7 files changed, 141 insertions, 49 deletions

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6449a1c2283b..f0f5fedb8caa 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
         if (len < IEEE80211_DEAUTH_FRAME_LEN)
                 return;
 
-        ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
-                 mgmt->sa, mgmt->da, mgmt->bssid, reason);
+        ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+        ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
         sta_info_destroy_addr(sdata, mgmt->sa);
 }
 
@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 
-        ibss_dbg(sdata,
-                 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
-                 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
+        ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+        ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
+                 mgmt->bssid, auth_transaction);
 
         if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                 return;
@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 rx_timestamp = drv_get_tsf(local, sdata);
         }
 
-        ibss_dbg(sdata,
-                 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+        ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
                  mgmt->sa, mgmt->bssid,
-                 (unsigned long long)rx_timestamp,
+                 (unsigned long long)rx_timestamp);
+        ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
                  (unsigned long long)beacon_timestamp,
                  (unsigned long long)(rx_timestamp - beacon_timestamp),
                  jiffies);
@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 
         tx_last_beacon = drv_tx_last_beacon(local);
 
-        ibss_dbg(sdata,
-                 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
-                 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
+        ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+        ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
+                 mgmt->bssid, tx_last_beacon);
 
         if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
                 return;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4fb2709cb527..513627896204 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -256,8 +256,27 @@ static void ieee80211_restart_work(struct work_struct *work)
 
         flush_work(&local->radar_detected_work);
         rtnl_lock();
-        list_for_each_entry(sdata, &local->interfaces, list)
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                /*
+                 * XXX: there may be more work for other vif types and even
+                 * for station mode: a good thing would be to run most of
+                 * the iface type's dependent _stop (ieee80211_mg_stop,
+                 * ieee80211_ibss_stop) etc...
+                 * For now, fix only the specific bug that was seen: race
+                 * between csa_connection_drop_work and us.
+                 */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        /*
+                         * This worker is scheduled from the iface worker that
+                         * runs on mac80211's workqueue, so we can't be
+                         * scheduling this worker after the cancel right here.
+                         * The exception is ieee80211_chswitch_done.
+                         * Then we can have a race...
+                         */
+                        cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
+                }
                 flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+        }
         ieee80211_scan_cancel(local);
 
         /* make sure any new ROC will consider local->in_reconfig */
@@ -471,10 +490,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
                 cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
                             IEEE80211_VHT_CAP_SHORT_GI_80 |
                             IEEE80211_VHT_CAP_SHORT_GI_160 |
-                            IEEE80211_VHT_CAP_RXSTBC_1 |
-                            IEEE80211_VHT_CAP_RXSTBC_2 |
-                            IEEE80211_VHT_CAP_RXSTBC_3 |
-                            IEEE80211_VHT_CAP_RXSTBC_4 |
+                            IEEE80211_VHT_CAP_RXSTBC_MASK |
                             IEEE80211_VHT_CAP_TXSTBC |
                             IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
                             IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
@@ -1208,6 +1224,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 #if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&local->ifa6_notifier);
 #endif
+        ieee80211_txq_teardown_flows(local);
 
         rtnl_lock();
 
@@ -1236,7 +1253,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
         skb_queue_purge(&local->skb_queue_tdls_chsw);
-        ieee80211_txq_teardown_flows(local);
 
         destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 35ad3983ae4b..daf9db3c8f24 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 forward = false;
                 reply = true;
                 target_metric = 0;
+
+                if (SN_GT(target_sn, ifmsh->sn))
+                        ifmsh->sn = target_sn;
+
                 if (time_after(jiffies, ifmsh->last_sn_update +
                                         net_traversal_jiffies(sdata)) ||
                     time_before(jiffies, ifmsh->last_sn_update)) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7fb9957359a3..3dbecae4be73 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1073,6 +1073,10 @@ static void ieee80211_chswitch_work(struct work_struct *work)
          */
 
         if (sdata->reserved_chanctx) {
+                struct ieee80211_supported_band *sband = NULL;
+                struct sta_info *mgd_sta = NULL;
+                enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
+
                 /*
                  * with multi-vif csa driver may call ieee80211_csa_finish()
                  * many times while waiting for other interfaces to use their
@@ -1081,6 +1085,48 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 if (sdata->reserved_ready)
                         goto out;
 
+                if (sdata->vif.bss_conf.chandef.width !=
+                    sdata->csa_chandef.width) {
+                        /*
+                         * For managed interface, we need to also update the AP
+                         * station bandwidth and align the rate scale algorithm
+                         * on the bandwidth change. Here we only consider the
+                         * bandwidth of the new channel definition (as channel
+                         * switch flow does not have the full HT/VHT/HE
+                         * information), assuming that if additional changes are
+                         * required they would be done as part of the processing
+                         * of the next beacon from the AP.
+                         */
+                        switch (sdata->csa_chandef.width) {
+                        case NL80211_CHAN_WIDTH_20_NOHT:
+                        case NL80211_CHAN_WIDTH_20:
+                        default:
+                                bw = IEEE80211_STA_RX_BW_20;
+                                break;
+                        case NL80211_CHAN_WIDTH_40:
+                                bw = IEEE80211_STA_RX_BW_40;
+                                break;
+                        case NL80211_CHAN_WIDTH_80:
+                                bw = IEEE80211_STA_RX_BW_80;
+                                break;
+                        case NL80211_CHAN_WIDTH_80P80:
+                        case NL80211_CHAN_WIDTH_160:
+                                bw = IEEE80211_STA_RX_BW_160;
+                                break;
+                        }
+
+                        mgd_sta = sta_info_get(sdata, ifmgd->bssid);
+                        sband =
+                                local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
+                }
+
+                if (sdata->vif.bss_conf.chandef.width >
+                    sdata->csa_chandef.width) {
+                        mgd_sta->sta.bandwidth = bw;
+                        rate_control_rate_update(local, sband, mgd_sta,
+                                                 IEEE80211_RC_BW_CHANGED);
+                }
+
                 ret = ieee80211_vif_use_reserved_context(sdata);
                 if (ret) {
                         sdata_info(sdata,
@@ -1091,6 +1137,13 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                         goto out;
                 }
 
+                if (sdata->vif.bss_conf.chandef.width <
+                    sdata->csa_chandef.width) {
+                        mgd_sta->sta.bandwidth = bw;
+                        rate_control_rate_update(local, sband, mgd_sta,
+                                                 IEEE80211_RC_BW_CHANGED);
+                }
+
                 goto out;
         }
 
@@ -1312,6 +1365,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                          cbss->beacon_interval));
         return;
  drop_connection:
+        /*
+         * This is just so that the disconnect flow will know that
+         * we were trying to switch channel and failed. In case the
+         * mode is 1 (we are not allowed to Tx), we will know not to
+         * send a deauthentication frame. Those two fields will be
+         * reset when the disconnection worker runs.
+         */
+        sdata->vif.csa_active = true;
+        sdata->csa_block_tx = csa_ie.mode;
+
         ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
         mutex_unlock(&local->chanctx_mtx);
         mutex_unlock(&local->mtx);
@@ -2522,6 +2585,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+        bool tx;
 
         sdata_lock(sdata);
         if (!ifmgd->associated) {
@@ -2529,6 +2593,8 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
+        tx = !sdata->csa_block_tx;
+
         /* AP is probably out of range (or not reachable for another reason) so
          * remove the bss struct for that AP.
          */
@@ -2536,7 +2602,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                               true, frame_buf);
+                               tx, frame_buf);
         mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
         ifmgd->csa_waiting_bcn = false;
@@ -2547,7 +2613,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         }
         mutex_unlock(&local->mtx);
 
-        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
+        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
 
         sdata_unlock(sdata);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 64742f2765c4..96611d5dfadb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1728,6 +1728,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
          */
         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
             !ieee80211_has_morefrags(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1) &&
             (ieee80211_is_mgmt(hdr->frame_control) ||
              ieee80211_is_data(hdr->frame_control)) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index cd332e3e1134..f353d9db54bc 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3078,27 +3078,18 @@ void ieee80211_clear_fast_xmit(struct sta_info *sta)
 }
 
 static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
-                                        struct sk_buff *skb, int headroom,
-                                        int *subframe_len)
+                                        struct sk_buff *skb, int headroom)
 {
-        int amsdu_len = *subframe_len + sizeof(struct ethhdr);
-        int padding = (4 - amsdu_len) & 3;
-
-        if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
+        if (skb_headroom(skb) < headroom) {
                 I802_DEBUG_INC(local->tx_expand_skb_head);
 
-                if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
+                if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
                         wiphy_debug(local->hw.wiphy,
                                     "failed to reallocate TX buffer\n");
                         return false;
                 }
         }
 
-        if (padding) {
-                *subframe_len += padding;
-                skb_put_zero(skb, padding);
-        }
-
         return true;
 }
 
@@ -3122,8 +3113,7 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
         if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
                 return true;
 
-        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
-                                         &subframe_len))
+        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
                 return false;
 
         data = skb_push(skb, sizeof(*amsdu_hdr));
@@ -3189,7 +3179,8 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         void *data;
         bool ret = false;
         unsigned int orig_len;
-        int n = 1, nfrags;
+        int n = 2, nfrags, pad = 0;
+        u16 hdrlen;
 
         if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
                 return false;
@@ -3222,9 +3213,6 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (skb->len + head->len > max_amsdu_len)
                 goto out;
 
-        if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-                goto out;
-
         nfrags = 1 + skb_shinfo(skb)->nr_frags;
         nfrags += 1 + skb_shinfo(head)->nr_frags;
         frag_tail = &skb_shinfo(head)->frag_list;
@@ -3240,10 +3228,24 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (max_frags && nfrags > max_frags)
                 goto out;
 
-        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
-                                         &subframe_len))
+        if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
                 goto out;
 
+        /*
+         * Pad out the previous subframe to a multiple of 4 by adding the
+         * padding to the next one, that's being added. Note that head->len
+         * is the length of the full A-MSDU, but that works since each time
+         * we add a new subframe we pad out the previous one to a multiple
+         * of 4 and thus it no longer matters in the next round.
+         */
+        hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
+        if ((head->len - hdrlen) & 3)
+                pad = 4 - ((head->len - hdrlen) & 3);
+
+        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
+                                                     2 + pad))
+                goto out_recalc;
+
         ret = true;
         data = skb_push(skb, ETH_ALEN + 2);
         memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
@@ -3253,15 +3255,19 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         memcpy(data, &len, 2);
         memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
 
+        memset(skb_push(skb, pad), 0, pad);
+
         head->len += skb->len;
         head->data_len += skb->len;
         *frag_tail = skb;
 
-        flow->backlog += head->len - orig_len;
-        tin->backlog_bytes += head->len - orig_len;
-
-        fq_recalc_backlog(fq, tin, flow);
+out_recalc:
+        if (head->len != orig_len) {
+                flow->backlog += head->len - orig_len;
+                tin->backlog_bytes += head->len - orig_len;
 
+                fq_recalc_backlog(fq, tin, flow);
+        }
 out:
         spin_unlock_bh(&fq->lock);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 88efda7c9f8a..716cd6442d86 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1135,7 +1135,7 @@ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_chanctx_conf *chanctx_conf;
         const struct ieee80211_reg_rule *rrule;
-        struct ieee80211_wmm_ac *wmm_ac;
+        const struct ieee80211_wmm_ac *wmm_ac;
         u16 center_freq = 0;
 
         if (sdata->vif.type != NL80211_IFTYPE_AP &&
@@ -1154,20 +1154,19 @@ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
 
         rrule = freq_reg_info(sdata->wdev.wiphy, MHZ_TO_KHZ(center_freq));
 
-        if (IS_ERR_OR_NULL(rrule) || !rrule->wmm_rule) {
+        if (IS_ERR_OR_NULL(rrule) || !rrule->has_wmm) {
                 rcu_read_unlock();
                 return;
         }
 
         if (sdata->vif.type == NL80211_IFTYPE_AP)
-                wmm_ac = &rrule->wmm_rule->ap[ac];
+                wmm_ac = &rrule->wmm_rule.ap[ac];
         else
-                wmm_ac = &rrule->wmm_rule->client[ac];
+                wmm_ac = &rrule->wmm_rule.client[ac];
         qparam->cw_min = max_t(u16, qparam->cw_min, wmm_ac->cw_min);
         qparam->cw_max = max_t(u16, qparam->cw_max, wmm_ac->cw_max);
         qparam->aifs = max_t(u8, qparam->aifs, wmm_ac->aifsn);
-        qparam->txop = !qparam->txop ? wmm_ac->cot / 32 :
-                min_t(u16, qparam->txop, wmm_ac->cot / 32);
+        qparam->txop = min_t(u16, qparam->txop, wmm_ac->cot / 32);
         rcu_read_unlock();
 }