Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baec5c6d authored by Vasanthakumar Thiagarajan's avatar Vasanthakumar Thiagarajan Committed by Kalle Valo
Browse files

ath6kl: Fix random rx data corruption 



The skb->tail pointer of rx buffers is not adjusted
after skb->data pointer is aligned to 4-byte, this
causes random rx data corruption.

Signed-off-by: default avatarJin Navy <nhjin@qca.qualcomm.com>
Signed-off-by: default avatarVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent 363f149c

drivers/net/wireless/ath/ath6kl/txrx.c

+8 −2
Original line number Original line Diff line number Diff line
@@ -894,8 +894,11 @@ void ath6kl_rx_refill(struct htc_target *target, enum htc_endpoint_id endpoint) 
			break;

			break;





		packet = (struct htc_packet *) skb->head;

		packet = (struct htc_packet *) skb->head;

		if (!IS_ALIGNED((unsigned long) skb->data, 4))

		if (!IS_ALIGNED((unsigned long) skb->data, 4)) {

			size_t len = skb_headlen(skb);

			skb->data = PTR_ALIGN(skb->data - 4, 4);

			skb->data = PTR_ALIGN(skb->data - 4, 4);

			skb_set_tail_pointer(skb, len);

		}

		set_htc_rxpkt_info(packet, skb, skb->data,

		set_htc_rxpkt_info(packet, skb, skb->data,

				   ATH6KL_BUFFER_SIZE, endpoint);

				   ATH6KL_BUFFER_SIZE, endpoint);

		packet->skb = skb;

		packet->skb = skb;
@@ -917,8 +920,11 @@ void ath6kl_refill_amsdu_rxbufs(struct ath6kl *ar, int count) 
			return;

			return;





		packet = (struct htc_packet *) skb->head;

		packet = (struct htc_packet *) skb->head;

		if (!IS_ALIGNED((unsigned long) skb->data, 4))

		if (!IS_ALIGNED((unsigned long) skb->data, 4)) {

			size_t len = skb_headlen(skb);

			skb->data = PTR_ALIGN(skb->data - 4, 4);

			skb->data = PTR_ALIGN(skb->data - 4, 4);

			skb_set_tail_pointer(skb, len);

		}

		set_htc_rxpkt_info(packet, skb, skb->data,

		set_htc_rxpkt_info(packet, skb, skb->data,

				   ATH6KL_AMSDU_BUFFER_SIZE, 0);

				   ATH6KL_AMSDU_BUFFER_SIZE, 0);

		packet->skb = skb;

		packet->skb = skb;