From patchwork Wed Aug 14 08:31:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sriram R X-Patchwork-Id: 11093499 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7C10214DB for ; Wed, 14 Aug 2019 08:32:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6683D287BD for ; Wed, 14 Aug 2019 08:32:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5AD4C287BF; Wed, 14 Aug 2019 08:32:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id F2494287BD for ; Wed, 14 Aug 2019 08:32:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=zEm+HoIfpbnkAHb0M0isoTTMXpJBePEffF3ZgQgOl9A=; b=TN/ 5LIL0Fo3KdP0PL7CVyjCpU3dVy6yW5Kpb1aDV4OMez1cI+7ttAcDFUDgXJwRj9aJIwC3OdtdFMdZ1 qbmiDr+TQGXOA8ohI290HFaWcrdlYhWNjRnfwHHde6jg7D9BQBT4/mohequIx33hQb2QgDPoa3aKC qeVPcv4Ejbx/HFxyR8NeZGNenwRMvYLhAh5lKY6deF0yvC0RhbahM1lYG5Vt93pzD+mwq6XlQv5Rr n+Xnihb92dVpygUCv7O9PTdzb+1Ey0YOYUqaFY0IQ4wp93Juh7mFHliQdogUL5SI4vT+JxblyfiSr dYrjnoaZlGJTthcZyYIbo+LCZ2mal5g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1hxohL-000602-2o; Wed, 14 Aug 2019 08:31:59 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1hxohI-0005zC-4O for ath11k@lists.infradead.org; Wed, 14 Aug 2019 08:31:57 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 7C280607DE; Wed, 14 Aug 2019 08:31:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1565771515; bh=plW+HL/jwUcr37uafJtGhP+jPTRRLUnWoi7oeoScoZ8=; h=From:To:Cc:Subject:Date:From; b=bdud4SvFkgrF16HzimEmTCjH0vgHK0/yi7fIHOCAy9mxTvmeAUDs7hdXxxr/at0S5 0TE4lmmdyUwMLINuk2J2Amm4s7NrWEM3UOwMNpjPkheZnlnYDxR4GuZ8gFChUAONWz 2DYsX1I5+ODkmWOtBfR+Edl9gEiWe8HYtibbVaHY= Received: from checstp253621-lin.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: srirrama@codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id AC94960128; Wed, 14 Aug 2019 08:31:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1565771514; bh=plW+HL/jwUcr37uafJtGhP+jPTRRLUnWoi7oeoScoZ8=; h=From:To:Cc:Subject:Date:From; b=kbO4vjTnkFXkEf6KXM6oEAQjzpLpLXKzs/bAwTcRdsDkfOJQ9RQ9Mp0aby3o1eDPX TxGP9qX+y5u5BH454NeK7QYgp6Qce+s4WQrn2GFcNRe4Anhk+HJnBBWMU1X1X/TyJh B5PEW0yaKRRpk7t7H5dv6Vlbl+1N+diULzhSP2sI= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org AC94960128 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=srirrama@codeaurora.org From: Sriram R To: ath11k@lists.infradead.org Subject: [PATCH v2] ath11k: Fix skb_panic observed during msdu coalescing Date: Wed, 14 Aug 2019 14:01:42 +0530 Message-Id: <1565771502-6999-1-git-send-email-srirrama@codeaurora.org> X-Mailer: git-send-email 2.7.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190814_013156_220352_C632CD62 X-CRM114-Status: GOOD ( 12.93 ) X-BeenThere: ath11k@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sriram R MIME-Version: 1.0 Sender: "ath11k" Errors-To: ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP skb_panic is hit during msdu coalescing whenever enough tailroom is not allocated based on the remaining msdu length which is spread across in different rx buffers. Compute the extra length for resizing the skb based on the total msdu length and the msdu length of the first buffer. Signed-off-by: Sriram R --- v2 : Trivial changes to variable names drivers/net/wireless/ath/ath11k/dp_rx.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 7d6b0c3..4ec9963 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -1366,21 +1366,28 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, { struct sk_buff *skb; struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(first); + int buf_first_hdr_len, buf_first_len; struct hal_rx_desc *ldesc; int space_extra; int rem_len; int buf_len; + /* As the msdu is spread across multiple rx buffers, + * find the offset to the start of msdu for computing + * the length of the msdu in the first buffer. + */ + buf_first_hdr_len = HAL_RX_DESC_SIZE + l3pad_bytes; + buf_first_len = DP_RX_BUFFER_SIZE - buf_first_hdr_len; + if (!rxcb->is_continuation) { - skb_put(first, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + skb_put(first, buf_first_hdr_len + msdu_len); + skb_pull(first, buf_first_hdr_len); return 0; } - if (WARN_ON_ONCE(msdu_len <= (DP_RX_BUFFER_SIZE - - (HAL_RX_DESC_SIZE + l3pad_bytes)))) { - skb_put(first, HAL_RX_DESC_SIZE + l3pad_bytes + msdu_len); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + if (WARN_ON_ONCE(msdu_len <= buf_first_len)) { + skb_put(first, buf_first_hdr_len + msdu_len); + skb_pull(first, buf_first_hdr_len); return 0; } @@ -1393,9 +1400,9 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, * in the first buf is of length DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE. */ skb_put(first, DP_RX_BUFFER_SIZE); - skb_pull(first, HAL_RX_DESC_SIZE + l3pad_bytes); + skb_pull(first, buf_first_hdr_len); - space_extra = msdu_len - (DP_RX_BUFFER_SIZE + skb_tailroom(first)); + space_extra = msdu_len - (buf_first_len + skb_tailroom(first)); if (space_extra > 0 && (pskb_expand_head(first, 0, space_extra, GFP_ATOMIC) < 0)) { /* Free up all buffers of the MSDU */ @@ -1415,8 +1422,7 @@ static int ath11k_dp_rx_msdu_coalesce(struct ath11k *ar, */ ath11k_dp_rx_desc_end_tlv_copy(rxcb->rx_desc, ldesc); - rem_len = msdu_len - - (DP_RX_BUFFER_SIZE - HAL_RX_DESC_SIZE - l3pad_bytes); + rem_len = msdu_len - buf_first_len; while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) { rxcb = ATH11K_SKB_RXCB(skb); if (rxcb->is_continuation)