From patchwork Thu Mar 6 10:37:55 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871139 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A525D20468E for ; Thu, 6 Mar 2025 10:38:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257495; cv=none; b=b7uIswV4oRQ0xFru5K2kLXGpLk4eZjDeI2y1TM9IDlV1U8JMVj5k9W3EAG41bUsqmQs0aNfvQmYs2rShC8Fnshw8HCkFNpdZmDCFmwoAuQizkB6PKQoVrqTvtiW+IRRZRn+a/WQTGSJ1ZubHCFVnvScZFQxq2t+DyQgEP0xBAB4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257495; c=relaxed/simple; bh=9gXbdCw8cKuWNEKljFZzi2H2Kv0B7d2KlMpOZodb3mw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=rdjhdr37QJA9nARxGmp1YYVb66y02scS0mKGpsO7fo/RsXEPqbfiidCVogi2VqRTYGgYWapLMK32jUzWein3fnIOIM19kpI9FbEdnVwCDH23qQ8ePNDavH0NpZ4qG84iFuWzndclHpzv9dKGjLvrnAgoAYa57ok32Ws6YzzWu8k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ntZLRlHN; arc=none smtp.client-ip=198.175.65.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ntZLRlHN" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741257494; x=1772793494; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=9gXbdCw8cKuWNEKljFZzi2H2Kv0B7d2KlMpOZodb3mw=; b=ntZLRlHN993QW9Maa6DXhghiAT0z8dgFlJ97ZFgs9PTMqojkdyDmhDtE QVL9kHZv3Uc5W7xRnrP15hGFe4ub86tVvPtSXCmP3s0O4G4XfaVg4docb 5U1st+9GCyEAGBaVFZ028nU8x92jFXcfRbIl6OZH6Qd0S91On5e60LNNu Rf67B8GHL+KGPcpdK3N4ByUk3/XgNxyhbQ95tOosJ3L9f/i3cU2E/z7Ug TeQ/YCkEUlkG/y19jS8/RPjMqrNe9B3ogjLmGJybtL8FH1MPkEGsejFpP STnR/eqsuf7IJwjtgWD6v5A5tXbEYX1VBGBy+1BGcrZxhwaeLG4uMLDqZ Q==; X-CSE-ConnectionGUID: jQA2gWo/Sby/02UAS9w7rQ== X-CSE-MsgGUID: itxHU6i1TIaU2nL+QmySLg== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="45915017" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="45915017" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa107.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:13 -0800 X-CSE-ConnectionGUID: gZ0BJUsWTCWvKF1zUHJS5Q== X-CSE-MsgGUID: w3E2wa2fQq26xdy7lGaCyA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,224,1728975600"; d="scan'208";a="123138375" Received: from weis0040.iil.intel.com ([10.12.217.108]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:11 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Emmanuel Grumbach , Johannes Berg Subject: [PATCH v2 wireless 1/5] wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state Date: Thu, 6 Mar 2025 12:37:55 +0200 Message-Id: <20250306123626.450bc40e8b04.I636ba96843c77f13309c15c9fd6eb0c5a52a7976@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> References: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited From: Emmanuel Grumbach We first want to flush the station to make sure we no longer have any frames being Tx by the station before the station is moved to un-authorized state. Failing to do that will lead to races: a frame may be sent after the station's state has been changed. Since the API clearly states that the driver can't fail the sta_state() transition down the list of state, we can easily flush the station first, and only then call the driver's sta_state(). Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit --- net/mac80211/sta_info.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index f83268fa9f92..caa3d0236b5e 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -4,7 +4,7 @@ * Copyright 2006-2007 Jiri Benc * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015 - 2017 Intel Deutschland GmbH - * Copyright (C) 2018-2023 Intel Corporation + * Copyright (C) 2018-2024 Intel Corporation */ #include @@ -1335,9 +1335,13 @@ static int _sta_info_move_state(struct sta_info *sta, sta->sta.addr, new_state); /* notify the driver before the actual changes so it can - * fail the transition + * fail the transition if the state is increasing. + * The driver is required not to fail when the transition + * is decreasing the state, so first, do all the preparation + * work and only then, notify the driver. */ - if (test_sta_flag(sta, WLAN_STA_INSERTED)) { + if (new_state > sta->sta_state && + test_sta_flag(sta, WLAN_STA_INSERTED)) { int err = drv_sta_state(sta->local, sta->sdata, sta, sta->sta_state, new_state); if (err) @@ -1413,6 +1417,16 @@ static int _sta_info_move_state(struct sta_info *sta, break; } + if (new_state < sta->sta_state && + test_sta_flag(sta, WLAN_STA_INSERTED)) { + int err = drv_sta_state(sta->local, sta->sdata, sta, + sta->sta_state, new_state); + + WARN_ONCE(err, + "Driver is not allowed to fail if the sta_state is transitioning down the list: %d\n", + err); + } + sta->sta_state = new_state; return 0; From patchwork Thu Mar 6 10:37:56 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871513 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9464C209F4E for ; Thu, 6 Mar 2025 10:38:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257496; cv=none; b=dp8zNzxqwCIshO/JccY79V4OFrV/oaCVliN+6bSWaIzIpl3VafZ5S3nXCKcoEHYryEdSNslAs2jr81KARu6fFmDfctLDU75iVk4Vneg/60Gu/tsPuoVTFigpn8WNibJExW6mCwBoeY0AUACYlsFjdHN3tQLW7WSLEK4HwlSVrI0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257496; c=relaxed/simple; bh=BwWAWBnCM2qE7bC0penKeu0dyy/89DAB4sKhllmbuvQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=LRE4JH0O2UCyT4hvMfVUkgVAO+9Y24Js9kXiQ04HCKMcBiX8TWXsMNfJO59IekhaoyGCDyVR26bAIk5QnBPBrHsx7iwCfP8aoAgGxln+6oY293Ua8MbuRtBHSLRhsOf1F+dJnjLuSfQzsPcuChFdggpt0FcLsQzKHgZ333ppvU0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=VFDUIS2n; arc=none smtp.client-ip=198.175.65.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="VFDUIS2n" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741257495; x=1772793495; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=BwWAWBnCM2qE7bC0penKeu0dyy/89DAB4sKhllmbuvQ=; b=VFDUIS2n+I0tX3LDqLG4XGH8mOPX2TV0jZPLrwbfWQ5B2cOoGYmLLOL7 BMiSWccHSUTzYKuZqzyiRqdH4v4iYzvTRkPFsW5V7+PYhJ45DNK1+LoRV xHNjBfOahv5Aah2ftuOL8pltD8HxK517hLNioQ7qUW5BnNl6xPvWGMd0U Pt4VGPEZ2WRNPKgkk1O83ftZCaZtpmUET+e5aQZlugDC+fEm5avCVGVbL ay7mnSdxZuEn91y4IxUkqiwmh5qzDi7qmQZDYwT/3JnfRnwisnBNDIO7y Tia+ricyqgxKFp4D64/O9QpK+0FABuZYpodgWSUqL4QKshfILhvZF9FQb Q==; X-CSE-ConnectionGUID: Cbs9GIKbRW+IygKyyVw6pg== X-CSE-MsgGUID: ORLehEYvTbyxxyGZmC4W/w== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="45915019" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="45915019" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa107.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:14 -0800 X-CSE-ConnectionGUID: DbMWilK9SYyDedqpkGpyrQ== X-CSE-MsgGUID: cXpzWW3NR2S6NLUjcG1YBQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,224,1728975600"; d="scan'208";a="123138380" Received: from weis0040.iil.intel.com ([10.12.217.108]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:13 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg Subject: [PATCH v2 wireless 2/5] wifi: mac80211: don't queue sdata::work for a non-running sdata Date: Thu, 6 Mar 2025 12:37:56 +0200 Message-Id: <20250306123626.1e02caf82640.I4949e71ed56e7186ed4968fa9ddff477473fa2f4@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> References: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited The worker really shouldn't be queued for a non-running interface. Also, if ieee80211_setup_sdata is called between queueing and executing the wk, it will be initialized, which will corrupt wiphy_work_list. Fixes: f8891461a277 ("mac80211: do not start any work during reconfigure flow") Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg --- net/mac80211/util.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 7f02bd5891eb..fdda14c08e2b 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -6,7 +6,7 @@ * Copyright 2007 Johannes Berg * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015-2017 Intel Deutschland GmbH - * Copyright (C) 2018-2024 Intel Corporation + * Copyright (C) 2018-2025 Intel Corporation * * utilities for mac80211 */ @@ -2193,8 +2193,10 @@ int ieee80211_reconfig(struct ieee80211_local *local) ieee80211_reconfig_roc(local); /* Requeue all works */ - list_for_each_entry(sdata, &local->interfaces, list) - wiphy_work_queue(local->hw.wiphy, &sdata->work); + list_for_each_entry(sdata, &local->interfaces, list) { + if (ieee80211_sdata_running(sdata)) + wiphy_work_queue(local->hw.wiphy, &sdata->work); + } } ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP, From patchwork Thu Mar 6 10:37:57 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871138 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C7EF5209F57 for ; Thu, 6 Mar 2025 10:38:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257499; cv=none; b=Kyw8mf1WWz8hP1doQvmGg/vyBfYoL41ar3Cn5wgFRnFcmNrqeVRvkptYwYyuquagqQhR4oEvaSs4DJRhkRECtB97S219Qdm69gb4tsLyug6Q27DZWEUFN+1pTbO5lG7Mf74LBKQMiq2Q7dnGcBNgMt5zFUz58AisQNXLGF/r8OE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257499; c=relaxed/simple; bh=+IyaAiQko7O6fIX11o38VosR2w0paHLTBkTyiRr5jCM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jFb917zSrXLdAKGm/BW7euCP9peHrTKggTsu/ZMNvi0QCAtSXbKl4u2GiZUN2eUzSZquvdTpRU0Af39JcInKDjGx6d6NVXyO7Q+MYzXupP5vIZjwzlrJcDB3on+7haQ/7m6R0F5/fcAnA1shQY378LN73uWGXICeT206pFgn5LY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Eq2YHqNI; arc=none smtp.client-ip=198.175.65.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Eq2YHqNI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741257498; x=1772793498; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=+IyaAiQko7O6fIX11o38VosR2w0paHLTBkTyiRr5jCM=; b=Eq2YHqNISiY8En8vNQB8p+pf3iEqPH4P3je4tOtdxlXG8t4Z74cUNZML dgLSKePs0oxObkRFEw+wjFNsWMEKttWyKvSv6icfMlSnxYk2J6F3cMSQ4 kNbJGEs95DF75/ov5mxTBNMUjlpZOQ4NJHxRiQdwfUdnY01DQGOK2CbED HkU/JO/kX6cC8nx47tvDM/9QvXJFXfaqTCxTWJaSKkMCuuoxirc9jFpnP J6mk1OsuiRBb0h/yvwo0LbiUybfjQkz3EWk8oVh4JduKdeDnYFi+A6nos KbwqO9ZqnZOkHSAIR3FKCZ3kTacMUec/GKbz1PUOR+47m0VEJjjhccffZ A==; X-CSE-ConnectionGUID: C2l0IM4JQE+Hyiv+Y+Fz1A== X-CSE-MsgGUID: Nygh2t+YT6uR1XqhEmQUFQ== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="45915025" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="45915025" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa107.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:16 -0800 X-CSE-ConnectionGUID: wV0EDDhUSmyUM0DWigfooA== X-CSE-MsgGUID: OXZjQw5ASU2qQ3v61eLNWQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,224,1728975600"; d="scan'208";a="123138383" Received: from weis0040.iil.intel.com ([10.12.217.108]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:14 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg , Ilan Peer Subject: [PATCH v2 wireless 3/5] wifi: nl80211: fix assoc link handling Date: Thu, 6 Mar 2025 12:37:57 +0200 Message-Id: <20250306123626.7b233d769c32.I62fd04a8667dd55cedb9a1c0414cc92dd098da75@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> References: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited From: Johannes Berg The refactoring of the assoc link handling in order to support multi-link reconfiguration broke the setting of the assoc link ID, and thus resulted in the wrong BSS "use_for" value being selected. Fix that for both association and ML reconfiguration. Fixes: 720fa448f5a7 ("wifi: nl80211: Split the links handling of an association request") Signed-off-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- net/wireless/nl80211.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index e87267fbb442..aac0e7298dc7 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -11123,6 +11123,7 @@ static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device static int nl80211_process_links(struct cfg80211_registered_device *rdev, struct cfg80211_assoc_link *links, + int assoc_link_id, const u8 *ssid, int ssid_len, struct genl_info *info) { @@ -11153,7 +11154,7 @@ static int nl80211_process_links(struct cfg80211_registered_device *rdev, } links[link_id].bss = nl80211_assoc_bss(rdev, ssid, ssid_len, attrs, - link_id, link_id); + assoc_link_id, link_id); if (IS_ERR(links[link_id].bss)) { err = PTR_ERR(links[link_id].bss); links[link_id].bss = NULL; @@ -11350,8 +11351,8 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]); ap_addr = req.ap_mld_addr; - err = nl80211_process_links(rdev, req.links, ssid, ssid_len, - info); + err = nl80211_process_links(rdev, req.links, req.link_id, + ssid, ssid_len, info); if (err) goto free; @@ -16506,7 +16507,10 @@ static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info) add_links = 0; if (info->attrs[NL80211_ATTR_MLO_LINKS]) { - err = nl80211_process_links(rdev, links, NULL, 0, info); + err = nl80211_process_links(rdev, links, + /* mark as MLO, but not assoc */ + IEEE80211_MLD_MAX_NUM_LINKS, + NULL, 0, info); if (err) return err; From patchwork Thu Mar 6 10:37:58 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871512 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97DE92046BD for ; Thu, 6 Mar 2025 10:38:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257500; cv=none; b=cd3mPqg235NEJZWI3WVUwS4wJYPooc3pWpeuuWUBC1NFmHt2NQiTQZcMj3aEttjpgOgPQXYXXJcERmW/qMUFQqY9RQew5kG8ePMAB6o3sqw2Nfirv8kiogMOJ0RSwRv6r9IOeFvgGl9ukrMkJmdLsF+gEZoghN5WwAH1KThAYsY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257500; c=relaxed/simple; bh=RWbpWBhYDsGTP4r8i+l8dUM5Rit0ewGtRNFcjfjkCiw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=R9DpudcOxZs3nRStwSJ578ufboRmNaq/eaaA4Ib93wq2VormYfULsbfRISgb/XPShIpfBIoxylBS8RXJHCIVbdVybAOT0oMX4Gn76XCpC/5wePzKeV5W4d0t/jD6DuRwMZAau5f/eTs10qiC5undBCQipzfBxQQxoatf/hY6pKA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=C3hhAx7w; arc=none smtp.client-ip=198.175.65.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="C3hhAx7w" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741257499; x=1772793499; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RWbpWBhYDsGTP4r8i+l8dUM5Rit0ewGtRNFcjfjkCiw=; b=C3hhAx7wnHt30NvlcNDg9ij4tqP/SujI+6ajmtf4JFY0sw8/+rZLCZGo u6fJVrD+NETQKz27oGE9wwrPJIRHk7LWzgdgCUn6edDsfn7OEG/ZoP9Kz D+/wfrpld24BuL1cIfMIjLW3PtWAT2XtZHacWOwLeLyxYUc2RWcASoNz1 flALQRL+AWcAzRpbEeDt0NOsiny3GX1X8ZkpaK3UGiH0bv7CWWcJ3f//T cz8On9gkLzc7560MkUTjdt1/5Oyn/AfXoQ4a4KrYvSmk++f3Y8Q0+iwI+ /HTaKHz8QH9O0OmLeoWzh8sMubvRUqUpTuzTqc9XxAbT4tBJauacGYxd4 Q==; X-CSE-ConnectionGUID: lG7X7bp8SxGLbOYMOSr3Jg== X-CSE-MsgGUID: RVYcOwoxSxOqVorgF+Ri6A== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="45915030" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="45915030" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa107.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:18 -0800 X-CSE-ConnectionGUID: mPmWJtO6QHyuN4r2iKlq9g== X-CSE-MsgGUID: NwwH75GoRO2CMNMjRaKfsw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,224,1728975600"; d="scan'208";a="123138389" Received: from weis0040.iil.intel.com ([10.12.217.108]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:16 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg , Ilan Peer Subject: [PATCH v2 wireless 4/5] wifi: mac80211: fix SA Query processing in MLO Date: Thu, 6 Mar 2025 12:37:58 +0200 Message-Id: <20250306123626.bab48bb49061.I9391b22f1360d20ac8c4e92604de23f27696ba8f@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> References: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited From: Johannes Berg When MLO is used and SA Query processing isn't done by userspace (e.g. wpa_supplicant w/o CONFIG_OCV), then the mac80211 code kicks in but uses the wrong addresses. Fix them. Signed-off-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- net/mac80211/rx.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 1e28efe4203c..0659ec892ec6 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -6,7 +6,7 @@ * Copyright 2007-2010 Johannes Berg * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright(c) 2015 - 2017 Intel Deutschland GmbH - * Copyright (C) 2018-2024 Intel Corporation + * Copyright (C) 2018-2025 Intel Corporation */ #include @@ -3329,8 +3329,8 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, return; } - if (!ether_addr_equal(mgmt->sa, sdata->deflink.u.mgd.bssid) || - !ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid)) { + if (!ether_addr_equal(mgmt->sa, sdata->vif.cfg.ap_addr) || + !