From ac1aea6e5972bfed711e1cd9455c0ce387df5513 Mon Sep 17 00:00:00 2001 From: Jinwei Chen Date: Tue, 28 Apr 2020 14:36:31 +0800 Subject: [PATCH] qcacmn: WAR for duplicate RX desc issue from REO2SW ring Two back to back same RX desc is received from REO2SW1 ring. After first RX desc is processed, RX_desc nbuf will be set to null. when second REO entry/same RX desc is processing, dp_rx_desc_nbuf_sanity_check() will access to RX_desc nbuf, null nbuf accessing lead to panic. As a WAR, check RX_desc in_use flag firstly to avoid invalid accessing to nbuf, move dp_rx_desc_nbuf_sanity_check() after it. Change-Id: Ib9455c76af85cf83587c1428b20a9ad9e93a9499 CRs-Fixed: 2672088 --- dp/wifi3.0/dp_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dp/wifi3.0/dp_rx.c b/dp/wifi3.0/dp_rx.c index dc98373a23d1..8ddf8fd2463e 100644 --- a/dp/wifi3.0/dp_rx.c +++ b/dp/wifi3.0/dp_rx.c @@ -2020,8 +2020,6 @@ more_data: continue; } - dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc); - /* * this is a unlikely scenario where the host is reaping * a descriptor which it already reaped just a while ago @@ -2041,6 +2039,8 @@ more_data: continue; } + dp_rx_desc_nbuf_sanity_check(ring_desc, rx_desc); + if (qdf_unlikely(!dp_rx_desc_check_magic(rx_desc))) { dp_err("Invalid rx_desc cookie=%d", rx_buf_cookie); DP_STATS_INC(soc, rx.err.rx_desc_invalid_magic, 1);