linux-next: manual merge of the net-next tree with the wireless tree

linux-next: manual merge of the net-next tree with the wireless tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 7266 bytes --]

Hi all,

Today's linux-next merge of the net-next tree got conflicts in
drivers/net/wireless/iwlwifi/iwl-trans.h,
drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c, and
drivers/net/wireless/iwlwifi/iwl-agn-rx.c between commit ed90542b0ce5
("iwlwifi: fix skb truesize underestimation") from the wireless tree and
various commits from the net-next tree.

This was anticipated and I have applied the fix supplied by John (see
below just to check).  Thanks to John for this!
-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

diff --cc drivers/net/wireless/iwlwifi/iwl-agn-rx.c
index 2247460,f941223..0000000
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@@ -787,25 -752,15 +751,24 @@@ static void iwlagn_pass_packet_to_mac80
  	    iwlagn_set_decrypted_flag(priv, hdr, ampdu_status, stats))
  		return;
  
 -	skb = dev_alloc_skb(128);
 +	/* Dont use dev_alloc_skb(), we'll have enough headroom once
 +	 * ieee80211_hdr pulled.
 +	 */
 +	skb = alloc_skb(128, GFP_ATOMIC);
  	if (!skb) {
 -		IWL_ERR(priv, "dev_alloc_skb failed\n");
 +		IWL_ERR(priv, "alloc_skb failed\n");
  		return;
  	}
 +	hdrlen = min_t(unsigned int, len, skb_tailroom(skb));
 +	memcpy(skb_put(skb, hdrlen), hdr, hdrlen);
 +	fraglen = len - hdrlen;
 +
 +	if (fraglen) {
- 		int offset = (void *)hdr + hdrlen - rxb_addr(rxb);
++		int offset = (void *)hdr - rxb_addr(rxb) + rxb_offset(rxb);
  
 -	offset = (void *)hdr - rxb_addr(rxb) + rxb_offset(rxb);
 -	p = rxb_steal_page(rxb);
 -	skb_add_rx_frag(skb, 0, p, offset, len, len);
 +		skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
 +				fraglen, rxb->truesize);
 +	}
- 	iwl_update_stats(priv, false, fc, len);
  
  	/*
  	* Wake any queues that were stopped due to a passive channel tx
diff --cc drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
index aa7aea1,d2239aa..0000000
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
@@@ -374,72 -373,89 +373,90 @@@ static void iwl_rx_handle_rxbuf(struct 
  	if (WARN_ON(!rxb))
  		return;
  
- 	rxcb.truesize = PAGE_SIZE << hw_params(trans).rx_page_order;
- 	dma_unmap_page(trans->dev, rxb->page_dma,
- 		       rxcb.truesize,
- 		       DMA_FROM_DEVICE);
- 
- 	rxcb._page = rxb->page;
- 	pkt = rxb_addr(&rxcb);
- 
- 	IWL_DEBUG_RX(trans, "%s, 0x%02x\n",
- 		     get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
+ 	dma_unmap_page(trans->dev, rxb->page_dma, max_len, DMA_FROM_DEVICE);
  
+ 	while (offset + sizeof(u32) + sizeof(struct iwl_cmd_header) < max_len) {
+ 		struct iwl_rx_packet *pkt;
+ 		struct iwl_device_cmd *cmd;
+ 		u16 sequence;
+ 		bool reclaim;
+ 		int index, cmd_index, err, len;
+ 		struct iwl_rx_cmd_buffer rxcb = {
+ 			._offset = offset,
+ 			._page = rxb->page,
+ 			._page_stolen = false,
++			.truesize = max_len,
+ 		};
  
- 	len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
- 	len += sizeof(u32); /* account for status word */
- 	trace_iwlwifi_dev_rx(trans->dev, pkt, len);
+ 		pkt = rxb_addr(&rxcb);
  
- 	/* Reclaim a command buffer only if this packet is a response
- 	 *   to a (driver-originated) command.
- 	 * If the packet (e.g. Rx frame) originated from uCode,
- 	 *   there is no command buffer to reclaim.
- 	 * Ucode should set SEQ_RX_FRAME bit if ucode-originated,
- 	 *   but apparently a few don't get set; catch them here. */
- 	reclaim = !(pkt->hdr.sequence & SEQ_RX_FRAME);
- 	if (reclaim) {
- 		int i;
+ 		if (pkt->len_n_flags == cpu_to_le32(FH_RSCSR_FRAME_INVALID))
+ 			break;
  