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) { /* Not from the current AP or not associated yet. */ return; } @@ -3346,9 +3346,9 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, skb_reserve(skb, local->hw.extra_tx_headroom); resp = skb_put_zero(skb, 24); - memcpy(resp->da, mgmt->sa, ETH_ALEN); + memcpy(resp->da, sdata->vif.cfg.ap_addr, ETH_ALEN); memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); - memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN); + memcpy(resp->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN); resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION); skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); From patchwork Thu Mar 6 10:37:59 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miri Korenblit X-Patchwork-Id: 871137 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 99A0E209F4E for ; Thu, 6 Mar 2025 10:38:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257501; cv=none; b=BJNVb0LrIYM1juy94pFl1j044G4emhExX6/q1xGwhOfEkRK5L63NIZxnJVsP06VSz0AqFsHiSOHATFsdDB3jvxj1iwk9SkJxJwF4i6N4suLuap1eCJPol2O6nY9AIFZD+BvCrp02b8qbYY+MBXQ9O/YgenRjhy8FXlYx+dyq/3M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741257501; c=relaxed/simple; bh=ZYNfFyPn/uv9iaTmv1j53v2cCqjuDgD8vvhKJucMvTA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=oRP5VPc4qMVTRFUPPryqMKC8zt+NlcSTFpEImg6TTB4KX1HwS6am07gWM4HrufT3zMnXgymDqlt/Tc/wvFol4BhWfSgOUFtxMNeerq1DdXwa3XBZw/Ek9xmcL203MRMNX2xGHPPFAkJj7eHPwHVvwa+ye619KhQPi0C/D0SbhPw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=F465/mg8; arc=none smtp.client-ip=198.175.65.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="F465/mg8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741257500; x=1772793500; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ZYNfFyPn/uv9iaTmv1j53v2cCqjuDgD8vvhKJucMvTA=; b=F465/mg86x3u17FIOeDre2uuFORpJoPH2VVmmxSvsWBkuxc+5QKqmd+4 Ot4ewvTPru5M/R76BRZRuAee2ks7qkJmXE9YjkVrKZeIqk6iE3VE4EbBI UvJKQ1Wylu7V0sXUzqlWAwIp3w9+gs8Mm838zTfr1nSModL0OnFt0UIW1 j3YWyS6/U7vzpxmpJXqW7+ftSmBkm/dWZ8rOx5qbQUKq37KSQV9ITWfze hxP+wasnfVhrrWqmdKsCmtJWU0q+09MI2h7xVluJoewwf1aD1o+eg9inJ 4IeCRsuJ0TGi8Jj3LWKkgm+T2OLaIm+aiYbR3rZge+JpZFDaSCujszJf8 Q==; X-CSE-ConnectionGUID: kDrLiVQXQBKnoQjyYyGyPw== X-CSE-MsgGUID: uZ8nVQmqQ/KCwS5TOogaPQ== X-IronPort-AV: E=McAfee;i="6700,10204,11363"; a="45915034" X-IronPort-AV: E=Sophos;i="6.14,225,1736841600"; d="scan'208";a="45915034" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa107.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:19 -0800 X-CSE-ConnectionGUID: S9u191tFRr+fnqDUvzteCw== X-CSE-MsgGUID: MCPepnbHS6+l6ZF4HdXALw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,224,1728975600"; d="scan'208";a="123138395" Received: from weis0040.iil.intel.com ([10.12.217.108]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Mar 2025 02:38:18 -0800 From: Miri Korenblit To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg Subject: [PATCH v2 wireless 5/5] wifi: cfg80211: cancel wiphy_work before freeing wiphy Date: Thu, 6 Mar 2025 12:37:59 +0200 Message-Id: <20250306123626.efd1d19f6e07.I48229f96f4067ef73f5b87302335e2fd750136c9@changeid> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> References: <20250306103759.4102293-1-miriam.rachel.korenblit@intel.com> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Israel (74) Limited A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is getting queued. If wiphy_free is called before the rdev::wiphy_work had a chance to run, the wiphy memory will be freed, and then when it eventally gets to run it'll use invalid memory. Fix this by canceling the work before freeing the wiphy. Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg --- net/wireless/core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 12b780de8779..828e29872633 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1191,6 +1191,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) { struct cfg80211_internal_bss *scan, *tmp; struct cfg80211_beacon_registration *reg, *treg; + unsigned long flags; + + spin_lock_irqsave(&rdev->wiphy_work_lock, flags); + WARN_ON(!list_empty(&rdev->wiphy_work_list)); + spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); + cancel_work_sync(&rdev->wiphy_work); + rfkill_destroy(rdev->wiphy.rfkill); list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { list_del(®->list);