Skip to content

GitLab

Switch branch/tag
  1. 22 Dec, 2021 2 commits
  3. 31 Jul, 2019 1 commit
  5. 29 Jul, 2019 1 commit
  7. 19 Jun, 2019 1 commit
  9. 18 Jun, 2018 2 commits
  11. 27 Feb, 2018 1 commit
  13. 19 Feb, 2018 1 commit
  15. 11 Dec, 2017 2 commits
  17. 20 Nov, 2017 1 commit
    • Kees Cook's avatar
      mac80211: aggregation: Convert timers to use timer_setup() · 7cca2acd
      Kees Cook authored 
      
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

This removes the tid mapping array and expands the tid structures to
add a pointer back to the station, along with the tid index itself.

Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
[switch tid variables to u8, the valid range is 0-15 at most,
 initialize tid_tx->sta/tid properly]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      7cca2acd
  19. 21 Sep, 2017 1 commit
  21. 06 Sep, 2017 1 commit
    • Johannes Berg's avatar
      mac80211: fix deadlock in driver-managed RX BA session start · bde59c47
      Johannes Berg authored 
      When an RX BA session is started by the driver, and it has to tell
mac80211 about it, the corresponding bit in tid_rx_manage_offl gets
set and the BA session work is scheduled. Upon testing this bit, it
will call __ieee80211_start_rx_ba_session(), thus deadlocking as it
already holds the ampdu_mlme.mtx, which that acquires again.

Fix this by adding ___ieee80211_start_rx_ba_session(), a version of
the function that requires the mutex already held.

Cc: stable@vger.kernel.org
Fixes: 699cb58c

 ("mac80211: manage RX BA session offload without SKB queue")
Reported-by: default avatarMatteo Croce <mcroce@redhat.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      bde59c47
  23. 09 Aug, 2017 1 commit
  25. 16 Jun, 2017 1 commit
    • Johannes Berg's avatar
      networking: convert many more places to skb_put_zero() · b080db58
      Johannes Berg authored 
      
There were many places that my previous spatch didn't find,
as pointed out by yuan linyu in various patches.

The following spatch found many more and also removes the
now unnecessary casts:

    @@
    identifier p, p2;
    expression len;
    expression skb;
    type t, t2;
    @@
    (
    -p = skb_put(skb, len);
    +p = skb_put_zero(skb, len);
    |
    -p = (t)skb_put(skb, len);
    +p = skb_put_zero(skb, len);
    )
    ... when != p
    (
    p2 = (t2)p;
    -memset(p2, 0, len);
    |
    -memset(p, 0, len);
    )

    @@
    type t, t2;
    identifier p, p2;
    expression skb;
    @@
    t *p;
    ...
    (
    -p = skb_put(skb, sizeof(t));
    +p = skb_put_zero(skb, sizeof(t));
    |
    -p = (t *)skb_put(skb, sizeof(t));
    +p = skb_put_zero(skb, sizeof(t));
    )
    ... when != p
    (
    p2 = (t2)p;
    -memset(p2, 0, sizeof(*p));
    |
    -memset(p, 0, sizeof(*p));
    )

    @@
    expression skb, len;
    @@
    -memset(skb_put(skb, len), 0, len);
    +skb_put_zero(skb, len);

Apply it to the tree (with one manual fixup to keep the
comment in vxlan.c, which spatch removed.)
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b080db58
  27. 08 Jun, 2017 1 commit
    • Johannes Berg's avatar
      mac80211: manage RX BA session offload without SKB queue · 699cb58c
      Johannes Berg authored 
      
Instead of using the SKB queue with the fake pkt_type for the
offloaded RX BA session management, also handle this with the
normal aggregation state machine worker. This also makes the
use of this more reliable since it gets rid of the allocation
of the fake skb.

Combined with the previous patch, this finally allows us to
get rid of the pkt_type hack entirely, so do that as well.
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      699cb58c
  29. 06 Mar, 2017 1 commit
  31. 27 Feb, 2017 2 commits
  33. 19 Oct, 2016 1 commit
    • Johannes Berg's avatar
      mac80211: fix tid_agg_rx NULL dereference · 1c3d185a
      Johannes Berg authored 
      On drivers setting the SUPPORTS_REORDERING_BUFFER hardware flag,
we crash when the peer sends an AddBA request while we already
have a session open on the seame TID; this is because on those
drivers, the tid_agg_rx is left NULL even though the session is
valid, and the agg_session_valid bit is set.

To fix this, store the dialog tokens outside the tid_agg_rx to
be able to compare them to the received AddBA request.

Fixes: f89e07d4

 ("mac80211: agg-rx: refuse ADDBA Request with timeout update")
Reported-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      1c3d185a
  35. 15 Sep, 2016 1 commit
    • Johannes Berg's avatar
      mac80211: reject TSPEC TIDs (TSIDs) for aggregation · 85d5313e
      Johannes Berg authored 
      
Since mac80211 doesn't currently support TSIDs 8-15 which can
only be used after QoS TSPEC negotiation (and not even after
WMM negotiation), reject attempts to set up aggregation
sessions for them, which might confuse drivers. In mac80211
we do correctly handle that, but the TSIDs should never get
used anyway, and drivers might not be able to handle it.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      85d5313e
  37. 12 Sep, 2016 2 commits
    • Johannes Berg's avatar
      mac80211: send delBA on unexpected BlockAck data frames · bfe40fa3
      Johannes Berg authored 
      
When we receive data frames with ACK policy BlockAck, send
delBA as requested by the 802.11 spec. Since this would be
happening for every frame inside an A-MPDU if it's really
received outside a session, limit it to a single attempt.
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      bfe40fa3
    • Maxim Altshul's avatar
      mac80211: RX BA support for sta max_rx_aggregation_subframes · 480dd46b
      Maxim Altshul authored 
      
The ability to change the max_rx_aggregation frames is useful
in cases of IOP.

