samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix RXDMA null buffer address access issue

Browse Source 
During mon_pdev_init RX monitor status buffers will be attached
to status ring. In case of buffer allocation failure HP will be
pointing to null buffer address entry and during ring process
this index slot will be skipped. This will lead to RXDMA accessing
null buffer address descriptor.

Fix this by adjusting the HP of monitor status ring during RX
buffer allocation failures.

Change-Id: I290a724fefc6f65be058a84c97b9e6d51a08ef39
CRs-Fixed: 3268663
This commit is contained in:
Karthik Kantamneni
2023-09-29 12:52:30 +05:30
committed by Rahul Choudhary
parent 0fc63202c0
commit 3600a51a25
2 changed files with 41 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
hal/wifi3.0/hal_api.h
View File

@@ -2178,6 +2178,34 @@ void *hal_srng_src_peek_n_get_next(hal_soc_handle_t hal_soc_hdl,
return NULL;
}
/**
* hal_srng_src_dec_hp - Decrement source srng HP to previous index
* @hal_soc_hdl: Opaque HAL SOC handle
* @hal_ring_hdl: Source ring pointer
*
* Return: None
*/
static inline
void hal_srng_src_dec_hp(hal_soc_handle_t hal_soc_hdl,
hal_ring_handle_t hal_ring_hdl)
{
struct hal_srng *srng = (struct hal_srng *)hal_ring_hdl;
uint32_t hp = srng->u.src_ring.hp;
/* This HP adjustment is mostly done in error cases.
* Only local HP is being decremented not the value
* communicated to consumer or H.W.
*/
if (hp == srng->u.src_ring.cached_tp)
return;
else if (hp == 0)
hp = srng->ring_size - srng->entry_size;
else
hp = (hp - srng->entry_size) % srng->ring_size;
srng->u.src_ring.hp = hp;
}
/**
* hal_srng_src_peek_n_get_next_next() - Get next to next, i.e HP + 2 entry from
* a ring without moving head pointer.