Created attachment 308306 [details]
otcpl-dell-latitude-5420-tgl-iwlwifi-fail-dmesg.txt

Upon running 6.16.0-rc3 I discovered 5 of our machines booted but then failed to get wifi. All of them are production machines. They tried to enable iwlwifi but then end up failing in an infinite loop of errors. I've attached the full boot dmesg log for otcpl-dell-latitude-5420-tgl. 

- otcpl-hp-spectre-tgl
- otcpl-lenovo-tix1-tgl
- otcpl-dell-latitude-5420-tgl
- otcpl-dell-7390-cmlu
- otcpl-dell-9300-icl

The error is in the mac configuration:


[    6.361791] iwlwifi 0000:00:14.3: Registered PHC clock: iwlwifi-PTP, with index: 1
[    6.361832] ------------[ cut here ]------------
[    6.361833] WARNING: CPU: 3 PID: 858 at drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c:37 iwl_mvm_mld_mac_ctxt_cmd_common+0x130/0x1b0 [iwlmvm]
[    6.361854] Modules linked in: <list>
[    6.361939] CPU: 3 UID: 0 PID: 858 Comm: NetworkManager Tainted: G S                  6.16.0-rc3-dirty #1 PREEMPT(voluntary) 
[    6.361942] Tainted: [S]=CPU_OUT_OF_SPEC
[    6.361943] Hardware name: Dell Inc. Latitude 5420/054CCV, BIOS 1.15.1 12/20/2021
[    6.361944] RIP: 0010:iwl_mvm_mld_mac_ctxt_cmd_common+0x130/0x1b0 [iwlmvm]
...
[    6.361965] Call Trace:
[    6.361967]  <TASK>
[    6.361969]  iwl_mvm_mld_mac_ctx_send+0x10a/0x310 [iwlmvm]
[    6.361979]  iwl_mvm_mld_mac_ctxt_add+0x37/0xe0 [iwlmvm]
[    6.361989]  iwl_mvm_mld_mac_add_interface+0x106/0x300 [iwlmvm]
[    6.361998]  drv_add_interface+0x53/0x250 [mac80211]
[    6.362031]  ieee80211_do_open+0x550/0x7a0 [mac80211]
[    6.362056]  ieee80211_open+0x72/0xa0 [mac80211]
[    6.362081]  __dev_open+0x103/0x290
[    6.362085]  __dev_change_flags+0x1ae/0x220
[    6.362088]  netif_change_flags+0x2a/0x70
[    6.362091]  do_setlink.constprop.0+0x39d/0x12a0
[    6.362096]  ? __nla_validate_parse+0x59/0xe80
[    6.362100]  ? security_capable+0x129/0x140
[    6.362103]  ? ns_capable+0x31/0x60
[    6.362105]  ? netlink_create+0x250/0x260
[    6.362108]  rtnl_newlink+0x8c3/0xd20
[    6.362110]  ? kmem_cache_alloc_node_noprof+0x2c7/0x3a0
[    6.362113]  ? preempt_count_add+0x7f/0xd0
[    6.362115]  ? _raw_spin_lock_irqsave+0x2c/0x60
[    6.362118]  ? security_capable+0x129/0x140
[    6.362119]  ? __pfx_rtnl_newlink+0x10/0x10
[    6.362121]  rtnetlink_rcv_msg+0x360/0x400
[    6.362123]  ? preempt_count_add+0x52/0xd0
[    6.362125]  ? fib6_clean_node+0x9b/0x180
[    6.362127]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[    6.362129]  netlink_rcv_skb+0x5c/0x110
[    6.362132]  rtnetlink_rcv+0x19/0x20
[    6.362133]  netlink_unicast+0x27d/0x3a0
[    6.362135]  netlink_sendmsg+0x1f7/0x430
[    6.362137]  ____sys_sendmsg+0x38b/0x3c0
[    6.362140]  ___sys_sendmsg+0x87/0xd0
[    6.362142]  ? __pfx_do_proc_dointvec_conv+0x10/0x10
[    6.362144]  ? kvfree+0x32/0x40
[    6.362145]  ? kfree+0x1a9/0x320
[    6.362147]  ? debug_smp_processor_id+0x1b/0x30
[    6.362149]  ? refill_obj_stock+0x122/0x340
[    6.362151]  ? __memcg_slab_free_hook+0xe2/0x120
[    6.362153]  __sys_sendmsg+0x77/0xe0
[    6.362156]  __x64_sys_sendmsg+0x21/0x30
[    6.362157]  x64_sys_call+0x92d/0x2150
[    6.362159]  do_syscall_64+0x56/0x860
[    6.362160]  entry_SYSCALL_64_after_hwframe+0x76/0x7e


So it looks like the original patch fix is simple, it takes an exit condition that was logically impossible to use, and then made it get used wrong. Perhaps this exit condition shouldn't exist at all (seeing as it's never been exercised)?


iff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
index 81ca9ff67be9..3c255ae916c8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
@@ -34,7 +34,7 @@ static void iwl_mvm_mld_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                                            WIDE_ID(MAC_CONF_GROUP,
                                                    MAC_CONFIG_CMD), 0);
 
-       if (WARN_ON(cmd_ver < 1 && cmd_ver > 3))
+       if (WARN_ON(cmd_ver < 1 || cmd_ver > 3))
                return;
 
        cmd->id_and_color = cpu_to_le32(mvmvif->id);