There exist some devices (latest mobile phones and some AP's)
that tend to not respect a BA sessions maximum size (in Kbps).
These devices won't respect the AMPDU size that was negotiated during
association (even though they do respect the maximal number of packets).

This violation is characterized by a valid number of packets in
a single AMPDU. Even so, the total size will exceed the size negotiated
during association.

Eventually, this will cause some undefined behavior, which in turn
causes the hw to drop packets, causing the throughput to plummet.

This patch will make the subframe limitation to be held by each station,
instead of being held only by hw.
Signed-off-by: default avatarMaxim Altshul <maxim.altshul@ti.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      480dd46b
  39. 06 Jul, 2016 1 commit
    • Johannes Berg's avatar
      mac80211: agg-rx: refuse ADDBA Request with timeout update · f89e07d4
      Johannes Berg authored 
      
The current implementation of handling ADDBA Request while a session
is already active with the peer is wrong - in case the peer is using
the existing session's dialog token this should be treated as update
to the session, which can update the timeout value.

We don't really have a good way of supporting that, so reject, but
implement the required behaviour in the spec of "Even if the updated
ADDBA Request frame is not accepted, the original Block ACK setup
remains active." (802.11-2012 10.5.4)
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      f89e07d4
  41. 24 Feb, 2016 2 commits
  43. 29 Jan, 2016 1 commit
    • Chris Bainbridge's avatar
      mac80211: fix use of uninitialised values in RX aggregation · f39ea269
      Chris Bainbridge authored 
      Use kzalloc instead of kmalloc for struct tid_ampdu_rx to
initialize the "removed" field (all others are initialized
manually). That fixes:

UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
load of value 2 is not a valid value for type '_Bool'
CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
Workqueue: phy0 rt2x00usb_work_rxdone
 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
 ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
 ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
Call Trace:
 [<ffffffff8181d866>] dump_stack+0x45/0x5f
 [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
 [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
 [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
 [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
 [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
 [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990

While at it, convert to use sizeof(*tid_agg_rx) instead.

Fixes: 788211d8

 ("mac80211: fix RX A-MPDU session reorder timer deletion")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarChris Bainbridge <chris.bainbridge@gmail.com>
[reword commit message, use sizeof(*tid_agg_rx)]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      f39ea269
  45. 14 Jan, 2016 2 commits
  47. 22 Sep, 2015 2 commits
  49. 01 Apr, 2015 1 commit
    • Johannes Berg's avatar
      mac80211: fix RX A-MPDU session reorder timer deletion · 788211d8
      Johannes Berg authored 
      
There's an issue with the way the RX A-MPDU reorder timer is
deleted that can cause a kernel crash like this:

 * tid_rx is removed - call_rcu(ieee80211_free_tid_rx)
 * station is destroyed
 * reorder timer fires before ieee80211_free_tid_rx() runs,
   accessing the station, thus potentially crashing due to
   the use-after-free

The station deletion is protected by synchronize_net(), but
that isn't enough -- ieee80211_free_tid_rx() need not have
run when that returns (it deletes the timer.) We could use
rcu_barrier() instead of synchronize_net(), but that's much
more expensive.

Instead, to fix this, add a field tracking that the session
is being deleted. In this case, the only re-arming of the
timer happens with the reorder spinlock held, so make that
code not rearm it if the session is being deleted and also
delete the timer after setting that field. This ensures the
timer cannot fire after ___ieee80211_stop_rx_ba_session()
returns, which fixes the problem.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      788211d8
  51. 30 Mar, 2015 1 commit
    • Johannes Berg's avatar
      mac80211: reject aggregation sessions with non-HT peers · 8f9c77fc
      Johannes Berg authored 
      
If a peer or some local agent (rate control, ...) decides to start
an aggregation session but doesn't support HT (which also implies
QoS), reject it.

This is mostly a corner case as such peers normally won't try to
use block-ack sessions and rate control wouldn't start them, but
technically QoS stations could request it according to the spec.

However, since drivers don't really support such non-HT sessions
it's better to reject them.

Also, while at it, move the tracing for TX sessions earlier so it
captures the error cases as well.
Reviewed-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      8f9c77fc
  53. 03 Sep, 2014 1 commit
    • Michal Kazior's avatar
      mac80211: fix offloaded BA session traffic after hw restart · 4549cf2b
      Michal Kazior authored 
      
When starting an offloaded BA session it is
unknown what starting sequence number should be
used. Using last_seq worked in most cases except
after hw restart.

When hw restart is requested last_seq is
(rightfully so) kept unmodified. This ended up
with BA sessions being restarted with an aribtrary
BA window values resulting in dropped frames until
sequence numbers caught up.

Instead of last_seq pick seqno of a first Rxed
frame of a given BA session.

This fixes stalled traffic after hw restart with
offloaded BA sessions (currently only ath10k).
Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      4549cf2b
  55. 21 Jul, 2014 2 commits
  57. 18 Jan, 2013 1 commit
  59. 19 Nov, 2012 1 commit
  61. 24 Jun, 2012 1 commit
    • Johannes Berg's avatar
      mac80211: clean up debugging · bdcbd8e0
      Johannes Berg authored 
      
There are a few things that make the logging and
debugging in mac80211 less useful than it should
be right now:
 * a lot of messages should be pr_info, not pr_debug
 * wholesale use of pr_debug makes it require *both*
   Kconfig and dynamic configuration
 * there are still a lot of ifdefs
 * the style is very inconsistent, sometimes the
   sdata->name is printed in front

Clean up everything, introducing new macros and
separating out the station MLME debugging into
a new Kconfig symbol.
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      bdcbd8e0