<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/net/wireless, branch v4.1.19</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>iwlwifi: pcie: properly configure the debug buffer size for 8000</title>
<updated>2016-02-03T19:01:44+00:00</updated>
<author>
<name>Emmanuel Grumbach</name>
<email>emmanuel.grumbach@intel.com</email>
</author>
<published>2016-01-05T13:25:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=d9d42b679e3653759b107ff99daf8da9c21aaec7'/>
<id>d9d42b679e3653759b107ff99daf8da9c21aaec7</id>
<content type='text'>
[ Upstream commit 62d7476d958ce06d7a10b02bdb30006870286fe2 ]

8000 device family has a new debug engine that needs to be
configured differently than 7000's.
The debug engine's DMA works in chunks of memory and the
size of the buffer really means the start of the last
chunk. Since one chunk is 256-byte long, we should
configure the device to write to buffer_size - 256.
This fixes a situation were the device would write to
memory it is not allowed to access.

CC: &lt;stable@vger.kernel.org&gt; [4.1+]
Signed-off-by: Emmanuel Grumbach &lt;emmanuel.grumbach@intel.com&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 62d7476d958ce06d7a10b02bdb30006870286fe2 ]

8000 device family has a new debug engine that needs to be
configured differently than 7000's.
The debug engine's DMA works in chunks of memory and the
size of the buffer really means the start of the last
chunk. Since one chunk is 256-byte long, we should
configure the device to write to buffer_size - 256.
This fixes a situation were the device would write to
memory it is not allowed to access.

CC: &lt;stable@vger.kernel.org&gt; [4.1+]
Signed-off-by: Emmanuel Grumbach &lt;emmanuel.grumbach@intel.com&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>iwlwifi: update and fix 7265 series PCI IDs</title>
<updated>2016-02-03T19:01:44+00:00</updated>
<author>
<name>Sasha Levin</name>
<email>sasha.levin@oracle.com</email>
</author>
<published>2016-02-01T20:02:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=01999150f50e945ee85914c37a1337784c1993c8'/>
<id>01999150f50e945ee85914c37a1337784c1993c8</id>
<content type='text'>
[ Upstream commit 006bda75d81fd27a583a3b310e9444fea2aa6ef2 ]

Update and fix some 7265 PCI IDs entries.

CC: &lt;stable@vger.kernel.org&gt; [3.13+]
Signed-off-by: Oren Givon &lt;oren.givon@intel.com&gt;
Signed-off-by: Emmanuel Grumbach &lt;emmanuel.grumbach@intel.com&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 006bda75d81fd27a583a3b310e9444fea2aa6ef2 ]

Update and fix some 7265 PCI IDs entries.

CC: &lt;stable@vger.kernel.org&gt; [3.13+]
Signed-off-by: Oren Givon &lt;oren.givon@intel.com&gt;
Signed-off-by: Emmanuel Grumbach &lt;emmanuel.grumbach@intel.com&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)</title>
<updated>2016-02-01T19:54:02+00:00</updated>
<author>
<name>Uri Mashiach</name>
<email>uri.mashiach@compulab.co.il</email>
</author>
<published>2015-12-24T14:05:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=34ed7459a09569f4b2dd8a549f420fac8c3619e0'/>
<id>34ed7459a09569f4b2dd8a549f420fac8c3619e0</id>
<content type='text'>
[ Upstream commit e47301b06d5a65678690f04c2248fd181db1e59a ]

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [&lt;00000000&gt;]    lr : [&lt;bf2581f0&gt;]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [&lt;bf2581f0&gt;] (wl12xx_set_power_on [wlcore]) from
[&lt;bf25f7ac&gt;] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [&lt;bf25f7ac&gt;] (wlcore_nvs_cb [wlcore]) from [&lt;c04387ec&gt;]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [&lt;c04387ec&gt;] (request_firmware_work_func) from
[&lt;c0058e2c&gt;] (process_one_work+0x1b4/0x4b4)
[   23.695591] [&lt;c0058e2c&gt;] (process_one_work) from [&lt;c0059168&gt;]
(worker_thread+0x3c/0x4a4)
[   23.704124] [&lt;c0059168&gt;] (worker_thread) from [&lt;c005ee68&gt;]
(kthread+0xd4/0xf0)
[   23.711747] [&lt;c005ee68&gt;] (kthread) from [&lt;c000f598&gt;]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach &lt;uri.mashiach@compulab.co.il&gt;
Cc: stable@vger.kernel.org
Acked-by: Igor Grinberg &lt;grinberg@compulab.co.il&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit e47301b06d5a65678690f04c2248fd181db1e59a ]

