[PATCH v2 0/2] wifi: mac80211: reserve MME tailroom

[PATCH v2 0/2] wifi: mac80211: reserve MME tailroom

[Chien Wong]

BIP-CMAC-256 and BIP-GMAC append a 26-byte MME, while mac80211
currently reserves only 18 bytes of encryption tailroom. Protected
beacon skb allocation also needs to reserve room for the MME.

Changes in v2:
1. 'MMIE' -> 'MME'.
2. Minor tweak in commit msg

Chien Wong (2):
  wifi: mac80211: fix encryption tailroom
  wifi: mac80211: reserve MME tailroom for protected beacons

 net/mac80211/ieee80211_i.h | 2 +-
 net/mac80211/tx.c          | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

-- 
2.56.0

[PATCH v2 1/2] wifi: mac80211: fix encryption tailroom

[Chien Wong]

BIP-CMAC-256 and BIP-GMAC append a 26-byte MME but mac80211
currently reserves only 18 bytes of encryption tailroom.

Generating 26-byte MME may happen to work because the actual skb
tailroom can exceed the requested amount. For example, dev_alloc_skb()
rounds the allocation to kmalloc size buckets or alignment boundaries,
and the extra space may cover the 8-byte shortfall.

Reserve enough tailroom for the 26-byte MME.

Fixes: 56c52da2d554 ("mac80111: Add BIP-CMAC-256 cipher")
Signed-off-by: Chien Wong <m@xv97.com>
---
 net/mac80211/ieee80211_i.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 9374c2942489..e3e66d05519e 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -52,7 +52,7 @@ struct ieee80211_mesh_fast_tx;
 
 /* Required encryption head and tailroom */
 #define IEEE80211_ENCRYPT_HEADROOM 8
-#define IEEE80211_ENCRYPT_TAILROOM 18
+#define IEEE80211_ENCRYPT_TAILROOM 26 /* current max: GMAC/CMAC-256 MME */
 
 /* power level hasn't been configured (or set to automatic) */
 #define IEEE80211_UNSET_POWER_LEVEL	INT_MIN
-- 
2.56.0

[PATCH v2 2/2] wifi: mac80211: reserve MME tailroom for protected beacons

[Chien Wong]

Beacon protection appends an MME to beacons, but the skb
allocation does not reserve tailroom for it. If the available
tailroom is too small, the crypto path drops the beacon.

Two factors often mask this: the 256-byte TIM reservation is
rarely fully used, and dev_alloc_skb() may round up the
allocation, leaving extra tailroom. Neither guarantees enough
room for the MME.

Reserve enough room for the largest MME.

Fixes: 0a3a84360b37 ("mac80211: Beacon protection using the new BIGTK (AP)")
Signed-off-by: Chien Wong <m@xv97.com>
---
 net/mac80211/tx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d51f810dd2c5..6aad90a55722 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -5673,7 +5673,8 @@ __ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
 
 	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
 			    beacon->tail_len + 256 +
-			    local->hw.extra_beacon_tailroom + mbssid_len);
+			    local->hw.extra_beacon_tailroom + mbssid_len +
+			    IEEE80211_ENCRYPT_TAILROOM);
 	if (!skb)
 		return NULL;
 
-- 
2.56.0