xref: /openbmc/linux/net/mac80211/rx.c (revision 154be74e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright 2002-2005, Instant802 Networks, Inc.
4  * Copyright 2005-2006, Devicescape Software, Inc.
5  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
6  * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2013-2014  Intel Mobile Communications GmbH
8  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9  * Copyright (C) 2018-2023 Intel Corporation
10  */
11 
12 #include <linux/jiffies.h>
13 #include <linux/slab.h>
14 #include <linux/kernel.h>
15 #include <linux/skbuff.h>
16 #include <linux/netdevice.h>
17 #include <linux/etherdevice.h>
18 #include <linux/rcupdate.h>
19 #include <linux/export.h>
20 #include <linux/kcov.h>
21 #include <linux/bitops.h>
22 #include <net/mac80211.h>
23 #include <net/ieee80211_radiotap.h>
24 #include <asm/unaligned.h>
25 
26 #include "ieee80211_i.h"
27 #include "driver-ops.h"
28 #include "led.h"
29 #include "mesh.h"
30 #include "wep.h"
31 #include "wpa.h"
32 #include "tkip.h"
33 #include "wme.h"
34 #include "rate.h"
35 
36 /*
37  * monitor mode reception
38  *
39  * This function cleans up the SKB, i.e. it removes all the stuff
40  * only useful for monitoring.
41  */
ieee80211_clean_skb(struct sk_buff * skb,unsigned int present_fcs_len,unsigned int rtap_space)42 static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
43 					   unsigned int present_fcs_len,
44 					   unsigned int rtap_space)
45 {
46 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
47 	struct ieee80211_hdr *hdr;
48 	unsigned int hdrlen;
49 	__le16 fc;
50 
51 	if (present_fcs_len)
52 		__pskb_trim(skb, skb->len - present_fcs_len);
53 	pskb_pull(skb, rtap_space);
54 
55 	/* After pulling radiotap header, clear all flags that indicate
56 	 * info in skb->data.
57 	 */
58 	status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |
59 			  RX_FLAG_RADIOTAP_LSIG |
60 			  RX_FLAG_RADIOTAP_HE_MU |
61 			  RX_FLAG_RADIOTAP_HE);
62 
63 	hdr = (void *)skb->data;
64 	fc = hdr->frame_control;
65 
66 	/*
67 	 * Remove the HT-Control field (if present) on management
68 	 * frames after we've sent the frame to monitoring. We
69 	 * (currently) don't need it, and don't properly parse
70 	 * frames with it present, due to the assumption of a
71 	 * fixed management header length.
72 	 */
73 	if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
74 		return skb;
75 
76 	hdrlen = ieee80211_hdrlen(fc);
77 	hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
78 
79 	if (!pskb_may_pull(skb, hdrlen)) {
80 		dev_kfree_skb(skb);
81 		return NULL;
82 	}
83 
84 	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
85 		hdrlen - IEEE80211_HT_CTL_LEN);
86 	pskb_pull(skb, IEEE80211_HT_CTL_LEN);
87 
88 	return skb;
89 }
90 
should_drop_frame(struct sk_buff * skb,int present_fcs_len,unsigned int rtap_space)91 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
92 				     unsigned int rtap_space)
93 {
94 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
95 	struct ieee80211_hdr *hdr;
96 
97 	hdr = (void *)(skb->data + rtap_space);
98 
99 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
100 			    RX_FLAG_FAILED_PLCP_CRC |
101 			    RX_FLAG_ONLY_MONITOR |
102 			    RX_FLAG_NO_PSDU))
103 		return true;
104 
105 	if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
106 		return true;
107 
108 	if (ieee80211_is_ctl(hdr->frame_control) &&
109 	    !ieee80211_is_pspoll(hdr->frame_control) &&
110 	    !ieee80211_is_back_req(hdr->frame_control))
111 		return true;
112 
113 	return false;
114 }
115 
116 static int
ieee80211_rx_radiotap_hdrlen(struct ieee80211_local * local,struct ieee80211_rx_status * status,struct sk_buff * skb)117 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
118 			     struct ieee80211_rx_status *status,
119 			     struct sk_buff *skb)
120 {
121 	int len;
122 
123 	/* always present fields */
124 	len = sizeof(struct ieee80211_radiotap_header) + 8;
125 
126 	/* allocate extra bitmaps */
127 	if (status->chains)
128 		len += 4 * hweight8(status->chains);
129 
130 	if (ieee80211_have_rx_timestamp(status)) {
131 		len = ALIGN(len, 8);
132 		len += 8;
133 	}
134 	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
135 		len += 1;
136 
137 	/* antenna field, if we don't have per-chain info */
138 	if (!status->chains)
139 		len += 1;
140 
141 	/* padding for RX_FLAGS if necessary */
142 	len = ALIGN(len, 2);
143 
144 	if (status->encoding == RX_ENC_HT) /* HT info */
145 		len += 3;
146 
147 	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
148 		len = ALIGN(len, 4);
149 		len += 8;
150 	}
151 
152 	if (status->encoding == RX_ENC_VHT) {
153 		len = ALIGN(len, 2);
154 		len += 12;
155 	}
156 
157 	if (local->hw.radiotap_timestamp.units_pos >= 0) {
158 		len = ALIGN(len, 8);
159 		len += 12;
160 	}
161 
162 	if (status->encoding == RX_ENC_HE &&
163 	    status->flag & RX_FLAG_RADIOTAP_HE) {
164 		len = ALIGN(len, 2);
165 		len += 12;
166 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
167 	}
168 
169 	if (status->encoding == RX_ENC_HE &&
170 	    status->flag & RX_FLAG_RADIOTAP_HE_MU) {
171 		len = ALIGN(len, 2);
172 		len += 12;
173 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
174 	}
175 
176 	if (status->flag & RX_FLAG_NO_PSDU)
177 		len += 1;
178 
179 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
180 		len = ALIGN(len, 2);
181 		len += 4;
182 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
183 	}
184 
185 	if (status->chains) {
186 		/* antenna and antenna signal fields */
187 		len += 2 * hweight8(status->chains);
188 	}
189 
190 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
191 		int tlv_offset = 0;
192 
193 		/*
194 		 * The position to look at depends on the existence (or non-
195 		 * existence) of other elements, so take that into account...
196 		 */
197 		if (status->flag & RX_FLAG_RADIOTAP_HE)
198 			tlv_offset +=
199 				sizeof(struct ieee80211_radiotap_he);
200 		if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
201 			tlv_offset +=
202 				sizeof(struct ieee80211_radiotap_he_mu);
203 		if (status->flag & RX_FLAG_RADIOTAP_LSIG)
204 			tlv_offset +=
205 				sizeof(struct ieee80211_radiotap_lsig);
206 
207 		/* ensure 4 byte alignment for TLV */
208 		len = ALIGN(len, 4);
209 
210 		/* TLVs until the mac header */
211 		len += skb_mac_header(skb) - &skb->data[tlv_offset];
212 	}
213 
214 	return len;
215 }
216 
__ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data * sdata,int link_id,struct sta_info * sta,struct sk_buff * skb)217 static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
218 					   int link_id,
219 					   struct sta_info *sta,
220 					   struct sk_buff *skb)
221 {
222 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
223 
224 	if (link_id >= 0) {
225 		status->link_valid = 1;
226 		status->link_id = link_id;
227 	} else {
228 		status->link_valid = 0;
229 	}
230 
231 	skb_queue_tail(&sdata->skb_queue, skb);
232 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
233 	if (sta)
234 		sta->deflink.rx_stats.packets++;
235 }
236 
ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data * sdata,int link_id,struct sta_info * sta,struct sk_buff * skb)237 static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
238 					 int link_id,
239 					 struct sta_info *sta,
240 					 struct sk_buff *skb)
241 {
242 	skb->protocol = 0;
243 	__ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
244 }
245 
ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int rtap_space)246 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
247 					 struct sk_buff *skb,
248 					 int rtap_space)
249 {
250 	struct {
251 		struct ieee80211_hdr_3addr hdr;
252 		u8 category;
253 		u8 action_code;
254 	} __packed __aligned(2) action;
255 
256 	if (!sdata)
257 		return;
258 
259 	BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
260 
261 	if (skb->len < rtap_space + sizeof(action) +
262 		       VHT_MUMIMO_GROUPS_DATA_LEN)
263 		return;
264 
265 	if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
266 		return;
267 
268 	skb_copy_bits(skb, rtap_space, &action, sizeof(action));
269 
270 	if (!ieee80211_is_action(action.hdr.frame_control))
271 		return;
272 
273 	if (action.category != WLAN_CATEGORY_VHT)
274 		return;
275 
276 	if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
277 		return;
278 
279 	if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
280 		return;
281 
282 	skb = skb_copy(skb, GFP_ATOMIC);
283 	if (!skb)
284 		return;
285 
286 	ieee80211_queue_skb_to_iface(sdata, -1, NULL, skb);
287 }
288 
289 /*
290  * ieee80211_add_rx_radiotap_header - add radiotap header
291  *
292  * add a radiotap header containing all the fields which the hardware provided.
293  */
294 static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local * local,struct sk_buff * skb,struct ieee80211_rate * rate,int rtap_len,bool has_fcs)295 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
296 				 struct sk_buff *skb,
297 				 struct ieee80211_rate *rate,
298 				 int rtap_len, bool has_fcs)
299 {
300 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
301 	struct ieee80211_radiotap_header *rthdr;
302 	unsigned char *pos;
303 	__le32 *it_present;
304 	u32 it_present_val;
305 	u16 rx_flags = 0;
306 	u16 channel_flags = 0;
307 	u32 tlvs_len = 0;
308 	int mpdulen, chain;
309 	unsigned long chains = status->chains;
310 	struct ieee80211_radiotap_he he = {};
311 	struct ieee80211_radiotap_he_mu he_mu = {};
312 	struct ieee80211_radiotap_lsig lsig = {};
313 
314 	if (status->flag & RX_FLAG_RADIOTAP_HE) {
315 		he = *(struct ieee80211_radiotap_he *)skb->data;
316 		skb_pull(skb, sizeof(he));
317 		WARN_ON_ONCE(status->encoding != RX_ENC_HE);
318 	}
319 
320 	if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
321 		he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
322 		skb_pull(skb, sizeof(he_mu));
323 	}
324 
325 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
326 		lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
327 		skb_pull(skb, sizeof(lsig));
328 	}
329 
330 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
331 		/* data is pointer at tlv all other info was pulled off */
332 		tlvs_len = skb_mac_header(skb) - skb->data;
333 	}
334 
335 	mpdulen = skb->len;
336 	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
337 		mpdulen += FCS_LEN;
338 
339 	rthdr = skb_push(skb, rtap_len - tlvs_len);
340 	memset(rthdr, 0, rtap_len - tlvs_len);
341 	it_present = &rthdr->it_present;
342 
343 	/* radiotap header, set always present flags */
344 	rthdr->it_len = cpu_to_le16(rtap_len);
345 	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
346 			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
347 			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
348 
349 	if (!status->chains)
350 		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
351 
352 	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
353 		it_present_val |=
354 			BIT(IEEE80211_RADIOTAP_EXT) |
355 			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
356 		put_unaligned_le32(it_present_val, it_present);
357 		it_present++;
358 		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
359 				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
360 	}
361 
362 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
363 		it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
364 
365 	put_unaligned_le32(it_present_val, it_present);
366 
367 	/* This references through an offset into it_optional[] rather
368 	 * than via it_present otherwise later uses of pos will cause
369 	 * the compiler to think we have walked past the end of the
370 	 * struct member.
371 	 */
372 	pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
373 
374 	/* the order of the following fields is important */
375 
376 	/* IEEE80211_RADIOTAP_TSFT */
377 	if (ieee80211_have_rx_timestamp(status)) {
378 		/* padding */
379 		while ((pos - (u8 *)rthdr) & 7)
380 			*pos++ = 0;
381 		put_unaligned_le64(
382 			ieee80211_calculate_rx_timestamp(local, status,
383 							 mpdulen, 0),
384 			pos);
385 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
386 		pos += 8;
387 	}
388 
389 	/* IEEE80211_RADIOTAP_FLAGS */
390 	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
391 		*pos |= IEEE80211_RADIOTAP_F_FCS;
392 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
393 		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
394 	if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
395 		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
396 	pos++;
397 
398 	/* IEEE80211_RADIOTAP_RATE */
399 	if (!rate || status->encoding != RX_ENC_LEGACY) {
400 		/*
401 		 * Without rate information don't add it. If we have,
402 		 * MCS information is a separate field in radiotap,
403 		 * added below. The byte here is needed as padding
404 		 * for the channel though, so initialise it to 0.
405 		 */
406 		*pos = 0;
407 	} else {
408 		int shift = 0;
409 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
410 		if (status->bw == RATE_INFO_BW_10)
411 			shift = 1;
412 		else if (status->bw == RATE_INFO_BW_5)
413 			shift = 2;
414 		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
415 	}
416 	pos++;
417 
418 	/* IEEE80211_RADIOTAP_CHANNEL */
419 	/* TODO: frequency offset in KHz */
420 	put_unaligned_le16(status->freq, pos);
421 	pos += 2;
422 	if (status->bw == RATE_INFO_BW_10)
423 		channel_flags |= IEEE80211_CHAN_HALF;
424 	else if (status->bw == RATE_INFO_BW_5)
425 		channel_flags |= IEEE80211_CHAN_QUARTER;
426 
427 	if (status->band == NL80211_BAND_5GHZ ||
428 	    status->band == NL80211_BAND_6GHZ)
429 		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
430 	else if (status->encoding != RX_ENC_LEGACY)
431 		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
432 	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
433 		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
434 	else if (rate)
435 		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
436 	else
437 		channel_flags |= IEEE80211_CHAN_2GHZ;
438 	put_unaligned_le16(channel_flags, pos);
439 	pos += 2;
440 
441 	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
442 	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
443 	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
444 		*pos = status->signal;
445 		rthdr->it_present |=
446 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
447 		pos++;
448 	}
449 
450 	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
451 
452 	if (!status->chains) {
453 		/* IEEE80211_RADIOTAP_ANTENNA */
454 		*pos = status->antenna;
455 		pos++;
456 	}
457 
458 	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
459 
460 	/* IEEE80211_RADIOTAP_RX_FLAGS */
461 	/* ensure 2 byte alignment for the 2 byte field as required */
462 	if ((pos - (u8 *)rthdr) & 1)
463 		*pos++ = 0;
464 	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
465 		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
466 	put_unaligned_le16(rx_flags, pos);
467 	pos += 2;
468 
469 	if (status->encoding == RX_ENC_HT) {
470 		unsigned int stbc;
471 
472 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
473 		*pos = local->hw.radiotap_mcs_details;
474 		if (status->enc_flags & RX_ENC_FLAG_HT_GF)
475 			*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
476 		if (status->enc_flags & RX_ENC_FLAG_LDPC)
477 			*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
478 		pos++;
479 		*pos = 0;
480 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
481 			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
482 		if (status->bw == RATE_INFO_BW_40)
483 			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
484 		if (status->enc_flags & RX_ENC_FLAG_HT_GF)
485 			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
486 		if (status->enc_flags & RX_ENC_FLAG_LDPC)
487 			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
488 		stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
489 		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
490 		pos++;
491 		*pos++ = status->rate_idx;
492 	}
493 
494 	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
495 		u16 flags = 0;
496 
497 		/* ensure 4 byte alignment */
498 		while ((pos - (u8 *)rthdr) & 3)
499 			pos++;
500 		rthdr->it_present |=
501 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
502 		put_unaligned_le32(status->ampdu_reference, pos);
503 		pos += 4;
504 		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
505 			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
506 		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
507 			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
508 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
509 			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
510 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
511 			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
512 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
513 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
514 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
515 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
516 		put_unaligned_le16(flags, pos);
517 		pos += 2;
518 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
519 			*pos++ = status->ampdu_delimiter_crc;
520 		else
521 			*pos++ = 0;
522 		*pos++ = 0;
523 	}
524 
525 	if (status->encoding == RX_ENC_VHT) {
526 		u16 known = local->hw.radiotap_vht_details;
527 
528 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
529 		put_unaligned_le16(known, pos);
530 		pos += 2;
531 		/* flags */
532 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
533 			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
534 		/* in VHT, STBC is binary */
535 		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
536 			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
537 		if (status->enc_flags & RX_ENC_FLAG_BF)
538 			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
539 		pos++;
540 		/* bandwidth */
541 		switch (status->bw) {
542 		case RATE_INFO_BW_80:
543 			*pos++ = 4;
544 			break;
545 		case RATE_INFO_BW_160:
546 			*pos++ = 11;
547 			break;
548 		case RATE_INFO_BW_40:
549 			*pos++ = 1;
550 			break;
551 		default:
552 			*pos++ = 0;
553 		}
554 		/* MCS/NSS */
555 		*pos = (status->rate_idx << 4) | status->nss;
556 		pos += 4;
557 		/* coding field */
558 		if (status->enc_flags & RX_ENC_FLAG_LDPC)
559 			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
560 		pos++;
561 		/* group ID */
562 		pos++;
563 		/* partial_aid */
564 		pos += 2;
565 	}
566 
567 	if (local->hw.radiotap_timestamp.units_pos >= 0) {
568 		u16 accuracy = 0;
569 		u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
570 
571 		rthdr->it_present |=
572 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
573 
574 		/* ensure 8 byte alignment */
575 		while ((pos - (u8 *)rthdr) & 7)
576 			pos++;
577 
578 		put_unaligned_le64(status->device_timestamp, pos);
579 		pos += sizeof(u64);
580 
581 		if (local->hw.radiotap_timestamp.accuracy >= 0) {
582 			accuracy = local->hw.radiotap_timestamp.accuracy;
583 			flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
584 		}
585 		put_unaligned_le16(accuracy, pos);
586 		pos += sizeof(u16);
587 
588 		*pos++ = local->hw.radiotap_timestamp.units_pos;
589 		*pos++ = flags;
590 	}
591 
592 	if (status->encoding == RX_ENC_HE &&
593 	    status->flag & RX_FLAG_RADIOTAP_HE) {
594 #define HE_PREP(f, val)	le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
595 
596 		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
597 			he.data6 |= HE_PREP(DATA6_NSTS,
598 					    FIELD_GET(RX_ENC_FLAG_STBC_MASK,
599 						      status->enc_flags));
600 			he.data3 |= HE_PREP(DATA3_STBC, 1);
601 		} else {
602 			he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
603 		}
604 
605 #define CHECK_GI(s) \
606 	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
607 		     (int)NL80211_RATE_INFO_HE_GI_##s)
608 
609 		CHECK_GI(0_8);
610 		CHECK_GI(1_6);
611 		CHECK_GI(3_2);
612 
613 		he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
614 		he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
615 		he.data3 |= HE_PREP(DATA3_CODING,
616 				    !!(status->enc_flags & RX_ENC_FLAG_LDPC));
617 
618 		he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
619 
620 		switch (status->bw) {
621 		case RATE_INFO_BW_20:
622 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
623 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
624 			break;
625 		case RATE_INFO_BW_40:
626 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
627 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
628 			break;
629 		case RATE_INFO_BW_80:
630 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
631 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
632 			break;
633 		case RATE_INFO_BW_160:
634 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
635 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
636 			break;
637 		case RATE_INFO_BW_HE_RU:
638 #define CHECK_RU_ALLOC(s) \
639 	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
640 		     NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
641 
642 			CHECK_RU_ALLOC(26);
643 			CHECK_RU_ALLOC(52);
644 			CHECK_RU_ALLOC(106);
645 			CHECK_RU_ALLOC(242);
646 			CHECK_RU_ALLOC(484);
647 			CHECK_RU_ALLOC(996);
648 			CHECK_RU_ALLOC(2x996);
649 
650 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
651 					    status->he_ru + 4);
652 			break;
653 		default:
654 			WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
655 		}
656 
657 		/* ensure 2 byte alignment */
658 		while ((pos - (u8 *)rthdr) & 1)
659 			pos++;
660 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
661 		memcpy(pos, &he, sizeof(he));
662 		pos += sizeof(he);
663 	}
664 
665 	if (status->encoding == RX_ENC_HE &&
666 	    status->flag & RX_FLAG_RADIOTAP_HE_MU) {
667 		/* ensure 2 byte alignment */
668 		while ((pos - (u8 *)rthdr) & 1)
669 			pos++;
670 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
671 		memcpy(pos, &he_mu, sizeof(he_mu));
672 		pos += sizeof(he_mu);
673 	}
674 
675 	if (status->flag & RX_FLAG_NO_PSDU) {
676 		rthdr->it_present |=
677 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
678 		*pos++ = status->zero_length_psdu_type;
679 	}
680 
681 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
682 		/* ensure 2 byte alignment */
683 		while ((pos - (u8 *)rthdr) & 1)
684 			pos++;
685 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
686 		memcpy(pos, &lsig, sizeof(lsig));
687 		pos += sizeof(lsig);
688 	}
689 
690 	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
691 		*pos++ = status->chain_signal[chain];
692 		*pos++ = chain;
693 	}
694 }
695 
696 static struct sk_buff *
ieee80211_make_monitor_skb(struct ieee80211_local * local,struct sk_buff ** origskb,struct ieee80211_rate * rate,int rtap_space,bool use_origskb)697 ieee80211_make_monitor_skb(struct ieee80211_local *local,
698 			   struct sk_buff **origskb,
699 			   struct ieee80211_rate *rate,
700 			   int rtap_space, bool use_origskb)
701 {
702 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
703 	int rt_hdrlen, needed_headroom;
704 	struct sk_buff *skb;
705 
706 	/* room for the radiotap header based on driver features */
707 	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
708 	needed_headroom = rt_hdrlen - rtap_space;
709 
710 	if (use_origskb) {
711 		/* only need to expand headroom if necessary */
712 		skb = *origskb;
713 		*origskb = NULL;
714 
715 		/*
716 		 * This shouldn't trigger often because most devices have an
717 		 * RX header they pull before we get here, and that should
718 		 * be big enough for our radiotap information. We should
719 		 * probably export the length to drivers so that we can have
720 		 * them allocate enough headroom to start with.
721 		 */
722 		if (skb_headroom(skb) < needed_headroom &&
723 		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
724 			dev_kfree_skb(skb);
725 			return NULL;
726 		}
727 	} else {
728 		/*
729 		 * Need to make a copy and possibly remove radiotap header
730 		 * and FCS from the original.
