1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright 2002-2005, Instant802 Networks, Inc. 4 * Copyright 2005-2006, Devicescape Software, Inc. 5 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 6 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net> 7 * Copyright 2013-2014 Intel Mobile Communications GmbH 8 * Copyright (C) 2015-2017 Intel Deutschland GmbH 9 * Copyright (C) 2018-2026 Intel Corporation 10 * 11 * element parsing for mac80211 12 */ 13 14 #include <net/mac80211.h> 15 #include <linux/netdevice.h> 16 #include <linux/export.h> 17 #include <linux/types.h> 18 #include <linux/slab.h> 19 #include <linux/skbuff.h> 20 #include <linux/etherdevice.h> 21 #include <linux/if_arp.h> 22 #include <linux/bitmap.h> 23 #include <linux/crc32.h> 24 #include <net/net_namespace.h> 25 #include <net/cfg80211.h> 26 #include <net/rtnetlink.h> 27 #include <kunit/visibility.h> 28 29 #include "ieee80211_i.h" 30 #include "driver-ops.h" 31 #include "rate.h" 32 #include "mesh.h" 33 #include "wme.h" 34 #include "led.h" 35 #include "wep.h" 36 37 static const u8 empty_non_inheritance[] = { 38 WLAN_EID_EXTENSION, 1, WLAN_EID_EXT_NON_INHERITANCE, 39 /* 40 * cfg80211_is_element_inherited() hardcodes elements that 41 * cannot be inherited, so we just need an empty one to be 42 * calling it at all. 43 */ 44 }; 45 46 struct ieee80211_elem_defrag { 47 const struct element *elem; 48 /* container start/len */ 49 const u8 *start; 50 size_t len; 51 }; 52 53 struct ieee80211_elems_parse { 54 /* must be first for kfree to work */ 55 struct ieee802_11_elems elems; 56 57 struct ieee80211_elem_defrag ml_reconf, ml_epcs, ml_basic; 58 59 bool inside_multilink; 60 bool skip_vendor; 61 62 /* 63 * scratch buffer that can be used for various element parsing related 64 * tasks, e.g., element de-fragmentation etc. 65 */ 66 size_t scratch_len; 67 u8 *scratch_pos; 68 u8 scratch[] __counted_by(scratch_len); 69 }; 70 71 static void 72 ieee80211_parse_extension_element(u32 *crc, 73 const struct element *elem, 74 struct ieee80211_elems_parse *elems_parse, 75 struct ieee80211_elems_parse_params *params) 76 { 77 struct ieee802_11_elems *elems = &elems_parse->elems; 78 const void *data = elem->data + 1; 79 bool calc_crc = false; 80 u8 len; 81 82 if (!elem->datalen) 83 return; 84 85 len = elem->datalen - 1; 86 87 switch (elem->data[0]) { 88 case WLAN_EID_EXT_HE_MU_EDCA: 89 if (params->mode < IEEE80211_CONN_MODE_HE) 90 break; 91 calc_crc = true; 92 if (len >= sizeof(*elems->mu_edca_param_set)) 93 elems->mu_edca_param_set = data; 94 break; 95 case WLAN_EID_EXT_HE_CAPABILITY: 96 if (params->mode < IEEE80211_CONN_MODE_HE) 97 break; 98 if (ieee80211_he_capa_size_ok(data, len)) { 99 elems->he_cap = data; 100 elems->he_cap_len = len; 101 } 102 break; 103 case WLAN_EID_EXT_HE_OPERATION: 104 if (params->mode < IEEE80211_CONN_MODE_HE) 105 break; 106 calc_crc = true; 107 if (len >= sizeof(*elems->he_operation) && 108 len >= ieee80211_he_oper_size(data) - 1) 109 elems->he_operation = data; 110 break; 111 case WLAN_EID_EXT_UORA: 112 if (params->mode < IEEE80211_CONN_MODE_HE) 113 break; 114 if (len >= 1) 115 elems->uora_element = data; 116 break; 117 case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME: 118 if (len == 3) 119 elems->max_channel_switch_time = data; 120 break; 121 case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION: 122 if (len >= sizeof(*elems->mbssid_config_ie)) 123 elems->mbssid_config_ie = data; 124 break; 125 case WLAN_EID_EXT_HE_SPR: 126 if (params->mode < IEEE80211_CONN_MODE_HE) 127 break; 128 if (len >= sizeof(*elems->he_spr) && 129 len >= ieee80211_he_spr_size(data) - 1) 130 elems->he_spr = data; 131 break; 132 case WLAN_EID_EXT_HE_6GHZ_CAPA: 133 if (params->mode < IEEE80211_CONN_MODE_HE) 134 break; 135 if (len >= sizeof(*elems->he_6ghz_capa)) 136 elems->he_6ghz_capa = data; 137 break; 138 case WLAN_EID_EXT_EHT_CAPABILITY: 139 if (params->mode < IEEE80211_CONN_MODE_EHT) 140 break; 141 if (ieee80211_eht_capa_size_ok(elems->he_cap, 142 data, len, 143 params->from_ap)) { 144 elems->eht_cap = data; 145 elems->eht_cap_len = len; 146 } 147 break; 148 case WLAN_EID_EXT_EHT_OPERATION: 149 if (params->mode < IEEE80211_CONN_MODE_EHT) 150 break; 151 if (ieee80211_eht_oper_size_ok(data, len)) 152 elems->eht_operation = data; 153 calc_crc = true; 154 break; 155 case WLAN_EID_EXT_EHT_MULTI_LINK: 156 if (params->mode < IEEE80211_CONN_MODE_EHT) 157 break; 158 calc_crc = true; 159 160 if (ieee80211_mle_size_ok(data, len)) { 161 const struct ieee80211_multi_link_elem *mle = 162 (void *)data; 163 164 switch (le16_get_bits(mle->control, 165 IEEE80211_ML_CONTROL_TYPE)) { 166 case IEEE80211_ML_CONTROL_TYPE_BASIC: 167 if (elems_parse->inside_multilink) { 168 elems->parse_error |= 169 IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC; 170 break; 171 } 172 elems_parse->ml_basic.elem = elem; 173 elems_parse->ml_basic.start = params->start; 174 elems_parse->ml_basic.len = params->len; 175 break; 176 case IEEE80211_ML_CONTROL_TYPE_RECONF: 177 elems_parse->ml_reconf.elem = elem; 178 elems_parse->ml_reconf.start = params->start; 179 elems_parse->ml_reconf.len = params->len; 180 break; 181 case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS: 182 elems_parse->ml_epcs.elem = elem; 183 elems_parse->ml_epcs.start = params->start; 184 elems_parse->ml_epcs.len = params->len; 185 break; 186 default: 187 break; 188 } 189 } 190 break; 191 case WLAN_EID_EXT_BANDWIDTH_INDICATION: 192 if (params->mode < IEEE80211_CONN_MODE_EHT) 193 break; 194 if (ieee80211_bandwidth_indication_size_ok(data, len)) 195 elems->bandwidth_indication = data; 196 calc_crc = true; 197 break; 198 case WLAN_EID_EXT_TID_TO_LINK_MAPPING: 199 if (params->mode < IEEE80211_CONN_MODE_EHT) 200 break; 201 calc_crc = true; 202 if (ieee80211_tid_to_link_map_size_ok(data, len) && 203 elems->ttlm_num < ARRAY_SIZE(elems->ttlm)) { 204 elems->ttlm[elems->ttlm_num] = (void *)data; 205 elems->ttlm_num++; 206 } 207 break; 208 case WLAN_EID_EXT_UHR_OPER: 209 if (params->mode < IEEE80211_CONN_MODE_UHR) 210 break; 211 calc_crc = true; 212 if (ieee80211_uhr_oper_size_ok(data, len)) { 213 elems->uhr_operation = data; 214 elems->uhr_operation_len = len; 215 } 216 break; 217 case WLAN_EID_EXT_UHR_CAPA: 218 if (params->mode < IEEE80211_CONN_MODE_UHR) 219 break; 220 calc_crc = true; 221 if (ieee80211_uhr_capa_size_ok(data, len, true)) { 222 elems->uhr_cap = data; 223 elems->uhr_cap_len = len; 224 } 225 break; 226 } 227 228 if (crc && calc_crc) 229 *crc = crc32_be(*crc, (void *)elem, elem->datalen + 2); 230 } 231 232 static void ieee80211_parse_tpe(struct ieee80211_parsed_tpe *tpe, 233 const u8 *data, u8 len) 234 { 235 const struct ieee80211_tx_pwr_env *env = (const void *)data; 236 u8 count, interpret, category; 237 u8 *out, N, *cnt_out = NULL, *N_out = NULL; 238 239 if (!ieee80211_valid_tpe_element(data, len)) 240 return; 241 242 count = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_COUNT); 243 interpret = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_INTERPRET); 244 category = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_CATEGORY); 245 246 switch (interpret) { 247 case IEEE80211_TPE_LOCAL_EIRP: 248 out = tpe->max_local[category].power; 249 cnt_out = &tpe->max_local[category].count; 250 tpe->max_local[category].valid = true; 251 break; 252 case IEEE80211_TPE_REG_CLIENT_EIRP: 253 out = tpe->max_reg_client[category].power; 254 cnt_out = &tpe->max_reg_client[category].count; 255 tpe->max_reg_client[category].valid = true; 256 break; 257 case IEEE80211_TPE_LOCAL_EIRP_PSD: 258 out = tpe->psd_local[category].power; 259 cnt_out = &tpe->psd_local[category].count; 260 N_out = &tpe->psd_local[category].n; 261 tpe->psd_local[category].valid = true; 262 break; 263 case IEEE80211_TPE_REG_CLIENT_EIRP_PSD: 264 out = tpe->psd_reg_client[category].power; 265 cnt_out = &tpe->psd_reg_client[category].count; 266 N_out = &tpe->psd_reg_client[category].n; 267 tpe->psd_reg_client[category].valid = true; 268 break; 269 } 270 271 switch (interpret) { 272 case IEEE80211_TPE_LOCAL_EIRP: 273 case IEEE80211_TPE_REG_CLIENT_EIRP: 274 /* count was validated <= 3, plus 320 MHz */ 275 BUILD_BUG_ON(IEEE80211_TPE_EIRP_ENTRIES_320MHZ < 5); 276 memcpy(out, env->variable, count + 1); 277 *cnt_out = count + 1; 278 /* separately take 320 MHz if present */ 279 if (count == 3 && len > sizeof(*env) + count + 1) { 280 out[4] = env->variable[4]; 281 *cnt_out = 5; 282 } 283 break; 284 case IEEE80211_TPE_LOCAL_EIRP_PSD: 285 case IEEE80211_TPE_REG_CLIENT_EIRP_PSD: 286 if (!count) { 287 memset(out, env->variable[0], 288 IEEE80211_TPE_PSD_ENTRIES_320MHZ); 289 *cnt_out = IEEE80211_TPE_PSD_ENTRIES_320MHZ; 290 break; 291 } 292 293 N = 1 << (count - 1); 294 memcpy(out, env->variable, N); 295 *cnt_out = N; 296 *N_out = N; 297 298 if (len > sizeof(*env) + N) { 299 int K = u8_get_bits(env->variable[N], 300 IEEE80211_TX_PWR_ENV_EXT_COUNT); 301 302 K = min(K, IEEE80211_TPE_PSD_ENTRIES_320MHZ - N); 303 memcpy(out + N, env->variable + N + 1, K); 304 (*cnt_out) += K; 305 } 306 break; 307 } 308 } 309 310 static u32 311 _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params, 312 struct ieee80211_elems_parse *elems_parse, 313 const struct element *check_inherit) 314 { 315 struct ieee802_11_elems *elems = &elems_parse->elems; 316 const struct element *elem; 317 bool calc_crc = params->filter != 0; 318 DECLARE_BITMAP(seen_elems, 256); 319 u32 crc = params->crc; 320 321 bitmap_zero(seen_elems, 256); 322 323 switch (params->type) { 324 /* we don't need to parse assoc request, luckily (it's value 0) */ 325 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_REQ: 326 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_REQ: 327 default: 328 WARN(1, "invalid frame type 0x%x for element parsing\n", 329 params->type); 330 break; 331 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_RESP: 332 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_RESP: 333 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ: 334 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP: 335 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON: 336 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION: 337 case IEEE80211_FTYPE_EXT | IEEE80211_STYPE_S1G_BEACON: 338 break; 339 } 340 341 for_each_element(elem, params->start, params->len) { 342 const struct element *subelem; 343 u8 elem_parse_failed; 344 u8 id = elem->id; 345 u8 elen = elem->datalen; 346 const u8 *pos = elem->data; 347 348 if (check_inherit && 349 !cfg80211_is_element_inherited(elem, 350 check_inherit)) 351 continue; 352 353 switch (id) { 354 case WLAN_EID_SSID: 355 case WLAN_EID_SUPP_RATES: 356 case WLAN_EID_FH_PARAMS: 357 case WLAN_EID_DS_PARAMS: 358 case WLAN_EID_CF_PARAMS: 359 case WLAN_EID_TIM: 360 case WLAN_EID_IBSS_PARAMS: 361 case WLAN_EID_CHALLENGE: 362 case WLAN_EID_RSN: 363 case WLAN_EID_ERP_INFO: 364 case WLAN_EID_EXT_SUPP_RATES: 365 case WLAN_EID_HT_CAPABILITY: 366 case WLAN_EID_HT_OPERATION: 367 case WLAN_EID_VHT_CAPABILITY: 368 case WLAN_EID_VHT_OPERATION: 369 case WLAN_EID_MESH_ID: 370 case WLAN_EID_MESH_CONFIG: 371 case WLAN_EID_PEER_MGMT: 372 case WLAN_EID_PREQ: 373 case WLAN_EID_PREP: 374 case WLAN_EID_PERR: 375 case WLAN_EID_RANN: 376 case WLAN_EID_CHANNEL_SWITCH: 377 case WLAN_EID_EXT_CHANSWITCH_ANN: 378 case WLAN_EID_COUNTRY: 379 case WLAN_EID_PWR_CONSTRAINT: 380 case WLAN_EID_TIMEOUT_INTERVAL: 381 case WLAN_EID_SECONDARY_CHANNEL_OFFSET: 382 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH: 383 case WLAN_EID_CHAN_SWITCH_PARAM: 384 case WLAN_EID_EXT_CAPABILITY: 385 case WLAN_EID_CHAN_SWITCH_TIMING: 386 case WLAN_EID_LINK_ID: 387 case WLAN_EID_BSS_MAX_IDLE_PERIOD: 388 case WLAN_EID_RSNX: 389 case WLAN_EID_S1G_BCN_COMPAT: 390 case WLAN_EID_S1G_CAPABILITIES: 391 case WLAN_EID_S1G_OPERATION: 392 case WLAN_EID_AID_RESPONSE: 393 case WLAN_EID_S1G_SHORT_BCN_INTERVAL: 394 /* 395 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible 396 * that if the content gets bigger it might be needed more than once 397 */ 398 if (test_bit(id, seen_elems)) { 399 elems->parse_error |= 400 IEEE80211_PARSE_ERR_DUP_ELEM; 401 continue; 402 } 403 break; 404 } 405 406 if (calc_crc && id < 64 && (params->filter & (1ULL << id))) 407 crc = crc32_be(crc, pos - 2, elen + 2); 408 409 elem_parse_failed = 0; 410 411 switch (id) { 412 case WLAN_EID_LINK_ID: 413 if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) { 414 elem_parse_failed = 415 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 416 break; 417 } 418 elems->lnk_id = (void *)(pos - 2); 419 break; 420 case WLAN_EID_CHAN_SWITCH_TIMING: 421 if (elen < sizeof(struct ieee80211_ch_switch_timing)) { 422 elem_parse_failed = 423 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 424 break; 425 } 426 elems->ch_sw_timing = (void *)pos; 427 break; 428 case WLAN_EID_EXT_CAPABILITY: 429 elems->ext_capab = pos; 430 elems->ext_capab_len = elen; 431 break; 432 case WLAN_EID_SSID: 433 elems->ssid = pos; 434 elems->ssid_len = elen; 435 break; 436 case WLAN_EID_SUPP_RATES: 437 elems->supp_rates = pos; 438 elems->supp_rates_len = elen; 439 break; 440 case WLAN_EID_DS_PARAMS: 441 if (elen >= 1) 442 elems->ds_params = pos; 443 else 444 elem_parse_failed = 445 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 446 break; 447 case WLAN_EID_TIM: 448 if (elen >= sizeof(struct ieee80211_tim_ie)) { 449 elems->tim = (void *)pos; 450 elems->tim_len = elen; 451 } else 452 elem_parse_failed = 453 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 454 break; 455 case WLAN_EID_VENDOR_SPECIFIC: 456 if (elems_parse->skip_vendor) 457 break; 458 459 if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 && 460 pos[2] == 0xf2) { 461 /* Microsoft OUI (00:50:F2) */ 462 463 if (calc_crc) 464 crc = crc32_be(crc, pos - 2, elen + 2); 465 466 if (elen >= 5 && pos[3] == 2) { 467 /* OUI Type 2 - WMM IE */ 468 if (pos[4] == 0) { 469 elems->wmm_info = pos; 470 elems->wmm_info_len = elen; 471 } else if (pos[4] == 1) { 472 elems->wmm_param = pos; 473 elems->wmm_param_len = elen; 474 } 475 } 476 } 477 break; 478 case WLAN_EID_RSN: 479 elems->rsn = pos; 480 elems->rsn_len = elen; 481 break; 482 case WLAN_EID_ERP_INFO: 483 if (elen >= 1) 484 elems->erp_info = pos; 485 else 486 elem_parse_failed = 487 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 488 break; 489 case WLAN_EID_EXT_SUPP_RATES: 490 elems->ext_supp_rates = pos; 491 elems->ext_supp_rates_len = elen; 492 break; 493 case WLAN_EID_HT_CAPABILITY: 494 if (params->mode < IEEE80211_CONN_MODE_HT) 495 break; 496 if (elen >= sizeof(struct ieee80211_ht_cap)) 497 elems->ht_cap_elem = (void *)pos; 498 else 499 elem_parse_failed = 500 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 501 break; 502 case WLAN_EID_HT_OPERATION: 503 if (params->mode < IEEE80211_CONN_MODE_HT) 504 break; 505 if (elen >= sizeof(struct ieee80211_ht_operation)) 506 elems->ht_operation = (void *)pos; 507 else 508 elem_parse_failed = 509 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 510 break; 511 case WLAN_EID_VHT_CAPABILITY: 512 if (params->mode < IEEE80211_CONN_MODE_VHT) 513 break; 514 if (elen >= sizeof(struct ieee80211_vht_cap)) 515 elems->vht_cap_elem = (void *)pos; 516 else 517 elem_parse_failed = 518 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 519 break; 520 case WLAN_EID_VHT_OPERATION: 521 if (params->mode < IEEE80211_CONN_MODE_VHT) 522 break; 523 if (elen >= sizeof(struct ieee80211_vht_operation)) { 524 elems->vht_operation = (void *)pos; 525 if (calc_crc) 526 crc = crc32_be(crc, pos - 2, elen + 2); 527 break; 528 } 529 elem_parse_failed = 530 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 531 break; 532 case WLAN_EID_OPMODE_NOTIF: 533 if (params->mode < IEEE80211_CONN_MODE_VHT) 534 break; 535 if (elen > 0) { 536 elems->opmode_notif = pos; 537 if (calc_crc) 538 crc = crc32_be(crc, pos - 2, elen + 2); 539 break; 540 } 541 elem_parse_failed = 542 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 543 break; 544 case WLAN_EID_MESH_ID: 545 elems->mesh_id = pos; 546 elems->mesh_id_len = elen; 547 break; 548 case WLAN_EID_MESH_CONFIG: 549 if (elen >= sizeof(struct ieee80211_meshconf_ie)) 550 elems->mesh_config = (void *)pos; 551 else 552 elem_parse_failed = 553 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 554 break; 555 case WLAN_EID_PEER_MGMT: 556 elems->peering = pos; 557 elems->peering_len = elen; 558 break; 559 case WLAN_EID_MESH_AWAKE_WINDOW: 560 if (elen >= 2) 561 elems->awake_window = (void *)pos; 562 break; 563 case WLAN_EID_PREQ: 564 if (ieee80211_mesh_preq_size_ok(pos, elen)) { 565 elems->preq = pos; 566 elems->preq_len = elen; 567 } else { 568 elem_parse_failed = 569 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 570 } 571 break; 572 case WLAN_EID_PREP: 573 if (ieee80211_mesh_prep_size_ok(pos, elen)) { 574 elems->prep = pos; 575 elems->prep_len = elen; 576 } else { 577 elem_parse_failed = 578 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 579 } 580 break; 581 case WLAN_EID_PERR: 582 if (ieee80211_mesh_perr_size_ok(pos, elen)) { 583 elems->perr = pos; 584 elems->perr_len = elen; 585 } else { 586 elem_parse_failed = 587 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 588 } 589 break; 590 case WLAN_EID_RANN: 591 if (elen >= sizeof(struct ieee80211_rann_ie)) 592 elems->rann = (void *)pos; 593 else 594 elem_parse_failed = 595 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 596 break; 597 case WLAN_EID_CHANNEL_SWITCH: 598 if (elen != sizeof(struct ieee80211_channel_sw_ie)) { 599 elem_parse_failed = 600 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 601 break; 602 } 603 elems->ch_switch_ie = (void *)pos; 604 break; 605 case WLAN_EID_EXT_CHANSWITCH_ANN: 606 if (elen != sizeof(struct ieee80211_ext_chansw_ie)) { 607 elem_parse_failed = 608 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 609 break; 610 } 611 elems->ext_chansw_ie = (void *)pos; 612 break; 613 case WLAN_EID_SECONDARY_CHANNEL_OFFSET: 614 if (params->mode < IEEE80211_CONN_MODE_HT) 615 break; 616 if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) { 617 elem_parse_failed = 618 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 619 break; 620 } 621 elems->sec_chan_offs = (void *)pos; 622 break; 623 case WLAN_EID_CHAN_SWITCH_PARAM: 624 if (elen < 625 sizeof(*elems->mesh_chansw_params_ie)) { 626 elem_parse_failed = 627 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 628 break; 629 } 630 elems->mesh_chansw_params_ie = (void *)pos; 631 break; 632 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH: 633 if (params->mode < IEEE80211_CONN_MODE_VHT) 634 break; 635 636 if (params->type != (IEEE80211_FTYPE_MGMT | 637 IEEE80211_STYPE_ACTION)) { 638 elem_parse_failed = 639 IEEE80211_PARSE_ERR_UNEXPECTED_ELEM; 640 break; 641 } 642 643 if (elen < sizeof(*elems->wide_bw_chansw_ie)) { 644 elem_parse_failed = 645 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 646 break; 647 } 648 elems->wide_bw_chansw_ie = (void *)pos; 649 break; 650 case WLAN_EID_CHANNEL_SWITCH_WRAPPER: 651 if (params->mode < IEEE80211_CONN_MODE_VHT) 652 break; 653 if (params->type == (IEEE80211_FTYPE_MGMT | 654 IEEE80211_STYPE_ACTION)) { 655 elem_parse_failed = 656 IEEE80211_PARSE_ERR_UNEXPECTED_ELEM; 657 break; 658 } 659 /* 660 * This is a bit tricky, but as we only care about 661 * a few elements, parse them out manually. 662 */ 663 subelem = cfg80211_find_elem(WLAN_EID_WIDE_BW_CHANNEL_SWITCH, 664 pos, elen); 665 if (subelem) { 666 if (subelem->datalen >= sizeof(*elems->wide_bw_chansw_ie)) 667 elems->wide_bw_chansw_ie = 668 (void *)subelem->data; 669 else 670 elem_parse_failed = 671 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 672 } 673 674 if (params->mode < IEEE80211_CONN_MODE_EHT) 675 break; 676 677 subelem = cfg80211_find_ext_elem(WLAN_EID_EXT_BANDWIDTH_INDICATION, 678 pos, elen); 679 if (subelem) { 680 const void *edata = subelem->data + 1; 681 u8 edatalen = subelem->datalen - 1; 682 683 if (ieee80211_bandwidth_indication_size_ok(edata, 684 edatalen)) 685 elems->bandwidth_indication = edata; 686 else 687 elem_parse_failed = 688 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 689 } 690 691 subelem = cfg80211_find_ext_elem(WLAN_EID_TX_POWER_ENVELOPE, 692 pos, elen); 693 if (subelem) 694 ieee80211_parse_tpe(&elems->csa_tpe, 695 subelem->data + 1, 696 subelem->datalen - 1); 697 break; 698 case WLAN_EID_COUNTRY: 699 elems->country_elem = pos; 700 elems->country_elem_len = elen; 701 break; 702 case WLAN_EID_PWR_CONSTRAINT: 703 if (elen != 1) { 704 elem_parse_failed = 705 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 706 break; 707 } 708 elems->pwr_constr_elem = pos; 709 break; 710 case WLAN_EID_CISCO_VENDOR_SPECIFIC: 711 /* Lots of different options exist, but we only care 712 * about the Dynamic Transmit Power Control element. 713 * First check for the Cisco OUI, then for the DTPC 714 * tag (0x00). 715 */ 716 if (elen < 4) { 717 elem_parse_failed = 718 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 719 break; 720 } 721 722 if (pos[0] != 0x00 || pos[1] != 0x40 || 723 pos[2] != 0x96 || pos[3] != 0x00) 724 break; 725 726 if (elen != 6) { 727 elem_parse_failed = 728 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 729 break; 730 } 731 732 if (calc_crc) 733 crc = crc32_be(crc, pos - 2, elen + 2); 734 735 elems->cisco_dtpc_elem = pos; 736 break; 737 case WLAN_EID_ADDBA_EXT: 738 if (elen < sizeof(struct ieee80211_addba_ext_ie)) { 739 elem_parse_failed = 740 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 741 break; 742 } 743 elems->addba_ext_ie = (void *)pos; 744 break; 745 case WLAN_EID_TIMEOUT_INTERVAL: 746 if (elen >= sizeof(struct ieee80211_timeout_interval_ie)) 747 elems->timeout_int = (void *)pos; 748 else 749 elem_parse_failed = 750 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 751 break; 752 case WLAN_EID_BSS_MAX_IDLE_PERIOD: 753 if (elen >= sizeof(*elems->max_idle_period_ie)) 754 elems->max_idle_period_ie = (void *)pos; 755 break; 756 case WLAN_EID_RSNX: 757 elems->rsnx = pos; 758 elems->rsnx_len = elen; 759 break; 760 case WLAN_EID_TX_POWER_ENVELOPE: 761 if (params->mode < IEEE80211_CONN_MODE_HE) 762 break; 763 ieee80211_parse_tpe(&elems->tpe, pos, elen); 764 break; 765 case WLAN_EID_EXTENSION: 766 ieee80211_parse_extension_element(calc_crc ? 767 &crc : NULL, 768 elem, elems_parse, 769 params); 770 break; 771 case WLAN_EID_S1G_CAPABILITIES: 772 if (params->mode != IEEE80211_CONN_MODE_S1G) 773 break; 774 if (elen >= sizeof(*elems->s1g_capab)) 775 elems->s1g_capab = (void *)pos; 776 else 777 elem_parse_failed = 778 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 779 break; 780 case WLAN_EID_S1G_OPERATION: 781 if (params->mode != IEEE80211_CONN_MODE_S1G) 782 break; 783 if (elen == sizeof(*elems->s1g_oper)) 784 elems->s1g_oper = (void *)pos; 785 else 786 elem_parse_failed = 787 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 788 break; 789 case WLAN_EID_S1G_BCN_COMPAT: 790 if (params->mode != IEEE80211_CONN_MODE_S1G) 791 break; 792 if (elen == sizeof(*elems->s1g_bcn_compat)) 793 elems->s1g_bcn_compat = (void *)pos; 794 else 795 elem_parse_failed = 796 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 797 break; 798 case WLAN_EID_AID_RESPONSE: 799 if (params->mode != IEEE80211_CONN_MODE_S1G) 800 break; 801 if (elen == sizeof(struct ieee80211_aid_response_ie)) 802 elems->aid_resp = (void *)pos; 803 else 804 elem_parse_failed = 805 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE; 806 break; 807 default: 808 break; 809 } 810 811 if (elem_parse_failed) 812 elems->parse_error |= elem_parse_failed; 813 else 814 __set_bit(id, seen_elems); 815 } 816 817 if (!for_each_element_completed(elem, params->start, params->len)) 818 elems->parse_error |= IEEE80211_PARSE_ERR_INVALID_END; 819 820 return crc; 821 } 822 823 static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, 824 struct ieee802_11_elems *elems, 825 struct cfg80211_bss *bss, 826 u8 *nontransmitted_profile) 827 { 828 const struct element *elem, *sub; 829 830 if (!bss || !bss->transmitted_bss) 831 return 0; 832 833 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) { 834 if (elem->datalen < 2) 835 continue; 836 if (elem->data[0] < 1 || elem->data[0] > 8) 837 continue; 838 839 for_each_element(sub, elem->data + 1, elem->datalen - 1) { 840 u8 new_bssid[ETH_ALEN]; 841 size_t profile_len; 842 const u8 *index; 843 844 if (sub->id != 0 || sub->datalen < 4) { 845 /* not a valid BSS profile */ 846 continue; 847 } 848 849 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP || 850 sub->data[1] != 2) { 851 /* The first element of the 852 * Nontransmitted BSSID Profile is not 853 * the Nontransmitted BSSID Capability 854 * element. 855 */ 856 continue; 857 } 858 859 memset(nontransmitted_profile, 0, len); 860 profile_len = cfg80211_merge_profile(start, len, 861 elem, 862 sub, 863 nontransmitted_profile, 864 len); 865 866 /* found a Nontransmitted BSSID Profile */ 867 index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, 868 nontransmitted_profile, 869 profile_len); 870 if (!index || index[1] < 1 || index[2] == 0) { 871 /* Invalid MBSSID Index element */ 872 continue; 873 } 874 875 cfg80211_gen_new_bssid(bss->transmitted_bss->bssid, 876 elem->data[0], 877 index[2], 878 new_bssid); 879 if (ether_addr_equal(new_bssid, bss->bssid)) { 880 elems->bssid_index_len = index[1]; 881 elems->bssid_index = (void *)&index[2]; 882 return profile_len; 883 } 884 } 885 } 886 887 return 0; 888 } 889 890 static void 891 ieee80211_mle_get_sta_prof(struct ieee80211_elems_parse *elems_parse, 892 u8 link_id) 893 { 894 struct ieee802_11_elems *elems = &elems_parse->elems; 895 const struct ieee80211_multi_link_elem *ml = elems->ml_basic; 896 ssize_t ml_len = elems->ml_basic_len; 897 const struct element *sub; 898 899 for_each_mle_subelement(sub, (u8 *)ml, ml_len) { 900 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data; 901 ssize_t sta_prof_len; 902 u16 control; 903 904 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE) 905 continue; 906 907 if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data, 908 sub->datalen)) 909 return; 910 911 control = le16_to_cpu(prof->control); 912 913 if (link_id != u16_get_bits(control, 914 IEEE80211_MLE_STA_CONTROL_LINK_ID)) 915 continue; 916 917 if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE)) 918 return; 919 920 /* the sub element can be fragmented */ 921 sta_prof_len = 922 cfg80211_defragment_element(sub, 923 (u8 *)ml, ml_len, 924 elems_parse->scratch_pos, 925 elems_parse->scratch + 926 elems_parse->scratch_len - 927 elems_parse->scratch_pos, 928 IEEE80211_MLE_SUBELEM_FRAGMENT); 929 930 if (sta_prof_len < 0) 931 return; 932 933 elems->prof = (void *)elems_parse->scratch_pos; 934 elems->sta_prof_len = sta_prof_len; 935 elems_parse->scratch_pos += sta_prof_len; 936 937 return; 938 } 939 } 940 941 static const struct element * 942 ieee80211_prep_mle_link_parse(struct ieee80211_elems_parse *elems_parse, 943 struct ieee80211_elems_parse_params *params, 944 struct ieee80211_elems_parse_params *sub) 945 { 946 struct ieee802_11_elems *elems = &elems_parse->elems; 947 struct ieee80211_mle_per_sta_profile *prof; 948 const struct element *ml_basic_elem = NULL; 949 const struct element *tmp, *ret; 950 ssize_t ml_len; 951 const u8 *end; 952 953 if (params->mode < IEEE80211_CONN_MODE_EHT) 954 return NULL; 955 956 for_each_element_extid(tmp, WLAN_EID_EXT_EHT_MULTI_LINK, 957 elems->ie_start, elems->total_len) { 958 const struct ieee80211_multi_link_elem *mle = 959 (void *)tmp->data + 1; 960 961 if (!ieee80211_mle_size_ok(tmp->data + 1, tmp->datalen - 1)) 962 continue; 963 964 if (le16_get_bits(mle->control, IEEE80211_ML_CONTROL_TYPE) != 965 IEEE80211_ML_CONTROL_TYPE_BASIC) 966 continue; 967 968 ml_basic_elem = tmp; 969 break; 970 } 971 972 ml_len = cfg80211_defragment_element(ml_basic_elem, elems->ie_start, 973 elems->total_len, 974 elems_parse->scratch_pos, 975 elems_parse->scratch + 976 elems_parse->scratch_len - 977 elems_parse->scratch_pos, 978 WLAN_EID_FRAGMENT); 979 980 if (ml_len < 0) 981 return NULL; 982 983 elems->ml_basic = (const void *)elems_parse->scratch_pos; 984 elems->ml_basic_len = ml_len; 985 elems_parse->scratch_pos += ml_len; 986 987 if (params->link_id == -1) 988 return NULL; 989 990 ieee80211_mle_get_sta_prof(elems_parse, params->link_id); 991 prof = elems->prof; 992 993 if (!prof) 994 return NULL; 995 996 /* check if we have the 4 bytes for the fixed part in assoc response */ 997 if (elems->sta_prof_len < sizeof(*prof) + prof->sta_info_len - 1 + 4) { 998 elems->prof = NULL; 999 elems->sta_prof_len = 0; 1000 return NULL; 1001 } 1002 1003 /* 1004 * Skip the capability information and the status code that are expected 1005 * as part of the station profile in association response frames. Note 1006 * the -1 is because the 'sta_info_len' is accounted to as part of the 1007 * per-STA profile, but not part of the 'u8 variable[]' portion. 1008 */ 1009 sub->start = prof->variable + prof->sta_info_len - 1 + 4; 1010 end = (const u8 *)prof + elems->sta_prof_len; 1011 sub->len = end - sub->start; 1012 1013 sub->mode = params->mode; 1014 sub->type = params->type; 1015 sub->from_ap = params->from_ap; 1016 sub->link_id = -1; 1017 1018 ret = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 1019 sub->start, sub->len); 1020 if (ret) 1021 return ret; 1022 1023 /* 1024 * Since we know we want and found a profile, apply an empty 1025 * non-inheritance if the profile didn't have one, so that any 1026 * element that shouldn't be inherited by spec isn't. 1027 */ 1028 return (const void *)empty_non_inheritance; 1029 } 1030 1031 static const void * 1032 ieee80211_mle_defrag(struct ieee80211_elems_parse *elems_parse, 1033 struct ieee80211_elem_defrag *defrag, 1034 size_t *out_len) 1035 { 1036 const void *ret; 1037 ssize_t ml_len; 1038 1039 ml_len = cfg80211_defragment_element(defrag->elem, 1040 defrag->start, defrag->len, 1041 elems_parse->scratch_pos, 1042 elems_parse->scratch + 1043 elems_parse->scratch_len - 1044 elems_parse->scratch_pos, 1045 WLAN_EID_FRAGMENT); 1046 if (ml_len < 0) 1047 return NULL; 1048 ret = elems_parse->scratch_pos; 1049 *out_len = ml_len; 1050 elems_parse->scratch_pos += ml_len; 1051 return ret; 1052 } 1053 1054 struct ieee802_11_elems * 1055 ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params) 1056 { 1057 struct ieee80211_elems_parse_params sub = {}; 1058 struct ieee80211_elems_parse *elems_parse; 1059 const struct element *non_inherit = NULL; 1060 struct ieee802_11_elems *elems; 1061 size_t scratch_len = 3 * params->len; 1062 bool inside_multilink = false; 1063 1064 BUILD_BUG_ON(sizeof(empty_non_inheritance) != empty_non_inheritance[1] + 2); 1065 BUILD_BUG_ON(offsetof(typeof(*elems_parse), elems) != 0); 1066 1067 /* cannot parse for both a specific link and non-transmitted BSS */ 1068 if (WARN_ON(params->link_id >= 0 && params->bss)) 1069 return NULL; 1070 1071 elems_parse = kzalloc_flex(*elems_parse, scratch, scratch_len, 1072 GFP_ATOMIC); 1073 if (!elems_parse) 1074 return NULL; 