b43: fix tx path skb leaks

SVN-Revision: 34607

diff --git a/package/mac80211/patches/300-pending_work.patch b/package/mac80211/patches/300-pending_work.patch
index adce64689442afca80261ea2a5c2e8db26171e52..f90ae21b6fa9fb648ed144c81abb5445c7e58f65 100644 (file)
--- a/package/mac80211/patches/300-pending_work.patch
+++ b/package/mac80211/patches/300-pending_work.patch
@@ -614,3 +614,81 @@
                return;
        }
  
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -409,7 +409,10 @@ static inline
+                               struct b43_dmadesc_meta *meta)
+ {
+       if (meta->skb) {
+-              dev_kfree_skb_any(meta->skb);
++              if (ring->tx)
++                      ieee80211_free_txskb(ring->dev->wl->hw, meta->skb);
++              else
++                      dev_kfree_skb_any(meta->skb);
+               meta->skb = NULL;
+       }
+ }
+@@ -1454,7 +1457,7 @@ int b43_dma_tx(struct b43_wldev *dev, st
+       if (unlikely(err == -ENOKEY)) {
+               /* Drop this packet, as we don't have the encryption key
+                * anymore and must not transmit it unencrypted. */
+-              dev_kfree_skb_any(skb);
++              ieee80211_free_txskb(dev->wl->hw, skb);
+               err = 0;
+               goto out;
+       }
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -3397,7 +3397,7 @@ static void b43_tx_work(struct work_stru
+                               break;
+                       }
+                       if (unlikely(err))
+-                              dev_kfree_skb(skb); /* Drop it */
++                              ieee80211_free_txskb(wl->hw, skb);
+                       err = 0;
+               }
+ 
+@@ -3419,7 +3419,7 @@ static void b43_op_tx(struct ieee80211_h
+ 
+       if (unlikely(skb->len < 2 + 2 + 6)) {
+               /* Too short, this can't be a valid frame. */
+-              dev_kfree_skb_any(skb);
++              ieee80211_free_txskb(hw, skb);
+               return;
+       }
+       B43_WARN_ON(skb_shinfo(skb)->nr_frags);
+@@ -4234,8 +4234,12 @@ redo:
+ 
+       /* Drain all TX queues. */
+       for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
+-              while (skb_queue_len(&wl->tx_queue[queue_num]))
+-                      dev_kfree_skb(skb_dequeue(&wl->tx_queue[queue_num]));
++              while (skb_queue_len(&wl->tx_queue[queue_num])) {
++                      struct sk_buff *skb;
++
++                      skb = skb_dequeue(&wl->tx_queue[queue_num]);
++                      ieee80211_free_txskb(wl->hw, skb);
++              }
+       }
+ 
+       b43_mac_suspend(dev);
+--- a/drivers/net/wireless/b43/pio.c
++++ b/drivers/net/wireless/b43/pio.c
+@@ -196,7 +196,7 @@ static void b43_pio_cancel_tx_packets(st
+       for (i = 0; i < ARRAY_SIZE(q->packets); i++) {
+               pack = &(q->packets[i]);
+               if (pack->skb) {
+-                      dev_kfree_skb_any(pack->skb);
++                      ieee80211_free_txskb(q->dev->wl->hw, pack->skb);
+                       pack->skb = NULL;
+               }
+       }
+@@ -552,7 +552,7 @@ int b43_pio_tx(struct b43_wldev *dev, st
+       if (unlikely(err == -ENOKEY)) {
+               /* Drop this packet, as we don't have the encryption key
+                * anymore and must not transmit it unencrypted. */
+-              dev_kfree_skb_any(skb);
++              ieee80211_free_txskb(dev->wl->hw, skb);
+               err = 0;
+               goto out;
+       }

diff --git a/package/mac80211/patches/820-b43-add-antenna-control.patch b/package/mac80211/patches/820-b43-add-antenna-control.patch
index b1e820fb27faf625ce76e87a4eac9ee75c798d60..a2a3873fc5a355de7dc3eb620dc7f4a1e62576df 100644 (file)
--- a/package/mac80211/patches/820-b43-add-antenna-control.patch
+++ b/package/mac80211/patches/820-b43-add-antenna-control.patch
@@ -42,7 +42,7 @@
  
        if (wl->radio_enabled != phy->radio_on) {
                if (wl->radio_enabled) {
-@@ -4998,6 +4995,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5002,6 +4999,47 @@ static int b43_op_get_survey(struct ieee
        return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
        .tx                     = b43_op_tx,
        .conf_tx                = b43_op_conf_tx,
-@@ -5019,6 +5057,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5023,6 +5061,8 @@ static const struct ieee80211_ops b43_hw
        .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
        .get_survey             = b43_op_get_survey,
        .rfkill_poll            = b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5265,6 +5305,8 @@ static int b43_one_core_attach(struct b4
+@@ -5269,6 +5309,8 @@ static int b43_one_core_attach(struct b4
        if (!wldev)
                goto out;
  
@@ -108,7 +108,7 @@
        wldev->use_pio = b43_modparam_pio;
        wldev->dev = dev;
        wldev->wl = wl;
-@@ -5355,6 +5397,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5359,6 +5401,9 @@ static struct b43_wl *b43_wireless_init(
  
        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;