linux-stable.git/net/mac80211, branch v3.18.40

mac80211: fix unnecessary frame drops in mesh fwding

2016-07-12T12:47:45+00:00

[ Upstream commit cf44012810ccdd8fd947518e965cb04b7b8498be ]

The ieee80211_queue_stopped() expects hw queue
number but it was given raw WMM AC number instead.

This could cause frame drops and problems with
traffic in some cases - most notably if driver
doesn't map AC numbers to queue numbers 1:1 and
uses ieee80211_stop_queues() and
ieee80211_wake_queue() only without ever calling
ieee80211_wake_queues().

On ath10k it was possible to hit this problem in
the following case:

  1. wlan0 uses queue 0
     (ath10k maps queues per vif)
  2. offchannel uses queue 15
  3. queues 1-14 are unused
  4. ieee80211_stop_queues()
  5. ieee80211_wake_queue(q=0)
  6. ieee80211_wake_queue(q=15)
     (other queues are not woken up because both
      driver and mac80211 know other queues are
      unused)
  7. ieee80211_rx_h_mesh_fwding()
  8. ieee80211_select_queue_80211() returns 2
  9. ieee80211_queue_stopped(q=2) returns true
 10. frame is dropped (oops!)

Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping")
Signed-off-by: Michal Kazior 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: mesh: flush mesh paths unconditionally

2016-06-20T03:47:41+00:00

[ Upstream commit fe7a7c57629e8dcbc0e297363a9b2366d67a6dc5 ]

Currently, the mesh paths associated with a nexthop station are cleaned
up in the following code path:

    __sta_info_destroy_part1
    synchronize_net()
    __sta_info_destroy_part2
     -> cleanup_single_sta
       -> mesh_sta_cleanup
         -> mesh_plink_deactivate
           -> mesh_path_flush_by_nexthop

However, there are a couple of problems here:

1) the paths aren't flushed at all if the MPM is running in userspace
   (e.g. when using wpa_supplicant or authsae)

2) there is no synchronize_rcu between removing the path and readers
   accessing the nexthop, which means the following race is possible:

CPU0                            CPU1
~~~~                            ~~~~
                                sta_info_destroy_part1()
                                synchronize_net()
rcu_read_lock()
mesh_nexthop_resolve()
  mpath = mesh_path_lookup()
                                [...] -> mesh_path_flush_by_nexthop()
  sta = rcu_dereference(
    mpath->next_hop)
                                kfree(sta)
  access sta <-- CRASH

Fix both of these by unconditionally flushing paths before destroying
the sta, and by adding a synchronize_net() after path flush to ensure
no active readers can still dereference the sta.

Fixes this crash:

[  348.529295] BUG: unable to handle kernel paging request at 00020040
[  348.530014] IP: [] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
[  348.530014] *pde = 00000000
[  348.530014] Oops: 0000 [#1] PREEMPT
[  348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ]
[  348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G           O 4.6.0-rc5-wt=V1 #1
[  348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016  11/07/2014
[  348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000
[  348.530014] EIP: 0060:[] EFLAGS: 00010246 CPU: 0
[  348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
[  348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008
[  348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40
[  348.530014]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[  348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690
[  348.530014] Stack:
[  348.530014]  00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0
[  348.530014]  f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320
[  348.530014]  f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1
[  348.530014] Call Trace:
[  348.530014]  [] mesh_nexthop_lookup+0xbb/0xc8 [mac80211]
[  348.530014]  [] mesh_nexthop_resolve+0x34/0xd8 [mac80211]
[  348.530014]  [] ieee80211_xmit+0x92/0xc1 [mac80211]
[  348.530014]  [] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211]
[  348.530014]  [] ? sch_direct_xmit+0xd7/0x1b3
[  348.530014]  [] ? __local_bh_enable_ip+0x5d/0x7b
[  348.530014]  [] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4]
[  348.530014]  [] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat]
[  348.530014]  [] ? netif_skb_features+0x14d/0x30a
[  348.530014]  [] ieee80211_subif_start_xmit+0xa/0xe [mac80211]
[  348.530014]  [] dev_hard_start_xmit+0x1f8/0x267
[  348.530014]  [] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
[  348.530014]  [] sch_direct_xmit+0x8b/0x1b3
[  348.530014]  [] __dev_queue_xmit+0x2c8/0x513
[  348.530014]  [] dev_queue_xmit+0xa/0xc
[  348.530014]  [] batadv_send_skb_packet+0xd6/0xec [batman_adv]
[  348.530014]  [] batadv_send_unicast_skb+0x15/0x4a [batman_adv]
[  348.530014]  [] batadv_dat_send_data+0x27e/0x310 [batman_adv]
[  348.530014]  [] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv]
[  348.530014]  [] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv]
[  348.530014]  [] batadv_interface_tx+0x206/0x385 [batman_adv]
[  348.530014]  [] dev_hard_start_xmit+0x1f8/0x267
[  348.530014]  [] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
[  348.530014]  [] sch_direct_xmit+0x8b/0x1b3
[  348.530014]  [] __dev_queue_xmit+0x2c8/0x513
[  348.530014]  [] ? igb_xmit_frame+0x57/0x72 [igb]
[  348.530014]  [] dev_queue_xmit+0xa/0xc
[  348.530014]  [] br_dev_queue_push_xmit+0xeb/0xfb [bridge]
[  348.530014]  [] br_forward_finish+0x29/0x74 [bridge]
[  348.530014]  [] ? deliver_clone+0x3b/0x3b [bridge]
[  348.530014]  [] __br_forward+0x89/0xe7 [bridge]
[  348.530014]  [] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge]
[  348.530014]  [] deliver_clone+0x34/0x3b [bridge]
[  348.530014]  [] ? br_flood+0x95/0x95 [bridge]
[  348.530014]  [] br_flood+0x77/0x95 [bridge]
[  348.530014]  [] br_flood_forward+0x13/0x1a [bridge]
[  348.530014]  [] ? br_flood+0x95/0x95 [bridge]
[  348.530014]  [] br_handle_frame_finish+0x392/0x3db [bridge]
[  348.530014]  [] ? nf_iterate+0x2b/0x6b
[  348.530014]  [] br_handle_frame+0x1e6/0x240 [bridge]
[  348.530014]  [] ? br_handle_local_finish+0x6a/0x6a [bridge]
[  348.530014]  [] __netif_receive_skb_core+0x43a/0x66b
[  348.530014]  [] ? br_handle_frame_finish+0x3db/0x3db [bridge]
[  348.530014]  [] ? resched_curr+0x19/0x37
[  348.530014]  [] ? check_preempt_wakeup+0xbf/0xfe
[  348.530014]  [] ? ktime_get_with_offset+0x5c/0xfc
[  348.530014]  [] __netif_receive_skb+0x47/0x55
[  348.530014]  [] netif_receive_skb_internal+0x40/0x5a
[  348.530014]  [] napi_gro_receive+0x3a/0x94
[  348.530014]  [] igb_poll+0x6fd/0x9ad [igb]
[  348.530014]  [] ? swake_up_locked+0x14/0x26
[  348.530014]  [] net_rx_action+0xde/0x250
[  348.530014]  [] __do_softirq+0x8a/0x163
[  348.530014]  [] ? __hrtimer_tasklet_trampoline+0x19/0x19
[  348.530014]  [] do_softirq_own_stack+0x26/0x2c
[  348.530014]  
[  348.530014]  [] irq_exit+0x31/0x6f
[  348.530014]  [] do_IRQ+0x8d/0xa0
[  348.530014]  [] common_interrupt+0x2c/0x40
[  348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005
[  348.530014] EIP: [] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40
[  348.530014] CR2: 0000000000020040
[  348.530014] ---[ end trace 48556ac26779732e ]---
[  348.530014] Kernel panic - not syncing: Fatal exception in interrupt
[  348.530014] Kernel Offset: disabled

Cc: stable@vger.kernel.org
Reported-by: Fred Veldini 
Tested-by: Fred Veldini 
Signed-off-by: Bob Copeland 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: Fix Public Action frame RX in AP mode

2016-03-22T15:11:07+00:00

[ Upstream commit 1ec7bae8bec9b72e347e01330c745ab5cdd66f0e ]

Public Action frames use special rules for how the BSSID field (Address
3) is set. A wildcard BSSID is used in cases where the transmitter and
recipient are not members of the same BSS. As such, we need to accept
Public Action frames with wildcard BSSID.

Commit db8e17324553 ("mac80211: ignore frames between TDLS peers when
operating as AP") added a rule that drops Action frames to TDLS-peers
based on an Action frame having different DA (Address 1) and BSSID
(Address 3) values. This is not correct since it misses the possibility
of BSSID being a wildcard BSSID in which case the Address 1 would not
necessarily match.

Fix this by allowing mac80211 to accept wildcard BSSID in an Action
frame when in AP mode.

Fixes: db8e17324553 ("mac80211: ignore frames between TDLS peers when operating as AP")
Cc: stable@vger.kernel.org
Signed-off-by: Jouni Malinen 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: minstrel_ht: set default tx aggregation timeout to 0

2016-03-21T02:14:20+00:00

[ Upstream commit 7a36b930e6ed4702c866dc74a5ad07318a57c688 ]

The value 5000 was put here with the addition of the timeout field to
ieee80211_start_tx_ba_session. It was originally added in mac80211 to
save resources for drivers like iwlwifi, which only supports a limited
number of concurrent aggregation sessions.

Since iwlwifi does not use minstrel_ht and other drivers don't need
this, 0 is a better default - especially since there have been
recent reports of aggregation setup related issues reproduced with
ath9k. This should improve stability without causing any adverse
effects.

Cc: stable@vger.kernel.org
Acked-by: Avery Pennarun 
Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: fix use of uninitialised values in RX aggregation

2016-03-21T02:13:55+00:00

[ Upstream commit f39ea2690bd61efec97622c48323f40ed6e16317 ]

Use kzalloc instead of kmalloc for struct tid_ampdu_rx to
initialize the "removed" field (all others are initialized
manually). That fixes:

UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
load of value 2 is not a valid value for type '_Bool'
CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
Workqueue: phy0 rt2x00usb_work_rxdone
 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
 ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
 ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
Call Trace:
 [] dump_stack+0x45/0x5f
 [] ubsan_epilogue+0xd/0x40
 [] __ubsan_handle_load_invalid_value+0x67/0x70
 [] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
 [] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
 [] __ieee80211_rx_handle_packet+0x1f3/0x750
 [] ieee80211_rx_napi+0x447/0x990

While at it, convert to use sizeof(*tid_agg_rx) instead.

Fixes: 788211d81bfdf ("mac80211: fix RX A-MPDU session reorder timer deletion")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Bainbridge 
[reword commit message, use sizeof(*tid_agg_rx)]
Signed-off-by: Johannes Berg 

Signed-off-by: Sasha Levin

mac80211: Requeue work after scan complete for all VIF types.

2016-02-15T20:42:34+00:00

[ Upstream commit 4fa11ec726a32ea6dd768dbb2e2af3453a98ec0a ]

During a sw scan ieee80211_iface_work ignores work items for all vifs.
However after the scan complete work is requeued only for STA, ADHOC
and MESH iftypes.

This occasionally results in event processing getting delayed/not
processed for iftype AP when it coexists with a STA. This can result
in data halt and eventually disconnection on the AP interface.

Cc: stable@vger.kernel.org
Signed-off-by: Sachin Kulkarni 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: enable assoc check for mesh interfaces

2015-10-07T14:04:31+00:00

[ Upstream commit 3633ebebab2bbe88124388b7620442315c968e8f ]

We already set a station to be associated when peering completes, both
in user space and in the kernel.  Thus we should always have an
associated sta before sending data frames to that station.

Failure to check assoc state can cause crashes in the lower-level driver
due to transmitting unicast data frames before driver sta structures
(e.g. ampdu state in ath9k) are initialized.  This occurred when
forwarding in the presence of fixed mesh paths: frames were transmitted
to stations with whom we hadn't yet completed peering.

Cc: stable@vger.kernel.org
Reported-by: Alexis Green 
Tested-by: Jesse Jones 
Signed-off-by: Bob Copeland 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: clear subdir_stations when removing debugfs

2015-08-27T17:25:43+00:00

[ Upstream commit 4479004e6409087d1b4986881dc98c6c15dffb28 ]

If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:

BUG: unable to handle kernel NULL pointer dereference at 0000006c
IP: [] mutex_lock+0x12/0x30
Call Trace:
[] start_creating+0x44/0xc0
[] debugfs_create_dir+0x13/0xf0
[] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]

Cc: stable@kernel.org
Signed-off-by: Tom Hughes 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: prevent possible crypto tx tailroom corruption

2015-08-04T18:37:08+00:00

[ Upstream commit ab499db80fcf07c18e4053f91a619500f663e90e ]

There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.

This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.

I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.

Fixes: 8d1f7ecd2af5 ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211: don't use napi_gro_receive() outside NAPI context

2015-06-10T17:42:30+00:00

[ Upstream commit 22d3a3c829fa9ecdb493d1f1f2838d543f8d86a3 ]

No matter how the driver manages its NAPI context, there's no way
sending frames to it from a timer can be correct, since it would
corrupt the internal GRO lists.

To avoid that, always use the non-NAPI path when releasing frames
from the timer.

Cc: stable@vger.kernel.org
Reported-by: Jean Trivelly 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin