1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * cfg80211 scan result handling
4 *
5 * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2016 Intel Deutschland GmbH
8 * Copyright (C) 2018-2023 Intel Corporation
9 */
10 #include <linux/kernel.h>
11 #include <linux/slab.h>
12 #include <linux/module.h>
13 #include <linux/netdevice.h>
14 #include <linux/wireless.h>
15 #include <linux/nl80211.h>
16 #include <linux/etherdevice.h>
17 #include <linux/crc32.h>
18 #include <linux/bitfield.h>
19 #include <net/arp.h>
20 #include <net/cfg80211.h>
21 #include <net/cfg80211-wext.h>
22 #include <net/iw_handler.h>
23 #include "core.h"
24 #include "nl80211.h"
25 #include "wext-compat.h"
26 #include "rdev-ops.h"
27
28 /**
29 * DOC: BSS tree/list structure
30 *
31 * At the top level, the BSS list is kept in both a list in each
32 * registered device (@bss_list) as well as an RB-tree for faster
33 * lookup. In the RB-tree, entries can be looked up using their
34 * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
35 * for other BSSes.
36 *
37 * Due to the possibility of hidden SSIDs, there's a second level
38 * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
39 * The hidden_list connects all BSSes belonging to a single AP
40 * that has a hidden SSID, and connects beacon and probe response
41 * entries. For a probe response entry for a hidden SSID, the
42 * hidden_beacon_bss pointer points to the BSS struct holding the
43 * beacon's information.
44 *
45 * Reference counting is done for all these references except for
46 * the hidden_list, so that a beacon BSS struct that is otherwise
47 * not referenced has one reference for being on the bss_list and
48 * one for each probe response entry that points to it using the
49 * hidden_beacon_bss pointer. When a BSS struct that has such a
50 * pointer is get/put, the refcount update is also propagated to
51 * the referenced struct, this ensure that it cannot get removed
52 * while somebody is using the probe response version.
53 *
54 * Note that the hidden_beacon_bss pointer never changes, due to
55 * the reference counting. Therefore, no locking is needed for
56 * it.
57 *
58 * Also note that the hidden_beacon_bss pointer is only relevant
59 * if the driver uses something other than the IEs, e.g. private
60 * data stored in the BSS struct, since the beacon IEs are
61 * also linked into the probe response struct.
62 */
63
64 /*
65 * Limit the number of BSS entries stored in mac80211. Each one is
66 * a bit over 4k at most, so this limits to roughly 4-5M of memory.
67 * If somebody wants to really attack this though, they'd likely
68 * use small beacons, and only one type of frame, limiting each of
69 * the entries to a much smaller size (in order to generate more
70 * entries in total, so overhead is bigger.)
71 */
72 static int bss_entries_limit = 1000;
73 module_param(bss_entries_limit, int, 0644);
74 MODULE_PARM_DESC(bss_entries_limit,
75 "limit to number of scan BSS entries (per wiphy, default 1000)");
76
77 #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ)
78
79 /**
80 * struct cfg80211_colocated_ap - colocated AP information
81 *
82 * @list: linked list to all colocated aPS
83 * @bssid: BSSID of the reported AP
84 * @ssid: SSID of the reported AP
85 * @ssid_len: length of the ssid
86 * @center_freq: frequency the reported AP is on
87 * @unsolicited_probe: the reported AP is part of an ESS, where all the APs
88 * that operate in the same channel as the reported AP and that might be
89 * detected by a STA receiving this frame, are transmitting unsolicited
90 * Probe Response frames every 20 TUs
91 * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
92 * @same_ssid: the reported AP has the same SSID as the reporting AP
93 * @multi_bss: the reported AP is part of a multiple BSSID set
94 * @transmitted_bssid: the reported AP is the transmitting BSSID
95 * @colocated_ess: all the APs that share the same ESS as the reported AP are
96 * colocated and can be discovered via legacy bands.
97 * @short_ssid_valid: short_ssid is valid and can be used
98 * @short_ssid: the short SSID for this SSID
99 * @psd_20: The 20MHz PSD EIRP of the primary 20MHz channel for the reported AP
100 */
101 struct cfg80211_colocated_ap {
102 struct list_head list;
103 u8 bssid[ETH_ALEN];
104 u8 ssid[IEEE80211_MAX_SSID_LEN];
105 size_t ssid_len;
106 u32 short_ssid;
107 u32 center_freq;
108 u8 unsolicited_probe:1,
109 oct_recommended:1,
110 same_ssid:1,
111 multi_bss:1,
112 transmitted_bssid:1,
113 colocated_ess:1,
114 short_ssid_valid:1;
115 s8 psd_20;
116 };
117
bss_free(struct cfg80211_internal_bss * bss)118 static void bss_free(struct cfg80211_internal_bss *bss)
119 {
120 struct cfg80211_bss_ies *ies;
121
122 if (WARN_ON(atomic_read(&bss->hold)))
123 return;
124
125 ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
126 if (ies && !bss->pub.hidden_beacon_bss)
127 kfree_rcu(ies, rcu_head);
128 ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
129 if (ies)
130 kfree_rcu(ies, rcu_head);
131
132 /*
133 * This happens when the module is removed, it doesn't
134 * really matter any more save for completeness
135 */
136 if (!list_empty(&bss->hidden_list))
137 list_del(&bss->hidden_list);
138
139 kfree(bss);
140 }
141
bss_ref_get(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)142 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
143 struct cfg80211_internal_bss *bss)
144 {
145 lockdep_assert_held(&rdev->bss_lock);
146
147 bss->refcount++;
148
149 if (bss->pub.hidden_beacon_bss)
150 bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
151
152 if (bss->pub.transmitted_bss)
153 bss_from_pub(bss->pub.transmitted_bss)->refcount++;
154 }
155
bss_ref_put(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)156 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
157 struct cfg80211_internal_bss *bss)
158 {
159 lockdep_assert_held(&rdev->bss_lock);
160
161 if (bss->pub.hidden_beacon_bss) {
162 struct cfg80211_internal_bss *hbss;
163
164 hbss = bss_from_pub(bss->pub.hidden_beacon_bss);
165 hbss->refcount--;
166 if (hbss->refcount == 0)
167 bss_free(hbss);
168 }
169
170 if (bss->pub.transmitted_bss) {
171 struct cfg80211_internal_bss *tbss;
172
173 tbss = bss_from_pub(bss->pub.transmitted_bss);
174 tbss->refcount--;
175 if (tbss->refcount == 0)
176 bss_free(tbss);
177 }
178
179 bss->refcount--;
180 if (bss->refcount == 0)
181 bss_free(bss);
182 }
183
__cfg80211_unlink_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)184 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
185 struct cfg80211_internal_bss *bss)
186 {
187 lockdep_assert_held(&rdev->bss_lock);
188
189 if (!list_empty(&bss->hidden_list)) {
190 /*
191 * don't remove the beacon entry if it has
192 * probe responses associated with it
193 */
194 if (!bss->pub.hidden_beacon_bss)
195 return false;
196 /*
197 * if it's a probe response entry break its
198 * link to the other entries in the group
199 */
200 list_del_init(&bss->hidden_list);
201 }
202
203 list_del_init(&bss->list);
204 list_del_init(&bss->pub.nontrans_list);
205 rb_erase(&bss->rbn, &rdev->bss_tree);
206 rdev->bss_entries--;
207 WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
208 "rdev bss entries[%d]/list[empty:%d] corruption\n",
209 rdev->bss_entries, list_empty(&rdev->bss_list));
210 bss_ref_put(rdev, bss);
211 return true;
212 }
213
cfg80211_is_element_inherited(const struct element * elem,const struct element * non_inherit_elem)214 bool cfg80211_is_element_inherited(const struct element *elem,
215 const struct element *non_inherit_elem)
216 {
217 u8 id_len, ext_id_len, i, loop_len, id;
218 const u8 *list;
219
220 if (elem->id == WLAN_EID_MULTIPLE_BSSID)
221 return false;
222
223 if (elem->id == WLAN_EID_EXTENSION && elem->datalen > 1 &&
224 elem->data[0] == WLAN_EID_EXT_EHT_MULTI_LINK)
225 return false;
226
227 if (!non_inherit_elem || non_inherit_elem->datalen < 2)
228 return true;
229
230 /*
231 * non inheritance element format is:
232 * ext ID (56) | IDs list len | list | extension IDs list len | list
233 * Both lists are optional. Both lengths are mandatory.
234 * This means valid length is:
235 * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
236 */
237 id_len = non_inherit_elem->data[1];
238 if (non_inherit_elem->datalen < 3 + id_len)
239 return true;
240
241 ext_id_len = non_inherit_elem->data[2 + id_len];
242 if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
243 return true;
244
245 if (elem->id == WLAN_EID_EXTENSION) {
246 if (!ext_id_len)
247 return true;
248 loop_len = ext_id_len;
249 list = &non_inherit_elem->data[3 + id_len];
250 id = elem->data[0];
251 } else {
252 if (!id_len)
253 return true;
254 loop_len = id_len;
255 list = &non_inherit_elem->data[2];
256 id = elem->id;
257 }
258
259 for (i = 0; i < loop_len; i++) {
260 if (list[i] == id)
261 return false;
262 }
263
264 return true;
265 }
266 EXPORT_SYMBOL(cfg80211_is_element_inherited);
267
cfg80211_copy_elem_with_frags(const struct element * elem,const u8 * ie,size_t ie_len,u8 ** pos,u8 * buf,size_t buf_len)268 static size_t cfg80211_copy_elem_with_frags(const struct element *elem,
269 const u8 *ie, size_t ie_len,
270 u8 **pos, u8 *buf, size_t buf_len)
271 {
272 if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len ||
273 elem->data + elem->datalen > ie + ie_len))
274 return 0;
275
276 if (elem->datalen + 2 > buf + buf_len - *pos)
277 return 0;
278
279 memcpy(*pos, elem, elem->datalen + 2);
280 *pos += elem->datalen + 2;
281
282 /* Finish if it is not fragmented */
283 if (elem->datalen != 255)
284 return *pos - buf;
285
286 ie_len = ie + ie_len - elem->data - elem->datalen;
287 ie = (const u8 *)elem->data + elem->datalen;
288
289 for_each_element(elem, ie, ie_len) {
290 if (elem->id != WLAN_EID_FRAGMENT)
291 break;
292
293 if (elem->datalen + 2 > buf + buf_len - *pos)
294 return 0;
295
296 memcpy(*pos, elem, elem->datalen + 2);
297 *pos += elem->datalen + 2;
298
299 if (elem->datalen != 255)
300 break;
301 }
302
303 return *pos - buf;
304 }
305
cfg80211_gen_new_ie(const u8 * ie,size_t ielen,const u8 * subie,size_t subie_len,u8 * new_ie,size_t new_ie_len)306 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
307 const u8 *subie, size_t subie_len,
308 u8 *new_ie, size_t new_ie_len)
309 {
310 const struct element *non_inherit_elem, *parent, *sub;
311 u8 *pos = new_ie;
312 u8 id, ext_id;
313 unsigned int match_len;
314
315 non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
316 subie, subie_len);
317
318 /* We copy the elements one by one from the parent to the generated
319 * elements.
320 * If they are not inherited (included in subie or in the non
321 * inheritance element), then we copy all occurrences the first time
322 * we see this element type.
323 */
324 for_each_element(parent, ie, ielen) {
325 if (parent->id == WLAN_EID_FRAGMENT)
326 continue;
327
328 if (parent->id == WLAN_EID_EXTENSION) {
329 if (parent->datalen < 1)
330 continue;
331
332 id = WLAN_EID_EXTENSION;
333 ext_id = parent->data[0];
334 match_len = 1;
335 } else {
336 id = parent->id;
337 match_len = 0;
338 }
339
340 /* Find first occurrence in subie */
341 sub = cfg80211_find_elem_match(id, subie, subie_len,
342 &ext_id, match_len, 0);
343
344 /* Copy from parent if not in subie and inherited */
345 if (!sub &&
346 cfg80211_is_element_inherited(parent, non_inherit_elem)) {
347 if (!cfg80211_copy_elem_with_frags(parent,
348 ie, ielen,
349 &pos, new_ie,
350 new_ie_len))
351 return 0;
352
353 continue;
354 }
355
356 /* Already copied if an earlier element had the same type */
357 if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie,
358 &ext_id, match_len, 0))
359 continue;
360
361 /* Not inheriting, copy all similar elements from subie */
362 while (sub) {
363 if (!cfg80211_copy_elem_with_frags(sub,
364 subie, subie_len,
365 &pos, new_ie,
366 new_ie_len))
367 return 0;
368
369 sub = cfg80211_find_elem_match(id,
370 sub->data + sub->datalen,
371 subie_len + subie -
372 (sub->data +
373 sub->datalen),
374 &ext_id, match_len, 0);
375 }
376 }
377
378 /* The above misses elements that are included in subie but not in the
379 * parent, so do a pass over subie and append those.
380 * Skip the non-tx BSSID caps and non-inheritance element.
381 */
382 for_each_element(sub, subie, subie_len) {
383 if (sub->id == WLAN_EID_NON_TX_BSSID_CAP)
384 continue;
385
386 if (sub->id == WLAN_EID_FRAGMENT)
387 continue;
388
389 if (sub->id == WLAN_EID_EXTENSION) {
390 if (sub->datalen < 1)
391 continue;
392
393 id = WLAN_EID_EXTENSION;
394 ext_id = sub->data[0];
395 match_len = 1;
396
397 if (ext_id == WLAN_EID_EXT_NON_INHERITANCE)
398 continue;
399 } else {
400 id = sub->id;
401 match_len = 0;
402 }
403
404 /* Processed if one was included in the parent */
405 if (cfg80211_find_elem_match(id, ie, ielen,
406 &ext_id, match_len, 0))
407 continue;
408
409 if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len,
410 &pos, new_ie, new_ie_len))
411 return 0;
412 }
413
414 return pos - new_ie;
415 }
416
is_bss(struct cfg80211_bss * a,const u8 * bssid,const u8 * ssid,size_t ssid_len)417 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
418 const u8 *ssid, size_t ssid_len)
419 {
420 const struct cfg80211_bss_ies *ies;
421 const struct element *ssid_elem;
422
423 if (bssid && !ether_addr_equal(a->bssid, bssid))
424 return false;
425
426 if (!ssid)
427 return true;
428
429 ies = rcu_access_pointer(a->ies);
430 if (!ies)
431 return false;
432 ssid_elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
433 if (!ssid_elem)
434 return false;
435 if (ssid_elem->datalen != ssid_len)
436 return false;
437 return memcmp(ssid_elem->data, ssid, ssid_len) == 0;
438 }
439
440 static int
cfg80211_add_nontrans_list(struct cfg80211_bss * trans_bss,struct cfg80211_bss * nontrans_bss)441 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
442 struct cfg80211_bss *nontrans_bss)
443 {
444 const struct element *ssid_elem;
445 struct cfg80211_bss *bss = NULL;
446
447 rcu_read_lock();
448 ssid_elem = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID);
449 if (!ssid_elem) {
450 rcu_read_unlock();
451 return -EINVAL;
452 }
453
454 /* check if nontrans_bss is in the list */
455 list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
456 if (is_bss(bss, nontrans_bss->bssid, ssid_elem->data,
457 ssid_elem->datalen)) {
458 rcu_read_unlock();
459 return 0;
460 }
461 }
462
463 rcu_read_unlock();
464
465 /*
466 * This is a bit weird - it's not on the list, but already on another
467 * one! The only way that could happen is if there's some BSSID/SSID
468 * shared by multiple APs in their multi-BSSID profiles, potentially
469 * with hidden SSID mixed in ... ignore it.
