ath11k_nss: fix self-deadlock in peer sta kickout event - #111
Open
kk1987 wants to merge 1 commit into
Open
Conversation
The rewritten ath11k_peer_sta_kickout_event() in 999-900-bss-transition-handling.patch calls ath11k_dp_peer_cleanup() while holding ab->base_lock. ath11k_dp_peer_cleanup() takes ab->base_lock itself, so hitting the "Spurious quick kickout for STA ... but found in peer table" branch self-deadlocks the CPU with BHs disabled; the box hangs silently until the SoC watchdog resets it (no panic, empty pstore). Observed twice within one day on a Linksys MX4300 (IPQ8074): both times the warning was the last kernel message before a silent hang and a watchdog reset ~30 s later. The trigger window is a firmware PEER_STA_KICKOUT arriving ~1 s after hostapd deauthenticated the same STA, so mac80211 has dropped the station while the driver peer table still holds it. Snapshot vdev_id and drop the lock before calling ath11k_dp_peer_cleanup(), since the peer may go away once the lock is released. Also initialise save_peer, so the branch is not entered on an uninitialised pointer when no radio has the peer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uuv2b5Njo1YG8TkLXAD5LP
kk1987
force-pushed
the
fix-ath11k-kickout-deadlock
branch
from
August 21, 2026 21:22
6ae957d to
e955515
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ath11k_peer_sta_kickout_event(), as rewritten by999-900-bss-transition-handling.patch, callsath11k_dp_peer_cleanup()while still holdingab->base_lock— butath11k_dp_peer_cleanup()starts by takingab->base_lockitself (dp.c). Spinlocks are not recursive, so hitting theSpurious quick kickout for STA %pM but found in peer tablebranch spins that CPU forever with BHs disabled, the other CPUs soon pile up on the same lock, and the box hangs silently until the SoC watchdog resets it — no panic, nothing in pstore.I hit this twice within one day on a Linksys MX4300 (IPQ8074,
25.12-nss@ d6848fa): both times that warning was the very last kernel message, logged ~1 s after hostapd had deauthenticated the same STA — the race window where mac80211 has already dropped the station but the driver peer table still holds the peer, which is exactly the condition this branch handles. The gap between the last log line and the next kernel boot matched the 30 s SoC watchdog timeout both times.The fix snapshots
vdev_idunder the lock, drops the lock, then callsath11k_dp_peer_cleanup()— the snapshot matters becausesave_peermay be freed the moment the lock is released. It also initialisessave_peertoNULL: it is only assigned inside the per-radio loop, so whenever no radio holds the peer the branch was previously tested on an uninitialised pointer.Verified that the full mac80211 patch stack still applies cleanly to backports-6.18.26 with this change, and the equivalent fix compile-tests fine in my MX4300 build.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Uuv2b5Njo1YG8TkLXAD5LP