浏览代码

qcacmn: Skip invalid Rx descriptor access in wbm err process

There is a possibility where host can receive invalid SW cookie
from Rx rel ring which causes invalid rx descriptor access in
dp_rx_wbm_err_process().

Add a sanity check on received SW cookie to prevent the invalid
rx descriptor access.

Change-Id: I7818290466a2a8cea9938577fbf869d1fc30d5e3
CRs-Fixed: 3240038
Venkateswara Naralasetty 3 年之前
父节点
当前提交
1702cefb57
共有 1 个文件被更改,包括 5 次插入0 次删除
  1. 5 0
      dp/wifi3.0/li/dp_li_rx.c

+ 5 - 0
dp/wifi3.0/li/dp_li_rx.c

@@ -1015,6 +1015,11 @@ QDF_STATUS dp_wbm_get_rx_desc_from_hal_desc_li(
 		return QDF_STATUS_E_INVAL;
 	}
 
+	if (!dp_rx_is_sw_cookie_valid(soc, buf_info.sw_cookie)) {
+		dp_rx_err("invalid sw_cookie 0x%x", buf_info.sw_cookie);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	*r_rx_desc = dp_rx_cookie_2_va_rxdma_buf(soc, buf_info.sw_cookie);
 
 	return QDF_STATUS_SUCCESS;