xref: /openbmc/linux/net/wireless/scan.c (revision 9f05824b)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * cfg80211 scan result handling
4  *
5  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
6  * Copyright 2013-2014  Intel Mobile Communications GmbH
7  * Copyright 2016	Intel Deutschland GmbH
8  * Copyright (C) 2018-2023 Intel Corporation
9  */
10 #include <linux/kernel.h>
11 #include <linux/slab.h>
12 #include <linux/module.h>
13 #include <linux/netdevice.h>
14 #include <linux/wireless.h>
15 #include <linux/nl80211.h>
16 #include <linux/etherdevice.h>
17 #include <linux/crc32.h>
18 #include <linux/bitfield.h>
19 #include <net/arp.h>
20 #include <net/cfg80211.h>
21 #include <net/cfg80211-wext.h>
22 #include <net/iw_handler.h>
23 #include "core.h"
24 #include "nl80211.h"
25 #include "wext-compat.h"
26 #include "rdev-ops.h"
27 
28 /**
29  * DOC: BSS tree/list structure
30  *
31  * At the top level, the BSS list is kept in both a list in each
32  * registered device (@bss_list) as well as an RB-tree for faster
33  * lookup. In the RB-tree, entries can be looked up using their
34  * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
35  * for other BSSes.
36  *
37  * Due to the possibility of hidden SSIDs, there's a second level
38  * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
39  * The hidden_list connects all BSSes belonging to a single AP
40  * that has a hidden SSID, and connects beacon and probe response
41  * entries. For a probe response entry for a hidden SSID, the
42  * hidden_beacon_bss pointer points to the BSS struct holding the
43  * beacon's information.
44  *
45  * Reference counting is done for all these references except for
46  * the hidden_list, so that a beacon BSS struct that is otherwise
47  * not referenced has one reference for being on the bss_list and
48  * one for each probe response entry that points to it using the
49  * hidden_beacon_bss pointer. When a BSS struct that has such a
50  * pointer is get/put, the refcount update is also propagated to
51  * the referenced struct, this ensure that it cannot get removed
52  * while somebody is using the probe response version.
53  *
54  * Note that the hidden_beacon_bss pointer never changes, due to
55  * the reference counting. Therefore, no locking is needed for
56  * it.
57  *
58  * Also note that the hidden_beacon_bss pointer is only relevant
59  * if the driver uses something other than the IEs, e.g. private
60  * data stored in the BSS struct, since the beacon IEs are
61  * also linked into the probe response struct.
62  */
63 
64 /*
65  * Limit the number of BSS entries stored in mac80211. Each one is
66  * a bit over 4k at most, so this limits to roughly 4-5M of memory.
67  * If somebody wants to really attack this though, they'd likely
68  * use small beacons, and only one type of frame, limiting each of
69  * the entries to a much smaller size (in order to generate more
70  * entries in total, so overhead is bigger.)
71  */
72 static int bss_entries_limit = 1000;
73 module_param(bss_entries_limit, int, 0644);
74 MODULE_PARM_DESC(bss_entries_limit,
75                  "limit to number of scan BSS entries (per wiphy, default 1000)");
76 
77 #define IEEE80211_SCAN_RESULT_EXPIRE	(30 * HZ)
78 
79 /**
80  * struct cfg80211_colocated_ap - colocated AP information
81  *
82  * @list: linked list to all colocated aPS
83  * @bssid: BSSID of the reported AP
84  * @ssid: SSID of the reported AP
85  * @ssid_len: length of the ssid
86  * @center_freq: frequency the reported AP is on
87  * @unsolicited_probe: the reported AP is part of an ESS, where all the APs
88  *	that operate in the same channel as the reported AP and that might be
89  *	detected by a STA receiving this frame, are transmitting unsolicited
90  *	Probe Response frames every 20 TUs
91  * @oct_recommended: OCT is recommended to exchange MMPDUs with the reported AP
92  * @same_ssid: the reported AP has the same SSID as the reporting AP
93  * @multi_bss: the reported AP is part of a multiple BSSID set
94  * @transmitted_bssid: the reported AP is the transmitting BSSID
95  * @colocated_ess: all the APs that share the same ESS as the reported AP are
96  *	colocated and can be discovered via legacy bands.
97  * @short_ssid_valid: short_ssid is valid and can be used
98  * @short_ssid: the short SSID for this SSID
99  * @psd_20: The 20MHz PSD EIRP of the primary 20MHz channel for the reported AP
100  */
101 struct cfg80211_colocated_ap {
102 	struct list_head list;
103 	u8 bssid[ETH_ALEN];
104 	u8 ssid[IEEE80211_MAX_SSID_LEN];
105 	size_t ssid_len;
106 	u32 short_ssid;
107 	u32 center_freq;
108 	u8 unsolicited_probe:1,
109 	   oct_recommended:1,
110 	   same_ssid:1,
111 	   multi_bss:1,
112 	   transmitted_bssid:1,
113 	   colocated_ess:1,
114 	   short_ssid_valid:1;
115 	s8 psd_20;
116 };
117 
bss_free(struct cfg80211_internal_bss * bss)118 static void bss_free(struct cfg80211_internal_bss *bss)
119 {
120 	struct cfg80211_bss_ies *ies;
121 
122 	if (WARN_ON(atomic_read(&bss->hold)))
123 		return;
124 
125 	ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
126 	if (ies && !bss->pub.hidden_beacon_bss)
127 		kfree_rcu(ies, rcu_head);
128 	ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
129 	if (ies)
130 		kfree_rcu(ies, rcu_head);
131 
132 	/*
133 	 * This happens when the module is removed, it doesn't
134 	 * really matter any more save for completeness
135 	 */
136 	if (!list_empty(&bss->hidden_list))
137 		list_del(&bss->hidden_list);
138 
139 	kfree(bss);
140 }
141 
bss_ref_get(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)142 static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
143 			       struct cfg80211_internal_bss *bss)
144 {
145 	lockdep_assert_held(&rdev->bss_lock);
146 
147 	bss->refcount++;
148 
149 	if (bss->pub.hidden_beacon_bss)
150 		bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
151 
152 	if (bss->pub.transmitted_bss)
153 		bss_from_pub(bss->pub.transmitted_bss)->refcount++;
154 }
155 
bss_ref_put(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)156 static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
157 			       struct cfg80211_internal_bss *bss)
158 {
159 	lockdep_assert_held(&rdev->bss_lock);
160 
161 	if (bss->pub.hidden_beacon_bss) {
162 		struct cfg80211_internal_bss *hbss;
163 
164 		hbss = bss_from_pub(bss->pub.hidden_beacon_bss);
165 		hbss->refcount--;
166 		if (hbss->refcount == 0)
167 			bss_free(hbss);
168 	}
169 
170 	if (bss->pub.transmitted_bss) {
171 		struct cfg80211_internal_bss *tbss;
172 
173 		tbss = bss_from_pub(bss->pub.transmitted_bss);
174 		tbss->refcount--;
175 		if (tbss->refcount == 0)
176 			bss_free(tbss);
177 	}
178 
179 	bss->refcount--;
180 	if (bss->refcount == 0)
181 		bss_free(bss);
182 }
183 
__cfg80211_unlink_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)184 static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
185 				  struct cfg80211_internal_bss *bss)
186 {
187 	lockdep_assert_held(&rdev->bss_lock);
188 
189 	if (!list_empty(&bss->hidden_list)) {
190 		/*
191 		 * don't remove the beacon entry if it has
192 		 * probe responses associated with it
193 		 */
194 		if (!bss->pub.hidden_beacon_bss)
195 			return false;
196 		/*
197 		 * if it's a probe response entry break its
198 		 * link to the other entries in the group
199 		 */
200 		list_del_init(&bss->hidden_list);
201 	}
202 
203 	list_del_init(&bss->list);
204 	list_del_init(&bss->pub.nontrans_list);
205 	rb_erase(&bss->rbn, &rdev->bss_tree);
206 	rdev->bss_entries--;
207 	WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list),
208 		  "rdev bss entries[%d]/list[empty:%d] corruption\n",
209 		  rdev->bss_entries, list_empty(&rdev->bss_list));
210 	bss_ref_put(rdev, bss);
211 	return true;
212 }
213 
cfg80211_is_element_inherited(const struct element * elem,const struct element * non_inherit_elem)214 bool cfg80211_is_element_inherited(const struct element *elem,
215 				   const struct element *non_inherit_elem)
216 {
217 	u8 id_len, ext_id_len, i, loop_len, id;
218 	const u8 *list;
219 
220 	if (elem->id == WLAN_EID_MULTIPLE_BSSID)
221 		return false;
222 
223 	if (elem->id == WLAN_EID_EXTENSION && elem->datalen > 1 &&
224 	    elem->data[0] == WLAN_EID_EXT_EHT_MULTI_LINK)
225 		return false;
226 
227 	if (!non_inherit_elem || non_inherit_elem->datalen < 2)
228 		return true;
229 
230 	/*
231 	 * non inheritance element format is:
232 	 * ext ID (56) | IDs list len | list | extension IDs list len | list
233 	 * Both lists are optional. Both lengths are mandatory.
234 	 * This means valid length is:
235 	 * elem_len = 1 (extension ID) + 2 (list len fields) + list lengths
236 	 */
237 	id_len = non_inherit_elem->data[1];
238 	if (non_inherit_elem->datalen < 3 + id_len)
239 		return true;
240 
241 	ext_id_len = non_inherit_elem->data[2 + id_len];
242 	if (non_inherit_elem->datalen < 3 + id_len + ext_id_len)
243 		return true;
244 
245 	if (elem->id == WLAN_EID_EXTENSION) {
246 		if (!ext_id_len)
247 			return true;
248 		loop_len = ext_id_len;
249 		list = &non_inherit_elem->data[3 + id_len];
250 		id = elem->data[0];
251 	} else {
252 		if (!id_len)
253 			return true;
254 		loop_len = id_len;
255 		list = &non_inherit_elem->data[2];
256 		id = elem->id;
257 	}
258 
259 	for (i = 0; i < loop_len; i++) {
260 		if (list[i] == id)
261 			return false;
262 	}
263 
264 	return true;
265 }
266 EXPORT_SYMBOL(cfg80211_is_element_inherited);
267 
cfg80211_copy_elem_with_frags(const struct element * elem,const u8 * ie,size_t ie_len,u8 ** pos,u8 * buf,size_t buf_len)268 static size_t cfg80211_copy_elem_with_frags(const struct element *elem,
269 					    const u8 *ie, size_t ie_len,
270 					    u8 **pos, u8 *buf, size_t buf_len)
271 {
272 	if (WARN_ON((u8 *)elem < ie || elem->data > ie + ie_len ||
273 		    elem->data + elem->datalen > ie + ie_len))
274 		return 0;
275 
276 	if (elem->datalen + 2 > buf + buf_len - *pos)
277 		return 0;
278 
279 	memcpy(*pos, elem, elem->datalen + 2);
280 	*pos += elem->datalen + 2;
281 
282 	/* Finish if it is not fragmented  */
283 	if (elem->datalen != 255)
284 		return *pos - buf;
285 
286 	ie_len = ie + ie_len - elem->data - elem->datalen;
287 	ie = (const u8 *)elem->data + elem->datalen;
288 
289 	for_each_element(elem, ie, ie_len) {
290 		if (elem->id != WLAN_EID_FRAGMENT)
291 			break;
292 
293 		if (elem->datalen + 2 > buf + buf_len - *pos)
294 			return 0;
295 
296 		memcpy(*pos, elem, elem->datalen + 2);
297 		*pos += elem->datalen + 2;
298 
299 		if (elem->datalen != 255)
300 			break;
301 	}
302 
303 	return *pos - buf;
304 }
305 
cfg80211_gen_new_ie(const u8 * ie,size_t ielen,const u8 * subie,size_t subie_len,u8 * new_ie,size_t new_ie_len)306 static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
307 				  const u8 *subie, size_t subie_len,
308 				  u8 *new_ie, size_t new_ie_len)
309 {
310 	const struct element *non_inherit_elem, *parent, *sub;
311 	u8 *pos = new_ie;
312 	u8 id, ext_id;
313 	unsigned int match_len;
314 
315 	non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
316 						  subie, subie_len);
317 
318 	/* We copy the elements one by one from the parent to the generated
319 	 * elements.
320 	 * If they are not inherited (included in subie or in the non
321 	 * inheritance element), then we copy all occurrences the first time
322 	 * we see this element type.
323 	 */
324 	for_each_element(parent, ie, ielen) {
325 		if (parent->id == WLAN_EID_FRAGMENT)
326 			continue;
327 
328 		if (parent->id == WLAN_EID_EXTENSION) {
329 			if (parent->datalen < 1)
330 				continue;
331 
332 			id = WLAN_EID_EXTENSION;
333 			ext_id = parent->data[0];
334 			match_len = 1;
335 		} else {
336 			id = parent->id;
337 			match_len = 0;
338 		}
339 
340 		/* Find first occurrence in subie */
341 		sub = cfg80211_find_elem_match(id, subie, subie_len,
342 					       &ext_id, match_len, 0);
343 
344 		/* Copy from parent if not in subie and inherited */
345 		if (!sub &&
346 		    cfg80211_is_element_inherited(parent, non_inherit_elem)) {
347 			if (!cfg80211_copy_elem_with_frags(parent,
348 							   ie, ielen,
349 							   &pos, new_ie,
350 							   new_ie_len))
351 				return 0;
352 
353 			continue;
354 		}
355 
356 		/* Already copied if an earlier element had the same type */
357 		if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie,
358 					     &ext_id, match_len, 0))
359 			continue;
360 
361 		/* Not inheriting, copy all similar elements from subie */
362 		while (sub) {
363 			if (!cfg80211_copy_elem_with_frags(sub,
364 							   subie, subie_len,
365 							   &pos, new_ie,
366 							   new_ie_len))
367 				return 0;
368 
369 			sub = cfg80211_find_elem_match(id,
370 						       sub->data + sub->datalen,
371 						       subie_len + subie -
372 						       (sub->data +
373 							sub->datalen),
374 						       &ext_id, match_len, 0);
375 		}
376 	}
377 
378 	/* The above misses elements that are included in subie but not in the
379 	 * parent, so do a pass over subie and append those.
380 	 * Skip the non-tx BSSID caps and non-inheritance element.
381 	 */
382 	for_each_element(sub, subie, subie_len) {
383 		if (sub->id == WLAN_EID_NON_TX_BSSID_CAP)
384 			continue;
385 
386 		if (sub->id == WLAN_EID_FRAGMENT)
387 			continue;
388 
389 		if (sub->id == WLAN_EID_EXTENSION) {
390 			if (sub->datalen < 1)
391 				continue;
392 
393 			id = WLAN_EID_EXTENSION;
394 			ext_id = sub->data[0];
395 			match_len = 1;
396 
397 			if (ext_id == WLAN_EID_EXT_NON_INHERITANCE)
398 				continue;
399 		} else {
400 			id = sub->id;
401 			match_len = 0;
402 		}
403 
404 		/* Processed if one was included in the parent */
405 		if (cfg80211_find_elem_match(id, ie, ielen,
406 					     &ext_id, match_len, 0))
407 			continue;
408 
409 		if (!cfg80211_copy_elem_with_frags(sub, subie, subie_len,
410 						   &pos, new_ie, new_ie_len))
411 			return 0;
412 	}
413 
414 	return pos - new_ie;
415 }
416 
is_bss(struct cfg80211_bss * a,const u8 * bssid,const u8 * ssid,size_t ssid_len)417 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
418 		   const u8 *ssid, size_t ssid_len)
419 {
420 	const struct cfg80211_bss_ies *ies;
421 	const struct element *ssid_elem;
422 
423 	if (bssid && !ether_addr_equal(a->bssid, bssid))
424 		return false;
425 
426 	if (!ssid)
427 		return true;
428 
429 	ies = rcu_access_pointer(a->ies);
430 	if (!ies)
431 		return false;
432 	ssid_elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
433 	if (!ssid_elem)
434 		return false;
435 	if (ssid_elem->datalen != ssid_len)
436 		return false;
437 	return memcmp(ssid_elem->data, ssid, ssid_len) == 0;
438 }
439 
440 static int
cfg80211_add_nontrans_list(struct cfg80211_bss * trans_bss,struct cfg80211_bss * nontrans_bss)441 cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
442 			   struct cfg80211_bss *nontrans_bss)
443 {
444 	const struct element *ssid_elem;
445 	struct cfg80211_bss *bss = NULL;
446 
447 	rcu_read_lock();
448 	ssid_elem = ieee80211_bss_get_elem(nontrans_bss, WLAN_EID_SSID);
449 	if (!ssid_elem) {
450 		rcu_read_unlock();
451 		return -EINVAL;
452 	}
453 
454 	/* check if nontrans_bss is in the list */
455 	list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
456 		if (is_bss(bss, nontrans_bss->bssid, ssid_elem->data,
457 			   ssid_elem->datalen)) {
458 			rcu_read_unlock();
459 			return 0;
460 		}
461 	}
462 
463 	rcu_read_unlock();
464 
465 	/*
466 	 * This is a bit weird - it's not on the list, but already on another
467 	 * one! The only way that could happen is if there's some BSSID/SSID
468 	 * shared by multiple APs in their multi-BSSID profiles, potentially
469 	 * with hidden SSID mixed in ... ignore it.
