| 1 |
From: Felix Fietkau <nbd@nbd.name> |
| 2 |
To: linux-wireless@vger.kernel.org |
| 3 |
Cc: johannes@sipsolutions.net |
| 4 |
Subject: [PATCH v4] wifi: mac80211: fix initialization of rx->link and rx->link_sta |
| 5 |
Date: Sat, 17 Dec 2022 09:56:24 +0100 |
| 6 |
|
| 7 |
There are some codepaths that do not initialize rx->link_sta properly. This |
| 8 |
causes a crash in places which assume that rx->link_sta is valid if rx->sta |
| 9 |
is valid. |
| 10 |
One known instance is triggered by __ieee80211_rx_h_amsdu being called from |
| 11 |
fast-rx. It results in a crash like this one: |
| 12 |
|
| 13 |
BUG: kernel NULL pointer dereference, address: 00000000000000a8 |
| 14 |
#PF: supervisor write access in kernel mode |
| 15 |
#PF: error_code(0x0002) - not-present page PGD 0 P4D 0 |
| 16 |
Oops: 0002 [#1] PREEMPT SMP PTI |
| 17 |
CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3 |
| 18 |
Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014 |
| 19 |
RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211] |
| 20 |
Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48 |
| 21 |
83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0 |
| 22 |
11 00 00 8d 50 fd 83 fa 01 |
| 23 |
RSP: 0018:ffff999040803b10 EFLAGS: 00010286 |
| 24 |
RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000 |
| 25 |
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 |
| 26 |
RBP: ffff999040803ce0 R08: 0000000000000000 R09: 0000000000000000 |
| 27 |
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900 |
| 28 |
R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000 |
| 29 |
FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000 |
| 30 |
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| 31 |
CR2: 00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0 |
| 32 |
Call Trace: |
| 33 |
<TASK> |
| 34 |
__ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211] |
| 35 |
? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] |
| 36 |
? __local_bh_enable_ip+0x3b/0xa0 |
| 37 |
ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] |
| 38 |
? prepare_transfer+0x109/0x1a0 [xhci_hcd] |
| 39 |
ieee80211_rx_list+0xa80/0xda0 [mac80211] |
| 40 |
mt76_rx_complete+0x207/0x2e0 [mt76] |
| 41 |
mt76_rx_poll_complete+0x357/0x5a0 [mt76] |
| 42 |
mt76u_rx_worker+0x4f5/0x600 [mt76_usb] |
| 43 |
? mt76_get_min_avg_rssi+0x140/0x140 [mt76] |
| 44 |
__mt76_worker_fn+0x50/0x80 [mt76] |
| 45 |
kthread+0xed/0x120 |
| 46 |
? kthread_complete_and_exit+0x20/0x20 |
| 47 |
ret_from_fork+0x22/0x30 |
| 48 |
|
| 49 |
Since the initialization of rx->link and rx->link_sta is rather convoluted |
| 50 |
and duplicated in many places, clean it up by using a helper function to |
| 51 |
set it. |
| 52 |
|
| 53 |
Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling") |
| 54 |
Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default") |
| 55 |
Signed-off-by: Felix Fietkau <nbd@nbd.name> |
| 56 |
--- |
| 57 |
v4: fix regression in handling mgmt frames with AP_VLAN |
| 58 |
v3: include crash log |
| 59 |
v2: fix uninitialized variable |
| 60 |
|
| 61 |
net/mac80211/rx.c | 218 ++++++++++++++++++++-------------------------- |
| 62 |
1 file changed, 95 insertions(+), 123 deletions(-) |
| 63 |
|
| 64 |
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c |
| 65 |
index 3fa7b36d4324..09cd0caded16 100644 |
| 66 |
--- a/net/mac80211/rx.c |
| 67 |
+++ b/net/mac80211/rx.c |
| 68 |
@@ -4091,6 +4091,56 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) |
| 69 |
#undef CALL_RXH |
| 70 |
} |
| 71 |
|
| 72 |
+static bool |
| 73 |
+ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id) |
| 74 |
+{ |
| 75 |
+ if (!sta->mlo) |
| 76 |
+ return false; |
| 77 |
+ |
| 78 |
+ return !!(sta->valid_links & BIT(link_id)); |
| 79 |
+} |
| 80 |
+ |
| 81 |
+static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx, |
| 82 |
+ u8 link_id) |
| 83 |
+{ |
| 84 |
+ if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id)) |
| 85 |
+ return false; |
| 86 |
+ |
| 87 |
+ rx->link_id = link_id; |
| 88 |
+ rx->link = rcu_dereference(rx->sdata->link[link_id]); |
| 89 |
+ rx->link_sta = rcu_dereference(rx->sta->link[link_id]); |
| 90 |
+ |
| 91 |
+ return rx->link && rx->link_sta; |
| 92 |
+} |
| 93 |
+ |
| 94 |
+static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx, |
| 95 |
+ struct ieee80211_sta *pubsta, |
| 96 |
+ int link_id) |
| 97 |
+{ |
| 98 |
+ struct sta_info *sta; |
| 99 |
+ |
| 100 |
+ sta = container_of(pubsta, struct sta_info, sta); |
| 101 |
+ |
| 102 |
+ rx->link_id = link_id; |
| 103 |
+ rx->sta = sta; |
| 104 |
+ |
| 105 |
+ if (sta) { |
| 106 |
+ rx->local = sta->sdata->local; |
| 107 |
+ if (!rx->sdata) |
| 108 |
+ rx->sdata = sta->sdata; |
| 109 |
+ rx->link_sta = &sta->deflink; |
| 110 |
+ |
| 111 |
+ if (link_id >= 0 && |
| 112 |
+ !ieee80211_rx_data_set_link(rx, link_id)) |
| 113 |
+ return false; |
| 114 |
+ } |
| 115 |
+ |
| 116 |
+ if (link_id < 0) |
| 117 |
+ rx->link = &rx->sdata->deflink; |
| 118 |
+ |
| 119 |
+ return true; |
| 120 |
+} |
| 121 |
+ |
| 122 |
/* |
| 123 |
* This function makes calls into the RX path, therefore |
| 124 |
* it has to be invoked under RCU read lock. |
| 125 |
@@ -4099,16 +4149,19 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) |
| 126 |
{ |
| 127 |
struct sk_buff_head frames; |
| 128 |
struct ieee80211_rx_data rx = { |
| 129 |
- .sta = sta, |
| 130 |
- .sdata = sta->sdata, |
| 131 |
- .local = sta->local, |
| 132 |
/* This is OK -- must be QoS data frame */ |
| 133 |
.security_idx = tid, |
| 134 |
.seqno_idx = tid, |
| 135 |
- .link_id = -1, |
| 136 |
}; |
| 137 |
struct tid_ampdu_rx *tid_agg_rx; |
| 138 |
- u8 link_id; |
| 139 |
+ int link_id = -1; |
| 140 |
+ |
| 141 |
+ /* FIXME: statistics won't be right with this */ |
| 142 |
+ if (sta->sta.valid_links) |
| 143 |
+ link_id = ffs(sta->sta.valid_links) - 1; |
| 144 |
+ |
| 145 |
+ if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id)) |
| 146 |
+ return; |
| 147 |
|
| 148 |
tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); |
| 149 |
if (!tid_agg_rx) |
| 150 |
@@ -4128,10 +4181,6 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) |
| 151 |
}; |
| 152 |
drv_event_callback(rx.local, rx.sdata, &event); |
| 153 |
} |
| 154 |
- /* FIXME: statistics won't be right with this */ |
| 155 |
- link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0; |
| 156 |
- rx.link = rcu_dereference(sta->sdata->link[link_id]); |
| 157 |
- rx.link_sta = rcu_dereference(sta->link[link_id]); |
| 158 |
|
| 159 |
ieee80211_rx_handlers(&rx, &frames); |
| 160 |
} |
| 161 |
@@ -4147,7 +4196,6 @@ void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, |
| 162 |
/* This is OK -- must be QoS data frame */ |
| 163 |
.security_idx = tid, |
| 164 |
.seqno_idx = tid, |
| 165 |
- .link_id = -1, |
| 166 |
}; |
| 167 |
int i, diff; |
| 168 |
|
| 169 |
@@ -4158,10 +4206,8 @@ void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, |
| 170 |
|
| 171 |
sta = container_of(pubsta, struct sta_info, sta); |
