From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:43314 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1422627AbbJRCmG (ORCPT ); Sat, 17 Oct 2015 22:42:06 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michal Kazior , Kalle Valo Subject: [PATCH 4.2 184/258] ath10k: fix peer limit enforcement Date: Sat, 17 Oct 2015 18:58:17 -0700 Message-Id: <20151018014738.762950628@linuxfoundation.org> In-Reply-To: <20151018014729.976101177@linuxfoundation.org> References: <20151018014729.976101177@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: stable-owner@vger.kernel.org List-ID: 4.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Kazior commit e04cafbc38c70af2aad3810ce24ab0eba8114779 upstream. Firmware peer entries are involved in internal firmware vdev structures. This was not accounted for and could lead firmware to crash due to asking it to do more than it could. Fixes: 039a0051ec1a ("ath10k: allocate fw resources for iface combinations") Signed-off-by: Michal Kazior Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/ath/ath10k/mac.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -591,11 +591,19 @@ ath10k_mac_get_any_chandef_iter(struct i static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr, enum wmi_peer_type peer_type) { + struct ath10k_vif *arvif; + int num_peers = 0; int ret; lockdep_assert_held(&ar->conf_mutex); - if (ar->num_peers >= ar->max_num_peers) + num_peers = ar->num_peers; + + /* Each vdev consumes a peer entry as well */ + list_for_each_entry(arvif, &ar->arvifs, list) + num_peers++; + + if (num_peers >= ar->max_num_peers) return -ENOBUFS; ret = ath10k_wmi_peer_create(ar, vdev_id, addr, peer_type); @@ -4061,6 +4069,11 @@ static int ath10k_add_interface(struct i sizeof(arvif->bitrate_mask.control[i].vht_mcs)); } + if (ar->num_peers >= ar->max_num_peers) { + ath10k_warn(ar, "refusing vdev creation due to insufficient peer entry resources in firmware\n"); + return -ENOBUFS; + } + if (ar->free_vdev_map == 0) { ath10k_warn(ar, "Free vdev map is empty, no more interfaces allowed.\n"); ret = -EBUSY;