samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Validate rx return_buffer_manager

Browse Source 
Host rx return_buffer_manager should always be 4 or 6. Add check for
invalid return_buffer_manager value in ring descriptor.

Change-Id: I509dd58ddd89e6a0ce1bffa509dcfabbd0fbc975
CRs-Fixed: 2632372
This commit is contained in:
Saket Jha
2020-03-03 16:21:12 -08:00
committed by nshrivas
parent 9668aeef28
commit d364435727
2 changed files with 22 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
dp/wifi3.0/dp_rx.c
View File

@@ -96,21 +96,33 @@ QDF_STATUS dp_rx_desc_sanity(struct dp_soc *soc, hal_soc_handle_t hal_soc,
hal_ring_desc_t ring_desc, hal_ring_desc_t ring_desc,
struct dp_rx_desc *rx_desc) struct dp_rx_desc *rx_desc)
{ {
uint8_t return_buffer_manager;
if (qdf_unlikely(!rx_desc)) { if (qdf_unlikely(!rx_desc)) {
/* /*
* This is an unlikely case where the cookie obtained * This is an unlikely case where the cookie obtained
* from the ring_desc is invalid and hence we are not * from the ring_desc is invalid and hence we are not
* able to find the corresponding rx_desc * able to find the corresponding rx_desc
*/ */
DP_STATS_INC(soc, rx.err.invalid_cookie, 1); goto fail;
dp_err("Ring Desc:"); }
hal_srng_dump_ring_desc(hal_soc, hal_ring_hdl,
ring_desc); return_buffer_manager = hal_rx_ret_buf_manager_get(ring_desc);
qdf_assert(0); if (qdf_unlikely(!(return_buffer_manager == HAL_RX_BUF_RBM_SW1_BM ||
return QDF_STATUS_E_NULL_VALUE; return_buffer_manager == HAL_RX_BUF_RBM_SW3_BM))) {
dp_rx_desc_dump(rx_desc);
goto fail;
} }
return QDF_STATUS_SUCCESS; return QDF_STATUS_SUCCESS;
fail:
DP_STATS_INC(soc, rx.err.invalid_cookie, 1);
dp_err("Ring Desc:");
hal_srng_dump_ring_desc(hal_soc, hal_ring_hdl,
ring_desc);
return QDF_STATUS_E_NULL_VALUE;
} }
#else #else
static inline static inline
@@ -1936,6 +1948,8 @@ more_data:
continue; continue;
} }
dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);
/* /*
* this is a unlikely scenario where the host is reaping * this is a unlikely scenario where the host is reaping
* a descriptor which it already reaped just a while ago * a descriptor which it already reaped just a while ago
@@ -1962,8 +1976,6 @@ more_data:
ring_desc, rx_desc); ring_desc, rx_desc);
} }
dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);
/* Get MPDU DESC info */ /* Get MPDU DESC info */
hal_rx_mpdu_desc_info_get(ring_desc, &mpdu_desc_info); hal_rx_mpdu_desc_info_get(ring_desc, &mpdu_desc_info);

2
dp/wifi3.0/dp_stats.c
View File

@@ -5531,6 +5531,8 @@ void dp_txrx_path_stats(struct dp_soc *soc)
pdev->soc->stats.rx.err.defrag_peer_uninit); pdev->soc->stats.rx.err.defrag_peer_uninit);
DP_PRINT_STATS("pkts delivered no peer %u", DP_PRINT_STATS("pkts delivered no peer %u",
pdev->soc->stats.rx.err.pkt_delivered_no_peer); pdev->soc->stats.rx.err.pkt_delivered_no_peer);
DP_PRINT_STATS("RX invalid cookie: %d",
soc->stats.rx.err.invalid_cookie);
DP_PRINT_STATS("Reo Statistics"); DP_PRINT_STATS("Reo Statistics");
DP_PRINT_STATS("near_full: %u ", soc->stats.rx.near_full); DP_PRINT_STATS("near_full: %u ", soc->stats.rx.near_full);