memory clobber in rx path, maybe related to ath9k.

Commit Message

Luis Rodriguez Oct. 14, 2010, 10:51 p.m. UTC

None

Patch

diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index a4c5ed4..cd61727 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -192,6 +192,7 @@  static void setup_ht_cap(struct ath_softc *sc,
 	int i, max_streams;
 
 	ht_info->ht_supported = true;
+	ht_info->ht_supported = false;
 	ht_info->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
 		       IEEE80211_HT_CAP_SM_PS |
 		       IEEE80211_HT_CAP_SGI_40 |
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 8c13479..a96327e 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -639,6 +639,10 @@  int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
 	if ((adsp->ds_rxstatus8 & AR_RxDone) == 0)
 		return -EINPROGRESS;
 
+	ds->ds_data = 0;
+	ds->ds_vdata = 0;
+	wmb();
+
 	ads.u.rx = adsp->u.rx;
 
 	rs->rs_status = 0;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index bcd3892..b31b5fe 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1243,6 +1243,10 @@  static int ath9k_tx(struct ieee80211_hw *hw,
 	int padpos, padsize;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 	int qnum;
+	struct sk_buff *tmp_skb;
+
+	tmp_skb = skb_copy(skb, GFP_ATOMIC);
+	dev_kfree_skb_any(tmp_skb);
 
 	if (aphy->state != ATH_WIPHY_ACTIVE && aphy->state != ATH_WIPHY_SCAN) {
 		ath_print(common, ATH_DBG_XMIT,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index fe73fc5..8348199 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -502,6 +502,9 @@  int ath_startrecv(struct ath_softc *sc)
 		goto start_recv;
 
 	bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+	/* This is fishy, what if the bf->bf_daddr is not valid ? */
+	if (!bf->bf_daddr)
+		printk("= hah bf->bf_daddr is 0!\n");
 	ath9k_hw_putrxbuf(ah, bf->bf_daddr);
 	ath9k_hw_rxena(ah);
 
@@ -663,6 +666,12 @@  static void ath_rx_send_to_mac80211(struct ieee80211_hw *hw,
 				    struct ieee80211_rx_status *rxs)
 {
 	struct ieee80211_hdr *hdr;
+	struct sk_buff *tmp_skb;
+
+	if (1) {
+		tmp_skb = skb_copy(skb, GFP_ATOMIC);
+		dev_kfree_skb_any(tmp_skb);
+	}
 
 	hdr = (struct ieee80211_hdr *)skb->data;
 
@@ -815,11 +821,17 @@  static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
 		ret = ath9k_hw_rxprocdesc(ah, tds, &trs, 0);
 		if (ret == -EINPROGRESS)
 			return NULL;
+		WARN_ON(1);
 	}
 
 	if (!bf->bf_mpdu)
 		return bf;
 
+	if (!bf->bf_buf_addr)
+		printk("bf->bf_buf_addr = 0\n");
 	/*
 	 * Synchronize the DMA transfer with CPU before
 	 * 1. accessing the frame
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html