731 		 */
732 		skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD,
733 				      0, GFP_ATOMIC);
734 
735 		if (!skb)
736 			return NULL;
737 	}
738 
739 	/* prepend radiotap information */
740 	ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
741 
742 	skb_reset_mac_header(skb);
743 	skb->ip_summed = CHECKSUM_UNNECESSARY;
744 	skb->pkt_type = PACKET_OTHERHOST;
745 	skb->protocol = htons(ETH_P_802_2);
746 
747 	return skb;
748 }
749 
750 /*
751  * This function copies a received frame to all monitor interfaces and
752  * returns a cleaned-up SKB that no longer includes the FCS nor the
753  * radiotap header the driver might have added.
754  */
755 static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local * local,struct sk_buff * origskb,struct ieee80211_rate * rate)756 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
757 		     struct ieee80211_rate *rate)
758 {
759 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
760 	struct ieee80211_sub_if_data *sdata;
761 	struct sk_buff *monskb = NULL;
762 	int present_fcs_len = 0;
763 	unsigned int rtap_space = 0;
764 	struct ieee80211_sub_if_data *monitor_sdata =
765 		rcu_dereference(local->monitor_sdata);
766 	bool only_monitor = false;
767 	unsigned int min_head_len;
768 
769 	if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&
770 			 !skb_mac_header_was_set(origskb))) {
771 		/* with this skb no way to know where frame payload starts */
772 		dev_kfree_skb(origskb);
773 		return NULL;
774 	}
775 
776 	if (status->flag & RX_FLAG_RADIOTAP_HE)
777 		rtap_space += sizeof(struct ieee80211_radiotap_he);
778 
779 	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
780 		rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
781 
782 	if (status->flag & RX_FLAG_RADIOTAP_LSIG)
783 		rtap_space += sizeof(struct ieee80211_radiotap_lsig);
784 
785 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
786 		rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];
787 
788 	min_head_len = rtap_space;
789 
790 	/*
791 	 * First, we may need to make a copy of the skb because
792 	 *  (1) we need to modify it for radiotap (if not present), and
793 	 *  (2) the other RX handlers will modify the skb we got.
794 	 *
795 	 * We don't need to, of course, if we aren't going to return
796 	 * the SKB because it has a bad FCS/PLCP checksum.
797 	 */
798 
799 	if (!(status->flag & RX_FLAG_NO_PSDU)) {
800 		if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
801 			if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
802 				/* driver bug */
803 				WARN_ON(1);
804 				dev_kfree_skb(origskb);
805 				return NULL;
806 			}
807 			present_fcs_len = FCS_LEN;
808 		}
809 
810 		/* also consider the hdr->frame_control */
811 		min_head_len += 2;
812 	}
813 
814 	/* ensure that the expected data elements are in skb head */
815 	if (!pskb_may_pull(origskb, min_head_len)) {
816 		dev_kfree_skb(origskb);
817 		return NULL;
818 	}
819 
820 	only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space);
821 
822 	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
823 		if (only_monitor) {
824 			dev_kfree_skb(origskb);
825 			return NULL;
826 		}
827 
828 		return ieee80211_clean_skb(origskb, present_fcs_len,
829 					   rtap_space);
830 	}
831 
832 	ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space);
833 
834 	list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
835 		bool last_monitor = list_is_last(&sdata->u.mntr.list,
836 						 &local->mon_list);
837 
838 		if (!monskb)
839 			monskb = ieee80211_make_monitor_skb(local, &origskb,
840 							    rate, rtap_space,
841 							    only_monitor &&
842 							    last_monitor);
843 
844 		if (monskb) {
845 			struct sk_buff *skb;
846 
847 			if (last_monitor) {
848 				skb = monskb;
849 				monskb = NULL;
850 			} else {
851 				skb = skb_clone(monskb, GFP_ATOMIC);
852 			}
853 
854 			if (skb) {
855 				skb->dev = sdata->dev;
856 				dev_sw_netstats_rx_add(skb->dev, skb->len);
857 				netif_receive_skb(skb);
858 			}
859 		}
860 
861 		if (last_monitor)
862 			break;
863 	}
864 
865 	/* this happens if last_monitor was erroneously false */
866 	dev_kfree_skb(monskb);
867 
868 	/* ditto */
869 	if (!origskb)
870 		return NULL;
871 
872 	return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space);
873 }
874 
ieee80211_parse_qos(struct ieee80211_rx_data * rx)875 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
876 {
877 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
878 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
879 	int tid, seqno_idx, security_idx;
880 
881 	/* does the frame have a qos control field? */
882 	if (ieee80211_is_data_qos(hdr->frame_control)) {
883 		u8 *qc = ieee80211_get_qos_ctl(hdr);
884 		/* frame has qos control */
885 		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
886 		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
887 			status->rx_flags |= IEEE80211_RX_AMSDU;
888 
889 		seqno_idx = tid;
890 		security_idx = tid;
891 	} else {
892 		/*
893 		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
894 		 *
895 		 *	Sequence numbers for management frames, QoS data
896 		 *	frames with a broadcast/multicast address in the
897 		 *	Address 1 field, and all non-QoS data frames sent
898 		 *	by QoS STAs are assigned using an additional single
899 		 *	modulo-4096 counter, [...]
900 		 *
901 		 * We also use that counter for non-QoS STAs.
902 		 */
903 		seqno_idx = IEEE80211_NUM_TIDS;
904 		security_idx = 0;
905 		if (ieee80211_is_mgmt(hdr->frame_control))
906 			security_idx = IEEE80211_NUM_TIDS;
907 		tid = 0;
908 	}
909 
910 	rx->seqno_idx = seqno_idx;
911 	rx->security_idx = security_idx;
912 	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
913 	 * For now, set skb->priority to 0 for other cases. */
914 	rx->skb->priority = (tid > 7) ? 0 : tid;
915 }
916 
917 /**
918  * DOC: Packet alignment
919  *
920  * Drivers always need to pass packets that are aligned to two-byte boundaries
921  * to the stack.
922  *
923  * Additionally, should, if possible, align the payload data in a way that
924  * guarantees that the contained IP header is aligned to a four-byte
925  * boundary. In the case of regular frames, this simply means aligning the
926  * payload to a four-byte boundary (because either the IP header is directly
927  * contained, or IV/RFC1042 headers that have a length divisible by four are
928  * in front of it).  If the payload data is not properly aligned and the
929  * architecture doesn't support efficient unaligned operations, mac80211
930  * will align the data.
931  *
932  * With A-MSDU frames, however, the payload data address must yield two modulo
933  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
934  * push the IP header further back to a multiple of four again. Thankfully, the
935  * specs were sane enough this time around to require padding each A-MSDU
936  * subframe to a length that is a multiple of four.
937  *
938  * Padding like Atheros hardware adds which is between the 802.11 header and
939  * the payload is not supported, the driver is required to move the 802.11
940  * header to be directly in front of the payload in that case.
941  */
ieee80211_verify_alignment(struct ieee80211_rx_data * rx)942 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
943 {
944 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
945 	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
946 #endif
947 }
948 
949 
950 /* rx handlers */
951 
ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff * skb)952 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
953 {
954 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
955 
956 	if (is_multicast_ether_addr(hdr->addr1))
957 		return 0;
958 
959 	return ieee80211_is_robust_mgmt_frame(skb);
960 }
961 
962 
ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff * skb)963 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
964 {
965 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
966 
967 	if (!is_multicast_ether_addr(hdr->addr1))
968 		return 0;
969 
970 	return ieee80211_is_robust_mgmt_frame(skb);
971 }
972 
973 
974 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
ieee80211_get_mmie_keyidx(struct sk_buff * skb)975 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
976 {
977 	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
978 	struct ieee80211_mmie *mmie;
979 	struct ieee80211_mmie_16 *mmie16;
980 
981 	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
982 		return -1;
983 
984 	if (!ieee80211_is_robust_mgmt_frame(skb) &&
985 	    !ieee80211_is_beacon(hdr->frame_control))
986 		return -1; /* not a robust management frame */
987 
988 	mmie = (struct ieee80211_mmie *)
989 		(skb->data + skb->len - sizeof(*mmie));
990 	if (mmie->element_id == WLAN_EID_MMIE &&
991 	    mmie->length == sizeof(*mmie) - 2)
992 		return le16_to_cpu(mmie->key_id);
993 
994 	mmie16 = (struct ieee80211_mmie_16 *)
995 		(skb->data + skb->len - sizeof(*mmie16));
996 	if (skb->len >= 24 + sizeof(*mmie16) &&
997 	    mmie16->element_id == WLAN_EID_MMIE &&
998 	    mmie16->length == sizeof(*mmie16) - 2)
999 		return le16_to_cpu(mmie16->key_id);
1000 
1001 	return -1;
1002 }
1003 
ieee80211_get_keyid(struct sk_buff * skb)1004 static int ieee80211_get_keyid(struct sk_buff *skb)
1005 {
1006 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1007 	__le16 fc = hdr->frame_control;
1008 	int hdrlen = ieee80211_hdrlen(fc);
1009 	u8 keyid;
1010 
1011 	/* WEP, TKIP, CCMP and GCMP */
1012 	if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
1013 		return -EINVAL;
1014 
1015 	skb_copy_bits(skb, hdrlen + 3, &keyid, 1);
1016 
1017 	keyid >>= 6;
1018 
1019 	return keyid;
1020 }
1021 
ieee80211_rx_mesh_check(struct ieee80211_rx_data * rx)1022 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1023 {
1024 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1025 	char *dev_addr = rx->sdata->vif.addr;
1026 
1027 	if (ieee80211_is_data(hdr->frame_control)) {
1028 		if (is_multicast_ether_addr(hdr->addr1)) {
1029 			if (ieee80211_has_tods(hdr->frame_control) ||
1030 			    !ieee80211_has_fromds(hdr->frame_control))
1031 				return RX_DROP_MONITOR;
1032 			if (ether_addr_equal(hdr->addr3, dev_addr))
1033 				return RX_DROP_MONITOR;
1034 		} else {
1035 			if (!ieee80211_has_a4(hdr->frame_control))
1036 				return RX_DROP_MONITOR;
1037 			if (ether_addr_equal(hdr->addr4, dev_addr))
1038 				return RX_DROP_MONITOR;
1039 		}
1040 	}
1041 
1042 	/* If there is not an established peer link and this is not a peer link
1043 	 * establisment frame, beacon or probe, drop the frame.
1044 	 */
1045 
1046 	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
1047 		struct ieee80211_mgmt *mgmt;
1048 
1049 		if (!ieee80211_is_mgmt(hdr->frame_control))
1050 			return RX_DROP_MONITOR;
1051 
1052 		if (ieee80211_is_action(hdr->frame_control)) {
1053 			u8 category;
1054 
1055 			/* make sure category field is present */
1056 			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
1057 				return RX_DROP_MONITOR;
1058 
1059 			mgmt = (struct ieee80211_mgmt *)hdr;
1060 			category = mgmt->u.action.category;
1061 			if (category != WLAN_CATEGORY_MESH_ACTION &&
1062 			    category != WLAN_CATEGORY_SELF_PROTECTED)
1063 				return RX_DROP_MONITOR;
1064 			return RX_CONTINUE;
1065 		}
1066 
1067 		if (ieee80211_is_probe_req(hdr->frame_control) ||
1068 		    ieee80211_is_probe_resp(hdr->frame_control) ||
1069 		    ieee80211_is_beacon(hdr->frame_control) ||
1070 		    ieee80211_is_auth(hdr->frame_control))
1071 			return RX_CONTINUE;
1072 
1073 		return RX_DROP_MONITOR;
1074 	}
1075 
1076 	return RX_CONTINUE;
1077 }
1078 
ieee80211_rx_reorder_ready(struct tid_ampdu_rx * tid_agg_rx,int index)1079 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1080 					      int index)
1081 {
1082 	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1083 	struct sk_buff *tail = skb_peek_tail(frames);
1084 	struct ieee80211_rx_status *status;
1085 
1086 	if (tid_agg_rx->reorder_buf_filtered &&
1087 	    tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1088 		return true;
1089 
1090 	if (!tail)
1091 		return false;
1092 
1093 	status = IEEE80211_SKB_RXCB(tail);
1094 	if (status->flag & RX_FLAG_AMSDU_MORE)
1095 		return false;
1096 
1097 	return true;
1098 }
1099 
ieee80211_release_reorder_frame(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,int index,struct sk_buff_head * frames)1100 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1101 					    struct tid_ampdu_rx *tid_agg_rx,
1102 					    int index,
1103 					    struct sk_buff_head *frames)
1104 {
1105 	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1106 	struct sk_buff *skb;
1107 	struct ieee80211_rx_status *status;
1108 
1109 	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1110 
1111 	if (skb_queue_empty(skb_list))
1112 		goto no_frame;
1113 
1114 	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1115 		__skb_queue_purge(skb_list);
1116 		goto no_frame;
1117 	}
1118 
1119 	/* release frames from the reorder ring buffer */
1120 	tid_agg_rx->stored_mpdu_num--;
1121 	while ((skb = __skb_dequeue(skb_list))) {
1122 		status = IEEE80211_SKB_RXCB(skb);
1123 		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1124 		__skb_queue_tail(frames, skb);
1125 	}
1126 
1127 no_frame:
1128 	if (tid_agg_rx->reorder_buf_filtered)
1129 		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1130 	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1131 }
1132 
ieee80211_release_reorder_frames(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,u16 head_seq_num,struct sk_buff_head * frames)1133 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1134 					     struct tid_ampdu_rx *tid_agg_rx,
1135 					     u16 head_seq_num,
1136 					     struct sk_buff_head *frames)
1137 {
1138 	int index;
1139 
1140 	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1141 
1142 	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
1143 		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1144 		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1145 						frames);
1146 	}
1147 }
1148 
1149 /*
1150  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1151  * the skb was added to the buffer longer than this time ago, the earlier
1152  * frames that have not yet been received are assumed to be lost and the skb
1153  * can be released for processing. This may also release other skb's from the
1154  * reorder buffer if there are no additional gaps between the frames.
1155  *
1156  * Callers must hold tid_agg_rx->reorder_lock.
1157  */
1158 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1159 
ieee80211_sta_reorder_release(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,struct sk_buff_head * frames)1160 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1161 					  struct tid_ampdu_rx *tid_agg_rx,
1162 					  struct sk_buff_head *frames)
1163 {
1164 	int index, i, j;
1165 
1166 	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1167 
1168 	/* release the buffer until next missing frame */
1169 	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1170 	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1171 	    tid_agg_rx->stored_mpdu_num) {
1172 		/*
1173 		 * No buffers ready to be released, but check whether any
1174 		 * frames in the reorder buffer have timed out.
1175 		 */
1176 		int skipped = 1;
1177 		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1178 		     j = (j + 1) % tid_agg_rx->buf_size) {
1179 			if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
1180 				skipped++;
1181 				continue;
1182 			}
1183 			if (skipped &&
1184 			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
1185 					HT_RX_REORDER_BUF_TIMEOUT))
1186 				goto set_release_timer;
1187 
1188 			/* don't leave incomplete A-MSDUs around */
1189 			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1190 			     i = (i + 1) % tid_agg_rx->buf_size)
1191 				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
1192 
1193 			ht_dbg_ratelimited(sdata,
1194 					   "release an RX reorder frame due to timeout on earlier frames\n");
1195 			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1196 							frames);
1197 
1198 			/*
1199 			 * Increment the head seq# also for the skipped slots.
1200 			 */
1201 			tid_agg_rx->head_seq_num =
1202 				(tid_agg_rx->head_seq_num +
1203 				 skipped) & IEEE80211_SN_MASK;
1204 			skipped = 0;
1205 		}
1206 	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1207 		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1208 						frames);
1209 		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1210 	}
1211 
1212 	if (tid_agg_rx->stored_mpdu_num) {
1213 		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1214 
1215 		for (; j != (index - 1) % tid_agg_rx->buf_size;
1216 		     j = (j + 1) % tid_agg_rx->buf_size) {
1217 			if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
1218 				break;
1219 		}
1220 
1221  set_release_timer:
1222 
1223 		if (!tid_agg_rx->removed)
1224 			mod_timer(&tid_agg_rx->reorder_timer,
1225 				  tid_agg_rx->reorder_time[j] + 1 +
1226 				  HT_RX_REORDER_BUF_TIMEOUT);
1227 	} else {
1228 		del_timer(&tid_agg_rx->reorder_timer);
1229 	}
1230 }
1231 
1232 /*
1233  * As this function belongs to the RX path it must be under
1234  * rcu_read_lock protection. It returns false if the frame
1235  * can be processed immediately, true if it was consumed.
1236  */
ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data * sdata,struct tid_ampdu_rx * tid_agg_rx,struct sk_buff * skb,struct sk_buff_head * frames)1237 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1238 					     struct tid_ampdu_rx *tid_agg_rx,
1239 					     struct sk_buff *skb,
1240 					     struct sk_buff_head *frames)
1241 {
1242 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1243 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1244 	u16 sc = le16_to_cpu(hdr->seq_ctrl);
1245 	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1246 	u16 head_seq_num, buf_size;
1247 	int index;
1248 	bool ret = true;
1249 
1250 	spin_lock(&tid_agg_rx->reorder_lock);
1251 
1252 	/*
1253 	 * Offloaded BA sessions have no known starting sequence number so pick
1254 	 * one from first Rxed frame for this tid after BA was started.
1255 	 */
1256 	if (unlikely(tid_agg_rx->auto_seq)) {
1257 		tid_agg_rx->auto_seq = false;
1258 		tid_agg_rx->ssn = mpdu_seq_num;
1259 		tid_agg_rx->head_seq_num = mpdu_seq_num;
1260 	}
1261 
1262 	buf_size = tid_agg_rx->buf_size;
1263 	head_seq_num = tid_agg_rx->head_seq_num;
1264 
1265 	/*
1266 	 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1267 	 * be reordered.
1268 	 */
1269 	if (unlikely(!tid_agg_rx->started)) {
1270 		if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1271 			ret = false;
1272 			goto out;
1273 		}
1274 		tid_agg_rx->started = true;
1275 	}
1276 
1277 	/* frame with out of date sequence number */
1278 	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1279 		dev_kfree_skb(skb);
1280 		goto out;
1281 	}
1282 
1283 	/*
1284 	 * If frame the sequence number exceeds our buffering window
1285 	 * size release some previous frames to make room for this one.
1286 	 */
1287 	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1288 		head_seq_num = ieee80211_sn_inc(
1289 				ieee80211_sn_sub(mpdu_seq_num, buf_size));
1290 		/* release stored frames up to new head to stack */
1291 		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1292 						 head_seq_num, frames);
1293 	}
1294 
1295 	/* Now the new frame is always in the range of the reordering buffer */
1296 
1297 	index = mpdu_seq_num % tid_agg_rx->buf_size;
1298 
1299 	/* check if we already stored this frame */
1300 	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1301 		dev_kfree_skb(skb);
1302 		goto out;
1303 	}
1304 
1305 	/*
1306 	 * If the current MPDU is in the right order and nothing else
1307 	 * is stored we can process it directly, no need to buffer it.
1308 	 * If it is first but there's something stored, we may be able
1309 	 * to release frames after this one.
1310 	 */
1311 	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1312 	    tid_agg_rx->stored_mpdu_num == 0) {
1313 		if (!(status->flag & RX_FLAG_AMSDU_MORE))
1314 			tid_agg_rx->head_seq_num =
1315 				ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1316 		ret = false;
1317 		goto out;
1318 	}
1319 
1320 	/* put the frame in the reordering buffer */
1321 	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1322 	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1323 		tid_agg_rx->reorder_time[index] = jiffies;
1324 		tid_agg_rx->stored_mpdu_num++;
1325 		ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1326 	}
1327 
1328  out:
1329 	spin_unlock(&tid_agg_rx->reorder_lock);
1330 	return ret;
1331 }
1332 
1333 /*
1334  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1335  * true if the MPDU was buffered, false if it should be processed.
1336  */
ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data * rx,struct sk_buff_head * frames)1337 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1338 				       struct sk_buff_head *frames)
1339 {
1340 	struct sk_buff *skb = rx->skb;
1341 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1342 	struct sta_info *sta = rx->sta;
1343 	struct tid_ampdu_rx *tid_agg_rx;
1344 	u16 sc;
1345 	u8 tid, ack_policy;
1346 
1347 	if (!ieee80211_is_data_qos(hdr->frame_control) ||
1348 	    is_multicast_ether_addr(hdr->addr1))
1349 		goto dont_reorder;
1350 
1351 	/*
1352 	 * filter the QoS data rx stream according to
1353 	 * STA/TID and check if this STA/TID is on aggregation
1354 	 */
1355 
1356 	if (!sta)
1357 		goto dont_reorder;
1358 
1359 	ack_policy = *ieee80211_get_qos_ctl(hdr) &
1360 		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1361 	tid = ieee80211_get_tid(hdr);
1362 
1363 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1364 	if (!tid_agg_rx) {
1365 		if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1366 		    !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1367 		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1368 			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1369 					     WLAN_BACK_RECIPIENT,
1370 					     WLAN_REASON_QSTA_REQUIRE_SETUP);
1371 		goto dont_reorder;
1372 	}
1373 
1374 	/* qos null data frames are excluded */
1375 	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1376 		goto dont_reorder;
1377 
1378 	/* not part of a BA session */
1379 	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
1380 		goto dont_reorder;
1381 
1382 	/* new, potentially un-ordered, ampdu frame - process it */
1383 
1384 	/* reset session timer */
1385 	if (tid_agg_rx->timeout)
1386 		tid_agg_rx->last_rx = jiffies;
1387 
1388 	/* if this mpdu is fragmented - terminate rx aggregation session */
1389 	sc = le16_to_cpu(hdr->seq_ctrl);
1390 	if (sc & IEEE80211_SCTL_FRAG) {
1391 		ieee80211_queue_skb_to_iface(rx->sdata, rx->link_id, NULL, skb);
1392 		return;
1393 	}
1394 
1395 	/*
1396 	 * No locking needed -- we will only ever process one
1397 	 * RX packet at a time, and thus own tid_agg_rx. All
1398 	 * other code manipulating it needs to (and does) make
1399 	 * sure that we cannot get to it any more before doing
1400 	 * anything with it.
1401 	 */
1402 	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1403 					     frames))
1404 		return;
1405 
1406  dont_reorder:
1407 	__skb_queue_tail(frames, skb);
1408 }
1409 
1410 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_dup(struct ieee80211_rx_data * rx)1411 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1412 {
1413 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1414 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1415 
1416 	if (status->flag & RX_FLAG_DUP_VALIDATED)
1417 		return RX_CONTINUE;
1418 
1419 	/*
1420 	 * Drop duplicate 802.11 retransmissions
1421 	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1422 	 */
1423 
1424 	if (rx->skb->len < 24)
1425 		return RX_CONTINUE;
1426 
1427 	if (ieee80211_is_ctl(hdr->frame_control) ||
1428 	    ieee80211_is_any_nullfunc(hdr->frame_control) ||
1429 	    is_multicast_ether_addr(hdr->addr1))
1430 		return RX_CONTINUE;
1431 
1432 	if (!rx->sta)
1433 		return RX_CONTINUE;
1434 
1435 	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1436 		     rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1437 		I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1438 		rx->link_sta->rx_stats.num_duplicates++;
1439 		return RX_DROP_UNUSABLE;
1440 	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1441 		rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1442 	}
1443 
1444 	return RX_CONTINUE;
1445 }
1446 
1447 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check(struct ieee80211_rx_data * rx)1448 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1449 {
1450 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1451 
1452 	/* Drop disallowed frame classes based on STA auth/assoc state;
1453 	 * IEEE 802.11, Chap 5.5.
1454 	 *
1455 	 * mac80211 filters only based on association state, i.e. it drops
1456 	 * Class 3 frames from not associated stations. hostapd sends
1457 	 * deauth/disassoc frames when needed. In addition, hostapd is
1458 	 * responsible for filtering on both auth and assoc states.
1459 	 */
1460 
1461 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1462 		return ieee80211_rx_mesh_check(rx);
1463 
1464 	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1465 		      ieee80211_is_pspoll(hdr->frame_control)) &&
1466 		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1467 		     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1468 		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1469 		/*
1470 		 * accept port control frames from the AP even when it's not
1471 		 * yet marked ASSOC to prevent a race where we don't set the
1472 		 * assoc bit quickly enough before it sends the first frame
1473 		 */
1474 		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1475 		    ieee80211_is_data_present(hdr->frame_control)) {
1476 			unsigned int hdrlen;
1477 			__be16 ethertype;
1478 
1479 			hdrlen = ieee80211_hdrlen(hdr->frame_control);
1480 
1481 			if (rx->skb->len < hdrlen + 8)
1482 				return RX_DROP_MONITOR;
1483 
1484 			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1485 			if (ethertype == rx->sdata->control_port_protocol)
1486 				return RX_CONTINUE;
1487 		}
1488 
1489 		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1490 		    cfg80211_rx_spurious_frame(rx->sdata->dev,
1491 					       hdr->addr2,
1492 					       GFP_ATOMIC))
1493 			return RX_DROP_UNUSABLE;
1494 
1495 		return RX_DROP_MONITOR;
1496 	}
1497 
1498 	return RX_CONTINUE;
1499 }
1500 
1501 
1502 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data * rx)1503 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1504 {
1505 	struct ieee80211_local *local;
1506 	struct ieee80211_hdr *hdr;
1507 	struct sk_buff *skb;
1508 
1509 	local = rx->local;
1510 	skb = rx->skb;
1511 	hdr = (struct ieee80211_hdr *) skb->data;
1512 
1513 	if (!local->pspolling)
1514 		return RX_CONTINUE;
1515 
1516 	if (!ieee80211_has_fromds(hdr->frame_control))
1517 		/* this is not from AP */
1518 		return RX_CONTINUE;
1519 
1520 	if (!ieee80211_is_data(hdr->frame_control))
1521 		return RX_CONTINUE;
1522 
1523 	if (!ieee80211_has_moredata(hdr->frame_control)) {
1524 		/* AP has no more frames buffered for us */
1525 		local->pspolling = false;
1526 		return RX_CONTINUE;
1527 	}
1528 
1529 	/* more data bit is set, let's request a new frame from the AP */
1530 	ieee80211_send_pspoll(local, rx->sdata);
1531 
1532 	return RX_CONTINUE;
1533 }
1534 
sta_ps_start(struct sta_info * sta)1535 static void sta_ps_start(struct sta_info *sta)
1536 {
1537 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1538 	struct ieee80211_local *local = sdata->local;
1539 	struct ps_data *ps;
1540 	int tid;
1541 
1542 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1543 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1544 		ps = &sdata->bss->ps;
1545 	else
1546 		return;
1547 
1548 	atomic_inc(&ps->num_sta_ps);
1549 	set_sta_flag(sta, WLAN_STA_PS_STA);
1550 	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1551 		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1552 	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1553 	       sta->sta.addr, sta->sta.aid);
1554 
1555 	ieee80211_clear_fast_xmit(sta);
1556 
1557 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1558 		struct ieee80211_txq *txq = sta->sta.txq[tid];
1559 		struct txq_info *txqi = to_txq_info(txq);
1560 
1561 		spin_lock(&local->active_txq_lock[txq->ac]);
1562 		if (!list_empty(&txqi->schedule_order))
1563 			list_del_init(&txqi->schedule_order);
1564 		spin_unlock(&local->active_txq_lock[txq->ac]);
1565 
1566 		if (txq_has_queue(txq))
1567 			set_bit(tid, &sta->txq_buffered_tids);
1568 		else
1569 			clear_bit(tid, &sta->txq_buffered_tids);
1570 	}
1571 }
1572 
sta_ps_end(struct sta_info * sta)1573 static void sta_ps_end(struct sta_info *sta)
1574 {
1575 	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1576 	       sta->sta.addr, sta->sta.aid);
1577 
1578 	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1579 		/*
1580 		 * Clear the flag only if the other one is still set
1581 		 * so that the TX path won't start TX'ing new frames
1582 		 * directly ... In the case that the driver flag isn't
1583 		 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1584 		 */
1585 		clear_sta_flag(sta, WLAN_STA_PS_STA);
1586 		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1587 		       sta->sta.addr, sta->sta.aid);
1588 		return;
1589 	}
1590 
1591 	set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1592 	clear_sta_flag(sta, WLAN_STA_PS_STA);
1593 	ieee80211_sta_ps_deliver_wakeup(sta);
1594 }
1595 
ieee80211_sta_ps_transition(struct ieee80211_sta * pubsta,bool start)1596 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1597 {
1598 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1599 	bool in_ps;
1600 
1601 	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1602 
1603 	/* Don't let the same PS state be set twice */
1604 	in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1605 	if ((start && in_ps) || (!start && !in_ps))
1606 		return -EINVAL;
1607 
1608 	if (start)
1609 		sta_ps_start(sta);
1610 	else
1611 		sta_ps_end(sta);
1612 
1613 	return 0;
1614 }
1615 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1616 
ieee80211_sta_pspoll(struct ieee80211_sta * pubsta)1617 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1618 {
1619 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1620 
1621 	if (test_sta_flag(sta, WLAN_STA_SP))
1622 		return;
1623 
1624 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1625 		ieee80211_sta_ps_deliver_poll_response(sta);
1626 	else
1627 		set_sta_flag(sta, WLAN_STA_PSPOLL);
1628 }
1629 EXPORT_SYMBOL(ieee80211_sta_pspoll);
1630 
ieee80211_sta_uapsd_trigger(struct ieee80211_sta * pubsta,u8 tid)1631 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1632 {
1633 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1634 	int ac = ieee80211_ac_from_tid(tid);
1635 
1636 	/*
1637 	 * If this AC is not trigger-enabled do nothing unless the
1638 	 * driver is calling us after it already checked.
1639 	 *
1640 	 * NB: This could/should check a separate bitmap of trigger-
1641 	 * enabled queues, but for now we only implement uAPSD w/o
1642 	 * TSPEC changes to the ACs, so they're always the same.
1643 	 */
1644 	if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1645 	    tid != IEEE80211_NUM_TIDS)
1646 		return;
1647 
1648 	/* if we are in a service period, do nothing */
1649 	if (test_sta_flag(sta, WLAN_STA_SP))
1650 		return;
1651 
1652 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1653 		ieee80211_sta_ps_deliver_uapsd(sta);
1654 	else
1655 		set_sta_flag(sta, WLAN_STA_UAPSD);
1656 }
1657 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1658 
1659 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data * rx)1660 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1661 {
1662 	struct ieee80211_sub_if_data *sdata = rx->sdata;
1663 	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1664 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1665 
1666 	if (!rx->sta)
1667 		return RX_CONTINUE;
1668 
1669 	if (sdata->vif.type != NL80211_IFTYPE_AP &&
1670 	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1671 		return RX_CONTINUE;
1672 
1673 	/*
1674 	 * The device handles station powersave, so don't do anything about
1675 	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1676 	 * it to mac80211 since they're handled.)
1677 	 */
1678 	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1679 		return RX_CONTINUE;
1680 
1681 	/*
1682 	 * Don't do anything if the station isn't already asleep. In
1683 	 * the uAPSD case, the station will probably be marked asleep,
1684 	 * in the PS-Poll case the station must be confused ...
1685 	 */
1686 	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1687 		return RX_CONTINUE;
1688 
1689 	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1690 		ieee80211_sta_pspoll(&rx->sta->sta);
1691 
1692 		/* Free PS Poll skb here instead of returning RX_DROP that would
1693 		 * count as an dropped frame. */
1694 		dev_kfree_skb(rx->skb);
1695 
1696 		return RX_QUEUED;
1697 	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1698 		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1699 		   ieee80211_has_pm(hdr->frame_control) &&
1700 		   (ieee80211_is_data_qos(hdr->frame_control) ||
1701 		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1702 		u8 tid = ieee80211_get_tid(hdr);
1703 
1704 		ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1705 	}
1706 
1707 	return RX_CONTINUE;
1708 }
1709 
1710 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_sta_process(struct ieee80211_rx_data * rx)1711 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1712 {
1713 	struct sta_info *sta = rx->sta;
1714 	struct link_sta_info *link_sta = rx->link_sta;
1715 	struct sk_buff *skb = rx->skb;
1716 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1717 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1718 	int i;
1719 
1720 	if (!sta || !link_sta)
1721 		return RX_CONTINUE;
1722 
1723 	/*
1724 	 * Update last_rx only for IBSS packets which are for the current
1725 	 * BSSID and for station already AUTHORIZED to avoid keeping the
1726 	 * current IBSS network alive in cases where other STAs start
1727 	 * using different BSSID. This will also give the station another
1728 	 * chance to restart the authentication/authorization in case
1729 	 * something went wrong the first time.
1730 	 */
1731 	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1732 		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1733 						NL80211_IFTYPE_ADHOC);
1734 		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1735 		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1736 			link_sta->rx_stats.last_rx = jiffies;
1737 			if (ieee80211_is_data_present(hdr->frame_control) &&
1738 			    !is_multicast_ether_addr(hdr->addr1))
1739 				link_sta->rx_stats.last_rate =
1740 					sta_stats_encode_rate(status);
1741 		}
1742 	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1743 		link_sta->rx_stats.last_rx = jiffies;
1744 	} else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
1745 		   !is_multicast_ether_addr(hdr->addr1)) {
1746 		/*
1747 		 * Mesh beacons will update last_rx when if they are found to
1748 		 * match the current local configuration when processed.
1749 		 */
1750 		link_sta->rx_stats.last_rx = jiffies;
1751 		if (ieee80211_is_data_present(hdr->frame_control))
1752 			link_sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1753 	}
1754 
1755 	link_sta->rx_stats.fragments++;
1756 
1757 	u64_stats_update_begin(&link_sta->rx_stats.syncp);
1758 	link_sta->rx_stats.bytes += rx->skb->len;
1759 	u64_stats_update_end(&link_sta->rx_stats.syncp);
1760 
1761 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1762 		link_sta->rx_stats.last_signal = status->signal;
1763 		ewma_signal_add(&link_sta->rx_stats_avg.signal,
1764 				-status->signal);
1765 	}
1766 
1767 	if (status->chains) {
1768 		link_sta->rx_stats.chains = status->chains;
1769 		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1770 			int signal = status->chain_signal[i];
1771 
1772 			if (!(status->chains & BIT(i)))
1773 				continue;
1774 
1775 			link_sta->rx_stats.chain_signal_last[i] = signal;
1776 			ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
1777 					-signal);
1778 		}
1779 	}
1780 
1781 	if (ieee80211_is_s1g_beacon(hdr->frame_control))
1782 		return RX_CONTINUE;
1783 
1784 	/*
1785 	 * Change STA power saving mode only at the end of a frame
1786 	 * exchange sequence, and only for a data or management
1787 	 * frame as specified in IEEE 802.11-2016 11.2.3.2
1788 	 */
1789 	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1790 	    !ieee80211_has_morefrags(hdr->frame_control) &&
1791 	    !is_multicast_ether_addr(hdr->addr1) &&
1792 	    (ieee80211_is_mgmt(hdr->frame_control) ||
1793 	     ieee80211_is_data(hdr->frame_control)) &&
1794 	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1795 	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1796 	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1797 		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1798 			if (!ieee80211_has_pm(hdr->frame_control))
1799 				sta_ps_end(sta);
1800 		} else {
1801 			if (ieee80211_has_pm(hdr->frame_control))
1802 				sta_ps_start(sta);
1803 		}
1804 	}
1805 
1806 	/* mesh power save support */
1807 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1808 		ieee80211_mps_rx_h_sta_process(sta, hdr);
1809 
1810 	/*
1811 	 * Drop (qos-)data::nullfunc frames silently, since they
1812 	 * are used only to control station power saving mode.
1813 	 */
1814 	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
1815 		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1816 
1817 		/*
1818 		 * If we receive a 4-addr nullfunc frame from a STA
1819 		 * that was not moved to a 4-addr STA vlan yet send
1820 		 * the event to userspace and for older hostapd drop
1821 		 * the frame to the monitor interface.
1822 		 */
1823 		if (ieee80211_has_a4(hdr->frame_control) &&
1824 		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1825 		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1826 		      !rx->sdata->u.vlan.sta))) {
1827 			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1828 				cfg80211_rx_unexpected_4addr_frame(
1829 					rx->sdata->dev, sta->sta.addr,
1830 					GFP_ATOMIC);
1831 			return RX_DROP_M_UNEXPECTED_4ADDR_FRAME;
1832 		}
1833 		/*
1834 		 * Update counter and free packet here to avoid
1835 		 * counting this as a dropped packed.
1836 		 */
1837 		link_sta->rx_stats.packets++;
1838 		dev_kfree_skb(rx->skb);
1839 		return RX_QUEUED;
1840 	}
1841 
1842 	return RX_CONTINUE;
1843 } /* ieee80211_rx_h_sta_process */
1844 
1845 static struct ieee80211_key *
ieee80211_rx_get_bigtk(struct ieee80211_rx_data * rx,int idx)1846 ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1847 {
1848 	struct ieee80211_key *key = NULL;
1849 	int idx2;
1850 
1851 	/* Make sure key gets set if either BIGTK key index is set so that
1852 	 * ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
1853 	 * Beacon frames and Beacon frames that claim to use another BIGTK key
1854 	 * index (i.e., a key that we do not have).
1855 	 */
1856 
1857 	if (idx < 0) {
1858 		idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
1859 		idx2 = idx + 1;
1860 	} else {
1861 		if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1862 			idx2 = idx + 1;
1863 		else
1864 			idx2 = idx - 1;
1865 	}
1866 
1867 	if (rx->link_sta)
1868 		key = rcu_dereference(rx->link_sta->gtk[idx]);
1869 	if (!key)
1870 		key = rcu_dereference(rx->link->gtk[idx]);
1871 	if (!key && rx->link_sta)
1872 		key = rcu_dereference(rx->link_sta->gtk[idx2]);
1873 	if (!key)
1874 		key = rcu_dereference(rx->link->gtk[idx2]);
1875 
1876 	return key;
1877 }
1878 
1879 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data * rx)1880 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1881 {
1882 	struct sk_buff *skb = rx->skb;
1883 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1884 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1885 	int keyidx;
1886 	ieee80211_rx_result result = RX_DROP_UNUSABLE;
1887 	struct ieee80211_key *sta_ptk = NULL;
1888 	struct ieee80211_key *ptk_idx = NULL;
1889 	int mmie_keyidx = -1;
1890 	__le16 fc;
1891 
1892 	if (ieee80211_is_ext(hdr->frame_control))
1893 		return RX_CONTINUE;
1894 
1895 	/*
1896 	 * Key selection 101
1897 	 *
1898 	 * There are five types of keys:
1899 	 *  - GTK (group keys)
1900 	 *  - IGTK (group keys for management frames)
1901 	 *  - BIGTK (group keys for Beacon frames)
1902 	 *  - PTK (pairwise keys)
1903 	 *  - STK (station-to-station pairwise keys)
1904 	 *
1905 	 * When selecting a key, we have to distinguish between multicast
1906 	 * (including broadcast) and unicast frames, the latter can only
1907 	 * use PTKs and STKs while the former always use GTKs, IGTKs, and
1908 	 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
1909 	 * then unicast frames can also use key indices like GTKs. Hence, if we
1910 	 * don't have a PTK/STK we check the key index for a WEP key.
1911 	 *
1912 	 * Note that in a regular BSS, multicast frames are sent by the
1913 	 * AP only, associated stations unicast the frame to the AP first
1914 	 * which then multicasts it on their behalf.
1915 	 *
1916 	 * There is also a slight problem in IBSS mode: GTKs are negotiated
1917 	 * with each station, that is something we don't currently handle.
1918 	 * The spec seems to expect that one negotiates the same key with
1919 	 * every station but there's no such requirement; VLANs could be
1920 	 * possible.
1921 	 */
1922 
1923 	/* start without a key */
1924 	rx->key = NULL;
1925 	fc = hdr->frame_control;
1926 
1927 	if (rx->sta) {
1928 		int keyid = rx->sta->ptk_idx;
1929 		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1930 
1931 		if (ieee80211_has_protected(fc) &&
1932 		    !(status->flag & RX_FLAG_IV_STRIPPED)) {
1933 			keyid = ieee80211_get_keyid(rx->skb);
1934 
1935 			if (unlikely(keyid < 0))
1936 				return RX_DROP_UNUSABLE;
1937 
1938 			ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
1939 		}
1940 	}
1941 
1942 	if (!ieee80211_has_protected(fc))
1943 		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1944 
1945 	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1946 		rx->key = ptk_idx ? ptk_idx : sta_ptk;
1947 		if ((status->flag & RX_FLAG_DECRYPTED) &&
1948 		    (status->flag & RX_FLAG_IV_STRIPPED))
1949 			return RX_CONTINUE;
1950 		/* Skip decryption if the frame is not protected. */
1951 		if (!ieee80211_has_protected(fc))
1952 			return RX_CONTINUE;
1953 	} else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
1954 		/* Broadcast/multicast robust management frame / BIP */
1955 		if ((status->flag & RX_FLAG_DECRYPTED) &&
1956 		    (status->flag & RX_FLAG_IV_STRIPPED))
1957 			return RX_CONTINUE;
1958 
1959 		if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
1960 		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
1961 				   NUM_DEFAULT_BEACON_KEYS) {
1962 			if (rx->sdata->dev)
1963 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1964 							     skb->data,
1965 							     skb->len);
1966 			return RX_DROP_M_BAD_BCN_KEYIDX;
1967 		}
1968 
1969 		rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
1970 		if (!rx->key)
1971 			return RX_CONTINUE; /* Beacon protection not in use */
1972 	} else if (mmie_keyidx >= 0) {
1973 		/* Broadcast/multicast robust management frame / BIP */
1974 		if ((status->flag & RX_FLAG_DECRYPTED) &&
1975 		    (status->flag & RX_FLAG_IV_STRIPPED))
1976 			return RX_CONTINUE;
1977 
1978 		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1979 		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1980 			return RX_DROP_M_BAD_MGMT_KEYIDX; /* unexpected BIP keyidx */
1981 		if (rx->link_sta) {
1982 			if (ieee80211_is_group_privacy_action(skb) &&
1983 			    test_sta_flag(rx->sta, WLAN_STA_MFP))
1984 				return RX_DROP_MONITOR;
1985 
1986 			rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);
1987 		}
1988 		if (!rx->key)
1989 			rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);
1990 	} else if (!ieee80211_has_protected(fc)) {
1991 		/*
1992 		 * The frame was not protected, so skip decryption. However, we
1993 		 * need to set rx->key if there is a key that could have been
1994 		 * used so that the frame may be dropped if encryption would
1995 		 * have been expected.
1996 		 */
1997 		struct ieee80211_key *key = NULL;
1998 		int i;
1999 
2000 		if (ieee80211_is_beacon(fc)) {
2001 			key = ieee80211_rx_get_bigtk(rx, -1);
2002 		} else if (ieee80211_is_mgmt(fc) &&
2003 			   is_multicast_ether_addr(hdr->addr1)) {
2004 			key = rcu_dereference(rx->link->default_mgmt_key);
2005 		} else {
2006 			if (rx->link_sta) {
2007 				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2008 					key = rcu_dereference(rx->link_sta->gtk[i]);
2009 					if (key)
2010 						break;
2011 				}
2012 			}
2013 			if (!key) {
2014 				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2015 					key = rcu_dereference(rx->link->gtk[i]);
2016 					if (key)
2017 						break;
2018 				}
2019 			}
2020 		}
2021 		if (key)
2022 			rx->key = key;
2023 		return RX_CONTINUE;
2024 	} else {
2025 		/*
2026 		 * The device doesn't give us the IV so we won't be
2027 		 * able to look up the key. That's ok though, we
2028 		 * don't need to decrypt the frame, we just won't
2029 		 * be able to keep statistics accurate.
2030 		 * Except for key threshold notifications, should
2031 		 * we somehow allow the driver to tell us which key
2032 		 * the hardware used if this flag is set?
2033 		 */
2034 		if ((status->flag & RX_FLAG_DECRYPTED) &&
2035 		    (status->flag & RX_FLAG_IV_STRIPPED))
2036 			return RX_CONTINUE;
2037 
2038 		keyidx = ieee80211_get_keyid(rx->skb);
2039 
2040 		if (unlikely(keyidx < 0))
2041 			return RX_DROP_UNUSABLE;
2042 
2043 		/* check per-station GTK first, if multicast packet */
2044 		if (is_multicast_ether_addr(hdr->addr1) && rx->link_sta)
2045 			rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);
2046 
2047 		/* if not found, try default key */
2048 		if (!rx->key) {
2049 			if (is_multicast_ether_addr(hdr->addr1))
2050 				rx->key = rcu_dereference(rx->link->gtk[keyidx]);
2051 			if (!rx->key)
2052 				rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2053 
2054 			/*
2055 			 * RSNA-protected unicast frames should always be
2056 			 * sent with pairwise or station-to-station keys,
2057 			 * but for WEP we allow using a key index as well.
