1
2
3
4
5
6
7
8
9
10
11
12#include <linux/jiffies.h>
13#include <linux/slab.h>
14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
18#include <linux/rcupdate.h>
19#include <linux/export.h>
20#include <net/mac80211.h>
21#include <net/ieee80211_radiotap.h>
22#include <asm/unaligned.h>
23
24#include "ieee80211_i.h"
25#include "driver-ops.h"
26#include "led.h"
27#include "mesh.h"
28#include "wep.h"
29#include "wpa.h"
30#include "tkip.h"
31#include "wme.h"
32#include "rate.h"
33
34
35
36
37
38
39
40static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
41 struct sk_buff *skb)
42{
43 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
44
45 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
46 if (likely(skb->len > FCS_LEN))
47 __pskb_trim(skb, skb->len - FCS_LEN);
48 else {
49
50 WARN_ON(1);
51 dev_kfree_skb(skb);
52 return NULL;
53 }
54 }
55
56 if (status->vendor_radiotap_len)
57 __pskb_pull(skb, status->vendor_radiotap_len);
58
59 return skb;
60}
61
62static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
63{
64 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
65 struct ieee80211_hdr *hdr;
66
67 hdr = (void *)(skb->data + status->vendor_radiotap_len);
68
69 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
70 RX_FLAG_FAILED_PLCP_CRC |
71 RX_FLAG_AMPDU_IS_ZEROLEN))
72 return 1;
73 if (unlikely(skb->len < 16 + present_fcs_len +
74 status->vendor_radiotap_len))
75 return 1;
76 if (ieee80211_is_ctl(hdr->frame_control) &&
77 !ieee80211_is_pspoll(hdr->frame_control) &&
78 !ieee80211_is_back_req(hdr->frame_control))
79 return 1;
80 return 0;
81}
82
83static int
84ieee80211_rx_radiotap_space(struct ieee80211_local *local,
85 struct ieee80211_rx_status *status)
86{
87 int len;
88
89
90 len = sizeof(struct ieee80211_radiotap_header) + 9;
91
92
93 if (status->vendor_radiotap_len)
94 len += 4;
95
96 if (ieee80211_have_rx_timestamp(status)) {
97 len = ALIGN(len, 8);
98 len += 8;
99 }
100 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
101 len += 1;
102
103
104 len = ALIGN(len, 2);
105
106 if (status->flag & RX_FLAG_HT)
107 len += 3;
108
109 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
110 len = ALIGN(len, 4);
111 len += 8;
112 }
113
114 if (status->flag & RX_FLAG_VHT) {
115 len = ALIGN(len, 2);
116 len += 12;
117 }
118
119 if (status->vendor_radiotap_len) {
120 if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
121 status->vendor_radiotap_align = 1;
122
123 len = ALIGN(len, 2);
124
125 len += 6;
126
127 len = ALIGN(len, status->vendor_radiotap_align);
128
129 }
130
131 return len;
132}
133
134
135
136
137
138
139static void
140ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
141 struct sk_buff *skb,
142 struct ieee80211_rate *rate,
143 int rtap_len, bool has_fcs)
144{
145 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
146 struct ieee80211_radiotap_header *rthdr;
147 unsigned char *pos;
148 u16 rx_flags = 0;
149 int mpdulen;
150
151 mpdulen = skb->len;
152 if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
153 mpdulen += FCS_LEN;
154
155 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
156 memset(rthdr, 0, rtap_len);
157
158
159 rthdr->it_present =
160 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
161 (1 << IEEE80211_RADIOTAP_CHANNEL) |
162 (1 << IEEE80211_RADIOTAP_ANTENNA) |
163 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
164 rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len);
165
166 pos = (unsigned char *)(rthdr + 1);
167
168 if (status->vendor_radiotap_len) {
169 rthdr->it_present |=
170 cpu_to_le32(BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE)) |
171 cpu_to_le32(BIT(IEEE80211_RADIOTAP_EXT));
172 put_unaligned_le32(status->vendor_radiotap_bitmap, pos);
173 pos += 4;
174 }
175
176
177
178
179 if (ieee80211_have_rx_timestamp(status)) {
180
181 while ((pos - (u8 *)rthdr) & 7)
182 *pos++ = 0;
183 put_unaligned_le64(
184 ieee80211_calculate_rx_timestamp(local, status,
185 mpdulen, 0),
186 pos);
187 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
188 pos += 8;
189 }
190
191
192 if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
193 *pos |= IEEE80211_RADIOTAP_F_FCS;
194 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
195 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
196 if (status->flag & RX_FLAG_SHORTPRE)
197 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
198 pos++;
199
200
201 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
202
203
204
205
206
207
208 *pos = 0;
209 } else {
210 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
211 *pos = rate->bitrate / 5;
212 }
213 pos++;
214
215
216 put_unaligned_le16(status->freq, pos);
217 pos += 2;
218 if (status->band == IEEE80211_BAND_5GHZ)
219 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
220 pos);
221 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
222 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
223 pos);
224 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
225 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
226 pos);
227 else if (rate)
228 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
229 pos);
230 else
231 put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
232 pos += 2;
233
234
235 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
236 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
237 *pos = status->signal;
238 rthdr->it_present |=
239 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
240 pos++;
241 }
242
243
244
245
246 *pos = status->antenna;
247 pos++;
248
249
250
251
252
253 if ((pos - (u8 *)rthdr) & 1)
254 *pos++ = 0;
255 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
256 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
257 put_unaligned_le16(rx_flags, pos);
258 pos += 2;
259
260 if (status->flag & RX_FLAG_HT) {
261 unsigned int stbc;
262
263 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
264 *pos++ = local->hw.radiotap_mcs_details;
265 *pos = 0;
266 if (status->flag & RX_FLAG_SHORT_GI)
267 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
268 if (status->flag & RX_FLAG_40MHZ)
269 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
270 if (status->flag & RX_FLAG_HT_GF)
271 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
272 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
273 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
274 pos++;
275 *pos++ = status->rate_idx;
276 }
277
278 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
279 u16 flags = 0;
280
281
282 while ((pos - (u8 *)rthdr) & 3)
283 pos++;
284 rthdr->it_present |=
285 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
286 put_unaligned_le32(status->ampdu_reference, pos);
287 pos += 4;
288 if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
289 flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
290 if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
291 flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
292 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
293 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
294 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
295 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
296 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
297 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
298 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
299 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
300 put_unaligned_le16(flags, pos);
301 pos += 2;
302 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
303 *pos++ = status->ampdu_delimiter_crc;
304 else
305 *pos++ = 0;
306 *pos++ = 0;
307 }
308
309 if (status->flag & RX_FLAG_VHT) {
310 u16 known = local->hw.radiotap_vht_details;
311
312 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
313
314 if (status->flag & RX_FLAG_80P80MHZ)
315 known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
316 put_unaligned_le16(known, pos);
