Hi Mathy, url: https://github.com/0day-ci/linux/commits/Mathy-Vanhoef/mac80211-keep-non-zero-sequence-counter-of-injected-frames/20200629-021517 base: https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git master config: arm-randconfig-m031-20200701 (attached as .config) compiler: arm-linux-gnueabi-gcc (GCC) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@xxxxxxxxx> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> New smatch warnings: net/mac80211/tx.c:816 ieee80211_tx_h_sequence() warn: compare has higher precedence than mask net/mac80211/tx.c:816 ieee80211_tx_h_sequence() warn: add some parenthesis here? Old smatch warnings: net/mac80211/tx.c:1831 invoke_tx_handlers_late() warn: variable dereferenced before check 'tx->skb' (see line 1809) net/mac80211/tx.c:3426 ieee80211_xmit_fast_finish() error: we previously assumed 'key' could be null (see line 3394) # https://github.com/0day-ci/linux/commit/f452608b92bbd4fff530a8f234d4e909287d249c git remote add linux-review https://github.com/0day-ci/linux git remote update linux-review git checkout f452608b92bbd4fff530a8f234d4e909287d249c vim +816 net/mac80211/tx.c f591fa5dbbbeae Johannes Berg 2008-07-10 803 static ieee80211_tx_result debug_noinline f591fa5dbbbeae Johannes Berg 2008-07-10 804 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx) f591fa5dbbbeae Johannes Berg 2008-07-10 805 { f591fa5dbbbeae Johannes Berg 2008-07-10 806 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); f591fa5dbbbeae Johannes Berg 2008-07-10 807 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; f591fa5dbbbeae Johannes Berg 2008-07-10 808 int tid; f591fa5dbbbeae Johannes Berg 2008-07-10 809 25d834e16294c8 Johannes Berg 2008-09-12 810 /* f452608b92bbd4 Mathy Vanhoef 2020-06-28 811 * Packet injection may want to control the sequence number. f452608b92bbd4 Mathy Vanhoef 2020-06-28 812 * Do not assign one ourselves, and do not ask the driver to, f452608b92bbd4 Mathy Vanhoef 2020-06-28 813 * if there is no matching interface or if the injected frame f452608b92bbd4 Mathy Vanhoef 2020-06-28 814 * was already assigned a non-zero sequence number. 25d834e16294c8 Johannes Berg 2008-09-12 815 */ f452608b92bbd4 Mathy Vanhoef 2020-06-28 @816 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR || f452608b92bbd4 Mathy Vanhoef 2020-06-28 817 (info->flags & IEEE80211_TX_CTL_INJECTED != 0 && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This is wrong. Also != 0 doesn't add anything. It should just be: (info->flags & IEEE80211_TX_CTL_INJECTED) && The times when it's right to talk about == 0 and != 0 are when you are talking about numbers as in "if (len == 0) " or "if (cnt != 0)" and when you are using cmp() functions. "if (strcmp(foo, bar) < 0)" means foo is less than bar. "if (strcmp(foo, bar) == 0)" means foo == bar. f452608b92bbd4 Mathy Vanhoef 2020-06-28 818 hdr->seq_ctrl != 0))) 25d834e16294c8 Johannes Berg 2008-09-12 819 return TX_CONTINUE; 25d834e16294c8 Johannes Berg 2008-09-12 820 f591fa5dbbbeae Johannes Berg 2008-07-10 821 if (unlikely(ieee80211_is_ctl(hdr->frame_control))) f591fa5dbbbeae Johannes Berg 2008-07-10 822 return TX_CONTINUE; f591fa5dbbbeae Johannes Berg 2008-07-10 823 f591fa5dbbbeae Johannes Berg 2008-07-10 824 if (ieee80211_hdrlen(hdr->frame_control) < 24) f591fa5dbbbeae Johannes Berg 2008-07-10 825 return TX_CONTINUE; f591fa5dbbbeae Johannes Berg 2008-07-10 826 49a59543eb5a5d Johannes Berg 2011-09-29 827 if (ieee80211_is_qos_nullfunc(hdr->frame_control)) 49a59543eb5a5d Johannes Berg 2011-09-29 828 return TX_CONTINUE; 49a59543eb5a5d Johannes Berg 2011-09-29 829 94778280fabdb6 Johannes Berg 2008-10-10 830 /* 94778280fabdb6 Johannes Berg 2008-10-10 831 * Anything but QoS data that has a sequence number field 94778280fabdb6 Johannes Berg 2008-10-10 832 * (is long enough) gets a sequence number from the global c4c205f3cd17b5 Bob Copeland 2013-08-23 833 * counter. QoS data frames with a multicast destination c4c205f3cd17b5 Bob Copeland 2013-08-23 834 * also use the global counter (802.11-2012 9.3.2.10). 94778280fabdb6 Johannes Berg 2008-10-10 835 */ c4c205f3cd17b5 Bob Copeland 2013-08-23 836 if (!ieee80211_is_data_qos(hdr->frame_control) || c4c205f3cd17b5 Bob Copeland 2013-08-23 837 is_multicast_ether_addr(hdr->addr1)) { b9771d41aee7aa Johannes Berg 2018-05-28 838 if (tx->flags & IEEE80211_TX_NO_SEQNO) b9771d41aee7aa Johannes Berg 2018-05-28 839 return TX_CONTINUE; 94778280fabdb6 Johannes Berg 2008-10-10 840 /* driver should assign sequence number */ f591fa5dbbbeae Johannes Berg 2008-07-10 841 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ; 94778280fabdb6 Johannes Berg 2008-10-10 842 /* for pure STA mode without beacons, we can do it */ 94778280fabdb6 Johannes Berg 2008-10-10 843 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number); 94778280fabdb6 Johannes Berg 2008-10-10 844 tx->sdata->sequence_number += 0x10; 79c892b85027d5 Johannes Berg 2014-11-21 845 if (tx->sta) e5a9f8d04660da Johannes Berg 2015-10-16 846 tx->sta->tx_stats.msdu[IEEE80211_NUM_TIDS]++; f591fa5dbbbeae Johannes Berg 2008-07-10 847 return TX_CONTINUE; f591fa5dbbbeae Johannes Berg 2008-07-10 848 } f591fa5dbbbeae Johannes Berg 2008-07-10 849 f591fa5dbbbeae Johannes Berg 2008-07-10 850 /* f591fa5dbbbeae Johannes Berg 2008-07-10 851 * This should be true for injected/management frames only, for f591fa5dbbbeae Johannes Berg 2008-07-10 852 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ f591fa5dbbbeae Johannes Berg 2008-07-10 853 * above since they are not QoS-data frames. f591fa5dbbbeae Johannes Berg 2008-07-10 854 */ f591fa5dbbbeae Johannes Berg 2008-07-10 855 if (!tx->sta) f591fa5dbbbeae Johannes Berg 2008-07-10 856 return TX_CONTINUE; f591fa5dbbbeae Johannes Berg 2008-07-10 857 f591fa5dbbbeae Johannes Berg 2008-07-10 858 /* include per-STA, per-TID sequence counter */ a1f2ba04cc9241 Sara Sharon 2018-02-19 859 tid = ieee80211_get_tid(hdr); e5a9f8d04660da Johannes Berg 2015-10-16 860 tx->sta->tx_stats.msdu[tid]++; f591fa5dbbbeae Johannes Berg 2008-07-10 861 ba8c3d6f16a1f9 Felix Fietkau 2015-03-27 862 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid); f591fa5dbbbeae Johannes Berg 2008-07-10 863 f591fa5dbbbeae Johannes Berg 2008-07-10 864 return TX_CONTINUE; f591fa5dbbbeae Johannes Berg 2008-07-10 865 } --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx
Attachment:
.config.gz
Description: application/gzip
