brcmsmac: handle packet drop during transmit correctly
authorPiotr Haber <phaber@broadcom.com>
Wed, 28 Nov 2012 20:44:05 +0000 (21:44 +0100)
committerJohn W. Linville <linville@tuxdriver.com>
Fri, 30 Nov 2012 18:38:16 +0000 (13:38 -0500)
The .tx() callback function can drop packets when there is no
space in the DMA fifo. Propagate that information to caller
and make sure the freed sk_buff reference is not accessed.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
drivers/net/wireless/brcm80211/brcmsmac/main.c
drivers/net/wireless/brcm80211/brcmsmac/pub.h

index 1710ccba8bacf2c49961be0a61d89f6332cfbed4..f917d621accac07a04f7d92ffd5cd32c28c3d7c9 100644 (file)
@@ -285,8 +285,8 @@ static void brcms_ops_tx(struct ieee80211_hw *hw,
                kfree_skb(skb);
                goto done;
        }
-       brcms_c_sendpkt_mac80211(wl->wlc, skb, hw);
-       tx_info->rate_driver_data[0] = control->sta;
+       if (brcms_c_sendpkt_mac80211(wl->wlc, skb, hw))
+               tx_info->rate_driver_data[0] = control->sta;
  done:
        spin_unlock_bh(&wl->lock);
 }
index 2a44593f1e37152999486f7e045219f03d0ae1b5..54ab2f70d362c0edc95498e570ba4bccbb1e306d 100644 (file)
@@ -6928,17 +6928,20 @@ static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
        return ret;
 }
 
-void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
+bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
                              struct ieee80211_hw *hw)
 {
        uint fifo;
        struct scb *scb = &wlc->pri_scb;
 
        fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
-       if (brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0))
-               return;
-       if (brcms_c_tx(wlc, sdu))
-               dev_kfree_skb_any(sdu);
+       brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
+       if (!brcms_c_tx(wlc, sdu))
+               return true;
+
+       /* packet discarded */
+       dev_kfree_skb_any(sdu);
+       return false;
 }
 
 int
index 0148dec104f0369c5bc2942f3594f0d83a5e81af..0d7af349d864d8885cc130b7c0b94b09dc66b1b4 100644 (file)
@@ -284,7 +284,7 @@ extern void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask);
 extern bool brcms_c_intrsupd(struct brcms_c_info *wlc);
 extern bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc);
 extern bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded);
-extern void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,
+extern bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,
                                     struct sk_buff *sdu,
                                     struct ieee80211_hw *hw);
 extern bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid);