1. 28 Apr, 2017 8 commits
    • Mohammed Shafi Shajakhan's avatar
      mac80211: Fix possible sband related NULL pointer de-reference · 21a8e9dd
      Mohammed Shafi Shajakhan authored
      Existing API 'ieee80211_get_sdata_band' returns default 2 GHz band even
      if the channel context configuration is NULL. This crashes for chipsets
      which support 5 Ghz alone when it tries to access members of 'sband'.
      Channel context configuration can be NULL in multivif case and when
      channel switch is in progress (or) when it fails. Fix this by replacing
      the API 'ieee80211_get_sdata_band' with  'ieee80211_get_sband' which
      returns a NULL pointer for sband when the channel configuration is NULL.
      
      An example scenario is as below:
      
      In multivif mode (AP + STA) with drivers like ath10k, when we do a
      channel switch in the AP vif (which has a number of clients connected)
      and a STA vif which is connected to some other AP, when the channel
      switch in AP vif fails, while the STA vifs tries to connect to the
      other AP, there is a window where the channel context is NULL/invalid
      and this results in a crash  while the clients connected to the AP vif
      tries to reconnect and this race is very similar to the one investigated
      by Michal in https://patchwork.kernel.org/patch/3788161/ and this does
      happens with hardware that supports 5Ghz alone after long hours of
      testing with continuous channel switch on the AP vif
      
      ieee80211 phy0: channel context reservation cannot be finalized because
      some interfaces aren't switching
      wlan0: failed to finalize CSA, disconnecting
      wlan0-1: deauthenticating from 8c:fd:f0:01:54:9c by local choice
      	(Reason: 3=DEAUTH_LEAVING)
      
      	WARNING: CPU: 1 PID: 19032 at net/mac80211/ieee80211_i.h:1013 sta_info_alloc+0x374/0x3fc [mac80211]
      	[<bf77272c>] (sta_info_alloc [mac80211])
      	[<bf78776c>] (ieee80211_add_station [mac80211]))
      	[<bf73cc50>] (nl80211_new_station [cfg80211])
      
      	Unable to handle kernel NULL pointer dereference at virtual
      	address 00000014
      	pgd = d5f4c000
      	Internal error: Oops: 17 [#1] PREEMPT SMP ARM
      	PC is at sta_info_alloc+0x380/0x3fc [mac80211]
      	LR is at sta_info_alloc+0x37c/0x3fc [mac80211]
      	[<bf772738>] (sta_info_alloc [mac80211])
      	[<bf78776c>] (ieee80211_add_station [mac80211])
      	[<bf73cc50>] (nl80211_new_station [cfg80211]))
      
      Cc: Michal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      21a8e9dd
    • Felix Fietkau's avatar
      mac80211: add ieee80211_tx_status_ext · 5fe49a9d
      Felix Fietkau authored
      This allows the driver to pass in struct ieee80211_tx_status directly.
      Make ieee80211_tx_status_noskb a wrapper around it.
      
      As with ieee80211_tx_status_noskb, there is no _ni variant of this call,
      because it probably won't be needed.
      
      Even if the driver won't provide any extra status info other than what's
      in struct ieee80211_tx_info already, it can optimize status reporting
      this way by passing in the station pointer.
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      [use C99 initializers]
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      5fe49a9d
    • Felix Fietkau's avatar
      mac80211: move ieee80211_tx_status_noskb below ieee80211_tx_status · eefebd31
      Felix Fietkau authored
      Makes further cleanups more readable
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      eefebd31
    • Felix Fietkau's avatar
      mac80211: make rate control tx status API more extensible · 18fb84d9
      Felix Fietkau authored
      Rename .tx_status_noskb to .tx_status_ext and pass a new on-stack
      struct ieee80211_tx_status instead of struct ieee80211_tx_info.
      
      This struct can be used to pass extra information, e.g. for dynamic tx
      power control
      Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      18fb84d9
    • Johannes Berg's avatar
      mac80211: use bitfield macros for encoded rate · dcba665b
      Johannes Berg authored
      Instead of hand-coding the bit manipulations, use the bitfield
      macros to generate the code for the encoded bitrate.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      dcba665b
    • Johannes Berg's avatar
      mac80211: rename ieee80211_rx_status::vht_nss to just nss · 8613c948
      Johannes Berg authored
      This field will need to be used again for HE, so rename it now.
      
      Again, mostly done with this spatch:
      
      @@
      expression status;
      @@
      -status->vht_nss
      +status->nss
      @@
      expression status;
      @@
      -status.vht_nss
      +status.nss
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      8613c948
    • Johannes Berg's avatar
      mac80211: separate encoding/bandwidth from flags · da6a4352
      Johannes Berg authored
      We currently use a lot of flags that are mutually incompatible,
      separate this out into actual encoding and bandwidth enum values.
      
      Much of this again done with spatch, with manual post-editing,
      mostly to add the switch statements and get rid of the conversions.
      
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_80MHZ
      +status->bw = RATE_INFO_BW_80
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_40MHZ
      +status->bw = RATE_INFO_BW_40
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_20MHZ
      +status->bw = RATE_INFO_BW_20
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_160MHZ
      +status->bw = RATE_INFO_BW_160
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_5MHZ
      +status->bw = RATE_INFO_BW_5
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_10MHZ
      +status->bw = RATE_INFO_BW_10
      
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_VHT
      +status->encoding = RX_ENC_VHT
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_HT
      +status->encoding = RX_ENC_HT
      @@
      expression status;
      @@
      -status.enc_flags |= RX_ENC_FLAG_VHT
      +status.encoding = RX_ENC_VHT
      @@
      expression status;
      @@
      -status.enc_flags |= RX_ENC_FLAG_HT
      +status.encoding = RX_ENC_HT
      
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_HT)
      +(status->encoding == RX_ENC_HT)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_VHT)
      +(status->encoding == RX_ENC_VHT)
      
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_5MHZ)
      +(status->bw == RATE_INFO_BW_5)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_10MHZ)
      +(status->bw == RATE_INFO_BW_10)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_40MHZ)
      +(status->bw == RATE_INFO_BW_40)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_80MHZ)
      +(status->bw == RATE_INFO_BW_80)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_160MHZ)
      +(status->bw == RATE_INFO_BW_160)
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      da6a4352
    • Johannes Berg's avatar
      mac80211: clean up rate encoding bits in RX status · 7fdd69c5
      Johannes Berg authored
      In preparation for adding support for HE rates, clean up
      the driver report encoding for rate/bandwidth reporting
      on RX frames.
      
      Much of this patch was done with the following spatch:
      
      @@
      expression status;
      @@
      -status->flag & (RX_FLAG_HT | RX_FLAG_VHT)
      +status->enc_flags & (RX_ENC_FLAG_HT | RX_ENC_FLAG_VHT)
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_SHORTPRE
      +status->enc_flags op RX_ENC_FLAG_SHORTPRE
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_SHORTPRE
      +status->enc_flags & RX_ENC_FLAG_SHORTPRE
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_HT
      +status->enc_flags op RX_ENC_FLAG_HT
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_HT
      +status->enc_flags & RX_ENC_FLAG_HT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_40MHZ
      +status->enc_flags op RX_ENC_FLAG_40MHZ
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_40MHZ
      +status->enc_flags & RX_ENC_FLAG_40MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_SHORT_GI
      +status->enc_flags op RX_ENC_FLAG_SHORT_GI
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_SHORT_GI
      +status->enc_flags & RX_ENC_FLAG_SHORT_GI
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_HT_GF
      +status->enc_flags op RX_ENC_FLAG_HT_GF
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_HT_GF
      +status->enc_flags & RX_ENC_FLAG_HT_GF
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_VHT
      +status->enc_flags op RX_ENC_FLAG_VHT
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_VHT
      +status->enc_flags & RX_ENC_FLAG_VHT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_STBC_MASK
      +status->enc_flags op RX_ENC_FLAG_STBC_MASK
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_STBC_MASK
      +status->enc_flags & RX_ENC_FLAG_STBC_MASK
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_LDPC
      +status->enc_flags op RX_ENC_FLAG_LDPC
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_LDPC
      +status->enc_flags & RX_ENC_FLAG_LDPC
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_10MHZ
      +status->enc_flags op RX_ENC_FLAG_10MHZ
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_10MHZ
      +status->enc_flags & RX_ENC_FLAG_10MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_5MHZ
      +status->enc_flags op RX_ENC_FLAG_5MHZ
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_5MHZ
      +status->enc_flags & RX_ENC_FLAG_5MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->vht_flag op RX_VHT_FLAG_80MHZ
      +status->enc_flags op RX_ENC_FLAG_80MHZ
      @@
      expression status;
      @@
      -status->vht_flag & RX_VHT_FLAG_80MHZ
      +status->enc_flags & RX_ENC_FLAG_80MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->vht_flag op RX_VHT_FLAG_160MHZ
      +status->enc_flags op RX_ENC_FLAG_160MHZ
      @@
      expression status;
      @@
      -status->vht_flag & RX_VHT_FLAG_160MHZ
      +status->enc_flags & RX_ENC_FLAG_160MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->vht_flag op RX_VHT_FLAG_BF
      +status->enc_flags op RX_ENC_FLAG_BF
      @@
      expression status;
      @@
      -status->vht_flag & RX_VHT_FLAG_BF
      +status->enc_flags & RX_ENC_FLAG_BF
      