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [&lt;00000000&gt;]    lr : [&lt;bf2581f0&gt;]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [&lt;bf2581f0&gt;] (wl12xx_set_power_on [wlcore]) from
[&lt;bf25f7ac&gt;] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [&lt;bf25f7ac&gt;] (wlcore_nvs_cb [wlcore]) from [&lt;c04387ec&gt;]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [&lt;c04387ec&gt;] (request_firmware_work_func) from
[&lt;c0058e2c&gt;] (process_one_work+0x1b4/0x4b4)
[   23.695591] [&lt;c0058e2c&gt;] (process_one_work) from [&lt;c0059168&gt;]
(worker_thread+0x3c/0x4a4)
[   23.704124] [&lt;c0059168&gt;] (worker_thread) from [&lt;c005ee68&gt;]
(kthread+0xd4/0xf0)
[   23.711747] [&lt;c005ee68&gt;] (kthread) from [&lt;c000f598&gt;]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach &lt;uri.mashiach@compulab.co.il&gt;
Cc: stable@vger.kernel.org
Acked-by: Igor Grinberg &lt;grinberg@compulab.co.il&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rtlwifi: rtl_pci: Fix kernel panic</title>
<updated>2016-02-01T19:53:33+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2015-12-21T23:05:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e96bbdf82d1943c73af99d1a4e2ea9d140144983'/>
<id>e96bbdf82d1943c73af99d1a4e2ea9d140144983</id>
<content type='text'>
[ Upstream commit f99551a2d39dc26ea03dc6761be11ac913eb2d57 ]

In commit 38506ecefab9 (rtlwifi: rtl_pci: Start modification for new
drivers), a bug was introduced that causes a NULL pointer dereference.
As this bug only affects the infrequently used RTL8192EE and only under
low-memory conditions, it has taken a long time for the bug to show up.

The bug was reported on the linux-wireless mailing list and also at
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/ as
bug #1527603 (kernel crashes due to rtl8192ee driver on ubuntu 15.10).

Fixes: 38506ecefab9 ("rtlwifi: rtl_pci: Start modification for new drivers")
Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit f99551a2d39dc26ea03dc6761be11ac913eb2d57 ]

In commit 38506ecefab9 (rtlwifi: rtl_pci: Start modification for new
drivers), a bug was introduced that causes a NULL pointer dereference.
As this bug only affects the infrequently used RTL8192EE and only under
low-memory conditions, it has taken a long time for the bug to show up.

The bug was reported on the linux-wireless mailing list and also at
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/ as
bug #1527603 (kernel crashes due to rtl8192ee driver on ubuntu 15.10).

Fixes: 38506ecefab9 ("rtlwifi: rtl_pci: Start modification for new drivers")
Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rtlwifi: rtl8192cu: Add missing parameter setup</title>
<updated>2016-02-01T19:47:29+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2015-12-14T22:34:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=de944618d562173faaf27a853acb37ee85825682'/>
<id>de944618d562173faaf27a853acb37ee85825682</id>
<content type='text'>
[ Upstream commit b68d0ae7e58624c33f2eddab471fee55db27dbf9 ]

This driver fails to copy the module parameter for software encryption
to the locations used by the main code.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit b68d0ae7e58624c33f2eddab471fee55db27dbf9 ]

This driver fails to copy the module parameter for software encryption
to the locations used by the main code.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rtlwifi: rtl8192ce: Fix handling of module parameters</title>
<updated>2016-02-01T19:47:26+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2015-12-14T22:34:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0375ae541a81271fba5adf2b05adff1945cf3251'/>
<id>0375ae541a81271fba5adf2b05adff1945cf3251</id>
<content type='text'>
[ Upstream commit b24f19f16b9e43f54218c07609b783ea8625406a ]

The module parameter for software encryption was never transferred to
the location used by the driver.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit b24f19f16b9e43f54218c07609b783ea8625406a ]

The module parameter for software encryption was never transferred to
the location used by the driver.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rtlwifi: rtl8192se: Fix module parameter initialization</title>
<updated>2016-02-01T19:47:22+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2015-12-14T22:34:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=214e5cc67f9f5636b3272410f9ad0c151dafa0ac'/>
<id>214e5cc67f9f5636b3272410f9ad0c151dafa0ac</id>
<content type='text'>
[ Upstream commit 7503efbd82c15c4070adffff1344e5169d3634b4 ]

