Commit 1caa3a5e authored Jun 20, 2023 by Johannes Berg

wifi: iwlwifi: pcie: add size assertions

Ensure that the TX command scratch fits into the buffer
provided by the first TB. It does, of course, but add
some build-time validations in case we touch this code.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230620125813.8f54f2990b92.If19a038dfd633d4601e3d44dd0ff678bc0a851e9@changeid

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 4742c732

drivers/net/wireless/intel/iwlwifi/pcie/tx.c

+4 −1

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
		/*
		* Copyright (C) 2003-2014, 2018-2021 Intel Corporation
		* Copyright (C) 2003-2014, 2018-2021, 2023 Intel Corporation
		* Copyright (C) 2013-2015 Intel Mobile Communications GmbH
		* Copyright (C) 2016-2017 Intel Deutschland GmbH
		*/
		@@ -1547,6 +1547,9 @@ int iwl_trans_pcie_tx(struct iwl_trans trans, struct sk_buff skb,

		/* there must be data left over for TB1 or this code must be changed */
		BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_FIRST_TB_SIZE);
		BUILD_BUG_ON(sizeof(struct iwl_cmd_header) +
		offsetofend(struct iwl_tx_cmd, scratch) >
		IWL_FIRST_TB_SIZE);

		/* map the data for TB1 */
		tb1_addr = ((u8 *)&dev_cmd->hdr) + IWL_FIRST_TB_SIZE;

drivers/net/wireless/intel/iwlwifi/queue/tx.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -648,6 +648,13 @@ struct iwl_tfh_tfd iwl_txq_gen2_build_tfd(struct iwl_trans trans,

		/* There must be data left over for TB1 or this code must be changed */
		BUILD_BUG_ON(sizeof(struct iwl_tx_cmd_gen2) < IWL_FIRST_TB_SIZE);
		BUILD_BUG_ON(sizeof(struct iwl_cmd_header) +
		offsetofend(struct iwl_tx_cmd_gen2, dram_info) >
		IWL_FIRST_TB_SIZE);
		BUILD_BUG_ON(sizeof(struct iwl_tx_cmd_gen3) < IWL_FIRST_TB_SIZE);
		BUILD_BUG_ON(sizeof(struct iwl_cmd_header) +
		offsetofend(struct iwl_tx_cmd_gen3, dram_info) >
		IWL_FIRST_TB_SIZE);

		memset(tfd, 0, sizeof(*tfd));