[PATCH wireless] wifi: mt76: initialize tx_info band for 802.3 offload

[PATCH wireless] wifi: mt76: initialize tx_info band for 802.3 offload

[Andrea Pesaresi]

The failure was first observed in normal use on a GL.iNet GL-MT6000
(MT7986). An iPhone using FT roamed between the 2.4 and 5 GHz BSSes
while generating traffic, then lost connectivity and the router
rebooted. The ramoops record from that reboot shows:

  Unable to handle kernel read from unreadable memory at virtual
  address 0000000000000010
  CPU: 1 PID: 1419 Comm: mt76-tx phy0
  Hardware name: GL.iNet GL-MT6000 (DT)
  pc : rcname_read+0x1ec/0x340 [mac80211]
  lr : ieee80211_get_tx_rates+0x140/0x4cc [mac80211]
  Call trace:
   rcname_read+0x1ec/0x340 [mac80211]
   ieee80211_get_tx_rates+0x140/0x4cc [mac80211]
   __mt76_tx_complete_skb+0x6bc/0x9a8 [mt76]
   mt76_tx_worker+0xb8/0x1f0 [mt76]
  Kernel panic - not syncing: Oops: Fatal exception in interrupt

ieee80211_8023_xmit() clears tx_info before queueing a frame for
hardware encapsulation and does not initialize info->band. This is
normally harmless because mt7915 uses the firmware rate stored in
wcid->tx_info.

During AP-side FT roaming, the WCID rate information can be unset
while an 802.3 skb remains queued. mt76 then falls back to
ieee80211_get_tx_rates() with band 0. On the 5 GHz PHY,
wiphy->bands[NL80211_BAND_2GHZ] is NULL, leading to a NULL pointer
dereference in rate control and a kernel panic.

Set info->band from the resolved PHY while dequeuing hardware-
encapsulated frames. The dequeue caller has already selected the PHY
using wcid->phy_idx.

Temporary diagnostic instrumentation and a same-MAC dual-radio FT
stress test with continuous traffic reproduced the invalid state twice
in 300 cycles on MT7981. Both cases had info->band=0, PHY band 1,
tx_info=0 and HW 802.11 encapsulation enabled.

With this fix applied, three independent 300-cycle runs completed on
MT7981 and MT7986 (900 cycles in total) without a router disconnect,
kernel warning or crash. Continued testing with the original iPhone
also exercised repeated FT roaming without recurrence.

Fixes: 55f7c9b02790 ("mt76: mt7915: add 802.11 encap offload support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
---
 drivers/net/wireless/mediatek/mt76/tx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 3707ee19e4..a168851959 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -406,6 +406,8 @@ mt76_txq_dequeue(struct mt76_phy *phy, struct mt76_txq *mtxq)
 
 	info = IEEE80211_SKB_CB(skb);
 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
+	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
+		info->band = phy->chandef.chan->band;
 
 	return skb;
 }

base-commit: 1eeca1d5e0920fbdad6449768fd2d4364e714180
-- 
2.43.0