From: Greg Kroah-Hartman Date: Mon, 14 Oct 2024 09:29:30 +0000 (+0200) Subject: drop wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch X-Git-Tag: v5.10.227~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1c34cf14fe1f66b17972192465b8825ccfe0c58f;p=thirdparty%2Fkernel%2Fstable-queue.git drop wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch Needs a follow-up patch that does not apply , so drop it. --- diff --git a/queue-4.19/series b/queue-4.19/series index 6d000655833..8946a7de471 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -261,4 +261,3 @@ net-ibm-emac-mal-fix-wrong-goto.patch ppp-fix-ppp_async_encode-illegal-access.patch net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch cdc-ncm-avoid-overflow-in-sanity-checking.patch -wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch diff --git a/queue-4.19/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch b/queue-4.19/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch deleted file mode 100644 index 8091a683a6a..00000000000 --- a/queue-4.19/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 69403bad97aa0162e3d7911b27e25abe774093df Mon Sep 17 00:00:00 2001 -From: Alexander Wetzel -Date: Fri, 30 Dec 2022 13:18:50 +0100 -Subject: wifi: mac80211: sdata can be NULL during AMPDU start - -From: Alexander Wetzel - -commit 69403bad97aa0162e3d7911b27e25abe774093df upstream. - -ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a -deauthentication is ongoing. - -Here a trace triggering the race with the hostapd test -multi_ap_fronthaul_on_ap: - -(gdb) list *drv_ampdu_action+0x46 -0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). -391 int ret = -EOPNOTSUPP; -392 -393 might_sleep(); -394 -395 sdata = get_bss_sdata(sdata); -396 if (!check_sdata_in_driver(sdata)) -397 return -EIO; -398 -399 trace_drv_ampdu_action(local, sdata, params); -400 - -wlan0: moving STA 02:00:00:00:03:00 to state 3 -wlan0: associated -wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) -wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 -wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) -wlan0: moving STA 02:00:00:00:03:00 to state 2 -wlan0: moving STA 02:00:00:00:03:00 to state 1 -wlan0: Removed STA 02:00:00:00:03:00 -wlan0: Destroyed STA 02:00:00:00:03:00 -BUG: unable to handle page fault for address: fffffffffffffb48 -PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 -Oops: 0000 [#1] PREEMPT SMP PTI -CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 -Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 -Workqueue: phy3 ieee80211_ba_session_work [mac80211] -RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] -Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 -RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 -RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 -RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 -RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 -R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 -R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 -FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 -Call Trace: - - ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] - ieee80211_ba_session_work+0xff/0x2e0 [mac80211] - process_one_work+0x29f/0x620 - worker_thread+0x4d/0x3d0 - ? process_one_work+0x620/0x620 - kthread+0xfb/0x120 - ? kthread_complete_and_exit+0x20/0x20 - ret_from_fork+0x22/0x30 - - -Signed-off-by: Alexander Wetzel -Link: https://lore.kernel.org/r/20221230121850.218810-2-alexander@wetzel-home.de -Cc: stable@vger.kernel.org -Signed-off-by: Johannes Berg -Signed-off-by: Bruno VERNAY -Signed-off-by: Hugo SIMELIERE -Signed-off-by: Greg Kroah-Hartman ---- - net/mac80211/agg-tx.c | 6 +++++- - net/mac80211/driver-ops.c | 3 +++ - 2 files changed, 8 insertions(+), 1 deletion(-) - ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -455,7 +455,7 @@ void ieee80211_tx_ba_session_handle_star - { - struct tid_ampdu_tx *tid_tx; - struct ieee80211_local *local = sta->local; -- struct ieee80211_sub_if_data *sdata = sta->sdata; -+ struct ieee80211_sub_if_data *sdata; - struct ieee80211_ampdu_params params = { - .sta = &sta->sta, - .action = IEEE80211_AMPDU_TX_START, -@@ -486,9 +486,13 @@ void ieee80211_tx_ba_session_handle_star - */ - synchronize_net(); - -+ sdata = sta->sdata; - params.ssn = sta->tid_seq[tid] >> 4; - ret = drv_ampdu_action(local, sdata, ¶ms); - if (ret) { -+ if (!sdata) -+ return; -+ - ht_dbg(sdata, - "BA request denied - HW unavailable for %pM tid %d\n", - sta->sta.addr, tid); ---- a/net/mac80211/driver-ops.c -+++ b/net/mac80211/driver-ops.c -@@ -313,6 +313,9 @@ int drv_ampdu_action(struct ieee80211_lo - - might_sleep(); - -+ if (!sdata) -+ return -EIO; -+ - sdata = get_bss_sdata(sdata); - if (!check_sdata_in_driver(sdata)) - return -EIO; diff --git a/queue-5.4/series b/queue-5.4/series index 9349a9dcb39..38d77414963 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -348,4 +348,3 @@ locking-lockdep-avoid-potential-access-of-invalid-me.patch lockdep-fix-deadlock-issue-between-lockdep-and-rcu.patch resource-fix-region_intersects-vs-add_memory_driver_managed.patch cdc-ncm-avoid-overflow-in-sanity-checking.patch -wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch diff --git a/queue-5.4/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch b/queue-5.4/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch deleted file mode 100644 index 16dc3107577..00000000000 --- a/queue-5.4/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 69403bad97aa0162e3d7911b27e25abe774093df Mon Sep 17 00:00:00 2001 -From: Alexander Wetzel -Date: Fri, 30 Dec 2022 13:18:50 +0100 -Subject: wifi: mac80211: sdata can be NULL during AMPDU start - -From: Alexander Wetzel - -commit 69403bad97aa0162e3d7911b27e25abe774093df upstream. - -ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a -deauthentication is ongoing. - -Here a trace triggering the race with the hostapd test -multi_ap_fronthaul_on_ap: - -(gdb) list *drv_ampdu_action+0x46 -0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). -391 int ret = -EOPNOTSUPP; -392 -393 might_sleep(); -394 -395 sdata = get_bss_sdata(sdata); -396 if (!check_sdata_in_driver(sdata)) -397 return -EIO; -398 -399 trace_drv_ampdu_action(local, sdata, params); -400 - -wlan0: moving STA 02:00:00:00:03:00 to state 3 -wlan0: associated -wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) -wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 -wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) -wlan0: moving STA 02:00:00:00:03:00 to state 2 -wlan0: moving STA 02:00:00:00:03:00 to state 1 -wlan0: Removed STA 02:00:00:00:03:00 -wlan0: Destroyed STA 02:00:00:00:03:00 -BUG: unable to handle page fault for address: fffffffffffffb48 -PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 -Oops: 0000 [#1] PREEMPT SMP PTI -CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 -Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 -Workqueue: phy3 ieee80211_ba_session_work [mac80211] -RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] -Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 -RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 -RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 -RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 -RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 -R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 -R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 -FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 -Call Trace: - - ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] - ieee80211_ba_session_work+0xff/0x2e0 [mac80211] - process_one_work+0x29f/0x620 - worker_thread+0x4d/0x3d0 - ? process_one_work+0x620/0x620 - kthread+0xfb/0x120 - ? kthread_complete_and_exit+0x20/0x20 - ret_from_fork+0x22/0x30 - - -Signed-off-by: Alexander Wetzel -Link: https://lore.kernel.org/r/20221230121850.218810-2-alexander@wetzel-home.de -Cc: stable@vger.kernel.org -Signed-off-by: Johannes Berg -Signed-off-by: Bruno VERNAY -Signed-off-by: Hugo SIMELIERE -Signed-off-by: Greg Kroah-Hartman ---- - net/mac80211/agg-tx.c | 6 +++++- - net/mac80211/driver-ops.c | 3 +++ - 2 files changed, 8 insertions(+), 1 deletion(-) - ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -489,7 +489,7 @@ void ieee80211_tx_ba_session_handle_star - { - struct tid_ampdu_tx *tid_tx; - struct ieee80211_local *local = sta->local; -- struct ieee80211_sub_if_data *sdata = sta->sdata; -+ struct ieee80211_sub_if_data *sdata; - struct ieee80211_ampdu_params params = { - .sta = &sta->sta, - .action = IEEE80211_AMPDU_TX_START, -@@ -519,10 +519,14 @@ void ieee80211_tx_ba_session_handle_star - */ - synchronize_net(); - -+ sdata = sta->sdata; - params.ssn = sta->tid_seq[tid] >> 4; - ret = drv_ampdu_action(local, sdata, ¶ms); - tid_tx->ssn = params.ssn; - if (ret) { -+ if (!sdata) -+ return; -+ - ht_dbg(sdata, - "BA request denied - HW unavailable for %pM tid %d\n", - sta->sta.addr, tid); ---- a/net/mac80211/driver-ops.c -+++ b/net/mac80211/driver-ops.c -@@ -331,6 +331,9 @@ int drv_ampdu_action(struct ieee80211_lo - - might_sleep(); - -+ if (!sdata) -+ return -EIO; -+ - sdata = get_bss_sdata(sdata); - if (!check_sdata_in_driver(sdata)) - return -EIO;