Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 41a19141 authored by Yeshwanth Sriram Guntuka's avatar Yeshwanth Sriram Guntuka Committed by nshrivas
Browse files

qcacmn: Set local rx_desc list head to NULL

The issue sceanrio is as follows:

1) Packets are received in the rx exception ring and the
rx_descs processed are put into the pdev rx_desc freelist.

2) In the buffers replenish path, the above pdev rx_desc
freelist, on nbuf allocation or map error, is moved to the
soc rx_desc_pool freelist. The tail of the pdev rx_desc
freelist is set to NULL but not the head.

3) On receiving packets in the rx exception ring post above,
the new rx_desc are added to the pdev rx_desc freelist but
since the head of the list was not NULL prior to this, the
tail of the new list will have its next pointing to the
previous stale rx_desc list which is already moved to the soc
rx_desc_pool list.

4) In the replenish path, the buffers would be replenished
till tail of the new list but the desc_list would point
to the same aforementioned stale rx_desc list instead of NULL.
So even though replenish is successful, the desc_list check to
add the list back to soc rx_desc_pool freelist would be true.
This would cause next pointer of the tail and in effect the nbuf
pointer of the rx_desc pointed by tail to get updated.

5) On receiving the rx_desc mentioned in the previous step, nbuf
sanity check fails since nbuf address is pointing to another
rx_desc.

Fix is to set the local_desc_list also to NULL in
dp_rx_add_desc_list_to_free_list.

Change-Id: I984a4c122592547492b9d9625a71c0a90142b442
CRs-Fixed: 2704771
parent cd23d7fb
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment