Commit 1902f195 authored by Anjaneyulu's avatar Anjaneyulu Committed by Johannes Berg
Browse files

wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() 



rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry
is zero. For the case when entry->entry is not equal to 0, rxq
won't be NULL even if trans_pcie->rxq is NULL. Modify checker to
check for trans_pcie->rxq.

Fixes: abc599ef ("iwlwifi: pcie: don't crash when rx queues aren't allocated in interrupt")
Signed-off-by: default avatarAnjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: default avatarGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230614123446.5a5eb3889a4a.I375a1d58f16b48cd2044e7b7caddae512d7c86fd@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 568db7fd

drivers/net/wireless/intel/iwlwifi/pcie/rx.c

+3 −2
Original line number Diff line number Diff line
@@ -1636,14 +1636,14 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) 
	struct msix_entry *entry = dev_id;

	struct iwl_trans_pcie *trans_pcie = iwl_pcie_get_trans_pcie(entry);

	struct iwl_trans *trans = trans_pcie->trans;

	struct iwl_rxq *rxq = &trans_pcie->rxq[entry->entry];

	struct iwl_rxq *rxq;



	trace_iwlwifi_dev_irq_msix(trans->dev, entry, false, 0, 0);



	if (WARN_ON(entry->entry >= trans->num_rx_queues))

		return IRQ_NONE;



	if (!rxq) {

	if (!trans_pcie->rxq) {

		if (net_ratelimit())

			IWL_ERR(trans,

				"[%d] Got MSI-X interrupt before we have Rx queues\n",
@@ -1651,6 +1651,7 @@ irqreturn_t iwl_pcie_irq_rx_msix_handler(int irq, void *dev_id) 
		return IRQ_NONE;

	}



	rxq = &trans_pcie->rxq[entry->entry];

	lock_map_acquire(&trans->sync_cmd_lockdep_map);

	IWL_DEBUG_ISR(trans, "[%d] Got interrupt\n", entry->entry);