linux-stable.git/net/mac80211, branch linux-4.6.y

mac80211: Fix mesh estab_plinks counting in STA removal case

2016-07-27T15:42:07+00:00

commit 126e7557328a1cd576be4fca95b133a2695283ff upstream.

If a user space program (e.g., wpa_supplicant) deletes a STA entry that
is currently in NL80211_PLINK_ESTAB state, the number of established
plinks counter was not decremented and this could result in rejecting
new plink establishment before really hitting the real maximum plink
limit. For !user_mpm case, this decrementation is handled by
mesh_plink_deactive().

Fix this by decrementing estab_plinks on STA deletion
(mesh_sta_cleanup() gets called from there) so that the counter has a
correct value and the Beacon frame advertisement in Mesh Configuration
element shows the proper value for capability to accept additional
peers.

Signed-off-by: Jouni Malinen 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: mesh: flush mesh paths unconditionally

2016-07-27T15:42:07+00:00

commit fe7a7c57629e8dcbc0e297363a9b2366d67a6dc5 upstream.

Currently, the mesh paths associated with a nexthop station are cleaned
up in the following code path:

    __sta_info_destroy_part1
    synchronize_net()
    __sta_info_destroy_part2
     -> cleanup_single_sta
       -> mesh_sta_cleanup
         -> mesh_plink_deactivate
           -> mesh_path_flush_by_nexthop

However, there are a couple of problems here:

1) the paths aren't flushed at all if the MPM is running in userspace
   (e.g. when using wpa_supplicant or authsae)

2) there is no synchronize_rcu between removing the path and readers
   accessing the nexthop, which means the following race is possible:

