* [PATCH ath-next 1/4] wifi: ath12k: Handle error cases during extended skb allocation
2025-04-02 18:14 [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path P Praneesh
@ 2025-04-02 18:14 ` P Praneesh
2025-04-02 18:14 ` [PATCH ath-next 2/4] wifi: ath12k: Refactor tx descriptor handling in tx completion handler P Praneesh
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: P Praneesh @ 2025-04-02 18:14 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless
Currently, in the case of extended skb allocation, the buffer is freed
before the DMA unmap operation. This premature deletion can result in
skb->data corruption, as the memory region could be re-allocated for other
purposes. Fix this issue by reordering the failure cases by calling
dma_unmap_single() first, then followed by the corresponding kfree_skb().
This helps avoid data corruption in case of failures in dp_tx().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp_tx.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c
index 29e2715024ce..03c79becd59a 100644
--- a/drivers/net/wireless/ath/ath12k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_tx.c
@@ -230,7 +230,7 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
struct ath12k_skb_cb *skb_cb = ATH12K_SKB_CB(skb);
struct hal_tcl_data_cmd *hal_tcl_desc;
struct hal_tx_msdu_ext_desc *msg;
- struct sk_buff *skb_ext_desc;
+ struct sk_buff *skb_ext_desc = NULL;
struct hal_srng *tcl_ring;
struct ieee80211_hdr *hdr = (void *)skb->data;
struct ath12k_vif *ahvif = arvif->ahvif;
@@ -416,18 +416,15 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
if (ret < 0) {
ath12k_dbg(ab, ATH12K_DBG_DP_TX,
"Failed to add HTT meta data, dropping packet\n");
- kfree_skb(skb_ext_desc);
- goto fail_unmap_dma;
+ goto fail_free_ext_skb;
}
}
ti.paddr = dma_map_single(ab->dev, skb_ext_desc->data,
skb_ext_desc->len, DMA_TO_DEVICE);
ret = dma_mapping_error(ab->dev, ti.paddr);
- if (ret) {
- kfree_skb(skb_ext_desc);
- goto fail_unmap_dma;
- }
+ if (ret)
+ goto fail_free_ext_skb;
ti.data_len = skb_ext_desc->len;
ti.type = HAL_TCL_DESC_TYPE_EXT_DESC;
@@ -463,7 +460,7 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
ring_selector++;
}
- goto fail_unmap_dma;
+ goto fail_unmap_dma_ext;
}
ath12k_hal_tx_cmd_desc_setup(ab, hal_tcl_desc, &ti);
@@ -479,13 +476,16 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
return 0;
-fail_unmap_dma:
- dma_unmap_single(ab->dev, ti.paddr, ti.data_len, DMA_TO_DEVICE);
-
+fail_unmap_dma_ext:
if (skb_cb->paddr_ext_desc)
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
sizeof(struct hal_tx_msdu_ext_desc),
DMA_TO_DEVICE);
+fail_free_ext_skb:
+ kfree_skb(skb_ext_desc);
+
+fail_unmap_dma:
+ dma_unmap_single(ab->dev, ti.paddr, ti.data_len, DMA_TO_DEVICE);
fail_remove_tx_buf:
ath12k_dp_tx_release_txbuf(dp, tx_desc, pool_id);
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH ath-next 2/4] wifi: ath12k: Refactor tx descriptor handling in tx completion handler
2025-04-02 18:14 [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path P Praneesh
2025-04-02 18:14 ` [PATCH ath-next 1/4] wifi: ath12k: Handle error cases during extended skb allocation P Praneesh
@ 2025-04-02 18:14 ` P Praneesh
2025-04-02 18:14 ` [PATCH ath-next 3/4] wifi: ath12k: Fix memory leak during extended skb allocation P Praneesh
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: P Praneesh @ 2025-04-02 18:14 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless
Current code uses mac_id and msdu parameters in ath12k_dp_tx_free_txbuf()
and ath12k_dp_tx_process_htt_tx_complete(). Since these parameters are
already encapsulated by struct ath12k_dp_tx_desc, passing them individually
results in redundant arguments.