470 	 */
471 	if (!list_empty(&nontrans_bss->nontrans_list))
472 		return -EINVAL;
473 
474 	/* add to the list */
475 	list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
476 	return 0;
477 }
478 
__cfg80211_bss_expire(struct cfg80211_registered_device * rdev,unsigned long expire_time)479 static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
480 				  unsigned long expire_time)
481 {
482 	struct cfg80211_internal_bss *bss, *tmp;
483 	bool expired = false;
484 
485 	lockdep_assert_held(&rdev->bss_lock);
486 
487 	list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
488 		if (atomic_read(&bss->hold))
489 			continue;
490 		if (!time_after(expire_time, bss->ts))
491 			continue;
492 
493 		if (__cfg80211_unlink_bss(rdev, bss))
494 			expired = true;
495 	}
496 
497 	if (expired)
498 		rdev->bss_generation++;
499 }
500 
cfg80211_bss_expire_oldest(struct cfg80211_registered_device * rdev)501 static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev)
502 {
503 	struct cfg80211_internal_bss *bss, *oldest = NULL;
504 	bool ret;
505 
506 	lockdep_assert_held(&rdev->bss_lock);
507 
508 	list_for_each_entry(bss, &rdev->bss_list, list) {
509 		if (atomic_read(&bss->hold))
510 			continue;
511 
512 		if (!list_empty(&bss->hidden_list) &&
513 		    !bss->pub.hidden_beacon_bss)
514 			continue;
515 
516 		if (oldest && time_before(oldest->ts, bss->ts))
517 			continue;
518 		oldest = bss;
519 	}
520 
521 	if (WARN_ON(!oldest))
522 		return false;
523 
524 	/*
525 	 * The callers make sure to increase rdev->bss_generation if anything
526 	 * gets removed (and a new entry added), so there's no need to also do
527 	 * it here.
528 	 */
529 
530 	ret = __cfg80211_unlink_bss(rdev, oldest);
531 	WARN_ON(!ret);
532 	return ret;
533 }
534 
cfg80211_parse_bss_param(u8 data,struct cfg80211_colocated_ap * coloc_ap)535 static u8 cfg80211_parse_bss_param(u8 data,
536 				   struct cfg80211_colocated_ap *coloc_ap)
537 {
538 	coloc_ap->oct_recommended =
539 		u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED);
540 	coloc_ap->same_ssid =
541 		u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_SAME_SSID);
542 	coloc_ap->multi_bss =
543 		u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID);
544 	coloc_ap->transmitted_bssid =
545 		u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID);
546 	coloc_ap->unsolicited_probe =
547 		u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_PROBE_ACTIVE);
548 	coloc_ap->colocated_ess =
549 		u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_ESS);
550 
551 	return u8_get_bits(data, IEEE80211_RNR_TBTT_PARAMS_COLOC_AP);
552 }
553 
cfg80211_calc_short_ssid(const struct cfg80211_bss_ies * ies,const struct element ** elem,u32 * s_ssid)554 static int cfg80211_calc_short_ssid(const struct cfg80211_bss_ies *ies,
555 				    const struct element **elem, u32 *s_ssid)
556 {
557 
558 	*elem = cfg80211_find_elem(WLAN_EID_SSID, ies->data, ies->len);
559 	if (!*elem || (*elem)->datalen > IEEE80211_MAX_SSID_LEN)
560 		return -EINVAL;
561 
562 	*s_ssid = ~crc32_le(~0, (*elem)->data, (*elem)->datalen);
563 	return 0;
564 }
565 
cfg80211_free_coloc_ap_list(struct list_head * coloc_ap_list)566 static void cfg80211_free_coloc_ap_list(struct list_head *coloc_ap_list)
567 {
568 	struct cfg80211_colocated_ap *ap, *tmp_ap;
569 
570 	list_for_each_entry_safe(ap, tmp_ap, coloc_ap_list, list) {
571 		list_del(&ap->list);
572 		kfree(ap);
573 	}
574 }
575 
cfg80211_parse_ap_info(struct cfg80211_colocated_ap * entry,const u8 * pos,u8 length,const struct element * ssid_elem,u32 s_ssid_tmp)576 static int cfg80211_parse_ap_info(struct cfg80211_colocated_ap *entry,
577 				  const u8 *pos, u8 length,
578 				  const struct element *ssid_elem,
579 				  u32 s_ssid_tmp)
580 {
581 	u8 bss_params;
582 
583 	entry->psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
584 
585 	/* The length is already verified by the caller to contain bss_params */
586 	if (length > sizeof(struct ieee80211_tbtt_info_7_8_9)) {
587 		struct ieee80211_tbtt_info_ge_11 *tbtt_info = (void *)pos;
588 
589 		memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
590 		entry->short_ssid = le32_to_cpu(tbtt_info->short_ssid);
591 		entry->short_ssid_valid = true;
592 
593 		bss_params = tbtt_info->bss_params;
594 
595 		/* Ignore disabled links */
596 		if (length >= offsetofend(typeof(*tbtt_info), mld_params)) {
597 			if (le16_get_bits(tbtt_info->mld_params.params,
598 					  IEEE80211_RNR_MLD_PARAMS_DISABLED_LINK))
599 				return -EINVAL;
600 		}
601 
602 		if (length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
603 					  psd_20))
604 			entry->psd_20 = tbtt_info->psd_20;
605 	} else {
606 		struct ieee80211_tbtt_info_7_8_9 *tbtt_info = (void *)pos;
607 
608 		memcpy(entry->bssid, tbtt_info->bssid, ETH_ALEN);
609 
610 		bss_params = tbtt_info->bss_params;
611 
612 		if (length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
613 					  psd_20))
614 			entry->psd_20 = tbtt_info->psd_20;
615 	}
616 
617 	/* ignore entries with invalid BSSID */
618 	if (!is_valid_ether_addr(entry->bssid))
619 		return -EINVAL;
620 
621 	/* skip non colocated APs */
622 	if (!cfg80211_parse_bss_param(bss_params, entry))
623 		return -EINVAL;
624 
625 	/* no information about the short ssid. Consider the entry valid
626 	 * for now. It would later be dropped in case there are explicit
627 	 * SSIDs that need to be matched
628 	 */
629 	if (!entry->same_ssid && !entry->short_ssid_valid)
630 		return 0;
631 
632 	if (entry->same_ssid) {
633 		entry->short_ssid = s_ssid_tmp;
634 		entry->short_ssid_valid = true;
635 
636 		/*
637 		 * This is safe because we validate datalen in
638 		 * cfg80211_parse_colocated_ap(), before calling this
639 		 * function.
640 		 */
641 		memcpy(&entry->ssid, &ssid_elem->data, ssid_elem->datalen);
642 		entry->ssid_len = ssid_elem->datalen;
643 	}
644 
645 	return 0;
646 }
647 
cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies * ies,struct list_head * list)648 static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies,
649 				       struct list_head *list)
650 {
651 	struct ieee80211_neighbor_ap_info *ap_info;
652 	const struct element *elem, *ssid_elem;
653 	const u8 *pos, *end;
654 	u32 s_ssid_tmp;
655 	int n_coloc = 0, ret;
656 	LIST_HEAD(ap_list);
657 
658 	ret = cfg80211_calc_short_ssid(ies, &ssid_elem, &s_ssid_tmp);
659 	if (ret)
660 		return 0;
661 
662 	for_each_element_id(elem, WLAN_EID_REDUCED_NEIGHBOR_REPORT,
663 			    ies->data, ies->len) {
664 		pos = elem->data;
665 		end = elem->data + elem->datalen;
666 
667 		/* RNR IE may contain more than one NEIGHBOR_AP_INFO */
668 		while (pos + sizeof(*ap_info) <= end) {
669 			enum nl80211_band band;
670 			int freq;
671 			u8 length, i, count;
672 
673 			ap_info = (void *)pos;
674 			count = u8_get_bits(ap_info->tbtt_info_hdr,
675 					    IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
676 			length = ap_info->tbtt_info_len;
677 
678 			pos += sizeof(*ap_info);
679 
680 			if (!ieee80211_operating_class_to_band(ap_info->op_class,
681 							       &band))
682 				break;
683 
684 			freq = ieee80211_channel_to_frequency(ap_info->channel,
685 							      band);
686 
687 			if (end - pos < count * length)
688 				break;
689 
690 			if (u8_get_bits(ap_info->tbtt_info_hdr,
691 					IEEE80211_AP_INFO_TBTT_HDR_TYPE) !=
692 			    IEEE80211_TBTT_INFO_TYPE_TBTT) {
693 				pos += count * length;
694 				continue;
695 			}
696 
697 			/* TBTT info must include bss param + BSSID +
698 			 * (short SSID or same_ssid bit to be set).
699 			 * ignore other options, and move to the
700 			 * next AP info
701 			 */
702 			if (band != NL80211_BAND_6GHZ ||
703 			    !(length == offsetofend(struct ieee80211_tbtt_info_7_8_9,
704 						    bss_params) ||
705 			      length == sizeof(struct ieee80211_tbtt_info_7_8_9) ||
706 			      length >= offsetofend(struct ieee80211_tbtt_info_ge_11,
707 						    bss_params))) {
708 				pos += count * length;
709 				continue;
710 			}
711 
712 			for (i = 0; i < count; i++) {
713 				struct cfg80211_colocated_ap *entry;
714 
715 				entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
716 						GFP_ATOMIC);
717 
718 				if (!entry)
719 					goto error;
720 
721 				entry->center_freq = freq;
722 
723 				if (!cfg80211_parse_ap_info(entry, pos, length,
724 							    ssid_elem,
725 							    s_ssid_tmp)) {
726 					n_coloc++;
727 					list_add_tail(&entry->list, &ap_list);
728 				} else {
729 					kfree(entry);
730 				}
731 
732 				pos += length;
733 			}
734 		}
735 
736 error:
737 		if (pos != end) {
738 			cfg80211_free_coloc_ap_list(&ap_list);
739 			return 0;
740 		}
741 	}
742 
743 	list_splice_tail(&ap_list, list);
744 	return n_coloc;
745 }
746 
cfg80211_scan_req_add_chan(struct cfg80211_scan_request * request,struct ieee80211_channel * chan,bool add_to_6ghz)747 static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
748 					struct ieee80211_channel *chan,
749 					bool add_to_6ghz)
750 {
751 	int i;
752 	u32 n_channels = request->n_channels;
753 	struct cfg80211_scan_6ghz_params *params =
754 		&request->scan_6ghz_params[request->n_6ghz_params];
755 
756 	for (i = 0; i < n_channels; i++) {
757 		if (request->channels[i] == chan) {
758 			if (add_to_6ghz)
759 				params->channel_idx = i;
760 			return;
761 		}
762 	}
763 
764 	request->channels[n_channels] = chan;
765 	if (add_to_6ghz)
766 		request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
767 			n_channels;
768 
769 	request->n_channels++;
770 }
771 
cfg80211_find_ssid_match(struct cfg80211_colocated_ap * ap,struct cfg80211_scan_request * request)772 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
773 				     struct cfg80211_scan_request *request)
774 {
775 	int i;
776 	u32 s_ssid;
777 
778 	for (i = 0; i < request->n_ssids; i++) {
779 		/* wildcard ssid in the scan request */
780 		if (!request->ssids[i].ssid_len) {
781 			if (ap->multi_bss && !ap->transmitted_bssid)
782 				continue;
783 
784 			return true;
785 		}
786 
787 		if (ap->ssid_len &&
788 		    ap->ssid_len == request->ssids[i].ssid_len) {
789 			if (!memcmp(request->ssids[i].ssid, ap->ssid,
790 				    ap->ssid_len))
791 				return true;
792 		} else if (ap->short_ssid_valid) {
793 			s_ssid = ~crc32_le(~0, request->ssids[i].ssid,
794 					   request->ssids[i].ssid_len);
795 
796 			if (ap->short_ssid == s_ssid)
797 				return true;
798 		}
799 	}
800 
801 	return false;
802 }
803 
cfg80211_scan_6ghz(struct cfg80211_registered_device * rdev)804 static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
805 {
806 	u8 i;
807 	struct cfg80211_colocated_ap *ap;
808 	int n_channels, count = 0, err;
809 	struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
810 	LIST_HEAD(coloc_ap_list);
811 	bool need_scan_psc = true;
812 	const struct ieee80211_sband_iftype_data *iftd;
813 	size_t size, offs_ssids, offs_6ghz_params, offs_ies;
814 
815 	rdev_req->scan_6ghz = true;
816 
817 	if (!rdev->wiphy.bands[NL80211_BAND_6GHZ])
818 		return -EOPNOTSUPP;
819 
820 	iftd = ieee80211_get_sband_iftype_data(rdev->wiphy.bands[NL80211_BAND_6GHZ],
821 					       rdev_req->wdev->iftype);
822 	if (!iftd || !iftd->he_cap.has_he)
823 		return -EOPNOTSUPP;
824 
825 	n_channels = rdev->wiphy.bands[NL80211_BAND_6GHZ]->n_channels;
826 
827 	if (rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ) {
828 		struct cfg80211_internal_bss *intbss;
829 
830 		spin_lock_bh(&rdev->bss_lock);
831 		list_for_each_entry(intbss, &rdev->bss_list, list) {
832 			struct cfg80211_bss *res = &intbss->pub;
833 			const struct cfg80211_bss_ies *ies;
834 
835 			ies = rcu_access_pointer(res->ies);
836 			count += cfg80211_parse_colocated_ap(ies,
837 							     &coloc_ap_list);
838 		}
839 		spin_unlock_bh(&rdev->bss_lock);
840 	}
841 
842 	size = struct_size(request, channels, n_channels);
843 	offs_ssids = size;
844 	size += sizeof(*request->ssids) * rdev_req->n_ssids;
845 	offs_6ghz_params = size;
846 	size += sizeof(*request->scan_6ghz_params) * count;
847 	offs_ies = size;
848 	size += rdev_req->ie_len;
849 
850 	request = kzalloc(size, GFP_KERNEL);
851 	if (!request) {
852 		cfg80211_free_coloc_ap_list(&coloc_ap_list);
853 		return -ENOMEM;
854 	}
855 
856 	*request = *rdev_req;
857 	request->n_channels = 0;
858 	request->n_6ghz_params = 0;
859 	if (rdev_req->n_ssids) {
860 		/*
861 		 * Add the ssids from the parent scan request to the new
862 		 * scan request, so the driver would be able to use them
863 		 * in its probe requests to discover hidden APs on PSC
864 		 * channels.
865 		 */
866 		request->ssids = (void *)request + offs_ssids;
867 		memcpy(request->ssids, rdev_req->ssids,
868 		       sizeof(*request->ssids) * request->n_ssids);
869 	}
870 	request->scan_6ghz_params = (void *)request + offs_6ghz_params;
871 
872 	if (rdev_req->ie_len) {
873 		void *ie = (void *)request + offs_ies;
874 
875 		memcpy(ie, rdev_req->ie, rdev_req->ie_len);
876 		request->ie = ie;
877 	}
878 
879 	/*
880 	 * PSC channels should not be scanned in case of direct scan with 1 SSID
881 	 * and at least one of the reported co-located APs with same SSID
882 	 * indicating that all APs in the same ESS are co-located
883 	 */
884 	if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) {
885 		list_for_each_entry(ap, &coloc_ap_list, list) {
886 			if (ap->colocated_ess &&
887 			    cfg80211_find_ssid_match(ap, request)) {
888 				need_scan_psc = false;
889 				break;
890 			}
891 		}
892 	}
893 
894 	/*
895 	 * add to the scan request the channels that need to be scanned
896 	 * regardless of the collocated APs (PSC channels or all channels
897 	 * in case that NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set)
898 	 */
899 	for (i = 0; i < rdev_req->n_channels; i++) {
900 		if (rdev_req->channels[i]->band == NL80211_BAND_6GHZ &&
901 		    ((need_scan_psc &&
902 		      cfg80211_channel_is_psc(rdev_req->channels[i])) ||
903 		     !(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))) {
904 			cfg80211_scan_req_add_chan(request,
905 						   rdev_req->channels[i],
906 						   false);
907 		}
908 	}
909 
910 	if (!(rdev_req->flags & NL80211_SCAN_FLAG_COLOCATED_6GHZ))
911 		goto skip;
912 
913 	list_for_each_entry(ap, &coloc_ap_list, list) {
914 		bool found = false;
915 		struct cfg80211_scan_6ghz_params *scan_6ghz_params =
916 			&request->scan_6ghz_params[request->n_6ghz_params];
917 		struct ieee80211_channel *chan =
918 			ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
919 
920 		if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
921 			continue;
922 
923 		for (i = 0; i < rdev_req->n_channels; i++) {
924 			if (rdev_req->channels[i] == chan)
925 				found = true;
926 		}
927 
928 		if (!found)
929 			continue;
930 
931 		if (request->n_ssids > 0 &&
932 		    !cfg80211_find_ssid_match(ap, request))
933 			continue;
934 
935 		if (!is_broadcast_ether_addr(request->bssid) &&
936 		    !ether_addr_equal(request->bssid, ap->bssid))
937 			continue;
938 
939 		if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
940 			continue;
941 
942 		cfg80211_scan_req_add_chan(request, chan, true);
943 		memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN);
944 		scan_6ghz_params->short_ssid = ap->short_ssid;
945 		scan_6ghz_params->short_ssid_valid = ap->short_ssid_valid;
946 		scan_6ghz_params->unsolicited_probe = ap->unsolicited_probe;
947 		scan_6ghz_params->psd_20 = ap->psd_20;
948 
949 		/*
950 		 * If a PSC channel is added to the scan and 'need_scan_psc' is
951 		 * set to false, then all the APs that the scan logic is
952 		 * interested with on the channel are collocated and thus there
953 		 * is no need to perform the initial PSC channel listen.
