This is a backport of 'commit 4444bc2116ae ("wifi: mac80211: Proper mark iTXQs for resumption")' from linux 6.2.
If a hw queue is stopped ieee80211_tx_dequeue() should abort any potential running iTXQ run and mark the queue for resumption later.
This also drops the redundant @txqs_stopped and @IEEE80211_TXQ_STOP_NETIF_TX is renamed to @IEEE80211_TXQ_DIRTY to better describe the flag.
Additionally this fixes an use-after-free caused by ieee80211_tx_dequeue() potentially returning a pointer to a deleted skb.
The original 'commit 4444bc2116ae ("wifi: mac80211: Proper mark iTXQs for resumption")' in 6.2 only fixed the issue only in combination with 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ AMPDU fragmentation handling")'
Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/065cf0e5-2c64-56c6-ee66-a6b61be2dddf@roeck-us.net Link: https://lore.kernel.org/r/20221230121850.218810-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel alexander@wetzel-home.de ---
The automatic backport for this and the next patch failed as expected: https://lore.kernel.org/r/16742967949726@kroah.com https://lore.kernel.org/r/167429677624186@kroah.com
Since these patches stack only I've put them into a mini series. They fix different things but the logic overlaps.
In kernels < 6.2 we still support the old push path and since backporting 'commit 107395f9cf44 ("wifi: mac80211: Drop support for TX push path")' to stable kernels is a clear no go some changes had to be done to these patches.
Therefore here are quick manual ports, taking the old push path into account. I developed and verified basic functionality with both patches applied to the v6.1 tree from https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
This versions should also work for kernels < 6.1 with no or minimal changes.
A quick hostap hwsim test shows no regressions. (Single run, compared to reference runs I use with wireless-testing kernel)
But it also happened to trigger the KASAN I repored here again: https://lore.kernel.org/r/20230112173808.6205-1-alexander@wetzel-home.de So that's indeed an issue in stable... I'll try to give that another shot with your feedback, soon.
Alexander
--- include/net/mac80211.h | 4 ---- net/mac80211/debugfs_sta.c | 5 +++-- net/mac80211/driver-ops.h | 2 +- net/mac80211/ieee80211_i.h | 2 +- net/mac80211/tx.c | 23 +++++++++++++++-------- net/mac80211/util.c | 20 ++++++-------------- 6 files changed, 26 insertions(+), 30 deletions(-)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h index ac2bad57933f..72b739dc6d53 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -1827,8 +1827,6 @@ struct ieee80211_vif_cfg { * @drv_priv: data area for driver use, will always be aligned to * sizeof(void *). * @txq: the multicast data TX queue (if driver uses the TXQ abstraction) - * @txqs_stopped: per AC flag to indicate that intermediate TXQs are stopped, - * protected by fq->lock. * @offload_flags: 802.3 -> 802.11 enapsulation offload flags, see * &enum ieee80211_offload_flags. * @mbssid_tx_vif: Pointer to the transmitting interface if MBSSID is enabled. @@ -1857,8 +1855,6 @@ struct ieee80211_vif { bool probe_req_reg; bool rx_mcast_action_reg;
- bool txqs_stopped[IEEE80211_NUM_ACS]; - struct ieee80211_vif *mbssid_tx_vif;
/* must be last */ diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c index d3397c1248d3..b057253db28d 100644 --- a/net/mac80211/debugfs_sta.c +++ b/net/mac80211/debugfs_sta.c @@ -167,7 +167,7 @@ static ssize_t sta_aqm_read(struct file *file, char __user *userbuf, continue; txqi = to_txq_info(sta->sta.txq[i]); p += scnprintf(p, bufsz + buf - p, - "%d %d %u %u %u %u %u %u %u %u %u 0x%lx(%s%s%s)\n", + "%d %d %u %u %u %u %u %u %u %u %u 0x%lx(%s%s%s%s)\n", txqi->txq.tid, txqi->txq.ac, txqi->tin.backlog_bytes, @@ -182,7 +182,8 @@ static ssize_t sta_aqm_read(struct file *file, char __user *userbuf, txqi->flags, test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ? "STOP" : "RUN", test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags) ? " AMPDU" : "", - test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags) ? " NO-AMSDU" : ""); + test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags) ? " NO-AMSDU" : "", + test_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) ? " DIRTY" : ""); }
rcu_read_unlock(); diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h index 81e40b0a3b16..e685c12757f4 100644 --- a/net/mac80211/driver-ops.h +++ b/net/mac80211/driver-ops.h @@ -1183,7 +1183,7 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
/* In reconfig don't transmit now, but mark for waking later */ if (local->in_reconfig) { - set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txq->flags); + set_bit(IEEE80211_TXQ_DIRTY, &txq->flags); return; }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index a842f2e1c230..9027c6354251 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -835,7 +835,7 @@ enum txq_info_flags { IEEE80211_TXQ_STOP, IEEE80211_TXQ_AMPDU, IEEE80211_TXQ_NO_AMSDU, - IEEE80211_TXQ_STOP_NETIF_TX, + IEEE80211_TXQ_DIRTY, };
/** diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 874f2a4d831d..3363e322cfd9 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3709,13 +3709,15 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, struct ieee80211_local *local = hw_to_local(hw); struct txq_info *txqi = container_of(txq, struct txq_info, txq); struct ieee80211_hdr *hdr; - struct sk_buff *skb = NULL; struct fq *fq = &local->fq; struct fq_tin *tin = &txqi->tin; struct ieee80211_tx_info *info; struct ieee80211_tx_data tx; + struct sk_buff *skb; ieee80211_tx_result r; struct ieee80211_vif *vif = txq->vif; + int q = vif->hw_queue[txq->ac]; + bool q_stopped;
WARN_ON_ONCE(softirq_count() == 0);
@@ -3723,16 +3725,21 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, return NULL;
begin: - spin_lock_bh(&fq->lock); + skb = NULL; + spin_lock(&local->queue_stop_reason_lock); + q_stopped = local->queue_stop_reasons[q]; + spin_unlock(&local->queue_stop_reason_lock); + + if (unlikely(q_stopped)) { + /* mark for waking later */ + set_bit(IEEE80211_TXQ_DIRTY, &txqi->flags); + return NULL; + }
- if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) || - test_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags)) - goto out; + spin_lock_bh(&fq->lock);
- if (vif->txqs_stopped[txq->ac]) { - set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags); + if (unlikely(test_bit(IEEE80211_TXQ_STOP, &txqi->flags))) goto out; - }
/* Make sure fragments stay together. */ skb = __skb_dequeue(&txqi->frags); diff --git a/net/mac80211/util.c b/net/mac80211/util.c index b512cb37aafb..ed53c51bbc32 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -301,8 +301,6 @@ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac) local_bh_disable(); spin_lock(&fq->lock);
- sdata->vif.txqs_stopped[ac] = false; - if (!test_bit(SDATA_STATE_RUNNING, &sdata->state)) goto out;
@@ -324,7 +322,7 @@ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac) if (ac != txq->ac) continue;
- if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX, + if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY, &txqi->flags)) continue;
@@ -339,7 +337,7 @@ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
txqi = to_txq_info(vif->txq);
- if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags) || + if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) || (ps && atomic_read(&ps->num_sta_ps)) || ac != vif->txq->ac) goto out;
@@ -537,16 +535,10 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue, continue;
for (ac = 0; ac < n_acs; ac++) { - if (sdata->vif.hw_queue[ac] == queue || - sdata->vif.cab_queue == queue) { - if (!local->ops->wake_tx_queue) { - netif_stop_subqueue(sdata->dev, ac); - continue; - } - spin_lock(&local->fq.lock); - sdata->vif.txqs_stopped[ac] = true; - spin_unlock(&local->fq.lock); - } + if (!local->ops->wake_tx_queue && + (sdata->vif.hw_queue[ac] == queue || + sdata->vif.cab_queue == queue)) + netif_stop_subqueue(sdata->dev, ac); } } rcu_read_unlock();
This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ AMPDU fragmentation handling")' from linux 6.2.
mac80211 must not enable aggregation wile transmitting a fragmented MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel alexander@wetzel-home.de --- net/mac80211/agg-tx.c | 2 -- net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++ net/mac80211/tx.c | 13 +++++++------ 3 files changed, 44 insertions(+), 8 deletions(-)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c index 07c892aa8c73..e26a72f3a104 100644 --- a/net/mac80211/agg-tx.c +++ b/net/mac80211/agg-tx.c @@ -511,8 +511,6 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) */ clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
- ieee80211_agg_stop_txq(sta, tid); - /* * Make sure no packets are being processed. This ensures that * we have a valid starting sequence number and that in-flight diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c index 83bc41346ae7..ae42e956eff5 100644 --- a/net/mac80211/ht.c +++ b/net/mac80211/ht.c @@ -391,6 +391,43 @@ void ieee80211_ba_session_work(struct work_struct *work)