Introduce struct ath12k_tx_desc_params to capture the skb, mac_id, and pass
it to the corresponding functions. Refactor these functions to use struct
ath12k_tx_desc_params instead, reducing the number of arguments and improving
function argument handling efficiency. Additionally, use struct
ath12k_tx_desc_params in ath12k_dp_tx_htt_tx_complete_buf() and
ath12k_dp_tx_complete_msdu(), which will be utilized for fetching extended skb
in a future patch.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp.h | 5 +++
drivers/net/wireless/ath/ath12k/dp_tx.c | 42 ++++++++++++-------------
2 files changed, 26 insertions(+), 21 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index 427a87b63dec..e26a9c3477d9 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -300,6 +300,11 @@ struct ath12k_tx_desc_info {
u8 pool_id;
};
+struct ath12k_tx_desc_params {
+ struct sk_buff *skb;
+ u8 mac_id;
+};
+
struct ath12k_spt_info {
dma_addr_t paddr;
u64 *vaddr;
diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c
index 03c79becd59a..45f4c8bd78e6 100644
--- a/drivers/net/wireless/ath/ath12k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_tx.c
@@ -496,12 +496,13 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
}
static void ath12k_dp_tx_free_txbuf(struct ath12k_base *ab,
- struct sk_buff *msdu, u8 mac_id,
- struct dp_tx_ring *tx_ring)
+ struct dp_tx_ring *tx_ring,
+ struct ath12k_tx_desc_params *desc_params)
{
struct ath12k *ar;
+ struct sk_buff *msdu = desc_params->skb;
struct ath12k_skb_cb *skb_cb;
- u8 pdev_id = ath12k_hw_mac_id_to_pdev_id(ab->hw_params, mac_id);
+ u8 pdev_id = ath12k_hw_mac_id_to_pdev_id(ab->hw_params, desc_params->mac_id);
skb_cb = ATH12K_SKB_CB(msdu);
ar = ab->pdevs[pdev_id].ar;
@@ -519,11 +520,12 @@ static void ath12k_dp_tx_free_txbuf(struct ath12k_base *ab,
static void
ath12k_dp_tx_htt_tx_complete_buf(struct ath12k_base *ab,
- struct sk_buff *msdu,
+ struct ath12k_tx_desc_params *desc_params,
struct dp_tx_ring *tx_ring,
struct ath12k_dp_htt_wbm_tx_status *ts)
{
struct ieee80211_tx_info *info;
+ struct sk_buff *msdu = desc_params->skb;
struct ath12k_skb_cb *skb_cb;
struct ath12k *ar;
@@ -561,10 +563,9 @@ ath12k_dp_tx_htt_tx_complete_buf(struct ath12k_base *ab,
}
static void
-ath12k_dp_tx_process_htt_tx_complete(struct ath12k_base *ab,
- void *desc, u8 mac_id,
- struct sk_buff *msdu,
- struct dp_tx_ring *tx_ring)
+ath12k_dp_tx_process_htt_tx_complete(struct ath12k_base *ab, void *desc,
+ struct dp_tx_ring *tx_ring,
+ struct ath12k_tx_desc_params *desc_params)
{
struct htt_tx_wbm_completion *status_desc;
struct ath12k_dp_htt_wbm_tx_status ts = {0};
@@ -580,13 +581,13 @@ ath12k_dp_tx_process_htt_tx_complete(struct ath12k_base *ab,
ts.acked = (wbm_status == HAL_WBM_REL_HTT_TX_COMP_STATUS_OK);
ts.ack_rssi = le32_get_bits(status_desc->info2,
HTT_TX_WBM_COMP_INFO2_ACK_RSSI);
- ath12k_dp_tx_htt_tx_complete_buf(ab, msdu, tx_ring, &ts);
+ ath12k_dp_tx_htt_tx_complete_buf(ab, desc_params, tx_ring, &ts);
break;
case HAL_WBM_REL_HTT_TX_COMP_STATUS_DROP:
case HAL_WBM_REL_HTT_TX_COMP_STATUS_TTL:
case HAL_WBM_REL_HTT_TX_COMP_STATUS_REINJ:
case HAL_WBM_REL_HTT_TX_COMP_STATUS_INSPECT:
- ath12k_dp_tx_free_txbuf(ab, msdu, mac_id, tx_ring);
+ ath12k_dp_tx_free_txbuf(ab, tx_ring, desc_params);
break;
case HAL_WBM_REL_HTT_TX_COMP_STATUS_MEC_NOTIFY:
/* This event is to be handled only when the driver decides to
@@ -718,13 +719,14 @@ static void ath12k_dp_tx_update_txcompl(struct ath12k *ar, struct hal_tx_status
