A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-11 13:22:39 -05:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/net/mac80211
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Michal Kazior dbef536211 mac80211: prevent skb/txq mismatch 
Station structure is considered as not uploaded
(to driver) until drv_sta_state() finishes. This
call is however done after the structure is
attached to mac80211 internal lists and hashes.
This means mac80211 can lookup (and use) station
structure before it is uploaded to a driver.

If this happens (structure exists, but
sta->uploaded is false) fast_tx path can still be
taken. Deep in the fastpath call the sta->uploaded
is checked against to derive "pubsta" argument for
ieee80211_get_txq(). If sta->uploaded is false
(and sta is actually non-NULL) ieee80211_get_txq()
effectively downgraded to vif->txq.

At first glance this may look innocent but coerces
mac80211 into a state that is almost guaranteed
(codel may drop offending skb) to crash because a
station-oriented skb gets queued up on
vif-oriented txq. The ieee80211_tx_dequeue() ends
up looking at info->control.flags and tries to use
txq->sta which in the fail case is NULL.

It's probably pointless to pretend one can
downgrade skb from sta-txq to vif-txq.

Since downgrading unicast traffic to vif->txq must
not be done there's no txq to put a frame on if
sta->uploaded is false. Therefore the code is made
to fall back to regular tx() op path if the
described condition is hit.

Only drivers using wake_tx_queue were affected.

Example crash dump before fix:

 Unable to handle kernel paging request at virtual address ffffe26c
 PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211]
 [<bf4252a4>] (ieee80211_tx_dequeue [mac80211]) from
 [<bf4b1388>] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core])
 [<bf4b1388>] (ath10k_mac_tx_push_txq [ath10k_core]) from
 [<bf4bdfbc>] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core])
 [<bf4bdfbc>] (ath10k_htt_txrx_compl_task [ath10k_core])
 [<bf51c5a4>] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci])
 [<bf51c5a4>] (ath10k_pci_napi_poll [ath10k_pci]) from
 [<c0572e90>] (net_rx_action+0xac/0x160)

Reported-by: Mohammed Shafi Shajakhan <[email protected]>
Signed-off-by: Michal Kazior <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
2017-01-13 14:47:21 +01:00
..
aes_ccm.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_ccm.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_cmac.c mac80211: FILS AEAD protection for station mode association frames 2016-10-27 16:03:25 +02:00
aes_cmac.h mac80211: FILS AEAD protection for station mode association frames 2016-10-27 16:03:25 +02:00
aes_gcm.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gcm.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gmac.c mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
aes_gmac.h mac80211: move struct aead_req off the stack 2016-10-17 16:14:04 +02:00
agg-rx.c mac80211: fix tid_agg_rx NULL dereference 2016-10-19 12:11:49 +02:00
agg-tx.c mac80211: reject TSPEC TIDs (TSIDs) for aggregation 2016-09-15 10:08:52 +02:00
cfg.c mac80211: validate new interface's beacon intervals 2016-10-27 09:18:07 +02:00
chan.c mac80211: calculate min channel width correctly 2017-01-11 16:34:51 +01:00
debug.h
debugfs.c mac80211: add a HW flag for supporting HW TX fragmentation 2016-10-19 12:12:44 +02:00
debugfs.h
debugfs_key.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
debugfs_key.h
debugfs_netdev.c mac80211: filter multicast data packets on AP / AP_VLAN 2016-10-12 11:33:29 +02:00
debugfs_netdev.h
debugfs_sta.c mac80211: improve RX aggregation data in debugfs 2016-10-19 12:12:11 +02:00
debugfs_sta.h
driver-ops.c mac80211: add offset_tsf driver op and use it for mesh 2016-09-30 13:45:44 +02:00
driver-ops.h mac80211: add offset_tsf driver op and use it for mesh 2016-09-30 13:45:44 +02:00
ethtool.c mac80211: move station statistics into sub-structs 2015-10-21 10:08:22 +02:00
fils_aead.c mac80211: fils_aead: fix encrypt error handling 2016-10-28 12:59:12 +02:00
fils_aead.h mac80211: FILS AEAD protection for station mode association frames 2016-10-27 16:03:25 +02:00
ht.c mac80211: limit the A-MSDU Tx based on peer's capabilities 2016-02-24 09:04:20 +01:00
ibss.c cfg80211: remove enum ieee80211_band 2016-04-12 15:56:15 +02:00
ieee80211_i.h linux: drop __bitwise__ everywhere 2016-12-16 00:13:41 +02:00
iface.c mac80211: recalculate min channel width on VHT opmode changes 2017-01-11 16:35:05 +01:00
Kconfig mac80211: use DECLARE_EWMA 2015-08-14 17:49:53 +02:00
key.c mac80211: don't call drv_set_default_unicast_key() for VLANs 2016-12-13 15:57:59 +01:00
key.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
led.c mac80211: fix throughput LED trigger 2015-05-11 19:16:04 +02:00
led.h mac80211: make LED triggering depend on activation 2015-05-05 14:21:56 +02:00
main.c mac80211: initialize SMPS field in HT capabilities 2017-01-13 11:31:26 +01:00
Makefile Makefile: drop -D__CHECK_ENDIAN__ from cflags 2016-12-16 00:13:43 +02:00
mesh.c mac80211: mesh: flush stations before beacons are stopped 2016-08-03 08:45:15 +02:00
mesh.h mac80211: mesh: fix cleanup for mesh pathtable 2016-04-05 21:34:53 +02:00
mesh_hwmp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-09-23 06:46:57 -04:00
mesh_pathtbl.c mac80211: make mpath path fixing more robust 2016-09-12 12:27:14 +02:00
mesh_plink.c mac80211: use common cleanup for user/!user_mpm 2016-06-30 12:06:41 +02:00
mesh_ps.c mac80211: mesh: separate plid and aid concepts 2015-07-17 15:47:11 +02:00
mesh_sync.c mac80211: mesh: decrease max drift 2016-09-30 13:47:00 +02:00
michael.c
michael.h
mlme.c cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts 2016-12-09 12:57:49 +01:00
ocb.c mac80211: remove rx_stats.last_rx update after sta alloc 2016-04-06 13:18:15 +02:00
offchannel.c mac80211: fix CMD_FRAME for AP_VLAN 2016-10-12 09:19:12 +02:00
pm.c mac80211: remove useless open_count check 2016-09-13 15:39:29 +02:00
rate.c mac80211: calculate min channel width correctly 2017-01-11 16:34:51 +01:00
rate.h mac80211: remove sta_info debugfs sub-struct 2016-04-05 11:59:05 +02:00
rc80211_minstrel.c cfg80211: remove enum ieee80211_band 2016-04-12 15:56:15 +02:00
rc80211_minstrel.h mac80211: add standard deviation to Minstrel stats 2015-04-01 20:44:33 +02:00
rc80211_minstrel_debugfs.c mac80211: minstrel[_ht]: remove non-ascii debugfs characters 2015-09-29 15:56:47 +02:00
rc80211_minstrel_ht.c cfg80211: remove enum ieee80211_band 2016-04-12 15:56:15 +02:00
rc80211_minstrel_ht.h mac80211: add max lossless throughput per rate 2015-04-01 20:44:32 +02:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrel[_ht]: remove non-ascii debugfs characters 2015-09-29 15:56:47 +02:00
rx.c mac80211: recalculate min channel width on VHT opmode changes 2017-01-11 16:35:05 +01:00
scan.c mac80211: fix scan completed tracing 2016-09-15 16:46:16 +02:00
spectmgmt.c mac80211: parse wide bandwidth channel switch IE with workaround 2016-07-06 14:55:04 +02:00
sta_info.c mac80211: fix the TID on NDPs sent as EOSP carrier 2017-01-11 16:32:58 +01:00
sta_info.h mac80211: fix tid_agg_rx NULL dereference 2016-10-19 12:11:49 +02:00
status.c mac80211: Use rhltable instead of rhashtable 2016-09-20 04:43:36 -04:00
tdls.c mac80211: TDLS: don't require beaconing for AP BW 2016-08-30 08:03:41 +02:00
tkip.c mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
tkip.h mac80211: move TKIP TX IVs to public part of key struct 2016-02-24 09:04:38 +01:00
trace.c mac80211: Move message tracepoints to their own header 2015-04-07 12:32:09 -04:00
trace.h mac80211: add offset_tsf driver op and use it for mesh 2016-09-30 13:45:44 +02:00
trace_msg.h mac80211: Move message tracepoints to their own header 2015-04-07 12:32:09 -04:00
tx.c mac80211: prevent skb/txq mismatch 2017-01-13 14:47:21 +01:00
util.c mac80211: validate new interface's beacon intervals 2016-10-27 09:18:07 +02:00
vht.c mac80211: recalculate min channel width on VHT opmode changes 2017-01-11 16:35:05 +01:00
wep.c mac80211: move WEP tailroom size check 2015-05-11 14:51:29 +02:00
wep.h
wme.c mac80211: preserve more bits when building QoS header 2016-10-12 14:17:13 +02:00
wme.h
wpa.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-10-30 12:42:58 -04:00
wpa.h