diff options
| author | Roland Vossen <rvossen@broadcom.com> | 2011-04-12 14:34:41 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-06-03 09:32:10 +0900 |
| commit | 02ca42f78e4cc3b41c8fecb9ad3a8f547db87a85 (patch) | |
| tree | c9918673eeabe6bb298a566bdaf3ac7f05cc116c | |
| parent | 9edb40ddd05b47703bb1b5757ba36e96c77d1fdd (diff) | |
staging: brcm80211: bugfix for div by zero in minstrel_ht_tx_status
commit e9c661e08c2a6015c1b7cba1cecefa27a089df71 upstream.
Caused by brcmsmac.ko suppling a 0 value to Mac80211. Mac80211 subsequently
divides by this number. Bug only occurred on AMPDU traffic. This is a fix
for https://bugzilla.kernel.org/show_bug.cgi?id=32032, titled
'Divide error in minstrel_ht_tx_status followed by hang', reported by
Wouter Cloetens.
Signed-off-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c | 13 |
1 files changed, 3 insertions, 10 deletions
diff --git a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c index f0086595788..f7bff4e3aa0 100644 --- a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c +++ b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c @@ -1123,21 +1123,12 @@ wlc_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, ini->txretry[index] = 0; /* ampdu_ack_len: number of acked aggregated frames */ - /* ampdu_ack_map: block ack bit map for the aggregation */ /* ampdu_len: number of aggregated frames */ rate_status(wlc, tx_info, txs, mcs); tx_info->flags |= IEEE80211_TX_STAT_ACK; tx_info->flags |= IEEE80211_TX_STAT_AMPDU; - - /* XXX TODO: Make these accurate. */ tx_info->status.ampdu_ack_len = - (txs-> - status & TX_STATUS_FRM_RTX_MASK) >> - TX_STATUS_FRM_RTX_SHIFT; - tx_info->status.ampdu_len = - (txs-> - status & TX_STATUS_FRM_RTX_MASK) >> - TX_STATUS_FRM_RTX_SHIFT; + tx_info->status.ampdu_len = 1; skb_pull(p, D11_PHY_HDR_LEN); skb_pull(p, D11_TXH_LEN); @@ -1163,6 +1154,8 @@ wlc_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb, /* Retry timeout */ ini->tx_in_transit--; ieee80211_tx_info_clear_status(tx_info); + tx_info->status.ampdu_ack_len = 0; + tx_info->status.ampdu_len = 1; tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK; skb_pull(p, D11_PHY_HDR_LEN); |