Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a239a8b4 authored by Wey-Yi Guy's avatar Wey-Yi Guy Committed by John W. Linville
Browse files

iwlwifi: error checking for number of tfds in queue 



When receive reply_tx and ready to decrement the count for number of
tfds in queue, do error checking to prevent error condition and
tfds_in_queue become negative number.

Signed-off-by: default avatarWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
CC: stable@kernel.org
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5e2f75b8

drivers/net/wireless/iwlwifi/iwl-4965.c

+1 −1
Original line number Diff line number Diff line
@@ -2008,7 +2008,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv, 
			IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "

					   "%d index %d\n", scd_ssn , index);

			freed = iwl_tx_queue_reclaim(priv, txq_id, index);

			priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;

			iwl_free_tfds_in_queue(priv, sta_id, tid, freed);



			if (priv->mac80211_registered &&

			    (iwl_queue_space(&txq->q) > txq->q.low_mark) &&

drivers/net/wireless/iwlwifi/iwl-5000.c

+2 −2
Original line number Diff line number Diff line
@@ -1125,7 +1125,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv, 
					scd_ssn , index, txq_id, txq->swq_id);



			freed = iwl_tx_queue_reclaim(priv, txq_id, index);

			priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;

			iwl_free_tfds_in_queue(priv, sta_id, tid, freed);



			if (priv->mac80211_registered &&

			    (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -1154,7 +1154,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv, 


		freed = iwl_tx_queue_reclaim(priv, txq_id, index);

		if (ieee80211_is_data_qos(tx_resp->frame_ctrl))

			priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;

			iwl_free_tfds_in_queue(priv, sta_id, tid, freed);



		if (priv->mac80211_registered &&

		    (iwl_queue_space(&txq->q) > txq->q.low_mark))

drivers/net/wireless/iwlwifi/iwl-core.h

+2 −0
Original line number Diff line number Diff line
@@ -446,6 +446,8 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv); 
int iwl_hw_tx_queue_init(struct iwl_priv *priv,

			 struct iwl_tx_queue *txq);

int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);

void iwl_free_tfds_in_queue(struct iwl_priv *priv,

			    int sta_id, int tid, int freed);

int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,

		      int slots_num, u32 txq_id);

void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);

drivers/net/wireless/iwlwifi/iwl-tx.c

+15 −1
Original line number Diff line number Diff line
@@ -120,6 +120,20 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq) 
EXPORT_SYMBOL(iwl_txq_update_write_ptr);





void iwl_free_tfds_in_queue(struct iwl_priv *priv,

			    int sta_id, int tid, int freed)

{

	if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)

		priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;

	else {

		IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",

			priv->stations[sta_id].tid[tid].tfds_in_queue,

			freed);

		priv->stations[sta_id].tid[tid].tfds_in_queue = 0;

	}

}

EXPORT_SYMBOL(iwl_free_tfds_in_queue);



/**

 * iwl_tx_queue_free - Deallocate DMA queue.

 * @txq: Transmit queue to deallocate.
@@ -1559,7 +1573,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv, 
	if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {

		/* calculate mac80211 ampdu sw queue to wake */

		int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);

		priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;

		iwl_free_tfds_in_queue(priv, sta_id, tid, freed);



		if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&

		    priv->mac80211_registered &&