      @@
      assignment operator op;
      expression status, STBC;
      @@
      -status->flag op STBC << RX_FLAG_STBC_SHIFT
      +status->enc_flags op STBC << RX_ENC_FLAG_STBC_SHIFT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_SHORTPRE
      +status.enc_flags op RX_ENC_FLAG_SHORTPRE
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_SHORTPRE
      +status.enc_flags & RX_ENC_FLAG_SHORTPRE
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_HT
      +status.enc_flags op RX_ENC_FLAG_HT
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_HT
      +status.enc_flags & RX_ENC_FLAG_HT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_40MHZ
      +status.enc_flags op RX_ENC_FLAG_40MHZ
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_40MHZ
      +status.enc_flags & RX_ENC_FLAG_40MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_SHORT_GI
      +status.enc_flags op RX_ENC_FLAG_SHORT_GI
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_SHORT_GI
      +status.enc_flags & RX_ENC_FLAG_SHORT_GI
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_HT_GF
      +status.enc_flags op RX_ENC_FLAG_HT_GF
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_HT_GF
      +status.enc_flags & RX_ENC_FLAG_HT_GF
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_VHT
      +status.enc_flags op RX_ENC_FLAG_VHT
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_VHT
      +status.enc_flags & RX_ENC_FLAG_VHT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_STBC_MASK
      +status.enc_flags op RX_ENC_FLAG_STBC_MASK
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_STBC_MASK
      +status.enc_flags & RX_ENC_FLAG_STBC_MASK
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_LDPC
      +status.enc_flags op RX_ENC_FLAG_LDPC
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_LDPC
      +status.enc_flags & RX_ENC_FLAG_LDPC
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_10MHZ
      +status.enc_flags op RX_ENC_FLAG_10MHZ
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_10MHZ
      +status.enc_flags & RX_ENC_FLAG_10MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_5MHZ
      +status.enc_flags op RX_ENC_FLAG_5MHZ
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_5MHZ
      +status.enc_flags & RX_ENC_FLAG_5MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.vht_flag op RX_VHT_FLAG_80MHZ
      +status.enc_flags op RX_ENC_FLAG_80MHZ
      @@
      expression status;
      @@
      -status.vht_flag & RX_VHT_FLAG_80MHZ
      +status.enc_flags & RX_ENC_FLAG_80MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.vht_flag op RX_VHT_FLAG_160MHZ
      +status.enc_flags op RX_ENC_FLAG_160MHZ
      @@
      expression status;
      @@
      -status.vht_flag & RX_VHT_FLAG_160MHZ
      +status.enc_flags & RX_ENC_FLAG_160MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.vht_flag op RX_VHT_FLAG_BF
      +status.enc_flags op RX_ENC_FLAG_BF
      @@
      expression status;
      @@
      -status.vht_flag & RX_VHT_FLAG_BF
      +status.enc_flags & RX_ENC_FLAG_BF
      
      @@
      assignment operator op;
      expression status, STBC;
      @@
      -status.flag op STBC << RX_FLAG_STBC_SHIFT
      +status.enc_flags op STBC << RX_ENC_FLAG_STBC_SHIFT
      
      @@
      @@
      -RX_FLAG_STBC_SHIFT
      +RX_ENC_FLAG_STBC_SHIFT
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      7fdd69c5
  2. 26 Apr, 2017 10 commits
  3. 25 Apr, 2017 22 commits