linux/net/wireless/util.c

2926 lines
70 KiB
C
Raw Normal View History

License cleanup: add SPDX GPL-2.0 license identifier to files with no license Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-01 14:07:57 +00:00
// SPDX-License-Identifier: GPL-2.0
/*
* Wireless utility functions
*
* Copyright 2007-2009 Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright 2017 Intel Deutschland GmbH
* Copyright (C) 2018-2023 Intel Corporation
*/
#include <linux/export.h>
#include <linux/bitops.h>
#include <linux/etherdevice.h>
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h percpu.h is included by sched.h and module.h and thus ends up being included when building most .c files. percpu.h includes slab.h which in turn includes gfp.h making everything defined by the two files universally available and complicating inclusion dependencies. percpu.h -> slab.h dependency is about to be removed. Prepare for this change by updating users of gfp and slab facilities include those headers directly instead of assuming availability. As this conversion needs to touch large number of source files, the following script is used as the basis of conversion. http://userweb.kernel.org/~tj/misc/slabh-sweep.py The script does the followings. * Scan files for gfp and slab usages and update includes such that only the necessary includes are there. ie. if only gfp is used, gfp.h, if slab is used, slab.h. * When the script inserts a new include, it looks at the include blocks and try to put the new include such that its order conforms to its surrounding. It's put in the include block which contains core kernel includes, in the same order that the rest are ordered - alphabetical, Christmas tree, rev-Xmas-tree or at the end if there doesn't seem to be any matching order. * If the script can't find a place to put a new include (mostly because the file doesn't have fitting include block), it prints out an error message indicating which .h file needs to be added to the file. The conversion was done in the following steps. 1. The initial automatic conversion of all .c files updated slightly over 4000 files, deleting around 700 includes and adding ~480 gfp.h and ~3000 slab.h inclusions. The script emitted errors for ~400 files. 2. Each error was manually checked. Some didn't need the inclusion, some needed manual addition while adding it to implementation .h or embedding .c file was more appropriate for others. This step added inclusions to around 150 files. 3. The script was run again and the output was compared to the edits from #2 to make sure no file was left behind. 4. Several build tests were done and a couple of problems were fixed. e.g. lib/decompress_*.c used malloc/free() wrappers around slab APIs requiring slab.h to be added manually. 5. The script was run on all .h files but without automatically editing them as sprinkling gfp.h and slab.h inclusions around .h files could easily lead to inclusion dependency hell. Most gfp.h inclusion directives were ignored as stuff from gfp.h was usually wildly available and often used in preprocessor macros. Each slab.h inclusion directive was examined and added manually as necessary. 6. percpu.h was updated not to include slab.h. 7. Build test were done on the following configurations and failures were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my distributed build env didn't work with gcov compiles) and a few more options had to be turned off depending on archs to make things build (like ipr on powerpc/64 which failed due to missing writeq). * x86 and x86_64 UP and SMP allmodconfig and a custom test config. * powerpc and powerpc64 SMP allmodconfig * sparc and sparc64 SMP allmodconfig * ia64 SMP allmodconfig * s390 SMP allmodconfig * alpha SMP allmodconfig * um on x86_64 SMP allmodconfig 8. percpu.h modifications were reverted so that it could be applied as a separate patch and serve as bisection point. Given the fact that I had only a couple of failures from tests on step 6, I'm fairly confident about the coverage of this conversion patch. If there is a breakage, it's likely to be something in one of the arch headers which should be easily discoverable easily on most builds of the specific arch. Signed-off-by: Tejun Heo <tj@kernel.org> Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 08:04:11 +00:00
#include <linux/slab.h>
#include <linux/ieee80211.h>
#include <net/cfg80211.h>
#include <net/ip.h>
#include <net/dsfield.h>
#include <linux/if_vlan.h>
#include <linux/mpls.h>
#include <linux/gcd.h>
#include <linux/bitfield.h>
#include <linux/nospec.h>
#include "core.h"
#include "rdev-ops.h"
const struct ieee80211_rate *
ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
u32 basic_rates, int bitrate)
{
struct ieee80211_rate *result = &sband->bitrates[0];
int i;
for (i = 0; i < sband->n_bitrates; i++) {
if (!(basic_rates & BIT(i)))
continue;
if (sband->bitrates[i].bitrate > bitrate)
continue;
result = &sband->bitrates[i];
}
return result;
}
EXPORT_SYMBOL(ieee80211_get_response_rate);
u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
{
struct ieee80211_rate *bitrates;
u32 mandatory_rates = 0;
enum ieee80211_rate_flags mandatory_flag;
int i;
if (WARN_ON(!sband))
return 1;
if (sband->band == NL80211_BAND_2GHZ)
mandatory_flag = IEEE80211_RATE_MANDATORY_B;
else
mandatory_flag = IEEE80211_RATE_MANDATORY_A;
bitrates = sband->bitrates;
for (i = 0; i < sband->n_bitrates; i++)
if (bitrates[i].flags & mandatory_flag)
mandatory_rates |= BIT(i);
return mandatory_rates;
}
EXPORT_SYMBOL(ieee80211_mandatory_rates);
u32 ieee80211_channel_to_freq_khz(int chan, enum nl80211_band band)
{
/* see 802.11 17.3.8.3.2 and Annex J
* there are overlapping channel numbers in 5GHz and 2GHz bands */
if (chan <= 0)
return 0; /* not supported */
switch (band) {
case NL80211_BAND_2GHZ:
case NL80211_BAND_LC:
if (chan == 14)
return MHZ_TO_KHZ(2484);
else if (chan < 14)
return MHZ_TO_KHZ(2407 + chan * 5);
break;
case NL80211_BAND_5GHZ:
if (chan >= 182 && chan <= 196)
return MHZ_TO_KHZ(4000 + chan * 5);
else
return MHZ_TO_KHZ(5000 + chan * 5);
break;
case NL80211_BAND_6GHZ:
/* see 802.11ax D6.1 27.3.23.2 */
if (chan == 2)
return MHZ_TO_KHZ(5935);
if (chan <= 233)
return MHZ_TO_KHZ(5950 + chan * 5);
break;
case NL80211_BAND_60GHZ:
if (chan < 7)
return MHZ_TO_KHZ(56160 + chan * 2160);
break;
case NL80211_BAND_S1GHZ:
return 902000 + chan * 500;
default:
;
}
return 0; /* not supported */
}
EXPORT_SYMBOL(ieee80211_channel_to_freq_khz);
enum nl80211_chan_width
ieee80211_s1g_channel_width(const struct ieee80211_channel *chan)
{
if (WARN_ON(!chan || chan->band != NL80211_BAND_S1GHZ))
return NL80211_CHAN_WIDTH_20_NOHT;
/*S1G defines a single allowed channel width per channel.
* Extract that width here.
*/
if (chan->flags & IEEE80211_CHAN_1MHZ)
return NL80211_CHAN_WIDTH_1;
else if (chan->flags & IEEE80211_CHAN_2MHZ)
return NL80211_CHAN_WIDTH_2;
else if (chan->flags & IEEE80211_CHAN_4MHZ)
return NL80211_CHAN_WIDTH_4;
else if (chan->flags & IEEE80211_CHAN_8MHZ)
return NL80211_CHAN_WIDTH_8;
else if (chan->flags & IEEE80211_CHAN_16MHZ)
return NL80211_CHAN_WIDTH_16;
pr_err("unknown channel width for channel at %dKHz?\n",
ieee80211_channel_to_khz(chan));
return NL80211_CHAN_WIDTH_1;
}
EXPORT_SYMBOL(ieee80211_s1g_channel_width);
int ieee80211_freq_khz_to_channel(u32 freq)
{
/* TODO: just handle MHz for now */
freq = KHZ_TO_MHZ(freq);
/* see 802.11 17.3.8.3.2 and Annex J */
if (freq == 2484)
return 14;
else if (freq < 2484)
return (freq - 2407) / 5;
else if (freq >= 4910 && freq <= 4980)
return (freq - 4000) / 5;
else if (freq < 5925)
return (freq - 5000) / 5;
else if (freq == 5935)
return 2;
else if (freq <= 45000) /* DMG band lower limit */
/* see 802.11ax D6.1 27.3.22.2 */
return (freq - 5950) / 5;
else if (freq >= 58320 && freq <= 70200)
return (freq - 56160) / 2160;
else
return 0;
}
EXPORT_SYMBOL(ieee80211_freq_khz_to_channel);
struct ieee80211_channel *ieee80211_get_channel_khz(struct wiphy *wiphy,
u32 freq)
{
enum nl80211_band band;
struct ieee80211_supported_band *sband;
int i;
for (band = 0; band < NUM_NL80211_BANDS; band++) {
sband = wiphy->bands[band];
if (!sband)
continue;
for (i = 0; i < sband->n_channels; i++) {
struct ieee80211_channel *chan = &sband->channels[i];
if (ieee80211_channel_to_khz(chan) == freq)
return chan;
}
}
return NULL;
}
EXPORT_SYMBOL(ieee80211_get_channel_khz);
static void set_mandatory_flags_band(struct ieee80211_supported_band *sband)
{
int i, want;
switch (sband->band) {
case NL80211_BAND_5GHZ:
case NL80211_BAND_6GHZ:
want = 3;
for (i = 0; i < sband->n_bitrates; i++) {
if (sband->bitrates[i].bitrate == 60 ||
sband->bitrates[i].bitrate == 120 ||
sband->bitrates[i].bitrate == 240) {
sband->bitrates[i].flags |=
IEEE80211_RATE_MANDATORY_A;
want--;
}
}
WARN_ON(want);
break;
case NL80211_BAND_2GHZ:
case NL80211_BAND_LC:
want = 7;
for (i = 0; i < sband->n_bitrates; i++) {
switch (sband->bitrates[i].bitrate) {
case 10:
case 20:
case 55:
case 110:
sband->bitrates[i].flags |=
IEEE80211_RATE_MANDATORY_B |
IEEE80211_RATE_MANDATORY_G;
want--;
break;
case 60:
case 120:
case 240:
sband->bitrates[i].flags |=
IEEE80211_RATE_MANDATORY_G;
want--;
fallthrough;
default:
sband->bitrates[i].flags |=
IEEE80211_RATE_ERP_G;
break;
}
}
WARN_ON(want != 0 && want != 3);
break;
case NL80211_BAND_60GHZ:
/* check for mandatory HT MCS 1..4 */
WARN_ON(!sband->ht_cap.ht_supported);
WARN_ON((sband->ht_cap.mcs.rx_mask[0] & 0x1e) != 0x1e);
break;
case NL80211_BAND_S1GHZ:
/* Figure 9-589bd: 3 means unsupported, so != 3 means at least
* mandatory is ok.
*/
WARN_ON((sband->s1g_cap.nss_mcs[0] & 0x3) == 0x3);
break;
case NUM_NL80211_BANDS:
default:
WARN_ON(1);
break;
}
}
void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
{
enum nl80211_band band;
for (band = 0; band < NUM_NL80211_BANDS; band++)
if (wiphy->bands[band])
set_mandatory_flags_band(wiphy->bands[band]);
}
bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
{
int i;
for (i = 0; i < wiphy->n_cipher_suites; i++)
if (cipher == wiphy->cipher_suites[i])
return true;
return false;
}
static bool
cfg80211_igtk_cipher_supported(struct cfg80211_registered_device *rdev)
{
struct wiphy *wiphy = &rdev->wiphy;
int i;
for (i = 0; i < wiphy->n_cipher_suites; i++) {
switch (wiphy->cipher_suites[i]) {
case WLAN_CIPHER_SUITE_AES_CMAC:
case WLAN_CIPHER_SUITE_BIP_CMAC_256:
case WLAN_CIPHER_SUITE_BIP_GMAC_128:
case WLAN_CIPHER_SUITE_BIP_GMAC_256:
return true;
}
}
return false;
}
bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,
int key_idx, bool pairwise)
{
int max_key_idx;
if (pairwise)
max_key_idx = 3;
else if (wiphy_ext_feature_isset(&rdev->wiphy,
NL80211_EXT_FEATURE_BEACON_PROTECTION) ||
wiphy_ext_feature_isset(&rdev->wiphy,
NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
max_key_idx = 7;
else if (cfg80211_igtk_cipher_supported(rdev))
max_key_idx = 5;
else
max_key_idx = 3;
if (key_idx < 0 || key_idx > max_key_idx)
return false;
return true;
}
int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
struct key_params *params, int key_idx,
bool pairwise, const u8 *mac_addr)
{
if (!cfg80211_valid_key_idx(rdev, key_idx, pairwise))
return -EINVAL;
if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
return -EINVAL;
if (pairwise && !mac_addr)
return -EINVAL;
switch (params->cipher) {
case WLAN_CIPHER_SUITE_TKIP:
/* Extended Key ID can only be used with CCMP/GCMP ciphers */
if ((pairwise && key_idx) ||
params->mode != NL80211_KEY_RX_TX)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_CCMP:
case WLAN_CIPHER_SUITE_CCMP_256:
case WLAN_CIPHER_SUITE_GCMP:
case WLAN_CIPHER_SUITE_GCMP_256:
/* IEEE802.11-2016 allows only 0 and - when supporting
* Extended Key ID - 1 as index for pairwise keys.
* @NL80211_KEY_NO_TX is only allowed for pairwise keys when
* the driver supports Extended Key ID.
* @NL80211_KEY_SET_TX can't be set when installing and
* validating a key.
*/
if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
params->mode == NL80211_KEY_SET_TX)
return -EINVAL;
if (wiphy_ext_feature_isset(&rdev->wiphy,
NL80211_EXT_FEATURE_EXT_KEY_ID)) {
if (pairwise && (key_idx < 0 || key_idx > 1))
return -EINVAL;
} else if (pairwise && key_idx) {
return -EINVAL;
}
break;
case WLAN_CIPHER_SUITE_AES_CMAC:
case WLAN_CIPHER_SUITE_BIP_CMAC_256:
case WLAN_CIPHER_SUITE_BIP_GMAC_128:
case WLAN_CIPHER_SUITE_BIP_GMAC_256:
/* Disallow BIP (group-only) cipher as pairwise cipher */
if (pairwise)
return -EINVAL;
if (key_idx < 4)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_WEP40:
case WLAN_CIPHER_SUITE_WEP104:
if (key_idx > 3)
return -EINVAL;
break;
default:
break;
}
switch (params->cipher) {
case WLAN_CIPHER_SUITE_WEP40:
if (params->key_len != WLAN_KEY_LEN_WEP40)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_TKIP:
if (params->key_len != WLAN_KEY_LEN_TKIP)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_CCMP:
if (params->key_len != WLAN_KEY_LEN_CCMP)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_CCMP_256:
if (params->key_len != WLAN_KEY_LEN_CCMP_256)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_GCMP:
if (params->key_len != WLAN_KEY_LEN_GCMP)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_GCMP_256:
if (params->key_len != WLAN_KEY_LEN_GCMP_256)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_WEP104:
if (params->key_len != WLAN_KEY_LEN_WEP104)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_AES_CMAC:
if (params->key_len != WLAN_KEY_LEN_AES_CMAC)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_BIP_CMAC_256:
if (params->key_len != WLAN_KEY_LEN_BIP_CMAC_256)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_BIP_GMAC_128:
if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_128)
return -EINVAL;
break;
case WLAN_CIPHER_SUITE_BIP_GMAC_256:
if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_256)
return -EINVAL;
break;
default:
/*
* We don't know anything about this algorithm,
* allow using it -- but the driver must check
* all parameters! We still check below whether
* or not the driver supports this algorithm,
* of course.
*/
break;
}
if (params->seq) {
switch (params->cipher) {
case WLAN_CIPHER_SUITE_WEP40:
case WLAN_CIPHER_SUITE_WEP104:
/* These ciphers do not use key sequence */
return -EINVAL;
case WLAN_CIPHER_SUITE_TKIP:
case WLAN_CIPHER_SUITE_CCMP:
case WLAN_CIPHER_SUITE_CCMP_256:
case WLAN_CIPHER_SUITE_GCMP:
case WLAN_CIPHER_SUITE_GCMP_256:
case WLAN_CIPHER_SUITE_AES_CMAC:
case WLAN_CIPHER_SUITE_BIP_CMAC_256:
case WLAN_CIPHER_SUITE_BIP_GMAC_128:
case WLAN_CIPHER_SUITE_BIP_GMAC_256:
if (params->seq_len != 6)
return -EINVAL;
break;
}
}
if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))
return -EINVAL;
return 0;
}
unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
{
unsigned int hdrlen = 24;
if (ieee80211_is_ext(fc)) {
hdrlen = 4;
goto out;
}
if (ieee80211_is_data(fc)) {
if (ieee80211_has_a4(fc))
hdrlen = 30;
if (ieee80211_is_data_qos(fc)) {
hdrlen += IEEE80211_QOS_CTL_LEN;
if (ieee80211_has_order(fc))
hdrlen += IEEE80211_HT_CTL_LEN;
}
goto out;
}
if (ieee80211_is_mgmt(fc)) {
if (ieee80211_has_order(fc))
hdrlen += IEEE80211_HT_CTL_LEN;
goto out;
}
if (ieee80211_is_ctl(fc)) {
/*
* ACK and CTS are 10 bytes, all others 16. To see how
* to get this condition consider
* subtype mask: 0b0000000011110000 (0x00F0)
* ACK subtype: 0b0000000011010000 (0x00D0)
* CTS subtype: 0b0000000011000000 (0x00C0)
* bits that matter: ^^^ (0x00E0)
* value of those: 0b0000000011000000 (0x00C0)
*/
if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
hdrlen = 10;
else
hdrlen = 16;
}
out:
return hdrlen;
}
EXPORT_SYMBOL(ieee80211_hdrlen);
unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
{
const struct ieee80211_hdr *hdr =
(const struct ieee80211_hdr *)skb->data;
unsigned int hdrlen;
if (unlikely(skb->len < 10))
return 0;
hdrlen = ieee80211_hdrlen(hdr->frame_control);
if (unlikely(hdrlen > skb->len))
return 0;
return hdrlen;
}
EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
{
int ae = flags & MESH_FLAGS_AE;
/* 802.11-2012, 8.2.4.7.3 */
switch (ae) {
default:
case 0:
return 6;
case MESH_FLAGS_AE_A4:
return 12;
case MESH_FLAGS_AE_A5_A6:
return 18;
}
}
unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
{
return __ieee80211_get_mesh_hdrlen(meshhdr->flags);
}
EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
{
const __be16 *hdr_proto = hdr + ETH_ALEN;
if (!(ether_addr_equal(hdr, rfc1042_header) &&
*hdr_proto != htons(ETH_P_AARP) &&
*hdr_proto != htons(ETH_P_IPX)) &&
!ether_addr_equal(hdr, bridge_tunnel_header))
return false;
*proto = *hdr_proto;
return true;
}
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
{
const void *mesh_addr;
struct {
struct ethhdr eth;
u8 flags;
} payload;
int hdrlen;
int ret;
ret = skb_copy_bits(skb, 0, &payload, sizeof(payload));
if (ret)
return ret;
hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(payload.flags);
if (likely(pskb_may_pull(skb, hdrlen + 8) &&
ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
&payload.eth.h_proto)))
hdrlen += ETH_ALEN + 2;
else if (!pskb_may_pull(skb, hdrlen))
return -EINVAL;
else
payload.eth.h_proto = htons(skb->len - hdrlen);
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
switch (payload.flags & MESH_FLAGS_AE) {
case MESH_FLAGS_AE_A4:
memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
break;
case MESH_FLAGS_AE_A5_A6:
memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
break;
default:
break;
}
pskb_pull(skb, hdrlen - sizeof(payload.eth));
memcpy(skb->data, &payload.eth, sizeof(payload.eth));
return 0;
}
EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
const u8 *addr, enum nl80211_iftype iftype,
u8 data_offset, bool is_amsdu)
{
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
struct {
u8 hdr[ETH_ALEN] __aligned(2);
__be16 proto;
} payload;
struct ethhdr tmp;
u16 hdrlen;
if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
return -1;
hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
if (skb->len < hdrlen)
return -1;
/* convert IEEE 802.11 header + possible LLC headers into Ethernet
* header
* IEEE 802.11 address fields:
* ToDS FromDS Addr1 Addr2 Addr3 Addr4
* 0 0 DA SA BSSID n/a
* 0 1 DA BSSID SA n/a
* 1 0 BSSID SA DA n/a
* 1 1 RA TA DA SA
*/
memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
switch (hdr->frame_control &
cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
case cpu_to_le16(IEEE80211_FCTL_TODS):
if (unlikely(iftype != NL80211_IFTYPE_AP &&
iftype != NL80211_IFTYPE_AP_VLAN &&
iftype != NL80211_IFTYPE_P2P_GO))
return -1;
break;
case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
if (unlikely(iftype != NL80211_IFTYPE_MESH_POINT &&
iftype != NL80211_IFTYPE_AP_VLAN &&
iftype != NL80211_IFTYPE_STATION))
return -1;
break;
case cpu_to_le16(IEEE80211_FCTL_FROMDS):
if ((iftype != NL80211_IFTYPE_STATION &&
iftype != NL80211_IFTYPE_P2P_CLIENT &&
iftype != NL80211_IFTYPE_MESH_POINT) ||
(is_multicast_ether_addr(tmp.h_dest) &&
ether_addr_equal(tmp.h_source, addr)))
return -1;
break;
case cpu_to_le16(0):
if (iftype != NL80211_IFTYPE_ADHOC &&
iftype != NL80211_IFTYPE_STATION &&
iftype != NL80211_IFTYPE_OCB)
return -1;
break;
}
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
/* remove RFC1042 or Bridge-Tunnel encapsulation */
hdrlen += ETH_ALEN + 2;
skb_postpull_rcsum(skb, &payload, ETH_ALEN + 2);
} else {
tmp.h_proto = htons(skb->len - hdrlen);
}
pskb_pull(skb, hdrlen);
if (!ehdr)
ehdr = skb_push(skb, sizeof(struct ethhdr));
memcpy(ehdr, &tmp, sizeof(tmp));
return 0;
}
EXPORT_SYMBOL(ieee80211_data_to_8023_exthdr);
static void
__frame_add_frag(struct sk_buff *skb, struct page *page,
void *ptr, int len, int size)
{
struct skb_shared_info *sh = skb_shinfo(skb);
int page_offset;
get_page(page);
page_offset = ptr - page_address(page);
skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
}
static void
__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
int offset, int len)
{
struct skb_shared_info *sh = skb_shinfo(skb);
const skb_frag_t *frag = &sh->frags[0];
struct page *frag_page;
void *frag_ptr;
int frag_len, frag_size;
int head_size = skb->len - skb->data_len;
int cur_len;
frag_page = virt_to_head_page(skb->head);
frag_ptr = skb->data;
frag_size = head_size;
while (offset >= frag_size) {
offset -= frag_size;
frag_page = skb_frag_page(frag);
frag_ptr = skb_frag_address(frag);
frag_size = skb_frag_size(frag);
frag++;
}
frag_ptr += offset;
frag_len = frag_size - offset;
cur_len = min(len, frag_len);
__frame_add_frag(frame, frag_page, frag_ptr, cur_len, frag_size);
len -= cur_len;
while (len > 0) {
frag_len = skb_frag_size(frag);
cur_len = min(len, frag_len);
__frame_add_frag(frame, skb_frag_page(frag),
skb_frag_address(frag), cur_len, frag_len);
len -= cur_len;
frag++;
}
}
static struct sk_buff *
__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
int offset, int len, bool reuse_frag,
int min_len)
{
struct sk_buff *frame;
int cur_len = len;
if (skb->len - offset < len)
return NULL;
/*
* When reusing framents, copy some data to the head to simplify
* ethernet header handling and speed up protocol header processing
* in the stack later.
*/
if (reuse_frag)
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
cur_len = min_t(int, len, min_len);
/*
* Allocate and reserve two bytes more for payload
* alignment since sizeof(struct ethhdr) is 14.
*/
frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
if (!frame)
return NULL;
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
frame->priority = skb->priority;
skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
len -= cur_len;
if (!len)
return frame;
offset += cur_len;
__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
return frame;
}
static u16
ieee80211_amsdu_subframe_length(void *field, u8 mesh_flags, u8 hdr_type)
{
__le16 *field_le = field;
__be16 *field_be = field;
u16 len;
if (hdr_type >= 2)
len = le16_to_cpu(*field_le);
else
len = be16_to_cpu(*field_be);
if (hdr_type)
len += __ieee80211_get_mesh_hdrlen(mesh_flags);
return len;
}
bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr)
{
int offset = 0, subframe_len, padding;
for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
int remaining = skb->len - offset;
struct {
__be16 len;
u8 mesh_flags;
} hdr;
u16 len;
if (sizeof(hdr) > remaining)
return false;
if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
return false;
len = ieee80211_amsdu_subframe_length(&hdr.len, hdr.mesh_flags,
mesh_hdr);
subframe_len = sizeof(struct ethhdr) + len;
padding = (4 - subframe_len) & 0x3;
if (subframe_len > remaining)
return false;
}
return true;
}
EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
const u8 *addr, enum nl80211_iftype iftype,
const unsigned int extra_headroom,
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
const u8 *check_da, const u8 *check_sa,
u8 mesh_control)
{
unsigned int hlen = ALIGN(extra_headroom, 4);
struct sk_buff *frame = NULL;
int offset = 0;
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
struct {
struct ethhdr eth;
uint8_t flags;
} hdr;
bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
bool reuse_skb = false;
bool last = false;
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
int copy_len = sizeof(hdr.eth);
if (iftype == NL80211_IFTYPE_MESH_POINT)
copy_len = sizeof(hdr);
while (!last) {
int remaining = skb->len - offset;
unsigned int subframe_len;
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
int len, mesh_len = 0;
u8 padding;
if (copy_len > remaining)
goto purge;
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
skb_copy_bits(skb, offset, &hdr, copy_len);
if (iftype == NL80211_IFTYPE_MESH_POINT)
mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
len = ieee80211_amsdu_subframe_length(&hdr.eth.h_proto, hdr.flags,
mesh_control);
subframe_len = sizeof(struct ethhdr) + len;
padding = (4 - subframe_len) & 0x3;
/* the last MSDU has no padding */
if (subframe_len > remaining)
goto purge;
/* mitigate A-MSDU aggregation injection attacks */
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header))
goto purge;
offset += sizeof(struct ethhdr);
last = remaining <= subframe_len + padding;
/* FIXME: should we really accept multicast DA? */
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
if ((check_da && !is_multicast_ether_addr(hdr.eth.h_dest) &&
!ether_addr_equal(check_da, hdr.eth.h_dest)) ||
(check_sa && !ether_addr_equal(check_sa, hdr.eth.h_source))) {
offset += len + padding;
continue;
}
/* reuse skb for the last subframe */
if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
skb_pull(skb, offset);
frame = skb;
reuse_skb = true;
} else {
frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
reuse_frag, 32 + mesh_len);
if (!frame)
goto purge;
offset += len + padding;
}
skb_reset_network_header(frame);
frame->dev = skb->dev;
frame->priority = skb->priority;
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
skb_pull(frame, ETH_ALEN + 2);
wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-02-13 10:08:54 +00:00
memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
__skb_queue_tail(list, frame);
}
if (!reuse_skb)
dev_kfree_skb(skb);
return;
purge:
__skb_queue_purge(list);
dev_kfree_skb(skb);
}
EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
/* Given a data frame determine the 802.1p/1d tag to use. */
unsigned int cfg80211_classify8021d(struct sk_buff *skb,
struct cfg80211_qos_map *qos_map)
{
unsigned int dscp;
unsigned char vlan_priority;
unsigned int ret;
/* skb->priority values from 256->263 are magic values to
* directly indicate a specific 802.1d priority. This is used
* to allow 802.1d priority to be passed directly in from VLAN
* tags, etc.
*/
if (skb->priority >= 256 && skb->priority <= 263) {
ret = skb->priority - 256;
goto out;
}
if (skb_vlan_tag_present(skb)) {
vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
>> VLAN_PRIO_SHIFT;
if (vlan_priority > 0) {
ret = vlan_priority;
goto out;
}
}
switch (skb->protocol) {
case htons(ETH_P_IP):
dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
break;
case htons(ETH_P_IPV6):
dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
break;
case htons(ETH_P_MPLS_UC):
case htons(ETH_P_MPLS_MC): {
struct mpls_label mpls_tmp, *mpls;
mpls = skb_header_pointer(skb, sizeof(struct ethhdr),
sizeof(*mpls), &mpls_tmp);
if (!mpls)
return 0;
ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
>> MPLS_LS_TC_SHIFT;
goto out;
}
case htons(ETH_P_80221):
/* 802.21 is always network control traffic */
return 7;
default:
return 0;
}
if (qos_map) {
unsigned int i, tmp_dscp = dscp >> 2;
for (i = 0; i < qos_map->num_des; i++) {
if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
ret = qos_map->dscp_exception[i].up;
goto out;
}
}
for (i = 0; i < 8; i++) {
if (tmp_dscp >= qos_map->up[i].low &&
tmp_dscp <= qos_map->up[i].high) {
ret = i;
goto out;
}
}
}
/* The default mapping as defined Section 2.3 in RFC8325: The three
* Most Significant Bits (MSBs) of the DSCP are used as the
* corresponding L2 markings.
*/
ret = dscp >> 5;
/* Handle specific DSCP values for which the default mapping (as
* described above) doesn't adhere to the intended usage of the DSCP
* value. See section 4 in RFC8325. Specifically, for the following
* Diffserv Service Classes no update is needed:
* - Standard: DF
* - Low Priority Data: CS1
* - Multimedia Conferencing: AF41, AF42, AF43
* - Network Control Traffic: CS7
* - Real-Time Interactive: CS4
* - Signaling: CS5
*/
switch (dscp >> 2) {
case 10:
case 12:
case 14:
/* High throughput data: AF11, AF12, AF13 */
ret = 0;
break;
case 16:
/* Operations, Administration, and Maintenance and Provisioning:
* CS2
*/
ret = 0;
break;
case 18:
case 20:
case 22:
/* Low latency data: AF21, AF22, AF23 */
ret = 3;
break;
case 24:
/* Broadcasting video: CS3 */
ret = 4;
break;
case 26:
case 28:
case 30:
/* Multimedia Streaming: AF31, AF32, AF33 */
ret = 4;
break;
case 44:
/* Voice Admit: VA */
ret = 6;
break;
case 46:
/* Telephony traffic: EF */
ret = 6;
break;
case 48:
/* Network Control Traffic: CS6 */
ret = 7;
break;
}
out:
return array_index_nospec(ret, IEEE80211_NUM_TIDS);
}
EXPORT_SYMBOL(cfg80211_classify8021d);
const struct element *ieee80211_bss_get_elem(struct cfg80211_bss *bss, u8 id)
{
const struct cfg80211_bss_ies *ies;
ies = rcu_dereference(bss->ies);
if (!ies)
return NULL;
return cfg80211_find_elem(id, ies->data, ies->len);
}
EXPORT_SYMBOL(ieee80211_bss_get_elem);
void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
{
struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
struct net_device *dev = wdev->netdev;
int i;
if (!wdev->connect_keys)
return;
for (i = 0; i < 4; i++) {
if (!wdev->connect_keys->params[i].cipher)
continue;
if (rdev_add_key(rdev, dev, -1, i, false, NULL,
&wdev->connect_keys->params[i])) {
netdev_err(dev, "failed to set key %d\n", i);
continue;
}
if (wdev->connect_keys->def == i &&
rdev_set_default_key(rdev, dev, -1, i, true, true)) {
netdev_err(dev, "failed to set defkey %d\n", i);
continue;
}
}
mm, treewide: rename kzfree() to kfree_sensitive() As said by Linus: A symmetric naming is only helpful if it implies symmetries in use. Otherwise it's actively misleading. In "kzalloc()", the z is meaningful and an important part of what the caller wants. In "kzfree()", the z is actively detrimental, because maybe in the future we really _might_ want to use that "memfill(0xdeadbeef)" or something. The "zero" part of the interface isn't even _relevant_. The main reason that kzfree() exists is to clear sensitive information that should not be leaked to other future users of the same memory objects. Rename kzfree() to kfree_sensitive() to follow the example of the recently added kvfree_sensitive() and make the intention of the API more explicit. In addition, memzero_explicit() is used to clear the memory to make sure that it won't get optimized away by the compiler. The renaming is done by using the command sequence: git grep -w --name-only kzfree |\ xargs sed -i 's/kzfree/kfree_sensitive/' followed by some editing of the kfree_sensitive() kerneldoc and adding a kzfree backward compatibility macro in slab.h. [akpm@linux-foundation.org: fs/crypto/inline_crypt.c needs linux/slab.h] [akpm@linux-foundation.org: fix fs/crypto/inline_crypt.c some more] Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: David Howells <dhowells@redhat.com> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: Joe Perches <joe@perches.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: David Rientjes <rientjes@google.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: "Jason A . Donenfeld" <Jason@zx2c4.com> Link: http://lkml.kernel.org/r/20200616154311.12314-3-longman@redhat.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-08-07 06:18:13 +00:00
kfree_sensitive(wdev->connect_keys);
wdev->connect_keys = NULL;
}
void cfg80211_process_wdev_events(struct wireless_dev *wdev)
{
struct cfg80211_event *ev;
unsigned long flags;
spin_lock_irqsave(&wdev->event_lock, flags);
while (!list_empty(&wdev->event_list)) {
ev = list_first_entry(&wdev->event_list,
struct cfg80211_event, list);
list_del(&ev->list);
spin_unlock_irqrestore(&wdev->event_lock, flags);
switch (ev->type) {
case EVENT_CONNECT_RESULT:
__cfg80211_connect_result(
wdev->netdev,
&ev->cr,
ev->cr.status == WLAN_STATUS_SUCCESS);
break;
case EVENT_ROAMED:
__cfg80211_roamed(wdev, &ev->rm);
break;
case EVENT_DISCONNECTED:
__cfg80211_disconnected(wdev->netdev,
ev->dc.ie, ev->dc.ie_len,
ev->dc.reason,
!ev->dc.locally_generated);
break;
case EVENT_IBSS_JOINED:
__cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
ev->ij.channel);
break;
case EVENT_STOPPED:
cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
break;
cfg80211/nl80211: add a port authorized event Add an event that indicates that a connection is authorized (i.e. the 4 way handshake was performed by the driver). This event should be sent by the driver after sending a connect/roamed event. This is useful for networks that require 802.1X authentication. In cases that the driver supports 4 way handshake offload, but the 802.1X authentication is managed by user space, the driver needs to inform user space right after the 802.11 association was completed so user space can initialize its 802.1X state machine etc. However, it is also possible that the AP will choose to skip the 802.1X authentication (e.g. when PMKSA caching is used) and proceed with the 4 way handshake immediately. In this case the driver needs to inform user space that 802.1X authentication is no longer required (e.g. to prevent user space from disconnecting since it did not get any EAPOLs from the AP). This is also useful for roaming, in which case it is possible that the driver used the Fast Transition protocol so 802.1X is not required. Since there will now be a dedicated notification indicating that the connection is authorized, the authorized flag can be removed from the roamed event. Drivers can send the new port authorized event right after sending the roamed event to indicate the new AP is already authorized. This therefore reserves the old PORT_AUTHORIZED attribute. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-09-29 12:21:49 +00:00
case EVENT_PORT_AUTHORIZED:
__cfg80211_port_authorized(wdev, ev->pa.peer_addr,
ev->pa.td_bitmap,
ev->pa.td_bitmap_len);
cfg80211/nl80211: add a port authorized event Add an event that indicates that a connection is authorized (i.e. the 4 way handshake was performed by the driver). This event should be sent by the driver after sending a connect/roamed event. This is useful for networks that require 802.1X authentication. In cases that the driver supports 4 way handshake offload, but the 802.1X authentication is managed by user space, the driver needs to inform user space right after the 802.11 association was completed so user space can initialize its 802.1X state machine etc. However, it is also possible that the AP will choose to skip the 802.1X authentication (e.g. when PMKSA caching is used) and proceed with the 4 way handshake immediately. In this case the driver needs to inform user space that 802.1X authentication is no longer required (e.g. to prevent user space from disconnecting since it did not get any EAPOLs from the AP). This is also useful for roaming, in which case it is possible that the driver used the Fast Transition protocol so 802.1X is not required. Since there will now be a dedicated notification indicating that the connection is authorized, the authorized flag can be removed from the roamed event. Drivers can send the new port authorized event right after sending the roamed event to indicate the new AP is already authorized. This therefore reserves the old PORT_AUTHORIZED attribute. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-09-29 12:21:49 +00:00
break;
}
kfree(ev);
spin_lock_irqsave(&wdev->event_lock, flags);
}
spin_unlock_irqrestore(&wdev->event_lock, flags);
}
void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
{
struct wireless_dev *wdev;
lockdep_assert_held(&rdev->wiphy.mtx);
list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
cfg80211_process_wdev_events(wdev);
}
int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
struct net_device *dev, enum nl80211_iftype ntype,
struct vif_params *params)
{
int err;
enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
lockdep_assert_held(&rdev->wiphy.mtx);
/* don't support changing VLANs, you just re-create them */
if (otype == NL80211_IFTYPE_AP_VLAN)
return -EOPNOTSUPP;
/* cannot change into P2P device or NAN */
if (ntype == NL80211_IFTYPE_P2P_DEVICE ||
ntype == NL80211_IFTYPE_NAN)
return -EOPNOTSUPP;
if (!rdev->ops->change_virtual_intf ||
!(rdev->wiphy.interface_modes & (1 << ntype)))
return -EOPNOTSUPP;
cfg80211: ignore netif running state when changing iftype It was possible for mac80211 to be coerced into an unexpected flow causing sdata union to become corrupted. Station pointer was put into sdata->u.vlan.sta memory location while it was really master AP's sdata->u.ap.next_beacon. This led to station entry being later freed as next_beacon before __sta_info_flush() in ieee80211_stop_ap() and a subsequent invalid pointer dereference crash. The problem was that ieee80211_ptr->use_4addr wasn't cleared on interface type changes. This could be reproduced with the following steps: # host A and host B have just booted; no # wpa_s/hostapd running; all vifs are down host A> iw wlan0 set type station host A> iw wlan0 set 4addr on host A> printf 'interface=wlan0\nssid=4addrcrash\nchannel=1\nwds_sta=1' > /tmp/hconf host A> hostapd -B /tmp/conf host B> iw wlan0 set 4addr on host B> ifconfig wlan0 up host B> iw wlan0 connect -w hostAssid host A> pkill hostapd # host A crashed: [ 127.928192] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c8 [ 127.929014] IP: [<ffffffff816f4f32>] __sta_info_flush+0xac/0x158 ... [ 127.934578] [<ffffffff8170789e>] ieee80211_stop_ap+0x139/0x26c [ 127.934578] [<ffffffff8100498f>] ? dump_trace+0x279/0x28a [ 127.934578] [<ffffffff816dc661>] __cfg80211_stop_ap+0x84/0x191 [ 127.934578] [<ffffffff816dc7ad>] cfg80211_stop_ap+0x3f/0x58 [ 127.934578] [<ffffffff816c5ad6>] nl80211_stop_ap+0x1b/0x1d [ 127.934578] [<ffffffff815e53f8>] genl_family_rcv_msg+0x259/0x2b5 Note: This isn't a revert of f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running") as far as functionality is considered because b6a550156bc ("cfg80211/mac80211: move more combination checks to mac80211") moved the logic somewhere else already. Fixes: f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running") Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-05-22 08:57:22 +00:00
if (ntype != otype) {
/* if it's part of a bridge, reject changing type to station/ibss */
if (netif_is_bridge_port(dev) &&
(ntype == NL80211_IFTYPE_ADHOC ||
ntype == NL80211_IFTYPE_STATION ||
ntype == NL80211_IFTYPE_P2P_CLIENT))
return -EBUSY;
dev->ieee80211_ptr->use_4addr = false;
rdev_set_qos_map(rdev, dev, NULL);
switch (otype) {
case NL80211_IFTYPE_AP:
case NL80211_IFTYPE_P2P_GO:
cfg80211_stop_ap(rdev, dev, -1, true);
break;
case NL80211_IFTYPE_ADHOC:
cfg80211_leave_ibss(rdev, dev, false);
break;
case NL80211_IFTYPE_STATION:
case NL80211_IFTYPE_P2P_CLIENT:
cfg80211_disconnect(rdev, dev,
WLAN_REASON_DEAUTH_LEAVING, true);
break;
case NL80211_IFTYPE_MESH_POINT:
/* mesh should be handled? */
break;
case NL80211_IFTYPE_OCB:
cfg80211_leave_ocb(rdev, dev);
break;
default:
break;
}
cfg80211_process_rdev_events(rdev);
cfg80211_mlme_purge_registrations(dev->ieee80211_ptr);
memset(&dev->ieee80211_ptr->u, 0,
sizeof(dev->ieee80211_ptr->u));
memset(&dev->ieee80211_ptr->links, 0,
sizeof(dev->ieee80211_ptr->links));
}
err = rdev_change_virtual_intf(rdev, dev, ntype, params);
WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
if (!err && params && params->use_4addr != -1)
dev->ieee80211_ptr->use_4addr = params->use_4addr;
if (!err) {
dev->priv_flags &= ~IFF_DONT_BRIDGE;
switch (ntype) {
case NL80211_IFTYPE_STATION:
if (dev->ieee80211_ptr->use_4addr)
break;
fallthrough;
case NL80211_IFTYPE_OCB:
case NL80211_IFTYPE_P2P_CLIENT:
case NL80211_IFTYPE_ADHOC:
dev->priv_flags |= IFF_DONT_BRIDGE;
break;
case NL80211_IFTYPE_P2P_GO:
case NL80211_IFTYPE_AP:
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MESH_POINT:
/* bridging OK */
break;
case NL80211_IFTYPE_MONITOR:
/* monitor can't bridge anyway */
break;
case NL80211_IFTYPE_UNSPECIFIED:
case NUM_NL80211_IFTYPES:
/* not happening */
break;
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_WDS:
case NL80211_IFTYPE_NAN:
WARN_ON(1);
break;
}
}
if (!err && ntype != otype && netif_running(dev)) {
cfg80211_update_iface_num(rdev, ntype, 1);
cfg80211_update_iface_num(rdev, otype, -1);
}
return err;
}
static u32 cfg80211_calculate_bitrate_ht(struct rate_info *rate)
{
int modulation, streams, bitrate;
/* the formula below does only work for MCS values smaller than 32 */
if (WARN_ON_ONCE(rate->mcs >= 32))
return 0;
modulation = rate->mcs & 7;
streams = (rate->mcs >> 3) + 1;
bitrate = (rate->bw == RATE_INFO_BW_40) ? 13500000 : 6500000;
if (modulation < 4)
bitrate *= (modulation + 1);
else if (modulation == 4)
bitrate *= (modulation + 2);
else
bitrate *= (modulation + 3);
bitrate *= streams;
if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
bitrate = (bitrate / 9) * 10;
/* do NOT round down here */
return (bitrate + 50000) / 100000;
}
static u32 cfg80211_calculate_bitrate_dmg(struct rate_info *rate)
{
static const u32 __mcs2bitrate[] = {
/* control PHY */
[0] = 275,
/* SC PHY */
[1] = 3850,
[2] = 7700,
[3] = 9625,
[4] = 11550,
[5] = 12512, /* 1251.25 mbps */
[6] = 15400,
[7] = 19250,
[8] = 23100,
[9] = 25025,
[10] = 30800,
[11] = 38500,
[12] = 46200,
/* OFDM PHY */
[13] = 6930,
[14] = 8662, /* 866.25 mbps */
[15] = 13860,
[16] = 17325,
[17] = 20790,
[18] = 27720,
[19] = 34650,
[20] = 41580,
[21] = 45045,
[22] = 51975,
[23] = 62370,
[24] = 67568, /* 6756.75 mbps */
/* LP-SC PHY */
[25] = 6260,
[26] = 8340,
[27] = 11120,
[28] = 12510,
[29] = 16680,
[30] = 22240,
[31] = 25030,
};
if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
return 0;
return __mcs2bitrate[rate->mcs];
}
static u32 cfg80211_calculate_bitrate_extended_sc_dmg(struct rate_info *rate)
{
static const u32 __mcs2bitrate[] = {
[6 - 6] = 26950, /* MCS 9.1 : 2695.0 mbps */
[7 - 6] = 50050, /* MCS 12.1 */
[8 - 6] = 53900,
[9 - 6] = 57750,
[10 - 6] = 63900,
[11 - 6] = 75075,
[12 - 6] = 80850,
};
/* Extended SC MCS not defined for base MCS below 6 or above 12 */
if (WARN_ON_ONCE(rate->mcs < 6 || rate->mcs > 12))
return 0;
return __mcs2bitrate[rate->mcs - 6];
}
static u32 cfg80211_calculate_bitrate_edmg(struct rate_info *rate)
{
static const u32 __mcs2bitrate[] = {
/* control PHY */
[0] = 275,
/* SC PHY */
[1] = 3850,
[2] = 7700,
[3] = 9625,
[4] = 11550,
[5] = 12512, /* 1251.25 mbps */
[6] = 13475,
[7] = 15400,
[8] = 19250,
[9] = 23100,
[10] = 25025,
[11] = 26950,
[12] = 30800,
[13] = 38500,
[14] = 46200,
[15] = 50050,
[16] = 53900,
[17] = 57750,
[18] = 69300,
[19] = 75075,
[20] = 80850,
};
if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
return 0;
return __mcs2bitrate[rate->mcs] * rate->n_bonded_ch;
}
static u32 cfg80211_calculate_bitrate_vht(struct rate_info *rate)
{
static const u32 base[4][12] = {
{ 6500000,
13000000,
19500000,
26000000,
39000000,
52000000,
58500000,
65000000,
78000000,
/* not in the spec, but some devices use this: */
86700000,
97500000,
108300000,
},
{ 13500000,
27000000,
40500000,
54000000,
81000000,
108000000,
121500000,
135000000,
162000000,
180000000,
202500000,
225000000,
},
{ 29300000,
58500000,
87800000,
117000000,
175500000,
234000000,
263300000,
292500000,
351000000,
390000000,
438800000,
487500000,
},
{ 58500000,
117000000,
175500000,
234000000,
351000000,
468000000,
526500000,
585000000,
702000000,
780000000,
877500000,
975000000,
},
};
u32 bitrate;
int idx;
if (rate->mcs > 11)
goto warn;
switch (rate->bw) {
case RATE_INFO_BW_160:
idx = 3;
break;
case RATE_INFO_BW_80:
idx = 2;
break;
case RATE_INFO_BW_40:
idx = 1;
break;
case RATE_INFO_BW_5:
case RATE_INFO_BW_10:
default:
goto warn;
case RATE_INFO_BW_20:
idx = 0;
}
bitrate = base[idx][rate->mcs];
bitrate *= rate->nss;
if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
bitrate = (bitrate / 9) * 10;
/* do NOT round down here */
return (bitrate + 50000) / 100000;
warn:
WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
rate->bw, rate->mcs, rate->nss);
return 0;
}
static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
{
#define SCALE 6144
u32 mcs_divisors[14] = {
102399, /* 16.666666... */
51201, /* 8.333333... */
34134, /* 5.555555... */
25599, /* 4.166666... */
17067, /* 2.777777... */
12801, /* 2.083333... */
11377, /* 1.851725... */
10239, /* 1.666666... */
8532, /* 1.388888... */
7680, /* 1.250000... */
6828, /* 1.111111... */
6144, /* 1.000000... */
5690, /* 0.926106... */
5120, /* 0.833333... */
};
u32 rates_160M[3] = { 960777777, 907400000, 816666666 };
u32 rates_996[3] = { 480388888, 453700000, 408333333 };
u32 rates_484[3] = { 229411111, 216666666, 195000000 };
u32 rates_242[3] = { 114711111, 108333333, 97500000 };
u32 rates_106[3] = { 40000000, 37777777, 34000000 };
u32 rates_52[3] = { 18820000, 17777777, 16000000 };
u32 rates_26[3] = { 9411111, 8888888, 8000000 };
u64 tmp;
u32 result;
if (WARN_ON_ONCE(rate->mcs > 13))
return 0;
if (WARN_ON_ONCE(rate->he_gi > NL80211_RATE_INFO_HE_GI_3_2))
return 0;
if (WARN_ON_ONCE(rate->he_ru_alloc >
NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
return 0;
if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
return 0;
if (rate->bw == RATE_INFO_BW_160 ||
(rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
result = rates_160M[rate->he_gi];
else if (rate->bw == RATE_INFO_BW_80 ||
(rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996))
result = rates_996[rate->he_gi];
else if (rate->bw == RATE_INFO_BW_40 ||
(rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484))
result = rates_484[rate->he_gi];
else if (rate->bw == RATE_INFO_BW_20 ||
(rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_242))
result = rates_242[rate->he_gi];
else if (rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_106)
result = rates_106[rate->he_gi];
else if (rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_52)
result = rates_52[rate->he_gi];
else if (rate->bw == RATE_INFO_BW_HE_RU &&
rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
result = rates_26[rate->he_gi];
else {
WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
rate->bw, rate->he_ru_alloc);
return 0;
}
/* now scale to the appropriate MCS */
tmp = result;
tmp *= SCALE;
do_div(tmp, mcs_divisors[rate->mcs]);
result = tmp;
/* and take NSS, DCM into account */
result = (result * rate->nss) / 8;
if (rate->he_dcm)
result /= 2;
return result / 10000;
}
static u32 cfg80211_calculate_bitrate_eht(struct rate_info *rate)
{
#define SCALE 6144
static const u32 mcs_divisors[16] = {
102399, /* 16.666666... */
51201, /* 8.333333... */
34134, /* 5.555555... */
25599, /* 4.166666... */
17067, /* 2.777777... */
12801, /* 2.083333... */
11377, /* 1.851725... */
10239, /* 1.666666... */
8532, /* 1.388888... */
7680, /* 1.250000... */
6828, /* 1.111111... */
6144, /* 1.000000... */
5690, /* 0.926106... */
5120, /* 0.833333... */
409600, /* 66.666666... */
204800, /* 33.333333... */
};
static const u32 rates_996[3] = { 480388888, 453700000, 408333333 };
static const u32 rates_484[3] = { 229411111, 216666666, 195000000 };
static const u32 rates_242[3] = { 114711111, 108333333, 97500000 };
static const u32 rates_106[3] = { 40000000, 37777777, 34000000 };
static const u32 rates_52[3] = { 18820000, 17777777, 16000000 };
static const u32 rates_26[3] = { 9411111, 8888888, 8000000 };
u64 tmp;
u32 result;
if (WARN_ON_ONCE(rate->mcs > 15))
return 0;
if (WARN_ON_ONCE(rate->eht_gi > NL80211_RATE_INFO_EHT_GI_3_2))
return 0;
if (WARN_ON_ONCE(rate->eht_ru_alloc >
NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
return 0;
if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
return 0;
/* Bandwidth checks for MCS 14 */
if (rate->mcs == 14) {
if ((rate->bw != RATE_INFO_BW_EHT_RU &&
rate->bw != RATE_INFO_BW_80 &&
rate->bw != RATE_INFO_BW_160 &&
rate->bw != RATE_INFO_BW_320) ||
(rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_996 &&
rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_2x996 &&
rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_4x996)) {
WARN(1, "invalid EHT BW for MCS 14: bw:%d, ru:%d\n",
rate->bw, rate->eht_ru_alloc);
return 0;
}
}
if (rate->bw == RATE_INFO_BW_320 ||
(rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
result = 4 * rates_996[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484)
result = 3 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996)
result = 3 * rates_996[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484)
result = 2 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_160 ||
(rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996))
result = 2 * rates_996[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc ==
NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242)
result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi]
+ rates_242[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996P484)
result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_80 ||
(rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996))
result = rates_996[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484P242)
result = rates_484[rate->eht_gi] + rates_242[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_40 ||
(rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484))
result = rates_484[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_20 ||
(rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_242))
result = rates_242[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106P26)
result = rates_106[rate->eht_gi] + rates_26[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106)
result = rates_106[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52P26)
result = rates_52[rate->eht_gi] + rates_26[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52)
result = rates_52[rate->eht_gi];
else if (rate->bw == RATE_INFO_BW_EHT_RU &&
rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_26)
result = rates_26[rate->eht_gi];
else {
WARN(1, "invalid EHT MCS: bw:%d, ru:%d\n",
rate->bw, rate->eht_ru_alloc);
return 0;
}
/* now scale to the appropriate MCS */
tmp = result;
tmp *= SCALE;
do_div(tmp, mcs_divisors[rate->mcs]);
/* and take NSS */
tmp *= rate->nss;
do_div(tmp, 8);
result = tmp;
return result / 10000;
}
static u32 cfg80211_calculate_bitrate_s1g(struct rate_info *rate)
{
/* For 1, 2, 4, 8 and 16 MHz channels */
static const u32 base[5][11] = {
{ 300000,
600000,
900000,
1200000,
1800000,
2400000,
2700000,
3000000,
3600000,
4000000,
/* MCS 10 supported in 1 MHz only */
150000,
},
{ 650000,
1300000,
1950000,
2600000,
3900000,
5200000,
5850000,
6500000,
7800000,
/* MCS 9 not valid */
},
{ 1350000,
2700000,
4050000,
5400000,
8100000,
10800000,
12150000,
13500000,
16200000,
18000000,
},
{ 2925000,
5850000,
8775000,
11700000,
17550000,
23400000,
26325000,
29250000,
35100000,
39000000,
},
{ 8580000,
11700000,
17550000,
23400000,
35100000,
46800000,
52650000,
58500000,
70200000,
78000000,
},
};
u32 bitrate;
/* default is 1 MHz index */
int idx = 0;
if (rate->mcs >= 11)
goto warn;
switch (rate->bw) {
case RATE_INFO_BW_16:
idx = 4;
break;
case RATE_INFO_BW_8:
idx = 3;
break;
case RATE_INFO_BW_4:
idx = 2;
break;
case RATE_INFO_BW_2:
idx = 1;
break;
case RATE_INFO_BW_1:
idx = 0;
break;
case RATE_INFO_BW_5:
case RATE_INFO_BW_10:
case RATE_INFO_BW_20:
case RATE_INFO_BW_40:
case RATE_INFO_BW_80:
case RATE_INFO_BW_160:
default:
goto warn;
}
bitrate = base[idx][rate->mcs];
bitrate *= rate->nss;
if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
bitrate = (bitrate / 9) * 10;
/* do NOT round down here */
return (bitrate + 50000) / 100000;
warn:
WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
rate->bw, rate->mcs, rate->nss);
return 0;
}
u32 cfg80211_calculate_bitrate(struct rate_info *rate)
{
if (rate->flags & RATE_INFO_FLAGS_MCS)
return cfg80211_calculate_bitrate_ht(rate);
if (rate->flags & RATE_INFO_FLAGS_DMG)
return cfg80211_calculate_bitrate_dmg(rate);
if (rate->flags & RATE_INFO_FLAGS_EXTENDED_SC_DMG)
return cfg80211_calculate_bitrate_extended_sc_dmg(rate);
if (rate->flags & RATE_INFO_FLAGS_EDMG)
return cfg80211_calculate_bitrate_edmg(rate);
if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
return cfg80211_calculate_bitrate_vht(rate);
if (rate->flags & RATE_INFO_FLAGS_HE_MCS)
return cfg80211_calculate_bitrate_he(rate);
if (rate->flags & RATE_INFO_FLAGS_EHT_MCS)
return cfg80211_calculate_bitrate_eht(rate);
if (rate->flags & RATE_INFO_FLAGS_S1G_MCS)
return cfg80211_calculate_bitrate_s1g(rate);
return rate->legacy;
}
EXPORT_SYMBOL(cfg80211_calculate_bitrate);
int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
enum ieee80211_p2p_attr_id attr,
u8 *buf, unsigned int bufsize)
{
u8 *out = buf;
u16 attr_remaining = 0;
bool desired_attr = false;
u16 desired_len = 0;
while (len > 0) {
unsigned int iedatalen;
unsigned int copy;
const u8 *iedata;
if (len < 2)
return -EILSEQ;
iedatalen = ies[1];
if (iedatalen + 2 > len)
return -EILSEQ;
if (ies[0] != WLAN_EID_VENDOR_SPECIFIC)
goto cont;
if (iedatalen < 4)
goto cont;
iedata = ies + 2;
/* check WFA OUI, P2P subtype */
if (iedata[0] != 0x50 || iedata[1] != 0x6f ||
iedata[2] != 0x9a || iedata[3] != 0x09)
goto cont;
iedatalen -= 4;
iedata += 4;
/* check attribute continuation into this IE */
copy = min_t(unsigned int, attr_remaining, iedatalen);
if (copy && desired_attr) {
desired_len += copy;
if (out) {
memcpy(out, iedata, min(bufsize, copy));
out += min(bufsize, copy);
bufsize -= min(bufsize, copy);
}
if (copy == attr_remaining)
return desired_len;
}
attr_remaining -= copy;
if (attr_remaining)
goto cont;
iedatalen -= copy;
iedata += copy;
while (iedatalen > 0) {
u16 attr_len;
/* P2P attribute ID & size must fit */
if (iedatalen < 3)
return -EILSEQ;
desired_attr = iedata[0] == attr;
attr_len = get_unaligned_le16(iedata + 1);
iedatalen -= 3;
iedata += 3;
copy = min_t(unsigned int, attr_len, iedatalen);
if (desired_attr) {
desired_len += copy;
if (out) {
memcpy(out, iedata, min(bufsize, copy));
out += min(bufsize, copy);
bufsize -= min(bufsize, copy);
}
if (copy == attr_len)
return desired_len;
}
iedata += copy;
iedatalen -= copy;
attr_remaining = attr_len - copy;
}
cont:
len -= ies[1] + 2;
ies += ies[1] + 2;
}
if (attr_remaining && desired_attr)
return -EILSEQ;
return -ENOENT;
}
EXPORT_SYMBOL(cfg80211_get_p2p_attr);
static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id, bool id_ext)
{
int i;
/* Make sure array values are legal */
if (WARN_ON(ids[n_ids - 1] == WLAN_EID_EXTENSION))
return false;
i = 0;
while (i < n_ids) {
if (ids[i] == WLAN_EID_EXTENSION) {
if (id_ext && (ids[i + 1] == id))
return true;
i += 2;
continue;
}
if (ids[i] == id && !id_ext)
return true;
i++;
}
return false;
}
static size_t skip_ie(const u8 *ies, size_t ielen, size_t pos)
{
/* we assume a validly formed IEs buffer */
u8 len = ies[pos + 1];
pos += 2 + len;
/* the IE itself must have 255 bytes for fragments to follow */
if (len < 255)
return pos;
while (pos < ielen && ies[pos] == WLAN_EID_FRAGMENT) {
len = ies[pos + 1];
pos += 2 + len;
}
return pos;
}
size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
const u8 *ids, int n_ids,
const u8 *after_ric, int n_after_ric,
size_t offset)
{
size_t pos = offset;
while (pos < ielen) {
u8 ext = 0;
if (ies[pos] == WLAN_EID_EXTENSION)
ext = 2;
if ((pos + ext) >= ielen)
break;
if (!ieee80211_id_in_list(ids, n_ids, ies[pos + ext],
ies[pos] == WLAN_EID_EXTENSION))
break;
if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
pos = skip_ie(ies, ielen, pos);
while (pos < ielen) {
if (ies[pos] == WLAN_EID_EXTENSION)
ext = 2;
else
ext = 0;
if ((pos + ext) >= ielen)
break;
if (!ieee80211_id_in_list(after_ric,
n_after_ric,
ies[pos + ext],
ext == 2))
pos = skip_ie(ies, ielen, pos);
else
break;
}
} else {
pos = skip_ie(ies, ielen, pos);
}
}
return pos;
}
EXPORT_SYMBOL(ieee80211_ie_split_ric);
void ieee80211_fragment_element(struct sk_buff *skb, u8 *len_pos, u8 frag_id)
{
unsigned int elem_len;
if (!len_pos)
return;
elem_len = skb->data + skb->len - len_pos - 1;
while (elem_len > 255) {
/* this one is 255 */
*len_pos = 255;
/* remaining data gets smaller */
elem_len -= 255;
/* make space for the fragment ID/len in SKB */
skb_put(skb, 2);
/* shift back the remaining data to place fragment ID/len */
memmove(len_pos + 255 + 3, len_pos + 255 + 1, elem_len);
/* place the fragment ID */
len_pos += 255 + 1;
*len_pos = frag_id;
/* and point to fragment length to update later */
len_pos++;
}
*len_pos = elem_len;
}
EXPORT_SYMBOL(ieee80211_fragment_element);
bool ieee80211_operating_class_to_band(u8 operating_class,
enum nl80211_band *band)
{
switch (operating_class) {
case 112:
case 115 ... 127:
case 128 ... 130:
*band = NL80211_BAND_5GHZ;
return true;
case 131 ... 135:
case 137:
*band = NL80211_BAND_6GHZ;
return true;
case 81:
case 82:
case 83:
case 84:
*band = NL80211_BAND_2GHZ;
return true;
case 180:
*band = NL80211_BAND_60GHZ;
return true;
}
return false;
}
EXPORT_SYMBOL(ieee80211_operating_class_to_band);
bool ieee80211_operating_class_to_chandef(u8 operating_class,
struct ieee80211_channel *chan,
struct cfg80211_chan_def *chandef)
{
u32 control_freq, offset = 0;
enum nl80211_band band;
if (!ieee80211_operating_class_to_band(operating_class, &band) ||
!chan || band != chan->band)
return false;
control_freq = chan->center_freq;
chandef->chan = chan;
if (control_freq >= 5955)
offset = control_freq - 5955;
else if (control_freq >= 5745)
offset = control_freq - 5745;
else if (control_freq >= 5180)
offset = control_freq - 5180;
offset /= 20;
switch (operating_class) {
case 81: /* 2 GHz band; 20 MHz; channels 1..13 */
case 82: /* 2 GHz band; 20 MHz; channel 14 */
case 115: /* 5 GHz band; 20 MHz; channels 36,40,44,48 */
case 118: /* 5 GHz band; 20 MHz; channels 52,56,60,64 */
case 121: /* 5 GHz band; 20 MHz; channels 100..144 */
case 124: /* 5 GHz band; 20 MHz; channels 149,153,157,161 */
case 125: /* 5 GHz band; 20 MHz; channels 149..177 */
case 131: /* 6 GHz band; 20 MHz; channels 1..233*/
case 136: /* 6 GHz band; 20 MHz; channel 2 */
chandef->center_freq1 = control_freq;
chandef->width = NL80211_CHAN_WIDTH_20;
return true;
case 83: /* 2 GHz band; 40 MHz; channels 1..9 */
case 116: /* 5 GHz band; 40 MHz; channels 36,44 */
case 119: /* 5 GHz band; 40 MHz; channels 52,60 */
case 122: /* 5 GHz band; 40 MHz; channels 100,108,116,124,132,140 */
case 126: /* 5 GHz band; 40 MHz; channels 149,157,165,173 */
chandef->center_freq1 = control_freq + 10;
chandef->width = NL80211_CHAN_WIDTH_40;
return true;
case 84: /* 2 GHz band; 40 MHz; channels 5..13 */
case 117: /* 5 GHz band; 40 MHz; channels 40,48 */
case 120: /* 5 GHz band; 40 MHz; channels 56,64 */
case 123: /* 5 GHz band; 40 MHz; channels 104,112,120,128,136,144 */
case 127: /* 5 GHz band; 40 MHz; channels 153,161,169,177 */
chandef->center_freq1 = control_freq - 10;
chandef->width = NL80211_CHAN_WIDTH_40;
return true;
case 132: /* 6 GHz band; 40 MHz; channels 1,5,..,229*/
chandef->center_freq1 = control_freq + 10 - (offset & 1) * 20;
chandef->width = NL80211_CHAN_WIDTH_40;
return true;
case 128: /* 5 GHz band; 80 MHz; channels 36..64,100..144,149..177 */
case 133: /* 6 GHz band; 80 MHz; channels 1,5,..,229 */
chandef->center_freq1 = control_freq + 30 - (offset & 3) * 20;
chandef->width = NL80211_CHAN_WIDTH_80;
return true;
case 129: /* 5 GHz band; 160 MHz; channels 36..64,100..144,149..177 */
case 134: /* 6 GHz band; 160 MHz; channels 1,5,..,229 */
chandef->center_freq1 = control_freq + 70 - (offset & 7) * 20;
chandef->width = NL80211_CHAN_WIDTH_160;
return true;
case 130: /* 5 GHz band; 80+80 MHz; channels 36..64,100..144,149..177 */
case 135: /* 6 GHz band; 80+80 MHz; channels 1,5,..,229 */
/* The center_freq2 of 80+80 MHz is unknown */
case 137: /* 6 GHz band; 320 MHz; channels 1,5,..,229 */
/* 320-1 or 320-2 channelization is unknown */
default:
return false;
}
}
EXPORT_SYMBOL(ieee80211_operating_class_to_chandef);
bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
u8 *op_class)
{
u8 vht_opclass;
u32 freq = chandef->center_freq1;
if (freq >= 2412 && freq <= 2472) {
if (chandef->width > NL80211_CHAN_WIDTH_40)
return false;
/* 2.407 GHz, channels 1..13 */
if (chandef->width == NL80211_CHAN_WIDTH_40) {
if (freq > chandef->chan->center_freq)
*op_class = 83; /* HT40+ */
else
*op_class = 84; /* HT40- */
} else {
*op_class = 81;
}
return true;
}
if (freq == 2484) {
/* channel 14 is only for IEEE 802.11b */
if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
return false;
*op_class = 82; /* channel 14 */
return true;
}
switch (chandef->width) {
case NL80211_CHAN_WIDTH_80:
vht_opclass = 128;
break;
case NL80211_CHAN_WIDTH_160:
vht_opclass = 129;
break;
case NL80211_CHAN_WIDTH_80P80:
vht_opclass = 130;
break;
case NL80211_CHAN_WIDTH_10:
case NL80211_CHAN_WIDTH_5:
return false; /* unsupported for now */
default:
vht_opclass = 0;
break;
}
/* 5 GHz, channels 36..48 */
if (freq >= 5180 && freq <= 5240) {
if (vht_opclass) {
*op_class = vht_opclass;
} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
if (freq > chandef->chan->center_freq)
*op_class = 116;
else
*op_class = 117;
} else {
*op_class = 115;
}
return true;
}
/* 5 GHz, channels 52..64 */
if (freq >= 5260 && freq <= 5320) {
if (vht_opclass) {
*op_class = vht_opclass;
} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
if (freq > chandef->chan->center_freq)
*op_class = 119;
else
*op_class = 120;
} else {
*op_class = 118;
}
return true;
}
/* 5 GHz, channels 100..144 */
if (freq >= 5500 && freq <= 5720) {
if (vht_opclass) {
*op_class = vht_opclass;
} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
if (freq > chandef->chan->center_freq)
*op_class = 122;
else
*op_class = 123;
} else {
*op_class = 121;
}
return true;
}
/* 5 GHz, channels 149..169 */
if (freq >= 5745 && freq <= 5845) {
if (vht_opclass) {
*op_class = vht_opclass;
} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
if (freq > chandef->chan->center_freq)
*op_class = 126;
else
*op_class = 127;
} else if (freq <= 5805) {
*op_class = 124;
} else {
*op_class = 125;
}
return true;
}
/* 56.16 GHz, channel 1..4 */
if (freq >= 56160 + 2160 * 1 && freq <= 56160 + 2160 * 6) {
if (chandef->width >= NL80211_CHAN_WIDTH_40)
return false;
*op_class = 180;
return true;
}
/* not supported yet */
return false;
}
EXPORT_SYMBOL(ieee80211_chandef_to_operating_class);
static int cfg80211_wdev_bi(struct wireless_dev *wdev)
{
switch (wdev->iftype) {
case NL80211_IFTYPE_AP:
case NL80211_IFTYPE_P2P_GO:
WARN_ON(wdev->valid_links);
return wdev->links[0].ap.beacon_interval;
case NL80211_IFTYPE_MESH_POINT:
return wdev->u.mesh.beacon_interval;
case NL80211_IFTYPE_ADHOC:
return wdev->u.ibss.beacon_interval;
default:
break;
}
return 0;
}
static void cfg80211_calculate_bi_data(struct wiphy *wiphy, u32 new_beacon_int,
u32 *beacon_int_gcd,
bool *beacon_int_different,
int radio_idx)
{
struct cfg80211_registered_device *rdev;
struct wireless_dev *wdev;
*beacon_int_gcd = 0;
*beacon_int_different = false;
rdev = wiphy_to_rdev(wiphy);
list_for_each_entry(wdev, &wiphy->wdev_list, list) {
int wdev_bi;
/* this feature isn't supported with MLO */
if (wdev->valid_links)
continue;
/* skip wdevs not active on the given wiphy radio */
if (radio_idx >= 0 &&
!(rdev_get_radio_mask(rdev, wdev->netdev) & BIT(radio_idx)))
continue;
wdev_bi = cfg80211_wdev_bi(wdev);
if (!wdev_bi)
continue;
if (!*beacon_int_gcd) {
*beacon_int_gcd = wdev_bi;
continue;
}
if (wdev_bi == *beacon_int_gcd)
continue;
*beacon_int_different = true;
*beacon_int_gcd = gcd(*beacon_int_gcd, wdev_bi);
}
if (new_beacon_int && *beacon_int_gcd != new_beacon_int) {
if (*beacon_int_gcd)
*beacon_int_different = true;
*beacon_int_gcd = gcd(*beacon_int_gcd, new_beacon_int);
}
}
int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
enum nl80211_iftype iftype, u32 beacon_int)
{
/*
* This is just a basic pre-condition check; if interface combinations
* are possible the driver must already be checking those with a call
* to cfg80211_check_combinations(), in which case we'll validate more
* through the cfg80211_calculate_bi_data() call and code in
* cfg80211_iter_combinations().
*/
if (beacon_int < 10 || beacon_int > 10000)
return -EINVAL;
return 0;
}
int cfg80211_iter_combinations(struct wiphy *wiphy,
struct iface_combination_params *params,
void (*iter)(const struct ieee80211_iface_combination *c,
void *data),
void *data)
{
const struct wiphy_radio *radio = NULL;
const struct ieee80211_iface_combination *c, *cs;
const struct ieee80211_regdomain *regdom;
enum nl80211_dfs_regions region = 0;
int i, j, n, iftype;
int num_interfaces = 0;
u32 used_iftypes = 0;
u32 beacon_int_gcd;
bool beacon_int_different;
if (params->radio_idx >= 0)
radio = &wiphy->radio[params->radio_idx];
/*
* This is a bit strange, since the iteration used to rely only on
* the data given by the driver, but here it now relies on context,
* in form of the currently operating interfaces.
* This is OK for all current users, and saves us from having to
* push the GCD calculations into all the drivers.
* In the future, this should probably rely more on data that's in
* cfg80211 already - the only thing not would appear to be any new
* interfaces (while being brought up) and channel/radar data.
*/
cfg80211_calculate_bi_data(wiphy, params->new_beacon_int,
&beacon_int_gcd, &beacon_int_different,
params->radio_idx);
if (params->radar_detect) {
rcu_read_lock();
regdom = rcu_dereference(cfg80211_regdomain);
if (regdom)
region = regdom->dfs_region;
rcu_read_unlock();
}
for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
num_interfaces += params->iftype_num[iftype];
if (params->iftype_num[iftype] > 0 &&
!cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
used_iftypes |= BIT(iftype);
}
if (radio) {
cs = radio->iface_combinations;
n = radio->n_iface_combinations;
} else {
cs = wiphy->iface_combinations;
n = wiphy->n_iface_combinations;
}
for (i = 0; i < n; i++) {
struct ieee80211_iface_limit *limits;
u32 all_iftypes = 0;
c = &cs[i];
if (num_interfaces > c->max_interfaces)
continue;
if (params->num_different_channels > c->num_different_channels)
continue;
limits = kmemdup_array(c->limits, c->n_limits, sizeof(*limits),
GFP_KERNEL);
if (!limits)
return -ENOMEM;
for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
continue;
for (j = 0; j < c->n_limits; j++) {
all_iftypes |= limits[j].types;
if (!(limits[j].types & BIT(iftype)))
continue;
if (limits[j].max < params->iftype_num[iftype])
goto cont;
limits[j].max -= params->iftype_num[iftype];
}
}
if (params->radar_detect !=
(c->radar_detect_widths & params->radar_detect))
goto cont;
if (params->radar_detect && c->radar_detect_regions &&
!(c->radar_detect_regions & BIT(region)))
goto cont;
/* Finally check that all iftypes that we're currently
* using are actually part of this combination. If they
* aren't then we can't use this combination and have
* to continue to the next.
*/
if ((all_iftypes & used_iftypes) != used_iftypes)
goto cont;
if (beacon_int_gcd) {
if (c->beacon_int_min_gcd &&
beacon_int_gcd < c->beacon_int_min_gcd)
goto cont;
if (!c->beacon_int_min_gcd && beacon_int_different)
goto cont;
}
/* This combination covered all interface types and
* supported the requested numbers, so we're good.
