1
2
3
4
5
6
7
8
9
10
11
12#include <linux/jiffies.h>
13#include <linux/slab.h>
14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
18#include <linux/rcupdate.h>
19#include <net/mac80211.h>
20#include <net/ieee80211_radiotap.h>
21
22#include "ieee80211_i.h"
23#include "driver-ops.h"
24#include "led.h"
25#include "mesh.h"
26#include "wep.h"
27#include "wpa.h"
28#include "tkip.h"
29#include "wme.h"
30
31
32
33
34
35
36
37static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
38 struct sk_buff *skb)
39{
40 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
41 if (likely(skb->len > FCS_LEN))
42 __pskb_trim(skb, skb->len - FCS_LEN);
43 else {
44
45 WARN_ON(1);
46 dev_kfree_skb(skb);
47 skb = NULL;
48 }
49 }
50
51 return skb;
52}
53
54static inline int should_drop_frame(struct sk_buff *skb,
55 int present_fcs_len)
56{
57 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
58 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
59
60 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
61 return 1;
62 if (unlikely(skb->len < 16 + present_fcs_len))
63 return 1;
64 if (ieee80211_is_ctl(hdr->frame_control) &&
65 !ieee80211_is_pspoll(hdr->frame_control) &&
66 !ieee80211_is_back_req(hdr->frame_control))
67 return 1;
68 return 0;
69}
70
71static int
72ieee80211_rx_radiotap_len(struct ieee80211_local *local,
73 struct ieee80211_rx_status *status)
74{
75 int len;
76
77
78 len = sizeof(struct ieee80211_radiotap_header) + 9;
79
80 if (status->flag & RX_FLAG_TSFT)
81 len += 8;
82 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
83 len += 1;
84
85 if (len & 1)
86 len++;
87
88 return len;
89}
90
91
92
93
94
95
96static void
97ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
98 struct sk_buff *skb,
99 struct ieee80211_rate *rate,
100 int rtap_len)
101{
102 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
103 struct ieee80211_radiotap_header *rthdr;
104 unsigned char *pos;
105 u16 rx_flags = 0;
106
107 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
108 memset(rthdr, 0, rtap_len);
109
110
111 rthdr->it_present =
112 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
113 (1 << IEEE80211_RADIOTAP_CHANNEL) |
114 (1 << IEEE80211_RADIOTAP_ANTENNA) |
115 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
116 rthdr->it_len = cpu_to_le16(rtap_len);
117
118 pos = (unsigned char *)(rthdr+1);
119
120
121
122
123 if (status->flag & RX_FLAG_TSFT) {
124 put_unaligned_le64(status->mactime, pos);
125 rthdr->it_present |=
126 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
127 pos += 8;
128 }
129
130
131 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
132 *pos |= IEEE80211_RADIOTAP_F_FCS;
133 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
134 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
135 if (status->flag & RX_FLAG_SHORTPRE)
136 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
137 pos++;
138
139
140 if (status->flag & RX_FLAG_HT) {
141
142
143
144
145
146
147
148 *pos = 0;
149 } else {
150 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
151 *pos = rate->bitrate / 5;
152 }
153 pos++;
154
155
156 put_unaligned_le16(status->freq, pos);
157 pos += 2;
158 if (status->band == IEEE80211_BAND_5GHZ)
159 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
160 pos);
161 else if (status->flag & RX_FLAG_HT)
162 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
163 pos);
164 else if (rate->flags & IEEE80211_RATE_ERP_G)
165 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
166 pos);
167 else
168 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
169 pos);
170 pos += 2;
171
172
173 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
174 *pos = status->signal;
175 rthdr->it_present |=
176 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
177 pos++;
178 }
179
180
181
182
183 *pos = status->antenna;
184 pos++;
185
186
187
188
189
190 if ((pos - (u8 *)rthdr) & 1)
191 pos++;
192 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
193 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
194 put_unaligned_le16(rx_flags, pos);
195 pos += 2;
196}
197
198
199
200
201
202
203static struct sk_buff *
204ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
205 struct ieee80211_rate *rate)
206{
207 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
208 struct ieee80211_sub_if_data *sdata;
209 int needed_headroom = 0;
210 struct sk_buff *skb, *skb2;
211 struct net_device *prev_dev = NULL;
212 int present_fcs_len = 0;
213
214
215
216
217
218
219
220
221
222
223
224 needed_headroom = ieee80211_rx_radiotap_len(local, status);
225
226 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
227 present_fcs_len = FCS_LEN;
228
229
230 if (!pskb_may_pull(origskb, 2)) {
231 dev_kfree_skb(origskb);
232 return NULL;
233 }
234
235 if (!local->monitors) {
236 if (should_drop_frame(origskb, present_fcs_len)) {
237 dev_kfree_skb(origskb);
238 return NULL;
239 }
240
241 return remove_monitor_info(local, origskb);
242 }
243
244 if (should_drop_frame(origskb, present_fcs_len)) {
245
246 skb = origskb;
247 origskb = NULL;
248
249
250
251
252
253
254
255
256 if (skb_headroom(skb) < needed_headroom &&
257 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
258 dev_kfree_skb(skb);
259 return NULL;
260 }
261 } else {
262
263
264
265
266 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
267
268 origskb = remove_monitor_info(local, origskb);
269
270 if (!skb)
271 return origskb;
272 }
273
274
275 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
276
277 skb_reset_mac_header(skb);
278 skb->ip_summed = CHECKSUM_UNNECESSARY;
279 skb->pkt_type = PACKET_OTHERHOST;
280 skb->protocol = htons(ETH_P_802_2);
281
282 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
283 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
284 continue;
285
286 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
287 continue;
288
289 if (!ieee80211_sdata_running(sdata))
290 continue;
291
292 if (prev_dev) {
293 skb2 = skb_clone(skb, GFP_ATOMIC);
294 if (skb2) {
295 skb2->dev = prev_dev;
296 netif_receive_skb(skb2);
297 }
298 }
299
300 prev_dev = sdata->dev;
301 sdata->dev->stats.rx_packets++;
302 sdata->dev->stats.rx_bytes += skb->len;
303 }
304
305 if (prev_dev) {
306 skb->dev = prev_dev;
307 netif_receive_skb(skb);
308 } else
309 dev_kfree_skb(skb);
310
311 return origskb;
312}
313
314
315static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
316{
317 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
318 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
319 int tid;
320
321
322 if (ieee80211_is_data_qos(hdr->frame_control)) {
323 u8 *qc = ieee80211_get_qos_ctl(hdr);
324
325 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
326 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
327 status->rx_flags |= IEEE80211_RX_AMSDU;
328 } else {
329
330
331
332
333
334
335
336
337
338
339
340 tid = NUM_RX_DATA_QUEUES - 1;
341 }
342
343 rx->queue = tid;
344
345
346 rx->skb->priority = (tid > 7) ? 0 : tid;
347}
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
375{
376#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
377 WARN_ONCE((unsigned long)rx->skb->data & 1,
378 "unaligned packet at 0x%p\n", rx->skb->data);
379#endif
380}
381
382
383
384
385static ieee80211_rx_result debug_noinline
386ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
387{
388 struct ieee80211_local *local = rx->local;
389 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
390 struct sk_buff *skb = rx->skb;
391
392 if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
393 return RX_CONTINUE;
394
395 if (test_bit(SCAN_HW_SCANNING, &local->scanning))
396 return ieee80211_scan_rx(rx->sdata, skb);
397
398 if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
399
400 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
401 dev_kfree_skb(skb);
402 return RX_QUEUED;
403 }
404
405
406 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
407 return RX_DROP_UNUSABLE;
408}
409
410
411static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
412{
413 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
414
415 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
416 return 0;
417
418 return ieee80211_is_robust_mgmt_frame(hdr);
419}
420
421
422static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
423{
424 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
425
426 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
427 return 0;
428
429 return ieee80211_is_robust_mgmt_frame(hdr);
430}
431
432
433
434static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
435{
436 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
437 struct ieee80211_mmie *mmie;
438
439 if (skb->len < 24 + sizeof(*mmie) ||
440 !is_multicast_ether_addr(hdr->da))
441 return -1;
442
443 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
444 return -1;
445
446 mmie = (struct ieee80211_mmie *)
447 (skb->data + skb->len - sizeof(*mmie));
448 if (mmie->element_id != WLAN_EID_MMIE ||
449 mmie->length != sizeof(*mmie) - 2)
450 return -1;
451
452 return le16_to_cpu(mmie->key_id);
453}
454
455
456static ieee80211_rx_result
457ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
458{
459 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
460 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
461 char *dev_addr = rx->sdata->vif.addr;
462
463 if (ieee80211_is_data(hdr->frame_control)) {
464 if (is_multicast_ether_addr(hdr->addr1)) {
465 if (ieee80211_has_tods(hdr->frame_control) ||
466 !ieee80211_has_fromds(hdr->frame_control))
467 return RX_DROP_MONITOR;
468 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
469 return RX_DROP_MONITOR;
470 } else {
471 if (!ieee80211_has_a4(hdr->frame_control))
472 return RX_DROP_MONITOR;
473 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
474 return RX_DROP_MONITOR;
475 }
476 }
477
478
479
480
481
482 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
483 struct ieee80211_mgmt *mgmt;
484
485 if (!ieee80211_is_mgmt(hdr->frame_control))
486 return RX_DROP_MONITOR;
487
488 if (ieee80211_is_action(hdr->frame_control)) {
489 mgmt = (struct ieee80211_mgmt *)hdr;
490 if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
491 return RX_DROP_MONITOR;
492 return RX_CONTINUE;
493 }
494
495 if (ieee80211_is_probe_req(hdr->frame_control) ||
496 ieee80211_is_probe_resp(hdr->frame_control) ||
497 ieee80211_is_beacon(hdr->frame_control))
498 return RX_CONTINUE;
499
500 return RX_DROP_MONITOR;
501
502 }
503
504#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
505
506 if (ieee80211_is_data(hdr->frame_control) &&
507 is_multicast_ether_addr(hdr->addr1) &&
508 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
509 return RX_DROP_MONITOR;
510#undef msh_h_get
511
512 return RX_CONTINUE;
513}
514
515#define SEQ_MODULO 0x1000
516#define SEQ_MASK 0xfff
517
518static inline int seq_less(u16 sq1, u16 sq2)
519{
520 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
521}
522
523static inline u16 seq_inc(u16 sq)
524{
525 return (sq + 1) & SEQ_MASK;
526}
527
528static inline u16 seq_sub(u16 sq1, u16 sq2)
529{
530 return (sq1 - sq2) & SEQ_MASK;
531}
532
533
534static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
535 struct tid_ampdu_rx *tid_agg_rx,
536 int index)
537{
538 struct ieee80211_local *local = hw_to_local(hw);
539 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
540 struct ieee80211_rx_status *status;
541
542 lockdep_assert_held(&tid_agg_rx->reorder_lock);
543
544 if (!skb)
545 goto no_frame;
546
547
548 tid_agg_rx->stored_mpdu_num--;
549 tid_agg_rx->reorder_buf[index] = NULL;
550 status = IEEE80211_SKB_RXCB(skb);
551 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
552 skb_queue_tail(&local->rx_skb_queue, skb);
553
554no_frame:
555 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
556}
557
558static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
559 struct tid_ampdu_rx *tid_agg_rx,
560 u16 head_seq_num)
561{
562 int index;
563
564 lockdep_assert_held(&tid_agg_rx->reorder_lock);
565
566 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
567 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
568 tid_agg_rx->buf_size;
569 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
570 }
571}
572
573
574
575
576
577
578
579
580
581
582#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
583
584static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
585 struct tid_ampdu_rx *tid_agg_rx)
586{
587 int index, j;
588
589 lockdep_assert_held(&tid_agg_rx->reorder_lock);
590
591
592 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
593 tid_agg_rx->buf_size;
594 if (!tid_agg_rx->reorder_buf[index] &&
595 tid_agg_rx->stored_mpdu_num > 1) {
596
597
598
599
600 int skipped = 1;
601 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
602 j = (j + 1) % tid_agg_rx->buf_size) {
603 if (!tid_agg_rx->reorder_buf[j]) {
604 skipped++;
605 continue;
606 }
607 if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
608 HT_RX_REORDER_BUF_TIMEOUT))
609 goto set_release_timer;
610
611#ifdef CONFIG_MAC80211_HT_DEBUG
612 if (net_ratelimit())
613 wiphy_debug(hw->wiphy,
614 "release an RX reorder frame due to timeout on earlier frames\n");
615#endif
616 ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
617
618
619
620
621 tid_agg_rx->head_seq_num =
622 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
623 skipped = 0;
624 }
625 } else while (tid_agg_rx->reorder_buf[index]) {
626 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
627 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
628 tid_agg_rx->buf_size;
629 }
630
631 if (tid_agg_rx->stored_mpdu_num) {
632 j = index = seq_sub(tid_agg_rx->head_seq_num,
633 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
634
635 for (; j != (index - 1) % tid_agg_rx->buf_size;
636 j = (j + 1) % tid_agg_rx->buf_size) {
637 if (tid_agg_rx->reorder_buf[j])
638 break;
639 }
640
641 set_release_timer:
642
643 mod_timer(&tid_agg_rx->reorder_timer,
644 tid_agg_rx->reorder_time[j] +
645 HT_RX_REORDER_BUF_TIMEOUT);
646 } else {
647 del_timer(&tid_agg_rx->reorder_timer);
648 }
649}
650
651
652
653
654
655
656static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
657 struct tid_ampdu_rx *tid_agg_rx,
658 struct sk_buff *skb)
659{
660 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
661 u16 sc = le16_to_cpu(hdr->seq_ctrl);
662 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
663 u16 head_seq_num, buf_size;
664 int index;
665 bool ret = true;
666
667 spin_lock(&tid_agg_rx->reorder_lock);
668
669 buf_size = tid_agg_rx->buf_size;
670 head_seq_num = tid_agg_rx->head_seq_num;
671
672
673 if (seq_less(mpdu_seq_num, head_seq_num)) {
674 dev_kfree_skb(skb);
675 goto out;
676 }
677
678
679
680
681
682 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
683 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
684
685 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
686 }
687
688
689
690 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
691
692
693 if (tid_agg_rx->reorder_buf[index]) {
694 dev_kfree_skb(skb);
695 goto out;
696 }
697
698
699
700
701
702 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
703 tid_agg_rx->stored_mpdu_num == 0) {
704 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
705 ret = false;
706 goto out;
707 }
708
709
710 tid_agg_rx->reorder_buf[index] = skb;
711 tid_agg_rx->reorder_time[index] = jiffies;
712 tid_agg_rx->stored_mpdu_num++;
713 ieee80211_sta_reorder_release(hw, tid_agg_rx);
714
715 out:
716 spin_unlock(&tid_agg_rx->reorder_lock);
717 return ret;
718}
719
720
721
722
723
724static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
725{
726 struct sk_buff *skb = rx->skb;
727 struct ieee80211_local *local = rx->local;
728 struct ieee80211_hw *hw = &local->hw;
729 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
730 struct sta_info *sta = rx->sta;
731 struct tid_ampdu_rx *tid_agg_rx;
732 u16 sc;
733 int tid;
734
735 if (!ieee80211_is_data_qos(hdr->frame_control))
736 goto dont_reorder;
737
738
739
740
741
742
743 if (!sta)
744 goto dont_reorder;
745
746 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
747
748 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
749 if (!tid_agg_rx)
750 goto dont_reorder;
751
752
753 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
754 goto dont_reorder;
755
756
757
758
759 if (tid_agg_rx->timeout)
760 mod_timer(&tid_agg_rx->session_timer,
761 TU_TO_EXP_TIME(tid_agg_rx->timeout));
762
763
764 sc = le16_to_cpu(hdr->seq_ctrl);
765 if (sc & IEEE80211_SCTL_FRAG) {
766 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
767 skb_queue_tail(&rx->sdata->skb_queue, skb);
768 ieee80211_queue_work(&local->hw, &rx->sdata->work);
769 return;
770 }
771
772
773
774
775
776
777
778
779 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
780 return;
781
782 dont_reorder:
783 skb_queue_tail(&local->rx_skb_queue, skb);
784}
785
786static ieee80211_rx_result debug_noinline
787ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
788{
789 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
790 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
791
792
793 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
794 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
795 rx->sta->last_seq_ctrl[rx->queue] ==
796 hdr->seq_ctrl)) {
797 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
798 rx->local->dot11FrameDuplicateCount++;
799 rx->sta->num_duplicates++;
800 }
801 return RX_DROP_MONITOR;
802 } else
803 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
804 }
805
806 if (unlikely(rx->skb->len < 16)) {
807 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
808 return RX_DROP_MONITOR;
809 }
810
811
812
813
814
815
816
817
818
819
820 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
821 return ieee80211_rx_mesh_check(rx);
822
823 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
824 ieee80211_is_pspoll(hdr->frame_control)) &&
825 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
826 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
827 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
828 if ((!ieee80211_has_fromds(hdr->frame_control) &&
829 !ieee80211_has_tods(hdr->frame_control) &&
830 ieee80211_is_data(hdr->frame_control)) ||
831 !(status->rx_flags & IEEE80211_RX_RA_MATCH)) {
832
833
834 return RX_DROP_MONITOR;
835 }
836
837 return RX_DROP_MONITOR;
838 }
839
840 return RX_CONTINUE;
841}
842
843
844static ieee80211_rx_result debug_noinline
845ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
846{
847 struct sk_buff *skb = rx->skb;
848 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
849 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
850 int keyidx;
851 int hdrlen;
852 ieee80211_rx_result result = RX_DROP_UNUSABLE;
853 struct ieee80211_key *sta_ptk = NULL;
854 int mmie_keyidx = -1;
855 __le16 fc;
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
889 return RX_CONTINUE;
890
891
892 rx->key = NULL;
893
894 if (rx->sta)
895 sta_ptk = rcu_dereference(rx->sta->ptk);
896
897 fc = hdr->frame_control;
898
899 if (!ieee80211_has_protected(fc))
900 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
901
902 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
903 rx->key = sta_ptk;
904 if ((status->flag & RX_FLAG_DECRYPTED) &&
905 (status->flag & RX_FLAG_IV_STRIPPED))
906 return RX_CONTINUE;
907
908 if (!ieee80211_has_protected(fc))
909 return RX_CONTINUE;
910 } else if (mmie_keyidx >= 0) {
911
912 if ((status->flag & RX_FLAG_DECRYPTED) &&
913 (status->flag & RX_FLAG_IV_STRIPPED))
914 return RX_CONTINUE;
915
916 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
917 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
918 return RX_DROP_MONITOR;
919 if (rx->sta)
920 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
921 if (!rx->key)
922 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
923 } else if (!ieee80211_has_protected(fc)) {
924
925
926
927
928
929
930 struct ieee80211_key *key = NULL;
931 struct ieee80211_sub_if_data *sdata = rx->sdata;
932 int i;
933
934 if (ieee80211_is_mgmt(fc) &&
935 is_multicast_ether_addr(hdr->addr1) &&
936 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
