From c1e6ef488f6b61156164ea4fe0328e9e36a305aa Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 28 Jan 2016 22:42:10 +0000 Subject: mac80211: merge a bunch of pending fixes Signed-off-by: Felix Fietkau SVN-Revision: 48536 --- ...12-mac80211-fix-txq-queue-related-crashes.patch | 27 ++++++ ...ix-unnecessary-frame-drops-in-mesh-fwding.patch | 57 ++++++++++++ ...queue-work-after-scan-complete-for-all-VI.patch | 103 +++++++++++++++++++++ .../315-mac80211-fix-ibss-scan-parameters.patch | 57 ++++++++++++ ...1-agg-rx.c-fix-use-of-uninitialised-value.patch | 50 ++++++++++ 5 files changed, 294 insertions(+) create mode 100644 package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch create mode 100644 package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch create mode 100644 package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch create mode 100644 package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch create mode 100644 package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch diff --git a/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch new file mode 100644 index 0000000000..61cafc7625 --- /dev/null +++ b/package/kernel/mac80211/patches/312-mac80211-fix-txq-queue-related-crashes.patch @@ -0,0 +1,27 @@ +From: Michal Kazior +Date: Thu, 21 Jan 2016 14:23:07 +0100 +Subject: [PATCH] mac80211: fix txq queue related crashes + +The driver can access the queue simultanously +while mac80211 tears down the interface. Without +spinlock protection this could lead to corrupting +sk_buff_head and subsequently to an invalid +pointer dereference. + +Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation") +Signed-off-by: Michal Kazior +--- + +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct iee + if (sdata->vif.txq) { + struct txq_info *txqi = to_txq_info(sdata->vif.txq); + ++ spin_lock_bh(&txqi->queue.lock); + ieee80211_purge_tx_queue(&local->hw, &txqi->queue); ++ spin_unlock_bh(&txqi->queue.lock); ++ + atomic_set(&sdata->txqs_len[txqi->txq.ac], 0); + } + diff --git a/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch new file mode 100644 index 0000000000..844d43bfc7 --- /dev/null +++ b/package/kernel/mac80211/patches/313-mac80211-fix-unnecessary-frame-drops-in-mesh-fwding.patch @@ -0,0 +1,57 @@ +From: Michal Kazior +Date: Mon, 25 Jan 2016 14:43:24 +0100 +Subject: [PATCH] mac80211: fix unnecessary frame drops in mesh fwding + +The ieee80211_queue_stopped() expects hw queue +number but it was given raw WMM AC number instead. + +This could cause frame drops and problems with +traffic in some cases - most notably if driver +doesn't map AC numbers to queue numbers 1:1 and +uses ieee80211_stop_queues() and +ieee80211_wake_queue() only without ever calling +ieee80211_wake_queues(). + +On ath10k it was possible to hit this problem in +the following case: + + 1. wlan0 uses queue 0 + (ath10k maps queues per vif) + 2. offchannel uses queue 15 + 3. queues 1-14 are unused + 4. ieee80211_stop_queues() + 5. ieee80211_wake_queue(q=0) + 6. ieee80211_wake_queue(q=15) + (other queues are not woken up because both + driver and mac80211 know other queues are + unused) + 7. ieee80211_rx_h_mesh_fwding() + 8. ieee80211_select_queue_80211() returns 2 + 9. ieee80211_queue_stopped(q=2) returns true + 10. frame is dropped (oops!) + +Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping") +Signed-off-by: Michal Kazior +--- + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2235,7 +2235,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 + struct ieee80211_local *local = rx->local; + struct ieee80211_sub_if_data *sdata = rx->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; +- u16 q, hdrlen; ++ u16 ac, q, hdrlen; + + hdr = (struct ieee80211_hdr *) skb->data; + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -2304,7 +2304,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 + ether_addr_equal(sdata->vif.addr, hdr->addr3)) + return RX_CONTINUE; + +- q = ieee80211_select_queue_80211(sdata, skb, hdr); ++ ac = ieee80211_select_queue_80211(sdata, skb, hdr); ++ q = sdata->vif.hw_queue[ac]; + if (ieee80211_queue_stopped(&local->hw, q)) { + IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); + return RX_DROP_MONITOR; diff --git a/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch new file mode 100644 index 0000000000..5b3efbdc5a --- /dev/null +++ b/package/kernel/mac80211/patches/314-mac80211-Requeue-work-after-scan-complete-for-all-VI.patch @@ -0,0 +1,103 @@ +From: Sachin Kulkarni +Date: Tue, 12 Jan 2016 14:30:19 +0530 +Subject: [PATCH] mac80211: Requeue work after scan complete for all VIF + types. + +During a sw scan ieee80211_iface_work ignores work items for all vifs. +However after the scan complete work is requeued only for STA, ADHOC +and MESH iftypes. + +This occasionally results in event processing getting delayed/not +processed for iftype AP when it coexists with a STA. This can result +in data halt and eventually disconnection on the AP interface. + +Signed-off-by: Sachin Kulkarni +Cc: linux-wireless@vger.kernel.org +Cc: johannes@sipsolutions.net +--- + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -1731,7 +1731,6 @@ void ieee80211_ibss_notify_scan_complete + if (sdata->vif.type != NL80211_IFTYPE_ADHOC) + continue; + sdata->u.ibss.last_scan_completed = jiffies; +- ieee80211_queue_work(&local->hw, &sdata->work); + } + mutex_unlock(&local->iflist_mtx); + } +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -1369,17 +1369,6 @@ out: + sdata_unlock(sdata); + } + +-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) +-{ +- struct ieee80211_sub_if_data *sdata; +- +- rcu_read_lock(); +- list_for_each_entry_rcu(sdata, &local->interfaces, list) +- if (ieee80211_vif_is_mesh(&sdata->vif) && +- ieee80211_sdata_running(sdata)) +- ieee80211_queue_work(&local->hw, &sdata->work); +- rcu_read_unlock(); +-} + + void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata) + { +--- a/net/mac80211/mesh.h ++++ b/net/mac80211/mesh.h +@@ -362,14 +362,10 @@ static inline bool mesh_path_sel_is_hwmp + return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP; + } + +-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local); +- + void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata); + void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata); + void ieee80211s_stop(void); + #else +-static inline void +-ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {} + static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata) + { return false; } + static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata) +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3978,8 +3978,6 @@ static void ieee80211_restart_sta_timer( + if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR)) + ieee80211_queue_work(&sdata->local->hw, + &sdata->u.mgd.monitor_work); +- /* and do all the other regular work too */ +- ieee80211_queue_work(&sdata->local->hw, &sdata->work); + } + } + +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -314,6 +314,7 @@ static void __ieee80211_scan_completed(s + bool was_scanning = local->scanning; + struct cfg80211_scan_request *scan_req; + struct ieee80211_sub_if_data *scan_sdata; ++ struct ieee80211_sub_if_data *sdata; + + lockdep_assert_held(&local->mtx); + +@@ -373,7 +374,15 @@ static void __ieee80211_scan_completed(s + + ieee80211_mlme_notify_scan_completed(local); + ieee80211_ibss_notify_scan_completed(local); +- ieee80211_mesh_notify_scan_completed(local); ++ ++ /* Requeue all the work that might have been ignored while ++ * the scan was in progress ++ */ ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) { ++ if (ieee80211_sdata_running(sdata)) ++ ieee80211_queue_work(&sdata->local->hw, &sdata->work); ++ } ++ + if (was_scanning) + ieee80211_start_next_roc(local); + } diff --git a/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch new file mode 100644 index 0000000000..52fecb96b0 --- /dev/null +++ b/package/kernel/mac80211/patches/315-mac80211-fix-ibss-scan-parameters.patch @@ -0,0 +1,57 @@ +From: Sara Sharon +Date: Mon, 25 Jan 2016 15:46:35 +0200 +Subject: [PATCH] mac80211: fix ibss scan parameters + +When joining IBSS a full scan should be initiated in order to search +for existing cell, unless the fixed_channel parameter was set. +A default channel to create the IBSS on if no cell was found is +provided as well. +However - a scan is initiated only on the default channel provided +regardless of whether ifibss->fixed_channel is set or not, with the +obvious result of the cell not joining existing IBSS cell that is +on another channel. + +Fixes: 76bed0f43b27 ("mac80211: IBSS fix scan request") +Signed-off-by: Sara Sharon +Signed-off-by: Emmanuel Grumbach +--- + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -7,6 +7,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2009, Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2016 Intel Deutschland GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -1483,14 +1484,21 @@ static void ieee80211_sta_find_ibss(stru + + sdata_info(sdata, "Trigger new scan to find an IBSS to join\n"); + +- num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, +- &ifibss->chandef, +- channels, +- ARRAY_SIZE(channels)); + scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef); +- ieee80211_request_ibss_scan(sdata, ifibss->ssid, +- ifibss->ssid_len, channels, num, +- scan_width); ++ ++ if (ifibss->fixed_channel) { ++ num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, ++ &ifibss->chandef, ++ channels, ++ ARRAY_SIZE(channels)); ++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ++ ifibss->ssid_len, channels, ++ num, scan_width); ++ } else { ++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ++ ifibss->ssid_len, NULL, ++ 0, scan_width); ++ } + } else { + int interval = IEEE80211_SCAN_INTERVAL; + diff --git a/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch new file mode 100644 index 0000000000..e78df36600 --- /dev/null +++ b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch @@ -0,0 +1,50 @@ +From: Chris Bainbridge +Date: Wed, 27 Jan 2016 15:46:18 +0000 +Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values + +Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes: + +[ 7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29 +[ 7.976608] load of value 2 is not a valid value for type '_Bool' +[ 7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265 +[ 7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015 +[ 7.976616] Workqueue: phy0 rt2x00usb_work_rxdone +[ 7.976619] 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007 +[ 7.976622] ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500 +[ 7.976626] ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032 +[ 7.976629] Call Trace: +[ 7.976633] [] dump_stack+0x45/0x5f +[ 7.976637] [] ubsan_epilogue+0xd/0x40 +[ 7.976642] [] __ubsan_handle_load_invalid_value+0x67/0x70 +[ 7.976646] [] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730 +[ 7.976650] [] ieee80211_prepare_and_rx_handle+0xd04/0x1c00 +[ 7.976654] [] ? usb_hcd_map_urb_for_dma+0x65e/0x960 +[ 7.976659] [] __ieee80211_rx_handle_packet+0x1f3/0x750 +[ 7.976663] [] ieee80211_rx_napi+0x447/0x990 +[ 7.976667] [] rt2x00lib_rxdone+0x305/0xbd0 +[ 7.976670] [] ? dequeue_task_fair+0x64f/0x1de0 +[ 7.976674] [] ? sched_clock_cpu+0xe6/0x150 +[ 7.976678] [] rt2x00usb_work_rxdone+0x7c/0x140 +[ 7.976682] [] process_one_work+0x226/0x860 +[ 7.976686] [] worker_thread+0x5c/0x680 +[ 7.976690] [] ? process_one_work+0x860/0x860 +[ 7.976693] [] kthread+0xf6/0x150 +[ 7.976697] [] ? kthread_worker_fn+0x310/0x310 +[ 7.976700] [] ret_from_fork+0x3f/0x70 +[ 7.976703] [] ? kthread_worker_fn+0x310/0x310 + +Link: https://lkml.org/lkml/2016/1/26/230 +Signed-off-by: Chris Bainbridge +--- + +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -327,7 +327,7 @@ void __ieee80211_start_rx_ba_session(str + } + + /* prepare A-MPDU MLME for Rx aggregation */ +- tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); ++ tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); + if (!tid_agg_rx) + goto end; + -- cgit v1.2.3