954 		 */
955 		if (cfg80211_channel_is_psc(chan) && !need_scan_psc)
956 			scan_6ghz_params->psc_no_listen = true;
957 
958 		request->n_6ghz_params++;
959 	}
960 
961 skip:
962 	cfg80211_free_coloc_ap_list(&coloc_ap_list);
963 
964 	if (request->n_channels) {
965 		struct cfg80211_scan_request *old = rdev->int_scan_req;
966 
967 		rdev->int_scan_req = request;
968 
969 		/*
970 		 * If this scan follows a previous scan, save the scan start
971 		 * info from the first part of the scan
972 		 */
973 		if (old)
974 			rdev->int_scan_req->info = old->info;
975 
976 		err = rdev_scan(rdev, request);
977 		if (err) {
978 			rdev->int_scan_req = old;
979 			kfree(request);
980 		} else {
981 			kfree(old);
982 		}
983 
984 		return err;
985 	}
986 
987 	kfree(request);
988 	return -EINVAL;
989 }
990 
cfg80211_scan(struct cfg80211_registered_device * rdev)991 int cfg80211_scan(struct cfg80211_registered_device *rdev)
992 {
993 	struct cfg80211_scan_request *request;
994 	struct cfg80211_scan_request *rdev_req = rdev->scan_req;
995 	u32 n_channels = 0, idx, i;
996 
997 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ))
998 		return rdev_scan(rdev, rdev_req);
999 
1000 	for (i = 0; i < rdev_req->n_channels; i++) {
1001 		if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
1002 			n_channels++;
1003 	}
1004 
1005 	if (!n_channels)
1006 		return cfg80211_scan_6ghz(rdev);
1007 
1008 	request = kzalloc(struct_size(request, channels, n_channels),
1009 			  GFP_KERNEL);
1010 	if (!request)
1011 		return -ENOMEM;
1012 
1013 	*request = *rdev_req;
1014 	request->n_channels = n_channels;
1015 
1016 	for (i = idx = 0; i < rdev_req->n_channels; i++) {
1017 		if (rdev_req->channels[i]->band != NL80211_BAND_6GHZ)
1018 			request->channels[idx++] = rdev_req->channels[i];
1019 	}
1020 
1021 	rdev_req->scan_6ghz = false;
1022 	rdev->int_scan_req = request;
1023 	return rdev_scan(rdev, request);
1024 }
1025 
___cfg80211_scan_done(struct cfg80211_registered_device * rdev,bool send_message)1026 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
1027 			   bool send_message)
1028 {
1029 	struct cfg80211_scan_request *request, *rdev_req;
1030 	struct wireless_dev *wdev;
1031 	struct sk_buff *msg;
1032 #ifdef CONFIG_CFG80211_WEXT
1033 	union iwreq_data wrqu;
1034 #endif
1035 
1036 	lockdep_assert_held(&rdev->wiphy.mtx);
1037 
1038 	if (rdev->scan_msg) {
1039 		nl80211_send_scan_msg(rdev, rdev->scan_msg);
1040 		rdev->scan_msg = NULL;
1041 		return;
1042 	}
1043 
1044 	rdev_req = rdev->scan_req;
1045 	if (!rdev_req)
1046 		return;
1047 
1048 	wdev = rdev_req->wdev;
1049 	request = rdev->int_scan_req ? rdev->int_scan_req : rdev_req;
1050 
1051 	if (wdev_running(wdev) &&
1052 	    (rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ) &&
1053 	    !rdev_req->scan_6ghz && !request->info.aborted &&
1054 	    !cfg80211_scan_6ghz(rdev))
1055 		return;
1056 
1057 	/*
1058 	 * This must be before sending the other events!
1059 	 * Otherwise, wpa_supplicant gets completely confused with
1060 	 * wext events.
1061 	 */
1062 	if (wdev->netdev)
1063 		cfg80211_sme_scan_done(wdev->netdev);
1064 
1065 	if (!request->info.aborted &&
1066 	    request->flags & NL80211_SCAN_FLAG_FLUSH) {
1067 		/* flush entries from previous scans */
1068 		spin_lock_bh(&rdev->bss_lock);
1069 		__cfg80211_bss_expire(rdev, request->scan_start);
1070 		spin_unlock_bh(&rdev->bss_lock);
1071 	}
1072 
1073 	msg = nl80211_build_scan_msg(rdev, wdev, request->info.aborted);
1074 
1075 #ifdef CONFIG_CFG80211_WEXT
1076 	if (wdev->netdev && !request->info.aborted) {
1077 		memset(&wrqu, 0, sizeof(wrqu));
1078 
1079 		wireless_send_event(wdev->netdev, SIOCGIWSCAN, &wrqu, NULL);
1080 	}
1081 #endif
1082 
1083 	dev_put(wdev->netdev);
1084 
1085 	kfree(rdev->int_scan_req);
1086 	rdev->int_scan_req = NULL;
1087 
1088 	kfree(rdev->scan_req);
1089 	rdev->scan_req = NULL;
1090 
1091 	if (!send_message)
1092 		rdev->scan_msg = msg;
1093 	else
1094 		nl80211_send_scan_msg(rdev, msg);
1095 }
1096 
__cfg80211_scan_done(struct wiphy * wiphy,struct wiphy_work * wk)1097 void __cfg80211_scan_done(struct wiphy *wiphy, struct wiphy_work *wk)
1098 {
1099 	___cfg80211_scan_done(wiphy_to_rdev(wiphy), true);
1100 }
1101 
cfg80211_scan_done(struct cfg80211_scan_request * request,struct cfg80211_scan_info * info)1102 void cfg80211_scan_done(struct cfg80211_scan_request *request,
1103 			struct cfg80211_scan_info *info)
1104 {
1105 	struct cfg80211_scan_info old_info = request->info;
1106 
1107 	trace_cfg80211_scan_done(request, info);
1108 	WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req &&
1109 		request != wiphy_to_rdev(request->wiphy)->int_scan_req);
1110 
1111 	request->info = *info;
1112 
1113 	/*
1114 	 * In case the scan is split, the scan_start_tsf and tsf_bssid should
1115 	 * be of the first part. In such a case old_info.scan_start_tsf should
1116 	 * be non zero.
1117 	 */
1118 	if (request->scan_6ghz && old_info.scan_start_tsf) {
1119 		request->info.scan_start_tsf = old_info.scan_start_tsf;
1120 		memcpy(request->info.tsf_bssid, old_info.tsf_bssid,
1121 		       sizeof(request->info.tsf_bssid));
1122 	}
1123 
1124 	request->notified = true;
1125 	wiphy_work_queue(request->wiphy,
1126 			 &wiphy_to_rdev(request->wiphy)->scan_done_wk);
1127 }
1128 EXPORT_SYMBOL(cfg80211_scan_done);
1129 
cfg80211_add_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req)1130 void cfg80211_add_sched_scan_req(struct cfg80211_registered_device *rdev,
1131 				 struct cfg80211_sched_scan_request *req)
1132 {
1133 	lockdep_assert_held(&rdev->wiphy.mtx);
1134 
1135 	list_add_rcu(&req->list, &rdev->sched_scan_req_list);
1136 }
1137 
cfg80211_del_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req)1138 static void cfg80211_del_sched_scan_req(struct cfg80211_registered_device *rdev,
1139 					struct cfg80211_sched_scan_request *req)
1140 {
1141 	lockdep_assert_held(&rdev->wiphy.mtx);
1142 
1143 	list_del_rcu(&req->list);
1144 	kfree_rcu(req, rcu_head);
1145 }
1146 
1147 static struct cfg80211_sched_scan_request *
cfg80211_find_sched_scan_req(struct cfg80211_registered_device * rdev,u64 reqid)1148 cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
1149 {
1150 	struct cfg80211_sched_scan_request *pos;
1151 
1152 	list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list,
1153 				lockdep_is_held(&rdev->wiphy.mtx)) {
1154 		if (pos->reqid == reqid)
1155 			return pos;
1156 	}
1157 	return NULL;
1158 }
1159 
1160 /*
1161  * Determines if a scheduled scan request can be handled. When a legacy
1162  * scheduled scan is running no other scheduled scan is allowed regardless
1163  * whether the request is for legacy or multi-support scan. When a multi-support
1164  * scheduled scan is running a request for legacy scan is not allowed. In this
1165  * case a request for multi-support scan can be handled if resources are
1166  * available, ie. struct wiphy::max_sched_scan_reqs limit is not yet reached.
1167  */
cfg80211_sched_scan_req_possible(struct cfg80211_registered_device * rdev,bool want_multi)1168 int cfg80211_sched_scan_req_possible(struct cfg80211_registered_device *rdev,
1169 				     bool want_multi)
1170 {
1171 	struct cfg80211_sched_scan_request *pos;
1172 	int i = 0;
1173 
1174 	list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
1175 		/* request id zero means legacy in progress */
1176 		if (!i && !pos->reqid)
1177 			return -EINPROGRESS;
1178 		i++;
1179 	}
1180 
1181 	if (i) {
1182 		/* no legacy allowed when multi request(s) are active */
1183 		if (!want_multi)
1184 			return -EINPROGRESS;
1185 
1186 		/* resource limit reached */
1187 		if (i == rdev->wiphy.max_sched_scan_reqs)
1188 			return -ENOSPC;
1189 	}
1190 	return 0;
1191 }
1192 
cfg80211_sched_scan_results_wk(struct work_struct * work)1193 void cfg80211_sched_scan_results_wk(struct work_struct *work)
1194 {
1195 	struct cfg80211_registered_device *rdev;
1196 	struct cfg80211_sched_scan_request *req, *tmp;
1197 
1198 	rdev = container_of(work, struct cfg80211_registered_device,
1199 			   sched_scan_res_wk);
1200 
1201 	wiphy_lock(&rdev->wiphy);
1202 	list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
1203 		if (req->report_results) {
1204 			req->report_results = false;
1205 			if (req->flags & NL80211_SCAN_FLAG_FLUSH) {
1206 				/* flush entries from previous scans */
1207 				spin_lock_bh(&rdev->bss_lock);
1208 				__cfg80211_bss_expire(rdev, req->scan_start);
1209 				spin_unlock_bh(&rdev->bss_lock);
1210 				req->scan_start = jiffies;
1211 			}
1212 			nl80211_send_sched_scan(req,
1213 						NL80211_CMD_SCHED_SCAN_RESULTS);
1214 		}
1215 	}
1216 	wiphy_unlock(&rdev->wiphy);
1217 }
1218 
cfg80211_sched_scan_results(struct wiphy * wiphy,u64 reqid)1219 void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
1220 {
1221 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1222 	struct cfg80211_sched_scan_request *request;
1223 
1224 	trace_cfg80211_sched_scan_results(wiphy, reqid);
1225 	/* ignore if we're not scanning */
1226 
1227 	rcu_read_lock();
1228 	request = cfg80211_find_sched_scan_req(rdev, reqid);
1229 	if (request) {
1230 		request->report_results = true;
1231 		queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
1232 	}
1233 	rcu_read_unlock();
1234 }
1235 EXPORT_SYMBOL(cfg80211_sched_scan_results);
1236 
cfg80211_sched_scan_stopped_locked(struct wiphy * wiphy,u64 reqid)1237 void cfg80211_sched_scan_stopped_locked(struct wiphy *wiphy, u64 reqid)
1238 {
1239 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1240 
1241 	lockdep_assert_held(&wiphy->mtx);
1242 
1243 	trace_cfg80211_sched_scan_stopped(wiphy, reqid);
1244 
1245 	__cfg80211_stop_sched_scan(rdev, reqid, true);
1246 }
1247 EXPORT_SYMBOL(cfg80211_sched_scan_stopped_locked);
1248 
cfg80211_sched_scan_stopped(struct wiphy * wiphy,u64 reqid)1249 void cfg80211_sched_scan_stopped(struct wiphy *wiphy, u64 reqid)
1250 {
1251 	wiphy_lock(wiphy);
1252 	cfg80211_sched_scan_stopped_locked(wiphy, reqid);
1253 	wiphy_unlock(wiphy);
1254 }
1255 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
1256 
cfg80211_stop_sched_scan_req(struct cfg80211_registered_device * rdev,struct cfg80211_sched_scan_request * req,bool driver_initiated)1257 int cfg80211_stop_sched_scan_req(struct cfg80211_registered_device *rdev,
1258 				 struct cfg80211_sched_scan_request *req,
1259 				 bool driver_initiated)
1260 {
1261 	lockdep_assert_held(&rdev->wiphy.mtx);
1262 
1263 	if (!driver_initiated) {
1264 		int err = rdev_sched_scan_stop(rdev, req->dev, req->reqid);
1265 		if (err)
1266 			return err;
1267 	}
1268 
1269 	nl80211_send_sched_scan(req, NL80211_CMD_SCHED_SCAN_STOPPED);
1270 
1271 	cfg80211_del_sched_scan_req(rdev, req);
1272 
1273 	return 0;
1274 }
1275 
__cfg80211_stop_sched_scan(struct cfg80211_registered_device * rdev,u64 reqid,bool driver_initiated)1276 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
1277 			       u64 reqid, bool driver_initiated)
1278 {
1279 	struct cfg80211_sched_scan_request *sched_scan_req;
1280 
1281 	lockdep_assert_held(&rdev->wiphy.mtx);
1282 
1283 	sched_scan_req = cfg80211_find_sched_scan_req(rdev, reqid);
1284 	if (!sched_scan_req)
1285 		return -ENOENT;
1286 
1287 	return cfg80211_stop_sched_scan_req(rdev, sched_scan_req,
1288 					    driver_initiated);
1289 }
1290 
cfg80211_bss_age(struct cfg80211_registered_device * rdev,unsigned long age_secs)1291 void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
1292                       unsigned long age_secs)
1293 {
1294 	struct cfg80211_internal_bss *bss;
1295 	unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
1296 
1297 	spin_lock_bh(&rdev->bss_lock);
1298 	list_for_each_entry(bss, &rdev->bss_list, list)
1299 		bss->ts -= age_jiffies;
1300 	spin_unlock_bh(&rdev->bss_lock);
1301 }
1302 
cfg80211_bss_expire(struct cfg80211_registered_device * rdev)1303 void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
1304 {
1305 	__cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
1306 }
1307 
cfg80211_bss_flush(struct wiphy * wiphy)1308 void cfg80211_bss_flush(struct wiphy *wiphy)
1309 {
1310 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1311 
1312 	spin_lock_bh(&rdev->bss_lock);
1313 	__cfg80211_bss_expire(rdev, jiffies);
1314 	spin_unlock_bh(&rdev->bss_lock);
1315 }
1316 EXPORT_SYMBOL(cfg80211_bss_flush);
1317 
1318 const struct element *
cfg80211_find_elem_match(u8 eid,const u8 * ies,unsigned int len,const u8 * match,unsigned int match_len,unsigned int match_offset)1319 cfg80211_find_elem_match(u8 eid, const u8 *ies, unsigned int len,
1320 			 const u8 *match, unsigned int match_len,
1321 			 unsigned int match_offset)
1322 {
1323 	const struct element *elem;
1324 
1325 	for_each_element_id(elem, eid, ies, len) {
1326 		if (elem->datalen >= match_offset + match_len &&
1327 		    !memcmp(elem->data + match_offset, match, match_len))
1328 			return elem;
1329 	}
1330 
1331 	return NULL;
1332 }
1333 EXPORT_SYMBOL(cfg80211_find_elem_match);
1334 
cfg80211_find_vendor_elem(unsigned int oui,int oui_type,const u8 * ies,unsigned int len)1335 const struct element *cfg80211_find_vendor_elem(unsigned int oui, int oui_type,
1336 						const u8 *ies,
1337 						unsigned int len)
1338 {
1339 	const struct element *elem;
1340 	u8 match[] = { oui >> 16, oui >> 8, oui, oui_type };
1341 	int match_len = (oui_type < 0) ? 3 : sizeof(match);
1342 
1343 	if (WARN_ON(oui_type > 0xff))
1344 		return NULL;
1345 
1346 	elem = cfg80211_find_elem_match(WLAN_EID_VENDOR_SPECIFIC, ies, len,
1347 					match, match_len, 0);
1348 
1349 	if (!elem || elem->datalen < 4)
1350 		return NULL;
1351 
1352 	return elem;
1353 }
1354 EXPORT_SYMBOL(cfg80211_find_vendor_elem);
1355 
1356 /**
1357  * enum bss_compare_mode - BSS compare mode
1358  * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
1359  * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
1360  * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
1361  */
1362 enum bss_compare_mode {
1363 	BSS_CMP_REGULAR,
1364 	BSS_CMP_HIDE_ZLEN,
1365 	BSS_CMP_HIDE_NUL,
1366 };
1367 
cmp_bss(struct cfg80211_bss * a,struct cfg80211_bss * b,enum bss_compare_mode mode)1368 static int cmp_bss(struct cfg80211_bss *a,
1369 		   struct cfg80211_bss *b,
1370 		   enum bss_compare_mode mode)
1371 {
1372 	const struct cfg80211_bss_ies *a_ies, *b_ies;
1373 	const u8 *ie1 = NULL;
1374 	const u8 *ie2 = NULL;
1375 	int i, r;
1376 
1377 	if (a->channel != b->channel)
1378 		return (b->channel->center_freq * 1000 + b->channel->freq_offset) -
1379 		       (a->channel->center_freq * 1000 + a->channel->freq_offset);
1380 
1381 	a_ies = rcu_access_pointer(a->ies);
1382 	if (!a_ies)
1383 		return -1;
1384 	b_ies = rcu_access_pointer(b->ies);
1385 	if (!b_ies)
1386 		return 1;
1387 
1388 	if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
1389 		ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1390 				       a_ies->data, a_ies->len);
1391 	if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
1392 		ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
1393 				       b_ies->data, b_ies->len);
1394 	if (ie1 && ie2) {
1395 		int mesh_id_cmp;
1396 
1397 		if (ie1[1] == ie2[1])
1398 			mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1399 		else
1400 			mesh_id_cmp = ie2[1] - ie1[1];
1401 
1402 		ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1403 				       a_ies->data, a_ies->len);
1404 		ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
1405 				       b_ies->data, b_ies->len);
1406 		if (ie1 && ie2) {
1407 			if (mesh_id_cmp)
1408 				return mesh_id_cmp;
1409 			if (ie1[1] != ie2[1])
1410 				return ie2[1] - ie1[1];
1411 			return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1412 		}
1413 	}
1414 
1415 	r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
1416 	if (r)
1417 		return r;
1418 
1419 	ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
1420 	ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
1421 
1422 	if (!ie1 && !ie2)
1423 		return 0;
1424 
1425 	/*
1426 	 * Note that with "hide_ssid", the function returns a match if
1427 	 * the already-present BSS ("b") is a hidden SSID beacon for
1428 	 * the new BSS ("a").