937 rx->key = key;
938 else {
939 if (rx->sta) {
940 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
941 key = rcu_dereference(rx->sta->gtk[i]);
942 if (key)
943 break;
944 }
945 }
946 if (!key) {
947 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
948 key = rcu_dereference(sdata->keys[i]);
949 if (key)
950 break;
951 }
952 }
953 if (key)
954 rx->key = key;
955 }
956 return RX_CONTINUE;
957 } else {
958 u8 keyid;
959
960
961
962
963
964
965
966
967
968 if ((status->flag & RX_FLAG_DECRYPTED) &&
969 (status->flag & RX_FLAG_IV_STRIPPED))
970 return RX_CONTINUE;
971
972 hdrlen = ieee80211_hdrlen(fc);
973
974 if (rx->skb->len < 8 + hdrlen)
975 return RX_DROP_UNUSABLE;
976
977
978
979
980
981 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
982 keyidx = keyid >> 6;
983
984
985 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
986 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
987
988
989 if (!rx->key) {
990 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
991
992
993
994
995
996
997 if (rx->key &&
998 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
999 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1000 !is_multicast_ether_addr(hdr->addr1))
1001 rx->key = NULL;
1002 }
1003 }
1004
1005 if (rx->key) {
1006 rx->key->tx_rx_count++;
1007
1008 } else {
1009 return RX_DROP_MONITOR;
1010 }
1011
1012 if (skb_linearize(rx->skb))
1013 return RX_DROP_UNUSABLE;
1014
1015
1016 switch (rx->key->conf.cipher) {
1017 case WLAN_CIPHER_SUITE_WEP40:
1018 case WLAN_CIPHER_SUITE_WEP104:
1019
1020 if (rx->sta && ieee80211_is_data(fc) &&
1021 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
1022 !(status->flag & RX_FLAG_DECRYPTED)) &&
1023 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
1024 rx->sta->wep_weak_iv_count++;
1025
1026 result = ieee80211_crypto_wep_decrypt(rx);
1027 break;
1028 case WLAN_CIPHER_SUITE_TKIP:
1029 result = ieee80211_crypto_tkip_decrypt(rx);
1030 break;
1031 case WLAN_CIPHER_SUITE_CCMP:
1032 result = ieee80211_crypto_ccmp_decrypt(rx);
1033 break;
1034 case WLAN_CIPHER_SUITE_AES_CMAC:
1035 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1036 break;
1037 default:
1038
1039
1040
1041
1042 return RX_DROP_UNUSABLE;
1043 }
1044
1045
1046 status->flag |= RX_FLAG_DECRYPTED;
1047
1048 return result;
1049}
1050
1051static ieee80211_rx_result debug_noinline
1052ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1053{
1054 struct ieee80211_local *local;
1055 struct ieee80211_hdr *hdr;
1056 struct sk_buff *skb;
1057
1058 local = rx->local;
1059 skb = rx->skb;
1060 hdr = (struct ieee80211_hdr *) skb->data;
1061
1062 if (!local->pspolling)
1063 return RX_CONTINUE;
1064
1065 if (!ieee80211_has_fromds(hdr->frame_control))
1066
1067 return RX_CONTINUE;
1068
1069 if (!ieee80211_is_data(hdr->frame_control))
1070 return RX_CONTINUE;
1071
1072 if (!ieee80211_has_moredata(hdr->frame_control)) {
1073
1074 local->pspolling = false;
1075 return RX_CONTINUE;
1076 }
1077
1078
1079 ieee80211_send_pspoll(local, rx->sdata);
1080
1081 return RX_CONTINUE;
1082}
1083
1084static void ap_sta_ps_start(struct sta_info *sta)
1085{
1086 struct ieee80211_sub_if_data *sdata = sta->sdata;
1087 struct ieee80211_local *local = sdata->local;
1088
1089 atomic_inc(&sdata->bss->num_sta_ps);
1090 set_sta_flags(sta, WLAN_STA_PS_STA);
1091 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1092#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1093 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
1094 sdata->name, sta->sta.addr, sta->sta.aid);
1095#endif
1096}
1097
1098static void ap_sta_ps_end(struct sta_info *sta)
1099{
1100 struct ieee80211_sub_if_data *sdata = sta->sdata;
1101
1102 atomic_dec(&sdata->bss->num_sta_ps);
1103
1104#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1105 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
1106 sdata->name, sta->sta.addr, sta->sta.aid);
1107#endif
1108
1109 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
1110#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1111 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
1112 sdata->name, sta->sta.addr, sta->sta.aid);
1113#endif
1114 return;
1115 }
1116
1117 ieee80211_sta_ps_deliver_wakeup(sta);
1118}
1119
1120static ieee80211_rx_result debug_noinline
1121ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1122{
1123 struct sta_info *sta = rx->sta;
1124 struct sk_buff *skb = rx->skb;
1125 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1126 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1127
1128 if (!sta)
1129 return RX_CONTINUE;
1130
1131
1132
1133
1134
1135
1136 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1137 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1138 NL80211_IFTYPE_ADHOC);
1139 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
1140 sta->last_rx = jiffies;
1141 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1142
1143
1144
1145
1146 sta->last_rx = jiffies;
1147 }
1148
1149 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1150 return RX_CONTINUE;
1151
1152 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1153 ieee80211_sta_rx_notify(rx->sdata, hdr);
1154
1155 sta->rx_fragments++;
1156 sta->rx_bytes += rx->skb->len;
1157 sta->last_signal = status->signal;
1158 ewma_add(&sta->avg_signal, -status->signal);
1159
1160
1161
1162
1163
1164 if (!ieee80211_has_morefrags(hdr->frame_control) &&
1165 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1166 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1167 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1168 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
1169
1170
1171
1172
1173
1174
1175
1176
1177 if (ieee80211_is_data(hdr->frame_control) &&
1178 !ieee80211_has_pm(hdr->frame_control))
1179 ap_sta_ps_end(sta);
1180 } else {
1181 if (ieee80211_has_pm(hdr->frame_control))
1182 ap_sta_ps_start(sta);
1183 }
1184 }
1185
1186
1187
1188
1189
1190 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1191 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1192 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1193
1194
1195
1196
1197
1198
1199
1200 if (ieee80211_has_a4(hdr->frame_control) &&
1201 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1202 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1203 !rx->sdata->u.vlan.sta)))
1204 return RX_DROP_MONITOR;
1205
1206
1207
1208
1209 sta->rx_packets++;
1210 dev_kfree_skb(rx->skb);
1211 return RX_QUEUED;
1212 }
1213
1214 return RX_CONTINUE;
1215}
1216
1217static inline struct ieee80211_fragment_entry *
1218ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1219 unsigned int frag, unsigned int seq, int rx_queue,
1220 struct sk_buff **skb)
1221{
1222 struct ieee80211_fragment_entry *entry;
1223 int idx;
1224
1225 idx = sdata->fragment_next;
1226 entry = &sdata->fragments[sdata->fragment_next++];
1227 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1228 sdata->fragment_next = 0;
1229
1230 if (!skb_queue_empty(&entry->skb_list)) {
1231#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1232 struct ieee80211_hdr *hdr =
1233 (struct ieee80211_hdr *) entry->skb_list.next->data;
1234 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1235 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
1236 "addr1=%pM addr2=%pM\n",
1237 sdata->name, idx,
1238 jiffies - entry->first_frag_time, entry->seq,
1239 entry->last_frag, hdr->addr1, hdr->addr2);
1240#endif
1241 __skb_queue_purge(&entry->skb_list);
1242 }
1243
1244 __skb_queue_tail(&entry->skb_list, *skb);
1245 *skb = NULL;
1246 entry->first_frag_time = jiffies;
1247 entry->seq = seq;
1248 entry->rx_queue = rx_queue;
1249 entry->last_frag = frag;
1250 entry->ccmp = 0;
1251 entry->extra_len = 0;
1252
1253 return entry;
1254}
1255
1256static inline struct ieee80211_fragment_entry *
1257ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1258 unsigned int frag, unsigned int seq,
1259 int rx_queue, struct ieee80211_hdr *hdr)
1260{
1261 struct ieee80211_fragment_entry *entry;
1262 int i, idx;
1263
1264 idx = sdata->fragment_next;
1265 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1266 struct ieee80211_hdr *f_hdr;
1267
1268 idx--;
1269 if (idx < 0)
1270 idx = IEEE80211_FRAGMENT_MAX - 1;
1271
1272 entry = &sdata->fragments[idx];
1273 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1274 entry->rx_queue != rx_queue ||
1275 entry->last_frag + 1 != frag)
1276 continue;
1277
1278 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1279
1280
1281
1282
1283 if (((hdr->frame_control ^ f_hdr->frame_control) &
1284 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1285 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1286 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1287 continue;
1288
1289 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1290 __skb_queue_purge(&entry->skb_list);
1291 continue;
1292 }
1293 return entry;
1294 }
1295
1296 return NULL;
1297}
1298
1299static ieee80211_rx_result debug_noinline
1300ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1301{
1302 struct ieee80211_hdr *hdr;
1303 u16 sc;
1304 __le16 fc;
1305 unsigned int frag, seq;
1306 struct ieee80211_fragment_entry *entry;
1307 struct sk_buff *skb;
1308 struct ieee80211_rx_status *status;
1309
1310 hdr = (struct ieee80211_hdr *)rx->skb->data;
1311 fc = hdr->frame_control;
1312 sc = le16_to_cpu(hdr->seq_ctrl);
1313 frag = sc & IEEE80211_SCTL_FRAG;
1314
1315 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1316 (rx->skb)->len < 24 ||
1317 is_multicast_ether_addr(hdr->addr1))) {
1318
1319 goto out;
1320 }
1321 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1322
1323 if (skb_linearize(rx->skb))
1324 return RX_DROP_UNUSABLE;
1325
1326
1327
1328
1329
1330
1331 hdr = (struct ieee80211_hdr *)rx->skb->data;
1332 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1333
1334 if (frag == 0) {
1335
1336 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1337 rx->queue, &(rx->skb));
1338 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1339 ieee80211_has_protected(fc)) {
1340 int queue = ieee80211_is_mgmt(fc) ?
