From patchwork Fri May 8 12:35:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226152 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D134C47247 for ; Fri, 8 May 2020 13:04:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 06D7E20870 for ; Fri, 8 May 2020 13:04:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588943063; bh=17DgDuTxETQ7MoiY0oIHgTCZqZuCFtkAUqdkpS8UAG8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2GEVHWzC9CG+19IfbAL3lF6T+5hdxxiQHzQ9qMpKSrNwzM4d3+1QMGgC8GU5jStfF PUe6osoz7C4q+S5SO14TH+81g/Nrp19Y1r9dnVFqawcX10MkhbqvWnNuA0u6HobSBt 2ndBdC+gY/nraJFbVvTTN3k3TKPrQNojIctdRgPU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728820AbgEHMtI (ORCPT ); Fri, 8 May 2020 08:49:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:54004 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728684AbgEHMtH (ORCPT ); Fri, 8 May 2020 08:49:07 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0A3472495C; Fri, 8 May 2020 12:49:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588942143; bh=17DgDuTxETQ7MoiY0oIHgTCZqZuCFtkAUqdkpS8UAG8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DJiwxZKfBZ60xdj0yVLU3962cXmMX4VC3hR4NRR0ZbTnxcTy0PDTaDQueWAxwVaPC DwObApeTZLnN+iFN9Ajv3y405ockGEhrPNllAOAjc5F/lldVct810mDCuWf64KyfPe Tgcg0MskBnl3QgcfGuo7kd48m9eFkCwnE67fHI2s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Pedersen , Johannes Berg Subject: [PATCH 4.4 312/312] mac80211: add ieee80211_is_any_nullfunc() Date: Fri, 8 May 2020 14:35:03 +0200 Message-Id: <20200508123146.483755402@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200508123124.574959822@linuxfoundation.org> References: <20200508123124.574959822@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Thomas Pedersen commit 30b2f0be23fb40e58d0ad2caf8702c2a44cda2e1 upstream. commit 08a5bdde3812 ("mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED") Fixed a bug where we failed to take into account a nullfunc frame can be either non-QoS or QoS. It turns out there is at least one more bug in ieee80211_sta_tx_notify(), introduced in commit 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing"), where we forgot to check for the QoS variant and so assumed the QoS nullfunc frame never went out Fix this by adding a helper ieee80211_is_any_nullfunc() which consolidates the check for non-QoS and QoS nullfunc frames. Replace existing compound conditionals and add a couple more missing checks for QoS variant. Signed-off-by: Thomas Pedersen Link: https://lore.kernel.org/r/20200114055940.18502-3-thomas@adapt-ip.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- include/linux/ieee80211.h | 9 +++++++++ net/mac80211/mlme.c | 2 +- net/mac80211/rx.c | 8 +++----- net/mac80211/status.c | 5 ++--- net/mac80211/tx.c | 2 +- 5 files changed, 16 insertions(+), 10 deletions(-) --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -607,6 +607,15 @@ static inline bool ieee80211_is_qos_null } /** + * ieee80211_is_any_nullfunc - check if frame is regular or QoS nullfunc frame + * @fc: frame control bytes in little-endian byteorder + */ +static inline bool ieee80211_is_any_nullfunc(__le16 fc) +{ + return (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)); +} + +/** * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU * @fc: frame control field in little-endian byteorder */ --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -2283,7 +2283,7 @@ void ieee80211_sta_tx_notify(struct ieee if (!ieee80211_is_data(hdr->frame_control)) return; - if (ieee80211_is_nullfunc(hdr->frame_control) && + if (ieee80211_is_any_nullfunc(hdr->frame_control) && sdata->u.mgd.probe_send_count > 0) { if (ack) ieee80211_sta_reset_conn_monitor(sdata); --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1110,8 +1110,7 @@ ieee80211_rx_h_check_dup(struct ieee8021 return RX_CONTINUE; if (ieee80211_is_ctl(hdr->frame_control) || - ieee80211_is_nullfunc(hdr->frame_control) || - ieee80211_is_qos_nullfunc(hdr->frame_control) || + ieee80211_is_any_nullfunc(hdr->frame_control) || is_multicast_ether_addr(hdr->addr1)) return RX_CONTINUE; @@ -1487,8 +1486,7 @@ ieee80211_rx_h_sta_process(struct ieee80 * Drop (qos-)data::nullfunc frames silently, since they * are used only to control station power saving mode. */ - if (ieee80211_is_nullfunc(hdr->frame_control) || - ieee80211_is_qos_nullfunc(hdr->frame_control)) { + if (ieee80211_is_any_nullfunc(hdr->frame_control)) { I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); /* @@ -1977,7 +1975,7 @@ static int ieee80211_drop_unencrypted(st /* Drop unencrypted frames if key is set. */ if (unlikely(!ieee80211_has_protected(fc) && - !ieee80211_is_nullfunc(fc) && + !ieee80211_is_any_nullfunc(fc) && ieee80211_is_data(fc) && rx->key)) return -EACCES; --- a/net/mac80211/status.c +++ b/net/mac80211/status.c @@ -474,8 +474,7 @@ static void ieee80211_report_ack_skb(str rcu_read_lock(); sdata = ieee80211_sdata_from_skb(local, skb); if (sdata) { - if (ieee80211_is_nullfunc(hdr->frame_control) || - ieee80211_is_qos_nullfunc(hdr->frame_control)) + if (ieee80211_is_any_nullfunc(hdr->frame_control)) cfg80211_probe_status(sdata->dev, hdr->addr1, cookie, acked, GFP_ATOMIC); @@ -905,7 +904,7 @@ void ieee80211_tx_status(struct ieee8021 I802_DEBUG_INC(local->dot11FailedCount); } - if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && + if (ieee80211_is_any_nullfunc(fc) && ieee80211_has_pm(fc) && ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && !(info->flags & IEEE80211_TX_CTL_INJECTED) && local->ps_sdata && !(local->scanning)) { --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -291,7 +291,7 @@ ieee80211_tx_h_check_assoc(struct ieee80 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) && test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) && !ieee80211_is_probe_req(hdr->frame_control) && - !ieee80211_is_nullfunc(hdr->frame_control)) + !ieee80211_is_any_nullfunc(hdr->frame_control)) /* * When software scanning only nullfunc frames (to notify * the sleep state to the AP) and probe requests (for the