From patchwork Fri Oct 15 13:17:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bryan O'Donoghue X-Patchwork-Id: 515852 Delivered-To: patch@linaro.org Received: by 2002:adf:a11e:0:0:0:0:0 with SMTP id o30csp544096wro; Fri, 15 Oct 2021 06:15:54 -0700 (PDT) X-Google-Smtp-Source: ABdhPJykQJXkDA/ki/5v+2rZMT0SKTIplqNMbkxin/8bmhOZt5r3Kv2gmZDNlgGjcm1ueTxApAA2 X-Received: by 2002:a05:6808:f8f:: with SMTP id o15mr7975755oiw.137.1634303754401; Fri, 15 Oct 2021 06:15:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1634303754; cv=none; d=google.com; s=arc-20160816; b=bHm+hxvMRYAOZ4XDuw0+JiEnplMiXSkYWesNsSjucAwglEFEi8kgwhEShhcwhsob/Q AxVRbmKN3Mnbvsf8a4j3GZFnmacd3FxbYNaXBM7pL8CZGqmhE/LcGkf77u6HZm9h5Vlz fI/Uoahs2X8M0+rm9cF5tbW5cCdh7S23aajL+VnE0VXs1XmroSl67gDi2IGm+IpGDJMA cvSx/XR1KyrQi6kFzLlEQfKrCDQa5SQouk4wfvh96ZmW0MhqoSthRPszXnDC5php4mjf th8UUwndk8eW38E1MicFsYgjNve3MO+R2BWbcRX17RcDle1s28b7qJ1GQWwVBeRHgRmV H3Sw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence :mime-version:message-id:date:subject:cc:to:from:dkim-signature :dkim-signature; bh=Dk7jPYYE33xpzm8AYJJdHN0vF4XsS/k9jNZSkXwlvhk=; b=Hj/sACvt8v0XsMld6Rdf99BZtHVprJDkwf4kZv9E7d+xXxLm78M5eEzJCFpWR8ZG2e JjvsYi1Jxd2k0W9TAaWr3nTggSFKU3uDvQMgqAMQ/71e/YE41fqRDPqJ9KU/QI56JuhM prj/3/lUSX1MStw2r2kXDv1HVRh/9lwSD1meJCgqUdDR3J2OGx4Y9g91xqtTypxmyg/V KUi8DGKElFiFHxeqSUBHfRDkKTTz/zYNHY6d7LQ8T3NjbIOUz2cDe4PyoDa1DkW22ocJ 1nCFnDQgUUVkZxJxlQ4YjmK//cuUSmWfgD247TuZjpO5UMrSgUoTdGrE91K9UtkKYIg1 Bq6A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.infradead.org header.s=bombadil.20210309 header.b=J5QrmVNw; dkim=neutral (body hash did not verify) header.i=@linaro.org header.s=google header.b=zOWa4hAh; spf=pass (google.com: best guess record for domain of wcn36xx-bounces+patch=linaro.org@lists.infradead.org designates 2607:7c80:54:e::133 as permitted sender) smtp.mailfrom="wcn36xx-bounces+patch=linaro.org@lists.infradead.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from bombadil.infradead.org (bombadil.infradead.org. [2607:7c80:54:e::133]) by mx.google.com with ESMTPS id f3si6033211otb.330.2021.10.15.06.15.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Oct 2021 06:15:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of wcn36xx-bounces+patch=linaro.org@lists.infradead.org designates 2607:7c80:54:e::133 as permitted sender) client-ip=2607:7c80:54:e::133; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.infradead.org header.s=bombadil.20210309 header.b=J5QrmVNw; dkim=neutral (body hash did not verify) header.i=@linaro.org header.s=google header.b=zOWa4hAh; spf=pass (google.com: best guess record for domain of wcn36xx-bounces+patch=linaro.org@lists.infradead.org designates 2607:7c80:54:e::133 as permitted sender) smtp.mailfrom="wcn36xx-bounces+patch=linaro.org@lists.infradead.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=Dk7jPYYE33xpzm8AYJJdHN0vF4XsS/k9jNZSkXwlvhk=; b=J5QrmVNwymz4nu iyrapcd/qnDq/JbyQxLGjqKgL32DB3d1H0TzBusCD/ipR4PcjRFfF6uA2wmq1ufSM8GzP+fj22LBm K+h6P1qH7b8rS1KNSheMleq0lwltJ+vy/kE/teQryJFQyemFoGtU/sn3WyrwgtasTpID8hSoRVImh Xy+EB9aYQWCYWwXVM0Pnu9NRCXpkKclmoWD0+xmDbjNUCNsvBqfc0cQ5p0WGR2p4y11huLUzIWHWj jNtKcqBQVT2rINZXeF8Bgxpn9qIDdwJiKupgJcw7jSeMIc1dm3VLqIzpPIv1KQpsifgW3wLS3VZ3P cniW+gQa0XqPl3KLWu9w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mbN3w-007AU4-Ii; Fri, 15 Oct 2021 13:15:52 +0000 Received: from mail-wr1-x430.google.com ([2a00:1450:4864:20::430]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mbN3s-007AQc-0j for wcn36xx@lists.infradead.org; Fri, 15 Oct 2021 13:15:51 +0000 Received: by mail-wr1-x430.google.com with SMTP id t2so26487060wrb.8 for ; Fri, 15 Oct 2021 06:15:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=cX6ee/zMZHAq3yMrIa9rFmJR1PDVem3FHyhI2fReY3k=; b=zOWa4hAhdDGgUSv8hwQwPHdCT9+dVorGNtMNG3d4cvMgDEKy/ja8dimVWiy2e3t+dV xV0P+lO/CXkegSVGK8KOu05VqACwWBHq1KvVr6ZEjZMObb1KW3SItd2MH/8cRiTfbyt2 O8MR1h38v3knt3APD2lMU4v7fZiRznQdBrrC9gFbO0vkPm3POchXGyYE0BKoD5Uypogt 8SdTGXDXkvPiZ3fVBsyyioUIx4+nq/5yRn97xHbGVBE40Vjk2Ad66NkLNTlbzj9HKQgf hmMA48GQlEfTX0C6fapmyP/AB1Z5hoQVPnvjhPJFb6oMfMij5Z5X0Nk9PxSeFnKep+Jv Pa6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=cX6ee/zMZHAq3yMrIa9rFmJR1PDVem3FHyhI2fReY3k=; b=S8VaCAIDiAHA13VRHUM6yd3x91jhm6ODTwxz7fJJklv1A+TaTABAIAQi3nxJGZRgI8 BRzDkVWO+OKCryrrPqFAlh8AbLqR0qTvV16wKsu/qKJEnp0yvjTY640GmVKPToNncu0Z ZL1N0e40D6ZG2vKSdDEZaBq1jmoeRZRWAtPXPdw9jjDHtLqUDnrQotu1K+SC3hGVkTZd lc9dm4YqZpeWvG4JffurpakHlANn1zpuSECp+YAq59zNdjydNhi4zZZeCu0AJfSoHrqr dRQo7Q9ybqmBVQ84bKbYBDa1lPDPoTaY8b4bmN/g7LzQkyHV4SxOQ/hQggoJK1T9avsz IKRw== X-Gm-Message-State: AOAM531bNBPAt6vsjbAcm6untscbSl36x8znmK/skwQNynwUpBxPa1rk 0tZ9o+93HNCjY7bWYIuuBUN4qg== X-Received: by 2002:adf:a48f:: with SMTP id g15mr13741561wrb.259.1634303743282; Fri, 15 Oct 2021 06:15:43 -0700 (PDT) Received: from sagittarius-a.chello.ie (188-141-3-169.dynamic.upc.ie. [188.141.3.169]) by smtp.gmail.com with ESMTPSA id e8sm7091716wrg.48.2021.10.15.06.15.