317 pos += 2;
318
319 if (status->flag & RX_FLAG_SHORT_GI)
320 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
321 pos++;
322
323 if (status->flag & RX_FLAG_80MHZ)
324 *pos++ = 4;
325 else if (status->flag & RX_FLAG_80P80MHZ)
326 *pos++ = 0;
327 else if (status->flag & RX_FLAG_160MHZ)
328 *pos++ = 11;
329 else if (status->flag & RX_FLAG_40MHZ)
330 *pos++ = 1;
331 else
332 *pos++ = 0;
333
334 *pos = (status->rate_idx << 4) | status->vht_nss;
335 pos += 4;
336
337 pos++;
338
339 pos++;
340
341 pos += 2;
342 }
343
344 if (status->vendor_radiotap_len) {
345
346 if ((pos - (u8 *)rthdr) & 1)
347 *pos++ = 0;
348 *pos++ = status->vendor_radiotap_oui[0];
349 *pos++ = status->vendor_radiotap_oui[1];
350 *pos++ = status->vendor_radiotap_oui[2];
351 *pos++ = status->vendor_radiotap_subns;
352 put_unaligned_le16(status->vendor_radiotap_len, pos);
353 pos += 2;
354
355 while ((pos - (u8 *)rthdr) & (status->vendor_radiotap_align - 1))
356 *pos++ = 0;
357 }
358}
359
360
361
362
363
364
365static struct sk_buff *
366ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
367 struct ieee80211_rate *rate)
368{
369 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
370 struct ieee80211_sub_if_data *sdata;
371 int needed_headroom;
372 struct sk_buff *skb, *skb2;
373 struct net_device *prev_dev = NULL;
374 int present_fcs_len = 0;
375
376
377
378
379
380
381
382
383
384
385 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
386 present_fcs_len = FCS_LEN;
387
388
389 if (!pskb_may_pull(origskb, 2 + status->vendor_radiotap_len)) {
390 dev_kfree_skb(origskb);
391 return NULL;
392 }
393
394 if (!local->monitors) {
395 if (should_drop_frame(origskb, present_fcs_len)) {
396 dev_kfree_skb(origskb);
397 return NULL;
398 }
399
400 return remove_monitor_info(local, origskb);
401 }
402
403
404 needed_headroom = ieee80211_rx_radiotap_space(local, status);
405
406 if (should_drop_frame(origskb, present_fcs_len)) {
407
408 skb = origskb;
409 origskb = NULL;
410
411
412
413
414
415
416
417
418 if (skb_headroom(skb) < needed_headroom &&
419 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
420 dev_kfree_skb(skb);
421 return NULL;
422 }
423 } else {
424
425
426
427
428 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
429
430 origskb = remove_monitor_info(local, origskb);
431
432 if (!skb)
433 return origskb;
434 }
435
436
437 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
438 true);
439
440 skb_reset_mac_header(skb);
441 skb->ip_summed = CHECKSUM_UNNECESSARY;
442 skb->pkt_type = PACKET_OTHERHOST;
443 skb->protocol = htons(ETH_P_802_2);
444
445 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
446 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
447 continue;
448
449 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
450 continue;
451
452 if (!ieee80211_sdata_running(sdata))
453 continue;
454
455 if (prev_dev) {
456 skb2 = skb_clone(skb, GFP_ATOMIC);
457 if (skb2) {
458 skb2->dev = prev_dev;
459 netif_receive_skb(skb2);
460 }
461 }
462
463 prev_dev = sdata->dev;
464 sdata->dev->stats.rx_packets++;
465 sdata->dev->stats.rx_bytes += skb->len;
466 }
467
468 if (prev_dev) {
469 skb->dev = prev_dev;
470 netif_receive_skb(skb);
471 } else
472 dev_kfree_skb(skb);
473
474 return origskb;
475}
476
477static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
478{
479 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
480 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
481 int tid, seqno_idx, security_idx;
482
483
484 if (ieee80211_is_data_qos(hdr->frame_control)) {
485 u8 *qc = ieee80211_get_qos_ctl(hdr);
486
487 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
488 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
489 status->rx_flags |= IEEE80211_RX_AMSDU;
490
491 seqno_idx = tid;
492 security_idx = tid;
493 } else {
494
495
496
497
498
499
500
501
502
503
504
505 seqno_idx = IEEE80211_NUM_TIDS;
506 security_idx = 0;
507 if (ieee80211_is_mgmt(hdr->frame_control))
508 security_idx = IEEE80211_NUM_TIDS;
509 tid = 0;
510 }
511
512 rx->seqno_idx = seqno_idx;
513 rx->security_idx = security_idx;
514
515
516 rx->skb->priority = (tid > 7) ? 0 : tid;
517}
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
545{
546#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
547 WARN_ONCE((unsigned long)rx->skb->data & 1,
548 "unaligned packet at 0x%p\n", rx->skb->data);
549#endif
550}
551
552
553
554
555static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
556{
557 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
558
559 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
560 return 0;
561
562 return ieee80211_is_robust_mgmt_frame(hdr);
563}
564
565
566static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
567{
568 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
569
570 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
571 return 0;
572
573 return ieee80211_is_robust_mgmt_frame(hdr);
574}
575
576
577
578static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
579{
580 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
581 struct ieee80211_mmie *mmie;
582
583 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
584 return -1;
585
586 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
587 return -1;
588
589 mmie = (struct ieee80211_mmie *)
590 (skb->data + skb->len - sizeof(*mmie));
591 if (mmie->element_id != WLAN_EID_MMIE ||
592 mmie->length != sizeof(*mmie) - 2)
593 return -1;
594
595 return le16_to_cpu(mmie->key_id);
596}
597
598static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
599{
600 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
601 char *dev_addr = rx->sdata->vif.addr;
602
603 if (ieee80211_is_data(hdr->frame_control)) {
604 if (is_multicast_ether_addr(hdr->addr1)) {
605 if (ieee80211_has_tods(hdr->frame_control) ||
606 !ieee80211_has_fromds(hdr->frame_control))
607 return RX_DROP_MONITOR;
608 if (ether_addr_equal(hdr->addr3, dev_addr))
609 return RX_DROP_MONITOR;
610 } else {
611 if (!ieee80211_has_a4(hdr->frame_control))
612 return RX_DROP_MONITOR;
613 if (ether_addr_equal(hdr->addr4, dev_addr))
614 return RX_DROP_MONITOR;
615 }
616 }
617
618
619
620
621
622 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
623 struct ieee80211_mgmt *mgmt;
624
625 if (!ieee80211_is_mgmt(hdr->frame_control))
626 return RX_DROP_MONITOR;
627
628 if (ieee80211_is_action(hdr->frame_control)) {
629 u8 category;
630
631
632 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
633 return RX_DROP_MONITOR;
634
635 mgmt = (struct ieee80211_mgmt *)hdr;
636 category = mgmt->u.action.category;
637 if (category != WLAN_CATEGORY_MESH_ACTION &&
638 category != WLAN_CATEGORY_SELF_PROTECTED)
639 return RX_DROP_MONITOR;
640 return RX_CONTINUE;
641 }
642
643 if (ieee80211_is_probe_req(hdr->frame_control) ||
644 ieee80211_is_probe_resp(hdr->frame_control) ||
645 ieee80211_is_beacon(hdr->frame_control) ||
646 ieee80211_is_auth(hdr->frame_control))
647 return RX_CONTINUE;
648
649 return RX_DROP_MONITOR;
650 }
651
652 return RX_CONTINUE;
653}
654
655static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
656 struct tid_ampdu_rx *tid_agg_rx,
657 int index,
658 struct sk_buff_head *frames)
659{
660 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
661 struct ieee80211_rx_status *status;
662
663 lockdep_assert_held(&tid_agg_rx->reorder_lock);
664
665 if (!skb)
666 goto no_frame;
667
668
669 tid_agg_rx->stored_mpdu_num--;
670 tid_agg_rx->reorder_buf[index] = NULL;
671 status = IEEE80211_SKB_RXCB(skb);
672 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
673 __skb_queue_tail(frames, skb);
674
675no_frame:
676 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
677}
678
679static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
680 struct tid_ampdu_rx *tid_agg_rx,
681 u16 head_seq_num,
682 struct sk_buff_head *frames)
683{
684 int index;
685
686 lockdep_assert_held(&tid_agg_rx->reorder_lock);
687
688 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
689 index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
690 tid_agg_rx->ssn) %
691 tid_agg_rx->buf_size;
692 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
693 frames);
694 }
695}
696
697
698
699
700
701
702
703
704
705
706#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
707
708static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
709 struct tid_ampdu_rx *tid_agg_rx,
710 struct sk_buff_head *frames)
711{
712 int index, j;
713
714 lockdep_assert_held(&tid_agg_rx->reorder_lock);
715
716
717 index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
718 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
719 if (!tid_agg_rx->reorder_buf[index] &&
720 tid_agg_rx->stored_mpdu_num) {
721
722
723
724
725 int skipped = 1;
726 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
727 j = (j + 1) % tid_agg_rx->buf_size) {
728 if (!tid_agg_rx->reorder_buf[j]) {
729 skipped++;
730 continue;
731 }
732 if (skipped &&
733 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
734 HT_RX_REORDER_BUF_TIMEOUT))
735 goto set_release_timer;
736
737 ht_dbg_ratelimited(sdata,
738 "release an RX reorder frame due to timeout on earlier frames\n");
739 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
740 frames);
741
742
743
744
745 tid_agg_rx->head_seq_num =
746 (tid_agg_rx->head_seq_num +
747 skipped) & IEEE80211_SN_MASK;
748 skipped = 0;
749 }
750 } else while (tid_agg_rx->reorder_buf[index]) {
751 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
752 frames);
753 index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
754 tid_agg_rx->ssn) %
755 tid_agg_rx->buf_size;
756 }
757
758 if (tid_agg_rx->stored_mpdu_num) {
759 j = index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
760 tid_agg_rx->ssn) %
761 tid_agg_rx->buf_size;
762
763 for (; j != (index - 1) % tid_agg_rx->buf_size;
764 j = (j + 1) % tid_agg_rx->buf_size) {
765 if (tid_agg_rx->reorder_buf[j])
766 break;
767 }
768
769 set_release_timer:
770
771 mod_timer(&tid_agg_rx->reorder_timer,
772 tid_agg_rx->reorder_time[j] + 1 +
773 HT_RX_REORDER_BUF_TIMEOUT);
774 } else {
775 del_timer(&tid_agg_rx->reorder_timer);
776 }
777}
778
779
780
781
782
783
784static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
785 struct tid_ampdu_rx *tid_agg_rx,
786 struct sk_buff *skb,
787 struct sk_buff_head *frames)
788{
789 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
790 u16 sc = le16_to_cpu(hdr->seq_ctrl);
791 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
792 u16 head_seq_num, buf_size;
793 int index;
794 bool ret = true;
795
796 spin_lock(&tid_agg_rx->reorder_lock);
797
798 buf_size = tid_agg_rx->buf_size;
799 head_seq_num = tid_agg_rx->head_seq_num;
800
801
802 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
803 dev_kfree_skb(skb);
804 goto out;
805 }
806
807
808
809
810
811 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
812 head_seq_num = ieee80211_sn_inc(
813 ieee80211_sn_sub(mpdu_seq_num, buf_size));
814
815 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
816 head_seq_num, frames);
817 }
818
819
820
821 index = ieee80211_sn_sub(mpdu_seq_num,
822 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
823
824
825 if (tid_agg_rx->reorder_buf[index]) {
826 dev_kfree_skb(skb);
827 goto out;
828 }
829
830
831
832
833
834
835
836 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
837 tid_agg_rx->stored_mpdu_num == 0) {
838 tid_agg_rx->head_seq_num =
839 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
840 ret = false;
841 goto out;
842 }
843
844
845 tid_agg_rx->reorder_buf[index] = skb;
846 tid_agg_rx->reorder_time[index] = jiffies;
847 tid_agg_rx->stored_mpdu_num++;
848 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
849
850 out:
851 spin_unlock(&tid_agg_rx->reorder_lock);
852 return ret;
853}
854
855
856
857
858
859static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
860 struct sk_buff_head *frames)
861{
862 struct sk_buff *skb = rx->skb;
863 struct ieee80211_local *local = rx->local;
864 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
865 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
866 struct sta_info *sta = rx->sta;
867 struct tid_ampdu_rx *tid_agg_rx;
868 u16 sc;
869 u8 tid, ack_policy;
870
871 if (!ieee80211_is_data_qos(hdr->frame_control))
872 goto dont_reorder;
873
874
875
876
877
878
879 if (!sta)
880 goto dont_reorder;
881
882 ack_policy = *ieee80211_get_qos_ctl(hdr) &
883 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
884 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
885
886 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
887 if (!tid_agg_rx)
888 goto dont_reorder;
889
890
891 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
892 goto dont_reorder;
893
894
895 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
896 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
897 goto dont_reorder;
898
899
900 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
901 goto dont_reorder;
902
903
904
905
906 if (tid_agg_rx->timeout)
907 tid_agg_rx->last_rx = jiffies;
908
909
910 sc = le16_to_cpu(hdr->seq_ctrl);
911 if (sc & IEEE80211_SCTL_FRAG) {
912 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
913 skb_queue_tail(&rx->sdata->skb_queue, skb);
914 ieee80211_queue_work(&local->hw, &rx->sdata->work);
915 return;
916 }
917
918
919
920
921
922
923
924
925 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
926 frames))
927 return;
928
929 dont_reorder:
930 __skb_queue_tail(frames, skb);
931}
932
933static ieee80211_rx_result debug_noinline
934ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
935{
936 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
937 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
938
939
940
941
942
943 if (rx->skb->len >= 24 && rx->sta &&
944 !ieee80211_is_ctl(hdr->frame_control) &&
945 !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
946 !is_multicast_ether_addr(hdr->addr1)) {
947 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
948 rx->sta->last_seq_ctrl[rx->seqno_idx] ==
949 hdr->seq_ctrl)) {
950 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
951 rx->local->dot11FrameDuplicateCount++;
952 rx->sta->num_duplicates++;
953 }
954 return RX_DROP_UNUSABLE;
955 } else
956 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
957 }
958
959 if (unlikely(rx->skb->len < 16)) {
960 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
961 return RX_DROP_MONITOR;
962 }
963
964
965
966
967
968
969
970
971
972
973 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
974 return ieee80211_rx_mesh_check(rx);
975
976 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
977 ieee80211_is_pspoll(hdr->frame_control)) &&
978 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
979 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
980 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
981
982
983
984
985
986 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
987 ieee80211_is_data_present(hdr->frame_control)) {
988 unsigned int hdrlen;
989 __be16 ethertype;
990
991 hdrlen = ieee80211_hdrlen(hdr->frame_control);
992
993 if (rx->skb->len < hdrlen + 8)
994 return RX_DROP_MONITOR;
995
996 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2);
997 if (ethertype == rx->sdata->control_port_protocol)
998 return RX_CONTINUE;
999 }
1000
1001 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1002 cfg80211_rx_spurious_frame(rx->sdata->dev,
1003 hdr->addr2,
1004 GFP_ATOMIC))
1005 return RX_DROP_UNUSABLE;
1006
1007 return RX_DROP_MONITOR;
1008 }
1009
1010 return RX_CONTINUE;
1011}
1012
1013
1014static ieee80211_rx_result debug_noinline
1015ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1016{
1017 struct sk_buff *skb = rx->skb;
1018 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1019 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1020 int keyidx;
1021 int hdrlen;
1022 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1023 struct ieee80211_key *sta_ptk = NULL;
1024 int mmie_keyidx = -1;
1025 __le16 fc;
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1059 return RX_CONTINUE;
1060
1061
1062 rx->key = NULL;
1063
1064 if (rx->sta)
1065 sta_ptk = rcu_dereference(rx->sta->ptk);
1066
1067 fc = hdr->frame_control;
1068
1069 if (!ieee80211_has_protected(fc))
1070 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1071
1072 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1073 rx->key = sta_ptk;
1074 if ((status->flag & RX_FLAG_DECRYPTED) &&
1075 (status->flag & RX_FLAG_IV_STRIPPED))
1076 return RX_CONTINUE;
1077
1078 if (!ieee80211_has_protected(fc))
1079 return RX_CONTINUE;
1080 } else if (mmie_keyidx >= 0) {
1081
1082 if ((status->flag & RX_FLAG_DECRYPTED) &&
1083 (status->flag & RX_FLAG_IV_STRIPPED))
1084 return RX_CONTINUE;
1085
1086 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1087 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1088 return RX_DROP_MONITOR;
1089 if (rx->sta)
1090 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1091 if (!rx->key)
1092 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1093 } else if (!ieee80211_has_protected(fc)) {
1094
1095
1096
1097
1098
1099
1100 struct ieee80211_key *key = NULL;
1101 struct ieee80211_sub_if_data *sdata = rx->sdata;
1102 int i;
1103
1104 if (ieee80211_is_mgmt(fc) &&
1105 is_multicast_ether_addr(hdr->addr1) &&
1106 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1107 rx->key = key;
1108 else {
1109 if (rx->sta) {
1110 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1111 key = rcu_dereference(rx->sta->gtk[i]);
1112 if (key)
1113 break;
1114 }
1115 }
1116 if (!key) {
1117 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1118 key = rcu_dereference(sdata->keys[i]);
1119 if (key)
1120 break;
1121 }
1122 }
1123 if (key)
1124 rx->key = key;
1125 }
1126 return RX_CONTINUE;
1127 } else {
1128 u8 keyid;
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138 if ((status->flag & RX_FLAG_DECRYPTED) &&
1139 (status->flag & RX_FLAG_IV_STRIPPED))
1140 return RX_CONTINUE;
1141
1142 hdrlen = ieee80211_hdrlen(fc);
1143
1144 if (rx->skb->len < 8 + hdrlen)
1145 return RX_DROP_UNUSABLE;
1146
1147
1148
1149
1150
1151 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1152 keyidx = keyid >> 6;
1153
1154
1155 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1156 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1157
1158
1159 if (!rx->key) {
1160 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1161
1162
1163
1164
1165
1166
1167 if (rx->key &&
1168 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1169 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1170 !is_multicast_ether_addr(hdr->addr1))
1171 rx->key = NULL;
1172 }
1173 }
1174
1175 if (rx->key) {
1176 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1177 return RX_DROP_MONITOR;
1178
1179 rx->key->tx_rx_count++;
1180
1181 } else {
1182 return RX_DROP_MONITOR;
1183 }
1184
1185 switch (rx->key->conf.cipher) {
1186 case WLAN_CIPHER_SUITE_WEP40:
1187 case WLAN_CIPHER_SUITE_WEP104:
1188 result = ieee80211_crypto_wep_decrypt(rx);
1189 break;
1190 case WLAN_CIPHER_SUITE_TKIP:
1191 result = ieee80211_crypto_tkip_decrypt(rx);
1192 break;
1193 case WLAN_CIPHER_SUITE_CCMP:
1194 result = ieee80211_crypto_ccmp_decrypt(rx);
1195 break;
1196 case WLAN_CIPHER_SUITE_AES_CMAC:
1197 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1198 break;
1199 default:
1200
1201
1202
1203
1204 return RX_DROP_UNUSABLE;
1205 }
1206
1207
1208
1209
1210 status->flag |= RX_FLAG_DECRYPTED;
1211
1212 return result;
1213}
1214
1215static ieee80211_rx_result debug_noinline
1216ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1217{
1218 struct ieee80211_local *local;
1219 struct ieee80211_hdr *hdr;
1220 struct sk_buff *skb;
1221
1222 local = rx->local;
1223 skb = rx->skb;
1224 hdr = (struct ieee80211_hdr *) skb->data;
1225
1226 if (!local->pspolling)
1227 return RX_CONTINUE;
1228
1229 if (!ieee80211_has_fromds(hdr->frame_control))
1230
1231 return RX_CONTINUE;
1232
1233 if (!ieee80211_is_data(hdr->frame_control))
1234 return RX_CONTINUE;
1235
1236 if (!ieee80211_has_moredata(hdr->frame_control)) {
1237
1238 local->pspolling = false;
1239 return RX_CONTINUE;
1240 }
1241
1242
1243 ieee80211_send_pspoll(local, rx->sdata);
1244
1245 return RX_CONTINUE;
1246}
1247
1248static void sta_ps_start(struct sta_info *sta)
1249{
1250 struct ieee80211_sub_if_data *sdata = sta->sdata;
1251 struct ieee80211_local *local = sdata->local;
1252 struct ps_data *ps;
1253
1254 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1255 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1256 ps = &sdata->bss->ps;
1257 else
1258 return;
1259
1260 atomic_inc(&ps->num_sta_ps);
1261 set_sta_flag(sta, WLAN_STA_PS_STA);
1262 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1263 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1264 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1265 sta->sta.addr, sta->sta.aid);
1266}
1267
1268static void sta_ps_end(struct sta_info *sta)
1269{
1270 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1271 sta->sta.addr, sta->sta.aid);
1272
1273 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1274 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1275 sta->sta.addr, sta->sta.aid);
1276 return;
1277 }
1278
1279 ieee80211_sta_ps_deliver_wakeup(sta);
1280}
1281
1282int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
1283{
1284 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
1285 bool in_ps;
1286
1287 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
1288
1289
1290 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
1291 if ((start && in_ps) || (!start && !in_ps))
1292 return -EINVAL;
1293
1294 if (start)
1295 sta_ps_start(sta_inf);
1296 else
1297 sta_ps_end(sta_inf);
1298
1299 return 0;
1300}
1301EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1302
1303static ieee80211_rx_result debug_noinline
1304ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1305{
1306 struct ieee80211_sub_if_data *sdata = rx->sdata;
1307 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1308 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1309 int tid, ac;
1310
1311 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
1312 return RX_CONTINUE;
1313
1314 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1315 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1316 return RX_CONTINUE;
1317
1318
1319
1320
1321
1322
1323 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
1324 return RX_CONTINUE;
1325
1326
1327
1328
1329
1330
1331 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1332 return RX_CONTINUE;
1333
1334 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1335 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
1336 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1337 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1338 else
1339 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1340 }
1341
1342
1343
1344 dev_kfree_skb(rx->skb);
1345
1346 return RX_QUEUED;
1347 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1348 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1349 ieee80211_has_pm(hdr->frame_control) &&
1350 (ieee80211_is_data_qos(hdr->frame_control) ||
1351 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1352 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1353 ac = ieee802_1d_to_ac[tid & 7];
1354
1355
1356
1357
1358
1359
1360
1361
1362 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
1363 return RX_CONTINUE;
1364
1365
1366 if (test_sta_flag(rx->sta, WLAN_STA_SP))
1367 return RX_CONTINUE;
1368
1369 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1370 ieee80211_sta_ps_deliver_uapsd(rx->sta);
