samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
程式碼 問題 合併請求 Actions 套件 專案 版本發布 Wiki 動態

qcacmn: Fix the next link descriptor read issue

瀏覽代碼 
Link descriptor were getting freed by the pointer
of the previous freed link descriptor. This patch
fixes by copying the address of the current in a
local descriptor info and using it to free the
current.

Change-Id: I95e137ba5b1f0ad21b0e6fb39f6671e1d5b65ba6
CRs-Fixed: 2577624
此提交包含在：
Aniruddha Paul
2019-11-27 18:48:04 +05:30
提交者 nshrivas
父節點 efa9f5d2a9
當前提交 33fce952a9
共有 7 個檔案被更改，包括 57 行新增 和 42 行删除
下載 Patch 檔 下載差異檔 展開所有檔案 折疊所有檔案

2
dp/wifi3.0/dp_rx.h
查看文件

@@ -978,7 +978,7 @@ dp_rx_link_desc_return(struct dp_soc *soc, hal_ring_desc_t ring_desc,
*/
QDF_STATUS
dp_rx_link_desc_return_by_addr(struct dp_soc *soc,
hal_link_desc_t link_desc_addr,
hal_buff_addrinfo_t link_desc_addr,
uint8_t bm_action);
/**

46
dp/wifi3.0/dp_rx_err.c
查看文件

@@ -165,7 +165,7 @@ static inline bool dp_rx_mcast_echo_check(struct dp_soc *soc,
*/
QDF_STATUS
dp_rx_link_desc_return_by_addr(struct dp_soc *soc,
hal_link_desc_t link_desc_addr,
hal_buff_addrinfo_t link_desc_addr,
uint8_t bm_action)
{
struct dp_srng *wbm_desc_rel_ring = &soc->wbm_desc_rel_ring;
@@ -1719,8 +1719,6 @@ dp_rx_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
struct hal_rx_msdu_list msdu_list;
uint16_t num_msdus;
struct hal_buf_info buf_info;
void *p_buf_addr_info;
void *p_last_buf_addr_info;
uint32_t rx_bufs_used = 0;
uint32_t msdu_cnt;
uint32_t i;
@@ -1728,6 +1726,7 @@ dp_rx_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
uint8_t rxdma_error_code = 0;
uint8_t bm_action = HAL_BM_ACTION_PUT_IN_IDLE_LIST;
struct dp_pdev *pdev = dp_get_pdev_for_mac_id(soc, mac_id);
uint32_t rx_link_buf_info[HAL_RX_BUFFINFO_NUM_DWORDS];
hal_rxdma_desc_t ring_desc;
msdu = 0;
@@ -1735,7 +1734,7 @@ dp_rx_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
last = NULL;
hal_rx_reo_ent_buf_paddr_get(rxdma_dst_ring_desc, &buf_info,
&p_last_buf_addr_info, &msdu_cnt);
&msdu_cnt);
push_reason =
hal_rx_reo_ent_rxdma_push_reason_get(rxdma_dst_ring_desc);
@@ -1811,12 +1810,18 @@ dp_rx_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
rxdma_error_code = HAL_RXDMA_ERR_WAR;
}
hal_rx_mon_next_link_desc_get(rx_msdu_link_desc, &buf_info,
&p_buf_addr_info);
dp_rx_link_desc_return(soc, p_last_buf_addr_info, bm_action);
p_last_buf_addr_info = p_buf_addr_info;
/*
* Store the current link buffer into to the local structure
* to be used for release purpose.
*/
hal_rxdma_buff_addr_info_set(rx_link_buf_info, buf_info.paddr,
buf_info.sw_cookie, buf_info.rbm);
hal_rx_mon_next_link_desc_get(rx_msdu_link_desc, &buf_info);
dp_rx_link_desc_return_by_addr(soc,
(hal_buff_addrinfo_t)
rx_link_buf_info,
bm_action);
} while (buf_info.paddr);
DP_STATS_INC(soc, rx.err.rxdma_error[rxdma_error_code], 1);
@@ -1907,18 +1912,15 @@ dp_wbm_int_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
struct hal_rx_msdu_list msdu_list;
uint16_t num_msdus;
struct hal_buf_info buf_info;
void *p_buf_addr_info;
void *p_last_buf_addr_info;
uint32_t rx_bufs_used = 0;
uint32_t msdu_cnt;
uint32_t i;
uint32_t rx_bufs_used = 0, msdu_cnt, i;
uint32_t rx_link_buf_info[HAL_RX_BUFFINFO_NUM_DWORDS];
msdu = 0;
last = NULL;
hal_rx_reo_ent_buf_paddr_get(rxdma_dst_ring_desc, &buf_info,
&p_last_buf_addr_info, &msdu_cnt);
&msdu_cnt);
do {
rx_msdu_link_desc =
@@ -1951,13 +1953,17 @@ dp_wbm_int_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
}
}
hal_rx_mon_next_link_desc_get(rx_msdu_link_desc, &buf_info,
&p_buf_addr_info);
/*
* Store the current link buffer into to the local structure
* to be used for release purpose.
*/
hal_rxdma_buff_addr_info_set(rx_link_buf_info, buf_info.paddr,
buf_info.sw_cookie, buf_info.rbm);
dp_rx_link_desc_return(soc, p_last_buf_addr_info,
hal_rx_mon_next_link_desc_get(rx_msdu_link_desc, &buf_info);
dp_rx_link_desc_return_by_addr(soc, (hal_buff_addrinfo_t)
rx_link_buf_info,
HAL_BM_ACTION_PUT_IN_IDLE_LIST);
p_last_buf_addr_info = p_buf_addr_info;
} while (buf_info.paddr);
return rx_bufs_used;

