projects/linux·blob master · refs

1209 lines · 32.3 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright 2002-2005, Instant802 Networks, Inc.
4 * Copyright 2005-2006, Devicescape Software, Inc.
5 * Copyright 2006-2007 Jiri Benc <[email protected]>
6 * Copyright 2007 Johannes Berg <[email protected]>
7 * Copyright 2013-2014 Intel Mobile Communications GmbH
8 * Copyright (C) 2015-2017 Intel Deutschland GmbH
9 * Copyright (C) 2018-2026 Intel Corporation
10 *
11 * element parsing for mac80211
12 */
13
14#include <net/mac80211.h>
15#include <linux/netdevice.h>
16#include <linux/export.h>
17#include <linux/types.h>
18#include <linux/slab.h>
19#include <linux/skbuff.h>
20#include <linux/etherdevice.h>
21#include <linux/if_arp.h>
22#include <linux/bitmap.h>
23#include <linux/crc32.h>
24#include <net/net_namespace.h>
25#include <net/cfg80211.h>
26#include <net/rtnetlink.h>
27#include <kunit/visibility.h>
28
29#include "ieee80211_i.h"
30#include "driver-ops.h"
31#include "rate.h"
32#include "mesh.h"
33#include "wme.h"
34#include "led.h"
35#include "wep.h"
36
37static const u8 empty_non_inheritance[] = {
38 WLAN_EID_EXTENSION, 1, WLAN_EID_EXT_NON_INHERITANCE,
39 /*
40 * cfg80211_is_element_inherited() hardcodes elements that
41 * cannot be inherited, so we just need an empty one to be
42 * calling it at all.
43 */
44};
45
46struct ieee80211_elem_defrag {
47 const struct element *elem;
48 /* container start/len */
49 const u8 *start;
50 size_t len;
51};
52
53struct ieee80211_elems_parse {
54 /* must be first for kfree to work */
55 struct ieee802_11_elems elems;
56
57 struct ieee80211_elem_defrag ml_reconf, ml_epcs, ml_basic;
58
59 bool inside_multilink;
60 bool skip_vendor;
61
62 /*
63 * scratch buffer that can be used for various element parsing related
64 * tasks, e.g., element de-fragmentation etc.
65 */
66 size_t scratch_len;
67 u8 *scratch_pos;
68 u8 scratch[] __counted_by(scratch_len);
69};
70
71static void
72ieee80211_parse_extension_element(u32 *crc,
73 const struct element *elem,
74 struct ieee80211_elems_parse *elems_parse,
75 struct ieee80211_elems_parse_params *params)
76{
77 struct ieee802_11_elems *elems = &elems_parse->elems;
78 const void *data = elem->data + 1;
79 bool calc_crc = false;
80 u8 len;
81
82 if (!elem->datalen)
83 return;
84
85 len = elem->datalen - 1;
86
87 switch (elem->data[0]) {
88 case WLAN_EID_EXT_HE_MU_EDCA:
89 if (params->mode < IEEE80211_CONN_MODE_HE)
90 break;
91 calc_crc = true;
92 if (len >= sizeof(*elems->mu_edca_param_set))
93 elems->mu_edca_param_set = data;
94 break;
95 case WLAN_EID_EXT_HE_CAPABILITY:
96 if (params->mode < IEEE80211_CONN_MODE_HE)
97 break;
98 if (ieee80211_he_capa_size_ok(data, len)) {
99 elems->he_cap = data;
100 elems->he_cap_len = len;
101 }
102 break;
103 case WLAN_EID_EXT_HE_OPERATION:
104 if (params->mode < IEEE80211_CONN_MODE_HE)
105 break;
106 calc_crc = true;
107 if (len >= sizeof(*elems->he_operation) &&
108 len >= ieee80211_he_oper_size(data) - 1)
109 elems->he_operation = data;
110 break;
111 case WLAN_EID_EXT_UORA:
112 if (params->mode < IEEE80211_CONN_MODE_HE)
113 break;
114 if (len >= 1)
115 elems->uora_element = data;
116 break;
117 case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME:
118 if (len == 3)
119 elems->max_channel_switch_time = data;
120 break;
121 case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION:
122 if (len >= sizeof(*elems->mbssid_config_ie))
123 elems->mbssid_config_ie = data;
124 break;
125 case WLAN_EID_EXT_HE_SPR:
126 if (params->mode < IEEE80211_CONN_MODE_HE)
127 break;
128 if (len >= sizeof(*elems->he_spr) &&
129 len >= ieee80211_he_spr_size(data) - 1)
130 elems->he_spr = data;
131 break;
132 case WLAN_EID_EXT_HE_6GHZ_CAPA:
133 if (params->mode < IEEE80211_CONN_MODE_HE)
134 break;
135 if (len >= sizeof(*elems->he_6ghz_capa))
136 elems->he_6ghz_capa = data;
137 break;
138 case WLAN_EID_EXT_EHT_CAPABILITY:
139 if (params->mode < IEEE80211_CONN_MODE_EHT)
140 break;
141 if (ieee80211_eht_capa_size_ok(elems->he_cap,
142 data, len,
143 params->from_ap)) {
144 elems->eht_cap = data;
145 elems->eht_cap_len = len;
146 }
147 break;
148 case WLAN_EID_EXT_EHT_OPERATION:
149 if (params->mode < IEEE80211_CONN_MODE_EHT)
150 break;
151 if (ieee80211_eht_oper_size_ok(data, len))
152 elems->eht_operation = data;
153 calc_crc = true;
154 break;
155 case WLAN_EID_EXT_EHT_MULTI_LINK:
156 if (params->mode < IEEE80211_CONN_MODE_EHT)
157 break;
158 calc_crc = true;
159
160 if (ieee80211_mle_size_ok(data, len)) {
161 const struct ieee80211_multi_link_elem *mle =
162 (void *)data;
163
164 switch (le16_get_bits(mle->control,
165 IEEE80211_ML_CONTROL_TYPE)) {
166 case IEEE80211_ML_CONTROL_TYPE_BASIC:
167 if (elems_parse->inside_multilink) {
168 elems->parse_error |=
169 IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC;
170 break;
171 }
172 elems_parse->ml_basic.elem = elem;
173 elems_parse->ml_basic.start = params->start;
174 elems_parse->ml_basic.len = params->len;
175 break;
176 case IEEE80211_ML_CONTROL_TYPE_RECONF:
177 elems_parse->ml_reconf.elem = elem;
178 elems_parse->ml_reconf.start = params->start;
179 elems_parse->ml_reconf.len = params->len;
180 break;
181 case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
182 elems_parse->ml_epcs.elem = elem;
183 elems_parse->ml_epcs.start = params->start;
184 elems_parse->ml_epcs.len = params->len;
185 break;
186 default:
187 break;
188 }
189 }
190 break;
191 case WLAN_EID_EXT_BANDWIDTH_INDICATION:
192 if (params->mode < IEEE80211_CONN_MODE_EHT)
193 break;
194 if (ieee80211_bandwidth_indication_size_ok(data, len))
195 elems->bandwidth_indication = data;
196 calc_crc = true;
197 break;
198 case WLAN_EID_EXT_TID_TO_LINK_MAPPING:
199 if (params->mode < IEEE80211_CONN_MODE_EHT)
200 break;
201 calc_crc = true;
202 if (ieee80211_tid_to_link_map_size_ok(data, len) &&
203 elems->ttlm_num < ARRAY_SIZE(elems->ttlm)) {
204 elems->ttlm[elems->ttlm_num] = (void *)data;
205 elems->ttlm_num++;
206 }
207 break;
208 case WLAN_EID_EXT_UHR_OPER:
209 if (params->mode < IEEE80211_CONN_MODE_UHR)
210 break;
211 calc_crc = true;
212 if (ieee80211_uhr_oper_size_ok(data, len)) {
213 elems->uhr_operation = data;
214 elems->uhr_operation_len = len;
215 }
216 break;
217 case WLAN_EID_EXT_UHR_CAPA:
218 if (params->mode < IEEE80211_CONN_MODE_UHR)
219 break;
220 calc_crc = true;
221 if (ieee80211_uhr_capa_size_ok(data, len, true)) {
222 elems->uhr_cap = data;
223 elems->uhr_cap_len = len;
224 }
225 break;
226 }
227
228 if (crc && calc_crc)
229 *crc = crc32_be(*crc, (void *)elem, elem->datalen + 2);
230}
231
232static void ieee80211_parse_tpe(struct ieee80211_parsed_tpe *tpe,
233 const u8 *data, u8 len)
234{
235 const struct ieee80211_tx_pwr_env *env = (const void *)data;
236 u8 count, interpret, category;
237 u8 *out, N, *cnt_out = NULL, *N_out = NULL;
238
239 if (!ieee80211_valid_tpe_element(data, len))
240 return;
241
242 count = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_COUNT);
243 interpret = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_INTERPRET);
244 category = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_CATEGORY);
245
246 switch (interpret) {
247 case IEEE80211_TPE_LOCAL_EIRP:
248 out = tpe->max_local[category].power;
249 cnt_out = &tpe->max_local[category].count;
250 tpe->max_local[category].valid = true;
251 break;
252 case IEEE80211_TPE_REG_CLIENT_EIRP:
253 out = tpe->max_reg_client[category].power;
254 cnt_out = &tpe->max_reg_client[category].count;
255 tpe->max_reg_client[category].valid = true;
256 break;
257 case IEEE80211_TPE_LOCAL_EIRP_PSD:
258 out = tpe->psd_local[category].power;
259 cnt_out = &tpe->psd_local[category].count;
260 N_out = &tpe->psd_local[category].n;
261 tpe->psd_local[category].valid = true;
262 break;
263 case IEEE80211_TPE_REG_CLIENT_EIRP_PSD:
264 out = tpe->psd_reg_client[category].power;
265 cnt_out = &tpe->psd_reg_client[category].count;
266 N_out = &tpe->psd_reg_client[category].n;
267 tpe->psd_reg_client[category].valid = true;
268 break;
269 }
270
271 switch (interpret) {
272 case IEEE80211_TPE_LOCAL_EIRP:
273 case IEEE80211_TPE_REG_CLIENT_EIRP:
274 /* count was validated <= 3, plus 320 MHz */
275 BUILD_BUG_ON(IEEE80211_TPE_EIRP_ENTRIES_320MHZ < 5);
276 memcpy(out, env->variable, count + 1);
277 *cnt_out = count + 1;
278 /* separately take 320 MHz if present */
279 if (count == 3 && len > sizeof(*env) + count + 1) {
280 out[4] = env->variable[4];
281 *cnt_out = 5;
282 }
283 break;
284 case IEEE80211_TPE_LOCAL_EIRP_PSD:
285 case IEEE80211_TPE_REG_CLIENT_EIRP_PSD:
286 if (!count) {
287 memset(out, env->variable[0],
288 IEEE80211_TPE_PSD_ENTRIES_320MHZ);
289 *cnt_out = IEEE80211_TPE_PSD_ENTRIES_320MHZ;
290 break;
291 }
292
293 N = 1 << (count - 1);
294 memcpy(out, env->variable, N);
295 *cnt_out = N;
296 *N_out = N;
297
298 if (len > sizeof(*env) + N) {
299 int K = u8_get_bits(env->variable[N],
300 IEEE80211_TX_PWR_ENV_EXT_COUNT);
301
302 K = min(K, IEEE80211_TPE_PSD_ENTRIES_320MHZ - N);
303 memcpy(out + N, env->variable + N + 1, K);
304 (*cnt_out) += K;
305 }
306 break;
307 }
308}
309
310static u32
311_ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
312 struct ieee80211_elems_parse *elems_parse,
313 const struct element *check_inherit)
314{
315 struct ieee802_11_elems *elems = &elems_parse->elems;
316 const struct element *elem;
317 bool calc_crc = params->filter != 0;
318 DECLARE_BITMAP(seen_elems, 256);
319 u32 crc = params->crc;
320
321 bitmap_zero(seen_elems, 256);
322
323 switch (params->type) {
324 /* we don't need to parse assoc request, luckily (it's value 0) */
325 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_REQ:
326 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_REQ:
327 default:
328 WARN(1, "invalid frame type 0x%x for element parsing\n",
329 params->type);
330 break;
331 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_RESP:
332 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_RESP:
333 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ:
334 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP:
335 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON:
336 case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION:
337 case IEEE80211_FTYPE_EXT | IEEE80211_STYPE_S1G_BEACON:
338 break;
339 }
340
341 for_each_element(elem, params->start, params->len) {
342 const struct element *subelem;
343 u8 elem_parse_failed;
344 u8 id = elem->id;
345 u8 elen = elem->datalen;
346 const u8 *pos = elem->data;
347
348 if (check_inherit &&
349 !cfg80211_is_element_inherited(elem,
350 check_inherit))
351 continue;
352
353 switch (id) {
354 case WLAN_EID_SSID:
355 case WLAN_EID_SUPP_RATES:
356 case WLAN_EID_FH_PARAMS:
357 case WLAN_EID_DS_PARAMS:
358 case WLAN_EID_CF_PARAMS:
359 case WLAN_EID_TIM:
360 case WLAN_EID_IBSS_PARAMS:
361 case WLAN_EID_CHALLENGE:
362 case WLAN_EID_RSN:
363 case WLAN_EID_ERP_INFO:
364 case WLAN_EID_EXT_SUPP_RATES:
365 case WLAN_EID_HT_CAPABILITY:
366 case WLAN_EID_HT_OPERATION:
367 case WLAN_EID_VHT_CAPABILITY:
368 case WLAN_EID_VHT_OPERATION:
369 case WLAN_EID_MESH_ID:
370 case WLAN_EID_MESH_CONFIG:
371 case WLAN_EID_PEER_MGMT:
372 case WLAN_EID_PREQ:
373 case WLAN_EID_PREP:
374 case WLAN_EID_PERR:
375 case WLAN_EID_RANN:
376 case WLAN_EID_CHANNEL_SWITCH:
377 case WLAN_EID_EXT_CHANSWITCH_ANN:
378 case WLAN_EID_COUNTRY:
379 case WLAN_EID_PWR_CONSTRAINT:
380 case WLAN_EID_TIMEOUT_INTERVAL:
381 case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
382 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
383 case WLAN_EID_CHAN_SWITCH_PARAM:
384 case WLAN_EID_EXT_CAPABILITY:
385 case WLAN_EID_CHAN_SWITCH_TIMING:
386 case WLAN_EID_LINK_ID:
387 case WLAN_EID_BSS_MAX_IDLE_PERIOD:
388 case WLAN_EID_RSNX:
389 case WLAN_EID_S1G_BCN_COMPAT:
390 case WLAN_EID_S1G_CAPABILITIES:
391 case WLAN_EID_S1G_OPERATION:
392 case WLAN_EID_AID_RESPONSE:
393 case WLAN_EID_S1G_SHORT_BCN_INTERVAL:
394 /*
395 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
396 * that if the content gets bigger it might be needed more than once
397 */
398 if (test_bit(id, seen_elems)) {
399 elems->parse_error |=
400 IEEE80211_PARSE_ERR_DUP_ELEM;
401 continue;
402 }
403 break;
404 }
405
406 if (calc_crc && id < 64 && (params->filter & (1ULL << id)))
407 crc = crc32_be(crc, pos - 2, elen + 2);
408
409 elem_parse_failed = 0;
410
411 switch (id) {
412 case WLAN_EID_LINK_ID:
413 if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) {
414 elem_parse_failed =
415 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
416 break;
417 }
418 elems->lnk_id = (void *)(pos - 2);
419 break;
420 case WLAN_EID_CHAN_SWITCH_TIMING:
421 if (elen < sizeof(struct ieee80211_ch_switch_timing)) {
422 elem_parse_failed =
423 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
424 break;
425 }
426 elems->ch_sw_timing = (void *)pos;
427 break;
428 case WLAN_EID_EXT_CAPABILITY:
429 elems->ext_capab = pos;
430 elems->ext_capab_len = elen;
431 break;
432 case WLAN_EID_SSID:
433 elems->ssid = pos;
434 elems->ssid_len = elen;
435 break;
436 case WLAN_EID_SUPP_RATES:
437 elems->supp_rates = pos;
438 elems->supp_rates_len = elen;
439 break;
440 case WLAN_EID_DS_PARAMS:
441 if (elen >= 1)
442 elems->ds_params = pos;
443 else
444 elem_parse_failed =
445 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
446 break;
447 case WLAN_EID_TIM:
448 if (elen >= sizeof(struct ieee80211_tim_ie)) {
449 elems->tim = (void *)pos;
450 elems->tim_len = elen;
451 } else
452 elem_parse_failed =
453 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
454 break;
455 case WLAN_EID_VENDOR_SPECIFIC:
456 if (elems_parse->skip_vendor)
457 break;
458
459 if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
460 pos[2] == 0xf2) {
461 /* Microsoft OUI (00:50:F2) */
462
463 if (calc_crc)
464 crc = crc32_be(crc, pos - 2, elen + 2);
465
466 if (elen >= 5 && pos[3] == 2) {
467 /* OUI Type 2 - WMM IE */
468 if (pos[4] == 0) {
469 elems->wmm_info = pos;
470 elems->wmm_info_len = elen;
471 } else if (pos[4] == 1) {
472 elems->wmm_param = pos;
473 elems->wmm_param_len = elen;
474 }
475 }
476 }
477 break;
478 case WLAN_EID_RSN:
479 elems->rsn = pos;
480 elems->rsn_len = elen;
481 break;
482 case WLAN_EID_ERP_INFO:
483 if (elen >= 1)
484 elems->erp_info = pos;
485 else
486 elem_parse_failed =
487 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
488 break;
489 case WLAN_EID_EXT_SUPP_RATES:
490 elems->ext_supp_rates = pos;
491 elems->ext_supp_rates_len = elen;
492 break;
493 case WLAN_EID_HT_CAPABILITY:
494 if (params->mode < IEEE80211_CONN_MODE_HT)
495 break;
496 if (elen >= sizeof(struct ieee80211_ht_cap))
497 elems->ht_cap_elem = (void *)pos;
498 else
499 elem_parse_failed =
500 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
501 break;
502 case WLAN_EID_HT_OPERATION:
503 if (params->mode < IEEE80211_CONN_MODE_HT)
504 break;
505 if (elen >= sizeof(struct ieee80211_ht_operation))
506 elems->ht_operation = (void *)pos;
507 else
508 elem_parse_failed =
509 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
510 break;
511 case WLAN_EID_VHT_CAPABILITY:
512 if (params->mode < IEEE80211_CONN_MODE_VHT)
513 break;
514 if (elen >= sizeof(struct ieee80211_vht_cap))
515 elems->vht_cap_elem = (void *)pos;
516 else
517 elem_parse_failed =
518 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
519 break;
520 case WLAN_EID_VHT_OPERATION:
521 if (params->mode < IEEE80211_CONN_MODE_VHT)
522 break;
523 if (elen >= sizeof(struct ieee80211_vht_operation)) {
524 elems->vht_operation = (void *)pos;
525 if (calc_crc)
526 crc = crc32_be(crc, pos - 2, elen + 2);
527 break;
528 }
529 elem_parse_failed =
530 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
531 break;
532 case WLAN_EID_OPMODE_NOTIF:
533 if (params->mode < IEEE80211_CONN_MODE_VHT)
534 break;
535 if (elen > 0) {
536 elems->opmode_notif = pos;
537 if (calc_crc)
538 crc = crc32_be(crc, pos - 2, elen + 2);
539 break;
540 }
541 elem_parse_failed =
542 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
543 break;
544 case WLAN_EID_MESH_ID:
545 elems->mesh_id = pos;
546 elems->mesh_id_len = elen;
547 break;
548 case WLAN_EID_MESH_CONFIG:
549 if (elen >= sizeof(struct ieee80211_meshconf_ie))
550 elems->mesh_config = (void *)pos;
551 else
552 elem_parse_failed =
553 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
554 break;
555 case WLAN_EID_PEER_MGMT:
556 elems->peering = pos;
557 elems->peering_len = elen;
558 break;
559 case WLAN_EID_MESH_AWAKE_WINDOW:
560 if (elen >= 2)
561 elems->awake_window = (void *)pos;
562 break;
563 case WLAN_EID_PREQ:
564 if (ieee80211_mesh_preq_size_ok(pos, elen)) {
565 elems->preq = pos;
566 elems->preq_len = elen;
567 } else {
568 elem_parse_failed =
569 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
570 }
571 break;
572 case WLAN_EID_PREP:
573 if (ieee80211_mesh_prep_size_ok(pos, elen)) {
574 elems->prep = pos;
575 elems->prep_len = elen;
576 } else {
577 elem_parse_failed =
578 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
579 }
580 break;
581 case WLAN_EID_PERR:
582 if (ieee80211_mesh_perr_size_ok(pos, elen)) {
583 elems->perr = pos;
584 elems->perr_len = elen;
585 } else {
586 elem_parse_failed =
587 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
588 }
589 break;
590 case WLAN_EID_RANN:
591 if (elen >= sizeof(struct ieee80211_rann_ie))
592 elems->rann = (void *)pos;
593 else
594 elem_parse_failed =
595 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
596 break;
597 case WLAN_EID_CHANNEL_SWITCH:
598 if (elen != sizeof(struct ieee80211_channel_sw_ie)) {
599 elem_parse_failed =
600 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
601 break;
602 }
603 elems->ch_switch_ie = (void *)pos;
604 break;
605 case WLAN_EID_EXT_CHANSWITCH_ANN:
606 if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
607 elem_parse_failed =
608 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
609 break;
610 }
611 elems->ext_chansw_ie = (void *)pos;
612 break;
613 case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
614 if (params->mode < IEEE80211_CONN_MODE_HT)
615 break;
616 if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
617 elem_parse_failed =
618 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
619 break;
620 }
621 elems->sec_chan_offs = (void *)pos;
622 break;
623 case WLAN_EID_CHAN_SWITCH_PARAM:
624 if (elen <
625 sizeof(*elems->mesh_chansw_params_ie)) {
626 elem_parse_failed =
627 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
628 break;
629 }
630 elems->mesh_chansw_params_ie = (void *)pos;
631 break;
632 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
633 if (params->mode < IEEE80211_CONN_MODE_VHT)
634 break;
635
636 if (params->type != (IEEE80211_FTYPE_MGMT |
637 IEEE80211_STYPE_ACTION)) {
638 elem_parse_failed =
639 IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
640 break;
641 }
642
643 if (elen < sizeof(*elems->wide_bw_chansw_ie)) {
644 elem_parse_failed =
645 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
646 break;
647 }
648 elems->wide_bw_chansw_ie = (void *)pos;
649 break;
650 case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
651 if (params->mode < IEEE80211_CONN_MODE_VHT)
652 break;
653 if (params->type == (IEEE80211_FTYPE_MGMT |
654 IEEE80211_STYPE_ACTION)) {
655 elem_parse_failed =
656 IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
657 break;
658 }
659 /*
660 * This is a bit tricky, but as we only care about
661 * a few elements, parse them out manually.
662 */
663 subelem = cfg80211_find_elem(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
664 pos, elen);
665 if (subelem) {
666 if (subelem->datalen >= sizeof(*elems->wide_bw_chansw_ie))
667 elems->wide_bw_chansw_ie =
668 (void *)subelem->data;
669 else
670 elem_parse_failed =
671 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
672 }
673
674 if (params->mode < IEEE80211_CONN_MODE_EHT)
675 break;
676
677 subelem = cfg80211_find_ext_elem(WLAN_EID_EXT_BANDWIDTH_INDICATION,
678 pos, elen);
679 if (subelem) {
680 const void *edata = subelem->data + 1;
681 u8 edatalen = subelem->datalen - 1;
682
683 if (ieee80211_bandwidth_indication_size_ok(edata,
684 edatalen))
685 elems->bandwidth_indication = edata;
686 else
687 elem_parse_failed =
688 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
689 }
690
691 subelem = cfg80211_find_ext_elem(WLAN_EID_TX_POWER_ENVELOPE,
692 pos, elen);
693 if (subelem)
694 ieee80211_parse_tpe(&elems->csa_tpe,
695 subelem->data + 1,
696 subelem->datalen - 1);
697 break;
698 case WLAN_EID_COUNTRY:
699 elems->country_elem = pos;
700 elems->country_elem_len = elen;
701 break;
702 case WLAN_EID_PWR_CONSTRAINT:
703 if (elen != 1) {
704 elem_parse_failed =
705 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
706 break;
707 }
708 elems->pwr_constr_elem = pos;
709 break;
710 case WLAN_EID_CISCO_VENDOR_SPECIFIC:
711 /* Lots of different options exist, but we only care
712 * about the Dynamic Transmit Power Control element.
713 * First check for the Cisco OUI, then for the DTPC
714 * tag (0x00).
715 */
716 if (elen < 4) {
717 elem_parse_failed =
718 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
719 break;
720 }
721
722 if (pos[0] != 0x00 || pos[1] != 0x40 ||
723 pos[2] != 0x96 || pos[3] != 0x00)
724 break;
725
726 if (elen != 6) {
727 elem_parse_failed =
728 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
729 break;
730 }
731
732 if (calc_crc)
733 crc = crc32_be(crc, pos - 2, elen + 2);
734
735 elems->cisco_dtpc_elem = pos;
736 break;
737 case WLAN_EID_ADDBA_EXT:
738 if (elen < sizeof(struct ieee80211_addba_ext_ie)) {
739 elem_parse_failed =
740 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
741 break;
742 }
743 elems->addba_ext_ie = (void *)pos;
744 break;
745 case WLAN_EID_TIMEOUT_INTERVAL:
746 if (elen >= sizeof(struct ieee80211_timeout_interval_ie))
747 elems->timeout_int = (void *)pos;
748 else
749 elem_parse_failed =
750 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
751 break;
752 case WLAN_EID_BSS_MAX_IDLE_PERIOD:
753 if (elen >= sizeof(*elems->max_idle_period_ie))
754 elems->max_idle_period_ie = (void *)pos;
755 break;
756 case WLAN_EID_RSNX:
757 elems->rsnx = pos;
758 elems->rsnx_len = elen;
759 break;
760 case WLAN_EID_TX_POWER_ENVELOPE:
761 if (params->mode < IEEE80211_CONN_MODE_HE)
762 break;
763 ieee80211_parse_tpe(&elems->tpe, pos, elen);
764 break;
765 case WLAN_EID_EXTENSION:
766 ieee80211_parse_extension_element(calc_crc ?
767 &crc : NULL,
768 elem, elems_parse,
769 params);
770 break;
771 case WLAN_EID_S1G_CAPABILITIES:
772 if (params->mode != IEEE80211_CONN_MODE_S1G)
773 break;
774 if (elen >= sizeof(*elems->s1g_capab))
775 elems->s1g_capab = (void *)pos;
776 else
777 elem_parse_failed =
778 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
779 break;
780 case WLAN_EID_S1G_OPERATION:
781 if (params->mode != IEEE80211_CONN_MODE_S1G)
782 break;
783 if (elen == sizeof(*elems->s1g_oper))
784 elems->s1g_oper = (void *)pos;
785 else
786 elem_parse_failed =
787 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
788 break;
789 case WLAN_EID_S1G_BCN_COMPAT:
790 if (params->mode != IEEE80211_CONN_MODE_S1G)
791 break;
792 if (elen == sizeof(*elems->s1g_bcn_compat))
793 elems->s1g_bcn_compat = (void *)pos;
794 else
795 elem_parse_failed =
796 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
797 break;
798 case WLAN_EID_AID_RESPONSE:
799 if (params->mode != IEEE80211_CONN_MODE_S1G)
800 break;
801 if (elen == sizeof(struct ieee80211_aid_response_ie))
802 elems->aid_resp = (void *)pos;
803 else
804 elem_parse_failed =
805 IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
806 break;
807 default:
808 break;
809 }
810
811 if (elem_parse_failed)
812 elems->parse_error |= elem_parse_failed;
813 else
814 __set_bit(id, seen_elems);
815 }
816
817 if (!for_each_element_completed(elem, params->start, params->len))
818 elems->parse_error |= IEEE80211_PARSE_ERR_INVALID_END;
819
820 return crc;
821}
822
823static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
824 struct ieee802_11_elems *elems,
825 struct cfg80211_bss *bss,
826 u8 *nontransmitted_profile)
827{
828 const struct element *elem, *sub;
829
830 if (!bss || !bss->transmitted_bss)
831 return 0;
832
833 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
834 if (elem->datalen < 2)
835 continue;
836 if (elem->data[0] < 1 || elem->data[0] > 8)
837 continue;
838
839 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
840 u8 new_bssid[ETH_ALEN];
841 size_t profile_len;
842 const u8 *index;
843
844 if (sub->id != 0 || sub->datalen < 4) {
845 /* not a valid BSS profile */
846 continue;
847 }
848
849 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
850 sub->data[1] != 2) {
851 /* The first element of the
852 * Nontransmitted BSSID Profile is not
853 * the Nontransmitted BSSID Capability
854 * element.
855 */
856 continue;
857 }
858
859 memset(nontransmitted_profile, 0, len);
860 profile_len = cfg80211_merge_profile(start, len,
861 elem,
862 sub,
863 nontransmitted_profile,
864 len);
865
866 /* found a Nontransmitted BSSID Profile */
867 index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
868 nontransmitted_profile,
869 profile_len);
870 if (!index || index[1] < 1 || index[2] == 0) {
871 /* Invalid MBSSID Index element */
872 continue;
873 }
874
875 cfg80211_gen_new_bssid(bss->transmitted_bss->bssid,
876 elem->data[0],
877 index[2],
878 new_bssid);
879 if (ether_addr_equal(new_bssid, bss->bssid)) {
880 elems->bssid_index_len = index[1];
881 elems->bssid_index = (void *)&index[2];
882 return profile_len;
883 }
884 }
885 }
886
887 return 0;
888}
889
890static void
891ieee80211_mle_get_sta_prof(struct ieee80211_elems_parse *elems_parse,
892 u8 link_id)
893{
894 struct ieee802_11_elems *elems = &elems_parse->elems;
895 const struct ieee80211_multi_link_elem *ml = elems->ml_basic;
896 ssize_t ml_len = elems->ml_basic_len;
897 const struct element *sub;
898
899 for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
900 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
901 ssize_t sta_prof_len;
902 u16 control;
903
904 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
905 continue;
906
907 if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data,
908 sub->datalen))
909 return;
910
911 control = le16_to_cpu(prof->control);
912
913 if (link_id != u16_get_bits(control,
914 IEEE80211_MLE_STA_CONTROL_LINK_ID))
915 continue;
916
917 if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
918 return;
919
920 /* the sub element can be fragmented */
921 sta_prof_len =
922 cfg80211_defragment_element(sub,
923 (u8 *)ml, ml_len,
924 elems_parse->scratch_pos,
925 elems_parse->scratch +
926 elems_parse->scratch_len -
927 elems_parse->scratch_pos,
928 IEEE80211_MLE_SUBELEM_FRAGMENT);
929
930 if (sta_prof_len < 0)
931 return;
932
933 elems->prof = (void *)elems_parse->scratch_pos;
934 elems->sta_prof_len = sta_prof_len;
935 elems_parse->scratch_pos += sta_prof_len;
936
937 return;
938 }
939}
940
941static const struct element *
942ieee80211_prep_mle_link_parse(struct ieee80211_elems_parse *elems_parse,
943 struct ieee80211_elems_parse_params *params,
944 struct ieee80211_elems_parse_params *sub)
945{
946 struct ieee802_11_elems *elems = &elems_parse->elems;
947 struct ieee80211_mle_per_sta_profile *prof;
948 const struct element *ml_basic_elem = NULL;
949 const struct element *tmp, *ret;
950 ssize_t ml_len;
951 const u8 *end;
952
953 if (params->mode < IEEE80211_CONN_MODE_EHT)
954 return NULL;
955
956 for_each_element_extid(tmp, WLAN_EID_EXT_EHT_MULTI_LINK,
957 elems->ie_start, elems->total_len) {
958 const struct ieee80211_multi_link_elem *mle =
959 (void *)tmp->data + 1;
960
961 if (!ieee80211_mle_size_ok(tmp->data + 1, tmp->datalen - 1))
962 continue;
963
964 if (le16_get_bits(mle->control, IEEE80211_ML_CONTROL_TYPE) !=
965 IEEE80211_ML_CONTROL_TYPE_BASIC)
966 continue;
967
968 ml_basic_elem = tmp;
969 break;
970 }
971
972 ml_len = cfg80211_defragment_element(ml_basic_elem, elems->ie_start,
973 elems->total_len,
974 elems_parse->scratch_pos,
975 elems_parse->scratch +
976 elems_parse->scratch_len -
977 elems_parse->scratch_pos,
978 WLAN_EID_FRAGMENT);
979
980 if (ml_len < 0)
981 return NULL;
982
983 elems->ml_basic = (const void *)elems_parse->scratch_pos;
984 elems->ml_basic_len = ml_len;
985 elems_parse->scratch_pos += ml_len;
986
987 if (params->link_id == -1)
988 return NULL;
989
990 ieee80211_mle_get_sta_prof(elems_parse, params->link_id);
991 prof = elems->prof;
992
993 if (!prof)
994 return NULL;
995
996 /* check if we have the 4 bytes for the fixed part in assoc response */
997 if (elems->sta_prof_len < sizeof(*prof) + prof->sta_info_len - 1 + 4) {
998 elems->prof = NULL;
999 elems->sta_prof_len = 0;
1000 return NULL;
1001 }
1002
1003 /*
1004 * Skip the capability information and the status code that are expected
1005 * as part of the station profile in association response frames. Note
1006 * the -1 is because the 'sta_info_len' is accounted to as part of the
1007 * per-STA profile, but not part of the 'u8 variable[]' portion.
1008 */
1009 sub->start = prof->variable + prof->sta_info_len - 1 + 4;
1010 end = (const u8 *)prof + elems->sta_prof_len;
1011 sub->len = end - sub->start;
1012
1013 sub->mode = params->mode;
1014 sub->type = params->type;
1015 sub->from_ap = params->from_ap;
1016 sub->link_id = -1;
1017
1018 ret = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1019 sub->start, sub->len);
1020 if (ret)
1021 return ret;
1022
1023 /*
1024 * Since we know we want and found a profile, apply an empty
1025 * non-inheritance if the profile didn't have one, so that any
1026 * element that shouldn't be inherited by spec isn't.
1027 */
1028 return (const void *)empty_non_inheritance;
1029}
1030
1031static const void *
1032ieee80211_mle_defrag(struct ieee80211_elems_parse *elems_parse,
1033 struct ieee80211_elem_defrag *defrag,
1034 size_t *out_len)
1035{
1036 const void *ret;
1037 ssize_t ml_len;
1038
1039 ml_len = cfg80211_defragment_element(defrag->elem,
1040 defrag->start, defrag->len,
1041 elems_parse->scratch_pos,
1042 elems_parse->scratch +
1043 elems_parse->scratch_len -
1044 elems_parse->scratch_pos,
1045 WLAN_EID_FRAGMENT);
1046 if (ml_len < 0)
1047 return NULL;
1048 ret = elems_parse->scratch_pos;
1049 *out_len = ml_len;
1050 elems_parse->scratch_pos += ml_len;
1051 return ret;
1052}
1053
1054struct ieee802_11_elems *
1055ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
1056{
1057 struct ieee80211_elems_parse_params sub = {};
1058 struct ieee80211_elems_parse *elems_parse;
1059 const struct element *non_inherit = NULL;
1060 struct ieee802_11_elems *elems;
1061 size_t scratch_len = 3 * params->len;
1062 bool inside_multilink = false;
1063
1064 BUILD_BUG_ON(sizeof(empty_non_inheritance) != empty_non_inheritance[1] + 2);
1065 BUILD_BUG_ON(offsetof(typeof(*elems_parse), elems) != 0);
1066
1067 /* cannot parse for both a specific link and non-transmitted BSS */
1068 if (WARN_ON(params->link_id >= 0 && params->bss))
1069 return NULL;
1070
1071 elems_parse = kzalloc_flex(*elems_parse, scratch, scratch_len,
1072 GFP_ATOMIC);
1073 if (!elems_parse)
1074 return NULL;
1075
1076 elems_parse->elems.frame_type = params->type;
1077 elems_parse->elems.from_ap = params->from_ap;
1078
1079 elems_parse->scratch_len = scratch_len;
1080 elems_parse->scratch_pos = elems_parse->scratch;
1081
1082 elems = &elems_parse->elems;
1083 elems->ie_start = params->start;
1084 elems->total_len = params->len;
1085
1086 /* set all TPE entries to unlimited (but invalid) */
1087 ieee80211_clear_tpe(&elems->tpe);
1088 ieee80211_clear_tpe(&elems->csa_tpe);
1089
1090 /*
1091 * If we're looking for a non-transmitted BSS then we cannot at
1092 * the same time be looking for a second link as the two can only
1093 * appear in the same frame carrying info for different BSSes.
