wifi: mac80211: Serialize ieee80211_handle_wake_tx_queue

Bug: https://bugs.gentoo.org/902715

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 88 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index e2a4cc67..110a64f7 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch:  2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
 From:   https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
 Desc:   Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
 
+Patch:  2400_WiFi-mac80211-serialize-ieee80211-handle-wake-tx-queue.patch
+From:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
+Desc:   wifi: mac80211: Serialize ieee80211_handle_wake_tx_queue()
+
 Patch:  2900_tmp513-Fix-build-issue-by-selecting-CONFIG_REG.patch
 From:   https://bugs.gentoo.org/710790
 Desc:   tmp513 requies REGMAP_I2C to build.  Select it by default in Kconfig. See bug #710790. Thanks to Phil Stracchino
diff --git a/2400_WiFi-mac80211-serialize-ieee80211-handle-wake-tx-queue.patch b/2400_WiFi-mac80211-serialize-ieee80211-handle-wake-tx-queue.patch
new file mode 100644
index 00000000..ed730a0a
--- /dev/null
+++ b/2400_WiFi-mac80211-serialize-ieee80211-handle-wake-tx-queue.patch
@@ -0,0 +1,84 @@
+From 007ae9b268ba7553e479608cf9735d3c4672a2ab Mon Sep 17 00:00:00 2001
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Tue, 14 Mar 2023 22:11:22 +0100
+Subject: wifi: mac80211: Serialize ieee80211_handle_wake_tx_queue()
+
+ieee80211_handle_wake_tx_queue must not run concurrent multiple times.
+It calls ieee80211_txq_schedule_start() and the drivers migrated to iTXQ
+do not expect overlapping drv_tx() calls.
+
+This fixes 'c850e31f79f0 ("wifi: mac80211: add internal handler for
+wake_tx_queue")', which introduced ieee80211_handle_wake_tx_queue.
+Drivers started to use it with 'a790cc3a4fad ("wifi: mac80211: add
+wake_tx_queue callback to drivers")'.
+But only after fixing an independent bug with
+'4444bc2116ae ("wifi: mac80211: Proper mark iTXQs for resumption")'
+problematic concurrent calls really happened and exposed the initial
+issue.
+
+Fixes: c850e31f79f0 ("wifi: mac80211: add internal handler for wake_tx_queue")
+Reported-by: Thomas Mann <rauchwolke@gmx.net>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217119
+Link: https://lore.kernel.org/r/b8efebc6-4399-d0b8-b2a0-66843314616b@leemhuis.info/
+Link: https://lore.kernel.org/r/b7445607128a6b9ed7c17fcdcf3679bfaf4aaea.camel@sipsolutions.net>
+CC: <stable@vger.kernel.org>
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Link: https://lore.kernel.org/r/20230314211122.111688-1-alexander@wetzel-home.de
+[add missing spin_lock_init() noticed by Felix]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/ieee80211_i.h | 3 +++
+ net/mac80211/main.c        | 2 ++
+ net/mac80211/util.c        | 3 +++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index ecc232eb1ee82..e082582e0aa28 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1284,6 +1284,9 @@ struct ieee80211_local {
+ 	struct list_head active_txqs[IEEE80211_NUM_ACS];
+ 	u16 schedule_round[IEEE80211_NUM_ACS];
+ 
++	/* serializes ieee80211_handle_wake_tx_queue */
++	spinlock_t handle_wake_tx_queue_lock;
++
+ 	u16 airtime_flags;
+ 	u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
+ 	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 846528850612a..ddf2b7811c557 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -802,6 +802,8 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+ 	local->aql_threshold = IEEE80211_AQL_THRESHOLD;
+ 	atomic_set(&local->aql_total_pending_airtime, 0);
+ 
++	spin_lock_init(&local->handle_wake_tx_queue_lock);
++
+ 	INIT_LIST_HEAD(&local->chanctx_list);
+ 	mutex_init(&local->chanctx_mtx);
+ 
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 1a28fe5cb614f..3aceb3b731bf4 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -314,6 +314,8 @@ void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
+ 	struct ieee80211_txq *queue;
+ 
++	spin_lock(&local->handle_wake_tx_queue_lock);
++
+ 	/* Use ieee80211_next_txq() for airtime fairness accounting */
+ 	ieee80211_txq_schedule_start(hw, txq->ac);
+ 	while ((queue = ieee80211_next_txq(hw, txq->ac))) {
+@@ -321,6 +323,7 @@ void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
+ 		ieee80211_return_txq(hw, queue, false);
+ 	}
+ 	ieee80211_txq_schedule_end(hw, txq->ac);
++	spin_unlock(&local->handle_wake_tx_queue_lock);
+ }
+ EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue);
+ 
+-- 
+cgit