package/kernel/mac80211/patches/subsys/307-v6.2-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Tue, 13 Dec 2022 21:03:19 +0100
   3 Subject: [PATCH] wifi: mac80211: fix initialization of rx->link and
   4  rx->link_sta
   5
   6 There are some codepaths that do not initialize rx->link_sta properly. This
   7 causes a crash in places which assume that rx->link_sta is valid if rx->sta
   8 is valid.
   9 One known instance is triggered by __ieee80211_rx_h_amsdu being called from
  10 fast-rx.
  11
  12 Since the initialization of rx->link and rx->link_sta is rather convoluted
  13 and duplicated in many places, clean it up by using a helper function to
  14 set it.
  15
  16 Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
  17 Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
  18 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  19 ---
  20
  21 --- a/net/mac80211/rx.c
  22 +++ b/net/mac80211/rx.c
  23 @@ -4067,6 +4067,58 @@ static void ieee80211_invoke_rx_handlers
  24  #undef CALL_RXH
  25  }
  26
  27 +static bool
  28 +ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
  29 +{
  30 +       if (!sta->mlo)
  31 +               return false;
  32 +
  33 +       return !!(sta->valid_links & BIT(link_id));
  34 +}
  35 +
  36 +static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
  37 +                                      u8 link_id)
  38 +{
  39 +       rx->link_id = link_id;
  40 +       rx->link = rcu_dereference(rx->sdata->link[link_id]);
  41 +
  42 +       if (!rx->sta || !rx->sta->sta.mlo)
  43 +               return rx->link;
  44 +
  45 +       if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
  46 +               return false;
  47 +
  48 +       rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
  49 +
  50 +       return rx->link && rx->link_sta;
  51 +}
  52 +
  53 +static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
  54 +                                     struct ieee80211_sta *pubsta,
  55 +                                     int link_id)
  56 +{
  57 +       struct sta_info *sta;
  58 +
  59 +       sta = container_of(pubsta, struct sta_info, sta);
  60 +
  61 +       rx->link_id = link_id;
  62 +       rx->sta = sta;
  63 +
  64 +       if (sta) {
  65 +               rx->local = sta->sdata->local;
  66 +               if (!rx->sdata)
  67 +                       rx->sdata = sta->sdata;
  68 +               rx->link_sta = &sta->deflink;
  69 +       }
  70 +
  71 +       if (link_id < 0)
  72 +               rx->link = &rx->sdata->deflink;
  73 +       else if (!ieee80211_rx_data_set_link(rx, link_id))
  74 +               return false;
  75 +
  76 +       return true;
  77 +}
  78 +
  79  /*
  80   * This function makes calls into the RX path, therefore
  81   * it has to be invoked under RCU read lock.
  82 @@ -4075,16 +4127,19 @@ void ieee80211_release_reorder_timeout(s
  83  {
  84         struct sk_buff_head frames;
  85         struct ieee80211_rx_data rx = {
  86 -               .sta = sta,
  87 -               .sdata = sta->sdata,
  88 -               .local = sta->local,
  89                 /* This is OK -- must be QoS data frame */
  90                 .security_idx = tid,
  91                 .seqno_idx = tid,
  92 -               .link_id = -1,
  93         };
  94         struct tid_ampdu_rx *tid_agg_rx;
  95 -       u8 link_id;
  96 +       int link_id = -1;
  97 +
  98 +       /* FIXME: statistics won't be right with this */
  99 +       if (sta->sta.valid_links)
 100 +               link_id = ffs(sta->sta.valid_links) - 1;
 101 +
 102 +       if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
 103 +               return;
 104
 105         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 106         if (!tid_agg_rx)
 107 @@ -4104,10 +4159,6 @@ void ieee80211_release_reorder_timeout(s
 108                 };
 109                 drv_event_callback(rx.local, rx.sdata, &event);
 110         }
 111 -       /* FIXME: statistics won't be right with this */
 112 -       link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
 113 -       rx.link = rcu_dereference(sta->sdata->link[link_id]);
 114 -       rx.link_sta = rcu_dereference(sta->link[link_id]);
 115
 116         ieee80211_rx_handlers(&rx, &frames);
 117  }
 118 @@ -4123,7 +4174,6 @@ void ieee80211_mark_rx_ba_filtered_frame
 119                 /* This is OK -- must be QoS data frame */
 120                 .security_idx = tid,
 121                 .seqno_idx = tid,
 122 -               .link_id = -1,
 123         };
 124         int i, diff;
 125
 126 @@ -4134,10 +4184,8 @@ void ieee80211_mark_rx_ba_filtered_frame
 127
 128         sta = container_of(pubsta, struct sta_info, sta);
 129
 130 -       rx.sta = sta;
 131 -       rx.sdata = sta->sdata;
 132 -       rx.link = &rx.sdata->deflink;
 133 -       rx.local = sta->local;
 134 +       if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
 135 +               return;
 136
 137         rcu_read_lock();
 138         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 139 @@ -4524,15 +4572,6 @@ void ieee80211_check_fast_rx_iface(struc
 140         mutex_unlock(&local->sta_mtx);
 141  }
 142
 143 -static bool
 144 -ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
 145 -{
 146 -       if (!sta->mlo)
 147 -               return false;
 148 -
 149 -       return !!(sta->valid_links & BIT(link_id));
 150 -}
 151 -
 152  static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
 153                               struct ieee80211_fast_rx *fast_rx,
 154                               int orig_len)
 155 @@ -4643,7 +4682,6 @@ static bool ieee80211_invoke_fast_rx(str
 156         struct sk_buff *skb = rx->skb;
 157         struct ieee80211_hdr *hdr = (void *)skb->data;
 158         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 159 -       struct sta_info *sta = rx->sta;
 160         int orig_len = skb->len;
 161         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 162         int snap_offs = hdrlen;
 163 @@ -4655,7 +4693,6 @@ static bool ieee80211_invoke_fast_rx(str
 164                 u8 da[ETH_ALEN];
 165                 u8 sa[ETH_ALEN];
 166         } addrs __aligned(2);
 167 -       struct link_sta_info *link_sta;
 168         struct ieee80211_sta_rx_stats *stats;
 169
 170         /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
 171 @@ -4758,18 +4795,10 @@ static bool ieee80211_invoke_fast_rx(str
 172   drop:
 173         dev_kfree_skb(skb);
 174
 175 -       if (rx->link_id >= 0) {
 176 -               link_sta = rcu_dereference(sta->link[rx->link_id]);
 177 -               if (!link_sta)
 178 -                       return true;
 179 -       } else {
 180 -               link_sta = &sta->deflink;
 181 -       }
 182 -
 183         if (fast_rx->uses_rss)
 184 -               stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
 185 +               stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
 186         else
 187 -               stats = &link_sta->rx_stats;
 188 +               stats = &rx->link_sta->rx_stats;
 189
 190         stats->dropped++;
 191         return true;
 192 @@ -4787,8 +4816,8 @@ static bool ieee80211_prepare_and_rx_han
 193         struct ieee80211_local *local = rx->local;
 194         struct ieee80211_sub_if_data *sdata = rx->sdata;
 195         struct ieee80211_hdr *hdr = (void *)skb->data;
 196 -       struct link_sta_info *link_sta = NULL;
 197 -       struct ieee80211_link_data *link;
 198 +       struct link_sta_info *link_sta = rx->link_sta;
 199 +       struct ieee80211_link_data *link = rx->link;
 200
 201         rx->skb = skb;
 202
 203 @@ -4810,35 +4839,6 @@ static bool ieee80211_prepare_and_rx_han
 204         if (!ieee80211_accept_frame(rx))
 205                 return false;
 206
 207 -       if (rx->link_id >= 0) {
 208 -               link = rcu_dereference(rx->sdata->link[rx->link_id]);
 209 -
 210 -               /* we might race link removal */
 211 -               if (!link)
 212 -                       return true;
 213 -               rx->link = link;
 214 -
 215 -               if (rx->sta) {
 216 -                       rx->link_sta =
 217 -                               rcu_dereference(rx->sta->link[rx->link_id]);
 218 -                       if (!rx->link_sta)
 219 -                               return true;
 220 -               }
 221 -       } else {
 222 -               if (rx->sta)
 223 -                       rx->link_sta = &rx->sta->deflink;
 224 -
 225 -               rx->link = &sdata->deflink;
 226 -       }
 227 -
 228 -       if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
 229 -                    rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
 230 -               link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
 231 -
 232 -               if (WARN_ON_ONCE(!link_sta))
 233 -                       return true;
 234 -       }
 235 -
 236         if (!consume) {
 237                 struct skb_shared_hwtstamps *shwt;
 238
 239 @@ -4858,7 +4858,7 @@ static bool ieee80211_prepare_and_rx_han
 240                 shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
 241         }
 242
 243 -       if (unlikely(link_sta)) {
 244 +       if (unlikely(rx->sta && rx->sta->sta.mlo)) {
 245                 /* translate to MLD addresses */
 246                 if (ether_addr_equal(link->conf->addr, hdr->addr1))
 247                         ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
 248 @@ -4888,6 +4888,7 @@ static void __ieee80211_rx_handle_8023(s
 249         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 250         struct ieee80211_fast_rx *fast_rx;
 251         struct ieee80211_rx_data rx;
 252 +       int link_id = -1;
 253
 254         memset(&rx, 0, sizeof(rx));
 255         rx.skb = skb;
 256 @@ -4904,12 +4905,8 @@ static void __ieee80211_rx_handle_8023(s
 257         if (!pubsta)
 258                 goto drop;
 259
 260 -       rx.sta = container_of(pubsta, struct sta_info, sta);
 261 -       rx.sdata = rx.sta->sdata;
 262 -
 263 -       if (status->link_valid &&
 264 -           !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
 265 -               goto drop;
 266 +       if (status->link_valid)
 267 +               link_id = status->link_id;
 268
 269         /*
 270          * TODO: Should the frame be dropped if the right link_id is not
 271 @@ -4918,19 +4915,8 @@ static void __ieee80211_rx_handle_8023(s
 272          * link_id is used only for stats purpose and updating the stats on
 273          * the deflink is fine?
