package/kernel/mac80211/patches/subsys/307-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Tue, 13 Dec 2022 21:03:19 +0100
   3 Subject: [PATCH] wifi: mac80211: fix initialization of rx->link and
   4  rx->link_sta
   5
   6 There are some codepaths that do not initialize rx->link_sta properly. This
   7 causes a crash in places which assume that rx->link_sta is valid if rx->sta
   8 is valid.
   9 One known instance is triggered by __ieee80211_rx_h_amsdu being called from
  10 fast-rx.
  11
  12 Since the initialization of rx->link and rx->link_sta is rather convoluted
  13 and duplicated in many places, clean it up by using a helper function to
  14 set it.
  15
  16 Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
  17 Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
  18 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  19 ---
  20
  21 --- a/net/mac80211/rx.c
  22 +++ b/net/mac80211/rx.c
  23 @@ -4067,6 +4067,55 @@ static void ieee80211_invoke_rx_handlers
  24  #undef CALL_RXH
  25  }
  26
  27 +static bool
  28 +ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
  29 +{
  30 +       if (!sta->mlo)
  31 +               return false;
  32 +
  33 +       return !!(sta->valid_links & BIT(link_id));
  34 +}
  35 +
  36 +static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
  37 +                                      u8 link_id)
  38 +{
  39 +       if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
  40 +               return false;
  41 +
  42 +       rx->link_id = link_id;
  43 +       rx->link = rcu_dereference(rx->sdata->link[link_id]);
  44 +       rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
  45 +
  46 +       return rx->link && rx->link_sta;
  47 +}
  48 +
  49 +static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
  50 +                                     struct ieee80211_sta *pubsta,
  51 +                                     int link_id)
  52 +{
  53 +       struct sta_info *sta;
  54 +
  55 +       sta = container_of(pubsta, struct sta_info, sta);
  56 +
  57 +       rx->link_id = link_id;
  58 +       rx->sta = sta;
  59 +
  60 +       if (sta) {
  61 +               rx->local = sta->sdata->local;
  62 +               rx->sdata = sta->sdata;
  63 +               rx->link_sta = &sta->deflink;
  64 +
  65 +               if (link_id >= 0 &&
  66 +                   !ieee80211_rx_data_set_link(rx, link_id))
  67 +                       return false;
  68 +       }
  69 +
  70 +       if (link_id < 0)
  71 +               rx->link = &rx->sdata->deflink;
  72 +
  73 +       return true;
  74 +}
  75 +
  76  /*
  77   * This function makes calls into the RX path, therefore
  78   * it has to be invoked under RCU read lock.
  79 @@ -4075,16 +4124,19 @@ void ieee80211_release_reorder_timeout(s
  80  {
  81         struct sk_buff_head frames;
  82         struct ieee80211_rx_data rx = {
  83 -               .sta = sta,
  84 -               .sdata = sta->sdata,
  85 -               .local = sta->local,
  86                 /* This is OK -- must be QoS data frame */
  87                 .security_idx = tid,
  88                 .seqno_idx = tid,
  89 -               .link_id = -1,
  90         };
  91         struct tid_ampdu_rx *tid_agg_rx;
  92 -       u8 link_id;
  93 +       int link_id = -1;
  94 +
  95 +       /* FIXME: statistics won't be right with this */
  96 +       if (sta->sta.valid_links)
  97 +               link_id = ffs(sta->sta.valid_links) - 1;
  98 +
  99 +       if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
 100 +               return;
 101
 102         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 103         if (!tid_agg_rx)
 104 @@ -4104,10 +4156,6 @@ void ieee80211_release_reorder_timeout(s
 105                 };
 106                 drv_event_callback(rx.local, rx.sdata, &event);
 107         }
 108 -       /* FIXME: statistics won't be right with this */
 109 -       link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
 110 -       rx.link = rcu_dereference(sta->sdata->link[link_id]);
 111 -       rx.link_sta = rcu_dereference(sta->link[link_id]);
 112
 113         ieee80211_rx_handlers(&rx, &frames);
 114  }
 115 @@ -4123,7 +4171,6 @@ void ieee80211_mark_rx_ba_filtered_frame
 116                 /* This is OK -- must be QoS data frame */
 117                 .security_idx = tid,
 118                 .seqno_idx = tid,
 119 -               .link_id = -1,
 120         };
 121         int i, diff;
 122
 123 @@ -4134,10 +4181,8 @@ void ieee80211_mark_rx_ba_filtered_frame
 124
 125         sta = container_of(pubsta, struct sta_info, sta);
 126
 127 -       rx.sta = sta;
 128 -       rx.sdata = sta->sdata;
 129 -       rx.link = &rx.sdata->deflink;
 130 -       rx.local = sta->local;
 131 +       if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
 132 +               return;
 133
 134         rcu_read_lock();
 135         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 136 @@ -4524,15 +4569,6 @@ void ieee80211_check_fast_rx_iface(struc
 137         mutex_unlock(&local->sta_mtx);
 138  }
 139
 140 -static bool
 141 -ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
 142 -{
 143 -       if (!sta->mlo)
 144 -               return false;
 145 -
 146 -       return !!(sta->valid_links & BIT(link_id));
 147 -}
 148 -
 149  static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
 150                               struct ieee80211_fast_rx *fast_rx,
 151                               int orig_len)
 152 @@ -4643,7 +4679,6 @@ static bool ieee80211_invoke_fast_rx(str
 153         struct sk_buff *skb = rx->skb;
 154         struct ieee80211_hdr *hdr = (void *)skb->data;
 155         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 156 -       struct sta_info *sta = rx->sta;
 157         int orig_len = skb->len;
 158         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 159         int snap_offs = hdrlen;
 160 @@ -4655,7 +4690,6 @@ static bool ieee80211_invoke_fast_rx(str
 161                 u8 da[ETH_ALEN];
 162                 u8 sa[ETH_ALEN];
 163         } addrs __aligned(2);
 164 -       struct link_sta_info *link_sta;
 165         struct ieee80211_sta_rx_stats *stats;
 166
 167         /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
 168 @@ -4758,18 +4792,10 @@ static bool ieee80211_invoke_fast_rx(str
 169   drop:
 170         dev_kfree_skb(skb);
 171
 172 -       if (rx->link_id >= 0) {
 173 -               link_sta = rcu_dereference(sta->link[rx->link_id]);
 174 -               if (!link_sta)
 175 -                       return true;
 176 -       } else {
 177 -               link_sta = &sta->deflink;
 178 -       }
 179 -
 180         if (fast_rx->uses_rss)
 181 -               stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
 182 +               stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
 183         else
 184 -               stats = &link_sta->rx_stats;
 185 +               stats = &rx->link_sta->rx_stats;
 186
 187         stats->dropped++;
 188         return true;
 189 @@ -4787,7 +4813,6 @@ static bool ieee80211_prepare_and_rx_han
 190         struct ieee80211_local *local = rx->local;
 191         struct ieee80211_sub_if_data *sdata = rx->sdata;
 192         struct ieee80211_hdr *hdr = (void *)skb->data;
 193 -       struct link_sta_info *link_sta = NULL;
 194         struct ieee80211_link_data *link;
 195
 196         rx->skb = skb;
 197 @@ -4810,35 +4835,6 @@ static bool ieee80211_prepare_and_rx_han
 198         if (!ieee80211_accept_frame(rx))
 199                 return false;
 200
 201 -       if (rx->link_id >= 0) {
 202 -               link = rcu_dereference(rx->sdata->link[rx->link_id]);
 203 -
 204 -               /* we might race link removal */
 205 -               if (!link)
 206 -                       return true;
 207 -               rx->link = link;
 208 -
 209 -               if (rx->sta) {
 210 -                       rx->link_sta =
 211 -                               rcu_dereference(rx->sta->link[rx->link_id]);
 212 -                       if (!rx->link_sta)
 213 -                               return true;
 214 -               }
 215 -       } else {
 216 -               if (rx->sta)
 217 -                       rx->link_sta = &rx->sta->deflink;
 218 -
 219 -               rx->link = &sdata->deflink;
 220 -       }
 221 -
 222 -       if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
 223 -                    rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
 224 -               link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
 225 -
 226 -               if (WARN_ON_ONCE(!link_sta))
 227 -                       return true;
 228 -       }
 229 -
 230         if (!consume) {
 231                 struct skb_shared_hwtstamps *shwt;
 232
 233 @@ -4858,16 +4854,16 @@ static bool ieee80211_prepare_and_rx_han
 234                 shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
 235         }
 236
 237 -       if (unlikely(link_sta)) {
 238 +       if (unlikely(rx->sta && rx->sta->sta.mlo)) {
 239                 /* translate to MLD addresses */
 240                 if (ether_addr_equal(link->conf->addr, hdr->addr1))
 241                         ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
 242 -               if (ether_addr_equal(link_sta->addr, hdr->addr2))
 243 +               if (ether_addr_equal(rx->link_sta->addr, hdr->addr2))
 244                         ether_addr_copy(hdr->addr2, rx->sta->addr);
 245                 /* translate A3 only if it's the BSSID */
 246                 if (!ieee80211_has_tods(hdr->frame_control) &&
 247                     !ieee80211_has_fromds(hdr->frame_control)) {
 248 -                       if (ether_addr_equal(link_sta->addr, hdr->addr3))
 249 +                       if (ether_addr_equal(rx->link_sta->addr, hdr->addr3))
 250                                 ether_addr_copy(hdr->addr3, rx->sta->addr);
 251                         else if (ether_addr_equal(link->conf->addr, hdr->addr3))
 252                                 ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);
 253 @@ -4888,6 +4884,7 @@ static void __ieee80211_rx_handle_8023(s
 254         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 255         struct ieee80211_fast_rx *fast_rx;
 256         struct ieee80211_rx_data rx;
 257 +       int link_id = -1;
 258
 259         memset(&rx, 0, sizeof(rx));
 260         rx.skb = skb;
 261 @@ -4904,12 +4901,8 @@ static void __ieee80211_rx_handle_8023(s
 262         if (!pubsta)
 263                 goto drop;
 264
 265 -       rx.sta = container_of(pubsta, struct sta_info, sta);
 266 -       rx.sdata = rx.sta->sdata;
 267 -
 268 -       if (status->link_valid &&
 269 -           !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
 270 -               goto drop;
 271 +       if (status->link_valid)
 272 +               link_id = status->link_id;
 273
 274         /*
 275          * TODO: Should the frame be dropped if the right link_id is not
 276 @@ -4918,19 +4911,8 @@ static void __ieee80211_rx_handle_8023(s
 277          * link_id is used only for stats purpose and updating the stats on
 278          * the deflink is fine?
 279          */
 280 -       if (status->link_valid)
 281 -               rx.link_id = status->link_id;
 282 -
 283 -       if (rx.link_id >= 0) {
 284 -               struct ieee80211_link_data *link;
 285 -
 286 -               link =  rcu_dereference(rx.sdata->link[rx.link_id]);
 287 -               if (!link)
 288 -                       goto drop;
 289 -               rx.link = link;
 290 -       } else {
 291 -               rx.link = &rx.sdata->deflink;
 292 -       }
 293 +       if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
 294 +               goto drop;
 295
 296         fast_rx = rcu_dereference(rx.sta->fast_rx);
 297         if (!fast_rx)
 298 @@ -4948,6 +4930,8 @@ static bool ieee80211_rx_for_interface(s
 299  {
 300         struct link_sta_info *link_sta;
 301         struct ieee80211_hdr *hdr = (void *)skb->data;
 302 +       struct sta_info *sta;
 303 +       int link_id = -1;
 304
 305         /*
 306          * Look up link station first, in case there's a
 307 @@ -4957,24 +4941,19 @@ static bool ieee80211_rx_for_interface(s
 308          */
 309         link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
 310         if (link_sta) {
 311 -               rx->sta = link_sta->sta;
 312 -               rx->link_id = link_sta->link_id;
 313 +               sta = link_sta->sta;
 314 +               link_id = link_sta->link_id;
 315         } else {
 316                 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 317
 318 -               rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
 319 -               if (rx->sta) {
 320 -                       if (status->link_valid &&
 321 -                           !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
 322 -                                                              status->link_id))
 323 -                               return false;
 324 -
 325 -                       rx->link_id = status->link_valid ? status->link_id : -1;
 326 -               } else {
 327 -                       rx->link_id = -1;
 328 -               }
 329 +               sta = sta_info_get_bss(rx->sdata, hdr->addr2);
 330 +               if (status->link_valid)
 331 +                       link_id = status->link_id;
 332         }
 333
 334 +       if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
 335 +               return false;
 336 +
 337         return ieee80211_prepare_and_rx_handle(rx, skb, consume);
 338  }
 339
 340 @@ -5033,19 +5012,15 @@ static void __ieee80211_rx_handle_packet
 341
 342         if (ieee80211_is_data(fc)) {
 343                 struct sta_info *sta, *prev_sta;
 344 -               u8 link_id = status->link_id;
 345 +               int link_id = -1;
 346
 347 -               if (pubsta) {
 348 -                       rx.sta = container_of(pubsta, struct sta_info, sta);
 349 -                       rx.sdata = rx.sta->sdata;
 350 +               if (status->link_valid)
 351 +                       link_id = status->link_id;
 352
 353 -                       if (status->link_valid &&
 354 -                           !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
 355 +               if (pubsta) {
 356 +                       if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
 357                                 goto out;
 358
 359 -                       if (status->link_valid)
 360 -                               rx.link_id = status->link_id;
 361 -
 362                         /*
 363                          * In MLO connection, fetch the link_id using addr2
 364                          * when the driver does not pass link_id in status.
 365 @@ -5063,7 +5038,7 @@ static void __ieee80211_rx_handle_packet
 366                                 if (!link_sta)
 367                                         goto out;
 368
 369 -                               rx.link_id = link_sta->link_id;
 370 +                               ieee80211_rx_data_set_link(&rx, link_sta->link_id);
 371                         }
 372
 373                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
 374 @@ -5079,30 +5054,25 @@ static void __ieee80211_rx_handle_packet
 375                                 continue;
 376                         }
 377
 378 -                       if ((status->link_valid &&
 379 -                            !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
 380 -                                                               link_id)) ||
 381 -                           (!status->link_valid && prev_sta->sta.mlo))
 382 +                       if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
 383 +                                                      link_id))
 384 +                               goto out;
 385 +
 386 +                       if (!status->link_valid && prev_sta->sta.mlo)
 387                                 continue;
 388
 389 -                       rx.link_id = status->link_valid ? link_id : -1;
 390 -                       rx.sta = prev_sta;
 391 -                       rx.sdata = prev_sta->sdata;
 392                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
 393
 394                         prev_sta = sta;
 395                 }
 396
 397                 if (prev_sta) {
 398 -                       if ((status->link_valid &&
 399 -                            !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
 400 -                                                               link_id)) ||
 401 -                           (!status->link_valid && prev_sta->sta.mlo))
 402 +                       if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
 403 +                                                      link_id))
 404                                 goto out;
 405
 406 -                       rx.link_id = status->link_valid ? link_id : -1;
 407 -                       rx.sta = prev_sta;
 408 -                       rx.sdata = prev_sta->sdata;
 409 +                       if (!status->link_valid && prev_sta->sta.mlo)
 410 +                               goto out;
 411
 412                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
 413                                 return;