[DragonFlyBSD - Bug #3449] iwm(4): mask closed_rb_num to the RX ring size

[sigttou]

Issue #3449 has been updated by sigttou.

File 0003-iwm-4-mask-closed_rb_num-to-the-RX-ring-size-v2.patch added

See 5eae443eb5e2 in Linux and 3287dca4fa10 in OpenBSD.

----------------------------------------
Bug #3449: iwm(4): mask closed_rb_num to the RX ring size
http://bugs.dragonflybsd.org/issues/3449#change-14848

* Author: sigttou
* Status: New
* Priority: Normal
* Target version: 6.6
* Start date: 2026-10-16
----------------------------------------
@iwm_notif_intr()@ reads @hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff@ and loops @while(sc->rxq.cur != hw)@ without masking @hw@ to the ring size (512 entries for 9000-series MQ RX, 256 for legacy). If the device reports a value at or above the ring size, @cur@ never equals @hw@: the loop walks stale buffers indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi masks (@r &= (rxq->queue\_size − 1)@) and OpenBSD iwm/iwx use @hw &= (count − 1)@.

Change: Mask the value before the loop: @hw &= (count − 1)@, as Linux and OpenBSD do.

---Files--------------------------------
0003-iwm-4-mask-closed_rb_num-to-the-RX-ring-size.patch (1.07 KB)
0003-iwm-4-mask-closed_rb_num-to-the-RX-ring-size-v2.patch (1.02 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account