mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-13 08:07:32 -04:00
No description
- C 98.2%
- Assembly 1%
- Makefile 0.3%
- Shell 0.2%
- Python 0.1%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
3222184e14
Crash scenario: (1) frag data A is dropped and related RX desc A is replenished and reused, but pdev->free_list_tail is still pointed to RX desc A. (2) frag data B/C is coming, defrag fails then pdev->free_list_head will point to B-->C RX desc, but pdev->free_list_tail still point to A. (3) for defrag failing case, host only will replenish 1 RX buffer for current case, RX desc B is replenished, while C will be free back to RX desc pool. (4) dp_rx_add_desc_list_to_free_list will set RX desc A-->next = free_list, free_list point to C insted. (5) when step (1) RX desc A replenished buffer indicated to host by REO2Dst ring, RX desc A -->nbuf actually is pointed to another RX desc, invalid skb accessing will happen. Solution: a. reset tail pointer in dp_rx_add_desc_list_to_free_list at last. b. reset tail pointer same as head in dp_rx_add_to_free_desc_list if head->next is NULL. c. set correct rx_bufs number for replenish when dp_rx_defrag fails. Change-Id: Ib297baea3605a09dd7d85d1f5ceb95db48a2e1f1 CRs-Fixed: 2603676 |
||
| cfg | ||
| dp | ||
| ftm | ||
| global_lmac_if | ||
| hal/wifi3.0 | ||
| hif | ||
| htc | ||
| init_deinit/dispatcher | ||
| os_if/linux | ||
| qal | ||
| qdf | ||
| scheduler | ||
| spectral | ||
| target_if | ||
| umac | ||
| utils | ||
| wbuff | ||
| wlan_cfg | ||
| wmi | ||
| README.txt | ||
| VERSION.txt | ||
This is CNSS WLAN Host Driver for products starting from iHelium