[PATCH ath-next 0/2] wifi: ath11k: fix two races between ieee80211_register_hw() and the rest of mac registration

[Nikolay Bryskin]

ath11k does part of its per-radio setup only after
ieee80211_register_hw(), when userspace can already see and use the
wiphy. This series fixes two consequences of that:

1. txmgmt_empty_waitq is initialized after registration. A mgmt TX
   completion arriving before that (e.g. iwd authenticating as soon as
   the wiphy shows up) calls wake_up() on an uninitialized wait queue
   head and panics in softirq context.

2. The regdomain received from the firmware is applied after
   registration, and asynchronously, although the wiphy is
   REGULATORY_WIPHY_SELF_MANAGED. A GET_REG from userspace in that window
   hits the WARN_ON() in nl80211_get_reg_do(), and a connection made
   before the regdomain lands ends up with badly degraded TX once it does.
   This is the driver-side fix Johannes asked for when a patch dropping
   that WARN_ON() was proposed [1].

Both were found on a Dell XPS 13 9310 (QCA6390 hw2.0, WLAN.HST.1.0.1-05266)
with iwd. Patch 2's warning occurred naturally at boot; both failures
were reproduced reliably by inserting an msleep(2000) right after
ieee80211_register_hw(), and tested with and without each fix:

  delay  regd fix  waitq fix  result
  yes    no        no         WARN_ON, then NULL deref panic in __wake_up()
  yes    no        yes        WARN_ON, no panic, TX failing (83% tx failed)
  yes    yes       yes        no warning, no panic, link stable for 6+ min
  no     yes       yes        in daily use, no issues

The patches were developed and tested on v7.2.8 and rebased onto
ath-next without changes (git range-diff shows them identical); on
ath-next they are compile-tested only (W=1, no new warnings).

The same register-then-apply-regd ordering exists in ath12k
(ath12k_mac_hw_register()); I have no ath12k hardware to test a fix
there.

[1] https://lore.kernel.org/all/16aa99921c4e92e8d4da3c84aacbec2e673666aa.camel@sipsolutions.net/

Nikolay Bryskin (2):
  wifi: ath11k: initialize txmgmt_empty_waitq before registering the hw
  wifi: ath11k: apply the initial regdomain before registering the wiphy

 drivers/net/wireless/ath/ath11k/mac.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)


base-commit: 129324b60343dec19d45dcf87736f129b18b95bb
-- 
2.56.0