This commit is contained in:
coolsnowwolf 2021-07-13 00:39:11 +08:00
commit 604ceaa750
10 changed files with 272 additions and 4 deletions

View File

@ -0,0 +1,25 @@
From: Felix Fietkau <nbd@nbd.name>
Date: Thu, 8 Jul 2021 16:33:03 +0200
Subject: [PATCH] hostapd: fix use of uninitialized stack variables
When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq
unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1
filled by ieee80211_freq_to_chan.
However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),
seg0/1 remains uninitialized and filled with stack garbage, causing errors
such as "hostapd: 80 MHz: center segment 1 configured"
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -3431,7 +3431,7 @@ static int hostapd_change_config_freq(st
struct hostapd_freq_params *old_params)
{
int channel;
- u8 seg0, seg1;
+ u8 seg0 = 0, seg1 = 0;
struct hostapd_hw_modes *mode;
if (!params->channel) {

View File

@ -473,3 +473,44 @@
/* Proceed only if DFS is not offloaded to the driver */
if (iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
return 0;
--- a/src/ap/airtime_policy.c
+++ b/src/ap/airtime_policy.c
@@ -112,8 +112,14 @@ static void set_sta_weights(struct hosta
{
struct sta_info *sta;
- for (sta = hapd->sta_list; sta; sta = sta->next)
- sta_set_airtime_weight(hapd, sta, weight);
+ for (sta = hapd->sta_list; sta; sta = sta->next) {
+ unsigned int sta_weight = weight;
+
+ if (sta->dyn_airtime_weight)
+ sta_weight = (weight * sta->dyn_airtime_weight) / 256;
+
+ sta_set_airtime_weight(hapd, sta, sta_weight);
+ }
}
@@ -244,7 +250,10 @@ int airtime_policy_new_sta(struct hostap
unsigned int weight;
if (hapd->iconf->airtime_mode == AIRTIME_MODE_STATIC) {
- weight = get_weight_for_sta(hapd, sta->addr);
+ if (sta->dyn_airtime_weight)
+ weight = sta->dyn_airtime_weight;
+ else
+ weight = get_weight_for_sta(hapd, sta->addr);
if (weight)
return sta_set_airtime_weight(hapd, sta, weight);
}
--- a/src/ap/sta_info.h
+++ b/src/ap/sta_info.h
@@ -324,6 +324,7 @@ struct sta_info {
#endif /* CONFIG_TESTING_OPTIONS */
#ifdef CONFIG_AIRTIME_POLICY
unsigned int airtime_weight;
+ unsigned int dyn_airtime_weight;
struct os_reltime backlogged_until;
#endif /* CONFIG_AIRTIME_POLICY */

