From 52e8726d6782a14c7f9e0fea5a5bc8e6a1992fd4 Mon Sep 17 00:00:00 2001 From: Norbert van Bolhuis Date: Fri, 8 Nov 2024 13:52:30 +0100 Subject: [PATCH] wifi: brcmfmac: fix scatter-gather handling by detecting end of sg list The scatter-gather handling uses a pre-allocated list (with nents entries). If the driver runs out of sg entries it will result in an oops. Let's detect this instead and make the SDIO block transfer fail. Signed-off-by: Norbert van Bolhuis Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20241108125609.107016-1-nvbolhuis@gmail.com --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index 42d991d9f8cb..60eb95fc19a5 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -455,6 +455,11 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, if (sg_data_sz > max_req_sz - req_sz) sg_data_sz = max_req_sz - req_sz; + if (!sgl) { + /* out of (pre-allocated) scatterlist entries */ + ret = -ENOMEM; + goto exit; + } sg_set_buf(sgl, pkt_data, sg_data_sz); sg_cnt++; -- 2.25.1