Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
To:     "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
From:   Ben Greear <greearb@candelatech.com>
Subject: ax200, fw crashes, and sdata-in-driver
Organization: Candela Technologies
Message-ID: <bb23b798-f347-7559-b3dc-d8f713899d26@candelatech.com>
Date:   Mon, 13 Jul 2020 16:57:27 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.9.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-MW
Content-Transfer-Encoding: 7bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Hello,

I larded up my 5.4 kernel with KASAN and lockdep, and ran some tests.  This is with my
patch that keeps from busy-spinning forever (see previous ignored patch).

After a few restarts and FW crashes, the ax200 could not recover firmware.  There
were lots of sdata-in-driver errors, and then KASAN hit a use-after-free issue
related to ax200 accessing sta object that was previously deleted.

Now, I think I know why:

In the ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
method, it will clear the SDATA_IN_DRIVER flag, and according to comments,
this is run when firmware cannot be recovered.  But, just because FW is
dead does not mean that the driver itself has cleaned up its state.

So question is, should ax200 (and all drivers) be responsible for cleaning
up all state when FW cannot be recovered, or should instead mac80211 do cleanup
in this case by, among other things, not clearing that flag (and probably
not doing the ctx->driver_present = false; config as well)?

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com