[PATCH] mac80211: do not aggregate frames if max_frags is set to one

Do not try to aggregate packets in a A-MSDU frame if max_tx_fragments
or max_amsdu_subframes is set to 1. Moreover take into account
tail padding added on the first frame into flow backlog if
ieee80211_amsdu_realloc_pad routine on the second frame fails.
This patch fixes a kernel freeze that occasionally occurs running
iperf tests using mt76 driver

Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
Signed-off-by: Lorenzo Bianconi <redacted>
---
 net/mac80211/tx.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 093108077edc..a5701573c83b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c

@@ -3185,11 +3185,11 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
 	u8 max_subframes = sta->sta.max_amsdu_subframes;
 	int max_frags = local->hw.max_tx_fragments;
 	int max_amsdu_len = sta->sta.max_amsdu_len;
+	int n = 1, nfrags, delta;
 	__be16 len;
 	void *data;
 	bool ret = false;
 	unsigned int orig_len;
-	int n = 1, nfrags;
 
 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
 		return false;

@@ -3222,9 +3222,6 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
 	if (skb->len + head->len > max_amsdu_len)
 		goto out;
 
-	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-		goto out;
-
 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
 	nfrags += 1 + skb_shinfo(head)->nr_frags;
 	frag_tail = &skb_shinfo(head)->frag_list;

@@ -3240,10 +3237,15 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
 	if (max_frags && nfrags > max_frags)
 		goto out;
 
-	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
-					 &subframe_len))
+	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
 		goto out;
 
+	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
+					 &subframe_len)) {
+		delta = head->len - orig_len;
+		goto update_backlog;
+	}
+
 	ret = true;
 	data = skb_push(skb, ETH_ALEN + 2);
 	memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);

@@ -3256,11 +3258,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
 	head->len += skb->len;
 	head->data_len += skb->len;
 	*frag_tail = skb;
+	delta = head->len - orig_len;
 
-	flow->backlog += head->len - orig_len;
-	tin->backlog_bytes += head->len - orig_len;
-
-	fq_recalc_backlog(fq, tin, flow);
+update_backlog:
+	if (delta > 0) {
+		flow->backlog += delta;
+		tin->backlog_bytes += delta;
+		fq_recalc_backlog(fq, tin, flow);
+	}
 
 out:
 	spin_unlock_bh(&fq->lock);

-- 
2.17.1

On Tue, 2018-08-28 at 23:07 +0200, Lorenzo Bianconi wrote:

Do not try to aggregate packets in a A-MSDU frame if max_tx_fragments
or max_amsdu_subframes is set to 1. 

Yeah that seems valid.

Moreover take into account
tail padding added on the first frame into flow backlog if
ieee80211_amsdu_realloc_pad routine on the second frame fails.

That's not really right - the padding shouldn't have been added to the
first subframe in the first place as the last one shouldn't have padding
at all. There's also a separate bug in that the A-MSDU subframe length
should NOT include the padding.

My colleague Sara (CC'ed now) has a patch to fix all of this (we just
did that this morning). I'll send it out tomorrow morning. Can I bother
you to try that?

We'd have to fix the first point independently though, or I guess we can
roll that into our bugfix too, which would you prefer?

johannes

On Tue, 2018-08-28 at 23:07 +0200, Lorenzo Bianconi wrote:

quoted

Do not try to aggregate packets in a A-MSDU frame if max_tx_fragments
or max_amsdu_subframes is set to 1.

Yeah that seems valid.

quoted

Moreover take into account
tail padding added on the first frame into flow backlog if
ieee80211_amsdu_realloc_pad routine on the second frame fails.

That's not really right - the padding shouldn't have been added to the
first subframe in the first place as the last one shouldn't have padding
at all. There's also a separate bug in that the A-MSDU subframe length
should NOT include the padding.

Assuming the A-MSDU subframe is composed by two packets, the last one
must not contain padding, is my understanding correct?

My colleague Sara (CC'ed now) has a patch to fix all of this (we just
did that this morning). I'll send it out tomorrow morning. Can I bother
you to try that?

Sure, no worries :)

We'd have to fix the first point independently though, or I guess we can
roll that into our bugfix too, which would you prefer?

johannes

If the patch is already done I can add the fix for the first point on
top of it, does it sound good?

Regards,
Lorenzo

On Tue, 2018-08-28 at 23:41 +0200, Lorenzo Bianconi wrote:

Assuming the A-MSDU subframe is composed by two packets, the last one
must not contain padding, is my understanding correct?

Yes. More generally, assuming the A-MSDU subframe is composed of *any
number of* packets, the last one must not contain padding :)

quoted

My colleague Sara (CC'ed now) has a patch to fix all of this (we just
did that this morning). I'll send it out tomorrow morning. Can I bother
you to try that?

Sure, no worries :)

Thanks, patch coming up in a second.

quoted

We'd have to fix the first point independently though, or I guess we can
roll that into our bugfix too, which would you prefer?

johannes

If the patch is already done I can add the fix for the first point on
top of it, does it sound good?

Perfect.

johannes

On Tue, 2018-08-28 at 23:41 +0200, Lorenzo Bianconi wrote:

quoted

Assuming the A-MSDU subframe is composed by two packets, the last one
must not contain padding, is my understanding correct?

Yes. More generally, assuming the A-MSDU subframe is composed of *any
number of* packets, the last one must not contain padding :)

quoted

quoted

My colleague Sara (CC'ed now) has a patch to fix all of this (we just
did that this morning). I'll send it out tomorrow morning. Can I bother
you to try that?

Sure, no worries :)

Thanks, patch coming up in a second.

quoted

quoted

We'd have to fix the first point independently though, or I guess we can
roll that into our bugfix too, which would you prefer?

johannes

If the patch is already done I can add the fix for the first point on
top of it, does it sound good?

Perfect.

Ok, I will apply it on top of Sara's patch and send it later today.

Regards,
Lorenzo

johannes