1429 	 */
1430 
1431 	/* sort missing IE before (left of) present IE */
1432 	if (!ie1)
1433 		return -1;
1434 	if (!ie2)
1435 		return 1;
1436 
1437 	switch (mode) {
1438 	case BSS_CMP_HIDE_ZLEN:
1439 		/*
1440 		 * In ZLEN mode we assume the BSS entry we're
1441 		 * looking for has a zero-length SSID. So if
1442 		 * the one we're looking at right now has that,
1443 		 * return 0. Otherwise, return the difference
1444 		 * in length, but since we're looking for the
1445 		 * 0-length it's really equivalent to returning
1446 		 * the length of the one we're looking at.
1447 		 *
1448 		 * No content comparison is needed as we assume
1449 		 * the content length is zero.
1450 		 */
1451 		return ie2[1];
1452 	case BSS_CMP_REGULAR:
1453 	default:
1454 		/* sort by length first, then by contents */
1455 		if (ie1[1] != ie2[1])
1456 			return ie2[1] - ie1[1];
1457 		return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
1458 	case BSS_CMP_HIDE_NUL:
1459 		if (ie1[1] != ie2[1])
1460 			return ie2[1] - ie1[1];
1461 		/* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
1462 		for (i = 0; i < ie2[1]; i++)
1463 			if (ie2[i + 2])
1464 				return -1;
1465 		return 0;
1466 	}
1467 }
1468 
cfg80211_bss_type_match(u16 capability,enum nl80211_band band,enum ieee80211_bss_type bss_type)1469 static bool cfg80211_bss_type_match(u16 capability,
1470 				    enum nl80211_band band,
1471 				    enum ieee80211_bss_type bss_type)
1472 {
1473 	bool ret = true;
1474 	u16 mask, val;
1475 
1476 	if (bss_type == IEEE80211_BSS_TYPE_ANY)
1477 		return ret;
1478 
1479 	if (band == NL80211_BAND_60GHZ) {
1480 		mask = WLAN_CAPABILITY_DMG_TYPE_MASK;
1481 		switch (bss_type) {
1482 		case IEEE80211_BSS_TYPE_ESS:
1483 			val = WLAN_CAPABILITY_DMG_TYPE_AP;
1484 			break;
1485 		case IEEE80211_BSS_TYPE_PBSS:
1486 			val = WLAN_CAPABILITY_DMG_TYPE_PBSS;
1487 			break;
1488 		case IEEE80211_BSS_TYPE_IBSS:
1489 			val = WLAN_CAPABILITY_DMG_TYPE_IBSS;
1490 			break;
1491 		default:
1492 			return false;
1493 		}
1494 	} else {
1495 		mask = WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS;
1496 		switch (bss_type) {
1497 		case IEEE80211_BSS_TYPE_ESS:
1498 			val = WLAN_CAPABILITY_ESS;
1499 			break;
1500 		case IEEE80211_BSS_TYPE_IBSS:
1501 			val = WLAN_CAPABILITY_IBSS;
1502 			break;
1503 		case IEEE80211_BSS_TYPE_MBSS:
1504 			val = 0;
1505 			break;
1506 		default:
1507 			return false;
1508 		}
1509 	}
1510 
1511 	ret = ((capability & mask) == val);
1512 	return ret;
1513 }
1514 
1515 /* Returned bss is reference counted and must be cleaned up appropriately. */
cfg80211_get_bss(struct wiphy * wiphy,struct ieee80211_channel * channel,const u8 * bssid,const u8 * ssid,size_t ssid_len,enum ieee80211_bss_type bss_type,enum ieee80211_privacy privacy)1516 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
1517 				      struct ieee80211_channel *channel,
1518 				      const u8 *bssid,
1519 				      const u8 *ssid, size_t ssid_len,
1520 				      enum ieee80211_bss_type bss_type,
1521 				      enum ieee80211_privacy privacy)
1522 {
1523 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1524 	struct cfg80211_internal_bss *bss, *res = NULL;
1525 	unsigned long now = jiffies;
1526 	int bss_privacy;
1527 
1528 	trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, bss_type,
1529 			       privacy);
1530 
1531 	spin_lock_bh(&rdev->bss_lock);
1532 
1533 	list_for_each_entry(bss, &rdev->bss_list, list) {
1534 		if (!cfg80211_bss_type_match(bss->pub.capability,
1535 					     bss->pub.channel->band, bss_type))
1536 			continue;
1537 
1538 		bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
1539 		if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
1540 		    (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
1541 			continue;
1542 		if (channel && bss->pub.channel != channel)
1543 			continue;
1544 		if (!is_valid_ether_addr(bss->pub.bssid))
1545 			continue;
1546 		/* Don't get expired BSS structs */
1547 		if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
1548 		    !atomic_read(&bss->hold))
1549 			continue;
1550 		if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
1551 			res = bss;
1552 			bss_ref_get(rdev, res);
1553 			break;
1554 		}
1555 	}
1556 
1557 	spin_unlock_bh(&rdev->bss_lock);
1558 	if (!res)
1559 		return NULL;
1560 	trace_cfg80211_return_bss(&res->pub);
1561 	return &res->pub;
1562 }
1563 EXPORT_SYMBOL(cfg80211_get_bss);
1564 
rb_insert_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)1565 static bool rb_insert_bss(struct cfg80211_registered_device *rdev,
1566 			  struct cfg80211_internal_bss *bss)
1567 {
1568 	struct rb_node **p = &rdev->bss_tree.rb_node;
1569 	struct rb_node *parent = NULL;
1570 	struct cfg80211_internal_bss *tbss;
1571 	int cmp;
1572 
1573 	while (*p) {
1574 		parent = *p;
1575 		tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
1576 
1577 		cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
1578 
1579 		if (WARN_ON(!cmp)) {
1580 			/* will sort of leak this BSS */
1581 			return false;
1582 		}
1583 
1584 		if (cmp < 0)
1585 			p = &(*p)->rb_left;
1586 		else
1587 			p = &(*p)->rb_right;
1588 	}
1589 
1590 	rb_link_node(&bss->rbn, parent, p);
1591 	rb_insert_color(&bss->rbn, &rdev->bss_tree);
1592 	return true;
1593 }
1594 
1595 static struct cfg80211_internal_bss *
rb_find_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * res,enum bss_compare_mode mode)1596 rb_find_bss(struct cfg80211_registered_device *rdev,
1597 	    struct cfg80211_internal_bss *res,
1598 	    enum bss_compare_mode mode)
1599 {
1600 	struct rb_node *n = rdev->bss_tree.rb_node;
1601 	struct cfg80211_internal_bss *bss;
1602 	int r;
1603 
1604 	while (n) {
1605 		bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
1606 		r = cmp_bss(&res->pub, &bss->pub, mode);
1607 
1608 		if (r == 0)
1609 			return bss;
1610 		else if (r < 0)
1611 			n = n->rb_left;
1612 		else
1613 			n = n->rb_right;
1614 	}
1615 
1616 	return NULL;
1617 }
1618 
cfg80211_insert_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)1619 static void cfg80211_insert_bss(struct cfg80211_registered_device *rdev,
1620 				struct cfg80211_internal_bss *bss)
1621 {
1622 	lockdep_assert_held(&rdev->bss_lock);
1623 
1624 	if (!rb_insert_bss(rdev, bss))
1625 		return;
1626 	list_add_tail(&bss->list, &rdev->bss_list);
1627 	rdev->bss_entries++;
1628 }
1629 
cfg80211_rehash_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * bss)1630 static void cfg80211_rehash_bss(struct cfg80211_registered_device *rdev,
1631                                 struct cfg80211_internal_bss *bss)
1632 {
1633 	lockdep_assert_held(&rdev->bss_lock);
1634 
1635 	rb_erase(&bss->rbn, &rdev->bss_tree);
1636 	if (!rb_insert_bss(rdev, bss)) {
1637 		list_del(&bss->list);
1638 		if (!list_empty(&bss->hidden_list))
1639 			list_del_init(&bss->hidden_list);
1640 		if (!list_empty(&bss->pub.nontrans_list))
1641 			list_del_init(&bss->pub.nontrans_list);
1642 		rdev->bss_entries--;
1643 	}
1644 	rdev->bss_generation++;
1645 }
1646 
cfg80211_combine_bsses(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * new)1647 static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
1648 				   struct cfg80211_internal_bss *new)
1649 {
1650 	const struct cfg80211_bss_ies *ies;
1651 	struct cfg80211_internal_bss *bss;
1652 	const u8 *ie;
1653 	int i, ssidlen;
1654 	u8 fold = 0;
1655 	u32 n_entries = 0;
1656 
1657 	ies = rcu_access_pointer(new->pub.beacon_ies);
1658 	if (WARN_ON(!ies))
1659 		return false;
1660 
1661 	ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1662 	if (!ie) {
1663 		/* nothing to do */
1664 		return true;
1665 	}
1666 
1667 	ssidlen = ie[1];
1668 	for (i = 0; i < ssidlen; i++)
1669 		fold |= ie[2 + i];
1670 
1671 	if (fold) {
1672 		/* not a hidden SSID */
1673 		return true;
1674 	}
1675 
1676 	/* This is the bad part ... */
1677 
1678 	list_for_each_entry(bss, &rdev->bss_list, list) {
1679 		/*
1680 		 * we're iterating all the entries anyway, so take the
1681 		 * opportunity to validate the list length accounting
1682 		 */
1683 		n_entries++;
1684 
1685 		if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
1686 			continue;
1687 		if (bss->pub.channel != new->pub.channel)
1688 			continue;
1689 		if (bss->pub.scan_width != new->pub.scan_width)
1690 			continue;
1691 		if (rcu_access_pointer(bss->pub.beacon_ies))
1692 			continue;
1693 		ies = rcu_access_pointer(bss->pub.ies);
1694 		if (!ies)
1695 			continue;
1696 		ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
1697 		if (!ie)
1698 			continue;
1699 		if (ssidlen && ie[1] != ssidlen)
1700 			continue;
1701 		if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
1702 			continue;
1703 		if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
1704 			list_del(&bss->hidden_list);
1705 		/* combine them */
1706 		list_add(&bss->hidden_list, &new->hidden_list);
1707 		bss->pub.hidden_beacon_bss = &new->pub;
1708 		new->refcount += bss->refcount;
1709 		rcu_assign_pointer(bss->pub.beacon_ies,
1710 				   new->pub.beacon_ies);
1711 	}
1712 
1713 	WARN_ONCE(n_entries != rdev->bss_entries,
1714 		  "rdev bss entries[%d]/list[len:%d] corruption\n",
1715 		  rdev->bss_entries, n_entries);
1716 
1717 	return true;
1718 }
1719 
cfg80211_update_hidden_bsses(struct cfg80211_internal_bss * known,const struct cfg80211_bss_ies * new_ies,const struct cfg80211_bss_ies * old_ies)1720 static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
1721 					 const struct cfg80211_bss_ies *new_ies,
1722 					 const struct cfg80211_bss_ies *old_ies)
1723 {
1724 	struct cfg80211_internal_bss *bss;
1725 
1726 	/* Assign beacon IEs to all sub entries */
1727 	list_for_each_entry(bss, &known->hidden_list, hidden_list) {
1728 		const struct cfg80211_bss_ies *ies;
1729 
1730 		ies = rcu_access_pointer(bss->pub.beacon_ies);
1731 		WARN_ON(ies != old_ies);
1732 
1733 		rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
1734 	}
1735 }
1736 
1737 static bool
cfg80211_update_known_bss(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * known,struct cfg80211_internal_bss * new,bool signal_valid)1738 cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
1739 			  struct cfg80211_internal_bss *known,
1740 			  struct cfg80211_internal_bss *new,
1741 			  bool signal_valid)
1742 {
1743 	lockdep_assert_held(&rdev->bss_lock);
1744 
1745 	/* Update IEs */
1746 	if (rcu_access_pointer(new->pub.proberesp_ies)) {
1747 		const struct cfg80211_bss_ies *old;
1748 
1749 		old = rcu_access_pointer(known->pub.proberesp_ies);
1750 
1751 		rcu_assign_pointer(known->pub.proberesp_ies,
1752 				   new->pub.proberesp_ies);
1753 		/* Override possible earlier Beacon frame IEs */
1754 		rcu_assign_pointer(known->pub.ies,
1755 				   new->pub.proberesp_ies);
1756 		if (old)
1757 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1758 	} else if (rcu_access_pointer(new->pub.beacon_ies)) {
1759 		const struct cfg80211_bss_ies *old;
1760 
1761 		if (known->pub.hidden_beacon_bss &&
1762 		    !list_empty(&known->hidden_list)) {
1763 			const struct cfg80211_bss_ies *f;
1764 
1765 			/* The known BSS struct is one of the probe
1766 			 * response members of a group, but we're
1767 			 * receiving a beacon (beacon_ies in the new
1768 			 * bss is used). This can only mean that the
1769 			 * AP changed its beacon from not having an
1770 			 * SSID to showing it, which is confusing so
1771 			 * drop this information.
1772 			 */
1773 
1774 			f = rcu_access_pointer(new->pub.beacon_ies);
1775 			kfree_rcu((struct cfg80211_bss_ies *)f, rcu_head);
1776 			return false;
1777 		}
1778 
1779 		old = rcu_access_pointer(known->pub.beacon_ies);
1780 
1781 		rcu_assign_pointer(known->pub.beacon_ies, new->pub.beacon_ies);
1782 
1783 		/* Override IEs if they were from a beacon before */
1784 		if (old == rcu_access_pointer(known->pub.ies))
1785 			rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
1786 
1787 		cfg80211_update_hidden_bsses(known,
1788 					     rcu_access_pointer(new->pub.beacon_ies),
1789 					     old);
1790 
1791 		if (old)
1792 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
1793 	}
1794 
1795 	known->pub.beacon_interval = new->pub.beacon_interval;
1796 
1797 	/* don't update the signal if beacon was heard on
1798 	 * adjacent channel.
1799 	 */
1800 	if (signal_valid)
1801 		known->pub.signal = new->pub.signal;
1802 	known->pub.capability = new->pub.capability;
1803 	known->ts = new->ts;
1804 	known->ts_boottime = new->ts_boottime;
1805 	known->parent_tsf = new->parent_tsf;
1806 	known->pub.chains = new->pub.chains;
1807 	memcpy(known->pub.chain_signal, new->pub.chain_signal,
1808 	       IEEE80211_MAX_CHAINS);
1809 	ether_addr_copy(known->parent_bssid, new->parent_bssid);
1810 	known->pub.max_bssid_indicator = new->pub.max_bssid_indicator;
1811 	known->pub.bssid_index = new->pub.bssid_index;
1812 
1813 	return true;
1814 }
1815 
1816 /* Returned bss is reference counted and must be cleaned up appropriately. */
1817 static struct cfg80211_internal_bss *
__cfg80211_bss_update(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * tmp,bool signal_valid,unsigned long ts)1818 __cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1819 		      struct cfg80211_internal_bss *tmp,
1820 		      bool signal_valid, unsigned long ts)
1821 {
1822 	struct cfg80211_internal_bss *found = NULL;
1823 
1824 	if (WARN_ON(!tmp->pub.channel))
1825 		return NULL;
1826 
1827 	tmp->ts = ts;
1828 
1829 	if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
1830 		return NULL;
1831 	}
1832 
1833 	found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
1834 
1835 	if (found) {
1836 		if (!cfg80211_update_known_bss(rdev, found, tmp, signal_valid))
1837 			return NULL;
1838 	} else {
1839 		struct cfg80211_internal_bss *new;
1840 		struct cfg80211_internal_bss *hidden;
1841 		struct cfg80211_bss_ies *ies;
1842 
1843 		/*
1844 		 * create a copy -- the "res" variable that is passed in
1845 		 * is allocated on the stack since it's not needed in the
1846 		 * more common case of an update
1847 		 */
1848 		new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
1849 			      GFP_ATOMIC);
1850 		if (!new) {
1851 			ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
1852 			if (ies)
1853 				kfree_rcu(ies, rcu_head);
1854 			ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
1855 			if (ies)
1856 				kfree_rcu(ies, rcu_head);
1857 			return NULL;
1858 		}
1859 		memcpy(new, tmp, sizeof(*new));
1860 		new->refcount = 1;
1861 		INIT_LIST_HEAD(&new->hidden_list);
1862 		INIT_LIST_HEAD(&new->pub.nontrans_list);
1863 		/* we'll set this later if it was non-NULL */
1864 		new->pub.transmitted_bss = NULL;
1865 
1866 		if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
1867 			hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
1868 			if (!hidden)
1869 				hidden = rb_find_bss(rdev, tmp,
1870 						     BSS_CMP_HIDE_NUL);
1871 			if (hidden) {
1872 				new->pub.hidden_beacon_bss = &hidden->pub;
1873 				list_add(&new->hidden_list,
1874 					 &hidden->hidden_list);
1875 				hidden->refcount++;
1876 
1877 				ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
1878 				rcu_assign_pointer(new->pub.beacon_ies,
1879 						   hidden->pub.beacon_ies);
1880 				if (ies)
1881 					kfree_rcu(ies, rcu_head);
1882 			}
1883 		} else {
1884 			/*
1885 			 * Ok so we found a beacon, and don't have an entry. If
1886 			 * it's a beacon with hidden SSID, we might be in for an
1887 			 * expensive search for any probe responses that should
1888 			 * be grouped with this beacon for updates ...
1889 			 */
1890 			if (!cfg80211_combine_bsses(rdev, new)) {
1891 				bss_ref_put(rdev, new);
1892 				return NULL;
1893 			}
1894 		}
1895 
1896 		if (rdev->bss_entries >= bss_entries_limit &&
1897 		    !cfg80211_bss_expire_oldest(rdev)) {
1898 			bss_ref_put(rdev, new);
1899 			return NULL;
1900 		}
1901 
1902 		/* This must be before the call to bss_ref_get */
1903 		if (tmp->pub.transmitted_bss) {
1904 			new->pub.transmitted_bss = tmp->pub.transmitted_bss;
1905 			bss_ref_get(rdev, bss_from_pub(tmp->pub.transmitted_bss));
1906 		}
1907 
1908 		cfg80211_insert_bss(rdev, new);
1909 		found = new;
1910 	}
1911 
1912 	rdev->bss_generation++;
1913 	bss_ref_get(rdev, found);
1914 
1915 	return found;
1916 }
1917 
1918 struct cfg80211_internal_bss *
cfg80211_bss_update(struct cfg80211_registered_device * rdev,struct cfg80211_internal_bss * tmp,bool signal_valid,unsigned long ts)1919 cfg80211_bss_update(struct cfg80211_registered_device *rdev,
1920 		    struct cfg80211_internal_bss *tmp,
1921 		    bool signal_valid, unsigned long ts)
1922 {
1923 	struct cfg80211_internal_bss *res;
1924 
1925 	spin_lock_bh(&rdev->bss_lock);
1926 	res = __cfg80211_bss_update(rdev, tmp, signal_valid, ts);
1927 	spin_unlock_bh(&rdev->bss_lock);
1928 
1929 	return res;
1930 }
1931 
cfg80211_get_ies_channel_number(const u8 * ie,size_t ielen,enum nl80211_band band)1932 int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen,
1933 				    enum nl80211_band band)
1934 {
1935 	const struct element *tmp;
1936 
1937 	if (band == NL80211_BAND_6GHZ) {
1938 		struct ieee80211_he_operation *he_oper;
1939 
1940 		tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie,
1941 					     ielen);
1942 		if (tmp && tmp->datalen >= sizeof(*he_oper) &&
1943 		    tmp->datalen >= ieee80211_he_oper_size(&tmp->data[1])) {
1944 			const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
1945 
1946 			he_oper = (void *)&tmp->data[1];
1947 
1948 			he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
1949 			if (!he_6ghz_oper)
1950 				return -1;
1951 
1952 			return he_6ghz_oper->primary;
1953 		}
1954 	} else if (band == NL80211_BAND_S1GHZ) {
1955 		tmp = cfg80211_find_elem(WLAN_EID_S1G_OPERATION, ie, ielen);
1956 		if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) {
1957 			struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data;
1958 
1959 			return s1gop->oper_ch;
1960 		}
1961 	} else {
1962 		tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen);
1963 		if (tmp && tmp->datalen == 1)
1964 			return tmp->data[0];
1965 
1966 		tmp = cfg80211_find_elem(WLAN_EID_HT_OPERATION, ie, ielen);
1967 		if (tmp &&
1968 		    tmp->datalen >= sizeof(struct ieee80211_ht_operation)) {
1969 			struct ieee80211_ht_operation *htop = (void *)tmp->data;
1970 
1971 			return htop->primary_chan;
1972 		}
1973 	}
1974 
1975 	return -1;
1976 }
1977 EXPORT_SYMBOL(cfg80211_get_ies_channel_number);
1978 
1979 /*
1980  * Update RX channel information based on the available frame payload
1981  * information. This is mainly for the 2.4 GHz band where frames can be received
1982  * from neighboring channels and the Beacon frames use the DSSS Parameter Set
1983  * element to indicate the current (transmitting) channel, but this might also
1984  * be needed on other bands if RX frequency does not match with the actual
1985  * operating channel of a BSS, or if the AP reports a different primary channel.
1986  */
1987 static struct ieee80211_channel *
cfg80211_get_bss_channel(struct wiphy * wiphy,const u8 * ie,size_t ielen,struct ieee80211_channel * channel,enum nl80211_bss_scan_width scan_width)1988 cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
1989 			 struct ieee80211_channel *channel,
1990 			 enum nl80211_bss_scan_width scan_width)
1991 {
1992 	u32 freq;
1993 	int channel_number;
1994 	struct ieee80211_channel *alt_channel;
1995 
1996 	channel_number = cfg80211_get_ies_channel_number(ie, ielen,
1997 							 channel->band);
1998 
1999 	if (channel_number < 0) {
2000 		/* No channel information in frame payload */
2001 		return channel;
2002 	}
2003 
2004 	freq = ieee80211_channel_to_freq_khz(channel_number, channel->band);
2005 
2006 	/*
2007 	 * Frame info (beacon/prob res) is the same as received channel,
2008 	 * no need for further processing.
2009 	 */
2010 	if (freq == ieee80211_channel_to_khz(channel))
2011 		return channel;
2012 
2013 	alt_channel = ieee80211_get_channel_khz(wiphy, freq);
2014 	if (!alt_channel) {
2015 		if (channel->band == NL80211_BAND_2GHZ ||
2016 		    channel->band == NL80211_BAND_6GHZ) {
2017 			/*
2018 			 * Better not allow unexpected channels when that could
2019 			 * be going beyond the 1-11 range (e.g., discovering
2020 			 * BSS on channel 12 when radio is configured for
2021 			 * channel 11) or beyond the 6 GHz channel range.
2022 			 */
2023 			return NULL;
2024 		}
2025 
2026 		/* No match for the payload channel number - ignore it */
2027 		return channel;
2028 	}
2029 
2030 	if (scan_width == NL80211_BSS_CHAN_WIDTH_10 ||
2031 	    scan_width == NL80211_BSS_CHAN_WIDTH_5) {
2032 		/*
2033 		 * Ignore channel number in 5 and 10 MHz channels where there
2034 		 * may not be an n:1 or 1:n mapping between frequencies and
2035 		 * channel numbers.
2036 		 */
2037 		return channel;
2038 	}
2039 
2040 	/*
2041 	 * Use the channel determined through the payload channel number
2042 	 * instead of the RX channel reported by the driver.
2043 	 */
2044 	if (alt_channel->flags & IEEE80211_CHAN_DISABLED)
2045 		return NULL;
2046 	return alt_channel;
2047 }
2048 
2049 struct cfg80211_inform_single_bss_data {
2050 	struct cfg80211_inform_bss *drv_data;
2051 	enum cfg80211_bss_frame_type ftype;
2052 	struct ieee80211_channel *channel;
2053 	u8 bssid[ETH_ALEN];
2054 	u64 tsf;
2055 	u16 capability;
2056 	u16 beacon_interval;
2057 	const u8 *ie;
2058 	size_t ielen;
2059 
2060 	enum {
2061 		BSS_SOURCE_DIRECT = 0,
2062 		BSS_SOURCE_MBSSID,
2063 		BSS_SOURCE_STA_PROFILE,
2064 	} bss_source;
2065 	/* Set if reporting bss_source != BSS_SOURCE_DIRECT */
2066 	struct cfg80211_bss *source_bss;
2067 	u8 max_bssid_indicator;
2068 	u8 bssid_index;
2069 };
2070 
2071 /* Returned bss is reference counted and must be cleaned up appropriately. */
2072 static struct cfg80211_bss *
cfg80211_inform_single_bss_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * data,gfp_t gfp)2073 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
2074 				struct cfg80211_inform_single_bss_data *data,
2075 				gfp_t gfp)
2076 {
2077 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2078 	struct cfg80211_inform_bss *drv_data = data->drv_data;
2079 	struct cfg80211_bss_ies *ies;
2080 	struct ieee80211_channel *channel;
2081 	struct cfg80211_internal_bss tmp = {}, *res;
2082 	int bss_type;
2083 	bool signal_valid;
2084 	unsigned long ts;
2085 
2086 	if (WARN_ON(!wiphy))
2087 		return NULL;
2088 
2089 	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2090 		    (drv_data->signal < 0 || drv_data->signal > 100)))
2091 		return NULL;
2092 
2093 	if (WARN_ON(data->bss_source != BSS_SOURCE_DIRECT && !data->source_bss))
2094 		return NULL;
2095 
2096 	channel = data->channel;
2097 	if (!channel)
2098 		channel = cfg80211_get_bss_channel(wiphy, data->ie, data->ielen,
2099 						   drv_data->chan,
2100 						   drv_data->scan_width);
2101 	if (!channel)
2102 		return NULL;
2103 
2104 	memcpy(tmp.pub.bssid, data->bssid, ETH_ALEN);
2105 	tmp.pub.channel = channel;
2106 	tmp.pub.scan_width = drv_data->scan_width;
2107 	if (data->bss_source != BSS_SOURCE_STA_PROFILE)
2108 		tmp.pub.signal = drv_data->signal;
2109 	else
2110 		tmp.pub.signal = 0;
2111 	tmp.pub.beacon_interval = data->beacon_interval;
2112 	tmp.pub.capability = data->capability;
2113 	tmp.ts_boottime = drv_data->boottime_ns;
2114 	tmp.parent_tsf = drv_data->parent_tsf;
2115 	ether_addr_copy(tmp.parent_bssid, drv_data->parent_bssid);
2116 
2117 	if (data->bss_source != BSS_SOURCE_DIRECT) {
2118 		tmp.pub.transmitted_bss = data->source_bss;
2119 		ts = bss_from_pub(data->source_bss)->ts;
2120 		tmp.pub.bssid_index = data->bssid_index;
2121 		tmp.pub.max_bssid_indicator = data->max_bssid_indicator;
2122 	} else {
2123 		ts = jiffies;
2124 
2125 		if (channel->band == NL80211_BAND_60GHZ) {
2126 			bss_type = data->capability &
2127 				   WLAN_CAPABILITY_DMG_TYPE_MASK;
2128 			if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2129 			    bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2130 				regulatory_hint_found_beacon(wiphy, channel,
2131 							     gfp);
2132 		} else {
2133 			if (data->capability & WLAN_CAPABILITY_ESS)
2134 				regulatory_hint_found_beacon(wiphy, channel,
2135 							     gfp);
2136 		}
2137 	}
2138 
2139 	/*
2140 	 * If we do not know here whether the IEs are from a Beacon or Probe
2141 	 * Response frame, we need to pick one of the options and only use it
2142 	 * with the driver that does not provide the full Beacon/Probe Response
2143 	 * frame. Use Beacon frame pointer to avoid indicating that this should
2144 	 * override the IEs pointer should we have received an earlier
2145 	 * indication of Probe Response data.
2146 	 */
2147 	ies = kzalloc(sizeof(*ies) + data->ielen, gfp);
2148 	if (!ies)
2149 		return NULL;
2150 	ies->len = data->ielen;
2151 	ies->tsf = data->tsf;
2152 	ies->from_beacon = false;
2153 	memcpy(ies->data, data->ie, data->ielen);
2154 
2155 	switch (data->ftype) {
2156 	case CFG80211_BSS_FTYPE_BEACON:
2157 		ies->from_beacon = true;
2158 		fallthrough;
2159 	case CFG80211_BSS_FTYPE_UNKNOWN:
2160 		rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2161 		break;
2162 	case CFG80211_BSS_FTYPE_PRESP:
2163 		rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2164 		break;
2165 	}
2166 	rcu_assign_pointer(tmp.pub.ies, ies);
2167 
2168 	signal_valid = drv_data->chan == channel;
2169 	spin_lock_bh(&rdev->bss_lock);
2170 	res = __cfg80211_bss_update(rdev, &tmp, signal_valid, ts);
2171 	if (!res)
2172 		goto drop;
2173 
2174 	rdev_inform_bss(rdev, &res->pub, ies, drv_data->drv_data);
2175 
2176 	if (data->bss_source == BSS_SOURCE_MBSSID) {
2177 		/* this is a nontransmitting bss, we need to add it to
2178 		 * transmitting bss' list if it is not there
2179 		 */
2180 		if (cfg80211_add_nontrans_list(data->source_bss, &res->pub)) {
2181 			if (__cfg80211_unlink_bss(rdev, res)) {
2182 				rdev->bss_generation++;
2183 				res = NULL;
2184 			}
2185 		}
2186 
2187 		if (!res)
2188 			goto drop;
2189 	}
2190 	spin_unlock_bh(&rdev->bss_lock);
2191 
2192 	trace_cfg80211_return_bss(&res->pub);
2193 	/* __cfg80211_bss_update gives us a referenced result */
2194 	return &res->pub;
2195 
2196 drop:
2197 	spin_unlock_bh(&rdev->bss_lock);
2198 	return NULL;
2199 }
2200 
2201 static const struct element
cfg80211_get_profile_continuation(const u8 * ie,size_t ielen,const struct element * mbssid_elem,const struct element * sub_elem)2202 *cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
2203 				   const struct element *mbssid_elem,
2204 				   const struct element *sub_elem)
2205 {
2206 	const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
2207 	const struct element *next_mbssid;
2208 	const struct element *next_sub;
2209 
2210 	next_mbssid = cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
2211 					 mbssid_end,
2212 					 ielen - (mbssid_end - ie));
2213 
2214 	/*
2215 	 * If it is not the last subelement in current MBSSID IE or there isn't
2216 	 * a next MBSSID IE - profile is complete.
2217 	*/
2218 	if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
2219 	    !next_mbssid)
2220 		return NULL;
2221 
2222 	/* For any length error, just return NULL */
2223 
2224 	if (next_mbssid->datalen < 4)
2225 		return NULL;
2226 
2227 	next_sub = (void *)&next_mbssid->data[1];
2228 
2229 	if (next_mbssid->data + next_mbssid->datalen <
2230 	    next_sub->data + next_sub->datalen)
2231 		return NULL;
2232 
2233 	if (next_sub->id != 0 || next_sub->datalen < 2)
2234 		return NULL;
2235 
2236 	/*
2237 	 * Check if the first element in the next sub element is a start
2238 	 * of a new profile
2239 	 */
2240 	return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
2241 	       NULL : next_mbssid;
2242 }
2243 
cfg80211_merge_profile(const u8 * ie,size_t ielen,const struct element * mbssid_elem,const struct element * sub_elem,u8 * merged_ie,size_t max_copy_len)2244 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
2245 			      const struct element *mbssid_elem,
2246 			      const struct element *sub_elem,
2247 			      u8 *merged_ie, size_t max_copy_len)
2248 {
2249 	size_t copied_len = sub_elem->datalen;
2250 	const struct element *next_mbssid;
2251 
2252 	if (sub_elem->datalen > max_copy_len)
2253 		return 0;
2254 
2255 	memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
2256 
2257 	while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
2258 								mbssid_elem,
2259 								sub_elem))) {
2260 		const struct element *next_sub = (void *)&next_mbssid->data[1];
2261 
2262 		if (copied_len + next_sub->datalen > max_copy_len)
2263 			break;
2264 		memcpy(merged_ie + copied_len, next_sub->data,
2265 		       next_sub->datalen);
2266 		copied_len += next_sub->datalen;
2267 	}
2268 
2269 	return copied_len;
2270 }
2271 EXPORT_SYMBOL(cfg80211_merge_profile);
2272 
2273 static void
cfg80211_parse_mbssid_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * tx_data,struct cfg80211_bss * source_bss,gfp_t gfp)2274 cfg80211_parse_mbssid_data(struct wiphy *wiphy,
2275 			   struct cfg80211_inform_single_bss_data *tx_data,
2276 			   struct cfg80211_bss *source_bss,
2277 			   gfp_t gfp)
2278 {
2279 	struct cfg80211_inform_single_bss_data data = {
2280 		.drv_data = tx_data->drv_data,
2281 		.ftype = tx_data->ftype,
2282 		.tsf = tx_data->tsf,
2283 		.beacon_interval = tx_data->beacon_interval,
2284 		.source_bss = source_bss,
2285 		.bss_source = BSS_SOURCE_MBSSID,
2286 	};
2287 	const u8 *mbssid_index_ie;
2288 	const struct element *elem, *sub;
2289 	u8 *new_ie, *profile;
2290 	u64 seen_indices = 0;
2291 	struct cfg80211_bss *bss;
2292 
2293 	if (!source_bss)
2294 		return;
2295 	if (!cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID,
2296 				tx_data->ie, tx_data->ielen))
2297 		return;
2298 	if (!wiphy->support_mbssid)
2299 		return;
2300 	if (wiphy->support_only_he_mbssid &&
2301 	    !cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
2302 				    tx_data->ie, tx_data->ielen))
2303 		return;
2304 
2305 	new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2306 	if (!new_ie)
2307 		return;
2308 
2309 	profile = kmalloc(tx_data->ielen, gfp);
2310 	if (!profile)
2311 		goto out;
2312 
2313 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
2314 			    tx_data->ie, tx_data->ielen) {
2315 		if (elem->datalen < 4)
2316 			continue;
2317 		if (elem->data[0] < 1 || (int)elem->data[0] > 8)
2318 			continue;
2319 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
2320 			u8 profile_len;
2321 
2322 			if (sub->id != 0 || sub->datalen < 4) {
2323 				/* not a valid BSS profile */
2324 				continue;
2325 			}
2326 
2327 			if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
2328 			    sub->data[1] != 2) {
2329 				/* The first element within the Nontransmitted
2330 				 * BSSID Profile is not the Nontransmitted
2331 				 * BSSID Capability element.
