Commit fd2eab38 authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Zhang Changzhong
Browse files

wifi: iwlwifi: mvm: pause TCM when the firmware is stopped 

mainline inclusion
from mainline-v6.11-rc6
commit 0668ebc8c2282ca1e7eb96092a347baefffb5fe7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU87
CVE: CVE-2024-47673

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0668ebc8c2282ca1e7eb96092a347baefffb5fe7



--------------------------------

Not doing so will make us send a host command to the transport while the
firmware is not alive, which will trigger a WARNING.

bad state = 0
WARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]
RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]
Call Trace:
 <TASK>
 iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm]
 iwl_mvm_config_scan+0x198/0x260 [iwlmvm]
 iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm]
 iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm]
 process_one_work+0x29e/0x640
 worker_thread+0x2df/0x690
 ? rescuer_thread+0x540/0x540
 kthread+0x192/0x1e0
 ? set_kthread_struct+0x90/0x90
 ret_from_fork+0x22/0x30

Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.5abe71ca1b6b.I97a968cb8be1f24f94652d9b110ecbf6af73f89e@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent 635a4d10

drivers/net/wireless/intel/iwlwifi/mvm/ops.c

+2 −0
Original line number Diff line number Diff line
@@ -910,6 +910,8 @@ void iwl_mvm_stop_device(struct iwl_mvm *mvm) 


	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);



	iwl_mvm_pause_tcm(mvm, false);



	iwl_fw_dbg_stop_sync(&mvm->fwrt);

	iwl_trans_stop_device(mvm->trans);

	iwl_free_fw_paging(&mvm->fwrt);