From patchwork Thu Oct 24 06:03:11 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sriram R X-Patchwork-Id: 11208333 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B9EA51515 for ; Thu, 24 Oct 2019 06:03:49 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8C04D20856 for ; Thu, 24 Oct 2019 06:03:49 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="nhNRUVdo"; dkim=fail reason="key not found in DNS" (0-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="cWLWKvpf"; dkim=fail reason="key not found in DNS" (0-bit key) header.d=codeaurora.org header.i=@codeaurora.org header.b="cWLWKvpf" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8C04D20856 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=AFk709OrIBt7IRn9bmhEv0w1rk2M+rr24hpPKNfOhv4=; b=nhN RUVdoTqIyokJavR9Vu9M32JqDqxmBo6GEzx87QNNYEn0dJsThKDj7WmQsgq/vMy8sMglfgt/hlb+o hJjlz+tV5Hn3OA9veEh5jKSa/jmoGw9d+vhCqiTwRdWjzq7Gq2naGU94kZrGwj9NvFXB3/h/orapq sSO3pwkjux25k5eaEtAwXm/JSpRPS1QdjkikZMCCaizJPSkOUTs5mNdA7ksH/I4xWQBVOiSQrsQxI qlw2C3ijnZcw16GpUangYlTEnxR64fH+QhoLVElaeMpPMQkl0Kdjxst4bdsJHTRx40PTZ0QtJCF5G PMNbVuGQmE8ZIiMQbrmN0+4FqOCMyiA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1iNWDr-0004xh-Uv; Thu, 24 Oct 2019 06:03:47 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1iNWDp-0004xN-EL for ath11k@lists.infradead.org; Thu, 24 Oct 2019 06:03:46 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 55C8C60F32; Thu, 24 Oct 2019 06:03:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1571897024; bh=FfQvR56gn/yxpuLNwjNBcSYJyB/k6grtISpqdghH1gc=; h=From:To:Cc:Subject:Date:From; b=cWLWKvpfxBnFH2onMJhU5bd9mjiLwcxjfTAbe8JlwuQomYG7meRolbyZ4TJB02KLF oHBDZSoSN9k02pZ4Ncw7h+WW7nqAQiQD0HjzEjzZjYDx/xTe6gnBRBEWqc6+PGb8hg VKmfIFaRkLyutAv9QpYZE0sAHD5tnwhUhRsjjNWs= X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on pdx-caf-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=2.0 tests=ALL_TRUSTED,BAYES_00, DKIM_INVALID,DKIM_SIGNED,SPF_NONE autolearn=no autolearn_force=no version=3.4.0 Received: from checstp253621-lin.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: srirrama@codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id DFF5B60DBA; Thu, 24 Oct 2019 06:03:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1571897024; bh=FfQvR56gn/yxpuLNwjNBcSYJyB/k6grtISpqdghH1gc=; h=From:To:Cc:Subject:Date:From; b=cWLWKvpfxBnFH2onMJhU5bd9mjiLwcxjfTAbe8JlwuQomYG7meRolbyZ4TJB02KLF oHBDZSoSN9k02pZ4Ncw7h+WW7nqAQiQD0HjzEjzZjYDx/xTe6gnBRBEWqc6+PGb8hg VKmfIFaRkLyutAv9QpYZE0sAHD5tnwhUhRsjjNWs= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org DFF5B60DBA Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=srirrama@codeaurora.org From: Sriram R To: ath11k@lists.infradead.org Subject: [PATCH v3] ath11k: Fix skb_panic observed during msdu coalescing Date: Thu, 24 Oct 2019 11:33:11 +0530 Message-Id: <1571896991-19713-1-git-send-email-srirrama@codeaurora.org> X-Mailer: git-send-email 2.7.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20191023_230345_526779_AD95F712 X-CRM114-Status: GOOD ( 12.96 ) X-Spam-Score: -2.5 (--) X-Spam-Report: SpamAssassin version 3.4.2 on bombadil.infradead.org summary: Content analysis details: (-2.5 points) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [198.145.29.96 listed in list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-BeenThere: ath11k@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sriram R MIME-Version: 1.0 Sender: "ath11k" Errors-To: ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org skb_panic is hit during msdu coalescing whenever enough tailroom is not allocated based on the remaining msdu length which is spread across in different rx buffers. Compute the extra length for resizing the skb based on the total msdu length and the msdu length of the first buffer. Signed-off-by: Sriram R --- v3 : Rebased on top of ath11k-post-bringup drivers/net/wireless/ath/ath11k/dp_rx.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 321a2bb..acad746 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -1344,15 +1344,22 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, { struct sk_buff *skb; struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first); + int buf_first_hdr_len, buf_first_len; struct hal_rx_desc *ldesc; int space_extra; int rem_len; int buf_len; - if (WARN_ON_ONCE(msdu_len <= (DP_RX_BUFFER_SIZE - - (HAL_RX_DESC_SIZE + l3pad_bytes)))) { - skb_put(first, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + /* As the msdu is spread across multiple rx buffers, + * find the offset to the start of msdu for computing + * the length of the msdu in the first buffer. + */ + buf_first_hdr_len = HAL_RX_DESC_SIZE + l3pad_bytes; + buf_first_len = DP_RX_BUFFER_SIZE - buf_first_hdr_len; + + if (WARN_ON_ONCE(msdu_len <= buf_first_len)) { + skb_put(first, buf_first_hdr_len + msdu_len); + skb_pull(first, buf_first_hdr_len); return 0; } @@ -1365,9 +1372,9 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, * in the first buf is of length DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE. */ skb_put(first, DP_RX_BUFFER_SIZE); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + skb_pull(first, buf_first_hdr_len); - space_extra = msdu_len - (DP_RX_BUFFER_SIZE + skb_tailroom(first)); + space_extra = msdu_len - (buf_first_len + skb_tailroom(first)); if (space_extra > 0 && (pskb_expand_head(first, 0, space_extra, GFP_ATOMIC) < 0)) { /* Free up all buffers of the MSDU */ @@ -1387,8 +1394,7 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, */ ath11k_dp_rx_desc_end_tlv_copy(rxcb->rx_desc, ldesc); - rem_len = msdu_len - - (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE - l3pad_bytes); + rem_len = msdu_len - buf_first_len; while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) { rxcb = ATH11K_SKB_RXCB(skb); if (rxcb->is_continuation)