From da1be4d48515fde4eab98c776726747f7694f59f Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 2 Jul 2008 20:36:31 -0500 Subject: mac80211: detect driver tx bugs When a driver rejects a frame in it's ->tx() callback, it must also stop queues, otherwise mac80211 can go into a loop here. Detect this situation and abort the loop after five retries, warning about the driver bug. This patch was added to mainline as commit ef3a62d272f033989e83eb1f26505f93f93e3e69. Thanks to Larry Finger for doing the -stable port. Cc: Larry Finger Signed-off-by: Johannes Berg Signed-off-by: David S. Miller --- net/mac80211/tx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 67b509edd431..9bdaed803b8f 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1090,7 +1090,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb, ieee80211_tx_handler *handler; struct ieee80211_txrx_data tx; ieee80211_txrx_result res = TXRX_DROP, res_prepare; - int ret, i; + int ret, i, retries = 0; WARN_ON(__ieee80211_queue_pending(local, control->queue)); @@ -1181,6 +1181,13 @@ retry: if (!__ieee80211_queue_stopped(local, control->queue)) { clear_bit(IEEE80211_LINK_STATE_PENDING, &local->state[control->queue]); + retries++; + /* + * Driver bug, it's rejecting packets but + * not stopping queues. + */ + if (WARN_ON_ONCE(retries > 5)) + goto drop; goto retry; } memcpy(&store->control, control, -- cgit v1.2.3