1341 NUM_RX_DATA_QUEUES : rx->queue;
1342
1343
1344 entry->ccmp = 1;
1345 memcpy(entry->last_pn,
1346 rx->key->u.ccmp.rx_pn[queue],
1347 CCMP_PN_LEN);
1348 }
1349 return RX_QUEUED;
1350 }
1351
1352
1353
1354
1355 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
1356 if (!entry) {
1357 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1358 return RX_DROP_MONITOR;
1359 }
1360
1361
1362
1363 if (entry->ccmp) {
1364 int i;
1365 u8 pn[CCMP_PN_LEN], *rpn;
1366 int queue;
1367 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
1368 return RX_DROP_UNUSABLE;
1369 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1370 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1371 pn[i]++;
1372 if (pn[i])
1373 break;
1374 }
1375 queue = ieee80211_is_mgmt(fc) ?
1376 NUM_RX_DATA_QUEUES : rx->queue;
1377 rpn = rx->key->u.ccmp.rx_pn[queue];
1378 if (memcmp(pn, rpn, CCMP_PN_LEN))
1379 return RX_DROP_UNUSABLE;
1380 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1381 }
1382
1383 skb_pull(rx->skb, ieee80211_hdrlen(fc));
1384 __skb_queue_tail(&entry->skb_list, rx->skb);
1385 entry->last_frag = frag;
1386 entry->extra_len += rx->skb->len;
1387 if (ieee80211_has_morefrags(fc)) {
1388 rx->skb = NULL;
1389 return RX_QUEUED;
1390 }
1391
1392 rx->skb = __skb_dequeue(&entry->skb_list);
1393 if (skb_tailroom(rx->skb) < entry->extra_len) {
1394 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1395 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1396 GFP_ATOMIC))) {
1397 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1398 __skb_queue_purge(&entry->skb_list);
1399 return RX_DROP_UNUSABLE;
1400 }
1401 }
1402 while ((skb = __skb_dequeue(&entry->skb_list))) {
1403 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1404 dev_kfree_skb(skb);
1405 }
1406
1407
1408 status = IEEE80211_SKB_RXCB(rx->skb);
1409 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1410
1411 out:
1412 if (rx->sta)
1413 rx->sta->rx_packets++;
1414 if (is_multicast_ether_addr(hdr->addr1))
1415 rx->local->dot11MulticastReceivedFrameCount++;
1416 else
1417 ieee80211_led_rx(rx->local);
1418 return RX_CONTINUE;
1419}
1420
1421static ieee80211_rx_result debug_noinline
1422ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1423{
1424 struct ieee80211_sub_if_data *sdata = rx->sdata;
1425 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1426 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1427
1428 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1429 !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
1430 return RX_CONTINUE;
1431
1432 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1433 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1434 return RX_DROP_UNUSABLE;
1435
1436 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1437 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1438 else
1439 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1440
1441
1442
1443 dev_kfree_skb(rx->skb);
1444
1445 return RX_QUEUED;
1446}
1447
1448static ieee80211_rx_result debug_noinline
1449ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1450{
1451 u8 *data = rx->skb->data;
1452 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1453
1454 if (!ieee80211_is_data_qos(hdr->frame_control))
1455 return RX_CONTINUE;
1456
1457
1458 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1459 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1460 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1461
1462 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1463
1464 return RX_CONTINUE;
1465}
1466
1467static int
1468ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1469{
1470 if (unlikely(!rx->sta ||
1471 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1472 return -EACCES;
1473
1474 return 0;
1475}
1476
1477static int
1478ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1479{
1480 struct sk_buff *skb = rx->skb;
1481 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1482
1483
1484
1485
1486
1487 if (status->flag & RX_FLAG_DECRYPTED)
1488 return 0;
1489
1490
1491 if (unlikely(!ieee80211_has_protected(fc) &&
1492 !ieee80211_is_nullfunc(fc) &&
1493 ieee80211_is_data(fc) &&
1494 (rx->key || rx->sdata->drop_unencrypted)))
1495 return -EACCES;
1496
1497 return 0;
1498}
1499
1500static int
1501ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1502{
1503 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1504 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1505 __le16 fc = hdr->frame_control;
1506
1507
1508
1509
1510
1511 if (status->flag & RX_FLAG_DECRYPTED)
1512 return 0;
1513
1514 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1515 if (unlikely(!ieee80211_has_protected(fc) &&
1516 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1517 rx->key)) {
1518 if (ieee80211_is_deauth(fc))
1519 cfg80211_send_unprot_deauth(rx->sdata->dev,
1520 rx->skb->data,
1521 rx->skb->len);
1522 else if (ieee80211_is_disassoc(fc))
1523 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1524 rx->skb->data,
1525 rx->skb->len);
1526 return -EACCES;
1527 }
1528
1529 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1530 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1531 if (ieee80211_is_deauth(fc))
1532 cfg80211_send_unprot_deauth(rx->sdata->dev,
1533 rx->skb->data,
1534 rx->skb->len);
1535 else if (ieee80211_is_disassoc(fc))
1536 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1537 rx->skb->data,
1538 rx->skb->len);
1539 return -EACCES;
1540 }
1541
1542
1543
1544
1545 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1546 ieee80211_is_robust_mgmt_frame(
1547 (struct ieee80211_hdr *) rx->skb->data)))
1548 return -EACCES;
1549 }
1550
1551 return 0;
1552}
1553
1554static int
1555__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1556{
1557 struct ieee80211_sub_if_data *sdata = rx->sdata;
1558 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1559
1560 if (ieee80211_has_a4(hdr->frame_control) &&
1561 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1562 return -1;
1563
1564 if (is_multicast_ether_addr(hdr->addr1) &&
1565 ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) ||
1566 (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
1567 return -1;
1568
1569 return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1570}
1571
1572
1573
1574
1575static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1576{
1577 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1578 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1579 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1580
1581
1582
1583
1584
1585 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1586 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
1587 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1588 return true;
1589
1590 if (ieee80211_802_1x_port_control(rx) ||
1591 ieee80211_drop_unencrypted(rx, fc))
1592 return false;
1593
1594 return true;
1595}
1596
1597
1598
1599
1600static void
1601ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1602{
1603 struct ieee80211_sub_if_data *sdata = rx->sdata;
1604 struct net_device *dev = sdata->dev;
1605 struct sk_buff *skb, *xmit_skb;
1606 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1607 struct sta_info *dsta;
1608 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1609
1610 skb = rx->skb;
1611 xmit_skb = NULL;
1612
1613 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1614 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1615 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1616 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1617 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1618 if (is_multicast_ether_addr(ehdr->h_dest)) {
1619
1620
1621
1622
1623 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1624 if (!xmit_skb && net_ratelimit())
1625 printk(KERN_DEBUG "%s: failed to clone "
1626 "multicast frame\n", dev->name);
1627 } else {
1628 dsta = sta_info_get(sdata, skb->data);
1629 if (dsta) {
1630
1631
1632
1633
1634
1635
1636 xmit_skb = skb;
1637 skb = NULL;
1638 }
1639 }
1640 }
1641
1642 if (skb) {
1643 int align __maybe_unused;
1644
1645#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1646
1647
1648
1649
1650
