projects / openwrt / staging / pepe2k.git / blob
? search:


8c6823d221da5ff47d8794bbeafeb1a9743b7f87
[openwrt/staging/pepe2k.git] /
1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Tue, 13 Dec 2022 21:03:19 +0100
3 Subject: [PATCH] wifi: mac80211: fix initialization of rx->link and
4 rx->link_sta
5
6 There are some codepaths that do not initialize rx->link_sta properly. This
7 causes a crash in places which assume that rx->link_sta is valid if rx->sta
8 is valid.
9 One known instance is triggered by __ieee80211_rx_h_amsdu being called from
10 fast-rx.
11
12 Since the initialization of rx->link and rx->link_sta is rather convoluted
13 and duplicated in many places, clean it up by using a helper function to
14 set it.
15
16 Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
17 Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
18 Signed-off-by: Felix Fietkau <nbd@nbd.name>
19 ---
20
21 --- a/net/mac80211/rx.c
22 +++ b/net/mac80211/rx.c
23 @@ -4067,6 +4067,55 @@ static void ieee80211_invoke_rx_handlers
24 #undef CALL_RXH
25 }
26
27 +static bool
28 +ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
29 +{
30 + if (!sta->mlo)
31 + return false;
32 +
33 + return !!(sta->valid_links & BIT(link_id));
34 +}
35 +
36 +static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
37 + u8 link_id)
38 +{
39 + if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
40 + return false;
41 +
42 + rx->link_id = link_id;
43 + rx->link = rcu_dereference(rx->sdata->link[link_id]);
44 + rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
45 +
46 + return rx->link && rx->link_sta;
47 +}
48 +
49 +static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
50 + struct ieee80211_sta *pubsta,
51 + int link_id)
52 +{
53 + struct sta_info *sta;
54 +
55 + sta = container_of(pubsta, struct sta_info, sta);
56 +
57 + rx->link_id = link_id;
58 + rx->sta = sta;
59 +
60 + if (sta) {
61 + rx->local = sta->sdata->local;
62 + rx->sdata = sta->sdata;
63 + rx->link_sta = &sta->deflink;
64 +
65 + if (link_id >= 0 &&
66 + !ieee80211_rx_data_set_link(rx, link_id))
67 + return false;
68 + }
69 +
70 + if (link_id < 0)
71 + rx->link = &rx->sdata->deflink;
72 +
73 + return true;
74 +}
75 +
76 /*
77 * This function makes calls into the RX path, therefore
78 * it has to be invoked under RCU read lock.
79 @@ -4075,16 +4124,19 @@ void ieee80211_release_reorder_timeout(s
80 {
81 struct sk_buff_head frames;
82 struct ieee80211_rx_data rx = {
83 - .sta = sta,
84 - .sdata = sta->sdata,
85 - .local = sta->local,
86 /* This is OK -- must be QoS data frame */
87 .security_idx = tid,
88 .seqno_idx = tid,
89 - .link_id = -1,
90 };
91 struct tid_ampdu_rx *tid_agg_rx;
92 - u8 link_id;
93 + int link_id = -1;
94 +
95 + /* FIXME: statistics won't be right with this */
96 + if (sta->sta.valid_links)
97 + link_id = ffs(sta->sta.valid_links) - 1;
98 +
99 + if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
100 + return;
101
102 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
103 if (!tid_agg_rx)
104 @@ -4104,10 +4156,6 @@ void ieee80211_release_reorder_timeout(s
105 };
106 drv_event_callback(rx.local, rx.sdata, &event);
107 }
108 - /* FIXME: statistics won't be right with this */
109 - link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
110 - rx.link = rcu_dereference(sta->sdata->link[link_id]);
111 - rx.link_sta = rcu_dereference(sta->link[link_id]);
112
113 ieee80211_rx_handlers(&rx, &frames);
114 }
115 @@ -4123,7 +4171,6 @@ void ieee80211_mark_rx_ba_filtered_frame
116 /* This is OK -- must be QoS data frame */
117 .security_idx = tid,
118 .seqno_idx = tid,
119 - .link_id = -1,
120 };
121 int i, diff;
122
123 @@ -4134,10 +4181,8 @@ void ieee80211_mark_rx_ba_filtered_frame
124
125 sta = container_of(pubsta, struct sta_info, sta);
126
127 - rx.sta = sta;
128 - rx.sdata = sta->sdata;
129 - rx.link = &rx.sdata->deflink;
130 - rx.local = sta->local;
131 + if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
132 + return;
133
134 rcu_read_lock();
135 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
136 @@ -4524,15 +4569,6 @@ void ieee80211_check_fast_rx_iface(struc
137 mutex_unlock(&local->sta_mtx);
138 }
139
140 -static bool
141 -ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
142 -{
143 - if (!sta->mlo)
144 - return false;
145 -
146 - return !!(sta->valid_links & BIT(link_id));
147 -}
148 -
149 static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
150 struct ieee80211_fast_rx *fast_rx,
151 int orig_len)
152 @@ -4643,7 +4679,6 @@ static bool ieee80211_invoke_fast_rx(str
153 struct sk_buff *skb = rx->skb;
154 struct ieee80211_hdr *hdr = (void *)skb->data;
155 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
156 - struct sta_info *sta = rx->sta;
157 int orig_len = skb->len;
158 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
159 int snap_offs = hdrlen;
160 @@ -4655,7 +4690,6 @@ static bool ieee80211_invoke_fast_rx(str
161 u8 da[ETH_ALEN];
162 u8 sa[ETH_ALEN];
163 } addrs __aligned(2);
164 - struct link_sta_info *link_sta;
165 struct ieee80211_sta_rx_stats *stats;
166
167 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
168 @@ -4758,18 +4792,10 @@ static bool ieee80211_invoke_fast_rx(str
169 drop:
170 dev_kfree_skb(skb);
171
172 - if (rx->link_id >= 0) {
173 - link_sta = rcu_dereference(sta->link[rx->link_id]);
174 - if (!link_sta)
175 - return true;
176 - } else {
177 - link_sta = &sta->deflink;
178 - }
179 -
180 if (fast_rx->uses_rss)
181 - stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
182 + stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
183 else
184 - stats = &link_sta->rx_stats;
185 + stats = &rx->link_sta->rx_stats;
186
187 stats->dropped++;
188 return true;
189 @@ -4787,8 +4813,8 @@ static bool ieee80211_prepare_and_rx_han
190 struct ieee80211_local *local = rx->local;
191 struct ieee80211_sub_if_data *sdata = rx->sdata;
192 struct ieee80211_hdr *hdr = (void *)skb->data;
193 - struct link_sta_info *link_sta = NULL;
194 - struct ieee80211_link_data *link;
195 + struct link_sta_info *link_sta = rx->link_sta;
196 + struct ieee80211_link_data *link = rx->link;
197
198 rx->skb = skb;
199
200 @@ -4810,35 +4836,6 @@ static bool ieee80211_prepare_and_rx_han
201 if (!ieee80211_accept_frame(rx))
202 return false;
203
204 - if (rx->link_id >= 0) {
205 - link = rcu_dereference(rx->sdata->link[rx->link_id]);
206 -
207 - /* we might race link removal */
208 - if (!link)
209 - return true;
210 - rx->link = link;
211 -
212 - if (rx->sta) {
213 - rx->link_sta =
214 - rcu_dereference(rx->sta->link[rx->link_id]);
215 - if (!rx->link_sta)
216 - return true;
217 - }
218 - } else {
219 - if (rx->sta)
220 - rx->link_sta = &rx->sta->deflink;
221 -
222 - rx->link = &sdata->deflink;
223 - }
224 -
225 - if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
226 - rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
227 - link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
228 -
229 - if (WARN_ON_ONCE(!link_sta))
230 - return true;
231 - }
232 -
233 if (!consume) {
234 struct skb_shared_hwtstamps *shwt;
235
236 @@ -4858,7 +4855,7 @@ static bool ieee80211_prepare_and_rx_han
237 shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
238 }
239
240 - if (unlikely(link_sta)) {
241 + if (unlikely(rx->sta && rx->sta->sta.mlo)) {
242 /* translate to MLD addresses */
243 if (ether_addr_equal(link->conf->addr, hdr->addr1))
244 ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
245 @@ -4888,6 +4885,7 @@ static void __ieee80211_rx_handle_8023(s
246 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
247 struct ieee80211_fast_rx *fast_rx;
248 struct ieee80211_rx_data rx;
249 + int link_id = -1;
250
251 memset(&rx, 0, sizeof(rx));
252 rx.skb = skb;
253 @@ -4904,12 +4902,8 @@ static void __ieee80211_rx_handle_8023(s
254 if (!pubsta)
255 goto drop;
256
257 - rx.sta = container_of(pubsta, struct sta_info, sta);
258 - rx.sdata = rx.sta->sdata;
259 -
260 - if (status->link_valid &&
261 - !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
262 - goto drop;
263 + if (status->link_valid)
264 + link_id = status->link_id;
265
266 /*
267 * TODO: Should the frame be dropped if the right link_id is not
268 @@ -4918,19 +4912,8 @@ static void __ieee80211_rx_handle_8023(s
269 * link_id is used only for stats purpose and updating the stats on
270 * the deflink is fine?
271 */
272 - if (status->link_valid)
273 - rx.link_id = status->link_id;
274 -
275 - if (rx.link_id >= 0) {
276 - struct ieee80211_link_data *link;
277 -
278 - link = rcu_dereference(rx.sdata->link[rx.link_id]);
279 - if (!link)
280 - goto drop;
281 - rx.link = link;
282 - } else {
283 - rx.link = &rx.sdata->deflink;
284 - }
285 + if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
286 + goto drop;
287
288 fast_rx = rcu_dereference(rx.sta->fast_rx);
289 if (!fast_rx)
290 @@ -4948,6 +4931,8 @@ static bool ieee80211_rx_for_interface(s
291 {
292 struct link_sta_info *link_sta;
293 struct ieee80211_hdr *hdr = (void *)skb->data;
294 + struct sta_info *sta;
295 + int link_id = -1;
296
297 /*
298 * Look up link station first, in case there's a
299 @@ -4957,24 +4942,19 @@ static bool ieee80211_rx_for_interface(s
300 */
301 link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
302 if (link_sta) {
303 - rx->sta = link_sta->sta;
304 - rx->link_id = link_sta->link_id;
305 + sta = link_sta->sta;
306 + link_id = link_sta->link_id;
307 } else {
308 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
309
310 - rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
311 - if (rx->sta) {
312 - if (status->link_valid &&
313 - !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
314 - status->link_id))
315 - return false;
316 -
317 - rx->link_id = status->link_valid ? status->link_id : -1;
318 - } else {
319 - rx->link_id = -1;
320 - }
321 + sta = sta_info_get_bss(rx->sdata, hdr->addr2);
322 + if (status->link_valid)
323 + link_id = status->link_id;
324 }
325
326 + if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
327 + return false;
328 +
329 return ieee80211_prepare_and_rx_handle(rx, skb, consume);
330 }
331
332 @@ -5033,19 +5013,15 @@ static void __ieee80211_rx_handle_packet
333
334 if (ieee80211_is_data(fc)) {
335 struct sta_info *sta, *prev_sta;
336 - u8 link_id = status->link_id;
337 + int link_id = -1;
338
339 - if (pubsta) {
340 - rx.sta = container_of(pubsta, struct sta_info, sta);
341 - rx.sdata = rx.sta->sdata;
342 + if (status->link_valid)
343 + link_id = status->link_id;
344
345 - if (status->link_valid &&
346 - !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
347 + if (pubsta) {
348 + if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
349 goto out;
350
351 - if (status->link_valid)
352 - rx.link_id = status->link_id;
353 -
354 /*
355 * In MLO connection, fetch the link_id using addr2
356 * when the driver does not pass link_id in status.
357 @@ -5063,7 +5039,7 @@ static void __ieee80211_rx_handle_packet
358 if (!link_sta)
359 goto out;
360
361 - rx.link_id = link_sta->link_id;
362 + ieee80211_rx_data_set_link(&rx, link_sta->link_id);
363 }
364
365 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
366 @@ -5079,30 +5055,25 @@ static void __ieee80211_rx_handle_packet
367 continue;
368 }
369
370 - if ((status->link_valid &&
371 - !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
372 - link_id)) ||
373 - (!status->link_valid && prev_sta->sta.mlo))
374 + if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
375 + link_id))
376 + goto out;
377 +
378 + if (!status->link_valid && prev_sta->sta.mlo)
379 continue;
380
381 - rx.link_id = status->link_valid ? link_id : -1;
382 - rx.sta = prev_sta;
383 - rx.sdata = prev_sta->sdata;
384 ieee80211_prepare_and_rx_handle(&rx, skb, false);
385
386 prev_sta = sta;
387 }
388
389 if (prev_sta) {
390 - if ((status->link_valid &&
391 - !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
392 - link_id)) ||
393 - (!status->link_valid && prev_sta->sta.mlo))
394 + if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
395 + link_id))
396 goto out;
397
398 - rx.link_id = status->link_valid ? link_id : -1;
399 - rx.sta = prev_sta;
400 - rx.sdata = prev_sta->sdata;
401 + if (!status->link_valid && prev_sta->sta.mlo)
402 + goto out;
403
404 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
405 return;
Staging tree of Piotr Dymacz