CPU0                            CPU1
~~~~                            ~~~~
                                sta_info_destroy_part1()
                                synchronize_net()
rcu_read_lock()
mesh_nexthop_resolve()
  mpath = mesh_path_lookup()
                                [...] -> mesh_path_flush_by_nexthop()
  sta = rcu_dereference(
    mpath->next_hop)
                                kfree(sta)
  access sta <-- CRASH

Fix both of these by unconditionally flushing paths before destroying
the sta, and by adding a synchronize_net() after path flush to ensure
no active readers can still dereference the sta.

Fixes this crash:

[  348.529295] BUG: unable to handle kernel paging request at 00020040
[  348.530014] IP: [] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
[  348.530014] *pde = 00000000
[  348.530014] Oops: 0000 [#1] PREEMPT
[  348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ]
[  348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G           O 4.6.0-rc5-wt=V1 #1
[  348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016  11/07/2014
[  348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000
[  348.530014] EIP: 0060:[] EFLAGS: 00010246 CPU: 0
[  348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
[  348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008
[  348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40
[  348.530014]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[  348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690
[  348.530014] Stack:
[  348.530014]  00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0
[  348.530014]  f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320
[  348.530014]  f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1
[  348.530014] Call Trace:
[  348.530014]  [] mesh_nexthop_lookup+0xbb/0xc8 [mac80211]
[  348.530014]  [] mesh_nexthop_resolve+0x34/0xd8 [mac80211]
[  348.530014]  [] ieee80211_xmit+0x92/0xc1 [mac80211]
[  348.530014]  [] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211]
[  348.530014]  [] ? sch_direct_xmit+0xd7/0x1b3
[  348.530014]  [] ? __local_bh_enable_ip+0x5d/0x7b
[  348.530014]  [] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4]
[  348.530014]  [] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat]
[  348.530014]  [] ? netif_skb_features+0x14d/0x30a
[  348.530014]  [] ieee80211_subif_start_xmit+0xa/0xe [mac80211]
[  348.530014]  [] dev_hard_start_xmit+0x1f8/0x267
[  348.530014]  [] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
[  348.530014]  [] sch_direct_xmit+0x8b/0x1b3
[  348.530014]  [] __dev_queue_xmit+0x2c8/0x513
[  348.530014]  [] dev_queue_xmit+0xa/0xc
[  348.530014]  [] batadv_send_skb_packet+0xd6/0xec [batman_adv]
[  348.530014]  [] batadv_send_unicast_skb+0x15/0x4a [batman_adv]
[  348.530014]  [] batadv_dat_send_data+0x27e/0x310 [batman_adv]
[  348.530014]  [] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv]
[  348.530014]  [] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv]
[  348.530014]  [] batadv_interface_tx+0x206/0x385 [batman_adv]
[  348.530014]  [] dev_hard_start_xmit+0x1f8/0x267
[  348.530014]  [] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
[  348.530014]  [] sch_direct_xmit+0x8b/0x1b3
[  348.530014]  [] __dev_queue_xmit+0x2c8/0x513
[  348.530014]  [] ? igb_xmit_frame+0x57/0x72 [igb]
[  348.530014]  [] dev_queue_xmit+0xa/0xc
[  348.530014]  [] br_dev_queue_push_xmit+0xeb/0xfb [bridge]
[  348.530014]  [] br_forward_finish+0x29/0x74 [bridge]
[  348.530014]  [] ? deliver_clone+0x3b/0x3b [bridge]
[  348.530014]  [] __br_forward+0x89/0xe7 [bridge]
[  348.530014]  [] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge]
[  348.530014]  [] deliver_clone+0x34/0x3b [bridge]
[  348.530014]  [] ? br_flood+0x95/0x95 [bridge]
[  348.530014]  [] br_flood+0x77/0x95 [bridge]
[  348.530014]  [] br_flood_forward+0x13/0x1a [bridge]
[  348.530014]  [] ? br_flood+0x95/0x95 [bridge]
[  348.530014]  [] br_handle_frame_finish+0x392/0x3db [bridge]
[  348.530014]  [] ? nf_iterate+0x2b/0x6b
[  348.530014]  [] br_handle_frame+0x1e6/0x240 [bridge]
[  348.530014]  [] ? br_handle_local_finish+0x6a/0x6a [bridge]
[  348.530014]  [] __netif_receive_skb_core+0x43a/0x66b
[  348.530014]  [] ? br_handle_frame_finish+0x3db/0x3db [bridge]
[  348.530014]  [] ? resched_curr+0x19/0x37
[  348.530014]  [] ? check_preempt_wakeup+0xbf/0xfe
[  348.530014]  [] ? ktime_get_with_offset+0x5c/0xfc
[  348.530014]  [] __netif_receive_skb+0x47/0x55
[  348.530014]  [] netif_receive_skb_internal+0x40/0x5a
[  348.530014]  [] napi_gro_receive+0x3a/0x94
[  348.530014]  [] igb_poll+0x6fd/0x9ad [igb]
[  348.530014]  [] ? swake_up_locked+0x14/0x26
[  348.530014]  [] net_rx_action+0xde/0x250
[  348.530014]  [] __do_softirq+0x8a/0x163
