package/madwifi/patches/343-txqueue_races.patch

   1 Merged from madwifi trunk r3551, r3552
   2
   3 --- a/ath/if_ath.c
   4 +++ b/ath/if_ath.c
   5 @@ -8254,6 +8254,17 @@
   6                         goto bf_fail;
   7                 }
   8
   9 +               /* We make sure we don't remove the TX descriptor on
  10 +                * which the HW is pointing since it contains the
  11 +                * ds_link field, except if this is the last TX
  12 +                * descriptor in the queue */
  13 +
  14 +               if ((txq->axq_depth > 1) &&
  15 +                   (bf->bf_daddr == ath_hal_gettxbuf(ah, txq->axq_qnum))) {
  16 +                       ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
  17 +                       goto bf_fail;
  18 +               }
  19 +
  20                 ATH_TXQ_REMOVE_HEAD(txq, bf_list);
  21                 ATH_TXQ_UNLOCK_IRQ(txq);
  22
  23 --- a/ath/if_athvar.h
  24 +++ b/ath/if_athvar.h
  25 @@ -586,7 +586,8 @@
  26  } while (0)
  27  #define ATH_TXQ_REMOVE_HEAD(_tq, _field) do { \
  28         STAILQ_REMOVE_HEAD(&(_tq)->axq_q, _field); \
  29 -       (_tq)->axq_depth--; \
  30 +       if (--(_tq)->axq_depth <= 0) \
  31 +               (_tq)->axq_link = NULL; \
  32  } while (0)
  33  /* move buffers from MCASTQ to CABQ */
  34  #define ATH_TXQ_MOVE_MCASTQ(_tqs,_tqd) do { \