qcacmn: fix invalid accessing to rx_tlv_hdr due to scattered msdu

long length msdu is received and looks this msdu is spread across
multiple nbufs, there is no corresbonding logic for this case.
qdf_set_pkt_len will invoke pskb_expand_head to renew skb->head
buffer, but the rx_tlv_hdr is still pointed to original skb->data
buffer, invalid accessing will happen.
  As a WAR, drop this msdu related nbufs after dp_rx_sg_create is done.

Change-Id: Iceb09fd04e4d768325018a8ddd4261ab4f75991a
CRs-Fixed: 2597927
这个提交包含在:
Jinwei Chen
2020-01-14 13:52:06 +08:00
提交者 nshrivas
父节点 f6485c72bb
当前提交 0b92469595
修改 4 个文件,包含 53 行新增22 行删除

查看文件

@@ -5920,6 +5920,12 @@ dp_print_soc_rx_stats(struct dp_soc *soc)
DP_PRINT_STATS("RXDMA ERR DUP DESC: %d",
soc->stats.rx.err.hal_rxdma_err_dup);
DP_PRINT_STATS("RX scatter msdu: %d",
soc->stats.rx.err.scatter_msdu);
DP_PRINT_STATS("RX wait completed msdu break: %d",
soc->stats.rx.msdu_scatter_wait_break);
for (i = 0; i < HAL_RXDMA_ERR_MAX; i++) {
index += qdf_snprint(&rxdma_error[index],
DP_RXDMA_ERR_LENGTH - index,