Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <1bb6a89fb1401887f90c65af163cabc4a9d80ce9.camel@gmail.com>
Subject: iwlwifi connection loss leading to unknown state
From:   James Prestwood <prestwoj@gmail.com>
To:     linux-wireless@vger.kernel.org
Date:   Tue, 18 Oct 2022 14:39:33 -0700
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.40.4 (3.40.4-5.fc34) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi,

A user reported IWD being hung after attempting to reassociate. We have
tracked this down to iwlwifi timing out during/before association
("connection_loss") but the path back into mac80211 never results in a
disconnect event. After CMD_CONNECT (reassociate) we get a successful
authenticate event but then nothing (besides DEL_STATION). No connect
event indicating an error which is unexpected for IWD so it just hangs
waiting for _something_ (disconnect, connect event, associate event
etc).

We see the following messages when this happens:

[503620.270833] iwlwifi 0000:00:14.3: Not associated and the session
protection is over already...
[503620.270943] wlan0: Connection to AP d0:15:a6:70:b5:40 lost

This tells us that ieee80211_beacon_connection_loss_work() was called,
and in turn __ieee80211_disconnect(). The problem is we aren't yet
associated, so we bail out with:

__ieee80211_disconnect():
	if (!ifmgd->associated) {
		sdata_unlock(sdata);
		return;
	}

I believe we should be sending a disconnect event here? or a connect
event? or something to tell userspace what happened?

Like something in ieee80211_rx_mgmt_deauth() where ifmgd->assoc_data is
checked for indicating association was started but not completed and
send out a disconnect event right?

Note: I would also guess that ifmgd->assoc_data is being leaked when
this happens since I see no path to free it.

Thanks,
James