Modify

Opened 3 years ago

Last modified 19 months ago

#17506 reopened defect

Key removal related WARN() from mac80211.ko

Reported by: yousong Owned by: developers
Priority: normal Milestone:
Component: kernel Version: Trunk
Keywords: Cc:

Description

On HiWiFi-HC5661 of SoC AR9331 (IIRC, there is a MT7620A-based device also has the problem) with the following wireless config

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'platform/ar933x_wmac'
        option htmode 'HT20'
        option log_level 0

config wifi-iface
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'psk'
        option key 'psk2234214'

config wifi-iface
        option device 'radio0'
        option network 'wan'
        option mode 'sta'
        option ssid 'void'
        option key 'psk2xiodsf0'
        option encryption 'psk2'

, kernel WARN can be triggered by restarting the wireless configuration with wifi or kill -INT $(pgrep hostapd) command.

[  203.770000] ------------[ cut here ]------------
[  203.770000] WARNING: at /home/yousong/wasp-on-bb/build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/compat-wireless-2014-05-22/net/mac80211/driver-ops.h:12 ieee80211_get_key_rx_seq+0x1b8/0x640 [mac80211]()
[  203.790000] wlan0-1:  Failed check-sdata-in-driver check, flags: 0x0
[  203.800000] Modules linked in: ath9k ath9k_common pppoe ppp_async iptable_nat ath9k_hw ath pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv4 mac80211 ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS 
xt_REDIRECT xt_LOG xt_CT slhc nf_nat_irc nf_nat_ftp nf_nat nf_defrag_ipv4 nf_conntrack_irc nf_conntrack_ftp iptable_raw iptable_mangle iptable_filter ipt_REJECT ip_tables crc_ccitt compat ledtrig_usbdev ip6t_REJECT ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables 
nf_conntrack_ipv6 nf_conntrack nf_defrag_ipv6 ipv6 arc4 crypto_blkcipher ohci_hcd ehci_platform ehci_hcd gpio_button_hotplug usbcore nls_base usb_common
[  203.860000] CPU: 0 PID: 954 Comm: hostapd Tainted: G        W    3.10.49 #5
[  203.860000] Stack : 00000000 00000000 00000000 00000000 80362eba 0000003f 8335a758 83332854
[  203.860000]    802c0c64 8030f21b 000003ba 80362664 8335a758 83332854 00000000 00000024
[  203.860000]    00000008 80079040 00000003 80076a4c 831cbae8 83332854 802c2524 8281d9cc
[  203.860000]    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  203.860000]    00000000 00000000 00000000 00000000 00000000 00000000 00000000 8281d958
[  203.860000]    ...
[  203.900000] Call Trace:
[  203.900000] [<8006e294>] show_stack+0x48/0x70
[  203.910000] [<80076bbc>] warn_slowpath_common+0x78/0xa8
[  203.910000] [<80076c18>] warn_slowpath_fmt+0x2c/0x38
[  203.920000] [<831a49ac>] ieee80211_get_key_rx_seq+0x1b8/0x640 [mac80211]
[  203.920000] 
[  203.920000] ---[ end trace 1ed35f4cd8a2a9e5 ]---
[  203.930000] wlan0-1: failed to remove key (1, ff:ff:ff:ff:ff:ff) from hardware (-5)

wlan0-1 is the AP interface in this case, and wlan0 is the STA interface.

I can trace to the point that ieee80211_del_virtual_monitor(), drv_remove_interface() were called to remove wlan0-1 and clearing the IEEE80211_SDATA_IN_DRIVER.

Soon after that __ieee80211_key_destroy() was called, thus failing the check in the call chain of ieee80211_key_disable_hw_accel(), drv_set_key(), check_sdata_in_driver().

That being said, I have not much lead on how to form a patch for this...

Attachments (0)

Change History (7)

comment:1 in reply to: ↑ description Changed 3 years ago by yousong


I can trace to the point that ieee80211_del_virtual_monitor(), drv_remove_interface() were called to remove wlan0-1 and clearing the IEEE80211_SDATA_IN_DRIVER.

It should be ieee80211_do_stop() and drv_remove_interface().

Soon after that __ieee80211_key_destroy() was called, thus failing the check in the call chain of ieee80211_key_disable_hw_accel(), drv_set_key(), check_sdata_in_driver().

comment:2 Changed 3 years ago by yousong

Hmm, I posted a patch [1] for this.

[1] http://patchwork.openwrt.org/patch/6117/

comment:3 Changed 3 years ago by nbd

  • Resolution set to fixed
  • Status changed from new to closed

fixed in r43079

comment:4 Changed 3 years ago by dzubey@…

  • Resolution fixed deleted
  • Status changed from closed to reopened

I've encountered this bug on BB 14.07. Was this backported? Am I missing something?

comment:5 Changed 3 years ago by nbd

  • Resolution set to fixed
  • Status changed from reopened to closed

The fix was backported to the branch, but the release binaries are unmodified. You need to build from SVN (or wait for the next release) to get the fix.

comment:6 Changed 19 months ago by jamezg

The problem is still here in 15.05.
Did the path get included in this release?.

zcn-1523h -
Effects both AP/CPE- both are running WEP40. It seems quite random.

27.440000] br-lan: port 3(wlan0.sta1) entered forwarding state
[ 27.470000] ------------[ cut here ]------------
[ 27.470000] WARNING: CPU: 0 PID: 1024 at /home/buildbot/slave-local/ar71xx_generic/build/build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/compat-wireless-2015-03-09/net/mac80211/driver-ops.h:12 ieee80211_tx_skb_tid_band+0x118/0x1a0 [mac80211]()
[ 27.490000] wlan0.sta1: Failed check-sdata-in-driver check, flags: 0x3
[ 27.500000] Modules linked in: ath9k ath9k_common pppoe ppp_async iptable_nat ath9k_hw ath pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_CT slhc nf_reject_ipv4 nf_nat_masquerade_ipv4 nf_nat_ftp nf_nat nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_ftp nf_conntrack iptable_raw iptable_mangle iptable_filter ip_tables crc_ccitt compat ip6t_REJECT nf_reject_ipv6 nf_log_ipv6 nf_log_common ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables ipv6 arc4 crypto_blkcipher gpio_button_hotplug
[ 27.570000] CPU: 0 PID: 1024 Comm: hostapd Not tainted 3.18.23 #1
[ 27.570000] Stack : 00000000 00000000 00000000 00000000 803d4292 00000035 00000000 80da668c
[ 27.570000] 00000001 00000001 8031f208 80376ba3 00000400 803d34d0 81616430 00000001
[ 27.570000] 00000004 00000000 00000008 800a364c 00000003 8008043c 0000000c 00000001
[ 27.570000] 80322800 81633a7c 00000000 00000000 00000000 00000000 00000000 00000000
[ 27.570000] 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 27.570000] ...
[ 27.610000] Call Trace:
[ 27.610000] [<80071060>] show_stack+0x50/0x84
[ 27.610000] [<80080544>] warn_slowpath_common+0x84/0xb4
[ 27.620000] [<800805a0>] warn_slowpath_fmt+0x2c/0x38
[ 27.630000] [<80da668c>]
ieee80211_tx_skb_tid_band+0x118/0x1a0 [mac80211]
[ 27.630000]
[ 27.630000] ---[ end trace 7f2f79bb4fffbc7e ]---
[ 28.930000] br-lan: port 2(wlan0) entered forwarding state

comment:7 Changed 19 months ago by jamezg@…

  • Resolution fixed deleted
  • Status changed from closed to reopened

Add Comment

Modify Ticket

Action
as reopened .
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.