samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix double free of skb in case of send failure for TSO

Browse Source 
In case of TSO, same buffer results in multiple tx_desc after
segmentations. To avoid multiple free of skb ref_cnt is used.
Currently ref_cnt is incremented twice for 1st segment and
not incremented for last segment and in case of failure from
ce_send_fast, ref_cnt is decremented twice.

Above logic don't work in case when TSO packet with segment
count is 1 and ce_send_fast failure is observed.
So, Change logic to increment ref_cnt only once for 1st segment
and avoid reducing ref_cnt twice in case of ce_send_fast failure.

Change-Id: Ia85a6a8f905310b210d6f480a004feb2528a31d7
CRs-Fixed: 2469773
This commit is contained in:
Nirav Shah
2019-06-24 10:19:09 +05:30
committed by nshrivas
parent 7de51ff1ea
commit 21d055dd05
2 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/dp/txrx/ol_tx_desc.c
View File

@@ -966,10 +966,6 @@ void ol_tx_desc_frame_free_nonstd(struct ol_txrx_pdev_t *pdev,
} }
} else if (had_error == htt_tx_status_download_fail) { } else if (had_error == htt_tx_status_download_fail) {
/* Failed to send to target */ /* Failed to send to target */
/* This is to decrement skb->users count for TSO segment */
if (tx_desc->pkt_type == OL_TX_FRM_TSO)
qdf_nbuf_tx_free(tx_desc->netbuf, had_error);
goto free_tx_desc; goto free_tx_desc;
} else { } else {
/* single regular frame, called from completion path */ /* single regular frame, called from completion path */

3
core/dp/txrx/ol_tx_ll_fastpath.c
View File

@@ -429,7 +429,8 @@ ol_tx_ll_fast(ol_txrx_vdev_handle vdev, qdf_nbuf_t msdu_list)
* the skb is freed only after receiving tx * the skb is freed only after receiving tx
* completion for all segments of an nbuf. * completion for all segments of an nbuf.
*/ */
if (segments) if (segments !=
(msdu_info.tso_info.num_segs - 1))
qdf_nbuf_inc_users(msdu); qdf_nbuf_inc_users(msdu);
ol_tx_trace_pkt(msdu, tx_desc->id, ol_tx_trace_pkt(msdu, tx_desc->id,