diff options
| author | Norbert van Bolhuis <nvbolhuis@gmail.com> | 2024-11-07 14:28:13 +0100 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2024-11-11 13:11:17 +0100 |
| commit | 857282b819cbaa0675aaab1e7542e2c0579f52d7 (patch) | |
| tree | dfd7d2f25f671d027c77c9a84a66d39236929936 /drivers/irqchip/irq-renesas-irqc.c | |
| parent | wifi: Switch back to struct platform_driver::remove() (diff) | |
| download | linux-857282b819cbaa0675aaab1e7542e2c0579f52d7.tar.xz linux-857282b819cbaa0675aaab1e7542e2c0579f52d7.zip | |
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
This patch fixes a NULL pointer dereference bug in brcmfmac that occurs
when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs
are sent from the pkt queue.
The problem is the number of entries in the pre-allocated sgtable, it is
nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1.
Given the default [rt]xglom_size=32 it's actually 35 which is too small.
Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB
is added for each original SKB if tailroom isn't enough to hold tail_pad.
At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop"
in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return
NULL and this causes the oops.
The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle
the worst-case.
Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464
additional bytes of memory.
Signed-off-by: Norbert van Bolhuis <nvbolhuis@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241107132903.13513-1-nvbolhuis@gmail.com
Diffstat (limited to 'drivers/irqchip/irq-renesas-irqc.c')
0 files changed, 0 insertions, 0 deletions