View File

@ -21,6 +21,7 @@
#include "rrm.h"
#include "wnm_ap.h"
#include "taxonomy.h"
#include "airtime_policy.h"
static struct ubus_context *ctx;
static struct blob_buf b;
@ -741,6 +742,7 @@ enum {
CSA_SEC_CHANNEL_OFFSET,
CSA_HT,
CSA_VHT,
CSA_HE,
CSA_BLOCK_TX,
__CSA_MAX
};
@ -754,6 +756,7 @@ static const struct blobmsg_policy csa_policy[__CSA_MAX] = {
[CSA_SEC_CHANNEL_OFFSET] = { "sec_channel_offset", BLOBMSG_TYPE_INT32 },
[CSA_HT] = { "ht", BLOBMSG_TYPE_BOOL },
[CSA_VHT] = { "vht", BLOBMSG_TYPE_BOOL },
[CSA_HE] = { "he", BLOBMSG_TYPE_BOOL },
[CSA_BLOCK_TX] = { "block_tx", BLOBMSG_TYPE_BOOL },
};
@ -765,7 +768,15 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
{
struct blob_attr *tb[__CSA_MAX];
struct hostapd_data *hapd = get_hapd_from_object(obj);
struct csa_settings css;
struct hostapd_config *iconf = hapd->iface->conf;
struct csa_settings css = {
.freq_params = {
.ht_enabled = iconf->ieee80211n,
.vht_enabled = iconf->ieee80211ac,
.he_enabled = iconf->ieee80211ax,
.sec_channel_offset = iconf->secondary_channel,
}
};
int ret = UBUS_STATUS_OK;
int i;
@ -774,7 +785,21 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
if (!tb[CSA_FREQ])
return UBUS_STATUS_INVALID_ARGUMENT;
memset(&css, 0, sizeof(css));
switch (iconf->vht_oper_chwidth) {
case CHANWIDTH_USE_HT:
if (iconf->secondary_channel)
css.freq_params.bandwidth = 40;
else
css.freq_params.bandwidth = 20;
break;
case CHANWIDTH_160MHZ:
css.freq_params.bandwidth = 160;
break;
default:
css.freq_params.bandwidth = 80;
break;
}
css.freq_params.freq = blobmsg_get_u32(tb[CSA_FREQ]);
#define SET_CSA_SETTING(name, field, type) \
@ -790,6 +815,7 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
SET_CSA_SETTING(CSA_SEC_CHANNEL_OFFSET, freq_params.sec_channel_offset, u32);
SET_CSA_SETTING(CSA_HT, freq_params.ht_enabled, bool);
SET_CSA_SETTING(CSA_VHT, freq_params.vht_enabled, bool);
SET_CSA_SETTING(CSA_HE, freq_params.he_enabled, bool);
SET_CSA_SETTING(CSA_BLOCK_TX, block_tx, bool);
for (i = 0; i < hapd->iface->num_bss; i++) {
@ -1326,11 +1352,68 @@ hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
}
#endif
#ifdef CONFIG_AIRTIME_POLICY
enum {
UPDATE_AIRTIME_STA,
UPDATE_AIRTIME_WEIGHT,
__UPDATE_AIRTIME_MAX,
};
static const struct blobmsg_policy airtime_policy[__UPDATE_AIRTIME_MAX] = {
[UPDATE_AIRTIME_STA] = { "sta", BLOBMSG_TYPE_STRING },
[UPDATE_AIRTIME_WEIGHT] = { "weight", BLOBMSG_TYPE_INT32 },
};
static int
hostapd_bss_update_airtime(struct ubus_context *ctx, struct ubus_object *obj,
struct ubus_request_data *ureq, const char *method,
struct blob_attr *msg)
{
struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
struct blob_attr *tb[__UPDATE_AIRTIME_MAX];
struct sta_info *sta = NULL;
u8 addr[ETH_ALEN];
int weight;
blobmsg_parse(airtime_policy, __UPDATE_AIRTIME_MAX, tb, blob_data(msg), blob_len(msg));
if (!tb[UPDATE_AIRTIME_WEIGHT])
return UBUS_STATUS_INVALID_ARGUMENT;
weight = blobmsg_get_u32(tb[UPDATE_AIRTIME_WEIGHT]);
if (!tb[UPDATE_AIRTIME_STA]) {
if (!weight)
return UBUS_STATUS_INVALID_ARGUMENT;
hapd->conf->airtime_weight = weight;
return 0;
}
if (hwaddr_aton(blobmsg_data(tb[UPDATE_AIRTIME_STA]), addr))
return UBUS_STATUS_INVALID_ARGUMENT;
sta = ap_get_sta(hapd, addr);
if (!sta)
return UBUS_STATUS_NOT_FOUND;
sta->dyn_airtime_weight = weight;
airtime_policy_new_sta(hapd, sta);
return 0;
}
#endif
static const struct ubus_method bss_methods[] = {
UBUS_METHOD_NOARG("reload", hostapd_bss_reload),
UBUS_METHOD_NOARG("get_clients", hostapd_bss_get_clients),
UBUS_METHOD_NOARG("get_status", hostapd_bss_get_status),
UBUS_METHOD("del_client", hostapd_bss_del_client, del_policy),
#ifdef CONFIG_AIRTIME_POLICY
UBUS_METHOD("update_airtime", hostapd_bss_update_airtime, airtime_policy),
#endif
UBUS_METHOD_NOARG("list_bans", hostapd_bss_list_bans),
#ifdef CONFIG_WPS
UBUS_METHOD_NOARG("wps_start", hostapd_bss_wps_start),

