From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE41919DF9A; Mon, 17 Jun 2024 13:26:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718630793; cv=none; b=OX1Jp0a4n7Hh2DjFFI3l8WrVHJVxhWykVkmnyytQbN+LCHixmhYw/o6s7ZTOBwaD/qzUUwnj9iGzDO27qwidP4JyLGiZQwDNj2gs8P5DDUddj+5KeNJXQUjOxBpSUUsHKHUIxiz+qYtc8G32d4F0WHUJM2VVN3V2BvsLzK42C+A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718630793; c=relaxed/simple; bh=/Wi55a5hsYvtldVFwu4hzRH0299rWjheTH4KjtzzCzk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F+rqDS462d+dA7JbXqXl9tuDTNtlfWa3Jxsyp/5n2ZjoLC7t7/wPn2lSUNoQStlX8mUAD+CjN4Sl9AEX7swBE6Sm4Am9Je3ZDprPvP1rXDzO55N3bakDkdRiLI1Uc7b+izlqeOXUNNhU9+O8bOg8BtINNrJtCiVu98UW8btnLf8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iTEH6sbx; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iTEH6sbx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 203D6C4AF48; Mon, 17 Jun 2024 13:26:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1718630793; bh=/Wi55a5hsYvtldVFwu4hzRH0299rWjheTH4KjtzzCzk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iTEH6sbxPbCXQ+FWjSzi0IKSv0ORH6Cmh2Pc1RlSiy7SbdK1MxKKhsO0c7Nra6vPe 2iXnVt+V/c5srmoVKN8brUUGyF/4eQ2lxLOFUxX9HcfbeirQ15FA37CWPx3AfHbUlu PUhyZajIBYrelsU/UpeZs1NxPJGCv/WxXKLLG8wHVC9l/J9eWBOs1TW6kjOwsge7cb 30R+tcPnrvlYdWyN3cNoiAXrh/KWNUFHoNNlOpyY8QnQftvFjdThOEo90t7isat9Uc lLQtEpBBdMC/U1d1DWbpFOBEKl40yL6Hw5d9KNvZlsvUM8JPAgTsfc8J95VpOLfUJ8 KouwU2PFLOtEw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Johannes Berg , syzbot+8830db5d3593b5546d2e@syzkaller.appspotmail.com, Sasha Levin , johannes@sipsolutions.net, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.15 09/21] wifi: mac80211: handle tasklet frames before stopping Date: Mon, 17 Jun 2024 09:25:46 -0400 Message-ID: <20240617132617.2589631-9-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240617132617.2589631-1-sashal@kernel.org> References: <20240617132617.2589631-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.15.161 Content-Transfer-Encoding: 8bit From: Johannes Berg [ Upstream commit 177c6ae9725d783f9e96f02593ce8fb2639be22f ] The code itself doesn't want to handle frames from the driver if it's already stopped, but if the tasklet was queued before and runs after the stop, then all bets are off. Flush queues before actually stopping, RX should be off at this point since all the interfaces are removed already, etc. Reported-by: syzbot+8830db5d3593b5546d2e@syzkaller.appspotmail.com Link: https://msgid.link/20240515135318.b05f11385c9a.I41c1b33a2e1814c3a7ef352cd7f2951b91785617@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/ieee80211_i.h | 2 ++ net/mac80211/main.c | 10 ++++++++-- net/mac80211/util.c | 2 ++ 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 03f8c8bdab765..03c238e68038b 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1803,6 +1803,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata, void ieee80211_configure_filter(struct ieee80211_local *local); u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata); +void ieee80211_handle_queued_frames(struct ieee80211_local *local); + u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local); int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb, u64 *cookie, gfp_t gfp); diff --git a/net/mac80211/main.c b/net/mac80211/main.c index 9617ff8e27147..7d62374fe727b 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -220,9 +220,8 @@ u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata) BSS_CHANGED_ERP_SLOT; } -static void ieee80211_tasklet_handler(struct tasklet_struct *t) +void ieee80211_handle_queued_frames(struct ieee80211_local *local) { - struct ieee80211_local *local = from_tasklet(local, t, tasklet); struct sk_buff *skb; while ((skb = skb_dequeue(&local->skb_queue)) || @@ -247,6 +246,13 @@ static void ieee80211_tasklet_handler(struct tasklet_struct *t) } } +static void ieee80211_tasklet_handler(struct tasklet_struct *t) +{ + struct ieee80211_local *local = from_tasklet(local, t, tasklet); + + ieee80211_handle_queued_frames(local); +} + static void ieee80211_restart_work(struct work_struct *work) { struct ieee80211_local *local = diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 354badd32793a..3d47c2dba39da 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -2146,6 +2146,8 @@ u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata, void ieee80211_stop_device(struct ieee80211_local *local) { + ieee80211_handle_queued_frames(local); + ieee80211_led_radio(local, false); ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO); -- 2.43.0