Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Sven Eckelmann <sven@narfation.org>
Subject: [PATCH v2 0/2] ath11k: Don't leak ack_status_frame during
 tx_complete* processing
Date:   Wed, 02 Aug 2023 00:46:25 +0200
Message-Id: <20230802-ath11k-ack_status_leak-v2-0-c0af729d6229@narfation.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
To:     Kalle Valo <kvalo@kernel.org>,
        Jeff Johnson <quic_jjohnson@quicinc.com>,
        Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
Cc:     Kalle Valo <quic_kvalo@quicinc.com>, ath11k@lists.infradead.org,
        linux-wireless@vger.kernel.org, Felix Fietkau <nbd@nbd.name>,
        Sven Eckelmann <sven@narfation.org>, stable@vger.kernel.org
Precedence: bulk

It was noticed that APs stopped to accept clients after a while. With QCA's
ath11k fork, it even printed some additional information:

  attach ack fail -28

when new clients tried to connect. hostapd was then usually showing a
message like "deauthenticated due to inactivity (timer DEAUTH/REMOVE)".

While debugging this, it was noticed that this happened when a peer was no
longer known by ath11k but an NL80211_CMD_PROBE_CLIENT triggered TX was
just "finished" for it. In that case, ath11k was just throwing the skb away
and left some information in various data structures in mac80211.

And after Felix pointed out ieee80211_free_txskb(), it is also clear that
dev_kfree_skb_any() in these functions should also be calls to
ieee80211_free_txskb() - but for these, I have nothing to trigger this
error case. Still, a patch is provided as part of this patch series.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
Changes in v2:
- Simply switch to ieee80211_free_txskb() as recommended by Felix Fietkau

  + ieee80211_free_txskb calls ieee80211_report_used_skb
  + ieee80211_report_used_skb calls ieee80211_report_ack_skb (when
    ack_frame_id is set and !IEEE80211_TX_INTFL_MLME_CONN_TX)
  + ieee80211_report_ack_skb will remove skb from ack_status_frames

- Add second patch which handles similar situations in the previously
  patched functions
- Link to v1: https://lore.kernel.org/r/20230801-ath11k-ack_status_leak-v1-1-539cb72c55bc@narfation.org

---
Sven Eckelmann (2):
      ath11k: Don't drop tx_status when peer cannot be found
      ath11k: Cleanup mac80211 references on failure during tx_complete

 drivers/net/wireless/ath/ath11k/dp_tx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
---
base-commit: 1d7dd5aa35474e553b8671b58579e0749b560779
change-id: 20230801-ath11k-ack_status_leak-70a7a30e5d9f

Best regards,
-- 
Sven Eckelmann <sven@narfation.org>