2020-06-19 16:25:53

by Greg Kroah-Hartman

Subject: [PATCH 4.19 157/267] mt76: avoid rx reorder buffer overflow

From: Ryder Lee <[email protected]>

[ Upstream commit 7c4f744d6703757be959f521a7a441bf34745d99 ]

Enlarge slot to support 11ax 256 BA (256 MPDUs in an AMPDU)

Signed-off-by: Chih-Min Chen <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/wireless/mediatek/mt76/agg-rx.c | 8 ++++----
drivers/net/wireless/mediatek/mt76/mt76.h | 6 +++---
2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c
index 73c8b2805c97..d44d57e6eb27 100644
--- a/drivers/net/wireless/mediatek/mt76/agg-rx.c
+++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c
@@ -154,8 +154,8 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)
struct ieee80211_sta *sta;
struct mt76_rx_tid *tid;
bool sn_less;
- u16 seqno, head, size;
- u8 ackp, idx;
+ u16 seqno, head, size, idx;
+ u8 ackp;

__skb_queue_tail(frames, skb);

@@ -240,7 +240,7 @@ out:
}

int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno,
- u16 ssn, u8 size)
+ u16 ssn, u16 size)
{
struct mt76_rx_tid *tid;

@@ -264,7 +264,7 @@ EXPORT_SYMBOL_GPL(mt76_rx_aggr_start);

static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)
{
- u8 size = tid->size;
+ u16 size = tid->size;
int i;

cancel_delayed_work(&tid->reorder_work);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 2eab35879163..7b1667ec619e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -193,8 +193,8 @@ struct mt76_rx_tid {
struct delayed_work reorder_work;

u16 head;
- u8 size;
- u8 nframes;
+ u16 size;
+ u16 nframes;

u8 started:1, stopped:1, timer_pending:1;

@@ -537,7 +537,7 @@ int mt76_get_survey(struct ieee80211_hw *hw, int idx,
void mt76_set_stream_caps(struct mt76_dev *dev, bool vht);

int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tid,
- u16 ssn, u8 size);
+ u16 ssn, u16 size);
void mt76_rx_aggr_stop(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tid);

void mt76_wcid_key_setup(struct mt76_dev *dev, struct mt76_wcid *wcid,
--
2.25.1

2020-06-20 00:25:19

by Felix Fietkau

Subject: Re: [PATCH 4.19 157/267] mt76: avoid rx reorder buffer overflow

On 2020-06-19 16:32, Greg Kroah-Hartman wrote:
> From: Ryder Lee <[email protected]>
>
> [ Upstream commit 7c4f744d6703757be959f521a7a441bf34745d99 ]
>
> Enlarge slot to support 11ax 256 BA (256 MPDUs in an AMPDU)
>
> Signed-off-by: Chih-Min Chen <[email protected]>
> Signed-off-by: Ryder Lee <[email protected]>
> Signed-off-by: Felix Fietkau <[email protected]>
> Signed-off-by: Sasha Levin <[email protected]>
It does not make sense to backport this commit. It doesn't fix anything,
it's just preparation work for the mt7915 driver.

- Felix