[PATCH wireless-next 1/3] wifi: brcmfmac: pcie: stop console read on invalid write index

[PATCH wireless-next 1/3] wifi: brcmfmac: pcie: stop console read on invalid write index

[Soeren Coremans]

When the device drops off the bus, MMIO reads return all ones. The
console write index then never matches read_idx, which wraps at
bufsize, so brcmf_pcie_bus_console_read() loops forever and floods the
kernel log with 0xff characters at several thousand lines per second.

Seen on a BCM4366 after a firmware trap followed by a fatal PCIe error
(FCP): the reset path and the failed dongle setup both entered the loop
and never reached device_release_driver().

Return early when the write index lies outside the console buffer.

Found and written with the help of an AI coding assistant (Claude Opus
5.5); the cover letter describes how.

Fixes: 9e37f045d5e7 ("brcmfmac: Adding PCIe bus layer support.")
Cc: stable@vger.kernel.org
Signed-off-by: Soeren Coremans <sorencoremans@gmail.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index eca5f5f63bce..02c58de67b82 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -992,6 +992,14 @@ static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo,
 		return;
 	addr = console->base_addr + BRCMF_CONSOLE_WRITEIDX_OFFSET;
 	newidx = brcmf_pcie_read_tcm32(devinfo, addr);
+	/* A dead device reads back as all ones, an index read_idx never
+	 * reaches; without this check the loop below never terminates.
+	 */
+	if (newidx >= console->bufsize) {
+		brcmf_dbg(PCIE, "invalid console write index %u (bufsize %u)\n",
+			  newidx, console->bufsize);
+		return;
+	}
 	while (newidx != console->read_idx) {
 		addr = console->buf_addr + console->read_idx;
 		ch = brcmf_pcie_read_tcm8(devinfo, addr);
-- 
2.53.0