lkml.org 
[lkml]   [2010]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [REVERT] be6b38bcb175613f239e0b302607db346472c6b6. v2.6.34-rc3-406 oops with 4965AGN wireless
On Fri, Apr 09, 2010 at 01:16:43AM +0800, Jeff Chua wrote:
>
> index 1bd2cd8..83c52a6 100644
> --- a/drivers/net/wireless/iwlwifi/iwl-4965.c
> +++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
> @@ -2041,16 +2041,14 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
> tx_resp->failure_frame);
>
> freed = iwl_tx_queue_reclaim(priv, txq_id, index);
> - if (qc && likely(sta_id != IWL_INVALID_STATION))
> - priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
> + iwl_free_tfds_in_queue(priv, sta_id, tid, freed);

So what happens if we hit sta_id == IWL_INVALID_STATION and !txq->sched_retry?

AFAICS, IWL_INVALID_STATION is 255 and priv->stations[] has only 32 elements.
And code around that place is
if (txq->sched_retry && unlikely(sta_id == IWL_INVALID_STATION)) {
IWL_ERR(priv, "Station not known\n");
return;
}
if (txq->sched_retry) {
....
} else {
....
the code modified in that chunk
....
}
so this removal of check for sta_id doesn't look apriori safe...

I'm not familiar with that code and I don't have the hardware, so this is
just from RTFS, but... might make sense to replace that call of
iwl_free_tfds_in_queue with

if (sta_id == IWL_INVALID_STATION)
printk(KERN_ERR "buggered");
else
iwl_free_tfds_in_queue(priv, sta_id, tid, freed);

and see if that helps and if printk gets triggered.


\
 
 \ /
  Last update: 2010-04-08 20:17    [W:6.928 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site