diff mbox series

[v2,2/2] wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb

Message ID 20240822014255.10211-2-pkshih@realtek.com
State New
Headers show
Series [v2,1/2] wifi: mac80211: export ieee80211_purge_tx_queue() for drivers | expand

Commit Message

Ping-Ke Shih Aug. 22, 2024, 1:42 a.m. UTC
When removing kernel modules by:
   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core

Driver uses skb_queue_purge() to purge TX skb, but not report tx status
causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue()
to correct this.

Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing
between TX work and purge TX queue, flush and destroy TX work in advance.

   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
     choice (Reason: 3=DEAUTH_LEAVING)
   ------------[ cut here ]------------
   Have pending ack frames!
   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691
       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C
       6.10.1-200.fc40.aarch64 #1
   Hardware name: pine64 Pine64 PinePhone Braveheart
      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024
   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
   sp : ffff80008c1b37b0
   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000
   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0
   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff
   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000
   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000
   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964
   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0
   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001
   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000
   Call trace:
    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
    idr_for_each+0x74/0x110
    ieee80211_free_hw+0x44/0xe8 [mac80211]
    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]
    sdio_bus_remove+0x44/0x180
    device_remove+0x54/0x90
    device_release_driver_internal+0x1d4/0x238
    driver_detach+0x54/0xc0
    bus_remove_driver+0x78/0x108
    driver_unregister+0x38/0x78
    sdio_unregister_driver+0x2c/0x40
    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
    __do_sys_delete_module.isra.0+0x190/0x338
    __arm64_sys_delete_module+0x1c/0x30
    invoke_syscall+0x74/0x100
    el0_svc_common.constprop.0+0x48/0xf0
    do_el0_svc+0x24/0x38
    el0_svc+0x3c/0x158
    el0t_64_sync_handler+0x120/0x138
    el0t_64_sync+0x194/0x198
   ---[ end trace 0000000000000000 ]---

Reported-by: Peter Robinson <pbrobinson@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CALeDE9OAa56KMzgknaCD3quOgYuEHFx9_hcT=OFgmMAb+8MPyA@mail.gmail.com/
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
v2:
  - flush and destroy TX work before doing purge_tx_queue
  - remove "Tested-by: Peter Robinson" since code changed
---
 drivers/net/wireless/realtek/rtw88/sdio.c | 6 +++---
 drivers/net/wireless/realtek/rtw88/usb.c  | 5 +++--
 2 files changed, 6 insertions(+), 5 deletions(-)

