This is a note to let you know that I've just added the patch titled brcmsmac: handle packet drop during transmit correctly
to the 3.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: brcmsmac-handle-packet-drop-during-transmit-correctly.patch and it can be found in the queue-3.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. >From c4dea35e34f5f46e1701156153a09cce429d1ea9 Mon Sep 17 00:00:00 2001 From: Piotr Haber <pha...@broadcom.com> Date: Wed, 28 Nov 2012 21:44:05 +0100 Subject: brcmsmac: handle packet drop during transmit correctly From: Piotr Haber <pha...@broadcom.com> commit c4dea35e34f5f46e1701156153a09cce429d1ea9 upstream. The .tx() callback function can drop packets when there is no space in the DMA fifo. Propagate that information to caller and make sure the freed sk_buff reference is not accessed. Reviewed-by: Arend van Spriel <ar...@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <piete...@broadcom.com> Signed-off-by: Piotr Haber <pha...@broadcom.com> Signed-off-by: Arend van Spriel <ar...@broadcom.com> Signed-off-by: John W. Linville <linvi...@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> --- drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c | 4 ++-- drivers/net/wireless/brcm80211/brcmsmac/main.c | 14 +++++++++----- drivers/net/wireless/brcm80211/brcmsmac/main.h | 2 +- drivers/net/wireless/brcm80211/brcmsmac/pub.h | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) --- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c @@ -280,8 +280,8 @@ static void brcms_ops_tx(struct ieee8021 kfree_skb(skb); goto done; } - brcms_c_sendpkt_mac80211(wl->wlc, skb, hw); - tx_info->rate_driver_data[0] = control->sta; + if (brcms_c_sendpkt_mac80211(wl->wlc, skb, hw)) + tx_info->rate_driver_data[0] = control->sta; done: spin_unlock_bh(&wl->lock); } --- a/drivers/net/wireless/brcm80211/brcmsmac/main.c +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c @@ -6095,7 +6095,7 @@ static bool brcms_c_prec_enq(struct brcm return brcms_c_prec_enq_head(wlc, q, pkt, prec, false); } -void brcms_c_txq_enq(struct brcms_c_info *wlc, struct scb *scb, +bool brcms_c_txq_enq(struct brcms_c_info *wlc, struct scb *scb, struct sk_buff *sdu, uint prec) { struct brcms_txq_info *qi = wlc->pkt_queue; /* Check me */ @@ -6110,7 +6110,9 @@ void brcms_c_txq_enq(struct brcms_c_info * packet flooding from mac80211 stack */ brcmu_pkt_buf_free_skb(sdu); + return false; } + return true; } /* @@ -7273,7 +7275,7 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_ return 0; } -void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu, +bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu, struct ieee80211_hw *hw) { u8 prio; @@ -7288,10 +7290,12 @@ void brcms_c_sendpkt_mac80211(struct brc prio = ieee80211_is_data(d11_header->frame_control) ? sdu->priority : MAXPRIO; fifo = prio2fifo[prio]; - if (brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0)) - return; - brcms_c_txq_enq(wlc, scb, sdu, BRCMS_PRIO_TO_PREC(prio)); + brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0); + if (!brcms_c_txq_enq(wlc, scb, sdu, BRCMS_PRIO_TO_PREC(prio))) + return false; brcms_c_send_q(wlc); + + return true; } void brcms_c_send_q(struct brcms_c_info *wlc) --- a/drivers/net/wireless/brcm80211/brcmsmac/main.h +++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h @@ -642,7 +642,7 @@ extern void brcms_c_txfifo(struct brcms_ bool commit, s8 txpktpend); extern void brcms_c_txfifo_complete(struct brcms_c_info *wlc, uint fifo, s8 txpktpend); -extern void brcms_c_txq_enq(struct brcms_c_info *wlc, struct scb *scb, +extern bool brcms_c_txq_enq(struct brcms_c_info *wlc, struct scb *scb, struct sk_buff *sdu, uint prec); extern void brcms_c_print_txstatus(struct tx_status *txs); extern int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo, --- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h +++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h @@ -321,7 +321,7 @@ extern void brcms_c_intrsrestore(struct extern bool brcms_c_intrsupd(struct brcms_c_info *wlc); extern bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc); extern bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded); -extern void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, +extern bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu, struct ieee80211_hw *hw); extern bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid); Patches currently in stable-queue which might be from pha...@broadcom.com are queue-3.7/brcmsmac-handle-packet-drop-during-transmit-correctly.patch queue-3.7/brcmsmac-increase-timer-reference-count-for-new-timers-only.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html