[PATCH for v5.11 7/7] iwlwifi: queue: bail out on invalid freeing
STALE2076d
LANDED
From: Luca Coelho <hidden>
Date: 2021-01-22 12:55:02
Subsystem:
intel wireless wifi link (iwlwifi), the rest · Maintainers:
Miri Korenblit, Linus Torvalds
Landed in mainline as 0bed6a2a14af on 2021-01-25.
From: Johannes Berg <redacted> If we find an entry without an SKB, we currently continue, but that will just result in an infinite loop since we won't increment the read pointer, and will try the same thing over and over again. Fix this. Signed-off-by: Johannes Berg <redacted> Signed-off-by: Luca Coelho <redacted> --- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.c b/drivers/net/wireless/intel/iwlwifi/queue/tx.c
index 27eea909e32d..794c6d0836ab 100644
--- a/drivers/net/wireless/intel/iwlwifi/queue/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.c@@ -841,10 +841,8 @@ void iwl_txq_gen2_unmap(struct iwl_trans *trans, int txq_id) int idx = iwl_txq_get_cmd_index(txq, txq->read_ptr); struct sk_buff *skb = txq->entries[idx].skb; - if (WARN_ON_ONCE(!skb)) - continue; - - iwl_txq_free_tso_page(trans, skb); + if (!WARN_ON_ONCE(!skb)) + iwl_txq_free_tso_page(trans, skb); } iwl_txq_gen2_free_tfd(trans, txq); txq->read_ptr = iwl_txq_inc_wrap(trans, txq->read_ptr);
--
2.29.2