1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright 2002-2005, Instant802 Networks, Inc.
4 * Copyright 2005-2006, Devicescape Software, Inc.
5 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
6 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
7 * Copyright 2013-2014 Intel Mobile Communications GmbH
8 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9 * Copyright (C) 2018-2026 Intel Corporation
10 */
11
12 #include <linux/jiffies.h>
13 #include <linux/slab.h>
14 #include <linux/kernel.h>
15 #include <linux/skbuff.h>
16 #include <linux/netdevice.h>
17 #include <linux/etherdevice.h>
18 #include <linux/rcupdate.h>
19 #include <linux/export.h>
20 #include <linux/kcov.h>
21 #include <linux/bitops.h>
22 #include <kunit/visibility.h>
23 #include <net/mac80211.h>
24 #include <net/ieee80211_radiotap.h>
25 #include <linux/unaligned.h>
26
27 #include "ieee80211_i.h"
28 #include "driver-ops.h"
29 #include "led.h"
30 #include "mesh.h"
31 #include "wep.h"
32 #include "wpa.h"
33 #include "tkip.h"
34 #include "wme.h"
35 #include "rate.h"
36
37 /*
38 * monitor mode reception
39 *
40 * This function cleans up the SKB, i.e. it removes all the stuff
41 * only useful for monitoring.
42 */
ieee80211_clean_skb(struct sk_buff * skb,unsigned int present_fcs_len,unsigned int rtap_space)43 static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
44 unsigned int present_fcs_len,
45 unsigned int rtap_space)
46 {
47 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
48 struct ieee80211_hdr *hdr;
49 unsigned int hdrlen;
50 __le16 fc;
51
52 if (present_fcs_len)
53 __pskb_trim(skb, skb->len - present_fcs_len);
54 pskb_pull(skb, rtap_space);
55
56 /* After pulling radiotap header, clear all flags that indicate
57 * info in skb->data.
58 */
59 status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |
60 RX_FLAG_RADIOTAP_LSIG |
61 RX_FLAG_RADIOTAP_HE_MU |
62 RX_FLAG_RADIOTAP_HE |
63 RX_FLAG_RADIOTAP_VHT);
64
65 hdr = (void *)skb->data;
66 fc = hdr->frame_control;
67
68 /*
69 * Remove the HT-Control field (if present) on management
70 * frames after we've sent the frame to monitoring. We
71 * (currently) don't need it, and don't properly parse
72 * frames with it present, due to the assumption of a
73 * fixed management header length.
74 */
75 if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
76 return skb;
77
78 hdrlen = ieee80211_hdrlen(fc);
79 hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
80
81 if (!pskb_may_pull(skb, hdrlen)) {
82 dev_kfree_skb(skb);
83 return NULL;
84 }
85
86 memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
87 hdrlen - IEEE80211_HT_CTL_LEN);
88 pskb_pull(skb, IEEE80211_HT_CTL_LEN);
89
90 return skb;
91 }
92
should_drop_frame(struct sk_buff * skb,int present_fcs_len,unsigned int rtap_space)93 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
94 unsigned int rtap_space)
95 {
96 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
97 struct ieee80211_hdr *hdr;
98
99 hdr = (void *)(skb->data + rtap_space);
100
101 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
102 RX_FLAG_FAILED_PLCP_CRC |
103 RX_FLAG_ONLY_MONITOR |
104 RX_FLAG_NO_PSDU))
105 return true;
106
107 if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
108 return true;
109
110 if (ieee80211_is_ctl(hdr->frame_control) &&
111 !ieee80211_is_pspoll(hdr->frame_control) &&
112 !ieee80211_is_back_req(hdr->frame_control))
113 return true;
114
115 return false;
116 }
117
118 static int
ieee80211_rx_radiotap_hdrlen(struct ieee80211_local * local,struct ieee80211_rx_status * status,struct sk_buff * skb)119 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
120 struct ieee80211_rx_status *status,
121 struct sk_buff *skb)
122 {
123 int len;
124
125 /* always present fields */
126 len = sizeof(struct ieee80211_radiotap_header) + 8;
127
128 /* allocate extra bitmaps */
129 if (status->chains)
130 len += 4 * hweight8(status->chains);
131
132 if (ieee80211_have_rx_timestamp(status)) {
133 len = ALIGN(len, 8);
134 len += 8;
135 }
136 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
137 len += 1;
138
139 /* antenna field, if we don't have per-chain info */
140 if (!status->chains)
141 len += 1;
142
143 /* padding for RX_FLAGS if necessary */
144 len = ALIGN(len, 2);
145
146 if (status->encoding == RX_ENC_HT) /* HT info */
147 len += 3;
148
149 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
150 len = ALIGN(len, 4);
151 len += 8;
152 }
153
154 if (status->encoding == RX_ENC_VHT) {
155 /* Included even if RX_FLAG_RADIOTAP_VHT is not set */
156 len = ALIGN(len, 2);
157 len += 12;
158 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_vht) != 12);
159 }
160
161 if (local->hw.radiotap_timestamp.units_pos >= 0) {
162 len = ALIGN(len, 8);
163 len += 12;
164 }
165
166 if (status->encoding == RX_ENC_HE &&
167 status->flag & RX_FLAG_RADIOTAP_HE) {
168 len = ALIGN(len, 2);
169 len += 12;
170 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
171 }
172
173 if (status->encoding == RX_ENC_HE &&
174 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
175 len = ALIGN(len, 2);
176 len += 12;
177 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
178 }
179
180 if (status->flag & RX_FLAG_NO_PSDU)
181 len += 1;
182
183 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
184 len = ALIGN(len, 2);
185 len += 4;
186 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
187 }
188
189 if (status->chains) {
190 /* antenna and antenna signal fields */
191 len += 2 * hweight8(status->chains);
192 }
193
194 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
195 int tlv_offset = 0;
196
197 /*
198 * The position to look at depends on the existence (or non-
199 * existence) of other elements, so take that into account...
200 */
201 if (status->flag & RX_FLAG_RADIOTAP_VHT)
202 tlv_offset +=
203 sizeof(struct ieee80211_radiotap_vht);
204 if (status->flag & RX_FLAG_RADIOTAP_HE)
205 tlv_offset +=
206 sizeof(struct ieee80211_radiotap_he);
207 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
208 tlv_offset +=
209 sizeof(struct ieee80211_radiotap_he_mu);
210 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
211 tlv_offset +=
212 sizeof(struct ieee80211_radiotap_lsig);
213
214 /* ensure 4 byte alignment for TLV */
215 len = ALIGN(len, 4);
216
217 /* TLVs until the mac header */
218 len += skb_mac_header(skb) - &skb->data[tlv_offset];
219 }
220
221 return len;
222 }
223
__ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data * sdata,int link_id,struct sta_info * sta,struct sk_buff * skb)224 static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
225 int link_id,
226 struct sta_info *sta,
227 struct sk_buff *skb)
228 {
229 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
230
231 if (link_id >= 0) {
232 status->link_valid = 1;
233 status->link_id = link_id;
234 } else {
235 status->link_valid = 0;
236 }
237
238 skb_queue_tail(&sdata->skb_queue, skb);
239 wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
240 if (sta) {
241 struct link_sta_info *link_sta_info;
242
243 if (link_id >= 0) {
244 link_sta_info = rcu_dereference(sta->link[link_id]);
245 if (!link_sta_info)
246 return;
247 } else {
248 link_sta_info = &sta->deflink;
249 }
250
251 link_sta_info->rx_stats.packets++;
252 }
253 }
254
ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data * sdata,int link_id,struct sta_info * sta,struct sk_buff * skb)255 static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
256 int link_id,
257 struct sta_info *sta,
258 struct sk_buff *skb)
259 {
260 skb->protocol = 0;
261 __ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
262 }
263
ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int rtap_space)264 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
265 struct sk_buff *skb,
266 int rtap_space)
267 {
268 struct {
269 struct ieee80211_hdr_3addr hdr;
270 u8 category;
271 u8 action_code;
272 } __packed __aligned(2) action;
273
274 if (!sdata)
275 return;
276
277 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE(action_code));
278
279 if (skb->len < rtap_space + sizeof(action) +
280 VHT_MUMIMO_GROUPS_DATA_LEN)
281 return;
282
283 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
284 return;
285
286 skb_copy_bits(skb, rtap_space, &action, sizeof(action));
287
288 if (!ieee80211_is_action(action.hdr.frame_control))
289 return;
290
291 if (action.category != WLAN_CATEGORY_VHT)
292 return;
293
294 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
295 return;
296
297 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
298 return;
299
300 skb = skb_copy(skb, GFP_ATOMIC);
301 if (!skb)
302 return;
303
304 ieee80211_queue_skb_to_iface(sdata, -1, NULL, skb);
305 }
306
307 /*
308 * ieee80211_add_rx_radiotap_header - add radiotap header
309 *
310 * add a radiotap header containing all the fields which the hardware provided.
311 */
312 static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local * local,struct sk_buff * skb,struct ieee80211_rate * rate,int rtap_len,bool has_fcs)313 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
314 struct sk_buff *skb,
315 struct ieee80211_rate *rate,
316 int rtap_len, bool has_fcs)
317 {
318 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
319 struct ieee80211_radiotap_header *rthdr;
320 unsigned char *pos;
321 __le32 *it_present;
322 u32 it_present_val;
323 u16 rx_flags = 0;
324 u16 channel_flags = 0;
325 u32 tlvs_len = 0;
326 int mpdulen, chain;
327 unsigned long chains = status->chains;
328 struct ieee80211_radiotap_vht vht = {};
329 struct ieee80211_radiotap_he he = {};
330 struct ieee80211_radiotap_he_mu he_mu = {};
331 struct ieee80211_radiotap_lsig lsig = {};
332
333 if (status->flag & RX_FLAG_RADIOTAP_VHT) {
334 vht = *(struct ieee80211_radiotap_vht *)skb->data;
335 skb_pull(skb, sizeof(vht));
336 WARN_ON_ONCE(status->encoding != RX_ENC_VHT);
337 }
338
339 if (status->flag & RX_FLAG_RADIOTAP_HE) {
340 he = *(struct ieee80211_radiotap_he *)skb->data;
341 skb_pull(skb, sizeof(he));
342 WARN_ON_ONCE(status->encoding != RX_ENC_HE);
343 }
344
345 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
346 he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
347 skb_pull(skb, sizeof(he_mu));
348 }
349
350 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
351 lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
352 skb_pull(skb, sizeof(lsig));
353 }
354
355 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
356 /* data is pointer at tlv all other info was pulled off */
357 tlvs_len = skb_mac_header(skb) - skb->data;
358 }
359
360 mpdulen = skb->len;
361 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
362 mpdulen += FCS_LEN;
363
364 rthdr = skb_push(skb, rtap_len - tlvs_len);
365 memset(rthdr, 0, rtap_len - tlvs_len);
366 it_present = &rthdr->it_present;
367
368 /* radiotap header, set always present flags */
369 rthdr->it_len = cpu_to_le16(rtap_len);
370 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
371 BIT(IEEE80211_RADIOTAP_CHANNEL) |
372 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
373
374 if (!status->chains)
375 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
376
377 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
378 it_present_val |=
379 BIT(IEEE80211_RADIOTAP_EXT) |
380 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
381 put_unaligned_le32(it_present_val, it_present);
382 it_present++;
383 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
384 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
385 }
386
387 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
388 it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
389
390 put_unaligned_le32(it_present_val, it_present);
391
392 /* This references through an offset into it_optional[] rather
393 * than via it_present otherwise later uses of pos will cause
394 * the compiler to think we have walked past the end of the
395 * struct member.
396 */
397 pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
398
399 /* the order of the following fields is important */
400
401 /* IEEE80211_RADIOTAP_TSFT */
402 if (ieee80211_have_rx_timestamp(status)) {
403 /* padding */
404 while ((pos - (u8 *)rthdr) & 7)
405 *pos++ = 0;
406 put_unaligned_le64(
407 ieee80211_calculate_rx_timestamp(&local->hw, status,
408 mpdulen, 0),
409 pos);
410 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
411 pos += 8;
412 }
413
414 /* IEEE80211_RADIOTAP_FLAGS */
415 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
416 *pos |= IEEE80211_RADIOTAP_F_FCS;
417 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
418 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
419 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
420 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
421 pos++;
422
423 /* IEEE80211_RADIOTAP_RATE */
424 if (!rate || status->encoding != RX_ENC_LEGACY) {
425 /*
426 * Without rate information don't add it. If we have,
427 * MCS information is a separate field in radiotap,
428 * added below. The byte here is needed as padding
429 * for the channel though, so initialise it to 0.
430 */
431 *pos = 0;
432 } else {
433 int shift = 0;
434 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
435 if (status->bw == RATE_INFO_BW_10)
436 shift = 1;
437 else if (status->bw == RATE_INFO_BW_5)
438 shift = 2;
439 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
440 }
441 pos++;
442
443 /* IEEE80211_RADIOTAP_CHANNEL */
444 /* TODO: frequency offset in KHz */
445 put_unaligned_le16(status->freq, pos);
446 pos += 2;
447 if (status->bw == RATE_INFO_BW_10)
448 channel_flags |= IEEE80211_CHAN_HALF;
449 else if (status->bw == RATE_INFO_BW_5)
450 channel_flags |= IEEE80211_CHAN_QUARTER;
451
452 if (status->band == NL80211_BAND_5GHZ ||
453 status->band == NL80211_BAND_6GHZ)
454 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
455 else if (status->encoding != RX_ENC_LEGACY)
456 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
457 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
458 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
459 else if (rate)
460 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
461 else
462 channel_flags |= IEEE80211_CHAN_2GHZ;
463 put_unaligned_le16(channel_flags, pos);
464 pos += 2;
465
466 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
467 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
468 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
469 *pos = status->signal;
470 rthdr->it_present |=
471 cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
472 pos++;
473 }
474
475 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
476
477 if (!status->chains) {
478 /* IEEE80211_RADIOTAP_ANTENNA */
479 *pos = status->antenna;
480 pos++;
481 }
482
483 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
484
485 /* IEEE80211_RADIOTAP_RX_FLAGS */
486 /* ensure 2 byte alignment for the 2 byte field as required */
487 if ((pos - (u8 *)rthdr) & 1)
488 *pos++ = 0;
489 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
490 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
491 put_unaligned_le16(rx_flags, pos);
492 pos += 2;
493
494 if (status->encoding == RX_ENC_HT) {
495 unsigned int stbc;
496
497 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
498 *pos = local->hw.radiotap_mcs_details;
499 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
500 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
501 if (status->enc_flags & RX_ENC_FLAG_LDPC)
502 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
503 pos++;
504 *pos = 0;
505 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
506 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
507 if (status->bw == RATE_INFO_BW_40)
508 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
509 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
510 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
511 if (status->enc_flags & RX_ENC_FLAG_LDPC)
512 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
513 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
514 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
515 pos++;
516 *pos++ = status->rate_idx;
517 }
518
519 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
520 u16 flags = 0;
521
522 /* ensure 4 byte alignment */
523 while ((pos - (u8 *)rthdr) & 3)
524 pos++;
525 rthdr->it_present |=
526 cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
527 put_unaligned_le32(status->ampdu_reference, pos);
528 pos += 4;
529 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
530 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
531 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
532 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
533 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
534 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
535 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
536 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
537 if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
538 flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
539 put_unaligned_le16(flags, pos);
540 pos += 2;
541 *pos++ = 0;
542 *pos++ = 0;
543 }
544
545 if (status->encoding == RX_ENC_VHT) {
546 u16 fill = local->hw.radiotap_vht_details;
547
548 /* Leave driver filled fields alone */
549 fill &= ~le16_to_cpu(vht.known);
550 vht.known |= cpu_to_le16(fill);
551
552 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_GI &&
553 status->enc_flags & RX_ENC_FLAG_SHORT_GI)
554 vht.flags |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
555 /* in VHT, STBC is binary */
556 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_STBC &&
557 status->enc_flags & RX_ENC_FLAG_STBC_MASK)
558 vht.flags |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
559 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED &&
560 status->enc_flags & RX_ENC_FLAG_BF)
561 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
562
563 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH) {
564 switch (status->bw) {
565 case RATE_INFO_BW_40:
566 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_40;
567 break;
568 case RATE_INFO_BW_80:
569 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_80;
570 break;
571 case RATE_INFO_BW_160:
572 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_160;
573 break;
574 default:
575 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_20;
576 break;
577 }
578 }
579
580 /*
581 * If the driver filled in mcs_nss[0], then do not touch it.
582 *
583 * Otherwise, put some information about MCS/NSS into the
584 * user 0 field. Note that this is not technically correct for
585 * an MU frame as we might have decoded a different user.
586 */
587 if (!vht.mcs_nss[0]) {
588 vht.mcs_nss[0] = (status->rate_idx << 4) | status->nss;
589
590 /* coding field */
591 if (status->enc_flags & RX_ENC_FLAG_LDPC)
592 vht.coding |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
593 }
594
595 /* ensure 2 byte alignment */
596 while ((pos - (u8 *)rthdr) & 1)
597 pos++;
598 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
599 memcpy(pos, &vht, sizeof(vht));
600 pos += sizeof(vht);
601 }
602
603 if (local->hw.radiotap_timestamp.units_pos >= 0) {
604 u16 accuracy = 0;
605 u8 flags;
606 u64 ts;
607
608 rthdr->it_present |=
609 cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
610
611 /* ensure 8 byte alignment */
612 while ((pos - (u8 *)rthdr) & 7)
613 pos++;
614
615 if (status->flag & RX_FLAG_MACTIME_IS_RTAP_TS64) {
616 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT;
617 ts = status->mactime;
618 } else {
619 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
620 ts = status->device_timestamp;
621 }
622
623 put_unaligned_le64(ts, pos);
624 pos += sizeof(u64);
625
626 if (local->hw.radiotap_timestamp.accuracy >= 0) {
627 accuracy = local->hw.radiotap_timestamp.accuracy;
628 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
629 }
630 put_unaligned_le16(accuracy, pos);
631 pos += sizeof(u16);
632
633 *pos++ = local->hw.radiotap_timestamp.units_pos;
634 *pos++ = flags;
635 }
636
637 if (status->encoding == RX_ENC_HE &&
638 status->flag & RX_FLAG_RADIOTAP_HE) {
639 #define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
640
641 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
642 he.data6 |= HE_PREP(DATA6_NSTS,
643 FIELD_GET(RX_ENC_FLAG_STBC_MASK,
644 status->enc_flags));
645 he.data3 |= HE_PREP(DATA3_STBC, 1);
646 } else {
647 he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
648 }
649
650 #define CHECK_GI(s) \
651 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
652 (int)NL80211_RATE_INFO_HE_GI_##s)
653
654 CHECK_GI(0_8);
655 CHECK_GI(1_6);
656 CHECK_GI(3_2);
657
658 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
659 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
660 he.data3 |= HE_PREP(DATA3_CODING,
661 !!(status->enc_flags & RX_ENC_FLAG_LDPC));
662
663 he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
664
665 switch (status->bw) {
666 case RATE_INFO_BW_20:
667 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
668 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
669 break;
670 case RATE_INFO_BW_40:
671 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
672 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
673 break;
674 case RATE_INFO_BW_80:
675 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
676 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
677 break;
678 case RATE_INFO_BW_160:
679 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
680 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
681 break;
682 case RATE_INFO_BW_HE_RU:
683 #define CHECK_RU_ALLOC(s) \
684 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
685 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
686
687 CHECK_RU_ALLOC(26);
688 CHECK_RU_ALLOC(52);
689 CHECK_RU_ALLOC(106);
690 CHECK_RU_ALLOC(242);
691 CHECK_RU_ALLOC(484);
692 CHECK_RU_ALLOC(996);
693 CHECK_RU_ALLOC(2x996);
694
695 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
696 status->he_ru + 4);
697 break;
698 default:
699 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
700 }
701
702 /* ensure 2 byte alignment */
703 while ((pos - (u8 *)rthdr) & 1)
704 pos++;
705 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
706 memcpy(pos, &he, sizeof(he));
707 pos += sizeof(he);
708 }
709
710 if (status->encoding == RX_ENC_HE &&
711 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
712 /* ensure 2 byte alignment */
713 while ((pos - (u8 *)rthdr) & 1)
714 pos++;
715 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
716 memcpy(pos, &he_mu, sizeof(he_mu));
717 pos += sizeof(he_mu);
718 }
719
720 if (status->flag & RX_FLAG_NO_PSDU) {
721 rthdr->it_present |=
722 cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
723 *pos++ = status->zero_length_psdu_type;
724 }
725
726 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
727 /* ensure 2 byte alignment */
728 while ((pos - (u8 *)rthdr) & 1)
729 pos++;
730 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
731 memcpy(pos, &lsig, sizeof(lsig));
732 pos += sizeof(lsig);
733 }
734
735 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
736 *pos++ = status->chain_signal[chain];
737 *pos++ = chain;
738 }
739 }
740
741 static struct sk_buff *
ieee80211_make_monitor_skb(struct ieee80211_local * local,struct sk_buff ** origskb,struct ieee80211_rate * rate,int rtap_space,bool use_origskb)742 ieee80211_make_monitor_skb(struct ieee80211_local *local,
743 struct sk_buff **origskb,
744 struct ieee80211_rate *rate,
745 int rtap_space, bool use_origskb)
746 {
747 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
748 int rt_hdrlen, needed_headroom;
749 struct sk_buff *skb;
750
751 /* room for the radiotap header based on driver features */
752 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
753 needed_headroom = rt_hdrlen - rtap_space;
754
755 if (use_origskb) {
756 /* only need to expand headroom if necessary */
757 skb = *origskb;
758 *origskb = NULL;
759
760 /*
761 * This shouldn't trigger often because most devices have an
762 * RX header they pull before we get here, and that should
763 * be big enough for our radiotap information. We should
764 * probably export the length to drivers so that we can have
765 * them allocate enough headroom to start with.
766 */
767 if (skb_headroom(skb) < needed_headroom &&
768 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
769 dev_kfree_skb(skb);
770 return NULL;
771 }
772 } else {
773 /*
774 * Need to make a copy and possibly remove radiotap header
775 * and FCS from the original.
776 */
777 skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD,
778 0, GFP_ATOMIC);
779
780 if (!skb)
781 return NULL;
782 }
783
784 /* prepend radiotap information */
785 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
786
787 skb_reset_mac_header(skb);
788 skb->ip_summed = CHECKSUM_UNNECESSARY;
789 skb->pkt_type = PACKET_OTHERHOST;
790 skb->protocol = htons(ETH_P_802_2);
791
792 return skb;
793 }
794
795 static bool
ieee80211_validate_monitor_radio(struct ieee80211_sub_if_data * sdata,struct ieee80211_local * local,struct ieee80211_rx_status * status)796 ieee80211_validate_monitor_radio(struct ieee80211_sub_if_data *sdata,
797 struct ieee80211_local *local,
798 struct ieee80211_rx_status *status)
799 {
800 struct wiphy *wiphy = local->hw.wiphy;
801 int i, freq, bw;
802
803 if (!wiphy->n_radio)
804 return true;
805
806 switch (status->bw) {
807 case RATE_INFO_BW_20:
808 bw = 20000;
809 break;
810 case RATE_INFO_BW_40:
811 bw = 40000;
812 break;
813 case RATE_INFO_BW_80:
814 bw = 80000;
815 break;
816 case RATE_INFO_BW_160:
817 bw = 160000;
818 break;
819 case RATE_INFO_BW_320:
820 bw = 320000;
821 break;
822 default:
823 return false;
824 }
825
826 freq = MHZ_TO_KHZ(status->freq);
827
828 for (i = 0; i < wiphy->n_radio; i++) {
829 if (!(sdata->wdev.radio_mask & BIT(i)))
830 continue;
831
832 if (!ieee80211_radio_freq_range_valid(&wiphy->radio[i], freq, bw))
833 continue;
834
835 return true;
836 }
837 return false;
838 }
839
840 /*
841 * This function copies a received frame to all monitor interfaces and
842 * returns a cleaned-up SKB that no longer includes the FCS nor the
843 * radiotap header the driver might have added.
844 */
845 static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local * local,struct sk_buff * origskb,struct ieee80211_rate * rate)846 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
847 struct ieee80211_rate *rate)
848 {
849 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
850 struct ieee80211_sub_if_data *sdata, *prev_sdata = NULL;
851 struct sk_buff *skb, *monskb = NULL;
852 int present_fcs_len = 0;
853 unsigned int rtap_space = 0;
854 struct ieee80211_sub_if_data *monitor_sdata =
855 rcu_dereference(local->monitor_sdata);
856 bool only_monitor = false;
857 unsigned int min_head_len;
858
859 if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&
860 !skb_mac_header_was_set(origskb))) {
861 /* with this skb no way to know where frame payload starts */
862 dev_kfree_skb(origskb);
863 return NULL;
864 }
865
866 if (status->flag & RX_FLAG_RADIOTAP_VHT)
867 rtap_space += sizeof(struct ieee80211_radiotap_vht);
868
869 if (status->flag & RX_FLAG_RADIOTAP_HE)
870 rtap_space += sizeof(struct ieee80211_radiotap_he);
871
872 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
873 rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
874
875 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
876 rtap_space += sizeof(struct ieee80211_radiotap_lsig);
877
878 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
879 rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];
880
881 min_head_len = rtap_space;
882
883 /*
884 * First, we may need to make a copy of the skb because
885 * (1) we need to modify it for radiotap (if not present), and
886 * (2) the other RX handlers will modify the skb we got.
887 *
888 * We don't need to, of course, if we aren't going to return
889 * the SKB because it has a bad FCS/PLCP checksum.
890 */
891
892 if (!(status->flag & RX_FLAG_NO_PSDU)) {
893 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
894 if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
895 /* driver bug */
896 WARN_ON(1);
897 dev_kfree_skb(origskb);
898 return NULL;
899 }
900 present_fcs_len = FCS_LEN;
901 }
902
903 /* also consider the hdr->frame_control */
904 min_head_len += 2;
905 }
906
907 /* ensure that the expected data elements are in skb head */
908 if (!pskb_may_pull(origskb, min_head_len)) {
909 dev_kfree_skb(origskb);
910 return NULL;
911 }
912
913 only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space);
914
915 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
916 if (only_monitor) {
917 dev_kfree_skb(origskb);
918 return NULL;
919 }
920
921 return ieee80211_clean_skb(origskb, present_fcs_len,
922 rtap_space);
923 }
924
925 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space);
926
927 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
928 struct cfg80211_chan_def *chandef;
929
930 chandef = &sdata->vif.bss_conf.chanreq.oper;
931 if (chandef->chan &&
932 chandef->chan->center_freq != status->freq)
933 continue;
934
935 if (ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR) &&
936 !ieee80211_validate_monitor_radio(sdata, local, status))
937 continue;
938
939 if (!prev_sdata) {
940 prev_sdata = sdata;
941 continue;
942 }
943
944 if (ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR))
945 ieee80211_handle_mu_mimo_mon(sdata, origskb, rtap_space);
946
947 if (!monskb)
948 monskb = ieee80211_make_monitor_skb(local, &origskb,
949 rate, rtap_space,
950 false);
951 if (!monskb)
952 continue;
953
954 skb = skb_clone(monskb, GFP_ATOMIC);
955 if (!skb)
956 continue;
957
958 skb->dev = prev_sdata->dev;
959 dev_sw_netstats_rx_add(skb->dev, skb->len);
960 netif_receive_skb(skb);
961 prev_sdata = sdata;
962 }
963
964 if (prev_sdata) {
965 if (monskb)
966 skb = monskb;
967 else
968 skb = ieee80211_make_monitor_skb(local, &origskb,
969 rate, rtap_space,
970 only_monitor);
971 if (skb) {
972 skb->dev = prev_sdata->dev;
973 dev_sw_netstats_rx_add(skb->dev, skb->len);
974 netif_receive_skb(skb);
975 }
976 }
977
978 if (!origskb)
979 return NULL;
980
981 return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space);
982 }
983
ieee80211_parse_qos(struct ieee80211_rx_data * rx)984 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
985 {
986 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
987 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
988 int tid, seqno_idx, security_idx;
989
990 /* does the frame have a qos control field? */
991 if (ieee80211_is_data_qos(hdr->frame_control)) {
992 u8 *qc = ieee80211_get_qos_ctl(hdr);
993 /* frame has qos control */
994 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
995 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
996 status->rx_flags |= IEEE80211_RX_AMSDU;
997
998 seqno_idx = tid;
999 security_idx = tid;
1000 } else {
1001 /*
1002 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
1003 *
1004 * Sequence numbers for management frames, QoS data
1005 * frames with a broadcast/multicast address in the
1006 * Address 1 field, and all non-QoS data frames sent
1007 * by QoS STAs are assigned using an additional single
1008 * modulo-4096 counter, [...]
1009 *
1010 * We also use that counter for non-QoS STAs.
1011 */
1012 seqno_idx = IEEE80211_NUM_TIDS;
1013 security_idx = 0;
1014 if (ieee80211_is_mgmt(hdr->frame_control))
1015 security_idx = IEEE80211_NUM_TIDS;
1016 tid = 0;
1017 }
1018
1019 rx->seqno_idx = seqno_idx;
1020 rx->security_idx = security_idx;
1021 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
1022 * For now, set skb->priority to 0 for other cases. */
1023 rx->skb->priority = (tid > 7) ? 0 : tid;
1024 }
1025
1026 /**
1027 * DOC: Packet alignment
1028 *
1029 * Drivers always need to pass packets that are aligned to two-byte boundaries
1030 * to the stack.
1031 *
1032 * Additionally, they should, if possible, align the payload data in a way that
1033 * guarantees that the contained IP header is aligned to a four-byte
1034 * boundary. In the case of regular frames, this simply means aligning the
1035 * payload to a four-byte boundary (because either the IP header is directly
1036 * contained, or IV/RFC1042 headers that have a length divisible by four are
1037 * in front of it). If the payload data is not properly aligned and the
1038 * architecture doesn't support efficient unaligned operations, mac80211
1039 * will align the data.
1040 *
1041 * With A-MSDU frames, however, the payload data address must yield two modulo
1042 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
1043 * push the IP header further back to a multiple of four again. Thankfully, the
1044 * specs were sane enough this time around to require padding each A-MSDU
1045 * subframe to a length that is a multiple of four.
1046 *
1047 * Padding like Atheros hardware adds which is between the 802.11 header and
1048 * the payload is not supported; the driver is required to move the 802.11
1049 * header to be directly in front of the payload in that case.
1050 */
ieee80211_verify_alignment(struct ieee80211_rx_data * rx)1051 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
1052 {
1053 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1054 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
1055 #endif
1056 }
1057
1058
1059 /* rx handlers */
1060
ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff * skb)1061 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
1062 {
1063 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1064
1065 if (is_multicast_ether_addr(hdr->addr1))
1066 return 0;
1067
1068 return ieee80211_is_robust_mgmt_frame(skb);
1069 }
1070
1071
ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff * skb)1072 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
1073 {
1074 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1075
1076 if (!is_multicast_ether_addr(hdr->addr1))
1077 return 0;
1078
1079 return ieee80211_is_robust_mgmt_frame(skb);
1080 }
1081
1082
1083 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
ieee80211_get_mmie_keyidx(struct sk_buff * skb)1084 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
1085 {
1086 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
1087 struct ieee80211_mmie *mmie;
1088 struct ieee80211_mmie_16 *mmie16;
1089
1090 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
1091 return -1;
1092
1093 if (!ieee80211_is_robust_mgmt_frame(skb) &&
1094 !ieee80211_is_beacon(hdr->frame_control))
1095 return -1; /* not a robust management frame */
1096
1097 mmie = (struct ieee80211_mmie *)
1098 (skb->data + skb->len - sizeof(*mmie));
1099 if (mmie->element_id == WLAN_EID_MMIE &&
1100 mmie->length == sizeof(*mmie) - 2)
1101 return le16_to_cpu(mmie->key_id);
1102
1103 mmie16 = (struct ieee80211_mmie_16 *)
1104 (skb->data + skb->len - sizeof(*mmie16));
1105 if (skb->len >= 24 + sizeof(*mmie16) &&
1106 mmie16->element_id == WLAN_EID_MMIE &&
1107 mmie16->length == sizeof(*mmie16) - 2)
1108 return le16_to_cpu(mmie16->key_id);
1109
1110 return -1;
1111 }
1112
ieee80211_get_keyid(struct sk_buff * skb)1113 static int ieee80211_get_keyid(struct sk_buff *skb)
1114 {
1115 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1116 __le16 fc = hdr->frame_control;
1117 int hdrlen = ieee80211_hdrlen(fc);
1118 u8 keyid;
1119
1120 /* WEP, TKIP, CCMP and GCMP */
1121 if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
1122 return -EINVAL;
1123
1124 skb_copy_bits(skb, hdrlen + 3, &keyid, 1);
1125
1126 keyid >>= 6;
1127
1128 return keyid;
1129 }
1130
ieee80211_rx_mesh_check(struct ieee80211_rx_data * rx)1131 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1132 {
1133 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1134 char *dev_addr = rx->sdata->vif.addr;
1135
1136 if (ieee80211_is_data(hdr->frame_control)) {
1137 if (is_multicast_ether_addr(hdr->addr1)) {
1138 if (ieee80211_has_tods(hdr->frame_control) ||
1139 !ieee80211_has_fromds(hdr->frame_control))
1140 return RX_DROP_U_MESH_DS_BITS;
1141 if (ether_addr_equal(hdr->addr3, dev_addr))
1142 return RX_DROP_U_MESH_A3_MISMATCH;
1143 } else {
1144 if (!ieee80211_has_a4(hdr->frame_control))
1145 return RX_DROP_U_MESH_NO_A4;
1146 if (ether_addr_equal(hdr->addr4, dev_addr))
1147 return RX_DROP_U_MESH_A4_MISMATCH;
1148 }
1149 }
1150
1151 /* If there is not an established peer link and this is not a peer link
1152 * establisment frame, beacon or probe, drop the frame.
1153 */
1154
1155 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
1156 struct ieee80211_mgmt *mgmt;
1157
1158 if (!ieee80211_is_mgmt(hdr->frame_control))
1159 return RX_DROP_U_MESH_UNEXP_DATA;
1160
1161 if (ieee80211_is_action(hdr->frame_control)) {
1162 u8 category;
1163
1164 /* make sure category field is present */
1165 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(category))
1166 return RX_DROP_U_RUNT_ACTION;
1167
1168 mgmt = (struct ieee80211_mgmt *)hdr;
1169 category = mgmt->u.action.category;
1170 if (category != WLAN_CATEGORY_MESH_ACTION &&
1171 category != WLAN_CATEGORY_SELF_PROTECTED)
1172 return RX_DROP_U_MESH_WRONG_ACTION;
1173 return RX_CONTINUE;
1174 }
1175
1176 if (ieee80211_is_probe_req(hdr->frame_control) ||
1177 ieee80211_is_probe_resp(hdr->frame_control) ||
1178 ieee80211_is_beacon(hdr->frame_control) ||
1179 ieee80211_is_auth(hdr->frame_control))
1180 return RX_CONTINUE;
1181
1182 return RX_DROP_U_MESH_UNEXP_MGMT;
1183 }
1184
1185 return RX_CONTINUE;
1186 }
1187
ieee80211_rx_reorder_ready(struct tid_ampdu_rx * tid_agg_rx,int index)1188 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1189 int index)
1190 {
1191 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1192 struct sk_buff *tail = skb_peek_tail(frames);
1193 struct ieee80211_rx_status *status;
1194
1195 if (tid_agg_rx->reorder_buf_filtered &&
1196 tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1197 return true;
1198
1199 if (!tail)
1200 return false;
1201
1202 status = IEEE80211_SKB_RXCB(tail);
1203 if (status->flag & RX_FLAG_AMSDU_MORE)
1204 return false;
1205
1206 return true;
1207 }
1208
ieee80211_release_reorder_frame(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,int index,struct sk_buff_head * frames)1209 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1210 struct tid_ampdu_rx *tid_agg_rx,
1211 int index,
1212 struct sk_buff_head *frames)
1213 {
1214 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1215 struct sk_buff *skb;
1216 struct ieee80211_rx_status *status;
1217
1218 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1219
1220 if (skb_queue_empty(skb_list))
1221 goto no_frame;
1222
1223 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1224 __skb_queue_purge(skb_list);
1225 goto no_frame;
1226 }
1227
1228 /* release frames from the reorder ring buffer */
1229 tid_agg_rx->stored_mpdu_num--;
1230 while ((skb = __skb_dequeue(skb_list))) {
1231 status = IEEE80211_SKB_RXCB(skb);
1232 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1233 __skb_queue_tail(frames, skb);
1234 }
1235
1236 no_frame:
1237 if (tid_agg_rx->reorder_buf_filtered)
1238 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1239 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1240 }
1241
ieee80211_release_reorder_frames(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,u16 head_seq_num,struct sk_buff_head * frames)1242 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1243 struct tid_ampdu_rx *tid_agg_rx,
1244 u16 head_seq_num,
1245 struct sk_buff_head *frames)
1246 {
1247 int index;
1248
1249 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1250
1251 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
1252 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1253 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1254 frames);
1255 }
1256 }
1257
1258 /*
1259 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1260 * the skb was added to the buffer longer than this time ago, the earlier
1261 * frames that have not yet been received are assumed to be lost and the skb
1262 * can be released for processing. This may also release other skb's from the
1263 * reorder buffer if there are no additional gaps between the frames.
1264 *
1265 * Callers must hold tid_agg_rx->reorder_lock.
1266 */
1267 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1268
ieee80211_sta_reorder_release(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,struct sk_buff_head * frames)1269 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1270 struct tid_ampdu_rx *tid_agg_rx,
1271 struct sk_buff_head *frames)
1272 {
1273 int index, i, j;
1274
1275 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1276
1277 /* release the buffer until next missing frame */
1278 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1279 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1280 tid_agg_rx->stored_mpdu_num) {
1281 /*
1282 * No buffers ready to be released, but check whether any
1283 * frames in the reorder buffer have timed out.
1284 */
1285 int skipped = 1;
1286 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1287 j = (j + 1) % tid_agg_rx->buf_size) {
1288 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
1289 skipped++;
1290 continue;
1291 }
1292 if (skipped &&
1293 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
1294 HT_RX_REORDER_BUF_TIMEOUT))
1295 goto set_release_timer;
1296
1297 /* don't leave incomplete A-MSDUs around */
1298 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1299 i = (i + 1) % tid_agg_rx->buf_size)
1300 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
1301
1302 ht_dbg_ratelimited(sdata,
1303 "release an RX reorder frame due to timeout on earlier frames\n");
1304 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1305 frames);
1306
1307 /*
1308 * Increment the head seq# also for the skipped slots.
1309 */
1310 tid_agg_rx->head_seq_num =
1311 (tid_agg_rx->head_seq_num +
1312 skipped) & IEEE80211_SN_MASK;
1313 skipped = 0;
1314 }
1315 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1316 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1317 frames);
1318 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1319 }
1320
1321 if (tid_agg_rx->stored_mpdu_num) {
1322 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1323
1324 for (; j != (index - 1) % tid_agg_rx->buf_size;
1325 j = (j + 1) % tid_agg_rx->buf_size) {
1326 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
1327 break;
1328 }
1329
1330 set_release_timer:
1331
1332 if (!tid_agg_rx->removed)
1333 mod_timer(&tid_agg_rx->reorder_timer,
1334 tid_agg_rx->reorder_time[j] + 1 +
1335 HT_RX_REORDER_BUF_TIMEOUT);
1336 } else {
1337 timer_delete(&tid_agg_rx->reorder_timer);
1338 }
1339 }
1340
1341 /*
1342 * As this function belongs to the RX path it must be under
1343 * rcu_read_lock protection. It returns false if the frame
1344 * can be processed immediately, true if it was consumed.
1345 */
ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,struct sk_buff * skb,struct sk_buff_head * frames)1346 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1347 struct tid_ampdu_rx *tid_agg_rx,
1348 struct sk_buff *skb,
1349 struct sk_buff_head *frames)
1350 {
1351 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1352 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1353 u16 mpdu_seq_num = ieee80211_get_sn(hdr);
1354 u16 head_seq_num, buf_size;
1355 int index;
1356 bool ret = true;
1357
1358 spin_lock(&tid_agg_rx->reorder_lock);
1359
1360 /*
1361 * Offloaded BA sessions have no known starting sequence number so pick
1362 * one from first Rxed frame for this tid after BA was started.
1363 */
1364 if (unlikely(tid_agg_rx->auto_seq)) {
1365 tid_agg_rx->auto_seq = false;
1366 tid_agg_rx->ssn = mpdu_seq_num;
1367 tid_agg_rx->head_seq_num = mpdu_seq_num;
1368 }
1369
1370 buf_size = tid_agg_rx->buf_size;
1371 head_seq_num = tid_agg_rx->head_seq_num;
1372
1373 /*
1374 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1375 * be reordered.
1376 */
1377 if (unlikely(!tid_agg_rx->started)) {
1378 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1379 ret = false;
1380 goto out;
1381 }
1382 tid_agg_rx->started = true;
1383 }
1384
1385 /* frame with out of date sequence number */
1386 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1387 dev_kfree_skb(skb);
1388 goto out;
1389 }
1390
1391 /*
1392 * If frame the sequence number exceeds our buffering window
1393 * size release some previous frames to make room for this one.
1394 */
1395 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1396 head_seq_num = ieee80211_sn_inc(
1397 ieee80211_sn_sub(mpdu_seq_num, buf_size));
1398 /* release stored frames up to new head to stack */
1399 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1400 head_seq_num, frames);
1401 }
1402
1403 /* Now the new frame is always in the range of the reordering buffer */
1404
1405 index = mpdu_seq_num % tid_agg_rx->buf_size;
1406
1407 /* check if we already stored this frame */
1408 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1409 dev_kfree_skb(skb);
1410 goto out;
1411 }
1412
1413 /*
1414 * If the current MPDU is in the right order and nothing else
1415 * is stored we can process it directly, no need to buffer it.
1416 * If it is first but there's something stored, we may be able
1417 * to release frames after this one.
1418 */
1419 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1420 tid_agg_rx->stored_mpdu_num == 0) {
1421 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1422 tid_agg_rx->head_seq_num =
1423 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1424 ret = false;
1425 goto out;
1426 }
1427
1428 /* put the frame in the reordering buffer */
1429 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1430 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1431 tid_agg_rx->reorder_time[index] = jiffies;
1432 tid_agg_rx->stored_mpdu_num++;
1433 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1434 }
1435
1436 out:
1437 spin_unlock(&tid_agg_rx->reorder_lock);
1438 return ret;
1439 }
1440
1441 /*
1442 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1443 * true if the MPDU was buffered, false if it should be processed.
1444 */
ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data * rx,struct sk_buff_head * frames)1445 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1446 struct sk_buff_head *frames)
1447 {
1448 struct sk_buff *skb = rx->skb;
1449 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1450 struct sta_info *sta = rx->sta;
1451 struct tid_ampdu_rx *tid_agg_rx;
1452 u16 sc;
1453 u8 tid, ack_policy;
1454
1455 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1456 is_multicast_ether_addr(hdr->addr1))
1457 goto dont_reorder;
1458
1459 /*
1460 * filter the QoS data rx stream according to
1461 * STA/TID and check if this STA/TID is on aggregation
1462 */
1463
1464 if (!sta)
1465 goto dont_reorder;
1466
1467 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1468 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1469 tid = ieee80211_get_tid(hdr);
1470
1471 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1472 if (!tid_agg_rx) {
1473 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1474 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1475 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1476 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1477 WLAN_BACK_RECIPIENT,
1478 WLAN_REASON_QSTA_REQUIRE_SETUP,
1479 ieee80211_s1g_use_ndp_ba(rx->sdata,
1480 rx->sta));
1481 goto dont_reorder;
1482 }
1483
1484 /* qos null data frames are excluded */
1485 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1486 goto dont_reorder;
1487
1488 /* not part of a BA session */
1489 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
1490 goto dont_reorder;
1491
1492 /* new, potentially un-ordered, ampdu frame - process it */
1493
1494 /* reset session timer */
1495 if (tid_agg_rx->timeout)
1496 tid_agg_rx->last_rx = jiffies;
1497
1498 /* if this mpdu is fragmented - terminate rx aggregation session */
1499 sc = le16_to_cpu(hdr->seq_ctrl);
1500 if (sc & IEEE80211_SCTL_FRAG) {
1501 ieee80211_queue_skb_to_iface(rx->sdata, rx->link_id, NULL, skb);
1502 return;
1503 }
1504
1505 /*
1506 * No locking needed -- we will only ever process one
1507 * RX packet at a time, and thus own tid_agg_rx. All
1508 * other code manipulating it needs to (and does) make
1509 * sure that we cannot get to it any more before doing
1510 * anything with it.
1511 */
1512 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1513 frames))
1514 return;
1515
1516 dont_reorder:
1517 __skb_queue_tail(frames, skb);
1518 }
1519
1520 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_dup(struct ieee80211_rx_data * rx)1521 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1522 {
1523 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1524 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1525
1526 if (status->flag & RX_FLAG_DUP_VALIDATED)
1527 return RX_CONTINUE;
1528
1529 /*
1530 * Drop duplicate 802.11 retransmissions
1531 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1532 */
1533
1534 if (rx->skb->len < 24)
1535 return RX_CONTINUE;
1536
1537 if (ieee80211_is_ctl(hdr->frame_control) ||
1538 ieee80211_is_any_nullfunc(hdr->frame_control))
1539 return RX_CONTINUE;
1540
1541 if (!rx->sta)
1542 return RX_CONTINUE;
1543
1544 if (unlikely(is_multicast_ether_addr(hdr->addr1))) {
1545 struct ieee80211_sub_if_data *sdata = rx->sdata;
1546 u16 sn = ieee80211_get_sn(hdr);
1547
1548 if (!ieee80211_is_data_present(hdr->frame_control))
1549 return RX_CONTINUE;
1550
1551 if (!ieee80211_vif_is_mld(&sdata->vif) ||
1552 sdata->vif.type != NL80211_IFTYPE_STATION)
1553 return RX_CONTINUE;
1554
1555 if (sdata->u.mgd.mcast_seq_last != IEEE80211_SN_MODULO &&
1556 ieee80211_sn_less_eq(sn, sdata->u.mgd.mcast_seq_last))
1557 return RX_DROP_U_DUP;
1558
1559 sdata->u.mgd.mcast_seq_last = sn;
1560 return RX_CONTINUE;
1561 }
1562
1563 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1564 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1565 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1566 rx->link_sta->rx_stats.num_duplicates++;
1567 return RX_DROP_U_DUP;
1568 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1569 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1570 }
1571
1572 return RX_CONTINUE;
1573 }
1574
1575 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check(struct ieee80211_rx_data * rx)1576 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1577 {
1578 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1579
1580 /* Drop disallowed frame classes based on STA auth/assoc state;
1581 * IEEE 802.11, Chap 5.5.
1582 *
1583 * mac80211 filters only based on association state, i.e. it drops
1584 * Class 3 frames from not associated stations. hostapd sends
1585 * deauth/disassoc frames when needed. In addition, hostapd is
1586 * responsible for filtering on both auth and assoc states.
1587 */
1588
1589 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1590 return ieee80211_rx_mesh_check(rx);
1591
1592 /*
1593 * Wi-Fi Aware (TM) 4.0 specification 6.2.5:
1594 * For NAN_DATA, unicast data frames must have A2 (source)
1595 * assigned to an active NDP. If not the frame must be dropped
1596 * and NAN Data Path termination frame should be sent. Notify
1597 * user space so it can do so.
1598 */
1599 if (rx->sdata->vif.type == NL80211_IFTYPE_NAN_DATA) {
1600 if (ieee80211_is_data(hdr->frame_control) &&
1601 !is_multicast_ether_addr(hdr->addr1) &&
1602 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC))) {
1603 if (cfg80211_rx_spurious_frame(rx->sdata->dev, hdr->addr2,
1604 rx->link_id, GFP_ATOMIC))
1605 return RX_DROP_U_SPURIOUS_NOTIF;
1606 return RX_DROP_U_SPURIOUS;
1607 }
1608 return RX_CONTINUE;
1609 }
1610
1611 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1612 ieee80211_is_pspoll(hdr->frame_control)) &&
1613 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1614 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1615 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1616 /*
1617 * accept port control frames from the AP even when it's not
1618 * yet marked ASSOC to prevent a race where we don't set the
1619 * assoc bit quickly enough before it sends the first frame
1620 */
1621 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1622 ieee80211_is_data_present(hdr->frame_control)) {
1623 unsigned int hdrlen;
1624 __be16 ethertype;
1625
1626 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1627
1628 if (rx->skb->len < hdrlen + 8)
1629 return RX_DROP_U_RUNT_DATA;
1630
1631 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2);
1632 if (ethertype == rx->sdata->control_port_protocol)
1633 return RX_CONTINUE;
1634 }
1635
1636 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1637 cfg80211_rx_spurious_frame(rx->sdata->dev, hdr->addr2,
1638 rx->link_id, GFP_ATOMIC))
1639 return RX_DROP_U_SPURIOUS_NOTIF;
1640
1641 return RX_DROP_U_SPURIOUS;
1642 }
1643
1644 return RX_CONTINUE;
1645 }
1646
1647
1648 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data * rx)1649 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1650 {
1651 struct ieee80211_local *local;
1652 struct ieee80211_hdr *hdr;
1653 struct sk_buff *skb;
1654
1655 local = rx->local;
1656 skb = rx->skb;
1657 hdr = (struct ieee80211_hdr *) skb->data;
1658
1659 if (!local->pspolling)
1660 return RX_CONTINUE;
1661
1662 if (!ieee80211_has_fromds(hdr->frame_control))
1663 /* this is not from AP */
1664 return RX_CONTINUE;
1665
1666 if (!ieee80211_is_data(hdr->frame_control))
1667 return RX_CONTINUE;
1668
1669 if (!ieee80211_has_moredata(hdr->frame_control)) {
1670 /* AP has no more frames buffered for us */
1671 local->pspolling = false;
1672 return RX_CONTINUE;
1673 }
1674
1675 /* more data bit is set, let's request a new frame from the AP */
1676 ieee80211_send_pspoll(local, rx->sdata);
1677
1678 return RX_CONTINUE;
1679 }
1680
sta_ps_start(struct sta_info * sta)1681 static void sta_ps_start(struct sta_info *sta)
1682 {
1683 struct ieee80211_sub_if_data *sdata = sta->sdata;
1684 struct ieee80211_local *local = sdata->local;
1685 struct ps_data *ps;
1686 int tid;
1687
1688 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1689 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1690 ps = &sdata->bss->ps;
1691 else
1692 return;
1693
1694 atomic_inc(&ps->num_sta_ps);
1695 set_sta_flag(sta, WLAN_STA_PS_STA);
1696 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1697 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1698 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1699 sta->sta.addr, sta->sta.aid);
1700
1701 ieee80211_clear_fast_xmit(sta);
1702
1703 for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1704 struct ieee80211_txq *txq = sta->sta.txq[tid];
1705 struct txq_info *txqi = to_txq_info(txq);
1706
1707 spin_lock(&local->active_txq_lock[txq->ac]);
1708 if (!list_empty(&txqi->schedule_order))
1709 list_del_init(&txqi->schedule_order);
1710 spin_unlock(&local->active_txq_lock[txq->ac]);
1711
1712 if (txq_has_queue(txq))
1713 set_bit(tid, &sta->txq_buffered_tids);
1714 else
1715 clear_bit(tid, &sta->txq_buffered_tids);
1716 }
1717 }
1718
sta_ps_end(struct sta_info * sta)1719 static void sta_ps_end(struct sta_info *sta)
1720 {
1721 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1722 sta->sta.addr, sta->sta.aid);
1723
1724 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1725 /*
1726 * Clear the flag only if the other one is still set
1727 * so that the TX path won't start TX'ing new frames
1728 * directly ... In the case that the driver flag isn't
1729 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1730 */
1731 clear_sta_flag(sta, WLAN_STA_PS_STA);
1732 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1733 sta->sta.addr, sta->sta.aid);
1734 return;
1735 }
1736
1737 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1738 clear_sta_flag(sta, WLAN_STA_PS_STA);
1739 ieee80211_sta_ps_deliver_wakeup(sta);
1740 }
1741
ieee80211_sta_ps_transition(struct ieee80211_sta * pubsta,bool start)1742 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1743 {
1744 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1745 bool in_ps;
1746
1747 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1748
1749 /* Don't let the same PS state be set twice */
1750 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1751 if ((start && in_ps) || (!start && !in_ps))
1752 return -EINVAL;
1753
1754 if (start)
1755 sta_ps_start(sta);
1756 else
1757 sta_ps_end(sta);
1758
1759 return 0;
1760 }
1761 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1762
ieee80211_sta_pspoll(struct ieee80211_sta * pubsta)1763 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1764 {
1765 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1766
1767 if (test_sta_flag(sta, WLAN_STA_SP))
1768 return;
1769
1770 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1771 ieee80211_sta_ps_deliver_poll_response(sta);
1772 else
1773 set_sta_flag(sta, WLAN_STA_PSPOLL);
1774 }
1775 EXPORT_SYMBOL(ieee80211_sta_pspoll);
1776
ieee80211_sta_uapsd_trigger(struct ieee80211_sta * pubsta,u8 tid)1777 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1778 {
1779 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1780 int ac = ieee80211_ac_from_tid(tid);
1781
1782 /*
1783 * If this AC is not trigger-enabled do nothing unless the
1784 * driver is calling us after it already checked.
1785 *
1786 * NB: This could/should check a separate bitmap of trigger-
1787 * enabled queues, but for now we only implement uAPSD w/o
1788 * TSPEC changes to the ACs, so they're always the same.
1789 */
1790 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1791 tid != IEEE80211_NUM_TIDS)
1792 return;
1793
1794 /* if we are in a service period, do nothing */
1795 if (test_sta_flag(sta, WLAN_STA_SP))
1796 return;
1797
1798 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1799 ieee80211_sta_ps_deliver_uapsd(sta);
1800 else
1801 set_sta_flag(sta, WLAN_STA_UAPSD);
1802 }
1803 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1804
1805 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data * rx)1806 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1807 {
1808 struct ieee80211_sub_if_data *sdata = rx->sdata;
1809 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1810 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1811
1812 if (!rx->sta)
1813 return RX_CONTINUE;
1814
1815 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1816 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1817 return RX_CONTINUE;
1818
1819 /*
1820 * The device handles station powersave, so don't do anything about
1821 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1822 * it to mac80211 since they're handled.)
1823 */
1824 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1825 return RX_CONTINUE;
1826
1827 /*
1828 * Don't do anything if the station isn't already asleep. In
1829 * the uAPSD case, the station will probably be marked asleep,
1830 * in the PS-Poll case the station must be confused ...
1831 */
1832 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1833 return RX_CONTINUE;
1834
1835 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1836 ieee80211_sta_pspoll(&rx->sta->sta);
1837
1838 /* Free PS Poll skb here instead of returning RX_DROP that would
1839 * count as an dropped frame. */
1840 dev_kfree_skb(rx->skb);
1841
1842 return RX_QUEUED;
1843 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1844 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1845 ieee80211_has_pm(hdr->frame_control) &&
1846 (ieee80211_is_data_qos(hdr->frame_control) ||
1847 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1848 u8 tid = ieee80211_get_tid(hdr);
1849
1850 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1851 }
1852
1853 return RX_CONTINUE;
1854 }
1855
1856 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_sta_process(struct ieee80211_rx_data * rx)1857 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1858 {
1859 struct sta_info *sta = rx->sta;
1860 struct link_sta_info *link_sta = rx->link_sta;
1861 struct sk_buff *skb = rx->skb;
1862 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1863 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1864 int i;
1865
1866 if (!sta || !link_sta)
1867 return RX_CONTINUE;
1868
1869 /*
1870 * Update last_rx only for IBSS packets which are for the current
1871 * BSSID and for station already AUTHORIZED to avoid keeping the
1872 * current IBSS network alive in cases where other STAs start
1873 * using different BSSID. This will also give the station another
1874 * chance to restart the authentication/authorization in case
1875 * something went wrong the first time.
1876 */
1877 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1878 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1879 NL80211_IFTYPE_ADHOC);
1880 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1881 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1882 link_sta->rx_stats.last_rx = jiffies;
1883 if (ieee80211_is_data_present(hdr->frame_control) &&
1884 !is_multicast_ether_addr(hdr->addr1))
1885 link_sta->rx_stats.last_rate =
1886 sta_stats_encode_rate(status);
1887 }
1888 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1889 link_sta->rx_stats.last_rx = jiffies;
1890 } else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
1891 !is_multicast_ether_addr(hdr->addr1)) {
1892 /*
1893 * Mesh beacons will update last_rx when if they are found to
1894 * match the current local configuration when processed.
1895 */
1896 link_sta->rx_stats.last_rx = jiffies;
1897 if (ieee80211_is_data_present(hdr->frame_control))
1898 link_sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1899 }
1900
1901 link_sta->rx_stats.fragments++;
1902
1903 u64_stats_update_begin(&link_sta->rx_stats.syncp);
1904 u64_stats_add(&link_sta->rx_stats.bytes, rx->skb->len);
1905 u64_stats_update_end(&link_sta->rx_stats.syncp);
1906
1907 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1908 link_sta->rx_stats.last_signal = status->signal;
1909 ewma_signal_add(&link_sta->rx_stats_avg.signal,
1910 -status->signal);
1911 }
1912
1913 if (status->chains) {
1914 link_sta->rx_stats.chains = status->chains;
1915 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1916 int signal = status->chain_signal[i];
1917
1918 if (!(status->chains & BIT(i)))
1919 continue;
1920
1921 link_sta->rx_stats.chain_signal_last[i] = signal;
1922 ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
1923 -signal);
1924 }
1925 }
1926
1927 if (ieee80211_is_s1g_beacon(hdr->frame_control))
1928 return RX_CONTINUE;
1929
1930 /*
1931 * Change STA power saving mode only at the end of a frame
1932 * exchange sequence, and only for a data or management
1933 * frame as specified in IEEE 802.11-2016 11.2.3.2
1934 */
1935 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1936 !ieee80211_has_morefrags(hdr->frame_control) &&
1937 !is_multicast_ether_addr(hdr->addr1) &&
1938 (ieee80211_is_mgmt(hdr->frame_control) ||
1939 ieee80211_is_data(hdr->frame_control)) &&
1940 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1941 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1942 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1943 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1944 if (!ieee80211_has_pm(hdr->frame_control))
1945 sta_ps_end(sta);
1946 } else {
1947 if (ieee80211_has_pm(hdr->frame_control))
1948 sta_ps_start(sta);
1949 }
1950 }
1951
1952 /* mesh power save support */
1953 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1954 ieee80211_mps_rx_h_sta_process(sta, hdr);
1955
1956 /*
1957 * Drop (qos-)data::nullfunc frames silently, since they
1958 * are used only to control station power saving mode.
1959 */
1960 if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
1961 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1962
1963 /*
1964 * If we receive a 4-addr nullfunc frame from a STA
1965 * that was not moved to a 4-addr STA vlan yet send
1966 * the event to userspace and for older hostapd drop
1967 * the frame to the monitor interface.
1968 */
1969 if (ieee80211_has_a4(hdr->frame_control) &&
1970 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1971 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1972 !rx->sdata->u.vlan.sta))) {
1973 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1974 cfg80211_rx_unexpected_4addr_frame(
1975 rx->sdata->dev, sta->sta.addr,
1976 rx->link_id, GFP_ATOMIC);
1977 return RX_DROP_U_UNEXPECTED_4ADDR_FRAME;
1978 }
1979 /*
1980 * Update counter and free packet here to avoid
1981 * counting this as a dropped packed.
1982 */
1983 link_sta->rx_stats.packets++;
1984 dev_kfree_skb(rx->skb);
1985 return RX_QUEUED;
1986 }
1987
1988 return RX_CONTINUE;
1989 } /* ieee80211_rx_h_sta_process */
1990
1991 static struct ieee80211_key *
ieee80211_rx_get_bigtk(struct ieee80211_rx_data * rx,int idx)1992 ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1993 {
1994 struct ieee80211_key *key = NULL;
1995 int idx2;
1996
1997 /* Make sure key gets set if either BIGTK key index is set so that
1998 * ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
1999 * Beacon frames and Beacon frames that claim to use another BIGTK key
2000 * index (i.e., a key that we do not have).
2001 */
2002
2003 if (idx < 0) {
2004 idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
2005 idx2 = idx + 1;
2006 } else {
2007 if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2008 idx2 = idx + 1;
2009 else
2010 idx2 = idx - 1;
2011 }
2012
2013 if (rx->link_sta)
2014 key = rcu_dereference(rx->link_sta->gtk[idx]);
2015 if (!key)
2016 key = rcu_dereference(rx->link->gtk[idx]);
2017 if (!key && rx->link_sta)
2018 key = rcu_dereference(rx->link_sta->gtk[idx2]);
2019 if (!key)
2020 key = rcu_dereference(rx->link->gtk[idx2]);
2021
2022 return key;
2023 }
2024
2025 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data * rx)2026 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
2027 {
2028 struct sk_buff *skb = rx->skb;
2029 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2030 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2031 int keyidx;
2032 ieee80211_rx_result result = RX_DROP_U_DECRYPT_FAIL;
2033 struct ieee80211_key *sta_ptk = NULL;
2034 struct ieee80211_key *ptk_idx = NULL;
2035 int mmie_keyidx = -1;
2036 __le16 fc;
2037
2038 if (ieee80211_is_ext(hdr->frame_control))
2039 return RX_CONTINUE;
2040
2041 /*
2042 * Key selection 101
2043 *
2044 * There are five types of keys:
2045 * - GTK (group keys)
2046 * - IGTK (group keys for management frames)
2047 * - BIGTK (group keys for Beacon frames)
2048 * - PTK (pairwise keys)
2049 * - STK (station-to-station pairwise keys)
2050 *
2051 * When selecting a key, we have to distinguish between multicast
2052 * (including broadcast) and unicast frames, the latter can only
2053 * use PTKs and STKs while the former always use GTKs, IGTKs, and
2054 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
2055 * then unicast frames can also use key indices like GTKs. Hence, if we
2056 * don't have a PTK/STK we check the key index for a WEP key.
2057 *
2058 * Note that in a regular BSS, multicast frames are sent by the
2059 * AP only, associated stations unicast the frame to the AP first
2060 * which then multicasts it on their behalf.
2061 *
2062 * There is also a slight problem in IBSS mode: GTKs are negotiated
2063 * with each station, that is something we don't currently handle.
2064 * The spec seems to expect that one negotiates the same key with
2065 * every station but there's no such requirement; VLANs could be
2066 * possible.
2067 */
2068
2069 /* start without a key */
2070 rx->key = NULL;
2071 fc = hdr->frame_control;
2072
2073 if (rx->sta) {
2074 int keyid = rx->sta->ptk_idx;
2075 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
2076
2077 if (ieee80211_has_protected(fc) &&
2078 !(status->flag & RX_FLAG_IV_STRIPPED)) {
2079 keyid = ieee80211_get_keyid(rx->skb);
2080
2081 if (unlikely(keyid < 0))
2082 return RX_DROP_U_NO_KEY_ID;
2083
2084 ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
2085 }
2086 }
2087
2088 if (!ieee80211_has_protected(fc))
2089 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
2090
2091 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
2092 rx->key = ptk_idx ? ptk_idx : sta_ptk;
2093 if ((status->flag & RX_FLAG_DECRYPTED) &&
2094 (status->flag & RX_FLAG_IV_STRIPPED))
2095 return RX_CONTINUE;
2096 /* Skip decryption if the frame is not protected. */
2097 if (!ieee80211_has_protected(fc))
2098 return RX_CONTINUE;
2099 } else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
2100 /* Broadcast/multicast robust management frame / BIP */
2101 if ((status->flag & RX_FLAG_DECRYPTED) &&
2102 (status->flag & RX_FLAG_IV_STRIPPED))
2103 return RX_CONTINUE;
2104
2105 if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
2106 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
2107 NUM_DEFAULT_BEACON_KEYS) {
2108 if (rx->sdata->dev)
2109 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2110 skb->data,
2111 skb->len);
2112 return RX_DROP_U_BAD_BCN_KEYIDX;
2113 }
2114
2115 rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
2116 if (!rx->key)
2117 return RX_CONTINUE; /* Beacon protection not in use */
2118 } else if (mmie_keyidx >= 0) {
2119 /* Broadcast/multicast robust management frame / BIP */
2120 if ((status->flag & RX_FLAG_DECRYPTED) &&
2121 (status->flag & RX_FLAG_IV_STRIPPED))
2122 return RX_CONTINUE;
2123
2124 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
2125 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2126 return RX_DROP_U_BAD_MGMT_KEYIDX; /* unexpected BIP keyidx */
2127 if (rx->link_sta) {
2128 if (ieee80211_is_group_privacy_action(skb) &&
2129 test_sta_flag(rx->sta, WLAN_STA_MFP))
2130 return RX_DROP_U_UNPROTECTED;
2131
2132 rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);
2133 }
2134 if (!rx->key)
2135 rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);
2136 } else if (!ieee80211_has_protected(fc)) {
2137 /*
2138 * The frame was not protected, so skip decryption. However, we
2139 * need to set rx->key if there is a key that could have been
2140 * used so that the frame may be dropped if encryption would
2141 * have been expected.
2142 */
2143 struct ieee80211_key *key = NULL;
2144 int i;
2145
2146 if (ieee80211_is_beacon(fc)) {
2147 key = ieee80211_rx_get_bigtk(rx, -1);
2148 } else if (ieee80211_is_mgmt(fc) &&
2149 is_multicast_ether_addr(hdr->addr1)) {
2150 key = rcu_dereference(rx->link->default_mgmt_key);
2151 } else {
2152 if (rx->link_sta) {
2153 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2154 key = rcu_dereference(rx->link_sta->gtk[i]);
2155 if (key)
2156 break;
2157 }
2158 }
2159 if (!key) {
2160 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2161 key = rcu_dereference(rx->link->gtk[i]);
2162 if (key)
2163 break;
2164 }
2165 }
2166 }
2167 if (key)
2168 rx->key = key;
2169 return RX_CONTINUE;
2170 } else {
2171 /*
2172 * The device doesn't give us the IV so we won't be
2173 * able to look up the key. That's ok though, we
2174 * don't need to decrypt the frame, we just won't
2175 * be able to keep statistics accurate.
2176 * Except for key threshold notifications, should
2177 * we somehow allow the driver to tell us which key
2178 * the hardware used if this flag is set?
2179 */
2180 if ((status->flag & RX_FLAG_DECRYPTED) &&
2181 (status->flag & RX_FLAG_IV_STRIPPED))
2182 return RX_CONTINUE;
2183
2184 keyidx = ieee80211_get_keyid(rx->skb);
2185
2186 if (unlikely(keyidx < 0))
2187 return RX_DROP_U_NO_KEY_ID;
2188
2189 /* check per-station GTK first, if multicast packet */
2190 if (is_multicast_ether_addr(hdr->addr1) && rx->link_sta)
2191 rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);
2192
2193 /* if not found, try default key */
2194 if (!rx->key) {
2195 if (is_multicast_ether_addr(hdr->addr1))
2196 rx->key = rcu_dereference(rx->link->gtk[keyidx]);
2197 if (!rx->key)
2198 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2199
2200 /*
2201 * RSNA-protected unicast frames should always be
2202 * sent with pairwise or station-to-station keys,
2203 * but for WEP we allow using a key index as well.
