From patchwork Wed Jun 5 14:24:36 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Helmut Schaa X-Patchwork-Id: 2670321 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 9A819DF264 for ; Wed, 5 Jun 2013 14:24:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755771Ab3FEOYh (ORCPT ); Wed, 5 Jun 2013 10:24:37 -0400 Received: from mail-ie0-f169.google.com ([209.85.223.169]:37947 "EHLO mail-ie0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752718Ab3FEOYh (ORCPT ); Wed, 5 Jun 2013 10:24:37 -0400 Received: by mail-ie0-f169.google.com with SMTP id 10so3876126ied.28 for ; Wed, 05 Jun 2013 07:24:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=YfD5iZ4GqZwEBo/B01Ko4QfgjuuzLZl7nAuBPw2WZ9g=; b=LO6OtXylQnBGMLHQ5EJ/Pp9iS+3Dfll2u3zi4Cd2TDGWLONYY+j3UDpWknbwK+ncYm YM1EELol/pDbRnLqUDJF5GinydJaQCFArggA2GeJGLCi2LDaDKc2e0NF3WQkuE0CiZay g30VadEhnOVXxZ+mMjSjRs48mxfSTlOJsDnHD3dcG7jMbgg4n2rnOxuYAuEPVAgPgGWm Mm0e0N1cddaDIju2K3a44UYn/tM2rvC4z1DGTUpRgHxACwTrMthp1MVYvyKkXssymgZa yK3VdOpz3yKE2WTSr8uLVH/NMYcaB8TfIPOmQrD5hK+/HakKvrs7AzU69rb/xvegjA9a 4m1w== MIME-Version: 1.0 X-Received: by 10.50.87.4 with SMTP id t4mr3322213igz.76.1370442276564; Wed, 05 Jun 2013 07:24:36 -0700 (PDT) Received: by 10.64.245.140 with HTTP; Wed, 5 Jun 2013 07:24:36 -0700 (PDT) In-Reply-To: <1370371064-6903-1-git-send-email-linux@rempel-privat.de> References: <51ADBC01.6090202@blackshift.org> <1370371064-6903-1-git-send-email-linux@rempel-privat.de> Date: Wed, 5 Jun 2013 16:24:36 +0200 Message-ID: Subject: Re: [PATCH] ath9k_htc: fix skb_under_panic error From: Helmut Schaa To: Oleksij Rempel Cc: linux-wireless , ath9k-devel@lists.ath9k.org, Marc Kleine-Budde Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org On Tue, Jun 4, 2013 at 8:37 PM, Oleksij Rempel wrote: > This error seems to be really rare, and we do not know real couse of it. > But, in any case, we should check size of head before reducing it. Mind to try the (completely untested) patch against wireless-testing instead? Helmut --- Subject: [PATCH] ath9k_htc: Restore skb headroom when returning skb to mac80211 ath9k_htc adds padding between the 802.11 header and the payload during TX by moving the header. When handing the frame back to mac80211 for TX status handling the header is not moved back into its original position. This can result in a too small skb headroom when entering ath9k_htc again (due to a soft retransmission for example) causing an skb_under_panic oops. Fix this by moving the 802.11 header back into its original position before returning the frame to mac80211 as other drivers like rt2x00 or ath5k do. Signed-off-by: Helmut Schaa --- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 11 +++++++++++ 1 file changed, 11 insertions(+) if (slot < 0) { @@ -504,6 +506,15 @@ send_mac80211: ath9k_htc_tx_clear_slot(priv, slot); + /* Remove padding before handing frame back to mac80211 */ + hdr = (struct ieee80211_hdr *) skb->data; + padpos = ieee80211_hdrlen(hdr->frame_control); + padsize = padpos & 3; + if (padsize && skb->len > padpos + padsize) { + memmove(skb->data + padsize, skb->data, padpos); + skb_pull(skb, padsize); + } + /* Send status to mac80211 */ ieee80211_tx_status(priv->hw, skb); } -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index e602c95..666cfb6 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -448,6 +448,8 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv, struct ieee80211_conf *cur_conf = &priv->hw->conf; bool txok; int slot; + struct ieee80211_hdr *hdr; + int padpos, padsize; slot = strip_drv_header(priv, skb);