There is a warning when mvm->aux_queue is equal to IWL_MVM_INVALID_QUEUE:
[ 5.225765] ================================================================================
[ 5.225770] UBSAN: shift-out-of-bounds in drivers/net/wireless/intel/iwlwifi/mvm/sta.c:2096:53
[ 5.225773] shift exponent 65535 is too large for 64-bit type 'long unsigned int'
[ 5.225777] Call Trace:
[ 5.225779] <TASK>
[ 5.225781] dump_stack_lvl+0x4a/0x5f
[ 5.225785] dump_stack+0x10/0x12
[ 5.225786] ubsan_epilogue+0x9/0x45
[ 5.225787] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e
[ 5.225790] iwl_mvm_add_aux_sta.cold+0x17/0x1f [iwlmvm]
[ 5.225804] iwl_mvm_up+0x76c/0xb90 [iwlmvm]
[ 5.225814] __iwl_mvm_mac_start+0x2b/0x190 [iwlmvm]
[ 5.225821] iwl_mvm_mac_start+0x5f/0xc0 [iwlmvm]
...
[ 5.225952] ? _copy_from_user+0x2b/0x60
[ 5.225979] __x64_sys_sendmsg+0x1f/0x30
[ 5.225980] do_syscall_64+0x59/0xc0
[ 5.225982] ? syscall_exit_to_user_mode+0x27/0x50
[ 5.225984] ? __x64_sys_write+0x1a/0x20
[ 5.225985] ? do_syscall_64+0x69/0xc0
[ 5.225986] ? __x64_sys_write+0x1a/0x20
[ 5.225987] ? do_syscall_64+0x69/0xc0
[ 5.225988] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 5.225990] RIP: 0033:0x7fa42e00b18d
[ 5.225993] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48
[ 5.225994] RSP: 002b:00007fffba9a21c0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
[ 5.225996] RAX: ffffffffffffffda RBX: 0000562bdc028880 RCX: 00007fa42e00b18d
[ 5.225996] RDX: 0000000000000000 RSI: 00007fffba9a2210 RDI: 000000000000000c
[ 5.225997] RBP: 00007fffba9a2210 R08: 0000000000000000 R09: 0000000000000000
[ 5.225998] R10: 0000562bdbffa010 R11: 0000000000000293 R12: 0000562bdc028880
[ 5.225998] R13: 00007fffba9a23c8 R14: 00007fffba9a23bc R15: 0000000000000000
[ 5.225999] </TASK>
[ 5.226004] ================================================================================
mvm->aux_queue may be assigned IWL_MVM_INVALID_QUEUE in
iwl_op_mode_mvm_start().
Add iwl_mvm_has_new_tx_api() before iwl_mvm_allocate_int_sta() to avoid
shift-out-of-bounds.
Fixes: c6ce1c74ef29 ("iwlwifi: mvm: avoid static queue number aliasing")
Signed-off-by: Yajun Deng <yajun.deng@xxxxxxxxx>
---
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index cbd8053a9e35..33e2757e6fe6 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2088,12 +2088,14 @@ static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx,
int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm, u32 lmac_id)
{
+ u32 qmask;
int ret;
lockdep_assert_held(&mvm->mutex);
+ qmask = iwl_mvm_has_new_tx_api(mvm) ? 0 : BIT(mvm->aux_queue);
/* Allocate aux station and assign to it the aux queue */
- ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, BIT(mvm->aux_queue),
+ ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, qmask,
NL80211_IFTYPE_UNSPECIFIED,
IWL_STA_AUX_ACTIVITY);
if (ret)
--
2.25.1