2204 */
2205 if (rx->key &&
2206 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2207 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2208 !is_multicast_ether_addr(hdr->addr1))
2209 rx->key = NULL;
2210 }
2211 }
2212
2213 if (rx->key) {
2214 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2215 return RX_DROP_U_KEY_TAINTED;
2216
2217 /* TODO: add threshold stuff again */
2218 } else {
2219 return RX_DROP_U_UNPROTECTED;
2220 }
2221
2222 switch (rx->key->conf.cipher) {
2223 case WLAN_CIPHER_SUITE_WEP40:
2224 case WLAN_CIPHER_SUITE_WEP104:
2225 result = ieee80211_crypto_wep_decrypt(rx);
2226 break;
2227 case WLAN_CIPHER_SUITE_TKIP:
2228 result = ieee80211_crypto_tkip_decrypt(rx);
2229 break;
2230 case WLAN_CIPHER_SUITE_CCMP:
2231 result = ieee80211_crypto_ccmp_decrypt(
2232 rx, IEEE80211_CCMP_MIC_LEN);
2233 break;
2234 case WLAN_CIPHER_SUITE_CCMP_256:
2235 result = ieee80211_crypto_ccmp_decrypt(
2236 rx, IEEE80211_CCMP_256_MIC_LEN);
2237 break;
2238 case WLAN_CIPHER_SUITE_AES_CMAC:
2239 result = ieee80211_crypto_aes_cmac_decrypt(
2240 rx, IEEE80211_CMAC_128_MIC_LEN);
2241 break;
2242 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2243 result = ieee80211_crypto_aes_cmac_decrypt(
2244 rx, IEEE80211_CMAC_256_MIC_LEN);
2245 break;
2246 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2247 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2248 result = ieee80211_crypto_aes_gmac_decrypt(rx);
2249 break;
2250 case WLAN_CIPHER_SUITE_GCMP:
2251 case WLAN_CIPHER_SUITE_GCMP_256:
2252 result = ieee80211_crypto_gcmp_decrypt(rx);
2253 break;
2254 default:
2255 result = RX_DROP_U_BAD_CIPHER;
2256 }
2257
2258 /* the hdr variable is invalid after the decrypt handlers */
2259
2260 /* either the frame has been decrypted or will be dropped */
2261 status->flag |= RX_FLAG_DECRYPTED;
2262
2263 if (unlikely(ieee80211_is_beacon(fc) && RX_RES_IS_UNUSABLE(result) &&
2264 rx->sdata->dev))
2265 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2266 skb->data, skb->len);
2267
2268 return result;
2269 }
2270
ieee80211_init_frag_cache(struct ieee80211_fragment_cache * cache)2271 void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2272 {
2273 int i;
2274
2275 for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2276 skb_queue_head_init(&cache->entries[i].skb_list);
2277 }
2278
ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache * cache)2279 void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2280 {
2281 int i;
2282
2283 for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2284 __skb_queue_purge(&cache->entries[i].skb_list);
2285 }
2286
2287 static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_fragment_cache * cache,unsigned int frag,unsigned int seq,int rx_queue,struct sk_buff ** skb)2288 ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
2289 unsigned int frag, unsigned int seq, int rx_queue,
2290 struct sk_buff **skb)
2291 {
2292 struct ieee80211_fragment_entry *entry;
2293
2294 entry = &cache->entries[cache->next++];
2295 if (cache->next >= IEEE80211_FRAGMENT_MAX)
2296 cache->next = 0;
2297
2298 __skb_queue_purge(&entry->skb_list);
2299
2300 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
2301 *skb = NULL;
2302 entry->first_frag_time = jiffies;
2303 entry->seq = seq;
2304 entry->rx_queue = rx_queue;
2305 entry->last_frag = frag;
2306 entry->check_sequential_pn = false;
2307 entry->extra_len = 0;
2308
2309 return entry;
2310 }
2311
2312 static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_fragment_cache * cache,unsigned int frag,unsigned int seq,int rx_queue,struct ieee80211_hdr * hdr)2313 ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
2314 unsigned int frag, unsigned int seq,
2315 int rx_queue, struct ieee80211_hdr *hdr)
2316 {
2317 struct ieee80211_fragment_entry *entry;
2318 int i, idx;
2319
2320 idx = cache->next;
2321 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2322 struct ieee80211_hdr *f_hdr;
2323 struct sk_buff *f_skb;
2324
2325 idx--;
2326 if (idx < 0)
2327 idx = IEEE80211_FRAGMENT_MAX - 1;
2328
2329 entry = &cache->entries[idx];
2330 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2331 entry->rx_queue != rx_queue ||
2332 entry->last_frag + 1 != frag)
2333 continue;
2334
2335 f_skb = __skb_peek(&entry->skb_list);
2336 f_hdr = (struct ieee80211_hdr *) f_skb->data;
2337
2338 /*
2339 * Check ftype and addresses are equal, else check next fragment
2340 */
2341 if (((hdr->frame_control ^ f_hdr->frame_control) &
2342 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2343 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
2344 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
2345 continue;
2346
2347 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2348 __skb_queue_purge(&entry->skb_list);
2349 continue;
2350 }
2351 return entry;
2352 }
2353
2354 return NULL;
2355 }
2356
requires_sequential_pn(struct ieee80211_rx_data * rx,__le16 fc)2357 static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2358 {
2359 return rx->key &&
2360 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2361 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2362 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2363 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2364 ieee80211_has_protected(fc);
2365 }
2366
2367 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_defragment(struct ieee80211_rx_data * rx)2368 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2369 {
2370 struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
2371 struct ieee80211_hdr *hdr;
2372 u16 sc;
2373 __le16 fc;
2374 unsigned int frag, seq;
2375 struct ieee80211_fragment_entry *entry;
2376 struct sk_buff *skb;
2377 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2378
2379 hdr = (struct ieee80211_hdr *)rx->skb->data;
2380 fc = hdr->frame_control;
2381
2382 if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
2383 return RX_CONTINUE;
2384
2385 sc = le16_to_cpu(hdr->seq_ctrl);
2386 frag = sc & IEEE80211_SCTL_FRAG;
2387
2388 if (rx->sta)
2389 cache = &rx->sta->frags;
2390
2391 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2392 goto out;
2393
2394 if (is_multicast_ether_addr(hdr->addr1))
2395 return RX_DROP_U_MCAST_FRAGMENT;
2396
2397 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2398
2399 if (skb_linearize(rx->skb))
2400 return RX_DROP_U_OOM;
2401
2402 /*
2403 * skb_linearize() might change the skb->data and
2404 * previously cached variables (in this case, hdr) need to
2405 * be refreshed with the new data.
2406 */
2407 hdr = (struct ieee80211_hdr *)rx->skb->data;
2408 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2409
2410 if (frag == 0) {
2411 /* This is the first fragment of a new frame. */
2412 entry = ieee80211_reassemble_add(cache, frag, seq,
2413 rx->seqno_idx, &(rx->skb));
2414 if (requires_sequential_pn(rx, fc)) {
2415 int queue = rx->security_idx;
2416
2417 /* Store CCMP/GCMP PN so that we can verify that the
2418 * next fragment has a sequential PN value.
2419 */
2420 entry->check_sequential_pn = true;
2421 entry->is_protected = true;
2422 entry->key_color = rx->key->color;
2423 memcpy(entry->last_pn,
2424 rx->key->u.ccmp.rx_pn[queue],
2425 IEEE80211_CCMP_PN_LEN);
2426 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2427 u.ccmp.rx_pn) !=
2428 offsetof(struct ieee80211_key,
2429 u.gcmp.rx_pn));
2430 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2431 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2432 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2433 IEEE80211_GCMP_PN_LEN);
2434 } else if (rx->key &&
2435 (ieee80211_has_protected(fc) ||
2436 (status->flag & RX_FLAG_DECRYPTED))) {
2437 entry->is_protected = true;
2438 entry->key_color = rx->key->color;
2439 }
2440 return RX_QUEUED;
2441 }
2442
2443 /* This is a fragment for a frame that should already be pending in
2444 * fragment cache. Add this fragment to the end of the pending entry.
2445 */
2446 entry = ieee80211_reassemble_find(cache, frag, seq,
2447 rx->seqno_idx, hdr);
2448 if (!entry) {
2449 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2450 return RX_DROP_U_DEFRAG_MISMATCH;
2451 }
2452
2453 /* "The receiver shall discard MSDUs and MMPDUs whose constituent
2454 * MPDU PN values are not incrementing in steps of 1."
2455 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2456 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2457 */
2458 if (entry->check_sequential_pn) {
2459 int i;
2460 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2461
2462 if (!requires_sequential_pn(rx, fc))
2463 return RX_DROP_U_NONSEQ_PN;
2464
2465 /* Prevent mixed key and fragment cache attacks */
2466 if (entry->key_color != rx->key->color)
2467 return RX_DROP_U_BAD_KEY_COLOR;
2468
2469 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2470 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2471 pn[i]++;
2472 if (pn[i])
2473 break;
2474 }
2475
2476 rpn = rx->ccm_gcm.pn;
2477 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
2478 return RX_DROP_U_REPLAY;
2479 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2480 } else if (entry->is_protected &&
2481 (!rx->key ||
2482 (!ieee80211_has_protected(fc) &&
2483 !(status->flag & RX_FLAG_DECRYPTED)) ||
2484 rx->key->color != entry->key_color)) {
2485 /* Drop this as a mixed key or fragment cache attack, even
2486 * if for TKIP Michael MIC should protect us, and WEP is a
2487 * lost cause anyway.
2488 */
2489 return RX_DROP_U_EXPECT_DEFRAG_PROT;
2490 } else if (entry->is_protected && rx->key &&
2491 entry->key_color != rx->key->color &&
2492 (status->flag & RX_FLAG_DECRYPTED)) {
2493 return RX_DROP_U_BAD_KEY_COLOR;
2494 }
2495
2496 skb_pull(rx->skb, ieee80211_hdrlen(fc));
2497 __skb_queue_tail(&entry->skb_list, rx->skb);
2498 entry->last_frag = frag;
2499 entry->extra_len += rx->skb->len;
2500 if (ieee80211_has_morefrags(fc)) {
2501 rx->skb = NULL;
2502 return RX_QUEUED;
2503 }
2504
2505 rx->skb = __skb_dequeue(&entry->skb_list);
2506 if (skb_tailroom(rx->skb) < entry->extra_len) {
2507 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2508 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2509 GFP_ATOMIC))) {
2510 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2511 __skb_queue_purge(&entry->skb_list);
2512 return RX_DROP_U_OOM;
2513 }
2514 }
2515 while ((skb = __skb_dequeue(&entry->skb_list))) {
2516 skb_put_data(rx->skb, skb->data, skb->len);
2517 dev_kfree_skb(skb);
2518 }
2519
2520 out:
2521 ieee80211_led_rx(rx->local);
2522 if (rx->sta)
2523 rx->link_sta->rx_stats.packets++;
2524 return RX_CONTINUE;
2525 }
2526
ieee80211_802_1x_port_control(struct ieee80211_rx_data * rx)2527 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2528 {
2529 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2530 return -EACCES;
2531
2532 return 0;
2533 }
2534
ieee80211_drop_unencrypted(struct ieee80211_rx_data * rx,__le16 fc)2535 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2536 {
2537 struct sk_buff *skb = rx->skb;
2538 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2539
2540 /*
2541 * Pass through unencrypted frames if the hardware has
2542 * decrypted them already.
2543 */
2544 if (status->flag & RX_FLAG_DECRYPTED)
2545 return 0;
2546
2547 /* Drop unencrypted frames if key is set. */
2548 if (unlikely(!ieee80211_has_protected(fc) &&
2549 !ieee80211_is_any_nullfunc(fc) &&
2550 ieee80211_is_data(fc) && rx->key))
2551 return -EACCES;
2552
2553 return 0;
2554 }
2555
2556 VISIBLE_IF_MAC80211_KUNIT ieee80211_rx_result
ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data * rx)2557 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2558 {
2559 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2560 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2561 __le16 fc = mgmt->frame_control;
2562
2563 /*
2564 * Pass through unencrypted frames if the hardware has
2565 * decrypted them already.
2566 */
2567 if (status->flag & RX_FLAG_DECRYPTED)
2568 return RX_CONTINUE;
2569
2570 /* drop unicast protected dual (that wasn't protected) */
2571 if (ieee80211_is_action(fc) &&
2572 mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
2573 return RX_DROP_U_UNPROT_DUAL;
2574
2575 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2576 if (unlikely(!ieee80211_has_protected(fc) &&
2577 ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {
2578 if (ieee80211_is_deauth(fc) ||
2579 ieee80211_is_disassoc(fc)) {
2580 /*
2581 * Permit unprotected deauth/disassoc frames
2582 * during 4-way-HS (key is installed after HS).
2583 */
2584 if (!rx->key)
2585 return RX_CONTINUE;
2586
2587 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2588 rx->skb->data,
2589 rx->skb->len);
2590 }
2591 return RX_DROP_U_UNPROT_UCAST_MGMT;
2592 }
2593 /* BIP does not use Protected field, so need to check MMIE */
2594 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2595 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2596 if (ieee80211_is_deauth(fc) ||
2597 ieee80211_is_disassoc(fc))
2598 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2599 rx->skb->data,
2600 rx->skb->len);
2601 return RX_DROP_U_UNPROT_MCAST_MGMT;
2602 }
2603 if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2604 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2605 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2606 rx->skb->data,
2607 rx->skb->len);
2608 return RX_DROP_U_UNPROT_BEACON;
2609 }
2610 /*
2611 * When using MFP, Action frames are not allowed prior to
2612 * having configured keys.
2613 */
2614 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2615 ieee80211_is_robust_mgmt_frame(rx->skb)))
2616 return RX_DROP_U_UNPROT_ACTION;
2617
2618 /* drop unicast public action frames when using MPF */
2619 if (is_unicast_ether_addr(mgmt->da) &&
2620 ieee80211_is_protected_dual_of_public_action(rx->skb))
2621 return RX_DROP_U_UNPROT_UNICAST_PUB_ACTION;
2622 }
2623
2624 /*
2625 * Drop robust action frames before assoc regardless of MFP state,
2626 * after assoc we also have decided on MFP or not.
2627 */
2628 if (ieee80211_is_action(fc) &&
2629 ieee80211_is_robust_mgmt_frame(rx->skb) &&
2630 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))
2631 return RX_DROP_U_UNPROT_ROBUST_ACTION;
2632
2633 /*
2634 * Drop unprotected (Re)Association Request/Response frame received from
2635 * an EPP Peer.
2636 */
2637 if (!ieee80211_has_protected(fc) &&
2638 ieee80211_require_encrypted_assoc(fc, rx->sta))
2639 return RX_DROP_U_UNPROT_UCAST_MGMT;
2640
2641 return RX_CONTINUE;
2642 }
2643 EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_drop_unencrypted_mgmt);
2644
2645 static ieee80211_rx_result
__ieee80211_data_to_8023(struct ieee80211_rx_data * rx,bool * port_control)2646 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2647 {
2648 struct ieee80211_sub_if_data *sdata = rx->sdata;
2649 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2650 bool check_port_control = false;
2651 struct ethhdr *ehdr;
2652 int ret;
2653
2654 *port_control = false;
2655 if (ieee80211_has_a4(hdr->frame_control) &&
2656 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2657 return RX_DROP_U_UNEXPECTED_VLAN_4ADDR;
2658
2659 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2660 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2661 if (!sdata->u.mgd.use_4addr)
2662 return RX_DROP_U_UNEXPECTED_STA_4ADDR;
2663 else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))
2664 check_port_control = true;
2665 }
2666
2667 if (is_multicast_ether_addr(hdr->addr1) &&
2668 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2669 return RX_DROP_U_UNEXPECTED_VLAN_MCAST;
2670
2671 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2672 if (ret < 0)
2673 return RX_DROP_U_INVALID_8023;
2674
2675 ehdr = (struct ethhdr *) rx->skb->data;
2676 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2677 *port_control = true;
2678 else if (check_port_control)
2679 return RX_DROP_U_NOT_PORT_CONTROL;
2680
2681 return RX_CONTINUE;
2682 }
2683
ieee80211_is_our_addr(struct ieee80211_sub_if_data * sdata,const u8 * addr,int * out_link_id)2684 bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
2685 const u8 *addr, int *out_link_id)
2686 {
2687 unsigned int link_id;
2688
2689 /* non-MLO, or MLD address replaced by hardware */
2690 if (ether_addr_equal(sdata->vif.addr, addr))
2691 return true;
2692
2693 if (!ieee80211_vif_is_mld(&sdata->vif))
2694 return false;
2695
2696 for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
2697 struct ieee80211_bss_conf *conf;
2698
2699 conf = rcu_dereference(sdata->vif.link_conf[link_id]);
2700
2701 if (!conf)
2702 continue;
2703 if (ether_addr_equal(conf->addr, addr)) {
2704 if (out_link_id)
2705 *out_link_id = link_id;
2706 return true;
2707 }
2708 }
2709
2710 return false;
2711 }
2712
2713 /*
2714 * requires that rx->skb is a frame with ethernet header
2715 */
ieee80211_frame_allowed(struct ieee80211_rx_data * rx,__le16 fc)2716 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2717 {
2718 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2719 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2720 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2721
2722 /*
2723 * Allow EAPOL frames to us/the PAE group address regardless of
2724 * whether the frame was encrypted or not, and always disallow
2725 * all other destination addresses for them.
2726 */
2727 if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2728 return ieee80211_is_our_addr(rx->sdata, ehdr->h_dest, NULL) ||
2729 ether_addr_equal(ehdr->h_dest, pae_group_addr);
2730
2731 if (ieee80211_802_1x_port_control(rx) ||
2732 ieee80211_drop_unencrypted(rx, fc))
2733 return false;
2734
2735 return true;
2736 }
2737
ieee80211_deliver_skb_to_local_stack(struct sk_buff * skb,struct ieee80211_rx_data * rx)2738 static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2739 struct ieee80211_rx_data *rx)
2740 {
2741 struct ieee80211_sub_if_data *sdata = rx->sdata;
2742 struct net_device *dev = sdata->dev;
2743
2744 if (unlikely((skb->protocol == sdata->control_port_protocol ||
2745 (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2746 !sdata->control_port_no_preauth)) &&
2747 sdata->control_port_over_nl80211)) {
2748 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2749 bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2750
2751 cfg80211_rx_control_port(dev, skb, noencrypt, rx->link_id);
2752 dev_kfree_skb(skb);
2753 } else {
2754 struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2755
2756 memset(skb->cb, 0, sizeof(skb->cb));
2757
2758 /*
2759 * 802.1X over 802.11 requires that the authenticator address
2760 * be used for EAPOL frames. However, 802.1X allows the use of
2761 * the PAE group address instead. If the interface is part of
2762 * a bridge and we pass the frame with the PAE group address,
2763 * then the bridge will forward it to the network (even if the
2764 * client was not associated yet), which isn't supposed to
2765 * happen.
2766 * To avoid that, rewrite the destination address to our own
2767 * address, so that the authenticator (e.g. hostapd) will see
2768 * the frame, but bridge won't forward it anywhere else. Note
2769 * that due to earlier filtering, the only other address can
2770 * be the PAE group address, unless the hardware allowed them
2771 * through in 802.3 offloaded mode.
2772 */
2773 if (unlikely(skb->protocol == sdata->control_port_protocol &&
2774 !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2775 ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
2776
2777 /* deliver to local stack */
2778 if (rx->list)
2779 list_add_tail(&skb->list, rx->list);
2780 else
2781 netif_receive_skb(skb);
2782 }
2783 }
2784
2785 /*
2786 * requires that rx->skb is a frame with ethernet header
2787 */
2788 static void
ieee80211_deliver_skb(struct ieee80211_rx_data * rx)2789 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2790 {
2791 struct ieee80211_sub_if_data *sdata = rx->sdata;
2792 struct net_device *dev = sdata->dev;
2793 struct sk_buff *skb, *xmit_skb;
2794 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2795 struct sta_info *dsta;
2796
2797 skb = rx->skb;
2798 xmit_skb = NULL;
2799
2800 dev_sw_netstats_rx_add(dev, skb->len);
2801
2802 if (rx->sta) {
2803 /* The seqno index has the same property as needed
2804 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2805 * for non-QoS-data frames. Here we know it's a data
2806 * frame, so count MSDUs.
2807 */
2808 u64_stats_update_begin(&rx->link_sta->rx_stats.syncp);
2809 u64_stats_inc(&rx->link_sta->rx_stats.msdu[rx->seqno_idx]);
2810 u64_stats_update_end(&rx->link_sta->rx_stats.syncp);
2811 }
2812
2813 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2814 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2815 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2816 ehdr->h_proto != rx->sdata->control_port_protocol &&
2817 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2818 if (is_multicast_ether_addr(ehdr->h_dest) &&
2819 ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2820 /*
2821 * send multicast frames both to higher layers in
2822 * local net stack and back to the wireless medium
2823 */
2824 xmit_skb = skb_copy(skb, GFP_ATOMIC);
2825 if (!xmit_skb)
2826 net_info_ratelimited("%s: failed to clone multicast frame\n",
2827 dev->name);
2828 } else if (!is_multicast_ether_addr(ehdr->h_dest) &&
2829 !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {
2830 dsta = sta_info_get(sdata, ehdr->h_dest);
2831 if (dsta) {
2832 /*
2833 * The destination station is associated to
2834 * this AP (in this VLAN), so send the frame
2835 * directly to it and do not pass it to local
2836 * net stack.
2837 */
2838 xmit_skb = skb;
2839 skb = NULL;
2840 }
2841 }
2842 }
2843
2844 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2845 if (skb) {
2846 /* 'align' will only take the values 0 or 2 here since all
2847 * frames are required to be aligned to 2-byte boundaries
2848 * when being passed to mac80211; the code here works just
2849 * as well if that isn't true, but mac80211 assumes it can
2850 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2851 */
2852 int align;
2853
2854 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2855 if (align) {
2856 if (WARN_ON(skb_headroom(skb) < 3)) {
2857 dev_kfree_skb(skb);
2858 skb = NULL;
2859 } else {
2860 u8 *data = skb->data;
2861 size_t len = skb_headlen(skb);
2862 skb->data -= align;
2863 memmove(skb->data, data, len);
2864 skb_set_tail_pointer(skb, len);
2865 }
2866 }
2867 }
2868 #endif
2869
2870 if (skb) {
2871 skb->protocol = eth_type_trans(skb, dev);
2872 ieee80211_deliver_skb_to_local_stack(skb, rx);
2873 }
2874
2875 if (xmit_skb) {
2876 /*
2877 * Send to wireless media and increase priority by 256 to
2878 * keep the received priority instead of reclassifying
2879 * the frame (see cfg80211_classify8021d).
2880 */
2881 xmit_skb->priority += 256;
2882 xmit_skb->protocol = htons(ETH_P_802_3);
2883 skb_reset_network_header(xmit_skb);
2884 skb_reset_mac_header(xmit_skb);
2885 dev_queue_xmit(xmit_skb);
2886 }
2887 }
2888
2889 #ifdef CONFIG_MAC80211_MESH
2890 static bool
ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int hdrlen)2891 ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
2892 struct sk_buff *skb, int hdrlen)
2893 {
2894 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2895 struct ieee80211_mesh_fast_tx_key key = {
2896 .type = MESH_FAST_TX_TYPE_FORWARDED
2897 };
2898 struct ieee80211_mesh_fast_tx *entry;
2899 struct ieee80211s_hdr *mesh_hdr;
2900 struct tid_ampdu_tx *tid_tx;
2901 struct sta_info *sta;
2902 struct ethhdr eth;
2903 u8 tid;
2904
2905 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
2906 if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2907 ether_addr_copy(key.addr, mesh_hdr->eaddr1);
2908 else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
2909 ether_addr_copy(key.addr, skb->data);
2910 else
2911 return false;
2912
2913 entry = mesh_fast_tx_get(sdata, &key);
2914 if (!entry)
2915 return false;
2916
2917 sta = rcu_dereference(entry->mpath->next_hop);
2918 if (!sta)
2919 return false;
2920
2921 if (skb_linearize(skb))
2922 return false;
2923
2924 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2925 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2926 if (tid_tx) {
2927 if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2928 return false;
2929
2930 if (tid_tx->timeout)
2931 tid_tx->last_tx = jiffies;
2932 }
2933
2934 ieee80211_aggr_check(sdata, sta, skb);
2935
2936 if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
2937 &skb->protocol))
2938 hdrlen += ETH_ALEN;
2939 else
2940 skb->protocol = htons(skb->len - hdrlen);
2941 skb_set_network_header(skb, hdrlen + 2);
2942
2943 skb->dev = sdata->dev;
2944 memcpy(ð, skb->data, ETH_HLEN - 2);
2945 skb_pull(skb, 2);
2946 __ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
2947 eth.h_dest, eth.h_source);
2948 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2949 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2950
2951 return true;
2952 }
2953 #endif
2954
2955 static ieee80211_rx_result
ieee80211_rx_mesh_data(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct sk_buff * skb)2956 ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
2957 struct sk_buff *skb)
2958 {
2959 #ifdef CONFIG_MAC80211_MESH
2960 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2961 struct ieee80211_local *local = sdata->local;
2962 uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
2963 struct ieee80211_hdr hdr = {
2964 .frame_control = cpu_to_le16(fc)
2965 };
2966 struct ieee80211_hdr *fwd_hdr;
2967 struct ieee80211s_hdr *mesh_hdr;
2968 struct ieee80211_tx_info *info;
2969 struct sk_buff *fwd_skb;
2970 struct ethhdr *eth;
2971 bool multicast;
2972 int tailroom = 0;
2973 int hdrlen, mesh_hdrlen;
2974 u8 *qos;
2975
2976 if (!ieee80211_vif_is_mesh(&sdata->vif))
2977 return RX_CONTINUE;
2978
2979 if (!pskb_may_pull(skb, sizeof(*eth) + 6))
2980 return RX_DROP_U_RUNT_MESH_DATA;
2981
2982 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
2983 mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
2984
2985 if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
2986 return RX_DROP_U_RUNT_MESH_DATA;
2987
2988 eth = (struct ethhdr *)skb->data;
2989 multicast = is_multicast_ether_addr(eth->h_dest);
2990
2991 mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
2992 if (!mesh_hdr->ttl)
2993 return RX_DROP_U_MESH_NO_TTL;
2994
2995 /* frame is in RMC, don't forward */
2996 if (is_multicast_ether_addr(eth->h_dest) &&
2997 mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
2998 return RX_DROP_U_MESH_RMC;
2999
3000 /* forward packet */
3001 if (sdata->crypto_tx_tailroom_needed_cnt)
3002 tailroom = IEEE80211_ENCRYPT_TAILROOM;
3003
3004 if (mesh_hdr->flags & MESH_FLAGS_AE) {
3005 struct mesh_path *mppath;
3006 char *proxied_addr;
3007 bool update = false;
3008
3009 if (multicast)
3010 proxied_addr = mesh_hdr->eaddr1;
3011 else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
3012 /* has_a4 already checked in ieee80211_rx_mesh_check */
3013 proxied_addr = mesh_hdr->eaddr2;
3014 else
3015 return RX_DROP_U_MESH_BAD_AE;
3016
3017 rcu_read_lock();
3018 mppath = mpp_path_lookup(sdata, proxied_addr);
3019 if (!mppath) {
3020 mpp_path_add(sdata, proxied_addr, eth->h_source);
3021 } else {
3022 spin_lock_bh(&mppath->state_lock);
3023 if (!ether_addr_equal(mppath->mpp, eth->h_source)) {
3024 memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
3025 update = true;
3026 }
3027 mppath->exp_time = jiffies;
3028 spin_unlock_bh(&mppath->state_lock);
3029 }
3030
3031 /* flush fast xmit cache if the address path changed */
3032 if (update)
3033 mesh_fast_tx_flush_addr(sdata, proxied_addr);
3034
3035 rcu_read_unlock();
3036 }
3037
3038 /* Frame has reached destination. Don't forward */
3039 if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
3040 goto rx_accept;
3041
3042 if (!--mesh_hdr->ttl) {
3043 if (multicast)
3044 goto rx_accept;
3045
3046 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
3047 return RX_DROP_U_MESH_TTL_EXPIRED;
3048 }
3049
3050 if (!ifmsh->mshcfg.dot11MeshForwarding) {
3051 if (is_multicast_ether_addr(eth->h_dest))
3052 goto rx_accept;
3053
3054 return RX_DROP_U_MESH_NOT_FORWARDING;
3055 }
3056
3057 skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
3058
3059 if (!multicast &&
3060 ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
3061 return RX_QUEUED;
3062
3063 ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
3064 eth->h_dest, eth->h_source);
3065 hdrlen = ieee80211_hdrlen(hdr.frame_control);
3066 if (multicast) {
3067 int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
3068
3069 fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
3070 IEEE80211_ENCRYPT_HEADROOM,
3071 tailroom, GFP_ATOMIC);
3072 if (!fwd_skb)
3073 goto rx_accept;
3074 } else {
3075 fwd_skb = skb;
3076 skb = NULL;
3077
3078 if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
3079 return RX_DROP_U_OOM;
3080
3081 if (skb_linearize(fwd_skb))
3082 return RX_DROP_U_OOM;
3083 }
3084
3085 fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
3086 memcpy(fwd_hdr, &hdr, hdrlen - 2);
3087 qos = ieee80211_get_qos_ctl(fwd_hdr);
3088 qos[0] = qos[1] = 0;
3089
3090 skb_reset_mac_header(fwd_skb);
3091 hdrlen += mesh_hdrlen;
3092 if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
3093 &fwd_skb->protocol))
3094 hdrlen += ETH_ALEN;
3095 else
3096 fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
3097 skb_set_network_header(fwd_skb, hdrlen + 2);
3098
3099 info = IEEE80211_SKB_CB(fwd_skb);
3100 memset(info, 0, sizeof(*info));
3101 info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
3102 info->control.vif = &sdata->vif;
3103 info->control.jiffies = jiffies;
3104 fwd_skb->dev = sdata->dev;
3105 if (multicast) {
3106 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
3107 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3108 /* update power mode indication when forwarding */
3109 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
3110 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
3111 /* mesh power mode flags updated in mesh_nexthop_lookup */
3112 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
3113 } else {
3114 /* unable to resolve next hop */
3115 if (sta)
3116 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
3117 hdr.addr3, 0,
3118 WLAN_REASON_MESH_PATH_NOFORWARD,
3119 sta->sta.addr);
3120 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
3121 kfree_skb(fwd_skb);
3122 goto rx_accept;
3123 }
3124
3125 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
3126 ieee80211_set_qos_hdr(sdata, fwd_skb);
3127 ieee80211_add_pending_skb(local, fwd_skb);
3128
3129 rx_accept:
3130 if (!skb)
3131 return RX_QUEUED;
3132
3133 ieee80211_strip_8023_mesh_hdr(skb);
3134 #endif
3135
3136 return RX_CONTINUE;
3137 }
3138
3139 static ieee80211_rx_result debug_noinline
__ieee80211_rx_h_amsdu(struct ieee80211_rx_data * rx,u8 data_offset)3140 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
3141 {
3142 struct net_device *dev = rx->sdata->dev;
3143 struct sk_buff *skb = rx->skb;
3144 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3145 __le16 fc = hdr->frame_control;
3146 struct sk_buff_head frame_list;
3147 struct ethhdr ethhdr;
3148 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
3149
3150 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3151 check_da = NULL;
3152 check_sa = NULL;
3153 } else switch (rx->sdata->vif.type) {
3154 case NL80211_IFTYPE_AP:
3155 case NL80211_IFTYPE_AP_VLAN:
3156 check_da = NULL;
3157 break;
3158 case NL80211_IFTYPE_STATION:
3159 if (!test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
3160 check_sa = NULL;
3161 break;
3162 case NL80211_IFTYPE_MESH_POINT:
3163 check_sa = NULL;
3164 check_da = NULL;
3165 break;
3166 default:
3167 break;
3168 }
3169
3170 skb->dev = dev;
3171 __skb_queue_head_init(&frame_list);
3172
3173 if (ieee80211_data_to_8023_exthdr(skb, ðhdr,
3174 rx->sdata->vif.addr,
3175 rx->sdata->vif.type,
3176 data_offset, true))
3177 return RX_DROP_U_BAD_AMSDU;
3178
3179 if (rx->sta->amsdu_mesh_control < 0) {
3180 s8 valid = -1;
3181 int i;
3182
3183 for (i = 0; i <= 2; i++) {
3184 if (!ieee80211_is_valid_amsdu(skb, i))
3185 continue;
3186
3187 if (valid >= 0) {
3188 /* ambiguous */
3189 valid = -1;
3190 break;
3191 }
3192
3193 valid = i;
3194 }
3195
3196 rx->sta->amsdu_mesh_control = valid;
3197 }
3198
3199 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
3200 rx->sdata->vif.type,
3201 rx->local->hw.extra_tx_headroom,
3202 check_da, check_sa,
3203 rx->sta->amsdu_mesh_control);
3204
3205 while (!skb_queue_empty(&frame_list)) {
3206 rx->skb = __skb_dequeue(&frame_list);
3207
3208 switch (ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb)) {
3209 case RX_QUEUED:
3210 break;
3211 case RX_CONTINUE:
3212 if (ieee80211_frame_allowed(rx, fc)) {
3213 ieee80211_deliver_skb(rx);
3214 break;
3215 }
3216 fallthrough;
3217 default:
3218 dev_kfree_skb(rx->skb);
3219 }
3220 }
3221
3222 return RX_QUEUED;
3223 }
3224
3225 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_amsdu(struct ieee80211_rx_data * rx)3226 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
3227 {
3228 struct sk_buff *skb = rx->skb;
3229 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3230 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3231 __le16 fc = hdr->frame_control;
3232
3233 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
3234 return RX_CONTINUE;
3235
3236 if (unlikely(!ieee80211_is_data(fc)))
3237 return RX_CONTINUE;
3238
3239 if (unlikely(!ieee80211_is_data_present(fc)))
3240 return RX_DROP_U_AMSDU_WITHOUT_DATA;
3241
3242 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3243 switch (rx->sdata->vif.type) {
3244 case NL80211_IFTYPE_AP_VLAN:
3245 if (!rx->sdata->u.vlan.sta)
3246 return RX_DROP_U_BAD_4ADDR;
3247 break;
3248 case NL80211_IFTYPE_STATION:
3249 if (!rx->sdata->u.mgd.use_4addr)
3250 return RX_DROP_U_BAD_4ADDR;
3251 break;
3252 case NL80211_IFTYPE_MESH_POINT:
3253 break;
3254 default:
3255 return RX_DROP_U_BAD_4ADDR;
3256 }
3257 }
3258
3259 if (is_multicast_ether_addr(hdr->addr1) || !rx->sta)
3260 return RX_DROP_U_BAD_AMSDU;
3261
3262 if (rx->key) {
3263 /*
3264 * We should not receive A-MSDUs on pre-HT connections,
3265 * and HT connections cannot use old ciphers. Thus drop
3266 * them, as in those cases we couldn't even have SPP
3267 * A-MSDUs or such.
3268 */
3269 switch (rx->key->conf.cipher) {
3270 case WLAN_CIPHER_SUITE_WEP40:
3271 case WLAN_CIPHER_SUITE_WEP104:
3272 case WLAN_CIPHER_SUITE_TKIP:
3273 return RX_DROP_U_BAD_AMSDU_CIPHER;
3274 default:
3275 break;
3276 }
3277 }
3278
3279 return __ieee80211_rx_h_amsdu(rx, 0);
3280 }
3281
3282 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_data(struct ieee80211_rx_data * rx)3283 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
3284 {
3285 struct ieee80211_sub_if_data *sdata = rx->sdata;
3286 struct ieee80211_local *local = rx->local;
3287 struct net_device *dev = sdata->dev;
3288 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3289 __le16 fc = hdr->frame_control;
3290 ieee80211_rx_result res;
3291 bool port_control;
3292
3293 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
3294 return RX_CONTINUE;
3295
3296 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3297 return RX_DROP_U_NULL_DATA;
3298
3299 /* Send unexpected-4addr-frame event to hostapd */
3300 if (ieee80211_has_a4(hdr->frame_control) &&
3301 sdata->vif.type == NL80211_IFTYPE_AP) {
3302 if (rx->sta &&
3303 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
3304 cfg80211_rx_unexpected_4addr_frame(
3305 rx->sdata->dev, rx->sta->sta.addr, rx->link_id,
3306 GFP_ATOMIC);
3307 return RX_DROP_U_UNEXPECTED_4ADDR;
3308 }
3309
3310 res = __ieee80211_data_to_8023(rx, &port_control);
3311 if (unlikely(res != RX_CONTINUE))
3312 return res;
3313
3314 res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
3315 if (res != RX_CONTINUE)
3316 return res;
3317
3318 if (!ieee80211_frame_allowed(rx, fc))
3319 return RX_DROP_U_PORT_CONTROL;
3320
3321 /* directly handle TDLS channel switch requests/responses */
3322 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3323 cpu_to_be16(ETH_P_TDLS))) {
3324 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3325
3326 if (pskb_may_pull(rx->skb,
3327 offsetof(struct ieee80211_tdls_data, u)) &&
3328 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3329 tf->category == WLAN_CATEGORY_TDLS &&
3330 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3331 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
3332 rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3333 __ieee80211_queue_skb_to_iface(sdata, rx->link_id,
3334 rx->sta, rx->skb);
3335 return RX_QUEUED;
3336 }
3337 }
3338
3339 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3340 unlikely(port_control) && sdata->bss) {
3341 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3342 u.ap);
3343 dev = sdata->dev;
3344 rx->sdata = sdata;
3345 }
3346
3347 rx->skb->dev = dev;
3348
3349 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3350 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3351 !is_multicast_ether_addr(
3352 ((struct ethhdr *)rx->skb->data)->h_dest) &&
3353 (!local->scanning &&
3354 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3355 mod_timer(&local->dynamic_ps_timer, jiffies +
3356 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
3357
3358 ieee80211_deliver_skb(rx);
3359
3360 return RX_QUEUED;
3361 }
3362
3363 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_ctrl(struct ieee80211_rx_data * rx,struct sk_buff_head * frames)3364 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3365 {
3366 struct sk_buff *skb = rx->skb;
3367 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3368 struct tid_ampdu_rx *tid_agg_rx;
3369 u16 start_seq_num;
3370 u16 tid;
3371
3372 if (likely(!ieee80211_is_ctl(bar->frame_control)))
3373 return RX_CONTINUE;
3374
3375 if (ieee80211_is_back_req(bar->frame_control)) {
3376 struct {
3377 __le16 control, start_seq_num;
3378 } __packed bar_data;
3379 struct ieee80211_event event = {
3380 .type = BAR_RX_EVENT,
3381 };
3382
3383 if (!rx->sta)
3384 return RX_DROP_U_UNKNOWN_STA;
3385
3386 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3387 &bar_data, sizeof(bar_data)))
3388 return RX_DROP_U_RUNT_BAR;
3389
3390 tid = le16_to_cpu(bar_data.control) >> 12;
3391
3392 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3393 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
3394 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
3395 WLAN_BACK_RECIPIENT,
3396 WLAN_REASON_QSTA_REQUIRE_SETUP,
3397 ieee80211_s1g_use_ndp_ba(rx->sdata,
3398 rx->sta));
3399
3400 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3401 if (!tid_agg_rx)
3402 return RX_DROP_U_BAR_OUTSIDE_SESSION;
3403
3404 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3405 event.u.ba.tid = tid;
3406 event.u.ba.ssn = start_seq_num;
3407 event.u.ba.sta = &rx->sta->sta;
3408
3409 /* reset session timer */
3410 if (tid_agg_rx->timeout)
3411 mod_timer(&tid_agg_rx->session_timer,
3412 TU_TO_EXP_TIME(tid_agg_rx->timeout));
3413
3414 spin_lock(&tid_agg_rx->reorder_lock);
3415 /* release stored frames up to start of BAR */
3416 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
3417 start_seq_num, frames);
3418 spin_unlock(&tid_agg_rx->reorder_lock);
3419
3420 drv_event_callback(rx->local, rx->sdata, &event);
3421
3422 kfree_skb(skb);
3423 return RX_QUEUED;
3424 }
3425
3426 return RX_DROP_U_CTRL_FRAME;
3427 }
3428
ieee80211_process_sa_query_req(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)3429 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3430 struct ieee80211_mgmt *mgmt,
3431 size_t len)
3432 {
3433 struct ieee80211_local *local = sdata->local;
3434 struct sk_buff *skb;
3435 struct ieee80211_mgmt *resp;
3436
3437 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
3438 /* Not to own unicast address */
3439 return;
3440 }
3441
3442 if (!ether_addr_equal(mgmt->sa, sdata->vif.cfg.ap_addr) ||
3443 !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
3444 /* Not from the current AP or not associated yet. */
3445 return;
3446 }
3447
3448 if (len < IEEE80211_MIN_ACTION_SIZE(sa_query)) {
3449 /* Too short SA Query request frame */
3450 return;
3451 }
3452
3453 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
3454 if (skb == NULL)
3455 return;
3456
3457 skb_reserve(skb, local->hw.extra_tx_headroom);
3458 resp = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(sa_query));
3459 memcpy(resp->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
3460 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3461 memcpy(resp->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
3462 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3463 IEEE80211_STYPE_ACTION);
3464 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3465 resp->u.action.action_code = WLAN_ACTION_SA_QUERY_RESPONSE;
3466 memcpy(resp->u.action.sa_query.trans_id,
3467 mgmt->u.action.sa_query.trans_id,
3468 WLAN_SA_QUERY_TR_ID_LEN);
3469
3470 ieee80211_tx_skb(sdata, skb);
3471 }
3472
3473 static void
ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data * rx)3474 ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3475 {
3476 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3477 struct ieee80211_bss_conf *bss_conf;
3478 const struct element *ie;
3479 size_t baselen;
3480
3481 if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
3482 NL80211_EXT_FEATURE_BSS_COLOR))
3483 return;
3484
3485 if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3486 return;
3487
3488 bss_conf = rx->link->conf;
3489 if (bss_conf->csa_active || bss_conf->color_change_active ||
3490 !bss_conf->he_bss_color.enabled)
3491 return;
3492
3493 baselen = mgmt->u.beacon.variable - rx->skb->data;
3494 if (baselen > rx->skb->len)
3495 return;
3496
3497 ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
3498 mgmt->u.beacon.variable,
3499 rx->skb->len - baselen);
3500 if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3501 ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
3502 const struct ieee80211_he_operation *he_oper;
3503 u8 color;
3504
3505 he_oper = (void *)(ie->data + 1);
3506 if (le32_get_bits(he_oper->he_oper_params,
3507 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3508 return;
3509
3510 color = le32_get_bits(he_oper->he_oper_params,
3511 IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3512 if (color == bss_conf->he_bss_color.color)
3513 ieee80211_obss_color_collision_notify(&rx->sdata->vif,
3514 BIT_ULL(color),
3515 bss_conf->link_id);
3516 }
3517 }
3518
3519 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data * rx)3520 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3521 {
3522 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3523 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3524
3525 if (ieee80211_is_s1g_beacon(mgmt->frame_control))
3526 return RX_CONTINUE;
3527
3528 /*
3529 * From here on, look only at management frames.
3530 * Data and control frames are already handled,
3531 * and unknown (reserved) frames are useless.
3532 */
3533 if (rx->skb->len < 24)
3534 return RX_DROP_U_RUNT_MGMT;
3535
3536 if (!ieee80211_is_mgmt(mgmt->frame_control))
3537 return RX_DROP_U_EXPECTED_MGMT;
3538
3539 /* drop too small action frames */
3540 if (ieee80211_is_action(mgmt->frame_control) &&
3541 rx->skb->len < IEEE80211_MIN_ACTION_SIZE(category))
3542 return RX_DROP_U_RUNT_ACTION;
3543
3544 /* Drop non-broadcast Beacon frames */
3545 if (ieee80211_is_beacon(mgmt->frame_control) &&
3546 !is_broadcast_ether_addr(mgmt->da))
3547 return RX_DROP_U_NONBCAST_BEACON;
3548
3549 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3550 ieee80211_is_beacon(mgmt->frame_control) &&
3551 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3552 int sig = 0;
3553
3554 /* sw bss color collision detection */
3555 ieee80211_rx_check_bss_color_collision(rx);
3556
3557 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3558 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3559 sig = status->signal;
3560
3561 cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,
3562 rx->skb->data, rx->skb->len,
3563 ieee80211_rx_status_to_khz(status),
3564 sig);
3565 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3566 }
3567
3568 return ieee80211_drop_unencrypted_mgmt(rx);
3569 }
3570
3571 static bool
ieee80211_process_rx_twt_action(struct ieee80211_rx_data * rx)3572 ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3573 {
3574 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
3575 struct ieee80211_sub_if_data *sdata = rx->sdata;
3576
3577 /* TWT actions are only supported in AP for the moment */
3578 if (sdata->vif.type != NL80211_IFTYPE_AP)
3579 return false;
3580
3581 if (!rx->local->ops->add_twt_setup)
3582 return false;
3583
3584 if (!sdata->vif.bss_conf.twt_responder)
3585 return false;
3586
3587 if (!rx->sta)
3588 return false;
3589
3590 switch (mgmt->u.action.action_code) {
3591 case WLAN_S1G_TWT_SETUP: {
3592 struct ieee80211_twt_setup *twt;
3593
3594 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) +
3595 sizeof(struct ieee80211_twt_setup) +
3596 2 /* TWT req_type agrt */)
3597 break;
3598
3599 twt = (void *)mgmt->u.action.s1g.variable;
3600 if (twt->element_id != WLAN_EID_S1G_TWT)
3601 break;
3602
3603 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) +
3604 3 + /* token + tlv */
3605 twt->length)
3606 break;
3607
3608 return true; /* queue the frame */
3609 }
3610 case WLAN_S1G_TWT_TEARDOWN:
3611 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) + 1)
3612 break;
3613
3614 return true; /* queue the frame */
3615 default:
3616 break;
3617 }
3618
3619 return false;
3620 }
3621
3622 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data * rx)3623 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3624 {
3625 struct ieee80211_local *local = rx->local;
3626 struct ieee80211_sub_if_data *sdata = rx->sdata;
3627 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3628 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3629 int len = rx->skb->len;
3630
3631 if (!ieee80211_is_action(mgmt->frame_control))
3632 return RX_CONTINUE;
3633
3634 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3635 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3636 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3637 return RX_DROP_U_ACTION_UNKNOWN_SRC;
3638
3639 switch (mgmt->u.action.category) {
3640 case WLAN_CATEGORY_HT:
3641 /* reject HT action frames from stations not supporting HT
3642 * or not HE Capable
3643 */
3644 if (!rx->link_sta->pub->ht_cap.ht_supported &&
3645 !rx->link_sta->pub->he_cap.has_he)
3646 goto invalid;
3647
3648 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3649 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3650 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3651 sdata->vif.type != NL80211_IFTYPE_AP &&
3652 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3653 break;
3654
3655 /* verify action & smps_control/chanwidth are present */
3656 if (len < IEEE80211_MIN_ACTION_SIZE(ht_smps))
3657 goto invalid;
3658
3659 switch (mgmt->u.action.action_code) {
3660 case WLAN_HT_ACTION_SMPS: {
3661 struct ieee80211_supported_band *sband;
3662 enum ieee80211_smps_mode smps_mode;
3663 struct sta_opmode_info sta_opmode = {};
3664
3665 if (sdata->vif.type != NL80211_IFTYPE_AP &&
3666 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3667 goto handled;
3668
3669 /* convert to HT capability */
3670 switch (mgmt->u.action.ht_smps.smps_control) {
3671 case WLAN_HT_SMPS_CONTROL_DISABLED:
3672 smps_mode = IEEE80211_SMPS_OFF;
3673 break;
3674 case WLAN_HT_SMPS_CONTROL_STATIC:
3675 smps_mode = IEEE80211_SMPS_STATIC;
3676 break;
3677 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3678 smps_mode = IEEE80211_SMPS_DYNAMIC;
3679 break;
3680 default:
3681 goto invalid;
3682 }
3683
3684 /* if no change do nothing */
3685 if (rx->link_sta->pub->smps_mode == smps_mode)
3686 goto handled;
3687 rx->link_sta->pub->smps_mode = smps_mode;
3688 sta_opmode.smps_mode =
3689 ieee80211_smps_mode_to_smps_mode(smps_mode);
3690 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3691
3692 sband = rx->local->hw.wiphy->bands[status->band];
3693
3694 rate_control_rate_update(local, sband, rx->link_sta,
3695 IEEE80211_RC_SMPS_CHANGED);
3696 cfg80211_sta_opmode_change_notify(sdata->dev,
3697 rx->sta->addr,
3698 &sta_opmode,
3699 GFP_ATOMIC);
3700 goto handled;
3701 }
3702 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3703 u8 chanwidth = mgmt->u.action.ht_notify_cw.chanwidth;
3704
3705 if (chanwidth != IEEE80211_HT_CHANWIDTH_20MHZ &&
3706 chanwidth != IEEE80211_HT_CHANWIDTH_ANY)
3707 goto invalid;
3708
3709 /* If it doesn't support 40 MHz it can't change ... */
3710 if (!(rx->link_sta->pub->ht_cap.cap &
3711 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3712 goto handled;
3713
3714 goto queue;
3715 }
3716 default:
3717 goto invalid;
3718 }
3719
3720 break;
3721 case WLAN_CATEGORY_PUBLIC:
3722 case WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION:
3723 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3724 goto invalid;
3725 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3726 break;
3727 if (!rx->sta)
3728 break;
3729 if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))
3730 break;
3731 if (mgmt->u.action.action_code !=
3732 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3733 break;
3734 if (len < IEEE80211_MIN_ACTION_SIZE(ext_chan_switch))
3735 goto invalid;
3736 goto queue;
3737 case WLAN_CATEGORY_VHT:
3738 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3739 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3740 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3741 sdata->vif.type != NL80211_IFTYPE_AP &&
3742 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3743 break;
3744
3745 /* verify action code is present */
3746 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3747 goto invalid;
3748
3749 switch (mgmt->u.action.action_code) {
3750 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3751 /* verify opmode is present */
3752 if (len < IEEE80211_MIN_ACTION_SIZE(vht_opmode_notif))
3753 goto invalid;
3754 goto queue;
3755 }
3756 case WLAN_VHT_ACTION_GROUPID_MGMT: {
3757 if (len < IEEE80211_MIN_ACTION_SIZE(vht_group_notif))
3758 goto invalid;
3759 goto queue;
3760 }
3761 default:
3762 break;
3763 }
3764 break;
3765 case WLAN_CATEGORY_BACK:
3766 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3767 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3768 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3769 sdata->vif.type != NL80211_IFTYPE_AP &&
3770 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3771 sdata->vif.type != NL80211_IFTYPE_NAN_DATA)
3772 break;
3773
3774 /* verify action_code is present */
3775 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3776 break;
3777
3778 switch (mgmt->u.action.action_code) {
3779 case WLAN_ACTION_ADDBA_REQ:
3780 case WLAN_ACTION_NDP_ADDBA_REQ:
3781 if (len < IEEE80211_MIN_ACTION_SIZE(addba_req))
3782 goto invalid;
3783 break;
3784 case WLAN_ACTION_ADDBA_RESP:
3785 case WLAN_ACTION_NDP_ADDBA_RESP:
3786 if (len < IEEE80211_MIN_ACTION_SIZE(addba_resp))
3787 goto invalid;
3788 break;
3789 case WLAN_ACTION_DELBA:
3790 case WLAN_ACTION_NDP_DELBA:
3791 if (len < IEEE80211_MIN_ACTION_SIZE(delba))
3792 goto invalid;
3793 break;
3794 default:
3795 goto invalid;
3796 }
3797
3798 goto queue;
3799 case WLAN_CATEGORY_SPECTRUM_MGMT:
3800 /* verify action_code is present */
3801 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3802 break;
3803
3804 switch (mgmt->u.action.action_code) {
3805 case WLAN_ACTION_SPCT_MSR_REQ:
3806 if (status->band != NL80211_BAND_5GHZ)
3807 break;
3808
3809 if (len < IEEE80211_MIN_ACTION_SIZE(measurement))
3810 break;
3811
3812 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3813 break;
3814
3815 ieee80211_process_measurement_req(sdata, mgmt, len);
3816 goto handled;
3817 case WLAN_ACTION_SPCT_CHL_SWITCH: {
3818 u8 *bssid;
3819 if (len < IEEE80211_MIN_ACTION_SIZE(chan_switch))
3820 break;
3821
3822 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3823 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3824 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3825 break;
3826
3827 if (sdata->vif.type == NL80211_IFTYPE_STATION)
3828 bssid = sdata->deflink.u.mgd.bssid;
3829 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3830 bssid = sdata->u.ibss.bssid;
3831 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3832 bssid = mgmt->sa;
3833 else
3834 break;
3835
3836 if (!ether_addr_equal(mgmt->bssid, bssid))
3837 break;
3838
3839 goto queue;
3840 }
3841 }
3842 break;
3843 case WLAN_CATEGORY_SELF_PROTECTED:
3844 if (len < IEEE80211_MIN_ACTION_SIZE(self_prot))
3845 break;
3846
3847 switch (mgmt->u.action.action_code) {
3848 case WLAN_SP_MESH_PEERING_OPEN:
3849 case WLAN_SP_MESH_PEERING_CLOSE:
3850 case WLAN_SP_MESH_PEERING_CONFIRM:
3851 if (!ieee80211_vif_is_mesh(&sdata->vif))
3852 goto invalid;
3853 if (sdata->u.mesh.user_mpm)
3854 /* userspace handles this frame */
3855 break;
3856 goto queue;
3857 case WLAN_SP_MGK_INFORM:
3858 case WLAN_SP_MGK_ACK:
3859 if (!ieee80211_vif_is_mesh(&sdata->vif))
3860 goto invalid;
3861 break;
3862 }
3863 break;
3864 case WLAN_CATEGORY_MESH_ACTION:
3865 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3866 break;
3867
3868 if (!ieee80211_vif_is_mesh(&sdata->vif))
3869 break;
3870 if (mesh_action_is_path_sel(mgmt) &&
3871 !mesh_path_sel_is_hwmp(sdata))
3872 break;
3873 goto queue;
3874 case WLAN_CATEGORY_S1G:
3875 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3876 break;
3877
3878 switch (mgmt->u.action.action_code) {
3879 case WLAN_S1G_TWT_SETUP:
3880 case WLAN_S1G_TWT_TEARDOWN:
3881 if (ieee80211_process_rx_twt_action(rx))
3882 goto queue;
3883 break;
3884 default:
3885 break;
3886 }
3887 break;
3888 case WLAN_CATEGORY_PROTECTED_EHT:
3889 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3890 break;
3891
3892 switch (mgmt->u.action.action_code) {
3893 case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
3894 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3895 break;
3896
3897 if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_req))
3898 goto invalid;
3899 goto queue;
3900 case WLAN_PROTECTED_EHT_ACTION_TTLM_RES:
3901 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3902 break;
3903
3904 if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_res))
3905 goto invalid;
3906 goto queue;
3907 case WLAN_PROTECTED_EHT_ACTION_TTLM_TEARDOWN:
3908 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3909 break;
3910
3911 if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_tear_down))
3912 goto invalid;
3913 goto queue;
3914 case WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_RESP:
3915 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3916 break;
3917
3918 /* The reconfiguration response action frame must
3919 * least one 'Status Duple' entry (3 octets)
3920 */
3921 if (len < IEEE80211_MIN_ACTION_SIZE(ml_reconf_resp) + 3)
3922 goto invalid;
3923 goto queue;
3924 case WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_RESP:
3925 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3926 break;
3927
3928 if (len < IEEE80211_MIN_ACTION_SIZE(epcs) +
3929 IEEE80211_EPCS_ENA_RESP_BODY_LEN)
3930 goto invalid;
3931 goto queue;
3932 case WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_TEARDOWN:
3933 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3934 break;
3935
3936 if (len < IEEE80211_MIN_ACTION_SIZE(epcs))
3937 goto invalid;
3938 goto queue;
3939 case WLAN_PROTECTED_EHT_ACTION_EML_OP_MODE_NOTIF:
3940 if (sdata->vif.type != NL80211_IFTYPE_AP)
3941 break;
3942
3943 if (len < IEEE80211_MIN_ACTION_SIZE(eml_omn))
3944 goto invalid;
3945 goto queue;
3946 default:
3947 break;
3948 }
3949 break;
3950 }
3951
3952 return RX_CONTINUE;
3953
3954 invalid:
3955 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3956 /* will return in the next handlers */
3957 return RX_CONTINUE;
3958
3959 handled:
3960 if (rx->sta)
3961 rx->link_sta->rx_stats.packets++;
3962 dev_kfree_skb(rx->skb);
3963 return RX_QUEUED;
3964
3965 queue:
3966 ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
3967 return RX_QUEUED;
3968 }
3969
3970 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data * rx)3971 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3972 {
3973 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3974 struct cfg80211_rx_info info = {
3975 .freq = ieee80211_rx_status_to_khz(status),
3976 .buf = rx->skb->data,
3977 .len = rx->skb->len,
3978 .link_id = rx->link_id,
3979 .have_link_id = rx->link_id >= 0,
3980 };
3981
3982 /* skip known-bad action frames and return them in the next handler */
3983 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3984 return RX_CONTINUE;
3985
3986 /*
3987 * Getting here means the kernel doesn't know how to handle
3988 * it, but maybe userspace does ... include returned frames
3989 * so userspace can register for those to know whether ones
3990 * it transmitted were processed or returned.
3991 */
3992
3993 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3994 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3995 info.sig_dbm = status->signal;
3996
3997 if (ieee80211_is_timing_measurement(rx->skb) ||
3998 ieee80211_is_ftm(rx->skb)) {
3999 info.rx_tstamp = ktime_to_ns(skb_hwtstamps(rx->skb)->hwtstamp);
4000 info.ack_tstamp = ktime_to_ns(status->ack_tx_hwtstamp);
4001 }
4002
4003 if (cfg80211_rx_mgmt_ext(&rx->sdata->wdev, &info)) {
4004 if (rx->sta)
4005 rx->link_sta->rx_stats.packets++;
4006 dev_kfree_skb(rx->skb);
4007 return RX_QUEUED;
4008 }
4009
4010 return RX_CONTINUE;
4011 }
4012
4013 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data * rx)4014 ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
4015 {
4016 struct ieee80211_sub_if_data *sdata = rx->sdata;
4017 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
4018 int len = rx->skb->len;
4019
4020 if (!ieee80211_is_action(mgmt->frame_control))
4021 return RX_CONTINUE;
4022
4023 switch (mgmt->u.action.category) {
4024 case WLAN_CATEGORY_SA_QUERY:
4025 if (len < IEEE80211_MIN_ACTION_SIZE(sa_query))
4026 break;
4027
4028 switch (mgmt->u.action.action_code) {
4029 case WLAN_ACTION_SA_QUERY_REQUEST:
4030 if (sdata->vif.type != NL80211_IFTYPE_STATION)
4031 break;
4032 ieee80211_process_sa_query_req(sdata, mgmt, len);
4033 goto handled;
4034 }
4035 break;
4036 }
4037
4038 return RX_CONTINUE;
4039
4040 handled:
4041 if (rx->sta)
4042 rx->link_sta->rx_stats.packets++;
4043 dev_kfree_skb(rx->skb);
4044 return RX_QUEUED;
4045 }
4046
4047 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data * rx)4048 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
4049 {
4050 struct ieee80211_local *local = rx->local;
4051 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
4052 struct sk_buff *nskb;
4053 struct ieee80211_sub_if_data *sdata = rx->sdata;
4054 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4055
4056 if (!ieee80211_is_action(mgmt->frame_control))
4057 return RX_CONTINUE;
4058
4059 /*
4060 * For AP mode, hostapd is responsible for handling any action
4061 * frames that we didn't handle, including returning unknown
4062 * ones. For all other modes we will return them to the sender,
4063 * setting the 0x80 bit in the action category, as required by
4064 * 802.11-2012 9.24.4.
4065 * Newer versions of hostapd use the management frame registration
4066 * mechanisms and old cooked monitor interface is no longer supported.
4067 */
4068 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
4069 (sdata->vif.type == NL80211_IFTYPE_AP ||
4070 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
4071 return RX_DROP_U_MALFORMED_ACTION;
4072
4073 if (is_multicast_ether_addr(mgmt->da))
4074 return RX_DROP_U_UNKNOWN_MCAST_ACTION;
4075
4076 /* do not return rejected action frames */
4077 if (mgmt->u.action.category & 0x80)
4078 return RX_DROP_U_REJECTED_ACTION_RESPONSE;
4079
4080 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
4081 GFP_ATOMIC);
4082 if (nskb) {
4083 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
4084
4085 nmgmt->u.action.category |= 0x80;
4086 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
4087 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
4088
4089 memset(nskb->cb, 0, sizeof(nskb->cb));
4090
4091 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
4092 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
4093
4094 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
4095 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
4096 IEEE80211_TX_CTL_NO_CCK_RATE;
4097 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
4098 info->hw_queue =
4099 local->hw.offchannel_tx_hw_queue;
4100 }
4101
4102 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, -1,
4103 status->band);
4104 }
4105
4106 return RX_DROP_U_UNKNOWN_ACTION_REJECTED;
4107 }
4108
4109 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_ext(struct ieee80211_rx_data * rx)4110 ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
4111 {
4112 struct ieee80211_sub_if_data *sdata = rx->sdata;
4113 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
4114
4115 if (!ieee80211_is_ext(hdr->frame_control))
4116 return RX_CONTINUE;
4117
4118 if (sdata->vif.type != NL80211_IFTYPE_STATION)
4119 return RX_DROP_U_UNEXPECTED_EXT_FRAME;
4120
4121 /* for now only beacons are ext, so queue them */
4122 ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4123
4124 return RX_QUEUED;
4125 }
4126
4127 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt(struct ieee80211_rx_data * rx)4128 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
4129 {
4130 struct ieee80211_sub_if_data *sdata = rx->sdata;
4131 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
4132 __le16 stype;
4133
4134 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
4135
4136 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
4137 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4138 sdata->vif.type != NL80211_IFTYPE_OCB &&
4139 sdata->vif.type != NL80211_IFTYPE_STATION)
4140 return RX_DROP_U_UNHANDLED_MGMT;
4141
4142 switch (stype) {
4143 case cpu_to_le16(IEEE80211_STYPE_AUTH):
4144 case cpu_to_le16(IEEE80211_STYPE_BEACON):
4145 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
4146 /* process for all: mesh, mlme, ibss */
4147 break;
4148 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
4149 if (is_multicast_ether_addr(mgmt->da) &&
4150 !is_broadcast_ether_addr(mgmt->da))
4151 return RX_DROP_U_MCAST_DEAUTH;
4152
4153 /* process only for station/IBSS */
4154 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
4155 sdata->vif.type != NL80211_IFTYPE_ADHOC)
4156 return RX_DROP_U_UNHANDLED_DEAUTH;
4157 break;
4158 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
4159 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
4160 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
4161 if (is_multicast_ether_addr(mgmt->da) &&
4162 !is_broadcast_ether_addr(mgmt->da))
4163 return RX_DROP_U_MCAST_DISASSOC;
4164
4165 /* process only for station */
4166 if (sdata->vif.type != NL80211_IFTYPE_STATION)
4167 return RX_DROP_U_UNHANDLED_DISASSOC;
4168 break;
4169 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
4170 /* process only for ibss and mesh */
4171 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4172 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
4173 return RX_DROP_U_UNHANDLED_PREQ;
4174 break;
4175 default:
4176 return RX_DROP_U_UNHANDLED_MGMT_STYPE;
4177 }
4178
4179 ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4180
4181 return RX_QUEUED;
4182 }
4183
ieee80211_rx_handlers_result(struct ieee80211_rx_data * rx,ieee80211_rx_result res)4184 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
4185 ieee80211_rx_result res)
4186 {
4187 if (res == RX_QUEUED) {
4188 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
4189 return;
4190 }
4191
4192 if (res != RX_CONTINUE) {
4193 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
4194 if (rx->sta)
4195 rx->link_sta->rx_stats.dropped++;
4196 }
4197
4198 kfree_skb_reason(rx->skb, (__force u32)res);
4199 }
4200
ieee80211_rx_handlers(struct ieee80211_rx_data * rx,struct sk_buff_head * frames)4201 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
4202 struct sk_buff_head *frames)
4203 {
4204 ieee80211_rx_result res;
4205 struct sk_buff *skb;
4206
4207 #define CALL_RXH(rxh) \
4208 do { \
4209 res = rxh(rx); \
4210 if (res != RX_CONTINUE) \
4211 goto rxh_next; \
4212 } while (0)
4213
4214 /* Lock here to avoid hitting all of the data used in the RX
4215 * path (e.g. key data, station data, ...) concurrently when
4216 * a frame is released from the reorder buffer due to timeout
4217 * from the timer, potentially concurrently with RX from the
4218 * driver.
4219 */
4220 spin_lock_bh(&rx->local->rx_path_lock);
4221
4222 while ((skb = __skb_dequeue(frames))) {
4223 /*
4224 * all the other fields are valid across frames
4225 * that belong to an aMPDU since they are on the
4226 * same TID from the same station
4227 */
4228 rx->skb = skb;
4229
4230 if (WARN_ON_ONCE(!rx->link)) {
4231 res = RX_DROP_U_NO_LINK;
4232 goto rxh_next;
4233 }
4234
4235 CALL_RXH(ieee80211_rx_h_check_more_data);
4236 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
4237 CALL_RXH(ieee80211_rx_h_sta_process);
4238 CALL_RXH(ieee80211_rx_h_decrypt);
4239 CALL_RXH(ieee80211_rx_h_defragment);
4240 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
4241 /* must be after MMIC verify so header is counted in MPDU mic */
4242 CALL_RXH(ieee80211_rx_h_amsdu);
4243 CALL_RXH(ieee80211_rx_h_data);
4244
4245 /* special treatment -- needs the queue */
4246 res = ieee80211_rx_h_ctrl(rx, frames);
4247 if (res != RX_CONTINUE)
4248 goto rxh_next;
4249
4250 CALL_RXH(ieee80211_rx_h_mgmt_check);
4251 CALL_RXH(ieee80211_rx_h_action);
4252 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
4253 CALL_RXH(ieee80211_rx_h_action_post_userspace);
4254 CALL_RXH(ieee80211_rx_h_action_return);
4255 CALL_RXH(ieee80211_rx_h_ext);
4256 CALL_RXH(ieee80211_rx_h_mgmt);
4257
4258 rxh_next:
4259 ieee80211_rx_handlers_result(rx, res);
4260
4261 #undef CALL_RXH
4262 }
4263
4264 spin_unlock_bh(&rx->local->rx_path_lock);
4265 }
4266
ieee80211_invoke_rx_handlers(struct ieee80211_rx_data * rx)4267 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
4268 {
4269 struct sk_buff_head reorder_release;
4270 ieee80211_rx_result res;
4271
4272 __skb_queue_head_init(&reorder_release);
4273
4274 #define CALL_RXH(rxh) \
4275 do { \
4276 res = rxh(rx); \
4277 if (res != RX_CONTINUE) \
4278 goto rxh_next; \
4279 } while (0)
4280
4281 CALL_RXH(ieee80211_rx_h_check_dup);
4282 CALL_RXH(ieee80211_rx_h_check);
4283
4284 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
4285
4286 ieee80211_rx_handlers(rx, &reorder_release);
4287 return;
4288
4289 rxh_next:
4290 ieee80211_rx_handlers_result(rx, res);
4291
4292 #undef CALL_RXH
4293 }
4294
4295 static bool
ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta * sta,u8 link_id)4296 ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
4297 {
4298 return !!(sta->valid_links & BIT(link_id));
4299 }
4300
ieee80211_rx_data_set_link(struct ieee80211_rx_data * rx,u8 link_id)4301 static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
4302 u8 link_id)
4303 {
4304 rx->link_id = link_id;
4305 rx->link = rcu_dereference(rx->sdata->link[link_id]);
4306
4307 if (!rx->sta)
4308 return rx->link;
4309
4310 if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
4311 return false;
4312
4313 rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
4314
4315 return rx->link && rx->link_sta;
4316 }
4317
ieee80211_rx_data_set_sta(struct ieee80211_rx_data * rx,struct sta_info * sta,int link_id)4318 static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
4319 struct sta_info *sta, int link_id)
4320 {
4321 rx->link_id = link_id;
4322 rx->sta = sta;
4323
4324 if (sta) {
4325 rx->local = sta->sdata->local;
4326 if (!rx->sdata)
4327 rx->sdata = sta->sdata;
4328 rx->link_sta = &sta->deflink;
4329 } else {
4330 rx->link_sta = NULL;
4331 }
4332
4333 if (link_id < 0) {
4334 if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
4335 sta && !sta->sta.valid_links)
4336 rx->link =
4337 rcu_dereference(rx->sdata->link[sta->deflink.link_id]);
4338 else
4339 rx->link = &rx->sdata->deflink;
4340 } else if (!ieee80211_rx_data_set_link(rx, link_id)) {
4341 return false;
4342 }
4343
4344 return true;
4345 }
4346
4347 /*
4348 * This function makes calls into the RX path, therefore
4349 * it has to be invoked under RCU read lock.
4350 */
ieee80211_release_reorder_timeout(struct sta_info * sta,int tid)4351 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4352 {
4353 struct sk_buff_head frames;
4354 struct ieee80211_rx_data rx = {
4355 /* This is OK -- must be QoS data frame */
4356 .security_idx = tid,
4357 .seqno_idx = tid,
4358 };
4359 struct tid_ampdu_rx *tid_agg_rx;
4360 int link_id = -1;
4361
4362 /* FIXME: statistics won't be right with this */
4363 if (sta->sta.valid_links)
4364 link_id = ffs(sta->sta.valid_links) - 1;
4365
4366 if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
4367 return;
4368
4369 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4370 if (!tid_agg_rx)
4371 return;
4372
4373 __skb_queue_head_init(&frames);
4374
4375 spin_lock(&tid_agg_rx->reorder_lock);
4376 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4377 spin_unlock(&tid_agg_rx->reorder_lock);
4378
4379 if (!skb_queue_empty(&frames)) {
4380 struct ieee80211_event event = {
4381 .type = BA_FRAME_TIMEOUT,
4382 .u.ba.tid = tid,
4383 .u.ba.sta = &sta->sta,
4384 };
4385 drv_event_callback(rx.local, rx.sdata, &event);
4386 }
4387
4388 ieee80211_rx_handlers(&rx, &frames);
4389 }
4390
ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta * pubsta,u8 tid,u16 ssn,u64 filtered,u16 received_mpdus)4391 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4392 u16 ssn, u64 filtered,
4393 u16 received_mpdus)
4394 {
4395 struct ieee80211_local *local;
4396 struct sta_info *sta;
4397 struct tid_ampdu_rx *tid_agg_rx;
4398 struct sk_buff_head frames;
4399 struct ieee80211_rx_data rx = {
4400 /* This is OK -- must be QoS data frame */
4401 .security_idx = tid,
4402 .seqno_idx = tid,
4403 };
4404 int i, diff;
4405
4406 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4407 return;
4408
4409 __skb_queue_head_init(&frames);
4410
4411 sta = container_of(pubsta, struct sta_info, sta);
4412
4413 local = sta->sdata->local;
4414 WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,
4415 "RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",
4416 local->hw.max_rx_aggregation_subframes);
4417
4418 if (!ieee80211_rx_data_set_sta(&rx, sta, -1))
4419 return;
4420
4421 rcu_read_lock();
4422 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4423 if (!tid_agg_rx)
4424 goto out;
4425
4426 spin_lock_bh(&tid_agg_rx->reorder_lock);
4427
4428 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4429 int release;
4430
4431 /* release all frames in the reorder buffer */
4432 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4433 IEEE80211_SN_MODULO;
4434 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
4435 release, &frames);
4436 /* update ssn to match received ssn */
4437 tid_agg_rx->head_seq_num = ssn;
4438 } else {
4439 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
4440 &frames);
4441 }
4442
4443 /* handle the case that received ssn is behind the mac ssn.
4444 * it can be tid_agg_rx->buf_size behind and still be valid */
4445 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4446 if (diff >= tid_agg_rx->buf_size) {
4447 tid_agg_rx->reorder_buf_filtered = 0;
4448 goto release;
4449 }
4450 filtered = filtered >> diff;
4451 ssn += diff;
4452
4453 /* update bitmap */
4454 for (i = 0; i < tid_agg_rx->buf_size; i++) {
4455 int index = (ssn + i) % tid_agg_rx->buf_size;
4456
4457 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4458 if (filtered & BIT_ULL(i))
4459 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4460 }
4461
4462 /* now process also frames that the filter marking released */
4463 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4464
4465 release:
4466 spin_unlock_bh(&tid_agg_rx->reorder_lock);
4467
4468 ieee80211_rx_handlers(&rx, &frames);
4469
4470 out:
4471 rcu_read_unlock();
4472 }
4473 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4474
4475 /* main receive path */
4476
ieee80211_bssid_match(const u8 * raddr,const u8 * addr)4477 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4478 {
4479 return ether_addr_equal(raddr, addr) ||
4480 is_broadcast_ether_addr(raddr);
4481 }
4482
ieee80211_accept_frame(struct ieee80211_rx_data * rx)4483 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
4484 {
4485 struct ieee80211_sub_if_data *sdata = rx->sdata;
4486 struct sk_buff *skb = rx->skb;
4487 struct ieee80211_hdr *hdr = (void *)skb->data;
4488 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4489 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
4490 bool multicast = is_multicast_ether_addr(hdr->addr1) ||
4491 ieee80211_is_s1g_beacon(hdr->frame_control);
4492 static const u8 nan_network_id[ETH_ALEN] __aligned(2) = {
4493 0x51, 0x6F, 0x9A, 0x01, 0x00, 0x00
4494 };
4495
4496 switch (sdata->vif.type) {
4497 case NL80211_IFTYPE_STATION:
4498 if (!bssid && !sdata->u.mgd.use_4addr)
4499 return false;
4500 if (ieee80211_is_first_frag(hdr->seq_ctrl) &&
4501 ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4502 return false;
4503 if (multicast)
4504 return true;
4505 return ieee80211_is_our_addr(sdata, hdr->addr1, &rx->link_id);
4506 case NL80211_IFTYPE_ADHOC:
4507 if (!bssid)
4508 return false;
4509 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
4510 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
4511 !is_valid_ether_addr(hdr->addr2))
4512 return false;
4513 if (ieee80211_is_beacon(hdr->frame_control))
4514 return true;
4515 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
4516 return false;
4517 if (!multicast &&
4518 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
4519 return false;
4520 if (!rx->sta) {
4521 int rate_idx;
4522 if (status->encoding != RX_ENC_LEGACY)
4523 rate_idx = 0; /* TODO: HT/VHT rates */
4524 else
4525 rate_idx = status->rate_idx;
4526 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
4527 BIT(rate_idx));
4528 }
4529 return true;
4530 case NL80211_IFTYPE_OCB:
4531 if (!bssid)
4532 return false;
4533 if (!ieee80211_is_data_present(hdr->frame_control))
4534 return false;
4535 if (!is_broadcast_ether_addr(bssid))
4536 return false;
4537 if (!multicast &&
4538 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
4539 return false;
4540 /* reject invalid/our STA address */
4541 if (!is_valid_ether_addr(hdr->addr2) ||
4542 ether_addr_equal(sdata->dev->dev_addr, hdr->addr2))
4543 return false;
4544 if (!rx->sta) {
4545 int rate_idx;
4546 if (status->encoding != RX_ENC_LEGACY)
4547 rate_idx = 0; /* TODO: HT rates */
4548 else
4549 rate_idx = status->rate_idx;
4550 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
4551 BIT(rate_idx));
4552 }
4553 return true;
4554 case NL80211_IFTYPE_MESH_POINT:
4555 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
4556 return false;
4557 if (multicast)
4558 return true;
4559 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
4560 case NL80211_IFTYPE_AP_VLAN:
4561 case NL80211_IFTYPE_AP:
4562 if (!bssid)
4563 return ieee80211_is_our_addr(sdata, hdr->addr1,
4564 &rx->link_id);
4565
4566 if (!is_broadcast_ether_addr(bssid) &&
4567 !ieee80211_is_our_addr(sdata, bssid, NULL)) {
4568 /*
4569 * Accept public action frames even when the
4570 * BSSID doesn't match, this is used for P2P
4571 * and location updates. Note that mac80211
4572 * itself never looks at these frames.
4573 */
4574 if (!multicast &&
4575 !ieee80211_is_our_addr(sdata, hdr->addr1,
4576 &rx->link_id))
4577 return false;
4578 if (ieee80211_is_public_action(hdr, skb->len))
4579 return true;
4580 return ieee80211_is_beacon(hdr->frame_control);
4581 }
4582
4583 if (!ieee80211_has_tods(hdr->frame_control)) {
4584 /* ignore data frames to TDLS-peers */
4585 if (ieee80211_is_data(hdr->frame_control))
4586 return false;
4587 /* ignore action frames to TDLS-peers */
4588 if (ieee80211_is_action(hdr->frame_control) &&
4589 !is_broadcast_ether_addr(bssid) &&
4590 !ether_addr_equal(bssid, hdr->addr1))
4591 return false;
4592 }
4593
4594 /*
4595 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
4596 * the BSSID - we've checked that already but may have accepted
4597 * the wildcard (ff:ff:ff:ff:ff:ff).
4598 *
4599 * It also says:
4600 * The BSSID of the Data frame is determined as follows:
4601 * a) If the STA is contained within an AP or is associated
4602 * with an AP, the BSSID is the address currently in use
4603 * by the STA contained in the AP.
4604 *
4605 * So we should not accept data frames with an address that's
4606 * multicast.
4607 *
4608 * Accepting it also opens a security problem because stations
4609 * could encrypt it with the GTK and inject traffic that way.
4610 */
4611 if (ieee80211_is_data(hdr->frame_control) && multicast)
4612 return false;
4613
4614 return true;
4615 case NL80211_IFTYPE_P2P_DEVICE:
4616 return ieee80211_is_public_action(hdr, skb->len) ||
4617 ieee80211_is_probe_req(hdr->frame_control) ||
4618 ieee80211_is_probe_resp(hdr->frame_control) ||
4619 ieee80211_is_beacon(hdr->frame_control) ||
4620 (ieee80211_is_auth(hdr->frame_control) &&
4621 ether_addr_equal(sdata->vif.addr, hdr->addr1));
4622 case NL80211_IFTYPE_NAN:
4623 if (ieee80211_has_tods(hdr->frame_control) ||
4624 ieee80211_has_fromds(hdr->frame_control))
4625 return false;
4626
4627 /* Accept only frames that are addressed to the NAN cluster
4628 * (based on the Cluster ID). From these frames, accept only
4629 * action frames or authentication frames that are addressed to
4630 * the local NAN interface.
4631 */
4632 return memcmp(sdata->wdev.u.nan.cluster_id,
4633 hdr->addr3, ETH_ALEN) == 0 &&
4634 (ieee80211_is_public_action(hdr, skb->len) ||
4635 (ieee80211_is_auth(hdr->frame_control) &&
4636 ether_addr_equal(sdata->vif.addr, hdr->addr1)));
4637 case NL80211_IFTYPE_NAN_DATA:
4638 if (ieee80211_has_tods(hdr->frame_control) ||
4639 ieee80211_has_fromds(hdr->frame_control))
4640 return false;
4641
4642 if (ieee80211_is_data(hdr->frame_control)) {
4643 struct ieee80211_sub_if_data *nmi;
4644
4645 nmi = rcu_dereference(sdata->u.nan_data.nmi);
4646 if (!nmi)
4647 return false;
4648
4649 if (!ether_addr_equal(nmi->wdev.u.nan.cluster_id,
4650 hdr->addr3))
4651 return false;
4652
4653 return multicast ||
4654 ether_addr_equal(sdata->vif.addr, hdr->addr1);
4655 }
4656
4657 /* Non-public action frames (unicast or multicast) */
4658 if (ieee80211_is_action(hdr->frame_control) &&
4659 !ieee80211_is_public_action(hdr, skb->len) &&
4660 (ether_addr_equal(nan_network_id, hdr->addr1) ||
4661 ether_addr_equal(sdata->vif.addr, hdr->addr1)))
4662 return true;
4663
4664 /* Unicast secure management frames */
4665 return ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
4666 ieee80211_is_unicast_robust_mgmt_frame(skb);
4667 default:
4668 break;
4669 }
4670
4671 WARN_ON_ONCE(1);
4672 return false;
4673 }
4674
ieee80211_check_fast_rx(struct sta_info * sta)4675 void ieee80211_check_fast_rx(struct sta_info *sta)
4676 {
4677 struct ieee80211_sub_if_data *sdata = sta->sdata;
4678 struct ieee80211_local *local = sdata->local;
4679 struct ieee80211_key *key;
4680 struct ieee80211_fast_rx fastrx = {
4681 .dev = sdata->dev,
4682 .vif_type = sdata->vif.type,
4683 .control_port_protocol = sdata->control_port_protocol,
4684 }, *old, *new = NULL;
4685 u32 offload_flags;
4686 bool set_offload = false;
4687 bool assign = false;
4688 bool offload;
4689
4690 /* use sparse to check that we don't return without updating */
4691 __acquire(check_fast_rx);
4692
4693 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4694 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4695 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
4696 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
4697
4698 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4699
4700 /* fast-rx doesn't do reordering */
4701 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4702 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4703 goto clear;
4704
4705 switch (sdata->vif.type) {
4706 case NL80211_IFTYPE_STATION:
4707 if (sta->sta.tdls) {
4708 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4709 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4710 fastrx.expected_ds_bits = 0;
4711 } else {
4712 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4713 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4714 fastrx.expected_ds_bits =
4715 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4716 }
4717
4718 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4719 fastrx.expected_ds_bits |=
4720 cpu_to_le16(IEEE80211_FCTL_TODS);
4721 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4722 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4723 }
4724
4725 if (!sdata->u.mgd.powersave)
4726 break;
4727
4728 /* software powersave is a huge mess, avoid all of it */
4729 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4730 goto clear;
4731 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4732 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4733 goto clear;
4734 break;
4735 case NL80211_IFTYPE_AP_VLAN:
4736 case NL80211_IFTYPE_AP:
4737 /* parallel-rx requires this, at least with calls to
4738 * ieee80211_sta_ps_transition()
4739 */
4740 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4741 goto clear;
4742 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4743 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4744 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4745
4746 fastrx.internal_forward =
4747 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4748 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4749 !sdata->u.vlan.sta);
4750
4751 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4752 sdata->u.vlan.sta) {
4753 fastrx.expected_ds_bits |=
4754 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4755 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4756 fastrx.internal_forward = 0;
4757 }
4758
4759 break;
4760 case NL80211_IFTYPE_MESH_POINT:
4761 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
4762 IEEE80211_FCTL_TODS);
4763 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4764 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4765 break;
4766 default:
4767 goto clear;
4768 }
4769
4770 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
4771 goto clear;
4772
4773 rcu_read_lock();
4774 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4775 if (!key)
4776 key = rcu_dereference(sdata->default_unicast_key);
4777 if (key) {
4778 switch (key->conf.cipher) {
4779 case WLAN_CIPHER_SUITE_TKIP:
4780 /* we don't want to deal with MMIC in fast-rx */
4781 goto clear_rcu;
4782 case WLAN_CIPHER_SUITE_CCMP:
4783 case WLAN_CIPHER_SUITE_CCMP_256:
4784 case WLAN_CIPHER_SUITE_GCMP:
4785 case WLAN_CIPHER_SUITE_GCMP_256:
4786 break;
4787 default:
4788 /* We also don't want to deal with
4789 * WEP or cipher scheme.
4790 */
4791 goto clear_rcu;
4792 }
4793
4794 fastrx.key = true;
4795 fastrx.icv_len = key->conf.icv_len;
4796 }
4797
4798 assign = true;
4799 clear_rcu:
4800 rcu_read_unlock();
4801 clear:
4802 __release(check_fast_rx);
4803
4804 if (assign)
4805 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
4806
4807 offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
4808 offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
4809
4810 if (assign && offload)
4811 set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4812 else
4813 set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4814
4815 if (set_offload)
4816 drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
4817
4818 spin_lock_bh(&sta->lock);
4819 old = rcu_dereference_protected(sta->fast_rx, true);
4820 rcu_assign_pointer(sta->fast_rx, new);
4821 spin_unlock_bh(&sta->lock);
4822
4823 if (old)
4824 kfree_rcu(old, rcu_head);
4825 }
4826
ieee80211_clear_fast_rx(struct sta_info * sta)4827 void ieee80211_clear_fast_rx(struct sta_info *sta)
4828 {
4829 struct ieee80211_fast_rx *old;
4830
4831 spin_lock_bh(&sta->lock);
4832 old = rcu_dereference_protected(sta->fast_rx, true);
4833 RCU_INIT_POINTER(sta->fast_rx, NULL);
4834 spin_unlock_bh(&sta->lock);
4835
4836 if (old)
4837 kfree_rcu(old, rcu_head);
4838 }
4839
__ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data * sdata)4840 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4841 {
4842 struct ieee80211_local *local = sdata->local;
4843 struct sta_info *sta;
4844
4845 lockdep_assert_wiphy(local->hw.wiphy);
4846
4847 list_for_each_entry(sta, &local->sta_list, list) {
4848 if (sdata != sta->sdata &&
4849 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4850 continue;
4851 ieee80211_check_fast_rx(sta);
4852 }
4853 }
4854
ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data * sdata)4855 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4856 {
4857 struct ieee80211_local *local = sdata->local;
4858
4859 lockdep_assert_wiphy(local->hw.wiphy);
4860
4861 __ieee80211_check_fast_rx_iface(sdata);
4862 }
4863
ieee80211_rx_8023(struct ieee80211_rx_data * rx,struct ieee80211_fast_rx * fast_rx,int orig_len)4864 static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4865 struct ieee80211_fast_rx *fast_rx,
4866 int orig_len)
4867 {
4868 struct ieee80211_sta_rx_stats *stats;
4869 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4870 struct sta_info *sta = rx->sta;
4871 struct link_sta_info *link_sta;
4872 struct sk_buff *skb = rx->skb;
4873 void *sa = skb->data + ETH_ALEN;
4874 void *da = skb->data;
4875
4876 if (rx->link_id >= 0) {
4877 link_sta = rcu_dereference(sta->link[rx->link_id]);
4878 if (WARN_ON_ONCE(!link_sta)) {
4879 dev_kfree_skb(rx->skb);
4880 return;
4881 }
4882 } else {
4883 link_sta = &sta->deflink;
4884 }
4885
4886 stats = &link_sta->rx_stats;
4887 if (fast_rx->uses_rss)
4888 stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
4889
4890 /* statistics part of ieee80211_rx_h_sta_process() */
4891 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4892 stats->last_signal = status->signal;
4893 if (!fast_rx->uses_rss)
4894 ewma_signal_add(&link_sta->rx_stats_avg.signal,
4895 -status->signal);
4896 }
4897
4898 if (status->chains) {
4899 int i;
4900
4901 stats->chains = status->chains;
4902 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4903 int signal = status->chain_signal[i];
4904
4905 if (!(status->chains & BIT(i)))
4906 continue;
4907
4908 stats->chain_signal_last[i] = signal;
4909 if (!fast_rx->uses_rss)
4910 ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
4911 -signal);
4912 }
4913 }
4914 /* end of statistics */
4915
4916 stats->last_rx = jiffies;
4917 stats->last_rate = sta_stats_encode_rate(status);
4918
4919 stats->fragments++;
4920 stats->packets++;
4921
4922 skb->dev = fast_rx->dev;
4923
4924 dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
4925
4926 /* The seqno index has the same property as needed
4927 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4928 * for non-QoS-data frames. Here we know it's a data
4929 * frame, so count MSDUs.
4930 */
4931 u64_stats_update_begin(&stats->syncp);
4932 u64_stats_inc(&stats->msdu[rx->seqno_idx]);
4933 u64_stats_add(&stats->bytes, orig_len);
4934 u64_stats_update_end(&stats->syncp);
4935
4936 if (fast_rx->internal_forward) {
4937 struct sk_buff *xmit_skb = NULL;
4938 if (is_multicast_ether_addr(da)) {
4939 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4940 } else if (!ether_addr_equal(da, sa) &&
4941 sta_info_get(rx->sdata, da)) {
4942 xmit_skb = skb;
4943 skb = NULL;
4944 }
4945
4946 if (xmit_skb) {
4947 /*
4948 * Send to wireless media and increase priority by 256
4949 * to keep the received priority instead of
4950 * reclassifying the frame (see cfg80211_classify8021d).