- 		for (i = 0; i < trans_pcie->n_no_reclaim_cmds; i++) {
- 			if (trans_pcie->no_reclaim_cmds[i] == pkt->hdr.cmd) {
- 				reclaim = false;
- 				break;
+ 		IWL_DEBUG_RX(trans, "cmd at offset %d: %s (0x%.2x)\n",
+ 			rxcb._offset,
+ 			trans_pcie_get_cmd_string(trans_pcie, pkt->hdr.cmd),
+ 			pkt->hdr.cmd);
+ 
+ 		len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+ 		len += sizeof(u32); /* account for status word */
+ 		trace_iwlwifi_dev_rx(trans->dev, pkt, len);
+ 
+ 		/* Reclaim a command buffer only if this packet is a response
+ 		 *   to a (driver-originated) command.
+ 		 * If the packet (e.g. Rx frame) originated from uCode,
+ 		 *   there is no command buffer to reclaim.
+ 		 * Ucode should set SEQ_RX_FRAME bit if ucode-originated,
+ 		 *   but apparently a few don't get set; catch them here. */
+ 		reclaim = !(pkt->hdr.sequence & SEQ_RX_FRAME);
+ 		if (reclaim) {
+ 			int i;
+ 
+ 			for (i = 0; i < trans_pcie->n_no_reclaim_cmds; i++) {
+ 				if (trans_pcie->no_reclaim_cmds[i] ==
+ 							pkt->hdr.cmd) {
+ 					reclaim = false;
+ 					break;
+ 				}
  			}
  		}
- 	}
  
- 	sequence = le16_to_cpu(pkt->hdr.sequence);
- 	index = SEQ_TO_INDEX(sequence);
- 	cmd_index = get_cmd_index(&txq->q, index);
+ 		sequence = le16_to_cpu(pkt->hdr.sequence);
+ 		index = SEQ_TO_INDEX(sequence);
+ 		cmd_index = get_cmd_index(&txq->q, index);
  
- 	if (reclaim)
- 		cmd = txq->cmd[cmd_index];
- 	else
- 		cmd = NULL;
+ 		if (reclaim)
+ 			cmd = txq->entries[cmd_index].cmd;
+ 		else
+ 			cmd = NULL;
  
- 	err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
+ 		err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
  
- 	/*
- 	 * XXX: After here, we should always check rxcb._page
- 	 * against NULL before touching it or its virtual
- 	 * memory (pkt). Because some rx_handler might have
- 	 * already taken or freed the pages.
- 	 */
+ 		/*
+ 		 * After here, we should always check rxcb._page_stolen,
+ 		 * if it is true then one of the handlers took the page.
+ 		 */
  
- 	if (reclaim) {
- 		/* Invoke any callbacks, transfer the buffer to caller,
- 		 * and fire off the (possibly) blocking
- 		 * iwl_trans_send_cmd()
- 		 * as we reclaim the driver command queue */
- 		if (rxcb._page)
- 			iwl_tx_cmd_complete(trans, &rxcb, err);
- 		else
- 			IWL_WARN(trans, "Claim null rxb?\n");
+ 		if (reclaim) {
+ 			/* Invoke any callbacks, transfer the buffer to caller,
+ 			 * and fire off the (possibly) blocking
+ 			 * iwl_trans_send_cmd()
+ 			 * as we reclaim the driver command queue */
+ 			if (!rxcb._page_stolen)
+ 				iwl_tx_cmd_complete(trans, &rxcb, err);
+ 			else
+ 				IWL_WARN(trans, "Claim null rxb?\n");
+ 		}
+ 
+ 		page_stolen |= rxcb._page_stolen;
+ 		offset += ALIGN(len, FH_RSCSR_FRAME_ALIGN);
  	}
  
- 	/* page was stolen from us */
- 	if (rxcb._page == NULL)
+ 	/* page was stolen from us -- free our reference */
+ 	if (page_stolen) {
+ 		__free_pages(rxb->page, trans_pcie->rx_page_order);
  		rxb->page = NULL;
+ 	}
  
  	/* Reuse the page if possible. For notification packets and
  	 * SKBs that fail to Rx correctly, add them back into the
diff --cc drivers/net/wireless/iwlwifi/iwl-trans.h
index fdf9788,7018d31..0000000
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@@ -260,7 -256,8 +256,9 @@@ static inline void iwl_free_resp(struc
  
  struct iwl_rx_cmd_buffer {
  	struct page *_page;
+ 	int _offset;
+ 	bool _page_stolen;
 +	unsigned int truesize;
  };
  
  static inline void *rxb_addr(struct iwl_rx_cmd_buffer *r)

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]

Re: linux-next: manual merge of the net-next tree with the wireless tree

[Guy, Wey-Yi]

On Fri, 2012-05-04 at 13:21 +1000, Stephen Rothwell wrote:
> Hi all,
> 
> Today's linux-next merge of the net-next tree got conflicts in
> drivers/net/wireless/iwlwifi/iwl-trans.h,
> drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c, and
> drivers/net/wireless/iwlwifi/iwl-agn-rx.c between commit ed90542b0ce5
> ("iwlwifi: fix skb truesize underestimation") from the wireless tree and
> various commits from the net-next tree.
> 
> This was anticipated and I have applied the fix supplied by John (see
> below just to check).  Thanks to John for this!

