mirror of
https://gitee.com/bianbu-linux/linux-6.6
synced 2025-07-24 01:54:03 -04:00
499aafa2ce
[ Upstream commit bbc86757ca62423c3b6bd8f7176da1ff43450769 ]
When max virtual ap interfaces are configured in all the bands with
ACS and hostapd restart is done every 60s, a crash is observed at
random times.
In the above scenario, a fragmented packet is received for self peer,
for which rx_tid and rx_frags are not initialized in datapath.
While handling this fragment, crash is observed as the rx_frag list
is uninitialized and when we walk in ath12k_dp_rx_h_sort_frags,
skb null leads to exception.
To address this, before processing received fragments we check
dp_setup_done flag is set to ensure that peer has completed its
dp peer setup for fragment queue, else ignore processing the
fragments.
Call trace:
PC points to "ath12k_dp_process_rx_err+0x4e8/0xfcc [ath12k]"
LR points to "ath12k_dp_process_rx_err+0x480/0xfcc [ath12k]".
The Backtrace obtained is as follows:
ath12k_dp_process_rx_err+0x4e8/0xfcc [ath12k]
ath12k_dp_service_srng+0x78/0x260 [ath12k]
ath12k_pci_write32+0x990/0xb0c [ath12k]
__napi_poll+0x30/0xa4
net_rx_action+0x118/0x270
__do_softirq+0x10c/0x244
irq_exit+0x64/0xb4
__handle_domain_irq+0x88/0xac
gic_handle_irq+0x74/0xbc
el1_irq+0xf0/0x1c0
arch_cpu_idle+0x10/0x18
do_idle+0x104/0x248
cpu_startup_entry+0x20/0x64
rest_init+0xd0/0xdc
arch_call_rest_init+0xc/0x14
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230821130343.29495-2-quic_hprem@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
70 lines
2 KiB
C
70 lines
2 KiB
C
/* SPDX-License-Identifier: BSD-3-Clause-Clear */
|
|
/*
|
|
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
|
|
* Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
|
|
*/
|
|
|
|
#ifndef ATH12K_PEER_H
|
|
#define ATH12K_PEER_H
|
|
|
|
#include "dp_rx.h"
|
|
|
|
struct ppdu_user_delayba {
|
|
u16 sw_peer_id;
|
|
u32 info0;
|
|
u16 ru_end;
|
|
u16 ru_start;
|
|
u32 info1;
|
|
u32 rate_flags;
|
|
u32 resp_rate_flags;
|
|
};
|
|
|
|
struct ath12k_peer {
|
|
struct list_head list;
|
|
struct ieee80211_sta *sta;
|
|
int vdev_id;
|
|
u8 addr[ETH_ALEN];
|
|
int peer_id;
|
|
u16 ast_hash;
|
|
u8 pdev_idx;
|
|
u16 hw_peer_id;
|
|
|
|
/* protected by ab->data_lock */
|
|
struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
|
|
struct ath12k_dp_rx_tid rx_tid[IEEE80211_NUM_TIDS + 1];
|
|
|
|
/* Info used in MMIC verification of
|
|
* RX fragments
|
|
*/
|
|
struct crypto_shash *tfm_mmic;
|
|
u8 mcast_keyidx;
|
|
u8 ucast_keyidx;
|
|
u16 sec_type;
|
|
u16 sec_type_grp;
|
|
struct ppdu_user_delayba ppdu_stats_delayba;
|
|
bool delayba_flag;
|
|
bool is_authorized;
|
|
|
|
/* protected by ab->data_lock */
|
|
bool dp_setup_done;
|
|
};
|
|
|
|
void ath12k_peer_unmap_event(struct ath12k_base *ab, u16 peer_id);
|
|
void ath12k_peer_map_event(struct ath12k_base *ab, u8 vdev_id, u16 peer_id,
|
|
u8 *mac_addr, u16 ast_hash, u16 hw_peer_id);
|
|
struct ath12k_peer *ath12k_peer_find(struct ath12k_base *ab, int vdev_id,
|
|
const u8 *addr);
|
|
struct ath12k_peer *ath12k_peer_find_by_addr(struct ath12k_base *ab,
|
|
const u8 *addr);
|
|
struct ath12k_peer *ath12k_peer_find_by_id(struct ath12k_base *ab, int peer_id);
|
|
void ath12k_peer_cleanup(struct ath12k *ar, u32 vdev_id);
|
|
int ath12k_peer_delete(struct ath12k *ar, u32 vdev_id, u8 *addr);
|
|
int ath12k_peer_create(struct ath12k *ar, struct ath12k_vif *arvif,
|
|
struct ieee80211_sta *sta,
|
|
struct ath12k_wmi_peer_create_arg *arg);
|
|
int ath12k_wait_for_peer_delete_done(struct ath12k *ar, u32 vdev_id,
|
|
const u8 *addr);
|
|
bool ath12k_peer_exist_by_vdev_id(struct ath12k_base *ab, int vdev_id);
|
|
struct ath12k_peer *ath12k_peer_find_by_ast(struct ath12k_base *ab, int ast_hash);
|
|
|
|
#endif /* _PEER_H_ */
|