diff options
| author | Michal Kazior <michal.kazior@tieto.com> | 2014-10-23 16:04:24 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2014-10-24 15:29:19 +0200 |
| commit | b30595aea39d6946c1d17c3f278fb8d2fbe2a4cf (patch) | |
| tree | a75add4d16f3db69df37282eaecf25517bb09faf /drivers | |
| parent | ath10k: don't drop frames aggressively (diff) | |
| download | linux-b30595aea39d6946c1d17c3f278fb8d2fbe2a4cf.tar.xz linux-b30595aea39d6946c1d17c3f278fb8d2fbe2a4cf.zip | |
ath10k: add extra sanity check when popping amsdu
The netbuf pop can return NULL. Make sure to check
for that. It shouldn't happen but better safe than
sorry.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/htt_rx.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c index 7fa4d872f05c..25bd286391d9 100644 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c @@ -428,6 +428,15 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt, while (msdu_chained--) { struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt); + if (!next) { + ath10k_warn(ar, "failed to pop chained msdu\n"); + ath10k_htt_rx_free_msdu_chain(*head_msdu); + *head_msdu = NULL; + msdu = NULL; + htt->rx_confused = true; + break; + } + skb_trim(next, 0); skb_put(next, min(msdu_len, HTT_RX_BUF_SIZE)); msdu_len -= next->len; |