mac80211: fix crash with single-queue drivers

commit a6f38ac3cc853189705006cc1e0f17ce8467a1df upstream.

Larry (and some others I think) reported that with
single-queue drivers mac80211 crashes when waking
the queues. This happens because we allocate just
a single queue for each virtual interface in case
the driver doesn't have at least 4 queues, but the
code stopping/waking the virtual interface queues
wasn't taking this into account.

Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8dd4712620ff53832a212a3d69791e13cd59905f..f564b5efab0d4ae70223b0e5ad834536f499658c 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -268,6 +268,10 @@ EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
 {
        struct ieee80211_sub_if_data *sdata;
+       int n_acs = IEEE80211_NUM_ACS;
+
+       if (local->hw.queues < IEEE80211_NUM_ACS)
+               n_acs = 1;
 
        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                int ac;
@@ -279,7 +283,7 @@ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
                    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
                        continue;
 
-               for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+               for (ac = 0; ac < n_acs; ac++) {
                        int ac_queue = sdata->vif.hw_queue[ac];
 
                        if (ac_queue == queue ||
@@ -341,6 +345,7 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 {
        struct ieee80211_local *local = hw_to_local(hw);
        struct ieee80211_sub_if_data *sdata;
+       int n_acs = IEEE80211_NUM_ACS;
 
        trace_stop_queue(local, queue, reason);
 
@@ -352,11 +357,14 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 
        __set_bit(reason, &local->queue_stop_reasons[queue]);
 
+       if (local->hw.queues < IEEE80211_NUM_ACS)
+               n_acs = 1;
+
        rcu_read_lock();
        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                int ac;
 
-               for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+               for (ac = 0; ac < n_acs; ac++) {
                        if (sdata->vif.hw_queue[ac] == queue ||
                            sdata->vif.cab_queue == queue)
                                netif_stop_subqueue(sdata->dev, ac);