package/kernel/mac80211/patches/380-0004-ath10k-Fix-kernel-panic-while-using-worker-ath10k_st.patch

   1 From 8b2d93dd22615cb7f3046a5a2083a6f8bb8052ed Mon Sep 17 00:00:00 2001
   2 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
   3 Date: Mon, 12 Mar 2018 17:09:40 +0530
   4 Subject: [PATCH] ath10k: Fix kernel panic while using worker
   5  (ath10k_sta_rc_update_wk)
   6
   7 When attempt to run worker (ath10k_sta_rc_update_wk) after the station object
   8 (ieee80211_sta) delete will trigger the kernel panic.
   9
  10 This problem arise in AP + Mesh configuration, Where the current node AP VAP
  11 and neighbor node mesh VAP MAC address are same. When the current mesh node
  12 try to establish the mesh link with neighbor node, driver peer creation for
  13 the neighbor mesh node fails due to duplication MAC address. Already the AP
  14 VAP created with same MAC address.
  15
  16 It is caused by the following scenario steps.
  17
  18 Steps:
  19 1. In above condition, ath10k driver sta_state callback (ath10k_sta_state)
  20    fails to do the state change for a station from IEEE80211_STA_NOTEXIST
  21    to IEEE80211_STA_NONE due to peer creation fails. Sta_state callback is
  22    called from ieee80211_add_station() to handle the new station
  23    (neighbor mesh node) request from the wpa_supplicant.
  24 2. Concurrently ath10k receive the sta_rc_update callback notification from
  25    the mesh_neighbour_update() to handle the beacon frames of the above
  26    neighbor mesh node. since its atomic callback, ath10k driver queue the
  27    work (ath10k_sta_rc_update_wk) to handle rc update.
  28 3. Due to driver sta_state callback fails (step 1), mac80211 free the station
  29    object.
  30 4. When the worker (ath10k_sta_rc_update_wk) scheduled to run, it will access
  31    the station object which is already deleted. so it will trigger kernel
  32    panic.
  33
  34 Added the peer exist check in sta_rc_update callback before queue the work.
  35
  36 Kernel Panic log:
  37
  38 Unable to handle kernel NULL pointer dereference at virtual address 00000000
  39 pgd = c0204000
  40 [00000000] *pgd=00000000
  41 Internal error: Oops: 17 [#1] PREEMPT SMP ARM
  42 CPU: 1 PID: 1833 Comm: kworker/u4:2 Not tainted 3.14.77 #1
  43 task: dcef0000 ti: d72b6000 task.ti: d72b6000
  44 PC is at pwq_activate_delayed_work+0x10/0x40
  45 LR is at pwq_activate_delayed_work+0xc/0x40
  46 pc : [<c023f988>]    lr : [<c023f984>]    psr: 40000193
  47 sp : d72b7f18  ip : 0000007a  fp : d72b6000
  48 r10: 00000000  r9 : dd404414  r8 : d8c31998
  49 r7 : d72b6038  r6 : 00000004  r5 : d4907ec8  r4 : dcee1300
  50 r3 : ffffffe0  r2 : 00000000  r1 : 00000001  r0 : 00000000
  51 Flags: nZcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
  52 Control: 10c5787d  Table: 595bc06a  DAC: 00000015
  53 ...
  54 Process kworker/u4:2 (pid: 1833, stack limit = 0xd72b6238)
  55 Stack: (0xd72b7f18 to 0xd72b8000)
  56 7f00:                                                       00000001 dcee1300
  57 7f20: 00000001 c02410dc d8c31980 dd404400 dd404400 c0242790 d8c31980 00000089
  58 7f40: 00000000 d93e1340 00000000 d8c31980 c0242568 00000000 00000000 00000000
  59 7f60: 00000000 c02474dc 00000000 00000000 000000f8 d8c31980 00000000 00000000
  60 7f80: d72b7f80 d72b7f80 00000000 00000000 d72b7f90 d72b7f90 d72b7fac d93e1340
  61 7fa0: c0247404 00000000 00000000 c0208d20 00000000 00000000 00000000 00000000
  62 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  63 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
  64 [<c023f988>] (pwq_activate_delayed_work) from [<c02410dc>] (pwq_dec_nr_in_flight+0x58/0xc4)
  65 [<c02410dc>] (pwq_dec_nr_in_flight) from [<c0242790>] (worker_thread+0x228/0x360)
  66 [<c0242790>] (worker_thread) from [<c02474dc>] (kthread+0xd8/0xec)
  67 [<c02474dc>] (kthread) from [<c0208d20>] (ret_from_fork+0x14/0x34)
  68 Code: e92d4038 e1a05000 ebffffbc[69210.619376] SMP: failed to stop secondary CPUs
  69 Rebooting in 3 seconds..
  70
  71 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
  72 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  73 ---
  74  drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++
  75  1 file changed, 10 insertions(+)
  76
  77 --- a/drivers/net/wireless/ath/ath10k/mac.c
  78 +++ b/drivers/net/wireless/ath/ath10k/mac.c
  79 @@ -7065,10 +7065,20 @@ static void ath10k_sta_rc_update(struct
  80  {
  81         struct ath10k *ar = hw->priv;
  82         struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
  83 +       struct ath10k_vif *arvif = (void *)vif->drv_priv;
  84 +       struct ath10k_peer *peer;
  85         u32 bw, smps;
  86
  87         spin_lock_bh(&ar->data_lock);
  88
  89 +       peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr);
  90 +       if (!peer) {
  91 +               spin_unlock_bh(&ar->data_lock);
  92 +               ath10k_warn(ar, "mac sta rc update failed to find peer %pM on vdev %i\n",
  93 +                           sta->addr, arvif->vdev_id);
  94 +               return;
  95 +       }
  96 +
  97         ath10k_dbg(ar, ATH10K_DBG_MAC,
  98                    "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
  99                    sta->addr, changed, sta->bandwidth, sta->rx_nss,