Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e1eb1b4 authored by Jinwei Chen's avatar Jinwei Chen Committed by nshrivas
Browse files

qcacmn: WAR for duplicate RX desc issue from REO2SW ring 

Two back to back same RX desc is received from
REO2SW1 ring. After first RX desc is processed,
RX_desc nbuf will be set to null.
when second REO entry/same RX desc is processing,
dp_rx_desc_nbuf_sanity_check() will access to RX_desc nbuf, null
nbuf accessing lead to panic.

As a WAR, check RX_desc in_use flag firstly to avoid
invalid accessing to nbuf, move
dp_rx_desc_nbuf_sanity_check() after it.

Change-Id: Ib9455c76af85cf83587c1428b20a9ad9e93a9499
CRs-Fixed: 2672088
parent 19bb468f

dp/wifi3.0/dp_rx.c

+2 −2
Original line number Diff line number Diff line
@@ -2003,8 +2003,6 @@ uint32_t dp_rx_process(struct dp_intr *int_ctx, hal_ring_handle_t hal_ring_hdl, 
			continue;

		}



		dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);



		/*

		 * this is a unlikely scenario where the host is reaping

		 * a descriptor which it already reaped just a while ago
@@ -2024,6 +2022,8 @@ uint32_t dp_rx_process(struct dp_intr *int_ctx, hal_ring_handle_t hal_ring_hdl, 
			continue;

		}



		dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc);



		if (qdf_unlikely(!dp_rx_desc_check_magic(rx_desc))) {

			dp_err("Invalid rx_desc cookie=%d", rx_buf_cookie);

			DP_STATS_INC(soc, rx.err.rx_desc_invalid_magic, 1);