From patchwork Fri Aug 14 14:12:24 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "John W. Linville" X-Patchwork-Id: 31404 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id 73660B707B for ; Sat, 15 Aug 2009 00:16:19 +1000 (EST) Received: by ozlabs.org (Postfix) id 5DEA8DDDA0; Sat, 15 Aug 2009 00:16:19 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id D69F3DDD0B for ; Sat, 15 Aug 2009 00:16:18 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754818AbZHNOPM (ORCPT ); Fri, 14 Aug 2009 10:15:12 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755740AbZHNOPM (ORCPT ); Fri, 14 Aug 2009 10:15:12 -0400 Received: from charlotte.tuxdriver.com ([70.61.120.58]:55197 "EHLO smtp.tuxdriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754818AbZHNOPK (ORCPT ); Fri, 14 Aug 2009 10:15:10 -0400 Received: from uucp by smtp.tuxdriver.com with local-rmail (Exim 4.63) (envelope-from ) id 1MbxYk-00036N-TU; Fri, 14 Aug 2009 10:15:11 -0400 Received: from linville-t400.local (linville-t400.local [127.0.0.1]) by linville-t400.local (8.14.3/8.14.3) with ESMTP id n7EECO4S013990; Fri, 14 Aug 2009 10:12:24 -0400 Received: (from linville@localhost) by linville-t400.local (8.14.3/8.14.3/Submit) id n7EECOsn013988; Fri, 14 Aug 2009 10:12:24 -0400 Date: Fri, 14 Aug 2009 10:12:24 -0400 From: "John W. Linville" To: davem@davemloft.net Cc: linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: pull request: wireless-2.6 2009-08-14 Message-ID: <20090814141224.GH2650@tuxdriver.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.19 (2009-01-05) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Dave, A couple more squeakers for 2.6.31...one avoids a panic related to 802.11n, the other avoids some memory corruption with rt2x00 devices. Please let me know if there are problems! John --- Individual patches are available here: http://www.kernel.org/pub/linux/kernel/people/linville/wireless-2.6/ --- The following changes since commit 839d1624b9dcf31fdc02e47359043bb7bd71d6ca: Francois Romieu (1): 8139cp: balance dma_map_single vs dma_unmap_single pair are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6.git master Luis R. Rodriguez (1): mac80211: fix panic when splicing unprepared TIDs Pavel Roskin (1): rt2x00: fix memory corruption in rf cache, add a sanity check drivers/net/wireless/rt2x00/rt2x00.h | 6 ++++-- net/mac80211/agg-tx.c | 8 ++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h index a498dde..49c9e2c 100644 --- a/drivers/net/wireless/rt2x00/rt2x00.h +++ b/drivers/net/wireless/rt2x00/rt2x00.h @@ -849,13 +849,15 @@ struct rt2x00_dev { static inline void rt2x00_rf_read(struct rt2x00_dev *rt2x00dev, const unsigned int word, u32 *data) { - *data = rt2x00dev->rf[word]; + BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32)); + *data = rt2x00dev->rf[word - 1]; } static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev, const unsigned int word, u32 data) { - rt2x00dev->rf[word] = data; + BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32)); + rt2x00dev->rf[word - 1] = data; } /* diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c index 9e5762a..a24e598 100644 --- a/net/mac80211/agg-tx.c +++ b/net/mac80211/agg-tx.c @@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local, &local->hw, queue, IEEE80211_QUEUE_STOP_REASON_AGGREGATION); + if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)) + return; + + if (WARN(!sta->ampdu_mlme.tid_tx[tid], + "TID %d gone but expected when splicing aggregates from" + "the pending queue\n", tid)) + return; + if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) { spin_lock_irqsave(&local->queue_stop_reason_lock, flags); /* mark queue as pending, it is stopped already */