summaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)Author
2025-01-13wifi: mac80211: ibss: stop transmit when merging IBSSJohannes Berg
We disable the carrier, but that doesn't immediately take effect, and as such a concurrent transmit can go into the driver while drv_leave_ibss() is happening and confuse it. Synchronize to avoid that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.83b58167e80e.I538751fbe1b4302d20f6ed80afb024bca6a2dbf5@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: don't flush non-uploaded STAsJohannes Berg
If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash. Check if the sta was uploaded to the driver before and fix this. Fixes: d00800a289c9 ("wifi: mac80211: add flush_sta method") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.e3d10970a7c7.I491bbcccc46f835ade07df0640a75f6ed92f20a3@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: set key link ID to the deflink oneBenjamin Berg
When in non-MLO mode, the key ID was set to -1 even for keys that are not pairwise. Change the link ID to be the link ID of the deflink in this case so that drivers do not need to special cases for this. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.0c066f084677.I4a5c288465e75119edb6a0df90dddf6f30d14a02@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: pass correct link ID on assocBenjamin Berg
The link ID passed to drv_mgd_complete_tx when handling the association response was not set. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.2b06504ecaef.Ifb94e9375b910de6cdd2e5865d8cb3ab9790b314@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: nl80211: simplify nested if checksJohannes Berg
In the absence of (an) else clause(s), "if (a) if (b)" is equivalent to "if (a && b)", so simplify the code a bit. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.c8bf7338aa64.Ie49dcc1ba44b507d91d5a9d8bd538d7ac2e46c54@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Support parsing EPCS ML elementIlan Peer
Add support for parsing an ML element of type EPCS priority access, which can optionally be included in EHT protected action frames used to configure EPCS. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.5afdf65cff46.I0ffa30b40fbad47bc5b608b5fd46047a8c44e904@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: Add support for controlling EPCSIlan Peer
Add support for configuring Emergency Preparedness Communication Services (EPCS) for station mode. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.ea54ac94445c.I11d750188bc0871e13e86146a3b5cc048d853e69@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Support dynamic link addition and removalIlan Peer
Add support for adding and removing station links: - Adding links is done asynchronously, i.e., first an ML reconfiguration action frame is sent to the AP requesting to add links, and only when the AP replies, links which were added successfully by the AP are added locally. - Removing links is done synchronously, i.e., the links are removed before sending the ML reconfiguration action frame to the AP (to avoid using this links after the AP MLD removed them but before the station got the ML reconfiguration response). In case the AP replies with a status indicating that a link removal was not successful, disconnect (as this should not happen an is an indication that something might be wrong on the AP MLD). Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.ec0492a8dd21.I2869686642bbc0f86c40f284ebf7e6f644b551ab@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Pull link space calculation to a functionIlan Peer
Pull the calculation of the size needed for a link in an association request frame to a function, so it could also be used during the construction of other frames as well, e.g., ML link configuration request frame. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.ac16adfa39d4.I9e28c2fcd5ca252341c817fc03ea8df7b807fcbf@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Refactor adding association elementsIlan Peer
Instead of always using 'sdata->u.mgd.assoc_data' have the association data be passed as an argument. This will later allow to use the same functionality for adding links to the current association. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.191f58f2bba7.I6baa6e2989a39937234ff91d7db5ff1359a6bb30@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: Add support for dynamic addition/removal of linksIlan Peer
Add support for requesting dynamic addition/removal of links to the current MLO association. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.cef23352f2a2.I79c849974c494cb1cbf9e1b22a5d2d37395ff5ac@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: nl80211: Split the links handling of an association requestIlan Peer
And move it to a separate function so it could later be reused for dynamic addition of links. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250102161730.1e9c1873796a.I27a51c8c1d455f0a6d5b59f93f2c9ac49282febb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: nl80211: fix nl80211_start_radar_detection return valueNicolas Escande
Since the wiphy_guard changes, rdev_start_radar_detection's return value in nl80211_start_radar_detection is ignored and we always returned 0. Fixes: f42d22d3f796 ("wifi: cfg80211: define and use wiphy guard") Signed-off-by: Nicolas Escande <nico.escande@gmail.com> Link: https://patch.msgid.link/20250109161040.325742-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: skip regulatory for punctured subchannelsKavita Kavita
The kernel performs several regulatory checks for AP mode in nl80211/cfg80211. These checks include radar detection, verification of whether the sub-channel is disabled, and an examination to determine if the channel is a DFS channel (both DFS usable and DFS available). These checks are performed across a frequency range, examining each sub-channel. However, these checks are also performed on subchannels that have been punctured which should not be examined as they are not in use. This leads to the issue where the AP stops because one of the 20 MHz sub-channels is disabled or radar detected on the channel, even when the sub-channel is punctured. To address this issue, add a condition check wherever regulatory checks exist for AP mode in nl80211/cfg80211. This check identifies punctured channels and, upon finding them, skips the regulatory checks for those channels. Co-developed-by: Manaswini Paluri <quic_mpaluri@quicinc.com> Signed-off-by: Manaswini Paluri <quic_mpaluri@quicinc.com> Signed-off-by: Kavita Kavita <quic_kkavita@quicinc.com> Link: https://patch.msgid.link/20250109050409.25351-1-quic_kkavita@quicinc.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: fix tid removal during mesh forwardingAndy Strohman
With change (wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces), a non-zero TID assignment is lost during slow path mesh forwarding. Prior to this change, ieee80211_rx_h_mesh_fwding() left the TID intact in the header. As a result of this header corruption, packets belonging to non-zero TIDs will get treating as belonging TID 0 by functions such as ieee80211_get_tid(). While this miscategorization by itself is an issue, there are additional ramifications due to the fact that skb->priority still reflects the mesh forwarded packet's ingress (correct) TID. The mt7915 driver inspects the TID recorded within skb->priority and relays this to the hardware/radio during TX. The radio firmware appears to react to this by changing the sequence control header, but it does not also ensure/correct the TID in the QoS control header. As a result, the receiver will see packets with sequence numbers corresponding to the wrong TID. The receiver of the forwarded packet will see TID 0 in QoS control but a sequence number corresponding to the correct (different) TID in sequence control. This causes data stalls for TID 0 until the TID 0 sequence number advances past what the receiver believes it should be due to this bug. Mesh routing mpath changes cause a brief transition from fast path forwarding to slow path forwarding. Since this bug only affects the slow path forwarding, mpath changes bring opportunity for the bug to be triggered. In the author's case, he was experiencing TID 0 data stalls after mpath changes on an intermediate mesh node. These observed stalls may be specific to mediatek radios. But the inconsistency between the packet header and skb->priority may cause problems for other drivers as well. Regardless if this causes connectivity issues on other radios, this change is necessary in order transmit (forward) the packet on the correct TID and to have a consistent view a packet's TID within mac80211. Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Andy Strohman <andrew@andrewstrohman.com> Link: https://patch.msgid.link/20250107104431.446775-1-andrew@andrewstrohman.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment earlierKees Cook
