A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Enhance debug info in rx descriptor

Browse source 
Add previously freed nbuf and buffer start address info in rx descriptor.
This helps in debugging use after free access of rx buffers.

Change-Id: I1c883bf049ce75dd0413b85946fe2982648d8004
CRs-Fixed: 2827151
This commit is contained in:
Karthik Kantamneni 2020-11-24 11:42:26 +05:30 • committed by snandini
commit 856ef5334e
1 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
dp/wifi3.0/dp_rx.h
View file

@ -83,12 +83,16 @@ enum dp_rx_desc_state {
* @replenish_caller: name of the function that last
* replenished the rx desc
* @replenish_ts: last replenish timestamp
* @prev_nbuf: previous nbuf info
* @prev_nbuf_data_addr: previous nbuf data address
*/
struct dp_rx_desc_dbg_info {
char freelist_caller[QDF_MEM_FUNC_NAME_SIZE];
uint64_t freelist_ts;
char replenish_caller[QDF_MEM_FUNC_NAME_SIZE];
uint64_t replenish_ts;
qdf_nbuf_t prev_nbuf;
uint8_t *prev_nbuf_data_addr;
};
/**
@ -111,6 +115,7 @@ struct dp_rx_desc_dbg_info {
* @unmapped used to mark rx_desc an unmapped if the corresponding
* nbuf is already unmapped
* @in_err_state : Nbuf sanity failed for this descriptor.
* @nbuf_data_addr : VA of nbuf data posted
*/
struct dp_rx_desc {
qdf_nbuf_t nbuf;
@ -120,6 +125,7 @@ struct dp_rx_desc {
uint8_t pool_id;
#ifdef RX_DESC_DEBUG_CHECK
uint32_t magic;
uint8_t *nbuf_data_addr;
struct dp_rx_desc_dbg_info *dbg_info;
#endif
uint8_t in_use:1,
@ -780,6 +786,9 @@ void dp_rx_desc_update_dbg_info(struct dp_rx_desc *rx_desc,
qdf_str_lcopy(info->freelist_caller, func_name,
QDF_MEM_FUNC_NAME_SIZE);
info->freelist_ts = qdf_get_log_timestamp();
info->prev_nbuf = rx_desc->nbuf;
info->prev_nbuf_data_addr = rx_desc->nbuf_data_addr;
rx_desc->nbuf_data_addr = NULL;
}
}
#else
@ -825,6 +834,8 @@ void __dp_rx_add_to_free_desc_list(union dp_rx_desc_list_elem_t **head,
{
qdf_assert(head && new);
dp_rx_desc_update_dbg_info(new, func_name, RX_DESC_IN_FREELIST);
new->nbuf = NULL;
new->in_use = 0;
@ -833,8 +844,6 @@ void __dp_rx_add_to_free_desc_list(union dp_rx_desc_list_elem_t **head,
/* reset tail if head->next is NULL */
if (!*tail || !(*head)->next)
*tail = *head;
dp_rx_desc_update_dbg_info(new, func_name, RX_DESC_IN_FREELIST);
}
uint8_t dp_rx_process_invalid_peer(struct dp_soc *soc, qdf_nbuf_t nbuf,
@ -1332,6 +1341,7 @@ void dp_rx_desc_prep(struct dp_rx_desc *rx_desc,
rx_desc->magic = DP_RX_DESC_MAGIC;
rx_desc->nbuf = (nbuf_frag_info_t->virt_addr).nbuf;
rx_desc->unmapped = 0;
rx_desc->nbuf_data_addr = (uint8_t *)qdf_nbuf_data(rx_desc->nbuf);
}
/**