}
static void ath12k_dp_tx_complete_msdu(struct ath12k *ar,
- struct sk_buff *msdu,
+ struct ath12k_tx_desc_params *desc_params,
struct hal_tx_status *ts)
{
struct ath12k_base *ab = ar->ab;
struct ath12k_hw *ah = ar->ah;
struct ieee80211_tx_info *info;
struct ath12k_skb_cb *skb_cb;
+ struct sk_buff *msdu = desc_params->skb;
if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
/* Must not happen */
@@ -843,11 +845,11 @@ void ath12k_dp_tx_completion_handler(struct ath12k_base *ab, int ring_id)
int hal_ring_id = dp->tx_ring[ring_id].tcl_comp_ring.ring_id;
struct hal_srng *status_ring = &ab->hal.srng_list[hal_ring_id];
struct ath12k_tx_desc_info *tx_desc = NULL;
- struct sk_buff *msdu;
struct hal_tx_status ts = { 0 };
+ struct ath12k_tx_desc_params desc_params;
struct dp_tx_ring *tx_ring = &dp->tx_ring[ring_id];
struct hal_wbm_release_ring *desc;
- u8 mac_id, pdev_id;
+ u8 pdev_id;
u64 desc_va;
spin_lock_bh(&status_ring->lock);
@@ -901,28 +903,26 @@ void ath12k_dp_tx_completion_handler(struct ath12k_base *ab, int ring_id)
continue;
}
- msdu = tx_desc->skb;
- mac_id = tx_desc->mac_id;
+ desc_params.mac_id = tx_desc->mac_id;
+ desc_params.skb = tx_desc->skb;
/* Release descriptor as soon as extracting necessary info
* to reduce contention
*/
ath12k_dp_tx_release_txbuf(dp, tx_desc, tx_desc->pool_id);
if (ts.buf_rel_source == HAL_WBM_REL_SRC_MODULE_FW) {
- ath12k_dp_tx_process_htt_tx_complete(ab,
- (void *)tx_status,
- mac_id, msdu,
- tx_ring);
+ ath12k_dp_tx_process_htt_tx_complete(ab, (void *)tx_status,
+ tx_ring, &desc_params);
continue;
}
- pdev_id = ath12k_hw_mac_id_to_pdev_id(ab->hw_params, mac_id);
+ pdev_id = ath12k_hw_mac_id_to_pdev_id(ab->hw_params, desc_params.mac_id);
ar = ab->pdevs[pdev_id].ar;
if (atomic_dec_and_test(&ar->dp.num_tx_pending))
wake_up(&ar->dp.tx_empty_waitq);
- ath12k_dp_tx_complete_msdu(ar, msdu, &ts);
+ ath12k_dp_tx_complete_msdu(ar, &desc_params, &ts);
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH ath-next 3/4] wifi: ath12k: Fix memory leak during extended skb allocation
2025-04-02 18:14 [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path P Praneesh
2025-04-02 18:14 ` [PATCH ath-next 1/4] wifi: ath12k: Handle error cases during extended skb allocation P Praneesh
2025-04-02 18:14 ` [PATCH ath-next 2/4] wifi: ath12k: Refactor tx descriptor handling in tx completion handler P Praneesh
@ 2025-04-02 18:14 ` P Praneesh
2025-04-02 18:14 ` [PATCH ath-next 4/4] wifi: ath12k: Use skb->len for dma_unmap_single() length parameter P Praneesh
2025-04-07 17:16 ` [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path Jeff Johnson
4 siblings, 0 replies; 7+ messages in thread
From: P Praneesh @ 2025-04-02 18:14 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless
In ath12k_dp_tx(), memory allocated for extended skb is not freed
properly, causing a memory leak even when the host receives tx
completion for those skbs. Fix this issue by storing skb_ext_desc
in the host tx descriptor and using this skb_ext_desc field during
completion or during ath12k_dp_cc_cleanup().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp.c | 10 +++++++++-
drivers/net/wireless/ath/ath12k/dp.h | 2 ++
drivers/net/wireless/ath/ath12k/dp_tx.c | 15 ++++++++++++---
3 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index b1f27c3ac723..34c72a1b5ae1 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -1206,11 +1206,19 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