Since adding __counted_by(n_channels) to struct cfg80211_scan_request, anything adding to the channels array must increment n_channels first. Move n_channels increment earlier. Reported-by: John Rowley <lkml@johnrowley.me> Closes: https://lore.kernel.org/stable/1815535c709ba9d9.156c6a5c9cdf6e59.b249b6b6a5ee4634@localhost.localdomain/ Fixes: aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate") Signed-off-by: Kees Cook <kees@kernel.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://patch.msgid.link/20241230183610.work.680-kees@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: prohibit deactivating all linksJohannes Berg
In the internal API this calls this is a WARN_ON, but that should remain since internally we want to know about bugs that may cause this. Prevent deactivating all links in the debugfs write directly. Reported-by: syzbot+0c5d8e65f23569a8ffec@syzkaller.appspotmail.com Fixes: 3d9011029227 ("wifi: mac80211: implement link switching") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20241230091408.505bd125c35a.Ic3c1f9572b980a952a444cad62b09b9c6721732b@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: tests: add utility to create sdata skeletonBenjamin Berg
Some functions that should be tested may expect an sdata object that is configured to a basic degree. Add setup code to create such an object for use by tests. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.12eeefd3c98b.I6e8c2b8374d4305f16675524ca30621e089b6fb0@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: also verify requirements in EXT_SUPP_RATESBenjamin Berg
Parse both the Supported Rates and BSS Membership Selectors as well as the extended version of the tag when verifying whether we support all features. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.f1840f19afa7.I12e3a0e634ce7014f5067256d9a6215fec6bf165@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: verify BSS membership selectors and basic ratesBenjamin Berg
We should not attempt a connection if the BSS we are connecting to requires support for a basic rate or other feature using the BSS membership selector. Add a check verifying this. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.e58a0f34c798.Ifeb3bfd7b157ffa2ccdb20ca1cba6cf068fd117d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: nl80211: permit userspace to pass supported selectorsBenjamin Berg
Currently the SAE_H2E selector already exists, which needs to be implemented by the SME. As new such selectors might be added in the future, add a feature to permit userspace to report a selector as supported. If not given, the kernel should assume that userspace does support SAE_H2E. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.fe67b871cc39.Ieb98390328927e998e612345a58b6dbc00b0e3a2@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: parse BSS selectors and unknown ratesBenjamin Berg
Doing so enables further checking whether we are implementing the requested features. Also allow passing in NULL for more parameters as they may not be needed by the caller. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.76433fd3d69f.I94e8718de26ab32282b60ae257b8c6c334b7c528@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: skip all known membership selectorsBenjamin Berg
The GLK and EPD Selectors are also not rates, so add a new macro for the minimum value of a selector and test against that instead of the entire list. Also fix the typo in the EPD selector define. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.2c19a2dc53db.If187b7d93d8b43a6c70e422c837b7636538fb358@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: log link information in ieee80211_determine_chan_modeBenjamin Berg
ieee80211_determine_chan_mode is called for each link and if there is a downgrade, then it is interesting to know on which link it happened. Pass through the link_id where relevant and use the new link_id_info macro instead of sdata_info so that the link ID is printed when relevant. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.d400da710fc4.I64775ec914603d3c7b0c6ea14b507c0370c11622@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: fix typo in HE MCS checkBenjamin Berg
It printed the AP RX MCS value instead of the TX one. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.743c7c1914f4.I1e5888ac6c8324d078fe91d01da31daa76d0e328@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Remove unused basic_rates variableBenjamin Berg
The basic_rates variable was passed to mesh_sta_info_init as an out parameter even though the result is not used. Passing NULL instead is safe here, so do that. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.23a86a9bad0c.If79bc2c1c98d01cfb4c7e93c18b198fe6c6ea44c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: improve stop/wake queue tracingEmmanuel Grumbach
