Return-path: Received: from mail-ob0-f176.google.com ([209.85.214.176]:33204 "EHLO mail-ob0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755249AbaLVRiP (ORCPT ); Mon, 22 Dec 2014 12:38:15 -0500 From: Larry Finger To: kvalo@codeaurora.org Cc: linux-wireless@vger.kernel.org, Larry Finger , netdev@vger.kernel.org, Eric Biggers , Stable Subject: [PATCH for 3.19] rtlwifi: Fix error when accessing unmapped memory in skb Date: Mon, 22 Dec 2014 11:37:06 -0600 Message-Id: <1419269826-12552-1-git-send-email-Larry.Finger@lwfinger.net> (sfid-20141222_183820_075444_027DB689) Sender: linux-wireless-owner@vger.kernel.org List-ID: Under heavy memory pressure, it is possible for the allocation of a new skb to fail. When this happens, the kernel gets a memory access violation. Previous versions of the drivers would drop the read request; however, this logic was missed in the 3.18 update. This patch restores the previous behavior. Reported-by: Eric Biggers Signed-off-by: Larry Finger Cc: Eric Biggers Cc: Stable [3.18] --- drivers/net/wireless/rtlwifi/pci.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c index 846a2e6..55334ca 100644 --- a/drivers/net/wireless/rtlwifi/pci.c +++ b/drivers/net/wireless/rtlwifi/pci.c @@ -912,13 +912,15 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) } end: if (rtlpriv->use_new_trx_flow) { - _rtl_pci_init_one_rxdesc(hw, (u8 *)buffer_desc, - rxring_idx, - rtlpci->rx_ring[rxring_idx].idx); + if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)buffer_desc, + rxring_idx, + rtlpci->rx_ring[rxring_idx].idx)) + return; } else { - _rtl_pci_init_one_rxdesc(hw, (u8 *)pdesc, rxring_idx, - rtlpci->rx_ring[rxring_idx].idx); - + if (!_rtl_pci_init_one_rxdesc(hw, (u8 *)pdesc, + rxring_idx, + rtlpci->rx_ring[rxring_idx].idx)) + return; if (rtlpci->rx_ring[rxring_idx].idx == rtlpci->rxringcount - 1) rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, -- 2.1.2