470 */
471 if (!list_empty(&nontrans_bss->nontrans_list))
472 return -EINVAL;
473
474 /* add to the list */
475 list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
476 return 0;
477 }
478
__cfg80211_bss_expire(struct cfg80211_registered_device * rdev,unsigned long expire_time)479 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
480 unsigned long expire_time)
481 {
482 struct cfg80211_internal_bss *bss, *tmp;
483 bool expired = false;
484
485 lockdep_assert_held(&rdev->bss_lock);
486
487 list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
488 if (atomic_read(&bss->hold))
489 continue;
490 if (!time_after(expire_time, bss->ts))
491 continue;
492
493 if (__cfg80211_unlink_bss(rdev, bss))
494 expired = true;
495 }
496
497 if (expired)
498 rdev->bss_generation++;
499 }
500
cfg80211_bss_expire_oldest(struct cfg80211_registered_device * rdev)501 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
502 {
503 struct cfg80211_internal_bss *bss, *oldest = NULL;
504 bool ret;
505
506 lockdep_assert_held(&rdev->bss_lock);
507
508 list_for_each_entry(bss, &rdev->bss_list, list) {
509 if (atomic_read(&bss->hold))
510 continue;
511
512 if (!list_empty(&bss->hidden_list) &&
513 !bss->pub.hidden_beacon_bss)
514 continue;
515
516 if (oldest && time_before(oldest->ts, bss->ts))
517 continue;
518 oldest = bss;
519 }
520
521 if (WARN_ON(!oldest))
522 return false;
523
524 /*
525 * The callers make sure to increase rdev->bss_generation if anything
526 * gets removed (and a new entry added), so there's no need to also do
527 * it here.
528 */
529
530 ret = __cfg80211_unlink_bss(rdev, oldest);
531 WARN_ON(!ret);
532 return ret;
533 }
534
cfg80211_parse_bss_param(u8 data,struct cfg80211_colocated_ap * coloc_ap)535 static u8 cfg80211_parse_bss_param(u8 data,
536 struct cfg80211_colocated_ap *coloc_ap)
537 {
538 coloc_ap->oct_recommended =
539 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
540 coloc_ap->same_ssid =
541 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
542 coloc_ap->multi_bss =
543 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
544 coloc_ap->transmitted_bssid =
545 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
546 coloc_ap->unsolicited_probe =
547 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
548 coloc_ap->colocated_ess =
549 u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
550
551 return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
552 }
553
cfg80211_calc_short_ssid(const struct cfg80211_bss_ies * ies,const struct element ** elem,u32 * s_ssid)554 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
555 const struct element **elem, u32 *s_ssid)
556 {
557
558 *elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
559 if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
560 return -EINVAL;
561
562 *s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
563 return 0;
564 }
565
cfg80211_free_coloc_ap_list(struct list_head * coloc_ap_list)566 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
567 {
568 struct cfg80211_colocated_ap *ap, *tmp_ap;
569
570 list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
571 list_del(&ap->list);
572 kfree(ap);
573 }
574 }
575
cfg80211_parse_ap_info(struct cfg80211_colocated_ap * entry,const u8 * pos,u8 length,const struct element * ssid_elem,u32 s_ssid_tmp)576 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
577 const u8 *pos, u8 length,
578 const struct element *ssid_elem,
579 u32 s_ssid_tmp)
580 {
581 u8 bss_params;
582
583 entry->psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
584
585 /* The length is already verified by the caller to contain bss_params */
586 if (length > sizeof(struct ieee80211_tbtt_info_7_8_9)) {
587 struct ieee80211_tbtt_info_ge_11 *tbtt_info = (void *)pos;
588
589 memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
590 entry->short_ssid = le32_to_cpu(tbtt_info->short_ssid);
591 entry->short_ssid_valid = true;
592
593 bss_params = tbtt_info->bss_params;
594
595 /* Ignore disabled links */
596 if (length >= offsetofend(typeof(*tbtt_info), mld_params)) {
597 if (le16_get_bits(tbtt_info->mld_params.params,
598 IEEE80211_RNR_MLD_PARAMS_DISABLED_LINK))
599 return -EINVAL;
600 }
601
602 if (length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
603 psd_20))
604 entry->psd_20 = tbtt_info->psd_20;
605 } else {
606 struct ieee80211_tbtt_info_7_8_9 *tbtt_info = (void *)pos;
607
608 memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
609
610 bss_params = tbtt_info->bss_params;
611
612 if (length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
613 psd_20))
614 entry->psd_20 = tbtt_info->psd_20;
615 }
616
617 /* ignore entries with invalid BSSID */
618 if (!is_valid_ether_addr(entry->bssid))
619 return -EINVAL;
620
621 /* skip non colocated APs */
622 if (!cfg80211_parse_bss_param(bss_params, entry))
623 return -EINVAL;
624
625 /* no information about the short ssid. Consider the entry valid
626 * for now. It would later be dropped in case there are explicit
627 * SSIDs that need to be matched
628 */
629 if (!entry->same_ssid && !entry->short_ssid_valid)
630 return 0;
631
632 if (entry->same_ssid) {
633 entry->short_ssid = s_ssid_tmp;
634 entry->short_ssid_valid = true;
635
636 /*
637 * This is safe because we validate datalen in
638 * cfg80211_parse_colocated_ap(), before calling this
639 * function.
640 */
641 memcpy(&entry->ssid, &ssid_elem->data, ssid_elem->datalen);
642 entry->ssid_len = ssid_elem->datalen;
643 }
644
645 return 0;
646 }
647
cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies * ies,struct list_head * list)648 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
649 struct list_head *list)
650 {
651 struct ieee80211_neighbor_ap_info *ap_info;
652 const struct element *elem, *ssid_elem;
653 const u8 *pos, *end;
654 u32 s_ssid_tmp;
655 int n_coloc = 0, ret;
656 LIST_HEAD(ap_list);
657
658 ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp);
659 if (ret)
660 return 0;
661
662 for_each_element_id(elem, WLAN_EID_REDUCED_NEIGHBOR_REPORT,
663 ies->data, ies->len) {
664 pos = elem->data;
665 end = elem->data + elem->datalen;
666
667 /* RNR IE may contain more than one NEIGHBOR_AP_INFO */
668 while (pos + sizeof(*ap_info) <= end) {
669 enum nl80211_band band;
670 int freq;
671 u8 length, i, count;
672
673 ap_info = (void *)pos;
674 count = u8_get_bits(ap_info->tbtt_info_hdr,
675 IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
676 length = ap_info->tbtt_info_len;
677
678 pos += sizeof(*ap_info);
679
680 if (!ieee80211_operating_class_to_band(ap_info->op_class,
681 &band))
682 break;
683
684 freq = ieee80211_channel_to_frequency(ap_info->channel,
685 band);
686
687 if (end - pos < count * length)
688 break;
689
690 if (u8_get_bits(ap_info->tbtt_info_hdr,
691 IEEE80211_AP_INFO_TBTT_HDR_TYPE) !=
692 IEEE80211_TBTT_INFO_TYPE_TBTT) {
693 pos += count * length;
694 continue;
695 }
696
697 /* TBTT info must include bss param + BSSID +
698 * (short SSID or same_ssid bit to be set).
699 * ignore other options, and move to the
700 * next AP info
701 */
702 if (band != NL80211_BAND_6GHZ ||
703 !(length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
704 bss_params) ||
705 length == sizeof(struct ieee80211_tbtt_info_7_8_9) ||
706 length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
707 bss_params))) {
708 pos += count * length;
709 continue;
710 }
711
712 for (i = 0; i < count; i++) {
713 struct cfg80211_colocated_ap *entry;
714
715 entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
716 GFP_ATOMIC);
717
718 if (!entry)
719 goto error;
720
721 entry->center_freq = freq;
722
723 if (!cfg80211_parse_ap_info(entry, pos, length,
724 ssid_elem,
725 s_ssid_tmp)) {
726 n_coloc++;
727 list_add_tail(&entry->list, &ap_list);
728 } else {
729 kfree(entry);
730 }
731
732 pos += length;
733 }
734 }
735
736 error:
737 if (pos != end) {
738 cfg80211_free_coloc_ap_list(&ap_list);
739 return 0;
740 }
741 }
742
743 list_splice_tail(&ap_list, list);
744 return n_coloc;
745 }
746
cfg80211_scan_req_add_chan(struct cfg80211_scan_request * request,struct ieee80211_channel * chan,bool add_to_6ghz)747 static void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
748 struct ieee80211_channel *chan,
749 bool add_to_6ghz)
750 {
751 int i;
752 u32 n_channels = request->n_channels;
753 struct cfg80211_scan_6ghz_params *params =
754 &request->scan_6ghz_params[request->n_6ghz_params];
755
756 for (i = 0; i < n_channels; i++) {
757 if (request->channels[i] == chan) {
758 if (add_to_6ghz)
759 params->channel_idx = i;
760 return;
761 }
762 }
763
764 request->channels[n_channels] = chan;
765 if (add_to_6ghz)
766 request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
767 n_channels;
768
769 request->n_channels++;
770 }
771
cfg80211_find_ssid_match(struct cfg80211_colocated_ap * ap,struct cfg80211_scan_request * request)772 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
773 struct cfg80211_scan_request *request)
774 {
775 int i;
776 u32 s_ssid;
777
778 for (i = 0; i < request->n_ssids; i++) {
779 /* wildcard ssid in the scan request */
780 if (!request->ssids[i].ssid_len) {
781 if (ap->multi_bss && !ap->transmitted_bssid)
782 continue;
783
784 return true;
785 }
786
787 if (ap->ssid_len &&
788 ap->ssid_len == request->ssids[i].ssid_len) {
789 if (!memcmp(request->ssids[i].ssid, ap->ssid,
790 ap->ssid_len))
791 return true;
792 } else if (ap->short_ssid_valid) {
793 s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
794 request->ssids[i].ssid_len);
795
796 if (ap->short_ssid == s_ssid)
797 return true;
798 }
799 }
800
801 return false;
802 }
803
cfg80211_scan_6ghz(struct cfg80211_registered_device * rdev)804 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
805 {
806 u8 i;
807 struct cfg80211_colocated_ap *ap;
808 int n_channels, count = 0, err;
809 struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
810 LIST_HEAD(coloc_ap_list);
811 bool need_scan_psc = true;
812 const struct ieee80211_sband_iftype_data *iftd;
813 size_t size, offs_ssids, offs_6ghz_params, offs_ies;
814
815 rdev_req->scan_6ghz = true;
816
817 if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
818 return -EOPNOTSUPP;
819
820 iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
821 rdev_req->wdev->iftype);
822 if (!iftd || !iftd->he_cap.has_he)
823 return -EOPNOTSUPP;
824
825 n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
826
827 if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
828 struct cfg80211_internal_bss *intbss;
829
830 spin_lock_bh(&rdev->bss_lock);
831 list_for_each_entry(intbss, &rdev->bss_list, list) {
832 struct cfg80211_bss *res = &intbss->pub;
833 const struct cfg80211_bss_ies *ies;
834
835 ies = rcu_access_pointer(res->ies);
836 count += cfg80211_parse_colocated_ap(ies,
837 &coloc_ap_list);
838 }
839 spin_unlock_bh(&rdev->bss_lock);
840 }
841
842 size = struct_size(request, channels, n_channels);
843 offs_ssids = size;
844 size += sizeof(*request->ssids) * rdev_req->n_ssids;
845 offs_6ghz_params = size;
846 size += sizeof(*request->scan_6ghz_params) * count;
847 offs_ies = size;
848 size += rdev_req->ie_len;
849
850 request = kzalloc(size, GFP_KERNEL);
851 if (!request) {
852 cfg80211_free_coloc_ap_list(&coloc_ap_list);
853 return -ENOMEM;
854 }
855
856 *request = *rdev_req;
857 request->n_channels = 0;
858 request->n_6ghz_params = 0;
859 if (rdev_req->n_ssids) {
860 /*
861 * Add the ssids from the parent scan request to the new
862 * scan request, so the driver would be able to use them
863 * in its probe requests to discover hidden APs on PSC
864 * channels.
865 */
866 request->ssids = (void *)request + offs_ssids;
867 memcpy(request->ssids, rdev_req->ssids,
868 sizeof(*request->ssids) * request->n_ssids);
869 }
870 request->scan_6ghz_params = (void *)request + offs_6ghz_params;
871
872 if (rdev_req->ie_len) {
873 void *ie = (void *)request + offs_ies;
874
875 memcpy(ie, rdev_req->ie, rdev_req->ie_len);
876 request->ie = ie;
877 }
878
879 /*
880 * PSC channels should not be scanned in case of direct scan with 1 SSID
881 * and at least one of the reported co-located APs with same SSID
882 * indicating that all APs in the same ESS are co-located
883 */
884 if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) {
885 list_for_each_entry(ap, &coloc_ap_list, list) {
886 if (ap->colocated_ess &&
887 cfg80211_find_ssid_match(ap, request)) {
888 need_scan_psc = false;
889 break;
890 }
891 }
892 }
893
894 /*
895 * add to the scan request the channels that need to be scanned
896 * regardless of the collocated APs (PSC channels or all channels
897 * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
898 */
899 for (i = 0; i < rdev_req->n_channels; i++) {
900 if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
901 ((need_scan_psc &&
902 cfg80211_channel_is_psc(rdev_req->channels[i])) ||
903 !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
904 cfg80211_scan_req_add_chan(request,
905 rdev_req->channels[i],
906 false);
907 }
908 }
909
910 if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
911 goto skip;
912
913 list_for_each_entry(ap, &coloc_ap_list, list) {
914 bool found = false;
915 struct cfg80211_scan_6ghz_params *scan_6ghz_params =
916 &request->scan_6ghz_params[request->n_6ghz_params];
917 struct ieee80211_channel *chan =
918 ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
919
920 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
921 continue;
922
923 for (i = 0; i < rdev_req->n_channels; i++) {
924 if (rdev_req->channels[i] == chan)
925 found = true;
926 }
927
928 if (!found)
929 continue;
930
931 if (request->n_ssids > 0 &&
932 !cfg80211_find_ssid_match(ap, request))
933 continue;
934
935 if (!is_broadcast_ether_addr(request->bssid) &&
936 !ether_addr_equal(request->bssid, ap->bssid))
937 continue;
938
939 if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
940 continue;
941
942 cfg80211_scan_req_add_chan(request, chan, true);
943 memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
944 scan_6ghz_params->short_ssid = ap->short_ssid;
945 scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
946 scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
947 scan_6ghz_params->psd_20 = ap->psd_20;
948
949 /*
950 * If a PSC channel is added to the scan and 'need_scan_psc' is
951 * set to false, then all the APs that the scan logic is
952 * interested with on the channel are collocated and thus there
953 * is no need to perform the initial PSC channel listen.
954 */
955 if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
956 scan_6ghz_params->psc_no_listen = true;
957
958 request->n_6ghz_params++;
959 }
960
961 skip:
962 cfg80211_free_coloc_ap_list(&coloc_ap_list);
963
964 if (request->n_channels) {
965 struct cfg80211_scan_request *old = rdev->int_scan_req;
966
967 rdev->int_scan_req = request;
968
969 /*
970 * If this scan follows a previous scan, save the scan start
971 * info from the first part of the scan
972 */
973 if (old)
974 rdev->int_scan_req->info = old->info;
975
976 err = rdev_scan(rdev, request);
977 if (err) {
978 rdev->int_scan_req = old;
979 kfree(request);
980 } else {
981 kfree(old);
982 }
983
984 return err;
985 }
986
987 kfree(request);
988 return -EINVAL;
989 }
990
cfg80211_scan(struct cfg80211_registered_device * rdev)991 int cfg80211_scan(struct cfg80211_registered_device *rdev)
992 {
993 struct cfg80211_scan_request *request;
994 struct cfg80211_scan_request *rdev_req = rdev->scan_req;
995 u32 n_channels = 0, idx, i;
996
997 if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
998 return rdev_scan(rdev, rdev_req);
999
1000 for (i = 0; i < rdev_req->n_channels; i++) {
1001 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
1002 n_channels++;
1003 }
1004
1005 if (!n_channels)
1006 return cfg80211_scan_6ghz(rdev);
1007
1008 request = kzalloc(struct_size(request, channels, n_channels),
1009 GFP_KERNEL);
1010 if (!request)
1011 return -ENOMEM;
1012
1013 *request = *rdev_req;
1014 request->n_channels = n_channels;
1015
1016 for (i = idx = 0; i < rdev_req->n_channels; i++) {
1017 if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
1018 request->channels[idx++] = rdev_req->channels[i];
1019 }
1020
1021 rdev_req->scan_6ghz = false;
1022 rdev->int_scan_req = request;
1023 return rdev_scan(rdev, request);
1024 }
1025
___cfg80211_scan_done(struct cfg80211_registered_device * rdev,bool send_message)1026 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
1027 bool send_message)
1028 {
1029 struct cfg80211_scan_request *request, *rdev_req;
1030 struct wireless_dev *wdev;
1031 struct sk_buff *msg;
1032 #ifdef CONFIG_CFG80211_WEXT
1033 union iwreq_data wrqu;
1034 #endif
1035
1036 lockdep_assert_held(&rdev->wiphy.mtx);
1037
1038 if (rdev->scan_msg) {
1039 nl80211_send_scan_msg(rdev, rdev->scan_msg);
1040 rdev->scan_msg = NULL;
1041 return;
1042 }
1043
1044 rdev_req = rdev->scan_req;
1045 if (!rdev_req)
1046 return;
1047
1048 wdev = rdev_req->wdev;
1049 request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
1050
1051 if (wdev_running(wdev) &&
1052 (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
1053 !rdev_req->scan_6ghz && !request->info.aborted &&
1054 !cfg80211_scan_6ghz(rdev))
1055 return;
1056
1057 /*
1058 * This must be before sending the other events!
1059 * Otherwise, wpa_supplicant gets completely confused with
1060 * wext events.
1061 */
1062 if (wdev->netdev)
1063 cfg80211_sme_scan_done(wdev->netdev);
1064
1065 if (!request->info.aborted &&
1066 request->flags & NL80211_SCAN_FLAG_FLUSH) {
1067 /* flush entries from previous scans */
1068 spin_lock_bh(&rdev->bss_lock);
1069 __cfg80211_bss_expire(rdev, request->scan_start);
1070 spin_unlock_bh(&rdev->bss_lock);
1071 }
1072
1073 msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
1074
1075 #ifdef CONFIG_CFG80211_WEXT
1076 if (wdev->netdev && !request->info.aborted) {
1077 memset(&wrqu, 0, sizeof(wrqu));
1078
1079 wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
1080 }
1081 #endif
1082
1083 dev_put(wdev->netdev);
1084
1085 kfree(rdev->int_scan_req);
1086 rdev->int_scan_req = NULL;
1087
1088 kfree(rdev->scan_req);
1089 rdev->scan_req = NULL;
1090
1091 if (!send_message)
1092 rdev->scan_msg = msg;
1093 else
1094 nl80211_send_scan_msg(rdev, msg);
1095 }
1096
__cfg80211_scan_done(struct wiphy * wiphy,struct wiphy_work * wk)1097 void __cfg80211_scan_done(struct wiphy *wiphy, struct wiphy_work *wk)
1098 {
1099 ___cfg80211_scan_done(wiphy_to_rdev(wiphy), true);
1100 }
1101
cfg80211_scan_done(struct cfg80211_scan_request * request,struct cfg80211_scan_info * info)1102 void cfg80211_scan_done(struct cfg80211_scan_request *request,
1103 struct cfg80211_scan_info *info)
1104 {
1105 struct cfg80211_scan_info old_info = request->info;
1106
1107 trace_cfg80211_scan_done(request, info);
1108 WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1109 request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1110
1111 request->info = *info;
1112
1113 /*
1114 * In case the scan is split, the scan_start_tsf and tsf_bssid should
1115 * be of the first part. In such a case old_info.scan_start_tsf should
1116 * be non zero.
1117 */
1118 if (request->scan_6ghz && old_info.scan_start_tsf) {
1119 request->info.scan_start_tsf = old_info.scan_start_tsf;
1120 memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1121 sizeof(request->info.tsf_bssid));
1122 }
1123
1124 request->notified = true;
1125 wiphy_work_queue(request->wiphy,
1126 &wiphy_to_rdev(request->wiphy)->scan_done_wk);
1127 }
1128 EXPORT_SYMBOL(cfg80211_scan_done);
1129
cfg80211_add_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req)1130 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1131 struct cfg80211_sched_scan_request *req)
1132 {
1133 lockdep_assert_held(&rdev->wiphy.mtx);
1134
1135 list_add_rcu(&req->list, &rdev->sched_scan_req_list);
1136 }
1137
cfg80211_del_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req)1138 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1139 struct cfg80211_sched_scan_request *req)
1140 {
1141 lockdep_assert_held(&rdev->wiphy.mtx);
1142
1143 list_del_rcu(&req->list);
1144 kfree_rcu(req, rcu_head);
1145 }
1146
1147 static struct cfg80211_sched_scan_request *
cfg80211_find_sched_scan_req(struct cfg80211_registered_device * rdev,u64 reqid)1148 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1149 {
1150 struct cfg80211_sched_scan_request *pos;
1151
1152 list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1153 lockdep_is_held(&rdev->wiphy.mtx)) {
1154 if (pos->reqid == reqid)
1155 return pos;
1156 }
1157 return NULL;
1158 }
1159
1160 /*
1161 * Determines if a scheduled scan request can be handled. When a legacy
1162 * scheduled scan is running no other scheduled scan is allowed regardless
1163 * whether the request is for legacy or multi-support scan. When a multi-support
1164 * scheduled scan is running a request for legacy scan is not allowed. In this
1165 * case a request for multi-support scan can be handled if resources are
1166 * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1167 */
cfg80211_sched_scan_req_possible(struct cfg80211_registered_device * rdev,bool want_multi)1168 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1169 bool want_multi)
1170 {
1171 struct cfg80211_sched_scan_request *pos;
1172 int i = 0;
1173
1174 list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1175 /* request id zero means legacy in progress */
1176 if (!i && !pos->reqid)
1177 return -EINPROGRESS;
1178 i++;
1179 }
1180
1181 if (i) {
1182 /* no legacy allowed when multi request(s) are active */
1183 if (!want_multi)
1184 return -EINPROGRESS;
1185
1186 /* resource limit reached */
1187 if (i == rdev->wiphy.max_sched_scan_reqs)
1188 return -ENOSPC;
1189 }
1190 return 0;
1191 }
1192
cfg80211_sched_scan_results_wk(struct work_struct * work)1193 void cfg80211_sched_scan_results_wk(struct work_struct *work)
1194 {
1195 struct cfg80211_registered_device *rdev;
1196 struct cfg80211_sched_scan_request *req, *tmp;
1197
1198 rdev = container_of(work, struct cfg80211_registered_device,
1199 sched_scan_res_wk);
1200
1201 wiphy_lock(&rdev->wiphy);
1202 list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1203 if (req->report_results) {
1204 req->report_results = false;
1205 if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1206 /* flush entries from previous scans */
1207 spin_lock_bh(&rdev->bss_lock);
1208 __cfg80211_bss_expire(rdev, req->scan_start);
1209 spin_unlock_bh(&rdev->bss_lock);
1210 req->scan_start = jiffies;
1211 }
1212 nl80211_send_sched_scan(req,
1213 NL80211_CMD_SCHED_SCAN_RESULTS);
1214 }
1215 }
1216 wiphy_unlock(&rdev->wiphy);
1217 }
1218
cfg80211_sched_scan_results(struct wiphy * wiphy,u64 reqid)1219 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1220 {
1221 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1222 struct cfg80211_sched_scan_request *request;
1223
1224 trace_cfg80211_sched_scan_results(wiphy, reqid);
1225 /* ignore if we're not scanning */
1226
1227 rcu_read_lock();
1228 request = cfg80211_find_sched_scan_req(rdev, reqid);
1229 if (request) {
1230 request->report_results = true;
1231 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
1232 }
1233 rcu_read_unlock();
1234 }
1235 EXPORT_SYMBOL(cfg80211_sched_scan_results);
1236
cfg80211_sched_scan_stopped_locked(struct wiphy * wiphy,u64 reqid)1237 void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid)
1238 {
1239 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1240
1241 lockdep_assert_held(&wiphy->mtx);
1242
1243 trace_cfg80211_sched_scan_stopped(wiphy, reqid);
1244
1245 __cfg80211_stop_sched_scan(rdev, reqid, true);
1246 }
1247 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked);
1248
cfg80211_sched_scan_stopped(struct wiphy * wiphy,u64 reqid)1249 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1250 {
1251 wiphy_lock(wiphy);
1252 cfg80211_sched_scan_stopped_locked(wiphy, reqid);
1253 wiphy_unlock(wiphy);
1254 }
1255 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1256
cfg80211_stop_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req,bool driver_initiated)1257 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1258 struct cfg80211_sched_scan_request *req,
1259 bool driver_initiated)
1260 {
1261 lockdep_assert_held(&rdev->wiphy.mtx);
1262
1263 if (!driver_initiated) {
1264 int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
1265 if (err)
1266 return err;
1267 }
1268
1269 nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
1270
1271 cfg80211_del_sched_scan_req(rdev, req);
1272
1273 return 0;
1274 }
1275
__cfg80211_stop_sched_scan(struct cfg80211_registered_device * rdev,u64 reqid,bool driver_initiated)1276 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1277 u64 reqid, bool driver_initiated)
1278 {
1279 struct cfg80211_sched_scan_request *sched_scan_req;
1280
1281 lockdep_assert_held(&rdev->wiphy.mtx);
1282
1283 sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1284 if (!sched_scan_req)
1285 return -ENOENT;
1286
1287 return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
1288 driver_initiated);
1289 }
1290
cfg80211_bss_age(struct cfg80211_registered_device * rdev,unsigned long age_secs)1291 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1292 unsigned long age_secs)
1293 {
1294 struct cfg80211_internal_bss *bss;
1295 unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
1296
1297 spin_lock_bh(&rdev->bss_lock);
1298 list_for_each_entry(bss, &rdev->bss_list, list)
1299 bss->ts -= age_jiffies;
1300 spin_unlock_bh(&rdev->bss_lock);
1301 }
1302
cfg80211_bss_expire(struct cfg80211_registered_device * rdev)1303 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1304 {
1305 __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1306 }
1307
cfg80211_bss_flush(struct wiphy * wiphy)1308 void cfg80211_bss_flush(struct wiphy *wiphy)
1309 {
1310 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1311
1312 spin_lock_bh(&rdev->bss_lock);
1313 __cfg80211_bss_expire(rdev, jiffies);
1314 spin_unlock_bh(&rdev->bss_lock);
1315 }
1316 EXPORT_SYMBOL(cfg80211_bss_flush);
1317
1318 const struct element *
cfg80211_find_elem_match(u8 eid,const u8 * ies,unsigned int len,const u8 * match,unsigned int match_len,unsigned int match_offset)1319 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1320 const u8 *match, unsigned int match_len,
1321 unsigned int match_offset)
1322 {
1323 const struct element *elem;
1324
1325 for_each_element_id(elem, eid, ies, len) {
1326 if (elem->datalen >= match_offset + match_len &&
1327 !memcmp(elem->data + match_offset, match, match_len))
1328 return elem;
1329 }
1330
1331 return NULL;
1332 }
1333 EXPORT_SYMBOL(cfg80211_find_elem_match);
1334
cfg80211_find_vendor_elem(unsigned int oui,int oui_type,const u8 * ies,unsigned int len)1335 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1336 const u8 *ies,
1337 unsigned int len)
1338 {
1339 const struct element *elem;
1340 u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1341 int match_len = (oui_type < 0) ? 3 : sizeof(match);
1342
1343 if (WARN_ON(oui_type > 0xff))
1344 return NULL;
1345
1346 elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1347 match, match_len, 0);
1348
1349 if (!elem || elem->datalen < 4)
1350 return NULL;
1351
1352 return elem;
1353 }
1354 EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1355
1356 /**
1357 * enum bss_compare_mode - BSS compare mode
1358 * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1359 * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1360 * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1361 */
1362 enum bss_compare_mode {
1363 BSS_CMP_REGULAR,
1364 BSS_CMP_HIDE_ZLEN,
1365 BSS_CMP_HIDE_NUL,
1366 };
1367
cmp_bss(struct cfg80211_bss * a,struct cfg80211_bss * b,enum bss_compare_mode mode)1368 static int cmp_bss(struct cfg80211_bss *a,
1369 struct cfg80211_bss *b,
1370 enum bss_compare_mode mode)
1371 {
1372 const struct cfg80211_bss_ies *a_ies, *b_ies;
1373 const u8 *ie1 = NULL;
1374 const u8 *ie2 = NULL;
1375 int i, r;
1376
1377 if (a->channel != b->channel)
1378 return (b->channel->center_freq * 1000 + b->channel->freq_offset) -
1379 (a->channel->center_freq * 1000 + a->channel->freq_offset);
1380
1381 a_ies = rcu_access_pointer(a->ies);
1382 if (!a_ies)
1383 return -1;
1384 b_ies = rcu_access_pointer(b->ies);
1385 if (!b_ies)
1386 return 1;
1387
1388 if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1389 ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1390 a_ies->data, a_ies->len);
1391 if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1392 ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1393 b_ies->data, b_ies->len);
1394 if (ie1 && ie2) {
1395 int mesh_id_cmp;
1396
1397 if (ie1[1] == ie2[1])
1398 mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1399 else
1400 mesh_id_cmp = ie2[1] - ie1[1];
1401
1402 ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1403 a_ies->data, a_ies->len);
1404 ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1405 b_ies->data, b_ies->len);
1406 if (ie1 && ie2) {
1407 if (mesh_id_cmp)
1408 return mesh_id_cmp;
1409 if (ie1[1] != ie2[1])
1410 return ie2[1] - ie1[1];
1411 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1412 }
1413 }
1414
1415 r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
1416 if (r)
1417 return r;
1418
1419 ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
1420 ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
1421
1422 if (!ie1 && !ie2)
1423 return 0;
1424
1425 /*
1426 * Note that with "hide_ssid", the function returns a match if
1427 * the already-present BSS ("b") is a hidden SSID beacon for
1428 * the new BSS ("a").
1429 */
1430
1431 /* sort missing IE before (left of) present IE */
1432 if (!ie1)
1433 return -1;
1434 if (!ie2)
1435 return 1;
1436
1437 switch (mode) {
1438 case BSS_CMP_HIDE_ZLEN:
1439 /*
1440 * In ZLEN mode we assume the BSS entry we're
1441 * looking for has a zero-length SSID. So if
1442 * the one we're looking at right now has that,
1443 * return 0. Otherwise, return the difference
1444 * in length, but since we're looking for the
1445 * 0-length it's really equivalent to returning
1446 * the length of the one we're looking at.
1447 *
1448 * No content comparison is needed as we assume
1449 * the content length is zero.
1450 */
1451 return ie2[1];
1452 case BSS_CMP_REGULAR:
1453 default:
1454 /* sort by length first, then by contents */
1455 if (ie1[1] != ie2[1])
1456 return ie2[1] - ie1[1];
1457 return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1458 case BSS_CMP_HIDE_NUL:
1459 if (ie1[1] != ie2[1])
1460 return ie2[1] - ie1[1];
1461 /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1462 for (i = 0; i < ie2[1]; i++)
1463 if (ie2[i + 2])
1464 return -1;
1465 return 0;
1466 }
1467 }
1468
cfg80211_bss_type_match(u16 capability,enum nl80211_band band,enum ieee80211_bss_type bss_type)1469 static bool cfg80211_bss_type_match(u16 capability,
1470 enum nl80211_band band,
1471 enum ieee80211_bss_type bss_type)
1472 {
1473 bool ret = true;
1474 u16 mask, val;
1475
1476 if (bss_type == IEEE80211_BSS_TYPE_ANY)
1477 return ret;
1478
1479 if (band == NL80211_BAND_60GHZ) {
1480 mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1481 switch (bss_type) {
1482 case IEEE80211_BSS_TYPE_ESS:
1483 val = WLAN_CAPABILITY_DMG_TYPE_AP;
1484 break;
1485 case IEEE80211_BSS_TYPE_PBSS:
1486 val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1487 break;
1488 case IEEE80211_BSS_TYPE_IBSS:
1489 val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1490 break;
1491 default:
1492 return false;
1493 }
1494 } else {
1495 mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1496 switch (bss_type) {
1497 case IEEE80211_BSS_TYPE_ESS:
1498 val = WLAN_CAPABILITY_ESS;
1499 break;
1500 case IEEE80211_BSS_TYPE_IBSS:
1501 val = WLAN_CAPABILITY_IBSS;
1502 break;
1503 case IEEE80211_BSS_TYPE_MBSS:
1504 val = 0;
1505 break;
1506 default:
1507 return false;
1508 }
1509 }
1510
1511 ret = ((capability & mask) == val);
1512 return ret;
1513 }
1514
1515 /* Returned bss is reference counted and must be cleaned up appropriately. */
cfg80211_get_bss(struct wiphy * wiphy,struct ieee80211_channel * channel,const u8 * bssid,const u8 * ssid,size_t ssid_len,enum ieee80211_bss_type bss_type,enum ieee80211_privacy privacy)1516 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1517 struct ieee80211_channel *channel,
1518 const u8 *bssid,
1519 const u8 *ssid, size_t ssid_len,
1520 enum ieee80211_bss_type bss_type,
1521 enum ieee80211_privacy privacy)
1522 {
1523 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1524 struct cfg80211_internal_bss *bss, *res = NULL;
1525 unsigned long now = jiffies;
1526 int bss_privacy;
1527
1528 trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1529 privacy);
1530
1531 spin_lock_bh(&rdev->bss_lock);
1532
1533 list_for_each_entry(bss, &rdev->bss_list, list) {
1534 if (!cfg80211_bss_type_match(bss->pub.capability,
1535 bss->pub.channel->band, bss_type))
1536 continue;
1537
1538 bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1539 if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1540 (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1541 continue;
1542 if (channel && bss->pub.channel != channel)
1543 continue;
1544 if (!is_valid_ether_addr(bss->pub.bssid))
1545 continue;
1546 /* Don't get expired BSS structs */
1547 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1548 !atomic_read(&bss->hold))
1549 continue;
1550 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
1551 res = bss;
1552 bss_ref_get(rdev, res);
1553 break;
1554 }
1555 }
1556
1557 spin_unlock_bh(&rdev->bss_lock);
1558 if (!res)
1559 return NULL;
1560 trace_cfg80211_return_bss(&res->pub);
1561 return &res->pub;
1562 }
1563 EXPORT_SYMBOL(cfg80211_get_bss);
1564
rb_insert_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)1565 static void rb_insert_bss(struct cfg80211_registered_device *rdev,
1566 struct cfg80211_internal_bss *bss)
1567 {
1568 struct rb_node **p = &rdev->bss_tree.rb_node;
1569 struct rb_node *parent = NULL;
1570 struct cfg80211_internal_bss *tbss;
1571 int cmp;
1572
1573 while (*p) {
1574 parent = *p;
1575 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1576
1577 cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
1578
1579 if (WARN_ON(!cmp)) {
1580 /* will sort of leak this BSS */
1581 return;
1582 }
1583
1584 if (cmp < 0)
1585 p = &(*p)->rb_left;
1586 else
1587 p = &(*p)->rb_right;
1588 }
1589
1590 rb_link_node(&bss->rbn, parent, p);
1591 rb_insert_color(&bss->rbn, &rdev->bss_tree);
1592 }
1593
1594 static struct cfg80211_internal_bss *
rb_find_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * res,enum bss_compare_mode mode)1595 rb_find_bss(struct cfg80211_registered_device *rdev,
1596 struct cfg80211_internal_bss *res,
1597 enum bss_compare_mode mode)
1598 {
1599 struct rb_node *n = rdev->bss_tree.rb_node;
1600 struct cfg80211_internal_bss *bss;
1601 int r;
1602
1603 while (n) {
1604 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1605 r = cmp_bss(&res->pub, &bss->pub, mode);
1606
1607 if (r == 0)
1608 return bss;
1609 else if (r < 0)
1610 n = n->rb_left;
1611 else
1612 n = n->rb_right;
1613 }
1614
1615 return NULL;
1616 }
1617
cfg80211_combine_bsses(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * new)1618 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1619 struct cfg80211_internal_bss *new)
1620 {
1621 const struct cfg80211_bss_ies *ies;
1622 struct cfg80211_internal_bss *bss;
1623 const u8 *ie;
1624 int i, ssidlen;
1625 u8 fold = 0;
1626 u32 n_entries = 0;
1627
1628 ies = rcu_access_pointer(new->pub.beacon_ies);
1629 if (WARN_ON(!ies))
1630 return false;
1631
1632 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1633 if (!ie) {
1634 /* nothing to do */
1635 return true;
1636 }
1637
1638 ssidlen = ie[1];
1639 for (i = 0; i < ssidlen; i++)
1640 fold |= ie[2 + i];
1641
1642 if (fold) {
1643 /* not a hidden SSID */
1644 return true;
1645 }
1646
1647 /* This is the bad part ... */
1648
1649 list_for_each_entry(bss, &rdev->bss_list, list) {
1650 /*
1651 * we're iterating all the entries anyway, so take the
1652 * opportunity to validate the list length accounting
1653 */
1654 n_entries++;
1655
1656 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
1657 continue;
1658 if (bss->pub.channel != new->pub.channel)
1659 continue;
1660 if (bss->pub.scan_width != new->pub.scan_width)
1661 continue;
1662 if (rcu_access_pointer(bss->pub.beacon_ies))
1663 continue;
1664 ies = rcu_access_pointer(bss->pub.ies);
1665 if (!ies)
1666 continue;
1667 ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1668 if (!ie)
1669 continue;
1670 if (ssidlen && ie[1] != ssidlen)
1671 continue;
1672 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1673 continue;
1674 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1675 list_del(&bss->hidden_list);
1676 /* combine them */
1677 list_add(&bss->hidden_list, &new->hidden_list);
1678 bss->pub.hidden_beacon_bss = &new->pub;
1679 new->refcount += bss->refcount;
1680 rcu_assign_pointer(bss->pub.beacon_ies,
1681 new->pub.beacon_ies);
1682 }
1683
1684 WARN_ONCE(n_entries != rdev->bss_entries,
1685 "rdev bss entries[%d]/list[len:%d] corruption\n",
1686 rdev->bss_entries, n_entries);
1687
1688 return true;
1689 }
1690
cfg80211_update_hidden_bsses(struct cfg80211_internal_bss * known,const struct cfg80211_bss_ies * new_ies,const struct cfg80211_bss_ies * old_ies)1691 static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
1692 const struct cfg80211_bss_ies *new_ies,
1693 const struct cfg80211_bss_ies *old_ies)
1694 {
1695 struct cfg80211_internal_bss *bss;
1696
1697 /* Assign beacon IEs to all sub entries */
1698 list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1699 const struct cfg80211_bss_ies *ies;
1700
1701 ies = rcu_access_pointer(bss->pub.beacon_ies);
1702 WARN_ON(ies != old_ies);
1703
1704 rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
1705 }
1706 }
1707
1708 static bool
cfg80211_update_known_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * known,struct cfg80211_internal_bss * new,bool signal_valid)1709 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1710 struct cfg80211_internal_bss *known,
1711 struct cfg80211_internal_bss *new,
1712 bool signal_valid)
1713 {
1714 lockdep_assert_held(&rdev->bss_lock);
1715
1716 /* Update IEs */
1717 if (rcu_access_pointer(new->pub.proberesp_ies)) {
1718 const struct cfg80211_bss_ies *old;
1719
1720 old = rcu_access_pointer(known->pub.proberesp_ies);
1721
1722 rcu_assign_pointer(known->pub.proberesp_ies,
1723 new->pub.proberesp_ies);
1724 /* Override possible earlier Beacon frame IEs */
1725 rcu_assign_pointer(known->pub.ies,
1726 new->pub.proberesp_ies);
1727 if (old)
1728 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1729 } else if (rcu_access_pointer(new->pub.beacon_ies)) {
1730 const struct cfg80211_bss_ies *old;
1731
1732 if (known->pub.hidden_beacon_bss &&
1733 !list_empty(&known->hidden_list)) {
1734 const struct cfg80211_bss_ies *f;
1735
1736 /* The known BSS struct is one of the probe
1737 * response members of a group, but we're
1738 * receiving a beacon (beacon_ies in the new
1739 * bss is used). This can only mean that the
1740 * AP changed its beacon from not having an
1741 * SSID to showing it, which is confusing so
1742 * drop this information.
1743 */
1744
1745 f = rcu_access_pointer(new->pub.beacon_ies);
1746 kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1747 return false;
1748 }
1749
1750 old = rcu_access_pointer(known->pub.beacon_ies);
1751
1752 rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1753
1754 /* Override IEs if they were from a beacon before */
1755 if (old == rcu_access_pointer(known->pub.ies))
1756 rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1757
1758 cfg80211_update_hidden_bsses(known,
1759 rcu_access_pointer(new->pub.beacon_ies),
1760 old);
1761
1762 if (old)
1763 kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1764 }
1765
1766 known->pub.beacon_interval = new->pub.beacon_interval;
1767
1768 /* don't update the signal if beacon was heard on
1769 * adjacent channel.
1770 */
1771 if (signal_valid)
1772 known->pub.signal = new->pub.signal;
1773 known->pub.capability = new->pub.capability;
1774 known->ts = new->ts;
1775 known->ts_boottime = new->ts_boottime;
1776 known->parent_tsf = new->parent_tsf;
1777 known->pub.chains = new->pub.chains;
1778 memcpy(known->pub.chain_signal, new->pub.chain_signal,
1779 IEEE80211_MAX_CHAINS);
1780 ether_addr_copy(known->parent_bssid, new->parent_bssid);
1781 known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1782 known->pub.bssid_index = new->pub.bssid_index;
1783
1784 return true;
1785 }
1786
1787 /* Returned bss is reference counted and must be cleaned up appropriately. */
1788 static struct cfg80211_internal_bss *
__cfg80211_bss_update(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * tmp,bool signal_valid,unsigned long ts)1789 __cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1790 struct cfg80211_internal_bss *tmp,
1791 bool signal_valid, unsigned long ts)
1792 {
1793 struct cfg80211_internal_bss *found = NULL;
1794
1795 if (WARN_ON(!tmp->pub.channel))
1796 return NULL;
1797
1798 tmp->ts = ts;
1799
1800 if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1801 return NULL;
1802 }
1803
1804 found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
1805
1806 if (found) {
1807 if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
1808 return NULL;
1809 } else {
1810 struct cfg80211_internal_bss *new;
1811 struct cfg80211_internal_bss *hidden;
1812 struct cfg80211_bss_ies *ies;
1813
1814 /*
1815 * create a copy -- the "res" variable that is passed in
1816 * is allocated on the stack since it's not needed in the
1817 * more common case of an update
1818 */
1819 new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
1820 GFP_ATOMIC);
1821 if (!new) {
1822 ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1823 if (ies)
1824 kfree_rcu(ies, rcu_head);
1825 ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1826 if (ies)
1827 kfree_rcu(ies, rcu_head);
1828 return NULL;
1829 }
1830 memcpy(new, tmp, sizeof(*new));
1831 new->refcount = 1;
1832 INIT_LIST_HEAD(&new->hidden_list);
1833 INIT_LIST_HEAD(&new->pub.nontrans_list);
1834 /* we'll set this later if it was non-NULL */
1835 new->pub.transmitted_bss = NULL;
1836
1837 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1838 hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1839 if (!hidden)
1840 hidden = rb_find_bss(rdev, tmp,
1841 BSS_CMP_HIDE_NUL);
1842 if (hidden) {
1843 new->pub.hidden_beacon_bss = &hidden->pub;
1844 list_add(&new->hidden_list,
1845 &hidden->hidden_list);
1846 hidden->refcount++;
1847
1848 ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
1849 rcu_assign_pointer(new->pub.beacon_ies,
1850 hidden->pub.beacon_ies);
1851 if (ies)
1852 kfree_rcu(ies, rcu_head);
1853 }
1854 } else {
1855 /*
1856 * Ok so we found a beacon, and don't have an entry. If
1857 * it's a beacon with hidden SSID, we might be in for an
1858 * expensive search for any probe responses that should
1859 * be grouped with this beacon for updates ...