4951 */
4952 xmit_skb->priority += 256;
4953 xmit_skb->protocol = htons(ETH_P_802_3);
4954 skb_reset_network_header(xmit_skb);
4955 skb_reset_mac_header(xmit_skb);
4956 dev_queue_xmit(xmit_skb);
4957 }
4958
4959 if (!skb)
4960 return;
4961 }
4962
4963 /* deliver to local stack */
4964 skb->protocol = eth_type_trans(skb, fast_rx->dev);
4965 ieee80211_deliver_skb_to_local_stack(skb, rx);
4966 }
4967
ieee80211_invoke_fast_rx(struct ieee80211_rx_data * rx,struct ieee80211_fast_rx * fast_rx)4968 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4969 struct ieee80211_fast_rx *fast_rx)
4970 {
4971 struct sk_buff *skb = rx->skb;
4972 struct ieee80211_hdr *hdr = (void *)skb->data;
4973 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4974 ieee80211_rx_result res;
4975 int orig_len = skb->len;
4976 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
4977 int snap_offs = hdrlen;
4978 struct {
4979 u8 snap[sizeof(rfc1042_header)];
4980 __be16 proto;
4981 } *payload __aligned(2);
4982 struct {
4983 u8 da[ETH_ALEN];
4984 u8 sa[ETH_ALEN];
4985 } addrs __aligned(2);
4986 struct ieee80211_sta_rx_stats *stats;
4987
4988 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
4989 * to a common data structure; drivers can implement that per queue
4990 * but we don't have that information in mac80211
4991 */
4992 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4993 return false;
4994
4995 #define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4996
4997 /* If using encryption, we also need to have:
4998 * - PN_VALIDATED: similar, but the implementation is tricky
4999 * - DECRYPTED: necessary for PN_VALIDATED
5000 */
5001 if (fast_rx->key &&
5002 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
5003 return false;
5004
5005 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
5006 return false;
5007
5008 if (unlikely(ieee80211_is_frag(hdr)))
5009 return false;
5010
5011 /* Since our interface address cannot be multicast, this
5012 * implicitly also rejects multicast frames without the
5013 * explicit check.
5014 *
5015 * We shouldn't get any *data* frames not addressed to us
5016 * (AP mode will accept multicast *management* frames), but
5017 * punting here will make it go through the full checks in
5018 * ieee80211_accept_frame().
5019 */
5020 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
5021 return false;
5022
5023 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
5024 IEEE80211_FCTL_TODS)) !=
5025 fast_rx->expected_ds_bits)
5026 return false;
5027
5028 /* assign the key to drop unencrypted frames (later)
5029 * and strip the IV/MIC if necessary
5030 */
5031 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
5032 /* GCMP header length is the same */
5033 snap_offs += IEEE80211_CCMP_HDR_LEN;
5034 }
5035
5036 if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
5037 !(status->rx_flags & IEEE80211_RX_AMSDU)) {
5038 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
5039 return false;
5040
5041 payload = (void *)(skb->data + snap_offs);
5042
5043 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
5044 return false;
5045
5046 /* Don't handle these here since they require special code.
5047 * Accept AARP and IPX even though they should come with a
5048 * bridge-tunnel header - but if we get them this way then
5049 * there's little point in discarding them.
5050 */
5051 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
5052 payload->proto == fast_rx->control_port_protocol))
5053 return false;
5054 }
5055
5056 /* after this point, don't punt to the slowpath! */
5057
5058 if (fast_rx->uses_rss)
5059 stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
5060 else
5061 stats = &rx->link_sta->rx_stats;
5062
5063 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
5064 pskb_trim(skb, skb->len - fast_rx->icv_len))
5065 goto drop;
5066
5067 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
5068 goto drop;
5069
5070 if (status->rx_flags & IEEE80211_RX_AMSDU) {
5071 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
5072 RX_QUEUED)
5073 goto drop;
5074
5075 return true;
5076 }
5077
5078 /* do the header conversion - first grab the addresses */
5079 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
5080 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
5081 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
5082 skb_pull(skb, snap_offs - 2);
5083 put_unaligned_be16(skb->len - 2, skb->data);
5084 } else {
5085 skb_postpull_rcsum(skb, skb->data + snap_offs,
5086 sizeof(rfc1042_header) + 2);
5087
5088 /* remove the SNAP but leave the ethertype */
5089 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
5090 }
5091 /* push the addresses in front */
5092 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
5093
5094 res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
5095 switch (res) {
5096 case RX_QUEUED:
5097 stats->last_rx = jiffies;
5098 stats->last_rate = sta_stats_encode_rate(status);
5099 return true;
5100 case RX_CONTINUE:
5101 break;
5102 default:
5103 goto drop;
5104 }
5105
5106 ieee80211_rx_8023(rx, fast_rx, orig_len);
5107
5108 return true;
5109 drop:
5110 dev_kfree_skb(skb);
5111
5112 stats->dropped++;
5113 return true;
5114 }
5115
5116 /*
5117 * This function returns whether or not the SKB
5118 * was destined for RX processing or not, which,
5119 * if consume is true, is equivalent to whether
5120 * or not the skb was consumed.
5121 */
ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data * rx,struct sk_buff * skb,bool consume)5122 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
5123 struct sk_buff *skb, bool consume)
5124 {
5125 struct ieee80211_local *local = rx->local;
5126 struct ieee80211_sub_if_data *sdata = rx->sdata;
5127 struct ieee80211_hdr *hdr = (void *)skb->data;
5128 struct link_sta_info *link_sta = rx->link_sta;
5129 struct ieee80211_link_data *link = rx->link;
5130
5131 rx->skb = skb;
5132
5133 /* See if we can do fast-rx; if we have to copy we already lost,
5134 * so punt in that case. We should never have to deliver a data
5135 * frame to multiple interfaces anyway.
5136 *
5137 * We skip the ieee80211_accept_frame() call and do the necessary
5138 * checking inside ieee80211_invoke_fast_rx().
5139 */
5140 if (consume && rx->sta) {
5141 struct ieee80211_fast_rx *fast_rx;
5142
5143 fast_rx = rcu_dereference(rx->sta->fast_rx);
5144 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
5145 return true;
5146 }
5147
5148 if (!ieee80211_accept_frame(rx))
5149 return false;
5150
5151 if (!consume) {
5152 struct skb_shared_hwtstamps *shwt;
5153
5154 rx->skb = skb_copy(skb, GFP_ATOMIC);
5155 if (!rx->skb) {
5156 if (net_ratelimit())
5157 wiphy_debug(local->hw.wiphy,
5158 "failed to copy skb for %s\n",
5159 sdata->name);
5160 return true;
5161 }
5162
5163 /* skb_copy() does not copy the hw timestamps, so copy it
5164 * explicitly
5165 */
5166 shwt = skb_hwtstamps(rx->skb);
5167 shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
5168
5169 /* Update the hdr pointer to the new skb for translation below */
5170 hdr = (struct ieee80211_hdr *)rx->skb->data;
5171 }
5172
5173 /* Store a copy of the pre-translated link addresses for SW crypto */
5174 if (unlikely(is_unicast_ether_addr(hdr->addr1) &&
5175 !ieee80211_is_data(hdr->frame_control)))
5176 memcpy(rx->link_addrs, &hdr->addrs, 3 * ETH_ALEN);
5177
5178 if (unlikely(rx->sta && rx->sta->sta.mlo) &&
5179 is_unicast_ether_addr(hdr->addr1) &&
5180 !ieee80211_is_probe_resp(hdr->frame_control) &&
5181 !ieee80211_is_beacon(hdr->frame_control)) {
5182 /* translate to MLD addresses */
5183 if (ether_addr_equal(link->conf->addr, hdr->addr1))
5184 ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
5185 if (ether_addr_equal(link_sta->addr, hdr->addr2))
5186 ether_addr_copy(hdr->addr2, rx->sta->addr);
5187 /* translate A3 only if it's the BSSID */
5188 if (!ieee80211_has_tods(hdr->frame_control) &&
5189 !ieee80211_has_fromds(hdr->frame_control)) {
5190 if (ether_addr_equal(link_sta->addr, hdr->addr3))
5191 ether_addr_copy(hdr->addr3, rx->sta->addr);
5192 else if (ether_addr_equal(link->conf->addr, hdr->addr3))
5193 ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);
5194 }
5195 /* not needed for A4 since it can only carry the SA */
5196 }
5197
5198 ieee80211_invoke_rx_handlers(rx);
5199 return true;
5200 }
5201
__ieee80211_rx_handle_8023(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct list_head * list)5202 static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
5203 struct ieee80211_sta *pubsta,
5204 struct sk_buff *skb,
5205 struct list_head *list)
5206 {
5207 struct ieee80211_local *local = hw_to_local(hw);
5208 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5209 struct ieee80211_fast_rx *fast_rx;
5210 struct ieee80211_rx_data rx;
5211 struct sta_info *sta;
5212 int link_id = -1;
5213
5214 memset(&rx, 0, sizeof(rx));
5215 rx.skb = skb;
5216 rx.local = local;
5217 rx.list = list;
5218 rx.link_id = -1;
5219
5220 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5221
5222 /* drop frame if too short for header */
5223 if (skb->len < sizeof(struct ethhdr))
5224 goto drop;
5225
5226 if (!pubsta)
5227 goto drop;
5228
5229 if (status->link_valid)
5230 link_id = status->link_id;
5231
5232 /*
5233 * TODO: Should the frame be dropped if the right link_id is not
5234 * available? Or may be it is fine in the current form to proceed with
5235 * the frame processing because with frame being in 802.3 format,
5236 * link_id is used only for stats purpose and updating the stats on
5237 * the deflink is fine?
5238 */
5239 sta = container_of(pubsta, struct sta_info, sta);
5240 if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5241 goto drop;
5242
5243 fast_rx = rcu_dereference(rx.sta->fast_rx);
5244 if (!fast_rx)
5245 goto drop;
5246
5247 ieee80211_rx_8023(&rx, fast_rx, skb->len);
5248 return;
5249
5250 drop:
5251 dev_kfree_skb(skb);
5252 }
5253
ieee80211_rx_for_interface(struct ieee80211_rx_data * rx,struct sk_buff * skb,bool consume)5254 static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
5255 struct sk_buff *skb, bool consume)
5256 {
5257 struct link_sta_info *link_sta;
5258 struct ieee80211_hdr *hdr = (void *)skb->data;
5259 struct sta_info *sta;
5260 int link_id = -1;
5261
5262 /*
5263 * Look up link station first, in case there's a
5264 * chance that they might have a link address that
5265 * is identical to the MLD address, that way we'll
5266 * have the link information if needed.
5267 */
5268 link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
5269 if (link_sta) {
5270 sta = link_sta->sta;
5271 link_id = link_sta->link_id;
5272 } else {
5273 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5274
5275 sta = sta_info_get_bss(rx->sdata, hdr->addr2);
5276 if (status->link_valid) {
5277 link_id = status->link_id;
5278 } else if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
5279 status->freq) {
5280 struct ieee80211_link_data *link;
5281 struct ieee80211_chanctx_conf *conf;
5282
5283 for_each_link_data_rcu(rx->sdata, link) {
5284 conf = rcu_dereference(link->conf->chanctx_conf);
5285 if (!conf || !conf->def.chan)
5286 continue;
5287
5288 if (status->freq == conf->def.chan->center_freq) {
5289 link_id = link->link_id;
5290 break;
5291 }
5292 }
5293 }
5294 }
5295
5296 if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
5297 return false;
5298
5299 return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5300 }
5301
5302 /*
5303 * This is the actual Rx frames handler. as it belongs to Rx path it must
5304 * be called with rcu_read_lock protection.
5305 */
__ieee80211_rx_handle_packet(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct list_head * list)5306 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
5307 struct ieee80211_sta *pubsta,
5308 struct sk_buff *skb,
5309 struct list_head *list)
5310 {
5311 struct ieee80211_local *local = hw_to_local(hw);
5312 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5313 struct ieee80211_sub_if_data *sdata;
5314 struct ieee80211_hdr *hdr;
5315 __le16 fc;
5316 struct ieee80211_rx_data rx;
5317 struct ieee80211_sub_if_data *prev;
5318 struct rhlist_head *tmp;
5319 int err = 0;
5320
5321 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
5322 memset(&rx, 0, sizeof(rx));
5323 rx.skb = skb;
5324 rx.local = local;
5325 rx.list = list;
5326 rx.link_id = -1;
5327
5328 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
5329 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5330
5331 if (ieee80211_is_mgmt(fc)) {
5332 /* drop frame if too short for header */
5333 if (skb->len < ieee80211_hdrlen(fc))
5334 err = -ENOBUFS;
5335 else
5336 err = skb_linearize(skb);
5337 } else {
5338 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
5339 }
5340
5341 if (err) {
5342 dev_kfree_skb(skb);
5343 return;
5344 }
5345
5346 hdr = (struct ieee80211_hdr *)skb->data;
5347 ieee80211_parse_qos(&rx);
5348 ieee80211_verify_alignment(&rx);
5349
5350 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
5351 ieee80211_is_beacon(hdr->frame_control) ||
5352 ieee80211_is_s1g_beacon(hdr->frame_control)))
5353 ieee80211_scan_rx(local, skb);
5354
5355 if (ieee80211_is_data(fc)) {
5356 struct sta_info *sta, *prev_sta;
5357 int link_id = -1;
5358
5359 if (status->link_valid)
5360 link_id = status->link_id;
5361
5362 if (pubsta) {
5363 sta = container_of(pubsta, struct sta_info, sta);
5364 if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5365 goto out;
5366
5367 /*
5368 * In MLO connection, fetch the link_id using addr2
5369 * when the driver does not pass link_id in status.
5370 * When the address translation is already performed by
5371 * driver/hw, the valid link_id must be passed in
5372 * status.
5373 */
5374
5375 if (!status->link_valid && pubsta->mlo) {
5376 struct link_sta_info *link_sta;
5377
5378 link_sta = link_sta_info_get_bss(rx.sdata,
5379 hdr->addr2);
5380 if (!link_sta)
5381 goto out;
5382
5383 if (!ieee80211_rx_data_set_link(&rx,
5384 link_sta->link_id))
5385 goto out;
5386 }
5387
5388 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5389 return;
5390 goto out;
5391 }
5392
5393 prev_sta = NULL;
5394
5395 for_each_sta_info(local, hdr->addr2, sta, tmp) {
5396 if (!prev_sta) {
5397 prev_sta = sta;
5398 continue;
5399 }
5400
5401 rx.sdata = prev_sta->sdata;
5402 if (!status->link_valid && prev_sta->sta.mlo) {
5403 struct link_sta_info *link_sta;
5404
5405 link_sta = link_sta_info_get_bss(rx.sdata,
5406 hdr->addr2);
5407 if (!link_sta)
5408 continue;
5409
5410 link_id = link_sta->link_id;
5411 }
5412
5413 if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5414 goto out;
5415
5416 ieee80211_prepare_and_rx_handle(&rx, skb, false);
5417
5418 prev_sta = sta;
5419 }
5420
5421 if (prev_sta) {
5422 rx.sdata = prev_sta->sdata;
5423 if (!status->link_valid && prev_sta->sta.mlo) {
5424 struct link_sta_info *link_sta;
5425
5426 link_sta = link_sta_info_get_bss(rx.sdata,
5427 hdr->addr2);
5428 if (!link_sta)
5429 goto out;
5430
5431 link_id = link_sta->link_id;
5432 }
5433
5434 if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5435 goto out;
5436
5437 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5438 return;
5439 goto out;
5440 }
5441 }
5442
5443 prev = NULL;
5444
5445 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
5446 if (!ieee80211_sdata_running(sdata))
5447 continue;
5448
5449 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
5450 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
5451 continue;
5452
5453 /*
5454 * frame is destined for this interface, but if it's
5455 * not also for the previous one we handle that after
5456 * the loop to avoid copying the SKB once too much
5457 */
5458
5459 if (!prev) {
5460 prev = sdata;
5461 continue;
5462 }
5463
5464 rx.sdata = prev;
5465 ieee80211_rx_for_interface(&rx, skb, false);
5466
5467 prev = sdata;
5468 }
5469
5470 if (prev) {
5471 rx.sdata = prev;
5472
5473 if (ieee80211_rx_for_interface(&rx, skb, true))
5474 return;
5475 }
5476
5477 out:
5478 dev_kfree_skb(skb);
5479 }
5480
5481 /*
5482 * This is the receive path handler. It is called by a low level driver when an
5483 * 802.11 MPDU is received from the hardware.
5484 */
ieee80211_rx_list(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct list_head * list)5485 void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5486 struct sk_buff *skb, struct list_head *list)
5487 {
5488 struct ieee80211_local *local = hw_to_local(hw);
5489 struct ieee80211_rate *rate = NULL;
5490 struct ieee80211_supported_band *sband;
5491 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5492 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
5493
5494 WARN_ON_ONCE(softirq_count() == 0);
5495
5496 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
5497 goto drop;
5498
5499 sband = local->hw.wiphy->bands[status->band];
5500 if (WARN_ON(!sband))
5501 goto drop;
5502
5503 /*
5504 * If we're suspending, it is possible although not too likely
5505 * that we'd be receiving frames after having already partially
5506 * quiesced the stack. We can't process such frames then since
5507 * that might, for example, cause stations to be added or other
5508 * driver callbacks be invoked.
5509 */
5510 if (unlikely(local->quiescing || local->suspended))
5511 goto drop;
5512
5513 /* We might be during a HW reconfig, prevent Rx for the same reason */
5514 if (unlikely(local->in_reconfig))
5515 goto drop;
5516
5517 /*
5518 * The same happens when we're not even started,
5519 * but that's worth a warning.
5520 */
5521 if (WARN_ON(!local->started))
5522 goto drop;
5523
5524 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC) &&
5525 !(status->flag & RX_FLAG_NO_PSDU &&
5526 status->zero_length_psdu_type ==
5527 IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED))) {
5528 /*
5529 * Validate the rate, unless there was a PLCP error which may
5530 * have an invalid rate or the PSDU was not capture and may be
5531 * missing rate information.
5532 */
5533
5534 switch (status->encoding) {
5535 case RX_ENC_HT:
5536 /*
5537 * rate_idx is MCS index, which can be [0-76]
5538 * as documented on:
5539 *
5540 * https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
5541 *
5542 * Anything else would be some sort of driver or
5543 * hardware error. The driver should catch hardware
5544 * errors.
5545 */
5546 if (WARN(status->rate_idx > 76,
5547 "Rate marked as an HT rate but passed "
5548 "status->rate_idx is not "
5549 "an MCS index [0-76]: %d (0x%02x)\n",
5550 status->rate_idx,
5551 status->rate_idx))
5552 goto drop;
5553 break;
5554 case RX_ENC_VHT:
5555 if (WARN_ONCE(status->rate_idx > 11 ||
5556 !status->nss ||
5557 status->nss > 8,
5558 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
5559 status->rate_idx, status->nss))
5560 goto drop;
5561 break;
5562 case RX_ENC_HE:
5563 if (WARN_ONCE(status->rate_idx > 11 ||
5564 !status->nss ||
5565 status->nss > 8,
5566 "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5567 status->rate_idx, status->nss))
5568 goto drop;
5569 break;
5570 case RX_ENC_EHT:
5571 if (WARN_ONCE(status->rate_idx > 15 ||
5572 !status->nss ||
5573 status->nss > 8 ||
5574 status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5575 "Rate marked as an EHT rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5576 status->rate_idx, status->nss, status->eht.gi))
5577 goto drop;
5578 break;
5579 case RX_ENC_UHR:
5580 if (WARN_ONCE(!(status->rate_idx <= 15 ||
5581 status->rate_idx == 17 ||
5582 status->rate_idx == 19 ||
5583 status->rate_idx == 20 ||
5584 status->rate_idx == 23) ||
5585 !status->nss ||
5586 status->nss > 8 ||
5587 status->uhr.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5588 "Rate marked as a UHR rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5589 status->rate_idx, status->nss, status->uhr.gi))
5590 goto drop;
5591 if (WARN_ONCE(status->uhr.elr &&
5592 (status->nss != 1 || status->rate_idx > 1 ||
5593 status->uhr.gi != NL80211_RATE_INFO_EHT_GI_1_6 ||
5594 status->bw != RATE_INFO_BW_20 || status->uhr.im),
5595 "bad UHR ELR MCS MCS:%d, NSS:%d, GI:%d, BW:%d, IM:%d\n",
5596 status->rate_idx, status->nss, status->uhr.gi,
5597 status->bw, status->uhr.im))
5598 goto drop;
5599 if (WARN_ONCE(status->uhr.im &&
5600 (status->nss != 1 || status->rate_idx == 15),
5601 "bad UHR IM MCS MCS:%d, NSS:%d\n",
5602 status->rate_idx, status->nss))
5603 goto drop;
5604 break;
5605 default:
5606 WARN_ON_ONCE(1);
5607 fallthrough;
5608 case RX_ENC_LEGACY:
5609 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
5610 goto drop;
5611 rate = &sband->bitrates[status->rate_idx];
5612 }
5613 }
5614
5615 if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
5616 goto drop;
5617
5618 status->rx_flags = 0;
5619
5620 kcov_remote_start_common(skb_get_kcov_handle(skb));
5621
5622 /*
5623 * Frames with failed FCS/PLCP checksum are not returned,
5624 * all other frames are returned without radiotap header
5625 * if it was previously present.
5626 * Also, frames with less than 16 bytes are dropped.
5627 */
5628 if (!(status->flag & RX_FLAG_8023))
5629 skb = ieee80211_rx_monitor(local, skb, rate);
5630 if (skb) {
5631 if ((status->flag & RX_FLAG_8023) ||
5632 ieee80211_is_data_present(hdr->frame_control))
5633 ieee80211_tpt_led_trig_rx(local, skb->len);
5634
5635 if (status->flag & RX_FLAG_8023)
5636 __ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5637 else
5638 __ieee80211_rx_handle_packet(hw, pubsta, skb, list);
5639 }
5640
5641 kcov_remote_stop();
5642 return;
5643 drop:
5644 kfree_skb(skb);
5645 }
5646 EXPORT_SYMBOL(ieee80211_rx_list);
5647
ieee80211_rx_napi(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct napi_struct * napi)5648 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5649 struct sk_buff *skb, struct napi_struct *napi)
5650 {
5651 struct sk_buff *tmp;
5652 LIST_HEAD(list);
5653
5654
5655 /*
5656 * key references and virtual interfaces are protected using RCU
5657 * and this requires that we are in a read-side RCU section during
5658 * receive processing
5659 */
5660 rcu_read_lock();
5661 ieee80211_rx_list(hw, pubsta, skb, &list);
5662 rcu_read_unlock();
5663
5664 if (!napi) {
5665 netif_receive_skb_list(&list);
5666 return;
5667 }
5668
5669 list_for_each_entry_safe(skb, tmp, &list, list) {
5670 skb_list_del_init(skb);
5671 napi_gro_receive(napi, skb);
5672 }
5673 }
5674 EXPORT_SYMBOL(ieee80211_rx_napi);
5675
5676 /* This is a version of the rx handler that can be called from hard irq
5677 * context. Post the skb on the queue and schedule the tasklet */
ieee80211_rx_irqsafe(struct ieee80211_hw * hw,struct sk_buff * skb)5678 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
5679 {
5680 struct ieee80211_local *local = hw_to_local(hw);
5681
5682 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5683
5684 skb->pkt_type = IEEE80211_RX_MSG;
5685 skb_queue_tail(&local->skb_queue, skb);
5686 tasklet_schedule(&local->tasklet);
5687 }
5688 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
5689