diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2011-04-18 18:22:10 +0200 |
|---|---|---|
| committer | Wey-Yi Guy <wey-yi.w.guy@intel.com> | 2011-04-18 18:23:45 +0200 |
| commit | 7b21f00ee6073909c01adeba317af3d78c3b9d0a (patch) | |
| tree | 9f9034e4fed2e1b8fd5647e890ca7ada353b4d44 | |
| parent | iwlagn: remove most BUG_ON instances (diff) | |
| download | linux-7b21f00ee6073909c01adeba317af3d78c3b9d0a.tar.xz linux-7b21f00ee6073909c01adeba317af3d78c3b9d0a.zip | |
iwlagn: verify that huge commands are synchronous
Since huge commands all share a single buffer,
there can only be a single one in flight at a
time since otherwise they'd overwrite each
other. This is true in the driver now, but it
seems like a possible source of bugs, so add
a test to verify that huge commands are always
sent synchronously.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| -rw-r--r-- | drivers/net/wireless/iwlwifi/iwl-tx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c index e7faba57b6e3..1b69507db5fc 100644 --- a/drivers/net/wireless/iwlwifi/iwl-tx.c +++ b/drivers/net/wireless/iwlwifi/iwl-tx.c @@ -470,6 +470,14 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd) return -EIO; } + /* + * As we only have a single huge buffer, check that the command + * is synchronous (otherwise buffers could end up being reused). + */ + + if (WARN_ON((cmd->flags & CMD_ASYNC) && (cmd->flags & CMD_SIZE_HUGE))) + return -EINVAL; + spin_lock_irqsave(&priv->hcmd_lock, flags); if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) { |