Alex Elder 8d7b0b22ea net: ipa: compute DMA pool size properly ... [ Upstream commit 6c75dc94f2 ] In gsi_trans_pool_init_dma(), the total size of a pool of memory used for DMA transactions is calculated. However the calculation is done incorrectly. For 4KB pages, this total size is currently always more than one page, and as a result, the calculation produces a positive (though incorrect) total size. The code still works in this case; we just end up with fewer DMA pool entries than we intended. Bjorn Andersson tested booting a kernel with 16KB pages, and hit a null pointer derereference in sg_alloc_append_table_from_pages(), descending from gsi_trans_pool_init_dma(). The cause of this was that a 16KB total size was going to be allocated, and with 16KB pages the order of that allocation is 0. The total_size calculation yielded 0, which eventually led to the crash. Correcting the total_size calculation fixes the problem. Reported-by: Bjorn Andersson <quic_bjorande@quicinc.com> Tested-by: Bjorn Andersson <quic_bjorande@quicinc.com> Fixes: 9dd441e4ed ("soc: qcom: ipa: GSI transactions") Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Alex Elder <elder@linaro.org> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-04-05 11:24:57 +02:00
..
Kconfig	net: ipa: fix a build dependency	2022-04-20 09:34:21 +02:00
Makefile	…
gsi.c	net: ipa: record proper RX transaction count	2022-05-25 09:57:30 +02:00
gsi.h	…
gsi_private.h	…
gsi_reg.h	…
gsi_trans.c	net: ipa: compute DMA pool size properly	2023-04-05 11:24:57 +02:00
gsi_trans.h	…
ipa.h	…
ipa_cmd.c	…
ipa_cmd.h	…
ipa_data-v3.1.c	…
ipa_data-v3.5.1.c	…
ipa_data-v4.2.c	…
ipa_data-v4.5.c	…
ipa_data-v4.9.c	…
ipa_data-v4.11.c	…
ipa_data.h	…
ipa_endpoint.c	net: ipa: fix page free in ipa_endpoint_replenish_one()	2022-06-09 10:23:30 +02:00
ipa_endpoint.h	net: ipa: prevent concurrent replenish	2022-02-05 12:38:56 +01:00
ipa_gsi.c	…
ipa_gsi.h	…
ipa_interrupt.c	net: ipa: disable ipa interrupt during suspend	2023-02-01 08:27:11 +01:00
ipa_interrupt.h	net: ipa: disable ipa interrupt during suspend	2023-02-01 08:27:11 +01:00
ipa_main.c	…
ipa_mem.c	net: ipa: don't assume SMEM is page-aligned	2022-08-31 17:16:39 +02:00
ipa_mem.h	…
ipa_modem.c	…
ipa_modem.h	…
ipa_power.c	net: ipa: disable ipa interrupt during suspend	2023-02-01 08:27:11 +01:00
ipa_power.h	net: ipa: request IPA register values be retained	2022-04-20 09:34:05 +02:00
ipa_qmi.c	net: ipa: properly limit modem routing table use	2022-09-28 11:11:50 +02:00
ipa_qmi.h	…
ipa_qmi_msg.c	net: ipa: properly limit modem routing table use	2022-09-28 11:11:50 +02:00
ipa_qmi_msg.h	net: ipa: properly limit modem routing table use	2022-09-28 11:11:50 +02:00
ipa_reg.c	…
ipa_reg.h	…
ipa_resource.c	…
ipa_resource.h	…
ipa_smp2p.c	…
ipa_smp2p.h	…
ipa_sysfs.c	…
ipa_sysfs.h	…
ipa_table.c	net: ipa: properly limit modem routing table use	2022-09-28 11:11:50 +02:00
ipa_table.h	net: ipa: properly limit modem routing table use	2022-09-28 11:11:50 +02:00
ipa_uc.c	net: ipa: request IPA register values be retained	2022-04-20 09:34:05 +02:00
ipa_uc.h	…
ipa_version.h	…