diff options
| author | Adrian Chadd <adrian@FreeBSD.org> | 2026-10-17 21:32:51 +0000 |
|---|---|---|
| committer | Adrian Chadd <adrian@FreeBSD.org> | 2026-10-17 21:32:51 +0000 |
| commit | 461da47e45e7f8ef8754875f4820d3855e7f4097 (patch) | |
| tree | 3cc6f5d77125f0ccbacff435fa3b08292f0b3f6f /lib/libsys/__vdso_gettimeofday.c | |
| parent | 176fd23c88e8f7e3736389547c4a2990736911e7 (diff) | |
iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff and
loops while (sc->rxq.cur != hw) without masking hw to the ring size (512 entries
for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at or
above the ring size, cur never equals hw: the loop walks stale ring entries
indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi
masks the value (5eae443eb5e2) and OpenBSD has done the same since 9000-series
support was added (3287dca4fa10).
This was found while debugging an iwm crash on another BSD using the same
driver lineage (DragonFly, upstream bug 3449)
Locally tested:
* 7260, 9260, STA mode
PR: kern/299427
Submitted by: David Bidner <david@crap.solutions>
Differential Revision: https://reviews.freebsd.org/D60824
Diffstat (limited to 'lib/libsys/__vdso_gettimeofday.c')
0 files changed, 0 insertions, 0 deletions