| Message ID | 1637312901-10279-2-git-send-email-quic_vnaralas@quicinc.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d3d358efc553de4f9d803c889a2e91523ea90f19 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [PATCHv2,1/2] ath11k: add dbring debug support | expand |
Venkateswara Naralasetty <quic_vnaralas@quicinc.com> writes: > Currently there is no validation on the spectral/CFR report > over the db ring buffers from the hardware. Improper/incomplete > DMA by the target can result in invalid data received by host. > Due to this we may populate incorrect data to user space. > > This buffer validation support fix this issues by filling some > magic value in the buffer during buffer replenish and check for > the magic value in the buffer received by the target. If host > detect magic value in the received buffer it will drop the buffer. > > Tested-on: IPQ8074 WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1 > > Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com> > --- > v2: > * Rebased on TOT > > drivers/net/wireless/ath/ath11k/dbring.c | 32 ++++++++++++++++++++++++++++++ > drivers/net/wireless/ath/ath11k/dbring.h | 1 + > drivers/net/wireless/ath/ath11k/spectral.c | 10 ++++++++++ > 3 files changed, 43 insertions(+) > > diff --git a/drivers/net/wireless/ath/ath11k/dbring.c b/drivers/net/wireless/ath/ath11k/dbring.c > index 31cf7ac..5c07442 100644 > --- a/drivers/net/wireless/ath/ath11k/dbring.c > +++ b/drivers/net/wireless/ath/ath11k/dbring.c > @@ -6,6 +6,37 @@ > #include "core.h" > #include "debug.h" > > +#define ATH11K_DB_MAGIC_VALUE 0xdeadbeaf > + > +int ath11k_dbring_validate_buffer(struct ath11k *ar, void *buffer, u32 size) > +{ > + u32 *temp; > + int idx; > + > + size = size >> 2; > + > + for (idx = 0, temp = buffer; idx < size; idx++, temp++) { > + if (*temp == ATH11K_DB_MAGIC_VALUE) { > + ath11k_warn(ar->ab, "found magic value in the buffer\n"); I moved the warning message to the callers to make it easier to identify where the corruption is happening and also added the word "dropping" to make the message clearer for the user. https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&id=6c90df4c7aca225c4c486f31ca956ae6c08abe59
Venkateswara Naralasetty <quic_vnaralas@quicinc.com> wrote: > Currently there is no validation on the spectral/CFR report > over the db ring buffers from the hardware. Improper/incomplete > DMA by the target can result in invalid data received by host. > Due to this we may populate incorrect data to user space. > > This buffer validation support fix this issues by filling some > magic value in the buffer during buffer replenish and check for > the magic value in the buffer received by the target. If host > detect magic value in the received buffer it will drop the buffer. > > Tested-on: IPQ8074 WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1 > > Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com> > Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Patch applied to ath-next branch of ath.git, thanks. d3d358efc553 ath11k: add spectral/CFR buffer validation support
