From patchwork Thu Mar 6 10:18:27 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871520 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 948D61EA7C5 for ; Thu, 6 Mar 2025 10:18:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256328; cv=none; b=igKN77cNI/Vq/nNIqlI4yY55n5UC8v1aPFAGlagq/SOMRMgsE+o910MS/9ujhz4KK/kJ2CsUEefZwiNhUYTSziUlaHVsjO2WhHUT1+t7w2Cm+9r9uV8aa7SeWUIRt4+li7kavcvin85O6f9JJydIYD1xluCjVUUFyJ8pbVCVHdw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256328; c=relaxed/simple; bh=9gXbdCw8cKuWNEKljFZzi2H2Kv0B7d2KlMpOZodb3mw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kazsQ56Y+OC7oAn5FPw88FDjg9EvJiesvQvYo0MSVaYlJSAy2MYg9XARm0Emn9TTPxftpySoVYFV6fT6WTU2pGF+WPZbrNpGF4DW1CSos8csdc5rfubu66SEHIJJ2QalSpt1AAZwkk6buiVndzkGkMGbfUb7b+FvSwEA9HwdtkM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=TAuj67CQ; arc=none smtp.client-ip=192.198.163.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="TAuj67CQ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741256328; x=1772792328; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=9gXbdCw8cKuWNEKljFZzi2H2Kv0B7d2KlMpOZodb3mw=; b=TAuj67CQFx3yzNwyo+LfyabfaIB7AZotFcp40qr4fNu3S8hDBLcLv54l dke/ZpsnIYgheIbhNoasuz/6/DqeK5ELACZKSQny66KVrzmbiiUqK6h6o N1wFzo8IjtAVYVZh0xSLyBg1zkKWpk1i0BRdN98J0ZbLD0+51S2Ea+veV wHV84R6D9MErY2GTvfeF3PMJeAk+VmbtjhnNp/fjhpe1EPmIl2SeKedsc WOhVYk6EHv7OUx2ynobzw8u+9E7uNgElTZiMNxkGY5f0CNDujiZ+DITGA pNNwTkKCtjAn2OUeKSmgziId70hqwUP+kNdrog2S9AgM1Wv6Uau/c5uaA Q==; X-CSE-ConnectionGUID: AKAI7zf9Rd6d3r4B6SlAwQ== X-CSE-MsgGUID: ElX5ap9UTL6/pf7MuhHzvQ== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="46181361" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="46181361" Received: from orviesa009.jf.intel.com ([10.64.159.149]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:47 -0800 X-CSE-ConnectionGUID: CjRJGaLTQd+CzpGkhxO0Eg== X-CSE-MsgGUID: K7G1v1j/QQGq2TMIvHRt3g== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="118705699" Received: from weis0040.iil.intel.com ([10.12.217.108]) by orviesa009-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:44 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Emmanuel Grumbach , Johannes Berg Subject: [PATCH 1/5] wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state Date: Thu, 6 Mar 2025 12:18:27 +0200 Message-Id: <20250306121409.450bc40e8b04.I636ba96843c77f13309c15c9fd6eb0c5a52a7976@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> References: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited From: Emmanuel Grumbach We first want to flush the station to make sure we no longer have any frames being Tx by the station before the station is moved to un-authorized state. Failing to do that will lead to races: a frame may be sent after the station's state has been changed. Since the API clearly states that the driver can't fail the sta_state() transition down the list of state, we can easily flush the station first, and only then call the driver's sta_state(). Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit --- net/mac80211/sta_info.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index f83268fa9f92..caa3d0236b5e 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -4,7 +4,7 @@ * Copyright 2006-2007 Jiri Benc * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015 - 2017 Intel Deutschland GmbH - * Copyright (C) 2018-2023 Intel Corporation + * Copyright (C) 2018-2024 Intel Corporation */ #include @@ -1335,9 +1335,13 @@ static int _sta_info_move_state(struct sta_info *sta, sta->sta.addr, new_state); /* notify the driver before the actual changes so it can - * fail the transition + * fail the transition if the state is increasing. + * The driver is required not to fail when the transition + * is decreasing the state, so first, do all the preparation + * work and only then, notify the driver. */ - if (test_sta_flag(sta, WLAN_STA_INSERTED)) { + if (new_state > sta->sta_state && + test_sta_flag(sta, WLAN_STA_INSERTED)) { int err = drv_sta_state(sta->local, sta->sdata, sta, sta->sta_state, new_state); if (err) @@ -1413,6 +1417,16 @@ static int _sta_info_move_state(struct sta_info *sta, break; } + if (new_state < sta->sta_state && + test_sta_flag(sta, WLAN_STA_INSERTED)) { + int err = drv_sta_state(sta->local, sta->sdata, sta, + sta->sta_state, new_state); + + WARN_ONCE(err, + "Driver is not allowed to fail if the sta_state is transitioning down the list: %d\n", + err); + } + sta->sta_state = new_state; return 0; From patchwork Thu Mar 6 10:18:28 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871145 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 488141FECAD for ; Thu, 6 Mar 2025 10:18:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256328; cv=none; b=Ub4rjMNg5fWsAM5RNpxgGSOQk7QRsFPsWbR38vJ2kRZIWEcgajXoeDt9le9zcGa2RP5N30yAfZ64RTDi9cD0fxJn/wwKGm/rYjSOQlIhSb4cfWG2KOcLfveZVOtJgg4UeETSU8q0pgwiqbLuN7ZoF++d87BoS7tRJPaEar5pEdo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256328; c=relaxed/simple; bh=BwWAWBnCM2qE7bC0penKeu0dyy/89DAB4sKhllmbuvQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jkkyZ09o03NRCHTfUQQQuaMC11JVJI0S11DWkWghjbqg5Z7Pfkv9wKONrFSDmLmtSPROWMakfm+hcPhnieQH+2fg5/ms2J99oNV2cBYcCPLc9IzMi5xRVZUi8TFsqmotAeyIJQAkpvdEFTwJdAu3vmV41W5HX+1MSX7J/9bgfS0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=MZA0qPaR; arc=none smtp.client-ip=192.198.163.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="MZA0qPaR" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741256328; x=1772792328; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=BwWAWBnCM2qE7bC0penKeu0dyy/89DAB4sKhllmbuvQ=; b=MZA0qPaRJfNc77svgVZ+jCro9HqvrTI9dnd+9+/tkkB9zzE96+0HMCvq pjsv2I4p4dTw1BaDvUvToTqch4Rmk6jKH2NsfkQfwJmjM+ksjWvOqxPha PAKDhack1qzj8EmZoYdrKBUyWq9Bs1PmeF7tpNsLM4/FL6JC6Ub9aJnPu ARMCfVjlPFM2HrMxnqmCRmzP/vILqZl5Hqn5soB72gK2F/AFsAWhY1KuD kVVaVVuIJpLH+hPzil8W9RN5e27iPiBQBByhszMYlxT2VHERmpQa3UxAh 4ZRyvLnk2bzVN6AZjmVdiJ9vvDqtwSPKASmN85zYwsoazkR3g0N3RUYsr w==; X-CSE-ConnectionGUID: e+GxszPgQneV3FJAGy+9YQ== X-CSE-MsgGUID: jLmRbJh7S7STWdX104ZBhQ== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="46181366" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="46181366" Received: from orviesa009.jf.intel.com ([10.64.159.149]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:48 -0800 X-CSE-ConnectionGUID: Y8pXxOilT7qhkGK4iwXbjg== X-CSE-MsgGUID: Pk44ga9wSDGtbW0drpZYZg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="118705708" Received: from weis0040.iil.intel.com ([10.12.217.108]) by orviesa009-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:46 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg Subject: [PATCH 2/5] wifi: mac80211: don't queue sdata::work for a non-running sdata Date: Thu, 6 Mar 2025 12:18:28 +0200 Message-Id: <20250306121409.1e02caf82640.I4949e71ed56e7186ed4968fa9ddff477473fa2f4@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> References: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited The worker really shouldn't be queued for a non-running interface. Also, if ieee80211_setup_sdata is called between queueing and executing the wk, it will be initialized, which will corrupt wiphy_work_list. Fixes: f8891461a277 ("mac80211: do not start any work during reconfigure flow") Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg --- net/mac80211/util.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 7f02bd5891eb..fdda14c08e2b 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -6,7 +6,7 @@ * Copyright 2007 Johannes Berg * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015-2017 Intel Deutschland GmbH - * Copyright (C) 2018-2024 Intel Corporation + * Copyright (C) 2018-2025 Intel Corporation * * utilities for mac80211 */ @@ -2193,8 +2193,10 @@ int ieee80211_reconfig(struct ieee80211_local *local) ieee80211_reconfig_roc(local); /* Requeue all works */ - list_for_each_entry(sdata, &local->interfaces, list) - wiphy_work_queue(local->hw.wiphy, &sdata->work); + list_for_each_entry(sdata, &local->interfaces, list) { + if (ieee80211_sdata_running(sdata)) + wiphy_work_queue(local->hw.wiphy, &sdata->work); + } } ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP, From patchwork Thu Mar 6 10:18:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871144 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98787200BBD for ; Thu, 6 Mar 2025 10:18:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256331; cv=none; b=GfhfUwt2MnywavgYrvRSj/NMWCNbMWjYRXur+7gv9WDXcAB9mvtNwwqaO+OUdfpL1NKOtl5j3G103KtAqhTfWG8wycuT9hTEP9ILfLblBY7q1J5jrA/Htm7ir49GqXRt+OvS4cqm7KgLzCxPYD6T36ehSXXbEUhZdPZgBA1qmUs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256331; c=relaxed/simple; bh=+IyaAiQko7O6fIX11o38VosR2w0paHLTBkTyiRr5jCM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=McWqhEnhd5w+QUThL638zflv7iOpadDaMSAVeOg8peM81uuRTy35UBM/aVm7ekrtaiy5c9adfRxLn9CDG4Ql0tOsA1SMpfxBqo23KqbKGk/oW+b/dGrXgjK0j6DB4YPBFckfP/qofs8VcgzHzq/HtSqG7KHT2etvsuvqRGukJsQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=X1GMaQ0g; arc=none smtp.client-ip=192.198.163.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="X1GMaQ0g" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741256331; x=1772792331; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=+IyaAiQko7O6fIX11o38VosR2w0paHLTBkTyiRr5jCM=; b=X1GMaQ0gvLcFzXafoamih+F34/awxefQDFH+GVhQy1FUklmw/70f+HAo X8izyjS7whfOt+3Xf60uJb93b2No+i1GRGVeQyIzhbqXFex6m8kDwTF8c llOBc4acfI5VpnPZBKVcwThsqugZwvzb7Bw61JJhSgvkGwmKtGH8hjOjK b0GWH/bdvPn2/8gYdR+hMnr0XY+kcq4lDfy9usLuoDCBA3okjGlY+nBv/ tpKvCwGAGaxU8y1RdZuloB6aQK3WGOuvbmHsS4oG9CQukj9AhYVZmxym6 zNG1y/ALE7Hm0aaRtcqas0IrJiRMDkFY4oE9HD/b5Q2+JydBVLnuCfIoW A==; X-CSE-ConnectionGUID: 47leLAguQn+p/v67mkmMKg== X-CSE-MsgGUID: qqUzbwzYTw23dGIAYHATAg== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="46181373" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="46181373" Received: from orviesa009.jf.intel.com ([10.64.159.149]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:50 -0800 X-CSE-ConnectionGUID: VDWmSx/YRxeL+ObAn3MAhw== X-CSE-MsgGUID: zFt+1tUSQSGPp0GBinJfuA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="118705717" Received: from weis0040.iil.intel.com ([10.12.217.108]) by orviesa009-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:47 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg , Ilan Peer Subject: [PATCH 3/5] wifi: nl80211: fix assoc link handling Date: Thu, 6 Mar 2025 12:18:29 +0200 Message-Id: <20250306121409.7b233d769c32.I62fd04a8667dd55cedb9a1c0414cc92dd098da75@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> References: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited From: Johannes Berg The refactoring of the assoc link handling in order to support multi-link reconfiguration broke the setting of the assoc link ID, and thus resulted in the wrong BSS "use_for" value being selected. Fix that for both association and ML reconfiguration. Fixes: 720fa448f5a7 ("wifi: nl80211: Split the links handling of an association request") Signed-off-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- net/wireless/nl80211.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index e87267fbb442..aac0e7298dc7 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -11123,6 +11123,7 @@ static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device static int nl80211_process_links(struct cfg80211_registered_device *rdev, struct cfg80211_assoc_link *links, + int assoc_link_id, const u8 *ssid, int ssid_len, struct genl_info *info) { @@ -11153,7 +11154,7 @@ static int nl80211_process_links(struct cfg80211_registered_device *rdev, } links[link_id].bss = nl80211_assoc_bss(rdev, ssid, ssid_len, attrs, - link_id, link_id); + assoc_link_id, link_id); if (IS_ERR(links[link_id].bss)) { err = PTR_ERR(links[link_id].bss); links[link_id].bss = NULL; @@ -11350,8 +11351,8 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); ap_addr = req.ap_mld_addr; - err = nl80211_process_links(rdev, req.links, ssid, ssid_len, - info); + err = nl80211_process_links(rdev, req.links, req.link_id, + ssid, ssid_len, info); if (err) goto free; @@ -16506,7 +16507,10 @@ static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info) add_links = 0; if (info->attrs[NL80211_ATTR_MLO_LINKS]) { - err = nl80211_process_links(rdev, links, NULL, 0, info); + err = nl80211_process_links(rdev, links, + /* mark as MLO, but not assoc */ + IEEE80211_MLD_MAX_NUM_LINKS, + NULL, 0, info); if (err) return err; From patchwork Thu Mar 6 10:18:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871519 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A9331DE4EC for ; Thu, 6 Mar 2025 10:18:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256333; cv=none; b=aB8WhkWnQG9qVylThJPTqpj84j/XLhME+RnvOluz25ZUvmQzX5jT6MoNmIEyUmrRjhvpZ0pUgwwERf311I/HomY/K5FsCw/RZ/Il1A57jKf7FcYyYx661rF9LPjiwHNYtc7109b9TBalfzhNFZr9NM2fBZX/PRtuXbTITrHVov0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256333; c=relaxed/simple; bh=RWbpWBhYDsGTP4r8i+l8dUM5Rit0ewGtRNFcjfjkCiw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=uGAuyh0xXzVZBvEf2FD6eha+reJVOUPmRU13e4H9r8anuSbVburj/ThKAs1KzRjcukNhnPgbE+x0NDxYGN12icn83uaHH41n+CZzEnPwFiuGtk5jblCjLVHjf2kkF0B0dLkbjmIIYiNg7ZrOY1pcjcnZ/an73IjdPGcMVUugvk8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=B7t3G52m; arc=none smtp.client-ip=192.198.163.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="B7t3G52m" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741256332; x=1772792332; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RWbpWBhYDsGTP4r8i+l8dUM5Rit0ewGtRNFcjfjkCiw=; b=B7t3G52mjS5ZHWelWkW5DwPrLuMS8EIzI3r6V67/jW2+2LyoDo5yd8NK q7vu7Tj946u2u1aanN1Ay4NjfkM5P4J15n6nXMPtA0VCG4dMbFV+F3F5I 0RnS/JIcPZaKD7DFBd0FHTewCx2m1BKG9RdqXi2r2HoOIgoZlMtolNtW7 XmZ8urpsWGplaL9Vj8n4ZE67dPQRqHJ/yipzCDKZlX3T5RchKJ+DobKy1 22TezYzzBugtret1o58luIuH/IJUEOVRqoYTxf0q41gs5Vz4SJ5n8Tlwo 511fnUDFw6qUb2hr7mA8xRy5a3n4erKrXFb7Jfobv9PYuo8TLLKkXxvvK w==; X-CSE-ConnectionGUID: V5uRkMLgRb+ytn9B0SMR2g== X-CSE-MsgGUID: ghkcJA5sSHqx2ZGCH2l68w== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="46181379" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="46181379" Received: from orviesa009.jf.intel.com ([10.64.159.149]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:52 -0800 X-CSE-ConnectionGUID: r1wfLiPTQa+GEu77G/DsIQ== X-CSE-MsgGUID: 14qiM1y4Qj2LUrW2FkijSg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="118705724" Received: from weis0040.iil.intel.com ([10.12.217.108]) by orviesa009-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:49 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg , Ilan Peer Subject: [PATCH 4/5] wifi: mac80211: fix SA Query processing in MLO Date: Thu, 6 Mar 2025 12:18:30 +0200 Message-Id: <20250306121409.bab48bb49061.I9391b22f1360d20ac8c4e92604de23f27696ba8f@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> References: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited From: Johannes Berg When MLO is used and SA Query processing isn't done by userspace (e.g. wpa_supplicant w/o CONFIG_OCV), then the mac80211 code kicks in but uses the wrong addresses. Fix them. Signed-off-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- net/mac80211/rx.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 1e28efe4203c..0659ec892ec6 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -6,7 +6,7 @@ * Copyright 2007-2010 Johannes Berg * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright(c) 2015 - 2017 Intel Deutschland GmbH - * Copyright (C) 2018-2024 Intel Corporation + * Copyright (C) 2018-2025 Intel Corporation */ #include @@ -3329,8 +3329,8 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, return; } - if (!ether_addr_equal(mgmt->sa, sdata->deflink.u.mgd.bssid) || - !ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid)) { + if (!ether_addr_equal(mgmt->sa, sdata->vif.cfg.ap_addr) || + !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) { /* Not from the current AP or not associated yet. */ return; } @@ -3346,9 +3346,9 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, skb_reserve(skb, local->hw.extra_tx_headroom); resp = skb_put_zero(skb, 24); - memcpy(resp->da, mgmt->sa, ETH_ALEN); + memcpy(resp->da, sdata->vif.cfg.ap_addr, ETH_ALEN); memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); - memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN); + memcpy(resp->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN); resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION); skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); From patchwork Thu Mar 6 10:18:31 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871143 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AACA1EA7C5 for ; Thu, 6 Mar 2025 10:18:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256333; cv=none; b=ewAjDyxtVhuuFaGIzUr/NKJYNY+yoHA6p2MG2xtHfMiZoR1/el3HVR7RdaDuQqo4M9qWOu7DhgNfRbAS6N6wR+alZJQKTR7q2XeXUQGg948KZdhRW/WnkOk9nsLBBwY06Jp1IL8DO6kGE9Ckan0qJWvSVmY4utGdBeG4EW3VAM0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741256333; c=relaxed/simple; bh=ZYNfFyPn/uv9iaTmv1j53v2cCqjuDgD8vvhKJucMvTA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Zl+DCthYE9X1L3m//S0ah+yv5cfO5aLwJO/oiSE3jfsXfAt41lCHP4LXfHvHh/0l5eYht1jafGeg5duI5mx79YfwEoXYHUWyAKIE065wfuw4DQ2EQxMKStPoujQmnCayzD/jozQZnVfFufGwSx7fKcGAEGlLREgPPLw2vrQJGQQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=VSpK8AoT; arc=none smtp.client-ip=192.198.163.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="VSpK8AoT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741256333; x=1772792333; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ZYNfFyPn/uv9iaTmv1j53v2cCqjuDgD8vvhKJucMvTA=; b=VSpK8AoTlJ/uQiSVOXG/6/wWG9JfyapTPYJLrtlFAsoFUjNj73bqwq8w qGDIKtYX60wuLUVEHWXH9I6xQM/1iK68vcnFpYiUed+Hi1LRjClqWO3Z4 2BvUsrS5aDv1CnFsPsAGmUHIfxJ8tBJTq+UgIdtIEdjR0n8ggsGMJsXMY TSBhnN9Pd3KkRoaOoUjfEMjR0Fc0gEv9o7hGGxvz4EBPULNCbEn+0Hjhw wYkkNZAIEj9PVCP1WHfQ5rjyPuOpP3/uz2RBo+Zlos5fCIQR5MMTNwmf1 kgqHF2QHy5OzO+OMCQ2XiW4jVr8Io7gI4tJNcGYA+zXFqhBwzzTEsCh09 w==; X-CSE-ConnectionGUID: P9nVbAmUScOMMMkRyAML0Q== X-CSE-MsgGUID: qk2Ygc80SUuJ5cJLFdOoDw== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="46181384" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="46181384" Received: from orviesa009.jf.intel.com ([10.64.159.149]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:53 -0800 X-CSE-ConnectionGUID: k5/LcENdRhGL1MLbBfMp0w== X-CSE-MsgGUID: b7wCvAsETNqMJlFvZxSDNw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="118705731" Received: from weis0040.iil.intel.com ([10.12.217.108]) by orviesa009-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:18:51 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg Subject: [PATCH 5/5] wifi: cfg80211: cancel wiphy_work before freeing wiphy Date: Thu, 6 Mar 2025 12:18:31 +0200 Message-Id: <20250306121409.efd1d19f6e07.I48229f96f4067ef73f5b87302335e2fd750136c9@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> References: <20250306101831.4042303-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is getting queued. If wiphy_free is called before the rdev::wiphy_work had a chance to run, the wiphy memory will be freed, and then when it eventally gets to run it'll use invalid memory. Fix this by canceling the work before freeing the wiphy. Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg --- net/wireless/core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 12b780de8779..828e29872633 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1191,6 +1191,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) { struct cfg80211_internal_bss *scan, *tmp; struct cfg80211_beacon_registration *reg, *treg; + unsigned long flags; + + spin_lock_irqsave(&rdev->wiphy_work_lock, flags); + WARN_ON(!list_empty(&rdev->wiphy_work_list)); + spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); + cancel_work_sync(&rdev->wiphy_work); + rfkill_destroy(rdev->wiphy.rfkill); list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { list_del(®->list);