2058 			 */
2059 			if (rx->key &&
2060 			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2061 			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2062 			    !is_multicast_ether_addr(hdr->addr1))
2063 				rx->key = NULL;
2064 		}
2065 	}
2066 
2067 	if (rx->key) {
2068 		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2069 			return RX_DROP_MONITOR;
2070 
2071 		/* TODO: add threshold stuff again */
2072 	} else {
2073 		return RX_DROP_MONITOR;
2074 	}
2075 
2076 	switch (rx->key->conf.cipher) {
2077 	case WLAN_CIPHER_SUITE_WEP40:
2078 	case WLAN_CIPHER_SUITE_WEP104:
2079 		result = ieee80211_crypto_wep_decrypt(rx);
2080 		break;
2081 	case WLAN_CIPHER_SUITE_TKIP:
2082 		result = ieee80211_crypto_tkip_decrypt(rx);
2083 		break;
2084 	case WLAN_CIPHER_SUITE_CCMP:
2085 		result = ieee80211_crypto_ccmp_decrypt(
2086 			rx, IEEE80211_CCMP_MIC_LEN);
2087 		break;
2088 	case WLAN_CIPHER_SUITE_CCMP_256:
2089 		result = ieee80211_crypto_ccmp_decrypt(
2090 			rx, IEEE80211_CCMP_256_MIC_LEN);
2091 		break;
2092 	case WLAN_CIPHER_SUITE_AES_CMAC:
2093 		result = ieee80211_crypto_aes_cmac_decrypt(rx);
2094 		break;
2095 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2096 		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
2097 		break;
2098 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2099 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2100 		result = ieee80211_crypto_aes_gmac_decrypt(rx);
2101 		break;
2102 	case WLAN_CIPHER_SUITE_GCMP:
2103 	case WLAN_CIPHER_SUITE_GCMP_256:
2104 		result = ieee80211_crypto_gcmp_decrypt(rx);
2105 		break;
2106 	default:
2107 		result = RX_DROP_UNUSABLE;
2108 	}
2109 
2110 	/* the hdr variable is invalid after the decrypt handlers */
2111 
2112 	/* either the frame has been decrypted or will be dropped */
2113 	status->flag |= RX_FLAG_DECRYPTED;
2114 
2115 	if (unlikely(ieee80211_is_beacon(fc) && RX_RES_IS_UNUSABLE(result) &&
2116 		     rx->sdata->dev))
2117 		cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2118 					     skb->data, skb->len);
2119 
2120 	return result;
2121 }
2122 
ieee80211_init_frag_cache(struct ieee80211_fragment_cache * cache)2123 void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2124 {
2125 	int i;
2126 
2127 	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2128 		skb_queue_head_init(&cache->entries[i].skb_list);
2129 }
2130 
ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache * cache)2131 void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2132 {
2133 	int i;
2134 
2135 	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2136 		__skb_queue_purge(&cache->entries[i].skb_list);
2137 }
2138 
2139 static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_fragment_cache * cache,unsigned int frag,unsigned int seq,int rx_queue,struct sk_buff ** skb)2140 ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
2141 			 unsigned int frag, unsigned int seq, int rx_queue,
2142 			 struct sk_buff **skb)
2143 {
2144 	struct ieee80211_fragment_entry *entry;
2145 
2146 	entry = &cache->entries[cache->next++];
2147 	if (cache->next >= IEEE80211_FRAGMENT_MAX)
2148 		cache->next = 0;
2149 
2150 	__skb_queue_purge(&entry->skb_list);
2151 
2152 	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
2153 	*skb = NULL;
2154 	entry->first_frag_time = jiffies;
2155 	entry->seq = seq;
2156 	entry->rx_queue = rx_queue;
2157 	entry->last_frag = frag;
2158 	entry->check_sequential_pn = false;
2159 	entry->extra_len = 0;
2160 
2161 	return entry;
2162 }
2163 
2164 static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_fragment_cache * cache,unsigned int frag,unsigned int seq,int rx_queue,struct ieee80211_hdr * hdr)2165 ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
2166 			  unsigned int frag, unsigned int seq,
2167 			  int rx_queue, struct ieee80211_hdr *hdr)
2168 {
2169 	struct ieee80211_fragment_entry *entry;
2170 	int i, idx;
2171 
2172 	idx = cache->next;
2173 	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2174 		struct ieee80211_hdr *f_hdr;
2175 		struct sk_buff *f_skb;
2176 
2177 		idx--;
2178 		if (idx < 0)
2179 			idx = IEEE80211_FRAGMENT_MAX - 1;
2180 
2181 		entry = &cache->entries[idx];
2182 		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2183 		    entry->rx_queue != rx_queue ||
2184 		    entry->last_frag + 1 != frag)
2185 			continue;
2186 
2187 		f_skb = __skb_peek(&entry->skb_list);
2188 		f_hdr = (struct ieee80211_hdr *) f_skb->data;
2189 
2190 		/*
2191 		 * Check ftype and addresses are equal, else check next fragment
2192 		 */
2193 		if (((hdr->frame_control ^ f_hdr->frame_control) &
2194 		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2195 		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
2196 		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
2197 			continue;
2198 
2199 		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2200 			__skb_queue_purge(&entry->skb_list);
2201 			continue;
2202 		}
2203 		return entry;
2204 	}
2205 
2206 	return NULL;
2207 }
2208 
requires_sequential_pn(struct ieee80211_rx_data * rx,__le16 fc)2209 static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2210 {
2211 	return rx->key &&
2212 		(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2213 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2214 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2215 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2216 		ieee80211_has_protected(fc);
2217 }
2218 
2219 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_defragment(struct ieee80211_rx_data * rx)2220 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2221 {
2222 	struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
2223 	struct ieee80211_hdr *hdr;
2224 	u16 sc;
2225 	__le16 fc;
2226 	unsigned int frag, seq;
2227 	struct ieee80211_fragment_entry *entry;
2228 	struct sk_buff *skb;
2229 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2230 
2231 	hdr = (struct ieee80211_hdr *)rx->skb->data;
2232 	fc = hdr->frame_control;
2233 
2234 	if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
2235 		return RX_CONTINUE;
2236 
2237 	sc = le16_to_cpu(hdr->seq_ctrl);
2238 	frag = sc & IEEE80211_SCTL_FRAG;
2239 
2240 	if (rx->sta)
2241 		cache = &rx->sta->frags;
2242 
2243 	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2244 		goto out;
2245 
2246 	if (is_multicast_ether_addr(hdr->addr1))
2247 		return RX_DROP_MONITOR;
2248 
2249 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2250 
2251 	if (skb_linearize(rx->skb))
2252 		return RX_DROP_UNUSABLE;
2253 
2254 	/*
2255 	 *  skb_linearize() might change the skb->data and
2256 	 *  previously cached variables (in this case, hdr) need to
2257 	 *  be refreshed with the new data.
2258 	 */
2259 	hdr = (struct ieee80211_hdr *)rx->skb->data;
2260 	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2261 
2262 	if (frag == 0) {
2263 		/* This is the first fragment of a new frame. */
2264 		entry = ieee80211_reassemble_add(cache, frag, seq,
2265 						 rx->seqno_idx, &(rx->skb));
2266 		if (requires_sequential_pn(rx, fc)) {
2267 			int queue = rx->security_idx;
2268 
2269 			/* Store CCMP/GCMP PN so that we can verify that the
2270 			 * next fragment has a sequential PN value.
2271 			 */
2272 			entry->check_sequential_pn = true;
2273 			entry->is_protected = true;
2274 			entry->key_color = rx->key->color;
2275 			memcpy(entry->last_pn,
2276 			       rx->key->u.ccmp.rx_pn[queue],
2277 			       IEEE80211_CCMP_PN_LEN);
2278 			BUILD_BUG_ON(offsetof(struct ieee80211_key,
2279 					      u.ccmp.rx_pn) !=
2280 				     offsetof(struct ieee80211_key,
2281 					      u.gcmp.rx_pn));
2282 			BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2283 				     sizeof(rx->key->u.gcmp.rx_pn[queue]));
2284 			BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2285 				     IEEE80211_GCMP_PN_LEN);
2286 		} else if (rx->key &&
2287 			   (ieee80211_has_protected(fc) ||
2288 			    (status->flag & RX_FLAG_DECRYPTED))) {
2289 			entry->is_protected = true;
2290 			entry->key_color = rx->key->color;
2291 		}
2292 		return RX_QUEUED;
2293 	}
2294 
2295 	/* This is a fragment for a frame that should already be pending in
2296 	 * fragment cache. Add this fragment to the end of the pending entry.
2297 	 */
2298 	entry = ieee80211_reassemble_find(cache, frag, seq,
2299 					  rx->seqno_idx, hdr);
2300 	if (!entry) {
2301 		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2302 		return RX_DROP_MONITOR;
2303 	}
2304 
2305 	/* "The receiver shall discard MSDUs and MMPDUs whose constituent
2306 	 *  MPDU PN values are not incrementing in steps of 1."
2307 	 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2308 	 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2309 	 */
2310 	if (entry->check_sequential_pn) {
2311 		int i;
2312 		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2313 
2314 		if (!requires_sequential_pn(rx, fc))
2315 			return RX_DROP_UNUSABLE;
2316 
2317 		/* Prevent mixed key and fragment cache attacks */
2318 		if (entry->key_color != rx->key->color)
2319 			return RX_DROP_UNUSABLE;
2320 
2321 		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2322 		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2323 			pn[i]++;
2324 			if (pn[i])
2325 				break;
2326 		}
2327 
2328 		rpn = rx->ccm_gcm.pn;
2329 		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
2330 			return RX_DROP_UNUSABLE;
2331 		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2332 	} else if (entry->is_protected &&
2333 		   (!rx->key ||
2334 		    (!ieee80211_has_protected(fc) &&
2335 		     !(status->flag & RX_FLAG_DECRYPTED)) ||
2336 		    rx->key->color != entry->key_color)) {
2337 		/* Drop this as a mixed key or fragment cache attack, even
2338 		 * if for TKIP Michael MIC should protect us, and WEP is a
2339 		 * lost cause anyway.
2340 		 */
2341 		return RX_DROP_UNUSABLE;
2342 	} else if (entry->is_protected && rx->key &&
2343 		   entry->key_color != rx->key->color &&
2344 		   (status->flag & RX_FLAG_DECRYPTED)) {
2345 		return RX_DROP_UNUSABLE;
2346 	}
2347 
2348 	skb_pull(rx->skb, ieee80211_hdrlen(fc));
2349 	__skb_queue_tail(&entry->skb_list, rx->skb);
2350 	entry->last_frag = frag;
2351 	entry->extra_len += rx->skb->len;
2352 	if (ieee80211_has_morefrags(fc)) {
2353 		rx->skb = NULL;
2354 		return RX_QUEUED;
2355 	}
2356 
2357 	rx->skb = __skb_dequeue(&entry->skb_list);
2358 	if (skb_tailroom(rx->skb) < entry->extra_len) {
2359 		I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2360 		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2361 					      GFP_ATOMIC))) {
2362 			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2363 			__skb_queue_purge(&entry->skb_list);
2364 			return RX_DROP_UNUSABLE;
2365 		}
2366 	}
2367 	while ((skb = __skb_dequeue(&entry->skb_list))) {
2368 		skb_put_data(rx->skb, skb->data, skb->len);
2369 		dev_kfree_skb(skb);
2370 	}
2371 
2372  out:
2373 	ieee80211_led_rx(rx->local);
2374 	if (rx->sta)
2375 		rx->link_sta->rx_stats.packets++;
2376 	return RX_CONTINUE;
2377 }
2378 
ieee80211_802_1x_port_control(struct ieee80211_rx_data * rx)2379 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2380 {
2381 	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2382 		return -EACCES;
2383 
2384 	return 0;
2385 }
2386 
ieee80211_drop_unencrypted(struct ieee80211_rx_data * rx,__le16 fc)2387 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2388 {
2389 	struct sk_buff *skb = rx->skb;
2390 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2391 
2392 	/*
2393 	 * Pass through unencrypted frames if the hardware has
2394 	 * decrypted them already.
2395 	 */
2396 	if (status->flag & RX_FLAG_DECRYPTED)
2397 		return 0;
2398 
2399 	/* Drop unencrypted frames if key is set. */
2400 	if (unlikely(!ieee80211_has_protected(fc) &&
2401 		     !ieee80211_is_any_nullfunc(fc) &&
2402 		     ieee80211_is_data(fc) && rx->key))
2403 		return -EACCES;
2404 
2405 	return 0;
2406 }
2407 
ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data * rx)2408 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2409 {
2410 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2411 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2412 	__le16 fc = mgmt->frame_control;
2413 
2414 	/*
2415 	 * Pass through unencrypted frames if the hardware has
2416 	 * decrypted them already.
2417 	 */
2418 	if (status->flag & RX_FLAG_DECRYPTED)
2419 		return 0;
2420 
2421 	/* drop unicast protected dual (that wasn't protected) */
2422 	if (ieee80211_is_action(fc) &&
2423 	    mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
2424 		return -EACCES;
2425 
2426 	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2427 		if (unlikely(!ieee80211_has_protected(fc) &&
2428 			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {
2429 			if (ieee80211_is_deauth(fc) ||
2430 			    ieee80211_is_disassoc(fc)) {
2431 				/*
2432 				 * Permit unprotected deauth/disassoc frames
2433 				 * during 4-way-HS (key is installed after HS).
2434 				 */
2435 				if (!rx->key)
2436 					return 0;
2437 
2438 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2439 							     rx->skb->data,
2440 							     rx->skb->len);
2441 			}
2442 			return -EACCES;
2443 		}
2444 		/* BIP does not use Protected field, so need to check MMIE */
2445 		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2446 			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2447 			if (ieee80211_is_deauth(fc) ||
2448 			    ieee80211_is_disassoc(fc))
2449 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2450 							     rx->skb->data,
2451 							     rx->skb->len);
2452 			return -EACCES;
2453 		}
2454 		if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2455 			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2456 			cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2457 						     rx->skb->data,
2458 						     rx->skb->len);
2459 			return -EACCES;
2460 		}
2461 		/*
2462 		 * When using MFP, Action frames are not allowed prior to
2463 		 * having configured keys.
2464 		 */
2465 		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2466 			     ieee80211_is_robust_mgmt_frame(rx->skb)))
2467 			return -EACCES;
2468 
2469 		/* drop unicast public action frames when using MPF */
2470 		if (is_unicast_ether_addr(mgmt->da) &&
2471 		    ieee80211_is_protected_dual_of_public_action(rx->skb))
2472 			return -EACCES;
2473 	}
2474 
2475 	return 0;
2476 }
2477 
2478 static int
__ieee80211_data_to_8023(struct ieee80211_rx_data * rx,bool * port_control)2479 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2480 {
2481 	struct ieee80211_sub_if_data *sdata = rx->sdata;
2482 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2483 	bool check_port_control = false;
2484 	struct ethhdr *ehdr;
2485 	int ret;
2486 
2487 	*port_control = false;
2488 	if (ieee80211_has_a4(hdr->frame_control) &&
2489 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2490 		return -1;
2491 
2492 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2493 	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2494 
2495 		if (!sdata->u.mgd.use_4addr)
2496 			return -1;
2497 		else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))
2498 			check_port_control = true;
2499 	}
2500 
2501 	if (is_multicast_ether_addr(hdr->addr1) &&
2502 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2503 		return -1;
2504 
2505 	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2506 	if (ret < 0)
2507 		return ret;
2508 
2509 	ehdr = (struct ethhdr *) rx->skb->data;
2510 	if (ehdr->h_proto == rx->sdata->control_port_protocol)
2511 		*port_control = true;
2512 	else if (check_port_control)
2513 		return -1;
2514 
2515 	return 0;
2516 }
2517 
ieee80211_is_our_addr(struct ieee80211_sub_if_data * sdata,const u8 * addr,int * out_link_id)2518 bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
2519 			   const u8 *addr, int *out_link_id)
2520 {
2521 	unsigned int link_id;
2522 
2523 	/* non-MLO, or MLD address replaced by hardware */
2524 	if (ether_addr_equal(sdata->vif.addr, addr))
2525 		return true;
2526 
2527 	if (!ieee80211_vif_is_mld(&sdata->vif))
2528 		return false;
2529 
2530 	for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
2531 		struct ieee80211_bss_conf *conf;
2532 
2533 		conf = rcu_dereference(sdata->vif.link_conf[link_id]);
2534 
2535 		if (!conf)
2536 			continue;
2537 		if (ether_addr_equal(conf->addr, addr)) {
2538 			if (out_link_id)
2539 				*out_link_id = link_id;
2540 			return true;
2541 		}
2542 	}
2543 
2544 	return false;
2545 }
2546 
2547 /*
2548  * requires that rx->skb is a frame with ethernet header
2549  */
ieee80211_frame_allowed(struct ieee80211_rx_data * rx,__le16 fc)2550 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2551 {
2552 	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2553 		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2554 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2555 
2556 	/*
2557 	 * Allow EAPOL frames to us/the PAE group address regardless of
2558 	 * whether the frame was encrypted or not, and always disallow
2559 	 * all other destination addresses for them.
2560 	 */
2561 	if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2562 		return ieee80211_is_our_addr(rx->sdata, ehdr->h_dest, NULL) ||
2563 		       ether_addr_equal(ehdr->h_dest, pae_group_addr);
2564 
2565 	if (ieee80211_802_1x_port_control(rx) ||
2566 	    ieee80211_drop_unencrypted(rx, fc))
2567 		return false;
2568 
2569 	return true;
2570 }
2571 
ieee80211_deliver_skb_to_local_stack(struct sk_buff * skb,struct ieee80211_rx_data * rx)2572 static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2573 						 struct ieee80211_rx_data *rx)
2574 {
2575 	struct ieee80211_sub_if_data *sdata = rx->sdata;
2576 	struct net_device *dev = sdata->dev;
2577 
2578 	if (unlikely((skb->protocol == sdata->control_port_protocol ||
2579 		     (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2580 		      !sdata->control_port_no_preauth)) &&
2581 		     sdata->control_port_over_nl80211)) {
2582 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2583 		bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2584 
2585 		cfg80211_rx_control_port(dev, skb, noencrypt, rx->link_id);
2586 		dev_kfree_skb(skb);
2587 	} else {
2588 		struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2589 
2590 		memset(skb->cb, 0, sizeof(skb->cb));
2591 
2592 		/*
2593 		 * 802.1X over 802.11 requires that the authenticator address
2594 		 * be used for EAPOL frames. However, 802.1X allows the use of
2595 		 * the PAE group address instead. If the interface is part of
2596 		 * a bridge and we pass the frame with the PAE group address,
2597 		 * then the bridge will forward it to the network (even if the
2598 		 * client was not associated yet), which isn't supposed to
2599 		 * happen.
2600 		 * To avoid that, rewrite the destination address to our own
2601 		 * address, so that the authenticator (e.g. hostapd) will see
2602 		 * the frame, but bridge won't forward it anywhere else. Note
2603 		 * that due to earlier filtering, the only other address can
2604 		 * be the PAE group address, unless the hardware allowed them
2605 		 * through in 802.3 offloaded mode.
2606 		 */
2607 		if (unlikely(skb->protocol == sdata->control_port_protocol &&
2608 			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2609 			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
2610 
2611 		/* deliver to local stack */
2612 		if (rx->list)
2613 			list_add_tail(&skb->list, rx->list);
2614 		else
2615 			netif_receive_skb(skb);
2616 	}
2617 }
2618 
2619 /*
2620  * requires that rx->skb is a frame with ethernet header
2621  */
2622 static void
ieee80211_deliver_skb(struct ieee80211_rx_data * rx)2623 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2624 {
2625 	struct ieee80211_sub_if_data *sdata = rx->sdata;
2626 	struct net_device *dev = sdata->dev;
2627 	struct sk_buff *skb, *xmit_skb;
2628 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2629 	struct sta_info *dsta;
2630 
2631 	skb = rx->skb;
2632 	xmit_skb = NULL;
2633 
2634 	dev_sw_netstats_rx_add(dev, skb->len);
2635 
2636 	if (rx->sta) {
2637 		/* The seqno index has the same property as needed
2638 		 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2639 		 * for non-QoS-data frames. Here we know it's a data
2640 		 * frame, so count MSDUs.
2641 		 */
2642 		u64_stats_update_begin(&rx->link_sta->rx_stats.syncp);
2643 		rx->link_sta->rx_stats.msdu[rx->seqno_idx]++;
2644 		u64_stats_update_end(&rx->link_sta->rx_stats.syncp);
2645 	}
2646 
2647 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2648 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2649 	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2650 	    ehdr->h_proto != rx->sdata->control_port_protocol &&
2651 	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2652 		if (is_multicast_ether_addr(ehdr->h_dest) &&
2653 		    ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2654 			/*
2655 			 * send multicast frames both to higher layers in
2656 			 * local net stack and back to the wireless medium
2657 			 */
2658 			xmit_skb = skb_copy(skb, GFP_ATOMIC);
2659 			if (!xmit_skb)
2660 				net_info_ratelimited("%s: failed to clone multicast frame\n",
2661 						    dev->name);
2662 		} else if (!is_multicast_ether_addr(ehdr->h_dest) &&
2663 			   !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {
2664 			dsta = sta_info_get(sdata, ehdr->h_dest);
2665 			if (dsta) {
2666 				/*
2667 				 * The destination station is associated to
2668 				 * this AP (in this VLAN), so send the frame
2669 				 * directly to it and do not pass it to local
2670 				 * net stack.
2671 				 */
2672 				xmit_skb = skb;
2673 				skb = NULL;
2674 			}
2675 		}
2676 	}
2677 
2678 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2679 	if (skb) {
2680 		/* 'align' will only take the values 0 or 2 here since all
2681 		 * frames are required to be aligned to 2-byte boundaries
2682 		 * when being passed to mac80211; the code here works just
2683 		 * as well if that isn't true, but mac80211 assumes it can
2684 		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2685 		 */
2686 		int align;
2687 
2688 		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2689 		if (align) {
2690 			if (WARN_ON(skb_headroom(skb) < 3)) {
2691 				dev_kfree_skb(skb);
2692 				skb = NULL;
2693 			} else {
2694 				u8 *data = skb->data;
2695 				size_t len = skb_headlen(skb);
2696 				skb->data -= align;
2697 				memmove(skb->data, data, len);
2698 				skb_set_tail_pointer(skb, len);
2699 			}
2700 		}
2701 	}
2702 #endif
2703 
2704 	if (skb) {
2705 		skb->protocol = eth_type_trans(skb, dev);
2706 		ieee80211_deliver_skb_to_local_stack(skb, rx);
2707 	}
2708 
2709 	if (xmit_skb) {
2710 		/*
2711 		 * Send to wireless media and increase priority by 256 to
2712 		 * keep the received priority instead of reclassifying
2713 		 * the frame (see cfg80211_classify8021d).
