소스 검색

qcacmn: Keep rx_refill_buf_ring using index pdev->lmac_id under MCL case

Fix static analysis issue of rx_refill_buf_ring buffer overflow.
rx_refill_buf_ring length is different for WIN/MCL. For MCL length is 1,
WIN is 3. So rx_refill_buf_ring should always use index pdev->lmac_id to
replenish rx buffer for different MACs under MCL.

Change-Id: I00af069c09c01a81ae4aa54bad5beb79dc6fcff5
CRs-Fixed: 2703683
Ben Wang 5 년 전
부모
커밋
909e4e1893
2개의 변경된 파일12개의 추가작업 그리고 3개의 파일을 삭제
  1. 8 2
      dp/wifi3.0/dp_main.c
  2. 4 1
      dp/wifi3.0/dp_rx_err.c

+ 8 - 2
dp/wifi3.0/dp_main.c

@@ -1673,8 +1673,14 @@ static int dp_process_lmac_rings(struct dp_intr *int_ctx, int total_budget)
 					(1 << mac_for_pdev)) {
 			union dp_rx_desc_list_elem_t *desc_list = NULL;
 			union dp_rx_desc_list_elem_t *tail = NULL;
-			struct dp_srng *rx_refill_buf_ring =
-				&soc->rx_refill_buf_ring[mac_for_pdev];
+			struct dp_srng *rx_refill_buf_ring;
+
+			if (wlan_cfg_per_pdev_lmac_ring(soc->wlan_cfg_ctx))
+				rx_refill_buf_ring =
+					&soc->rx_refill_buf_ring[mac_for_pdev];
+			else
+				rx_refill_buf_ring =
+					&soc->rx_refill_buf_ring[pdev->lmac_id];
 
 			intr_stats->num_host2rxdma_ring_masks++;
 			DP_STATS_INC(pdev, replenish.low_thresh_intrs,

+ 4 - 1
dp/wifi3.0/dp_rx_err.c

@@ -2264,7 +2264,10 @@ dp_rxdma_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,
 	dp_srng_access_end(int_ctx, soc, err_dst_srng);
 
 	if (rx_bufs_used) {
-		dp_rxdma_srng = &soc->rx_refill_buf_ring[mac_id];
+		if (wlan_cfg_per_pdev_lmac_ring(soc->wlan_cfg_ctx))
+			dp_rxdma_srng = &soc->rx_refill_buf_ring[mac_id];
+		else
+			dp_rxdma_srng = &soc->rx_refill_buf_ring[pdev->lmac_id];
 		rx_desc_pool = &soc->rx_desc_buf[mac_id];
 
 		dp_rx_buffers_replenish(soc, mac_id, dp_rxdma_srng,