From patchwork Fri Jan 13 12:32:51 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kazior X-Patchwork-Id: 9515509 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 29EC9601DA for ; Fri, 13 Jan 2017 12:31:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1F0832862E for ; Fri, 13 Jan 2017 12:31:46 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 139EB2863D; Fri, 13 Jan 2017 12:31:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 06A7F2862E for ; Fri, 13 Jan 2017 12:31:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751521AbdAMMbn (ORCPT ); Fri, 13 Jan 2017 07:31:43 -0500 Received: from mail-lf0-f45.google.com ([209.85.215.45]:35319 "EHLO mail-lf0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751476AbdAMMbm (ORCPT ); Fri, 13 Jan 2017 07:31:42 -0500 Received: by mail-lf0-f45.google.com with SMTP id m78so36195386lfg.2 for ; Fri, 13 Jan 2017 04:31:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tieto.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=MGxlPJKExtMOzqKc3aKjHXYGNi/BBhkG/whb+jFHv4s=; b=dzL39fBmSpRzr7XUcn/N+pAjTV2jxxIx9pm1ZI33uLDB08jbRSS+rEv/dkZKwfPWMt F78kHrQHI7eDFKy4cudmxVaEi7Qyyv0EO1edzAO6CCsVhn28p0OhT3UlszylE+zOF482 k7LHk5YpnoFGl2ZIsYVdNSnFYkK0DeISI4HEY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=MGxlPJKExtMOzqKc3aKjHXYGNi/BBhkG/whb+jFHv4s=; b=BeFVTNcN5T+cUB6h5gRB1L6fOAgGE4SRqbkyHXxfQcbMSRRs9zJKY3+/sb2t/bHwZC VRimlYTNeiS0TDmfCHsSXV+sE4lAIrG9RaSYn+t2rift2EkruBT99AFSaVUVFpjC6LE4 Bd/QdfrIYkcd1QIrVw89uu0XfHL92DhUI4Une8DOPFfmezlO1aS0sLCJA03VRhryvZ18 OOLpsEytBRpNmPHGQLIGUrEyV5jwNbh/f2L2LVFgxTCINgb+iPZEfW7gcT0DVW2RdAB5 rM1O9+0VoPj/eTMEfoHicomoSZnJgdQLTOBVBn4mTFTXTXfrlsup0z96m3kHFfUjgRqw /TQQ== X-Gm-Message-State: AIkVDXLO0bc5kKjd9mGRb2SDAoLh9f5qSU5zj4dttpSC/P7vTtms/wk4N4Rgqk2zHcY5e9GMks63xqOpN9tZ5lBmdmoTz7+O0s7lL0NS2oyKK2kd/cb/CmKHczX2S2VnAkGPzmYPF11Tfw== X-Received: by 10.25.22.104 with SMTP id m101mr6378810lfi.17.1484310700542; Fri, 13 Jan 2017 04:31:40 -0800 (PST) Received: from localhost.localdomain ([91.198.246.8]) by smtp.gmail.com with ESMTPSA id 96sm3783125lfp.18.2017.01.13.04.31.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 13 Jan 2017 04:31:39 -0800 (PST) From: Michal Kazior To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, greearb@candelatech.com, mohammed@qti.qualcomm.com, Michal Kazior Subject: [PATCH v2] mac80211: prevent skb/txq mismatch Date: Fri, 13 Jan 2017 13:32:51 +0100 Message-Id: <1484310771-28359-1-git-send-email-michal.kazior@tieto.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1484231321-3179-1-git-send-email-michal.kazior@tieto.com> References: <1484231321-3179-1-git-send-email-michal.kazior@tieto.com> X-DomainID: tieto.com Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Station structure is considered as not uploaded (to driver) until drv_sta_state() finishes. This call is however done after the structure is attached to mac80211 internal lists and hashes. This means mac80211 can lookup (and use) station structure before it is uploaded to a driver. If this happens (structure exists, but sta->uploaded is false) fast_tx path can still be taken. Deep in the fastpath call the sta->uploaded is checked against to derive "pubsta" argument for ieee80211_get_txq(). If sta->uploaded is false (and sta is actually non-NULL) ieee80211_get_txq() effectively downgraded to vif->txq. At first glance this may look innocent but coerces mac80211 into a state that is almost guaranteed (codel may drop offending skb) to crash because a station-oriented skb gets queued up on vif-oriented txq. The ieee80211_tx_dequeue() ends up looking at info->control.flags and tries to use txq->sta which in the fail case is NULL. It's probably pointless to pretend one can downgrade skb from sta-txq to vif-txq. Since downgrading unicast traffic to vif->txq must not be done there's no txq to put a frame on if sta->uploaded is false. Therefore the code is made to fall back to regular tx() op path if the described condition is hit. Only drivers using wake_tx_queue were affected. Example crash dump before fix: Unable to handle kernel paging request at virtual address ffffe26c PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211] [] (ieee80211_tx_dequeue [mac80211]) from [] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core]) [] (ath10k_mac_tx_push_txq [ath10k_core]) from [] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core]) [] (ath10k_htt_txrx_compl_task [ath10k_core]) [] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci]) [] (ath10k_pci_napi_poll [ath10k_pci]) from [] (net_rx_action+0xac/0x160) Reported-by: Mohammed Shafi Shajakhan Signed-off-by: Michal Kazior --- Notes: v2: * move sta->uploaded check to if (sta) {} block [johannes] * explain how the change fixes the bug [johannes] net/mac80211/tx.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 4dea18be385c..2076d62207ee 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1244,7 +1244,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata, static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local, struct ieee80211_vif *vif, - struct ieee80211_sta *pubsta, + struct sta_info *sta, struct sk_buff *skb) { struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; @@ -1258,10 +1258,13 @@ static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local, if (!ieee80211_is_data(hdr->frame_control)) return NULL; - if (pubsta) { + if (sta) { u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK; - txq = pubsta->txq[tid]; + if (!sta->uploaded) + return NULL; + + txq = sta->sta.txq[tid]; } else if (vif) { txq = vif->txq; } @@ -1504,23 +1507,17 @@ static bool ieee80211_queue_skb(struct ieee80211_local *local, struct fq *fq = &local->fq; struct ieee80211_vif *vif; struct txq_info *txqi; - struct ieee80211_sta *pubsta; if (!local->ops->wake_tx_queue || sdata->vif.type == NL80211_IFTYPE_MONITOR) return false; - if (sta && sta->uploaded) - pubsta = &sta->sta; - else - pubsta = NULL; - if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap); vif = &sdata->vif; - txqi = ieee80211_get_txq(local, vif, pubsta, skb); + txqi = ieee80211_get_txq(local, vif, sta, skb); if (!txqi) return false;