Received-SPF: softfail (google.com: domain of transitioning linux-wireless-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Tue, 5 Apr 2022 18:49:08 +0200
From:   Peter Seiderer <ps.report@gmx.net>
To:     Toke =?UTF-8?B?SMO4aWxhbmQtSsO4cmdlbnNlbg==?= <toke@toke.dk>
Cc:     Kalle Valo <kvalo@kernel.org>, linux-wireless@vger.kernel.org,
        Toke =?UTF-8?B?SMO4aWxhbmQtSsO4cmdlbnNlbg==?= <toke@redhat.com>,
        stable@vger.kernel.org
Subject: Re: [PATCH for-5.18 v3] ath9k: Fix usage of driver-private space in
 tx_info
Message-ID: <20220405184908.7fb44111@gmx.net>
In-Reply-To: <20220404204800.2681133-1-toke@toke.dk>
References: <20220404204800.2681133-1-toke@toke.dk>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hello Toke,

On Mon,  4 Apr 2022 22:48:00 +0200, Toke H=C3=B8iland-J=C3=B8rgensen <toke@=
toke.dk> wrote:

> From: Toke H=C3=B8iland-J=C3=B8rgensen <toke@redhat.com>
>=20
> The ieee80211_tx_info_clear_status() helper also clears the rate counts a=
nd
> the driver-private part of struct ieee80211_tx_info, so using it breaks
> quite a few other things. So back out of using it, and instead define a
> ath-internal helper that only clears the area between the
> status_driver_data and the rates info. Combined with moving the
> ath_frame_info struct to status_driver_data, this avoids clearing anything
> we shouldn't be, and so we can keep the existing code for handling the ra=
te
> information.
>=20
> While fixing this I also noticed that the setting of
> tx_info->status.rates[tx_rateindex].count on hardware underrun errors was
> always immediately overridden by the normal setting of the same fields, so
> rearrange the code so that the underrun detection actually takes effect.
>=20
> The new helper could be generalised to a 'memset_between()' helper, but
> leave it as a driver-internal helper for now since this needs to go to
> stable.
>=20
> Cc: stable@vger.kernel.org
> Reported-by: Peter Seiderer <ps.report@gmx.net>
> Fixes: 037250f0a45c ("ath9k: Properly clear TX status area before reporti=
ng to mac80211")
> Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen <toke@redhat.com>

And finally found time to test your latest version of the patch, you can ad=
d my

Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Tested-by: Peter Seiderer <ps.report@gmx.net>

Thanks,

Peter Seiderer


> ---
>  drivers/net/wireless/ath/ath9k/main.c |  2 +-
>  drivers/net/wireless/ath/ath9k/xmit.c | 30 ++++++++++++++++++---------
>  2 files changed, 21 insertions(+), 11 deletions(-)
>=20
> diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless=
/ath/ath9k/main.c
> index 98090e40e1cf..e2791d45f5f5 100644
> --- a/drivers/net/wireless/ath/ath9k/main.c
> +++ b/drivers/net/wireless/ath/ath9k/main.c
> @@ -839,7 +839,7 @@ static bool ath9k_txq_list_has_key(struct list_head *=
txq_list, u32 keyix)
>  			continue;
> =20
>  		txinfo =3D IEEE80211_SKB_CB(bf->bf_mpdu);
> -		fi =3D (struct ath_frame_info *)&txinfo->rate_driver_data[0];
> +		fi =3D (struct ath_frame_info *)&txinfo->status.status_driver_data[0];
>  		if (fi->keyix =3D=3D keyix)
>  			return true;
>  	}
> diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless=
/ath/ath9k/xmit.c
> index cbcf96ac303e..db83cc4ba810 100644
> --- a/drivers/net/wireless/ath/ath9k/xmit.c
> +++ b/drivers/net/wireless/ath/ath9k/xmit.c
> @@ -141,8 +141,8 @@ static struct ath_frame_info *get_frame_info(struct s=
k_buff *skb)
>  {
>  	struct ieee80211_tx_info *tx_info =3D IEEE80211_SKB_CB(skb);
>  	BUILD_BUG_ON(sizeof(struct ath_frame_info) >
> -		     sizeof(tx_info->rate_driver_data));
> -	return (struct ath_frame_info *) &tx_info->rate_driver_data[0];
> +		     sizeof(tx_info->status.status_driver_data));
> +	return (struct ath_frame_info *) &tx_info->status.status_driver_data[0];
>  }
> =20
>  static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno)
> @@ -2542,6 +2542,16 @@ static void ath_tx_complete_buf(struct ath_softc *=
sc, struct ath_buf *bf,
>  	spin_unlock_irqrestore(&sc->tx.txbuflock, flags);
>  }
> =20
> +static void ath_clear_tx_status(struct ieee80211_tx_info *tx_info)
> +{
> +	void *ptr =3D &tx_info->status;
> +
> +	memset(ptr + sizeof(tx_info->status.rates), 0,
> +	       sizeof(tx_info->status) -
> +	       sizeof(tx_info->status.rates) -
> +	       sizeof(tx_info->status.status_driver_data));
> +}
> +
>  static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf,
>  			     struct ath_tx_status *ts, int nframes, int nbad,
>  			     int txok)
> @@ -2553,7 +2563,7 @@ static void ath_tx_rc_status(struct ath_softc *sc, =
struct ath_buf *bf,
>  	struct ath_hw *ah =3D sc->sc_ah;
>  	u8 i, tx_rateindex;
> =20
> -	ieee80211_tx_info_clear_status(tx_info);
> +	ath_clear_tx_status(tx_info);
> =20
>  	if (txok)
>  		tx_info->status.ack_signal =3D ts->ts_rssi;
> @@ -2569,6 +2579,13 @@ static void ath_tx_rc_status(struct ath_softc *sc,=
 struct ath_buf *bf,
>  	tx_info->status.ampdu_len =3D nframes;
>  	tx_info->status.ampdu_ack_len =3D nframes - nbad;
> =20
> +	tx_info->status.rates[tx_rateindex].count =3D ts->ts_longretry + 1;
> +
> +	for (i =3D tx_rateindex + 1; i < hw->max_rates; i++) {
> +		tx_info->status.rates[i].count =3D 0;
> +		tx_info->status.rates[i].idx =3D -1;
> +	}
> +
>  	if ((ts->ts_status & ATH9K_TXERR_FILT) =3D=3D 0 &&
>  	    (tx_info->flags & IEEE80211_TX_CTL_NO_ACK) =3D=3D 0) {
>  		/*
> @@ -2590,13 +2607,6 @@ static void ath_tx_rc_status(struct ath_softc *sc,=
 struct ath_buf *bf,
>  			tx_info->status.rates[tx_rateindex].count =3D
>  				hw->max_rate_tries;
>  	}
> -
> -	for (i =3D tx_rateindex + 1; i < hw->max_rates; i++) {
> -		tx_info->status.rates[i].count =3D 0;
> -		tx_info->status.rates[i].idx =3D -1;
> -	}
> -
> -	tx_info->status.rates[tx_rateindex].count =3D ts->ts_longretry + 1;
>  }
> =20
>  static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)