ath10k: fix peer limit enforcement

commit e04cafbc38c70af2aad3810ce24ab0eba8114779 upstream.

Firmware peer entries are involved in internal
firmware vdev structures. This was not accounted
for and could lead firmware to crash due to asking
it to do more than it could.

Fixes: 039a0051ec1a ("ath10k: allocate fw resources for iface combinations")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 79da25c1c75f42b37742890c6fff5d883dc701dd..83ced9629327d4805a55a3ab5f661049a86aacbe 100644 (file)
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -591,11 +591,19 @@ ath10k_mac_get_any_chandef_iter(struct ieee80211_hw *hw,
 static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr,
                              enum wmi_peer_type peer_type)
 {
+       struct ath10k_vif *arvif;
+       int num_peers = 0;
        int ret;
 
        lockdep_assert_held(&ar->conf_mutex);
 
-       if (ar->num_peers >= ar->max_num_peers)
+       num_peers = ar->num_peers;
+
+       /* Each vdev consumes a peer entry as well */
+       list_for_each_entry(arvif, &ar->arvifs, list)
+               num_peers++;
+
+       if (num_peers >= ar->max_num_peers)
                return -ENOBUFS;
 
        ret = ath10k_wmi_peer_create(ar, vdev_id, addr, peer_type);
@@ -4061,6 +4069,11 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                       sizeof(arvif->bitrate_mask.control[i].vht_mcs));
        }
 
+       if (ar->num_peers >= ar->max_num_peers) {
+               ath10k_warn(ar, "refusing vdev creation due to insufficient peer entry resources in firmware\n");
+               return -ENOBUFS;
+       }
+
        if (ar->free_vdev_map == 0) {
                ath10k_warn(ar, "Free vdev map is empty, no more interfaces allowed.\n");
                ret = -EBUSY;