Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp368820pxb; Tue, 2 Feb 2021 07:16:15 -0800 (PST) X-Google-Smtp-Source: ABdhPJyqPUtEqbP69mn4jW0NQvP/BgK20bQfqvWtjowWq4UkE30zW/3EG5vtXEuQ9YTxjwERpT0y X-Received: by 2002:a17:906:390c:: with SMTP id f12mr11989238eje.31.1612278975084; Tue, 02 Feb 2021 07:16:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1612278975; cv=none; d=google.com; s=arc-20160816; b=Pqr9tUDv6XY6zrV8Mo46B1W7XIl6S3ug9G7rK4eyl6ntzU76zCLx6srARU0r9t1a9N 6h88wwspIwMlNXf26RGL1EqI9UyJkR6fvJR8dXst0IuowwkiIEDXUKOCBvJFWHCxnbZ/ R15X200bqGPl2dYjloNrVLOtPEmLhW2G5t71P7zXYIZ6Ja+7VRRSLFAzYz3l8EZv34sA iCZeW0b7xIFqQMjS3bpyqjm3U5fV7DpCzkZNSU0keucVaJcATkjd1c94ApBzNX8/iXJQ /9g54RyjEMjHu4TZ/r8DgRBELGF8/qHXxHpCW9QAlnFe5TIO1/xNLVv5L1HqZasr//Ka HX8Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=/UMeijyEbvuo+efJi/zyKmIAfCTkeyskc+xEDDHhuzE=; b=HSnHZBU1M4qgSZ4C/x0jUpGmxrxDBzfJ4YGnepPf/86+5Ah3O08Grq2E4VMP4I3zhY gQVrXCd7dXXhT/TYOxsZtanItI/hDfk+I0ojI5hzbqBKlo/YN4t6acJ8qEpuPMSOZq32 CUpFYIFeMbq5Bgda1YB15PYWs+iSNRcUW3HaNmAIUzQzKNh4r6z+49RBFFDGsiHtR98+ 19yL/v2kJ+HgnrjuwDlQbaCDcZVS5zPxT1DI6Y2TZgP4CyYGHiOIIE5gRjx2pj7ThVBp xFaydf9ckqX6L6umtMiR3yceHptYVezc3OIfwHX97X0ysIDbXePFT06p8G92h08CVrsV VcPg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=MuDJOEI1; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id 11si5953078edw.195.2021.02.02.07.15.50; Tue, 02 Feb 2021 07:16:15 -0800 (PST) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=MuDJOEI1; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235118AbhBBPNS (ORCPT + 99 others); Tue, 2 Feb 2021 10:13:18 -0500 Received: from mail.kernel.org ([198.145.29.99]:38140 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235191AbhBBPL6 (ORCPT ); Tue, 2 Feb 2021 10:11:58 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id AFCF064F6C; Tue, 2 Feb 2021 15:06:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1612278402; bh=cLcsa51PyK+Y+1DrJUenXnA+a2UDeaAi47p99Do7Sq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MuDJOEI1oR/CrOjRkTX5Yuh7wmPYFIewi6nbm0zGlYUA+9+SWgonNChgaTGnoAge/ wR+0UJbYODjzih3rW3zVVpTZZmCzpCAG5sTY/F2zeXeB0vSN1AtkSg9iLW8RfKduKP CF8zxxy+8e3cBv5rQpX0eJ57jyyyjeprwQkJtCFPjYOBzrosk0n5ZtnHkGZ7AXXUPe Pv6t1gMt6JkYxlwe0TrP5F13ns6SgoCLoex/NgoRgjRtBaGuEIlJd2LO+DotaYa8Vu 937ehMSk+rLsKxBjyC7kLnGKUd/f2UdBiAxw6ew3gPllh6/UhtmniuWmeW5lum8i0q MpCyZ53lKDZ1w== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Johannes Berg , Luca Coelho , Kalle Valo , Sasha Levin , linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.10 20/25] iwlwifi: queue: bail out on invalid freeing Date: Tue, 2 Feb 2021 10:06:10 -0500 Message-Id: <20210202150615.1864175-20-sashal@kernel.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20210202150615.1864175-1-sashal@kernel.org> References: <20210202150615.1864175-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg [ Upstream commit 0bed6a2a14afaae240cc431e49c260568488b51c ] If we find an entry without an SKB, we currently continue, but that will just result in an infinite loop since we won't increment the read pointer, and will try the same thing over and over again. Fix this. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20210122144849.abe2dedcc3ac.Ia6b03f9eeb617fd819e56dd5376f4bb8edc7b98a@changeid Signed-off-by: Sasha Levin --- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.c b/drivers/net/wireless/intel/iwlwifi/queue/tx.c index af0b27a68d84d..9181221a2434d 100644 --- a/drivers/net/wireless/intel/iwlwifi/queue/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.c @@ -887,10 +887,8 @@ void iwl_txq_gen2_unmap(struct iwl_trans *trans, int txq_id) int idx = iwl_txq_get_cmd_index(txq, txq->read_ptr); struct sk_buff *skb = txq->entries[idx].skb; - if (WARN_ON_ONCE(!skb)) - continue; - - iwl_txq_free_tso_page(trans, skb); + if (!WARN_ON_ONCE(!skb)) + iwl_txq_free_tso_page(trans, skb); } iwl_txq_gen2_free_tfd(trans, txq); txq->read_ptr = iwl_txq_inc_wrap(trans, txq->read_ptr); -- 2.27.0