| 172 |
|
| 173 |
- rx.sta = sta; |
| 174 |
- rx.sdata = sta->sdata; |
| 175 |
- rx.link = &rx.sdata->deflink; |
| 176 |
- rx.local = sta->local; |
| 177 |
+ if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1)) |
| 178 |
+ return; |
| 179 |
|
| 180 |
rcu_read_lock(); |
| 181 |
tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); |
| 182 |
@@ -4548,15 +4594,6 @@ void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) |
| 183 |
mutex_unlock(&local->sta_mtx); |
| 184 |
} |
| 185 |
|
| 186 |
-static bool |
| 187 |
-ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id) |
| 188 |
-{ |
| 189 |
- if (!sta->mlo) |
| 190 |
- return false; |
| 191 |
- |
| 192 |
- return !!(sta->valid_links & BIT(link_id)); |
| 193 |
-} |
| 194 |
- |
| 195 |
static void ieee80211_rx_8023(struct ieee80211_rx_data *rx, |
| 196 |
struct ieee80211_fast_rx *fast_rx, |
| 197 |
int orig_len) |
| 198 |
@@ -4667,7 +4704,6 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, |
| 199 |
struct sk_buff *skb = rx->skb; |
| 200 |
struct ieee80211_hdr *hdr = (void *)skb->data; |
| 201 |
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); |
| 202 |
- struct sta_info *sta = rx->sta; |
| 203 |
int orig_len = skb->len; |
| 204 |
int hdrlen = ieee80211_hdrlen(hdr->frame_control); |
| 205 |
int snap_offs = hdrlen; |
| 206 |
@@ -4679,7 +4715,6 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, |
| 207 |
u8 da[ETH_ALEN]; |
| 208 |
u8 sa[ETH_ALEN]; |
| 209 |
} addrs __aligned(2); |
| 210 |
- struct link_sta_info *link_sta; |
| 211 |
struct ieee80211_sta_rx_stats *stats; |
| 212 |
|
| 213 |
/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write |
| 214 |
@@ -4782,18 +4817,10 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, |
| 215 |
drop: |
| 216 |
dev_kfree_skb(skb); |
| 217 |
|
| 218 |
- if (rx->link_id >= 0) { |
| 219 |
- link_sta = rcu_dereference(sta->link[rx->link_id]); |
| 220 |
- if (!link_sta) |
| 221 |
- return true; |
| 222 |
- } else { |
| 223 |
- link_sta = &sta->deflink; |
| 224 |
- } |
| 225 |
- |
| 226 |
if (fast_rx->uses_rss) |
| 227 |
- stats = this_cpu_ptr(link_sta->pcpu_rx_stats); |
| 228 |
+ stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats); |
| 229 |
else |
| 230 |
- stats = &link_sta->rx_stats; |
| 231 |
+ stats = &rx->link_sta->rx_stats; |
| 232 |
|
| 233 |
stats->dropped++; |
| 234 |
return true; |
| 235 |
@@ -4811,8 +4838,8 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, |
| 236 |
struct ieee80211_local *local = rx->local; |
| 237 |
struct ieee80211_sub_if_data *sdata = rx->sdata; |
| 238 |
struct ieee80211_hdr *hdr = (void *)skb->data; |
| 239 |
- struct link_sta_info *link_sta = NULL; |
| 240 |
- struct ieee80211_link_data *link; |
| 241 |
+ struct link_sta_info *link_sta = rx->link_sta; |
| 242 |
+ struct ieee80211_link_data *link = rx->link; |
| 243 |
|
| 244 |
rx->skb = skb; |
| 245 |
|
| 246 |
@@ -4834,35 +4861,6 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, |
| 247 |
if (!ieee80211_accept_frame(rx)) |
| 248 |
return false; |
| 249 |
|
| 250 |
- if (rx->link_id >= 0) { |
| 251 |
- link = rcu_dereference(rx->sdata->link[rx->link_id]); |
| 252 |
- |
| 253 |
- /* we might race link removal */ |
| 254 |
- if (!link) |
| 255 |
- return true; |
| 256 |
- rx->link = link; |
| 257 |
- |
| 258 |
- if (rx->sta) { |
| 259 |
- rx->link_sta = |
| 260 |
- rcu_dereference(rx->sta->link[rx->link_id]); |
| 261 |
- if (!rx->link_sta) |
| 262 |
- return true; |
| 263 |
