diff options
| author | PixelBot AutoMerger <android-nexus-securitybot@system.gserviceaccount.com> | 2022-12-25 18:32:42 -0800 |
|---|---|---|
| committer | SecurityBot <android-nexus-securitybot@system.gserviceaccount.com> | 2022-12-25 18:32:42 -0800 |
| commit | 166dff5cd42ac4febdb8966c687e38c3125bf1a9 (patch) | |
| tree | d0ee71e870e18ef94f4c5e3f5b88f1784bae2294 | |
| parent | 811075a8eecf069db82e5a7bb8f49b64bd13d18c (diff) | |
| parent | 6204cc13f7a9e94dbbdce06c46a24bf0315be3e2 (diff) | |
| download | qca-wfi-host-cmn-166dff5cd42ac4febdb8966c687e38c3125bf1a9.tar.gz | |
Merge android-msm-pixel-4.19-tm-qpr2 into android-msm-pixel-4.19android-u-preview-2_r0.1android-u-beta-3_r0.1android-u-beta-2_r0.1android-u-beta-2.1_r0.1android-u-beta-1_r0.2android-msm-redbull-4.19-u-preview-2android-msm-redbull-4.19-u-beta3android-msm-redbull-4.19-u-beta2android-msm-redbull-4.19-u-beta1
SBMerger: 478053055
Change-Id: I30e8e19b3c5bf0f8b074c1ee90c85d667f5cd0f4
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
| -rw-r--r-- | dp/wifi3.0/dp_rx.c | 9 | ||||
| -rw-r--r-- | dp/wifi3.0/dp_stats.c | 2 | ||||
| -rw-r--r-- | dp/wifi3.0/dp_types.h | 2 |
3 files changed, 12 insertions, 1 deletions
diff --git a/dp/wifi3.0/dp_rx.c b/dp/wifi3.0/dp_rx.c index 13a9cc5e0..ee5a75f34 100644 --- a/dp/wifi3.0/dp_rx.c +++ b/dp/wifi3.0/dp_rx.c @@ -2054,8 +2054,15 @@ done: next = nbuf->next; rx_tlv_hdr = qdf_nbuf_data(nbuf); /* Get TID from struct cb->tid_val, save to tid */ - if (qdf_nbuf_is_rx_chfrag_start(nbuf)) + if (qdf_nbuf_is_rx_chfrag_start(nbuf)) { tid = qdf_nbuf_get_tid_val(nbuf); + if (tid >= CDP_MAX_DATA_TIDS) { + DP_STATS_INC(soc, rx.err.rx_invalid_tid_err, 1); + qdf_nbuf_free(nbuf); + nbuf = next; + continue; + } + } /* * Check if DMA completed -- msdu_done is the last bit diff --git a/dp/wifi3.0/dp_stats.c b/dp/wifi3.0/dp_stats.c index 6162e734e..db96381cb 100644 --- a/dp/wifi3.0/dp_stats.c +++ b/dp/wifi3.0/dp_stats.c @@ -5671,5 +5671,7 @@ dp_print_soc_rx_stats(struct dp_soc *soc) DP_PRINT_STATS("REO Error(0-14):%s", reo_error); DP_PRINT_STATS("REO CMD SEND FAIL: %d", soc->stats.rx.err.reo_cmd_send_fail); + DP_PRINT_STATS("Rx invalid TID count:%d", + soc->stats.rx.err.rx_invalid_tid_err); } diff --git a/dp/wifi3.0/dp_types.h b/dp/wifi3.0/dp_types.h index 363e98087..506766cdb 100644 --- a/dp/wifi3.0/dp_types.h +++ b/dp/wifi3.0/dp_types.h @@ -784,6 +784,8 @@ struct dp_soc_stats { uint32_t reo_err_oor_sg_count; /* RX msdu rejected count on delivery to vdev stack_fn*/ uint32_t rejected; + /* Rx invalid tid count */ + uint32_t rx_invalid_tid_err; } err; /* packet count per core - per ring */ |