Add the refcount. This can be useful when we want to understand why a queue stays stopped after it is woken. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.bd320c6e6702.I6ae0f19d922aea1f28236d72bf260acac428fc02@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: check extended MLD capa/ops in assocJohannes Berg
Check that additionally extended MLD capa/ops for the MLD is consistent, i.e. the same value is reported by all affiliated APs/links. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.e29f42c7ae21.Ib2cdce608321ad154e4b13103cc315c3e3cb6b2b@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: scan: skip duplicate RNR entriesJohannes Berg
There really shouldn't be duplicate entries when we give the list to the driver, and since we already have a list it's easy to avoid. While at it, remove the unnecessary allocation there. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.b0012c70f503.Id6fcad979434c1437340aa283abae2906345cca1@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: mlme: improve messages from config_bw()Johannes Berg
The ieee80211_config_bw() function is called in different contexts: during association with the association response and during beacon tracking with the beacon. This can be a bit misleading, so disambiguate the messages for those. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.ee574cf7553b.Ie7c78877d20b5e9de4cce3cf8e4f1b9e0c7ee005@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: reject per-band vendor elements with MLOJohannes Berg
The MLME code doesn't currently handle adding vendor elements correctly with multi-link due to element inheritance. Simply prevent that for now completely, if someone needs it we can fix this later. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.bb82d3aaf6ef.Ib30573d0666430a3d7a905e513dfc661edf0bf65@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: remove an unneeded check in RxEmmanuel Grumbach
Coverity pointed out that __ieee80211_rx_h_amsdu() checks if rx->sta is NULL before dereferencing it but not always. Since rx->sta can't be NULL at this point, just remove the check to avoid confusion Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.033096029d0a.I0923387246a6152f589d278f27f27bce52daee79@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: add some support for RX OMI power savingJohannes Berg
In order to save power, it can be desirable to change the RX operating mode using OMI to reduce the bandwidth. As the handshake must be done in the HTC+ field, it cannot be done by mac80211 directly, so expose functions to the driver to request and finalize the necessary updates. Note that RX OMI really only changes what the peer (AP) will transmit to us, but in order to use it to actually save some power (by reducing the listen bandwidth) we also update rate scaling and then the channel context's mindef accordingly. The updates are split into two in order to sequence them correctly, when reducing bandwidth first reduce the rate scaling and thus TX, then send OMI, then reduce the listen bandwidth (chandef); when increasing bandwidth this is the other way around. This also requires tracking in different variables which part is applicable already. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250101070249.2c1a1934bd73.I4e90fd503504e37f9eac5bdae62e3f07e7071275@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Remove unused ieee80211_smps_is_restrictiveDr. David Alan Gilbert
The last use of ieee80211_smps_is_restrictive() was removed in 2020 by commit 52b4810bed83 ("mac80211: Remove support for changing AP SMPS mode") Remove it. Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Link: https://patch.msgid.link/20241226170119.108947-1-linux@treblig.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: cfg80211: copy multi-link element from the multi-link probe request's ↵Michael-CY Lee
