wifi: iwlegacy: replace BUG_ON() with WARN_ON() on num_stations check

BUG_ON() for il->num_stations < 0 can happen in real word, see
https://bugzilla.kernel.org/show_bug.cgi?id=221733

Replace BUG_ON() with WARN_ON() (and reset the counter to 0) to
do not put whole system to inconsistent state on the condition.

Also allocate debugfs buffer for all stations (32 or 25)
to do not use num_stations since it might not be right.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Link: https://patch.msgid.link/20260724095545.33647-1-stf_xl@wp.pl
[clarify commit message wrt. debugfs buffer]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index 8d0ff339ad088541dd3ddf5200afce62c5522134..0bb807ff8edfff56aad55ebc288423b3db345438 100644 (file)
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -2179,8 +2179,8 @@ il_remove_station(struct il_priv *il, const u8 sta_id, const u8 * addr)
        il->stations[sta_id].used &= ~IL_STA_DRIVER_ACTIVE;
 
        il->num_stations--;
-
-       BUG_ON(il->num_stations < 0);
+       if (WARN_ON(il->num_stations < 0))
+               il->num_stations = 0;
 
        spin_unlock_irqrestore(&il->sta_lock, flags);
 
@@ -2328,7 +2328,8 @@ il_dealloc_bcast_stations(struct il_priv *il)
 
                il->stations[i].used &= ~IL_STA_UCODE_ACTIVE;
                il->num_stations--;
-               BUG_ON(il->num_stations < 0);
+               if (WARN_ON(il->num_stations < 0))
+                       il->num_stations = 0;
                kfree(il->stations[i].lq);
                il->stations[i].lq = NULL;
        }

diff --git a/drivers/net/wireless/intel/iwlegacy/debug.c b/drivers/net/wireless/intel/iwlegacy/debug.c
index d998a3f1b0566c985bb1b3a354d756e892a65a76..8a9f79ff1c6eed33bae1adf18333f72b75205d73 100644 (file)
--- a/drivers/net/wireless/intel/iwlegacy/debug.c
+++ b/drivers/net/wireless/intel/iwlegacy/debug.c
@@ -396,7 +396,7 @@ il_dbgfs_stations_read(struct file *file, char __user *user_buf, size_t count,
        int i, j, pos = 0;
        ssize_t ret;
        /* Add 30 for initial string */
-       const size_t bufsz = 30 + sizeof(char) * 500 * (il->num_stations);
+       const size_t bufsz = 30 + sizeof(char) * 500 * max_sta;
 
        buf = kmalloc(bufsz, GFP_KERNEL);
        if (!buf)