1094 *
1095 * In any case, we only look for one at a time, as encoded by
1096 * the WARN_ON above.
1097 */
1098 if (params->bss) {
1099 int nontx_len =
1100 ieee802_11_find_bssid_profile(params->start,
1101 params->len,
1102 elems, params->bss,
1103 elems_parse->scratch_pos);
1104 sub.start = elems_parse->scratch_pos;
1105 sub.mode = params->mode;
1106 sub.len = nontx_len;
1107 sub.type = params->type;
1108 sub.link_id = params->link_id;
1109
1110 /* indicate to consumer whether or not profile was found */
1111 if (params->bss->transmitted_bss && !nontx_len)
1112 elems->mbssid_nontx_profile_missing = true;
1113
1114 /* consume the space used for non-transmitted profile */
1115 elems_parse->scratch_pos += nontx_len;
1116
1117 non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1118 sub.start, nontx_len);
1119 /*
1120 * If it's a non-transmitted BSS, we shouldn't pick
1121 * any elements in the outer parsing that shouldn't
1122 * be inherited. If the profile has a non-inheritance
1123 * element this automatically happens, but if not then
1124 * provide an empty one so that the hard-coded elements
1125 * in cfg80211_is_element_inherited() are ignored, but
1126 * it must be called.
1127 */
1128 if (params->bss->transmitted_bss && !non_inherit)
1129 non_inherit = (const void *)empty_non_inheritance;
1130 } else {
1131 /*
1132 * Find the multi-link element and the non-inherit element inside
1133 * the applicable profile, if requested by params->link_id >= 0.
1134 */
1135 non_inherit = ieee80211_prep_mle_link_parse(elems_parse, params,
1136 &sub);
1137 inside_multilink = true;
1138 }
1139
1140 elems_parse->skip_vendor =
1141 cfg80211_find_elem(WLAN_EID_VENDOR_SPECIFIC,
1142 sub.start, sub.len);
1143 elems->crc = _ieee802_11_parse_elems_full(params, elems_parse,
1144 non_inherit);
1145
1146 /* Override with nontransmitted/per-STA profile if found */
1147 if (sub.len) {
1148 elems_parse->inside_multilink = inside_multilink;
1149 elems_parse->skip_vendor = false;
1150 _ieee802_11_parse_elems_full(&sub, elems_parse, NULL);
1151 }
1152
1153 elems->ml_reconf = ieee80211_mle_defrag(elems_parse,
1154 &elems_parse->ml_reconf,
1155 &elems->ml_reconf_len);
1156 elems->ml_epcs = ieee80211_mle_defrag(elems_parse,
1157 &elems_parse->ml_epcs,
1158 &elems->ml_epcs_len);
1159 if (!elems->ml_basic)
1160 elems->ml_basic = ieee80211_mle_defrag(elems_parse,
1161 &elems_parse->ml_basic,
1162 &elems->ml_basic_len);
1163
1164 if (elems->tim && !elems->parse_error) {
1165 const struct ieee80211_tim_ie *tim_ie = elems->tim;
1166
1167 elems->dtim_period = tim_ie->dtim_period;
1168 elems->dtim_count = tim_ie->dtim_count;
1169 }
1170
1171 /* Override DTIM period and count if needed */
1172 if (elems->bssid_index &&
1173 elems->bssid_index_len >=
1174 offsetofend(struct ieee80211_bssid_index, dtim_period))
1175 elems->dtim_period = elems->bssid_index->dtim_period;
1176
1177 if (elems->bssid_index &&
1178 elems->bssid_index_len >=
1179 offsetofend(struct ieee80211_bssid_index, dtim_count))
1180 elems->dtim_count = elems->bssid_index->dtim_count;
1181
1182 return elems;
1183}
1184EXPORT_SYMBOL_IF_KUNIT(ieee802_11_parse_elems_full);
1185
1186int ieee80211_parse_bitrates(const struct ieee80211_supported_band *sband,
1187 const u8 *srates, int srates_len, u32 *rates)
1188{
1189 struct ieee80211_rate *br;
1190 int brate, rate, i, j, count = 0;
1191
1192 *rates = 0;
1193
1194 for (i = 0; i < srates_len; i++) {
1195 rate = srates[i] & 0x7f;
1196
1197 for (j = 0; j < sband->n_bitrates; j++) {
1198 br = &sband->bitrates[j];
1199
1200 brate = DIV_ROUND_UP(br->bitrate, 5);
1201 if (brate == rate) {
1202 *rates |= BIT(j);
1203 count++;
1204 break;
1205 }
1206 }
1207 }
1208 return count;
1209}