Commit 0bed6a2a authored by Johannes Berg's avatar Johannes Berg Committed by Kalle Valo
Browse files

iwlwifi: queue: bail out on invalid freeing 



If we find an entry without an SKB, we currently continue, but
that will just result in an infinite loop since we won't increment
the read pointer, and will try the same thing over and over again.
Fix this.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20210122144849.abe2dedcc3ac.Ia6b03f9eeb617fd819e56dd5376f4bb8edc7b98a@changeid
parent 7a21b1d4

drivers/net/wireless/intel/iwlwifi/queue/tx.c

+2 −4
Original line number Diff line number Diff line
@@ -840,9 +840,7 @@ void iwl_txq_gen2_unmap(struct iwl_trans *trans, int txq_id) 
			int idx = iwl_txq_get_cmd_index(txq, txq->read_ptr);

			struct sk_buff *skb = txq->entries[idx].skb;



			if (WARN_ON_ONCE(!skb))

				continue;



			if (!WARN_ON_ONCE(!skb))

				iwl_txq_free_tso_page(trans, skb);

		}

		iwl_txq_gen2_free_tfd(trans, txq);