tid_tx = sta->ampdu_mlme.tid_start_tx[tid]; if (!blocked && tid_tx) { + struct ieee80211_sub_if_data *sdata = sta->sdata; + struct ieee80211_local *local = sdata->local; + + if (local->ops->wake_tx_queue) { + struct txq_info *txqi = + to_txq_info(sta->sta.txq[tid]); + struct fq *fq = &local->fq; + + spin_lock_bh(&fq->lock); + + /* Allow only frags to be dequeued */ + set_bit(IEEE80211_TXQ_STOP, &txqi->flags); + + if (!skb_queue_empty(&txqi->frags)) { + /* Fragmented Tx is ongoing, wait for it + * to finish. Reschedule worker to retry + * later. + */ + + spin_unlock_bh(&fq->lock); + spin_unlock_bh(&sta->lock); + + /* Give the task working on the txq a + * chance to send out the queued frags + */ + synchronize_net(); + + mutex_unlock(&sta->ampdu_mlme.mtx); + + ieee80211_queue_work(&sdata->local->hw, + work); + return; + } + + spin_unlock_bh(&fq->lock); + } + /* * Assign it over to the normal tid_tx array * where it "goes live". diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 3363e322cfd9..b114886c66de 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1295,7 +1295,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata, if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) { if (!(tx->flags & IEEE80211_TX_UNICAST) || skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold || - info->flags & IEEE80211_TX_CTL_AMPDU) + (info->flags & IEEE80211_TX_CTL_AMPDU && + !local->ops->wake_tx_queue)) info->flags |= IEEE80211_TX_CTL_DONTFRAG; }
@@ -3725,7 +3726,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, return NULL;
begin: - skb = NULL; spin_lock(&local->queue_stop_reason_lock); q_stopped = local->queue_stop_reasons[q]; spin_unlock(&local->queue_stop_reason_lock); @@ -3738,9 +3738,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
spin_lock_bh(&fq->lock);
- if (unlikely(test_bit(IEEE80211_TXQ_STOP, &txqi->flags))) - goto out; - /* Make sure fragments stay together. */ skb = __skb_dequeue(&txqi->frags); if (unlikely(skb)) { @@ -3750,6 +3747,9 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, IEEE80211_SKB_CB(skb)->control.flags &= ~IEEE80211_TX_INTCFL_NEED_TXPROCESSING; } else { + if (unlikely(test_bit(IEEE80211_TXQ_STOP, &txqi->flags))) + goto out; + skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func); }
@@ -3800,7 +3800,8 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, }
if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags)) - info->flags |= IEEE80211_TX_CTL_AMPDU; + info->flags |= (IEEE80211_TX_CTL_AMPDU | + IEEE80211_TX_CTL_DONTFRAG); else info->flags &= ~IEEE80211_TX_CTL_AMPDU;
On Sat, Jan 21, 2023 at 11:33:30PM +0100, Alexander Wetzel wrote:
This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ AMPDU fragmentation handling")' from linux 6.2.
mac80211 must not enable aggregation wile transmitting a fragmented MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel alexander@wetzel-home.de
net/mac80211/agg-tx.c | 2 -- net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++ net/mac80211/tx.c | 13 +++++++------ 3 files changed, 44 insertions(+), 8 deletions(-)
This backport fails to apply to the 6.1.y tree:
Applying patch wifi-mac80211-fix-itxq-ampdu-fragmentation-handling.patch patching file net/mac80211/agg-tx.c patching file net/mac80211/ht.c patching file net/mac80211/tx.c Hunk #2 FAILED at 3726. Hunk #3 FAILED at 3739. Hunk #4 succeeded at 3744 (offset -7 lines). Hunk #5 succeeded at 3797 (offset -7 lines). 2 out of 5 hunks FAILED -- rejects in file net/mac80211/tx.c
Try again?
thanks,
greg k-h
On Fri, Jan 27, 2023 at 08:36:37AM +0100, Greg KH wrote:
On Sat, Jan 21, 2023 at 11:33:30PM +0100, Alexander Wetzel wrote:
This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ AMPDU fragmentation handling")' from linux 6.2.
mac80211 must not enable aggregation wile transmitting a fragmented MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel alexander@wetzel-home.de
net/mac80211/agg-tx.c | 2 -- net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++ net/mac80211/tx.c | 13 +++++++------ 3 files changed, 44 insertions(+), 8 deletions(-)
This backport fails to apply to the 6.1.y tree:
Applying patch wifi-mac80211-fix-itxq-ampdu-fragmentation-handling.patch patching file net/mac80211/agg-tx.c patching file net/mac80211/ht.c patching file net/mac80211/tx.c Hunk #2 FAILED at 3726. Hunk #3 FAILED at 3739. Hunk #4 succeeded at 3744 (offset -7 lines). Hunk #5 succeeded at 3797 (offset -7 lines). 2 out of 5 hunks FAILED -- rejects in file net/mac80211/tx.c
Try again?
Argh, forgot to apply patch 1/2...
{sigh} I need more coffee...
On Sat, Jan 21, 2023 at 11:33:30PM +0100, Alexander Wetzel wrote:
This is a backport of 'commit 592234e941f1 ("wifi: mac80211: Fix iTXQ AMPDU fragmentation handling")' from linux 6.2.
mac80211 must not enable aggregation wile transmitting a fragmented MPDU. Enforce that for mac80211 internal TX queues (iTXQs).
Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230106223141.98696-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel alexander@wetzel-home.de
net/mac80211/agg-tx.c | 2 -- net/mac80211/ht.c | 37 +++++++++++++++++++++++++++++++++++++ net/mac80211/tx.c | 13 +++++++------ 3 files changed, 44 insertions(+), 8 deletions(-)
Both now queued up, thanks.
greg k-h
linux-stable-mirror@lists.linaro.org
-
Alexander Wetzel -
Greg KH