Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 034c5f26 authored by Yan-Hsuan Chuang's avatar Yan-Hsuan Chuang Committed by Greg Kroah-Hartman
Browse files

rtw88: fix potential NULL skb access in TX ISR 



[ Upstream commit f4f84ff8377d4cedf18317747bc407b2cf657d0f ]

Sometimes the TX queue may be empty and we could possible
dequeue a NULL pointer, crash the kernel. If the skb is NULL
then there is nothing to do, just leave the ISR.

And the TX queue should not be empty here, so print an error
to see if there is anything wrong for DMA ring.

Fixes: e3037485 ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: default avatarYan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e7e4d0ea

drivers/net/wireless/realtek/rtw88/pci.c

+5 −0
Original line number Diff line number Diff line
@@ -762,6 +762,11 @@ static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci, 


	while (count--) {

		skb = skb_dequeue(&ring->queue);

		if (!skb) {

			rtw_err(rtwdev, "failed to dequeue %d skb TX queue %d, BD=0x%08x, rp %d -> %d\n",

				count, hw_queue, bd_idx, ring->r.rp, cur_rp);

			break;

		}

		tx_data = rtw_pci_get_tx_data(skb);

		pci_unmap_single(rtwpci->pdev, tx_data->dma, skb->len,

				 PCI_DMA_TODEVICE);