*/
(*iter)(c, data);
cont:
kfree(limits);
}
return 0;
}
EXPORT_SYMBOL(cfg80211_iter_combinations);
static void
cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
void *data)
{
int *num = data;
(*num)++;
}
int cfg80211_check_combinations(struct wiphy *wiphy,
struct iface_combination_params *params)
{
int err, num = 0;
err = cfg80211_iter_combinations(wiphy, params,
cfg80211_iter_sum_ifcombs, &num);
if (err)
return err;
if (num == 0)
return -EBUSY;
return 0;
}
EXPORT_SYMBOL(cfg80211_check_combinations);
int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
const u8 *rates, unsigned int n_rates,
u32 *mask)
{
int i, j;
if (!sband)
return -EINVAL;
if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
return -EINVAL;
*mask = 0;
for (i = 0; i < n_rates; i++) {
int rate = (rates[i] & 0x7f) * 5;
bool found = false;
for (j = 0; j < sband->n_bitrates; j++) {
if (sband->bitrates[j].bitrate == rate) {
found = true;
*mask |= BIT(j);
break;
}
}
if (!found)
return -EINVAL;
}
/*
* mask must have at least one bit set here since we
* didn't accept a 0-length rates array nor allowed
* entries in the array that didn't exist
*/
return 0;
}
unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy)
{
enum nl80211_band band;
unsigned int n_channels = 0;
for (band = 0; band < NUM_NL80211_BANDS; band++)
if (wiphy->bands[band])
n_channels += wiphy->bands[band]->n_channels;
return n_channels;
}
EXPORT_SYMBOL(ieee80211_get_num_supported_channels);
int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
struct station_info *sinfo)
{
struct cfg80211_registered_device *rdev;
struct wireless_dev *wdev;
wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NULL dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000 [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705 Hardware name: RPT (r1) (DT) Workqueue: bat_events batadv_v_elp_throughput_metric_update pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core] lr : sta_set_sinfo+0xcc/0xbd4 sp : ffff000007b43ad0 x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98 x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000 x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000 x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000 x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000 x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90 x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000 Call trace: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] sta_set_sinfo+0xcc/0xbd4 ieee80211_get_station+0x2c/0x44 cfg80211_get_station+0x80/0x154 batadv_v_elp_get_throughput+0x138/0x1fc batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x1ec/0x414 worker_thread+0x70/0x46c kthread+0xdc/0xe0 ret_from_fork+0x10/0x20 Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814) This happens because STA has time to disconnect and reconnect before batadv_v_elp_throughput_metric_update() delayed work gets scheduled. In this situation, ath10k_sta_state() can be in the middle of resetting arsta data when the work queue get chance to be scheduled and ends up accessing it. Locking wiphy prevents that. Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API") Signed-off-by: Remi Pommarel <repk@triplefau.lt> Reviewed-by: Nicolas Escande <nico.escande@gmail.com> Acked-by: Antonio Quartulli <a@unstable.cc> Link: https://msgid.link/983b24a6a176e0800c01aedcd74480d9b551cb13.1716046653.git.repk@triplefau.lt Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-05-21 19:47:26 +00:00
int ret;
wdev = dev->ieee80211_ptr;
if (!wdev)
return -EOPNOTSUPP;
rdev = wiphy_to_rdev(wdev->wiphy);
if (!rdev->ops->get_station)
return -EOPNOTSUPP;
memset(sinfo, 0, sizeof(*sinfo));
wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NULL dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000 [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705 Hardware name: RPT (r1) (DT) Workqueue: bat_events batadv_v_elp_throughput_metric_update pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core] lr : sta_set_sinfo+0xcc/0xbd4 sp : ffff000007b43ad0 x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98 x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000 x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000 x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000 x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000 x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90 x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000 Call trace: ath10k_sta_statistics+0x10/0x2dc [ath10k_core] sta_set_sinfo+0xcc/0xbd4 ieee80211_get_station+0x2c/0x44 cfg80211_get_station+0x80/0x154 batadv_v_elp_get_throughput+0x138/0x1fc batadv_v_elp_throughput_metric_update+0x1c/0xa4 process_one_work+0x1ec/0x414 worker_thread+0x70/0x46c kthread+0xdc/0xe0 ret_from_fork+0x10/0x20 Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814) This happens because STA has time to disconnect and reconnect before batadv_v_elp_throughput_metric_update() delayed work gets scheduled. In this situation, ath10k_sta_state() can be in the middle of resetting arsta data when the work queue get chance to be scheduled and ends up accessing it. Locking wiphy prevents that. Fixes: 7406353d43c8 ("cfg80211: implement cfg80211_get_station cfg80211 API") Signed-off-by: Remi Pommarel <repk@triplefau.lt> Reviewed-by: Nicolas Escande <nico.escande@gmail.com> Acked-by: Antonio Quartulli <a@unstable.cc> Link: https://msgid.link/983b24a6a176e0800c01aedcd74480d9b551cb13.1716046653.git.repk@triplefau.lt Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-05-21 19:47:26 +00:00
wiphy_lock(&rdev->wiphy);
ret = rdev_get_station(rdev, dev, mac_addr, sinfo);
wiphy_unlock(&rdev->wiphy);
return ret;
}
EXPORT_SYMBOL(cfg80211_get_station);
void cfg80211_free_nan_func(struct cfg80211_nan_func *f)
{
int i;
if (!f)
return;
kfree(f->serv_spec_info);
kfree(f->srf_bf);
kfree(f->srf_macs);
for (i = 0; i < f->num_rx_filters; i++)
kfree(f->rx_filters[i].filter);
for (i = 0; i < f->num_tx_filters; i++)
kfree(f->tx_filters[i].filter);
kfree(f->rx_filters);
kfree(f->tx_filters);
kfree(f);
}
EXPORT_SYMBOL(cfg80211_free_nan_func);
bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
u32 center_freq_khz, u32 bw_khz)
{
u32 start_freq_khz, end_freq_khz;
start_freq_khz = center_freq_khz - (bw_khz / 2);
end_freq_khz = center_freq_khz + (bw_khz / 2);
if (start_freq_khz >= freq_range->start_freq_khz &&
end_freq_khz <= freq_range->end_freq_khz)
return true;
return false;
}
int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
{
sinfo->pertid = kcalloc(IEEE80211_NUM_TIDS + 1,
sizeof(*(sinfo->pertid)),
gfp);
if (!sinfo->pertid)
return -ENOMEM;
return 0;
}
EXPORT_SYMBOL(cfg80211_sinfo_alloc_tid_stats);
/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
const unsigned char rfc1042_header[] __aligned(2) =
{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
EXPORT_SYMBOL(rfc1042_header);
/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
const unsigned char bridge_tunnel_header[] __aligned(2) =
{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
EXPORT_SYMBOL(bridge_tunnel_header);
/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
struct iapp_layer2_update {
u8 da[ETH_ALEN]; /* broadcast */
u8 sa[ETH_ALEN]; /* STA addr */
__be16 len; /* 6 */
u8 dsap; /* 0 */
u8 ssap; /* 0 */
u8 control;
u8 xid_info[3];
} __packed;
void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
{
struct iapp_layer2_update *msg;
struct sk_buff *skb;
/* Send Level 2 Update Frame to update forwarding tables in layer 2
* bridge devices */
skb = dev_alloc_skb(sizeof(*msg));
if (!skb)
return;
msg = skb_put(skb, sizeof(*msg));
/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
* Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
eth_broadcast_addr(msg->da);
ether_addr_copy(msg->sa, addr);
msg->len = htons(6);
msg->dsap = 0;
msg->ssap = 0x01; /* NULL LSAP, CR Bit: Response */
msg->control = 0xaf; /* XID response lsb.1111F101.
* F=0 (no poll command; unsolicited frame) */
msg->xid_info[0] = 0x81; /* XID format identifier */
msg->xid_info[1] = 1; /* LLC types/classes: Type 1 LLC */
msg->xid_info[2] = 0; /* XID sender's receive window size (RW) */
skb->dev = dev;
skb->protocol = eth_type_trans(skb, dev);
memset(skb->cb, 0, sizeof(skb->cb));
netif_rx(skb);
}
EXPORT_SYMBOL(cfg80211_send_layer2_update);
int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
enum ieee80211_vht_chanwidth bw,
int mcs, bool ext_nss_bw_capable,
unsigned int max_vht_nss)
{
u16 map = le16_to_cpu(cap->supp_mcs.rx_mcs_map);
int ext_nss_bw;
int supp_width;
int i, mcs_encoding;
if (map == 0xffff)
return 0;
if (WARN_ON(mcs > 9 || max_vht_nss > 8))
return 0;
if (mcs <= 7)
mcs_encoding = 0;
else if (mcs == 8)
mcs_encoding = 1;
else
mcs_encoding = 2;
if (!max_vht_nss) {
/* find max_vht_nss for the given MCS */
for (i = 7; i >= 0; i--) {
int supp = (map >> (2 * i)) & 3;
if (supp == 3)
continue;
if (supp >= mcs_encoding) {
max_vht_nss = i + 1;
break;
}
}
}
if (!(cap->supp_mcs.tx_mcs_map &
cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE)))
return max_vht_nss;
ext_nss_bw = le32_get_bits(cap->vht_cap_info,
IEEE80211_VHT_CAP_EXT_NSS_BW_MASK);
supp_width = le32_get_bits(cap->vht_cap_info,
IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
/* if not capable, treat ext_nss_bw as 0 */
if (!ext_nss_bw_capable)
ext_nss_bw = 0;
/* This is invalid */
if (supp_width == 3)
return 0;
/* This is an invalid combination so pretend nothing is supported */
if (supp_width == 2 && (ext_nss_bw == 1 || ext_nss_bw == 2))
return 0;
/*
* Cover all the special cases according to IEEE 802.11-2016
* Table 9-250. All other cases are either factor of 1 or not
* valid/supported.
*/
switch (bw) {
case IEEE80211_VHT_CHANWIDTH_USE_HT:
case IEEE80211_VHT_CHANWIDTH_80MHZ:
if ((supp_width == 1 || supp_width == 2) &&
ext_nss_bw == 3)
return 2 * max_vht_nss;
break;
case IEEE80211_VHT_CHANWIDTH_160MHZ:
if (supp_width == 0 &&
(ext_nss_bw == 1 || ext_nss_bw == 2))
return max_vht_nss / 2;
if (supp_width == 0 &&
ext_nss_bw == 3)
return (3 * max_vht_nss) / 4;
if (supp_width == 1 &&
ext_nss_bw == 3)
return 2 * max_vht_nss;
break;
case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
if (supp_width == 0 && ext_nss_bw == 1)
return 0; /* not possible */
if (supp_width == 0 &&
ext_nss_bw == 2)
return max_vht_nss / 2;
if (supp_width == 0 &&
ext_nss_bw == 3)
return (3 * max_vht_nss) / 4;
if (supp_width == 1 &&
ext_nss_bw == 0)
return 0; /* not possible */
if (supp_width == 1 &&
ext_nss_bw == 1)
return max_vht_nss / 2;
if (supp_width == 1 &&
ext_nss_bw == 2)
return (3 * max_vht_nss) / 4;
break;
}
/* not covered or invalid combination received */
return max_vht_nss;
}
EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
bool is_4addr, u8 check_swif)
{
bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
switch (check_swif) {
case 0:
if (is_vlan && is_4addr)
return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
return wiphy->interface_modes & BIT(iftype);
case 1:
if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
return wiphy->software_iftypes & BIT(iftype);
default:
break;
}
return false;
}
EXPORT_SYMBOL(cfg80211_iftype_allowed);
void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id)
{
struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
lockdep_assert_wiphy(wdev->wiphy);
switch (wdev->iftype) {
case NL80211_IFTYPE_AP:
case NL80211_IFTYPE_P2P_GO:
cfg80211_stop_ap(rdev, wdev->netdev, link_id, true);
break;
default:
/* per-link not relevant */
break;
}
wdev->valid_links &= ~BIT(link_id);
rdev_del_intf_link(rdev, wdev, link_id);
eth_zero_addr(wdev->links[link_id].addr);
}
void cfg80211_remove_links(struct wireless_dev *wdev)
{
unsigned int link_id;
/*
* links are controlled by upper layers (userspace/cfg)
* only for AP mode, so only remove them here for AP
*/
if (wdev->iftype != NL80211_IFTYPE_AP)
return;
if (wdev->valid_links) {
for_each_valid_link(wdev, link_id)
cfg80211_remove_link(wdev, link_id);
}
}
int cfg80211_remove_virtual_intf(struct cfg80211_registered_device *rdev,
struct wireless_dev *wdev)
{
cfg80211_remove_links(wdev);
return rdev_del_virtual_intf(rdev, wdev);
}
const struct wiphy_iftype_ext_capab *
cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type)
{
int i;
for (i = 0; i < wiphy->num_iftype_ext_capab; i++) {
if (wiphy->iftype_ext_capab[i].iftype == type)
return &wiphy->iftype_ext_capab[i];
}
return NULL;
}
EXPORT_SYMBOL(cfg80211_get_iftype_ext_capa);
static bool
ieee80211_radio_freq_range_valid(const struct wiphy_radio *radio,
u32 freq, u32 width)
{
const struct wiphy_radio_freq_range *r;
int i;
for (i = 0; i < radio->n_freq_range; i++) {
r = &radio->freq_range[i];
if (freq - width / 2 >= r->start_freq &&
freq + width / 2 <= r->end_freq)
return true;
}
return false;
}
bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio,
const struct cfg80211_chan_def *chandef)
{
u32 freq, width;
freq = ieee80211_chandef_to_khz(chandef);
width = nl80211_chan_width_to_mhz(chandef->width);
if (!ieee80211_radio_freq_range_valid(radio, freq, width))
return false;
freq = MHZ_TO_KHZ(chandef->center_freq2);
if (freq && !ieee80211_radio_freq_range_valid(radio, freq, width))
return false;
return true;
}
EXPORT_SYMBOL(cfg80211_radio_chandef_valid);