From: Mohammed Shafi Shajakhan <moham...@qca.qualcomm.com>
There is a possibility that AR_MCI_GPM_1 register can
return 0xdeadbeef and this results in caching of invalid
GPM index in ar9003_mci_is_gpm_valid. Ensure we
have appropriate checks to avoid this.
Cc: xijin luo <xi...@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <moham...@qca.qualcomm.com>
---
drivers/net/wireless/ath/ath9k/ar9003_mci.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mci.c
b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
index 9a34fca..995b866 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mci.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
@@ -1327,6 +1327,10 @@ u32 ar9003_mci_get_next_gpm_offset(struct ath_hw *ah,
bool first, u32 *more)
if (first) {
gpm_ptr = MS(REG_READ(ah, AR_MCI_GPM_1), AR_MCI_GPM_WRITE_PTR);
+
+ if (gpm_ptr >= mci->gpm_len)
+ gpm_ptr = 0;
+
mci->gpm_idx = gpm_ptr;
return gpm_ptr;
}
@@ -1371,6 +1375,10 @@ u32 ar9003_mci_get_next_gpm_offset(struct ath_hw *ah,
bool first, u32 *more)
more_gpm = MCI_GPM_NOMORE;
temp_index = mci->gpm_idx;
+
+ if (temp_index >= mci->gpm_len)
+ temp_index = 0;
+
mci->gpm_idx++;
if (mci->gpm_idx >= mci->gpm_len)
--
1.7.0.4
_______________________________________________
ath9k-devel mailing list
ath9k-devel@lists.ath9k.org
https://lists.ath9k.org/mailman/listinfo/ath9k-devel