diff --git a/drivers/net/wireless/ath/ath11k/dbring.c b/drivers/net/wireless/ath/ath11k/dbring.c index 31cf7ac..5c07442 100644 --- a/drivers/net/wireless/ath/ath11k/dbring.c +++ b/drivers/net/wireless/ath/ath11k/dbring.c @@ -6,6 +6,37 @@ #include "core.h" #include "debug.h" +#define ATH11K_DB_MAGIC_VALUE 0xdeadbeaf + +int ath11k_dbring_validate_buffer(struct ath11k *ar, void *buffer, u32 size) +{ + u32 *temp; + int idx; + + size = size >> 2; + + for (idx = 0, temp = buffer; idx < size; idx++, temp++) { + if (*temp == ATH11K_DB_MAGIC_VALUE) { + ath11k_warn(ar->ab, "found magic value in the buffer\n"); + return -EINVAL; + } + } + + return 0; +} + +static void ath11k_dbring_fill_magic_value(struct ath11k *ar, + void *buffer, u32 size) +{ + u32 *temp; + int idx; + + size = size >> 2; + + for (idx = 0, temp = buffer; idx < size; idx++, temp++) + *temp++ = ATH11K_DB_MAGIC_VALUE; +} + static int ath11k_dbring_bufs_replenish(struct ath11k *ar, struct ath11k_dbring *ring, struct ath11k_dbring_element *buff, @@ -27,6 +58,7 @@ static int ath11k_dbring_bufs_replenish(struct ath11k *ar, ptr_unaligned = buff->payload; ptr_aligned = PTR_ALIGN(ptr_unaligned, ring->buf_align); + ath11k_dbring_fill_magic_value(ar, ptr_aligned, ring->buf_sz); paddr = dma_map_single(ab->dev, ptr_aligned, ring->buf_sz, DMA_FROM_DEVICE); diff --git a/drivers/net/wireless/ath/ath11k/dbring.h b/drivers/net/wireless/ath/ath11k/dbring.h index 78a985f..124c7db 100644 --- a/drivers/net/wireless/ath/ath11k/dbring.h +++ b/drivers/net/wireless/ath/ath11k/dbring.h @@ -76,4 +76,5 @@ int ath11k_dbring_get_cap(struct ath11k_base *ab, struct ath11k_dbring_cap *db_cap); void ath11k_dbring_srng_cleanup(struct ath11k *ar, struct ath11k_dbring *ring); void ath11k_dbring_buf_cleanup(struct ath11k *ar, struct ath11k_dbring *ring); +int ath11k_dbring_validate_buffer(struct ath11k *ar, void *data, u32 size); #endif /* ATH11K_DBRING_H */ diff --git a/drivers/net/wireless/ath/ath11k/spectral.c b/drivers/net/wireless/ath/ath11k/spectral.c index ac4da99..b65e23d 100644 --- a/drivers/net/wireless/ath/ath11k/spectral.c +++ b/drivers/net/wireless/ath/ath11k/spectral.c @@ -581,6 +581,7 @@ int ath11k_spectral_process_fft(struct ath11k *ar, u16 length, freq; u8 chan_width_mhz, bin_sz; int ret; + u32 check_length; lockdep_assert_held(&ar->spectral.lock); @@ -614,6 +615,11 @@ int ath11k_spectral_process_fft(struct ath11k *ar, return -EINVAL; } + check_length = sizeof(*fft_report) + (num_bins * ab->hw_params.spectral.fft_sz); + ret = ath11k_dbring_validate_buffer(ar, data, check_length); + if (ret) + return ret; + ret = ath11k_spectral_pull_search(ar, data, &search); if (ret) { ath11k_warn(ab, "failed to pull search report %d\n", ret); @@ -747,6 +753,10 @@ static int ath11k_spectral_process_data(struct ath11k *ar, goto err; } + ret = ath11k_dbring_validate_buffer(ar, data, tlv_len); + if (ret) + goto err; + summary = (struct spectral_summary_fft_report *)tlv; ath11k_spectral_pull_summary(ar, ¶m->meta, summary, &summ_rpt);
Currently there is no validation on the spectral/CFR report over the db ring buffers from the hardware. Improper/incomplete DMA by the target can result in invalid data received by host. Due to this we may populate incorrect data to user space. This buffer validation support fix this issues by filling some magic value in the buffer during buffer replenish and check for the magic value in the buffer received by the target. If host detect magic value in the received buffer it will drop the buffer. Tested-on: IPQ8074 WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com> --- v2: * Rebased on TOT drivers/net/wireless/ath/ath11k/dbring.c | 32 ++++++++++++++++++++++++++++++ drivers/net/wireless/ath/ath11k/dbring.h | 1 + drivers/net/wireless/ath/ath11k/spectral.c | 10 ++++++++++ 3 files changed, 43 insertions(+)