On Wed, 2011-04-20 at 06:57 -0700, Stanislaw Gruszka wrote:
> Since
>
> commit a120e912eb51e347f36c71b60a1d13af74d30e83
> Author: Stanislaw Gruszka <sgruszka@xxxxxxxxxx>
> Date: Fri Feb 19 15:47:33 2010 -0800
>
> iwlwifi: sanity check before counting number of tfds can be free
>
> we use skb->data after calling ieee80211_tx_status_irqsafe(), which
> could free skb instantly.
>
> On current kernels I do not observe practical problems related with
> bug, but on 2.6.35.y it cause random system hangs when stressing
> wireless link.
>
> Cc: stable@xxxxxxxxxx # 2.6.32+
> Signed-off-by: Stanislaw Gruszka <sgruszka@xxxxxxxxxx>
Acked-by: Wey-Yi Guy <wey-yi.w.guy@xxxxxxxxx>
> ---
> drivers/net/wireless/iwlwifi/iwl-agn-tx.c | 10 +++++++---
> 1 files changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
> index 2816b43..494de0e 100644
> --- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
> +++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
> @@ -1236,12 +1236,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
> q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
>
> tx_info = &txq->txb[txq->q.read_ptr];
> - iwlagn_tx_status(priv, tx_info,
> - txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
> +
> + if (WARN_ON_ONCE(tx_info->skb == NULL))
> + continue;
>
btw, you see this happen?
Wey
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
