package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-fix-monitor-mode-bringup-crash.patch

   1 From 950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7 Mon Sep 17 00:00:00 2001
   2 From: Nagarajan Maran <quic_nmaran@quicinc.com>
   3 Date: Tue, 29 Nov 2022 19:55:32 +0530
   4 Subject: [PATCH] wifi: ath11k: fix monitor mode bringup crash
   5
   6 When the interface is brought up in monitor mode, it leads
   7 to NULL pointer dereference crash. This crash happens when
   8 the packet type is extracted for a SKB. This extraction
   9 which is present in the received msdu delivery path,is
  10 not needed for the monitor ring packets since they are
  11 all RAW packets. Hence appending the flags with
  12 "RX_FLAG_ONLY_MONITOR" to skip that extraction.
  13
  14 Observed calltrace:
  15
  16 Unable to handle kernel NULL pointer dereference at virtual address
  17 0000000000000064
  18 Mem abort info:
  19   ESR = 0x0000000096000004
  20   EC = 0x25: DABT (current EL), IL = 32 bits
  21   SET = 0, FnV = 0
  22   EA = 0, S1PTW = 0
  23   FSC = 0x04: level 0 translation fault
  24 Data abort info:
  25   ISV = 0, ISS = 0x00000004
  26   CM = 0, WnR = 0
  27 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048517000
  28 [0000000000000064] pgd=0000000000000000, p4d=0000000000000000
  29 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
  30 Modules linked in: ath11k_pci ath11k qmi_helpers
  31 CPU: 2 PID: 1781 Comm: napi/-271 Not tainted
  32 6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6
  33 Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT)
  34 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  35 pc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]
  36 lr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k]
  37 sp : ffff80000ef5bb10
  38 x29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0
  39 x26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000
  40 x23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600
  41 x20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006
  42 x17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143
  43 x14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8
  44 x11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff
  45 x8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8
  46 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
  47 x2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052
  48 Call trace:
  49  ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]
  50  ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]
  51  ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k]
  52  ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]
  53  ath11k_dp_service_srng+0x234/0x338 [ath11k]
  54  ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]
  55  __napi_poll+0x5c/0x190
  56  napi_threaded_poll+0xf0/0x118
  57  kthread+0xf4/0x110
  58  ret_from_fork+0x10/0x20
  59
  60 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
  61 Reported-by: Florian Schmidt <florian@fls.name>
  62 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216573
  63 Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  64 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
  65 Link: https://lore.kernel.org/r/20221129142532.23421-1-quic_nmaran@quicinc.com
  66 ---
  67  drivers/net/wireless/ath/ath11k/dp_rx.c | 1 +
  68  1 file changed, 1 insertion(+)
  69
  70 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
  71 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
  72 @@ -5022,6 +5022,7 @@ static int ath11k_dp_rx_mon_deliver(stru
  73                 } else {
  74                         rxs->flag |= RX_FLAG_ALLOW_SAME_PN;
  75                 }
  76 +               rxs->flag |= RX_FLAG_ONLY_MONITOR;
  77                 ath11k_update_radiotap(ar, ppduinfo, mon_skb, rxs);
  78
  79                 ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb, rxs);