1860 */
1861 if (!cfg80211_combine_bsses(rdev, new)) {
1862 bss_ref_put(rdev, new);
1863 return NULL;
1864 }
1865 }
1866
1867 if (rdev->bss_entries >= bss_entries_limit &&
1868 !cfg80211_bss_expire_oldest(rdev)) {
1869 bss_ref_put(rdev, new);
1870 return NULL;
1871 }
1872
1873 /* This must be before the call to bss_ref_get */
1874 if (tmp->pub.transmitted_bss) {
1875 new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1876 bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss));
1877 }
1878
1879 list_add_tail(&new->list, &rdev->bss_list);
1880 rdev->bss_entries++;
1881 rb_insert_bss(rdev, new);
1882 found = new;
1883 }
1884
1885 rdev->bss_generation++;
1886 bss_ref_get(rdev, found);
1887
1888 return found;
1889 }
1890
1891 struct cfg80211_internal_bss *
cfg80211_bss_update(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * tmp,bool signal_valid,unsigned long ts)1892 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1893 struct cfg80211_internal_bss *tmp,
1894 bool signal_valid, unsigned long ts)
1895 {
1896 struct cfg80211_internal_bss *res;
1897
1898 spin_lock_bh(&rdev->bss_lock);
1899 res = __cfg80211_bss_update(rdev, tmp, signal_valid, ts);
1900 spin_unlock_bh(&rdev->bss_lock);
1901
1902 return res;
1903 }
1904
cfg80211_get_ies_channel_number(const u8 * ie,size_t ielen,enum nl80211_band band)1905 int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen,
1906 enum nl80211_band band)
1907 {
1908 const struct element *tmp;
1909
1910 if (band == NL80211_BAND_6GHZ) {
1911 struct ieee80211_he_operation *he_oper;
1912
1913 tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie,
1914 ielen);
1915 if (tmp && tmp->datalen >= sizeof(*he_oper) &&
1916 tmp->datalen >= ieee80211_he_oper_size(&tmp->data[1])) {
1917 const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
1918
1919 he_oper = (void *)&tmp->data[1];
1920
1921 he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
1922 if (!he_6ghz_oper)
1923 return -1;
1924
1925 return he_6ghz_oper->primary;
1926 }
1927 } else if (band == NL80211_BAND_S1GHZ) {
1928 tmp = cfg80211_find_elem(WLAN_EID_S1G_OPERATION, ie, ielen);
1929 if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) {
1930 struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data;
1931
1932 return s1gop->oper_ch;
1933 }
1934 } else {
1935 tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen);
1936 if (tmp && tmp->datalen == 1)
1937 return tmp->data[0];
1938
1939 tmp = cfg80211_find_elem(WLAN_EID_HT_OPERATION, ie, ielen);
1940 if (tmp &&
1941 tmp->datalen >= sizeof(struct ieee80211_ht_operation)) {
1942 struct ieee80211_ht_operation *htop = (void *)tmp->data;
1943
1944 return htop->primary_chan;
1945 }
1946 }
1947
1948 return -1;
1949 }
1950 EXPORT_SYMBOL(cfg80211_get_ies_channel_number);
1951
1952 /*
1953 * Update RX channel information based on the available frame payload
1954 * information. This is mainly for the 2.4 GHz band where frames can be received
1955 * from neighboring channels and the Beacon frames use the DSSS Parameter Set
1956 * element to indicate the current (transmitting) channel, but this might also
1957 * be needed on other bands if RX frequency does not match with the actual
1958 * operating channel of a BSS, or if the AP reports a different primary channel.
1959 */
1960 static struct ieee80211_channel *
cfg80211_get_bss_channel(struct wiphy * wiphy,const u8 * ie,size_t ielen,struct ieee80211_channel * channel,enum nl80211_bss_scan_width scan_width)1961 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1962 struct ieee80211_channel *channel,
1963 enum nl80211_bss_scan_width scan_width)
1964 {
1965 u32 freq;
1966 int channel_number;
1967 struct ieee80211_channel *alt_channel;
1968
1969 channel_number = cfg80211_get_ies_channel_number(ie, ielen,
1970 channel->band);
1971
1972 if (channel_number < 0) {
1973 /* No channel information in frame payload */
1974 return channel;
1975 }
1976
1977 freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
1978
1979 /*
1980 * Frame info (beacon/prob res) is the same as received channel,
1981 * no need for further processing.
1982 */
1983 if (freq == ieee80211_channel_to_khz(channel))
1984 return channel;
1985
1986 alt_channel = ieee80211_get_channel_khz(wiphy, freq);
1987 if (!alt_channel) {
1988 if (channel->band == NL80211_BAND_2GHZ ||
1989 channel->band == NL80211_BAND_6GHZ) {
1990 /*
1991 * Better not allow unexpected channels when that could
1992 * be going beyond the 1-11 range (e.g., discovering
1993 * BSS on channel 12 when radio is configured for
1994 * channel 11) or beyond the 6 GHz channel range.
1995 */
1996 return NULL;
1997 }
1998
1999 /* No match for the payload channel number - ignore it */
2000 return channel;
2001 }
2002
2003 if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
2004 scan_width == NL80211_BSS_CHAN_WIDTH_5) {
2005 /*
2006 * Ignore channel number in 5 and 10 MHz channels where there
2007 * may not be an n:1 or 1:n mapping between frequencies and
2008 * channel numbers.
2009 */
2010 return channel;
2011 }
2012
2013 /*
2014 * Use the channel determined through the payload channel number
2015 * instead of the RX channel reported by the driver.
2016 */
2017 if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
2018 return NULL;
2019 return alt_channel;
2020 }
2021
2022 struct cfg80211_inform_single_bss_data {
2023 struct cfg80211_inform_bss *drv_data;
2024 enum cfg80211_bss_frame_type ftype;
2025 struct ieee80211_channel *channel;
2026 u8 bssid[ETH_ALEN];
2027 u64 tsf;
2028 u16 capability;
2029 u16 beacon_interval;
2030 const u8 *ie;
2031 size_t ielen;
2032
2033 enum {
2034 BSS_SOURCE_DIRECT = 0,
2035 BSS_SOURCE_MBSSID,
2036 BSS_SOURCE_STA_PROFILE,
2037 } bss_source;
2038 /* Set if reporting bss_source != BSS_SOURCE_DIRECT */
2039 struct cfg80211_bss *source_bss;
2040 u8 max_bssid_indicator;
2041 u8 bssid_index;
2042 };
2043
2044 /* Returned bss is reference counted and must be cleaned up appropriately. */
2045 static struct cfg80211_bss *
cfg80211_inform_single_bss_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * data,gfp_t gfp)2046 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
2047 struct cfg80211_inform_single_bss_data *data,
2048 gfp_t gfp)
2049 {
2050 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2051 struct cfg80211_inform_bss *drv_data = data->drv_data;
2052 struct cfg80211_bss_ies *ies;
2053 struct ieee80211_channel *channel;
2054 struct cfg80211_internal_bss tmp = {}, *res;
2055 int bss_type;
2056 bool signal_valid;
2057 unsigned long ts;
2058
2059 if (WARN_ON(!wiphy))
2060 return NULL;
2061
2062 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2063 (drv_data->signal < 0 || drv_data->signal > 100)))
2064 return NULL;
2065
2066 if (WARN_ON(data->bss_source != BSS_SOURCE_DIRECT && !data->source_bss))
2067 return NULL;
2068
2069 channel = data->channel;
2070 if (!channel)
2071 channel = cfg80211_get_bss_channel(wiphy, data->ie, data->ielen,
2072 drv_data->chan,
2073 drv_data->scan_width);
2074 if (!channel)
2075 return NULL;
2076
2077 memcpy(tmp.pub.bssid, data->bssid, ETH_ALEN);
2078 tmp.pub.channel = channel;
2079 tmp.pub.scan_width = drv_data->scan_width;
2080 if (data->bss_source != BSS_SOURCE_STA_PROFILE)
2081 tmp.pub.signal = drv_data->signal;
2082 else
2083 tmp.pub.signal = 0;
2084 tmp.pub.beacon_interval = data->beacon_interval;
2085 tmp.pub.capability = data->capability;
2086 tmp.ts_boottime = drv_data->boottime_ns;
2087 tmp.parent_tsf = drv_data->parent_tsf;
2088 ether_addr_copy(tmp.parent_bssid, drv_data->parent_bssid);
2089
2090 if (data->bss_source != BSS_SOURCE_DIRECT) {
2091 tmp.pub.transmitted_bss = data->source_bss;
2092 ts = bss_from_pub(data->source_bss)->ts;
2093 tmp.pub.bssid_index = data->bssid_index;
2094 tmp.pub.max_bssid_indicator = data->max_bssid_indicator;
2095 } else {
2096 ts = jiffies;
2097
2098 if (channel->band == NL80211_BAND_60GHZ) {
2099 bss_type = data->capability &
2100 WLAN_CAPABILITY_DMG_TYPE_MASK;
2101 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2102 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2103 regulatory_hint_found_beacon(wiphy, channel,
2104 gfp);
2105 } else {
2106 if (data->capability & WLAN_CAPABILITY_ESS)
2107 regulatory_hint_found_beacon(wiphy, channel,
2108 gfp);
2109 }
2110 }
2111
2112 /*
2113 * If we do not know here whether the IEs are from a Beacon or Probe
2114 * Response frame, we need to pick one of the options and only use it
2115 * with the driver that does not provide the full Beacon/Probe Response
2116 * frame. Use Beacon frame pointer to avoid indicating that this should
2117 * override the IEs pointer should we have received an earlier
2118 * indication of Probe Response data.
2119 */
2120 ies = kzalloc(sizeof(*ies) + data->ielen, gfp);
2121 if (!ies)
2122 return NULL;
2123 ies->len = data->ielen;
2124 ies->tsf = data->tsf;
2125 ies->from_beacon = false;
2126 memcpy(ies->data, data->ie, data->ielen);
2127
2128 switch (data->ftype) {
2129 case CFG80211_BSS_FTYPE_BEACON:
2130 ies->from_beacon = true;
2131 fallthrough;
2132 case CFG80211_BSS_FTYPE_UNKNOWN:
2133 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2134 break;
2135 case CFG80211_BSS_FTYPE_PRESP:
2136 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2137 break;
2138 }
2139 rcu_assign_pointer(tmp.pub.ies, ies);
2140
2141 signal_valid = drv_data->chan == channel;
2142 spin_lock_bh(&rdev->bss_lock);
2143 res = __cfg80211_bss_update(rdev, &tmp, signal_valid, ts);
2144 if (!res)
2145 goto drop;
2146
2147 rdev_inform_bss(rdev, &res->pub, ies, drv_data->drv_data);
2148
2149 if (data->bss_source == BSS_SOURCE_MBSSID) {
2150 /* this is a nontransmitting bss, we need to add it to
2151 * transmitting bss' list if it is not there
2152 */
2153 if (cfg80211_add_nontrans_list(data->source_bss, &res->pub)) {
2154 if (__cfg80211_unlink_bss(rdev, res)) {
2155 rdev->bss_generation++;
2156 res = NULL;
2157 }
2158 }
2159
2160 if (!res)
2161 goto drop;
2162 }
2163 spin_unlock_bh(&rdev->bss_lock);
2164
2165 trace_cfg80211_return_bss(&res->pub);
2166 /* __cfg80211_bss_update gives us a referenced result */
2167 return &res->pub;
2168
2169 drop:
2170 spin_unlock_bh(&rdev->bss_lock);
2171 return NULL;
2172 }
2173
2174 static const struct element
cfg80211_get_profile_continuation(const u8 * ie,size_t ielen,const struct element * mbssid_elem,const struct element * sub_elem)2175 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
2176 const struct element *mbssid_elem,
2177 const struct element *sub_elem)
2178 {
2179 const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
2180 const struct element *next_mbssid;
2181 const struct element *next_sub;
2182
2183 next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
2184 mbssid_end,
2185 ielen - (mbssid_end - ie));
2186
2187 /*
2188 * If it is not the last subelement in current MBSSID IE or there isn't
2189 * a next MBSSID IE - profile is complete.
2190 */
2191 if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
2192 !next_mbssid)
2193 return NULL;
2194
2195 /* For any length error, just return NULL */
2196
2197 if (next_mbssid->datalen < 4)
2198 return NULL;
2199
2200 next_sub = (void *)&next_mbssid->data[1];
2201
2202 if (next_mbssid->data + next_mbssid->datalen <
2203 next_sub->data + next_sub->datalen)
2204 return NULL;
2205
2206 if (next_sub->id != 0 || next_sub->datalen < 2)
2207 return NULL;
2208
2209 /*
2210 * Check if the first element in the next sub element is a start
2211 * of a new profile
2212 */
2213 return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2214 NULL : next_mbssid;
2215 }
2216
cfg80211_merge_profile(const u8 * ie,size_t ielen,const struct element * mbssid_elem,const struct element * sub_elem,u8 * merged_ie,size_t max_copy_len)2217 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2218 const struct element *mbssid_elem,
2219 const struct element *sub_elem,
2220 u8 *merged_ie, size_t max_copy_len)
2221 {
2222 size_t copied_len = sub_elem->datalen;
2223 const struct element *next_mbssid;
2224
2225 if (sub_elem->datalen > max_copy_len)
2226 return 0;
2227
2228 memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2229
2230 while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2231 mbssid_elem,
2232 sub_elem))) {
2233 const struct element *next_sub = (void *)&next_mbssid->data[1];
2234
2235 if (copied_len + next_sub->datalen > max_copy_len)
2236 break;
2237 memcpy(merged_ie + copied_len, next_sub->data,
2238 next_sub->datalen);
2239 copied_len += next_sub->datalen;
2240 }
2241
2242 return copied_len;
2243 }
2244 EXPORT_SYMBOL(cfg80211_merge_profile);
2245
2246 static void
cfg80211_parse_mbssid_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * tx_data,struct cfg80211_bss * source_bss,gfp_t gfp)2247 cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2248 struct cfg80211_inform_single_bss_data *tx_data,
2249 struct cfg80211_bss *source_bss,
2250 gfp_t gfp)
2251 {
2252 struct cfg80211_inform_single_bss_data data = {
2253 .drv_data = tx_data->drv_data,
2254 .ftype = tx_data->ftype,
2255 .tsf = tx_data->tsf,
2256 .beacon_interval = tx_data->beacon_interval,
2257 .source_bss = source_bss,
2258 .bss_source = BSS_SOURCE_MBSSID,
2259 };
2260 const u8 *mbssid_index_ie;
2261 const struct element *elem, *sub;
2262 u8 *new_ie, *profile;
2263 u64 seen_indices = 0;
2264 struct cfg80211_bss *bss;
2265
2266 if (!source_bss)
2267 return;
2268 if (!cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
2269 tx_data->ie, tx_data->ielen))
2270 return;
2271 if (!wiphy->support_mbssid)
2272 return;
2273 if (wiphy->support_only_he_mbssid &&
2274 !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
2275 tx_data->ie, tx_data->ielen))
2276 return;
2277
2278 new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2279 if (!new_ie)
2280 return;
2281
2282 profile = kmalloc(tx_data->ielen, gfp);
2283 if (!profile)
2284 goto out;
2285
2286 for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
2287 tx_data->ie, tx_data->ielen) {
2288 if (elem->datalen < 4)
2289 continue;
2290 if (elem->data[0] < 1 || (int)elem->data[0] > 8)
2291 continue;
2292 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2293 u8 profile_len;
2294
2295 if (sub->id != 0 || sub->datalen < 4) {
2296 /* not a valid BSS profile */
2297 continue;
2298 }
2299
2300 if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2301 sub->data[1] != 2) {
2302 /* The first element within the Nontransmitted
2303 * BSSID Profile is not the Nontransmitted
2304 * BSSID Capability element.
