2011-12-02 04:29:05

by Nikolay Martynov

[permalink] [raw]
Subject: iwlwifi: kernel panic if try to open tid with large index (>=8)

Hi.

I have an intel 5300 card running on latest compat-wireless.
If I do:
echo "tx start 8" >
/sys/kernel/debug/ieee80211/phy0/netdev\:wlan1/stations/XX\:XX\:XX\:XX\:XX\:XX/agg_status
I get two pages of kernel stack trace and complete freeze, no
messages left in any logs after reboot.
I looks like driver doesn't correctly check that this tid is
actually supported when it comes from mac80211 layer.
This doesn't seem like a huge issue, just an annoying one.

Please let me knoe if I can provide any more information.
Thanks.

--
Truthfully yours,
Martynov Nikolay.
Email: [email protected]


2011-12-02 20:19:33

by Johannes Berg

[permalink] [raw]
Subject: Re: iwlwifi: kernel panic if try to open tid with large index (>=8)

On Fri, 2011-12-02 at 07:01 -0800, wwguy wrote:
> On Fri, 2011-12-02 at 01:11 -0800, Johannes Berg wrote:
> > On Thu, 2011-12-01 at 23:29 -0500, Nikolay Martynov wrote:
> > > Hi.
> > >
> > > I have an intel 5300 card running on latest compat-wireless.
> > > If I do:
> > > echo "tx start 8" >
> > > /sys/kernel/debug/ieee80211/phy0/netdev\:wlan1/stations/XX\:XX\:XX\:XX\:XX\:XX/agg_status
> >
> > Yikes. I think mac80211 should just reject that since it will never put
> > traffic into that TID anyway.
> >
> Johannes, are you going to help fix that :-)

I *think* this is the right fix. Do you agree? It fixes it for sure --
but does it really not have any side effects? I'm pretty sure it doesn't
since I looked at all the code just now ...

johannes

---
drivers/net/wireless/iwlwifi/iwl-commands.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/iwlwifi/iwl-commands.h 2011-12-02 21:12:01.000000000 +0100
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h 2011-12-02 21:12:02.000000000 +0100
@@ -814,7 +814,7 @@ struct iwl_qosparam_cmd {
#define IWLAGN_STATION_COUNT 16

#define IWL_INVALID_STATION 255
-#define IWL_MAX_TID_COUNT 9
+#define IWL_MAX_TID_COUNT 8

#define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2)
#define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8)



2011-12-02 15:07:42

by Wey-Yi Guy

[permalink] [raw]
Subject: Re: iwlwifi: kernel panic if try to open tid with large index (>=8)

On Fri, 2011-12-02 at 01:11 -0800, Johannes Berg wrote:
> On Thu, 2011-12-01 at 23:29 -0500, Nikolay Martynov wrote:
> > Hi.
> >
> > I have an intel 5300 card running on latest compat-wireless.
> > If I do:
> > echo "tx start 8" >
> > /sys/kernel/debug/ieee80211/phy0/netdev\:wlan1/stations/XX\:XX\:XX\:XX\:XX\:XX/agg_status
>
> Yikes. I think mac80211 should just reject that since it will never put
> traffic into that TID anyway.
>
Johannes, are you going to help fix that :-)

Wey


2011-12-02 09:11:43

by Johannes Berg

[permalink] [raw]
Subject: Re: iwlwifi: kernel panic if try to open tid with large index (>=8)

On Thu, 2011-12-01 at 23:29 -0500, Nikolay Martynov wrote:
> Hi.
>
> I have an intel 5300 card running on latest compat-wireless.
> If I do:
> echo "tx start 8" >
> /sys/kernel/debug/ieee80211/phy0/netdev\:wlan1/stations/XX\:XX\:XX\:XX\:XX\:XX/agg_status

Yikes. I think mac80211 should just reject that since it will never put
traffic into that TID anyway.

johannes


2011-12-02 20:21:25

by Wey-Yi Guy

[permalink] [raw]
Subject: Re: iwlwifi: kernel panic if try to open tid with large index (>=8)

On Fri, 2011-12-02 at 12:19 -0800, Johannes Berg wrote:
> On Fri, 2011-12-02 at 07:01 -0800, wwguy wrote:
> > On Fri, 2011-12-02 at 01:11 -0800, Johannes Berg wrote:
> > > On Thu, 2011-12-01 at 23:29 -0500, Nikolay Martynov wrote:
> > > > Hi.
> > > >
> > > > I have an intel 5300 card running on latest compat-wireless.
> > > > If I do:
> > > > echo "tx start 8" >
> > > > /sys/kernel/debug/ieee80211/phy0/netdev\:wlan1/stations/XX\:XX\:XX\:XX\:XX\:XX/agg_status
> > >
> > > Yikes. I think mac80211 should just reject that since it will never put
> > > traffic into that TID anyway.
> > >
> > Johannes, are you going to help fix that :-)
>
> I *think* this is the right fix. Do you agree? It fixes it for sure --
> but does it really not have any side effects? I'm pretty sure it doesn't
> since I looked at all the code just now ...
>
initial look at it, I agree

Wey


2011-12-02 04:40:03

by Wey-Yi Guy

[permalink] [raw]
Subject: Re: iwlwifi: kernel panic if try to open tid with large index (>=8)

hmm, this is a good catch, I don't believe anyone here ever test with
this. Thank you so much for letting us know.

Wey



On Thu, 2011-12-01 at 20:29 -0800, Nikolay Martynov wrote:
> Hi.
>
> I have an intel 5300 card running on latest compat-wireless.
> If I do:
> echo "tx start 8" >
> /sys/kernel/debug/ieee80211/phy0/netdev\:wlan1/stations/XX\:XX\:XX\:XX\:XX\:XX/agg_status
> I get two pages of kernel stack trace and complete freeze, no
> messages left in any logs after reboot.
> I looks like driver doesn't correctly check that this tid is
> actually supported when it comes from mac80211 layer.
> This doesn't seem like a huge issue, just an annoying one.
>
> Please let me knoe if I can provide any more information.
> Thanks.
>