2020-12-21 23:57:46

by Ben Greear

[permalink] [raw]
Subject: skb_cb corruption in ath10k

Hello,

I'm trying to figure out what changed in the last few kernels that is making:

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
/* why is code here all of a sudden */

in data frames in ath10k,
when, to the best of my knowledge, nothing should be setting that up in the stack.

My guess is that something is stepping on the cb field somewhere in ath10k,
but I am not sure where that might be at this point.

And it also appears mac80211 or maybe supplicant is setting the rate-inject flag on some mgt frames,
but I think that is a separate concern at this point.

If anyone has any ideas of likely points, please let me know.

Thanks,
Ben

--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com


2020-12-24 17:09:42

by Ben Greear

[permalink] [raw]
Subject: Re: skb_cb corruption in ath10k

On 12/21/20 3:55 PM, Ben Greear wrote:
> Hello,
>
> I'm trying to figure out what changed in the last few kernels that is making:
>
> struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
> if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
>     /* why is code here all of a sudden */
>
> in data frames in ath10k,
> when, to the best of my knowledge, nothing should be setting that up in the stack.
>
> My guess is that something is stepping on the cb field somewhere in ath10k,
> but I am not sure where that might be at this point.
>
> And it also appears mac80211 or maybe supplicant is setting the rate-inject flag on some mgt frames,
> but I think that is a separate concern at this point.
>
> If anyone has any ideas of likely points, please let me know.

This issue was me being confused about how the ath10k skb_cb sits in
the same memory as the iee skb_cb. I just needed to reorder the
ath10k-skb-cb struct a bit to not clobber the control.flags area.

I also see no reason not to natually pack that stuct so that the
pointers are 8-byte aligned. Any idea why it is force-packed
currently instead of using proper padding?

Thanks,
Ben