1075 1076 elems_parse->elems.frame_type = params->type; 1077 elems_parse->elems.from_ap = params->from_ap; 1078 1079 elems_parse->scratch_len = scratch_len; 1080 elems_parse->scratch_pos = elems_parse->scratch; 1081 1082 elems = &elems_parse->elems; 1083 elems->ie_start = params->start; 1084 elems->total_len = params->len; 1085 1086 /* set all TPE entries to unlimited (but invalid) */ 1087 ieee80211_clear_tpe(&elems->tpe); 1088 ieee80211_clear_tpe(&elems->csa_tpe); 1089 1090 /* 1091 * If we're looking for a non-transmitted BSS then we cannot at 1092 * the same time be looking for a second link as the two can only 1093 * appear in the same frame carrying info for different BSSes. 1094 * 1095 * In any case, we only look for one at a time, as encoded by 1096 * the WARN_ON above. 1097 */ 1098 if (params->bss) { 1099 int nontx_len = 1100 ieee802_11_find_bssid_profile(params->start, 1101 params->len, 1102 elems, params->bss, 1103 elems_parse->scratch_pos); 1104 sub.start = elems_parse->scratch_pos; 1105 sub.mode = params->mode; 1106 sub.len = nontx_len; 1107 sub.type = params->type; 1108 sub.link_id = params->link_id; 1109 1110 /* indicate to consumer whether or not profile was found */ 1111 if (params->bss->transmitted_bss && !nontx_len) 1112 elems->mbssid_nontx_profile_missing = true; 1113 1114 /* consume the space used for non-transmitted profile */ 1115 elems_parse->scratch_pos += nontx_len; 1116 1117 non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, 1118 sub.start, nontx_len); 1119 /* 1120 * If it's a non-transmitted BSS, we shouldn't pick 1121 * any elements in the outer parsing that shouldn't 1122 * be inherited. If the profile has a non-inheritance 1123 * element this automatically happens, but if not then 1124 * provide an empty one so that the hard-coded elements 1125 * in cfg80211_is_element_inherited() are ignored, but 1126 * it must be called. 1127 */ 1128 if (params->bss->transmitted_bss && !non_inherit) 1129 non_inherit = (const void *)empty_non_inheritance; 1130 } else { 1131 /* 1132 * Find the multi-link element and the non-inherit element inside 1133 * the applicable profile, if requested by params->link_id >= 0. 1134 */ 1135 non_inherit = ieee80211_prep_mle_link_parse(elems_parse, params, 1136 &sub); 1137 inside_multilink = true; 1138 } 1139 1140 elems_parse->skip_vendor = 1141 cfg80211_find_elem(WLAN_EID_VENDOR_SPECIFIC, 1142 sub.start, sub.len); 1143 elems->crc = _ieee802_11_parse_elems_full(params, elems_parse, 1144 non_inherit); 1145 1146 /* Override with nontransmitted/per-STA profile if found */ 1147 if (sub.len) { 1148 elems_parse->inside_multilink = inside_multilink; 1149 elems_parse->skip_vendor = false; 1150 _ieee802_11_parse_elems_full(&sub, elems_parse, NULL); 1151 } 1152 1153 elems->ml_reconf = ieee80211_mle_defrag(elems_parse, 1154 &elems_parse->ml_reconf, 1155 &elems->ml_reconf_len); 1156 elems->ml_epcs = ieee80211_mle_defrag(elems_parse, 1157 &elems_parse->ml_epcs, 1158 &elems->ml_epcs_len); 1159 if (!elems->ml_basic) 1160 elems->ml_basic = ieee80211_mle_defrag(elems_parse, 1161 &elems_parse->ml_basic, 1162 &elems->ml_basic_len); 1163 1164 if (elems->tim && !elems->parse_error) { 1165 const struct ieee80211_tim_ie *tim_ie = elems->tim; 1166 1167 elems->dtim_period = tim_ie->dtim_period; 1168 elems->dtim_count = tim_ie->dtim_count; 1169 } 1170 1171 /* Override DTIM period and count if needed */ 1172 if (elems->bssid_index && 1173 elems->bssid_index_len >= 1174 offsetofend(struct ieee80211_bssid_index, dtim_period)) 1175 elems->dtim_period = elems->bssid_index->dtim_period; 1176 1177 if (elems->bssid_index && 1178 elems->bssid_index_len >= 1179 offsetofend(struct ieee80211_bssid_index, dtim_count)) 1180 elems->dtim_count = elems->bssid_index->dtim_count; 1181 1182 return elems; 1183 } 1184 EXPORT_SYMBOL_IF_KUNIT(ieee802_11_parse_elems_full); 1185 1186 int ieee80211_parse_bitrates(const struct ieee80211_supported_band *sband, 1187 const u8 *srates, int srates_len, u32 *rates) 1188 { 1189 struct ieee80211_rate *br; 1190 int brate, rate, i, j, count = 0; 1191 1192 *rates = 0; 1193 1194 for (i = 0; i < srates_len; i++) { 1195 rate = srates[i] & 0x7f; 1196 1197 for (j = 0; j < sband->n_bitrates; j++) { 1198 br = &sband->bitrates[j]; 1199 1200 brate = DIV_ROUND_UP(br->bitrate, 5); 1201 if (brate == rate) { 1202 *rates |= BIT(j); 1203 count++; 1204 break; 1205 } 1206 } 1207 } 1208 return count; 1209 } 1210