if (!skb)
continue;
+ skb_cb = ATH12K_SKB_CB(skb);
+ if (skb_cb->paddr_ext_desc) {
+ dma_unmap_single(ab->dev,
+ skb_cb->paddr_ext_desc,
+ tx_desc_info->skb_ext_desc->len,
+ DMA_TO_DEVICE);
+ dev_kfree_skb_any(tx_desc_info->skb_ext_desc);
+ }
+
/* if we are unregistering, hw would've been destroyed and
* ar is no longer valid.
*/
if (!(test_bit(ATH12K_FLAG_UNREGISTERING, &ab->dev_flags))) {
- skb_cb = ATH12K_SKB_CB(skb);
ar = skb_cb->ar;
if (atomic_dec_and_test(&ar->dp.num_tx_pending))
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index e26a9c3477d9..c8e0c70a4d26 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -295,6 +295,7 @@ struct ath12k_rx_desc_info {
struct ath12k_tx_desc_info {
struct list_head list;
struct sk_buff *skb;
+ struct sk_buff *skb_ext_desc;
u32 desc_id; /* Cookie */
u8 mac_id;
u8 pool_id;
@@ -302,6 +303,7 @@ struct ath12k_tx_desc_info {
struct ath12k_tx_desc_params {
struct sk_buff *skb;
+ struct sk_buff *skb_ext_desc;
u8 mac_id;
};
diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c
index 45f4c8bd78e6..ab359483472f 100644
--- a/drivers/net/wireless/ath/ath12k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_tx.c
@@ -84,6 +84,7 @@ static void ath12k_dp_tx_release_txbuf(struct ath12k_dp *dp,
u8 pool_id)
{
spin_lock_bh(&dp->tx_desc_lock[pool_id]);
+ tx_desc->skb_ext_desc = NULL;
list_move_tail(&tx_desc->list, &dp->tx_desc_free_list[pool_id]);
spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
}
@@ -430,6 +431,7 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
ti.type = HAL_TCL_DESC_TYPE_EXT_DESC;
skb_cb->paddr_ext_desc = ti.paddr;
+ tx_desc->skb_ext_desc = skb_ext_desc;
}
hal_ring_id = tx_ring->tcl_data_ring.ring_id;
@@ -508,9 +510,11 @@ static void ath12k_dp_tx_free_txbuf(struct ath12k_base *ab,
ar = ab->pdevs[pdev_id].ar;
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
- if (skb_cb->paddr_ext_desc)
+ if (skb_cb->paddr_ext_desc) {
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE);
+ dev_kfree_skb_any(desc_params->skb_ext_desc);
+ }
ieee80211_free_txskb(ar->ah->hw, msdu);
@@ -538,9 +542,11 @@ ath12k_dp_tx_htt_tx_complete_buf(struct ath12k_base *ab,
wake_up(&ar->dp.tx_empty_waitq);
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
- if (skb_cb->paddr_ext_desc)
+ if (skb_cb->paddr_ext_desc) {
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE);
+ dev_kfree_skb_any(desc_params->skb_ext_desc);
+ }
memset(&info->status, 0, sizeof(info->status));
@@ -736,9 +742,11 @@ static void ath12k_dp_tx_complete_msdu(struct ath12k *ar,
skb_cb = ATH12K_SKB_CB(msdu);
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
- if (skb_cb->paddr_ext_desc)
+ if (skb_cb->paddr_ext_desc) {
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE);
+ dev_kfree_skb_any(desc_params->skb_ext_desc);
+ }
rcu_read_lock();
@@ -905,6 +913,7 @@ void ath12k_dp_tx_completion_handler(struct ath12k_base *ab, int ring_id)
desc_params.mac_id = tx_desc->mac_id;
desc_params.skb = tx_desc->skb;
+ desc_params.skb_ext_desc = tx_desc->skb_ext_desc;
/* Release descriptor as soon as extracting necessary info
* to reduce contention
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH ath-next 4/4] wifi: ath12k: Use skb->len for dma_unmap_single() length parameter
2025-04-02 18:14 [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path P Praneesh
` (2 preceding siblings ...)