2332 				 */
2333 				continue;
2334 			}
2335 
2336 			memset(profile, 0, tx_data->ielen);
2337 			profile_len = cfg80211_merge_profile(tx_data->ie,
2338 							     tx_data->ielen,
2339 							     elem,
2340 							     sub,
2341 							     profile,
2342 							     tx_data->ielen);
2343 
2344 			/* found a Nontransmitted BSSID Profile */
2345 			mbssid_index_ie = cfg80211_find_ie
2346 				(WLAN_EID_MULTI_BSSID_IDX,
2347 				 profile, profile_len);
2348 			if (!mbssid_index_ie || mbssid_index_ie[1] < 1 ||
2349 			    mbssid_index_ie[2] == 0 ||
2350 			    mbssid_index_ie[2] > 46) {
2351 				/* No valid Multiple BSSID-Index element */
2352 				continue;
2353 			}
2354 
2355 			if (seen_indices & BIT_ULL(mbssid_index_ie[2]))
2356 				/* We don't support legacy split of a profile */
2357 				net_dbg_ratelimited("Partial info for BSSID index %d\n",
2358 						    mbssid_index_ie[2]);
2359 
2360 			seen_indices |= BIT_ULL(mbssid_index_ie[2]);
2361 
2362 			data.bssid_index = mbssid_index_ie[2];
2363 			data.max_bssid_indicator = elem->data[0];
2364 
2365 			cfg80211_gen_new_bssid(tx_data->bssid,
2366 					       data.max_bssid_indicator,
2367 					       data.bssid_index,
2368 					       data.bssid);
2369 
2370 			memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2371 			data.ie = new_ie;
2372 			data.ielen = cfg80211_gen_new_ie(tx_data->ie,
2373 							 tx_data->ielen,
2374 							 profile,
2375 							 profile_len,
2376 							 new_ie,
2377 							 IEEE80211_MAX_DATA_LEN);
2378 			if (!data.ielen)
2379 				continue;
2380 
2381 			data.capability = get_unaligned_le16(profile + 2);
2382 			bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
2383 			if (!bss)
2384 				break;
2385 			cfg80211_put_bss(wiphy, bss);
2386 		}
2387 	}
2388 
2389 out:
2390 	kfree(new_ie);
2391 	kfree(profile);
2392 }
2393 
cfg80211_defragment_element(const struct element * elem,const u8 * ies,size_t ieslen,u8 * data,size_t data_len,u8 frag_id)2394 ssize_t cfg80211_defragment_element(const struct element *elem, const u8 *ies,
2395 				    size_t ieslen, u8 *data, size_t data_len,
2396 				    u8 frag_id)
2397 {
2398 	const struct element *next;
2399 	ssize_t copied;
2400 	u8 elem_datalen;
2401 
2402 	if (!elem)
2403 		return -EINVAL;
2404 
2405 	/* elem might be invalid after the memmove */
2406 	next = (void *)(elem->data + elem->datalen);
2407 	elem_datalen = elem->datalen;
2408 
2409 	if (elem->id == WLAN_EID_EXTENSION) {
2410 		copied = elem->datalen - 1;
2411 		if (copied > data_len)
2412 			return -ENOSPC;
2413 
2414 		memmove(data, elem->data + 1, copied);
2415 	} else {
2416 		copied = elem->datalen;
2417 		if (copied > data_len)
2418 			return -ENOSPC;
2419 
2420 		memmove(data, elem->data, copied);
2421 	}
2422 
2423 	/* Fragmented elements must have 255 bytes */
2424 	if (elem_datalen < 255)
2425 		return copied;
2426 
2427 	for (elem = next;
2428 	     elem->data < ies + ieslen &&
2429 		elem->data + elem->datalen <= ies + ieslen;
2430 	     elem = next) {
2431 		/* elem might be invalid after the memmove */
2432 		next = (void *)(elem->data + elem->datalen);
2433 
2434 		if (elem->id != frag_id)
2435 			break;
2436 
2437 		elem_datalen = elem->datalen;
2438 
2439 		if (copied + elem_datalen > data_len)
2440 			return -ENOSPC;
2441 
2442 		memmove(data + copied, elem->data, elem_datalen);
2443 		copied += elem_datalen;
2444 
2445 		/* Only the last fragment may be short */
2446 		if (elem_datalen != 255)
2447 			break;
2448 	}
2449 
2450 	return copied;
2451 }
2452 EXPORT_SYMBOL(cfg80211_defragment_element);
2453 
2454 struct cfg80211_mle {
2455 	struct ieee80211_multi_link_elem *mle;
2456 	struct ieee80211_mle_per_sta_profile
2457 		*sta_prof[IEEE80211_MLD_MAX_NUM_LINKS];
2458 	ssize_t sta_prof_len[IEEE80211_MLD_MAX_NUM_LINKS];
2459 
2460 	u8 data[];
2461 };
2462 
2463 static struct cfg80211_mle *
cfg80211_defrag_mle(const struct element * mle,const u8 * ie,size_t ielen,gfp_t gfp)2464 cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen,
2465 		    gfp_t gfp)
2466 {
2467 	const struct element *elem;
2468 	struct cfg80211_mle *res;
2469 	size_t buf_len;
2470 	ssize_t mle_len;
2471 	u8 common_size, idx;
2472 
2473 	if (!mle || !ieee80211_mle_size_ok(mle->data + 1, mle->datalen - 1))
2474 		return NULL;
2475 
2476 	/* Required length for first defragmentation */
2477 	buf_len = mle->datalen - 1;
2478 	for_each_element(elem, mle->data + mle->datalen,
2479 			 ielen - sizeof(*mle) + mle->datalen) {
2480 		if (elem->id != WLAN_EID_FRAGMENT)
2481 			break;
2482 
2483 		buf_len += elem->datalen;
2484 	}
2485 
2486 	res = kzalloc(struct_size(res, data, buf_len), gfp);
2487 	if (!res)
2488 		return NULL;
2489 
2490 	mle_len = cfg80211_defragment_element(mle, ie, ielen,
2491 					      res->data, buf_len,
2492 					      WLAN_EID_FRAGMENT);
2493 	if (mle_len < 0)
2494 		goto error;
2495 
2496 	res->mle = (void *)res->data;
2497 
2498 	/* Find the sub-element area in the buffer */
2499 	common_size = ieee80211_mle_common_size((u8 *)res->mle);
2500 	ie = res->data + common_size;
2501 	ielen = mle_len - common_size;
2502 
2503 	idx = 0;
2504 	for_each_element_id(elem, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE,
2505 			    ie, ielen) {
2506 		res->sta_prof[idx] = (void *)elem->data;
2507 		res->sta_prof_len[idx] = elem->datalen;
2508 
2509 		idx++;
2510 		if (idx >= IEEE80211_MLD_MAX_NUM_LINKS)
2511 			break;
2512 	}
2513 	if (!for_each_element_completed(elem, ie, ielen))
2514 		goto error;
2515 
2516 	/* Defragment sta_info in-place */
2517 	for (idx = 0; idx < IEEE80211_MLD_MAX_NUM_LINKS && res->sta_prof[idx];
2518 	     idx++) {
2519 		if (res->sta_prof_len[idx] < 255)
2520 			continue;
2521 
2522 		elem = (void *)res->sta_prof[idx] - 2;
2523 
2524 		if (idx + 1 < ARRAY_SIZE(res->sta_prof) &&
2525 		    res->sta_prof[idx + 1])
2526 			buf_len = (u8 *)res->sta_prof[idx + 1] -
2527 				  (u8 *)res->sta_prof[idx];
2528 		else
2529 			buf_len = ielen + ie - (u8 *)elem;
2530 
2531 		res->sta_prof_len[idx] =
2532 			cfg80211_defragment_element(elem,
2533 						    (u8 *)elem, buf_len,
2534 						    (u8 *)res->sta_prof[idx],
2535 						    buf_len,
2536 						    IEEE80211_MLE_SUBELEM_FRAGMENT);
2537 		if (res->sta_prof_len[idx] < 0)
2538 			goto error;
2539 	}
2540 
2541 	return res;
2542 
2543 error:
2544 	kfree(res);
2545 	return NULL;
2546 }
2547 
2548 static bool
cfg80211_tbtt_info_for_mld_ap(const u8 * ie,size_t ielen,u8 mld_id,u8 link_id,const struct ieee80211_neighbor_ap_info ** ap_info,const u8 ** tbtt_info)2549 cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
2550 			      const struct ieee80211_neighbor_ap_info **ap_info,
2551 			      const u8 **tbtt_info)
2552 {
2553 	const struct ieee80211_neighbor_ap_info *info;
2554 	const struct element *rnr;
2555 	const u8 *pos, *end;
2556 
2557 	for_each_element_id(rnr, WLAN_EID_REDUCED_NEIGHBOR_REPORT, ie, ielen) {
2558 		pos = rnr->data;
2559 		end = rnr->data + rnr->datalen;
2560 
2561 		/* RNR IE may contain more than one NEIGHBOR_AP_INFO */
2562 		while (sizeof(*info) <= end - pos) {
2563 			const struct ieee80211_rnr_mld_params *mld_params;
2564 			u16 params;
2565 			u8 length, i, count, mld_params_offset;
2566 			u8 type, lid;
2567 
2568 			info = (void *)pos;
2569 			count = u8_get_bits(info->tbtt_info_hdr,
2570 					    IEEE80211_AP_INFO_TBTT_HDR_COUNT) + 1;
2571 			length = info->tbtt_info_len;
2572 
2573 			pos += sizeof(*info);
2574 
2575 			if (count * length > end - pos)
2576 				return false;
2577 
2578 			type = u8_get_bits(info->tbtt_info_hdr,
2579 					   IEEE80211_AP_INFO_TBTT_HDR_TYPE);
2580 
2581 			/* Only accept full TBTT information. NSTR mobile APs
2582 			 * use the shortened version, but we ignore them here.
2583 			 */
2584 			if (type == IEEE80211_TBTT_INFO_TYPE_TBTT &&
2585 			    length >=
2586 			    offsetofend(struct ieee80211_tbtt_info_ge_11,
2587 					mld_params)) {
2588 				mld_params_offset =
2589 					offsetof(struct ieee80211_tbtt_info_ge_11, mld_params);
2590 			} else {
2591 				pos += count * length;
2592 				continue;
2593 			}
2594 
2595 			for (i = 0; i < count; i++) {
2596 				mld_params = (void *)pos + mld_params_offset;
2597 				params = le16_to_cpu(mld_params->params);
2598 
2599 				lid = u16_get_bits(params,
2600 						   IEEE80211_RNR_MLD_PARAMS_LINK_ID);
2601 
2602 				if (mld_id == mld_params->mld_id &&
2603 				    link_id == lid) {
2604 					*ap_info = info;
2605 					*tbtt_info = pos;
2606 
2607 					return true;
2608 				}
2609 
2610 				pos += length;
2611 			}
2612 		}
2613 	}
2614 
2615 	return false;
2616 }
2617 
2618 static void
cfg80211_parse_ml_elem_sta_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * tx_data,struct cfg80211_bss * source_bss,const struct element * elem,gfp_t gfp)2619 cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
2620 				struct cfg80211_inform_single_bss_data *tx_data,
2621 				struct cfg80211_bss *source_bss,
2622 				const struct element *elem,
2623 				gfp_t gfp)
2624 {
2625 	struct cfg80211_inform_single_bss_data data = {
2626 		.drv_data = tx_data->drv_data,
2627 		.ftype = tx_data->ftype,
2628 		.source_bss = source_bss,
2629 		.bss_source = BSS_SOURCE_STA_PROFILE,
2630 	};
2631 	struct ieee80211_multi_link_elem *ml_elem;
2632 	struct cfg80211_mle *mle;
2633 	u16 control;
2634 	u8 *new_ie;
2635 	struct cfg80211_bss *bss;
2636 	int mld_id;
2637 	u16 seen_links = 0;
2638 	const u8 *pos;
2639 	u8 i;
2640 
2641 	if (!ieee80211_mle_size_ok(elem->data + 1, elem->datalen - 1))
2642 		return;
2643 
2644 	ml_elem = (void *)elem->data + 1;
2645 	control = le16_to_cpu(ml_elem->control);
2646 	if (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE) !=
2647 	    IEEE80211_ML_CONTROL_TYPE_BASIC)
2648 		return;
2649 
2650 	/* Must be present when transmitted by an AP (in a probe response) */
2651 	if (!(control & IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT) ||
2652 	    !(control & IEEE80211_MLC_BASIC_PRES_LINK_ID) ||
2653 	    !(control & IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP))
2654 		return;
2655 
2656 	/* length + MLD MAC address + link ID info + BSS Params Change Count */
2657 	pos = ml_elem->variable + 1 + 6 + 1 + 1;
2658 
2659 	if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MED_SYNC_DELAY))
2660 		pos += 2;
2661 	if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_EML_CAPA))
2662 		pos += 2;
2663 
2664 	/* MLD capabilities and operations */
2665 	pos += 2;
2666 
2667 	/*
2668 	 * The MLD ID of the reporting AP is always zero. It is set if the AP
2669 	 * is part of an MBSSID set and will be non-zero for ML Elements
2670 	 * relating to a nontransmitted BSS (matching the Multi-BSSID Index,
2671 	 * Draft P802.11be_D3.2, 35.3.4.2)
2672 	 */
2673 	if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MLD_ID)) {
2674 		mld_id = *pos;
2675 		pos += 1;
2676 	} else {
2677 		mld_id = 0;
2678 	}
2679 
2680 	/* Extended MLD capabilities and operations */
2681 	pos += 2;
2682 
2683 	/* Fully defrag the ML element for sta information/profile iteration */
2684 	mle = cfg80211_defrag_mle(elem, tx_data->ie, tx_data->ielen, gfp);
2685 	if (!mle)
2686 		return;
2687 
2688 	new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
2689 	if (!new_ie)
2690 		goto out;
2691 
2692 	for (i = 0; i < ARRAY_SIZE(mle->sta_prof) && mle->sta_prof[i]; i++) {
2693 		const struct ieee80211_neighbor_ap_info *ap_info;
2694 		enum nl80211_band band;
2695 		u32 freq;
2696 		const u8 *profile;
2697 		const u8 *tbtt_info;
2698 		ssize_t profile_len;
2699 		u8 link_id;
2700 
2701 		if (!ieee80211_mle_basic_sta_prof_size_ok((u8 *)mle->sta_prof[i],
2702 							  mle->sta_prof_len[i]))
2703 			continue;
2704 
2705 		control = le16_to_cpu(mle->sta_prof[i]->control);
2706 
2707 		if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
2708 			continue;
2709 
2710 		link_id = u16_get_bits(control,
2711 				       IEEE80211_MLE_STA_CONTROL_LINK_ID);
2712 		if (seen_links & BIT(link_id))
2713 			break;
2714 		seen_links |= BIT(link_id);
2715 
2716 		if (!(control & IEEE80211_MLE_STA_CONTROL_BEACON_INT_PRESENT) ||
2717 		    !(control & IEEE80211_MLE_STA_CONTROL_TSF_OFFS_PRESENT) ||
2718 		    !(control & IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT))
2719 			continue;
2720 
2721 		memcpy(data.bssid, mle->sta_prof[i]->variable, ETH_ALEN);
2722 		data.beacon_interval =
2723 			get_unaligned_le16(mle->sta_prof[i]->variable + 6);
2724 		data.tsf = tx_data->tsf +
2725 			   get_unaligned_le64(mle->sta_prof[i]->variable + 8);
2726 
2727 		/* sta_info_len counts itself */
2728 		profile = mle->sta_prof[i]->variable +
2729 			  mle->sta_prof[i]->sta_info_len - 1;
2730 		profile_len = (u8 *)mle->sta_prof[i] + mle->sta_prof_len[i] -
2731 			      profile;
2732 
2733 		if (profile_len < 2)
2734 			continue;
2735 
2736 		data.capability = get_unaligned_le16(profile);
2737 		profile += 2;
2738 		profile_len -= 2;
2739 
2740 		/* Find in RNR to look up channel information */
2741 		if (!cfg80211_tbtt_info_for_mld_ap(tx_data->ie, tx_data->ielen,
2742 						   mld_id, link_id,
2743 						   &ap_info, &tbtt_info))
2744 			continue;
2745 
2746 		/* We could sanity check the BSSID is included */
2747 
2748 		if (!ieee80211_operating_class_to_band(ap_info->op_class,
2749 						       &band))
2750 			continue;
2751 
2752 		freq = ieee80211_channel_to_freq_khz(ap_info->channel, band);
2753 		data.channel = ieee80211_get_channel_khz(wiphy, freq);
2754 
2755 		/* Generate new elements */
2756 		memset(new_ie, 0, IEEE80211_MAX_DATA_LEN);
2757 		data.ie = new_ie;
2758 		data.ielen = cfg80211_gen_new_ie(tx_data->ie, tx_data->ielen,
2759 						 profile, profile_len,
2760 						 new_ie,
2761 						 IEEE80211_MAX_DATA_LEN);
2762 		if (!data.ielen)
2763 			continue;
2764 
2765 		bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
2766 		if (!bss)
2767 			break;
2768 		cfg80211_put_bss(wiphy, bss);
2769 	}
2770 
2771 out:
2772 	kfree(new_ie);
2773 	kfree(mle);
2774 }
2775 
cfg80211_parse_ml_sta_data(struct wiphy * wiphy,struct cfg80211_inform_single_bss_data * tx_data,struct cfg80211_bss * source_bss,gfp_t gfp)2776 static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
2777 				       struct cfg80211_inform_single_bss_data *tx_data,
2778 				       struct cfg80211_bss *source_bss,
2779 				       gfp_t gfp)
2780 {
2781 	const struct element *elem;
2782 
2783 	if (!source_bss)
2784 		return;
2785 
2786 	if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP)
2787 		return;
2788 
2789 	for_each_element_extid(elem, WLAN_EID_EXT_EHT_MULTI_LINK,
2790 			       tx_data->ie, tx_data->ielen)
2791 		cfg80211_parse_ml_elem_sta_data(wiphy, tx_data, source_bss,
2792 						elem, gfp);
2793 }
2794 
2795 struct cfg80211_bss *
cfg80211_inform_bss_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,enum cfg80211_bss_frame_type ftype,const u8 * bssid,u64 tsf,u16 capability,u16 beacon_interval,const u8 * ie,size_t ielen,gfp_t gfp)2796 cfg80211_inform_bss_data(struct wiphy *wiphy,
2797 			 struct cfg80211_inform_bss *data,
