From 8b06e06832ebe757246582b65306ad2a2537741f Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 15 Sep 2022 16:38:18 +0200 Subject: mac80211: merge pending fixes for tx queueing issues Fixes a potential deadlock and a tx queue hang on STA assoc Signed-off-by: Felix Fietkau --- ...x-deadlock-Don-t-start-TX-while-holding-f.patch | 40 ++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch (limited to 'package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch') diff --git a/package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch b/package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch new file mode 100644 index 0000000000..8c56acbf88 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch @@ -0,0 +1,40 @@ +From: Alexander Wetzel +Date: Thu, 15 Sep 2022 14:41:20 +0200 +Subject: [PATCH] mac80211: Fix deadlock: Don't start TX while holding + fq->lock + +ieee80211_txq_purge() calls fq_tin_reset() and +ieee80211_purge_tx_queue(); Both are then calling +ieee80211_free_txskb(). Which can decide to TX the skb again. + +There are at least two ways to get a deadlock: + +1) When we have a TDLS teardown packet queued in either tin or frags + ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit() + while we still hold fq->lock. ieee80211_txq_enqueue() will thus + deadlock. + +2) A variant of the above happens if aggregation is up and running: + In that case ieee80211_iface_work() will deadlock with the original + task: The original tasks already holds fq->lock and tries to get + sta->lock after kicking off ieee80211_iface_work(). But the worker + can get sta->lock prior to the original task and will then spin for + fq->lock. + +Avoid these deadlocks by not sending out any skbs when called via +ieee80211_free_txskb(). + +Signed-off-by: Alexander Wetzel +--- + +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -698,7 +698,7 @@ static void ieee80211_report_used_skb(st + + if (!sdata) { + skb->dev = NULL; +- } else { ++ } else if (!dropped) { + unsigned int hdr_size = + ieee80211_hdrlen(hdr->frame_control); + -- cgit v1.2.3