From: Arend van Spriel <arend@broadcom.com>
To: Emil Goode <emilgoode@gmail.com>
Cc: Brett Rudley <brudley@broadcom.com>,
"Franky (Zhenhui) Lin" <frankyl@broadcom.com>,
Hante Meuleman <meuleman@broadcom.com>,
"John W. Linville" <linville@tuxdriver.com>,
Pieter-Paul Giesberts <pieterpg@broadcom.com>,
Daniel Kim <dekim@broadcom.com>,
linux-wireless@vger.kernel.org, brcm80211-dev-list@broadcom.com,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] brcmfmac: Fix off by one bug in brcmf_count_20mhz_channels()
Date: Tue, 23 Sep 2014 09:33:04 +0000 [thread overview]
Message-ID: <54213E50.4020207@broadcom.com> (raw)
In-Reply-To: <20140922230833.GB10356@lianli>
On 09/23/14 01:08, Emil Goode wrote:
> Hello Arend,
>
> Sorry for the late reply. I have attached a kernel log with brcmfmac
> debugging enabled (without my patch applied).
>
> Let me know if I can provide any other useful information.
No problem, Emil
I was wondering what was returned on "chanspecs" query. So 17 channel
configs which is expected.
Regards,
Arend
> Best regards,
>
> Emil
>
> On Mon, Sep 22, 2014 at 11:56:43AM +0200, Arend van Spriel wrote:
>> On 09/21/14 00:58, Emil Goode wrote:
>>> In the brcmf_count_20mhz_channels function we are looping through a list
>>> of channels received from firmware. Since the index of the first channel
>>> is 0 the condition leads to an off by one bug. This is causing us to hit
>>> the WARN_ON_ONCE(1) calls in the brcmu_d11n_decchspec function, which is
>>> how I discovered the bug.
>>
>> The fix is fine. Would like to know what exactly is going wrong. Can you
>> provide a kernel log with brcmfmac debugging enabled, ie. insmod brcmfmac.ko
>> debug=0x1416
>>
>> Regards,
>> Arend
>>
>>> Introduced by:
>>> commit b48d891676f756d48b4d0ee131e4a7a5d43ca417
>>> ("brcmfmac: rework wiphy structure setup")
>>>
>>> Signed-off-by: Emil Goode<emilgoode@gmail.com>
>>> ---
>>> drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
>>> index 02fe706..93b5dd9 100644
>>> --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
>>> +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
>>> @@ -4918,7 +4918,7 @@ static void brcmf_count_20mhz_channels(struct brcmf_cfg80211_info *cfg,
>>> struct brcmu_chan ch;
>>> int i;
>>>
>>> - for (i = 0; i<= total; i++) {
>>> + for (i = 0; i< total; i++) {
>>> ch.chspec = (u16)le32_to_cpu(chlist->element[i]);
>>> cfg->d11inf.decchspec(&ch);
>>>
>>
WARNING: multiple messages have this Message-ID (diff)
From: Arend van Spriel <arend@broadcom.com>
To: Emil Goode <emilgoode@gmail.com>
Cc: Brett Rudley <brudley@broadcom.com>,
"Franky (Zhenhui) Lin" <frankyl@broadcom.com>,
Hante Meuleman <meuleman@broadcom.com>,
"John W. Linville" <linville@tuxdriver.com>,
Pieter-Paul Giesberts <pieterpg@broadcom.com>,
Daniel Kim <dekim@broadcom.com>, <linux-wireless@vger.kernel.org>,
<brcm80211-dev-list@broadcom.com>, <netdev@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH] brcmfmac: Fix off by one bug in brcmf_count_20mhz_channels()
Date: Tue, 23 Sep 2014 11:33:04 +0200 [thread overview]
Message-ID: <54213E50.4020207@broadcom.com> (raw)
In-Reply-To: <20140922230833.GB10356@lianli>
On 09/23/14 01:08, Emil Goode wrote:
> Hello Arend,
>
> Sorry for the late reply. I have attached a kernel log with brcmfmac
> debugging enabled (without my patch applied).
>
> Let me know if I can provide any other useful information.
No problem, Emil
I was wondering what was returned on "chanspecs" query. So 17 channel
configs which is expected.
Regards,
Arend
> Best regards,
>
> Emil
>
> On Mon, Sep 22, 2014 at 11:56:43AM +0200, Arend van Spriel wrote:
>> On 09/21/14 00:58, Emil Goode wrote:
>>> In the brcmf_count_20mhz_channels function we are looping through a list
>>> of channels received from firmware. Since the index of the first channel
>>> is 0 the condition leads to an off by one bug. This is causing us to hit
>>> the WARN_ON_ONCE(1) calls in the brcmu_d11n_decchspec function, which is
>>> how I discovered the bug.
>>
>> The fix is fine. Would like to know what exactly is going wrong. Can you
>> provide a kernel log with brcmfmac debugging enabled, ie. insmod brcmfmac.ko
>> debug=0x1416
>>
>> Regards,
>> Arend
>>
>>> Introduced by:
>>> commit b48d891676f756d48b4d0ee131e4a7a5d43ca417
>>> ("brcmfmac: rework wiphy structure setup")
>>>
>>> Signed-off-by: Emil Goode<emilgoode@gmail.com>
>>> ---
>>> drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
>>> index 02fe706..93b5dd9 100644
>>> --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
>>> +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
>>> @@ -4918,7 +4918,7 @@ static void brcmf_count_20mhz_channels(struct brcmf_cfg80211_info *cfg,
>>> struct brcmu_chan ch;
>>> int i;
>>>
>>> - for (i = 0; i<= total; i++) {
>>> + for (i = 0; i< total; i++) {
>>> ch.chspec = (u16)le32_to_cpu(chlist->element[i]);
>>> cfg->d11inf.decchspec(&ch);
>>>
>>
next prev parent reply other threads:[~2014-09-23 9:33 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-20 22:58 [PATCH] brcmfmac: Fix off by one bug in brcmf_count_20mhz_channels() Emil Goode
2014-09-20 22:58 ` Emil Goode
2014-09-20 22:58 ` Emil Goode
2014-09-22 9:49 ` Arend van Spriel
2014-09-22 9:49 ` Arend van Spriel
2014-09-22 22:38 ` Emil Goode
2014-09-22 22:38 ` Emil Goode
2014-09-22 9:56 ` Arend van Spriel
2014-09-22 9:56 ` Arend van Spriel
2014-09-22 23:08 ` Emil Goode
2014-09-22 23:08 ` Emil Goode
2014-09-23 9:33 ` Arend van Spriel [this message]
2014-09-23 9:33 ` Arend van Spriel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54213E50.4020207@broadcom.com \
--to=arend@broadcom.com \
--cc=brcm80211-dev-list@broadcom.com \
--cc=brudley@broadcom.com \
--cc=dekim@broadcom.com \
--cc=emilgoode@gmail.com \
--cc=frankyl@broadcom.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=meuleman@broadcom.com \
--cc=netdev@vger.kernel.org \
--cc=pieterpg@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.