From: Greg Kroah-Hartman <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org,
stable-review@kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
Zhu Yi <yi.zhu@intel.com>,
Reinette Chatre <reinette.chatre@intel.com>,
"John W. Linville" <linville@tuxdriver.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [PATCH 39/52] iwlwifi: fix iwl_queue_used bug when read_ptr == write_ptr
Date: Thu, 14 Jan 2010 14:27:18 -0800 [thread overview]
Message-ID: <1263508051-7868-39-git-send-email-gregkh@suse.de> (raw)
In-Reply-To: <1263508051-7868-38-git-send-email-gregkh@suse.de>
From: Zhu Yi <yi.zhu@intel.com>
commit c8106d7625a58ee4387cb2efe3e82320ad44b467 upstream.
When txq read_ptr equals to write_ptr, iwl_queue_used should
always return false. Because there is no used TFD in this case.
This is a complementary fix to the fix already included in commit "iwl3945:
fix panic in iwl3945 driver". Both fixes are needed to address the panic
below.
This problem was discussed on linux-wireless in
http://thread.gmane.org/gmane.linux.kernel.wireless.general/43568
<1>[ 7290.414172] IP: [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<4>[ 7290.414205] PGD 0
<1>[ 7290.414214] Thread overran stack, or stack corrupted
<0>[ 7290.414229] Oops: 0002 [#1] PREEMPT SMP
<0>[ 7290.414246] last sysfs file: /sys/devices/platform/coretemp.1/temp1_input
<4>[ 7290.414265] CPU 0
<4>[ 7290.414274] Modules linked in: af_packet nfsd usb_storage usb_libusual cpufreq_powersave exportfs cpufreq_conservative iwl3945 nfs cpufreq_userspace snd_hda_codec_realtek acpi_cpufreq uvcvideo lockd iwlcore snd_hda_intel joydev coretemp nfs_acl videodev snd_hda_codec mac80211 v4l1_compat snd_hwdep sbp2 v4l2_compat_ioctl32 uhci_hcd psmouse auth_rpcgss ohci1394 cfg80211 ehci_hcd video ieee1394 snd_pcm serio_raw battery ac nvidia(P) usbcore output sunrpc evdev lirc_ene0100 snd_page_alloc rfkill tg3 libphy fuse lzo lzo_decompress lzo_compress
<6>[ 7290.414486] Pid: 0, comm: swapper Tainted: P 2.6.32-rc8-wl #213 Aspire 5720
<6>[ 7290.414507] RIP: 0010:[<ffffffffa0dd53a1>] [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<6>[ 7290.414541] RSP: 0018:ffff880002203d60 EFLAGS: 00010246
<6>[ 7290.414557] RAX: 000000000000004f RBX: ffff880064c11600 RCX: 0000000000000013
<6>[ 7290.414576] RDX: ffffffffa0ddcf20 RSI: ffff8800512b7008 RDI: 0000000000000038
<6>[ 7290.414596] RBP: ffff880002203dd0 R08: 0000000000000000 R09: 0000000000000100
<6>[ 7290.414616] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000a0
<6>[ 7290.414635] R13: 0000000000000002 R14: 0000000000000013 R15: 0000000000020201
<6>[ 7290.414655] FS: 0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
<6>[ 7290.414677] CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
<6>[ 7290.414693] CR2: 0000000000000041 CR3: 0000000001001000 CR4: 00000000000006f0
<6>[ 7290.414712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<6>[ 7290.414732] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>[ 7290.414752] Process swapper (pid: 0, threadinfo ffffffff81524000, task ffffffff81528b60)
<0>[ 7290.414772] Stack:
<4>[ 7290.414780] ffff880002203da0 0000000000000046 0000000000000000 0000000000000046
<4>[ 7290.414804] <0> 0000000000000282 0000000000000282 0000000000000282 ffff880064c12010
<4>[ 7290.414830] <0> ffff880002203db0 ffff880064c11600 ffff880064c12e50 ffff8800512b7000
<0>[ 7290.414858] Call Trace:
<0>[ 7290.414867] <IRQ>
<4>[ 7290.414884] [<ffffffffa0dc8c47>] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945]
<4>[ 7290.414910] [<ffffffff8138fc60>] ? _spin_unlock+0x30/0x60
<4>[ 7290.414931] [<ffffffff81049a21>] tasklet_action+0x101/0x110
<4>[ 7290.414950] [<ffffffff8104a3d0>] __do_softirq+0xc0/0x160
<4>[ 7290.414968] [<ffffffff8100d01c>] call_softirq+0x1c/0x30
<4>[ 7290.414986] [<ffffffff8100eff5>] do_softirq+0x75/0xb0
