Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH] wifi: ath11k: Fix SKB corruption in REO destination ring
From:   Kalle Valo <kvalo@kernel.org>
In-Reply-To: <20230403191533.28114-1-quic_nmaran@quicinc.com>
References: <20230403191533.28114-1-quic_nmaran@quicinc.com>
To:     Nagarajan Maran <quic_nmaran@quicinc.com>
Cc:     <ath11k@lists.infradead.org>, <linux-wireless@vger.kernel.org>,
        Nagarajan Maran <quic_nmaran@quicinc.com>
User-Agent: pwcli/0.1.1-git (https://github.com/kvalo/pwcli/) Python/3.7.3
Message-ID: <168191425579.18451.5661406318387164374.kvalo@kernel.org>
Date:   Wed, 19 Apr 2023 14:24:17 +0000 (UTC)
Precedence: bulk

Nagarajan Maran <quic_nmaran@quicinc.com> wrote:

> While running traffics for a long time, randomly an RX descriptor
> filled with value "0" from REO destination ring is received.
> This descriptor which is invalid causes the wrong SKB (SKB stored in
> the IDR lookup with buffer id "0") to be fetched which in turn
> causes SKB memory corruption issue and the same leads to crash
> after some time.
> 
> Changed the start id for idr allocation to "1" and the buffer id "0"
> is reserved for error validation. Introduced Sanity check to validate
> the descriptor, before processing the SKB.
> 
> Crash Signature :
> 
> Unable to handle kernel paging request at virtual address 3f004900
> PC points to "b15_dma_inv_range+0x30/0x50"
> LR points to "dma_cache_maint_page+0x8c/0x128".
> The Backtrace obtained is as follows:
> [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128)
> [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc)
> [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k])
> [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k])
> [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci])
> [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8)
> [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280)
> [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280)
> [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4)
> [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4)
> [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90)
> [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
> 
> Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
> 
> Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>

Patch applied to ath-next branch of ath.git, thanks.

f9fff67d2d7c wifi: ath11k: Fix SKB corruption in REO destination ring

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20230403191533.28114-1-quic_nmaran@quicinc.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches