Patch "wifi: ath11k: Don't drop tx_status when peer cannot be found" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    wifi: ath11k: Don't drop tx_status when peer cannot be found

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-ath11k-don-t-drop-tx_status-when-peer-cannot-be.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 05c2cb1497456a2f5e514763c3d7d1bb3905e5b1
Author: Sven Eckelmann <sven@xxxxxxxxxxxxx>
Date:   Tue Aug 22 16:42:24 2023 +0300

    wifi: ath11k: Don't drop tx_status when peer cannot be found
    
    [ Upstream commit 400ece6c7f346b0a30867bd00b03b5b2563d4357 ]
    
    When a station idles for a long time, hostapd will try to send a QoS Null
    frame to the station as "poll". NL80211_CMD_PROBE_CLIENT is used for this
    purpose. And the skb will be added to ack_status_frame - waiting for a
    completion via ieee80211_report_ack_skb().
    
    But when the peer was already removed before the tx_complete arrives, the
    peer will be missing. And when using dev_kfree_skb_any (instead of going
    through mac80211), the entry will stay inside ack_status_frames. This IDR
    will therefore run full after 8K request were generated for such clients.
    At this point, the access point will then just stall and not allow any new
    clients because idr_alloc() for ack_status_frame will fail.
    
    ieee80211_free_txskb() on the other hand will (when required) call
    ieee80211_report_ack_skb() and make sure that (when required) remove the
    entry from the ack_status_frame.
    
    Tested-on: IPQ6018 hw1.0 WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
    
    Fixes: 6257c702264c ("wifi: ath11k: fix tx status reporting in encap offload mode")
    Fixes: 94739d45c388 ("ath11k: switch to using ieee80211_tx_status_ext()")
    Cc: stable@xxxxxxxxxxxxxxx
    Signed-off-by: Sven Eckelmann <sven@xxxxxxxxxxxxx>
    Signed-off-by: Kalle Valo <quic_kvalo@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230802-ath11k-ack_status_leak-v2-1-c0af729d6229@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c
index 64c8ccac22d27..cd24488612454 100644
--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -369,7 +369,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct ath11k_base *ab,
 			   "dp_tx: failed to find the peer with peer_id %d\n",
 			    ts->peer_id);
 		spin_unlock_bh(&ab->base_lock);
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 	spin_unlock_bh(&ab->base_lock);
@@ -624,7 +624,7 @@ static void ath11k_dp_tx_complete_msdu(struct ath11k *ar,
 			   "dp_tx: failed to find the peer with peer_id %d\n",
 			    ts->peer_id);
 		spin_unlock_bh(&ab->base_lock);
-		dev_kfree_skb_any(msdu);
+		ieee80211_free_txskb(ar->hw, msdu);
 		return;
 	}
 	arsta = (struct ath11k_sta *)peer->sta->drv_priv;