Two of the module parameter descriptions show incorrect default values.
In addition the value for software encryption is not transferred to
the locations used by the driver.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 7503efbd82c15c4070adffff1344e5169d3634b4 ]

Two of the module parameter descriptions show incorrect default values.
In addition the value for software encryption is not transferred to
the locations used by the driver.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rtlwifi: rtl8192de: Fix incorrect module parameter descriptions</title>
<updated>2016-02-01T19:47:19+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2015-12-14T22:34:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1a37aece44090c945a9b764e413b901863d32e86'/>
<id>1a37aece44090c945a9b764e413b901863d32e86</id>
<content type='text'>
[ Upstream commit d4d60b4caaa5926e1b243070770968f05656107a ]

Two of the module parameters are listed with incorrect default values.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit d4d60b4caaa5926e1b243070770968f05656107a ]

Two of the module parameters are listed with incorrect default values.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rtlwifi: rtl8188ee: Fix module parameter initialization</title>
<updated>2016-02-01T19:47:16+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2015-12-14T22:34:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=07493d2c6685b2e0a243f5dfda8cabbf581994d8'/>
<id>07493d2c6685b2e0a243f5dfda8cabbf581994d8</id>
<content type='text'>
[ Upstream commit 06f34572c6110e2e2d5e653a957f1d74db9e3f2b ]

In this driver, parameters disable_watchdog and sw_crypto are never
copied into the locations used in the main code. While modifying the
parameter handling, the copying of parameter msi_support is moved to
be with the rest.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 06f34572c6110e2e2d5e653a957f1d74db9e3f2b ]

In this driver, parameters disable_watchdog and sw_crypto are never
copied into the locations used in the main code. While modifying the
parameter handling, the copying of parameter msi_support is moved to
be with the rest.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wlcore/wl12xx: spi: fix oops on firmware load</title>
<updated>2016-02-01T16:37:29+00:00</updated>
<author>
<name>Uri Mashiach</name>
<email>uri.mashiach@compulab.co.il</email>
</author>
<published>2015-12-10T13:12:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=3d51d36e7148182e76fc36d66c494d192c410fdd'/>
<id>3d51d36e7148182e76fc36d66c494d192c410fdd</id>
<content type='text'>
[ Upstream commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 ]

The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len &gt; 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.

Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:

root@debian-armhf:~# ifconfig wlan0 up
[  294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[  294.320173] pgd = de528000
[  294.323028] [00203fc4] *pgd=00000000
[  294.326916] Internal error: Oops: 5 [#1] SMP ARM
[  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[  294.372236] PC is at __spi_validate+0xa8/0x2ac
[  294.376902] LR is at __spi_sync+0x78/0x210
[  294.381200] pc : [&lt;c049c760&gt;]    lr : [&lt;c049ebe0&gt;]    psr: 60000013
[  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
[  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
[  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
00203fbc
[  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
de3a9000
[  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment user
[  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
[  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[  294.432437] Stack: (0xde551998 to 0xde552000)

...

[  294.883613] [&lt;c049c760&gt;] (__spi_validate) from [&lt;c049ebe0&gt;]
(__spi_sync+0x78/0x210)
[  294.891670] [&lt;c049ebe0&gt;] (__spi_sync) from [&lt;bf036598&gt;]
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[  294.901661] [&lt;bf036598&gt;] (wl12xx_spi_raw_write [wlcore_spi]) from
[&lt;bf21c694&gt;] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[  294.914038] [&lt;bf21c694&gt;] (wlcore_boot_upload_firmware [wlcore]) from
[&lt;bf24532c&gt;] (wl12xx_boot+0xc10/0xfac [wl12xx])
[  294.925161] [&lt;bf24532c&gt;] (wl12xx_boot [wl12xx]) from [&lt;bf20d5cc&gt;]
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[  294.936364] [&lt;bf20d5cc&gt;] (wl1271_op_add_interface [wlcore]) from
[&lt;bf15c4ac&gt;] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[  294.947963] [&lt;bf15c4ac&gt;] (ieee80211_do_open [mac80211]) from
[&lt;c0537978&gt;] (__dev_open+0xa8/0x110)
[  294.957307] [&lt;c0537978&gt;] (__dev_open) from [&lt;c0537bf8&gt;]
(__dev_change_flags+0x88/0x148)
[  294.965713] [&lt;c0537bf8&gt;] (__dev_change_flags) from [&lt;c0537cd0&gt;]
(dev_change_flags+0x18/0x48)
[  294.974576] [&lt;c0537cd0&gt;] (dev_change_flags) from [&lt;c05a55a0&gt;]
(devinet_ioctl+0x6b4/0x7d0)
[  294.983191] [&lt;c05a55a0&gt;] (devinet_ioctl) from [&lt;c0517040&gt;]
(sock_ioctl+0x1e4/0x2bc)
[  294.991244] [&lt;c0517040&gt;] (sock_ioctl) from [&lt;c017d378&gt;]
(do_vfs_ioctl+0x420/0x6b0)
[  294.999208] [&lt;c017d378&gt;] (do_vfs_ioctl) from [&lt;c017d674&gt;]
(SyS_ioctl+0x6c/0x7c)
[  295.006880] [&lt;c017d674&gt;] (SyS_ioctl) from [&lt;c000f4c0&gt;]
(ret_fast_syscall+0x0/0x54)
[  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[  295.021544] ---[ end trace 66ed188198f4e24e ]---