Thanks everyone to help address this, it is my miss to cause all these trouble

Wey

linux-next: manual merge of the net-next tree with the wireless tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 809 bytes --]

Hi all,

Today's linux-next merge of the net-next tree got a conflict in:

  net/mac80211/key.c

between commit:

  02e0e426a2fb ("wifi: mac80211: fix error path key leak")

from the wireless tree and commits:

  2a8b665e6bcc ("wifi: mac80211: remove key_mtx")
  7d6904bf26b9 ("Merge wireless into wireless-next")

from the net-next tree.

I fixed it up (I just used the latter, there may be more needed) and
can carry the fix as necessary. This is now fixed as far as linux-next
is concerned, but any non trivial conflicts should be mentioned to your
upstream maintainer when your tree is submitted for merging.  You may
also want to consider cooperating with the maintainer of the
conflicting tree to minimise any particularly complex conflicts.



-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the net-next tree with the wireless tree

[Johannes Berg]

Hi,

On Thu, 2023-10-12 at 11:37 +1100, Stephen Rothwell wrote:
> Hi all,
> 
> Today's linux-next merge of the net-next tree got a conflict in:
> 
>   net/mac80211/key.c
> 
> between commit:
> 
>   02e0e426a2fb ("wifi: mac80211: fix error path key leak")
> 
> from the wireless tree and commits:
> 
>   2a8b665e6bcc ("wifi: mac80211: remove key_mtx")
>   7d6904bf26b9 ("Merge wireless into wireless-next")
> 
> from the net-next tree.

Oops, right, I forgot about that.

> I fixed it up (I just used the latter, there may be more needed)

Just using net-next/wireless-next is fine, I actually noticed the issue
while I was merging the trees to fix the previous conflicts here.

Thanks,
johannes

Re: linux-next: manual merge of the net-next tree with the wireless tree

[Jakub Kicinski]

On Thu, 12 Oct 2023 10:10:10 +0200 Johannes Berg wrote:
> > I fixed it up (I just used the latter, there may be more needed)  
> 
> Just using net-next/wireless-next is fine, I actually noticed the issue
> while I was merging the trees to fix the previous conflicts here.

Resolved the conflict in 041c3466f39d, could you double check?
Also, there's another direct return without freeing the key in
ieee80211_key_link(), is that one okay ?

Re: linux-next: manual merge of the net-next tree with the wireless tree

[Johannes Berg]

On Thu, 2023-10-19 at 14:40 -0700, Jakub Kicinski wrote:
> On Thu, 12 Oct 2023 10:10:10 +0200 Johannes Berg wrote:
> > > I fixed it up (I just used the latter, there may be more needed)  
> > 
> > Just using net-next/wireless-next is fine, I actually noticed the issue
> > while I was merging the trees to fix the previous conflicts here.
> 
> Resolved the conflict in 041c3466f39d, could you double check?

I don't see anything there, but I guess that means it's good? Code looks
fine.

> Also, there's another direct return without freeing the key in
> ieee80211_key_link(), is that one okay ?

*sigh*

No, it's not. I think that means I resolved the previous merge there
incorrectly, because it's OK in wireless and broken in wireless-next,
and it had been fixed in d097ae01ebd4 ("wifi: mac80211: fix potential
key leak").

Anyway, thanks for checking and noticing! Will fix.

johannes

linux-next: manual merge of the net-next tree with the wireless tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1546 bytes --]

Hi all,

Today's linux-next merge of the net-next tree got a conflict in:

  net/mac80211/rx.c

between commit:

  91535613b609 ("wifi: mac80211: don't drop all unprotected public action frames")

from the wireless tree and commit:

  6c02fab72429 ("wifi: mac80211: split ieee80211_drop_unencrypted_mgmt() return value")

from the net-next tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc net/mac80211/rx.c
index 8f6b6f56b65b,051db97a92b4..000000000000
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@@ -2468,14 -2469,15 +2469,14 @@@ ieee80211_drop_unencrypted_mgmt(struct 
  
  		/* drop unicast public action frames when using MPF */
  		if (is_unicast_ether_addr(mgmt->da) &&
 -		    ieee80211_is_public_action((void *)rx->skb->data,
 -					       rx->skb->len))
 +		    ieee80211_is_protected_dual_of_public_action(rx->skb))
- 			return -EACCES;
+ 			return RX_DROP_U_UNPROT_UNICAST_PUB_ACTION;
  	}
  
- 	return 0;
+ 	return RX_CONTINUE;
  }
  
- static int
+ static ieee80211_rx_result
  __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
  {
  	struct ieee80211_sub_if_data *sdata = rx->sdata;

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]