1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright 2002-2005, Instant802 Networks, Inc. 4 * Copyright 2005-2006, Devicescape Software, Inc. 5 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 6 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net> 7 * Copyright 2013-2014 Intel Mobile Communications GmbH 8 * Copyright (C) 2015-2017 Intel Deutschland GmbH 9 * Copyright (C) 2018-2026 Intel Corporation 10 * 11 * element parsing for mac80211 12 */ 13 14 #include <net/mac80211.h> 15 #include <linux/netdevice.h> 16 #include <linux/export.h> 17 #include <linux/types.h> 18 #include <linux/slab.h> 19 #include <linux/skbuff.h> 20 #include <linux/etherdevice.h> 21 #include <linux/if_arp.h> 22 #include <linux/bitmap.h> 23 #include <linux/crc32.h> 24 #include <net/net_namespace.h> 25 #include <net/cfg80211.h> 26 #include <net/rtnetlink.h> 27 #include <kunit/visibility.h> 28 29 #include "ieee80211_i.h" 30 #include "driver-ops.h" 31 #include "rate.h" 32 #include "mesh.h" 33 #include "wme.h" 34 #include "led.h" 35 #include "wep.h" 36 37 static const u8 empty_non_inheritance[] = { 38 WLAN_EID_EXTENSION, 1, WLAN_EID_EXT_NON_INHERITANCE, 39 /* 40 * cfg80211_is_element_inherited() hardcodes elements that 41 * cannot be inherited, so we just need an empty one to be 42 * calling it at all. 43 */ 44 }; 45 46 struct ieee80211_elem_defrag { 47 const struct element *elem; 48 /* container start/len */ 49 const u8 *start; 50 size_t len; 51 }; 52 53 struct ieee80211_elems_parse { 54 /* must be first for kfree to work */ 55 struct ieee802_11_elems elems; 56 57 struct ieee80211_elem_defrag ml_reconf, ml_epcs, ml_basic; 58 59 bool inside_multilink; 60 bool skip_vendor; 61 62 /* 63 * scratch buffer that can be used for various element parsing related 64 * tasks, e.g., element de-fragmentation etc. 65 */ 66 size_t scratch_len; 67 u8 *scratch_pos; 68 u8 scratch[] __counted_by(scratch_len); 69 }; 70 71 static void 72 ieee80211_parse_extension_element(u32 *crc, 73 const struct element *elem, 74 struct ieee80211_elems_parse *elems_parse, 75 struct ieee80211_elems_parse_params *params) 76 { 77 struct ieee802_11_elems *elems = &elems_parse->elems; 78 const void *data = elem->data + 1; 79 bool calc_crc = false; 80 u8 len; 81 82 if (!elem->datalen) 83 return; 84 85 len = elem->datalen - 1; 86 87 switch (elem->data[0]) { 88 case WLAN_EID_EXT_HE_MU_EDCA: 89 if (params->mode < IEEE80211_CONN_MODE_HE) 90 break; 91 calc_crc = true; 92 if (len >= sizeof(*elems->mu_edca_param_set)) 93 elems->mu_edca_param_set = data; 94 break; 95 case WLAN_EID_EXT_HE_CAPABILITY: 96 if (params->mode < IEEE80211_CONN_MODE_HE) 97 break; 98 if (ieee80211_he_capa_size_ok(data, len)) { 99 elems->he_cap = data; 100 elems->he_cap_len = len; 101 } 102 break; 103 case WLAN_EID_EXT_HE_OPERATION: 104 if (params->mode < IEEE80211_CONN_MODE_HE) 105 break; 106 calc_crc = true; 107 if (len >= sizeof(*elems->he_operation) && 108 len >= ieee80211_he_oper_size(data) - 1) 109 elems->he_operation = data; 110 break; 111 case WLAN_EID_EXT_UORA: 112 if (params->mode < IEEE80211_CONN_MODE_HE) 113 break; 114 if (len >= 1) 115 elems->uora_element = data; 116 break; 117 case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME: 118 if (len == 3) 119 elems->max_channel_switch_time = data; 120 break; 121 case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION: 122 if (len >= sizeof(*elems->mbssid_config_ie)) 123 elems->mbssid_config_ie = data; 124 break; 125 case WLAN_EID_EXT_HE_SPR: 126 if (params->mode < IEEE80211_CONN_MODE_HE) 127 break; 128 if (len >= sizeof(*elems->he_spr) && 129 len >= ieee80211_he_spr_size(data) - 1) 130 elems->he_spr = data; 131 break; 132 case WLAN_EID_EXT_HE_6GHZ_CAPA: 133 if (params->mode < IEEE80211_CONN_MODE_HE) 134 break; 135 if (len >= sizeof(*elems->he_6ghz_capa)) 136 elems->he_6ghz_capa = data; 137 break; 138 case WLAN_EID_EXT_EHT_CAPABILITY: 139 if (params->mode < IEEE80211_CONN_MODE_EHT) 140 break; 141 if (ieee80211_eht_capa_size_ok(elems->he_cap, 142 data, len, 143 params->from_ap)) { 144 elems->eht_cap = data; 145 elems->eht_cap_len = len; 146 } 147 break; 148 case WLAN_EID_EXT_EHT_OPERATION: 149 if (params->mode < IEEE80211_CONN_MODE_EHT) 150 break; 151 if (ieee80211_eht_oper_size_ok(data, len)) 152 elems->eht_operation = data; 153 calc_crc = true; 154 break; 155 case WLAN_EID_EXT_EHT_MULTI_LINK: 156 if (params->mode < IEEE80211_CONN_MODE_EHT) 157 break; 158 calc_crc = true; 159 160 if (ieee80211_mle_size_ok(data, len)) { 161 const struct ieee80211_multi_link_elem *mle = 162 (void *)data; 163 164 switch (le16_get_bits(mle->control, 165 IEEE80211_ML_CONTROL_TYPE)) { 166 case IEEE80211_ML_CONTROL_TYPE_BASIC: 167 if (elems_parse->inside_multilink) { 168 elems->parse_error |= 169 IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC; 170 break; 171 } 172 elems_parse->ml_basic.elem = elem; 173 elems_parse->ml_basic.start = params->start; 174 elems_parse->ml_basic.len = params->len; 175 break; 176 case IEEE80211_ML_CONTROL_TYPE_RECONF: 177 elems_parse->ml_reconf.elem = elem; 178 elems_parse->ml_reconf.start = params->start; 179 elems_parse->ml_reconf.len = params->len; 180 break; 181 case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: 182 elems_parse->ml_epcs.elem = elem; 183 elems_parse->ml_epcs.start = params->start; 184 elems_parse->ml_epcs.len = params->len; 185 break; 186 default: 187 break; 188 } 189 } 190 break; 191 case WLAN_EID_EXT_BANDWIDTH_INDICATION: 192 if (params->mode < IEEE80211_CONN_MODE_EHT) 193 break; 194 if (ieee80211_bandwidth_indication_size_ok(data, len)) 195 elems->bandwidth_indication = data; 196 calc_crc = true; 197 break; 198 case WLAN_EID_EXT_TID_TO_LINK_MAPPING: 199 if (params->mode < IEEE80211_CONN_MODE_EHT) 200 break; 201 calc_crc = true; 202 if (ieee80211_tid_to_link_map_size_ok(data, len) && 203 elems->ttlm_num < ARRAY_SIZE(elems->ttlm)) { 204 elems->ttlm[elems->ttlm_num] = (void *)data; 205 elems->ttlm_num++; 206 } 207 break; 208 case WLAN_EID_EXT_CIP_CAPA: 209 if (len >= sizeof(*elems->cip_cap)) 210 elems->cip_cap = data; 211 break; 212 case WLAN_EID_EXT_UHR_OPER: 213 if (params->mode < IEEE80211_CONN_MODE_UHR) 214 break; 215 calc_crc = true; 216 if (ieee80211_uhr_oper_size_ok(data, len)) { 217 elems->uhr_operation = data; 218 elems->uhr_operation_len = len; 219 } 220 break; 221 case WLAN_EID_EXT_UHR_CAPA: 222 if (params->mode < IEEE80211_CONN_MODE_UHR) 223 break; 224 calc_crc = true; 225 if (ieee80211_uhr_capa_size_ok(data, len, true)) { 226 elems->uhr_cap = data; 227 elems->uhr_cap_len = len; 228 } 229 break; 230 } 231 232 if (crc && calc_crc) 233 *crc = crc32_be(*crc, (void *)elem, elem->datalen + 2); 234 } 235 236 static void ieee80211_parse_tpe(struct ieee80211_parsed_tpe *tpe, 237 const u8 *data, u8 len) 238 { 239 const struct ieee80211_tx_pwr_env *env = (const void *)data; 240 u8 count, interpret, category; 241 u8 *out, N, *cnt_out = NULL, *N_out = NULL; 242 243 if (!ieee80211_valid_tpe_element(data, len)) 244 return; 245 246 count = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_COUNT); 247 interpret = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_INTERPRET); 248 category = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_CATEGORY); 249 250 switch (interpret) { 251 case IEEE80211_TPE_LOCAL_EIRP: 252 out = tpe->max_local[category].power; 253 cnt_out = &tpe->max_local[category].count; 254 tpe->max_local[category].valid = true; 255 break; 256 case IEEE80211_TPE_REG_CLIENT_EIRP: 257 out = tpe->max_reg_client[category].power; 258 cnt_out = &tpe->max_reg_client[category].count; 259 tpe->max_reg_client[category].valid = true; 260 break; 261 case IEEE80211_TPE_LOCAL_EIRP_PSD: 262 out = tpe->psd_local[category].power; 263 cnt_out = &tpe->psd_local[category].count; 264 N_out = &tpe->psd_local[category].n; 265 tpe->psd_local[category].valid = true; 266 break; 267 case IEEE80211_TPE_REG_CLIENT_EIRP_PSD: 268 out = tpe->psd_reg_client[category].power; 269 cnt_out = &tpe->psd_reg_client[category].count; 270 N_out = &tpe->psd_reg_client[category].n; 271 tpe->psd_reg_client[category].valid = true; 272 break; 273 } 274 275 switch (interpret) { 276 case IEEE80211_TPE_LOCAL_EIRP: 277 case IEEE80211_TPE_REG_CLIENT_EIRP: 278 /* count was validated <= 3, plus 320 MHz */ 279 BUILD_BUG_ON(IEEE80211_TPE_EIRP_ENTRIES_320MHZ < 5); 280 memcpy(out, env->variable, count + 1); 281 *cnt_out = count + 1; 282 /* separately take 320 MHz if present */ 283 if (count == 3 && len > sizeof(*env) + count + 1) { 284 out[4] = env->variable[4]; 285 *cnt_out = 5; 286 } 287 break; 288 case IEEE80211_TPE_LOCAL_EIRP_PSD: 289 case IEEE80211_TPE_REG_CLIENT_EIRP_PSD: 290 if (!count) { 291 memset(out, env->variable[0], 292 IEEE80211_TPE_PSD_ENTRIES_320MHZ); 293 *cnt_out = IEEE80211_TPE_PSD_ENTRIES_320MHZ; 294 break; 295 } 296 297 N = 1 << (count - 1); 298 memcpy(out, env->variable, N); 299 *cnt_out = N; 300 *N_out = N; 301 302 if (len > sizeof(*env) + N) { 303 int K = u8_get_bits(env->variable[N], 304 IEEE80211_TX_PWR_ENV_EXT_COUNT); 305 306 K = min(K, IEEE80211_TPE_PSD_ENTRIES_320MHZ - N); 307 memcpy(out + N, env->variable + N + 1, K); 308 (*cnt_out) += K; 309 } 310 break; 311 } 312 } 313 314 static u32 315 _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params, 316 struct ieee80211_elems_parse *elems_parse, 317 const struct element *check_inherit) 318 { 319 struct ieee802_11_elems *elems = &elems_parse->elems; 320 const struct element *elem; 321 bool calc_crc = params->filter != 0; 322 DECLARE_BITMAP(seen_elems, 256); 323 u32 crc = params->crc; 324 325 bitmap_zero(seen_elems, 256); 326 327 switch (params->type) { 328 /* we don't need to parse assoc request, luckily (it's value 0) */ 329 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_REQ: 330 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_REQ: 331 default: 332 WARN(1, "invalid frame type 0x%x for element parsing\n", 333 params->type); 334 break; 335 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_RESP: 336 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_RESP: 337 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ: 338 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP: 339 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON: 340 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION: 341 case IEEE80211_FTYPE_EXT | IEEE80211_STYPE_S1G_BEACON: 342 break; 343 } 344 345 for_each_element(elem, params->start, params->len) { 346 const struct element *subelem; 347 u8 elem_parse_failed; 348 u8 id = elem->id; 349 u8 elen = elem->datalen; 350 const u8 *pos = elem->data; 351 352 if (check_inherit && 353 !cfg80211_is_element_inherited(elem, 354 check_inherit)) 355 continue; 356 357 switch (id) { 358 case WLAN_EID_SSID: 359 case WLAN_EID_SUPP_RATES: 360 case WLAN_EID_FH_PARAMS: 361 case WLAN_EID_DS_PARAMS: 362 case WLAN_EID_CF_PARAMS: 363 case WLAN_EID_TIM: 364 case WLAN_EID_IBSS_PARAMS: 365 case WLAN_EID_CHALLENGE: 366 case WLAN_EID_RSN: 367 case WLAN_EID_ERP_INFO: 368 case WLAN_EID_EXT_SUPP_RATES: 369 case WLAN_EID_HT_CAPABILITY: 370 case WLAN_EID_HT_OPERATION: 371 case WLAN_EID_VHT_CAPABILITY: 372 case WLAN_EID_VHT_OPERATION: 373 case WLAN_EID_MESH_ID: 374 case WLAN_EID_MESH_CONFIG: 375 case WLAN_EID_PEER_MGMT: 376 case WLAN_EID_PREQ: 377 case WLAN_EID_PREP: 378 case WLAN_EID_PERR: 379 case WLAN_EID_RANN: 380 case WLAN_EID_CHANNEL_SWITCH: 381 case WLAN_EID_EXT_CHANSWITCH_ANN: 382 case WLAN_EID_COUNTRY: 383 case WLAN_EID_PWR_CONSTRAINT: 384 case WLAN_EID_TIMEOUT_INTERVAL: 385 case WLAN_EID_SECONDARY_CHANNEL_OFFSET: 386 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH: 387 case WLAN_EID_CHAN_SWITCH_PARAM: 388 case WLAN_EID_EXT_CAPABILITY: 389 case WLAN_EID_CHAN_SWITCH_TIMING: 390 case WLAN_EID_LINK_ID: 391 case WLAN_EID_BSS_MAX_IDLE_PERIOD: 392 case WLAN_EID_RSNX: 393 case WLAN_EID_S1G_BCN_COMPAT: 394 case WLAN_EID_S1G_CAPABILITIES: 395 case WLAN_EID_S1G_OPERATION: 396 case WLAN_EID_AID_RESPONSE: 397 case WLAN_EID_S1G_SHORT_BCN_INTERVAL: 398 /* 399 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible 400 * that if the content gets bigger it might be needed more than once 401 */ 402 if (test_bit(id, seen_elems)) { 403 elems->parse_error |= 404 IEEE80211_PARSE_ERR_DUP_ELEM; 405 continue; 406 } 407 break; 408 } 409 410 if (calc_crc && id < 64 && (params->filter & (1ULL << id))) 411 crc = crc32_be(crc, pos - 2, elen + 2); 412 413 elem_parse_failed = 0; 414 415 switch (id) { 416 case WLAN_EID_LINK_ID: 417 if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) { 418 elem_parse_failed = 419 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 420 break; 421 } 422 elems->lnk_id = (void *)(pos - 2); 423 break; 424 case WLAN_EID_CHAN_SWITCH_TIMING: 425 if (elen < sizeof(struct ieee80211_ch_switch_timing)) { 426 elem_parse_failed = 427 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 428 break; 429 } 430 elems->ch_sw_timing = (void *)pos; 431 break; 432 case WLAN_EID_EXT_CAPABILITY: 433 elems->ext_capab = pos; 434 elems->ext_capab_len = elen; 435 break; 436 case WLAN_EID_SSID: 437 elems->ssid = pos; 438 elems->ssid_len = elen; 439 break; 440 case WLAN_EID_SUPP_RATES: 441 elems->supp_rates = pos; 442 elems->supp_rates_len = elen; 443 break; 444 case WLAN_EID_DS_PARAMS: 445 if (elen >= 1) 446 elems->ds_params = pos; 447 else 448 elem_parse_failed = 449 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 450 break; 451 case WLAN_EID_TIM: 452 if ((params->mode == IEEE80211_CONN_MODE_S1G && 453 elen >= 2 /* control/PVB are optional */) || 454 elen >= sizeof(struct ieee80211_tim_ie)) { 455 elems->tim = (void *)pos; 456 elems->tim_len = elen; 457 } else { 458 elem_parse_failed = 459 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 460 } 461 break; 462 case WLAN_EID_VENDOR_SPECIFIC: 463 if (elems_parse->skip_vendor) 464 break; 465 466 if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 && 467 pos[2] == 0xf2) { 468 /* Microsoft OUI (00:50:F2) */ 469 470 if (calc_crc) 471 crc = crc32_be(crc, pos - 2, elen + 2); 472 473 if (elen >= 5 && pos[3] == 2) { 474 /* OUI Type 2 - WMM IE */ 475 if (pos[4] == 0) { 476 elems->wmm_info = pos; 477 elems->wmm_info_len = elen; 478 } else if (pos[4] == 1) { 479 elems->wmm_param = pos; 480 elems->wmm_param_len = elen; 481 } 482 } 483 } 484 break; 485 case WLAN_EID_RSN: 486 elems->rsn = pos; 487 elems->rsn_len = elen; 488 break; 489 case WLAN_EID_ERP_INFO: 490 if (elen >= 1) 491 elems->erp_info = pos; 492 else 493 elem_parse_failed = 494 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 495 break; 496 case WLAN_EID_EXT_SUPP_RATES: 497 elems->ext_supp_rates = pos; 498 elems->ext_supp_rates_len = elen; 499 break; 500 case WLAN_EID_HT_CAPABILITY: 501 if (params->mode < IEEE80211_CONN_MODE_HT) 502 break; 503 if (elen >= sizeof(struct ieee80211_ht_cap)) 504 elems->ht_cap_elem = (void *)pos; 505 else 506 elem_parse_failed = 507 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 508 break; 509 case WLAN_EID_HT_OPERATION: 510 if (params->mode < IEEE80211_CONN_MODE_HT) 511 break; 512 if (elen >= sizeof(struct ieee80211_ht_operation)) 513 elems->ht_operation = (void *)pos; 514 else 515 elem_parse_failed = 516 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 517 break; 518 case WLAN_EID_VHT_CAPABILITY: 519 if (params->mode < IEEE80211_CONN_MODE_VHT) 520 break; 521 if (elen >= sizeof(struct ieee80211_vht_cap)) 522 elems->vht_cap_elem = (void *)pos; 523 else 524 elem_parse_failed = 525 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 526 break; 527 case WLAN_EID_VHT_OPERATION: 528 if (params->mode < IEEE80211_CONN_MODE_VHT) 529 break; 530 if (elen >= sizeof(struct ieee80211_vht_operation)) { 531 elems->vht_operation = (void *)pos; 532 if (calc_crc) 533 crc = crc32_be(crc, pos - 2, elen + 2); 534 break; 535 } 536 elem_parse_failed = 537 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 538 break; 539 case WLAN_EID_OPMODE_NOTIF: 540 if (params->mode < IEEE80211_CONN_MODE_VHT) 541 break; 542 if (elen > 0) { 543 elems->opmode_notif = pos; 544 if (calc_crc) 545 crc = crc32_be(crc, pos - 2, elen + 2); 546 break; 547 } 548 elem_parse_failed = 549 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 550 break; 551 case WLAN_EID_MESH_ID: 552 elems->mesh_id = pos; 553 elems->mesh_id_len = elen; 554 break; 555 case WLAN_EID_MESH_CONFIG: 556 if (elen >= sizeof(struct ieee80211_meshconf_ie)) 557 elems->mesh_config = (void *)pos; 558 else 559 elem_parse_failed = 560 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 561 break; 562 case WLAN_EID_PEER_MGMT: 563 elems->peering = pos; 564 elems->peering_len = elen; 565 break; 566 case WLAN_EID_MESH_AWAKE_WINDOW: 567 if (elen >= 2) 568 elems->awake_window = (void *)pos; 569 break; 570 case WLAN_EID_PREQ: 571 if (ieee80211_mesh_preq_size_ok(pos, elen)) { 572 elems->preq = pos; 573 elems->preq_len = elen; 574 } else { 575 elem_parse_failed = 576 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 577 } 578 break; 579 case WLAN_EID_PREP: 580 if (ieee80211_mesh_prep_size_ok(pos, elen)) { 581 elems->prep = pos; 582 elems->prep_len = elen; 583 } else { 584 elem_parse_failed = 585 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 586 } 587 break; 588 case WLAN_EID_PERR: 589 if (ieee80211_mesh_perr_size_ok(pos, elen)) { 590 elems->perr = pos; 591 elems->perr_len = elen; 592 } else { 593 elem_parse_failed = 594 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 595 } 596 break; 597 case WLAN_EID_RANN: 598 if (elen >= sizeof(struct ieee80211_rann_ie)) 599 elems->rann = (void *)pos; 600 else 601 elem_parse_failed = 602 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 603 break; 604 case WLAN_EID_CHANNEL_SWITCH: 605 if (elen != sizeof(struct ieee80211_channel_sw_ie)) { 606 elem_parse_failed = 607 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 608 break; 609 } 610 elems->ch_switch_ie = (void *)pos; 611 break; 612 case WLAN_EID_EXT_CHANSWITCH_ANN: 613 if (elen != sizeof(struct ieee80211_ext_chansw_ie)) { 614 elem_parse_failed = 615 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 616 break; 617 } 618 elems->ext_chansw_ie = (void *)pos; 619 break; 620 case WLAN_EID_SECONDARY_CHANNEL_OFFSET: 621 if (params->mode < IEEE80211_CONN_MODE_HT) 622 break; 623 if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) { 624 elem_parse_failed = 625 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 626 break; 627 } 628 elems->sec_chan_offs = (void *)pos; 629 break; 630 case WLAN_EID_CHAN_SWITCH_PARAM: 631 if (elen < 632 sizeof(*elems->mesh_chansw_params_ie)) { 633 elem_parse_failed = 634 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 635 break; 636 } 637 elems->mesh_chansw_params_ie = (void *)pos; 638 break; 639 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH: 640 if (params->mode < IEEE80211_CONN_MODE_VHT) 641 break; 642 643 if (params->type != (IEEE80211_FTYPE_MGMT | 644 IEEE80211_STYPE_ACTION)) { 645 elem_parse_failed = 646 IEEE80211_PARSE_ERR_UNEXPECTED_ELEM; 647 break; 648 } 649 650 if (elen < sizeof(*elems->wide_bw_chansw_ie)) { 651 elem_parse_failed = 652 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 653 break; 654 } 655 elems->wide_bw_chansw_ie = (void *)pos; 656 break; 657 case WLAN_EID_CHANNEL_SWITCH_WRAPPER: 658 if (params->mode < IEEE80211_CONN_MODE_VHT) 659 break; 660 if (params->type == (IEEE80211_FTYPE_MGMT | 661 IEEE80211_STYPE_ACTION)) { 662 elem_parse_failed = 663 IEEE80211_PARSE_ERR_UNEXPECTED_ELEM; 664 break; 665 } 666 /* 667 * This is a bit tricky, but as we only care about 668 * a few elements, parse them out manually. 669 */ 670 subelem = cfg80211_find_elem(WLAN_EID_WIDE_BW_CHANNEL_SWITCH, 671 pos, elen); 672 if (subelem) { 673 if (subelem->datalen >= sizeof(*elems->wide_bw_chansw_ie)) 674 elems->wide_bw_chansw_ie = 675 (void *)subelem->data; 676 else 677 elem_parse_failed = 678 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 679 } 680 681 if (params->mode < IEEE80211_CONN_MODE_EHT) 682 break; 683 684 subelem = cfg80211_find_ext_elem(WLAN_EID_EXT_BANDWIDTH_INDICATION, 685 pos, elen); 686 if (subelem) { 687 const void *edata = subelem->data + 1; 688 u8 edatalen = subelem->datalen - 1; 689 690 if (ieee80211_bandwidth_indication_size_ok(edata, 691 edatalen)) 692 elems->bandwidth_indication = edata; 693 else 694 elem_parse_failed = 695 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 696 } 697 698 for_each_element_id(subelem, WLAN_EID_TX_POWER_ENVELOPE, 699 pos, elen) 700 ieee80211_parse_tpe(&elems->csa_tpe, 701 subelem->data + 1, 702 subelem->datalen - 1); 703 break; 704 case WLAN_EID_COUNTRY: 705 elems->country_elem = pos; 706 elems->country_elem_len = elen; 707 break; 708 case WLAN_EID_PWR_CONSTRAINT: 709 if (elen != 1) { 710 elem_parse_failed = 711 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 712 break; 713 } 714 elems->pwr_constr_elem = pos; 715 break; 716 case WLAN_EID_CISCO_VENDOR_SPECIFIC: 717 /* Lots of different options exist, but we only care 718 * about the Dynamic Transmit Power Control element. 719 * First check for the Cisco OUI, then for the DTPC 720 * tag (0x00). 721 */ 722 if (elen < 4) { 723 elem_parse_failed = 724 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 725 break; 726 } 727 728 if (pos[0] != 0x00 || pos[1] != 0x40 || 729 pos[2] != 0x96 || pos[3] != 0x00) 730 break; 731 732 if (elen != 6) { 733 elem_parse_failed = 734 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 735 break; 736 } 737 738 if (calc_crc) 739 crc = crc32_be(crc, pos - 2, elen + 2); 740 741 elems->cisco_dtpc_elem = pos; 742 break; 743 case WLAN_EID_ADDBA_EXT: 744 if (elen < sizeof(struct ieee80211_addba_ext_ie)) { 745 elem_parse_failed = 746 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 747 break; 748 } 749 elems->addba_ext_ie = (void *)pos; 750 break; 751 case WLAN_EID_TIMEOUT_INTERVAL: 752 if (elen >= sizeof(struct ieee80211_timeout_interval_ie)) 753 elems->timeout_int = (void *)pos; 754 else 755 elem_parse_failed = 756 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 757 break; 758 case WLAN_EID_BSS_MAX_IDLE_PERIOD: 759 if (elen >= sizeof(*elems->max_idle_period_ie)) 760 elems->max_idle_period_ie = (void *)pos; 761 break; 762 case WLAN_EID_RSNX: 763 elems->rsnx = pos; 764 elems->rsnx_len = elen; 765 break; 766 case WLAN_EID_TX_POWER_ENVELOPE: 767 if (params->mode < IEEE80211_CONN_MODE_HE) 768 break; 769 ieee80211_parse_tpe(&elems->tpe, pos, elen); 770 break; 771 case WLAN_EID_EXTENSION: 772 ieee80211_parse_extension_element(calc_crc ? 773 &crc : NULL, 774 elem, elems_parse, 775 params); 776 break; 777 case WLAN_EID_S1G_CAPABILITIES: 778 if (params->mode != IEEE80211_CONN_MODE_S1G) 779 break; 780 if (elen >= sizeof(*elems->s1g_capab)) 781 elems->s1g_capab = (void *)pos; 782 else 783 elem_parse_failed = 784 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 785 break; 786 case WLAN_EID_S1G_OPERATION: 787 if (params->mode != IEEE80211_CONN_MODE_S1G) 788 break; 789 if (elen == sizeof(*elems->s1g_oper)) 790 elems->s1g_oper = (void *)pos; 791 else 792 elem_parse_failed = 793 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 794 break; 795 case WLAN_EID_S1G_BCN_COMPAT: 796 if (params->mode != IEEE80211_CONN_MODE_S1G) 797 break; 798 if (elen == sizeof(*elems->s1g_bcn_compat)) 799 elems->s1g_bcn_compat = (void *)pos; 800 else 801 elem_parse_failed = 802 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 803 break; 804 case WLAN_EID_AID_RESPONSE: 805 if (params->mode != IEEE80211_CONN_MODE_S1G) 806 break; 807 if (elen == sizeof(struct ieee80211_aid_response_ie)) 808 elems->aid_resp = (void *)pos; 809 else 810 elem_parse_failed = 811 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 812 break; 813 default: 814 break; 815 } 816 817 if (elem_parse_failed) 818 elems->parse_error |= elem_parse_failed; 819 else 820 __set_bit(id, seen_elems); 821 } 822 823 if (!for_each_element_completed(elem, params->start, params->len)) 824 elems->parse_error |= IEEE80211_PARSE_ERR_INVALID_END; 825 826 return crc; 827 } 828 829 static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, 830 struct ieee802_11_elems *elems, 831 struct cfg80211_bss *bss, 832 u8 *nontransmitted_profile) 833 { 834 const struct element *elem, *sub; 835 836 if (!bss || !bss->transmitted_bss) 837 return 0; 838 839 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) { 840 if (elem->datalen < 2) 841 continue; 842 if (elem->data[0] < 1 || elem->data[0] > 8) 843 continue; 844 845 for_each_element(sub, elem->data + 1, elem->datalen - 1) { 846 u8 new_bssid[ETH_ALEN]; 847 size_t profile_len; 848 const u8 *index; 849 850 if (sub->id != 0 || sub->datalen < 4) { 851 /* not a valid BSS profile */ 852 continue; 853 } 854 855 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP || 856 sub->data[1] != 2) { 857 /* The first element of the 858 * Nontransmitted BSSID Profile is not 859 * the Nontransmitted BSSID Capability 860 * element. 861 */ 862 continue; 863 } 864 865 memset(nontransmitted_profile, 0, len); 866 profile_len = cfg80211_merge_profile(start, len, 867 elem, 868 sub, 869 nontransmitted_profile, 870 len); 871 872 /* found a Nontransmitted BSSID Profile */ 873 index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, 874 nontransmitted_profile, 875 profile_len); 876 if (!index || index[1] < 1 || index[2] == 0) { 877 /* Invalid MBSSID Index element */ 878 continue; 879 } 880 881 cfg80211_gen_new_bssid(bss->transmitted_bss->bssid, 882 elem->data[0], 883 index[2], 884 new_bssid); 885 if (ether_addr_equal(new_bssid, bss->bssid)) { 886 elems->bssid_index_len = index[1]; 887 elems->bssid_index = (void *)&index[2]; 888 return profile_len; 889 } 890 } 891 } 892 893 return 0; 894 } 895 896 static void 897 ieee80211_mle_get_sta_prof(struct ieee80211_elems_parse *elems_parse, 898 u8 link_id) 899 { 900 struct ieee802_11_elems *elems = &elems_parse->elems; 901 const struct ieee80211_multi_link_elem *ml = elems->ml_basic; 902 ssize_t ml_len = elems->ml_basic_len; 903 const struct element *sub; 904 905 for_each_mle_subelement(sub, (u8 *)ml, ml_len) { 906 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data; 907 ssize_t sta_prof_len; 908 u16 control; 909 910 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE) 911 continue; 912 913 if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data, 914 sub->datalen)) 915 return; 916 917 control = le16_to_cpu(prof->control); 918 919 if (link_id != u16_get_bits(control, 920 IEEE80211_MLE_STA_CONTROL_LINK_ID)) 921 continue; 922 923 if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE)) 924 return; 925 926 /* the sub element can be fragmented */ 927 sta_prof_len = 928 cfg80211_defragment_element(sub, 929 (u8 *)ml, ml_len, 930 elems_parse->scratch_pos, 931 elems_parse->scratch + 932 elems_parse->scratch_len - 933 elems_parse->scratch_pos, 934 IEEE80211_MLE_SUBELEM_FRAGMENT); 935 936 if (sta_prof_len < 0) 937 return; 938 939 elems->prof = (void *)elems_parse->scratch_pos; 940 elems->sta_prof_len = sta_prof_len; 941 elems_parse->scratch_pos += sta_prof_len; 942 943 return; 944 } 945 } 946 947 static const struct element * 948 ieee80211_prep_mle_link_parse(struct ieee80211_elems_parse *elems_parse, 949 struct ieee80211_elems_parse_params *params, 950 struct ieee80211_elems_parse_params *sub) 951 { 952 struct ieee802_11_elems *elems = &elems_parse->elems; 953 struct ieee80211_mle_per_sta_profile *prof; 954 const struct element *ml_basic_elem = NULL; 955 const struct element *tmp, *ret; 956 ssize_t ml_len; 957 const u8 *end; 958 959 if (params->mode < IEEE80211_CONN_MODE_EHT) 960 return NULL; 961 962 for_each_element_extid(tmp, WLAN_EID_EXT_EHT_MULTI_LINK, 963 elems->ie_start, elems->total_len) { 964 const struct ieee80211_multi_link_elem *mle = 965 (void *)tmp->data + 1; 966 967 if (!ieee80211_mle_size_ok(tmp->data + 1, tmp->datalen - 1)) 968 continue; 969 970 if (le16_get_bits(mle->control, IEEE80211_ML_CONTROL_TYPE) != 971 IEEE80211_ML_CONTROL_TYPE_BASIC) 972 continue; 973 974 ml_basic_elem = tmp; 975 break; 976 } 977 978 ml_len = cfg80211_defragment_element(ml_basic_elem, elems->ie_start, 979 elems->total_len, 980 elems_parse->scratch_pos, 981 elems_parse->scratch + 982 elems_parse->scratch_len - 983 elems_parse->scratch_pos, 984 WLAN_EID_FRAGMENT); 985 986 if (ml_len < 0) 987 return NULL; 988 989 elems->ml_basic = (const void *)elems_parse->scratch_pos; 990 elems->ml_basic_len = ml_len; 991 elems_parse->scratch_pos += ml_len; 992 993 if (params->link_id == -1) 994 return NULL; 995 996 ieee80211_mle_get_sta_prof(elems_parse, params->link_id); 997 prof = elems->prof; 998 999 if (!prof) 1000 return NULL; 1001 1002 /* check if we have the 4 bytes for the fixed part in assoc response */ 1003 if (elems->sta_prof_len < sizeof(*prof) + prof->sta_info_len - 1 + 4) { 1004 elems->prof = NULL; 1005 elems->sta_prof_len = 0; 1006 return NULL; 1007 } 1008 1009 /* 1010 * Skip the capability information and the status code that are expected 1011 * as part of the station profile in association response frames. Note 1012 * the -1 is because the 'sta_info_len' is accounted to as part of the 1013 * per-STA profile, but not part of the 'u8 variable[]' portion. 1014 */ 1015 sub->start = prof->variable + prof->sta_info_len - 1 + 4; 1016 end = (const u8 *)prof + elems->sta_prof_len; 1017 sub->len = end - sub->start; 1018 1019 sub->mode = params->mode; 1020 sub->type = params->type; 1021 sub->from_ap = params->from_ap; 1022 sub->link_id = -1; 1023 1024 ret = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 1025 sub->start, sub->len); 1026 if (ret) 1027 return ret; 1028 1029 /* 1030 * Since we know we want and found a profile, apply an empty 1031 * non-inheritance if the profile didn't have one, so that any 1032 * element that shouldn't be inherited by spec isn't. 1033 */ 1034 return (const void *)empty_non_inheritance; 1035 } 1036 1037 static const void * 1038 ieee80211_mle_defrag(struct ieee80211_elems_parse *elems_parse, 1039 struct ieee80211_elem_defrag *defrag, 1040 size_t *out_len) 1041 { 1042 const void *ret; 1043 ssize_t ml_len; 1044 1045 ml_len = cfg80211_defragment_element(defrag->elem, 1046 defrag->start, defrag->len, 1047 elems_parse->scratch_pos, 1048 elems_parse->scratch + 1049 elems_parse->scratch_len - 1050 elems_parse->scratch_pos, 1051 WLAN_EID_FRAGMENT); 1052 if (ml_len < 0) 1053 return NULL; 1054 ret = elems_parse->scratch_pos; 1055 *out_len = ml_len; 1056 elems_parse->scratch_pos += ml_len; 1057 return ret; 1058 } 1059 1060 struct ieee802_11_elems * 1061 ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params) 1062 { 1063 struct ieee80211_elems_parse_params sub = {}; 1064 struct ieee80211_elems_parse *elems_parse; 1065 const struct element *non_inherit = NULL; 1066 struct ieee802_11_elems *elems; 1067 size_t scratch_len = 3 * params->len; 1068 bool inside_multilink = false; 1069 1070 BUILD_BUG_ON(sizeof(empty_non_inheritance) != empty_non_inheritance[1] + 2); 1071 BUILD_BUG_ON(offsetof(typeof(*elems_parse), elems) != 0); 1072 1073 /* cannot parse for both a specific link and non-transmitted BSS */ 1074 if (WARN_ON(params->link_id >= 0 && params->bss)) 1075 return NULL; 1076 1077 elems_parse = kzalloc_flex(*elems_parse, scratch, scratch_len, 1078 GFP_ATOMIC); 1079 if (!elems_parse) 1080 return NULL; 1081 1082 elems_parse->elems.frame_type = params->type; 1083 elems_parse->elems.from_ap = params->from_ap; 1084 1085 elems_parse->scratch_len = scratch_len; 1086 elems_parse->scratch_pos = elems_parse->scratch; 1087 1088 elems = &elems_parse->elems; 1089 elems->ie_start = params->start; 1090 elems->total_len = params->len; 1091 1092 /* set all TPE entries to unlimited (but invalid) */ 1093 ieee80211_clear_tpe(&elems->tpe); 1094 ieee80211_clear_tpe(&elems->csa_tpe); 1095 1096 /* 1097 * If we're looking for a non-transmitted BSS then we cannot at 1098 * the same time be looking for a second link as the two can only 1099 * appear in the same frame carrying info for different BSSes. 1100 * 1101 * In any case, we only look for one at a time, as encoded by 1102 * the WARN_ON above. 1103 */ 1104 if (params->bss) { 1105 int nontx_len = 1106 ieee802_11_find_bssid_profile(params->start, 1107 params->len, 1108 elems, params->bss, 1109 elems_parse->scratch_pos); 1110 sub.start = elems_parse->scratch_pos; 1111 sub.mode = params->mode; 1112 sub.len = nontx_len; 1113 sub.type = params->type; 1114 sub.link_id = params->link_id; 1115 1116 /* indicate to consumer whether or not profile was found */ 1117 if (params->bss->transmitted_bss && !nontx_len) 1118 elems->mbssid_nontx_profile_missing = true; 1119 1120 /* consume the space used for non-transmitted profile */ 1121 elems_parse->scratch_pos += nontx_len; 1122 1123 non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 1124 sub.start, nontx_len); 1125 /* 1126 * If it's a non-transmitted BSS, we shouldn't pick 1127 * any elements in the outer parsing that shouldn't 1128 * be inherited. If the profile has a non-inheritance 1129 * element this automatically happens, but if not then 1130 * provide an empty one so that the hard-coded elements 1131 * in cfg80211_is_element_inherited() are ignored, but 1132 * it must be called. 1133 */ 1134 if (params->bss->transmitted_bss && !non_inherit) 1135 non_inherit = (const void *)empty_non_inheritance; 1136 } else { 1137 /* 1138 * Find the multi-link element and the non-inherit element inside 1139 * the applicable profile, if requested by params->link_id >= 0. 1140 */ 1141 non_inherit = ieee80211_prep_mle_link_parse(elems_parse, params, 1142 &sub); 1143 inside_multilink = true; 1144 } 1145 1146 elems_parse->skip_vendor = 1147 cfg80211_find_elem(WLAN_EID_VENDOR_SPECIFIC, 1148 sub.start, sub.len); 1149 elems->crc = _ieee802_11_parse_elems_full(params, elems_parse, 1150 non_inherit); 1151 1152 /* Override with nontransmitted/per-STA profile if found */ 1153 if (sub.len) { 1154 elems_parse->inside_multilink = inside_multilink; 1155 elems_parse->skip_vendor = false; 1156 _ieee802_11_parse_elems_full(&sub, elems_parse, NULL); 1157 } 1158 1159 elems->ml_reconf = ieee80211_mle_defrag(elems_parse, 1160 &elems_parse->ml_reconf, 1161 &elems->ml_reconf_len); 1162 elems->ml_epcs = ieee80211_mle_defrag(elems_parse, 1163 &elems_parse->ml_epcs, 1164 &elems->ml_epcs_len); 1165 if (!elems->ml_basic) 1166 elems->ml_basic = ieee80211_mle_defrag(elems_parse, 1167 &elems_parse->ml_basic, 1168 &elems->ml_basic_len); 1169 1170 if (elems->tim && !elems->parse_error) { 1171 const struct ieee80211_tim_ie *tim_ie = elems->tim; 1172 1173 elems->dtim_period = tim_ie->dtim_period; 1174 elems->dtim_count = tim_ie->dtim_count; 1175 } 1176 1177 /* Override DTIM period and count if needed */ 1178 if (elems->bssid_index && 1179 elems->bssid_index_len >= 1180 offsetofend(struct ieee80211_bssid_index, dtim_period)) 1181 elems->dtim_period = elems->bssid_index->dtim_period; 1182 1183 if (elems->bssid_index && 1184 elems->bssid_index_len >= 1185 offsetofend(struct ieee80211_bssid_index, dtim_count)) 1186 elems->dtim_count = elems->bssid_index->dtim_count; 1187 1188 return elems; 1189 } 1190 EXPORT_SYMBOL_IF_KUNIT(ieee802_11_parse_elems_full); 1191 1192 int ieee80211_parse_bitrates(const struct ieee80211_supported_band *sband, 1193 const u8 *srates, int srates_len, u32 *rates) 1194 { 1195 struct ieee80211_rate *br; 1196 int brate, rate, i, j, count = 0; 1197 1198 *rates = 0; 1199 1200 for (i = 0; i < srates_len; i++) { 1201 rate = srates[i] & 0x7f; 1202 1203 for (j = 0; j < sband->n_bitrates; j++) { 1204 br = &sband->bitrates[j]; 1205 1206 brate = DIV_ROUND_UP(br->bitrate, 5); 1207 if (brate == rate) { 1208 *rates |= BIT(j); 1209 count++; 1210 break; 1211 } 1212 } 1213 } 1214 return count; 1215 } 1216