Commit 0e3de998 authored by Ivo van Doorn's avatar Ivo van Doorn Committed by John W. Linville
Browse files

rt2x00: Fix TX failure path

The callback function write_tx_data() can only fail
when our ENTRY_OWNER_DEVICE_DATA flag on a queue entry
failed to determine the entry was not available and
it is in fact still owned by the hardware.
This means that if that function fails the queue
must be stopped in mac80211.

When rt2x00queue_get_queue() returns NULL in the TX
path, it means mac80211 has passed us an invalid queue,
although this should be impossible, it shouldn't hurt
if we send mac80211 a signal to stop the queue either.

Both issues can simply be resolved by removing their
manual failure handler and making them use the failure path
provided in rt2x00mac_tx().
Signed-off-by: default avatarIvo van Doorn <>
Signed-off-by: default avatarJohn W. Linville <>
parent 0f829b1d
......@@ -132,8 +132,7 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
"Attempt to send packet over invalid queue %d.\n"
"Please file bug report to %s.\n", qid, DRV_PROJECT);
return NETDEV_TX_OK;
goto exit_fail;
......@@ -386,7 +386,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
u8 rate_idx, rate_flags;
if (unlikely(rt2x00queue_full(queue)))
return -EINVAL;
return -ENOBUFS;
if (test_and_set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags)) {
......@@ -415,7 +415,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
tx_info = IEEE80211_SKB_CB(skb);
rate_idx = tx_info->control.rates[0].idx;
rate_flags = tx_info->control.rates[0].flags;
skbdesc = get_skb_frame_desc(entry->skb);
skbdesc = get_skb_frame_desc(skb);
memset(skbdesc, 0, sizeof(*skbdesc));
skbdesc->entry = entry;
skbdesc->tx_rate_idx = rate_idx;
......@@ -427,20 +427,18 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
* the frame so we can provide it to the driver seperately.
if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
!test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
!test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags))
rt2x00crypto_tx_remove_iv(skb, iv_len);
* It could be possible that the queue was corrupted and this
* call failed. Just drop the frame, we cannot rollback and pass
* the frame to mac80211 because the skb->cb has now been tainted.
* call failed. Since we always return NETDEV_TX_OK to mac80211,
* this frame will simply be dropped.
if (unlikely(queue->rt2x00dev->ops->lib->write_tx_data(entry))) {
clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
entry->skb = NULL;
return 0;
return -EIO;
if (test_bit(DRIVER_REQUIRE_DMA, &queue->rt2x00dev->flags))
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment