ath10k: guard against CE corruption from firmware

In case firmware crashes it may report CE
completions for entries that were never
submitted/filled with meaningful data. This in
turn led to NULL dereferences.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index 3118d7506734267c8fcca7e80ad9eeba9269fce1..6d7a72eb11a57b6e6bf8065072ed2a2b4e35d98e 100644 (file)
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -191,6 +191,11 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
        struct ath10k_htc *htc = &ar->htc;
        struct ath10k_htc_ep *ep = &htc->endpoint[eid];
 
+       if (!skb) {
+               ath10k_warn("invalid sk_buff completion - NULL pointer. firmware crashed?\n");
+               return 0;
+       }
+
        ath10k_htc_notify_tx_completion(ep, skb);
        /* the skb now belongs to the completion handler */
 

diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index e41665f7eb85aa8478f1602f9cfbffda9d9d11ba..0b897269f129f05f02ba1d195a5605298cf19f3b 100644 (file)
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1270,6 +1270,13 @@ static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
                 * Indicate the completion to higer layer to free
                 * the buffer
                 */
+
+               if (!netbuf) {
+                       ath10k_warn("invalid sk_buff on CE %d - NULL pointer. firmware crashed?\n",
+                                   ce_hdl->id);
+                       continue;
+               }
+
                ATH10K_SKB_CB(netbuf)->is_aborted = true;
                ar_pci->msg_callbacks_current.tx_completion(ar,
                                                            netbuf,