<4>[ 7290.415003] [<ffffffff81049ee5>] irq_exit+0x95/0xa0
<4>[ 7290.415020] [<ffffffff8100e547>] do_IRQ+0x77/0xf0
<4>[ 7290.415038] [<ffffffff8100c7d3>] ret_from_intr+0x0/0xf
<0>[ 7290.415052] <EOI>
<4>[ 7290.415067] [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415087] [<ffffffff81234f04>] ? acpi_idle_enter_bm+0x27a/0x2a5
<4>[ 7290.415107] [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415130] [<ffffffff812c11f3>] ? cpuidle_idle_call+0x93/0xf0
<4>[ 7290.415149] [<ffffffff8100b0d7>] ? cpu_idle+0xa7/0x110
<4>[ 7290.415168] [<ffffffff8137b3d5>] ? rest_init+0x75/0x80
<4>[ 7290.415187] [<ffffffff8158cd0a>] ? start_kernel+0x3a7/0x3b3
<4>[ 7290.415206] [<ffffffff8158c315>] ? x86_64_start_reservations+0x125/0x129
<4>[ 7290.415227] [<ffffffff8158c3fd>] ? x86_64_start_kernel+0xe4/0xeb
<0>[ 7290.415243] Code: 00 41 39 ce 0f 8d e8 01 00 00 48 8b 47 40 48 63 d2 48 69 d2 98 00 00 00 4c 8b 04 02 48 c7 c2 20 cf dd a0 49 8d 78 38 49 8d 40 4f <c6> 47 09 00 c6 47 0c 00 c6 47 0f 00 c6 47 12 00 c6 47 15 00 49
<1>[ 7290.415382] RIP [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<4>[ 7290.415410] RSP <ffff880002203d60>
<0>[ 7290.415421] CR2: 0000000000000041
<4>[ 7290.415436] ---[ end trace ec46807277caa515 ]---
<0>[ 7290.415450] Kernel panic - not syncing: Fatal exception in interrupt
<4>[ 7290.415468] Pid: 0, comm: swapper Tainted: P D 2.6.32-rc8-wl #213
<4>[ 7290.415486] Call Trace:
<4>[ 7290.415495] <IRQ> [<ffffffff8138c040>] panic+0x7d/0x13a
<4>[ 7290.415519] [<ffffffff8101071a>] oops_end+0xda/0xe0
<4>[ 7290.415538] [<ffffffff8102e1ea>] no_context+0xea/0x250
<4>[ 7290.415557] [<ffffffff81038991>] ? select_task_rq_fair+0x511/0x780
<4>[ 7290.415578] [<ffffffff8102e475>] __bad_area_nosemaphore+0x125/0x1e0
<4>[ 7290.415597] [<ffffffff81038d0c>] ? __enqueue_entity+0x7c/0x80
<4>[ 7290.415616] [<ffffffff81039201>] ? enqueue_task_fair+0x111/0x150
<4>[ 7290.415636] [<ffffffff8102e53e>] bad_area_nosemaphore+0xe/0x10
<4>[ 7290.415656] [<ffffffff8102e8fa>] do_page_fault+0x26a/0x320
<4>[ 7290.415674] [<ffffffff813905df>] page_fault+0x1f/0x30
<4>[ 7290.415697] [<ffffffffa0dd53a1>] ? iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<4>[ 7290.415723] [<ffffffffa0dc8c47>] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945]
<4>[ 7290.415746] [<ffffffff8138fc60>] ? _spin_unlock+0x30/0x60
<4>[ 7290.415764] [<ffffffff81049a21>] tasklet_action+0x101/0x110
<4>[ 7290.415783] [<ffffffff8104a3d0>] __do_softirq+0xc0/0x160
<4>[ 7290.415801] [<ffffffff8100d01c>] call_softirq+0x1c/0x30
<4>[ 7290.415818] [<ffffffff8100eff5>] do_softirq+0x75/0xb0
<4>[ 7290.415835] [<ffffffff81049ee5>] irq_exit+0x95/0xa0
<4>[ 7290.415852] [<ffffffff8100e547>] do_IRQ+0x77/0xf0
<4>[ 7290.415869] [<ffffffff8100c7d3>] ret_from_intr+0x0/0xf
<4>[ 7290.415883] <EOI> [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415911] [<ffffffff81234f04>] ? acpi_idle_enter_bm+0x27a/0x2a5
<4>[ 7290.415931] [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415952] [<ffffffff812c11f3>] ? cpuidle_idle_call+0x93/0xf0
<4>[ 7290.415971] [<ffffffff8100b0d7>] ? cpu_idle+0xa7/0x110
<4>[ 7290.415989] [<ffffffff8137b3d5>] ? rest_init+0x75/0x80
<4>[ 7290.416007] [<ffffffff8158cd0a>] ? start_kernel+0x3a7/0x3b3
<4>[ 7290.416026] [<ffffffff8158c315>] ? x86_64_start_reservations+0x125/0x129
<4>[ 7290.416047] [<ffffffff8158c3fd>] ? x86_64_start_kernel+0xe4/0xeb
Reported-by: Maxim Levitsky <maximlevitsky@gmail.com>
Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/iwlwifi/iwl-dev.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c2d9b7a..cea2ee2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -703,7 +703,7 @@ extern void iwl_txq_ctx_stop(struct iwl_priv *priv);
extern int iwl_queue_space(const struct iwl_queue *q);
static inline int iwl_queue_used(const struct iwl_queue *q, int i)
{
- return q->write_ptr > q->read_ptr ?