 274          */
 275 -       if (status->link_valid)
 276 -               rx.link_id = status->link_id;
 277 -
 278 -       if (rx.link_id >= 0) {
 279 -               struct ieee80211_link_data *link;
 280 -
 281 -               link =  rcu_dereference(rx.sdata->link[rx.link_id]);
 282 -               if (!link)
 283 -                       goto drop;
 284 -               rx.link = link;
 285 -       } else {
 286 -               rx.link = &rx.sdata->deflink;
 287 -       }
 288 +       if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
 289 +               goto drop;
 290
 291         fast_rx = rcu_dereference(rx.sta->fast_rx);
 292         if (!fast_rx)
 293 @@ -4948,6 +4934,8 @@ static bool ieee80211_rx_for_interface(s
 294  {
 295         struct link_sta_info *link_sta;
 296         struct ieee80211_hdr *hdr = (void *)skb->data;
 297 +       struct sta_info *sta;
 298 +       int link_id = -1;
 299
 300         /*
 301          * Look up link station first, in case there's a
 302 @@ -4957,24 +4945,19 @@ static bool ieee80211_rx_for_interface(s
 303          */
 304         link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
 305         if (link_sta) {
 306 -               rx->sta = link_sta->sta;
 307 -               rx->link_id = link_sta->link_id;
 308 +               sta = link_sta->sta;
 309 +               link_id = link_sta->link_id;
 310         } else {
 311                 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 312
 313 -               rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
 314 -               if (rx->sta) {
 315 -                       if (status->link_valid &&
 316 -                           !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
 317 -                                                              status->link_id))
 318 -                               return false;
 319 -
 320 -                       rx->link_id = status->link_valid ? status->link_id : -1;
 321 -               } else {
 322 -                       rx->link_id = -1;
 323 -               }
 324 +               sta = sta_info_get_bss(rx->sdata, hdr->addr2);
 325 +               if (status->link_valid)
 326 +                       link_id = status->link_id;
 327         }
 328
 329 +       if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
 330 +               return false;
 331 +
 332         return ieee80211_prepare_and_rx_handle(rx, skb, consume);
 333  }
 334
 335 @@ -5033,19 +5016,15 @@ static void __ieee80211_rx_handle_packet
 336
 337         if (ieee80211_is_data(fc)) {
 338                 struct sta_info *sta, *prev_sta;
 339 -               u8 link_id = status->link_id;
 340 +               int link_id = -1;
 341
 342 -               if (pubsta) {
 343 -                       rx.sta = container_of(pubsta, struct sta_info, sta);
 344 -                       rx.sdata = rx.sta->sdata;
 345 +               if (status->link_valid)
 346 +                       link_id = status->link_id;
 347
 348 -                       if (status->link_valid &&
 349 -                           !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
 350 +               if (pubsta) {
 351 +                       if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
 352                                 goto out;
 353
 354 -                       if (status->link_valid)
 355 -                               rx.link_id = status->link_id;
 356 -
 357                         /*
 358                          * In MLO connection, fetch the link_id using addr2
 359                          * when the driver does not pass link_id in status.
 360 @@ -5063,7 +5042,7 @@ static void __ieee80211_rx_handle_packet
 361                                 if (!link_sta)
 362                                         goto out;
 363
 364 -                               rx.link_id = link_sta->link_id;
 365 +                               ieee80211_rx_data_set_link(&rx, link_sta->link_id);
 366                         }
 367
 368                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
 369 @@ -5079,30 +5058,27 @@ static void __ieee80211_rx_handle_packet
 370                                 continue;
 371                         }
 372
 373 -                       if ((status->link_valid &&
 374 -                            !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
 375 -                                                               link_id)) ||
 376 -                           (!status->link_valid && prev_sta->sta.mlo))
 377 +                       rx.sdata = prev_sta->sdata;
 378 +                       if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
 379 +                                                      link_id))
 380 +                               goto out;
 381 +
 382 +                       if (!status->link_valid && prev_sta->sta.mlo)
 383                                 continue;
 384
 385 -                       rx.link_id = status->link_valid ? link_id : -1;
 386 -                       rx.sta = prev_sta;
 387 -                       rx.sdata = prev_sta->sdata;
 388                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
 389
 390                         prev_sta = sta;
 391                 }
 392
 393                 if (prev_sta) {
 394 -                       if ((status->link_valid &&
 395 -                            !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
 396 -                                                               link_id)) ||
 397 -                           (!status->link_valid && prev_sta->sta.mlo))
 398 +                       rx.sdata = prev_sta->sdata;
 399 +                       if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
 400 +                                                      link_id))
 401                                 goto out;
 402
 403 -                       rx.link_id = status->link_valid ? link_id : -1;
 404 -                       rx.sta = prev_sta;
 405 -                       rx.sdata = prev_sta->sdata;
 406 +                       if (!status->link_valid && prev_sta->sta.mlo)
 407 +                               goto out;
 408
 409                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
 410                                 return;