Am Samstag 13 November 2010 schrieb Ivo van Doorn: > From: RA-Jay Hung <Jay_Hung@xxxxxxxxxxxxxx> > > When send out skb data to mac80211, orignal code will cause mac80211 > unaligned access, so modify code to make mac80211 can natural access. And this introduces the same panic again :( The problem is the following: We don't pass the skb in the same state back to mac80211 as we got it. When inserting the l2pad we're moving the header and thus reduce headroom. This patch modifies the bahavior during l2pad removal to not move the header back into its old position but instead moves the payload. Thus the skb keeps the reduced headroom. If this skb gets requeued into rt2x00 (which can happen when the frame wasn't acked and the according STA is known to e in powersave mode) the header and payload get aligned again further reducing headroom which results in a too small headroom for the TXWI and thus a skb_under_panic. Helmut > Signed-off-by: RA-Jay Hung <jay_hung@xxxxxxxxxxxxxx> > Signed-off-by: Ivo van Doorn <IvDoorn@xxxxxxxxx> > --- > drivers/net/wireless/rt2x00/rt2x00queue.c | 6 ++++-- > 1 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c > index dc54317..a3d79c7 100644 > --- a/drivers/net/wireless/rt2x00/rt2x00queue.c > +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c > @@ -204,8 +204,10 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length) > if (!l2pad) > return; > > - memmove(skb->data + l2pad, skb->data, header_length); > - skb_pull(skb, l2pad); > + memmove(skb->data + header_length, skb->data + header_length + l2pad, > + skb->len - header_length - l2pad); > + > + skb_trim(skb, skb->len - l2pad); > } > > static void rt2x00queue_create_tx_descriptor_seq(struct queue_entry *entry, > -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
