[PATCH 1/1] wifi: mac80211: don't coalesce a new ROC onto an expired one

[JB Tsai <jb.tsai@mediatek.com>]

From: james-ly huang <james-ly.huang@mediatek.com>

ieee80211_coalesce_hw_started_roc() computed the remaining time of the
running ROC as

	remaining = cur_roc->start_time +
		    msecs_to_jiffies(cur_roc->duration) - now;

and merged the new request into it when the new duration fits. When the
running ROC is already over, that subtraction wraps around (unsigned),
the "fits" check passes, and the new request gets added behind a ROC
that will never produce another on_channel or expired event.

The expired-but-still-listed state is not rare at all: the driver's
ieee80211_remain_on_channel_expired() only queues the hw_roc_done work,
so until that work runs - the driver's UNI_ROC_ABORT round trip can
take tens of ms - every ROC on the list whose time is up stays listed
with started=true. A remain-on-channel / mgmt-TX request arriving in
that window hits exactly this path.

Check the ROC's end time explicitly with time_after_eq() and refuse to
coalesce once it has passed; compute the (now guaranteed positive)
remaining window from the same end time.

Signed-off-by: james-ly huang <james-ly.huang@mediatek.com>
---
 net/mac80211/offchannel.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 44808120ff51..a9cc802f68dc 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -529,7 +529,7 @@ ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
 				  struct ieee80211_roc_work *cur_roc)
 {
 	unsigned long now = jiffies;
-	unsigned long remaining;
+	unsigned long end;
 
 	if (WARN_ON(!cur_roc->started))
 		return false;
@@ -540,12 +540,20 @@ ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
 	if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration)
 		return false;
 
-	remaining = cur_roc->start_time +
-		    msecs_to_jiffies(cur_roc->duration) -
-		    now;
+	end = cur_roc->start_time + msecs_to_jiffies(cur_roc->duration);
+
+	/* The current ROC may already be over: the driver's
+	 * ieee80211_remain_on_channel_expired() only queues hw_roc_done,
+	 * so until that work runs the ROC stays on roc_list with
+	 * started=true and no remaining time. Coalescing onto it would
+	 * leave the new request queued behind a ROC that will not produce
+	 * another on_channel or expired event
+	 */
+	if (time_after_eq(now, end))
+		return false;
 
 	/* if it doesn't fit entirely, schedule a new one */
-	if (new_roc->duration > jiffies_to_msecs(remaining))
+	if (new_roc->duration > jiffies_to_msecs(end - now))
 		return false;
 
 	/* add just after the current one so we combine their finish later */
-- 
2.45.2