From nobody Thu Oct 17 09:16:42 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XThzb3T9vz5Ym7J; Thu, 17 Oct 2024 09:16:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XThzb1bK3z4HXV; Thu, 17 Oct 2024 09:16:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1729156603; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qvBrvEFg6OcYVPX1w7EsCEshifQUqt+vkO6BQDiAKwo=; b=SUXzSJrhE2jGXXbxadWu9Ns0o1wsm4YMSxoDibjJ44k+I7DOejrCuwVxJldfNR/n5qdlW3 /nxxxbXrubHhjo3ESmNPjWojqRk/md3OfG50gSJwc3H0x89JAq7IsOUkU0Cr55+v55kx7P TnT8wtAEfPeme1TaGeN9tR9nhCL4noKpQq9TZ0V3fEOH6I8IbsK8PAuoGS/dmRe7OGqPXO 0wAiS3W6kHXCKzpSxT7sEvyZ/TmGnNIFj51vQUkpS/0cIEBbyVTIdTGhF9gFabZoATXYtM F1zltiYmJxnVdLW2SVuA0akU6PQUPzLsq586SLH+yu8BGUtOHCrSro2lMf6DoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1729156603; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qvBrvEFg6OcYVPX1w7EsCEshifQUqt+vkO6BQDiAKwo=; b=psg7OJt7ZhbF+Bu33mlZtN7ksE8Vg5xjqqJKyfQv7qr9VgGY0qcuTFl85Tv9Gv4d21HjD9 V//qvAIeBSLY3h9ejNtRpFoqBxduC1UwBiuQzVoOami6ZjIi7Y2/wc3smgkn6gJrVgynJk tEA9Z3d5Ts9Qk0VNT+ve6EV9Yqmq1op+RdaTJw0L5NxhZZfklCpf6z659+M01qf3vC7RdX YQK+ZzNBcw7r0zDFjORjgzO1H1/9cYkwX4lmAorVuTaqu9O86zBbcrB/essq36ZZKJJq4k pGB7Cm5lzutpnvz5qbnX0qIK4H+jWSQ0fQFxDLEynnDj1jJFwIHSGHaUOPTapw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1729156603; a=rsa-sha256; cv=none; b=X0XXH+8IWjB0oOSZzCiMMnqfT0gKMpOAcEHI7yAbW3XVfw4+4RK1BtHhZ4HFnlwSatVijx 8nVRO9Lh0sJtwEnat/uFoQ5iQloMzqKaChH+sclIS+GQao3pYGfSL2JiPAI1UIrUPH8s0n A2rVcfcRaDKxa7SMF2wFRrKH6QsgPFrep4E75jaaN7xbPyuv/wD9EZzhNzfERLN0wyKnAy FdBc6xePFJ9UXRaQTD/XWMYJKjOUNtOqZO6q17pruJAOVifbJPLfrDwDr/3QBB1gep8NLk dq/sand35JW75EgKiJzi1tj4eRhToE/m3pinaXVCPe3Uhiw6ZNUAR68dNbLr5Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XThzZ6xXMzk8r; Thu, 17 Oct 2024 09:16:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 49H9GgTM087502; Thu, 17 Oct 2024 09:16:42 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 49H9GgF1087499; Thu, 17 Oct 2024 09:16:42 GMT (envelope-from git) Date: Thu, 17 Oct 2024 09:16:42 GMT Message-Id: <202410170916.49H9GgF1087499@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: "Bjoern A. Zeeb" Subject: git: 65de0f1855f3 - stable/14 - LinuxKPI: 802.11: fix ieee80211_schedule_txq() to avoid rtw89 panic List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 65de0f1855f3e2e49413dfa03ffbfd6735d3e738 Auto-Submitted: auto-generated The branch stable/14 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=65de0f1855f3e2e49413dfa03ffbfd6735d3e738 commit 65de0f1855f3e2e49413dfa03ffbfd6735d3e738 Author: Austin Shafer AuthorDate: 2024-10-10 15:31:07 +0000 Commit: Bjoern A. Zeeb CommitDate: 2024-10-16 21:46:19 +0000 LinuxKPI: 802.11: fix ieee80211_schedule_txq() to avoid rtw89 panic rtw89 TX path was faulting in linuxkpi_ieee80211_next_txq() due to a "double scheduling" check in linuxkpI_ieee80211_schedule_txq() being incorrect: the next pointer may be NULL there if the element is the last in the tailq, so correctly check tqe_prev. Without the fix we may have queued the same element to the tailq twice, and because it was the last element and had a NULL tqe_next, that NULL value would get propogated into another node's tqe_prev on removal, and other such nastiness. With this rtw89 no longer panics. Reviewed by: bz Differential Revision: https://reviews.freebsd.org/D47006 (cherry picked from commit 41b746e05231b44c87f3a3087a7fe29966af6d0f) --- sys/compat/linuxkpi/common/src/linux_80211.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 56bc9252511a..ff257bf32766 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -6075,8 +6075,12 @@ void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw, if (!withoutpkts && ltxq_empty) goto out; - /* Make sure we do not double-schedule. */ - if (ltxq->txq_entry.tqe_next != NULL) + /* + * Make sure we do not double-schedule. We do this by checking tqe_prev, + * the previous entry in our tailq. tqe_prev is always valid if this entry + * is queued, tqe_next may be NULL if this is the only element in the list. + */ + if (ltxq->txq_entry.tqe_prev != NULL) goto out; lhw = HW_TO_LHW(hw);