Signed-off-by: Uri Mashiach &lt;uri.mashiach@compulab.co.il&gt;
Acked-by: Igor Grinberg &lt;grinberg@compulab.co.il&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 ]

The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len &gt; 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.

Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:

root@debian-armhf:~# ifconfig wlan0 up
[  294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[  294.320173] pgd = de528000
[  294.323028] [00203fc4] *pgd=00000000
[  294.326916] Internal error: Oops: 5 [#1] SMP ARM
[  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[  294.372236] PC is at __spi_validate+0xa8/0x2ac
[  294.376902] LR is at __spi_sync+0x78/0x210
[  294.381200] pc : [&lt;c049c760&gt;]    lr : [&lt;c049ebe0&gt;]    psr: 60000013
[  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
[  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
[  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
00203fbc
[  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
de3a9000
[  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment user
[  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
[  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[  294.432437] Stack: (0xde551998 to 0xde552000)

...

[  294.883613] [&lt;c049c760&gt;] (__spi_validate) from [&lt;c049ebe0&gt;]
(__spi_sync+0x78/0x210)
[  294.891670] [&lt;c049ebe0&gt;] (__spi_sync) from [&lt;bf036598&gt;]
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[  294.901661] [&lt;bf036598&gt;] (wl12xx_spi_raw_write [wlcore_spi]) from
[&lt;bf21c694&gt;] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[  294.914038] [&lt;bf21c694&gt;] (wlcore_boot_upload_firmware [wlcore]) from
[&lt;bf24532c&gt;] (wl12xx_boot+0xc10/0xfac [wl12xx])
[  294.925161] [&lt;bf24532c&gt;] (wl12xx_boot [wl12xx]) from [&lt;bf20d5cc&gt;]
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[  294.936364] [&lt;bf20d5cc&gt;] (wl1271_op_add_interface [wlcore]) from
[&lt;bf15c4ac&gt;] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[  294.947963] [&lt;bf15c4ac&gt;] (ieee80211_do_open [mac80211]) from
[&lt;c0537978&gt;] (__dev_open+0xa8/0x110)
[  294.957307] [&lt;c0537978&gt;] (__dev_open) from [&lt;c0537bf8&gt;]
(__dev_change_flags+0x88/0x148)
[  294.965713] [&lt;c0537bf8&gt;] (__dev_change_flags) from [&lt;c0537cd0&gt;]
(dev_change_flags+0x18/0x48)
[  294.974576] [&lt;c0537cd0&gt;] (dev_change_flags) from [&lt;c05a55a0&gt;]
(devinet_ioctl+0x6b4/0x7d0)
[  294.983191] [&lt;c05a55a0&gt;] (devinet_ioctl) from [&lt;c0517040&gt;]
(sock_ioctl+0x1e4/0x2bc)
[  294.991244] [&lt;c0517040&gt;] (sock_ioctl) from [&lt;c017d378&gt;]
(do_vfs_ioctl+0x420/0x6b0)
[  294.999208] [&lt;c017d378&gt;] (do_vfs_ioctl) from [&lt;c017d674&gt;]
(SyS_ioctl+0x6c/0x7c)
[  295.006880] [&lt;c017d674&gt;] (SyS_ioctl) from [&lt;c000f4c0&gt;]
(ret_fast_syscall+0x0/0x54)
[  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[  295.021544] ---[ end trace 66ed188198f4e24e ]---

Signed-off-by: Uri Mashiach &lt;uri.mashiach@compulab.co.il&gt;
Acked-by: Igor Grinberg &lt;grinberg@compulab.co.il&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Kalle Valo &lt;kvalo@codeaurora.org&gt;
Signed-off-by: Sasha Levin &lt;sasha.levin@oracle.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
