blob: 5a8db1de1b1b88cb86b3c6c840cff552b9ac3b32 [file] [log] [blame]
From 86082bbb05a8455cca67ee6fefca2d7b007fceb8 Mon Sep 17 00:00:00 2001
From: Yan-Hsuan Chuang <>
Date: Tue, 7 Jan 2020 16:08:07 +0800
Subject: [PATCH] rtw88: fix potential NULL skb access in TX ISR
commit f4f84ff8377d4cedf18317747bc407b2cf657d0f upstream.
Sometimes the TX queue may be empty and we could possible
dequeue a NULL pointer, crash the kernel. If the skb is NULL
then there is nothing to do, just leave the ISR.
And the TX queue should not be empty here, so print an error
to see if there is anything wrong for DMA ring.
Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Yan-Hsuan Chuang <>
Signed-off-by: Kalle Valo <>
Signed-off-by: Paul Gortmaker <>
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index 68fae52151dd..bad6d56fcd38 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -727,6 +727,11 @@ static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,
while (count--) {
skb = skb_dequeue(&ring->queue);
+ if (!skb) {
+ rtw_err(rtwdev, "failed to dequeue %d skb TX queue %d, BD=0x%08x, rp %d -> %d\n",
+ count, hw_queue, bd_idx, ring->r.rp, cur_rp);
+ break;
+ }
tx_data = rtw_pci_get_tx_data(skb);
pci_unmap_single(rtwpci->pdev, tx_data->dma, skb->len,