netdev - mgmt-tx issues with off-channel neighbor response on channel 100

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <8cfd6df9-d8b7-678e-210a-778e756604f7@candelatech.com>
Date:   Tue, 19 Mar 2019 14:05:03 -0700
From:   Ben Greear <greearb@...delatech.com>
To:     netdev <netdev@...r.kernel.org>,
        "hostap@...ts.infradead.org" <hostap@...ts.infradead.org>
Subject: mgmt-tx issues with off-channel neighbor response on channel 100

Hello,

I'm not sure if the fault is hostapd or the wireless stack (or something else),
but this is what I see:

I put an AP on channel 100, configured for RRM.

STA associates to it and sends a channel report request.

hostapd reports tx of the response frame failed with EBUSY (-16).

Debugging in the kernel (4.20.8+ hacks) shows it fails because
of the offchannel check.  This appears to be because hostapd marks
the frame as off-channel-OK, and nl80211 fails because of the
CAC logic (I think):

static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
{
	ASSERT_WDEV_LOCK(wdev);

	if (!cfg80211_beaconing_iface_active(wdev))
		return true;

	if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
		return true;

	return regulatory_pre_cac_allowed(wdev->wiphy);
}

In this case, the packet is not actually off-channel, and CAC has already
completed successfully.

Any opinions on where to fix this?

Thanks,
Ben

-- 
Ben Greear <greearb@...delatech.com>
Candela Technologies Inc  http://www.candelatech.com