frame body to the generated elements According to Draft P802.11be_D7.0 clause 35.3.4.2, if a multi-link request requests an MLD with which an AP corresponding to the nontransmitted BSSID, the corresponding multi-link probe response shall carry a basic multi-mink element of that MLD in the frame body of the multi-link probe response, whose location is outside of the Multiple BSSID element carried in the frame. Therefore additional handing is needed for parsing multi-link probe response and generating the merged elements so that the MLD in the frame body can be correctly copied to the generated elements. Otherwise, the nontransmitted BSS looks like non-MLD. Signed-off-by: Money Wang <money.wang@mediatek.com> Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com> Link: https://patch.msgid.link/20241225073725.847062-1-michael-cy.lee@mediatek.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: change disassoc sequence a bitMiri Korenblit
Currently, the sequence goes like this (among others): 1. flush all stations (including the AP ones) -> this will tell the drivers to remove the stations 2. notify the driver the vif is not associated. Which means that in between 1 and 2, the state is that the vif is associated, but there is no AP station, which makes no sense, and may be problematic for some drivers (for example iwlwifi) Change the sequence to: 1. flush the TDLS stations 2. move the AP station to IEEE80211_STA_NONE 3. notify the driver about the vif being unassociated 4. flush the AP station In order to not break other drivers, add a vif flag to indicate whether the driver wants to new sequence or not. If the flag is not set, then things will be done in the old sequence. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20241224192322.996ad1be6cb3.I7815d33415aa1d65c0120b54be7a15a45388f807@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: add an option to filter a sta from being flushedMiri Korenblit
Sometimes we might want to flush only part of the stations of a vif, for example only the TDLS ones. To allow this, add a do_not_flush_sta argument to __sta_info_flush, which in turn, will not flush this station. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20241224192322.535e1fcca192.Icecf7f443bf98c9535ce8ec03b24d0d17dfbc28e@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13wifi: mac80211: Clean up debugfs_key deadcodeDr. David Alan Gilbert
The last use of ieee80211_debugfs_key_sta_del() was removed in 2007 by commit 11a843b7e160 ("[MAC80211]: rework key handling") The last use of ieee80211_debugfs_key_add_mgmt_default() was removed in 2010 by commit f7e0104c1a4e ("mac80211: support separate default keys") The last use of ieee80211_debugfs_key_add_beacon_default() was removed in 2020 by commit e5473e80d467 ("mac80211: Support BIGTK configuration for Beacon protection") Remove them. Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Link: https://patch.msgid.link/20241224013257.185742-2-linux@treblig.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-01-13pktgen: Avoid out-of-bounds access in get_imix_entriesArtem Chernyshev
Passing a sufficient amount of imix entries leads to invalid access to the pkt_dev->imix_entries array because of the incorrect boundary check. UBSAN: array-index-out-of-bounds in net/core/pktgen.c:874:24 index 20 is out of range for type 'imix_pkt [20]' CPU: 2 PID: 1210 Comm: bash Not tainted 6.10.0-rc1 #121 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl lib/dump_stack.c:117 __ubsan_handle_out_of_bounds lib/ubsan.c:429 get_imix_entries net/core/pktgen.c:874 pktgen_if_write net/core/pktgen.c:1063 pde_write fs/proc/inode.c:334 proc_reg_write fs/proc/inode.c:346 vfs_write fs/read_write.c:593 ksys_write fs/read_write.c:644 do_syscall_64 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:130 Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 52a62f8603f9 ("pktgen: Parse internet mix (imix) input") Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru> [ fp: allow to fill the array completely; minor changelog cleanup ] Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-01-13Merge 6.13-rc7 into driver-core-nextGreg Kroah-Hartman
We need the debugfs / driver-core fixes in here as well for testing and to build on top of. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-12net: remove get_task_comm() and print task comm directlyYafang Shao
Since task->comm is guaranteed to be NUL-terminated, we can print it directly without the need to copy it into a separate buffer. This simplifies the code and avoids unnecessary operations. Link: https://lkml.kernel.org/r/20241219023452.69907-4-laoar.shao@gmail.com Signed-off-by: Yafang Shao <laoar.shao@gmail.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "André Almeida" <andrealmeid@igalia.com> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Borislav Petkov (AMD) <bp@alien8.de> Cc: Danilo Krummrich <dakr@redhat.com> Cc: Darren Hart <dvhart@infradead.org> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Airlie <airlied@gmail.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: James Morris <jmorris@namei.org> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Jiri Slaby <jirislaby@kernel.org> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: Karol Herbst <kherbst@redhat.com> Cc: Kees Cook <kees@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Lyude Paul <lyude@redhat.com> Cc: Oded Gabbay <ogabbay@kernel.org> Cc: Paul Moore <paul@paul-moore.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Petr Mladek <pmladek@suse.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: Simona Vetter <simona@ffwll.ch> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Tvrtko Ursulin <tursulin@ursulin.net> Cc: Vineet Gupta <vgupta@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-01-12bluetooth: mgmt: convert timeouts to secs_to_jiffies()Easwar Hariharan
Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced secs_to_jiffies(). As the value here is a multiple of 1000, use secs_to_jiffies() instead of msecs_to_jiffies to avoid the multiplication. This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with the following Coccinelle rules: @@ constant C; @@ - msecs_to_jiffies(C * 1000) + secs_to_jiffies(C) @@ constant C; @@ - msecs_to_jiffies(C * MSEC_PER_SEC) + secs_to_jiffies(C) Link: https://lkml.kernel.org/r/20241210-converge-secs-to-jiffies-v3-15-ddfefd7e9f2a@linux.microsoft.com Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Andrew Lunn <andrew+netdev@lunn.ch> Cc: Anna-Maria Behnsen <anna-maria@linutronix.de> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Christophe Leroy <christophe.leroy@csgroup.eu> Cc: Daniel Mack <daniel@zonque.org> Cc: David Airlie <airlied@gmail.com> Cc: David S. Miller <davem@davemloft.net> Cc: Dick Kennedy <dick.kennedy@broadcom.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Florian Fainelli <florian.fainelli@broadcom.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Haojian Zhuang <haojian.zhuang@gmail.com> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Ilya Dryomov <idryomov@gmail.com> Cc: Jack Wang <jinpu.wang@cloud.ionos.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: James Smart <james.smart@broadcom.com> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Jeff Johnson <jjohnson@kernel.org> Cc: Jeff Johnson <quic_jjohnson@quicinc.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Jeroen de Borst <jeroendb@google.com> Cc: Jiri Kosina <jikos@kernel.org> Cc: Joe Lawrence <joe.lawrence@redhat.com> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: Josh Poimboeuf <jpoimboe@kernel.org> Cc: Jozsef Kadlecsik <kadlec@netfilter.org> Cc: Julia Lawall <julia.lawall@inria.fr> Cc: Kalle Valo <kvalo@kernel.org> Cc: Louis Peens <louis.peens@corigine.com> Cc: Lucas De Marchi <lucas.demarchi@intel.com> Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Miroslav Benes <mbenes@suse.cz> Cc: Naveen N Rao <naveen@kernel.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Nicolas Palix <nicolas.palix@imag.fr> Cc: Oded Gabbay <ogabbay@kernel.org> Cc: Ofir Bitton <obitton@habana.ai> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Petr Mladek <pmladek@suse.com> Cc: Praveen Kaligineedi <pkaligineedi@google.com> Cc: Ray Jui <rjui@broadcom.com> Cc: Robert Jarzmik <robert.jarzmik@free.fr> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Roger Pau Monné <roger.pau@citrix.com> Cc: Russell King <linux@armlinux.org.uk> Cc: Scott Branden <sbranden@broadcom.com> Cc: Shailend Chand <shailend@google.com> Cc: Simona Vetter <simona@ffwll.ch> Cc: Simon Horman <horms@kernel.org> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Takashi Iwai <tiwai@suse.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Xiubo Li <xiubli@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-01-12netfilter: conntrack: cleanup timeout definitionsEaswar Hariharan
Patch series "Converge on using secs_to_jiffies()", v3. This is a series that follows up on my previous series to introduce secs_to_jiffies() and convert a few initial users.[1] In the review for that series, Anna-Maria requested converting other users with Coccinelle. [2] This is part 1 that converts users of msecs_to_jiffies() that use the multiply pattern of either of: - msecs_to_jiffies(N*1000), or - msecs_to_jiffies(N*MSEC_PER_SEC) where N is a constant, to avoid the multiplication. The entire conversion is made with Coccinelle in the script added in patch 2. Some changes suggested by Coccinelle have been deferred to later parts that will address other possible variant patterns. [1] https://lore.kernel.org/all/20241030-open-coded-timeouts-v3-0-9ba123facf88@linux.microsoft.com/ [2] https://lore.kernel.org/all/8734kngfni.fsf@somnus/ This patch (of 19): None of the higher order definitions are used anymore, so remove definitions for minutes, hours, and days timeouts. Convert the seconds denominated timeouts to secs_to_jiffies() Link: https://lkml.kernel.org/r/20241210-converge-secs-to-jiffies-v3-0-ddfefd7e9f2a@linux.microsoft.com Link: https://lkml.kernel.org/r/20241210-converge-secs-to-jiffies-v3-1-ddfefd7e9f2a@linux.microsoft.com Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Andrew Lunn <andrew+netdev@lunn.ch> Cc: Anna-Maria Behnsen <anna-maria@linutronix.de> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Christophe Leroy <christophe.leroy@csgroup.eu> Cc: Daniel Mack <daniel@zonque.org> Cc: David Airlie <airlied@gmail.com> Cc: David S. Miller <davem@davemloft.net> Cc: Dick Kennedy <dick.kennedy@broadcom.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Florian Fainelli <florian.fainelli@broadcom.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Haojian Zhuang <haojian.zhuang@gmail.com> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Ilya Dryomov <idryomov@gmail.com> Cc: Jack Wang <jinpu.wang@cloud.ionos.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: James Smart <james.smart@broadcom.com> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Jeff Johnson <jjohnson@kernel.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: Jeroen de Borst <jeroendb@google.com> Cc: Jiri Kosina <jikos@kernel.org> Cc: Joe Lawrence <joe.lawrence@redhat.com> Cc: Johan Hedberg <johan.hedberg@gmail.com>: Cc: Josh Poimboeuf <jpoimboe@kernel.org> Cc: Jozsef Kadlecsik <kadlec@netfilter.org> Cc: Julia Lawall <julia.lawall@inria.fr> Cc: Kalle Valo <kvalo@kernel.org> Cc: Louis Peens <louis.peens@corigine.com> Cc: Lucas De Marchi <lucas.demarchi@intel.com> Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Marcel Holtmann <marcel@holtmann.org>: Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Miroslav Benes <mbenes@suse.cz> Cc: Naveen N Rao <naveen@kernel.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Nicolas Palix <nicolas.palix@imag.fr> Cc: Oded Gabbay <ogabbay@kernel.org> Cc: Ofir Bitton <obitton@habana.ai> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Petr Mladek <pmladek@suse.com> Cc: Praveen Kaligineedi <pkaligineedi@google.com> Cc: Ray Jui <rjui@broadcom.com> Cc: Robert Jarzmik <robert.jarzmik@free.fr> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Roger Pau Monné <roger.pau@citrix.com> Cc: Russell King <linux@armlinux.org.uk> Cc: Scott Branden <sbranden@broadcom.com> Cc: Shailend Chand <shailend@google.com> Cc: Simona Vetter <simona@ffwll.ch> Cc: Simon Horman <horms@kernel.org> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Takashi Iwai <tiwai@suse.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Xiubo Li <xiubli@redhat.com> Cc: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-01-11net/smc: delete pointless divide by oneDan Carpenter
Here "buf" is a void pointer so sizeof(*buf) is one. Doing a divide by one makes the code less readable. Delete it. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Link: https://patch.msgid.link/ee1a790b-f874-4512-b3ae-9c45f99dc640@stanley.mountain Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-01-10SUNRPC: Document validity guarantees of the pointer returned by reserve_spaceChuck Lever
A subtlety of this API is that if the @nbytes region traverses a page boundary, the next __xdr_commit_encode will shift the data item in the XDR encode buffer. This makes the returned pointer point to something else, leading to unexpected behavior. There are a few cases where the caller saves the returned pointer and then later uses it to insert a computed value into an earlier part of the stream. This can be safe only if either: - the data item is guaranteed to be in the XDR buffer's head, and thus is not ever going to be near a page boundary, or - the data item is no larger than 4 octets, since XDR alignment rules require all data items to start on 4-octet boundaries But that safety is only an artifact of the current implementation. It would be less brittle if these "safe" uses were eventually replaced. Reviewed-by: NeilBrown <neilb@suse.de> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2025-01-10net: hide the definition of dev_get_by_napi_id()Jakub Kicinski
