From patchwork Wed Aug 14 04:07:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sriram R X-Patchwork-Id: 11093077 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A8EAF14DB for ; Wed, 14 Aug 2019 04:08:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8590B2860A for ; Wed, 14 Aug 2019 04:08:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 78944286AA; Wed, 14 Aug 2019 04:08:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 174652860A for ; Wed, 14 Aug 2019 04:08:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=wO2HDtOZ5Sg9vyzvkC3JV0ncgZ7QZDxWV6wUltc4yXg=; b=R9F nceGdvQP+W0TzvSu11fD2YSM1j7NZndAgdBa3MIgZ2LkSB5ktDyN/lid1HJpd0xt5zE6keEaASYY0 35MAfKwqNYVbGCnwFf+OAnibgvlI7EoIHADvO/FtOhcDPBIRs0JAJVgZZnjqIzGZFBMxWwGT3shHE OIR689nnDleYm8iWGsZHWvxzL8GKjGglVHq3HvN4jgNTnZ7H/aOyLm6FnAiWPgBHEGfqpi3Nln349 LkY+U2KEdviUwCmocfovwnoTIV92OkwlqcJW0Ju7GP7xXR/4oucT1MiTxRYzqj0la4Q9/VC4VXQVJ yUyawZnutuoHCbeMFKrrnEsCe0AUJQQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1hxkZs-0007B9-0h; Wed, 14 Aug 2019 04:08:00 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1hxkZo-0007Aa-V0 for ath11k@lists.infradead.org; Wed, 14 Aug 2019 04:07:58 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id EE31860740; Wed, 14 Aug 2019 04:07:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1565755675; bh=wBrJk3ErnTDcC949s4YO3iWqZBMVhBSKT/2WvE/KBMI=; h=From:To:Cc:Subject:Date:From; b=QlDBOKqA1XAW7WXG5PEEJmIVDUCQ7HY9vy7xiqVMleLUWJHB7lrEYjKr80izZMH2U SyJjM3qCBDU95nFo0HV9stT1DIuguowMchizuOLnOlKIUwQYfRaAC1sTbWFa6blYcL 0q/XSSxqAOJKmIu+b+Cj3AnFrpill3q5WXQWc8Zo= Received: from checstp253621-lin.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: srirrama@codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 6F9E960316; Wed, 14 Aug 2019 04:07:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1565755674; bh=wBrJk3ErnTDcC949s4YO3iWqZBMVhBSKT/2WvE/KBMI=; h=From:To:Cc:Subject:Date:From; b=Dj+nMWlri0u6jjSxZlpj7o8wmI/e9QROCw0nt3h1wqDS9c+YfCY5Z36sIoKoNtwLV v1gUg63kwOBkEZVM2UgeziCSLWn5boJG8T3nurJng491cB3TrPf5oHz09fp8pIRLDs tf+bfxW0aCV0mfFqZ+C4ZOQmiTWdNnJ63QG/FQx0= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 6F9E960316 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=srirrama@codeaurora.org From: Sriram R To: ath11k@lists.infradead.org Subject: [PATCH] ath11k: Fix skb_panic observed during msdu coalescing Date: Wed, 14 Aug 2019 09:37:41 +0530 Message-Id: <1565755661-811-1-git-send-email-srirrama@codeaurora.org> X-Mailer: git-send-email 2.7.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190813_210757_074177_B6DC65D1 X-CRM114-Status: GOOD ( 12.58 ) X-BeenThere: ath11k@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sriram R MIME-Version: 1.0 Sender: "ath11k" Errors-To: ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP skb_panic is hit during msdu coalescing whenever enough tailroom is not allocated based on the remaining msdu length which is spread across in different rx buffers. Compute the extra length for resizing the skb based on the total msdu length and the msdu length of the first buffer. Signed-off-by: Sriram R --- drivers/net/wireless/ath/ath11k/dp_rx.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 7d6b0c3..27d526b 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -1362,25 +1362,32 @@ void ath11k_dp_htt_htc_t2h_msg_handler(struct ath11k_base *ab, static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, struct sk_buff_head *msdu_list, struct sk_buff *first, struct sk_buff *last, - u8 l3pad_bytes, int msdu_len) + u8 l3pad_bytes, int msdu_total_len) { struct sk_buff *skb; struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first); + int msdu_first_offset, msdu_first_len; struct hal_rx_desc *ldesc; int space_extra; int rem_len; int buf_len; + /* As the msdu is spread across multiple rx buffers, + * find the offset to the start of msdu for computing + * the length of the msdu in the first buffer. + */ + msdu_first_offset = HAL_RX_DESC_SIZE + l3pad_bytes; + msdu_first_len = DP_RX_BUFFER_SIZE - msdu_first_offset; + if (!rxcb->is_continuation) { - skb_put(first, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + skb_put(first, msdu_first_offset + msdu_total_len); + skb_pull(first, msdu_first_offset); return 0; } - if (WARN_ON_ONCE(msdu_len <= (DP_RX_BUFFER_SIZE - - (HAL_RX_DESC_SIZE + l3pad_bytes)))) { - skb_put(first, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + if (WARN_ON_ONCE(msdu_total_len <= msdu_first_len)) { + skb_put(first, msdu_first_offset + msdu_total_len); + skb_pull(first, msdu_first_offset); return 0; } @@ -1393,9 +1400,9 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, * in the first buf is of length DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE. */ skb_put(first, DP_RX_BUFFER_SIZE); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + skb_pull(first, msdu_first_offset); - space_extra = msdu_len - (DP_RX_BUFFER_SIZE + skb_tailroom(first)); + space_extra = msdu_total_len - (msdu_first_len + skb_tailroom(first)); if (space_extra > 0 && (pskb_expand_head(first, 0, space_extra, GFP_ATOMIC) < 0)) { /* Free up all buffers of the MSDU */ @@ -1415,8 +1422,7 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, */ ath11k_dp_rx_desc_end_tlv_copy(rxcb->rx_desc, ldesc); - rem_len = msdu_len - - (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE - l3pad_bytes); + rem_len = msdu_total_len - msdu_first_len; while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) { rxcb = ATH11K_SKB_RXCB(skb); if (rxcb->is_continuation)