drivers/net/wireless/ath/wil6210/txrx.h | 3 +-- drivers/net/wireless/marvell/mwifiex/main.c | 3 +-- include/net/sock.h | 7 +++++++ net/mac80211/mesh.c | 2 +- net/mac80211/tx.c | 6 +++--- 5 files changed, 13 insertions(+), 8 deletions(-)
Checking the SOCK_WIFI_STATUS flag bit in sk_flags, may give a wrong result
since sk_flags are part of a union and the union is used otherwise. Add
a sk_requests_wifi_status() which checks if sk is non-NULL, sk is a full socket
and checks the flag bit.
Fixes: 76a853f86c97 ("wifi: free SKBTX_WIFI_STATUS skb tx_flags flag")
Idea-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Bert Karwatzki <spasswolf@web.de>
---
drivers/net/wireless/ath/wil6210/txrx.h | 3 +--
drivers/net/wireless/marvell/mwifiex/main.c | 3 +--
include/net/sock.h | 7 +++++++
net/mac80211/mesh.c | 2 +-
net/mac80211/tx.c | 6 +++---
5 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index 33ccd0b248d4..fff8b7f8abc5 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -617,8 +617,7 @@ static inline bool wil_need_txstat(struct sk_buff *skb)
{
const u8 *da = wil_skb_get_da(skb);
- return is_unicast_ether_addr(da) && skb->sk &&
- sock_flag(skb->sk, SOCK_WIFI_STATUS);
+ return is_unicast_ether_addr(da) && sk_requests_wifi_status(skb->sk);
}
static inline void wil_consume_skb(struct sk_buff *skb, bool acked)
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index 1485f949ad4e..7b50a88a18e5 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -913,8 +913,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
multicast = is_multicast_ether_addr(skb->data);
- if (unlikely(!multicast && skb->sk &&
- sock_flag(skb->sk, SOCK_WIFI_STATUS) &&
+ if (unlikely(!multicast && sk_requests_wifi_status(skb->sk) &&
priv->adapter->fw_api_ver == MWIFIEX_FW_V15))
skb = mwifiex_clone_skb_for_tx_status(priv,
skb,
diff --git a/include/net/sock.h b/include/net/sock.h
index 3e15d7105ad2..2da289ec4c17 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2822,6 +2822,13 @@ sk_is_refcounted(struct sock *sk)
return !sk_fullsock(sk) || !sock_flag(sk, SOCK_RCU_FREE);
}
+static inline bool
+sk_requests_wifi_status(struct sock *sk)
+{
+ return sk && sk_fullsock(sk) && sock_flag(sk,
+SOCK_WIFI_STATUS);
+}
+
/* Checks if this SKB belongs to an HW offloaded socket
* and whether any SW fallbacks are required based on dev.
* Check decrypted mark in case skb_orphan() cleared socket.
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index a381b4b756ea..5cc56d578048 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -777,7 +777,7 @@ bool ieee80211_mesh_xmit_fast(struct ieee80211_sub_if_data *sdata,
if (ethertype < ETH_P_802_3_MIN)
return false;
- if (skb->sk && sock_flag(skb->sk, SOCK_WIFI_STATUS))
+ if (sk_requests_wifi_status(skb->sk))
return false;
if (skb->ip_summed == CHECKSUM_PARTIAL) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3b9392a6ddb2..d8d4f3d7d7f2 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2859,7 +2859,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
}
if (unlikely(!multicast &&
- ((skb->sk && sock_flag(skb->sk, SOCK_WIFI_STATUS)) ||
+ (sk_requests_wifi_status(skb->sk) ||
ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS)))
info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
cookie);
@@ -3756,7 +3756,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
return false;
/* don't handle TX status request here either */
- if (skb->sk && sock_flag(skb->sk, SOCK_WIFI_STATUS))
+ if (sk_requests_wifi_status(skb->sk))
return false;
if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
@@ -4648,7 +4648,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
}
- if (unlikely(skb->sk && sock_flag(skb->sk, SOCK_WIFI_STATUS))) {
+ if (unlikely(sk_requests_wifi_status(skb->sk))) {
info->status_data = ieee80211_store_ack_skb(local, skb,
&info->flags, NULL);
if (info->status_data)
--
2.49.0
There are two calls to sock_flag(., SOCK_WIFI_STATUS) which I didn't change:
In __sock_recv_wifi_status() (in net/socket.c) which gets called by
sock_recv_timestamp() and in sk_getsockopt() (in net/core/sock.c). These
existed before the error occured and seem to be fine.
Bert Karwatzki
On Wed, May 21, 2025 at 6:34 AM Bert Karwatzki <spasswolf@web.de> wrote:
>
> Checking the SOCK_WIFI_STATUS flag bit in sk_flags, may give a wrong result
> since sk_flags are part of a union and the union is used otherwise. Add
> a sk_requests_wifi_status() which checks if sk is non-NULL, sk is a full socket
> and checks the flag bit.
>
> Fixes: 76a853f86c97 ("wifi: free SKBTX_WIFI_STATUS skb tx_flags flag")
> Idea-by: Johannes Berg <johannes.berg@intel.com>
> Signed-off-by: Bert Karwatzki <spasswolf@web.de>
Since Johannes will modify it manually, so...
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Thanks,
Jason
Hi--
On 5/20/25 3:34 PM, Bert Karwatzki wrote:
> Checking the SOCK_WIFI_STATUS flag bit in sk_flags, may give a wrong result
> since sk_flags are part of a union and the union is used otherwise. Add
> a sk_requests_wifi_status() which checks if sk is non-NULL, sk is a full socket
> and checks the flag bit.
>
> Fixes: 76a853f86c97 ("wifi: free SKBTX_WIFI_STATUS skb tx_flags flag")
> Idea-by: Johannes Berg <johannes.berg@intel.com>
That is usually spelled
Suggested-by:
> Signed-off-by: Bert Karwatzki <spasswolf@web.de>
> ---
> drivers/net/wireless/ath/wil6210/txrx.h | 3 +--
> drivers/net/wireless/marvell/mwifiex/main.c | 3 +--
> include/net/sock.h | 7 +++++++
> net/mac80211/mesh.c | 2 +-
> net/mac80211/tx.c | 6 +++---
> 5 files changed, 13 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
> index 33ccd0b248d4..fff8b7f8abc5 100644
> --- a/drivers/net/wireless/ath/wil6210/txrx.h
> +++ b/drivers/net/wireless/ath/wil6210/txrx.h
> @@ -617,8 +617,7 @@ static inline bool wil_need_txstat(struct sk_buff *skb)
> {
> const u8 *da = wil_skb_get_da(skb);
>
> - return is_unicast_ether_addr(da) && skb->sk &&
> - sock_flag(skb->sk, SOCK_WIFI_STATUS);
> + return is_unicast_ether_addr(da) && sk_requests_wifi_status(skb->sk);
> }
>
> static inline void wil_consume_skb(struct sk_buff *skb, bool acked)
> diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
> index 1485f949ad4e..7b50a88a18e5 100644
> --- a/drivers/net/wireless/marvell/mwifiex/main.c
> +++ b/drivers/net/wireless/marvell/mwifiex/main.c
> @@ -913,8 +913,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
>
> multicast = is_multicast_ether_addr(skb->data);
>
> - if (unlikely(!multicast && skb->sk &&
> - sock_flag(skb->sk, SOCK_WIFI_STATUS) &&
> + if (unlikely(!multicast && sk_requests_wifi_status(skb->sk) &&
> priv->adapter->fw_api_ver == MWIFIEX_FW_V15))
> skb = mwifiex_clone_skb_for_tx_status(priv,
> skb,
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 3e15d7105ad2..2da289ec4c17 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -2822,6 +2822,13 @@ sk_is_refcounted(struct sock *sk)
> return !sk_fullsock(sk) || !sock_flag(sk, SOCK_RCU_FREE);
> }
>
> +static inline bool
> +sk_requests_wifi_status(struct sock *sk)
> +{
> + return sk && sk_fullsock(sk) && sock_flag(sk,
> +SOCK_WIFI_STATUS);
Missing indentation on the line above.
> +}
> +
> /* Checks if this SKB belongs to an HW offloaded socket
> * and whether any SW fallbacks are required based on dev.
> * Check decrypted mark in case skb_orphan() cleared socket.
--
~Randy
On Tue, 2025-05-20 at 15:57 -0700, Randy Dunlap wrote: ... > That is usually spelled > Suggested-by: ... > Missing indentation on the line above. ... I'll just fix that - will apply it now. Maybe also change the subject, since really it's about checking the socket flags properly, the main feature isn't adding the function :) johannes
© 2016 - 2025 Red Hat, Inc.