From patchwork Fri Feb 21 07:41:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 230795 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB21EC35640 for ; Fri, 21 Feb 2020 08:31:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AB82320637 for ; Fri, 21 Feb 2020 08:31:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1582273878; bh=KmtZZPuEoHO4gyd2nmECJTZBKi3nPgjlr6C/KvSZc3c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=vxfydtKhQt8IofjQJWxwBaawuby06jG454k89FTmenSkRlt/mOTbGgrk/iaewtSGi 3JEMQsacwLAQBxND5TadfAH+LStind3rEhxn39GELOrna41hH+gJUkq+uo8nhYOujx 5vnBUOUQVzsbk00yQ7eqc0vE8oZPDGbxK3nCwfkY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732691AbgBUION (ORCPT ); Fri, 21 Feb 2020 03:14:13 -0500 Received: from mail.kernel.org ([198.145.29.99]:50646 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732857AbgBUION (ORCPT ); Fri, 21 Feb 2020 03:14:13 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 80AEA24680; Fri, 21 Feb 2020 08:14:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1582272852; bh=KmtZZPuEoHO4gyd2nmECJTZBKi3nPgjlr6C/KvSZc3c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Fk/s1JDzdirQOzBwsCVtf6/t7r0BUTJfYIYAq3cmrP7ZNoNBTnNNneo6lgBc5Zb85 YGo9G7qJZf1eh6LeLnWxZXQJpazjEyxVvGwrZ3FL9XKWo0rmp7Cy6PYghWvU6AXBqV X750dATlmOhMsI1AHUZTCoCAemHPZj1PADXQs9Dg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yan-Hsuan Chuang , Kalle Valo , Sasha Levin Subject: [PATCH 5.4 300/344] rtw88: fix potential NULL skb access in TX ISR Date: Fri, 21 Feb 2020 08:41:39 +0100 Message-Id: <20200221072417.143055591@linuxfoundation.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200221072349.335551332@linuxfoundation.org> References: <20200221072349.335551332@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Yan-Hsuan Chuang [ Upstream commit f4f84ff8377d4cedf18317747bc407b2cf657d0f ] Sometimes the TX queue may be empty and we could possible dequeue a NULL pointer, crash the kernel. If the skb is NULL then there is nothing to do, just leave the ISR. And the TX queue should not be empty here, so print an error to see if there is anything wrong for DMA ring. Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin --- drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c index d90928be663b9..77a2bdee50fa7 100644 --- a/drivers/net/wireless/realtek/rtw88/pci.c +++ b/drivers/net/wireless/realtek/rtw88/pci.c @@ -762,6 +762,11 @@ static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci, while (count--) { skb = skb_dequeue(&ring->queue); + if (!skb) { + rtw_err(rtwdev, "failed to dequeue %d skb TX queue %d, BD=0x%08x, rp %d -> %d\n", + count, hw_queue, bd_idx, ring->r.rp, cur_rp); + break; + } tx_data = rtw_pci_get_tx_data(skb); pci_unmap_single(rtwpci->pdev, tx_data->dma, skb->len, PCI_DMA_TODEVICE);