iwlagn: verify flow id in compressed BA packet
authorShanyu Zhao <shanyu.zhao@intel.com>
Wed, 2 Jun 2010 00:13:58 +0000 (17:13 -0700)
committerReinette Chatre <reinette.chatre@intel.com>
Mon, 14 Jun 2010 17:51:37 +0000 (10:51 -0700)
commitb561e8274f75831ee87e4ea378cbb1f9f050a51a
treeedccfc3caea047e36b94e04ea6cf29a19dd416ba
parentda5ae1cfff4cc5b9392eab59b227ad907626d7aa
iwlagn: verify flow id in compressed BA packet

The flow id (scd_flow) in a compressed BA packet should match the txq_id
of the queue from which the aggregated packets were sent. However, in
some hardware like the 1000 series, sometimes the flow id is 0 for the
txq_id (10 to 19). This can cause the annoying message:
[ 2213.306191] iwlagn 0000:01:00.0: Received BA when not expected
[ 2213.310178] iwlagn 0000:01:00.0: Read index for DMA queue txq id (0),
index 5, is out of range [0-256] 7 7.

And even worse, if agg->wait_for_ba is true when the bad BA is arriving,
this can cause system hang due to NULL pointer dereference because the
code is operating in a wrong tx queue!

Signed-off-by: Shanyu Zhao <shanyu.zhao@intel.com>
Signed-off-by: Pradeep Kulkarni <pradeepx.kulkarni@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
drivers/net/wireless/iwlwifi/iwl-agn-tx.c