1371 else
1372 set_sta_flag(rx->sta, WLAN_STA_UAPSD);
1373 }
1374
1375 return RX_CONTINUE;
1376}
1377
1378static ieee80211_rx_result debug_noinline
1379ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1380{
1381 struct sta_info *sta = rx->sta;
1382 struct sk_buff *skb = rx->skb;
1383 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1384 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1385 int i;
1386
1387 if (!sta)
1388 return RX_CONTINUE;
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1399 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1400 NL80211_IFTYPE_ADHOC);
1401 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1402 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1403 sta->last_rx = jiffies;
1404 if (ieee80211_is_data(hdr->frame_control)) {
1405 sta->last_rx_rate_idx = status->rate_idx;
1406 sta->last_rx_rate_flag = status->flag;
1407 sta->last_rx_rate_vht_nss = status->vht_nss;
1408 }
1409 }
1410 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1411
1412
1413
1414
1415 sta->last_rx = jiffies;
1416 if (ieee80211_is_data(hdr->frame_control)) {
1417 sta->last_rx_rate_idx = status->rate_idx;
1418 sta->last_rx_rate_flag = status->flag;
1419 sta->last_rx_rate_vht_nss = status->vht_nss;
1420 }
1421 }
1422
1423 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1424 return RX_CONTINUE;
1425
1426 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1427 ieee80211_sta_rx_notify(rx->sdata, hdr);
1428
1429 sta->rx_fragments++;
1430 sta->rx_bytes += rx->skb->len;
1431 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1432 sta->last_signal = status->signal;
1433 ewma_add(&sta->avg_signal, -status->signal);
1434 }
1435
1436 if (status->chains) {
1437 sta->chains = status->chains;
1438 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1439 int signal = status->chain_signal[i];
1440
1441 if (!(status->chains & BIT(i)))
1442 continue;
1443
1444 sta->chain_signal_last[i] = signal;
1445 ewma_add(&sta->chain_signal_avg[i], -signal);
1446 }
1447 }
1448
1449
1450
1451
1452
1453 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
1454 !ieee80211_has_morefrags(hdr->frame_control) &&
1455 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1456 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1457 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1458 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1459
1460
1461
1462
1463
1464
1465
1466
1467 if (ieee80211_is_data(hdr->frame_control) &&
1468 !ieee80211_has_pm(hdr->frame_control))
1469 sta_ps_end(sta);
1470 } else {
1471 if (ieee80211_has_pm(hdr->frame_control))
1472 sta_ps_start(sta);
1473 }
1474 }
1475
1476
1477 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1478 ieee80211_mps_rx_h_sta_process(sta, hdr);
1479
1480
1481
1482
1483
1484 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1485 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1486 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1487
1488
1489
1490
1491
1492
1493
1494 if (ieee80211_has_a4(hdr->frame_control) &&
1495 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1496 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1497 !rx->sdata->u.vlan.sta))) {
1498 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1499 cfg80211_rx_unexpected_4addr_frame(
1500 rx->sdata->dev, sta->sta.addr,
1501 GFP_ATOMIC);
1502 return RX_DROP_MONITOR;
1503 }
1504
1505
1506
1507
1508 sta->rx_packets++;
1509 dev_kfree_skb(rx->skb);
1510 return RX_QUEUED;
1511 }
1512
1513 return RX_CONTINUE;
1514}
1515
1516static inline struct ieee80211_fragment_entry *
1517ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1518 unsigned int frag, unsigned int seq, int rx_queue,
1519 struct sk_buff **skb)
1520{
1521 struct ieee80211_fragment_entry *entry;
1522
1523 entry = &sdata->fragments[sdata->fragment_next++];
1524 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1525 sdata->fragment_next = 0;
1526
1527 if (!skb_queue_empty(&entry->skb_list))
1528 __skb_queue_purge(&entry->skb_list);
1529
1530 __skb_queue_tail(&entry->skb_list, *skb);
1531 *skb = NULL;
1532 entry->first_frag_time = jiffies;
1533 entry->seq = seq;
1534 entry->rx_queue = rx_queue;
1535 entry->last_frag = frag;
1536 entry->ccmp = 0;
1537 entry->extra_len = 0;
1538
1539 return entry;
1540}
1541
1542static inline struct ieee80211_fragment_entry *
1543ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1544 unsigned int frag, unsigned int seq,
1545 int rx_queue, struct ieee80211_hdr *hdr)
1546{
1547 struct ieee80211_fragment_entry *entry;
1548 int i, idx;
1549
1550 idx = sdata->fragment_next;
1551 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1552 struct ieee80211_hdr *f_hdr;
1553
1554 idx--;
1555 if (idx < 0)
1556 idx = IEEE80211_FRAGMENT_MAX - 1;
1557
1558 entry = &sdata->fragments[idx];
1559 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1560 entry->rx_queue != rx_queue ||
1561 entry->last_frag + 1 != frag)
1562 continue;
1563
1564 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1565
1566
1567
1568
1569 if (((hdr->frame_control ^ f_hdr->frame_control) &
1570 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1571 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1572 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1573 continue;
1574
1575 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1576 __skb_queue_purge(&entry->skb_list);
1577 continue;
1578 }
1579 return entry;
1580 }
1581
1582 return NULL;
1583}
1584
1585static ieee80211_rx_result debug_noinline
1586ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1587{
1588 struct ieee80211_hdr *hdr;
1589 u16 sc;
1590 __le16 fc;
1591 unsigned int frag, seq;
1592 struct ieee80211_fragment_entry *entry;
1593 struct sk_buff *skb;
1594 struct ieee80211_rx_status *status;
1595
1596 hdr = (struct ieee80211_hdr *)rx->skb->data;
1597 fc = hdr->frame_control;
1598
1599 if (ieee80211_is_ctl(fc))
1600 return RX_CONTINUE;
1601
1602 sc = le16_to_cpu(hdr->seq_ctrl);
1603 frag = sc & IEEE80211_SCTL_FRAG;
1604
1605 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1606 is_multicast_ether_addr(hdr->addr1))) {
1607
1608 goto out;
1609 }
1610 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1611
1612 if (skb_linearize(rx->skb))
1613 return RX_DROP_UNUSABLE;
1614
1615
1616
1617
1618
1619
1620 hdr = (struct ieee80211_hdr *)rx->skb->data;
1621 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1622
1623 if (frag == 0) {
1624
1625 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1626 rx->seqno_idx, &(rx->skb));
1627 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1628 ieee80211_has_protected(fc)) {
1629 int queue = rx->security_idx;
1630
1631
1632 entry->ccmp = 1;
1633 memcpy(entry->last_pn,
1634 rx->key->u.ccmp.rx_pn[queue],
1635 IEEE80211_CCMP_PN_LEN);
1636 }
1637 return RX_QUEUED;
1638 }
1639
1640
1641
1642
1643 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
1644 rx->seqno_idx, hdr);
1645 if (!entry) {
1646 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1647 return RX_DROP_MONITOR;
1648 }
1649
1650
1651
1652 if (entry->ccmp) {
1653 int i;
1654 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1655 int queue;
1656 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
1657 return RX_DROP_UNUSABLE;
1658 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
1659 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1660 pn[i]++;
1661 if (pn[i])
1662 break;
1663 }
1664 queue = rx->security_idx;
1665 rpn = rx->key->u.ccmp.rx_pn[queue];
1666 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
1667 return RX_DROP_UNUSABLE;
1668 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1669 }
1670
1671 skb_pull(rx->skb, ieee80211_hdrlen(fc));
1672 __skb_queue_tail(&entry->skb_list, rx->skb);
1673 entry->last_frag = frag;
1674 entry->extra_len += rx->skb->len;
1675 if (ieee80211_has_morefrags(fc)) {
1676 rx->skb = NULL;
1677 return RX_QUEUED;
1678 }
1679
1680 rx->skb = __skb_dequeue(&entry->skb_list);
1681 if (skb_tailroom(rx->skb) < entry->extra_len) {
1682 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1683 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1684 GFP_ATOMIC))) {
1685 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1686 __skb_queue_purge(&entry->skb_list);
1687 return RX_DROP_UNUSABLE;
1688 }
1689 }
1690 while ((skb = __skb_dequeue(&entry->skb_list))) {
1691 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1692 dev_kfree_skb(skb);
1693 }
1694
1695
1696 status = IEEE80211_SKB_RXCB(rx->skb);
1697 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1698
1699 out:
1700 if (rx->sta)
1701 rx->sta->rx_packets++;
1702 if (is_multicast_ether_addr(hdr->addr1))
1703 rx->local->dot11MulticastReceivedFrameCount++;
1704 else
1705 ieee80211_led_rx(rx->local);
1706 return RX_CONTINUE;
1707}
1708
1709static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1710{
1711 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
1712 return -EACCES;
1713
1714 return 0;
1715}
1716
1717static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1718{
1719 struct sk_buff *skb = rx->skb;
1720 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1721
1722
1723
1724
1725
1726 if (status->flag & RX_FLAG_DECRYPTED)
1727 return 0;
1728
1729
1730 if (unlikely(!ieee80211_has_protected(fc) &&
1731 !ieee80211_is_nullfunc(fc) &&
1732 ieee80211_is_data(fc) &&
1733 (rx->key || rx->sdata->drop_unencrypted)))
1734 return -EACCES;
1735
1736 return 0;
1737}
1738
1739static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1740{
1741 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1742 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1743 __le16 fc = hdr->frame_control;
1744
1745
1746
1747
1748
1749 if (status->flag & RX_FLAG_DECRYPTED)
1750 return 0;
1751
1752 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
1753 if (unlikely(!ieee80211_has_protected(fc) &&
1754 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1755 rx->key)) {
1756 if (ieee80211_is_deauth(fc) ||
1757 ieee80211_is_disassoc(fc))
1758 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1759 rx->skb->data,
1760 rx->skb->len);
1761 return -EACCES;
1762 }
1763
1764 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1765 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1766 if (ieee80211_is_deauth(fc) ||
1767 ieee80211_is_disassoc(fc))
1768 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1769 rx->skb->data,
1770 rx->skb->len);
1771 return -EACCES;
1772 }
1773
1774
1775
1776
1777 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1778 ieee80211_is_robust_mgmt_frame(
1779 (struct ieee80211_hdr *) rx->skb->data)))
1780 return -EACCES;
1781 }
1782
1783 return 0;
1784}
1785
1786static int
1787__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
1788{
1789 struct ieee80211_sub_if_data *sdata = rx->sdata;
1790 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1791 bool check_port_control = false;
1792 struct ethhdr *ehdr;
1793 int ret;
1794
1795 *port_control = false;
1796 if (ieee80211_has_a4(hdr->frame_control) &&
1797 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1798 return -1;
1799
1800 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1801 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1802
1803 if (!sdata->u.mgd.use_4addr)
1804 return -1;
1805 else
1806 check_port_control = true;
1807 }
1808
1809 if (is_multicast_ether_addr(hdr->addr1) &&
1810 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1811 return -1;
1812
1813 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1814 if (ret < 0)
1815 return ret;
1816
1817 ehdr = (struct ethhdr *) rx->skb->data;
1818 if (ehdr->h_proto == rx->sdata->control_port_protocol)
1819 *port_control = true;
1820 else if (check_port_control)
1821 return -1;
1822
1823 return 0;
1824}
1825
1826
1827
1828
1829static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1830{
1831 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1832 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1833 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1834
1835
1836
1837
1838
1839 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1840 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
1841 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
1842 return true;
1843
1844 if (ieee80211_802_1x_port_control(rx) ||
1845 ieee80211_drop_unencrypted(rx, fc))
1846 return false;
1847
1848 return true;
1849}
1850
1851
1852
1853
1854static void
1855ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1856{
1857 struct ieee80211_sub_if_data *sdata = rx->sdata;
1858 struct net_device *dev = sdata->dev;
1859 struct sk_buff *skb, *xmit_skb;
1860 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1861 struct sta_info *dsta;
1862 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1863
1864 skb = rx->skb;
1865 xmit_skb = NULL;
1866
1867 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1868 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1869 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1870 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1871 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1872 if (is_multicast_ether_addr(ehdr->h_dest)) {
1873
1874
1875
1876
1877 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1878 if (!xmit_skb)
1879 net_info_ratelimited("%s: failed to clone multicast frame\n",
1880 dev->name);
1881 } else {
1882 dsta = sta_info_get(sdata, skb->data);
1883 if (dsta) {
1884
1885
1886
1887
1888
1889
1890 xmit_skb = skb;
1891 skb = NULL;
1892 }
1893 }
1894 }
1895
1896 if (skb) {
1897 int align __maybe_unused;
1898
1899#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
1910 if (align) {
1911 if (WARN_ON(skb_headroom(skb) < 3)) {
1912 dev_kfree_skb(skb);
1913 skb = NULL;
1914 } else {
1915 u8 *data = skb->data;
1916 size_t len = skb_headlen(skb);
1917 skb->data -= align;
1918 memmove(skb->data, data, len);
1919 skb_set_tail_pointer(skb, len);
1920 }
1921 }
1922#endif
1923
1924 if (skb) {
1925
1926 skb->protocol = eth_type_trans(skb, dev);
1927 memset(skb->cb, 0, sizeof(skb->cb));
1928 netif_receive_skb(skb);
1929 }
1930 }
1931
1932 if (xmit_skb) {
1933
1934
1935
1936
1937
1938 xmit_skb->priority += 256;
1939 xmit_skb->protocol = htons(ETH_P_802_3);
1940 skb_reset_network_header(xmit_skb);
1941 skb_reset_mac_header(xmit_skb);
1942 dev_queue_xmit(xmit_skb);
1943 }
1944}
1945
1946static ieee80211_rx_result debug_noinline
1947ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1948{
1949 struct net_device *dev = rx->sdata->dev;
1950 struct sk_buff *skb = rx->skb;
1951 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1952 __le16 fc = hdr->frame_control;
1953 struct sk_buff_head frame_list;
1954 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1955
1956 if (unlikely(!ieee80211_is_data(fc)))
1957 return RX_CONTINUE;
1958
1959 if (unlikely(!ieee80211_is_data_present(fc)))
1960 return RX_DROP_MONITOR;
1961
1962 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1963 return RX_CONTINUE;
1964
1965 if (ieee80211_has_a4(hdr->frame_control) &&
1966 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1967 !rx->sdata->u.vlan.sta)
1968 return RX_DROP_UNUSABLE;
1969
1970 if (is_multicast_ether_addr(hdr->addr1) &&
1971 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1972 rx->sdata->u.vlan.sta) ||
1973 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1974 rx->sdata->u.mgd.use_4addr)))
1975 return RX_DROP_UNUSABLE;
1976
1977 skb->dev = dev;
1978 __skb_queue_head_init(&frame_list);
1979
1980 if (skb_linearize(skb))
1981 return RX_DROP_UNUSABLE;
1982
1983 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1984 rx->sdata->vif.type,
1985 rx->local->hw.extra_tx_headroom, true);
