package/kernel/mac80211/patches/352-mac80211-prevent-skb-txq-mismatch.patch

   1 From: Michal Kazior <michal.kazior@tieto.com>
   2 Date: Fri, 13 Jan 2017 13:32:51 +0100
   3 Subject: [PATCH] mac80211: prevent skb/txq mismatch
   4
   5 Station structure is considered as not uploaded
   6 (to driver) until drv_sta_state() finishes. This
   7 call is however done after the structure is
   8 attached to mac80211 internal lists and hashes.
   9 This means mac80211 can lookup (and use) station
  10 structure before it is uploaded to a driver.
  11
  12 If this happens (structure exists, but
  13 sta->uploaded is false) fast_tx path can still be
  14 taken. Deep in the fastpath call the sta->uploaded
  15 is checked against to derive "pubsta" argument for
  16 ieee80211_get_txq(). If sta->uploaded is false
  17 (and sta is actually non-NULL) ieee80211_get_txq()
  18 effectively downgraded to vif->txq.
  19
  20 At first glance this may look innocent but coerces
  21 mac80211 into a state that is almost guaranteed
  22 (codel may drop offending skb) to crash because a
  23 station-oriented skb gets queued up on
  24 vif-oriented txq. The ieee80211_tx_dequeue() ends
  25 up looking at info->control.flags and tries to use
  26 txq->sta which in the fail case is NULL.
  27
  28 It's probably pointless to pretend one can
  29 downgrade skb from sta-txq to vif-txq.
  30
  31 Since downgrading unicast traffic to vif->txq must
  32 not be done there's no txq to put a frame on if
  33 sta->uploaded is false. Therefore the code is made
  34 to fall back to regular tx() op path if the
  35 described condition is hit.
  36
  37 Only drivers using wake_tx_queue were affected.
  38
  39 Example crash dump before fix:
  40
  41  Unable to handle kernel paging request at virtual address ffffe26c
  42  PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211]
  43  [<bf4252a4>] (ieee80211_tx_dequeue [mac80211]) from
  44  [<bf4b1388>] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core])
  45  [<bf4b1388>] (ath10k_mac_tx_push_txq [ath10k_core]) from
  46  [<bf4bdfbc>] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core])
  47  [<bf4bdfbc>] (ath10k_htt_txrx_compl_task [ath10k_core])
  48  [<bf51c5a4>] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci])
  49  [<bf51c5a4>] (ath10k_pci_napi_poll [ath10k_pci]) from
  50  [<c0572e90>] (net_rx_action+0xac/0x160)
  51
  52 Reported-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
  53 Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
  54 ---
  55
  56 --- a/net/mac80211/tx.c
  57 +++ b/net/mac80211/tx.c
  58 @@ -798,7 +798,7 @@ static __le16 ieee80211_tx_next_seq(stru
  59
  60  static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
  61                                           struct ieee80211_vif *vif,
  62 -                                         struct ieee80211_sta *pubsta,
  63 +                                         struct sta_info *sta,
  64                                           struct sk_buff *skb)
  65  {
  66         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  67 @@ -812,10 +812,13 @@ static struct txq_info *ieee80211_get_tx
  68         if (!ieee80211_is_data(hdr->frame_control))
  69                 return NULL;
  70
  71 -       if (pubsta) {
  72 +       if (sta) {
  73                 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
  74
  75 -               txq = pubsta->txq[tid];
  76 +               if (!sta->uploaded)
  77 +                       return NULL;
  78 +
  79 +               txq = sta->sta.txq[tid];
  80         } else if (vif) {
  81                 txq = vif->txq;
  82         }
  83 @@ -1503,23 +1506,17 @@ static bool ieee80211_queue_skb(struct i
  84         struct fq *fq = &local->fq;
  85         struct ieee80211_vif *vif;
  86         struct txq_info *txqi;
  87 -       struct ieee80211_sta *pubsta;
  88
  89         if (!local->ops->wake_tx_queue ||
  90             sdata->vif.type == NL80211_IFTYPE_MONITOR)
  91                 return false;
  92
  93 -       if (sta && sta->uploaded)
  94 -               pubsta = &sta->sta;
  95 -       else
  96 -               pubsta = NULL;
  97 -
  98         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  99                 sdata = container_of(sdata->bss,
 100                                      struct ieee80211_sub_if_data, u.ap);
 101
 102         vif = &sdata->vif;
 103 -       txqi = ieee80211_get_txq(local, vif, pubsta, skb);
 104 +       txqi = ieee80211_get_txq(local, vif, sta, skb);
 105
 106         if (!txqi)
 107                 return false;