Comments

Ping-Ke Shih Sept. 20, 2024, 1:11 p.m. UTC | #1
Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> On 20/09/2024 09:33, Ping-Ke Shih wrote:
> > Ping-Ke Shih <pkshih@realtek.com> wrote:
> >
> >> When removing kernel modules by:
> >>    rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core
> >>
> >> Driver uses skb_queue_purge() to purge TX skb, but not report tx status
> >> causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue()
> >> to correct this.
> >>
> >> Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing
> >> between TX work and purge TX queue, flush and destroy TX work in advance.
> >>
> >>    wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
> >>      choice (Reason: 3=DEAUTH_LEAVING)
> >>    ------------[ cut here ]------------
> >>    Have pending ack frames!
> >>    WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691
> >>        ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
> >>    CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C
> >>        6.10.1-200.fc40.aarch64 #1
> >>    Hardware name: pine64 Pine64 PinePhone Braveheart
> >>       (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024
> >>    pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> >>    pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
> >>    lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
> >>    sp : ffff80008c1b37b0
> >>    x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000
> >>    x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0
> >>    x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff
> >>    x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000
> >>    x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000
> >>    x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964
> >>    x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0
> >>    x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001
> >>    x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
> >>    x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000
> >>    Call trace:
> >>     ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
> >>     idr_for_each+0x74/0x110
> >>     ieee80211_free_hw+0x44/0xe8 [mac80211]
> >>     rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]
> >>     sdio_bus_remove+0x44/0x180
> >>     device_remove+0x54/0x90
> >>     device_release_driver_internal+0x1d4/0x238
> >>     driver_detach+0x54/0xc0
> >>     bus_remove_driver+0x78/0x108
> >>     driver_unregister+0x38/0x78
> >>     sdio_unregister_driver+0x2c/0x40
> >>     rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
> >>     __do_sys_delete_module.isra.0+0x190/0x338
> >>     __arm64_sys_delete_module+0x1c/0x30
> >>     invoke_syscall+0x74/0x100
> >>     el0_svc_common.constprop.0+0x48/0xf0
> >>     do_el0_svc+0x24/0x38
> >>     el0_svc+0x3c/0x158
> >>     el0t_64_sync_handler+0x120/0x138
> >>     el0t_64_sync+0x194/0x198
> >>    ---[ end trace 0000000000000000 ]---
> >>
> >> Reported-by: Peter Robinson <pbrobinson@gmail.com>
> >> Closes: https://lore.kernel.org/linux-wireless/CALeDE9OAa56KMzgknaCD3quOgYuEHFx9_hcT=OFgmMAb+8MPyA@mail.gmail.com/
> >> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
> >> Tested-by: Ping-Ke Shih <pkshih@realtek.com> # 8723DU
> >
> > 1 patch(es) applied to rtw-next branch of rtw.git, thanks.
> >
> > 3e5e4a801aaf wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
> >
> > ---
> > https://github.com/pkshih/rtw.git
> >
> >
> 
> A small problem: patch 1/2 is not applied yet:
> 
> linux/drivers/net/wireless/realtek/rtw88/usb.c:430:17: error: implicit declaration of function ‘ieee80211_purge_tx_queue’; did you mean ‘ieee80211_wake_queue’? [-Wimplicit-function-declaration]
>   430 |                 ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);
>       |                 ^~~~~~~~~~~~~~~~~~~~~~~~
>       |                 ieee80211_wake_queue
> 

Patch 1/2 is merged [1]. Have you update kernel from rtw tree?

[1] 53bc1b73b678 ("wifi: mac80211: export ieee80211_purge_tx_queue() for drivers")
Bitterblue Smith Sept. 20, 2024, 2:44 p.m. UTC | #2
On 20/09/2024 16:11, Ping-Ke Shih wrote:
> Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
>> On 20/09/2024 09:33, Ping-Ke Shih wrote:
>>> Ping-Ke Shih <pkshih@realtek.com> wrote:
>>>
>>>> When removing kernel modules by:
>>>>    rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core
>>>>
>>>> Driver uses skb_queue_purge() to purge TX skb, but not report tx status
>>>> causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue()
>>>> to correct this.
>>>>
>>>> Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing
>>>> between TX work and purge TX queue, flush and destroy TX work in advance.
>>>>
>>>>    wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
>>>>      choice (Reason: 3=DEAUTH_LEAVING)
>>>>    ------------[ cut here ]------------
>>>>    Have pending ack frames!
>>>>    WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691
>>>>        ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
>>>>    CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C
>>>>        6.10.1-200.fc40.aarch64 #1
>>>>    Hardware name: pine64 Pine64 PinePhone Braveheart
>>>>       (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024
>>>>    pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>>>>    pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
>>>>    lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
>>>>    sp : ffff80008c1b37b0
>>>>    x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000
>>>>    x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0
>>>>    x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff
>>>>    x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000
>>>>    x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000
>>>>    x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964
>>>>    x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0
>>>>    x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001
>>>>    x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
>>>>    x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000
>>>>    Call trace:
>>>>     ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
>>>>     idr_for_each+0x74/0x110
>>>>     ieee80211_free_hw+0x44/0xe8 [mac80211]
>>>>     rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]
>>>>     sdio_bus_remove+0x44/0x180
>>>>     device_remove+0x54/0x90
>>>>     device_release_driver_internal+0x1d4/0x238
>>>>     driver_detach+0x54/0xc0
>>>>     bus_remove_driver+0x78/0x108
>>>>     driver_unregister+0x38/0x78
>>>>     sdio_unregister_driver+0x2c/0x40
>>>>     rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
>>>>     __do_sys_delete_module.isra.0+0x190/0x338
>>>>     __arm64_sys_delete_module+0x1c/0x30
>>>>     invoke_syscall+0x74/0x100
>>>>     el0_svc_common.constprop.0+0x48/0xf0
>>>>     do_el0_svc+0x24/0x38
>>>>     el0_svc+0x3c/0x158
>>>>     el0t_64_sync_handler+0x120/0x138
>>>>     el0t_64_sync+0x194/0x198
>>>>    ---[ end trace 0000000000000000 ]---
>>>>
>>>> Reported-by: Peter Robinson <pbrobinson@gmail.com>
>>>> Closes: https://lore.kernel.org/linux-wireless/CALeDE9OAa56KMzgknaCD3quOgYuEHFx9_hcT=OFgmMAb+8MPyA@mail.gmail.com/
>>>> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
>>>> Tested-by: Ping-Ke Shih <pkshih@realtek.com> # 8723DU
>>>
>>> 1 patch(es) applied to rtw-next branch of rtw.git, thanks.
>>>
>>> 3e5e4a801aaf wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
>>>
>>> ---
>>> https://github.com/pkshih/rtw.git
>>>
>>>
>>
>> A small problem: patch 1/2 is not applied yet:
>>
>> linux/drivers/net/wireless/realtek/rtw88/usb.c:430:17: error: implicit declaration of function ‘ieee80211_purge_tx_queue’; did you mean ‘ieee80211_wake_queue’? [-Wimplicit-function-declaration]
>>   430 |                 ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);
>>       |                 ^~~~~~~~~~~~~~~~~~~~~~~~
>>       |                 ieee80211_wake_queue
>>
> 
> Patch 1/2 is merged [1]. Have you update kernel from rtw tree?
> 
> [1] 53bc1b73b678 ("wifi: mac80211: export ieee80211_purge_tx_queue() for drivers")
> 
> 

Oh, right. This is what happens when I try to compile just rtw88.
I didn't see an email from Johannes or Kalle saying the patch was
applied, so I assumed it wasn't. Sorry about that.
diff mbox series

Patch

diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
index 21d0754dd7f6..b67e551fcee3 100644
--- a/drivers/net/wireless/realtek/rtw88/sdio.c
+++ b/drivers/net/wireless/realtek/rtw88/sdio.c
@@ -1297,12 +1297,12 @@  static void rtw_sdio_deinit_tx(struct rtw_dev *rtwdev)
 	struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;
 	int i;
 
-	for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
-		skb_queue_purge(&rtwsdio->tx_queue[i]);
-
 	flush_workqueue(rtwsdio->txwq);
 	destroy_workqueue(rtwsdio->txwq);
 	kfree(rtwsdio->tx_handler_data);
+
+	for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
+		ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]);
 }
 
 int rtw_sdio_probe(struct sdio_func *sdio_func,
diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index e83ab6fb83f5..dbc7d8d73494 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -423,10 +423,11 @@  static void rtw_usb_tx_handler(struct work_struct *work)
 
 static void rtw_usb_tx_queue_purge(struct rtw_usb *rtwusb)
 {
+	struct rtw_dev *rtwdev = rtwusb->rtwdev;
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++)
-		skb_queue_purge(&rtwusb->tx_queue[i]);
+		ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);
 }
 
 static void rtw_usb_write_port_complete(struct urb *urb)
@@ -889,9 +890,9 @@  static void rtw_usb_deinit_tx(struct rtw_dev *rtwdev)
 {
 	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
 
-	rtw_usb_tx_queue_purge(rtwusb);
 	flush_workqueue(rtwusb->txwq);
 	destroy_workqueue(rtwusb->txwq);
+	rtw_usb_tx_queue_purge(rtwusb);
 }
 
 static int rtw_usb_intf_init(struct rtw_dev *rtwdev,