diff mbox series

[wpan] mac802154: Fix LQI recording

Message ID 20221020142535.1038885-1-miquel.raynal@bootlin.com (mailing list archive)
State Accepted
Headers show
Series [wpan] mac802154: Fix LQI recording | expand

Commit Message

Miquel Raynal Oct. 20, 2022, 2:25 p.m. UTC
Back in 2014, the LQI was saved in the skb control buffer (skb->cb, or
mac_cb(skb)) without any actual reset of this area prior to its use.

As part of a useful rework of the use of this region, 32edc40ae65c
("ieee802154: change _cb handling slightly") introduced mac_cb_init() to
basically memset the cb field to 0. In particular, this new function got
called at the beginning of mac802154_parse_frame_start(), right before
the location where the buffer got actually filled.

What went through unnoticed however, is the fact that the very first
helper called by device drivers in the receive path already used this
area to save the LQI value for later extraction. Resetting the cb field
"so late" led to systematically zeroing the LQI.

If we consider the reset of the cb field needed, we can make it as soon
as we get an skb from a device driver, right before storing the LQI,
as is the very first time we need to write something there.

Cc: stable@vger.kernel.org
Fixes: 32edc40ae65c ("ieee802154: change _cb handling slightly")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
---

Hello,

I am surprised the LQI was gone for all those years and nobody
noticed it, so perhaps I did misinterpret slightly the situation, but I
am pretty sure the cb area reset was erasing the LQI.

About the backports, they will likely fail on the older kernels because
of some function/file moves, but I don't think we really care.

Cheers,
Miquèl

 net/mac802154/rx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Alexander Aring Oct. 20, 2022, 11:30 p.m. UTC | #1
Hi,

On Thu, Oct 20, 2022 at 10:25 AM Miquel Raynal
<miquel.raynal@bootlin.com> wrote:
>
> Back in 2014, the LQI was saved in the skb control buffer (skb->cb, or
> mac_cb(skb)) without any actual reset of this area prior to its use.
>
> As part of a useful rework of the use of this region, 32edc40ae65c
> ("ieee802154: change _cb handling slightly") introduced mac_cb_init() to
> basically memset the cb field to 0. In particular, this new function got
> called at the beginning of mac802154_parse_frame_start(), right before
> the location where the buffer got actually filled.
>
> What went through unnoticed however, is the fact that the very first
> helper called by device drivers in the receive path already used this
> area to save the LQI value for later extraction. Resetting the cb field
> "so late" led to systematically zeroing the LQI.
>
> If we consider the reset of the cb field needed, we can make it as soon
> as we get an skb from a device driver, right before storing the LQI,
> as is the very first time we need to write something there.
>
> Cc: stable@vger.kernel.org
> Fixes: 32edc40ae65c ("ieee802154: change _cb handling slightly")
> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>

Acked-by: Alexander Aring <aahringo@redhat.com>

> ---
>
> Hello,
>
> I am surprised the LQI was gone for all those years and nobody
> noticed it, so perhaps I did misinterpret slightly the situation, but I
> am pretty sure the cb area reset was erasing the LQI.
>

probably because nobody was really using those values before. There
were some patches years ago to add them into af802154 cmsg but
probably not well tested and so far it's the only upstream user.

However, thanks for fixing it.

- Alex
Stefan Schmidt Oct. 24, 2022, 9:19 a.m. UTC | #2
Hello.

On 20.10.22 16:25, Miquel Raynal wrote:
> Back in 2014, the LQI was saved in the skb control buffer (skb->cb, or
> mac_cb(skb)) without any actual reset of this area prior to its use.
> 
> As part of a useful rework of the use of this region, 32edc40ae65c
> ("ieee802154: change _cb handling slightly") introduced mac_cb_init() to
> basically memset the cb field to 0. In particular, this new function got
> called at the beginning of mac802154_parse_frame_start(), right before
> the location where the buffer got actually filled.
> 
> What went through unnoticed however, is the fact that the very first
> helper called by device drivers in the receive path already used this
> area to save the LQI value for later extraction. Resetting the cb field
> "so late" led to systematically zeroing the LQI.
> 
> If we consider the reset of the cb field needed, we can make it as soon
> as we get an skb from a device driver, right before storing the LQI,
> as is the very first time we need to write something there.
> 
> Cc: stable@vger.kernel.org
> Fixes: 32edc40ae65c ("ieee802154: change _cb handling slightly")
> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
> ---
> 
> Hello,
> 
> I am surprised the LQI was gone for all those years and nobody
> noticed it, so perhaps I did misinterpret slightly the situation, but I
> am pretty sure the cb area reset was erasing the LQI.
> 
> About the backports, they will likely fail on the older kernels because
> of some function/file moves, but I don't think we really care.
> 
> Cheers,
> Miquèl
> 
>   net/mac802154/rx.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
> index d1f7b8df41fe..a4733a62911f 100644
> --- a/net/mac802154/rx.c
> +++ b/net/mac802154/rx.c
> @@ -134,7 +134,7 @@ static int
>   ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
>   {
>   	int hlen;
> -	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
> +	struct ieee802154_mac_cb *cb = mac_cb(skb);
>   
>   	skb_reset_mac_header(skb);
>   
> @@ -305,8 +305,9 @@ void
>   ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
>   {
>   	struct ieee802154_local *local = hw_to_local(hw);
> +	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
>   
> -	mac_cb(skb)->lqi = lqi;
> +	cb->lqi = lqi;
>   	skb->pkt_type = IEEE802154_RX_MSG;
>   	skb_queue_tail(&local->skb_queue, skb);
>   	tasklet_schedule(&local->tasklet);


This patch has been applied to the wpan tree and will be
part of the next pull request to net. Thanks!

regards
Stefan Schmidt
diff mbox series

Patch

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index d1f7b8df41fe..a4733a62911f 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -134,7 +134,7 @@  static int
 ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
 {
 	int hlen;
-	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
+	struct ieee802154_mac_cb *cb = mac_cb(skb);
 
 	skb_reset_mac_header(skb);
 
@@ -305,8 +305,9 @@  void
 ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
 {
 	struct ieee802154_local *local = hw_to_local(hw);
+	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
 
-	mac_cb(skb)->lqi = lqi;
+	cb->lqi = lqi;
 	skb->pkt_type = IEEE802154_RX_MSG;
 	skb_queue_tail(&local->skb_queue, skb);
 	tasklet_schedule(&local->tasklet);