1986
1987 while (!skb_queue_empty(&frame_list)) {
1988 rx->skb = __skb_dequeue(&frame_list);
1989
1990 if (!ieee80211_frame_allowed(rx, fc)) {
1991 dev_kfree_skb(rx->skb);
1992 continue;
1993 }
1994 dev->stats.rx_packets++;
1995 dev->stats.rx_bytes += rx->skb->len;
1996
1997 ieee80211_deliver_skb(rx);
1998 }
1999
2000 return RX_QUEUED;
2001}
2002
2003#ifdef CONFIG_MAC80211_MESH
2004static ieee80211_rx_result
2005ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2006{
2007 struct ieee80211_hdr *fwd_hdr, *hdr;
2008 struct ieee80211_tx_info *info;
2009 struct ieee80211s_hdr *mesh_hdr;
2010 struct sk_buff *skb = rx->skb, *fwd_skb;
2011 struct ieee80211_local *local = rx->local;
2012 struct ieee80211_sub_if_data *sdata = rx->sdata;
2013 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2014 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2015 __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
2016 u16 q, hdrlen;
2017
2018 hdr = (struct ieee80211_hdr *) skb->data;
2019 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2020
2021
2022 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2023 return RX_DROP_MONITOR;
2024
2025 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2026
2027
2028 if (!pskb_may_pull(rx->skb,
2029 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2030 return RX_DROP_MONITOR;
2031
2032
2033 hdr = (struct ieee80211_hdr *) skb->data;
2034 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2035
2036
2037 if (ieee80211_is_data(hdr->frame_control) &&
2038 is_multicast_ether_addr(hdr->addr1) &&
2039 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2040 return RX_DROP_MONITOR;
2041
2042 if (!ieee80211_is_data(hdr->frame_control) ||
2043 !(status->rx_flags & IEEE80211_RX_RA_MATCH))
2044 return RX_CONTINUE;
2045
2046 if (!mesh_hdr->ttl)
2047 return RX_DROP_MONITOR;
2048
2049 if (mesh_hdr->flags & MESH_FLAGS_AE) {
2050 struct mesh_path *mppath;
2051 char *proxied_addr;
2052 char *mpp_addr;
2053
2054 if (is_multicast_ether_addr(hdr->addr1)) {
2055 mpp_addr = hdr->addr3;
2056 proxied_addr = mesh_hdr->eaddr1;
2057 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
2058
2059 mpp_addr = hdr->addr4;
2060 proxied_addr = mesh_hdr->eaddr2;
2061 } else {
2062 return RX_DROP_MONITOR;
2063 }
2064
2065 rcu_read_lock();
2066 mppath = mpp_path_lookup(sdata, proxied_addr);
2067 if (!mppath) {
2068 mpp_path_add(sdata, proxied_addr, mpp_addr);
2069 } else {
2070 spin_lock_bh(&mppath->state_lock);
2071 if (!ether_addr_equal(mppath->mpp, mpp_addr))
2072 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2073 spin_unlock_bh(&mppath->state_lock);
2074 }
2075 rcu_read_unlock();
2076 }
2077
2078
2079 if (!is_multicast_ether_addr(hdr->addr1) &&
2080 ether_addr_equal(sdata->vif.addr, hdr->addr3))
2081 return RX_CONTINUE;
2082
2083 q = ieee80211_select_queue_80211(sdata, skb, hdr);
2084 if (ieee80211_queue_stopped(&local->hw, q)) {
2085 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2086 return RX_DROP_MONITOR;
2087 }
2088 skb_set_queue_mapping(skb, q);
2089
2090 if (!--mesh_hdr->ttl) {
2091 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2092 goto out;
2093 }
2094
2095 if (!ifmsh->mshcfg.dot11MeshForwarding)
2096 goto out;
2097
2098 fwd_skb = skb_copy(skb, GFP_ATOMIC);
2099 if (!fwd_skb) {
2100 net_info_ratelimited("%s: failed to clone mesh frame\n",
2101 sdata->name);
2102 goto out;
2103 }
2104
2105 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
2106 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2107 info = IEEE80211_SKB_CB(fwd_skb);
2108 memset(info, 0, sizeof(*info));
2109 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2110 info->control.vif = &rx->sdata->vif;
2111 info->control.jiffies = jiffies;
2112 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2113 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2114 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2115
2116 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2117 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2118
2119 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2120 } else {
2121
2122 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2123 fwd_hdr->addr3, 0, reason, fwd_hdr->addr2);
2124 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2125 kfree_skb(fwd_skb);
2126 return RX_DROP_MONITOR;
2127 }
2128
2129 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2130 ieee80211_add_pending_skb(local, fwd_skb);
2131 out:
2132 if (is_multicast_ether_addr(hdr->addr1) ||
2133 sdata->dev->flags & IFF_PROMISC)
2134 return RX_CONTINUE;
2135 else
2136 return RX_DROP_MONITOR;
2137}
2138#endif
2139
2140static ieee80211_rx_result debug_noinline
2141ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2142{
2143 struct ieee80211_sub_if_data *sdata = rx->sdata;
2144 struct ieee80211_local *local = rx->local;
2145 struct net_device *dev = sdata->dev;
2146 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2147 __le16 fc = hdr->frame_control;
2148 bool port_control;
2149 int err;
2150
2151 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2152 return RX_CONTINUE;
2153
2154 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
2155 return RX_DROP_MONITOR;
2156
2157
2158
2159
2160
2161 if (ieee80211_has_a4(hdr->frame_control) &&
2162 sdata->vif.type == NL80211_IFTYPE_AP) {
2163 if (rx->sta &&
2164 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2165 cfg80211_rx_unexpected_4addr_frame(
2166 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2167 return RX_DROP_MONITOR;
2168 }
2169
2170 err = __ieee80211_data_to_8023(rx, &port_control);
2171 if (unlikely(err))
2172 return RX_DROP_UNUSABLE;
2173
2174 if (!ieee80211_frame_allowed(rx, fc))
2175 return RX_DROP_MONITOR;
2176
2177 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2178 unlikely(port_control) && sdata->bss) {
2179 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2180 u.ap);
2181 dev = sdata->dev;
2182 rx->sdata = sdata;
2183 }
2184
2185 rx->skb->dev = dev;
2186
2187 dev->stats.rx_packets++;
2188 dev->stats.rx_bytes += rx->skb->len;
2189
2190 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2191 !is_multicast_ether_addr(
2192 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2193 (!local->scanning &&
2194 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2195 mod_timer(&local->dynamic_ps_timer, jiffies +
2196 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2197 }
2198
2199 ieee80211_deliver_skb(rx);
2200
2201 return RX_QUEUED;
2202}
2203
2204static ieee80211_rx_result debug_noinline
2205ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2206{
2207 struct sk_buff *skb = rx->skb;
2208 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2209 struct tid_ampdu_rx *tid_agg_rx;
2210 u16 start_seq_num;
2211 u16 tid;
2212
2213 if (likely(!ieee80211_is_ctl(bar->frame_control)))
2214 return RX_CONTINUE;
2215
2216 if (ieee80211_is_back_req(bar->frame_control)) {
2217 struct {
2218 __le16 control, start_seq_num;
2219 } __packed bar_data;
2220
2221 if (!rx->sta)
2222 return RX_DROP_MONITOR;
2223
2224 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2225 &bar_data, sizeof(bar_data)))
2226 return RX_DROP_MONITOR;
2227
2228 tid = le16_to_cpu(bar_data.control) >> 12;
2229
2230 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2231 if (!tid_agg_rx)
2232 return RX_DROP_MONITOR;
2233
2234 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2235
2236
2237 if (tid_agg_rx->timeout)
2238 mod_timer(&tid_agg_rx->session_timer,
2239 TU_TO_EXP_TIME(tid_agg_rx->timeout));
2240
2241 spin_lock(&tid_agg_rx->reorder_lock);
2242
2243 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2244 start_seq_num, frames);
2245 spin_unlock(&tid_agg_rx->reorder_lock);
2246
2247 kfree_skb(skb);
2248 return RX_QUEUED;
2249 }
2250
2251
2252
2253
2254
2255
2256 return RX_DROP_MONITOR;
2257}
2258
