瀏覽代碼

qcacld-3.0: fix invalid net_dev accessing due to GRO flush timeout

scenario:
(1) KASAN is enabled and DP thread is slow to process and deliver
Rx packets to stack.
(2) vdev-2 do disconnection and flush Rx packets that belong to
vdev-2, but DP thread is busy with processing vdev-0 Rx pakcets
then no chance to do GRO flush for vdev-2, Rx flush timeout and
vdev-2 net_dev get freed, later when DP thread do GRO flush for
vdev-2 pakcets, invalid accessing to vdev-2 net_dev happened.

solution:
(1) increase Rx packets flush timeout from 1000 ms to 2000 ms.
(2) do extra GRO flush if timeout happened.

Change-Id: Iddc445d950eeb6cd2bd0b125bf87051e850abeb2
CRs-Fixed: 2894978
Jinwei Chen 4 年之前
父節點
當前提交
20d8019747
共有 1 個文件被更改,包括 10 次插入3 次删除
  1. 10 3
      core/dp/txrx3.0/dp_rx_thread.c

+ 10 - 3
core/dp/txrx3.0/dp_rx_thread.c

@@ -25,7 +25,7 @@
 #include <cds_sched.h>
 
 /* Timeout in ms to wait for a DP rx thread */
-#define DP_RX_THREAD_WAIT_TIMEOUT 1000
+#define DP_RX_THREAD_WAIT_TIMEOUT 2000
 
 #define DP_RX_TM_DEBUG 0
 #if DP_RX_TM_DEBUG
@@ -1047,10 +1047,17 @@ void dp_rx_thread_flush_by_vdev_id(struct dp_rx_thread *rx_thread,
 	if (QDF_IS_STATUS_SUCCESS(qdf_status))
 		dp_debug("thread:%d napi gro flush successfully",
 			 rx_thread->id);
-	else if (qdf_status == QDF_STATUS_E_TIMEOUT)
+	else if (qdf_status == QDF_STATUS_E_TIMEOUT) {
 		dp_err("thread:%d timed out waiting for napi gro flush",
 		       rx_thread->id);
-	else
+		/*
+		 * If timeout, then force flush here in case any rx packets
+		 * belong to this vdev is still pending on stack queue,
+		 * while net_vdev will be freed soon.
+		 */
+		dp_rx_thread_gro_flush(rx_thread,
+				       DP_RX_GRO_NORMAL_FLUSH);
+	} else
 		dp_err("thread:%d failed while waiting for napi gro flush",
 		       rx_thread->id);
 }