Commit 0f8d5656 authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Kalle Valo

iwlwifi: queue: don't crash if txq->entries is NULL

The code was really awkward, we would first dereference
txq->entries when calling iwl_txq_genX_tfd_unmap and then
we would check that txq->entries is non-NULL.
Fix that by exiting if txq->entries is NULL.
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20210115130252.173359fc236d.I75c7c2397d20df8d7fbc24cb16a5232d5c551889@changeid
parent a800f958
...@@ -142,16 +142,16 @@ void iwl_txq_gen2_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq) ...@@ -142,16 +142,16 @@ void iwl_txq_gen2_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
* idx is bounded by n_window * idx is bounded by n_window
*/ */
int idx = iwl_txq_get_cmd_index(txq, txq->read_ptr); int idx = iwl_txq_get_cmd_index(txq, txq->read_ptr);
struct sk_buff *skb;
lockdep_assert_held(&txq->lock); lockdep_assert_held(&txq->lock);
if (!txq->entries)
return;
iwl_txq_gen2_tfd_unmap(trans, &txq->entries[idx].meta, iwl_txq_gen2_tfd_unmap(trans, &txq->entries[idx].meta,
iwl_txq_get_tfd(trans, txq, idx)); iwl_txq_get_tfd(trans, txq, idx));
/* free SKB */
if (txq->entries) {
struct sk_buff *skb;
skb = txq->entries[idx].skb; skb = txq->entries[idx].skb;
/* Can be called from irqs-disabled context /* Can be called from irqs-disabled context
...@@ -162,7 +162,6 @@ void iwl_txq_gen2_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq) ...@@ -162,7 +162,6 @@ void iwl_txq_gen2_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
iwl_op_mode_free_skb(trans->op_mode, skb); iwl_op_mode_free_skb(trans->op_mode, skb);
txq->entries[idx].skb = NULL; txq->entries[idx].skb = NULL;
} }
}
} }
int iwl_txq_gen2_set_tb(struct iwl_trans *trans, struct iwl_tfh_tfd *tfd, int iwl_txq_gen2_set_tb(struct iwl_trans *trans, struct iwl_tfh_tfd *tfd,
...@@ -1494,18 +1493,19 @@ void iwl_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq) ...@@ -1494,18 +1493,19 @@ void iwl_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
*/ */
int rd_ptr = txq->read_ptr; int rd_ptr = txq->read_ptr;
int idx = iwl_txq_get_cmd_index(txq, rd_ptr); int idx = iwl_txq_get_cmd_index(txq, rd_ptr);
struct sk_buff *skb;
lockdep_assert_held(&txq->lock); lockdep_assert_held(&txq->lock);
if (!txq->entries)
return;
/* We have only q->n_window txq->entries, but we use /* We have only q->n_window txq->entries, but we use
* TFD_QUEUE_SIZE_MAX tfds * TFD_QUEUE_SIZE_MAX tfds
*/ */
iwl_txq_gen1_tfd_unmap(trans, &txq->entries[idx].meta, txq, rd_ptr); iwl_txq_gen1_tfd_unmap(trans, &txq->entries[idx].meta, txq, rd_ptr);
/* free SKB */ /* free SKB */
if (txq->entries) {
struct sk_buff *skb;
skb = txq->entries[idx].skb; skb = txq->entries[idx].skb;
/* Can be called from irqs-disabled context /* Can be called from irqs-disabled context
...@@ -1516,7 +1516,6 @@ void iwl_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq) ...@@ -1516,7 +1516,6 @@ void iwl_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
iwl_op_mode_free_skb(trans->op_mode, skb); iwl_op_mode_free_skb(trans->op_mode, skb);
txq->entries[idx].skb = NULL; txq->entries[idx].skb = NULL;
} }
}
} }
void iwl_txq_progress(struct iwl_txq *txq) void iwl_txq_progress(struct iwl_txq *txq)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment