wifi: iwlwifi: Fix A-MSDU TSO preparation

The TSO preparation assumed that the skb head contained the headers
while the rest of the data was in the fragments. Since this is not
always true, e.g., it is possible that the data was linearised, modify
the TSO preparation to start the data processing after the network
headers.

Fixes: 7f5e3038f029 ("wifi: iwlwifi: map entire SKB when sending AMSDUs")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250209143303.75769a4769bf.Iaf79e8538093cdf8c446c292cc96164ad6498f61@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 856b7e9f717d529cc1ff15bfee83c5a35885e2ea..45460f93d24add5c41520db20ef68aef33d6866d 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
- * Copyright (C) 2003-2015, 2018-2024 Intel Corporation
+ * Copyright (C) 2003-2015, 2018-2025 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -646,7 +646,8 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset,
                                    unsigned int len);
 struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb,
                                   struct iwl_cmd_meta *cmd_meta,
-                                  u8 **hdr, unsigned int hdr_room);
+                                  u8 **hdr, unsigned int hdr_room,
+                                  unsigned int offset);
 
 void iwl_pcie_free_tso_pages(struct iwl_trans *trans, struct sk_buff *skb,
                             struct iwl_cmd_meta *cmd_meta);

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index dce5096db82b61d3f2c9a88d25e3120d310b9e58..401919f9fe88ed420796bc22b4270ae2ac979e20 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
  * Copyright (C) 2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2020, 2023-2024 Intel Corporation
+ * Copyright (C) 2018-2020, 2023-2025 Intel Corporation
  */
 #include <net/tso.h>
 #include <linux/tcp.h>
@@ -188,7 +188,8 @@ static int iwl_txq_gen2_build_amsdu(struct iwl_trans *trans,
                (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));
 
        /* Our device supports 9 segments at most, it will fit in 1 page */
-       sgt = iwl_pcie_prep_tso(trans, skb, out_meta, &start_hdr, hdr_room);
+       sgt = iwl_pcie_prep_tso(trans, skb, out_meta, &start_hdr, hdr_room,
+                               snap_ip_tcp_hdrlen + hdr_len);
        if (!sgt)
                return -ENOMEM;
 

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 334ebd4c12fa7c8a33c5c802f14cebc77e3cb0d6..7b6071a59b6947ed7b7cb69e90be14826ee0181c 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2003-2014, 2018-2021, 2023-2024 Intel Corporation
+ * Copyright (C) 2003-2014, 2018-2021, 2023-2025 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -1855,6 +1855,7 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset,
  * @cmd_meta: command meta to store the scatter list information for unmapping
  * @hdr: output argument for TSO headers
  * @hdr_room: requested length for TSO headers
+ * @offset: offset into the data from which mapping should start
  *
  * Allocate space for a scatter gather list and TSO headers and map the SKB
  * using the scatter gather list. The SKB is unmapped again when the page is
@@ -1864,18 +1865,20 @@ dma_addr_t iwl_pcie_get_sgt_tb_phys(struct sg_table *sgt, unsigned int offset,
  */
 struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb,
                                   struct iwl_cmd_meta *cmd_meta,
-                                  u8 **hdr, unsigned int hdr_room)
+                                  u8 **hdr, unsigned int hdr_room,
+                                  unsigned int offset)
 {
        struct sg_table *sgt;
+       unsigned int n_segments;
 
        if (WARN_ON_ONCE(skb_has_frag_list(skb)))
                return NULL;
 
+       n_segments = DIV_ROUND_UP(skb->len - offset, skb_shinfo(skb)->gso_size);
        *hdr = iwl_pcie_get_page_hdr(trans,
                                     hdr_room + __alignof__(struct sg_table) +
                                     sizeof(struct sg_table) +
-                                    (skb_shinfo(skb)->nr_frags + 1) *
-                                    sizeof(struct scatterlist),
+                                    n_segments * sizeof(struct scatterlist),
                                     skb);
        if (!*hdr)
                return NULL;
@@ -1883,11 +1886,11 @@ struct sg_table *iwl_pcie_prep_tso(struct iwl_trans *trans, struct sk_buff *skb,
        sgt = (void *)PTR_ALIGN(*hdr + hdr_room, __alignof__(struct sg_table));
        sgt->sgl = (void *)(sgt + 1);
 
-       sg_init_table(sgt->sgl, skb_shinfo(skb)->nr_frags + 1);
+       sg_init_table(sgt->sgl, n_segments);
 
        /* Only map the data, not the header (it is copied to the TSO page) */
-       sgt->orig_nents = skb_to_sgvec(skb, sgt->sgl, skb_headlen(skb),
-                                      skb->data_len);
+       sgt->orig_nents = skb_to_sgvec(skb, sgt->sgl, offset,
+                                      skb->len - offset);
        if (WARN_ON_ONCE(sgt->orig_nents <= 0))
                return NULL;
 
@@ -1939,7 +1942,8 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
                (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
 
        /* Our device supports 9 segments at most, it will fit in 1 page */
-       sgt = iwl_pcie_prep_tso(trans, skb, out_meta, &start_hdr, hdr_room);
+       sgt = iwl_pcie_prep_tso(trans, skb, out_meta, &start_hdr, hdr_room,
+                               snap_ip_tcp_hdrlen + hdr_len + iv_len);
        if (!sgt)
                return -ENOMEM;