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Oct 2021 06:15:42 -0700 (PDT) From: Bryan O'Donoghue To: kvalo@codeaurora.org, linux-wireless@vger.kernel.org, wcn36xx@lists.infradead.org Cc: loic.poulain@linaro.org, benl@squareup.com, daniel.thompson@linaro.org, bryan.odonoghue@linaro.org Subject: [PATCH 0/4] wcn36xx: Fix DMA buffer allocation and free logic Date: Fri, 15 Oct 2021 14:17:37 +0100 Message-Id: <20211015131741.2455824-1-bryan.odonoghue@linaro.org> X-Mailer: git-send-email 2.33.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211015_061548_124458_623DEBA9 X-CRM114-Status: GOOD ( 10.41 ) X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Digging around through some bugs reported from an extensive testing cycle we've found that wcn36xx has a number of unexplained RX related oopses. In at least one case we appear to have DMA'd data to an unmapped region. The written data appears to be a correctly formed DMA buffer descriptor - a DXE BD in WCNSS parlance, with an AP beacon inside [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2a00:1450:4864:20:0:0:0:430 listed in] [list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-BeenThere: wcn36xx@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "wcn36xx" Errors-To: wcn36xx-bounces+patch=linaro.org@lists.infradead.org Digging around through some bugs reported from an extensive testing cycle we've found that wcn36xx has a number of unexplained RX related oopses. In at least one case we appear to have DMA'd data to an unmapped region. The written data appears to be a correctly formed DMA buffer descriptor - a DXE BD in WCNSS parlance, with an AP beacon inside of it. Reasoning about how such a situation might come about and reviewing the run-time code, there was no obvious path where we might free a BD or an skbuff pointed to by a BD, which DXE might not be aware of. However looking at the ieee80211_ops.start and ieee80211_ops.stop callbacks in wcn36xx we can see a number of bugs associated with BD allocation, error handling and leaving the DMA engine active, despite freeing SKBs on the MSM side. This last mention - failure to quiesce potential DMA from the downstream agent - WCNSS DXE despite freeing the memory @ the skbuffs is a decent candidate for our unexplained upstream DMA transaction to unmapped memory. Since wcn36xx_stop and wcn36xx_start can be called a number of times by the controlling upper layers it means there is a potential gap between wcn36xx_stop and wcn36xx_start which could leave WCNSS in a state where it will try to DMA to memory we have freed. This series addresses the obvious bugs that jump out on the start()/stop() path. Patch #1 In order to make it easier to read the DXE code, I've moved all of the lock taking and freeing for DXE into dxe.c Patch #2 Fixes a very obviously broken channel enable/disable cycle Patch #3 Fixes a very obvious memory leak with dma_alloc_coherent() Patch #4 Makes sure before we release skbuffs which we assigned to the RX channels that we ensure the DXE block is put into reset Bryan O'Donoghue (4): wcn36xx: Fix DXE lock layering violation wcn36xx: Fix DXE/DMA channel enable/disable cycle wcn36xx: Release DMA channel descriptor allocations wcn36xx: Put DXE block into reset before freeing memory drivers/net/wireless/ath/wcn36xx/dxe.c | 75 +++++++++++++++++++++---- drivers/net/wireless/ath/wcn36xx/dxe.h | 2 + drivers/net/wireless/ath/wcn36xx/txrx.c | 15 +---- 3 files changed, 68 insertions(+), 24 deletions(-) -- 2.33.0 _______________________________________________ wcn36xx mailing list wcn36xx@lists.infradead.org http://lists.infradead.org/mailman/listinfo/wcn36xx