From 3fc56ff0c80a8d3b066920b3f2c4b9ce06c3ce8c Mon Sep 17 00:00:00 2001 From: Jinwei Chen Date: Tue, 9 Mar 2021 00:43:25 -0800 Subject: [PATCH] qcacld-3.0: fix invalid net_dev accessing due to GRO flush timeout scenario: (1) KASAN is enabled and DP thread is slow to process and deliver Rx packets to stack. (2) vdev-2 do disconnection and flush Rx packets that belong to vdev-2, but DP thread is busy with processing vdev-0 Rx pakcets then no chance to do GRO flush for vdev-2, Rx flush timeout and vdev-2 net_dev get freed, later when DP thread do GRO flush for vdev-2 pakcets, invalid accessing to vdev-2 net_dev happened. solution: (1) increase Rx packets flush timeout from 1000 ms to 2000 ms. (2) do extra GRO flush if timeout happened. Change-Id: Iddc445d950eeb6cd2bd0b125bf87051e850abeb2 CRs-Fixed: 2894978 --- core/dp/txrx3.0/dp_rx_thread.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/core/dp/txrx3.0/dp_rx_thread.c b/core/dp/txrx3.0/dp_rx_thread.c index 700ce4bdd336..9f6a4e03d63d 100644 --- a/core/dp/txrx3.0/dp_rx_thread.c +++ b/core/dp/txrx3.0/dp_rx_thread.c @@ -25,7 +25,7 @@ #include /* Timeout in ms to wait for a DP rx thread */ -#define DP_RX_THREAD_WAIT_TIMEOUT 1000 +#define DP_RX_THREAD_WAIT_TIMEOUT 2000 #define DP_RX_TM_DEBUG 0 #if DP_RX_TM_DEBUG @@ -1029,10 +1029,17 @@ void dp_rx_thread_flush_by_vdev_id(struct dp_rx_thread *rx_thread, if (QDF_IS_STATUS_SUCCESS(qdf_status)) dp_debug("thread:%d napi gro flush successfully", rx_thread->id); - else if (qdf_status == QDF_STATUS_E_TIMEOUT) + else if (qdf_status == QDF_STATUS_E_TIMEOUT) { dp_err("thread:%d timed out waiting for napi gro flush", rx_thread->id); - else + /* + * If timeout, then force flush here in case any rx packets + * belong to this vdev is still pending on stack queue, + * while net_vdev will be freed soon. + */ + dp_rx_thread_gro_flush(rx_thread, + DP_RX_GRO_NORMAL_FLUSH); + } else dp_err("thread:%d failed while waiting for napi gro flush", rx_thread->id); }