* [stable v6.1 1/2] wifi: mac80211: Abort iTXQ runs on queue stop
@ 2023-01-21 22:33 Alexander Wetzel
2023-01-21 22:33 ` [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling Alexander Wetzel
0 siblings, 1 reply; 5+ messages in thread
From: Alexander Wetzel @ 2023-01-21 22:33 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Alexander Wetzel, stable
This is a backport of 'commit 4444bc2116ae ("wifi: mac80211: Proper mark
iTXQs for resumption")' from linux 6.2.
If a hw queue is stopped ieee80211_tx_dequeue() should abort any
potential running iTXQ run and mark the queue for resumption later.
This also drops the redundant @txqs_stopped and
@IEEE80211_TXQ_STOP_NETIF_TX is renamed to @IEEE80211_TXQ_DIRTY to
better describe the flag.
Additionally this fixes an use-after-free caused by
ieee80211_tx_dequeue() potentially returning a pointer to a deleted skb.
The original 'commit 4444bc2116ae ("wifi: mac80211: Proper mark
iTXQs for resumption")' in 6.2 only fixed the issue only in combination
with 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ AMPDU fragmentation
handling")'
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/065cf0e5-2c64-56c6-ee66-a6b61be2dddf@roeck-us.net
Link: https://lore.kernel.org/r/20221230121850.218810-1-alexander@wetzel-home.de
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
---
The automatic backport for this and the next patch failed as expected:
https://lore.kernel.org/r/16742967949726@kroah.com
https://lore.kernel.org/r/167429677624186@kroah.com
Since these patches stack only I've put them into a mini series.
They fix different things but the logic overlaps.
In kernels < 6.2 we still support the old push path and since backporting
'commit 107395f9cf44 ("wifi: mac80211: Drop support for TX push path")'
to stable kernels is a clear no go some changes had to be done to these
patches.
Therefore here are quick manual ports, taking the old push path into
account.
I developed and verified basic functionality with both patches applied
to the v6.1 tree from
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
This versions should also work for kernels < 6.1 with no or minimal
changes.
A quick hostap hwsim test shows no regressions. (Single run, compared to
reference runs I use with wireless-testing kernel)
But it also happened to trigger the KASAN I repored here again:
https://lore.kernel.org/r/20230112173808.6205-1-alexander@wetzel-home.de
So that's indeed an issue in stable...
I'll try to give that another shot with your feedback, soon.
Alexander
---
include/net/mac80211.h | 4 ----
net/mac80211/debugfs_sta.c | 5 +++--
net/mac80211/driver-ops.h | 2 +-
net/mac80211/ieee80211_i.h | 2 +-
net/mac80211/tx.c | 23 +++++++++++++++--------
net/mac80211/util.c | 20 ++++++--------------
6 files changed, 26 insertions(+), 30 deletions(-)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ac2bad57933f..72b739dc6d53 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1827,8 +1827,6 @@ struct ieee80211_vif_cfg {
* @drv_priv: data area for driver use, will always be aligned to
* sizeof(void \*).
* @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
- * @txqs_stopped: per AC flag to indicate that intermediate TXQs are stopped,
- * protected by fq->lock.
* @offload_flags: 802.3 -> 802.11 enapsulation offload flags, see
* &enum ieee80211_offload_flags.
* @mbssid_tx_vif: Pointer to the transmitting interface if MBSSID is enabled.