2025-04-02 18:14 ` [PATCH ath-next 3/4] wifi: ath12k: Fix memory leak during extended skb allocation P Praneesh
@ 2025-04-02 18:14 ` P Praneesh
2025-04-07 17:16 ` [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path Jeff Johnson
4 siblings, 0 replies; 7+ messages in thread
From: P Praneesh @ 2025-04-02 18:14 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless
During dma_unmap_single() for extended skb, the driver currently uses
sizeof() of the corresponding structure. When the allocation size changes,
one of the parameters of dma_unmap_single() needs to be updated everywhere.
Improve code readability by using skb->len instead of sizeof() the structure.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp_tx.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c
index ab359483472f..9e598a585020 100644
--- a/drivers/net/wireless/ath/ath12k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_tx.c
@@ -481,7 +481,7 @@ int ath12k_dp_tx(struct ath12k *ar, struct ath12k_link_vif *arvif,
fail_unmap_dma_ext:
if (skb_cb->paddr_ext_desc)
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
- sizeof(struct hal_tx_msdu_ext_desc),
+ skb_ext_desc->len,
DMA_TO_DEVICE);
fail_free_ext_skb:
kfree_skb(skb_ext_desc);
@@ -512,7 +512,7 @@ static void ath12k_dp_tx_free_txbuf(struct ath12k_base *ab,
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
if (skb_cb->paddr_ext_desc) {
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
- sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE);
+ desc_params->skb_ext_desc->len, DMA_TO_DEVICE);
dev_kfree_skb_any(desc_params->skb_ext_desc);
}
@@ -544,7 +544,7 @@ ath12k_dp_tx_htt_tx_complete_buf(struct ath12k_base *ab,
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
if (skb_cb->paddr_ext_desc) {
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
- sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE);
+ desc_params->skb_ext_desc->len, DMA_TO_DEVICE);
dev_kfree_skb_any(desc_params->skb_ext_desc);
}
@@ -744,7 +744,7 @@ static void ath12k_dp_tx_complete_msdu(struct ath12k *ar,
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
if (skb_cb->paddr_ext_desc) {
dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc,
- sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE);
+ desc_params->skb_ext_desc->len, DMA_TO_DEVICE);
dev_kfree_skb_any(desc_params->skb_ext_desc);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path
2025-04-02 18:14 [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path P Praneesh
` (3 preceding siblings ...)
2025-04-02 18:14 ` [PATCH ath-next 4/4] wifi: ath12k: Use skb->len for dma_unmap_single() length parameter P Praneesh
@ 2025-04-07 17:16 ` Jeff Johnson
2025-04-08 6:07 ` Praneesh P
4 siblings, 1 reply; 7+ messages in thread
From: Jeff Johnson @ 2025-04-07 17:16 UTC (permalink / raw)
To: P Praneesh, ath12k; +Cc: linux-wireless
On 4/2/2025 11:14 AM, P Praneesh wrote:
> Address the memory leak caused by extended skb allocation observed during
> multicast transmission in this series.
