ソースを参照

qcacmn: WAR for duplicate RX desc issue from REO2SW ring

Two back to back same RX desc is received from
REO2SW1 ring. After first RX desc is processed,
RX_desc nbuf will be set to null.
when second REO entry/same RX desc is processing,
dp_rx_desc_nbuf_sanity_check() will access to RX_desc nbuf, null
nbuf accessing lead to panic.

As a WAR, check RX_desc in_use flag firstly to avoid
invalid accessing to nbuf, move
dp_rx_desc_nbuf_sanity_check() after it.

Change-Id: Ib9455c76af85cf83587c1428b20a9ad9e93a9499
CRs-Fixed: 2672088
Jinwei Chen 5 年 前
コミット
ac1aea6e59
1 ファイル変更2 行追加2 行削除
  1. 2 2
      dp/wifi3.0/dp_rx.c

+ 2 - 2
dp/wifi3.0/dp_rx.c

@@ -2020,8 +2020,6 @@ more_data:
 			continue;
 		}
 
-		dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);
-
 		/*
 		 * this is a unlikely scenario where the host is reaping
 		 * a descriptor which it already reaped just a while ago
@@ -2041,6 +2039,8 @@ more_data:
 			continue;
 		}
 
+		dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);
+
 		if (qdf_unlikely(!dp_rx_desc_check_magic(rx_desc))) {
 			dp_err("Invalid rx_desc cookie=%d", rx_buf_cookie);
 			DP_STATS_INC(soc, rx.err.rx_desc_invalid_magic, 1);