@@ -1857,8 +1855,6 @@ struct ieee80211_vif {
bool probe_req_reg;
bool rx_mcast_action_reg;
- bool txqs_stopped[IEEE80211_NUM_ACS];
-
struct ieee80211_vif *mbssid_tx_vif;
/* must be last */
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index d3397c1248d3..b057253db28d 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -167,7 +167,7 @@ static ssize_t sta_aqm_read(struct file *file, char __user *userbuf,
continue;
txqi = to_txq_info(sta->sta.txq[i]);
p += scnprintf(p, bufsz + buf - p,
- "%d %d %u %u %u %u %u %u %u %u %u 0x%lx(%s%s%s)\n",
+ "%d %d %u %u %u %u %u %u %u %u %u 0x%lx(%s%s%s%s)\n",
txqi->txq.tid,
txqi->txq.ac,
txqi->tin.backlog_bytes,
@@ -182,7 +182,8 @@ static ssize_t sta_aqm_read(struct file *file, char __user *userbuf,
txqi->flags,
test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ? "STOP" : "RUN",
test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags) ? " AMPDU" : "",
- test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags) ? " NO-AMSDU" : "");
+ test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags) ? " NO-AMSDU" : "",
+ test_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) ? " DIRTY" : "");
}
rcu_read_unlock();
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 81e40b0a3b16..e685c12757f4 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1183,7 +1183,7 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
/* In reconfig don't transmit now, but mark for waking later */
if (local->in_reconfig) {
- set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txq->flags);
+ set_bit(IEEE80211_TXQ_DIRTY, &txq->flags);
return;
}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index a842f2e1c230..9027c6354251 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -835,7 +835,7 @@ enum txq_info_flags {
IEEE80211_TXQ_STOP,
IEEE80211_TXQ_AMPDU,
IEEE80211_TXQ_NO_AMSDU,
- IEEE80211_TXQ_STOP_NETIF_TX,
+ IEEE80211_TXQ_DIRTY,
};
/**
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 874f2a4d831d..3363e322cfd9 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3709,13 +3709,15 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
struct ieee80211_local *local = hw_to_local(hw);
struct txq_info *txqi = container_of(txq, struct txq_info, txq);
struct ieee80211_hdr *hdr;
- struct sk_buff *skb = NULL;
struct fq *fq = &local->fq;
struct fq_tin *tin = &txqi->tin;
struct ieee80211_tx_info *info;
struct ieee80211_tx_data tx;
+ struct sk_buff *skb;
ieee80211_tx_result r;
struct ieee80211_vif *vif = txq->vif;
+ int q = vif->hw_queue[txq->ac];
+ bool q_stopped;
WARN_ON_ONCE(softirq_count() == 0);
@@ -3723,16 +3725,21 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
return NULL;
begin:
- spin_lock_bh(&fq->lock);
+ skb = NULL;
+ spin_lock(&local->queue_stop_reason_lock);
+ q_stopped = local->queue_stop_reasons[q];
+ spin_unlock(&local->queue_stop_reason_lock);
+
+ if (unlikely(q_stopped)) {
+ /* mark for waking later */
+ set_bit(IEEE80211_TXQ_DIRTY, &txqi->flags);
+ return NULL;
+ }
- if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ||
- test_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags))
- goto out;
+ spin_lock_bh(&fq->lock);
- if (vif->txqs_stopped[txq->ac]) {
- set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags);
+ if (unlikely(test_bit(IEEE80211_TXQ_STOP, &txqi->flags)))
goto out;
- }
/* Make sure fragments stay together. */
skb = __skb_dequeue(&txqi->frags);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index b512cb37aafb..ed53c51bbc32 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -301,8 +301,6 @@ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
local_bh_disable();
spin_lock(&fq->lock);
- sdata->vif.txqs_stopped[ac] = false;
-
if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
goto out;
@@ -324,7 +322,7 @@ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
if (ac != txq->ac)
continue;
- if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX,
+ if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY,
&txqi->flags))
continue;
@@ -339,7 +337,7 @@ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
txqi = to_txq_info(vif->txq);
- if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags) ||
+ if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) ||
(ps && atomic_read(&ps->num_sta_ps)) || ac != vif->txq->ac)
goto out;
@@ -537,16 +535,10 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
continue;
for (ac = 0; ac < n_acs; ac++) {
- if (sdata->vif.hw_queue[ac] == queue ||
- sdata->vif.cab_queue == queue) {
- if (!local->ops->wake_tx_queue) {
- netif_stop_subqueue(sdata->dev, ac);
- continue;
- }
- spin_lock(&local->fq.lock);
- sdata->vif.txqs_stopped[ac] = true;
- spin_unlock(&local->fq.lock);
- }
+ if (!local->ops->wake_tx_queue &&
+ (sdata->vif.hw_queue[ac] == queue ||
+ sdata->vif.cab_queue == queue))
+ netif_stop_subqueue(sdata->dev, ac);
}
}
rcu_read_unlock();
--
2.39.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling
2023-01-21 22:33 [stable v6.1 1/2] wifi: mac80211: Abort iTXQ runs on queue stop Alexander Wetzel
@ 2023-01-21 22:33 ` Alexander Wetzel
2023-01-27 7:36 ` Greg KH
2023-01-27 7:38 ` Greg KH
0 siblings, 2 replies; 5+ messages in thread
From: Alexander Wetzel @ 2023-01-21 22:33 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Alexander Wetzel, stable
This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ
AMPDU fragmentation handling")' from linux 6.2.
