Commit 4b553f3c authored May 23, 2019 by Claire Chang Committed by Kalle Valo Jun 25, 2019

ath10k: add missing error handling



In function ath10k_sdio_mbox_rx_alloc() [sdio.c],
ath10k_sdio_mbox_alloc_rx_pkt() is called without handling the error cases.
This will make the driver think the allocation for skb is successful and
try to access the skb. If we enable failslab, system will easily crash with
NULL pointer dereferencing.

Call trace of CONFIG_FAILSLAB:
ath10k_sdio_irq_handler+0x570/0xa88 [ath10k_sdio]
process_sdio_pending_irqs+0x4c/0x174
sdio_run_irqs+0x3c/0x64
sdio_irq_work+0x1c/0x28

Fixes: d96db25d ("ath10k: add initial SDIO support")
Signed-off-by: Claire Chang <tientzu@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

parent 4fa42ade

drivers/net/wireless/ath/ath10k/sdio.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -607,6 +607,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar,
		full_len,
		last_in_bundle,
		last_in_bundle);
		if (ret) {
		ath10k_warn(ar, "alloc_rx_pkt error %d\n", ret);
		goto err;
		}
		}

		ar_sdio->n_rx_pkts = i;

Admin message