From: Stanislaw Gruszka Date: Fri, 24 Jul 2026 09:55:45 +0000 (+0200) Subject: wifi: iwlegacy: replace BUG_ON() with WARN_ON() on num_stations check X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57aa1718d5953dd532137d43b696c68545c2e0b3;p=thirdparty%2Fkernel%2Fstable.git wifi: iwlegacy: replace BUG_ON() with WARN_ON() on num_stations check BUG_ON() for il->num_stations < 0 can happen in real word, see https://bugzilla.kernel.org/show_bug.cgi?id=221733 Replace BUG_ON() with WARN_ON() (and reset the counter to 0) to do not put whole system to inconsistent state on the condition. Also allocate debugfs buffer for all stations (32 or 25) to do not use num_stations since it might not be right. Signed-off-by: Stanislaw Gruszka Link: https://patch.msgid.link/20260724095545.33647-1-stf_xl@wp.pl [clarify commit message wrt. debugfs buffer] Signed-off-by: Johannes Berg --- diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c index 8d0ff339ad088..0bb807ff8edff 100644 --- a/drivers/net/wireless/intel/iwlegacy/common.c +++ b/drivers/net/wireless/intel/iwlegacy/common.c @@ -2179,8 +2179,8 @@ il_remove_station(struct il_priv *il, const u8 sta_id, const u8 * addr) il->stations[sta_id].used &= ~IL_STA_DRIVER_ACTIVE; il->num_stations--; - - BUG_ON(il->num_stations < 0); + if (WARN_ON(il->num_stations < 0)) + il->num_stations = 0; spin_unlock_irqrestore(&il->sta_lock, flags); @@ -2328,7 +2328,8 @@ il_dealloc_bcast_stations(struct il_priv *il) il->stations[i].used &= ~IL_STA_UCODE_ACTIVE; il->num_stations--; - BUG_ON(il->num_stations < 0); + if (WARN_ON(il->num_stations < 0)) + il->num_stations = 0; kfree(il->stations[i].lq); il->stations[i].lq = NULL; } diff --git a/drivers/net/wireless/intel/iwlegacy/debug.c b/drivers/net/wireless/intel/iwlegacy/debug.c index d998a3f1b0566..8a9f79ff1c6ee 100644 --- a/drivers/net/wireless/intel/iwlegacy/debug.c +++ b/drivers/net/wireless/intel/iwlegacy/debug.c @@ -396,7 +396,7 @@ il_dbgfs_stations_read(struct file *file, char __user *user_buf, size_t count, int i, j, pos = 0; ssize_t ret; /* Add 30 for initial string */ - const size_t bufsz = 30 + sizeof(char) * 500 * (il->num_stations); + const size_t bufsz = 30 + sizeof(char) * 500 * max_sta; buf = kmalloc(bufsz, GFP_KERNEL); if (!buf)