Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c4dea35e authored by Piotr Haber's avatar Piotr Haber Committed by John W. Linville
Browse files

brcmsmac: handle packet drop during transmit correctly 



The .tx() callback function can drop packets when there is no
space in the DMA fifo. Propagate that information to caller
and make sure the freed sk_buff reference is not accessed.

Reviewed-by: default avatarArend van Spriel <arend@broadcom.com>
Reviewed-by: default avatarPieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: default avatarPiotr Haber <phaber@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 006a8f14

drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c

+2 −2
Original line number Diff line number Diff line
@@ -285,7 +285,7 @@ static void brcms_ops_tx(struct ieee80211_hw *hw, 
		kfree_skb(skb);

		goto done;

	}

	brcms_c_sendpkt_mac80211(wl->wlc, skb, hw);

	if (brcms_c_sendpkt_mac80211(wl->wlc, skb, hw))

		tx_info->rate_driver_data[0] = control->sta;

 done:

	spin_unlock_bh(&wl->lock);

drivers/net/wireless/brcm80211/brcmsmac/main.c

+8 −5
Original line number Diff line number Diff line
@@ -6928,17 +6928,20 @@ static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb) 
	return ret;

}



void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,

bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,

			      struct ieee80211_hw *hw)

{

	uint fifo;

	struct scb *scb = &wlc->pri_scb;



	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));

	if (brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0))

		return;

	if (brcms_c_tx(wlc, sdu))

	brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);

	if (!brcms_c_tx(wlc, sdu))

		return true;



	/* packet discarded */

	dev_kfree_skb_any(sdu);

	return false;

}



int

drivers/net/wireless/brcm80211/brcmsmac/pub.h

+1 −1
Original line number Diff line number Diff line
@@ -284,7 +284,7 @@ extern void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask); 
extern bool brcms_c_intrsupd(struct brcms_c_info *wlc);

extern bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc);

extern bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded);

extern void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,

extern bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,

				     struct sk_buff *sdu,

				     struct ieee80211_hw *hw);

extern bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid);