[Bug 297184] LinuxKPI: do not rate-adjust a torn-down vap on tx completion

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297184

            Bug ID: 297184
           Summary: LinuxKPI: do not rate-adjust a torn-down vap on tx
                    completion
           Product: Base System
           Version: CURRENT
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]

Created attachment 273336
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D273336&action=
=3Dedit
guard call to ieee80211_ratectl_rate

linuxkpi_ieee80211_tx_status_ext() guards its rate-control work with "ni !=
=3D
NULL", but then dereferences one level deeper:

        ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);

A tx completion can be delivered from the driver's NAPI/rx-completion thread
after the vap has been destroyed, once net80211 has driven it to INIT and
cleared iv_bss, while frames were still in flight.  The node itself is still
referenced and valid, so the existing check passes and we fault on the NULL=
 bss
node:

    panic: page fault
    ieee80211_ratectl_rate (ni=3D0x0)
    linuxkpi_ieee80211_tx_status_ext
    ath10k_txrx_tx_unref / ath10k_htt_t2h_msg_handler
    ath10k_pci_napi_poll / lkpi_napi_task

Confirmed in the dump: ni and ni->ni_vap valid, iv_bss NULL, and iv_state
already IEEE80211_S_INIT.

--=20
You are receiving this mail because:
You are the assignee for the bug.=