1651
1652
1653 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
1654 if (align) {
1655 if (WARN_ON(skb_headroom(skb) < 3)) {
1656 dev_kfree_skb(skb);
1657 skb = NULL;
1658 } else {
1659 u8 *data = skb->data;
1660 size_t len = skb_headlen(skb);
1661 skb->data -= align;
1662 memmove(skb->data, data, len);
1663 skb_set_tail_pointer(skb, len);
1664 }
1665 }
1666#endif
1667
1668 if (skb) {
1669
1670 skb->protocol = eth_type_trans(skb, dev);
1671 memset(skb->cb, 0, sizeof(skb->cb));
1672 netif_receive_skb(skb);
1673 }
1674 }
1675
1676 if (xmit_skb) {
1677
1678 xmit_skb->protocol = htons(ETH_P_802_3);
1679 skb_reset_network_header(xmit_skb);
1680 skb_reset_mac_header(xmit_skb);
1681 dev_queue_xmit(xmit_skb);
1682 }
1683}
1684
1685static ieee80211_rx_result debug_noinline
1686ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1687{
1688 struct net_device *dev = rx->sdata->dev;
1689 struct sk_buff *skb = rx->skb;
1690 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1691 __le16 fc = hdr->frame_control;
1692 struct sk_buff_head frame_list;
1693 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1694
1695 if (unlikely(!ieee80211_is_data(fc)))
1696 return RX_CONTINUE;
1697
1698 if (unlikely(!ieee80211_is_data_present(fc)))
1699 return RX_DROP_MONITOR;
1700
1701 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1702 return RX_CONTINUE;
1703
1704 if (ieee80211_has_a4(hdr->frame_control) &&
1705 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1706 !rx->sdata->u.vlan.sta)
1707 return RX_DROP_UNUSABLE;
1708
1709 if (is_multicast_ether_addr(hdr->addr1) &&
1710 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1711 rx->sdata->u.vlan.sta) ||
1712 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1713 rx->sdata->u.mgd.use_4addr)))
1714 return RX_DROP_UNUSABLE;
1715
1716 skb->dev = dev;
1717 __skb_queue_head_init(&frame_list);
1718
1719 if (skb_linearize(skb))
1720 return RX_DROP_UNUSABLE;
1721
1722 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1723 rx->sdata->vif.type,
1724 rx->local->hw.extra_tx_headroom);
1725
1726 while (!skb_queue_empty(&frame_list)) {
1727 rx->skb = __skb_dequeue(&frame_list);
1728
1729 if (!ieee80211_frame_allowed(rx, fc)) {
1730 dev_kfree_skb(rx->skb);
1731 continue;
1732 }
1733 dev->stats.rx_packets++;
1734 dev->stats.rx_bytes += rx->skb->len;
1735
1736 ieee80211_deliver_skb(rx);
1737 }
1738
1739 return RX_QUEUED;
1740}
1741
1742#ifdef CONFIG_MAC80211_MESH
1743static ieee80211_rx_result
1744ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1745{
1746 struct ieee80211_hdr *hdr;
1747 struct ieee80211s_hdr *mesh_hdr;
1748 unsigned int hdrlen;
1749 struct sk_buff *skb = rx->skb, *fwd_skb;
1750 struct ieee80211_local *local = rx->local;
1751 struct ieee80211_sub_if_data *sdata = rx->sdata;
1752 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1753
1754 hdr = (struct ieee80211_hdr *) skb->data;
1755 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1756 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1757
1758 if (!ieee80211_is_data(hdr->frame_control))
1759 return RX_CONTINUE;
1760
1761 if (!mesh_hdr->ttl)
1762
1763 return RX_DROP_MONITOR;
1764
1765 if (mesh_hdr->flags & MESH_FLAGS_AE) {
1766 struct mesh_path *mppath;
1767 char *proxied_addr;
1768 char *mpp_addr;
1769
1770 if (is_multicast_ether_addr(hdr->addr1)) {
1771 mpp_addr = hdr->addr3;
1772 proxied_addr = mesh_hdr->eaddr1;
1773 } else {
1774 mpp_addr = hdr->addr4;
1775 proxied_addr = mesh_hdr->eaddr2;
1776 }
1777
1778 rcu_read_lock();
1779 mppath = mpp_path_lookup(proxied_addr, sdata);
1780 if (!mppath) {
1781 mpp_path_add(proxied_addr, mpp_addr, sdata);
1782 } else {
1783 spin_lock_bh(&mppath->state_lock);
1784 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1785 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
1786 spin_unlock_bh(&mppath->state_lock);
1787 }
1788 rcu_read_unlock();
1789 }
1790
1791
1792 if (!is_multicast_ether_addr(hdr->addr1) &&
1793 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
1794 return RX_CONTINUE;
1795
1796 mesh_hdr->ttl--;
1797
1798 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1799 if (!mesh_hdr->ttl)
1800 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1801 dropped_frames_ttl);
1802 else {
1803 struct ieee80211_hdr *fwd_hdr;
1804 struct ieee80211_tx_info *info;
1805
1806 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1807
1808 if (!fwd_skb && net_ratelimit())
1809 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1810 sdata->name);
1811 if (!fwd_skb)
1812 goto out;
1813
1814 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
1815 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
1816 info = IEEE80211_SKB_CB(fwd_skb);
1817 memset(info, 0, sizeof(*info));
1818 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1819 info->control.vif = &rx->sdata->vif;
1820 skb_set_queue_mapping(skb,
1821 ieee80211_select_queue(rx->sdata, fwd_skb));
1822 ieee80211_set_qos_hdr(local, skb);
1823 if (is_multicast_ether_addr(fwd_hdr->addr1))
1824 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1825 fwded_mcast);
1826 else {
1827 int err;
1828
1829
1830
1831
1832 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
1833 ETH_ALEN);
1834 err = mesh_nexthop_lookup(fwd_skb, sdata);
1835
1836
1837
1838 if (err)
1839 return RX_DROP_MONITOR;
1840
1841 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1842 fwded_unicast);
1843 }
1844 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1845 fwded_frames);
1846 ieee80211_add_pending_skb(local, fwd_skb);
1847 }
1848 }
1849
1850 out:
1851 if (is_multicast_ether_addr(hdr->addr1) ||
1852 sdata->dev->flags & IFF_PROMISC)
1853 return RX_CONTINUE;
1854 else
1855 return RX_DROP_MONITOR;
1856}
1857#endif
1858
1859static ieee80211_rx_result debug_noinline
1860ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1861{
1862 struct ieee80211_sub_if_data *sdata = rx->sdata;
1863 struct ieee80211_local *local = rx->local;
1864 struct net_device *dev = sdata->dev;
1865 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1866 __le16 fc = hdr->frame_control;
1867 int err;
1868
1869 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1870 return RX_CONTINUE;
1871
1872 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1873 return RX_DROP_MONITOR;
1874
1875
1876
1877
1878
1879 if (ieee80211_has_a4(hdr->frame_control) &&
1880 sdata->vif.type == NL80211_IFTYPE_AP)
1881 return RX_DROP_MONITOR;
1882
1883 err = __ieee80211_data_to_8023(rx);
1884 if (unlikely(err))
1885 return RX_DROP_UNUSABLE;
1886
1887 if (!ieee80211_frame_allowed(rx, fc))
1888 return RX_DROP_MONITOR;
1889
1890 rx->skb->dev = dev;
1891
1892 dev->stats.rx_packets++;
1893 dev->stats.rx_bytes += rx->skb->len;
1894
1895 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
1896 !is_multicast_ether_addr(((struct ethhdr *)rx->skb->data)->h_dest)) {
1897 mod_timer(&local->dynamic_ps_timer, jiffies +
1898 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1899 }
1900
1901 ieee80211_deliver_skb(rx);
1902
1903 return RX_QUEUED;
1904}
1905
1906static ieee80211_rx_result debug_noinline
1907ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1908{
1909 struct ieee80211_local *local = rx->local;
1910 struct ieee80211_hw *hw = &local->hw;
1911 struct sk_buff *skb = rx->skb;
1912 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1913 struct tid_ampdu_rx *tid_agg_rx;
1914 u16 start_seq_num;
1915 u16 tid;
1916
1917 if (likely(!ieee80211_is_ctl(bar->frame_control)))
1918 return RX_CONTINUE;
1919
1920 if (ieee80211_is_back_req(bar->frame_control)) {
1921 struct {
1922 __le16 control, start_seq_num;
1923 } __packed bar_data;
1924
1925 if (!rx->sta)
1926 return RX_DROP_MONITOR;
1927
1928 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
1929 &bar_data, sizeof(bar_data)))
1930 return RX_DROP_MONITOR;
1931
1932 tid = le16_to_cpu(bar_data.control) >> 12;
1933
1934 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
1935 if (!tid_agg_rx)
1936 return RX_DROP_MONITOR;
1937
1938 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
1939
1940
1941 if (tid_agg_rx->timeout)
1942 mod_timer(&tid_agg_rx->session_timer,
1943 TU_TO_EXP_TIME(tid_agg_rx->timeout));
1944
1945 spin_lock(&tid_agg_rx->reorder_lock);
1946
1947 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
1948 spin_unlock(&tid_agg_rx->reorder_lock);
1949
1950 kfree_skb(skb);
1951 return RX_QUEUED;
1952 }
1953
1954
1955
1956
1957
1958
1959 return RX_DROP_MONITOR;
1960}
1961
1962static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1963 struct ieee80211_mgmt *mgmt,
1964 size_t len)
1965{
1966 struct ieee80211_local *local = sdata->local;
1967 struct sk_buff *skb;
1968 struct ieee80211_mgmt *resp;
1969
1970 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
1971
1972 return;
1973 }
1974
1975 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
1976 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
1977
1978 return;
1979 }
1980
1981 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
1982
1983 return;
1984 }
1985
1986 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
1987 if (skb == NULL)
1988 return;
1989
1990 skb_reserve(skb, local->hw.extra_tx_headroom);
1991 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
1992 memset(resp, 0, 24);
1993 memcpy(resp->da, mgmt->sa, ETH_ALEN);
1994 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
1995 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
1996 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1997 IEEE80211_STYPE_ACTION);
1998 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
1999 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2000 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2001 memcpy(resp->u.action.u.sa_query.trans_id,
2002 mgmt->u.action.u.sa_query.trans_id,
2003 WLAN_SA_QUERY_TR_ID_LEN);
2004
2005 ieee80211_tx_skb(sdata, skb);
2006}
2007
2008static ieee80211_rx_result debug_noinline
2009ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2010{
2011 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2012 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2013
2014
2015
2016
2017
2018
2019 if (rx->skb->len < 24)
2020 return RX_DROP_MONITOR;
2021
2022 if (!ieee80211_is_mgmt(mgmt->frame_control))
2023 return RX_DROP_MONITOR;
2024
2025 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2026 return RX_DROP_MONITOR;
2027
2028 if (ieee80211_drop_unencrypted_mgmt(rx))
2029 return RX_DROP_UNUSABLE;
2030
2031 return RX_CONTINUE;
2032}
2033
2034static ieee80211_rx_result debug_noinline
2035ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2036{
2037 struct ieee80211_local *local = rx->local;
2038 struct ieee80211_sub_if_data *sdata = rx->sdata;
2039 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2040 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2041 int len = rx->skb->len;
2042
2043 if (!ieee80211_is_action(mgmt->frame_control))
2044 return RX_CONTINUE;
2045
2046
2047 if (len < IEEE80211_MIN_ACTION_SIZE)
2048 return RX_DROP_UNUSABLE;
2049
2050 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
2051 return RX_DROP_UNUSABLE;
2052
2053 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2054 return RX_DROP_UNUSABLE;
2055
2056 switch (mgmt->u.action.category) {
2057 case WLAN_CATEGORY_BACK:
2058
2059
2060
2061
2062
2063
2064 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2065 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2066 sdata->vif.type != NL80211_IFTYPE_AP)
2067 break;
2068
2069
2070 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2071 break;
2072
2073 switch (mgmt->u.action.u.addba_req.action_code) {
2074 case WLAN_ACTION_ADDBA_REQ:
2075 if (len < (IEEE80211_MIN_ACTION_SIZE +
2076 sizeof(mgmt->u.action.u.addba_req)))
2077 goto invalid;
2078 break;
2079 case WLAN_ACTION_ADDBA_RESP:
2080 if (len < (IEEE80211_MIN_ACTION_SIZE +
2081 sizeof(mgmt->u.action.u.addba_resp)))
2082 goto invalid;
2083 break;
2084 case WLAN_ACTION_DELBA:
2085 if (len < (IEEE80211_MIN_ACTION_SIZE +
2086 sizeof(mgmt->u.action.u.delba)))
2087 goto invalid;
2088 break;
2089 default:
2090 goto invalid;
2091 }
2092
2093 goto queue;
2094 case WLAN_CATEGORY_SPECTRUM_MGMT:
2095 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2096 break;
2097
2098 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2099 break;
2100
2101
2102 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2103 break;
2104
2105 switch (mgmt->u.action.u.measurement.action_code) {
2106 case WLAN_ACTION_SPCT_MSR_REQ:
2107 if (len < (IEEE80211_MIN_ACTION_SIZE +
2108 sizeof(mgmt->u.action.u.measurement)))
2109 break;
2110 ieee80211_process_measurement_req(sdata, mgmt, len);
2111 goto handled;
2112 case WLAN_ACTION_SPCT_CHL_SWITCH:
2113 if (len < (IEEE80211_MIN_ACTION_SIZE +
2114 sizeof(mgmt->u.action.u.chan_switch)))
2115 break;
2116
2117 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2118 break;
2119
2120 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
2121 break;
2122
2123 goto queue;
2124 }
2125 break;
2126 case WLAN_CATEGORY_SA_QUERY:
2127 if (len < (IEEE80211_MIN_ACTION_SIZE +
2128 sizeof(mgmt->u.action.u.sa_query)))
2129 break;
2130
2131 switch (mgmt->u.action.u.sa_query.action) {
2132 case WLAN_ACTION_SA_QUERY_REQUEST:
2133 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2134 break;
2135 ieee80211_process_sa_query_req(sdata, mgmt, len);
2136 goto handled;
2137 }
2138 break;
2139 case WLAN_CATEGORY_MESH_PLINK:
2140 if (!ieee80211_vif_is_mesh(&sdata->vif))
2141 break;
2142 goto queue;
2143 case WLAN_CATEGORY_MESH_PATH_SEL:
2144 if (!mesh_path_sel_is_hwmp(sdata))
2145 break;
2146 goto queue;
2147 }
2148
2149 return RX_CONTINUE;
2150
2151 invalid:
2152 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2153
2154 return RX_CONTINUE;
2155
2156 handled:
2157 if (rx->sta)
2158 rx->sta->rx_packets++;
2159 dev_kfree_skb(rx->skb);
2160 return RX_QUEUED;
2161
2162 queue:
2163 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2164 skb_queue_tail(&sdata->skb_queue, rx->skb);
2165 ieee80211_queue_work(&local->hw, &sdata->work);
2166 if (rx->sta)
2167 rx->sta->rx_packets++;
2168 return RX_QUEUED;
2169}
2170
2171static ieee80211_rx_result debug_noinline
2172ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2173{
2174 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2175
2176
2177 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2178 return RX_CONTINUE;
2179
2180
2181
2182
2183
2184
2185
2186
2187 if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
2188 rx->skb->data, rx->skb->len,
2189 GFP_ATOMIC)) {
2190 if (rx->sta)
2191 rx->sta->rx_packets++;
2192 dev_kfree_skb(rx->skb);
2193 return RX_QUEUED;
2194 }
2195
2196
2197 return RX_CONTINUE;
2198}
2199
2200static ieee80211_rx_result debug_noinline
2201ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2202{
2203 struct ieee80211_local *local = rx->local;
2204 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2205 struct sk_buff *nskb;
2206 struct ieee80211_sub_if_data *sdata = rx->sdata;
2207 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2208
2209 if (!ieee80211_is_action(mgmt->frame_control))
2210 return RX_CONTINUE;
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2223 (sdata->vif.type == NL80211_IFTYPE_AP ||
2224 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2225 return RX_DROP_MONITOR;
2226
2227
2228 if (mgmt->u.action.category & 0x80)
2229 return RX_DROP_UNUSABLE;
2230
2231 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2232 GFP_ATOMIC);
2233 if (nskb) {
2234 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2235
2236 nmgmt->u.action.category |= 0x80;
2237 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2238 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2239
2240 memset(nskb->cb, 0, sizeof(nskb->cb));
2241
2242 ieee80211_tx_skb(rx->sdata, nskb);
2243 }
2244 dev_kfree_skb(rx->skb);
2245 return RX_QUEUED;
2246}
2247
2248static ieee80211_rx_result debug_noinline
2249ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2250{
2251 struct ieee80211_sub_if_data *sdata = rx->sdata;
2252 ieee80211_rx_result rxs;
2253 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2254 __le16 stype;
2255
2256 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2257 if (rxs != RX_CONTINUE)
2258 return rxs;
2259
2260 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2261
2262 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2263 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2264 sdata->vif.type != NL80211_IFTYPE_STATION)
2265 return RX_DROP_MONITOR;
2266
2267 switch (stype) {
2268 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2269 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2270
2271 break;
2272 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2273 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2274 if (is_multicast_ether_addr(mgmt->da) &&
2275 !is_broadcast_ether_addr(mgmt->da))
2276 return RX_DROP_MONITOR;
2277
2278
2279 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2280 return RX_DROP_MONITOR;
2281 break;
2282 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2283 case cpu_to_le16(IEEE80211_STYPE_AUTH):
2284
2285 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
2286 return RX_DROP_MONITOR;
2287 break;
2288 default:
2289 return RX_DROP_MONITOR;
2290 }
2291
2292
2293 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2294 skb_queue_tail(&sdata->skb_queue, rx->skb);
2295 ieee80211_queue_work(&rx->local->hw, &sdata->work);
2296 if (rx->sta)
2297 rx->sta->rx_packets++;
2298
2299 return RX_QUEUED;
2300}
2301
2302static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
2303 struct ieee80211_rx_data *rx)
2304{
2305 int keyidx;
2306 unsigned int hdrlen;
2307
2308 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2309 if (rx->skb->len >= hdrlen + 4)
2310 keyidx = rx->skb->data[hdrlen + 3] >> 6;
2311 else
2312 keyidx = -1;
2313
2314 if (!rx->sta) {
2315
2316
2317
2318
2319 return;
2320 }
2321
2322 if (!ieee80211_has_protected(hdr->frame_control))
2323 return;
2324
2325 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
2326
2327
2328
2329
2330
2331
2332 return;
2333 }
2334
2335 if (!ieee80211_is_data(hdr->frame_control) &&
2336 !ieee80211_is_auth(hdr->frame_control))
2337 return;
2338
2339 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2340 GFP_ATOMIC);
2341}
2342
2343
2344static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2345 struct ieee80211_rate *rate)
2346{
2347 struct ieee80211_sub_if_data *sdata;
2348 struct ieee80211_local *local = rx->local;
2349 struct ieee80211_rtap_hdr {
2350 struct ieee80211_radiotap_header hdr;
2351 u8 flags;
2352 u8 rate_or_pad;
2353 __le16 chan_freq;
2354 __le16 chan_flags;
2355 } __packed *rthdr;
2356 struct sk_buff *skb = rx->skb, *skb2;
2357 struct net_device *prev_dev = NULL;
2358 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2359
2360
2361
2362
2363
2364 if (rx->flags & IEEE80211_RX_CMNTR)
2365 goto out_free_skb;
2366 rx->flags |= IEEE80211_RX_CMNTR;
2367
2368 if (skb_headroom(skb) < sizeof(*rthdr) &&
2369 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2370 goto out_free_skb;
2371
2372 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2373 memset(rthdr, 0, sizeof(*rthdr));
2374 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2375 rthdr->hdr.it_present =
2376 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
2377 (1 << IEEE80211_RADIOTAP_CHANNEL));
2378
2379 if (rate) {
2380 rthdr->rate_or_pad = rate->bitrate / 5;
2381 rthdr->hdr.it_present |=
2382 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2383 }
2384 rthdr->chan_freq = cpu_to_le16(status->freq);
2385
2386 if (status->band == IEEE80211_BAND_5GHZ)
2387 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2388 IEEE80211_CHAN_5GHZ);
2389 else
2390 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2391 IEEE80211_CHAN_2GHZ);
2392
2393 skb_set_mac_header(skb, 0);
2394 skb->ip_summed = CHECKSUM_UNNECESSARY;
2395 skb->pkt_type = PACKET_OTHERHOST;
2396 skb->protocol = htons(ETH_P_802_2);
2397
2398 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2399 if (!ieee80211_sdata_running(sdata))
2400 continue;
2401
2402 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2403 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2404 continue;
2405
2406 if (prev_dev) {
2407 skb2 = skb_clone(skb, GFP_ATOMIC);
2408 if (skb2) {
2409 skb2->dev = prev_dev;
2410 netif_receive_skb(skb2);
2411 }
2412 }
2413
2414 prev_dev = sdata->dev;
2415 sdata->dev->stats.rx_packets++;
2416 sdata->dev->stats.rx_bytes += skb->len;
2417 }
2418
2419 if (prev_dev) {
2420 skb->dev = prev_dev;
2421 netif_receive_skb(skb);
2422 return;
2423 }
2424
2425 out_free_skb:
2426 dev_kfree_skb(skb);
2427}
2428
2429static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2430 ieee80211_rx_result res)
2431{
2432 switch (res) {
2433 case RX_DROP_MONITOR:
2434 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2435 if (rx->sta)
2436 rx->sta->rx_dropped++;
2437
2438 case RX_CONTINUE: {
2439 struct ieee80211_rate *rate = NULL;
2440 struct ieee80211_supported_band *sband;
2441 struct ieee80211_rx_status *status;
2442
2443 status = IEEE80211_SKB_RXCB((rx->skb));
2444
2445 sband = rx->local->hw.wiphy->bands[status->band];
2446 if (!(status->flag & RX_FLAG_HT))
2447 rate = &sband->bitrates[status->rate_idx];
2448
2449 ieee80211_rx_cooked_monitor(rx, rate);
2450 break;
2451 }
2452 case RX_DROP_UNUSABLE:
2453 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2454 if (rx->sta)
2455 rx->sta->rx_dropped++;
2456 dev_kfree_skb(rx->skb);
2457 break;
2458 case RX_QUEUED:
2459 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2460 break;
2461 }
2462}
2463
2464static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
2465{
2466 ieee80211_rx_result res = RX_DROP_MONITOR;
2467 struct sk_buff *skb;
2468
2469#define CALL_RXH(rxh) \
2470 do { \
2471 res = rxh(rx); \
2472 if (res != RX_CONTINUE) \
2473 goto rxh_next; \
2474 } while (0);
2475
2476 spin_lock(&rx->local->rx_skb_queue.lock);
2477 if (rx->local->running_rx_handler)
2478 goto unlock;
2479
2480 rx->local->running_rx_handler = true;
2481
2482 while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
2483 spin_unlock(&rx->local->rx_skb_queue.lock);
2484
2485
2486
2487
2488
2489
2490 rx->skb = skb;
2491 rx->flags = 0;
2492
2493 CALL_RXH(ieee80211_rx_h_decrypt)
2494 CALL_RXH(ieee80211_rx_h_check_more_data)
2495 CALL_RXH(ieee80211_rx_h_sta_process)
2496 CALL_RXH(ieee80211_rx_h_defragment)
2497 CALL_RXH(ieee80211_rx_h_ps_poll)
2498 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2499
2500 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2501 CALL_RXH(ieee80211_rx_h_amsdu)
2502#ifdef CONFIG_MAC80211_MESH
2503 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2504 CALL_RXH(ieee80211_rx_h_mesh_fwding);
2505#endif
2506 CALL_RXH(ieee80211_rx_h_data)
2507 CALL_RXH(ieee80211_rx_h_ctrl);
2508 CALL_RXH(ieee80211_rx_h_mgmt_check)
2509 CALL_RXH(ieee80211_rx_h_action)
2510 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2511 CALL_RXH(ieee80211_rx_h_action_return)
2512 CALL_RXH(ieee80211_rx_h_mgmt)
2513
2514 rxh_next:
2515 ieee80211_rx_handlers_result(rx, res);
2516 spin_lock(&rx->local->rx_skb_queue.lock);
2517#undef CALL_RXH
2518 }
2519
2520 rx->local->running_rx_handler = false;
2521
2522 unlock:
2523 spin_unlock(&rx->local->rx_skb_queue.lock);
2524}
2525
2526static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2527{
2528 ieee80211_rx_result res = RX_DROP_MONITOR;
2529
2530#define CALL_RXH(rxh) \
2531 do { \
2532 res = rxh(rx); \
2533 if (res != RX_CONTINUE) \
2534 goto rxh_next; \
2535 } while (0);
2536
2537 CALL_RXH(ieee80211_rx_h_passive_scan)
2538 CALL_RXH(ieee80211_rx_h_check)
2539
2540 ieee80211_rx_reorder_ampdu(rx);
2541
2542 ieee80211_rx_handlers(rx);
2543 return;
2544
2545 rxh_next:
2546 ieee80211_rx_handlers_result(rx, res);
2547
2548#undef CALL_RXH
2549}
2550
2551
2552
2553
2554
2555void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2556{
2557 struct ieee80211_rx_data rx = {
2558 .sta = sta,
2559 .sdata = sta->sdata,
2560 .local = sta->local,
2561 .queue = tid,
2562 };
2563 struct tid_ampdu_rx *tid_agg_rx;
2564
2565 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2566 if (!tid_agg_rx)
2567 return;
2568
2569 spin_lock(&tid_agg_rx->reorder_lock);
2570 ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
2571 spin_unlock(&tid_agg_rx->reorder_lock);
2572
2573 ieee80211_rx_handlers(&rx);
2574}
2575
2576
2577
2578static int prepare_for_handlers(struct ieee80211_rx_data *rx,
2579 struct ieee80211_hdr *hdr)
