zhaojh329
commented
4 months ago It doesn't crash anymore when remove bridger.
Open zhaojh329 opened 4 months ago
zhaojh329
commented
4 months ago It doesn't crash anymore when remove bridger.
everything411
commented
1 month ago same problem. further more, for mutliple ssid setups, this issue always occur each time applying wifi settings in luci or reboot the router. simple wifi down in ssh also crash the router, 100% reproducable.
config and log.zip
everything411
commented
1 month ago crash at mtk_wed_setup_tc_block_cb+0x4/0x38
static inline bool tc_can_offload(const struct net_device *dev)
{
return dev->features & NETIF_F_HW_TC;
}
static int
mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv)
{
struct mtk_wed_flow_block_priv *priv = cb_priv;
struct flow_cls_offload *cls = type_data;
struct mtk_wed_hw *hw = priv->hw;
if (!tc_can_offload(priv->dev))
return -EOPNOTSUPP;
if (type != TC_SETUP_CLSFLOWER)
return -EOPNOTSUPP;
return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
}the assembly code is
.text:0000000000000040 ; int __fastcall mtk_wed_setup_tc_block_cb(tc_setup_type type, void *type_data, void *cb_priv)
.text:0000000000000040 mtk_wed_setup_tc_block_cb ; DATA XREF: mtk_wed_setup_tc+78↓o
.text:0000000000000040 ; mtk_wed_setup_tc+C0↓o
.text:0000000000000040
.text:0000000000000040 var_10 = -0x10
.text:0000000000000040
.text:0000000000000040 type = X0 ; tc_setup_type
.text:0000000000000040 type_data = X1 ; void *
.text:0000000000000040 hw = X2 ; mtk_wed_hw *
.text:0000000000000040 LDP hw, X3, [hw]
.text:0000000000000044 LDR X3, [X3,#0xF0]
.text:0000000000000048 TST X3, #0x2000000000000
.text:000000000000004C CCMP W0, #3, #0, NE
.text:0000000000000050 B.NE loc_70
.text:0000000000000054 STP X29, X30, [SP,#var_10]!
.text:0000000000000058 MOV X29, SP
.text:000000000000005C LDR type, [hw,#0x10]
.text:0000000000000060 LDR W2, [hw,#0x80]
.text:0000000000000064 BL mtk_flow_offload_cmd
.text:0000000000000068 LDP X29, X30, [SP+0x10+var_10],#0x10
.text:000000000000006C RET
.text:0000000000000070 ; ---------------------------------------------------------------------------
.text:0000000000000070
.text:0000000000000070 loc_70 ; CODE XREF: mtk_wed_setup_tc_block_cb+10↑j
.text:0000000000000070 MOV W0, #0xFFFFFFA1
.text:0000000000000074 RET
.text:0000000000000074 ; End of function mtk_wed_setup_tc_block_cbLDR X3, [X3,#0xF0] crashed, and it means that priv->dev is a bad pointer and page fault when accessing priv->dev->features
everything411
commented
1 month ago I'm not familiar with these codes and don't know why priv->dev could be garbage data. Is there anyone can help with that?
rx78gp01
commented
1 month ago You can try patch mtk_wed.c :
@@ -2686,7 +2686,7 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_pri
struct flow_cls_offload *cls = type_data;
struct mtk_wed_hw *hw = priv->hw;
- if (!tc_can_offload(priv->dev))
+ if (!priv || !tc_can_offload(priv->dev))
return -EOPNOTSUPP;
if (type != TC_SETUP_CLSFLOWER)
@@ -2747,6 +2747,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev,
flow_block_cb_remove(block_cb, f);
list_del(&block_cb->driver_list);
kfree(block_cb->cb_priv);
+ block_cb->cb_priv = NULL;
}
return 0;
default:@rx78gp01 thanks a lot and with this patch my multiple ssid setup works again now! could you please submit this patch to upstream?
everything411
commented
1 month ago cc @dangowrt @nbd168
everything411
commented
1 month ago the right patch should be
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -2686,7 +2686,12 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_pri
struct flow_cls_offload *cls = type_data;
- struct mtk_wed_hw *hw = priv->hw;
+ struct mtk_wed_hw *hw = NULL;
+
+ if(priv)
+ hw = priv->hw;
+ else
+ return -EOPNOTSUPP;
if (!tc_can_offload(priv->dev))
return -EOPNOTSUPP;
if (type != TC_SETUP_CLSFLOWER)
@@ -2747,6 +2747,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev,
flow_block_cb_remove(block_cb, f);
list_del(&block_cb->driver_list);
kfree(block_cb->cb_priv);
+ block_cb->cb_priv = NULL;
}
return 0;
default:
rx78gp01's original version cause a null pointer dereference at priv->hw
devianceluka
commented
1 month ago the right patch should be
--- a/drivers/net/ethernet/mediatek/mtk_wed.c +++ b/drivers/net/ethernet/mediatek/mtk_wed.c @@ -2686,7 +2686,12 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_pri struct flow_cls_offload *cls = type_data; - struct mtk_wed_hw *hw = priv->hw; + struct mtk_wed_hw *hw = NULL; + + if(priv) + hw = priv->hw; + else + return -EOPNOTSUPP; if (!tc_can_offload(priv->dev)) return -EOPNOTSUPP; if (type != TC_SETUP_CLSFLOWER) @@ -2747,6 +2747,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw *hw, struct net_device *dev, flow_block_cb_remove(block_cb, f); list_del(&block_cb->driver_list); kfree(block_cb->cb_priv); + block_cb->cb_priv = NULL; } return 0; default:rx78gp01's original version cause a null pointer dereference at
priv->hw
I can confirm it doesnt crash anymore with multissid with this patch on Redmi AX6000. Thanks @everything411 !
OpenWrt commit 66019e456f60f5ef71a9af0d73502e20b874d114