wifi: rtw89: correct drop logic for malformed AMPDU frames

The previous commit aims to fix issue caused by malformed AMPDU frames.
But the drop logic fails to deal with the first AMPDU packet paired with
certain range of sequence number, and leads to unexpected packet drop.
It is more likely to encounter this failure when there are busy traffic
during rekey process and could lead to disconnection from the AP.
Fix this by adding a initial state judgement and only reset status
during pairwise rekey.

Fixes: bda294ed0ed0 ("wifi: rtw89: Drop malformed AMPDU frames with abnormal PN")
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260515014433.16168-10-pkshih@realtek.com

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 7b26aedc088340ac7991207efa5cbf4ec72074e9..0f3168d853698fe67a0b8ba28ed069f9e7c3406c 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -3948,7 +3948,8 @@ static bool rtw89_core_skb_pn_valid(struct rtw89_dev *rtwdev,
                last_pn = tid_stats->last_pn;
 
                if (pn > last_pn) {
-                       if (ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) {
+                       if (last_pn != -1LL &&
+                           ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) {
                                dev_kfree_skb_any(skb);
 
                                return false;

diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index 330ece51286dbb1355a906be316b7ab93bbc9ac9..aade5c5b79e82dffa353bc612a6960b3f71eae6b 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -979,7 +979,8 @@ static int rtw89_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                        rtw89_err(rtwdev, "failed to add key to sec cam\n");
                        return ret;
                }
-               rtw89_core_tid_rx_stats_reset(rtwdev);
+               if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+                       rtw89_core_tid_rx_stats_reset(rtwdev);
                break;
        case DISABLE_KEY:
                flush_work(&rtwdev->txq_work);