Received-SPF: pass (google.com: domain of linux-wireless+bounces-7480-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Fri, 10 May 2024 18:05:35 +0300
From: Dan Carpenter <dan.carpenter@linaro.org>
To: yedidya.ben.shimol@intel.com
Cc: linux-wireless@vger.kernel.org
Subject: [bug report] wifi: iwlwifi: mvm: Block EMLSR when a p2p/softAP vif
 is active
Message-ID: <c115d43e-9087-407b-832a-9e6925b882ac@moroto.mountain>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hello Yedidya Benshimol,

Commit a1efeb823084 ("wifi: iwlwifi: mvm: Block EMLSR when a
p2p/softAP vif is active") from May 5, 2024 (linux-next), leads to
the following Smatch static checker warning:

	drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:1277 iwl_mvm_stop_roc()
	warn: inconsistent returns '&mvm->mutex'.

drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
    1225 void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
    1226 {
    1227         struct iwl_mvm_vif *mvmvif;
    1228         struct iwl_mvm_time_event_data *te_data;
    1229 
    1230         mutex_lock(&mvm->mutex);
    1231 
    1232         if (fw_has_capa(&mvm->fw->ucode_capa,
    1233                         IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
    1234                 mvmvif = iwl_mvm_vif_from_mac80211(vif);
    1235                 te_data = &mvmvif->time_event_data;
    1236 
    1237                 if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
    1238                         if (te_data->id >= SESSION_PROTECT_CONF_MAX_ID) {
    1239                                 IWL_DEBUG_TE(mvm,
    1240                                              "No remain on channel event\n");
    1241                                 return;

Call mutex_unlock(&mvm->mutex) or iwl_mvm_cleanup_roc() before returning?

    1242                         }
    1243 
    1244                         iwl_mvm_cancel_session_protection(mvm, vif,
    1245                                                           te_data->id,
    1246                                                           te_data->link_id);
    1247                 } else {
    1248                         iwl_mvm_roc_station_remove(mvm, mvmvif);
    1249                 }
    1250                 goto cleanup_roc;
    1251         }
    1252 
    1253         te_data = iwl_mvm_get_roc_te(mvm);
    1254         if (!te_data) {
    1255                 IWL_WARN(mvm, "No remain on channel event\n");
    1256                 return;

Here too.

    1257         }
    1258 
    1259         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
    1260 
    1261         if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE)
    1262                 iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
    1263         else
    1264                 iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
    1265 
    1266 cleanup_roc:
    1267         /*
    1268          * In case we get here before the ROC event started,
    1269          * (so the status bit isn't set) set it here so iwl_mvm_cleanup_roc will
    1270          * cleanup things properly
    1271          */
    1272         set_bit(vif->type == NL80211_IFTYPE_P2P_DEVICE ?
    1273                 IWL_MVM_STATUS_ROC_RUNNING : IWL_MVM_STATUS_ROC_AUX_RUNNING,
    1274                 &mvm->status);
    1275 
    1276         /* Mutex is released inside this function */
--> 1277         iwl_mvm_cleanup_roc(mvm);
    1278 }

regards,
dan carpenter