Re: [PATCH] rtlwifi: get buffer_desc before trying to alloc new skb
From: Larry Finger <hidden>
Date: 2015-03-12 16:03:06
Also in:
linux-wireless, lkml
On 03/12/2015 06:33 AM, Yang Bai wrote:
if rtlpriv->use_new_trx_flow == true and we run out of memory to alloc a new skb, we will directly jump to no_new tag with buffer_desc == NULL. Then we will dereference this NULL pointer in function _rtl_pci_init_one_rxdesc. Signed-off-by: Yang Bai <redacted>
Good catch. The only problem that I have is this fix adds even more branching to this interrupt routine. At first glance, I should be able to set buffer_desc in the earlier code where the code has already branched. For testing, an RTL8192EE card will be needed. Do you have such a card? Larry
quoted hunk ↗ jump to hunk
--- drivers/net/wireless/rtlwifi/pci.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c index a62170e..7fe04d1 100644 --- a/drivers/net/wireless/rtlwifi/pci.c +++ b/drivers/net/wireless/rtlwifi/pci.c@@ -820,17 +820,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) pci_unmap_single(rtlpci->pdev, *((dma_addr_t *)skb->cb), rtlpci->rxbuffersize, PCI_DMA_FROMDEVICE); + if (rtlpriv->use_new_trx_flow) + buffer_desc = + &rtlpci->rx_ring[rxring_idx].buffer_desc + [rtlpci->rx_ring[rxring_idx].idx]; + /* get a new skb - if fail, old one will be reused */ new_skb = dev_alloc_skb(rtlpci->rxbuffersize); if (unlikely(!new_skb)) goto no_new; - if (rtlpriv->use_new_trx_flow) { - buffer_desc = - &rtlpci->rx_ring[rxring_idx].buffer_desc - [rtlpci->rx_ring[rxring_idx].idx]; + if (rtlpriv->use_new_trx_flow) /*means rx wifi info*/ pdesc = (struct rtl_rx_desc *)skb->data; - } + memset(&rx_status , 0 , sizeof(rx_status)); rtlpriv->cfg->ops->query_rx_desc(hw, &stats, &rx_status, (u8 *)pdesc, skb);