>
> P Praneesh (4):
> wifi: ath12k: Handle error cases during extended skb allocation
> wifi: ath12k: Refactor tx descriptor handling in tx completion handler
> wifi: ath12k: Fix memory leak during extended skb allocation
> wifi: ath12k: Use skb->len for dma_unmap_single() length parameter
>
> drivers/net/wireless/ath/ath12k/dp.c | 10 ++-
> drivers/net/wireless/ath/ath12k/dp.h | 7 ++
> drivers/net/wireless/ath/ath12k/dp_tx.c | 87 ++++++++++++++-----------
> 3 files changed, 64 insertions(+), 40 deletions(-)
>
>
> base-commit: ba613742db305037ca2193b2b552b769c4f2a5f7
Please rebase to current ath/main
Applying: wifi: ath12k: Handle error cases during extended skb allocation
Applying: wifi: ath12k: Refactor tx descriptor handling in tx completion handler
Using index info to reconstruct a base tree...
M drivers/net/wireless/ath/ath12k/dp.h
M drivers/net/wireless/ath/ath12k/dp_tx.c
Falling back to patching base and 3-way merge...
Auto-merging drivers/net/wireless/ath/ath12k/dp_tx.c
CONFLICT (content): Merge conflict in drivers/net/wireless/ath/ath12k/dp_tx.c
Auto-merging drivers/net/wireless/ath/ath12k/dp.h
Recorded preimage for 'drivers/net/wireless/ath/ath12k/dp_tx.c'
error: Failed to merge in the changes.
Patch failed at 0002 wifi: ath12k: Refactor tx descriptor handling in tx completion handler
/jeff
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path
2025-04-07 17:16 ` [PATCH ath-next 0/4] wifi: ath12k: Fix multicast memory leak in tx path Jeff Johnson
@ 2025-04-08 6:07 ` Praneesh P
0 siblings, 0 replies; 7+ messages in thread
From: Praneesh P @ 2025-04-08 6:07 UTC (permalink / raw)
To: Jeff Johnson, P Praneesh, ath12k; +Cc: linux-wireless
On 4/7/2025 10:46 PM, Jeff Johnson wrote:
> On 4/2/2025 11:14 AM, P Praneesh wrote:
>> Address the memory leak caused by extended skb allocation observed during
>> multicast transmission in this series.
>>
>> P Praneesh (4):
>> wifi: ath12k: Handle error cases during extended skb allocation
>> wifi: ath12k: Refactor tx descriptor handling in tx completion handler
>> wifi: ath12k: Fix memory leak during extended skb allocation
>> wifi: ath12k: Use skb->len for dma_unmap_single() length parameter
>>
>> drivers/net/wireless/ath/ath12k/dp.c | 10 ++-
>> drivers/net/wireless/ath/ath12k/dp.h | 7 ++
>> drivers/net/wireless/ath/ath12k/dp_tx.c | 87 ++++++++++++++-----------
>> 3 files changed, 64 insertions(+), 40 deletions(-)
>>
>>
>> base-commit: ba613742db305037ca2193b2b552b769c4f2a5f7
>
> Please rebase to current ath/main
>
> Applying: wifi: ath12k: Handle error cases during extended skb allocation
> Applying: wifi: ath12k: Refactor tx descriptor handling in tx completion handler
> Using index info to reconstruct a base tree...
> M drivers/net/wireless/ath/ath12k/dp.h
> M drivers/net/wireless/ath/ath12k/dp_tx.c
> Falling back to patching base and 3-way merge...
> Auto-merging drivers/net/wireless/ath/ath12k/dp_tx.c
> CONFLICT (content): Merge conflict in drivers/net/wireless/ath/ath12k/dp_tx.c
> Auto-merging drivers/net/wireless/ath/ath12k/dp.h
> Recorded preimage for 'drivers/net/wireless/ath/ath12k/dp_tx.c'
> error: Failed to merge in the changes.
> Patch failed at 0002 wifi: ath12k: Refactor tx descriptor handling in tx completion handler
>
> /jeff
>
Sure, I'll rebase to the TOT and send the next version.
^ permalink raw reply [flat|nested] 7+ messages in thread