2580{
2581 struct ieee80211_sub_if_data *sdata = rx->sdata;
2582 struct sk_buff *skb = rx->skb;
2583 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2584 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
2585 int multicast = is_multicast_ether_addr(hdr->addr1);
2586
2587 switch (sdata->vif.type) {
2588 case NL80211_IFTYPE_STATION:
2589 if (!bssid && !sdata->u.mgd.use_4addr)
2590 return 0;
2591 if (!multicast &&
2592 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
2593 if (!(sdata->dev->flags & IFF_PROMISC))
2594 return 0;
2595 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2596 }
2597 break;
2598 case NL80211_IFTYPE_ADHOC:
2599 if (!bssid)
2600 return 0;
2601 if (ieee80211_is_beacon(hdr->frame_control)) {
2602 return 1;
2603 }
2604 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2605 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2606 return 0;
2607 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2608 } else if (!multicast &&
2609 compare_ether_addr(sdata->vif.addr,
2610 hdr->addr1) != 0) {
2611 if (!(sdata->dev->flags & IFF_PROMISC))
2612 return 0;
2613 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2614 } else if (!rx->sta) {
2615 int rate_idx;
2616 if (status->flag & RX_FLAG_HT)
2617 rate_idx = 0;
2618 else
2619 rate_idx = status->rate_idx;
2620 rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
2621 hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
2622 }
2623 break;
2624 case NL80211_IFTYPE_MESH_POINT:
2625 if (!multicast &&
2626 compare_ether_addr(sdata->vif.addr,
2627 hdr->addr1) != 0) {
2628 if (!(sdata->dev->flags & IFF_PROMISC))
2629 return 0;
2630
2631 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2632 }
2633 break;
2634 case NL80211_IFTYPE_AP_VLAN:
2635 case NL80211_IFTYPE_AP:
2636 if (!bssid) {
2637 if (compare_ether_addr(sdata->vif.addr,
2638 hdr->addr1))
2639 return 0;
2640 } else if (!ieee80211_bssid_match(bssid,
2641 sdata->vif.addr)) {
2642 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2643 return 0;
2644 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2645 }
2646 break;
2647 case NL80211_IFTYPE_WDS:
2648 if (bssid || !ieee80211_is_data(hdr->frame_control))
2649 return 0;
2650 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2651 return 0;
2652 break;
2653 default:
2654
2655 WARN_ON(1);
2656 break;
2657 }
2658
2659 return 1;
2660}
2661
2662
2663
2664
2665
2666
2667
2668static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2669 struct sk_buff *skb, bool consume)
2670{
2671 struct ieee80211_local *local = rx->local;
2672 struct ieee80211_sub_if_data *sdata = rx->sdata;
2673 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2674 struct ieee80211_hdr *hdr = (void *)skb->data;
2675 int prepares;
2676
2677 rx->skb = skb;
2678 status->rx_flags |= IEEE80211_RX_RA_MATCH;
2679 prepares = prepare_for_handlers(rx, hdr);
2680
2681 if (!prepares)
2682 return false;
2683
2684 if (status->flag & RX_FLAG_MMIC_ERROR) {
2685 if (status->rx_flags & IEEE80211_RX_RA_MATCH)
2686 ieee80211_rx_michael_mic_report(hdr, rx);
2687 return false;
2688 }
2689
2690 if (!consume) {
2691 skb = skb_copy(skb, GFP_ATOMIC);
2692 if (!skb) {
2693 if (net_ratelimit())
2694 wiphy_debug(local->hw.wiphy,
2695 "failed to copy multicast frame for %s\n",
2696 sdata->name);
2697 return true;
2698 }
2699
2700 rx->skb = skb;
2701 }
2702
2703 ieee80211_invoke_rx_handlers(rx);
2704 return true;
2705}
2706
2707
2708
2709
2710
2711static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2712 struct sk_buff *skb)
2713{
2714 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2715 struct ieee80211_local *local = hw_to_local(hw);
2716 struct ieee80211_sub_if_data *sdata;
2717 struct ieee80211_hdr *hdr;
2718 __le16 fc;
2719 struct ieee80211_rx_data rx;
2720 struct ieee80211_sub_if_data *prev;
2721 struct sta_info *sta, *tmp, *prev_sta;
2722 int err = 0;
2723
2724 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
2725 memset(&rx, 0, sizeof(rx));
2726 rx.skb = skb;
2727 rx.local = local;
2728
2729 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
2730 local->dot11ReceivedFragmentCount++;
2731
2732 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2733 test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
2734 status->rx_flags |= IEEE80211_RX_IN_SCAN;
2735
2736 if (ieee80211_is_mgmt(fc))
2737 err = skb_linearize(skb);
2738 else
2739 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
2740
2741 if (err) {
2742 dev_kfree_skb(skb);
2743 return;
2744 }
2745
2746 hdr = (struct ieee80211_hdr *)skb->data;
2747 ieee80211_parse_qos(&rx);
2748 ieee80211_verify_alignment(&rx);
2749
2750 if (ieee80211_is_data(fc)) {
2751 prev_sta = NULL;
2752
2753 for_each_sta_info(local, hdr->addr2, sta, tmp) {
2754 if (!prev_sta) {
2755 prev_sta = sta;
2756 continue;
2757 }
2758
2759 rx.sta = prev_sta;
2760 rx.sdata = prev_sta->sdata;
2761 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2762
2763 prev_sta = sta;
2764 }
2765
2766 if (prev_sta) {
2767 rx.sta = prev_sta;
2768 rx.sdata = prev_sta->sdata;
2769
2770 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2771 return;
2772 goto out;
2773 }
2774 }
2775
2776 prev = NULL;
2777
2778 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2779 if (!ieee80211_sdata_running(sdata))
2780 continue;
2781
2782 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2783 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2784 continue;
2785
2786
2787
2788
2789
2790
2791
2792 if (!prev) {
2793 prev = sdata;
2794 continue;
2795 }
2796
2797 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2798 rx.sdata = prev;
2799 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2800
2801 prev = sdata;
2802 }
2803
2804 if (prev) {
2805 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2806 rx.sdata = prev;
2807
2808 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2809 return;
2810 }
2811
2812 out:
2813 dev_kfree_skb(skb);
2814}
2815
2816
2817
2818
2819
2820void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
2821{
2822 struct ieee80211_local *local = hw_to_local(hw);
2823 struct ieee80211_rate *rate = NULL;
2824 struct ieee80211_supported_band *sband;
2825 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2826
2827 WARN_ON_ONCE(softirq_count() == 0);
2828
2829 if (WARN_ON(status->band < 0 ||
2830 status->band >= IEEE80211_NUM_BANDS))
2831 goto drop;
2832
2833 sband = local->hw.wiphy->bands[status->band];
2834 if (WARN_ON(!sband))
2835 goto drop;
2836
2837
2838
2839
2840
2841
2842
2843
2844 if (unlikely(local->quiescing || local->suspended))
2845 goto drop;
2846
2847
2848
2849
2850
2851 if (WARN_ON(!local->started))
2852 goto drop;
2853
2854 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
2855
2856
2857
2858
2859
2860 if (status->flag & RX_FLAG_HT) {
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871 if (WARN((status->rate_idx < 0 ||
2872 status->rate_idx > 76),
2873 "Rate marked as an HT rate but passed "
2874 "status->rate_idx is not "
2875 "an MCS index [0-76]: %d (0x%02x)\n",
2876 status->rate_idx,
2877 status->rate_idx))
2878 goto drop;
2879 } else {
2880 if (WARN_ON(status->rate_idx < 0 ||
2881 status->rate_idx >= sband->n_bitrates))
2882 goto drop;
2883 rate = &sband->bitrates[status->rate_idx];
2884 }
2885 }
2886
2887 status->rx_flags = 0;
2888
2889
2890
2891
2892
2893
2894 rcu_read_lock();
2895
2896
2897
2898
2899
2900
2901
2902 skb = ieee80211_rx_monitor(local, skb, rate);
2903 if (!skb) {
2904 rcu_read_unlock();
2905 return;
2906 }
2907
2908 ieee80211_tpt_led_trig_rx(local,
2909 ((struct ieee80211_hdr *)skb->data)->frame_control,
2910 skb->len);
2911 __ieee80211_rx_handle_packet(hw, skb);
2912
2913 rcu_read_unlock();
2914
2915 return;
2916 drop:
2917 kfree_skb(skb);
2918}
2919EXPORT_SYMBOL(ieee80211_rx);
2920
2921
2922
2923void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
2924{
2925 struct ieee80211_local *local = hw_to_local(hw);
2926
2927 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2928
2929 skb->pkt_type = IEEE80211_RX_MSG;
2930 skb_queue_tail(&local->skb_queue, skb);
2931 tasklet_schedule(&local->tasklet);
2932}
2933EXPORT_SYMBOL(ieee80211_rx_irqsafe);
2934