Patch "iwlwifi: pcie: fix access to scratch buffer" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

iwlwifi: pcie: fix access to scratch buffer

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
iwlwifi-pcie-fix-access-to-scratch-buffer.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Sara Sharon <[email protected]>
Date: Thu, 9 Jun 2016 17:19:35 +0300
Subject: iwlwifi: pcie: fix access to scratch buffer

From: Sara Sharon <[email protected]>

commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream.

This fixes a pretty ancient bug that hasn't manifested itself until now.
The scratchbuf for command queue is allocated only for 32 slots but is accessed with the queue write pointer - which can be up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs we never passed a page boundary when accessing the scratch buffer, but when attempting to increase the size of the scratch buffer a panic was quick to follow when trying to access the address resulted in a page boundary.

---
 drivers/net/wireless/intel/iwlwifi/pcie/tx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct
 
 	/* start the TFD with the scratchbuf */
 	scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
-	memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
+	memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
 	iwl_pcie_txq_build_tfd(trans, txq,
-			       iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
+			       iwl_pcie_get_scratchbuf_dma(txq, idx),
 			       scratch_size, true);
 
 	/* map first command fragment, if any remains */

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch