mirror of
https://github.com/Telecominfraproject/wlan-ap.git
synced 2025-12-16 17:01:37 +00:00
05b5bae4aa
The num_peers counter becomes corrupted during peer deletion due to race conditions between ath11k_peer_delete() and ath11k_peer_unmap_event(). The firmware may or may not send unmap events, and the timing varies, causing the counter to either leak (increment without decrement) or underflow (double decrement). Root causes: 1. ath11k_peer_delete() doesn't decrement num_peers, relying on ath11k_peer_unmap_event() to do it 2. Firmware sometimes doesn't send unmap events, leaving num_peers inflated 3. When unmap events do arrive, timing races with ath11k_peer_delete() can cause missed decrements 4. Cleanup paths may double-decrement if delete_in_progress not checked 5. num_peers modified outside proper locking in some paths This fix: - Moves num_peers decrement into ath11k_peer_delete() after successful peer deletion wait, ensuring exactly one decrement per deletion - Handles both cases: peer removed by unmap event, or peer still in list - Removes num_peers decrement from ath11k_peer_unmap_event() to prevent double-decrement when unmap event arrives - Adds ath11k_dp_peer_cleanup() call before ath11k_peer_delete() in roaming path to ensure datapath structures properly cleaned up - Adds delete_in_progress checks in cleanup paths to prevent double-delete - Ensures all num_peers modifications happen under base_lock - Adds comprehensive debug logging to track num_peers throughout peer lifecycle Signed-off-by: Arif Alam <arif.alam@netexperience.com> Signed-off-by: John Crispin <john@phrozen.org> |
||
|---|---|---|
| .. | ||
| bluetooth | ||
| bluetooth-cc2652 | ||
| bluetooth-csr | ||
| edgecore/eltt2 | ||
| hfcl/hfcl | ||
| hostapd/hostapd | ||
| ipq807x_v5.4 | ||
| mcu | ||
| mediatek | ||
| mediatek-sdk | ||
| morse | ||
| qca-wifi-7 | ||
| tip | ||
| ucentral | ||