[  348.530014]  [] ? __hrtimer_tasklet_trampoline+0x19/0x19
[  348.530014]  [] do_softirq_own_stack+0x26/0x2c
[  348.530014]  
[  348.530014]  [] irq_exit+0x31/0x6f
[  348.530014]  [] do_IRQ+0x8d/0xa0
[  348.530014]  [] common_interrupt+0x2c/0x40
[  348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005
[  348.530014] EIP: [] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40
[  348.530014] CR2: 0000000000020040
[  348.530014] ---[ end trace 48556ac26779732e ]---
[  348.530014] Kernel panic - not syncing: Fatal exception in interrupt
[  348.530014] Kernel Offset: disabled

Reported-by: Fred Veldini 
Tested-by: Fred Veldini 
Signed-off-by: Bob Copeland 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix fast_tx header alignment

2016-07-27T15:42:07+00:00

commit 6fe04128f158c5ad27e7504bfdf1b12e63331bc9 upstream.

The header field is defined as u8[] but also accessed as struct
ieee80211_hdr. Enforce an alignment of 2 to prevent unnecessary
unaligned accesses, which can be very harmful for performance on many
platforms.

Fixes: e495c24731a2 ("mac80211: extend fast-xmit for more ciphers")
Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix statistics leak if dev_alloc_name() fails

2016-04-27T08:06:58+00:00

In the case that dev_alloc_name() fails, e.g. because the name was
given by the user and already exists, we need to clean up properly
and free the per-CPU statistics. Fix that.

Cc: stable@vger.kernel.org
Fixes: 5a490510ba5f ("mac80211: use per-CPU TX/RX statistics")
Signed-off-by: Johannes Berg

mac80211: fix "warning: ‘target_metric’ may be used uninitialized"

2016-04-06T13:10:25+00:00

This fixes:

net/mac80211/mesh_hwmp.c:603:26: warning: ‘target_metric’ may be used uninitialized in this function

target_metric is only consumed when reply = true so no bug exists here,
but not all versions of gcc realize it.  Initialize to 0 to remove the
warning.

Signed-off-by: Jeff Mahoney 
Signed-off-by: Johannes Berg

mac80211: close the SP when we enqueue frames during the SP

2016-04-05T09:33:49+00:00

Since we enqueued the frame that was supposed to be sent
during the SP, and that frame may very well cary the
IEEE80211_TX_STATUS_EOSP bit, we may never close the SP
(WLAN_STA_SP will never be cleared). If that happens, we
will not open any new SP and will never respond to any poll
frame from the client.
Clear WLAN_STA_SP manually if a frame that was polled during
the SP is queued because of a starting A-MPDU session. The
client may not see the EOSP bit, but it will at least be
able to poll new frames in another SP.

Reported-by: Alesya Shapira 
Signed-off-by: Emmanuel Grumbach 
[remove erroneous comment]
Signed-off-by: Johannes Berg

mac80211: Fix BW upgrade for TDLS peers

2016-04-05T09:26:33+00:00

It is possible that the station is connected to an AP
with bandwidth of 80+80MHz or 160MHz. In such cases
there is no need to perform an upgrade as the maximal
supported bandwidth is 80MHz.

In addition, when upgrading and setting center_freq1
and bandwidth to 80MHz also set center_freq2 to 0.

Fixes: 0fabfaafec3a ("mac80211: upgrade BW of TDLS peers when possible"
Signed-off-by: Ilan Peer 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg

mac80211: don't send deferred frames outside the SP

2016-04-05T09:16:50+00:00

Frames that are sent between
ampdu_action(IEEE80211_AMPDU_TX_START) and the move to the
HT_AGG_STATE_OPERATIONAL state are buffered.
If we try to start an A-MPDU session while the peer is
sleeping and polling frames with U-APSD, we may have frames
that will be buffered by ieee80211_tx_prep_agg. These frames
have IEEE80211_TX_CTL_NO_PS_BUFFER set since they are sent to
a sleeping client and possibly IEEE80211_TX_STATUS_EOSP.
If the frame is buffered, we need clear these two flags
since they will be re-sent after the move to
HT_AGG_STATE_OPERATIONAL state which is very likely to
happen after the SP ends.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg

mac80211: remove description of dropped member

2016-04-05T09:12:09+00:00

Commit 976bd9efdae6 ("mac80211: move beacon_loss_count into ifmgd")
removed the member from the sta_info struct but the description stayed
lingering. Remove it.

Signed-off-by: Luis de Bethencourt 
Signed-off-by: Johannes Berg

mac80211: ensure no limits on station rhashtable

2016-04-05T09:06:58+00:00

By default, the rhashtable logic will fail to insert
objects if the key-chains are too long and un-balanced.

In the degenerate case where mac80211 is creating many
virtual interfaces connected to the same peer(s), this
case can happen.

St insecure_elasticity to true to allow chains to grow
as long as needed.

Signed-off-by: Ben Greear 
[remove message, change commit message slightly]
Signed-off-by: Johannes Berg