28
dp/wifi3.0/dp_rx_mon_dest.c
查看文件

@@ -55,7 +55,7 @@
*/
static QDF_STATUS
dp_rx_mon_link_desc_return(struct dp_pdev *dp_pdev,
void *buf_addr_info, int mac_id)
hal_buff_addrinfo_t buf_addr_info, int mac_id)
{
struct dp_srng *dp_srng;
hal_ring_handle_t hal_ring_hdl;
@@ -153,14 +153,15 @@ void *dp_rx_cookie_2_mon_link_desc(struct dp_pdev *pdev,
*/
static inline
QDF_STATUS dp_rx_monitor_link_desc_return(struct dp_pdev *pdev,
void *p_last_buf_addr_info,
hal_buff_addrinfo_t
p_last_buf_addr_info,
uint8_t mac_id, uint8_t bm_action)
{
if (pdev->soc->wlan_cfg_ctx->rxdma1_enable)
return dp_rx_mon_link_desc_return(pdev, p_last_buf_addr_info,
mac_id);
return dp_rx_link_desc_return(pdev->soc, p_last_buf_addr_info,
return dp_rx_link_desc_return_by_addr(pdev->soc, p_last_buf_addr_info,
bm_action);
}
@@ -269,8 +270,6 @@ dp_rx_mon_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
uint16_t num_msdus;
uint32_t rx_buf_size, rx_pkt_offset;
struct hal_buf_info buf_info;
void *p_buf_addr_info;
void *p_last_buf_addr_info;
uint32_t rx_bufs_used = 0;
uint32_t msdu_ppdu_id, msdu_cnt;
uint8_t *data;
@@ -280,13 +279,13 @@ dp_rx_mon_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
bool drop_mpdu = false;
uint8_t bm_action = HAL_BM_ACTION_PUT_IN_IDLE_LIST;
uint64_t nbuf_paddr = 0;
uint32_t rx_link_buf_info[HAL_RX_BUFFINFO_NUM_DWORDS];
msdu = 0;
last = NULL;
hal_rx_reo_ent_buf_paddr_get(rxdma_dst_ring_desc, &buf_info,
&p_last_buf_addr_info, &msdu_cnt);
hal_rx_reo_ent_buf_paddr_get(rxdma_dst_ring_desc, &buf_info, &msdu_cnt);
if ((hal_rx_reo_ent_rxdma_push_reason_get(rxdma_dst_ring_desc) ==
HAL_RX_WBM_RXDMA_PSH_RSN_ERROR)) {
@@ -505,19 +504,22 @@ next_msdu:
tail, rx_desc);
}
hal_rx_mon_next_link_desc_get(rx_msdu_link_desc, &buf_info,
&p_buf_addr_info);
/*
* Store the current link buffer into to the local
* structure to be used for release purpose.
*/
hal_rxdma_buff_addr_info_set(rx_link_buf_info, buf_info.paddr,
buf_info.sw_cookie, buf_info.rbm);
hal_rx_mon_next_link_desc_get(rx_msdu_link_desc, &buf_info);
if (dp_rx_monitor_link_desc_return(dp_pdev,
p_last_buf_addr_info,
(hal_buff_addrinfo_t)
rx_link_buf_info,
mac_id,
bm_action)
!= QDF_STATUS_SUCCESS)
QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
"dp_rx_monitor_link_desc_return failed");
p_last_buf_addr_info = p_buf_addr_info;
} while (buf_info.paddr && msdu_cnt);
if (last)