2798 			 enum cfg80211_bss_frame_type ftype,
2799 			 const u8 *bssid, u64 tsf, u16 capability,
2800 			 u16 beacon_interval, const u8 *ie, size_t ielen,
2801 			 gfp_t gfp)
2802 {
2803 	struct cfg80211_inform_single_bss_data inform_data = {
2804 		.drv_data = data,
2805 		.ftype = ftype,
2806 		.tsf = tsf,
2807 		.capability = capability,
2808 		.beacon_interval = beacon_interval,
2809 		.ie = ie,
2810 		.ielen = ielen,
2811 	};
2812 	struct cfg80211_bss *res;
2813 
2814 	memcpy(inform_data.bssid, bssid, ETH_ALEN);
2815 
2816 	res = cfg80211_inform_single_bss_data(wiphy, &inform_data, gfp);
2817 	if (!res)
2818 		return NULL;
2819 
2820 	cfg80211_parse_mbssid_data(wiphy, &inform_data, res, gfp);
2821 
2822 	cfg80211_parse_ml_sta_data(wiphy, &inform_data, res, gfp);
2823 
2824 	return res;
2825 }
2826 EXPORT_SYMBOL(cfg80211_inform_bss_data);
2827 
2828 /* cfg80211_inform_bss_width_frame helper */
2829 static struct cfg80211_bss *
cfg80211_inform_single_bss_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,gfp_t gfp)2830 cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
2831 				      struct cfg80211_inform_bss *data,
2832 				      struct ieee80211_mgmt *mgmt, size_t len,
2833 				      gfp_t gfp)
2834 {
2835 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2836 	struct cfg80211_internal_bss tmp = {}, *res;
2837 	struct cfg80211_bss_ies *ies;
2838 	struct ieee80211_channel *channel;
2839 	bool signal_valid;
2840 	struct ieee80211_ext *ext = NULL;
2841 	u8 *bssid, *variable;
2842 	u16 capability, beacon_int;
2843 	size_t ielen, min_hdr_len = offsetof(struct ieee80211_mgmt,
2844 					     u.probe_resp.variable);
2845 	int bss_type;
2846 
2847 	BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
2848 			offsetof(struct ieee80211_mgmt, u.beacon.variable));
2849 
2850 	trace_cfg80211_inform_bss_frame(wiphy, data, mgmt, len);
2851 
2852 	if (WARN_ON(!mgmt))
2853 		return NULL;
2854 
2855 	if (WARN_ON(!wiphy))
2856 		return NULL;
2857 
2858 	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
2859 		    (data->signal < 0 || data->signal > 100)))
2860 		return NULL;
2861 
2862 	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2863 		ext = (void *) mgmt;
2864 		min_hdr_len = offsetof(struct ieee80211_ext, u.s1g_beacon);
2865 		if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2866 			min_hdr_len = offsetof(struct ieee80211_ext,
2867 					       u.s1g_short_beacon.variable);
2868 	}
2869 
2870 	if (WARN_ON(len < min_hdr_len))
2871 		return NULL;
2872 
2873 	ielen = len - min_hdr_len;
2874 	variable = mgmt->u.probe_resp.variable;
2875 	if (ext) {
2876 		if (ieee80211_is_s1g_short_beacon(mgmt->frame_control))
2877 			variable = ext->u.s1g_short_beacon.variable;
2878 		else
2879 			variable = ext->u.s1g_beacon.variable;
2880 	}
2881 
2882 	channel = cfg80211_get_bss_channel(wiphy, variable,
2883 					   ielen, data->chan, data->scan_width);
2884 	if (!channel)
2885 		return NULL;
2886 
2887 	if (ext) {
2888 		const struct ieee80211_s1g_bcn_compat_ie *compat;
2889 		const struct element *elem;
2890 
2891 		elem = cfg80211_find_elem(WLAN_EID_S1G_BCN_COMPAT,
2892 					  variable, ielen);
2893 		if (!elem)
2894 			return NULL;
2895 		if (elem->datalen < sizeof(*compat))
2896 			return NULL;
2897 		compat = (void *)elem->data;
2898 		bssid = ext->u.s1g_beacon.sa;
2899 		capability = le16_to_cpu(compat->compat_info);
2900 		beacon_int = le16_to_cpu(compat->beacon_int);
2901 	} else {
2902 		bssid = mgmt->bssid;
2903 		beacon_int = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2904 		capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
2905 	}
2906 
2907 	if (channel->band == NL80211_BAND_60GHZ) {
2908 		bss_type = capability & WLAN_CAPABILITY_DMG_TYPE_MASK;
2909 		if (bss_type == WLAN_CAPABILITY_DMG_TYPE_AP ||
2910 		    bss_type == WLAN_CAPABILITY_DMG_TYPE_PBSS)
2911 			regulatory_hint_found_beacon(wiphy, channel, gfp);
2912 	} else {
2913 		if (capability & WLAN_CAPABILITY_ESS)
2914 			regulatory_hint_found_beacon(wiphy, channel, gfp);
2915 	}
2916 
2917 	ies = kzalloc(sizeof(*ies) + ielen, gfp);
2918 	if (!ies)
2919 		return NULL;
2920 	ies->len = ielen;
2921 	ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2922 	ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control) ||
2923 			   ieee80211_is_s1g_beacon(mgmt->frame_control);
2924 	memcpy(ies->data, variable, ielen);
2925 
2926 	if (ieee80211_is_probe_resp(mgmt->frame_control))
2927 		rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
2928 	else
2929 		rcu_assign_pointer(tmp.pub.beacon_ies, ies);
2930 	rcu_assign_pointer(tmp.pub.ies, ies);
2931 
2932 	memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
2933 	tmp.pub.beacon_interval = beacon_int;
2934 	tmp.pub.capability = capability;
2935 	tmp.pub.channel = channel;
2936 	tmp.pub.scan_width = data->scan_width;
2937 	tmp.pub.signal = data->signal;
2938 	tmp.ts_boottime = data->boottime_ns;
2939 	tmp.parent_tsf = data->parent_tsf;
2940 	tmp.pub.chains = data->chains;
2941 	memcpy(tmp.pub.chain_signal, data->chain_signal, IEEE80211_MAX_CHAINS);
2942 	ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
2943 
2944 	signal_valid = data->chan == channel;
2945 	spin_lock_bh(&rdev->bss_lock);
2946 	res = __cfg80211_bss_update(rdev, &tmp, signal_valid, jiffies);
2947 	if (!res)
2948 		goto drop;
2949 
2950 	rdev_inform_bss(rdev, &res->pub, ies, data->drv_data);
2951 
2952 	spin_unlock_bh(&rdev->bss_lock);
2953 
2954 	trace_cfg80211_return_bss(&res->pub);
2955 	/* __cfg80211_bss_update gives us a referenced result */
2956 	return &res->pub;
2957 
2958 drop:
2959 	spin_unlock_bh(&rdev->bss_lock);
2960 	return NULL;
2961 }
2962 
2963 struct cfg80211_bss *
cfg80211_inform_bss_frame_data(struct wiphy * wiphy,struct cfg80211_inform_bss * data,struct ieee80211_mgmt * mgmt,size_t len,gfp_t gfp)2964 cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
2965 			       struct cfg80211_inform_bss *data,
2966 			       struct ieee80211_mgmt *mgmt, size_t len,
2967 			       gfp_t gfp)
2968 {
2969 	struct cfg80211_inform_single_bss_data inform_data = {
2970 		.drv_data = data,
2971 		.ie = mgmt->u.probe_resp.variable,
2972 		.ielen = len - offsetof(struct ieee80211_mgmt,
2973 					u.probe_resp.variable),
2974 	};
2975 	struct cfg80211_bss *res;
2976 
2977 	res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt,
2978 						    len, gfp);
2979 	if (!res)
2980 		return NULL;
2981 
2982 	/* don't do any further MBSSID/ML handling for S1G */
2983 	if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2984 		return res;
2985 
2986 	inform_data.ftype = ieee80211_is_beacon(mgmt->frame_control) ?
2987 		CFG80211_BSS_FTYPE_BEACON : CFG80211_BSS_FTYPE_PRESP;
2988 	memcpy(inform_data.bssid, mgmt->bssid, ETH_ALEN);
2989 	inform_data.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
2990 	inform_data.beacon_interval =
2991 		le16_to_cpu(mgmt->u.probe_resp.beacon_int);
2992 
2993 	/* process each non-transmitting bss */
2994 	cfg80211_parse_mbssid_data(wiphy, &inform_data, res, gfp);
2995 
2996 	cfg80211_parse_ml_sta_data(wiphy, &inform_data, res, gfp);
2997 
2998 	return res;
2999 }
3000 EXPORT_SYMBOL(cfg80211_inform_bss_frame_data);
3001 
cfg80211_ref_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)3002 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
3003 {
3004 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3005 
3006 	if (!pub)
3007 		return;
3008 
3009 	spin_lock_bh(&rdev->bss_lock);
3010 	bss_ref_get(rdev, bss_from_pub(pub));
3011 	spin_unlock_bh(&rdev->bss_lock);
3012 }
3013 EXPORT_SYMBOL(cfg80211_ref_bss);
3014 
cfg80211_put_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)3015 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
3016 {
3017 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3018 
3019 	if (!pub)
3020 		return;
3021 
3022 	spin_lock_bh(&rdev->bss_lock);
3023 	bss_ref_put(rdev, bss_from_pub(pub));
3024 	spin_unlock_bh(&rdev->bss_lock);
3025 }
3026 EXPORT_SYMBOL(cfg80211_put_bss);
3027 
cfg80211_unlink_bss(struct wiphy * wiphy,struct cfg80211_bss * pub)3028 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
3029 {
3030 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3031 	struct cfg80211_internal_bss *bss, *tmp1;
3032 	struct cfg80211_bss *nontrans_bss, *tmp;
3033 
3034 	if (WARN_ON(!pub))
3035 		return;
3036 
3037 	bss = bss_from_pub(pub);
3038 
3039 	spin_lock_bh(&rdev->bss_lock);
3040 	if (list_empty(&bss->list))
3041 		goto out;
3042 
3043 	list_for_each_entry_safe(nontrans_bss, tmp,
3044 				 &pub->nontrans_list,
3045 				 nontrans_list) {
3046 		tmp1 = bss_from_pub(nontrans_bss);
3047 		if (__cfg80211_unlink_bss(rdev, tmp1))
3048 			rdev->bss_generation++;
3049 	}
3050 
3051 	if (__cfg80211_unlink_bss(rdev, bss))
3052 		rdev->bss_generation++;
3053 out:
3054 	spin_unlock_bh(&rdev->bss_lock);
3055 }
3056 EXPORT_SYMBOL(cfg80211_unlink_bss);
3057 
cfg80211_bss_iter(struct wiphy * wiphy,struct cfg80211_chan_def * chandef,void (* iter)(struct wiphy * wiphy,struct cfg80211_bss * bss,void * data),void * iter_data)3058 void cfg80211_bss_iter(struct wiphy *wiphy,
3059 		       struct cfg80211_chan_def *chandef,
3060 		       void (*iter)(struct wiphy *wiphy,
3061 				    struct cfg80211_bss *bss,
3062 				    void *data),
3063 		       void *iter_data)
3064 {
3065 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3066 	struct cfg80211_internal_bss *bss;
3067 
3068 	spin_lock_bh(&rdev->bss_lock);
3069 
3070 	list_for_each_entry(bss, &rdev->bss_list, list) {
3071 		if (!chandef || cfg80211_is_sub_chan(chandef, bss->pub.channel,
3072 						     false))
3073 			iter(wiphy, &bss->pub, iter_data);
3074 	}
3075 
3076 	spin_unlock_bh(&rdev->bss_lock);
3077 }
3078 EXPORT_SYMBOL(cfg80211_bss_iter);
3079 
cfg80211_update_assoc_bss_entry(struct wireless_dev * wdev,unsigned int link_id,struct ieee80211_channel * chan)3080 void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
3081 				     unsigned int link_id,
3082 				     struct ieee80211_channel *chan)
3083 {
3084 	struct wiphy *wiphy = wdev->wiphy;
3085 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3086 	struct cfg80211_internal_bss *cbss = wdev->links[link_id].client.current_bss;
3087 	struct cfg80211_internal_bss *new = NULL;
3088 	struct cfg80211_internal_bss *bss;
3089 	struct cfg80211_bss *nontrans_bss;
3090 	struct cfg80211_bss *tmp;
3091 
3092 	spin_lock_bh(&rdev->bss_lock);
3093 
3094 	/*
3095 	 * Some APs use CSA also for bandwidth changes, i.e., without actually
3096 	 * changing the control channel, so no need to update in such a case.
3097 	 */
3098 	if (cbss->pub.channel == chan)
3099 		goto done;
3100 
3101 	/* use transmitting bss */
3102 	if (cbss->pub.transmitted_bss)
3103 		cbss = bss_from_pub(cbss->pub.transmitted_bss);
3104 
3105 	cbss->pub.channel = chan;
3106 
3107 	list_for_each_entry(bss, &rdev->bss_list, list) {
3108 		if (!cfg80211_bss_type_match(bss->pub.capability,
3109 					     bss->pub.channel->band,
3110 					     wdev->conn_bss_type))
3111 			continue;
3112 
3113 		if (bss == cbss)
3114 			continue;
3115 
3116 		if (!cmp_bss(&bss->pub, &cbss->pub, BSS_CMP_REGULAR)) {
3117 			new = bss;
3118 			break;
3119 		}
3120 	}
3121 
3122 	if (new) {
3123 		/* to save time, update IEs for transmitting bss only */
3124 		if (cfg80211_update_known_bss(rdev, cbss, new, false)) {
3125 			new->pub.proberesp_ies = NULL;
3126 			new->pub.beacon_ies = NULL;
3127 		}
3128 
3129 		list_for_each_entry_safe(nontrans_bss, tmp,
3130 					 &new->pub.nontrans_list,
3131 					 nontrans_list) {
3132 			bss = bss_from_pub(nontrans_bss);
3133 			if (__cfg80211_unlink_bss(rdev, bss))
3134 				rdev->bss_generation++;
3135 		}
3136 
3137 		WARN_ON(atomic_read(&new->hold));
3138 		if (!WARN_ON(!__cfg80211_unlink_bss(rdev, new)))
3139 			rdev->bss_generation++;
3140 	}
3141 	cfg80211_rehash_bss(rdev, cbss);
3142 
3143 	list_for_each_entry_safe(nontrans_bss, tmp,
3144 				 &cbss->pub.nontrans_list,
3145 				 nontrans_list) {
3146 		bss = bss_from_pub(nontrans_bss);
3147 		bss->pub.channel = chan;
3148 		cfg80211_rehash_bss(rdev, bss);
3149 	}
3150 
3151 done:
3152 	spin_unlock_bh(&rdev->bss_lock);
3153 }
3154 
3155 #ifdef CONFIG_CFG80211_WEXT
3156 static struct cfg80211_registered_device *
cfg80211_get_dev_from_ifindex(struct net * net,int ifindex)3157 cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
3158 {
3159 	struct cfg80211_registered_device *rdev;
3160 	struct net_device *dev;
3161 
3162 	ASSERT_RTNL();
3163 
3164 	dev = dev_get_by_index(net, ifindex);
3165 	if (!dev)
3166 		return ERR_PTR(-ENODEV);
3167 	if (dev->ieee80211_ptr)
3168 		rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
3169 	else
3170 		rdev = ERR_PTR(-ENODEV);
3171 	dev_put(dev);
3172 	return rdev;
3173 }
3174 
cfg80211_wext_siwscan(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)3175 int cfg80211_wext_siwscan(struct net_device *dev,
3176 			  struct iw_request_info *info,
3177 			  union iwreq_data *wrqu, char *extra)
3178 {
3179 	struct cfg80211_registered_device *rdev;
3180 	struct wiphy *wiphy;
3181 	struct iw_scan_req *wreq = NULL;
3182 	struct cfg80211_scan_request *creq;
3183 	int i, err, n_channels = 0;
3184 	enum nl80211_band band;
3185 
3186 	if (!netif_running(dev))
3187 		return -ENETDOWN;
3188 
3189 	if (wrqu->data.length == sizeof(struct iw_scan_req))
3190 		wreq = (struct iw_scan_req *)extra;
3191 
3192 	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3193 
3194 	if (IS_ERR(rdev))
3195 		return PTR_ERR(rdev);
3196 
3197 	if (rdev->scan_req || rdev->scan_msg)
3198 		return -EBUSY;
3199 
3200 	wiphy = &rdev->wiphy;
3201 
3202 	/* Determine number of channels, needed to allocate creq */
3203 	if (wreq && wreq->num_channels) {
3204 		/* Passed from userspace so should be checked */
3205 		if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
3206 			return -EINVAL;
3207 		n_channels = wreq->num_channels;
3208 	} else {
3209 		n_channels = ieee80211_get_num_supported_channels(wiphy);
3210 	}
3211 
3212 	creq = kzalloc(struct_size(creq, channels, n_channels) +
3213 		       sizeof(struct cfg80211_ssid),
3214 		       GFP_ATOMIC);
3215 	if (!creq)
3216 		return -ENOMEM;
3217 
3218 	creq->wiphy = wiphy;
3219 	creq->wdev = dev->ieee80211_ptr;
3220 	/* SSIDs come after channels */
3221 	creq->ssids = (void *)creq + struct_size(creq, channels, n_channels);
3222 	creq->n_channels = n_channels;
3223 	creq->n_ssids = 1;
3224 	creq->scan_start = jiffies;
3225 
3226 	/* translate "Scan on frequencies" request */
3227 	i = 0;
3228 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3229 		int j;
3230 
3231 		if (!wiphy->bands[band])
3232 			continue;
3233 
3234 		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3235 			/* ignore disabled channels */
3236 			if (wiphy->bands[band]->channels[j].flags &
3237 						IEEE80211_CHAN_DISABLED)
3238 				continue;
3239 
3240 			/* If we have a wireless request structure and the
3241 			 * wireless request specifies frequencies, then search
3242 			 * for the matching hardware channel.
