lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 407/459] rtw88: fix potential NULL skb access in TX ISR
    Date
    From: Yan-Hsuan Chuang <yhchuang@realtek.com>

    [ Upstream commit f4f84ff8377d4cedf18317747bc407b2cf657d0f ]

    Sometimes the TX queue may be empty and we could possible
    dequeue a NULL pointer, crash the kernel. If the skb is NULL
    then there is nothing to do, just leave the ISR.

    And the TX queue should not be empty here, so print an error
    to see if there is anything wrong for DMA ring.

    Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
    Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
    index d90928be663b9..77a2bdee50fa7 100644
    --- a/drivers/net/wireless/realtek/rtw88/pci.c
    +++ b/drivers/net/wireless/realtek/rtw88/pci.c
    @@ -762,6 +762,11 @@ static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,

    while (count--) {
    skb = skb_dequeue(&ring->queue);
    + if (!skb) {
    + rtw_err(rtwdev, "failed to dequeue %d skb TX queue %d, BD=0x%08x, rp %d -> %d\n",
    + count, hw_queue, bd_idx, ring->r.rp, cur_rp);
    + break;
    + }
    tx_data = rtw_pci_get_tx_data(skb);
    pci_unmap_single(rtwpci->pdev, tx_data->dma, skb->len,
    PCI_DMA_TODEVICE);
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 17:12    [W:4.133 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site