samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Detect dp_rx_process reo descriptor paddr corruption

Browse Source 
Compare REO ring descriptor paddr with rx_desc->nbuf->cb->paddr,
possible corruption if they differ.

Change-Id: I064df12495a9934fe2396305a7a4a8cdeacdfd4f
CRs-Fixed: 2398155
This commit is contained in:
Manjunathappa Prakash
2019-02-20 17:02:59 -08:00
committed by nshrivas
parent dace806a9d
commit 8f70862cd8
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
dp/wifi3.0/dp_rx.c
View File

@@ -1431,6 +1431,33 @@ int dp_wds_rx_policy_check(
}
#endif
#ifdef RX_DESC_DEBUG_CHECK
/**
* dp_rx_desc_nbuf_sanity_check - Add sanity check to catch REO rx_desc paddr
* corruption
*
* @ring_desc: REO ring descriptor
* @rx_desc: Rx descriptor
*
* Return: NONE
*/
static inline void dp_rx_desc_nbuf_sanity_check(void *ring_desc,
struct dp_rx_desc *rx_desc)
{
struct hal_buf_info hbi;
hal_rx_reo_buf_paddr_get(ring_desc, &hbi);
/* Sanity check for possible buffer paddr corruption */
qdf_assert_always((&hbi)->paddr ==
qdf_nbuf_get_frag_paddr(rx_desc->nbuf, 0));
}
#else
static inline void dp_rx_desc_nbuf_sanity_check(void *ring_desc,
struct dp_rx_desc *rx_desc)
{
}
#endif
/**
* dp_rx_process() - Brain of the Rx processing functionality
* Called from the bottom half (tasklet/NET_RX_SOFTIRQ)
@@ -1557,6 +1584,7 @@ uint32_t dp_rx_process(struct dp_intr *int_ctx, void *hal_ring,
rx_desc = dp_rx_cookie_2_va_rxdma_buf(soc, rx_buf_cookie);
qdf_assert(rx_desc);
dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);
/*
* this is a unlikely scenario where the host is reaping
* a descriptor which it already reaped just a while ago