Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jernej =?utf-8?B?xaBrcmFiZWM=?= <jernej.skrabec@gmail.com>
To:     Martin Blumenstingl <martin.blumenstingl@googlemail.com>,
        Larry Finger <Larry.Finger@lwfinger.net>
Cc:     linux-wireless <linux-wireless@vger.kernel.org>
Subject: Re: Driver for rtw8723ds
Date:   Sat, 13 May 2023 12:23:17 +0200
Message-ID: <13262218.uLZWGnKmhe@jernej-laptop>
In-Reply-To: <880bb4ed-f3a5-2d7f-db10-fec65087dd05@lwfinger.net>
References: <72a8eeb1-c91c-80a7-5a09-1b7963e0996b@lwfinger.net>
 <CAFBinCAA2CXZBRO7yb4Hjg6Cos4JFQiCMWZLGVh8DCOYWg7HhA@mail.gmail.com>
 <880bb4ed-f3a5-2d7f-db10-fec65087dd05@lwfinger.net>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Larry,

Dne sreda, 10. maj 2023 ob 23:47:24 CEST je Larry Finger napisal(a):
> On 5/10/23 16:07, Martin Blumenstingl wrote:
> > On Wed, May 10, 2023 at 12:02=E2=80=AFAM Larry Finger <Larry.Finger@lwf=
inger.net> wrote:
> > [...]
> >> I added that patch to the driver. The user reports that he was able to=
 do a ping
> >> and an nslookup before it crashed with the following in the log:
> > That's some positive news alongside the crash log: it seems that a
> > part of the driver works! :-)
> >=20
> >> [    8.700626] skbuff: skb_over_panic: text:ffff8000011924ac len:3341 =
put:3341
> >> head:ffff000003b3c000 data:ffff000003b3c040 tail:0xd4d end:0x2c0 dev:<=
NULL>
> > [...]
> >> Somehow skb->tail was greater than skb->end. Unfortunately I do not ha=
ve access
> >> to gdb to tell you what line corresponds to rtw_sdio_rx_skb+0x50 on th=
e MangoPi
> >> MQ Quad.
> > I need to have a closer look at the pkg_offset and struct
> > rtw_rx_pkt_stat which we receive.
> > Recently my own MangoPI MQ-Quad arrived but I did not have the time to
> > set it up yet. I'll try to do so during the weekend so I can debug
> > this on my own.
> >=20
> > Please ping me next week in case I haven't provided any update until th=
en.
>=20
> I have some test prints in to check for skb overrun. My initial indicatio=
n is=20
> that the problem was in the c2h branch of rtw_sdio_rx_skb(), but my next =
run=20
> should verify that. My changes will do a pr_warn_once() when the problem=
=20
> happens, and then drop the skb.
>=20
> My contact reported that he had one run of 3 minutes before the problem=20
> happened, which is good news for most of the driver.

I may have discovered something interesting. rtl8723ds vendor driver has
following checks in RX data parsing code:
https://github.com/lwfinger/rtl8723ds/blob/master/hal/rtl8723d/sdio/rtl8723=
ds_recv.c#L83-L99

Those checks are absent in rtl8822bs vendor driver, which was my original
development platform for SDIO. This may indicate some kind of bug in FW
and/or HW.

I think that at least second check, which checks for exactly the case your
client experience, can be easily added and tested.

Best regards,
Jernej