2305 */
2306 continue;
2307 }
2308
2309 memset(profile, 0, tx_data->ielen);
2310 profile_len = cfg80211_merge_profile(tx_data->ie,
2311 tx_data->ielen,
2312 elem,
2313 sub,
2314 profile,
2315 tx_data->ielen);
2316
2317 /* found a Nontransmitted BSSID Profile */
2318 mbssid_index_ie = cfg80211_find_ie
2319 (WLAN_EID_MULTI_BSSID_IDX,
2320 profile, profile_len);
2321 if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2322 mbssid_index_ie[2] == 0 ||
2323 mbssid_index_ie[2] > 46) {
2324 /* No valid Multiple BSSID-Index element */
2325 continue;
2326 }
2327
2328 if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2329 /* We don't support legacy split of a profile */
2330 net_dbg_ratelimited("Partial info for BSSID index %d\n",
2331 mbssid_index_ie[2]);
2332
2333 seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2334
2335 data.bssid_index = mbssid_index_ie[2];
2336 data.max_bssid_indicator = elem->data[0];
2337
2338 cfg80211_gen_new_bssid(tx_data->bssid,
2339 data.max_bssid_indicator,
2340 data.bssid_index,
2341 data.bssid);
2342
2343 memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2344 data.ie = new_ie;
2345 data.ielen = cfg80211_gen_new_ie(tx_data->ie,
2346 tx_data->ielen,
2347 profile,
2348 profile_len,
2349 new_ie,
2350 IEEE80211_MAX_DATA_LEN);
2351 if (!data.ielen)
2352 continue;
2353
2354 data.capability = get_unaligned_le16(profile + 2);
2355 bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
2356 if (!bss)
2357 break;
2358 cfg80211_put_bss(wiphy, bss);
2359 }
2360 }
2361
2362 out:
2363 kfree(new_ie);
2364 kfree(profile);
2365 }
2366
cfg80211_defragment_element(const struct element * elem,const u8 * ies,size_t ieslen,u8 * data,size_t data_len,u8 frag_id)2367 ssize_t cfg80211_defragment_element(const struct element *elem, const u8 *ies,
2368 size_t ieslen, u8 *data, size_t data_len,
2369 u8 frag_id)
2370 {
2371 const struct element *next;
2372 ssize_t copied;
2373 u8 elem_datalen;
2374
2375 if (!elem)
2376 return -EINVAL;
2377
2378 /* elem might be invalid after the memmove */
2379 next = (void *)(elem->data + elem->datalen);
2380 elem_datalen = elem->datalen;
2381
2382 if (elem->id == WLAN_EID_EXTENSION) {
2383 copied = elem->datalen - 1;
2384 if (copied > data_len)
2385 return -ENOSPC;
2386
2387 memmove(data, elem->data + 1, copied);
2388 } else {
2389 copied = elem->datalen;
2390 if (copied > data_len)
2391 return -ENOSPC;
2392
2393 memmove(data, elem->data, copied);
2394 }
2395
2396 /* Fragmented elements must have 255 bytes */
2397 if (elem_datalen < 255)
2398 return copied;
2399
2400 for (elem = next;
2401 elem->data < ies + ieslen &&
2402 elem->data + elem->datalen <= ies + ieslen;
2403 elem = next) {
2404 /* elem might be invalid after the memmove */
2405 next = (void *)(elem->data + elem->datalen);
2406
2407 if (elem->id != frag_id)
2408 break;
2409
2410 elem_datalen = elem->datalen;
2411
2412 if (copied + elem_datalen > data_len)
2413 return -ENOSPC;
2414
2415 memmove(data + copied, elem->data, elem_datalen);
2416 copied += elem_datalen;
2417
2418 /* Only the last fragment may be short */
2419 if (elem_datalen != 255)
2420 break;
2421 }
2422
2423 return copied;
2424 }
2425 EXPORT_SYMBOL(cfg80211_defragment_element);
2426
2427 struct cfg80211_mle {
2428 struct ieee80211_multi_link_elem *mle;
2429 struct ieee80211_mle_per_sta_profile
2430 *sta_prof[IEEE80211_MLD_MAX_NUM_LINKS];
2431 ssize_t sta_prof_len[IEEE80211_MLD_MAX_NUM_LINKS];
2432
2433 u8 data[];
2434 };
2435
2436 static struct cfg80211_mle *
cfg80211_defrag_mle(const struct element * mle,const u8 * ie,size_t ielen,gfp_t gfp)2437 cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen,
2438 gfp_t gfp)
2439 {
2440 const struct element *elem;
2441 struct cfg80211_mle *res;
2442 size_t buf_len;
2443 ssize_t mle_len;
2444 u8 common_size, idx;
2445
2446 if (!mle || !ieee80211_mle_size_ok(mle->data + 1, mle->datalen - 1))
2447 return NULL;
2448
2449 /* Required length for first defragmentation */
2450 buf_len = mle->datalen - 1;
2451 for_each_element(elem, mle->data + mle->datalen,
2452 ielen - sizeof(*mle) + mle->datalen) {
2453 if (elem->id != WLAN_EID_FRAGMENT)
2454 break;
2455
2456 buf_len += elem->datalen;
2457 }
2458
2459 res = kzalloc(struct_size(res, data, buf_len), gfp);
2460 if (!res)
2461 return NULL;
2462
2463 mle_len = cfg80211_defragment_element(mle, ie, ielen,
2464 res->data, buf_len,
2465 WLAN_EID_FRAGMENT);
2466 if (mle_len < 0)
2467 goto error;
2468
2469 res->mle = (void *)res->data;
2470
2471 /* Find the sub-element area in the buffer */
2472 common_size = ieee80211_mle_common_size((u8 *)res->mle);
2473 ie = res->data + common_size;
2474 ielen = mle_len - common_size;
2475
2476 idx = 0;
2477 for_each_element_id(elem, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE,
2478 ie, ielen) {
2479 res->sta_prof[idx] = (void *)elem->data;
2480 res->sta_prof_len[idx] = elem->datalen;
2481
2482 idx++;
2483 if (idx >= IEEE80211_MLD_MAX_NUM_LINKS)
2484 break;
2485 }
2486 if (!for_each_element_completed(elem, ie, ielen))
2487 goto error;
2488
2489 /* Defragment sta_info in-place */
2490 for (idx = 0; idx < IEEE80211_MLD_MAX_NUM_LINKS && res->sta_prof[idx];
2491 idx++) {
2492 if (res->sta_prof_len[idx] < 255)
2493 continue;
2494
2495 elem = (void *)res->sta_prof[idx] - 2;
2496
2497 if (idx + 1 < ARRAY_SIZE(res->sta_prof) &&
2498 res->sta_prof[idx + 1])
2499 buf_len = (u8 *)res->sta_prof[idx + 1] -
2500 (u8 *)res->sta_prof[idx];
2501 else
2502 buf_len = ielen + ie - (u8 *)elem;
2503
2504 res->sta_prof_len[idx] =
2505 cfg80211_defragment_element(elem,
2506 (u8 *)elem, buf_len,
2507 (u8 *)res->sta_prof[idx],
2508 buf_len,
2509 IEEE80211_MLE_SUBELEM_FRAGMENT);
2510 if (res->sta_prof_len[idx] < 0)
2511 goto error;
2512 }
2513
2514 return res;
2515
2516 error:
2517 kfree(res);
2518 return NULL;
2519 }
2520
2521 static bool
cfg80211_tbtt_info_for_mld_ap(const u8 * ie,size_t ielen,u8 mld_id,u8 link_id,const struct ieee80211_neighbor_ap_info ** ap_info,const u8 ** tbtt_info)2522 cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
2523 const struct ieee80211_neighbor_ap_info **ap_info,
2524 const u8 **tbtt_info)
2525 {
2526 const struct ieee80211_neighbor_ap_info *info;
2527 const struct element *rnr;
2528 const u8 *pos, *end;
2529
2530 for_each_element_id(rnr, WLAN_EID_REDUCED_NEIGHBOR_REPORT, ie, ielen) {
2531 pos = rnr->data;
2532 end = rnr->data + rnr->datalen;
2533
2534 /* RNR IE may contain more than one NEIGHBOR_AP_INFO */
2535 while (sizeof(*info) <= end - pos) {
2536 const struct ieee80211_rnr_mld_params *mld_params;
2537 u16 params;
2538 u8 length, i, count, mld_params_offset;
2539 u8 type, lid;
2540
2541 info = (void *)pos;
2542 count = u8_get_bits(info->tbtt_info_hdr,
2543 IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
2544 length = info->tbtt_info_len;
2545
2546 pos += sizeof(*info);
2547
2548 if (count * length > end - pos)
2549 return false;
2550
2551 type = u8_get_bits(info->tbtt_info_hdr,
2552 IEEE80211_AP_INFO_TBTT_HDR_TYPE);
2553
2554 /* Only accept full TBTT information. NSTR mobile APs
2555 * use the shortened version, but we ignore them here.
2556 */
2557 if (type == IEEE80211_TBTT_INFO_TYPE_TBTT &&
2558 length >=
2559 offsetofend(struct ieee80211_tbtt_info_ge_11,
2560 mld_params)) {
2561 mld_params_offset =
2562 offsetof(struct ieee80211_tbtt_info_ge_11, mld_params);
2563 } else {
2564 pos += count * length;
2565 continue;
2566 }
2567
2568 for (i = 0; i < count; i++) {
2569 mld_params = (void *)pos + mld_params_offset;
2570 params = le16_to_cpu(mld_params->params);
2571
2572 lid = u16_get_bits(params,
2573 IEEE80211_RNR_MLD_PARAMS_LINK_ID);
2574
2575 if (mld_id == mld_params->mld_id &&
2576 link_id == lid) {
2577 *ap_info = info;
2578 *tbtt_info = pos;
2579
2580 return true;
2581 }
2582
2583 pos += length;
2584 }
2585 }
2586 }
2587
2588 return false;
2589 }
2590
2591 static void
cfg80211_parse_ml_elem_sta_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * tx_data,struct cfg80211_bss * source_bss,const struct element * elem,gfp_t gfp)2592 cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
2593 struct cfg80211_inform_single_bss_data *tx_data,
2594 struct cfg80211_bss *source_bss,
2595 const struct element *elem,
2596 gfp_t gfp)
2597 {
2598 struct cfg80211_inform_single_bss_data data = {
2599 .drv_data = tx_data->drv_data,
2600 .ftype = tx_data->ftype,
2601 .source_bss = source_bss,
2602 .bss_source = BSS_SOURCE_STA_PROFILE,
2603 };
2604 struct ieee80211_multi_link_elem *ml_elem;
2605 struct cfg80211_mle *mle;
2606 u16 control;
2607 u8 *new_ie;
2608 struct cfg80211_bss *bss;
2609 int mld_id;
2610 u16 seen_links = 0;
2611 const u8 *pos;
2612 u8 i;
2613
2614 if (!ieee80211_mle_size_ok(elem->data + 1, elem->datalen - 1))
2615 return;
2616
2617 ml_elem = (void *)elem->data + 1;
2618 control = le16_to_cpu(ml_elem->control);
2619 if (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE) !=
2620 IEEE80211_ML_CONTROL_TYPE_BASIC)
2621 return;
2622
2623 /* Must be present when transmitted by an AP (in a probe response) */
2624 if (!(control & IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT) ||
2625 !(control & IEEE80211_MLC_BASIC_PRES_LINK_ID) ||
2626 !(control & IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP))
2627 return;
2628
2629 /* length + MLD MAC address + link ID info + BSS Params Change Count */
2630 pos = ml_elem->variable + 1 + 6 + 1 + 1;
2631
2632 if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MED_SYNC_DELAY))
2633 pos += 2;
2634 if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_EML_CAPA))
2635 pos += 2;
2636
2637 /* MLD capabilities and operations */
2638 pos += 2;
2639
2640 /*
2641 * The MLD ID of the reporting AP is always zero. It is set if the AP
2642 * is part of an MBSSID set and will be non-zero for ML Elements
2643 * relating to a nontransmitted BSS (matching the Multi-BSSID Index,
2644 * Draft P802.11be_D3.2, 35.3.4.2)
2645 */
2646 if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MLD_ID)) {
2647 mld_id = *pos;
2648 pos += 1;
2649 } else {
2650 mld_id = 0;
2651 }
2652
2653 /* Extended MLD capabilities and operations */
2654 pos += 2;
2655
2656 /* Fully defrag the ML element for sta information/profile iteration */
2657 mle = cfg80211_defrag_mle(elem, tx_data->ie, tx_data->ielen, gfp);
2658 if (!mle)
2659 return;
2660
2661 new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2662 if (!new_ie)
2663 goto out;
2664
2665 for (i = 0; i < ARRAY_SIZE(mle->sta_prof) && mle->sta_prof[i]; i++) {
2666 const struct ieee80211_neighbor_ap_info *ap_info;
2667 enum nl80211_band band;
2668 u32 freq;
2669 const u8 *profile;
2670 const u8 *tbtt_info;
2671 ssize_t profile_len;
2672 u8 link_id;
2673
2674 if (!ieee80211_mle_basic_sta_prof_size_ok((u8 *)mle->sta_prof[i],
2675 mle->sta_prof_len[i]))
2676 continue;
2677
2678 control = le16_to_cpu(mle->sta_prof[i]->control);
2679
2680 if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
2681 continue;
2682
2683 link_id = u16_get_bits(control,
2684 IEEE80211_MLE_STA_CONTROL_LINK_ID);
2685 if (seen_links & BIT(link_id))
2686 break;
2687 seen_links |= BIT(link_id);
2688
2689 if (!(control & IEEE80211_MLE_STA_CONTROL_BEACON_INT_PRESENT) ||
2690 !(control & IEEE80211_MLE_STA_CONTROL_TSF_OFFS_PRESENT) ||
2691 !(control & IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT))
2692 continue;
2693
2694 memcpy(data.bssid, mle->sta_prof[i]->variable, ETH_ALEN);
2695 data.beacon_interval =
2696 get_unaligned_le16(mle->sta_prof[i]->variable + 6);
2697 data.tsf = tx_data->tsf +
2698 get_unaligned_le64(mle->sta_prof[i]->variable + 8);
2699
2700 /* sta_info_len counts itself */
2701 profile = mle->sta_prof[i]->variable +
2702 mle->sta_prof[i]->sta_info_len - 1;
2703 profile_len = (u8 *)mle->sta_prof[i] + mle->sta_prof_len[i] -
2704 profile;
2705
2706 if (profile_len < 2)
2707 continue;
2708
2709 data.capability = get_unaligned_le16(profile);
2710 profile += 2;
2711 profile_len -= 2;
2712
2713 /* Find in RNR to look up channel information */
2714 if (!cfg80211_tbtt_info_for_mld_ap(tx_data->ie, tx_data->ielen,
2715 mld_id, link_id,
2716 &ap_info, &tbtt_info))
2717 continue;
2718
2719 /* We could sanity check the BSSID is included */
2720
2721 if (!ieee80211_operating_class_to_band(ap_info->op_class,
2722 &band))
2723 continue;
2724
2725 freq = ieee80211_channel_to_freq_khz(ap_info->channel, band);
2726 data.channel = ieee80211_get_channel_khz(wiphy, freq);
2727
2728 /* Generate new elements */
2729 memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2730 data.ie = new_ie;
2731 data.ielen = cfg80211_gen_new_ie(tx_data->ie, tx_data->ielen,
2732 profile, profile_len,
2733 new_ie,
2734 IEEE80211_MAX_DATA_LEN);
2735 if (!data.ielen)
2736 continue;
2737
2738 bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
2739 if (!bss)
2740 break;
2741 cfg80211_put_bss(wiphy, bss);
2742 }
2743
2744 out:
2745 kfree(new_ie);
2746 kfree(mle);
2747 }
2748
cfg80211_parse_ml_sta_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * tx_data,struct cfg80211_bss * source_bss,gfp_t gfp)2749 static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
2750 struct cfg80211_inform_single_bss_data *tx_data,
2751 struct cfg80211_bss *source_bss,
2752 gfp_t gfp)
2753 {
2754 const struct element *elem;
2755
2756 if (!source_bss)
2757 return;
2758
2759 if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP)
2760 return;
2761
2762 for_each_element_extid(elem, WLAN_EID_EXT_EHT_MULTI_LINK,
2763 tx_data->ie, tx_data->ielen)
2764 cfg80211_parse_ml_elem_sta_data(wiphy, tx_data, source_bss,
2765 elem, gfp);
2766 }
2767
2768 struct cfg80211_bss *
cfg80211_inform_bss_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,enum cfg80211_bss_frame_type ftype,const u8 * bssid,u64 tsf,u16 capability,u16 beacon_interval,const u8 * ie,size_t ielen,gfp_t gfp)2769 cfg80211_inform_bss_data(struct wiphy *wiphy,
2770 struct cfg80211_inform_bss *data,
2771 enum cfg80211_bss_frame_type ftype,
2772 const u8 *bssid, u64 tsf, u16 capability,
2773 u16 beacon_interval, const u8 *ie, size_t ielen,
2774 gfp_t gfp)
2775 {
2776 struct cfg80211_inform_single_bss_data inform_data = {
