• Ping-Ke Shih's avatar
    wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning · b98c1610
    Ping-Ke Shih authored
    The commit 06470f74 ("mac80211: add API to allow filtering frames in BA sessions")
    added reorder_buf_filtered to mark frames filtered by firmware, and it
    can only work correctly if hw.max_rx_aggregation_subframes <= 64 since
    it stores the bitmap in a u64 variable.
    
    However, new HE or EHT devices can support BlockAck number up to 256 or
    1024, and then using a higher subframe index leads UBSAN warning:
    
     UBSAN: shift-out-of-bounds in net/mac80211/rx.c:1129:39
     shift exponent 215 is too large for 64-bit type 'long long unsigned int'
     Call Trace:
      <IRQ>
      dump_stack_lvl+0x48/0x70
      dump_stack+0x10/0x20
      __ubsan_handle_shift_out_of_bounds+0x1ac/0x360
      ieee80211_release_reorder_frame.constprop.0.cold+0x64/0x69 [mac80211]
      ieee80211_sta_reorder_release+0x9c/0x400 [mac80211]
      ieee80211_prepare_and_rx_handle+0x1234/0x1420 [mac80211]
      ieee80211_rx_list+0xaef/0xf60 [mac80211]
      ieee80211_rx_napi+0x53/0xd0 [mac80211]
    
    Since only old hardware that supports <=64 BlockAck uses
    ieee80211_mark_rx_ba_filtered_frames(), limit the use as it is, so add a
    WARN_ONCE() and comment to note to avoid using this function if hardware
    capability is not suitable.
    Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
    Link: https://lore.kernel.org/r/20230818014004.16177-1-pkshih@realtek.com
    [edit commit message]
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    b98c1610
mac80211.h 291 KB