linux/drivers/net/wireless/rt2x00
Stanislaw Gruszka 4b1bfb7d2d rt2x00: fix crash in rt2800usb_write_tx_desc
Patch should fix this oops:

BUG: unable to handle kernel NULL pointer dereference at 000000a0
IP: [<f8e06078>] rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb]
*pdpt = 000000002408c001 *pde = 0000000024079067 *pte = 0000000000000000
Oops: 0000 [#1] SMP
EIP: 0060:[<f8e06078>] EFLAGS: 00010282 CPU: 0
EIP is at rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb]
EAX: 00000035 EBX: ef2bef10 ECX: 00000000 EDX: d40958a0
ESI: ef1865f8 EDI: ef1865f8 EBP: d4095878 ESP: d409585c
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [<f8da5e85>] rt2x00queue_write_tx_frame+0x155/0x300 [rt2x00lib]
 [<f8da424c>] rt2x00mac_tx+0x7c/0x370 [rt2x00lib]
 [<c04882b2>] ? mark_held_locks+0x62/0x90
 [<c081f645>] ? _raw_spin_unlock_irqrestore+0x35/0x60
 [<c04884ba>] ? trace_hardirqs_on_caller+0x5a/0x170
 [<c04885db>] ? trace_hardirqs_on+0xb/0x10
 [<f8d618ac>] __ieee80211_tx+0x5c/0x1e0 [mac80211]
 [<f8d631fc>] ieee80211_tx+0xbc/0xe0 [mac80211]
 [<f8d63163>] ? ieee80211_tx+0x23/0xe0 [mac80211]
 [<f8d632e1>] ieee80211_xmit+0xc1/0x200 [mac80211]
 [<f8d63220>] ? ieee80211_tx+0xe0/0xe0 [mac80211]
 [<c0487d45>] ? lock_release_holdtime+0x35/0x1b0
 [<f8d63986>] ? ieee80211_subif_start_xmit+0x446/0x5f0 [mac80211]
 [<f8d637dd>] ieee80211_subif_start_xmit+0x29d/0x5f0 [mac80211]
 [<f8d63924>] ? ieee80211_subif_start_xmit+0x3e4/0x5f0 [mac80211]
 [<c0760188>] ? sock_setsockopt+0x6a8/0x6f0
 [<c0760000>] ? sock_setsockopt+0x520/0x6f0
 [<c076daef>] dev_hard_start_xmit+0x2ef/0x650

Oops might happen because we perform parallel putting new entries in a
queue (rt2x00queue_write_tx_frame()) and removing entries after
finishing transmitting (rt2800usb_work_txdone()). There are cases when
_txdone may process an entry that was not fully send and nullify
entry->skb .

To fix check in _txdone if entry has flags that indicate pending
transmission and wait until flags get cleared.

Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-11 14:34:36 -04:00
..
Kconfig rt2x00: Enabled rt35xx device support by default. 2011-06-01 15:10:59 -04:00
Makefile
rt2x00.h Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem 2011-07-08 11:03:36 -04:00
rt2x00config.c rt2x00: fix rmmod crash 2011-06-06 15:24:18 -04:00
rt2x00crypto.c rt2x00: Don't use queue entry as parameter when creating TX descriptor. 2011-07-07 13:20:58 -04:00
rt2x00debug.c
rt2x00debug.h
rt2x00dev.c rt2x00: fix possible memory corruption in case of invalid rxdesc.size 2011-06-22 16:09:44 -04:00
rt2x00dump.h
rt2x00firmware.c
rt2x00leds.c
rt2x00leds.h
rt2x00lib.h rt2x00: Fix compilation without CONFIG_RT2X00_LIB_CRYPTO 2011-08-02 13:48:14 -04:00
rt2x00link.c
rt2x00mac.c rt2x00: fix usage of NULL queue 2011-08-02 13:48:14 -04:00
rt2x00pci.c
rt2x00pci.h
rt2x00queue.c rt2x00: Reduce window of a queue's tx lock. 2011-07-07 13:20:58 -04:00
rt2x00queue.h rt2x00: Serialize TX operations on a queue. 2011-07-07 13:20:57 -04:00
rt2x00reg.h
rt2x00soc.c
rt2x00soc.h
rt2x00usb.c rt2x00: reset usb devices at probe 2011-06-22 16:09:44 -04:00
rt2x00usb.h
rt61pci.c rt2x00: Implement tx_frames_pending mac80211 callback function. 2011-07-07 13:21:00 -04:00
rt61pci.h
rt73usb.c rt2x00: Add new rt73 buffalo USB id 2011-08-09 16:11:32 -04:00
rt73usb.h
rt2400pci.c rt2x00: Implement tx_frames_pending mac80211 callback function. 2011-07-07 13:21:00 -04:00
rt2400pci.h
rt2500pci.c rt2x00: Implement tx_frames_pending mac80211 callback function. 2011-07-07 13:21:00 -04:00
rt2500pci.h
rt2500usb.c rt2x00: Implement tx_frames_pending mac80211 callback function. 2011-07-07 13:21:00 -04:00
rt2500usb.h
rt2800.h
rt2800lib.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem 2011-08-03 09:18:21 -04:00
rt2800lib.h rt2x00: Move rt2800_txdone and rt2800_txdone_entry_check to rt2800usb. 2011-06-01 15:10:59 -04:00
rt2800pci.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem 2011-07-08 11:03:36 -04:00
rt2800pci.h
rt2800usb.c rt2x00: fix crash in rt2800usb_write_tx_desc 2011-08-11 14:34:36 -04:00
rt2800usb.h