mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Adrian Chadd
461da47e45
iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff and loops while (sc->rxq.cur != hw) without masking hw to the ring size (512 entries for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at or above the ring size, cur never equals hw: the loop walks stale ring entries indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi masks the value (5eae443eb5e2) and OpenBSD has done the same since 9000-series support was added (3287dca4fa10). This was found while debugging an iwm crash on another BSD using the same driver lineage (DragonFly, upstream bug 3449) Locally tested: * 7260, 9260, STA mode PR: kern/299427 Submitted by: David Bidner <[email protected]> Differential Revision: https://reviews.freebsd.org/D60824