On 11/26/2012 08:20 PM, John W. Linville wrote: > On Mon, Nov 26, 2012 at 08:55:11AM -0600, Seth Forshee wrote: >> On Fri, Nov 23, 2012 at 12:44:42PM +0100, Arend van Spriel wrote: >>> From: Piotr Haber <phaber@xxxxxxxxxxxx> >>> >>> In the event that tx packet can not be queued by the driver >>> the packet is dropped. Propagate that information to the .tx() >>> callback to make sure the freed packet is not accessed after >>> that. >>> >>> This has happened causing slab corruptions as reported by >>> Stanislaw Gruszka. >>> >>> Bug #47721: https://bugzilla.kernel.org/show_bug.cgi?id=47721 >>> >>> Reported-by: Stanislaw Gruszka <stf_xl@xxxxx> >>> Reviewed-by: Arend van Spriel <arend@xxxxxxxxxxxx> >>> Reviewed-by: Pieter-Paul Giesberts <pieterpg@xxxxxxxxxxxx> >>> Signed-off-by: Piotr Haber <phaber@xxxxxxxxxxxx> >>> Signed-off-by: Arend van Spriel <arend@xxxxxxxxxxxx> >>> --- >>> Fixing a kernel bug so based on the wireless repository. The >>> fix for wireless-next will be posted separately as the patches >>> differ. So this patch does not need to be merged to the >>> wireless-next tree. >> >> Let me know if I can be of help in resolving the conflicts. Fwiw the fix >> looks like it ought to be easy to make on top of wireless-next, but I do >> have a couple of comments. >> >>> diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c >>> index be5bcfb..a6605b1 100644 >>> --- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c >>> +++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c >>> @@ -901,7 +901,7 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, >>> struct ieee80211_hdr *h; >>> u16 seq, start_seq = 0, bindex, index, mcl; >>> u8 mcs = 0; >>> - bool ba_recd = false, ack_recd = false; >>> + bool ba_recd = false, ack_recd = false, last_packet = false; >>> u8 suc_mpdu = 0, tot_mpdu = 0; >>> uint supr_status; >>> bool update_rate = true, retry = true, tx_error = false; >>> @@ -1010,6 +1010,8 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, >>> >>> index = TX_SEQ_TO_INDEX(seq); >>> ack_recd = false; >>> + last_packet = (((mcl & TXC_AMPDU_MASK) >> TXC_AMPDU_SHIFT) == >>> + TXC_AMPDU_LAST); >>> if (ba_recd) { >>> bindex = MODSUB_POW2(seq, start_seq, SEQNUM_MAX); >>> BCMMSG(wiphy, >>> @@ -1074,8 +1076,7 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, >>> tot_mpdu++; >>> >>> /* break out if last packet of ampdu */ >>> - if (((mcl & TXC_AMPDU_MASK) >> TXC_AMPDU_SHIFT) == >>> - TXC_AMPDU_LAST) >>> + if (last_packet) >>> break; >>> >>> p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED); >> >> These changes are effectively a no-op and don't really seem to have >> anything to do with fixing the bug. > > I concur -- could you remove these bits for the 3.7 fix? > True. Will resend it. Gr. AvS -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
