Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933064Ab0DHSNw (ORCPT ); Thu, 8 Apr 2010 14:13:52 -0400 Received: from zeniv.linux.org.uk ([195.92.253.2]:38963 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933045Ab0DHSNs (ORCPT ); Thu, 8 Apr 2010 14:13:48 -0400 Date: Thu, 8 Apr 2010 19:13:40 +0100 From: Al Viro To: Jeff Chua Cc: Linus Torvalds , Wey-Yi Guy , Shanyu Zhao , Reinette Chatre , stable@kernel.org, Linux Kernel Subject: Re: [REVERT] be6b38bcb175613f239e0b302607db346472c6b6. v2.6.34-rc3-406 oops with 4965AGN wireless Message-ID: <20100408181340.GN30031@ZenIV.linux.org.uk> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-08-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1648 Lines: 45 On Fri, Apr 09, 2010 at 01:16:43AM +0800, Jeff Chua wrote: > > index 1bd2cd8..83c52a6 100644 > --- a/drivers/net/wireless/iwlwifi/iwl-4965.c > +++ b/drivers/net/wireless/iwlwifi/iwl-4965.c > @@ -2041,16 +2041,14 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv, > tx_resp->failure_frame); > > freed = iwl_tx_queue_reclaim(priv, txq_id, index); > - if (qc && likely(sta_id != IWL_INVALID_STATION)) > - priv->stations[sta_id].tid[tid].tfds_in_queue -= freed; > + iwl_free_tfds_in_queue(priv, sta_id, tid, freed); So what happens if we hit sta_id == IWL_INVALID_STATION and !txq->sched_retry? AFAICS, IWL_INVALID_STATION is 255 and priv->stations[] has only 32 elements. And code around that place is if (txq->sched_retry && unlikely(sta_id == IWL_INVALID_STATION)) { IWL_ERR(priv, "Station not known\n"); return; } if (txq->sched_retry) { .... } else { .... the code modified in that chunk .... } so this removal of check for sta_id doesn't look apriori safe... I'm not familiar with that code and I don't have the hardware, so this is just from RTFS, but... might make sense to replace that call of iwl_free_tfds_in_queue with if (sta_id == IWL_INVALID_STATION) printk(KERN_ERR "buggered"); else iwl_free_tfds_in_queue(priv, sta_id, tid, freed); and see if that helps and if printk gets triggered. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/