View File

@ -0,0 +1,52 @@
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
#include "qca9563_tplink_re450.dtsi"
/ {
compatible = "tplink,re455-v1", "qca,qca9563";
model = "TP-Link RE455 v1";
};
&partitions {
partition@0 {
label = "u-boot";
reg = <0x000000 0x020000>;
read-only;
};
info: partition@20000 {
label = "info";
reg = <0x020000 0x002000>;
read-only;
};
partition@22000 {
label = "partition-table";
reg = <0x022000 0x002000>;
read-only;
};
partition@24000 {
label = "info2";
reg = <0x024000 0x00a000>;
read-only;
};
partition@2e000 {
label = "config";
reg = <0x02e000 0x022000>;
read-only;
};
partition@50000 {
compatible = "tplink,firmware";
label = "firmware";
reg = <0x050000 0x7a0000>;
};
art: partition@7f0000 {
label = "art";
reg = <0x7f0000 0x010000>;
read-only;
};
};

View File

@ -351,7 +351,8 @@ tplink,tl-wr902ac-v1)
tplink,re355-v1|\
tplink,re450-v1|\
tplink,re450-v2|\
tplink,re450-v3)
tplink,re450-v3|\
tplink,re455-v1)
ucidef_set_led_netdev "lan_data" "LAN Data" "green:lan_data" "eth0" "tx rx"
ucidef_set_led_netdev "lan_link" "LAN Link" "green:lan_link" "eth0" "link"
;;

View File

@ -70,6 +70,7 @@ ath79_setup_interfaces()
tplink,re450-v1|\
tplink,re450-v2|\
tplink,re450-v3|\
tplink,re455-v1|\
tplink,tl-wr902ac-v1|\
ubnt,bullet-ac|\
ubnt,bullet-m-ar7240|\

View File

@ -141,7 +141,8 @@ case "$FIRMWARE" in
;;
tplink,eap245-v1|\
tplink,re450-v2|\
tplink,re450-v3)
tplink,re450-v3|\
tplink,re455-v1)
caldata_extract "art" 0x5000 0x844
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) 1)
;;

View File

@ -486,6 +486,18 @@ define Device/tplink_re450-v3
endef
TARGET_DEVICES += tplink_re450-v3
define Device/tplink_re455-v1
$(Device/tplink-safeloader)
SOC := qca9563
IMAGE_SIZE := 7808k
DEVICE_MODEL := RE455
DEVICE_VARIANT := v1
DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
TPLINK_BOARD_ID := RE455-V1
LOADER_TYPE := elf
endef
TARGET_DEVICES += tplink_re455-v1
define Device/tplink_tl-mr6400-v1
$(Device/tplink-8mlzma)
SOC := qca9531

View File

@ -93,3 +93,15 @@
&smb208_s2b {
regulator-max-microvolt = <1150000>;
};
&nss0 {
qcom,low-frequency = <550000000>; /* orig value 110000000 */
qcom,mid-frequency = <550000000>; /* orig value 275000000 */
qcom,max-frequency = <550000000>;
};
&nss1 {
qcom,low-frequency = <550000000>; /* orig value 110000000 */
qcom,mid-frequency = <550000000>; /* orig value 275000000 */
qcom,max-frequency = <550000000>;
};

View File

@ -2399,6 +2399,46 @@ static struct device_info boards[] = {
.last_sysupgrade_partition = "file-system"
},
/** Firmware layout for the RE455 v1 */
{
.id = "RE455-V1",
.vendor = "",
.support_list =
"SupportList:\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:00000000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:55530000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:45550000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:4A500000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:43410000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:41550000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:41530000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:4B520000}\r\n"
"{product_name:RE455,product_ver:1.0.0,special_id:42520000}\r\n",
.part_trail = 0x00,
.soft_ver = NULL,
/* We're using a dynamic kernel/rootfs split here */
.partitions = {
{"fs-uboot", 0x00000, 0x20000},
{"default-mac", 0x20000, 0x00020},
{"pin", 0x20020, 0x00020},
{"product-info", 0x21000, 0x01000},
{"partition-table", 0x22000, 0x02000},
{"soft-version", 0x24000, 0x01000},
{"support-list", 0x25000, 0x01000},
{"profile", 0x26000, 0x08000},
{"user-config", 0x2e000, 0x10000},
{"default-config", 0x3e000, 0x10000},
{"config-info", 0x4e000, 0x00400},
{"firmware", 0x50000, 0x7a0000},
{"radio", 0x7f0000, 0x10000},
{NULL, 0, 0}
},
.first_sysupgrade_partition = "os-image",
.last_sysupgrade_partition = "file-system"
},
/** Firmware layout for the RE500 */
{
.id = "RE500-V1",