lkml.org 
[lkml]   [2019]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 160/413] ath10k: add missing error handling
    Date
    [ Upstream commit 4b553f3ca4cbde67399aa3a756c37eb92145b8a1 ]

    In function ath10k_sdio_mbox_rx_alloc() [sdio.c],
    ath10k_sdio_mbox_alloc_rx_pkt() is called without handling the error cases.
    This will make the driver think the allocation for skb is successful and
    try to access the skb. If we enable failslab, system will easily crash with
    NULL pointer dereferencing.

    Call trace of CONFIG_FAILSLAB:
    ath10k_sdio_irq_handler+0x570/0xa88 [ath10k_sdio]
    process_sdio_pending_irqs+0x4c/0x174
    sdio_run_irqs+0x3c/0x64
    sdio_irq_work+0x1c/0x28

    Fixes: d96db25d2025 ("ath10k: add initial SDIO support")
    Signed-off-by: Claire Chang <tientzu@chromium.org>
    Reviewed-by: Brian Norris <briannorris@chromium.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath10k/sdio.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
    index fae56c67766f..73ef3e75d199 100644
    --- a/drivers/net/wireless/ath/ath10k/sdio.c
    +++ b/drivers/net/wireless/ath/ath10k/sdio.c
    @@ -602,6 +602,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar,
    full_len,
    last_in_bundle,
    last_in_bundle);
    + if (ret) {
    + ath10k_warn(ar, "alloc_rx_pkt error %d\n", ret);
    + goto err;
    + }
    }

    ar_sdio->n_rx_pkts = i;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-24 21:30    [W:4.058 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site