mac80211: detect driver tx bugs

When a driver rejects a frame in it's ->tx() callback, it must also
stop queues, otherwise mac80211 can go into a loop here. Detect this
situation and abort the loop after five retries, warning about the
driver bug.

This patch was added to mainline as
commit ef3a62d272f033989e83eb1f26505f93f93e3e69.

Thanks to Larry Finger <Larry.Finger@lwfinger.net> for doing the -stable
port.

Cc: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 67b509edd431024ea62623d023f5cf309005af64..9bdaed803b8f0260ff5b9b08b945970fd6a176c8 100644 (file)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1090,7 +1090,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
        ieee80211_tx_handler *handler;
        struct ieee80211_txrx_data tx;
        ieee80211_txrx_result res = TXRX_DROP, res_prepare;
-       int ret, i;
+       int ret, i, retries = 0;
 
        WARN_ON(__ieee80211_queue_pending(local, control->queue));
 
@@ -1181,6 +1181,13 @@ retry:
                if (!__ieee80211_queue_stopped(local, control->queue)) {
                        clear_bit(IEEE80211_LINK_STATE_PENDING,
                                  &local->state[control->queue]);
+                       retries++;
+                       /*
+                        * Driver bug, it's rejecting packets but
+                        * not stopping queues.
+                        */
+                       if (WARN_ON_ONCE(retries > 5))
+                               goto drop;
                        goto retry;
                }
                memcpy(&store->control, control,