+ return q->write_ptr >= q->read_ptr ?
(i >= q->read_ptr && i < q->write_ptr) :
!(i < q->read_ptr && i >= q->write_ptr);
}
--
1.6.6
next prev parent reply other threads:[~2010-01-14 22:32 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-14 22:25 [00/52] 2.6.32.4-stable review Greg KH
2010-01-14 22:26 ` [PATCH 01/52] untangle the do_mremap() mess Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 02/52] fasync: split 'fasync_helper()' into separate add/remove functions Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 03/52] ASoC: fix params_rate() macro use in several codecs Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 04/52] modules: Skip empty sections when exporting section notes Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 05/52] exofs: simple_write_end does not mark_inode_dirty Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 06/52] Revert "x86: Side-step lguest problem by only building cmpxchg8b_emu for pre-Pentium" Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 07/52] nfsd: make sure data is on disk before calling ->fsync Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 08/52] sunrpc: fix peername failed on closed listener Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 09/52] SUNRPC: Fix up an error return value in gss_import_sec_context_kerberos() Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 10/52] SUNRPC: Fix the return value in gss_import_sec_context() Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 11/52] sunrpc: on successful gss error pipe write, don't return error Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 12/52] drm/i915: Update LVDS connector status when receiving ACPI LID event Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 13/52] drm/i915: fix order of fence release wrt flushing Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 14/52] drm/i915: Permit pinning whilst the device is 'suspended' Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 15/52] drm: remove address mask param for drm_pci_alloc() Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 16/52] drm/i915: Enable/disable the dithering for LVDS based on VBT setting Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 17/52] drm/i915: Make the BPC in FDI rx/transcoder be consistent with that in pipeconf on Ironlake Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 18/52] drm/i915: Select the correct BPC for LVDS " Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 19/52] drm/i915: fix unused var Greg Kroah-Hartman
2010-01-14 22:26 ` [PATCH 20/52] rtc_cmos: convert shutdown to new pnp_driver->shutdown Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 21/52] drivers/cpuidle/governors/menu.c: fix undefined reference to `__udivdi3' Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 22/52] cgroups: fix 2.6.32 regression causing BUG_ON() in cgroup_diput() Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 23/52] lib/rational.c needs module.h Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 24/52] dma-debug: allow DMA_BIDIRECTIONAL mappings to be synced with DMA_FROM_DEVICE and Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 25/52] kernel/signal.c: fix kernel information leak with print-fatal-signals=1 Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 26/52] mmc_block: add dev_t initialization check Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 27/52] mmc_block: fix probe error cleanup bug Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 28/52] mmc_block: fix queue cleanup Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 29/52] ALSA: hda - Fix ALC861-VD capture source mixer Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 30/52] ALSA: ac97: Add Dell Dimension 2400 to Headphone/Line Jack Sense blacklist Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 31/52] ALSA: atiixp: Specify codec for Foxconn RC4107MA-RS2 Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 32/52] ASoC: Fix WM8350 DSP mode B configuration Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 33/52] netfilter: ebtables: enforce CAP_NET_ADMIN Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 34/52] netfilter: nf_ct_ftp: fix out of bounds read in update_nl_seq() Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 35/52] hwmon: (coretemp) Fix TjMax for Atom N450/D410/D510 CPUs Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 36/52] hwmon: (adt7462) Fix pin 28 monitoring Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 37/52] quota: Fix dquot_transfer for filesystems different from ext4 Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 38/52] xen: fix hang on suspend Greg Kroah-Hartman
2010-01-14 22:27 ` Greg Kroah-Hartman [this message]
2010-01-14 22:27 ` [PATCH 40/52] ath5k: Fix eeprom checksum check for custom sized eeproms Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 41/52] cfg80211: fix syntax error on user regulatory hints Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 42/52] iwl: off by one bug Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 43/52] mac80211: add missing sanity checks for action frames Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 44/52] drm/i915: remove render reclock support Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 45/52] libertas: Remove carrier signaling from the scan code Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 46/52] kernel/sysctl.c: fix stable merge error in NOMMU mmap_min_addr Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 47/52] mac80211: fix skb buffering issue (and fixes to that) Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 48/52] fix braindamage in audit_tree.c untag_chunk() Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 49/52] fix more leaks in audit_tree.c tag_chunk() Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 50/52] module: handle ppc64 relocating kcrctabs when CONFIG_RELOCATABLE=y Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 51/52] ipv6: skb_dst() can be NULL in ipv6_hop_jumbo() Greg Kroah-Hartman
2010-01-14 22:27 ` [PATCH 52/52] Linux 2.6.32.4-rc1 Greg Kroah-Hartman
2010-01-14 23:38 ` [Stable-review] [PATCH 15/52] drm: remove address mask param for drm_pci_alloc() Ben Hutchings
2010-01-14 23:45 ` Greg KH
2010-01-15 0:56 ` Zhenyu Wang
2010-01-16 0:15 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1263508051-7868-39-git-send-email-gregkh@suse.de \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=reinette.chatre@intel.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=yi.zhu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome