Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a120e912 authored by Stanislaw Gruszka's avatar Stanislaw Gruszka Committed by John W. Linville
Browse files

iwlwifi: sanity check before counting number of tfds can be free 



Check the frame control for ieee80211_is_data_qos() is true before
counting the number of tfds can be free, the tfds_in_queue only
increment when ieee80211_is_data_qos() is true before transmit; so it
should only decrement if the type match.

Remove ieee80211_is_data_qos check for frame_ctrl in tx_resp to avoid
invalid information pass from uCode.

Signed-off-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: default avatarWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
CC: stable@kernel.org
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent a239a8b4

drivers/net/wireless/iwlwifi/iwl-5000.c

+2 −4
Original line number Diff line number Diff line
@@ -1153,7 +1153,6 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv, 
				   tx_resp->failure_frame);



		freed = iwl_tx_queue_reclaim(priv, txq_id, index);

		if (ieee80211_is_data_qos(tx_resp->frame_ctrl))

		iwl_free_tfds_in_queue(priv, sta_id, tid, freed);



		if (priv->mac80211_registered &&
@@ -1161,7 +1160,6 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv, 
			iwl_wake_queue(priv, txq_id);

	}



	if (ieee80211_is_data_qos(tx_resp->frame_ctrl))

	iwl_txq_check_empty(priv, sta_id, tid, txq_id);



	if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))

drivers/net/wireless/iwlwifi/iwl-tx.c

+5 −1
Original line number Diff line number Diff line
@@ -1145,6 +1145,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index) 
	struct iwl_queue *q = &txq->q;

	struct iwl_tx_info *tx_info;

	int nfreed = 0;

	struct ieee80211_hdr *hdr;



	if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {

		IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
@@ -1159,13 +1160,16 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index) 


		tx_info = &txq->txb[txq->q.read_ptr];

		iwl_tx_status(priv, tx_info->skb[0]);



		hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;

		if (hdr && ieee80211_is_data_qos(hdr->frame_control))

			nfreed++;

		tx_info->skb[0] = NULL;



		if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)

			priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);



		priv->cfg->ops->lib->txq_free_tfd(priv, txq);

		nfreed++;

	}

	return nfreed;

}