mac80211 must not enable aggregation wile transmitting a fragmented
MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
---
net/mac80211/agg-tx.c | 2 --
net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++
net/mac80211/tx.c | 13 +++++++------
3 files changed, 44 insertions(+), 8 deletions(-)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 07c892aa8c73..e26a72f3a104 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -511,8 +511,6 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
*/
clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
- ieee80211_agg_stop_txq(sta, tid);
-
/*
* Make sure no packets are being processed. This ensures that
* we have a valid starting sequence number and that in-flight
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 83bc41346ae7..ae42e956eff5 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -391,6 +391,43 @@ void ieee80211_ba_session_work(struct work_struct *work)
tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
if (!blocked && tid_tx) {
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+ struct ieee80211_local *local = sdata->local;
+
+ if (local->ops->wake_tx_queue) {
+ struct txq_info *txqi =
+ to_txq_info(sta->sta.txq[tid]);
+ struct fq *fq = &local->fq;
+
+ spin_lock_bh(&fq->lock);
+
+ /* Allow only frags to be dequeued */
+ set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
+
+ if (!skb_queue_empty(&txqi->frags)) {
+ /* Fragmented Tx is ongoing, wait for it
+ * to finish. Reschedule worker to retry
+ * later.
+ */
+
+ spin_unlock_bh(&fq->lock);
+ spin_unlock_bh(&sta->lock);
+
+ /* Give the task working on the txq a
+ * chance to send out the queued frags
+ */
+ synchronize_net();
+
+ mutex_unlock(&sta->ampdu_mlme.mtx);
+
+ ieee80211_queue_work(&sdata->local->hw,
+ work);
+ return;
+ }
+
+ spin_unlock_bh(&fq->lock);
+ }
+
/*
* Assign it over to the normal tid_tx array
* where it "goes live".
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3363e322cfd9..b114886c66de 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1295,7 +1295,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
if (!(tx->flags & IEEE80211_TX_UNICAST) ||
skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
- info->flags & IEEE80211_TX_CTL_AMPDU)
+ (info->flags & IEEE80211_TX_CTL_AMPDU &&
+ !local->ops->wake_tx_queue))
info->flags |= IEEE80211_TX_CTL_DONTFRAG;
}
@@ -3725,7 +3726,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
return NULL;
begin:
- skb = NULL;
spin_lock(&local->queue_stop_reason_lock);
q_stopped = local->queue_stop_reasons[q];
spin_unlock(&local->queue_stop_reason_lock);
@@ -3738,9 +3738,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
spin_lock_bh(&fq->lock);
- if (unlikely(test_bit(IEEE80211_TXQ_STOP, &txqi->flags)))
- goto out;
-
/* Make sure fragments stay together. */
skb = __skb_dequeue(&txqi->frags);
if (unlikely(skb)) {
@@ -3750,6 +3747,9 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
IEEE80211_SKB_CB(skb)->control.flags &=
~IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
} else {
+ if (unlikely(test_bit(IEEE80211_TXQ_STOP, &txqi->flags)))
+ goto out;
+
skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func);
}
@@ -3800,7 +3800,8 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
}
if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
- info->flags |= IEEE80211_TX_CTL_AMPDU;
+ info->flags |= (IEEE80211_TX_CTL_AMPDU |
+ IEEE80211_TX_CTL_DONTFRAG);
else
info->flags &= ~IEEE80211_TX_CTL_AMPDU;
--
2.39.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling
2023-01-21 22:33 ` [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling Alexander Wetzel
@ 2023-01-27 7:36 ` Greg KH
2023-01-27 7:37 ` Greg KH
2023-01-27 7:38 ` Greg KH
1 sibling, 1 reply; 5+ messages in thread
From: Greg KH @ 2023-01-27 7:36 UTC (permalink / raw)
To: Alexander Wetzel; +Cc: linux-wireless, johannes, stable
On Sat, Jan 21, 2023 at 11:33:30PM +0100, Alexander Wetzel wrote:
> This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ
> AMPDU fragmentation handling")' from linux 6.2.
>
> mac80211 must not enable aggregation wile transmitting a fragmented
> MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
>
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de
> Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
> ---
> net/mac80211/agg-tx.c | 2 --
> net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++
> net/mac80211/tx.c | 13 +++++++------
> 3 files changed, 44 insertions(+), 8 deletions(-)
This backport fails to apply to the 6.1.y tree:
Applying patch wifi-mac80211-fix-itxq-ampdu-fragmentation-handling.patch
patching file net/mac80211/agg-tx.c
patching file net/mac80211/ht.c
patching file net/mac80211/tx.c
Hunk #2 FAILED at 3726.
Hunk #3 FAILED at 3739.
Hunk #4 succeeded at 3744 (offset -7 lines).
Hunk #5 succeeded at 3797 (offset -7 lines).
2 out of 5 hunks FAILED -- rejects in file net/mac80211/tx.c
Try again?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling
2023-01-27 7:36 ` Greg KH
@ 2023-01-27 7:37 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2023-01-27 7:37 UTC (permalink / raw)
To: Alexander Wetzel; +Cc: linux-wireless, johannes, stable
On Fri, Jan 27, 2023 at 08:36:37AM +0100, Greg KH wrote:
> On Sat, Jan 21, 2023 at 11:33:30PM +0100, Alexander Wetzel wrote:
> > This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ
> > AMPDU fragmentation handling")' from linux 6.2.
> >
> > mac80211 must not enable aggregation wile transmitting a fragmented
> > MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
> >
> > Cc: stable@vger.kernel.org
> > Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de
> > Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
> > ---
> > net/mac80211/agg-tx.c | 2 --
> > net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++
> > net/mac80211/tx.c | 13 +++++++------
> > 3 files changed, 44 insertions(+), 8 deletions(-)
>
> This backport fails to apply to the 6.1.y tree:
>
> Applying patch wifi-mac80211-fix-itxq-ampdu-fragmentation-handling.patch
> patching file net/mac80211/agg-tx.c
> patching file net/mac80211/ht.c
> patching file net/mac80211/tx.c
> Hunk #2 FAILED at 3726.
> Hunk #3 FAILED at 3739.
> Hunk #4 succeeded at 3744 (offset -7 lines).
> Hunk #5 succeeded at 3797 (offset -7 lines).
> 2 out of 5 hunks FAILED -- rejects in file net/mac80211/tx.c
>
>
> Try again?
Argh, forgot to apply patch 1/2...
{sigh} I need more coffee...
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling
2023-01-21 22:33 ` [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling Alexander Wetzel
2023-01-27 7:36 ` Greg KH
@ 2023-01-27 7:38 ` Greg KH
1 sibling, 0 replies; 5+ messages in thread
From: Greg KH @ 2023-01-27 7:38 UTC (permalink / raw)
To: Alexander Wetzel; +Cc: linux-wireless, johannes, stable
On Sat, Jan 21, 2023 at 11:33:30PM +0100, Alexander Wetzel wrote:
> This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ
> AMPDU fragmentation handling")' from linux 6.2.
>
> mac80211 must not enable aggregation wile transmitting a fragmented
> MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
>
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de
> Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
> ---
> net/mac80211/agg-tx.c | 2 --
> net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++
> net/mac80211/tx.c | 13 +++++++------
> 3 files changed, 44 insertions(+), 8 deletions(-)
>
Both now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-01-27 7:38 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-21 22:33 [stable v6.1 1/2] wifi: mac80211: Abort iTXQ runs on queue stop Alexander Wetzel
2023-01-21 22:33 ` [stable v6.1 2/2] wifi: mac80211: Fix iTXQ AMPDU fragmentation handling Alexander Wetzel
2023-01-27 7:36 ` Greg KH
2023-01-27 7:37 ` Greg KH
2023-01-27 7:38 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).