2714 		 */
2715 		xmit_skb->priority += 256;
2716 		xmit_skb->protocol = htons(ETH_P_802_3);
2717 		skb_reset_network_header(xmit_skb);
2718 		skb_reset_mac_header(xmit_skb);
2719 		dev_queue_xmit(xmit_skb);
2720 	}
2721 }
2722 
2723 #ifdef CONFIG_MAC80211_MESH
2724 static bool
ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int hdrlen)2725 ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
2726 			       struct sk_buff *skb, int hdrlen)
2727 {
2728 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2729 	struct ieee80211_mesh_fast_tx_key key = {
2730 		.type = MESH_FAST_TX_TYPE_FORWARDED
2731 	};
2732 	struct ieee80211_mesh_fast_tx *entry;
2733 	struct ieee80211s_hdr *mesh_hdr;
2734 	struct tid_ampdu_tx *tid_tx;
2735 	struct sta_info *sta;
2736 	struct ethhdr eth;
2737 	u8 tid;
2738 
2739 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
2740 	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2741 		ether_addr_copy(key.addr, mesh_hdr->eaddr1);
2742 	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
2743 		ether_addr_copy(key.addr, skb->data);
2744 	else
2745 		return false;
2746 
2747 	entry = mesh_fast_tx_get(sdata, &key);
2748 	if (!entry)
2749 		return false;
2750 
2751 	sta = rcu_dereference(entry->mpath->next_hop);
2752 	if (!sta)
2753 		return false;
2754 
2755 	if (skb_linearize(skb))
2756 		return false;
2757 
2758 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2759 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2760 	if (tid_tx) {
2761 		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2762 			return false;
2763 
2764 		if (tid_tx->timeout)
2765 			tid_tx->last_tx = jiffies;
2766 	}
2767 
2768 	ieee80211_aggr_check(sdata, sta, skb);
2769 
2770 	if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
2771 					    &skb->protocol))
2772 		hdrlen += ETH_ALEN;
2773 	else
2774 		skb->protocol = htons(skb->len - hdrlen);
2775 	skb_set_network_header(skb, hdrlen + 2);
2776 
2777 	skb->dev = sdata->dev;
2778 	memcpy(&eth, skb->data, ETH_HLEN - 2);
2779 	skb_pull(skb, 2);
2780 	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
2781 			      eth.h_dest, eth.h_source);
2782 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2783 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2784 
2785 	return true;
2786 }
2787 #endif
2788 
2789 static ieee80211_rx_result
ieee80211_rx_mesh_data(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct sk_buff * skb)2790 ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
2791 		       struct sk_buff *skb)
2792 {
2793 #ifdef CONFIG_MAC80211_MESH
2794 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2795 	struct ieee80211_local *local = sdata->local;
2796 	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
2797 	struct ieee80211_hdr hdr = {
2798 		.frame_control = cpu_to_le16(fc)
2799 	};
2800 	struct ieee80211_hdr *fwd_hdr;
2801 	struct ieee80211s_hdr *mesh_hdr;
2802 	struct ieee80211_tx_info *info;
2803 	struct sk_buff *fwd_skb;
2804 	struct ethhdr *eth;
2805 	bool multicast;
2806 	int tailroom = 0;
2807 	int hdrlen, mesh_hdrlen;
2808 	u8 *qos;
2809 
2810 	if (!ieee80211_vif_is_mesh(&sdata->vif))
2811 		return RX_CONTINUE;
2812 
2813 	if (!pskb_may_pull(skb, sizeof(*eth) + 6))
2814 		return RX_DROP_MONITOR;
2815 
2816 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
2817 	mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
2818 
2819 	if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
2820 		return RX_DROP_MONITOR;
2821 
2822 	eth = (struct ethhdr *)skb->data;
2823 	multicast = is_multicast_ether_addr(eth->h_dest);
2824 
2825 	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
2826 	if (!mesh_hdr->ttl)
2827 		return RX_DROP_MONITOR;
2828 
2829 	/* frame is in RMC, don't forward */
2830 	if (is_multicast_ether_addr(eth->h_dest) &&
2831 	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
2832 		return RX_DROP_MONITOR;
2833 
2834 	/* forward packet */
2835 	if (sdata->crypto_tx_tailroom_needed_cnt)
2836 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
2837 
2838 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2839 		struct mesh_path *mppath;
2840 		char *proxied_addr;
2841 		bool update = false;
2842 
2843 		if (multicast)
2844 			proxied_addr = mesh_hdr->eaddr1;
2845 		else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2846 			/* has_a4 already checked in ieee80211_rx_mesh_check */
2847 			proxied_addr = mesh_hdr->eaddr2;
2848 		else
2849 			return RX_DROP_MONITOR;
2850 
2851 		rcu_read_lock();
2852 		mppath = mpp_path_lookup(sdata, proxied_addr);
2853 		if (!mppath) {
2854 			mpp_path_add(sdata, proxied_addr, eth->h_source);
2855 		} else {
2856 			spin_lock_bh(&mppath->state_lock);
2857 			if (!ether_addr_equal(mppath->mpp, eth->h_source)) {
2858 				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
2859 				update = true;
2860 			}
2861 			mppath->exp_time = jiffies;
2862 			spin_unlock_bh(&mppath->state_lock);
2863 		}
2864 
2865 		/* flush fast xmit cache if the address path changed */
2866 		if (update)
2867 			mesh_fast_tx_flush_addr(sdata, proxied_addr);
2868 
2869 		rcu_read_unlock();
2870 	}
2871 
2872 	/* Frame has reached destination.  Don't forward */
2873 	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
2874 		goto rx_accept;
2875 
2876 	if (!--mesh_hdr->ttl) {
2877 		if (multicast)
2878 			goto rx_accept;
2879 
2880 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2881 		return RX_DROP_MONITOR;
2882 	}
2883 
2884 	if (!ifmsh->mshcfg.dot11MeshForwarding) {
2885 		if (is_multicast_ether_addr(eth->h_dest))
2886 			goto rx_accept;
2887 
2888 		return RX_DROP_MONITOR;
2889 	}
2890 
2891 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
2892 
2893 	if (!multicast &&
2894 	    ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
2895 		return RX_QUEUED;
2896 
2897 	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
2898 				      eth->h_dest, eth->h_source);
2899 	hdrlen = ieee80211_hdrlen(hdr.frame_control);
2900 	if (multicast) {
2901 		int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
2902 
2903 		fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
2904 					       IEEE80211_ENCRYPT_HEADROOM,
2905 					  tailroom, GFP_ATOMIC);
2906 		if (!fwd_skb)
2907 			goto rx_accept;
2908 	} else {
2909 		fwd_skb = skb;
2910 		skb = NULL;
2911 
2912 		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
2913 			return RX_DROP_UNUSABLE;
2914 
2915 		if (skb_linearize(fwd_skb))
2916 			return RX_DROP_UNUSABLE;
2917 	}
2918 
2919 	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
2920 	memcpy(fwd_hdr, &hdr, hdrlen - 2);
2921 	qos = ieee80211_get_qos_ctl(fwd_hdr);
2922 	qos[0] = qos[1] = 0;
2923 
2924 	skb_reset_mac_header(fwd_skb);
2925 	hdrlen += mesh_hdrlen;
2926 	if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
2927 					    &fwd_skb->protocol))
2928 		hdrlen += ETH_ALEN;
2929 	else
2930 		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
2931 	skb_set_network_header(fwd_skb, hdrlen + 2);
2932 
2933 	info = IEEE80211_SKB_CB(fwd_skb);
2934 	memset(info, 0, sizeof(*info));
2935 	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
2936 	info->control.vif = &sdata->vif;
2937 	info->control.jiffies = jiffies;
2938 	fwd_skb->dev = sdata->dev;
2939 	if (multicast) {
2940 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2941 		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2942 		/* update power mode indication when forwarding */
2943 		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2944 	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2945 		/* mesh power mode flags updated in mesh_nexthop_lookup */
2946 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2947 	} else {
2948 		/* unable to resolve next hop */
2949 		if (sta)
2950 			mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2951 					   hdr.addr3, 0,
2952 					   WLAN_REASON_MESH_PATH_NOFORWARD,
2953 					   sta->sta.addr);
2954 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2955 		kfree_skb(fwd_skb);
2956 		goto rx_accept;
2957 	}
2958 
2959 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2960 	ieee80211_add_pending_skb(local, fwd_skb);
2961 
2962 rx_accept:
2963 	if (!skb)
2964 		return RX_QUEUED;
2965 
2966 	ieee80211_strip_8023_mesh_hdr(skb);
2967 #endif
2968 
2969 	return RX_CONTINUE;
2970 }
2971 
2972 static ieee80211_rx_result debug_noinline
__ieee80211_rx_h_amsdu(struct ieee80211_rx_data * rx,u8 data_offset)2973 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
2974 {
2975 	struct net_device *dev = rx->sdata->dev;
2976 	struct sk_buff *skb = rx->skb;
2977 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2978 	__le16 fc = hdr->frame_control;
2979 	struct sk_buff_head frame_list;
2980 	ieee80211_rx_result res;
2981 	struct ethhdr ethhdr;
2982 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
2983 
2984 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2985 		check_da = NULL;
2986 		check_sa = NULL;
2987 	} else switch (rx->sdata->vif.type) {
2988 		case NL80211_IFTYPE_AP:
2989 		case NL80211_IFTYPE_AP_VLAN:
2990 			check_da = NULL;
2991 			break;
2992 		case NL80211_IFTYPE_STATION:
2993 			if (!rx->sta ||
2994 			    !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
2995 				check_sa = NULL;
2996 			break;
2997 		case NL80211_IFTYPE_MESH_POINT:
2998 			check_sa = NULL;
2999 			check_da = NULL;
3000 			break;
3001 		default:
3002 			break;
3003 	}
3004 
3005 	skb->dev = dev;
3006 	__skb_queue_head_init(&frame_list);
3007 
3008 	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
3009 					  rx->sdata->vif.addr,
3010 					  rx->sdata->vif.type,
3011 					  data_offset, true))
3012 		return RX_DROP_UNUSABLE;
3013 
3014 	if (rx->sta->amsdu_mesh_control < 0) {
3015 		s8 valid = -1;
3016 		int i;
3017 
3018 		for (i = 0; i <= 2; i++) {
3019 			if (!ieee80211_is_valid_amsdu(skb, i))
3020 				continue;
3021 
3022 			if (valid >= 0) {
3023 				/* ambiguous */
3024 				valid = -1;
3025 				break;
3026 			}
3027 
3028 			valid = i;
3029 		}
3030 
3031 		rx->sta->amsdu_mesh_control = valid;
3032 	}
3033 
3034 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
3035 				 rx->sdata->vif.type,
3036 				 rx->local->hw.extra_tx_headroom,
3037 				 check_da, check_sa,
3038 				 rx->sta->amsdu_mesh_control);
3039 
3040 	while (!skb_queue_empty(&frame_list)) {
3041 		rx->skb = __skb_dequeue(&frame_list);
3042 
3043 		res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
3044 		switch (res) {
3045 		case RX_QUEUED:
3046 			continue;
3047 		case RX_CONTINUE:
3048 			break;
3049 		default:
3050 			goto free;
3051 		}
3052 
3053 		if (!ieee80211_frame_allowed(rx, fc))
3054 			goto free;
3055 
3056 		ieee80211_deliver_skb(rx);
3057 		continue;
3058 
3059 free:
3060 		dev_kfree_skb(rx->skb);
3061 	}
3062 
3063 	return RX_QUEUED;
3064 }
3065 
3066 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_amsdu(struct ieee80211_rx_data * rx)3067 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
3068 {
3069 	struct sk_buff *skb = rx->skb;
3070 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3071 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3072 	__le16 fc = hdr->frame_control;
3073 
3074 	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
3075 		return RX_CONTINUE;
3076 
3077 	if (unlikely(!ieee80211_is_data(fc)))
3078 		return RX_CONTINUE;
3079 
3080 	if (unlikely(!ieee80211_is_data_present(fc)))
3081 		return RX_DROP_MONITOR;
3082 
3083 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3084 		switch (rx->sdata->vif.type) {
3085 		case NL80211_IFTYPE_AP_VLAN:
3086 			if (!rx->sdata->u.vlan.sta)
3087 				return RX_DROP_UNUSABLE;
3088 			break;
3089 		case NL80211_IFTYPE_STATION:
3090 			if (!rx->sdata->u.mgd.use_4addr)
3091 				return RX_DROP_UNUSABLE;
3092 			break;
3093 		case NL80211_IFTYPE_MESH_POINT:
3094 			break;
3095 		default:
3096 			return RX_DROP_UNUSABLE;
3097 		}
3098 	}
3099 
3100 	if (is_multicast_ether_addr(hdr->addr1) || !rx->sta)
3101 		return RX_DROP_UNUSABLE;
3102 
3103 	if (rx->key) {
3104 		/*
3105 		 * We should not receive A-MSDUs on pre-HT connections,
3106 		 * and HT connections cannot use old ciphers. Thus drop
3107 		 * them, as in those cases we couldn't even have SPP
3108 		 * A-MSDUs or such.
3109 		 */
3110 		switch (rx->key->conf.cipher) {
3111 		case WLAN_CIPHER_SUITE_WEP40:
3112 		case WLAN_CIPHER_SUITE_WEP104:
3113 		case WLAN_CIPHER_SUITE_TKIP:
3114 			return RX_DROP_UNUSABLE;
3115 		default:
3116 			break;
3117 		}
3118 	}
3119 
3120 	return __ieee80211_rx_h_amsdu(rx, 0);
3121 }
3122 
3123 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_data(struct ieee80211_rx_data * rx)3124 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
3125 {
3126 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3127 	struct ieee80211_local *local = rx->local;
3128 	struct net_device *dev = sdata->dev;
3129 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3130 	__le16 fc = hdr->frame_control;
3131 	ieee80211_rx_result res;
3132 	bool port_control;
3133 	int err;
3134 
3135 	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
3136 		return RX_CONTINUE;
3137 
3138 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3139 		return RX_DROP_MONITOR;
3140 
3141 	/*
3142 	 * Send unexpected-4addr-frame event to hostapd. For older versions,
3143 	 * also drop the frame to cooked monitor interfaces.
3144 	 */
3145 	if (ieee80211_has_a4(hdr->frame_control) &&
3146 	    sdata->vif.type == NL80211_IFTYPE_AP) {
3147 		if (rx->sta &&
3148 		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
3149 			cfg80211_rx_unexpected_4addr_frame(
3150 				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
3151 		return RX_DROP_MONITOR;
3152 	}
3153 
3154 	err = __ieee80211_data_to_8023(rx, &port_control);
3155 	if (unlikely(err))
3156 		return RX_DROP_UNUSABLE;
3157 
3158 	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
3159 	if (res != RX_CONTINUE)
3160 		return res;
3161 
3162 	if (!ieee80211_frame_allowed(rx, fc))
3163 		return RX_DROP_MONITOR;
3164 
3165 	/* directly handle TDLS channel switch requests/responses */
3166 	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3167 						cpu_to_be16(ETH_P_TDLS))) {
3168 		struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3169 
3170 		if (pskb_may_pull(rx->skb,
3171 				  offsetof(struct ieee80211_tdls_data, u)) &&
3172 		    tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3173 		    tf->category == WLAN_CATEGORY_TDLS &&
3174 		    (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3175 		     tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
3176 			rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3177 			__ieee80211_queue_skb_to_iface(sdata, rx->link_id,
3178 						       rx->sta, rx->skb);
3179 			return RX_QUEUED;
3180 		}
3181 	}
3182 
3183 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3184 	    unlikely(port_control) && sdata->bss) {
3185 		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3186 				     u.ap);
3187 		dev = sdata->dev;
3188 		rx->sdata = sdata;
3189 	}
3190 
3191 	rx->skb->dev = dev;
3192 
3193 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3194 	    local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3195 	    !is_multicast_ether_addr(
3196 		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
3197 	    (!local->scanning &&
3198 	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3199 		mod_timer(&local->dynamic_ps_timer, jiffies +
3200 			  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
3201 
3202 	ieee80211_deliver_skb(rx);
3203 
3204 	return RX_QUEUED;
3205 }
3206 
3207 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_ctrl(struct ieee80211_rx_data * rx,struct sk_buff_head * frames)3208 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3209 {
3210 	struct sk_buff *skb = rx->skb;
3211 	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3212 	struct tid_ampdu_rx *tid_agg_rx;
3213 	u16 start_seq_num;
3214 	u16 tid;
3215 
3216 	if (likely(!ieee80211_is_ctl(bar->frame_control)))
3217 		return RX_CONTINUE;
3218 
3219 	if (ieee80211_is_back_req(bar->frame_control)) {
3220 		struct {
3221 			__le16 control, start_seq_num;
3222 		} __packed bar_data;
3223 		struct ieee80211_event event = {
3224 			.type = BAR_RX_EVENT,
3225 		};
3226 
3227 		if (!rx->sta)
3228 			return RX_DROP_MONITOR;
3229 
3230 		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3231 				  &bar_data, sizeof(bar_data)))
3232 			return RX_DROP_MONITOR;
3233 
3234 		tid = le16_to_cpu(bar_data.control) >> 12;
3235 
3236 		if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3237 		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
3238 			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
3239 					     WLAN_BACK_RECIPIENT,
3240 					     WLAN_REASON_QSTA_REQUIRE_SETUP);
3241 
3242 		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3243 		if (!tid_agg_rx)
3244 			return RX_DROP_MONITOR;
3245 
3246 		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3247 		event.u.ba.tid = tid;
3248 		event.u.ba.ssn = start_seq_num;
3249 		event.u.ba.sta = &rx->sta->sta;
3250 
3251 		/* reset session timer */
3252 		if (tid_agg_rx->timeout)
3253 			mod_timer(&tid_agg_rx->session_timer,
3254 				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
3255 
3256 		spin_lock(&tid_agg_rx->reorder_lock);
3257 		/* release stored frames up to start of BAR */
3258 		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
3259 						 start_seq_num, frames);
3260 		spin_unlock(&tid_agg_rx->reorder_lock);
3261 
3262 		drv_event_callback(rx->local, rx->sdata, &event);
3263 
3264 		kfree_skb(skb);
3265 		return RX_QUEUED;
3266 	}
3267 
3268 	/*
3269 	 * After this point, we only want management frames,
3270 	 * so we can drop all remaining control frames to
3271 	 * cooked monitor interfaces.
3272 	 */
3273 	return RX_DROP_MONITOR;
3274 }
3275 
ieee80211_process_sa_query_req(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)3276 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3277 					   struct ieee80211_mgmt *mgmt,
3278 					   size_t len)
3279 {
3280 	struct ieee80211_local *local = sdata->local;
3281 	struct sk_buff *skb;
3282 	struct ieee80211_mgmt *resp;
3283 
3284 	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
3285 		/* Not to own unicast address */
3286 		return;
3287 	}
3288 
3289 	if (!ether_addr_equal(mgmt->sa, sdata->deflink.u.mgd.bssid) ||
3290 	    !ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid)) {
3291 		/* Not from the current AP or not associated yet. */
3292 		return;
3293 	}
3294 
3295 	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
3296 		/* Too short SA Query request frame */
3297 		return;
3298 	}
3299 
3300 	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
3301 	if (skb == NULL)
3302 		return;
3303 
3304 	skb_reserve(skb, local->hw.extra_tx_headroom);
3305 	resp = skb_put_zero(skb, 24);
3306 	memcpy(resp->da, mgmt->sa, ETH_ALEN);
3307 	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3308 	memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
3309 	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3310 					  IEEE80211_STYPE_ACTION);
3311 	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
3312 	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3313 	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
3314 	memcpy(resp->u.action.u.sa_query.trans_id,
3315 	       mgmt->u.action.u.sa_query.trans_id,
3316 	       WLAN_SA_QUERY_TR_ID_LEN);
3317 
3318 	ieee80211_tx_skb(sdata, skb);
3319 }
3320 
3321 static void
ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data * rx)3322 ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3323 {
3324 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3325 	const struct element *ie;
3326 	size_t baselen;
3327 
3328 	if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
3329 				     NL80211_EXT_FEATURE_BSS_COLOR))
3330 		return;
3331 
3332 	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3333 		return;
3334 
3335 	if (rx->sdata->vif.bss_conf.csa_active)
3336 		return;
3337 
3338 	baselen = mgmt->u.beacon.variable - rx->skb->data;
3339 	if (baselen > rx->skb->len)
3340 		return;
3341 
3342 	ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
3343 				    mgmt->u.beacon.variable,
3344 				    rx->skb->len - baselen);
3345 	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3346 	    ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
3347 		struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
3348 		const struct ieee80211_he_operation *he_oper;
3349 		u8 color;
3350 
3351 		he_oper = (void *)(ie->data + 1);
3352 		if (le32_get_bits(he_oper->he_oper_params,
3353 				  IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3354 			return;
3355 
3356 		color = le32_get_bits(he_oper->he_oper_params,
3357 				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3358 		if (color == bss_conf->he_bss_color.color)
3359 			ieee80211_obss_color_collision_notify(&rx->sdata->vif,
3360 							      BIT_ULL(color),
3361 							      GFP_ATOMIC);
3362 	}
3363 }
3364 
3365 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data * rx)3366 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3367 {
3368 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3369 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3370 
3371 	if (ieee80211_is_s1g_beacon(mgmt->frame_control))
3372 		return RX_CONTINUE;
3373 
3374 	/*
3375 	 * From here on, look only at management frames.
3376 	 * Data and control frames are already handled,
3377 	 * and unknown (reserved) frames are useless.
3378 	 */
3379 	if (rx->skb->len < 24)
3380 		return RX_DROP_MONITOR;
3381 
3382 	if (!ieee80211_is_mgmt(mgmt->frame_control))
3383 		return RX_DROP_MONITOR;
3384 
3385 	/* drop too small action frames */
3386 	if (ieee80211_is_action(mgmt->frame_control) &&
3387 	    rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
3388 		return RX_DROP_UNUSABLE;
3389 
3390 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3391 	    ieee80211_is_beacon(mgmt->frame_control) &&
3392 	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3393 		int sig = 0;
3394 
3395 		/* sw bss color collision detection */
3396 		ieee80211_rx_check_bss_color_collision(rx);
3397 
3398 		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3399 		    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3400 			sig = status->signal;
3401 
3402 		cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,
3403 						rx->skb->data, rx->skb->len,
3404 						ieee80211_rx_status_to_khz(status),
3405 						sig);
3406 		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3407 	}
3408 
3409 	if (ieee80211_drop_unencrypted_mgmt(rx))
3410 		return RX_DROP_UNUSABLE;
3411 
3412 	return RX_CONTINUE;
3413 }
3414 
3415 static bool
ieee80211_process_rx_twt_action(struct ieee80211_rx_data * rx)3416 ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3417 {
3418 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
3419 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3420 
3421 	/* TWT actions are only supported in AP for the moment */
3422 	if (sdata->vif.type != NL80211_IFTYPE_AP)
3423 		return false;
3424 
3425 	if (!rx->local->ops->add_twt_setup)
3426 		return false;
3427 
3428 	if (!sdata->vif.bss_conf.twt_responder)
3429 		return false;
3430 
3431 	if (!rx->sta)
3432 		return false;
3433 
3434 	switch (mgmt->u.action.u.s1g.action_code) {
3435 	case WLAN_S1G_TWT_SETUP: {
3436 		struct ieee80211_twt_setup *twt;
3437 
3438 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3439 				   1 + /* action code */
3440 				   sizeof(struct ieee80211_twt_setup) +
3441 				   2 /* TWT req_type agrt */)
3442 			break;
3443 
3444 		twt = (void *)mgmt->u.action.u.s1g.variable;
3445 		if (twt->element_id != WLAN_EID_S1G_TWT)
3446 			break;
3447 
3448 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3449 				   4 + /* action code + token + tlv */
3450 				   twt->length)
3451 			break;
3452 
3453 		return true; /* queue the frame */
3454 	}
3455 	case WLAN_S1G_TWT_TEARDOWN:
3456 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
3457 			break;
3458 
3459 		return true; /* queue the frame */
3460 	default:
3461 		break;
3462 	}
3463 
3464 	return false;
3465 }
3466 
3467 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data * rx)3468 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3469 {
3470 	struct ieee80211_local *local = rx->local;
3471 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3472 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3473 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3474 	int len = rx->skb->len;
3475 
3476 	if (!ieee80211_is_action(mgmt->frame_control))
3477 		return RX_CONTINUE;
3478 
3479 	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3480 	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3481 	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3482 		return RX_DROP_UNUSABLE;
3483 
3484 	switch (mgmt->u.action.category) {
3485 	case WLAN_CATEGORY_HT:
3486 		/* reject HT action frames from stations not supporting HT */
3487 		if (!rx->link_sta->pub->ht_cap.ht_supported)
3488 			goto invalid;
3489 
3490 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3491 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3492 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3493 		    sdata->vif.type != NL80211_IFTYPE_AP &&
3494 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3495 			break;
3496 
3497 		/* verify action & smps_control/chanwidth are present */
3498 		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3499 			goto invalid;
3500 
3501 		switch (mgmt->u.action.u.ht_smps.action) {
3502 		case WLAN_HT_ACTION_SMPS: {
3503 			struct ieee80211_supported_band *sband;
3504 			enum ieee80211_smps_mode smps_mode;
3505 			struct sta_opmode_info sta_opmode = {};
3506 
3507 			if (sdata->vif.type != NL80211_IFTYPE_AP &&
3508 			    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3509 				goto handled;
3510 
3511 			/* convert to HT capability */
3512 			switch (mgmt->u.action.u.ht_smps.smps_control) {
3513 			case WLAN_HT_SMPS_CONTROL_DISABLED:
3514 				smps_mode = IEEE80211_SMPS_OFF;
3515 				break;
3516 			case WLAN_HT_SMPS_CONTROL_STATIC:
3517 				smps_mode = IEEE80211_SMPS_STATIC;
3518 				break;
3519 			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3520 				smps_mode = IEEE80211_SMPS_DYNAMIC;
3521 				break;
3522 			default:
3523 				goto invalid;
3524 			}
3525 
3526 			/* if no change do nothing */
3527 			if (rx->link_sta->pub->smps_mode == smps_mode)
3528 				goto handled;
3529 			rx->link_sta->pub->smps_mode = smps_mode;
3530 			sta_opmode.smps_mode =
3531 				ieee80211_smps_mode_to_smps_mode(smps_mode);
3532 			sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3533 
3534 			sband = rx->local->hw.wiphy->bands[status->band];
3535 
3536 			rate_control_rate_update(local, sband, rx->sta, 0,
3537 						 IEEE80211_RC_SMPS_CHANGED);
3538 			cfg80211_sta_opmode_change_notify(sdata->dev,
3539 							  rx->sta->addr,
3540 							  &sta_opmode,
3541 							  GFP_ATOMIC);
3542 			goto handled;
3543 		}
3544 		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3545 			struct ieee80211_supported_band *sband;
3546 			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
3547 			enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
3548 			struct sta_opmode_info sta_opmode = {};
3549 
3550 			/* If it doesn't support 40 MHz it can't change ... */
3551 			if (!(rx->link_sta->pub->ht_cap.cap &
3552 					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3553 				goto handled;
3554 
3555 			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
3556 				max_bw = IEEE80211_STA_RX_BW_20;
3557 			else
3558 				max_bw = ieee80211_sta_cap_rx_bw(rx->link_sta);
3559 
3560 			/* set cur_max_bandwidth and recalc sta bw */
3561 			rx->link_sta->cur_max_bandwidth = max_bw;
3562 			new_bw = ieee80211_sta_cur_vht_bw(rx->link_sta);
3563 
3564 			if (rx->link_sta->pub->bandwidth == new_bw)
3565 				goto handled;
3566 
3567 			rx->link_sta->pub->bandwidth = new_bw;
3568 			sband = rx->local->hw.wiphy->bands[status->band];
3569 			sta_opmode.bw =
3570 				ieee80211_sta_rx_bw_to_chan_width(rx->link_sta);
3571 			sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
3572 
3573 			rate_control_rate_update(local, sband, rx->sta, 0,
3574 						 IEEE80211_RC_BW_CHANGED);
3575 			cfg80211_sta_opmode_change_notify(sdata->dev,
3576 							  rx->sta->addr,
3577 							  &sta_opmode,
3578 							  GFP_ATOMIC);
3579 			goto handled;
3580 		}
3581 		default:
3582 			goto invalid;
3583 		}
3584 
3585 		break;
3586 	case WLAN_CATEGORY_PUBLIC:
3587 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3588 			goto invalid;
3589 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
3590 			break;
3591 		if (!rx->sta)
3592 			break;
3593 		if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))
3594 			break;
3595 		if (mgmt->u.action.u.ext_chan_switch.action_code !=
3596 				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3597 			break;
3598 		if (len < offsetof(struct ieee80211_mgmt,
3599 				   u.action.u.ext_chan_switch.variable))
3600 			goto invalid;
3601 		goto queue;
3602 	case WLAN_CATEGORY_VHT:
3603 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3604 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3605 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3606 		    sdata->vif.type != NL80211_IFTYPE_AP &&
3607 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3608 			break;
3609 
3610 		/* verify action code is present */
3611 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3612 			goto invalid;
3613 
3614 		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
3615 		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3616 			/* verify opmode is present */
3617 			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3618 				goto invalid;
3619 			goto queue;
3620 		}
3621 		case WLAN_VHT_ACTION_GROUPID_MGMT: {
3622 			if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3623 				goto invalid;
3624 			goto queue;
3625 		}
3626 		default:
3627 			break;
3628 		}
3629 		break;
3630 	case WLAN_CATEGORY_BACK:
3631 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3632 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3633 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3634 		    sdata->vif.type != NL80211_IFTYPE_AP &&
3635 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3636 			break;
3637 
3638 		/* verify action_code is present */
3639 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3640 			break;
3641 
3642 		switch (mgmt->u.action.u.addba_req.action_code) {
3643 		case WLAN_ACTION_ADDBA_REQ:
3644 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3645 				   sizeof(mgmt->u.action.u.addba_req)))
3646 				goto invalid;
3647 			break;
3648 		case WLAN_ACTION_ADDBA_RESP:
3649 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3650 				   sizeof(mgmt->u.action.u.addba_resp)))
3651 				goto invalid;
3652 			break;
3653 		case WLAN_ACTION_DELBA:
3654 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3655 				   sizeof(mgmt->u.action.u.delba)))
3656 				goto invalid;
3657 			break;
3658 		default:
3659 			goto invalid;
3660 		}
3661 
3662 		goto queue;
3663 	case WLAN_CATEGORY_SPECTRUM_MGMT:
3664 		/* verify action_code is present */
3665 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3666 			break;
3667 
3668 		switch (mgmt->u.action.u.measurement.action_code) {
3669 		case WLAN_ACTION_SPCT_MSR_REQ:
3670 			if (status->band != NL80211_BAND_5GHZ)
3671 				break;
3672 
3673 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3674 				   sizeof(mgmt->u.action.u.measurement)))
3675 				break;
3676 
3677 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3678 				break;
3679 
3680 			ieee80211_process_measurement_req(sdata, mgmt, len);
3681 			goto handled;
3682 		case WLAN_ACTION_SPCT_CHL_SWITCH: {
3683 			u8 *bssid;
3684 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3685 				   sizeof(mgmt->u.action.u.chan_switch)))
3686 				break;
3687 
3688 			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3689 			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3690 			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3691 				break;
3692 
3693 			if (sdata->vif.type == NL80211_IFTYPE_STATION)
3694 				bssid = sdata->deflink.u.mgd.bssid;
3695 			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3696 				bssid = sdata->u.ibss.bssid;
3697 			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3698 				bssid = mgmt->sa;
3699 			else
3700 				break;
3701 
3702 			if (!ether_addr_equal(mgmt->bssid, bssid))
3703 				break;
3704 
3705 			goto queue;
3706 			}
3707 		}
3708 		break;
3709 	case WLAN_CATEGORY_SELF_PROTECTED:
3710 		if (len < (IEEE80211_MIN_ACTION_SIZE +
3711 			   sizeof(mgmt->u.action.u.self_prot.action_code)))
3712 			break;
3713 
3714 		switch (mgmt->u.action.u.self_prot.action_code) {
3715 		case WLAN_SP_MESH_PEERING_OPEN:
3716 		case WLAN_SP_MESH_PEERING_CLOSE:
3717 		case WLAN_SP_MESH_PEERING_CONFIRM:
3718 			if (!ieee80211_vif_is_mesh(&sdata->vif))
3719 				goto invalid;
3720 			if (sdata->u.mesh.user_mpm)
3721 				/* userspace handles this frame */
3722 				break;
3723 			goto queue;
3724 		case WLAN_SP_MGK_INFORM:
3725 		case WLAN_SP_MGK_ACK:
3726 			if (!ieee80211_vif_is_mesh(&sdata->vif))
3727 				goto invalid;
3728 			break;
3729 		}
3730 		break;
3731 	case WLAN_CATEGORY_MESH_ACTION:
3732 		if (len < (IEEE80211_MIN_ACTION_SIZE +
3733 			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
3734 			break;
3735 
3736 		if (!ieee80211_vif_is_mesh(&sdata->vif))
3737 			break;
3738 		if (mesh_action_is_path_sel(mgmt) &&
3739 		    !mesh_path_sel_is_hwmp(sdata))
3740 			break;
3741 		goto queue;
3742 	case WLAN_CATEGORY_S1G:
3743 		if (len < offsetofend(typeof(*mgmt),
3744 				      u.action.u.s1g.action_code))
3745 			break;
3746 
3747 		switch (mgmt->u.action.u.s1g.action_code) {
3748 		case WLAN_S1G_TWT_SETUP:
3749 		case WLAN_S1G_TWT_TEARDOWN:
3750 			if (ieee80211_process_rx_twt_action(rx))
3751 				goto queue;
3752 			break;
3753 		default:
3754 			break;
3755 		}
3756 		break;
3757 	}
3758 
3759 	return RX_CONTINUE;
3760 
3761  invalid:
3762 	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3763 	/* will return in the next handlers */
3764 	return RX_CONTINUE;
3765 
3766  handled:
3767 	if (rx->sta)
3768 		rx->link_sta->rx_stats.packets++;
3769 	dev_kfree_skb(rx->skb);
3770 	return RX_QUEUED;
3771 
3772  queue:
3773 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
3774 	return RX_QUEUED;
3775 }
3776 
3777 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data * rx)3778 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3779 {
3780 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3781 	struct cfg80211_rx_info info = {
3782 		.freq = ieee80211_rx_status_to_khz(status),
3783 		.buf = rx->skb->data,
3784 		.len = rx->skb->len,
3785 		.link_id = rx->link_id,
3786 		.have_link_id = rx->link_id >= 0,
3787 	};
3788 
3789 	/* skip known-bad action frames and return them in the next handler */
3790 	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3791 		return RX_CONTINUE;
3792 
3793 	/*
3794 	 * Getting here means the kernel doesn't know how to handle
3795 	 * it, but maybe userspace does ... include returned frames
3796 	 * so userspace can register for those to know whether ones
3797 	 * it transmitted were processed or returned.
3798 	 */
3799 
3800 	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3801 	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3802 		info.sig_dbm = status->signal;
3803 
3804 	if (ieee80211_is_timing_measurement(rx->skb) ||
3805 	    ieee80211_is_ftm(rx->skb)) {
3806 		info.rx_tstamp = ktime_to_ns(skb_hwtstamps(rx->skb)->hwtstamp);
3807 		info.ack_tstamp = ktime_to_ns(status->ack_tx_hwtstamp);
3808 	}
3809 
3810 	if (cfg80211_rx_mgmt_ext(&rx->sdata->wdev, &info)) {
3811 		if (rx->sta)
3812 			rx->link_sta->rx_stats.packets++;
3813 		dev_kfree_skb(rx->skb);
3814 		return RX_QUEUED;
3815 	}
3816 
3817 	return RX_CONTINUE;
3818 }
3819 
3820 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data * rx)3821 ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
3822 {
3823 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3824 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3825 	int len = rx->skb->len;
3826 
3827 	if (!ieee80211_is_action(mgmt->frame_control))
3828 		return RX_CONTINUE;
3829 
3830 	switch (mgmt->u.action.category) {
3831 	case WLAN_CATEGORY_SA_QUERY:
3832 		if (len < (IEEE80211_MIN_ACTION_SIZE +
3833 			   sizeof(mgmt->u.action.u.sa_query)))
3834 			break;
3835 
3836 		switch (mgmt->u.action.u.sa_query.action) {
3837 		case WLAN_ACTION_SA_QUERY_REQUEST:
3838 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3839 				break;
3840 			ieee80211_process_sa_query_req(sdata, mgmt, len);
3841 			goto handled;
3842 		}
3843 		break;
3844 	}
3845 
3846 	return RX_CONTINUE;
3847 
3848  handled:
3849 	if (rx->sta)
3850 		rx->link_sta->rx_stats.packets++;
3851 	dev_kfree_skb(rx->skb);
3852 	return RX_QUEUED;
3853 }
3854 
3855 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data * rx)3856 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3857 {
3858 	struct ieee80211_local *local = rx->local;
3859 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3860 	struct sk_buff *nskb;
3861 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3862 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3863 
3864 	if (!ieee80211_is_action(mgmt->frame_control))
3865 		return RX_CONTINUE;
3866 
3867 	/*
3868 	 * For AP mode, hostapd is responsible for handling any action
3869 	 * frames that we didn't handle, including returning unknown
3870 	 * ones. For all other modes we will return them to the sender,
3871 	 * setting the 0x80 bit in the action category, as required by
3872 	 * 802.11-2012 9.24.4.
3873 	 * Newer versions of hostapd shall also use the management frame
3874 	 * registration mechanisms, but older ones still use cooked
3875 	 * monitor interfaces so push all frames there.
3876 	 */
3877 	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3878 	    (sdata->vif.type == NL80211_IFTYPE_AP ||
3879 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3880 		return RX_DROP_MONITOR;
3881 
3882 	if (is_multicast_ether_addr(mgmt->da))
3883 		return RX_DROP_MONITOR;
3884 
3885 	/* do not return rejected action frames */
3886 	if (mgmt->u.action.category & 0x80)
3887 		return RX_DROP_UNUSABLE;
3888 
3889 	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3890 			       GFP_ATOMIC);
3891 	if (nskb) {
3892 		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3893 
3894 		nmgmt->u.action.category |= 0x80;
3895 		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3896 		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3897 
3898 		memset(nskb->cb, 0, sizeof(nskb->cb));
3899 
3900 		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3901 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3902 
3903 			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3904 				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3905 				      IEEE80211_TX_CTL_NO_CCK_RATE;
3906 			if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3907 				info->hw_queue =
3908 					local->hw.offchannel_tx_hw_queue;
3909 		}
3910 
3911 		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, -1,
3912 					    status->band);
3913 	}
3914 	dev_kfree_skb(rx->skb);
3915 	return RX_QUEUED;
3916 }
3917 
3918 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_ext(struct ieee80211_rx_data * rx)3919 ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
3920 {
3921 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3922 	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
3923 
3924 	if (!ieee80211_is_ext(hdr->frame_control))
3925 		return RX_CONTINUE;
3926 
3927 	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3928 		return RX_DROP_MONITOR;
3929 
3930 	/* for now only beacons are ext, so queue them */
3931 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
3932 
3933 	return RX_QUEUED;
3934 }
3935 
3936 static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt(struct ieee80211_rx_data * rx)3937 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3938 {
3939 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3940 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3941 	__le16 stype;
3942 
3943 	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3944 
3945 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3946 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3947 	    sdata->vif.type != NL80211_IFTYPE_OCB &&
3948 	    sdata->vif.type != NL80211_IFTYPE_STATION)
3949 		return RX_DROP_MONITOR;
3950 
3951 	switch (stype) {
3952 	case cpu_to_le16(IEEE80211_STYPE_AUTH):
3953 	case cpu_to_le16(IEEE80211_STYPE_BEACON):
3954 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3955 		/* process for all: mesh, mlme, ibss */
3956 		break;
3957 	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3958 		if (is_multicast_ether_addr(mgmt->da) &&
3959 		    !is_broadcast_ether_addr(mgmt->da))
3960 			return RX_DROP_MONITOR;
3961 
3962 		/* process only for station/IBSS */
3963 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3964 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3965 			return RX_DROP_MONITOR;
3966 		break;
3967 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3968 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3969 	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3970 		if (is_multicast_ether_addr(mgmt->da) &&
3971 		    !is_broadcast_ether_addr(mgmt->da))
3972 			return RX_DROP_MONITOR;
3973 
3974 		/* process only for station */
3975 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
3976 			return RX_DROP_MONITOR;
3977 		break;
3978 	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3979 		/* process only for ibss and mesh */
3980 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3981 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3982 			return RX_DROP_MONITOR;
3983 		break;
3984 	default:
3985 		return RX_DROP_MONITOR;
3986 	}
3987 
3988 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
3989 
3990 	return RX_QUEUED;
3991 }
3992 
ieee80211_rx_cooked_monitor(struct ieee80211_rx_data * rx,struct ieee80211_rate * rate,ieee80211_rx_result reason)3993 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3994 					struct ieee80211_rate *rate,
3995 					ieee80211_rx_result reason)
3996 {
3997 	struct ieee80211_sub_if_data *sdata;
3998 	struct ieee80211_local *local = rx->local;
3999 	struct sk_buff *skb = rx->skb, *skb2;
4000 	struct net_device *prev_dev = NULL;
4001 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4002 	int needed_headroom;
4003 
4004 	/*
4005 	 * If cooked monitor has been processed already, then
4006 	 * don't do it again. If not, set the flag.
4007 	 */
4008 	if (rx->flags & IEEE80211_RX_CMNTR)
4009 		goto out_free_skb;
4010 	rx->flags |= IEEE80211_RX_CMNTR;
4011 
4012 	/* If there are no cooked monitor interfaces, just free the SKB */
4013 	if (!local->cooked_mntrs)
4014 		goto out_free_skb;
4015 
4016 	/* room for the radiotap header based on driver features */
4017 	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
4018 
4019 	if (skb_headroom(skb) < needed_headroom &&
4020 	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
4021 		goto out_free_skb;
4022 
4023 	/* prepend radiotap information */
4024 	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
4025 					 false);
4026 
4027 	skb_reset_mac_header(skb);
4028 	skb->ip_summed = CHECKSUM_UNNECESSARY;
4029 	skb->pkt_type = PACKET_OTHERHOST;
4030 	skb->protocol = htons(ETH_P_802_2);
4031 
4032 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4033 		if (!ieee80211_sdata_running(sdata))
4034 			continue;
4035 
4036 		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
4037 		    !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
4038 			continue;
4039 
4040 		if (prev_dev) {
4041 			skb2 = skb_clone(skb, GFP_ATOMIC);
4042 			if (skb2) {
4043 				skb2->dev = prev_dev;
4044 				netif_receive_skb(skb2);
4045 			}
4046 		}
4047 
4048 		prev_dev = sdata->dev;
4049 		dev_sw_netstats_rx_add(sdata->dev, skb->len);
4050 	}
4051 
4052 	if (prev_dev) {
4053 		skb->dev = prev_dev;
4054 		netif_receive_skb(skb);
4055 		return;
4056 	}
4057 
4058  out_free_skb:
4059 	kfree_skb_reason(skb, (__force u32)reason);
4060 }
4061 
ieee80211_rx_handlers_result(struct ieee80211_rx_data * rx,ieee80211_rx_result res)4062 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
4063 					 ieee80211_rx_result res)
4064 {
4065 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4066 	struct ieee80211_supported_band *sband;
4067 	struct ieee80211_rate *rate = NULL;
4068 
4069 	if (res == RX_QUEUED) {
4070 		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
4071 		return;
4072 	}
4073 
4074 	if (res != RX_CONTINUE) {
4075 		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
4076 		if (rx->sta)
4077 			rx->link_sta->rx_stats.dropped++;
4078 	}
4079 
4080 	if (u32_get_bits((__force u32)res, SKB_DROP_REASON_SUBSYS_MASK) ==
4081 			SKB_DROP_REASON_SUBSYS_MAC80211_UNUSABLE) {
4082 		kfree_skb_reason(rx->skb, (__force u32)res);
4083 		return;
4084 	}
4085 
4086 	sband = rx->local->hw.wiphy->bands[status->band];
4087 	if (status->encoding == RX_ENC_LEGACY)
4088 		rate = &sband->bitrates[status->rate_idx];
4089 
4090 	ieee80211_rx_cooked_monitor(rx, rate, res);
4091 }
4092 
ieee80211_rx_handlers(struct ieee80211_rx_data * rx,struct sk_buff_head * frames)4093 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
4094 				  struct sk_buff_head *frames)
4095 {
4096 	ieee80211_rx_result res = RX_DROP_MONITOR;
4097 	struct sk_buff *skb;
4098 
4099 #define CALL_RXH(rxh)			\
4100 	do {				\
4101 		res = rxh(rx);		\
4102 		if (res != RX_CONTINUE)	\
4103 			goto rxh_next;  \
4104 	} while (0)
4105 
4106 	/* Lock here to avoid hitting all of the data used in the RX
4107 	 * path (e.g. key data, station data, ...) concurrently when
4108 	 * a frame is released from the reorder buffer due to timeout
4109 	 * from the timer, potentially concurrently with RX from the
4110 	 * driver.
4111 	 */
4112 	spin_lock_bh(&rx->local->rx_path_lock);
4113 
4114 	while ((skb = __skb_dequeue(frames))) {
4115 		/*
4116 		 * all the other fields are valid across frames
4117 		 * that belong to an aMPDU since they are on the
4118 		 * same TID from the same station
4119 		 */
4120 		rx->skb = skb;
4121 
4122 		if (WARN_ON_ONCE(!rx->link))
4123 			goto rxh_next;
4124 
4125 		CALL_RXH(ieee80211_rx_h_check_more_data);
4126 		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
4127 		CALL_RXH(ieee80211_rx_h_sta_process);
4128 		CALL_RXH(ieee80211_rx_h_decrypt);
4129 		CALL_RXH(ieee80211_rx_h_defragment);
4130 		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
4131 		/* must be after MMIC verify so header is counted in MPDU mic */
4132 		CALL_RXH(ieee80211_rx_h_amsdu);
4133 		CALL_RXH(ieee80211_rx_h_data);
4134 
4135 		/* special treatment -- needs the queue */
4136 		res = ieee80211_rx_h_ctrl(rx, frames);
4137 		if (res != RX_CONTINUE)
4138 			goto rxh_next;
4139 
4140 		CALL_RXH(ieee80211_rx_h_mgmt_check);
4141 		CALL_RXH(ieee80211_rx_h_action);
4142 		CALL_RXH(ieee80211_rx_h_userspace_mgmt);
4143 		CALL_RXH(ieee80211_rx_h_action_post_userspace);
4144 		CALL_RXH(ieee80211_rx_h_action_return);
4145 		CALL_RXH(ieee80211_rx_h_ext);
4146 		CALL_RXH(ieee80211_rx_h_mgmt);
4147 
4148  rxh_next:
4149 		ieee80211_rx_handlers_result(rx, res);
4150 
4151 #undef CALL_RXH
4152 	}
4153 
4154 	spin_unlock_bh(&rx->local->rx_path_lock);
4155 }
4156 
ieee80211_invoke_rx_handlers(struct ieee80211_rx_data * rx)4157 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
4158 {
4159 	struct sk_buff_head reorder_release;
4160 	ieee80211_rx_result res = RX_DROP_MONITOR;
4161 
4162 	__skb_queue_head_init(&reorder_release);
4163 
4164 #define CALL_RXH(rxh)			\
4165 	do {				\
4166 		res = rxh(rx);		\
4167 		if (res != RX_CONTINUE)	\
4168 			goto rxh_next;  \
4169 	} while (0)
4170 
4171 	CALL_RXH(ieee80211_rx_h_check_dup);
4172 	CALL_RXH(ieee80211_rx_h_check);
4173 
4174 	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
4175 
4176 	ieee80211_rx_handlers(rx, &reorder_release);
4177 	return;
4178 
4179  rxh_next:
4180 	ieee80211_rx_handlers_result(rx, res);
4181 
4182 #undef CALL_RXH
4183 }
4184 
4185 static bool
ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta * sta,u8 link_id)4186 ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
4187 {
4188 	return !!(sta->valid_links & BIT(link_id));
4189 }
4190 
ieee80211_rx_data_set_link(struct ieee80211_rx_data * rx,u8 link_id)4191 static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
4192 				       u8 link_id)
4193 {
4194 	rx->link_id = link_id;
4195 	rx->link = rcu_dereference(rx->sdata->link[link_id]);
4196 
4197 	if (!rx->sta)
4198 		return rx->link;
4199 
4200 	if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
4201 		return false;
4202 
4203 	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
4204 
4205 	return rx->link && rx->link_sta;
4206 }
4207 
ieee80211_rx_data_set_sta(struct ieee80211_rx_data * rx,struct sta_info * sta,int link_id)4208 static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
4209 				      struct sta_info *sta, int link_id)
4210 {
4211 	rx->link_id = link_id;
4212 	rx->sta = sta;
4213 
4214 	if (sta) {
4215 		rx->local = sta->sdata->local;
4216 		if (!rx->sdata)
4217 			rx->sdata = sta->sdata;
4218 		rx->link_sta = &sta->deflink;
4219 	} else {
4220 		rx->link_sta = NULL;
4221 	}
4222 
4223 	if (link_id < 0)
4224 		rx->link = &rx->sdata->deflink;
4225 	else if (!ieee80211_rx_data_set_link(rx, link_id))
4226 		return false;
4227 
4228 	return true;
4229 }
4230 
4231 /*
4232  * This function makes calls into the RX path, therefore
4233  * it has to be invoked under RCU read lock.
4234  */
ieee80211_release_reorder_timeout(struct sta_info * sta,int tid)4235 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4236 {
4237 	struct sk_buff_head frames;
4238 	struct ieee80211_rx_data rx = {
4239 		/* This is OK -- must be QoS data frame */
4240 		.security_idx = tid,
4241 		.seqno_idx = tid,
4242 	};
4243 	struct tid_ampdu_rx *tid_agg_rx;
4244 	int link_id = -1;
4245 
4246 	/* FIXME: statistics won't be right with this */
4247 	if (sta->sta.valid_links)
4248 		link_id = ffs(sta->sta.valid_links) - 1;
4249 
4250 	if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
4251 		return;
4252 
4253 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4254 	if (!tid_agg_rx)
4255 		return;
4256 
4257 	__skb_queue_head_init(&frames);
4258 
4259 	spin_lock(&tid_agg_rx->reorder_lock);
4260 	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4261 	spin_unlock(&tid_agg_rx->reorder_lock);
4262 
4263 	if (!skb_queue_empty(&frames)) {
4264 		struct ieee80211_event event = {
4265 			.type = BA_FRAME_TIMEOUT,
4266 			.u.ba.tid = tid,
4267 			.u.ba.sta = &sta->sta,
4268 		};
4269 		drv_event_callback(rx.local, rx.sdata, &event);
4270 	}
4271 
4272 	ieee80211_rx_handlers(&rx, &frames);
4273 }
4274 
ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta * pubsta,u8 tid,u16 ssn,u64 filtered,u16 received_mpdus)4275 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4276 					  u16 ssn, u64 filtered,
4277 					  u16 received_mpdus)
4278 {
4279 	struct ieee80211_local *local;
4280 	struct sta_info *sta;
4281 	struct tid_ampdu_rx *tid_agg_rx;
4282 	struct sk_buff_head frames;
4283 	struct ieee80211_rx_data rx = {
4284 		/* This is OK -- must be QoS data frame */
4285 		.security_idx = tid,
4286 		.seqno_idx = tid,
4287 	};
4288 	int i, diff;
4289 
4290 	if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4291 		return;
4292 
4293 	__skb_queue_head_init(&frames);
4294 
4295 	sta = container_of(pubsta, struct sta_info, sta);
4296 
4297 	local = sta->sdata->local;
4298 	WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,
4299 		  "RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",
4300 		  local->hw.max_rx_aggregation_subframes);
4301 
4302 	if (!ieee80211_rx_data_set_sta(&rx, sta, -1))
4303 		return;
4304 
4305 	rcu_read_lock();
4306 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4307 	if (!tid_agg_rx)
4308 		goto out;
4309 
4310 	spin_lock_bh(&tid_agg_rx->reorder_lock);
4311 
4312 	if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4313 		int release;
4314 
4315 		/* release all frames in the reorder buffer */
4316 		release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4317 			   IEEE80211_SN_MODULO;
4318 		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
4319 						 release, &frames);
4320 		/* update ssn to match received ssn */
4321 		tid_agg_rx->head_seq_num = ssn;
4322 	} else {
4323 		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
4324 						 &frames);
4325 	}
4326 
4327 	/* handle the case that received ssn is behind the mac ssn.
4328 	 * it can be tid_agg_rx->buf_size behind and still be valid */
4329 	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4330 	if (diff >= tid_agg_rx->buf_size) {
4331 		tid_agg_rx->reorder_buf_filtered = 0;
4332 		goto release;
4333 	}
4334 	filtered = filtered >> diff;
4335 	ssn += diff;
4336 
4337 	/* update bitmap */
4338 	for (i = 0; i < tid_agg_rx->buf_size; i++) {
4339 		int index = (ssn + i) % tid_agg_rx->buf_size;
4340 
4341 		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4342 		if (filtered & BIT_ULL(i))
4343 			tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4344 	}
4345 
4346 	/* now process also frames that the filter marking released */
4347 	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4348 
4349 release:
4350 	spin_unlock_bh(&tid_agg_rx->reorder_lock);
4351 
4352 	ieee80211_rx_handlers(&rx, &frames);
4353 
4354  out:
4355 	rcu_read_unlock();
4356 }
4357 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4358 
4359 /* main receive path */
4360 
ieee80211_bssid_match(const u8 * raddr,const u8 * addr)4361 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4362 {
4363 	return ether_addr_equal(raddr, addr) ||
4364 	       is_broadcast_ether_addr(raddr);
4365 }
4366 
ieee80211_accept_frame(struct ieee80211_rx_data * rx)4367 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
4368 {
4369 	struct ieee80211_sub_if_data *sdata = rx->sdata;
4370 	struct sk_buff *skb = rx->skb;
4371 	struct ieee80211_hdr *hdr = (void *)skb->data;
4372 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4373 	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
4374 	bool multicast = is_multicast_ether_addr(hdr->addr1) ||
4375 			 ieee80211_is_s1g_beacon(hdr->frame_control);
4376 
4377 	switch (sdata->vif.type) {
4378 	case NL80211_IFTYPE_STATION:
4379 		if (!bssid && !sdata->u.mgd.use_4addr)
4380 			return false;
4381 		if (ieee80211_is_first_frag(hdr->seq_ctrl) &&
4382 		    ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4383 			return false;
4384 		if (multicast)
4385 			return true;
4386 		return ieee80211_is_our_addr(sdata, hdr->addr1, &rx->link_id);
4387 	case NL80211_IFTYPE_ADHOC:
4388 		if (!bssid)
4389 			return false;
4390 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
4391 		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
4392 		    !is_valid_ether_addr(hdr->addr2))
4393 			return false;
4394 		if (ieee80211_is_beacon(hdr->frame_control))
4395 			return true;
4396 		if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
4397 			return false;
4398 		if (!multicast &&
4399 		    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
4400 			return false;
4401 		if (!rx->sta) {
4402 			int rate_idx;
4403 			if (status->encoding != RX_ENC_LEGACY)
4404 				rate_idx = 0; /* TODO: HT/VHT rates */
4405 			else
4406 				rate_idx = status->rate_idx;
4407 			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
4408 						 BIT(rate_idx));
4409 		}
4410 		return true;
4411 	case NL80211_IFTYPE_OCB:
4412 		if (!bssid)
4413 			return false;
4414 		if (!ieee80211_is_data_present(hdr->frame_control))
4415 			return false;
4416 		if (!is_broadcast_ether_addr(bssid))
4417 			return false;
4418 		if (!multicast &&
4419 		    !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
4420 			return false;
4421 		if (!rx->sta) {
4422 			int rate_idx;
4423 			if (status->encoding != RX_ENC_LEGACY)
4424 				rate_idx = 0; /* TODO: HT rates */
4425 			else
4426 				rate_idx = status->rate_idx;
4427 			ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
4428 						BIT(rate_idx));
4429 		}
4430 		return true;
4431 	case NL80211_IFTYPE_MESH_POINT:
4432 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
4433 			return false;
4434 		if (multicast)
4435 			return true;
4436 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
4437 	case NL80211_IFTYPE_AP_VLAN:
4438 	case NL80211_IFTYPE_AP:
4439 		if (!bssid)
4440 			return ieee80211_is_our_addr(sdata, hdr->addr1,
4441 						     &rx->link_id);
4442 
4443 		if (!is_broadcast_ether_addr(bssid) &&
4444 		    !ieee80211_is_our_addr(sdata, bssid, NULL)) {
4445 			/*
4446 			 * Accept public action frames even when the
4447 			 * BSSID doesn't match, this is used for P2P
4448 			 * and location updates. Note that mac80211
4449 			 * itself never looks at these frames.
4450 			 */
4451 			if (!multicast &&
4452 			    !ieee80211_is_our_addr(sdata, hdr->addr1,
4453 						   &rx->link_id))
4454 				return false;
4455 			if (ieee80211_is_public_action(hdr, skb->len))
4456 				return true;
4457 			return ieee80211_is_beacon(hdr->frame_control);
4458 		}
4459 
4460 		if (!ieee80211_has_tods(hdr->frame_control)) {
4461 			/* ignore data frames to TDLS-peers */
4462 			if (ieee80211_is_data(hdr->frame_control))
4463 				return false;
4464 			/* ignore action frames to TDLS-peers */
4465 			if (ieee80211_is_action(hdr->frame_control) &&
4466 			    !is_broadcast_ether_addr(bssid) &&
4467 			    !ether_addr_equal(bssid, hdr->addr1))
4468 				return false;
4469 		}
4470 
4471 		/*
4472 		 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
4473 		 * the BSSID - we've checked that already but may have accepted
4474 		 * the wildcard (ff:ff:ff:ff:ff:ff).
4475 		 *
4476 		 * It also says:
4477 		 *	The BSSID of the Data frame is determined as follows:
4478 		 *	a) If the STA is contained within an AP or is associated
4479 		 *	   with an AP, the BSSID is the address currently in use
4480 		 *	   by the STA contained in the AP.
4481 		 *
4482 		 * So we should not accept data frames with an address that's
4483 		 * multicast.
4484 		 *
4485 		 * Accepting it also opens a security problem because stations
4486 		 * could encrypt it with the GTK and inject traffic that way.
4487 		 */
4488 		if (ieee80211_is_data(hdr->frame_control) && multicast)
4489 			return false;
4490 
4491 		return true;
4492 	case NL80211_IFTYPE_P2P_DEVICE:
4493 		return ieee80211_is_public_action(hdr, skb->len) ||
4494 		       ieee80211_is_probe_req(hdr->frame_control) ||
4495 		       ieee80211_is_probe_resp(hdr->frame_control) ||
4496 		       ieee80211_is_beacon(hdr->frame_control);
4497 	case NL80211_IFTYPE_NAN:
4498 		/* Currently no frames on NAN interface are allowed */
4499 		return false;
4500 	default:
4501 		break;
4502 	}
4503 
4504 	WARN_ON_ONCE(1);
4505 	return false;
4506 }
4507 
ieee80211_check_fast_rx(struct sta_info * sta)4508 void ieee80211_check_fast_rx(struct sta_info *sta)
4509 {
4510 	struct ieee80211_sub_if_data *sdata = sta->sdata;
4511 	struct ieee80211_local *local = sdata->local;
4512 	struct ieee80211_key *key;
4513 	struct ieee80211_fast_rx fastrx = {
4514 		.dev = sdata->dev,
4515 		.vif_type = sdata->vif.type,
4516 		.control_port_protocol = sdata->control_port_protocol,
4517 	}, *old, *new = NULL;
4518 	u32 offload_flags;
4519 	bool set_offload = false;
4520 	bool assign = false;
4521 	bool offload;
4522 
4523 	/* use sparse to check that we don't return without updating */
4524 	__acquire(check_fast_rx);
4525 
4526 	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4527 	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4528 	ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
4529 	ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
4530 
4531 	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4532 
4533 	/* fast-rx doesn't do reordering */
4534 	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4535 	    !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4536 		goto clear;
4537 
4538 	switch (sdata->vif.type) {
4539 	case NL80211_IFTYPE_STATION:
4540 		if (sta->sta.tdls) {
4541 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4542 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4543 			fastrx.expected_ds_bits = 0;
4544 		} else {
4545 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4546 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4547 			fastrx.expected_ds_bits =
4548 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
4549 		}
4550 
4551 		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4552 			fastrx.expected_ds_bits |=
4553 				cpu_to_le16(IEEE80211_FCTL_TODS);
4554 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4555 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4556 		}
4557 
4558 		if (!sdata->u.mgd.powersave)
4559 			break;
4560 
4561 		/* software powersave is a huge mess, avoid all of it */
4562 		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4563 			goto clear;
4564 		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4565 		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4566 			goto clear;
4567 		break;
4568 	case NL80211_IFTYPE_AP_VLAN:
4569 	case NL80211_IFTYPE_AP:
4570 		/* parallel-rx requires this, at least with calls to
4571 		 * ieee80211_sta_ps_transition()
4572 		 */
4573 		if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4574 			goto clear;
4575 		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4576 		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4577 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4578 
4579 		fastrx.internal_forward =
4580 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4581 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4582 			 !sdata->u.vlan.sta);
4583 
4584 		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4585 		    sdata->u.vlan.sta) {
4586 			fastrx.expected_ds_bits |=
4587 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
4588 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4589 			fastrx.internal_forward = 0;
4590 		}
4591 
4592 		break;
4593 	case NL80211_IFTYPE_MESH_POINT:
4594 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
4595 						      IEEE80211_FCTL_TODS);
4596 		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4597 		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4598 		break;
4599 	default:
4600 		goto clear;
4601 	}
4602 
4603 	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
4604 		goto clear;
4605 
4606 	rcu_read_lock();
4607 	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4608 	if (!key)
4609 		key = rcu_dereference(sdata->default_unicast_key);
4610 	if (key) {
4611 		switch (key->conf.cipher) {
4612 		case WLAN_CIPHER_SUITE_TKIP:
4613 			/* we don't want to deal with MMIC in fast-rx */
4614 			goto clear_rcu;
4615 		case WLAN_CIPHER_SUITE_CCMP:
4616 		case WLAN_CIPHER_SUITE_CCMP_256:
4617 		case WLAN_CIPHER_SUITE_GCMP:
4618 		case WLAN_CIPHER_SUITE_GCMP_256:
4619 			break;
4620 		default:
4621 			/* We also don't want to deal with
4622 			 * WEP or cipher scheme.
4623 			 */
4624 			goto clear_rcu;
4625 		}
4626 
4627 		fastrx.key = true;
4628 		fastrx.icv_len = key->conf.icv_len;
4629 	}
4630 
4631 	assign = true;
4632  clear_rcu:
4633 	rcu_read_unlock();
4634  clear:
4635 	__release(check_fast_rx);
4636 
4637 	if (assign)
4638 		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
4639 
4640 	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
4641 	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
4642 
4643 	if (assign && offload)
4644 		set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4645 	else
4646 		set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4647 
4648 	if (set_offload)
4649 		drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
4650 
4651 	spin_lock_bh(&sta->lock);
4652 	old = rcu_dereference_protected(sta->fast_rx, true);
4653 	rcu_assign_pointer(sta->fast_rx, new);
4654 	spin_unlock_bh(&sta->lock);
4655 
4656 	if (old)
4657 		kfree_rcu(old, rcu_head);
4658 }
4659 
ieee80211_clear_fast_rx(struct sta_info * sta)4660 void ieee80211_clear_fast_rx(struct sta_info *sta)
4661 {
4662 	struct ieee80211_fast_rx *old;
4663 
4664 	spin_lock_bh(&sta->lock);
4665 	old = rcu_dereference_protected(sta->fast_rx, true);
4666 	RCU_INIT_POINTER(sta->fast_rx, NULL);
4667 	spin_unlock_bh(&sta->lock);
4668 
4669 	if (old)
4670 		kfree_rcu(old, rcu_head);
4671 }
4672 
__ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data * sdata)4673 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4674 {
4675 	struct ieee80211_local *local = sdata->local;
4676 	struct sta_info *sta;
4677 
4678 	lockdep_assert_held(&local->sta_mtx);
4679 
4680 	list_for_each_entry(sta, &local->sta_list, list) {
4681 		if (sdata != sta->sdata &&
4682 		    (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4683 			continue;
4684 		ieee80211_check_fast_rx(sta);
4685 	}
4686 }
4687 
ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data * sdata)4688 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4689 {
4690 	struct ieee80211_local *local = sdata->local;
4691 
4692 	mutex_lock(&local->sta_mtx);
4693 	__ieee80211_check_fast_rx_iface(sdata);
4694 	mutex_unlock(&local->sta_mtx);
4695 }
4696 
ieee80211_rx_8023(struct ieee80211_rx_data * rx,struct ieee80211_fast_rx * fast_rx,int orig_len)4697 static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4698 			      struct ieee80211_fast_rx *fast_rx,
4699 			      int orig_len)
4700 {
4701 	struct ieee80211_sta_rx_stats *stats;
4702 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4703 	struct sta_info *sta = rx->sta;
4704 	struct link_sta_info *link_sta;
4705 	struct sk_buff *skb = rx->skb;
4706 	void *sa = skb->data + ETH_ALEN;
4707 	void *da = skb->data;
4708 
4709 	if (rx->link_id >= 0) {
4710 		link_sta = rcu_dereference(sta->link[rx->link_id]);
4711 		if (WARN_ON_ONCE(!link_sta)) {
4712 			dev_kfree_skb(rx->skb);
4713 			return;
4714 		}
4715 	} else {
4716 		link_sta = &sta->deflink;
4717 	}
4718 
4719 	stats = &link_sta->rx_stats;
4720 	if (fast_rx->uses_rss)
4721 		stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
4722 
4723 	/* statistics part of ieee80211_rx_h_sta_process() */
4724 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4725 		stats->last_signal = status->signal;
4726 		if (!fast_rx->uses_rss)
4727 			ewma_signal_add(&link_sta->rx_stats_avg.signal,
4728 					-status->signal);
4729 	}
4730 
4731 	if (status->chains) {
4732 		int i;
4733 
4734 		stats->chains = status->chains;
4735 		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4736 			int signal = status->chain_signal[i];
4737 
4738 			if (!(status->chains & BIT(i)))
4739 				continue;
4740 
4741 			stats->chain_signal_last[i] = signal;
4742 			if (!fast_rx->uses_rss)
4743 				ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
4744 						-signal);
4745 		}
4746 	}
4747 	/* end of statistics */
4748 
4749 	stats->last_rx = jiffies;
4750 	stats->last_rate = sta_stats_encode_rate(status);
4751 
4752 	stats->fragments++;
4753 	stats->packets++;
4754 
4755 	skb->dev = fast_rx->dev;
4756 
4757 	dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
4758 
4759 	/* The seqno index has the same property as needed
4760 	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4761 	 * for non-QoS-data frames. Here we know it's a data
4762 	 * frame, so count MSDUs.
4763 	 */
4764 	u64_stats_update_begin(&stats->syncp);
4765 	stats->msdu[rx->seqno_idx]++;
4766 	stats->bytes += orig_len;
4767 	u64_stats_update_end(&stats->syncp);
4768 
4769 	if (fast_rx->internal_forward) {
4770 		struct sk_buff *xmit_skb = NULL;
4771 		if (is_multicast_ether_addr(da)) {
4772 			xmit_skb = skb_copy(skb, GFP_ATOMIC);
4773 		} else if (!ether_addr_equal(da, sa) &&
4774 			   sta_info_get(rx->sdata, da)) {
4775 			xmit_skb = skb;
4776 			skb = NULL;
4777 		}
4778 
4779 		if (xmit_skb) {
4780 			/*
4781 			 * Send to wireless media and increase priority by 256
4782 			 * to keep the received priority instead of
4783 			 * reclassifying the frame (see cfg80211_classify8021d).
4784 			 */
4785 			xmit_skb->priority += 256;
4786 			xmit_skb->protocol = htons(ETH_P_802_3);
4787 			skb_reset_network_header(xmit_skb);
4788 			skb_reset_mac_header(xmit_skb);
4789 			dev_queue_xmit(xmit_skb);
4790 		}
4791 
4792 		if (!skb)
4793 			return;
4794 	}
4795 
4796 	/* deliver to local stack */
4797 	skb->protocol = eth_type_trans(skb, fast_rx->dev);
4798 	ieee80211_deliver_skb_to_local_stack(skb, rx);
4799 }
4800 
ieee80211_invoke_fast_rx(struct ieee80211_rx_data * rx,struct ieee80211_fast_rx * fast_rx)4801 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4802 				     struct ieee80211_fast_rx *fast_rx)
4803 {
4804 	struct sk_buff *skb = rx->skb;
4805 	struct ieee80211_hdr *hdr = (void *)skb->data;
4806 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4807 	static ieee80211_rx_result res;
4808 	int orig_len = skb->len;
4809 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
4810 	int snap_offs = hdrlen;
4811 	struct {
4812 		u8 snap[sizeof(rfc1042_header)];
4813 		__be16 proto;
4814 	} *payload __aligned(2);
4815 	struct {
4816 		u8 da[ETH_ALEN];
4817 		u8 sa[ETH_ALEN];
4818 	} addrs __aligned(2);
4819 	struct ieee80211_sta_rx_stats *stats;
4820 
4821 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
4822 	 * to a common data structure; drivers can implement that per queue
4823 	 * but we don't have that information in mac80211
4824 	 */
4825 	if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4826 		return false;
4827 
4828 #define FAST_RX_CRYPT_FLAGS	(RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4829 
4830 	/* If using encryption, we also need to have:
4831 	 *  - PN_VALIDATED: similar, but the implementation is tricky
4832 	 *  - DECRYPTED: necessary for PN_VALIDATED
4833 	 */
4834 	if (fast_rx->key &&
4835 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
4836 		return false;
4837 
4838 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
4839 		return false;
4840 
4841 	if (unlikely(ieee80211_is_frag(hdr)))
4842 		return false;
4843 
4844 	/* Since our interface address cannot be multicast, this
4845 	 * implicitly also rejects multicast frames without the
4846 	 * explicit check.
4847 	 *
4848 	 * We shouldn't get any *data* frames not addressed to us
4849 	 * (AP mode will accept multicast *management* frames), but
4850 	 * punting here will make it go through the full checks in
4851 	 * ieee80211_accept_frame().
4852 	 */
4853 	if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
4854 		return false;
4855 
4856 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
4857 					      IEEE80211_FCTL_TODS)) !=
4858 	    fast_rx->expected_ds_bits)
4859 		return false;
4860 
4861 	/* assign the key to drop unencrypted frames (later)
4862 	 * and strip the IV/MIC if necessary
4863 	 */
4864 	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
4865 		/* GCMP header length is the same */
4866 		snap_offs += IEEE80211_CCMP_HDR_LEN;
4867 	}
4868 
4869 	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
4870 	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
4871 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
4872 			return false;
4873 
4874 		payload = (void *)(skb->data + snap_offs);
4875 
4876 		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
4877 			return false;
4878 
4879 		/* Don't handle these here since they require special code.
4880 		 * Accept AARP and IPX even though they should come with a
4881 		 * bridge-tunnel header - but if we get them this way then
4882 		 * there's little point in discarding them.
4883 		 */
4884 		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4885 			     payload->proto == fast_rx->control_port_protocol))
4886 			return false;
4887 	}
4888 
4889 	/* after this point, don't punt to the slowpath! */
4890 
4891 	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4892 	    pskb_trim(skb, skb->len - fast_rx->icv_len))
4893 		goto drop;
4894 
4895 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
4896 		goto drop;
4897 
4898 	if (status->rx_flags & IEEE80211_RX_AMSDU) {
4899 		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
4900 		    RX_QUEUED)
4901 			goto drop;
4902 
4903 		return true;
4904 	}
4905 
4906 	/* do the header conversion - first grab the addresses */
4907 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
4908 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
4909 	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
4910 	    skb_pull(skb, snap_offs - 2);
4911 	    put_unaligned_be16(skb->len - 2, skb->data);
4912 	} else {
4913 	    skb_postpull_rcsum(skb, skb->data + snap_offs,
4914 			       sizeof(rfc1042_header) + 2);
4915 
4916 	    /* remove the SNAP but leave the ethertype */
4917 	    skb_pull(skb, snap_offs + sizeof(rfc1042_header));
4918 	}
4919 	/* push the addresses in front */
4920 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4921 
4922 	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
4923 	switch (res) {
4924 	case RX_QUEUED:
4925 		return true;
4926 	case RX_CONTINUE:
4927 		break;
4928 	default:
4929 		goto drop;
4930 	}
4931 
4932 	ieee80211_rx_8023(rx, fast_rx, orig_len);
4933 
4934 	return true;
4935  drop:
4936 	dev_kfree_skb(skb);
4937 
4938 	if (fast_rx->uses_rss)
4939 		stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
4940 	else
4941 		stats = &rx->link_sta->rx_stats;
4942 
4943 	stats->dropped++;
4944 	return true;
4945 }
4946 
4947 /*
4948  * This function returns whether or not the SKB
4949  * was destined for RX processing or not, which,
4950  * if consume is true, is equivalent to whether
4951  * or not the skb was consumed.
4952  */
ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data * rx,struct sk_buff * skb,bool consume)4953 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4954 					    struct sk_buff *skb, bool consume)
4955 {
4956 	struct ieee80211_local *local = rx->local;
4957 	struct ieee80211_sub_if_data *sdata = rx->sdata;
4958 	struct ieee80211_hdr *hdr = (void *)skb->data;
4959 	struct link_sta_info *link_sta = rx->link_sta;
4960 	struct ieee80211_link_data *link = rx->link;
4961 
4962 	rx->skb = skb;
4963 
4964 	/* See if we can do fast-rx; if we have to copy we already lost,
4965 	 * so punt in that case. We should never have to deliver a data
4966 	 * frame to multiple interfaces anyway.
4967 	 *
4968 	 * We skip the ieee80211_accept_frame() call and do the necessary
4969 	 * checking inside ieee80211_invoke_fast_rx().
4970 	 */
4971 	if (consume && rx->sta) {
4972 		struct ieee80211_fast_rx *fast_rx;
4973 
4974 		fast_rx = rcu_dereference(rx->sta->fast_rx);
4975 		if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4976 			return true;
4977 	}
4978 
4979 	if (!ieee80211_accept_frame(rx))
4980 		return false;
4981 
4982 	if (!consume) {
4983 		struct skb_shared_hwtstamps *shwt;
4984 
4985 		rx->skb = skb_copy(skb, GFP_ATOMIC);
4986 		if (!rx->skb) {
4987 			if (net_ratelimit())
4988 				wiphy_debug(local->hw.wiphy,
4989 					"failed to copy skb for %s\n",
4990 					sdata->name);
4991 			return true;
4992 		}
4993 
4994 		/* skb_copy() does not copy the hw timestamps, so copy it
4995 		 * explicitly
4996 		 */
4997 		shwt = skb_hwtstamps(rx->skb);
4998 		shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
4999 
5000 		/* Update the hdr pointer to the new skb for translation below */
5001 		hdr = (struct ieee80211_hdr *)rx->skb->data;
5002 	}
5003 
5004 	if (unlikely(rx->sta && rx->sta->sta.mlo) &&
5005 	    is_unicast_ether_addr(hdr->addr1) &&
5006 	    !ieee80211_is_probe_resp(hdr->frame_control) &&
5007 	    !ieee80211_is_beacon(hdr->frame_control)) {
5008 		/* translate to MLD addresses */
5009 		if (ether_addr_equal(link->conf->addr, hdr->addr1))
5010 			ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
5011 		if (ether_addr_equal(link_sta->addr, hdr->addr2))
5012 			ether_addr_copy(hdr->addr2, rx->sta->addr);
5013 		/* translate A3 only if it's the BSSID */
5014 		if (!ieee80211_has_tods(hdr->frame_control) &&
5015 		    !ieee80211_has_fromds(hdr->frame_control)) {
5016 			if (ether_addr_equal(link_sta->addr, hdr->addr3))
5017 				ether_addr_copy(hdr->addr3, rx->sta->addr);
5018 			else if (ether_addr_equal(link->conf->addr, hdr->addr3))
5019 				ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);
5020 		}
5021 		/* not needed for A4 since it can only carry the SA */
5022 	}
5023 
5024 	ieee80211_invoke_rx_handlers(rx);
5025 	return true;
5026 }
5027 
__ieee80211_rx_handle_8023(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct list_head * list)5028 static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
5029 				       struct ieee80211_sta *pubsta,
5030 				       struct sk_buff *skb,
5031 				       struct list_head *list)
5032 {
5033 	struct ieee80211_local *local = hw_to_local(hw);
5034 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5035 	struct ieee80211_fast_rx *fast_rx;
5036 	struct ieee80211_rx_data rx;
5037 	struct sta_info *sta;
5038 	int link_id = -1;
5039 
5040 	memset(&rx, 0, sizeof(rx));
5041 	rx.skb = skb;
5042 	rx.local = local;
5043 	rx.list = list;
5044 	rx.link_id = -1;
5045 
5046 	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5047 
5048 	/* drop frame if too short for header */
5049 	if (skb->len < sizeof(struct ethhdr))
5050 		goto drop;
5051 
5052 	if (!pubsta)
5053 		goto drop;
5054 
5055 	if (status->link_valid)
5056 		link_id = status->link_id;
5057 
5058 	/*
5059 	 * TODO: Should the frame be dropped if the right link_id is not
5060 	 * available? Or may be it is fine in the current form to proceed with
5061 	 * the frame processing because with frame being in 802.3 format,
5062 	 * link_id is used only for stats purpose and updating the stats on
5063 	 * the deflink is fine?
5064 	 */
5065 	sta = container_of(pubsta, struct sta_info, sta);
5066 	if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5067 		goto drop;
5068 
5069 	fast_rx = rcu_dereference(rx.sta->fast_rx);
5070 	if (!fast_rx)
5071 		goto drop;
5072 
5073 	ieee80211_rx_8023(&rx, fast_rx, skb->len);
5074 	return;
5075 
5076 drop:
5077 	dev_kfree_skb(skb);
5078 }
5079 
ieee80211_rx_for_interface(struct ieee80211_rx_data * rx,struct sk_buff * skb,bool consume)5080 static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
5081 				       struct sk_buff *skb, bool consume)
5082 {
5083 	struct link_sta_info *link_sta;
5084 	struct ieee80211_hdr *hdr = (void *)skb->data;
5085 	struct sta_info *sta;
5086 	int link_id = -1;
5087 
5088 	/*
5089 	 * Look up link station first, in case there's a
5090 	 * chance that they might have a link address that
5091 	 * is identical to the MLD address, that way we'll
5092 	 * have the link information if needed.
5093 	 */
5094 	link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
5095 	if (link_sta) {
5096 		sta = link_sta->sta;
5097 		link_id = link_sta->link_id;
5098 	} else {
5099 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5100 
5101 		sta = sta_info_get_bss(rx->sdata, hdr->addr2);
5102 		if (status->link_valid)
5103 			link_id = status->link_id;
5104 	}
5105 
5106 	if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
5107 		return false;
5108 
5109 	return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5110 }
5111 
5112 /*
5113  * This is the actual Rx frames handler. as it belongs to Rx path it must
5114  * be called with rcu_read_lock protection.
5115  */
__ieee80211_rx_handle_packet(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct list_head * list)5116 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
5117 					 struct ieee80211_sta *pubsta,
5118 					 struct sk_buff *skb,
5119 					 struct list_head *list)
5120 {
5121 	struct ieee80211_local *local = hw_to_local(hw);
5122 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5123 	struct ieee80211_sub_if_data *sdata;
5124 	struct ieee80211_hdr *hdr;
5125 	__le16 fc;
5126 	struct ieee80211_rx_data rx;
5127 	struct ieee80211_sub_if_data *prev;
5128 	struct rhlist_head *tmp;
5129 	int err = 0;
5130 
5131 	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
5132 	memset(&rx, 0, sizeof(rx));
5133 	rx.skb = skb;
5134 	rx.local = local;
5135 	rx.list = list;
5136 	rx.link_id = -1;
5137 
5138 	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
5139 		I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5140 
5141 	if (ieee80211_is_mgmt(fc)) {
5142 		/* drop frame if too short for header */
5143 		if (skb->len < ieee80211_hdrlen(fc))
5144 			err = -ENOBUFS;
5145 		else
5146 			err = skb_linearize(skb);
5147 	} else {
5148 		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
5149 	}
5150 
5151 	if (err) {
5152 		dev_kfree_skb(skb);
5153 		return;
5154 	}
5155 
5156 	hdr = (struct ieee80211_hdr *)skb->data;
5157 	ieee80211_parse_qos(&rx);
5158 	ieee80211_verify_alignment(&rx);
5159 
5160 	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
5161 		     ieee80211_is_beacon(hdr->frame_control) ||
5162 		     ieee80211_is_s1g_beacon(hdr->frame_control)))
5163 		ieee80211_scan_rx(local, skb);
5164 
5165 	if (ieee80211_is_data(fc)) {
5166 		struct sta_info *sta, *prev_sta;
5167 		int link_id = -1;
5168 
5169 		if (status->link_valid)
5170 			link_id = status->link_id;
5171 
5172 		if (pubsta) {
5173 			sta = container_of(pubsta, struct sta_info, sta);
5174 			if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5175 				goto out;
5176 
5177 			/*
5178 			 * In MLO connection, fetch the link_id using addr2
5179 			 * when the driver does not pass link_id in status.
5180 			 * When the address translation is already performed by
5181 			 * driver/hw, the valid link_id must be passed in
5182 			 * status.
5183 			 */
5184 
5185 			if (!status->link_valid && pubsta->mlo) {
5186 				struct ieee80211_hdr *hdr = (void *)skb->data;
5187 				struct link_sta_info *link_sta;
5188 
5189 				link_sta = link_sta_info_get_bss(rx.sdata,
5190 								 hdr->addr2);
5191 				if (!link_sta)
5192 					goto out;
5193 
5194 				ieee80211_rx_data_set_link(&rx, link_sta->link_id);
5195 			}
5196 
5197 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5198 				return;
5199 			goto out;
5200 		}
5201 
5202 		prev_sta = NULL;
5203 
5204 		for_each_sta_info(local, hdr->addr2, sta, tmp) {
5205 			if (!prev_sta) {
5206 				prev_sta = sta;
5207 				continue;
5208 			}
5209 
5210 			rx.sdata = prev_sta->sdata;
5211 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5212 				goto out;
5213 
5214 			if (!status->link_valid && prev_sta->sta.mlo)
5215 				continue;
5216 
5217 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
5218 
5219 			prev_sta = sta;
5220 		}
5221 
5222 		if (prev_sta) {
5223 			rx.sdata = prev_sta->sdata;
5224 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5225 				goto out;
5226 
5227 			if (!status->link_valid && prev_sta->sta.mlo)
5228 				goto out;
5229 
5230 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5231 				return;
5232 			goto out;
5233 		}
5234 	}
5235 
5236 	prev = NULL;
5237 
5238 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
5239 		if (!ieee80211_sdata_running(sdata))
5240 			continue;
5241 
5242 		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
5243 		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
5244 			continue;
5245 
5246 		/*
5247 		 * frame is destined for this interface, but if it's
5248 		 * not also for the previous one we handle that after
5249 		 * the loop to avoid copying the SKB once too much
5250 		 */
5251 
5252 		if (!prev) {
5253 			prev = sdata;
5254 			continue;
5255 		}
5256 
5257 		rx.sdata = prev;
5258 		ieee80211_rx_for_interface(&rx, skb, false);
5259 
5260 		prev = sdata;
5261 	}
5262 
5263 	if (prev) {
5264 		rx.sdata = prev;
5265 
5266 		if (ieee80211_rx_for_interface(&rx, skb, true))
5267 			return;
5268 	}
5269 
5270  out:
5271 	dev_kfree_skb(skb);
5272 }
5273 
5274 /*
5275  * This is the receive path handler. It is called by a low level driver when an
5276  * 802.11 MPDU is received from the hardware.
5277  */
ieee80211_rx_list(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct list_head * list)5278 void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5279 		       struct sk_buff *skb, struct list_head *list)
5280 {
5281 	struct ieee80211_local *local = hw_to_local(hw);
5282 	struct ieee80211_rate *rate = NULL;
5283 	struct ieee80211_supported_band *sband;
5284 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5285 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
5286 
5287 	WARN_ON_ONCE(softirq_count() == 0);
5288 
5289 	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
5290 		goto drop;
5291 
5292 	sband = local->hw.wiphy->bands[status->band];
5293 	if (WARN_ON(!sband))
5294 		goto drop;
5295 
5296 	/*
5297 	 * If we're suspending, it is possible although not too likely
5298 	 * that we'd be receiving frames after having already partially
5299 	 * quiesced the stack. We can't process such frames then since
5300 	 * that might, for example, cause stations to be added or other
5301 	 * driver callbacks be invoked.
5302 	 */
5303 	if (unlikely(local->quiescing || local->suspended))
5304 		goto drop;
5305 
5306 	/* We might be during a HW reconfig, prevent Rx for the same reason */
5307 	if (unlikely(local->in_reconfig))
5308 		goto drop;
5309 
5310 	/*
5311 	 * The same happens when we're not even started,
5312 	 * but that's worth a warning.
5313 	 */
5314 	if (WARN_ON(!local->started))
5315 		goto drop;
5316 
5317 	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
5318 		/*
5319 		 * Validate the rate, unless a PLCP error means that
5320 		 * we probably can't have a valid rate here anyway.
5321 		 */
5322 
5323 		switch (status->encoding) {
5324 		case RX_ENC_HT:
5325 			/*
5326 			 * rate_idx is MCS index, which can be [0-76]
5327 			 * as documented on:
5328 			 *
5329 			 * https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
5330 			 *
5331 			 * Anything else would be some sort of driver or
5332 			 * hardware error. The driver should catch hardware
5333 			 * errors.
5334 			 */
5335 			if (WARN(status->rate_idx > 76,
5336 				 "Rate marked as an HT rate but passed "
5337 				 "status->rate_idx is not "
5338 				 "an MCS index [0-76]: %d (0x%02x)\n",
5339 				 status->rate_idx,
5340 				 status->rate_idx))
5341 				goto drop;
5342 			break;
5343 		case RX_ENC_VHT:
5344 			if (WARN_ONCE(status->rate_idx > 11 ||
5345 				      !status->nss ||
5346 				      status->nss > 8,
5347 				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
5348 				      status->rate_idx, status->nss))
5349 				goto drop;
5350 			break;
5351 		case RX_ENC_HE:
5352 			if (WARN_ONCE(status->rate_idx > 11 ||
5353 				      !status->nss ||
5354 				      status->nss > 8,
5355 				      "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5356 				      status->rate_idx, status->nss))
5357 				goto drop;
5358 			break;
5359 		case RX_ENC_EHT:
5360 			if (WARN_ONCE(status->rate_idx > 15 ||
5361 				      !status->nss ||
5362 				      status->nss > 8 ||
5363 				      status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5364 				      "Rate marked as an EHT rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5365 				      status->rate_idx, status->nss, status->eht.gi))
5366 				goto drop;
5367 			break;
5368 		default:
5369 			WARN_ON_ONCE(1);
5370 			fallthrough;
5371 		case RX_ENC_LEGACY:
5372 			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
5373 				goto drop;
5374 			rate = &sband->bitrates[status->rate_idx];
5375 		}
5376 	}
5377 
5378 	if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
5379 		goto drop;
5380 
5381 	status->rx_flags = 0;
5382 
5383 	kcov_remote_start_common(skb_get_kcov_handle(skb));
5384 
5385 	/*
5386 	 * Frames with failed FCS/PLCP checksum are not returned,
5387 	 * all other frames are returned without radiotap header
5388 	 * if it was previously present.
5389 	 * Also, frames with less than 16 bytes are dropped.
5390 	 */
5391 	if (!(status->flag & RX_FLAG_8023))
5392 		skb = ieee80211_rx_monitor(local, skb, rate);
5393 	if (skb) {
5394 		if ((status->flag & RX_FLAG_8023) ||
5395 			ieee80211_is_data_present(hdr->frame_control))
5396 			ieee80211_tpt_led_trig_rx(local, skb->len);
5397 
5398 		if (status->flag & RX_FLAG_8023)
5399 			__ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5400 		else
5401 			__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
5402 	}
5403 
5404 	kcov_remote_stop();
5405 	return;
5406  drop:
5407 	kfree_skb(skb);
5408 }
5409 EXPORT_SYMBOL(ieee80211_rx_list);
5410 
ieee80211_rx_napi(struct ieee80211_hw * hw,struct ieee80211_sta * pubsta,struct sk_buff * skb,struct napi_struct * napi)5411 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5412 		       struct sk_buff *skb, struct napi_struct *napi)
5413 {
5414 	struct sk_buff *tmp;
5415 	LIST_HEAD(list);
5416 
5417 
5418 	/*
5419 	 * key references and virtual interfaces are protected using RCU
5420 	 * and this requires that we are in a read-side RCU section during
5421 	 * receive processing
5422 	 */
5423 	rcu_read_lock();
5424 	ieee80211_rx_list(hw, pubsta, skb, &list);
5425 	rcu_read_unlock();
5426 
5427 	if (!napi) {
5428 		netif_receive_skb_list(&list);
5429 		return;
5430 	}
5431 
5432 	list_for_each_entry_safe(skb, tmp, &list, list) {
5433 		skb_list_del_init(skb);
5434 		napi_gro_receive(napi, skb);
5435 	}
5436 }
5437 EXPORT_SYMBOL(ieee80211_rx_napi);
5438 
5439 /* This is a version of the rx handler that can be called from hard irq
5440  * context. Post the skb on the queue and schedule the tasklet */
ieee80211_rx_irqsafe(struct ieee80211_hw * hw,struct sk_buff * skb)5441 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
5442 {
5443 	struct ieee80211_local *local = hw_to_local(hw);
5444 
5445 	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5446 
5447 	skb->pkt_type = IEEE80211_RX_MSG;
5448 	skb_queue_tail(&local->skb_queue, skb);
5449 	tasklet_schedule(&local->tasklet);
5450 }
5451 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
5452