- } |
| 264 |
- } else { |
| 265 |
- if (rx->sta) |
| 266 |
- rx->link_sta = &rx->sta->deflink; |
| 267 |
- |
| 268 |
- rx->link = &sdata->deflink; |
| 269 |
- } |
| 270 |
- |
| 271 |
- if (unlikely(!is_multicast_ether_addr(hdr->addr1) && |
| 272 |
- rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) { |
| 273 |
- link_sta = rcu_dereference(rx->sta->link[rx->link_id]); |
| 274 |
- |
| 275 |
- if (WARN_ON_ONCE(!link_sta)) |
| 276 |
- return true; |
| 277 |
- } |
| 278 |
- |
| 279 |
if (!consume) { |
| 280 |
struct skb_shared_hwtstamps *shwt; |
| 281 |
|
| 282 |
@@ -4882,7 +4880,7 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, |
| 283 |
shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp; |
| 284 |
} |
| 285 |
|
| 286 |
- if (unlikely(link_sta)) { |
| 287 |
+ if (unlikely(rx->sta && rx->sta->sta.mlo)) { |
| 288 |
/* translate to MLD addresses */ |
| 289 |
if (ether_addr_equal(link->conf->addr, hdr->addr1)) |
| 290 |
ether_addr_copy(hdr->addr1, rx->sdata->vif.addr); |
| 291 |
@@ -4912,6 +4910,7 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, |
| 292 |
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); |
| 293 |
struct ieee80211_fast_rx *fast_rx; |
| 294 |
struct ieee80211_rx_data rx; |
| 295 |
+ int link_id = -1; |
| 296 |
|
| 297 |
memset(&rx, 0, sizeof(rx)); |
| 298 |
rx.skb = skb; |
| 299 |
@@ -4928,12 +4927,8 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, |
| 300 |
if (!pubsta) |
| 301 |
goto drop; |
| 302 |
|
| 303 |
- rx.sta = container_of(pubsta, struct sta_info, sta); |
| 304 |
- rx.sdata = rx.sta->sdata; |
| 305 |
- |
| 306 |
- if (status->link_valid && |
| 307 |
- !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id)) |
| 308 |
- goto drop; |
| 309 |
+ if (status->link_valid) |
| 310 |
+ link_id = status->link_id; |
| 311 |
|
| 312 |
/* |
| 313 |
* TODO: Should the frame be dropped if the right link_id is not |
| 314 |
@@ -4942,19 +4937,8 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, |
| 315 |
* link_id is used only for stats purpose and updating the stats on |
| 316 |
* the deflink is fine? |
| 317 |
*/ |
| 318 |
- if (status->link_valid) |
| 319 |
- rx.link_id = status->link_id; |
| 320 |
- |
| 321 |
- if (rx.link_id >= 0) { |
| 322 |
- struct ieee80211_link_data *link; |
| 323 |
- |
| 324 |
- link = rcu_dereference(rx.sdata->link[rx.link_id]); |
| 325 |
- if (!link) |
| 326 |
- goto drop; |
| 327 |
- rx.link = link; |
| 328 |
- } else { |
| 329 |
- rx.link = &rx.sdata->deflink; |
| 330 |
- } |
| 331 |
+ if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id)) |
| 332 |
+ goto drop; |
| 333 |
|
| 334 |
fast_rx = rcu_dereference(rx.sta->fast_rx); |
| 335 |
if (!fast_rx) |
| 336 |
@@ -4972,6 +4956,8 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx, |
| 337 |
{ |
| 338 |
struct link_sta_info *link_sta; |
| 339 |
struct ieee80211_hdr *hdr = (void *)skb->data; |
| 340 |
+ struct sta_info *sta; |
| 341 |
+ int link_id = -1; |
| 342 |
|
| 343 |
/* |
| 344 |
* Look up link station first, in case there's a |
| 345 |
@@ -4981,24 +4967,19 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx, |
| 346 |
*/ |
| 347 |
link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2); |
| 348 |
if (link_sta) { |
| 349 |
- rx->sta = link_sta->sta; |
| 350 |
- rx->link_id = link_sta->link_id; |
| 351 |
+ sta = link_sta->sta; |
| 352 |
+ link_id = link_sta->link_id; |
| 353 |
} else { |
| 354 |
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); |
| 355 |
|
| 356 |
- rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2); |
| 357 |
- if (rx->sta) { |
| 358 |
- if (status->link_valid && |
| 359 |
- !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, |
| 360 |
- status->link_id)) |
| 361 |
- return false; |
| 362 |
- |
| 363 |
- rx->link_id = status->link_valid ? status->link_id : -1; |
| 364 |
- } else { |
| 365 |
- rx->link_id = -1; |
| 366 |
- } |
| 367 |
+ sta = sta_info_get_bss(rx->sdata, hdr->addr2); |
| 368 |
+ if (status->link_valid) |
| 369 |
+ link_id = status->link_id; |
| 370 |
} |
| 371 |
|
| 372 |
+ if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id)) |
| 373 |
+ return false; |
| 374 |
+ |
| 375 |
return ieee80211_prepare_and_rx_handle(rx, skb, consume); |
| 376 |
} |
| 377 |
|
| 378 |
@@ -5057,19 +5038,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, |
| 379 |
|
| 380 |
if (ieee80211_is_data(fc)) { |
| 381 |
struct sta_info *sta, *prev_sta; |
| 382 |
- u8 link_id = status->link_id; |
| 383 |
+ int link_id = -1; |
| 384 |
|
| 385 |
- if (pubsta) { |
| 386 |
- rx.sta = container_of(pubsta, struct sta_info, sta); |
| 387 |
- rx.sdata = rx.sta->sdata; |
| 388 |
+ if (status->link_valid) |
| 389 |
+ link_id = status->link_id; |
| 390 |
|
| 391 |
- if (status->link_valid && |
| 392 |
- !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id)) |
| 393 |
+ if (pubsta) { |
| 394 |
+ if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id)) |
| 395 |
goto out; |
| 396 |
|
| 397 |
- if (status->link_valid) |
| 398 |
- rx.link_id = status->link_id; |
| 399 |
- |
| 400 |
/* |
| 401 |
* In MLO connection, fetch the link_id using addr2 |
| 402 |
* when the driver does not pass link_id in status. |
| 403 |
@@ -5087,7 +5064,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, |
| 404 |
if (!link_sta) |
| 405 |
goto out; |
| 406 |
|
| 407 |
- rx.link_id = link_sta->link_id; |
| 408 |
+ ieee80211_rx_data_set_link(&rx, link_sta->link_id); |
| 409 |
} |
| 410 |
|
| 411 |
if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) |
| 412 |
@@ -5103,30 +5080,25 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, |
| 413 |
continue; |
| 414 |
} |
| 415 |
|
| 416 |
- if ((status->link_valid && |
| 417 |
- !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta, |
| 418 |
- link_id)) || |
| 419 |
- (!status->link_valid && prev_sta->sta.mlo)) |
| 420 |
+ if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta, |
| 421 |
+ link_id)) |
| 422 |
+ goto out; |
| 423 |
+ |
| 424 |
+ if (!status->link_valid && prev_sta->sta.mlo) |
| 425 |
continue; |
| 426 |
|
| 427 |
- rx.link_id = status->link_valid ? link_id : -1; |
| 428 |
- rx.sta = prev_sta; |
| 429 |
- rx.sdata = prev_sta->sdata; |
| 430 |
ieee80211_prepare_and_rx_handle(&rx, skb, false); |
| 431 |
|
| 432 |
prev_sta = sta; |
| 433 |
} |
| 434 |
|
| 435 |
if (prev_sta) { |
| 436 |
- if ((status->link_valid && |
| 437 |
- !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta, |
| 438 |
- link_id)) || |
| 439 |
- (!status->link_valid && prev_sta->sta.mlo)) |
| 440 |
+ if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta, |
| 441 |
+ link_id)) |
| 442 |
goto out; |
| 443 |
|
| 444 |
- rx.link_id = status->link_valid ? link_id : -1; |
| 445 |
- rx.sta = prev_sta; |
| 446 |
- rx.sdata = prev_sta->sdata; |
| 447 |
+ if (!status->link_valid && prev_sta->sta.mlo) |
| 448 |
+ goto out; |
| 449 |
|
| 450 |
if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) |
| 451 |
return; |
Parent Directory
| 
Revision Log