From: Johannes Berg <johannes@sipsolutions.net>
To: Ben Greear <greearb@candelatech.com>,
"linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: Re: ax200, fw crashes, and sdata-in-driver
Date: Thu, 30 Jul 2020 14:30:55 +0200 [thread overview]
Message-ID: <c9525845a8a8b7291988c92b9f427c64e8eef6c4.camel@sipsolutions.net> (raw)
In-Reply-To: <bb23b798-f347-7559-b3dc-d8f713899d26@candelatech.com> (sfid-20200714_015810_768492_BCCFB763)
Hi,
> I larded up my 5.4 kernel with KASAN and lockdep, and ran some tests. This is with my
> patch that keeps from busy-spinning forever (see previous ignored patch).
Right, sorry, hadn't gotten to patches in a while.
> After a few restarts and FW crashes, the ax200 could not recover firmware. There
> were lots of sdata-in-driver errors, and then KASAN hit a use-after-free issue
> related to ax200 accessing sta object that was previously deleted.
>
> Now, I think I know why:
>
> In the ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
> method, it will clear the SDATA_IN_DRIVER flag, and according to comments,
> this is run when firmware cannot be recovered. But, just because FW is
> dead does not mean that the driver itself has cleaned up its state.
>
> So question is, should ax200 (and all drivers) be responsible for cleaning
> up all state when FW cannot be recovered, or should instead mac80211 do cleanup
> in this case by, among other things, not clearing that flag (and probably
> not doing the ctx->driver_present = false; config as well)?
I think it should be the driver. It's not clear _why_ the driver failed,
after all. If the firmware is still alive and just rejected something
then perhaps rolling things back will work. But if the firmware just
died again, that will just cause even more trouble.
johannes
next prev parent reply other threads:[~2020-07-30 12:31 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-13 23:57 ax200, fw crashes, and sdata-in-driver Ben Greear
2020-07-30 12:30 ` Johannes Berg [this message]
2020-07-30 12:58 ` Ben Greear
2020-09-22 20:57 ` Ben Greear
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c9525845a8a8b7291988c92b9f427c64e8eef6c4.camel@sipsolutions.net \
--to=johannes@sipsolutions.net \
--cc=greearb@candelatech.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).