lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wcn36xx: add proper DMA memory barriers in rx path

Browse Source 
[ Upstream commit 9bfe38e064af5decba2ffce66a2958ab8b10eaa4 ]

This is essentially exactly following the dma_wmb()/dma_rmb() usage
instructions in Documentation/memory-barriers.txt.

The theoretical races here are:

1. DXE (the DMA Transfer Engine in the Wi-Fi subsystem) seeing the
dxe->ctrl & WCN36xx_DXE_CTRL_VLD write before the dxe->dst_addr_l
write, thus performing DMA into the wrong address.

2. CPU reading dxe->dst_addr_l before DXE unsets dxe->ctrl &
WCN36xx_DXE_CTRL_VLD. This should generally be harmless since DXE
doesn't write dxe->dst_addr_l (no risk of freeing the wrong skb).

Fixes: 8e84c25821 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Benjamin Li <benl@squareup.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211023001528.3077822-1-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Benjamin Li 2021-10-22 17:15:28 -07:00 committed by Greg Kroah-Hartman
parent a3256ae45b
commit 9ca0d10742
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/wireless/ath/wcn36xx/dxe.c
View File

@ -563,6 +563,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
dxe = ctl->desc; dxe = ctl->desc;
while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) { while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) {
/* do not read until we own DMA descriptor */
dma_rmb();
/* read/modify DMA descriptor */
skb = ctl->skb; skb = ctl->skb;
dma_addr = dxe->dst_addr_l; dma_addr = dxe->dst_addr_l;
ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC); ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC);
@ -573,9 +577,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE, dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE,
DMA_FROM_DEVICE); DMA_FROM_DEVICE);
wcn36xx_rx_skb(wcn, skb); wcn36xx_rx_skb(wcn, skb);
} /* else keep old skb not submitted and use it for rx DMA */ }
/* else keep old skb not submitted and reuse it for rx DMA
* (dropping the packet that it contained)
*/
/* flush descriptor changes before re-marking as valid */
dma_wmb();
dxe->ctrl = ctrl; dxe->ctrl = ctrl;
ctl = ctl->next; ctl = ctl->next;
dxe = ctl->desc; dxe = ctl->desc;
} }