There are no module callers of dev_get_by_napi_id(), and commit d1cacd747768 ("netdev: prevent accessing NAPI instances from another namespace") proves that getting NAPI by id needs to be done with care. So hide dev_get_by_napi_id(). Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Reviewed-by: Joe Damato <jdamato@fastly.com> Link: https://patch.msgid.link/20250110004924.3212260-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-01-10net: warn during dump if NAPI list is not sortedJakub Kicinski
Dump continuation depends on the NAPI list being sorted. Broken netlink dump continuation may be rare and hard to debug so add a warning if we notice the potential problem while walking the list. Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Reviewed-by: Joe Damato <jdamato@fastly.com> Link: https://patch.msgid.link/20250110004505.3210140-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-01-10tls: skip setting sk_write_space on rekeySabrina Dubroca
syzbot reported a problem when calling setsockopt(SO_SNDBUF) after a rekey. SO_SNDBUF calls sk_write_space, ie tls_write_space, which then calls the original socket's sk_write_space, saved in ctx->sk_write_space. Rekeys should skip re-assigning ctx->sk_write_space, so we don't end up with tls_write_space calling itself. Fixes: 47069594e67e ("tls: implement rekey for TLS1.3") Reported-by: syzbot+6ac73b3abf1b598863fa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/676d231b.050a0220.2f3838.0461.GAE@google.com/ Tested-by: syzbot+6ac73b3abf1b598863fa@syzkaller.appspotmail.com Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/ffdbe4de691d1c1eead556bbf42e33ae215304a7.1736436785.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-01-10openvswitch: fix lockup on tx to unregistering netdev with carrierIlya Maximets
Commit in a fixes tag attempted to fix the issue in the following sequence of calls: do_output -> ovs_vport_send -> dev_queue_xmit -> __dev_queue_xmit -> netdev_core_pick_tx -> skb_tx_hash When device is unregistering, the 'dev->real_num_tx_queues' goes to zero and the 'while (unlikely(hash >= qcount))' loop inside the 'skb_tx_hash' becomes infinite, locking up the core forever. But unfortunately, checking just the carrier status is not enough to fix the issue, because some devices may still be in unregistering state while reporting carrier status OK. One example of such device is a net/dummy. It sets carrier ON on start, but it doesn't implement .ndo_stop to set the carrier off. And it makes sense, because dummy doesn't really have a carrier. Therefore, while this device is unregistering, it's still easy to hit the infinite loop in the skb_tx_hash() from the OVS datapath. There might be other drivers that do the same, but dummy by itself is important for the OVS ecosystem, because it is frequently used as a packet sink for tcpdump while debugging OVS deployments. And when the issue is hit, the only way to recover is to reboot. Fix that by also checking if the device is running. The running state is handled by the net core during unregistering, so it covers unregistering case better, and we don't really need to send packets to devices that are not running anyway. While only checking the running state might be enough, the carrier check is preserved. The running and the carrier states seem disjoined throughout the code and different drivers. And other core functions like __dev_direct_xmit() check both before attempting to transmit a packet. So, it seems safer to check both flags in OVS as well. Fixes: 066b86787fa3 ("net: openvswitch: fix race on port output") Reported-by: Friedrich Weber <f.weber@proxmox.com> Closes: https://mail.openvswitch.org/pipermail/ovs-discuss/2025-January/053423.html Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Tested-by: Friedrich Weber <f.weber@proxmox.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20250109122225.4034688-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-01-10net: ethtool: Use hwprov under rcu_read_lockLi RongQing
hwprov should be protected by rcu_read_lock to prevent possible UAF Fixes: 4c61d809cf60 ("net: ethtool: Fix suspicious rcu_dereference usage") Signed-off-by: Li RongQing <lirongqing@baidu.com> Acked-by: Kory Maincent <kory.maincent@bootlin.com> diff with v1: move and use err varialbe, instead of define a new variable net/ethtool/common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) Link: https://patch.msgid.link/20250109111057.4746-1-lirongqing@baidu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit (git 2.34.1) at 2025-07-15 17:41:51 +0000