Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
Message-ID: <b1358d256500d5bb6b3bbc312673c24b54b3674e.camel@sipsolutions.net>
Subject: Re: [PATCH] wifi: cfg80211: fix bss rbn double erase issue
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Jiazi Li <jqqlijiazi@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>
Cc:     Jiazi Li <jiazi.li@transsion.com>, linux-wireless@vger.kernel.org
Date:   Wed, 25 Oct 2023 12:36:24 +0200
In-Reply-To: <20231025103304.22082-1-jiazi.li@transsion.com>
References: <20231025103304.22082-1-jiazi.li@transsion.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Precedence: bulk

Huh.

On Wed, 2023-10-25 at 18:33 +0800, Jiazi Li wrote:
> If cfg80211_update_assoc_bss_entry call rb_insert_bss re-insert bss
> failed because cmp_bss return 0,
>=20

Ok that's bad - so you hit the WARN_ON there? How that? We should fix
that too?

> this bss->rbn will continue to hold
> expired data, such as __rd_parent_color.

Does that matter in any way?

> And this bss still in rdev->bss_list, maybe double erase in
> __cfg80211_bss_expire later.
> Double erase a rbtree node(with expired parent and color data) maybe
> corrupt rbtree, so add a in_rbtree flag to fix this issue.

This seems overly complex - couldn't we just remove it from the list too
or something? It's already a case that "should never happen" so ... not
sure we need to do something "good"?

johannes