git/linux-cryptodev-2.6
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git synced 2026-04-04 04:37:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mac80211: handle WLAN_HT_ACTION_NOTIFY_CHANWIDTH async

Browse Source 
If this action frame, with the value of IEEE80211_HT_CHANWIDTH_ANY,
arrives right after a beacon that changed the operational bandwidth from
20 MHz to 40 MHz, then updating the rate control bandwidth to 40 can
race with updating the chanctx width (that happens in the beacon
proccesing) back to 40 MHz:

cpu0					cpu1

ieee80211_rx_mgmt_beacon
ieee80211_config_bw
ieee80211_link_change_chanreq
(*)ieee80211_link_update_chanreq
					ieee80211_rx_h_action
					(**)ieee80211_sta_cur_vht_bw
(***) ieee80211_recalc_chanctx_chantype

in (**), the maximum between the capability width and the bss width is
returned. But the bss width was just updated to 40 in (*),
so the action frame handling code will increase the width of the rate
control before the chanctx was increased (in ***), leading to a FW error
(at least in iwlwifi driver. But this is wrong regardless).

Fix this by simply handling the action frame async, so it won't race
with the beacon proccessing.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218632
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250709233537.bb9dc6f36c35.I39782d6077424e075974c3bee4277761494a1527@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Miri Korenblit
2025-07-09 23:38:02 +03:00
committed by Johannes Berg
parent 6ee152b0cd
commit 93370f2d37
4 changed files with 80 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
net/mac80211/ht.c
View File

@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright 2017 Intel Deutschland GmbH
* Copyright(c) 2020-2024 Intel Corporation
* Copyright(c) 2020-2025 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -603,3 +603,41 @@ out:
}
/* this might change ... don't want non-open drivers using it */
EXPORT_SYMBOL_GPL(ieee80211_request_smps);
void ieee80211_ht_handle_chanwidth_notif(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata,
struct sta_info *sta,
struct link_sta_info *link_sta,
u8 chanwidth, enum nl80211_band band)
{
enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
struct ieee80211_supported_band *sband;
struct sta_opmode_info sta_opmode = {};
lockdep_assert_wiphy(local->hw.wiphy);
if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
max_bw = IEEE80211_STA_RX_BW_20;
else
max_bw = ieee80211_sta_cap_rx_bw(link_sta);
/* set cur_max_bandwidth and recalc sta bw */
link_sta->cur_max_bandwidth = max_bw;
new_bw = ieee80211_sta_cur_vht_bw(link_sta);
if (link_sta->pub->bandwidth == new_bw)
return;
link_sta->pub->bandwidth = new_bw;
sband = local->hw.wiphy->bands[band];
sta_opmode.bw =
ieee80211_sta_rx_bw_to_chan_width(link_sta);
sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
rate_control_rate_update(local, sband, link_sta,
IEEE80211_RC_BW_CHANGED);
cfg80211_sta_opmode_change_notify(sdata->dev,
sta->addr,
&sta_opmode,
GFP_KERNEL);
}

6
net/mac80211/ieee80211_i.h
View File

@@ -2204,6 +2204,12 @@ u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs);
enum nl80211_smps_mode
ieee80211_smps_mode_to_smps_mode(enum ieee80211_smps_mode smps);
void ieee80211_ht_handle_chanwidth_notif(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata,
struct sta_info *sta,
struct link_sta_info *link_sta,
u8 chanwidth, enum nl80211_band band);
/* VHT */
void
ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,

29
net/mac80211/iface.c
View File

@@ -1556,6 +1556,35 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
break;
}
}
} else if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_HT) {
switch (mgmt->u.action.u.ht_smps.action) {
case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
struct ieee80211_rx_status *status;
struct link_sta_info *link_sta;
struct sta_info *sta;
sta = sta_info_get_bss(sdata, mgmt->sa);
if (!sta)
break;
status = IEEE80211_SKB_RXCB(skb);
if (!status->link_valid)
link_sta = &sta->deflink;
else
link_sta = rcu_dereference_protected(sta->link[status->link_id],
lockdep_is_held(&local->hw.wiphy->mtx));
if (link_sta)
ieee80211_ht_handle_chanwidth_notif(local, sdata, sta,
link_sta, chanwidth,
status->band);
break;
}
default:
WARN_ON(1);
break;
}
} else if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_VHT) {
switch (mgmt->u.action.u.vht_group_notif.action_code) {

35
net/mac80211/rx.c
View File

@@ -3580,41 +3580,18 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
goto handled;
}
case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
struct ieee80211_supported_band *sband;
u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
struct sta_opmode_info sta_opmode = {};
if (chanwidth != IEEE80211_HT_CHANWIDTH_20MHZ &&
chanwidth != IEEE80211_HT_CHANWIDTH_ANY)
goto invalid;
/* If it doesn't support 40 MHz it can't change ... */
if (!(rx->link_sta->pub->ht_cap.cap &
IEEE80211_HT_CAP_SUP_WIDTH_20_40))
IEEE80211_HT_CAP_SUP_WIDTH_20_40))
goto handled;
if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
max_bw = IEEE80211_STA_RX_BW_20;
else
max_bw = ieee80211_sta_cap_rx_bw(rx->link_sta);
/* set cur_max_bandwidth and recalc sta bw */
rx->link_sta->cur_max_bandwidth = max_bw;
new_bw = ieee80211_sta_cur_vht_bw(rx->link_sta);
if (rx->link_sta->pub->bandwidth == new_bw)
goto handled;
rx->link_sta->pub->bandwidth = new_bw;
sband = rx->local->hw.wiphy->bands[status->band];
sta_opmode.bw =
ieee80211_sta_rx_bw_to_chan_width(rx->link_sta);
sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
rate_control_rate_update(local, sband, rx->link_sta,
IEEE80211_RC_BW_CHANGED);
cfg80211_sta_opmode_change_notify(sdata->dev,
rx->sta->addr,
&sta_opmode,
GFP_ATOMIC);
goto handled;
goto queue;
}
default:
goto invalid;