Received-SPF: softfail (google.com: domain of transitioning linux-wireless-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: rtl818x: Prevent using not initialized queues
From:   Kalle Valo <kvalo@kernel.org>
In-Reply-To: <20220422145228.7567-1-alexander@wetzel-home.de>
References: <20220422145228.7567-1-alexander@wetzel-home.de>
To:     Alexander Wetzel <alexander@wetzel-home.de>
Cc:     linux-wireless@vger.kernel.org,
        Alexander Wetzel <alexander@wetzel-home.de>,
        stable@vger.kernel.org, pa@panix.com
User-Agent: pwcli/0.1.0-git (https://github.com/kvalo/pwcli/) Python/3.7.3
Message-ID: <165103577076.18987.11755306741060093427.kvalo@kernel.org>
Date:   Wed, 27 Apr 2022 05:02:52 +0000 (UTC)
Precedence: bulk

Alexander Wetzel <alexander@wetzel-home.de> wrote:

> Using not existing queues can panic the kernel with rtl8180/rtl8185 cards.
> Ignore the skb priority for those cards, they only have one tx queue. Pierre
> Asselin (pa@panix.com) reported the kernel crash in the Gentoo forum:
> 
> https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html
> 
> He also confirmed that this patch fixes the issue. In summary this happened:
> 
> After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a
> "divide error: 0000" when connecting to an AP. Control port tx now tries to
> use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in
> 2.10.
> 
> Since only the rtl8187se part of the driver supports QoS, the priority
> of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185
> cards.
> 
> rtl8180 is then unconditionally reading out the priority and finally crashes on
> drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this
> patch:
> 	idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries
> 
> "ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got
> initialized.
> 
> Cc: stable@vger.kernel.org
> Reported-by: pa@panix.com
> Tested-by: pa@panix.com
> Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>

Patch applied to wireless-next.git, thanks.

746285cf81dc rtl818x: Prevent using not initialized queues

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20220422145228.7567-1-alexander@wetzel-home.de/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches