[PATCH wireless 0/2] Fix ieee80211_tx_h_select_key() for 802.11 encaps offloading

[PATCH wireless 0/2] Fix ieee80211_tx_h_select_key() for 802.11 encaps offloading

[Remi Pommarel]

The fix in [0] introduces issue with mt7921 chips (at least), due to the
802.11 encapsulation offloading support of those chips.
ieee80211_tx_h_select_key() treated 802.3 frames as if they were 802.11
ones causing the skb's control block hw_key to be invalid.

The first patch fixes the root cause of this issue and the second one
reapplies the initial use after free fix that has been temporarly
reverted meanwhile.

[0] https://lore.kernel.org/linux-wireless/06aa507b853ca385ceded81c18b0a6dd0f081bc8.1742833382.git.repk@triplefau.lt/

Remi Pommarel (2):
  wifi: mac80211: Check 802.11 encaps offloading in
    ieee80211_tx_h_select_key()
  Reapply "wifi: mac80211: Update skb's control block key in
    ieee80211_tx_dequeue()"

 net/mac80211/tx.c | 7 +++++++
 1 file changed, 7 insertions(+)

-- 
2.50.1

[PATCH wireless 1/2] wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()

[Remi Pommarel]

With 802.11 encapsulation offloading, ieee80211_tx_h_select_key() is
called on 802.3 frames. In that case do not try to use skb data as
valid 802.11 headers.

Reported-by: Bert Karwatzki <spasswolf@web.de>
Closes: https://lore.kernel.org/linux-wireless/20250410215527.3001-1-spasswolf@web.de
Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
---
 net/mac80211/tx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d58b80813bdd..0af5bf9aba6a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -612,6 +612,12 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 	else
 		tx->key = NULL;
 
+	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
+		if (tx->key && tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+			info->control.hw_key = &tx->key->conf;
+		return TX_CONTINUE;
+	}
+
 	if (tx->key) {
 		bool skip_hw = false;
 
-- 
2.50.1

[PATCH wireless 2/2] Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"

[Remi Pommarel]

This reverts commit 0937cb5f345c79d702b4d0d744e2a2529b551cb2.

This commit broke TX with 802.11 encapsulation HW offloading, now that
this is fixed, reapply it.

Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
---
 net/mac80211/tx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0af5bf9aba6a..fdc994d8c9c3 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3882,6 +3882,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 	 * The key can be removed while the packet was queued, so need to call
 	 * this here to get the current key.
 	 */
+	info->control.hw_key = NULL;
 	r = ieee80211_tx_h_select_key(&tx);
 	if (r != TX_CONTINUE) {
 		ieee80211_free_txskb(&local->hw, skb);
-- 
2.50.1