lkml.org 
[lkml]   [2021]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.10 20/25] iwlwifi: queue: bail out on invalid freeing
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    [ Upstream commit 0bed6a2a14afaae240cc431e49c260568488b51c ]

    If we find an entry without an SKB, we currently continue, but
    that will just result in an infinite loop since we won't increment
    the read pointer, and will try the same thing over and over again.
    Fix this.

    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/iwlwifi.20210122144849.abe2dedcc3ac.Ia6b03f9eeb617fd819e56dd5376f4bb8edc7b98a@changeid
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/intel/iwlwifi/queue/tx.c | 6 ++----
    1 file changed, 2 insertions(+), 4 deletions(-)

    diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.c b/drivers/net/wireless/intel/iwlwifi/queue/tx.c
    index af0b27a68d84d..9181221a2434d 100644
    --- a/drivers/net/wireless/intel/iwlwifi/queue/tx.c
    +++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.c
    @@ -887,10 +887,8 @@ void iwl_txq_gen2_unmap(struct iwl_trans *trans, int txq_id)
    int idx = iwl_txq_get_cmd_index(txq, txq->read_ptr);
    struct sk_buff *skb = txq->entries[idx].skb;

    - if (WARN_ON_ONCE(!skb))
    - continue;
    -
    - iwl_txq_free_tso_page(trans, skb);
    + if (!WARN_ON_ONCE(!skb))
    + iwl_txq_free_tso_page(trans, skb);
    }
    iwl_txq_gen2_free_tfd(trans, txq);
    txq->read_ptr = iwl_txq_inc_wrap(trans, txq->read_ptr);
    --
    2.27.0
    \
     
     \ /
      Last update: 2021-02-02 16:15    [W:2.765 / U:1.292 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site