From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qt0-x241.google.com (mail-qt0-x241.google.com [IPv6:2607:f8b0:400d:c0d::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 961483B2A3 for ; Thu, 12 Jan 2017 13:44:13 -0500 (EST) Received: by mail-qt0-x241.google.com with SMTP id f4so3459525qte.2 for ; Thu, 12 Jan 2017 10:44:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-transfer-encoding; bh=177/+AtNMTk2HaFSgGKKdwKWctW5DfLq0SdOu0QSYl4=; b=YIJnCRE3s98Wua5WIiR47gpvpHzMxwg6rVDo1U03IrxTR/vEgJ/z8WJYWJL4FydY7R xdKBBZP402NfIeYneMCHfp5b0ZroJeKVDfahCsbfAaBK5XABZp+r0DrFndTcVyrMTcUA dusHy1EvZuBYhWBy9PFepC25lYkEQZYO5eWQ8RodjIfgAPjzo+JPmzEBeI1s+bphZyQZ 0BBgUK7GGf4xvyjMSddsc6t5nXGGyMTtf7TbtpFVnnbZmvOQU5qOWKjPs2O3qxiIAcuv xY7wjvDzZsSHryG6B+Lnr0ZM7SYDjkycEoweH2OMIsZdXFeZsQJtN1gGJjNDgzUOQ0Em 8hvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-transfer-encoding; bh=177/+AtNMTk2HaFSgGKKdwKWctW5DfLq0SdOu0QSYl4=; b=gm1srB4c7J99ecg/Idj19O1BRFauSKyay6un/1VLK/lcj2kxJ9bNKW1kdCSpnhdKKM z72Up2QnK57Jfhc1UGmbRJe8Q7pJODqmeUixFWzkVuemwNXDW6nhID40Cws8S1pnuJS/ 8zJ3ssZOI62kkjTxg/I12eO+E4LKfijIGCNX23P8K5vJds16E1ITPoGje8uwhwBRycRA I4DBjYm22OKzrAn/JxpQcSYUADcYe3MuCQWAhNqwDeya+uFzj253wleiCKQi9aGP3WXJ aJknZNzd+MW6yn4X9ij06MwvWgG7cRLKIuUOZJERUUKazm99In/ZIutsnr6D3A5fIjax t7Ug== X-Gm-Message-State: AIkVDXKztKqd5bWWwffAZeM/4cEXkjpQBPzmSDJj+U644PmK9wciECbOvXZi6u9iC2DG84fBnFJbHRb5fqg4IA== X-Received: by 10.237.59.186 with SMTP id r55mr843357qte.25.1484246652947; Thu, 12 Jan 2017 10:44:12 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.152.197 with HTTP; Thu, 12 Jan 2017 10:44:12 -0800 (PST) In-Reply-To: <1484231321-3179-1-git-send-email-michal.kazior@tieto.com> References: <1484231321-3179-1-git-send-email-michal.kazior@tieto.com> From: Dave Taht Date: Thu, 12 Jan 2017 10:44:12 -0800 Message-ID: To: make-wifi-fast@lists.bufferbloat.net Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Make-wifi-fast] Fwd: [PATCH] mac80211: prevent skb/txq mismatch X-BeenThere: make-wifi-fast@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Jan 2017 18:44:13 -0000 yea! (I think) ---------- Forwarded message ---------- From: Michal Kazior Date: Thu, Jan 12, 2017 at 6:28 AM Subject: [PATCH] mac80211: prevent skb/txq mismatch To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, greearb@candelatech.com, mohammed@qti.qualcomm.com, Michal Kazior Station structure is considered as not uploaded (to driver) until drv_sta_state() finishes. This call is however done after the structure is attached to mac80211 internal lists and hashes. This means mac80211 can lookup (and use) station structure before it is uploaded to a driver. If this happens (structure exists, but sta->uploaded is false) fast_tx path can still be taken. Deep in the fastpath call the sta->uploaded is checked against to derive "pubsta" argument for ieee80211_get_txq(). If sta->uploaded is false (and sta is actually non-NULL) ieee80211_get_txq() effectively downgraded to vif->txq. At first glance this may look innocent but coerces mac80211 into a state that is almost guaranteed (codel may drop offending skb) to crash because a station-oriented skb gets queued up on vif-oriented txq. The ieee80211_tx_dequeue() ends up looking at info->control.flags and tries to use txq->sta which in the fail case is NULL. It's probably pointless to pretend one can downgrade skb from sta-txq to vif-txq. Only drivers using wake_tx_queue were affected. Example crash dump before fix: Unable to handle kernel paging request at virtual address ffffe26c PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211] [] (ieee80211_tx_dequeue [mac80211]) from [] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core]) [] (ath10k_mac_tx_push_txq [ath10k_core]) from [] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core]) [] (ath10k_htt_txrx_compl_task [ath10k_core]) [] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci]) [] (ath10k_pci_napi_poll [ath10k_pci]) from [] (net_rx_action+0xac/0x160) Reported-by: Mohammed Shafi Shajakhan Signed-off-by: Michal Kazior --- net/mac80211/tx.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 4dea18be385c..c77fcf83d004 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1244,13 +1244,16 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata, static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local, struct ieee80211_vif *vif, - struct ieee80211_sta *pubsta, + struct sta_info *sta, struct sk_buff *skb) { struct ieee80211_hdr *hdr =3D (struct ieee80211_hdr *) skb->data; struct ieee80211_tx_info *info =3D IEEE80211_SKB_CB(skb); struct ieee80211_txq *txq =3D NULL; + if (sta && !sta->uploaded) + return NULL; + if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) || (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE)) return NULL; @@ -1258,10 +1261,10 @@ static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local, if (!ieee80211_is_data(hdr->frame_control)) return NULL; - if (pubsta) { + if (sta) { u8 tid =3D skb->priority & IEEE80211_QOS_CTL_TID_MASK; - txq =3D pubsta->txq[tid]; + txq =3D sta->sta.txq[tid]; } else if (vif) { txq =3D vif->txq; } @@ -1504,23 +1507,17 @@ static bool ieee80211_queue_skb(struct ieee80211_local *local, struct fq *fq =3D &local->fq; struct ieee80211_vif *vif; struct txq_info *txqi; - struct ieee80211_sta *pubsta; if (!local->ops->wake_tx_queue || sdata->vif.type =3D=3D NL80211_IFTYPE_MONITOR) return false; - if (sta && sta->uploaded) - pubsta =3D &sta->sta; - else - pubsta =3D NULL; - if (sdata->vif.type =3D=3D NL80211_IFTYPE_AP_VLAN) sdata =3D container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap); vif =3D &sdata->vif; - txqi =3D ieee80211_get_txq(local, vif, pubsta, skb); + txqi =3D ieee80211_get_txq(local, vif, sta, skb); if (!txqi) return false; -- 2.1.4 --=20 Dave T=C3=A4ht Let's go make home routers and wifi faster! With better software! http://blog.cerowrt.org