2020-09-29 18:20:43

by Thomas Pedersen

Subject: [PATCH] mac80211: process S1G Operation element before HT

The sband->ht_cap was being processed before S1G Operation
element. Since the HT capability element should not be
present on the S1G band, avoid processing potential
garbage by moving the call to
ieee80211_apply_htcap_overrides() to after the S1G block.

Signed-off-by: Thomas Pedersen <[email protected]>
---
net/mac80211/mlme.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 38e87ac9902e..80b4d46d0b20 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -174,9 +174,6 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
goto out;
}

- memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
- ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
-
if (s1g_oper && sband->band == NL80211_BAND_S1GHZ) {
ieee80211_chandef_s1g_oper(s1g_oper, chandef);
ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_40MHZ |
@@ -186,6 +183,9 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
goto out;
}

+ memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
+ ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
+
if (!ht_oper || !sta_ht_cap.ht_supported) {
ret = IEEE80211_STA_DISABLE_HT |
IEEE80211_STA_DISABLE_VHT |
--
2.20.1

2020-09-29 18:35:40

by Johannes Berg

Subject: Re: [PATCH] mac80211: process S1G Operation element before HT

On Tue, 2020-09-29 at 11:19 -0700, Thomas Pedersen wrote:
> The sband->ht_cap was being processed before S1G Operation
> element. Since the HT capability element should not be
> present on the S1G band, avoid processing potential
> garbage by moving the call to
> ieee80211_apply_htcap_overrides() to after the S1G block.

Ah, heh. I hadn't even realized that.

What I meant though was something else: we have

if (s1g_oper && sband->band == NL80211_BAND_S1GHZ) {
...
goto out;
}

// process ht cap overrides (after this patch)

// check HT oper

// check VHT oper

// ...

So given that first condition, if you actually have an S1G AP *without*
S1G operation element (for some reason), you'd start processing HT, VHT,
and whatever else capabilities, sending us down a misleading and likely
very confusing path, which seems like it should be avoided?

johannes

2020-09-29 18:47:42

by Thomas Pedersen

Subject: Re: [PATCH] mac80211: process S1G Operation element before HT

On 2020-09-29 11:32, Johannes Berg wrote:
> On Tue, 2020-09-29 at 11:19 -0700, Thomas Pedersen wrote:
>> The sband->ht_cap was being processed before S1G Operation
>> element. Since the HT capability element should not be
>> present on the S1G band, avoid processing potential
>> garbage by moving the call to
>> ieee80211_apply_htcap_overrides() to after the S1G block.
>
> Ah, heh. I hadn't even realized that.
>
> What I meant though was something else: we have
>
> if (s1g_oper && sband->band == NL80211_BAND_S1GHZ) {
> ...
> goto out;
> }
>
> // process ht cap overrides (after this patch)
>
> // check HT oper
>
> // check VHT oper
>
> // ...
>
> So given that first condition, if you actually have an S1G AP *without*
> S1G operation element (for some reason), you'd start processing HT,
> VHT,
> and whatever else capabilities, sending us down a misleading and likely
> very confusing path, which seems like it should be avoided?

Ah ok, yes the !s1g_oper case. I'll take a look.

--
thomas