linux/drivers/net/wireless/ath
Nicolas Boichat b713996083 ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet
When the FW bundles multiple packets, pkt->act_len may be incorrect
as it refers to the first packet only (however, the FW will only
bundle packets that fit into the same pkt->alloc_len).

Before this patch, the skb length would be set (incorrectly) to
pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually
adjusted in ath10k_sdio_mbox_rx_process_packet.

The first problem is that ath10k_sdio_mbox_rx_process_packet does not
use proper skb_put commands to adjust the length (it directly changes
skb->len), so we end up with a mismatch between skb->head + skb->tail
and skb->data + skb->len. This is quite serious, and causes corruptions
in the TCP stack, as the stack tries to coalesce packets, and relies
on skb->tail being correct (that is, skb_tail_pointer must point to
the first byte_after_ the data).

Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet,
this moves the code to ath10k_sdio_mbox_rx_packet, and also add a
bounds check, as skb_put would crash the kernel if not enough space is
available.

Tested with QCA6174 SDIO with firmware
WLAN.RMH.4.4.1-00007-QCARMSWP-1.

Fixes: 8530b4e7b2 ("ath10k: sdio: set skb len for all rx packets")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-12 17:53:02 +03:00
..
ar5523 ath: fix SPDX tags 2019-06-26 18:11:06 +03:00
ath5k ath: fix SPDX tags 2019-06-26 18:11:06 +03:00
ath6kl ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() 2019-09-04 09:23:26 +03:00
ath9k ath9k: release allocated buffer if timed out 2019-09-10 16:31:40 +03:00
ath10k ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet 2019-09-12 17:53:02 +03:00
carl9170 carl9170: remove set but not used variable 'udev' 2019-09-04 09:09:34 +03:00
wcn36xx wcn36xx: use dynamic allocation for large variables 2019-09-04 09:22:26 +03:00
wil6210 wil6210: Delete an unnecessary kfree() call in wil_tid_ampdu_rx_alloc() 2019-09-04 09:07:29 +03:00
ath.h ath: Remove unnecessary ath_bcast_mac and use eth_broadcast_addr 2018-03-29 12:10:26 +03:00
debug.c
dfs_pattern_detector.c ath: DFS JP domain W56 fixed pulse type 3 RADAR detection 2019-04-29 17:58:51 +03:00
dfs_pattern_detector.h ath: add support to get the detected radar specifications 2018-05-25 13:15:21 +03:00
dfs_pri_detector.c
dfs_pri_detector.h ath: add support to get the detected radar specifications 2018-05-25 13:15:21 +03:00
hw.c
Kconfig ath: fix SPDX tags 2019-06-26 18:11:06 +03:00
key.c
main.c
Makefile ath: fix SPDX tags 2019-06-26 18:11:06 +03:00
reg.h
regd_common.h ath: regd: add extra US coutry codes 2019-02-07 17:02:19 +02:00
regd.c
regd.h ath: drop duplicated define 2019-04-29 17:55:53 +03:00
spectral_common.h
trace.c
trace.h