Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9c661e0 authored by Roland Vossen's avatar Roland Vossen Committed by Greg Kroah-Hartman
Browse files

staging: brcm80211: bugfix for div by zero in minstrel_ht_tx_status 

Caused by brcmsmac.ko suppling a 0 value to Mac80211. Mac80211 subsequently
divides by this number. Bug only occurred on AMPDU traffic. This is a fix
for https://bugzilla.kernel.org/show_bug.cgi?id=32032

, titled
'Divide error in minstrel_ht_tx_status followed by hang', reported by
Wouter Cloetens.

Signed-off-by: default avatarRoland Vossen <rvossen@broadcom.com>
Reviewed-by: default avatarArend van Spriel <arend@broadcom.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent a1c5ad81

drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c

+3 −10
Original line number Original line Diff line number Diff line
@@ -1122,21 +1122,12 @@ wlc_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, 
				ini->txretry[index] = 0;

				ini->txretry[index] = 0;





				/* ampdu_ack_len: number of acked aggregated frames */

				/* ampdu_ack_len: number of acked aggregated frames */

				/* ampdu_ack_map: block ack bit map for the aggregation */

				/* ampdu_len: number of aggregated frames */

				/* ampdu_len: number of aggregated frames */

				rate_status(wlc, tx_info, txs, mcs);

				rate_status(wlc, tx_info, txs, mcs);

				tx_info->flags |= IEEE80211_TX_STAT_ACK;

				tx_info->flags |= IEEE80211_TX_STAT_ACK;

				tx_info->flags |= IEEE80211_TX_STAT_AMPDU;

				tx_info->flags |= IEEE80211_TX_STAT_AMPDU;



				/* XXX TODO: Make these accurate. */

				tx_info->status.ampdu_ack_len =

				tx_info->status.ampdu_ack_len =

				    (txs->

					tx_info->status.ampdu_len = 1;

				     status & TX_STATUS_FRM_RTX_MASK) >>

				    TX_STATUS_FRM_RTX_SHIFT;

				tx_info->status.ampdu_len =

				    (txs->

				     status & TX_STATUS_FRM_RTX_MASK) >>

				    TX_STATUS_FRM_RTX_SHIFT;





				skb_pull(p, D11_PHY_HDR_LEN);

				skb_pull(p, D11_PHY_HDR_LEN);

				skb_pull(p, D11_TXH_LEN);

				skb_pull(p, D11_TXH_LEN);
@@ -1162,6 +1153,8 @@ wlc_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, 
				/* Retry timeout */

				/* Retry timeout */

				ini->tx_in_transit--;

				ini->tx_in_transit--;

				ieee80211_tx_info_clear_status(tx_info);

				ieee80211_tx_info_clear_status(tx_info);

				tx_info->status.ampdu_ack_len = 0;

				tx_info->status.ampdu_len = 1;

				tx_info->flags |=

				tx_info->flags |=

				    IEEE80211_TX_STAT_AMPDU_NO_BACK;

				    IEEE80211_TX_STAT_AMPDU_NO_BACK;

				skb_pull(p, D11_PHY_HDR_LEN);

				skb_pull(p, D11_PHY_HDR_LEN);