ATH11K, firmware CRASH after sending WMI_PEER_CONFIG_VLAN_CMDID

Hello all,


I had a crash after trying to send WMI_PEER_CONFIG_VLAN_CMDID to
disable vlan strip  for my inline vlan tag (this later is dropped by
the firmware)



int ath11k_wmi_set_vlan_rx_strip(struct ath11k *ar, const u8 *peer_addr,
+       u32 vdev_id, bool strip)
+{
+ struct ath11k_pdev_wmi *wmi = ar->wmi;
+ struct wmi_peer_config_vlan_cmd_fixed_param *cmd;
+ struct sk_buff *skb;
+ int ret;
+
+ skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
+ if (!skb)
+ return -ENOMEM;
+
+ cmd = (struct wmi_peer_config_vlan_cmd_fixed_param *)skb->data;
+ cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_PEER_SET_PARAM_CMD) |
+   FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
+ ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+ cmd->vdev_id = vdev_id;
+ cmd->insert_vlan_tci = 0;
+ cmd->peer_vlan_config_mask = 1 << 1; // indicates setting of vlan rx
+ if (strip)
+ cmd->peer_vlan_config_mask |= 1 << 5; // c_tag (enabled by default)
+
+ ret = ath11k_wmi_cmd_send(wmi, skb, WMI_PEER_CONFIG_VLAN_CMDID);
+ if (ret) {
+ ath11k_warn(ar->ab, "failed to send WMI_PEER_CONFIG_VLAN_CMDID cmd\n");
+ dev_kfree_skb(skb);
+ }
+
+ ath11k_dbg(
+ ar->ab, ATH11K_DBG_WMI,
+ "cmd peer config vlan vdev %d peer 0x%pM set rx strip %d\n",
+ vdev_id, peer_addr, strip);
+
+ return ret;
+}

I called this function after association : WMI_PEER_ASSOC_CONF_EVENTID


I got a crash.:



[  134.881569] AL >>>>>>>>>>>>>> start ath11k_wmi_set_vlan_rx_strip()
[  134.887765] AL >> return in the function ath11k_wmi_set_vlan_rx_strip()
[  134.894382] AL >> start ath11k_wmi_cmd_send()
[  134.898744] AL >> start ath11k_wmi_cmd_send_nowait()
[  134.903716] AL >> get out  ath11k_wmi_cmd_send_nowait()
[  134.908948] AL >> go out from  ath11k_wmi_cmd_send()
[  134.913922] AL >> cmd peer config vlan vdev 0 peer
0x00:09:90:01:5a:17 set tx strip 0
[  134.921762] AL >>>>>>>>>>>>>> out from
ath11k_wmi_set_vlan_rx_strip() with ret=0

But after that , it fails to associate.
135.276059] AL >> go out from  ath11k_wmi_cmd_send()
[  135.281068] AL >> start ath11k_wmi_cmd_send()
[  135.285440] AL >> start ath11k_wmi_cmd_send_nowait()
[  135.290413] AL >> get out  ath11k_wmi_cmd_send_nowait()
[  135.295647] AL >> go out from  ath11k_wmi_cmd_send()
[  136.312790] ath11k_pci 0001:01:00.0: failed to get peer assoc conf
event for 00:09:90:01:5a:17 vdev 0
[  136.322045] ath11k_pci 0001:01:00.0: Failed to associate station:
00:09:90:01:5a:17
[  136.329783] AL >> start ath11k_wmi_cmd_send()
[  136.334150] AL >> start ath11k_wmi_cmd_send_nowait()
[  136.339125] AL >> get out  ath11k_wmi_cmd_send_nowait()
[  136.344358] AL >> go out from  ath11k_wmi_cmd_send()
[  139.384778] ath11k_pci 0001:01:00.0: failed wait for peer deleted
[  139.390904] ath11k_pci 0001:01:00.0: Failed to delete peer:
00:09:90:01:5a:17 for VDEV: 0

[  139.399097] ath11k_pci 0001:01:00.0: Failed to remove station:
00:09:90:01:5a:17 for VDEV: 0
[  139.407544] ath11k_pci 0001:01:00.0: Found peer entry
00:09:90:02:fe:65 n vdev 0 after it was supposedly removed
[  139.417731] ------------[ cut here ]------------
[  139.422354] WARNING: CPU: 1 PID: 3553 at
../mac80211-regular/backports-6.11.2/net/mac80211/sta_info.c:789
sta_info_insert_rcu+0x53c/0x6b8 [mac80211]
[  139.435792] Modules linked in: pppoe ppp_async ath12k(O)
ath11k_pci(O) ath11k(O) qmi_wwan pppox ppp_generic nft_fib_inet
nf_flow_table_inet mac80211(O) ipt_REJECT cfg80211(O) xt_time
xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_multiport
xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_ecn xt_dscp
xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment
xt_TCPMSS xt_LOG xt_HL xt_DSCP xt_CLASSIFY xfrm_interface usbnet
ts_kmp ts_fsm ts_bm slhc qrtr_mhi qrtr qmi_helpers(O) nft_reject_ipv6
nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota
nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash
nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_compat
nft_chain_nat nf_tables nf_reject_ipv4 nf_nat nf_log_syslog
nf_flow_table nf_conncount mhi mdio_netlink(O) iptable_mangle
iptable_filter ipt_ECN ip_tables crc_ccitt compat(O) cdc_wdm sch_teql
sch_sfq sch_multiq sch_gred sch_fq sch_codel em_text em_nbyte em_meta
em_cmp act_skbmod act_simple act_pedit act_csum libcrc32c act_connmark

[  139.436124]  nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sch_tbf
sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_route cls_matchall
cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact xt_set
ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport
ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net
ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip
ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip
ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set
nfnetlink ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT
x_tables nf_reject_ipv6 bonding ip6_gre ip_gre gre ip6_vti ip_vti
ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel ipcomp esp4 ah4 ip6_tunnel
tunnel6 tunnel4 ip_tunnel tun xfrm_user xfrm_ipcomp af_key xfrm_algo
gpy215 ecdh_generic ecc xcbc crypto_user algif_skcipher algif_rng
algif_hash algif_aead af_alg sha512_generic sha256_generic libsha256
sha1_generic seqiv sha3_generic drbg pcbc michael_mic md5 md4 kpp hmac
ehainiv geniv rng ecb des_generic libdes deflate
[  139.526243]  zlib_deflate cts cmac chacha20poly1305 cbc authencesn
authenc arc4 crypto_acompress mii
[  139.625203] CPU: 1 PID: 3553 Comm: hostapd Tainted: G           O
    6.6.62 #0
[  139.632691] Stack : ffffffff81375640 ffffffff80fc86a8
8000000001f6b750 800000002051cd80
[  139.640710]         0000000000000000 80000000239a74f0
ffffffff810fca78 80000000239a74b0
[  139.648725]         0000000000000000 ffffffff81375440
0000000000057fa8 c0000000ffffefff
[  139.656742]         80000000239a7688 0000000000000000
0000000000000000 0000000000000000
[  139.664757]         ffffffff810fca78 0000000000000001
0000000000000000 0000000000000009
[  139.672772]         0000000000000315 0000000000000000
ffffffff81c0bd30 0000000000000003
[  139.680789]         80000000a39a7317 ffffffff80bc3750
0000000000000008 ffffffff81de0008
[  139.688805]         80000000239a4000 80000000239a74f0
ffffffffc07d0430 ffffffff80fc86a8
[  139.696821]         0000000000000000 0000000000000000
0000000000000000 7bec4bfb953bfc00
[  139.704835]         ffffffff810fca78 ffffffff8066308c
80000000032f8000 ffffffff80fc860c
[  139.712852]         ...
[  139.715302] Call Trace:
[  139.717748] [<ffffffff8066308c>] show_stack+0x34/0x100
[  139.722901] [<ffffffff80fc86a8>] dump_stack_lvl+0x58/0x78
[  139.728305] [<ffffffff80684328>] __warn+0xa8/0x168
[  139.733106] [<ffffffff80684530>] warn_slowpath_fmt+0x148/0x1c0
[  139.738948] [<ffffffffc07d830c>] sta_info_insert_rcu+0x53c/0x6b8 [mac80211]
[  139.746063] [<ffffffffc07d84b4>] sta_info_insert+0x2c/0x38 [mac80211]
[  139.752621] [<ffffffffc074bfa8>]
cfg80211_update_owe_info_event+0x16d0/0x1858 [cfg80211]
[  139.760838]
[  139.762348] ---[ end trace 0000000000000000 ]---