[5.16] mac80211: fix rate control for retransmitted frames

Since retransmission clears info->control, rate control needs to be called
again, otherwise the driver might crash due to invalid rates.

Cc: stable@vger.kernel.org # 5.14+
Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Reported-by: Robert W <rwbugreport@lost-in-the-void.net>
Fixes: 03c3911d2d67 ("mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 net/mac80211/tx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Hi, this is your Linux kernel regression tracker speaking.

Top-posting for once, to make this easy accessible to everyone.

What is talking below fix so long to get mainlined? The patch and the
confirmation that it fixes the regressions was 19 days ago. The patch is
also in linux-next for 12 days. From my point of view as regression
tracker that seem "too long", as this is a regression that also affects
a stable kernel.

Or am I missing something?

Ciao, Thorsten

P.S.: As a Linux kernel regression tracker I'm getting a lot of reports
on my table. I can only look briefly into most of them. Unfortunately
therefore I sometimes will get things wrong or miss something important.
I hope that's not the case here; if you think it is, don't hesitate to
tell me about it in a public reply. That's in everyone's interest, as
what I wrote above might be misleading to everyone reading this; any
suggestion I gave thus might sent someone reading this down the wrong
rabbit hole, which none of us wants.

BTW, I have no personal interest in this issue, which is tracked using
regzbot, my Linux kernel regression tracking bot
(https://linux-regtracking.leemhuis.info/regzbot/). I'm only posting
this mail to get things rolling again and hence don't need to be CC on
all further activities wrt to this regression.

#regzbot poke

On 22.11.21 21:43, Felix Fietkau wrote:
> Since retransmission clears info->control, rate control needs to be called
> again, otherwise the driver might crash due to invalid rates.
> 
> Cc: stable@vger.kernel.org # 5.14+
> Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
> Reported-by: Robert W <rwbugreport@lost-in-the-void.net>
> Fixes: 03c3911d2d67 ("mac80211: call ieee80211_tx_h_rate_ctrl() when dequeue")
> Signed-off-by: Felix Fietkau <nbd@nbd.name>
> ---
>  net/mac80211/tx.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
> index 278945e3e08a..e19f6e246642 100644
> --- a/net/mac80211/tx.c
> +++ b/net/mac80211/tx.c
> @@ -1822,15 +1822,15 @@ static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
>  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
>  	ieee80211_tx_result res = TX_CONTINUE;
>  
> +	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
> +		CALL_TXH(ieee80211_tx_h_rate_ctrl);
> +
>  	if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
>  		__skb_queue_tail(&tx->skbs, tx->skb);
>  		tx->skb = NULL;
>  		goto txh_done;
>  	}
>  
> -	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
> -		CALL_TXH(ieee80211_tx_h_rate_ctrl);
> -
>  	CALL_TXH(ieee80211_tx_h_michael_mic_add);
>  	CALL_TXH(ieee80211_tx_h_sequence);
>  	CALL_TXH(ieee80211_tx_h_fragment);
>

Thorsten Leemhuis <regressions@leemhuis.info> writes:

> Hi, this is your Linux kernel regression tracker speaking.
>
> Top-posting for once, to make this easy accessible to everyone.
>
> What is talking below fix so long to get mainlined? The patch and the
> confirmation that it fixes the regressions was 19 days ago. The patch is
> also in linux-next for 12 days. From my point of view as regression
> tracker that seem "too long", as this is a regression that also affects
> a stable kernel.
>
> Or am I missing something?

In general it just takes time for wireless patches to reach Linus' tree.
For example, we don't usually send pull requests to the net tree every
week so that alone causes delay.