[FS#3783] MT7621 WiFi driver crash

[OpenWrt Bugs]

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

A new Flyspray task has been opened.  Details are below. 

User who did this - Vincent Riou (VincentR) 

Attached to Project - OpenWrt/LEDE Project
Summary - MT7621 WiFi driver crash 
Task Type - Bug Report
Category - Base system
Status - Unconfirmed
Assigned To - 
Operating System - All
Severity - Critical
Priority - Very Low
Reported Version - openwrt-21.02
Due in Version - Undecided
Due Date - Undecided
Details - **Summary**

The WiFi driver crashes on an MT7621 router running OpenWRT21.02rc1 (5 commits further to be exact 6f053e5b).
The router used is an InvizBox Go (WiFi only) i.e. MT7621 + MT7603E (not supported by OpenWRT just yet - I'm working on getting there). I don't believe the issue is specific to that hardware though.

The crash seems to happen in AP/STA mode when an AP gets added to the configuration and the STA was connected (I'll add more information if I come across more scenarios). I'm not able to reproduce consistently at the moment.
Once crashed the WiFi stack is not usable anymore until a reboot. Following a reboot, things are back to normal.

The crash stack is as follow:

[  726.587920] ------------[ cut here ]------------
[  726.597570] WARNING: CPU: 0 PID: 1767 at backports-5.10.16-1/net/mac80211/ieee80211_i.h:1468 sta_info_alloc+0x5c4/0x5fc [mac80211]
[  726.621113] Modules linked in: xt_connlimit pppoe ppp_async nf_conncount iptable_nat xt_state xt_nat xt_helper xt_conntrack xt_connmark xt_connbytes xt_REDIRECT xt_MASQUERADEr
[  726.621458]  algif_skcipher algif_rng algif_hash algif_aead af_alg sha256_generic libsha256 sha1_generic jitterentropy_rng drbg md5 hmac echainiv des_generic libdes cbc authec
[  726.859235] CPU: 0 PID: 1767 Comm: hostapd Not tainted 5.4.111 #0
[  726.871379] Stack : 8e375fb4 8007ce5c 80660000 80660d78 806c0000 80660d40 8065fe94 8e257a34
[  726.888032]         80800000 8dc34188 806aa6e3 805f993c 00000000 00000001 8e2579d8 72c69b9f
[  726.904659]         00000000 00000000 80830000 00000000 30232031 0000014b 2e352064 31312e34
[  726.921286]         00000000 00000024 00000000 000d1c63 80000000 806c0000 00000000 8e3075b8
[  726.937913]         00000009 8e146480 00000005 00000002 00000000 8034dfbc 00000000 80800000
[  726.954538]         ...
[  726.959397] Call Trace:
[  726.964284] [] show_stack+0x30/0x100
[  726.973153] [] dump_stack+0xa4/0xdc
[  726.981832] [] __warn+0xc0/0x10c
[  726.989981] [] warn_slowpath_fmt+0x5c/0xac
[  727.000018] [] sta_info_alloc+0x5c4/0x5fc [mac80211]
[  727.011712] [] ieee80211_nan_func_match+0x3d88/0x4410 [mac80211]
[  727.025846] ---[ end trace bc705bf94f0c5c24 ]---


**Steps to reproduce**

The following steps do not necessarily lead to the crash. I expect them to be what leads to it but am still unsure. The stack may show the way to a better reproduction scenario...

On an MT7621 router setup as AP/STA, add a second AP and possibly a third one.
Call /etc/init.d/network reload after each change

**Current behaviour**

Crash stack is visible in console/dmesg and the STA fails to reconnect (which also leads all APs to become not accessible - expected).

**Expected behaviour**

No crash

**Notes**
This crash was also observed on builds before the rc1 tag. I don't know the conditions leading to these crashes.

I had saved one older crash stack (truncated by console unfortunately) as a reference (early 21.02 branch when I started testing in preparation for release):

[ 1939.972549] ------------[ cut here ]------------
[ 1939.982051] WARNING: CPU: 2 PID: 2079 at backports-5.10.16-1/net/mac80211/ieee80211_i.h:1468 sta_info_alloc+0x5c4/0x]
[ 1940.005526] Modules linked in: xt_connlimit pppoe ppp_async nf_conncount iptable_nat xt_state xt_nat xt_helper xt_cor
[ 1940.005842]  algif_skcipher algif_rng algif_hash algif_aead af_alg sha256_generic libsha256 sha1_generic jitterentroc
[ 1940.243641] CPU: 2 PID: 2079 Comm: hostapd Not tainted 5.4.111 #0
[ 1940.255784] Stack : 8df75fb4 8007ce5c 80660000 80660d78 806c0000 80660d40 8065fe94 8dd01a34
[ 1940.272451]         80800000 8fe51fc8 806aa6e3 805f993c 00000002 00000001 8dd019d8 91468ee6
[ 1940.289110]         00000000 00000000 80830000 00000000 30232031 0000012f 2e352064 31312e34
[ 1940.305752]         00000000 00000060 00000000 0003b7b9 80000000 806c0000 00000000 8df075b8
[ 1940.322392]         00000009 8fed4480 00000005 00000002 00000000 8034dfbc 00000008 80800008
[ 1940.339021]         ...
[ 1940.343883] Call Trace:
[ 1940.348778] [] show_stack+0x30/0x100
[ 1940.357652] [] dump_stack+0xa4/0xdc
[ 1940.366336] [] __warn+0xc0/0x10c
[ 1940.374487] [] warn_slowpath_fmt+0x5c/0xac
[ 1940.384532] [] sta_info_alloc+0x5c4/0x5fc [mac80211]
[ 1940.396280] [] ieee80211_nan_func_match+0x3d88/0x4410 [mac80211]
[ 1940.410460] ---[ end trace dda71e821ee728c4 ]---



More information can be found at the following URL:
https://bugs.openwrt.org/index.php?do=details&task_id=3783

You are receiving this message because you have requested it from the Flyspray bugtracking system.  If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.