From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 18 Apr 2011 16:22:10 +0000 (-0700)
Subject: iwlagn: verify that huge commands are synchronous
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=7b21f00ee6073909c01adeba317af3d78c3b9d0a;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git

iwlagn: verify that huge commands are synchronous

Since huge commands all share a single buffer,
there can only be a single one in flight at a
time since otherwise they'd overwrite each
other. This is true in the driver now, but it
seems like a possible source of bugs, so add
a test to verify that huge commands are always
sent synchronously.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
---

diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index e7faba57b6e3..1b69507db5fc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -470,6 +470,14 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 		return -EIO;
 	}
 
+	/*
+	 * As we only have a single huge buffer, check that the command
+	 * is synchronous (otherwise buffers could end up being reused).
+	 */
+
+	if (WARN_ON((cmd->flags & CMD_ASYNC) && (cmd->flags & CMD_SIZE_HUGE)))
+		return -EINVAL;
+
 	spin_lock_irqsave(&priv->hcmd_lock, flags);
 
 	if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {