array-index-out-of-bounds during resume from hibernate

[user-8472]

Observed a crash of driver during a resume from hibernate. The system was able to recover gracefully. Call Traces are attached. The designated (-->) lines below show the offending lines.

switch (rf_path) {                                                                                                                      
case RF_PATH_A:                                                                                                                         
    get_mix_mode_tx_agc_bb_swing_offset(dm, method, (enum rf_path)rf_path, tx_power_index_offest);                                      
    odm_set_bb_reg(dm, REG_A_TX_AGC, TXAGC_BITMASK, cali_info->absolute_ofdm_swing_idx[rf_path]);                                       
-->odm_set_bb_reg(dm, REG_A_BBSWING, BBSWING_BITMASK, tx_scaling_table_jaguar[cali_info->bb_swing_idx_ofdm[rf_path]]); /*set BBswing*/ 
    break;                                                                                                                              
                                                                                                                                        
case RF_PATH_B:                                                                                                                         
    get_mix_mode_tx_agc_bb_swing_offset(dm, method, (enum rf_path)rf_path, tx_power_index_offest);                                      
    odm_set_bb_reg(dm, REG_B_TX_AGC, TXAGC_BITMASK, cali_info->absolute_ofdm_swing_idx[rf_path]);                                       
-->odm_set_bb_reg(dm, REG_B_BBSWING, BBSWING_BITMASK, tx_scaling_table_jaguar[cali_info->bb_swing_idx_ofdm[rf_path]]); /*set BBswing*/ 
    break;                                                                                                                              
                                                                                                                                        
case RF_PATH_C:                                                                                                                         
    get_mix_mode_tx_agc_bb_swing_offset(dm, method, (enum rf_path)rf_path, tx_power_index_offest);                                      
    odm_set_bb_reg(dm, REG_C_TX_AGC, TXAGC_BITMASK, cali_info->absolute_ofdm_swing_idx[rf_path]);                                       
-->odm_set_bb_reg(dm, REG_C_BBSWING, BBSWING_BITMASK, tx_scaling_table_jaguar[cali_info->bb_swing_idx_ofdm[rf_path]]); /*set BBswing*/ 
    break;                                                                                                                              
                                                                                                                                        
case RF_PATH_D:                                                                                                                         
    get_mix_mode_tx_agc_bb_swing_offset(dm, method, (enum rf_path)rf_path, tx_power_index_offest);                                      
    odm_set_bb_reg(dm, REG_D_TX_AGC, TXAGC_BITMASK, cali_info->absolute_ofdm_swing_idx[rf_path]);                                       
-->odm_set_bb_reg(dm, REG_D_BBSWING, BBSWING_BITMASK, tx_scaling_table_jaguar[cali_info->bb_swing_idx_ofdm[rf_path]]); /*set BBswing*/ 
    break;                                                                                                                              
                                                                                                                                        
default:                                                                                                                                
    RF_DBG(dm, DBG_RF_TX_PWR_TRACK,                                                                                                     
           "Wrong path name!!!!\n");                                                                                                    
    break;                                                                                                                              
}                                                                                                                                       

array-index-out-of-bounds.8814.txt

[morrownr]

Hi @user-8472

I'm too busy to take a look this week but maybe next week. This is a subject where I don't have a lot of knowledge and I don't test the drivers here with hibernation. Maybe someone else with more knowledge will come along.

@morrownr