3243 			 */
3244 			if (wreq && wreq->num_channels) {
3245 				int k;
3246 				int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
3247 				for (k = 0; k < wreq->num_channels; k++) {
3248 					struct iw_freq *freq =
3249 						&wreq->channel_list[k];
3250 					int wext_freq =
3251 						cfg80211_wext_freq(freq);
3252 
3253 					if (wext_freq == wiphy_freq)
3254 						goto wext_freq_found;
3255 				}
3256 				goto wext_freq_not_found;
3257 			}
3258 
3259 		wext_freq_found:
3260 			creq->channels[i] = &wiphy->bands[band]->channels[j];
3261 			i++;
3262 		wext_freq_not_found: ;
3263 		}
3264 	}
3265 	/* No channels found? */
3266 	if (!i) {
3267 		err = -EINVAL;
3268 		goto out;
3269 	}
3270 
3271 	/* Set real number of channels specified in creq->channels[] */
3272 	creq->n_channels = i;
3273 
3274 	/* translate "Scan for SSID" request */
3275 	if (wreq) {
3276 		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
3277 			if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
3278 				err = -EINVAL;
3279 				goto out;
3280 			}
3281 			memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
3282 			creq->ssids[0].ssid_len = wreq->essid_len;
3283 		}
3284 		if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE) {
3285 			creq->ssids = NULL;
3286 			creq->n_ssids = 0;
3287 		}
3288 	}
3289 
3290 	for (i = 0; i < NUM_NL80211_BANDS; i++)
3291 		if (wiphy->bands[i])
3292 			creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
3293 
3294 	eth_broadcast_addr(creq->bssid);
3295 
3296 	wiphy_lock(&rdev->wiphy);
3297 
3298 	rdev->scan_req = creq;
3299 	err = rdev_scan(rdev, creq);
3300 	if (err) {
3301 		rdev->scan_req = NULL;
3302 		/* creq will be freed below */
3303 	} else {
3304 		nl80211_send_scan_start(rdev, dev->ieee80211_ptr);
3305 		/* creq now owned by driver */
3306 		creq = NULL;
3307 		dev_hold(dev);
3308 	}
3309 	wiphy_unlock(&rdev->wiphy);
3310  out:
3311 	kfree(creq);
3312 	return err;
3313 }
3314 EXPORT_WEXT_HANDLER(cfg80211_wext_siwscan);
3315 
ieee80211_scan_add_ies(struct iw_request_info * info,const struct cfg80211_bss_ies * ies,char * current_ev,char * end_buf)3316 static char *ieee80211_scan_add_ies(struct iw_request_info *info,
3317 				    const struct cfg80211_bss_ies *ies,
3318 				    char *current_ev, char *end_buf)
3319 {
3320 	const u8 *pos, *end, *next;
3321 	struct iw_event iwe;
3322 
3323 	if (!ies)
3324 		return current_ev;
3325 
3326 	/*
3327 	 * If needed, fragment the IEs buffer (at IE boundaries) into short
3328 	 * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
3329 	 */
3330 	pos = ies->data;
3331 	end = pos + ies->len;
3332 
3333 	while (end - pos > IW_GENERIC_IE_MAX) {
3334 		next = pos + 2 + pos[1];
3335 		while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
3336 			next = next + 2 + next[1];
3337 
3338 		memset(&iwe, 0, sizeof(iwe));
3339 		iwe.cmd = IWEVGENIE;
3340 		iwe.u.data.length = next - pos;
3341 		current_ev = iwe_stream_add_point_check(info, current_ev,
3342 							end_buf, &iwe,
3343 							(void *)pos);
3344 		if (IS_ERR(current_ev))
3345 			return current_ev;
3346 		pos = next;
3347 	}
3348 
3349 	if (end > pos) {
3350 		memset(&iwe, 0, sizeof(iwe));
3351 		iwe.cmd = IWEVGENIE;
3352 		iwe.u.data.length = end - pos;
3353 		current_ev = iwe_stream_add_point_check(info, current_ev,
3354 							end_buf, &iwe,
3355 							(void *)pos);
3356 		if (IS_ERR(current_ev))
3357 			return current_ev;
3358 	}
3359 
3360 	return current_ev;
3361 }
3362 
3363 static char *
ieee80211_bss(struct wiphy * wiphy,struct iw_request_info * info,struct cfg80211_internal_bss * bss,char * current_ev,char * end_buf)3364 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
3365 	      struct cfg80211_internal_bss *bss, char *current_ev,
3366 	      char *end_buf)
3367 {
3368 	const struct cfg80211_bss_ies *ies;
3369 	struct iw_event iwe;
3370 	const u8 *ie;
3371 	u8 buf[50];
3372 	u8 *cfg, *p, *tmp;
3373 	int rem, i, sig;
3374 	bool ismesh = false;
3375 
3376 	memset(&iwe, 0, sizeof(iwe));
3377 	iwe.cmd = SIOCGIWAP;
3378 	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
3379 	memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
3380 	current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
3381 						IW_EV_ADDR_LEN);
3382 	if (IS_ERR(current_ev))
3383 		return current_ev;
3384 
3385 	memset(&iwe, 0, sizeof(iwe));
3386 	iwe.cmd = SIOCGIWFREQ;
3387 	iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
3388 	iwe.u.freq.e = 0;
3389 	current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
3390 						IW_EV_FREQ_LEN);
3391 	if (IS_ERR(current_ev))
3392 		return current_ev;
3393 
3394 	memset(&iwe, 0, sizeof(iwe));
3395 	iwe.cmd = SIOCGIWFREQ;
3396 	iwe.u.freq.m = bss->pub.channel->center_freq;
3397 	iwe.u.freq.e = 6;
3398 	current_ev = iwe_stream_add_event_check(info, current_ev, end_buf, &iwe,
3399 						IW_EV_FREQ_LEN);
3400 	if (IS_ERR(current_ev))
3401 		return current_ev;
3402 
3403 	if (wiphy->signal_type != CFG80211_SIGNAL_TYPE_NONE) {
3404 		memset(&iwe, 0, sizeof(iwe));
3405 		iwe.cmd = IWEVQUAL;
3406 		iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
3407 				     IW_QUAL_NOISE_INVALID |
3408 				     IW_QUAL_QUAL_UPDATED;
3409 		switch (wiphy->signal_type) {
3410 		case CFG80211_SIGNAL_TYPE_MBM:
3411 			sig = bss->pub.signal / 100;
3412 			iwe.u.qual.level = sig;
3413 			iwe.u.qual.updated |= IW_QUAL_DBM;
3414 			if (sig < -110)		/* rather bad */
3415 				sig = -110;
3416 			else if (sig > -40)	/* perfect */
3417 				sig = -40;
3418 			/* will give a range of 0 .. 70 */
3419 			iwe.u.qual.qual = sig + 110;
3420 			break;
3421 		case CFG80211_SIGNAL_TYPE_UNSPEC:
3422 			iwe.u.qual.level = bss->pub.signal;
3423 			/* will give range 0 .. 100 */
3424 			iwe.u.qual.qual = bss->pub.signal;
3425 			break;
3426 		default:
3427 			/* not reached */
3428 			break;
3429 		}
3430 		current_ev = iwe_stream_add_event_check(info, current_ev,
3431 							end_buf, &iwe,
3432 							IW_EV_QUAL_LEN);
3433 		if (IS_ERR(current_ev))
3434 			return current_ev;
3435 	}
3436 
3437 	memset(&iwe, 0, sizeof(iwe));
3438 	iwe.cmd = SIOCGIWENCODE;
3439 	if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
3440 		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
3441 	else
3442 		iwe.u.data.flags = IW_ENCODE_DISABLED;
3443 	iwe.u.data.length = 0;
3444 	current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3445 						&iwe, "");
3446 	if (IS_ERR(current_ev))
3447 		return current_ev;
3448 
3449 	rcu_read_lock();
3450 	ies = rcu_dereference(bss->pub.ies);
3451 	rem = ies->len;
3452 	ie = ies->data;
3453 
3454 	while (rem >= 2) {
3455 		/* invalid data */
3456 		if (ie[1] > rem - 2)
3457 			break;
3458 
3459 		switch (ie[0]) {
3460 		case WLAN_EID_SSID:
3461 			memset(&iwe, 0, sizeof(iwe));
3462 			iwe.cmd = SIOCGIWESSID;
3463 			iwe.u.data.length = ie[1];
3464 			iwe.u.data.flags = 1;
3465 			current_ev = iwe_stream_add_point_check(info,
3466 								current_ev,
3467 								end_buf, &iwe,
3468 								(u8 *)ie + 2);
3469 			if (IS_ERR(current_ev))
3470 				goto unlock;
3471 			break;
3472 		case WLAN_EID_MESH_ID:
3473 			memset(&iwe, 0, sizeof(iwe));
3474 			iwe.cmd = SIOCGIWESSID;
3475 			iwe.u.data.length = ie[1];
3476 			iwe.u.data.flags = 1;
3477 			current_ev = iwe_stream_add_point_check(info,
3478 								current_ev,
3479 								end_buf, &iwe,
3480 								(u8 *)ie + 2);
3481 			if (IS_ERR(current_ev))
3482 				goto unlock;
3483 			break;
3484 		case WLAN_EID_MESH_CONFIG:
3485 			ismesh = true;
3486 			if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
3487 				break;
3488 			cfg = (u8 *)ie + 2;
3489 			memset(&iwe, 0, sizeof(iwe));
3490 			iwe.cmd = IWEVCUSTOM;
3491 			sprintf(buf, "Mesh Network Path Selection Protocol ID: "
3492 				"0x%02X", cfg[0]);
3493 			iwe.u.data.length = strlen(buf);
3494 			current_ev = iwe_stream_add_point_check(info,
3495 								current_ev,
3496 								end_buf,
3497 								&iwe, buf);
3498 			if (IS_ERR(current_ev))
3499 				goto unlock;
3500 			sprintf(buf, "Path Selection Metric ID: 0x%02X",
3501 				cfg[1]);
3502 			iwe.u.data.length = strlen(buf);
3503 			current_ev = iwe_stream_add_point_check(info,
3504 								current_ev,
3505 								end_buf,
3506 								&iwe, buf);
3507 			if (IS_ERR(current_ev))
3508 				goto unlock;
3509 			sprintf(buf, "Congestion Control Mode ID: 0x%02X",
3510 				cfg[2]);
3511 			iwe.u.data.length = strlen(buf);
3512 			current_ev = iwe_stream_add_point_check(info,
3513 								current_ev,
3514 								end_buf,
3515 								&iwe, buf);
3516 			if (IS_ERR(current_ev))
3517 				goto unlock;
3518 			sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
3519 			iwe.u.data.length = strlen(buf);
3520 			current_ev = iwe_stream_add_point_check(info,
3521 								current_ev,
3522 								end_buf,
3523 								&iwe, buf);
3524 			if (IS_ERR(current_ev))
3525 				goto unlock;
3526 			sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
3527 			iwe.u.data.length = strlen(buf);
3528 			current_ev = iwe_stream_add_point_check(info,
3529 								current_ev,
3530 								end_buf,
3531 								&iwe, buf);
3532 			if (IS_ERR(current_ev))
3533 				goto unlock;
3534 			sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
3535 			iwe.u.data.length = strlen(buf);
3536 			current_ev = iwe_stream_add_point_check(info,
3537 								current_ev,
3538 								end_buf,
3539 								&iwe, buf);
3540 			if (IS_ERR(current_ev))
3541 				goto unlock;
3542 			sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
3543 			iwe.u.data.length = strlen(buf);
3544 			current_ev = iwe_stream_add_point_check(info,
3545 								current_ev,
3546 								end_buf,
3547 								&iwe, buf);
3548 			if (IS_ERR(current_ev))
3549 				goto unlock;
3550 			break;
3551 		case WLAN_EID_SUPP_RATES:
3552 		case WLAN_EID_EXT_SUPP_RATES:
3553 			/* display all supported rates in readable format */
3554 			p = current_ev + iwe_stream_lcp_len(info);
3555 
3556 			memset(&iwe, 0, sizeof(iwe));
3557 			iwe.cmd = SIOCGIWRATE;
3558 			/* Those two flags are ignored... */
3559 			iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
3560 
3561 			for (i = 0; i < ie[1]; i++) {
3562 				iwe.u.bitrate.value =
3563 					((ie[i + 2] & 0x7f) * 500000);
3564 				tmp = p;
3565 				p = iwe_stream_add_value(info, current_ev, p,
3566 							 end_buf, &iwe,
3567 							 IW_EV_PARAM_LEN);
3568 				if (p == tmp) {
3569 					current_ev = ERR_PTR(-E2BIG);
3570 					goto unlock;
3571 				}
3572 			}
3573 			current_ev = p;
3574 			break;
3575 		}
3576 		rem -= ie[1] + 2;
3577 		ie += ie[1] + 2;
3578 	}
3579 
3580 	if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
3581 	    ismesh) {
3582 		memset(&iwe, 0, sizeof(iwe));
3583 		iwe.cmd = SIOCGIWMODE;
3584 		if (ismesh)
3585 			iwe.u.mode = IW_MODE_MESH;
3586 		else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
3587 			iwe.u.mode = IW_MODE_MASTER;
3588 		else
3589 			iwe.u.mode = IW_MODE_ADHOC;
3590 		current_ev = iwe_stream_add_event_check(info, current_ev,
3591 							end_buf, &iwe,
3592 							IW_EV_UINT_LEN);
3593 		if (IS_ERR(current_ev))
3594 			goto unlock;
3595 	}
3596 
3597 	memset(&iwe, 0, sizeof(iwe));
3598 	iwe.cmd = IWEVCUSTOM;
3599 	sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
3600 	iwe.u.data.length = strlen(buf);
3601 	current_ev = iwe_stream_add_point_check(info, current_ev, end_buf,
3602 						&iwe, buf);
3603 	if (IS_ERR(current_ev))
3604 		goto unlock;
3605 	memset(&iwe, 0, sizeof(iwe));
3606 	iwe.cmd = IWEVCUSTOM;
3607 	sprintf(buf, " Last beacon: %ums ago",
3608 		elapsed_jiffies_msecs(bss->ts));
3609 	iwe.u.data.length = strlen(buf);
3610 	current_ev = iwe_stream_add_point_check(info, current_ev,
3611 						end_buf, &iwe, buf);
3612 	if (IS_ERR(current_ev))
3613 		goto unlock;
3614 
3615 	current_ev = ieee80211_scan_add_ies(info, ies, current_ev, end_buf);
3616 
3617  unlock:
3618 	rcu_read_unlock();
3619 	return current_ev;
3620 }
3621 
3622 
ieee80211_scan_results(struct cfg80211_registered_device * rdev,struct iw_request_info * info,char * buf,size_t len)3623 static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
3624 				  struct iw_request_info *info,
3625 				  char *buf, size_t len)
3626 {
3627 	char *current_ev = buf;
3628 	char *end_buf = buf + len;
3629 	struct cfg80211_internal_bss *bss;
3630 	int err = 0;
3631 
3632 	spin_lock_bh(&rdev->bss_lock);
3633 	cfg80211_bss_expire(rdev);
3634 
3635 	list_for_each_entry(bss, &rdev->bss_list, list) {
3636 		if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
3637 			err = -E2BIG;
3638 			break;
3639 		}
3640 		current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
3641 					   current_ev, end_buf);
3642 		if (IS_ERR(current_ev)) {
3643 			err = PTR_ERR(current_ev);
3644 			break;
3645 		}
3646 	}
3647 	spin_unlock_bh(&rdev->bss_lock);
3648 
3649 	if (err)
3650 		return err;
3651 	return current_ev - buf;
3652 }
3653 
3654 
cfg80211_wext_giwscan(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)3655 int cfg80211_wext_giwscan(struct net_device *dev,
3656 			  struct iw_request_info *info,
3657 			  union iwreq_data *wrqu, char *extra)
3658 {
3659 	struct iw_point *data = &wrqu->data;
3660 	struct cfg80211_registered_device *rdev;
3661 	int res;
3662 
3663 	if (!netif_running(dev))
3664 		return -ENETDOWN;
3665 
3666 	rdev = cfg80211_get_dev_from_ifindex(dev_net(dev), dev->ifindex);
3667 
3668 	if (IS_ERR(rdev))
3669 		return PTR_ERR(rdev);
3670 
3671 	if (rdev->scan_req || rdev->scan_msg)
3672 		return -EAGAIN;
3673 
3674 	res = ieee80211_scan_results(rdev, info, extra, data->length);
3675 	data->length = 0;
3676 	if (res >= 0) {
3677 		data->length = res;
3678 		res = 0;
3679 	}
3680 
3681 	return res;
3682 }
3683 EXPORT_WEXT_HANDLER(cfg80211_wext_giwscan);
3684 #endif
3685