Browse Source

qcacmn: Fix fraglist creation api to handle nr_frags

Handle skb fraglist creation if parent skb has nr_frags.

Currently it is being handled if parent skb has nr_frags
associated with it and results into acessing invalid skb
region.

e.g:
To understand example, consider below points:
1. Parent frag has 40 bytes of data(qdf_nbuf_data())
2. Assume each frag is of size 10 bytes.

 ----------------------------------------------------------
|Parent_SKB -----> 1st Fraglist SKB - Cons SKB chained     |
 ----------------------------------------------------------
| nbuf->Data    : 40B         |   Nbuf->Data: 0B           |
 ----------------------------------------------------------
| Nr Frags: 16                |   Nr Frags: 10             |
 ----------------------------------------------------------
| Data Len: 160B (16 * 10)    |   Data Len: 100B (10 * 10) |
 ----------------------------------------------------------
| Nbuf->len: 200B ( 40 + 160) |   Nbuf->len: 100B          |
 ----------------------------------------------------------

While creating fraglist,
Parent nbuf -> data_len will become 100 Bytes (Because of assignment '=').
Logically it should be (160B + 100B). '+='

This change incorporate above handling.

Change-Id: I9f63035aa44e6f85a803511cb19632178d3dc2e5
Ankit Kumar 4 years ago
parent
commit
45c8760063
1 changed files with 2 additions and 2 deletions
  1. 2 2
      qdf/linux/src/i_qdf_nbuf.h

+ 2 - 2
qdf/linux/src/i_qdf_nbuf.h

@@ -1387,8 +1387,8 @@ __qdf_nbuf_append_ext_list(struct sk_buff *skb_head,
 			struct sk_buff *ext_list, size_t ext_len)
 {
 	skb_shinfo(skb_head)->frag_list = ext_list;
-	skb_head->data_len = ext_len;
-	skb_head->len += skb_head->data_len;
+	skb_head->data_len += ext_len;
+	skb_head->len += ext_len;
 }
 
 /**