Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2415fc16 authored Nov 08, 2013 by Michal Kazior Committed by Kalle Valo Nov 12, 2013

ath10k: guard against CE corruption from firmware



In case firmware crashes it may report CE
completions for entries that were never
submitted/filled with meaningful data. This in
turn led to NULL dereferences.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

parent 28642f42

drivers/net/wireless/ath/ath10k/htc.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -191,6 +191,11 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
		struct ath10k_htc *htc = &ar->htc;
		struct ath10k_htc_ep *ep = &htc->endpoint[eid];

		if (!skb) {
		ath10k_warn("invalid sk_buff completion - NULL pointer. firmware crashed?\n");
		return 0;
		}

		ath10k_htc_notify_tx_completion(ep, skb);
		/* the skb now belongs to the completion handler */

drivers/net/wireless/ath/ath10k/pci.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -1270,6 +1270,13 @@ static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
		* Indicate the completion to higer layer to free
		* the buffer
		*/

		if (!netbuf) {
		ath10k_warn("invalid sk_buff on CE %d - NULL pointer. firmware crashed?\n",
		ce_hdl->id);
		continue;
		}

		ATH10K_SKB_CB(netbuf)->is_aborted = true;
		ar_pci->msg_callbacks_current.tx_completion(ar,
		netbuf,