Reading the rsvd_page debugfs entry before writing a page offset and count to it calls vzalloc() with a size of zero, because rsvd_page.page_num defaults to 0. vmalloc warns about this: WARNING: mm/vmalloc.c:4019 at __vmalloc_node_range_noprof+0x9ac/0xa30 ... Call Trace: __vmalloc_node_noprof+0x4c/0x70 rtw_debugfs_get_rsvd_page+0x4c/0x110 [rtw88_core] seq_read_iter+0x132/0x4b0 seq_read+0x12e/0x1c0 full_proxy_read+0x6f/0xc0 vfs_read+0xdd/0x490 rtw_fw_dump_fifo() would reject the zero size anyway, but only after the allocation. Check for a zero buffer size first and print a short usage hint instead of allocating. Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") Signed-off-by: Abdurrahman Karadag --- v2: no code change. Add the wireless target tree to the subject and Cc the maintainers/blamed authors that v1 missed. drivers/net/wireless/realtek/rtw88/debug.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c index b67d69b..84e45af 100644 --- a/drivers/net/wireless/realtek/rtw88/debug.c +++ b/drivers/net/wireless/realtek/rtw88/debug.c @@ -315,6 +315,11 @@ static int rtw_debugfs_get_rsvd_page(struct seq_file *m, void *v) int i; int ret; + if (!buf_size) { + seq_puts(m, "usage: echo > rsvd_page\n"); + return 0; + } + buf = vzalloc(buf_size); if (!buf) return -ENOMEM; -- 2.55.0