Search Linux Wireless

RE: rtw89: array-index-out-of-bounds in rtw89_pci_release_rpp()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dominique Martinet <asmadeus@xxxxxxxxxxxxx> wrote:
> On my machine I sometimes get a kernel panic when the wireless driver
> crashes (fw dump)

By the log, firmware did detect hardware abnormal and reset it, but somehow
hardware still can't work properly. Driver got wrong data and threw 
"Cannot map qsel to dma: 31" before UBSAN warning.

I guess at that moment, driver got wrong and unexpected value 0xffffffff. 

My suggestions are:

(1) The latest firmware of RTL8852BTE is 0.29.122.0. Please try it.

(2) To disable PCI ASPM is also worth to try:

   /etc/modprobe.d/70-rtw89.conf 
   options rtw89_pci disable_aspm_l1ss=y disable_aspm_l1=y disable_clkreq=y
   options rtw89_core disable_ps_mode=y

   After setup these options, you need to cold reboot your machine to
   make sure ASPM isn't enabled. Also, please check the setting via
   /sys/module/rtw89_pci/parameters/ after rebooting. 

(3) Another is to disable power save mode via
   sudo iw wlan0 set power_save off

   If this can work to you, you can add option to configuration file of
   network manager to disable it. 

> 
> The line in question would be this line:
> >        txwd = &wd_ring->pages[seq];
> (which matches as pages is an array of 512 rtw89_pci_tx_wd structs)
> 
> 
> Checking seq < RTW89_PCI_TXWD_NUM_MAX is trivial and I could send a
> patch, but if that data is really bogus I assume any local check could
> be fooled e.g. the data could be < 512 and still incorrect.

You're right. 






[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Wireless Regulations]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux