From d48a8ed40d3d1b65eec9c848828c6c0e2928cf07 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Fri, 15 Feb 2019 18:43:55 +0100 Subject: mac80211: update to version 4.19.23-1 This updates mac80211 to backports version 4.19.23-1 which includes all the stable fixes from kernel 4.19.23. The removed patches are included in this version. Signed-off-by: Hauke Mehrtens --- .../patches/subsys/140-tweak-TSQ-setting.patch | 2 +- .../patches/subsys/150-disable_addr_notifier.patch | 4 +- ...-free-skb-fraglist-before-freeing-the-skb.patch | 31 ----------- ...-mac80211-add-hdrlen-to-ieee80211_tx_data.patch | 4 +- ...8-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch | 14 ++--- ...nstrel-merge-with-minstrel_ht-always-enab.patch | 4 +- ...x-memory-accounting-with-A-MSDU-aggregati.patch | 6 +-- ...nore-tx-status-for-PS-stations-in-ieee802.patch | 26 ---------- ...x-reordering-of-buffered-broadcast-packet.patch | 28 ---------- ...x-a-kernel-panic-when-TXing-after-TXQ-tea.patch | 60 ---------------------- ...-memory-leak-if-validate_pae_over_nl80211.patch | 29 ----------- ...nstrel_ht-add-flag-to-indicate-missing-in.patch | 4 +- ...sure-that-management-tx-skbs-have-encrypt.patch | 48 ----------------- 13 files changed, 19 insertions(+), 241 deletions(-) delete mode 100644 package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch delete mode 100644 package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch delete mode 100644 package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch delete mode 100644 package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch delete mode 100644 package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch delete mode 100644 package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch (limited to 'package/kernel/mac80211/patches/subsys') diff --git a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch index f7116eb9f7..42a6382209 100644 --- a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch +++ b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch @@ -1,6 +1,6 @@ --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -3791,6 +3791,12 @@ out: +@@ -3797,6 +3797,12 @@ out: netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev) { diff --git a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch index db3c693fd4..1581b3400b 100644 --- a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch +++ b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch @@ -52,7 +52,7 @@ fail_ifa: #endif rtnl_lock(); -@@ -1220,10 +1220,10 @@ void ieee80211_unregister_hw(struct ieee +@@ -1219,10 +1219,10 @@ void ieee80211_unregister_hw(struct ieee tasklet_kill(&local->tx_pending_tasklet); tasklet_kill(&local->tasklet); @@ -64,4 +64,4 @@ +#if IS_ENABLED(__disabled__CONFIG_IPV6) unregister_inet6addr_notifier(&local->ifa6_notifier); #endif - ieee80211_txq_teardown_flows(local); + diff --git a/package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch b/package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch deleted file mode 100644 index dc12290f4f..0000000000 --- a/package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Sara Sharon -Date: Thu, 11 Oct 2018 14:21:21 +0200 -Subject: [PATCH] mac80211: free skb fraglist before freeing the skb - -mac80211 uses the frag list to build AMSDU. When freeing -the skb, it may not be really freed, since someone is still -holding a reference to it. -In that case, when TCP skb is being retransmitted, the -pointer to the frag list is being reused, while the data -in there is no longer valid. -Since we will never get frag list from the network stack, -as mac80211 doesn't advertise the capability, we can safely -free and nullify it before releasing the SKB. - -Signed-off-by: Sara Sharon ---- - ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -558,6 +558,11 @@ static void ieee80211_report_used_skb(st - } - - ieee80211_led_tx(local); -+ -+ if (skb_has_frag_list(skb)) { -+ kfree_skb_list(skb_shinfo(skb)->frag_list); -+ skb_shinfo(skb)->frag_list = NULL; -+ } - } - - /* diff --git a/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch index a0221c0d6c..a6bd3eab6e 100644 --- a/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch +++ b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch @@ -48,7 +48,7 @@ Signed-off-by: Janusz Dziedzic if (likely(sta)) { if (!IS_ERR(sta)) tx->sta = sta; -@@ -3501,6 +3501,7 @@ begin: +@@ -3507,6 +3507,7 @@ begin: tx.local = local; tx.skb = skb; tx.sdata = vif_to_sdata(info->control.vif); @@ -56,7 +56,7 @@ Signed-off-by: Janusz Dziedzic if (txq->sta) tx.sta = container_of(txq->sta, struct sta_info, sta); -@@ -3837,6 +3838,7 @@ ieee80211_build_data_template(struct iee +@@ -3843,6 +3844,7 @@ ieee80211_build_data_template(struct iee hdr = (void *)skb->data; tx.sta = sta_info_get(sdata, hdr->addr1); tx.skb = skb; diff --git a/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch index 42274cbab1..bc87d0a45b 100644 --- a/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch +++ b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch @@ -147,7 +147,7 @@ Signed-off-by: Janusz Dziedzic if (likely(sta)) { if (!IS_ERR(sta)) -@@ -2209,7 +2208,7 @@ netdev_tx_t ieee80211_monitor_start_xmit +@@ -2215,7 +2214,7 @@ netdev_tx_t ieee80211_monitor_start_xmit goto fail; hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr); @@ -156,7 +156,7 @@ Signed-off-by: Janusz Dziedzic if (skb->len < len_rthdr + hdrlen) goto fail; -@@ -2427,7 +2426,7 @@ static struct sk_buff *ieee80211_build_h +@@ -2433,7 +2432,7 @@ static struct sk_buff *ieee80211_build_h struct ieee80211_chanctx_conf *chanctx_conf; struct ieee80211_sub_if_data *ap_sdata; enum nl80211_band band; @@ -165,7 +165,7 @@ Signed-off-by: Janusz Dziedzic if (IS_ERR(sta)) sta = NULL; -@@ -2647,6 +2646,9 @@ static struct sk_buff *ieee80211_build_h +@@ -2653,6 +2652,9 @@ static struct sk_buff *ieee80211_build_h hdrlen += 2; } @@ -175,7 +175,7 @@ Signed-off-by: Janusz Dziedzic /* * Drop unicast frames to unauthorised stations unless they are * EAPOL frames from the local station. -@@ -2727,6 +2729,7 @@ static struct sk_buff *ieee80211_build_h +@@ -2733,6 +2735,7 @@ static struct sk_buff *ieee80211_build_h skb_pull(skb, skip_header_bytes); head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb); @@ -183,7 +183,7 @@ Signed-off-by: Janusz Dziedzic /* * So we need to modify the skb header and hence need a copy of -@@ -2759,6 +2762,9 @@ static struct sk_buff *ieee80211_build_h +@@ -2765,6 +2768,9 @@ static struct sk_buff *ieee80211_build_h memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen); #endif @@ -193,7 +193,7 @@ Signed-off-by: Janusz Dziedzic if (ieee80211_is_data_qos(fc)) { __le16 *qos_control; -@@ -2934,6 +2940,9 @@ void ieee80211_check_fast_xmit(struct st +@@ -2940,6 +2946,9 @@ void ieee80211_check_fast_xmit(struct st fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA); } @@ -203,7 +203,7 @@ Signed-off-by: Janusz Dziedzic /* We store the key here so there's no point in using rcu_dereference() * but that's fine because the code that changes the pointers will call * this function after doing so. For a single CPU that would be enough, -@@ -3528,7 +3537,7 @@ begin: +@@ -3534,7 +3543,7 @@ begin: if (tx.key && (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) diff --git a/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch index 055472206e..6f1239ccab 100644 --- a/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch +++ b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch @@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau ccflags-y += -DDEBUG --- a/net/mac80211/main.c +++ b/net/mac80211/main.c -@@ -1306,18 +1306,12 @@ static int __init ieee80211_init(void) +@@ -1304,18 +1304,12 @@ static int __init ieee80211_init(void) if (ret) return ret; @@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau rc80211_minstrel_exit(); return ret; -@@ -1325,7 +1319,6 @@ static int __init ieee80211_init(void) +@@ -1323,7 +1317,6 @@ static int __init ieee80211_init(void) static void __exit ieee80211_exit(void) { diff --git a/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch index fe0b98c3ac..4e83ff1ea0 100644 --- a/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch +++ b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch @@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -3188,6 +3188,7 @@ static bool ieee80211_amsdu_aggregate(st +@@ -3194,6 +3194,7 @@ static bool ieee80211_amsdu_aggregate(st u8 max_subframes = sta->sta.max_amsdu_subframes; int max_frags = local->hw.max_tx_fragments; int max_amsdu_len = sta->sta.max_amsdu_len; @@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau __be16 len; void *data; bool ret = false; -@@ -3219,12 +3220,13 @@ static bool ieee80211_amsdu_aggregate(st +@@ -3225,12 +3226,13 @@ static bool ieee80211_amsdu_aggregate(st flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func); head = skb_peek_tail(&flow->queue); if (!head) @@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau nfrags = 1 + skb_shinfo(skb)->nr_frags; nfrags += 1 + skb_shinfo(head)->nr_frags; -@@ -3282,6 +3284,9 @@ out_recalc: +@@ -3288,6 +3290,9 @@ out_recalc: fq_recalc_backlog(fq, tin, flow); } out: diff --git a/package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch b/package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch deleted file mode 100644 index ee2059f9c8..0000000000 --- a/package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: Felix Fietkau -Date: Tue, 13 Nov 2018 20:29:03 +0100 -Subject: [PATCH] mac80211: ignore tx status for PS stations in - ieee80211_tx_status_ext - -Make it behave like regular ieee80211_tx_status calls, except for the lack of -filtered frame processing. -This fixes spurious low-ack triggered disconnections with powersave clients -connected to an AP. - -Fixes: f027c2aca0cf4 ("mac80211: add ieee80211_tx_status_noskb") -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -984,6 +984,8 @@ void ieee80211_tx_status_ext(struct ieee - /* Track when last TDLS packet was ACKed */ - if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH)) - sta->status_stats.last_tdls_pkt_time = jiffies; -+ } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) { -+ return; - } else { - ieee80211_lost_packet(sta, info); - } diff --git a/package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch b/package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch deleted file mode 100644 index 4257365a79..0000000000 --- a/package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch +++ /dev/null @@ -1,28 +0,0 @@ -From: Felix Fietkau -Date: Wed, 28 Nov 2018 22:36:06 +0100 -Subject: [PATCH] mac80211: fix reordering of buffered broadcast packets - -If the buffered broadcast queue contains packets, letting new packets bypass -that queue can lead to heavy reordering, since the driver is probably throttling -transmission of buffered multicast packets after beacons. - -Keep buffering packets until the buffer has been cleared (and no client -is in powersave mode). - -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -439,8 +439,8 @@ ieee80211_tx_h_multicast_ps_buf(struct i - if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL)) - info->hw_queue = tx->sdata->vif.cab_queue; - -- /* no stations in PS mode */ -- if (!atomic_read(&ps->num_sta_ps)) -+ /* no stations in PS mode and no buffered packets */ -+ if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf)) - return TX_CONTINUE; - - info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM; diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch deleted file mode 100644 index 606897d1fe..0000000000 --- a/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch +++ /dev/null @@ -1,60 +0,0 @@ -From a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Mon Sep 17 00:00:00 2001 -From: Sara Sharon -Date: Sat, 15 Dec 2018 11:03:10 +0200 -Subject: [PATCH 1/3] mac80211: fix a kernel panic when TXing after TXQ - teardown - -Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(), -to avoid a use-after-free of the netdev data. However, interfaces -aren't fully removed at the point, and cfg80211_shutdown_all_interfaces -can for example, TX a deauth frame. Move the TXQ teardown to the -point between cfg80211_shutdown_all_interfaces and the free of -netdev queues, so we can be sure they are torn down before netdev -is freed, but after there is no ongoing TX. - -Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces") -Signed-off-by: Sara Sharon -Signed-off-by: Luca Coelho -Signed-off-by: Johannes Berg ---- - net/mac80211/iface.c | 3 +++ - net/mac80211/main.c | 2 -- - 2 files changed, 3 insertions(+), 2 deletions(-) - ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -7,6 +7,7 @@ - * Copyright 2008, Johannes Berg - * Copyright 2013-2014 Intel Mobile Communications GmbH - * Copyright (c) 2016 Intel Deutschland GmbH -+ * Copyright (C) 2018 Intel Corporation - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -2035,6 +2036,8 @@ void ieee80211_remove_interfaces(struct - WARN(local->open_count, "%s: open count remains %d\n", - wiphy_name(local->hw.wiphy), local->open_count); - -+ ieee80211_txq_teardown_flows(local); -+ - mutex_lock(&local->iflist_mtx); - list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) { - list_del(&sdata->list); ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -1200,7 +1200,6 @@ int ieee80211_register_hw(struct ieee802 - rtnl_unlock(); - ieee80211_led_exit(local); - ieee80211_wep_free(local); -- ieee80211_txq_teardown_flows(local); - fail_flows: - destroy_workqueue(local->workqueue); - fail_workqueue: -@@ -1226,7 +1225,6 @@ void ieee80211_unregister_hw(struct ieee - #if IS_ENABLED(__disabled__CONFIG_IPV6) - unregister_inet6addr_notifier(&local->ifa6_notifier); - #endif -- ieee80211_txq_teardown_flows(local); - - rtnl_lock(); - diff --git a/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch b/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch deleted file mode 100644 index d31d45bbdf..0000000000 --- a/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch +++ /dev/null @@ -1,29 +0,0 @@ -From d350a0f431189517b1af0dbbb605c273231a8966 Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Sat, 15 Dec 2018 11:03:22 +0200 -Subject: [PATCH 2/3] nl80211: fix memory leak if validate_pae_over_nl80211() - fails - -If validate_pae_over_nl80211() were to fail in nl80211_crypto_settings(), -we might leak the 'connkeys' allocation. Fix this. - -Fixes: 64bf3d4bc2b0 ("nl80211: Add CONTROL_PORT_OVER_NL80211 attribute") -Signed-off-by: Johannes Berg ---- - net/wireless/nl80211.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -9002,8 +9002,10 @@ static int nl80211_join_ibss(struct sk_b - if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { - int r = validate_pae_over_nl80211(rdev, info); - -- if (r < 0) -+ if (r < 0) { -+ kzfree(connkeys); - return r; -+ } - - ibss.control_port_over_nl80211 = true; - } diff --git a/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch b/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch index 2c706b101f..2b9ff93db6 100644 --- a/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch +++ b/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch @@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau --- a/include/net/mac80211.h +++ b/include/net/mac80211.h -@@ -2132,6 +2132,9 @@ struct ieee80211_txq { +@@ -2130,6 +2130,9 @@ struct ieee80211_txq { * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte. * Padding will be added after ieee80211_hdr, before IV/LLC. * @@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays */ enum ieee80211_hw_flags { -@@ -2178,6 +2181,7 @@ enum ieee80211_hw_flags { +@@ -2176,6 +2179,7 @@ enum ieee80211_hw_flags { IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP, IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP, IEEE80211_HW_NEEDS_ALIGNED4_SKBS, diff --git a/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch b/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch deleted file mode 100644 index 1c1951eadd..0000000000 --- a/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch +++ /dev/null @@ -1,48 +0,0 @@ -From: Felix Fietkau -Date: Mon, 28 Jan 2019 13:16:45 +0100 -Subject: [PATCH] mac80211: ensure that management tx skbs have encryption - tailroom - -Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management -frames need to be software encrypted. Since normal data packets are still -encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented -after key upload. This can lead to passing skbs to ccmp_encrypt_skb, which -don't have the needed tailroom for software encryption. - -Change the code to add tailroom for encrypted management packets, even if -crypto_tx_tailroom_needed_cnt is 0. - -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -1912,9 +1912,16 @@ static int ieee80211_skb_resize(struct i - int head_need, bool may_encrypt) - { - struct ieee80211_local *local = sdata->local; -+ struct ieee80211_hdr *hdr; -+ bool enc_tailroom; - int tail_need = 0; - -- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) { -+ hdr = (struct ieee80211_hdr *) skb->data; -+ enc_tailroom = may_encrypt && -+ (sdata->crypto_tx_tailroom_needed_cnt || -+ ieee80211_is_mgmt(hdr->frame_control)); -+ -+ if (enc_tailroom) { - tail_need = IEEE80211_ENCRYPT_TAILROOM; - tail_need -= skb_tailroom(skb); - tail_need = max_t(int, tail_need, 0); -@@ -1922,8 +1929,7 @@ static int ieee80211_skb_resize(struct i - - if (skb_cloned(skb) && - (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) || -- !skb_clone_writable(skb, ETH_HLEN) || -- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt))) -+ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom)) - I802_DEBUG_INC(local->tx_expand_skb_head_cloned); - else if (head_need || tail_need) - I802_DEBUG_INC(local->tx_expand_skb_head); -- cgit v1.2.3