samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: fix TX completion ring NULL pointer dereference issue

Browse Source 
If IPA is enabled, index 1/2 in array soc->tx_comp_ring[] will
not be initialized, but initialize index 3/4 instead, if access
to index 1/2, NULL pointer dereference issue appeared.

use soc->num_tcl_data_rings as number of TX completion ring
wlan host interested, it differs between IPA enabled/disable case.

Change-Id: I92b4e2c9971f93136a9f4e60ae3de32140aa2477
CRs-Fixed: 3647677
This commit is contained in:
Jinwei Chen
2023-10-25 00:17:06 -07:00
committed by Ravindra Konda
parent 162ac04ff7
commit e8d518c82c
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
dp/wifi3.0/dp_main.c
View File

@@ -7207,10 +7207,16 @@ static inline void dp_srng_clear_ring_usage_wm_stats(struct dp_soc *soc)
hal_srng_clear_ring_usage_wm_locked(soc->hal_soc, hal_srng_clear_ring_usage_wm_locked(soc->hal_soc,
soc->reo_dest_ring[ring].hal_srng); soc->reo_dest_ring[ring].hal_srng);
for (ring = 0; ring < soc->num_tx_comp_rings; ring++) for (ring = 0; ring < soc->num_tcl_data_rings; ring++) {
if (wlan_cfg_get_wbm_ring_num_for_index(
soc->wlan_cfg_ctx, ring) ==
INVALID_WBM_RING_NUM)
continue;
hal_srng_clear_ring_usage_wm_locked(soc->hal_soc, hal_srng_clear_ring_usage_wm_locked(soc->hal_soc,
soc->tx_comp_ring[ring].hal_srng); soc->tx_comp_ring[ring].hal_srng);
} }
}
#else #else
static inline void dp_srng_clear_ring_usage_wm_stats(struct dp_soc *soc) static inline void dp_srng_clear_ring_usage_wm_stats(struct dp_soc *soc)
{ {

7
dp/wifi3.0/dp_stats.c
View File

@@ -8374,7 +8374,12 @@ void dp_dump_srng_high_wm_stats(struct dp_soc *soc, uint64_t srng_mask)
} }
if (srng_mask & DP_SRNG_WM_MASK_TX_COMP) { if (srng_mask & DP_SRNG_WM_MASK_TX_COMP) {
for (ring = 0; ring < soc->num_tx_comp_rings; ring++) { for (ring = 0; ring < soc->num_tcl_data_rings; ring++) {
if (wlan_cfg_get_wbm_ring_num_for_index(
soc->wlan_cfg_ctx, ring) ==
INVALID_WBM_RING_NUM)
continue;
pos = 0; pos = 0;
pos += hal_dump_srng_high_wm_stats(soc->hal_soc, pos += hal_dump_srng_high_wm_stats(soc->hal_soc,
soc->tx_comp_ring[ring].hal_srng, soc->tx_comp_ring[ring].hal_srng,