2777 .drv_data = data,
2778 .ftype = ftype,
2779 .tsf = tsf,
2780 .capability = capability,
2781 .beacon_interval = beacon_interval,
2782 .ie = ie,
2783 .ielen = ielen,
2784 };
2785 struct cfg80211_bss *res;
2786
2787 memcpy(inform_data.bssid, bssid, ETH_ALEN);
2788
2789 res = cfg80211_inform_single_bss_data(wiphy, &inform_data, gfp);
2790 if (!res)
2791 return NULL;
2792
2793 cfg80211_parse_mbssid_data(wiphy, &inform_data, res, gfp);
2794
2795 cfg80211_parse_ml_sta_data(wiphy, &inform_data, res, gfp);
2796
2797 return res;
2798 }
2799 EXPORT_SYMBOL(cfg80211_inform_bss_data);
2800
2801 /* cfg80211_inform_bss_width_frame helper */
2802 static struct cfg80211_bss *
cfg80211_inform_single_bss_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,gfp_t gfp)2803 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2804 struct cfg80211_inform_bss *data,
2805 struct ieee80211_mgmt *mgmt, size_t len,
2806 gfp_t gfp)
2807 {
2808 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2809 struct cfg80211_internal_bss tmp = {}, *res;
2810 struct cfg80211_bss_ies *ies;
2811 struct ieee80211_channel *channel;
2812 bool signal_valid;
2813 struct ieee80211_ext *ext = NULL;
2814 u8 *bssid, *variable;
2815 u16 capability, beacon_int;
2816 size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2817 u.probe_resp.variable);
2818 int bss_type;
2819
2820 BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2821 offsetof(struct ieee80211_mgmt, u.beacon.variable));
2822
2823 trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2824
2825 if (WARN_ON(!mgmt))
2826 return NULL;
2827
2828 if (WARN_ON(!wiphy))
2829 return NULL;
2830
2831 if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2832 (data->signal < 0 || data->signal > 100)))
2833 return NULL;
2834
2835 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2836 ext = (void *) mgmt;
2837 min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2838 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2839 min_hdr_len = offsetof(struct ieee80211_ext,
2840 u.s1g_short_beacon.variable);
2841 }
2842
2843 if (WARN_ON(len < min_hdr_len))
2844 return NULL;
2845
2846 ielen = len - min_hdr_len;
2847 variable = mgmt->u.probe_resp.variable;
2848 if (ext) {
2849 if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2850 variable = ext->u.s1g_short_beacon.variable;
2851 else
2852 variable = ext->u.s1g_beacon.variable;
2853 }
2854
2855 channel = cfg80211_get_bss_channel(wiphy, variable,
2856 ielen, data->chan, data->scan_width);
2857 if (!channel)
2858 return NULL;
2859
2860 if (ext) {
2861 const struct ieee80211_s1g_bcn_compat_ie *compat;
2862 const struct element *elem;
2863
2864 elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT,
2865 variable, ielen);
2866 if (!elem)
2867 return NULL;
2868 if (elem->datalen < sizeof(*compat))
2869 return NULL;
2870 compat = (void *)elem->data;
2871 bssid = ext->u.s1g_beacon.sa;
2872 capability = le16_to_cpu(compat->compat_info);
2873 beacon_int = le16_to_cpu(compat->beacon_int);
2874 } else {
2875 bssid = mgmt->bssid;
2876 beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2877 capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2878 }
2879
2880 if (channel->band == NL80211_BAND_60GHZ) {
2881 bss_type = capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2882 if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2883 bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2884 regulatory_hint_found_beacon(wiphy, channel, gfp);
2885 } else {
2886 if (capability & WLAN_CAPABILITY_ESS)
2887 regulatory_hint_found_beacon(wiphy, channel, gfp);
2888 }
2889
2890 ies = kzalloc(sizeof(*ies) + ielen, gfp);
2891 if (!ies)
2892 return NULL;
2893 ies->len = ielen;
2894 ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2895 ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) ||
2896 ieee80211_is_s1g_beacon(mgmt->frame_control);
2897 memcpy(ies->data, variable, ielen);
2898
2899 if (ieee80211_is_probe_resp(mgmt->frame_control))
2900 rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2901 else
2902 rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2903 rcu_assign_pointer(tmp.pub.ies, ies);
2904
2905 memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2906 tmp.pub.beacon_interval = beacon_int;
2907 tmp.pub.capability = capability;
2908 tmp.pub.channel = channel;
2909 tmp.pub.scan_width = data->scan_width;
2910 tmp.pub.signal = data->signal;
2911 tmp.ts_boottime = data->boottime_ns;
2912 tmp.parent_tsf = data->parent_tsf;
2913 tmp.pub.chains = data->chains;
2914 memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2915 ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
2916
2917 signal_valid = data->chan == channel;
2918 spin_lock_bh(&rdev->bss_lock);
2919 res = __cfg80211_bss_update(rdev, &tmp, signal_valid, jiffies);
2920 if (!res)
2921 goto drop;
2922
2923 rdev_inform_bss(rdev, &res->pub, ies, data->drv_data);
2924
2925 spin_unlock_bh(&rdev->bss_lock);
2926
2927 trace_cfg80211_return_bss(&res->pub);
2928 /* __cfg80211_bss_update gives us a referenced result */
2929 return &res->pub;
2930
2931 drop:
2932 spin_unlock_bh(&rdev->bss_lock);
2933 return NULL;
2934 }
2935
2936 struct cfg80211_bss *
cfg80211_inform_bss_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,gfp_t gfp)2937 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2938 struct cfg80211_inform_bss *data,
2939 struct ieee80211_mgmt *mgmt, size_t len,
2940 gfp_t gfp)
2941 {
2942 struct cfg80211_inform_single_bss_data inform_data = {
2943 .drv_data = data,
2944 .ie = mgmt->u.probe_resp.variable,
2945 .ielen = len - offsetof(struct ieee80211_mgmt,
2946 u.probe_resp.variable),
2947 };
2948 struct cfg80211_bss *res;
2949
2950 res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2951 len, gfp);
2952 if (!res)
2953 return NULL;
2954
2955 /* don't do any further MBSSID/ML handling for S1G */
2956 if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2957 return res;
2958
2959 inform_data.ftype = ieee80211_is_beacon(mgmt->frame_control) ?
2960 CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2961 memcpy(inform_data.bssid, mgmt->bssid, ETH_ALEN);
2962 inform_data.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2963 inform_data.beacon_interval =
2964 le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2965
2966 /* process each non-transmitting bss */
2967 cfg80211_parse_mbssid_data(wiphy, &inform_data, res, gfp);
2968
2969 cfg80211_parse_ml_sta_data(wiphy, &inform_data, res, gfp);
2970
2971 return res;
2972 }
2973 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
2974
cfg80211_ref_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)2975 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2976 {
2977 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2978
2979 if (!pub)
2980 return;
2981
2982 spin_lock_bh(&rdev->bss_lock);
2983 bss_ref_get(rdev, bss_from_pub(pub));
2984 spin_unlock_bh(&rdev->bss_lock);
2985 }
2986 EXPORT_SYMBOL(cfg80211_ref_bss);
2987
cfg80211_put_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)2988 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
2989 {
2990 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2991
2992 if (!pub)
2993 return;
2994
2995 spin_lock_bh(&rdev->bss_lock);
2996 bss_ref_put(rdev, bss_from_pub(pub));
2997 spin_unlock_bh(&rdev->bss_lock);
2998 }
2999 EXPORT_SYMBOL(cfg80211_put_bss);
3000
cfg80211_unlink_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)3001 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
3002 {
3003 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3004 struct cfg80211_internal_bss *bss, *tmp1;
3005 struct cfg80211_bss *nontrans_bss, *tmp;
3006
3007 if (WARN_ON(!pub))
3008 return;
3009
3010 bss = bss_from_pub(pub);
3011
3012 spin_lock_bh(&rdev->bss_lock);
3013 if (list_empty(&bss->list))
3014 goto out;
3015
3016 list_for_each_entry_safe(nontrans_bss, tmp,
3017 &pub->nontrans_list,
3018 nontrans_list) {
3019 tmp1 = bss_from_pub(nontrans_bss);
3020 if (__cfg80211_unlink_bss(rdev, tmp1))
3021 rdev->bss_generation++;
3022 }
3023
3024 if (__cfg80211_unlink_bss(rdev, bss))
3025 rdev->bss_generation++;
3026 out:
3027 spin_unlock_bh(&rdev->bss_lock);
3028 }
3029 EXPORT_SYMBOL(cfg80211_unlink_bss);
3030
cfg80211_bss_iter(struct wiphy * wiphy,struct cfg80211_chan_def * chandef,void (* iter)(struct wiphy * wiphy,struct cfg80211_bss * bss,void * data),void * iter_data)3031 void cfg80211_bss_iter(struct wiphy *wiphy,
3032 struct cfg80211_chan_def *chandef,
3033 void (*iter)(struct wiphy *wiphy,
3034 struct cfg80211_bss *bss,
3035 void *data),
3036 void *iter_data)
3037 {
3038 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3039 struct cfg80211_internal_bss *bss;
3040
3041 spin_lock_bh(&rdev->bss_lock);
3042
3043 list_for_each_entry(bss, &rdev->bss_list, list) {
3044 if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel,
3045 false))
3046 iter(wiphy, &bss->pub, iter_data);
3047 }
3048
3049 spin_unlock_bh(&rdev->bss_lock);
3050 }
3051 EXPORT_SYMBOL(cfg80211_bss_iter);
3052
cfg80211_update_assoc_bss_entry(struct wireless_dev * wdev,unsigned int link_id,struct ieee80211_channel * chan)3053 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
3054 unsigned int link_id,
3055 struct ieee80211_channel *chan)
3056 {
3057 struct wiphy *wiphy = wdev->wiphy;
3058 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3059 struct cfg80211_internal_bss *cbss = wdev->links[link_id].client.current_bss;
3060 struct cfg80211_internal_bss *new = NULL;
3061 struct cfg80211_internal_bss *bss;
3062 struct cfg80211_bss *nontrans_bss;
3063 struct cfg80211_bss *tmp;
3064
3065 spin_lock_bh(&rdev->bss_lock);
3066
3067 /*
3068 * Some APs use CSA also for bandwidth changes, i.e., without actually
3069 * changing the control channel, so no need to update in such a case.
3070 */
3071 if (cbss->pub.channel == chan)
3072 goto done;
3073
3074 /* use transmitting bss */
3075 if (cbss->pub.transmitted_bss)
3076 cbss = bss_from_pub(cbss->pub.transmitted_bss);
3077
3078 cbss->pub.channel = chan;
3079
3080 list_for_each_entry(bss, &rdev->bss_list, list) {
3081 if (!cfg80211_bss_type_match(bss->pub.capability,
3082 bss->pub.channel->band,
3083 wdev->conn_bss_type))
3084 continue;
3085
3086 if (bss == cbss)
3087 continue;
3088
3089 if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
3090 new = bss;
3091 break;
3092 }
3093 }
3094
3095 if (new) {
3096 /* to save time, update IEs for transmitting bss only */
3097 if (cfg80211_update_known_bss(rdev, cbss, new, false)) {
3098 new->pub.proberesp_ies = NULL;
3099 new->pub.beacon_ies = NULL;
3100 }
3101
3102 list_for_each_entry_safe(nontrans_bss, tmp,
3103 &new->pub.nontrans_list,
3104 nontrans_list) {
3105 bss = bss_from_pub(nontrans_bss);
3106 if (__cfg80211_unlink_bss(rdev, bss))
3107 rdev->bss_generation++;
3108 }
3109
3110 WARN_ON(atomic_read(&new->hold));
3111 if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
3112 rdev->bss_generation++;
3113 }
3114
3115 rb_erase(&cbss->rbn, &rdev->bss_tree);
3116 rb_insert_bss(rdev, cbss);
3117 rdev->bss_generation++;
3118
3119 list_for_each_entry_safe(nontrans_bss, tmp,
3120 &cbss->pub.nontrans_list,
3121 nontrans_list) {
3122 bss = bss_from_pub(nontrans_bss);
3123 bss->pub.channel = chan;
3124 rb_erase(&bss->rbn, &rdev->bss_tree);
3125 rb_insert_bss(rdev, bss);
3126 rdev->bss_generation++;
3127 }
3128
3129 done:
3130 spin_unlock_bh(&rdev->bss_lock);
3131 }
3132
3133 #ifdef CONFIG_CFG80211_WEXT
3134 static struct cfg80211_registered_device *
cfg80211_get_dev_from_ifindex(struct net * net,int ifindex)3135 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
3136 {
3137 struct cfg80211_registered_device *rdev;
3138 struct net_device *dev;
3139
3140 ASSERT_RTNL();
3141
3142 dev = dev_get_by_index(net, ifindex);
3143 if (!dev)
3144 return ERR_PTR(-ENODEV);
3145 if (dev->ieee80211_ptr)
3146 rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
3147 else
3148 rdev = ERR_PTR(-ENODEV);
3149 dev_put(dev);
3150 return rdev;
3151 }
3152
cfg80211_wext_siwscan(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)3153 int cfg80211_wext_siwscan(struct net_device *dev,
3154 struct iw_request_info *info,
3155 union iwreq_data *wrqu, char *extra)
3156 {
3157 struct cfg80211_registered_device *rdev;
3158 struct wiphy *wiphy;
3159 struct iw_scan_req *wreq = NULL;
3160 struct cfg80211_scan_request *creq;
3161 int i, err, n_channels = 0;
3162 enum nl80211_band band;
3163
3164 if (!netif_running(dev))
3165 return -ENETDOWN;
3166
3167 if (wrqu->data.length == sizeof(struct iw_scan_req))
3168 wreq = (struct iw_scan_req *)extra;
3169
3170 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3171
3172 if (IS_ERR(rdev))
3173 return PTR_ERR(rdev);
3174
3175 if (rdev->scan_req || rdev->scan_msg)
3176 return -EBUSY;
3177
3178 wiphy = &rdev->wiphy;
3179
3180 /* Determine number of channels, needed to allocate creq */
3181 if (wreq && wreq->num_channels) {
3182 /* Passed from userspace so should be checked */
3183 if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
3184 return -EINVAL;
3185 n_channels = wreq->num_channels;
3186 } else {
3187 n_channels = ieee80211_get_num_supported_channels(wiphy);
3188 }
3189
3190 creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
3191 n_channels * sizeof(void *),
3192 GFP_ATOMIC);
3193 if (!creq)
3194 return -ENOMEM;
3195
3196 creq->wiphy = wiphy;
3197 creq->wdev = dev->ieee80211_ptr;
3198 /* SSIDs come after channels */
3199 creq->ssids = (void *)&creq->channels[n_channels];
3200 creq->n_channels = n_channels;
3201 creq->n_ssids = 1;
3202 creq->scan_start = jiffies;
3203
3204 /* translate "Scan on frequencies" request */
3205 i = 0;
3206 for (band = 0; band < NUM_NL80211_BANDS; band++) {
3207 int j;
3208
3209 if (!wiphy->bands[band])
3210 continue;
3211
3212 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3213 /* ignore disabled channels */
3214 if (wiphy->bands[band]->channels[j].flags &
3215 IEEE80211_CHAN_DISABLED)
3216 continue;
3217
3218 /* If we have a wireless request structure and the
3219 * wireless request specifies frequencies, then search
3220 * for the matching hardware channel.
