mac80211: don't update the PM state of a peer upon a multicast frame

Closes: #887045
Closes: #886292

debian/changelog

@@ -1,7 +1,12 @@
 linux (4.18.6-2) UNRELEASED; urgency=medium
 
+  [ Ben Hutchings ]
   * [x86] wireless: Enable R8822BE as module (Closes: #908330)
 
+  [ Salvatore Bonaccorso ]
+  * mac80211: don't update the PM state of a peer upon a multicast frame
+    (Closes: #887045, #886292)
+
  -- Ben Hutchings <ben@decadent.org.uk>  Sat, 08 Sep 2018 23:24:31 +0100
 
 linux (4.18.6-1) unstable; urgency=medium

debian/patches/bugfix/all/mac80211-don-t-update-the-PM-state-of-a-peer-upon-a-.patch

@@ -0,0 +1,62 @@
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 20 Aug 2018 13:56:07 +0300
+Subject: mac80211: don't update the PM state of a peer upon a multicast frame
+Origin: https://git.kernel.org/linus/20932750d9c78d307e4f2f18f9c6a32b82b1e0e8
+Bug-Debian: https://bugs.debian.org/887045
+Bug-Debian: https://bugs.debian.org/886292
+
+I changed the way mac80211 updates the PM state of the peer.
+I forgot that we could also have multicast frames from the
+peer and that those frame should of course not change the
+PM state of the peer: A peer goes to power save when it
+needs to scan, but it won't send the broadcast Probe Request
+with the PM bit set.
+
+This made us mark the peer as awake when it wasn't and then
+Intel's firmware would fail to transmit because the peer is
+asleep according to its database. The driver warned about
+this and it looked like this:
+
+ WARNING: CPU: 0 PID: 184 at /usr/src/linux-4.16.14/drivers/net/wireless/intel/iwlwifi/mvm/tx.c:1369 iwl_mvm_rx_tx_cmd+0x53b/0x860
+ CPU: 0 PID: 184 Comm: irq/124-iwlwifi Not tainted 4.16.14 #1
+ RIP: 0010:iwl_mvm_rx_tx_cmd+0x53b/0x860
+ Call Trace:
+  iwl_pcie_rx_handle+0x220/0x880
+  iwl_pcie_irq_handler+0x6c9/0xa20
+  ? irq_forced_thread_fn+0x60/0x60
+  ? irq_thread_dtor+0x90/0x90
+
+The relevant code that spits the WARNING is:
+
+        case TX_STATUS_FAIL_DEST_PS:
+                /* the FW should have stopped the queue and not
+                 * return this status
+                 */
+                WARN_ON(1);
+                info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=199967.
+
+Fixes: 9fef65443388 ("mac80211: always update the PM state of a peer on MGMT / DATA frames")
+Cc: <stable@vger.kernel.org>   #4.16+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/rx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 932985ca4e66..3f80a5ca4050 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1612,6 +1612,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
+ 	 */
+ 	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
+ 	    !ieee80211_has_morefrags(hdr->frame_control) &&
++	    !is_multicast_ether_addr(hdr->addr1) &&
+ 	    (ieee80211_is_mgmt(hdr->frame_control) ||
+ 	     ieee80211_is_data(hdr->frame_control)) &&
+ 	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
+-- 
+2.19.0
+

debian/patches/series

@@ -99,6 +99,7 @@ debian/revert-objtool-fix-config_stack_validation-y-warning.patch
 bugfix/all/i40e-build-for-64-bit-targets-only.patch
 bugfix/all/netfilter-ipvs-Fix-invalid-bytes-in-IP_VS_MH_TAB_IND.patch
 bugfix/all/block-really-disable-runtime-pm-for-blk-mq.patch
+bugfix/all/mac80211-don-t-update-the-PM-state-of-a-peer-upon-a-.patch
 
 # Miscellaneous features
 features/all/kbuild-add-build-salt-to-the-kernel-and-modules.patch