From patchwork Sun Dec 20 11:50:00 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Emmanuel Grumbach X-Patchwork-Id: 7891961 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 81B75BEEE5 for ; Sun, 20 Dec 2015 11:50:10 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A750920431 for ; Sun, 20 Dec 2015 11:50:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8C138203E6 for ; Sun, 20 Dec 2015 11:50:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933050AbbLTLuF (ORCPT ); Sun, 20 Dec 2015 06:50:05 -0500 Received: from mga02.intel.com ([134.134.136.20]:41167 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754261AbbLTLuE (ORCPT ); Sun, 20 Dec 2015 06:50:04 -0500 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP; 20 Dec 2015 03:50:03 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.20,454,1444719600"; d="scan'208";a="845173649" Received: from unknown (HELO egrumbacBOX.ger.corp.intel.com) ([10.12.217.191]) by orsmga001.jf.intel.com with ESMTP; 20 Dec 2015 03:50:02 -0800 From: Emmanuel Grumbach To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Emmanuel Grumbach Subject: [PATCH] mac80211: fix PS-Poll handling Date: Sun, 20 Dec 2015 13:50:00 +0200 Message-Id: <1450612200-6726-1-git-send-email-emmanuel.grumbach@intel.com> X-Mailer: git-send-email 2.5.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP My commit below broken PS-Poll handling. In case the driver has no frames buffered, driver_release_tids will be 0, but calling find_highest_prio_tid() with 0 as a parameter is not a good idea: fls(0) - 1 = -1. This bug caused mac80211 to think that frames were buffered in the driver which in turn was confused because mac80211 was asking to release frames that were not reported to exist. On iwlwifi, this led to the WARNING below: WARNING: CPU: 0 PID: 11230 at drivers/net/wireless/intel/iwlwifi/mvm/sta.c:1733 iwl_mvm_sta_modify_sleep_tx_count+0x2af/0x320 [iwlmvm]() ffffffffc0627c60 ffff8800069b7648 ffffffff81888913 0000000000000000 0000000000000000 ffff8800069b7688 ffffffff81089d6a ffff8800069b7678 0000000000000001 ffff88003b35abf0 ffff88000698b128 ffff8800069b76d4 Call Trace: [] dump_stack+0x4c/0x65 [] warn_slowpath_common+0x8a/0xc0 [] warn_slowpath_null+0x1a/0x20 [] iwl_mvm_sta_modify_sleep_tx_count+0x2af/0x320 [iwlmvm] [] iwl_mvm_mac_release_buffered_frames+0x31/0x40 [iwlmvm] [] ieee80211_sta_ps_deliver_response+0x6e6/0xd80 [mac80211] [] ieee80211_sta_ps_deliver_poll_response+0x26/0x30 [mac80211] [] ieee80211_rx_handlers+0xa83/0x2900 [mac80211] [] ieee80211_prepare_and_rx_handle+0x1ed/0xa70 [mac80211] [] ? sta_info_get_bss+0x5/0x4a0 [mac80211] [] ieee80211_rx_napi+0x586/0xcd0 [mac80211] [] iwl_mvm_rx_rx_mpdu+0x59e/0xc60 [iwlmvm] Fixes: 0ead2510f8ce ("mac80211: allow the driver to send EOSP when needed") Signed-off-by: Emmanuel Grumbach --- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index b346544..8ea94d3 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -1563,7 +1563,7 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta, more_data = ieee80211_sta_ps_more_data(sta, ignored_acs, reason, driver_release_tids); - if (reason == IEEE80211_FRAME_RELEASE_PSPOLL) + if (driver_release_tids && reason == IEEE80211_FRAME_RELEASE_PSPOLL) driver_release_tids = BIT(find_highest_prio_tid(driver_release_tids));