3221 */
3222 if (wreq && wreq->num_channels) {
3223 int k;
3224 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
3225 for (k = 0; k < wreq->num_channels; k++) {
3226 struct iw_freq *freq =
3227 &wreq->channel_list[k];
3228 int wext_freq =
3229 cfg80211_wext_freq(freq);
3230
3231 if (wext_freq == wiphy_freq)
3232 goto wext_freq_found;
3233 }
3234 goto wext_freq_not_found;
3235 }
3236
3237 wext_freq_found:
3238 creq->channels[i] = &wiphy->bands[band]->channels[j];
3239 i++;
3240 wext_freq_not_found: ;
3241 }
3242 }
3243 /* No channels found? */
3244 if (!i) {
3245 err = -EINVAL;
3246 goto out;
3247 }
3248
3249 /* Set real number of channels specified in creq->channels[] */
3250 creq->n_channels = i;
3251
3252 /* translate "Scan for SSID" request */
3253 if (wreq) {
3254 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
3255 if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
3256 err = -EINVAL;
3257 goto out;
3258 }
3259 memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
3260 creq->ssids[0].ssid_len = wreq->essid_len;
3261 }
3262 if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) {
3263 creq->ssids = NULL;
3264 creq->n_ssids = 0;
3265 }
3266 }
3267
3268 for (i = 0; i < NUM_NL80211_BANDS; i++)
3269 if (wiphy->bands[i])
3270 creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
3271
3272 eth_broadcast_addr(creq->bssid);
3273
3274 wiphy_lock(&rdev->wiphy);
3275
3276 rdev->scan_req = creq;
3277 err = rdev_scan(rdev, creq);
3278 if (err) {
3279 rdev->scan_req = NULL;
3280 /* creq will be freed below */
3281 } else {
3282 nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
3283 /* creq now owned by driver */
3284 creq = NULL;
3285 dev_hold(dev);
3286 }
3287 wiphy_unlock(&rdev->wiphy);
3288 out:
3289 kfree(creq);
3290 return err;
3291 }
3292 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
3293
ieee80211_scan_add_ies(struct iw_request_info * info,const struct cfg80211_bss_ies * ies,char * current_ev,char * end_buf)3294 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
3295 const struct cfg80211_bss_ies *ies,
3296 char *current_ev, char *end_buf)
3297 {
3298 const u8 *pos, *end, *next;
3299 struct iw_event iwe;
3300
3301 if (!ies)
3302 return current_ev;
3303
3304 /*
3305 * If needed, fragment the IEs buffer (at IE boundaries) into short
3306 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
3307 */
3308 pos = ies->data;
3309 end = pos + ies->len;
3310
3311 while (end - pos > IW_GENERIC_IE_MAX) {
3312 next = pos + 2 + pos[1];
3313 while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
3314 next = next + 2 + next[1];
3315
3316 memset(&iwe, 0, sizeof(iwe));
3317 iwe.cmd = IWEVGENIE;
3318 iwe.u.data.length = next - pos;
3319 current_ev = iwe_stream_add_point_check(info, current_ev,
3320 end_buf, &iwe,
3321 (void *)pos);
3322 if (IS_ERR(current_ev))
3323 return current_ev;
3324 pos = next;
3325 }
3326
3327 if (end > pos) {
3328 memset(&iwe, 0, sizeof(iwe));
3329 iwe.cmd = IWEVGENIE;
3330 iwe.u.data.length = end - pos;
3331 current_ev = iwe_stream_add_point_check(info, current_ev,
3332 end_buf, &iwe,
3333 (void *)pos);
3334 if (IS_ERR(current_ev))
3335 return current_ev;
3336 }
3337
3338 return current_ev;
3339 }
3340
3341 static char *
ieee80211_bss(struct wiphy * wiphy,struct iw_request_info * info,struct cfg80211_internal_bss * bss,char * current_ev,char * end_buf)3342 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
3343 struct cfg80211_internal_bss *bss, char *current_ev,
3344 char *end_buf)
3345 {
3346 const struct cfg80211_bss_ies *ies;
3347 struct iw_event iwe;
3348 const u8 *ie;
3349 u8 buf[50];
3350 u8 *cfg, *p, *tmp;
3351 int rem, i, sig;
3352 bool ismesh = false;
3353
3354 memset(&iwe, 0, sizeof(iwe));
3355 iwe.cmd = SIOCGIWAP;
3356 iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
3357 memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
3358 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
3359 IW_EV_ADDR_LEN);
3360 if (IS_ERR(current_ev))
3361 return current_ev;
3362
3363 memset(&iwe, 0, sizeof(iwe));
3364 iwe.cmd = SIOCGIWFREQ;
3365 iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
3366 iwe.u.freq.e = 0;
3367 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
3368 IW_EV_FREQ_LEN);
3369 if (IS_ERR(current_ev))
3370 return current_ev;
3371
3372 memset(&iwe, 0, sizeof(iwe));
3373 iwe.cmd = SIOCGIWFREQ;
3374 iwe.u.freq.m = bss->pub.channel->center_freq;
3375 iwe.u.freq.e = 6;
3376 current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
3377 IW_EV_FREQ_LEN);
3378 if (IS_ERR(current_ev))
3379 return current_ev;
3380
3381 if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
3382 memset(&iwe, 0, sizeof(iwe));
3383 iwe.cmd = IWEVQUAL;
3384 iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
3385 IW_QUAL_NOISE_INVALID |
3386 IW_QUAL_QUAL_UPDATED;
3387 switch (wiphy->signal_type) {
3388 case CFG80211_SIGNAL_TYPE_MBM:
3389 sig = bss->pub.signal / 100;
3390 iwe.u.qual.level = sig;
3391 iwe.u.qual.updated |= IW_QUAL_DBM;
3392 if (sig < -110) /* rather bad */
3393 sig = -110;
3394 else if (sig > -40) /* perfect */
3395 sig = -40;
3396 /* will give a range of 0 .. 70 */
3397 iwe.u.qual.qual = sig + 110;
3398 break;
3399 case CFG80211_SIGNAL_TYPE_UNSPEC:
3400 iwe.u.qual.level = bss->pub.signal;
3401 /* will give range 0 .. 100 */
3402 iwe.u.qual.qual = bss->pub.signal;
3403 break;
3404 default:
3405 /* not reached */
3406 break;
3407 }
3408 current_ev = iwe_stream_add_event_check(info, current_ev,
3409 end_buf, &iwe,
3410 IW_EV_QUAL_LEN);
3411 if (IS_ERR(current_ev))
3412 return current_ev;
3413 }
3414
3415 memset(&iwe, 0, sizeof(iwe));
3416 iwe.cmd = SIOCGIWENCODE;
3417 if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
3418 iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
3419 else
3420 iwe.u.data.flags = IW_ENCODE_DISABLED;
3421 iwe.u.data.length = 0;
3422 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3423 &iwe, "");
3424 if (IS_ERR(current_ev))
3425 return current_ev;
3426
3427 rcu_read_lock();
3428 ies = rcu_dereference(bss->pub.ies);
3429 rem = ies->len;
3430 ie = ies->data;
3431
3432 while (rem >= 2) {
3433 /* invalid data */
3434 if (ie[1] > rem - 2)
3435 break;
3436
3437 switch (ie[0]) {
3438 case WLAN_EID_SSID:
3439 memset(&iwe, 0, sizeof(iwe));
3440 iwe.cmd = SIOCGIWESSID;
3441 iwe.u.data.length = ie[1];
3442 iwe.u.data.flags = 1;
3443 current_ev = iwe_stream_add_point_check(info,
3444 current_ev,
3445 end_buf, &iwe,
3446 (u8 *)ie + 2);
3447 if (IS_ERR(current_ev))
3448 goto unlock;
3449 break;
3450 case WLAN_EID_MESH_ID:
3451 memset(&iwe, 0, sizeof(iwe));
3452 iwe.cmd = SIOCGIWESSID;
3453 iwe.u.data.length = ie[1];
3454 iwe.u.data.flags = 1;
3455 current_ev = iwe_stream_add_point_check(info,
3456 current_ev,
3457 end_buf, &iwe,
3458 (u8 *)ie + 2);
3459 if (IS_ERR(current_ev))
3460 goto unlock;
3461 break;
3462 case WLAN_EID_MESH_CONFIG:
3463 ismesh = true;
3464 if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
3465 break;
3466 cfg = (u8 *)ie + 2;
3467 memset(&iwe, 0, sizeof(iwe));
3468 iwe.cmd = IWEVCUSTOM;
3469 sprintf(buf, "Mesh Network Path Selection Protocol ID: "
3470 "0x%02X", cfg[0]);
3471 iwe.u.data.length = strlen(buf);
3472 current_ev = iwe_stream_add_point_check(info,
3473 current_ev,
3474 end_buf,
3475 &iwe, buf);
3476 if (IS_ERR(current_ev))
3477 goto unlock;
3478 sprintf(buf, "Path Selection Metric ID: 0x%02X",
3479 cfg[1]);
3480 iwe.u.data.length = strlen(buf);
3481 current_ev = iwe_stream_add_point_check(info,
3482 current_ev,
3483 end_buf,
3484 &iwe, buf);
3485 if (IS_ERR(current_ev))
3486 goto unlock;
3487 sprintf(buf, "Congestion Control Mode ID: 0x%02X",
3488 cfg[2]);
3489 iwe.u.data.length = strlen(buf);
3490 current_ev = iwe_stream_add_point_check(info,
3491 current_ev,
3492 end_buf,
3493 &iwe, buf);
3494 if (IS_ERR(current_ev))
3495 goto unlock;
3496 sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
3497 iwe.u.data.length = strlen(buf);
3498 current_ev = iwe_stream_add_point_check(info,
3499 current_ev,
3500 end_buf,
3501 &iwe, buf);
3502 if (IS_ERR(current_ev))
3503 goto unlock;
3504 sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
3505 iwe.u.data.length = strlen(buf);
3506 current_ev = iwe_stream_add_point_check(info,
3507 current_ev,
3508 end_buf,
3509 &iwe, buf);
3510 if (IS_ERR(current_ev))
3511 goto unlock;
3512 sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
3513 iwe.u.data.length = strlen(buf);
3514 current_ev = iwe_stream_add_point_check(info,
3515 current_ev,
3516 end_buf,
3517 &iwe, buf);
3518 if (IS_ERR(current_ev))
3519 goto unlock;
3520 sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
3521 iwe.u.data.length = strlen(buf);
3522 current_ev = iwe_stream_add_point_check(info,
3523 current_ev,
3524 end_buf,
3525 &iwe, buf);
3526 if (IS_ERR(current_ev))
3527 goto unlock;
3528 break;
3529 case WLAN_EID_SUPP_RATES:
3530 case WLAN_EID_EXT_SUPP_RATES:
3531 /* display all supported rates in readable format */
3532 p = current_ev + iwe_stream_lcp_len(info);
3533
3534 memset(&iwe, 0, sizeof(iwe));
3535 iwe.cmd = SIOCGIWRATE;
3536 /* Those two flags are ignored... */
3537 iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3538
3539 for (i = 0; i < ie[1]; i++) {
3540 iwe.u.bitrate.value =
3541 ((ie[i + 2] & 0x7f) * 500000);
3542 tmp = p;
3543 p = iwe_stream_add_value(info, current_ev, p,
3544 end_buf, &iwe,
3545 IW_EV_PARAM_LEN);
3546 if (p == tmp) {
3547 current_ev = ERR_PTR(-E2BIG);
3548 goto unlock;
3549 }
3550 }
3551 current_ev = p;
3552 break;
3553 }
3554 rem -= ie[1] + 2;
3555 ie += ie[1] + 2;
3556 }
3557
3558 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3559 ismesh) {
3560 memset(&iwe, 0, sizeof(iwe));
3561 iwe.cmd = SIOCGIWMODE;
3562 if (ismesh)
3563 iwe.u.mode = IW_MODE_MESH;
3564 else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3565 iwe.u.mode = IW_MODE_MASTER;
3566 else
3567 iwe.u.mode = IW_MODE_ADHOC;
3568 current_ev = iwe_stream_add_event_check(info, current_ev,
3569 end_buf, &iwe,
3570 IW_EV_UINT_LEN);
3571 if (IS_ERR(current_ev))
3572 goto unlock;
3573 }
3574
3575 memset(&iwe, 0, sizeof(iwe));
3576 iwe.cmd = IWEVCUSTOM;
3577 sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
3578 iwe.u.data.length = strlen(buf);
3579 current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3580 &iwe, buf);
3581 if (IS_ERR(current_ev))
3582 goto unlock;
3583 memset(&iwe, 0, sizeof(iwe));
3584 iwe.cmd = IWEVCUSTOM;
3585 sprintf(buf, " Last beacon: %ums ago",
3586 elapsed_jiffies_msecs(bss->ts));
3587 iwe.u.data.length = strlen(buf);
3588 current_ev = iwe_stream_add_point_check(info, current_ev,
3589 end_buf, &iwe, buf);
3590 if (IS_ERR(current_ev))
3591 goto unlock;
3592
3593 current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3594
3595 unlock:
3596 rcu_read_unlock();
3597 return current_ev;
3598 }
3599
3600
ieee80211_scan_results(struct cfg80211_registered_device * rdev,struct iw_request_info * info,char * buf,size_t len)3601 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3602 struct iw_request_info *info,
3603 char *buf, size_t len)
3604 {
3605 char *current_ev = buf;
3606 char *end_buf = buf + len;
3607 struct cfg80211_internal_bss *bss;
3608 int err = 0;
3609
3610 spin_lock_bh(&rdev->bss_lock);
3611 cfg80211_bss_expire(rdev);
3612
3613 list_for_each_entry(bss, &rdev->bss_list, list) {
3614 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3615 err = -E2BIG;
3616 break;
3617 }
3618 current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
3619 current_ev, end_buf);
3620 if (IS_ERR(current_ev)) {
3621 err = PTR_ERR(current_ev);
3622 break;
3623 }
3624 }
3625 spin_unlock_bh(&rdev->bss_lock);
3626
3627 if (err)
3628 return err;
3629 return current_ev - buf;
3630 }
3631
3632
cfg80211_wext_giwscan(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)3633 int cfg80211_wext_giwscan(struct net_device *dev,
3634 struct iw_request_info *info,
3635 union iwreq_data *wrqu, char *extra)
3636 {
3637 struct iw_point *data = &wrqu->data;
3638 struct cfg80211_registered_device *rdev;
3639 int res;
3640
3641 if (!netif_running(dev))
3642 return -ENETDOWN;
3643
3644 rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3645
3646 if (IS_ERR(rdev))
3647 return PTR_ERR(rdev);
3648
3649 if (rdev->scan_req || rdev->scan_msg)
3650 return -EAGAIN;
3651
3652 res = ieee80211_scan_results(rdev, info, extra, data->length);
3653 data->length = 0;
3654 if (res >= 0) {
3655 data->length = res;
3656 res = 0;
3657 }
3658
3659 return res;
3660 }
3661 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3662 #endif
3663