On Wed, 2011-04-20 at 06:57 -0700, Stanislaw Gruszka wrote: > Since > > commit a120e912eb51e347f36c71b60a1d13af74d30e83 > Author: Stanislaw Gruszka <sgruszka@xxxxxxxxxx> > Date: Fri Feb 19 15:47:33 2010 -0800 > > iwlwifi: sanity check before counting number of tfds can be free > > we use skb->data after calling ieee80211_tx_status_irqsafe(), which > could free skb instantly. > > On current kernels I do not observe practical problems related with > bug, but on 2.6.35.y it cause random system hangs when stressing > wireless link. > > Cc: stable@xxxxxxxxxx # 2.6.32+ > Signed-off-by: Stanislaw Gruszka <sgruszka@xxxxxxxxxx> Acked-by: Wey-Yi Guy <wey-yi.w.guy@xxxxxxxxx> > --- > drivers/net/wireless/iwlwifi/iwl-agn-tx.c | 10 +++++++--- > 1 files changed, 7 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c > index 2816b43..494de0e 100644 > --- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c > +++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c > @@ -1236,12 +1236,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index) > q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) { > > tx_info = &txq->txb[txq->q.read_ptr]; > - iwlagn_tx_status(priv, tx_info, > - txq_id >= IWLAGN_FIRST_AMPDU_QUEUE); > + > + if (WARN_ON_ONCE(tx_info->skb == NULL)) > + continue; > btw, you see this happen? Wey -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html