From: Michal Kazior <michal.kazior@tieto.com>
To: ath10k@lists.infradead.org
Cc: linux-wireless@vger.kernel.org, greearb@candelatech.com,
Michal Kazior <michal.kazior@tieto.com>
Subject: [PATCH/RFT 10/12] ath10k: guard against CE corruption from firmware
Date: Wed, 30 Oct 2013 12:42:24 +0100 [thread overview]
Message-ID: <1383133346-8135-11-git-send-email-michal.kazior@tieto.com> (raw)
In-Reply-To: <1383133346-8135-1-git-send-email-michal.kazior@tieto.com>
In case firmware crashes it may report CE
completions for entries that were never
submitted/filled with meaningful data. This in
turn led to NULL dereferences.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
---
drivers/net/wireless/ath/ath10k/htc.c | 5 +++++
drivers/net/wireless/ath/ath10k/pci.c | 7 +++++++
2 files changed, 12 insertions(+)
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index 3118d75..c59f5b4 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -191,6 +191,11 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
struct ath10k_htc *htc = &ar->htc;
struct ath10k_htc_ep *ep = &htc->endpoint[eid];
+ if (!skb) {
+ ath10k_warn("invalid sk_buff completion - NULL pointer. firmware crashed?");
+ return 0;
+ }
+
ath10k_htc_notify_tx_completion(ep, skb);
/* the skb now belongs to the completion handler */
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 63ad250..43cdc35 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1270,6 +1270,13 @@ static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
* Indicate the completion to higer layer to free
* the buffer
*/
+
+ if (!netbuf) {
+ ath10k_warn("invalid sk_buff on CE %d - NULL pointer. firmware crashed?",
+ ce_hdl->id);
+ continue;
+ }
+
ATH10K_SKB_CB(netbuf)->is_aborted = true;
ar_pci->msg_callbacks_current.tx_completion(ar,
netbuf,
--
1.8.4.rc3
next prev parent reply other threads:[~2013-10-30 11:45 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-30 11:42 [PATCH/RFT 00/12] ath10k: pci fixes 2013-10-30 Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 01/12] ath10k: remove ar_pci->ce_count Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 02/12] ath10k: don't forget to kill fw error tasklet Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 03/12] ath10k: split tasklet killing function Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 04/12] ath10k: rename function to match it's role Michal Kazior
2013-11-06 13:08 ` Kalle Valo
2013-10-30 11:42 ` [PATCH/RFT 05/12] ath10k: make sure to mask all CE irqs Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 06/12] ath10k: fix ath10k_ce_init() failpath Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 07/12] ath10k: remove meaningless check Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 08/12] ath10k: use ath10k_do_pci_wake/sleep Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 09/12] ath10k: propagate ath10k_ce_disable_interrupts() errors Michal Kazior
2013-11-06 12:34 ` Kalle Valo
2013-10-30 11:42 ` Michal Kazior [this message]
2013-10-30 11:42 ` [PATCH/RFT 11/12] ath10k: re-arrange PCI init code Michal Kazior
2013-10-30 11:42 ` [PATCH/RFT 12/12] ath10k: add some debug prints Michal Kazior
2013-10-30 17:16 ` Joe Perches
2013-11-06 12:43 ` Kalle Valo
2013-11-06 12:38 ` Kalle Valo
2013-10-30 17:06 ` [PATCH/RFT 00/12] ath10k: pci fixes 2013-10-30 Ben Greear
2013-10-30 23:41 ` Ben Greear
2013-11-08 7:01 ` [PATCHv2 00/13] " Michal Kazior
2013-11-08 7:01 ` [PATCHv2 01/13] ath10k: remove ar_pci->ce_count Michal Kazior
2013-11-08 7:01 ` [PATCHv2 02/13] ath10k: don't forget to kill fw error tasklet Michal Kazior
2013-11-08 7:01 ` [PATCHv2 03/13] ath10k: split tasklet killing function Michal Kazior
2013-11-08 7:01 ` [PATCHv2 04/13] ath10k: rename ath10k_pci_reset_target() Michal Kazior
2013-11-08 7:01 ` [PATCHv2 05/13] ath10k: make sure to mask all CE irqs Michal Kazior
2013-11-08 7:01 ` [PATCHv2 06/13] ath10k: fix ath10k_ce_init() failpath Michal Kazior
2013-11-08 7:01 ` [PATCHv2 07/13] ath10k: remove meaningless check Michal Kazior
2013-11-08 7:01 ` [PATCHv2 08/13] ath10k: use ath10k_do_pci_wake/sleep Michal Kazior
2013-11-08 7:01 ` [PATCHv2 09/13] ath10k: propagate ath10k_ce_disable_interrupts() errors Michal Kazior
2013-11-08 7:01 ` [PATCHv2 10/13] ath10k: guard against CE corruption from firmware Michal Kazior
2013-11-08 7:01 ` [PATCHv2 11/13] ath10k: re-arrange PCI init code Michal Kazior
2013-11-08 7:01 ` [PATCHv2 12/13] ath10k: add and fix some PCI prints Michal Kazior
2013-11-08 7:01 ` [PATCHv2 13/13] ath10k: reset device upon stopping/power down Michal Kazior
2013-11-12 18:07 ` [PATCHv2 00/13] ath10k: pci fixes 2013-10-30 Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1383133346-8135-11-git-send-email-michal.kazior@tieto.com \
--to=michal.kazior@tieto.com \
--cc=ath10k@lists.infradead.org \
--cc=greearb@candelatech.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).