[PATCH] mac80211: ensure that mgmt tx skbs have tailroom for encryption

[PATCH] mac80211: ensure that mgmt tx skbs have tailroom for encryption

[Felix Fietkau]

Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management
frames need to be software encrypted. Since normal data packets are still
encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented
after key upload to hw. This can lead to passing skbs to ccmp_encrypt_skb,
which don't have the necessary tailroom for software encryption.

Change the code to add tailroom for encrypted management packets, even if
crypto_tx_tailroom_needed_cnt is 0.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 net/mac80211/tx.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 61c7ea9de2cc..8a49a74c0a37 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1945,9 +1945,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
 				int head_need, bool may_encrypt)
 {
 	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_hdr *hdr;
+	bool enc_tailroom;
 	int tail_need = 0;
 
-	if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
+	hdr = (struct ieee80211_hdr *) skb->data;
+	enc_tailroom = may_encrypt &&
+		       (sdata->crypto_tx_tailroom_needed_cnt ||
+			ieee80211_is_mgmt(hdr->frame_control));
+
+	if (enc_tailroom) {
 		tail_need = IEEE80211_ENCRYPT_TAILROOM;
 		tail_need -= skb_tailroom(skb);
 		tail_need = max_t(int, tail_need, 0);
@@ -1955,8 +1962,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
 
 	if (skb_cloned(skb) &&
 	    (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
-	     !skb_clone_writable(skb, ETH_HLEN) ||
-	     (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
+	     !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
 		I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
 	else if (head_need || tail_need)
 		I802_DEBUG_INC(local->tx_expand_skb_head);
-- 
2.17.0

Re: [PATCH] mac80211: ensure that mgmt tx skbs have tailroom for encryption

[Sasha Levin]

Hi,

[This is an automated email]

This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: all

The bot has tested the following trees: v4.20.5, v4.19.18, v4.14.96, v4.9.153, v4.4.172, v3.18.133.

v4.20.5: Build OK!
v4.19.18: Build OK!
v4.14.96: Build OK!
v4.9.153: Build OK!
v4.4.172: Build OK!
v3.18.133: Failed to apply! Possible dependencies:
    057fcd426e14 ("bcma: gpio: use predictable base for all BCM47XX buses")
    077efc8c42e8 ("ath10k: clean up sta auth/assoc code")
    202e86e60646 ("ath10k: add ATH10K_FW_IE_WMI_OP_VERSION")
    292a753d4b18 ("ath10k: clean up num_peers locking")
    30686bf7f5b3 ("mac80211: convert HW flags to unsigned long bitmap")
    34b28b6e9a66 ("ath10k: print wmi version info")
    3c7984e97f32 ("ath10k: don't create bssid peer for ibss")
    3cb10943fc60 ("ath10k: use IEEE80211_HW_SW_CRYPTO_CONTROL")
    41fbf6e4f317 ("ath10k: enable IEEE80211_HW_SUPPORT_FAST_XMIT")
    5f2144d9b2ea ("ath10k: create ath10k_core_init_features()")
    830915597747 ("ath10k: refactor ath10k_init_download_firmware()")
    84cbf3a75928 ("ath10k: split ce pipe init/alloc further")
    a52c0282721e ("ath10k: add missing goto")
    a58227ef69a7 ("ath10k: retrieve calibration data from file")
    c6ce492d03e8 ("ath10k: clean up error handling in ath10k_core_probe_fw()")
    ca996ec56608 ("ath10k: implement wmi-tlv backend")
    cfd1061e9b52 ("ath10k: fix station count enforcement")
    d63955b33b3b ("ath10k: add support for qca6174")
    d98c3edcbbbf ("Merge tag 'wireless-drivers-next-for-davem-2015-05-21' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next")


How should we proceed with this patch?

--
Thanks,
Sasha