Fix ieee80211_tx_h_select_key() for 802.11 encaps offloading

The fix in [0] introduces issue with mt7921 chips (at least), due to the 802.11 encapsulation offloading support of those chips. ieee80211_tx_h_select_key() treated 802.3 frames as if they were 802.11 ones causing the skb's control block hw_key to be invalid.

The first patch fixes the root cause of this issue and the second one reapplies the initial use after free fix that has been temporarly reverted meanwhile.

[0] https://lore.kernel.org/linux-wireless/06aa507b853ca385ceded81c18b0a6dd0f081bc8.1742833382.git.repk@triplefau.lt/

Remi Pommarel (2):
wifi: mac80211: Check 802.11 encaps offloading in

    ieee80211_tx_h_select_key()
  Reapply "wifi: mac80211: Update skb's control block key in
    ieee80211_tx_dequeue()"

 net/mac80211/tx.c | 7 +++++++
 1 file changed, 7 insertions(+)

2.50.1

With 802.11 encapsulation offloading, ieee80211_tx_h_select_key() is called on 802.3 frames. In that case do not try to use skb data as valid 802.11 headers.

---
 net/mac80211/tx.c | 6 ++++++
 1 file changed, 6 insertions(+)

index d58b80813bdd..0af5bf9aba6a 100644
@@ -612,6 +612,12 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 	else
 		tx->key = NULL;
 
+	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
+		if (tx->key && tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+			info->control.hw_key = &tx->key->conf;
+		return TX_CONTINUE;
+	}
+
 	if (tx->key) {
 		bool skip_hw = false;
 

2.50.1

This reverts commit 0937cb5f345c79d702b4d0d744e2a2529b551cb2.

This commit broke TX with 802.11 encapsulation HW offloading, now that this is fixed, reapply it.

---
 net/mac80211/tx.c | 1 +
 1 file changed, 1 insertion(+)

index 0af5bf9aba6a..fdc994d8c9c3 100644
@@ -3882,6 +3882,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 	 * The key can be removed while the packet was queued, so need to call
 	 * this here to get the current key.
 	 */
+	info->control.hw_key = NULL;
 	r = ieee80211_tx_h_select_key(&tx);
 	if (r != TX_CONTINUE) {
 		ieee80211_free_txskb(&local->hw, skb);

2.50.1