package/kernel/mac80211/patches/subsys/307-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Tue, 13 Dec 2022 21:03:19 +0100
   3 Subject: [PATCH] wifi: mac80211: fix initialization of rx->link and
   4  rx->link_sta
   5
   6 There are some codepaths that do not initialize rx->link_sta properly. This
   7 causes a crash in places which assume that rx->link_sta is valid if rx->sta
   8 is valid.
   9 One known instance is triggered by __ieee80211_rx_h_amsdu being called from
  10 fast-rx.
  11
  12 Since the initialization of rx->link and rx->link_sta is rather convoluted
  13 and duplicated in many places, clean it up by using a helper function to
  14 set it.
  15
  16 Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
  17 Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
  18 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  19 ---
  20
  21 --- a/net/mac80211/rx.c
  22 +++ b/net/mac80211/rx.c
  23 @@ -4067,6 +4067,56 @@ static void ieee80211_invoke_rx_handlers
  24  #undef CALL_RXH
  25  }
  26
  27 +static bool
  28 +ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
  29 +{
  30 +       if (!sta->mlo)
  31 +               return false;
  32 +
  33 +       return !!(sta->valid_links & BIT(link_id));
  34 +}
  35 +
  36 +static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
  37 +                                      u8 link_id)
  38 +{
  39 +       if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
  40 +               return false;
  41 +
  42 +       rx->link_id = link_id;
  43 +       rx->link = rcu_dereference(rx->sdata->link[link_id]);
  44 +       rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
  45 +
  46 +       return rx->link && rx->link_sta;
  47 +}
  48 +
  49 +static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
  50 +                                     struct ieee80211_sta *pubsta,
  51 +                                     int link_id)
  52 +{
  53 +       struct sta_info *sta;
  54 +
  55 +       sta = container_of(pubsta, struct sta_info, sta);
  56 +
  57 +       rx->link_id = link_id;
  58 +       rx->sta = sta;
  59 +
  60 +       if (sta) {
  61 +               rx->local = sta->sdata->local;
  62 +               if (!rx->sdata)
  63 +                       rx->sdata = sta->sdata;
  64 +               rx->link_sta = &sta->deflink;
  65 +
  66 +               if (link_id >= 0 &&
  67 +                   !ieee80211_rx_data_set_link(rx, link_id))
  68 +                       return false;
  69 +       }
  70 +
  71 +       if (link_id < 0)
  72 +               rx->link = &rx->sdata->deflink;
  73 +
  74 +       return true;
  75 +}
  76 +
  77  /*
  78   * This function makes calls into the RX path, therefore
  79   * it has to be invoked under RCU read lock.
  80 @@ -4075,16 +4125,19 @@ void ieee80211_release_reorder_timeout(s
  81  {
  82         struct sk_buff_head frames;
  83         struct ieee80211_rx_data rx = {
  84 -               .sta = sta,
  85 -               .sdata = sta->sdata,
  86 -               .local = sta->local,
  87                 /* This is OK -- must be QoS data frame */
  88                 .security_idx = tid,
  89                 .seqno_idx = tid,
  90 -               .link_id = -1,
  91         };
  92         struct tid_ampdu_rx *tid_agg_rx;
  93 -       u8 link_id;
  94 +       int link_id = -1;
  95 +
  96 +       /* FIXME: statistics won't be right with this */
  97 +       if (sta->sta.valid_links)
  98 +               link_id = ffs(sta->sta.valid_links) - 1;
  99 +
 100 +       if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
 101 +               return;
 102
 103         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 104         if (!tid_agg_rx)
 105 @@ -4104,10 +4157,6 @@ void ieee80211_release_reorder_timeout(s
 106                 };
 107                 drv_event_callback(rx.local, rx.sdata, &event);
 108         }
 109 -       /* FIXME: statistics won't be right with this */
 110 -       link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
 111 -       rx.link = rcu_dereference(sta->sdata->link[link_id]);
 112 -       rx.link_sta = rcu_dereference(sta->link[link_id]);
 113
 114         ieee80211_rx_handlers(&rx, &frames);
 115  }
 116 @@ -4123,7 +4172,6 @@ void ieee80211_mark_rx_ba_filtered_frame
 117                 /* This is OK -- must be QoS data frame */
 118                 .security_idx = tid,
 119                 .seqno_idx = tid,
 120 -               .link_id = -1,
 121         };
 122         int i, diff;
 123
 124 @@ -4134,10 +4182,8 @@ void ieee80211_mark_rx_ba_filtered_frame
 125
 126         sta = container_of(pubsta, struct sta_info, sta);
 127
 128 -       rx.sta = sta;
 129 -       rx.sdata = sta->sdata;
 130 -       rx.link = &rx.sdata->deflink;
 131 -       rx.local = sta->local;
 132 +       if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
 133 +               return;
 134
 135         rcu_read_lock();
 136         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 137 @@ -4524,15 +4570,6 @@ void ieee80211_check_fast_rx_iface(struc
 138         mutex_unlock(&local->sta_mtx);
 139  }
 140
 141 -static bool
 142 -ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
 143 -{
 144 -       if (!sta->mlo)
 145 -               return false;
 146 -
 147 -       return !!(sta->valid_links & BIT(link_id));
 148 -}
 149 -
 150  static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
 151                               struct ieee80211_fast_rx *fast_rx,
 152                               int orig_len)
 153 @@ -4643,7 +4680,6 @@ static bool ieee80211_invoke_fast_rx(str
 154         struct sk_buff *skb = rx->skb;
 155         struct ieee80211_hdr *hdr = (void *)skb->data;
 156         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 157 -       struct sta_info *sta = rx->sta;
 158         int orig_len = skb->len;
 159         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 160         int snap_offs = hdrlen;
 161 @@ -4655,7 +4691,6 @@ static bool ieee80211_invoke_fast_rx(str
 162                 u8 da[ETH_ALEN];
 163                 u8 sa[ETH_ALEN];
 164         } addrs __aligned(2);
 165 -       struct link_sta_info *link_sta;
 166         struct ieee80211_sta_rx_stats *stats;
 167
 168         /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
 169 @@ -4758,18 +4793,10 @@ static bool ieee80211_invoke_fast_rx(str
 170   drop:
 171         dev_kfree_skb(skb);
 172
 173 -       if (rx->link_id >= 0) {
 174 -               link_sta = rcu_dereference(sta->link[rx->link_id]);
 175 -               if (!link_sta)
 176 -                       return true;
 177 -       } else {
 178 -               link_sta = &sta->deflink;
 179 -       }
 180 -
 181         if (fast_rx->uses_rss)
 182 -               stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
 183 +               stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
 184         else
 185 -               stats = &link_sta->rx_stats;
 186 +               stats = &rx->link_sta->rx_stats;
 187
 188         stats->dropped++;
 189         return true;
 190 @@ -4787,8 +4814,8 @@ static bool ieee80211_prepare_and_rx_han
 191         struct ieee80211_local *local = rx->local;
 192         struct ieee80211_sub_if_data *sdata = rx->sdata;
 193         struct ieee80211_hdr *hdr = (void *)skb->data;
 194 -       struct link_sta_info *link_sta = NULL;
 195 -       struct ieee80211_link_data *link;
 196 +       struct link_sta_info *link_sta = rx->link_sta;
 197 +       struct ieee80211_link_data *link = rx->link;
 198
 199         rx->skb = skb;
 200
 201 @@ -4810,35 +4837,6 @@ static bool ieee80211_prepare_and_rx_han
 202         if (!ieee80211_accept_frame(rx))
 203                 return false;
 204
 205 -       if (rx->link_id >= 0) {
 206 -               link = rcu_dereference(rx->sdata->link[rx->link_id]);
 207 -
 208 -               /* we might race link removal */
 209 -               if (!link)
 210 -                       return true;
 211 -               rx->link = link;
 212 -
 213 -               if (rx->sta) {
 214 -                       rx->link_sta =
 215 -                               rcu_dereference(rx->sta->link[rx->link_id]);
 216 -                       if (!rx->link_sta)
 217 -                               return true;
 218 -               }
 219 -       } else {
 220 -               if (rx->sta)
 221 -                       rx->link_sta = &rx->sta->deflink;
 222 -
 223 -               rx->link = &sdata->deflink;
 224 -       }
 225 -
 226 -       if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
 227 -                    rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
 228 -               link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
 229 -
 230 -               if (WARN_ON_ONCE(!link_sta))
 231 -                       return true;
 232 -       }
 233 -
 234         if (!consume) {
 235                 struct skb_shared_hwtstamps *shwt;
 236
 237 @@ -4858,7 +4856,7 @@ static bool ieee80211_prepare_and_rx_han
 238                 shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
 239         }
 240
 241 -       if (unlikely(link_sta)) {
 242 +       if (unlikely(rx->sta && rx->sta->sta.mlo)) {
 243                 /* translate to MLD addresses */
 244                 if (ether_addr_equal(link->conf->addr, hdr->addr1))
 245                         ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
 246 @@ -4888,6 +4886,7 @@ static void __ieee80211_rx_handle_8023(s
 247         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 248         struct ieee80211_fast_rx *fast_rx;
 249         struct ieee80211_rx_data rx;
 250 +       int link_id = -1;
 251
 252         memset(&rx, 0, sizeof(rx));
 253         rx.skb = skb;
 254 @@ -4904,12 +4903,8 @@ static void __ieee80211_rx_handle_8023(s
 255         if (!pubsta)
 256                 goto drop;
 257
 258 -       rx.sta = container_of(pubsta, struct sta_info, sta);
 259 -       rx.sdata = rx.sta->sdata;
 260 -
 261 -       if (status->link_valid &&
 262 -           !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
 263 -               goto drop;
 264 +       if (status->link_valid)
 265 +               link_id = status->link_id;
 266
 267         /*
 268          * TODO: Should the frame be dropped if the right link_id is not
 269 @@ -4918,19 +4913,8 @@ static void __ieee80211_rx_handle_8023(s
 270          * link_id is used only for stats purpose and updating the stats on
 271          * the deflink is fine?
 272          */
 273 -       if (status->link_valid)
 274 -               rx.link_id = status->link_id;
 275 -
 276 -       if (rx.link_id >= 0) {
 277 -               struct ieee80211_link_data *link;
 278 -
 279 -               link =  rcu_dereference(rx.sdata->link[rx.link_id]);
 280 -               if (!link)
 281 -                       goto drop;
 282 -               rx.link = link;
 283 -       } else {
 284 -               rx.link = &rx.sdata->deflink;
 285 -       }
 286 +       if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
 287 +               goto drop;
 288
 289         fast_rx = rcu_dereference(rx.sta->fast_rx);
 290         if (!fast_rx)
 291 @@ -4948,6 +4932,8 @@ static bool ieee80211_rx_for_interface(s
 292  {
 293         struct link_sta_info *link_sta;
 294         struct ieee80211_hdr *hdr = (void *)skb->data;
 295 +       struct sta_info *sta;
 296 +       int link_id = -1;
 297
 298         /*
 299          * Look up link station first, in case there's a
 300 @@ -4957,24 +4943,19 @@ static bool ieee80211_rx_for_interface(s
 301          */
 302         link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
 303         if (link_sta) {
 304 -               rx->sta = link_sta->sta;
 305 -               rx->link_id = link_sta->link_id;
 306 +               sta = link_sta->sta;
 307 +               link_id = link_sta->link_id;
 308         } else {
 309                 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 310
 311 -               rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
 312 -               if (rx->sta) {
 313 -                       if (status->link_valid &&
 314 -                           !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
 315 -                                                              status->link_id))
 316 -                               return false;
 317 -
 318 -                       rx->link_id = status->link_valid ? status->link_id : -1;
 319 -               } else {
 320 -                       rx->link_id = -1;
 321 -               }
 322 +               sta = sta_info_get_bss(rx->sdata, hdr->addr2);
 323 +               if (status->link_valid)
 324 +                       link_id = status->link_id;
 325         }
 326
 327 +       if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
 328 +               return false;
 329 +
 330         return ieee80211_prepare_and_rx_handle(rx, skb, consume);
 331  }
 332
 333 @@ -5033,19 +5014,15 @@ static void __ieee80211_rx_handle_packet
 334
 335         if (ieee80211_is_data(fc)) {
 336                 struct sta_info *sta, *prev_sta;
 337 -               u8 link_id = status->link_id;
 338 +               int link_id = -1;
 339
 340 -               if (pubsta) {
 341 -                       rx.sta = container_of(pubsta, struct sta_info, sta);
 342 -                       rx.sdata = rx.sta->sdata;
 343 +               if (status->link_valid)
 344 +                       link_id = status->link_id;
 345
 346 -                       if (status->link_valid &&
 347 -                           !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
 348 +               if (pubsta) {
 349 +                       if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
 350                                 goto out;
 351
 352 -                       if (status->link_valid)
 353 -                               rx.link_id = status->link_id;
 354 -
 355                         /*
 356                          * In MLO connection, fetch the link_id using addr2
 357                          * when the driver does not pass link_id in status.
 358 @@ -5063,7 +5040,7 @@ static void __ieee80211_rx_handle_packet
 359                                 if (!link_sta)
 360                                         goto out;
 361
 362 -                               rx.link_id = link_sta->link_id;
 363 +                               ieee80211_rx_data_set_link(&rx, link_sta->link_id);
 364                         }
 365
 366                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
 367 @@ -5079,30 +5056,25 @@ static void __ieee80211_rx_handle_packet
 368                                 continue;
 369                         }
 370
 371 -                       if ((status->link_valid &&
 372 -                            !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
 373 -                                                               link_id)) ||
 374 -                           (!status->link_valid && prev_sta->sta.mlo))
 375 +                       if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
 376 +                                                      link_id))
 377 +                               goto out;
 378 +
 379 +                       if (!status->link_valid && prev_sta->sta.mlo)
 380                                 continue;
 381
 382 -                       rx.link_id = status->link_valid ? link_id : -1;
 383 -                       rx.sta = prev_sta;
 384 -                       rx.sdata = prev_sta->sdata;
 385                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
 386
 387                         prev_sta = sta;
 388                 }
 389
 390                 if (prev_sta) {
 391 -                       if ((status->link_valid &&
 392 -                            !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
 393 -                                                               link_id)) ||
 394 -                           (!status->link_valid && prev_sta->sta.mlo))
 395 +                       if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
 396 +                                                      link_id))
 397                                 goto out;
 398
 399 -                       rx.link_id = status->link_valid ? link_id : -1;
 400 -                       rx.sta = prev_sta;
 401 -                       rx.sdata = prev_sta->sdata;
 402 +                       if (!status->link_valid && prev_sta->sta.mlo)
 403 +                               goto out;
 404
 405                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
 406                                 return;