2259static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2260 struct ieee80211_mgmt *mgmt,
2261 size_t len)
2262{
2263 struct ieee80211_local *local = sdata->local;
2264 struct sk_buff *skb;
2265 struct ieee80211_mgmt *resp;
2266
2267 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2268
2269 return;
2270 }
2271
2272 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2273 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2274
2275 return;
2276 }
2277
2278 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2279
2280 return;
2281 }
2282
2283 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2284 if (skb == NULL)
2285 return;
2286
2287 skb_reserve(skb, local->hw.extra_tx_headroom);
2288 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2289 memset(resp, 0, 24);
2290 memcpy(resp->da, mgmt->sa, ETH_ALEN);
2291 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2292 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2293 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2294 IEEE80211_STYPE_ACTION);
2295 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2296 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2297 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2298 memcpy(resp->u.action.u.sa_query.trans_id,
2299 mgmt->u.action.u.sa_query.trans_id,
2300 WLAN_SA_QUERY_TR_ID_LEN);
2301
2302 ieee80211_tx_skb(sdata, skb);
2303}
2304
2305static ieee80211_rx_result debug_noinline
2306ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2307{
2308 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2309 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2310
2311
2312
2313
2314
2315
2316 if (rx->skb->len < 24)
2317 return RX_DROP_MONITOR;
2318
2319 if (!ieee80211_is_mgmt(mgmt->frame_control))
2320 return RX_DROP_MONITOR;
2321
2322 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2323 ieee80211_is_beacon(mgmt->frame_control) &&
2324 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2325 int sig = 0;
2326
2327 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
2328 sig = status->signal;
2329
2330 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2331 rx->skb->data, rx->skb->len,
2332 status->freq, sig);
2333 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2334 }
2335
2336 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2337 return RX_DROP_MONITOR;
2338
2339 if (ieee80211_drop_unencrypted_mgmt(rx))
2340 return RX_DROP_UNUSABLE;
2341
2342 return RX_CONTINUE;
2343}
2344
2345static ieee80211_rx_result debug_noinline
2346ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2347{
2348 struct ieee80211_local *local = rx->local;
2349 struct ieee80211_sub_if_data *sdata = rx->sdata;
2350 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2351 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2352 int len = rx->skb->len;
2353
2354 if (!ieee80211_is_action(mgmt->frame_control))
2355 return RX_CONTINUE;
2356
2357
2358 if (len < IEEE80211_MIN_ACTION_SIZE)
2359 return RX_DROP_UNUSABLE;
2360
2361 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2362 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED)
2363 return RX_DROP_UNUSABLE;
2364
2365 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2366 return RX_DROP_UNUSABLE;
2367
2368 switch (mgmt->u.action.category) {
2369 case WLAN_CATEGORY_HT:
2370
2371 if (!rx->sta->sta.ht_cap.ht_supported)
2372 goto invalid;
2373
2374 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2375 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2376 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2377 sdata->vif.type != NL80211_IFTYPE_AP &&
2378 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2379 break;
2380
2381
2382 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2383 goto invalid;
2384
2385 switch (mgmt->u.action.u.ht_smps.action) {
2386 case WLAN_HT_ACTION_SMPS: {
2387 struct ieee80211_supported_band *sband;
2388 enum ieee80211_smps_mode smps_mode;
2389
2390
2391 switch (mgmt->u.action.u.ht_smps.smps_control) {
2392 case WLAN_HT_SMPS_CONTROL_DISABLED:
2393 smps_mode = IEEE80211_SMPS_OFF;
2394 break;
2395 case WLAN_HT_SMPS_CONTROL_STATIC:
2396 smps_mode = IEEE80211_SMPS_STATIC;
2397 break;
2398 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2399 smps_mode = IEEE80211_SMPS_DYNAMIC;
2400 break;
2401 default:
2402 goto invalid;
2403 }
2404
2405
2406 if (rx->sta->sta.smps_mode == smps_mode)
2407 goto handled;
2408 rx->sta->sta.smps_mode = smps_mode;
2409
2410 sband = rx->local->hw.wiphy->bands[status->band];
2411
2412 rate_control_rate_update(local, sband, rx->sta,
2413 IEEE80211_RC_SMPS_CHANGED);
2414 goto handled;
2415 }
2416 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2417 struct ieee80211_supported_band *sband;
2418 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2419 enum ieee80211_sta_rx_bandwidth new_bw;
2420
2421
2422 if (!(rx->sta->sta.ht_cap.cap &
2423 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2424 goto handled;
2425
2426 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2427 new_bw = IEEE80211_STA_RX_BW_20;
2428 else
2429 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2430
2431 if (rx->sta->sta.bandwidth == new_bw)
2432 goto handled;
2433
2434 sband = rx->local->hw.wiphy->bands[status->band];
2435
2436 rate_control_rate_update(local, sband, rx->sta,
2437 IEEE80211_RC_BW_CHANGED);
2438 goto handled;
2439 }
2440 default:
2441 goto invalid;
2442 }
2443
2444 break;
2445 case WLAN_CATEGORY_PUBLIC:
2446 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2447 goto invalid;
2448 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2449 break;
2450 if (!rx->sta)
2451 break;
2452 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2453 break;
2454 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2455 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2456 break;
2457 if (len < offsetof(struct ieee80211_mgmt,
2458 u.action.u.ext_chan_switch.variable))
2459 goto invalid;
2460 goto queue;
2461 case WLAN_CATEGORY_VHT:
2462 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2463 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2464 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2465 sdata->vif.type != NL80211_IFTYPE_AP &&
2466 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2467 break;
2468
2469
2470 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2471 goto invalid;
2472
2473 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2474 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
2475 u8 opmode;
2476
2477
2478 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2479 goto invalid;
2480
2481 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
2482
2483 ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2484 opmode, status->band,
2485 false);
2486 goto handled;
2487 }
2488 default:
2489 break;
2490 }
2491 break;
2492 case WLAN_CATEGORY_BACK:
2493 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2494 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2495 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2496 sdata->vif.type != NL80211_IFTYPE_AP &&
2497 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2498 break;
2499
2500
2501 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2502 break;
2503
2504 switch (mgmt->u.action.u.addba_req.action_code) {
2505 case WLAN_ACTION_ADDBA_REQ:
2506 if (len < (IEEE80211_MIN_ACTION_SIZE +
2507 sizeof(mgmt->u.action.u.addba_req)))
2508 goto invalid;
2509 break;
2510 case WLAN_ACTION_ADDBA_RESP:
2511 if (len < (IEEE80211_MIN_ACTION_SIZE +
2512 sizeof(mgmt->u.action.u.addba_resp)))
2513 goto invalid;
2514 break;
2515 case WLAN_ACTION_DELBA:
2516 if (len < (IEEE80211_MIN_ACTION_SIZE +
2517 sizeof(mgmt->u.action.u.delba)))
2518 goto invalid;
2519 break;
2520 default:
2521 goto invalid;
2522 }
2523
2524 goto queue;
2525 case WLAN_CATEGORY_SPECTRUM_MGMT:
2526 if (status->band != IEEE80211_BAND_5GHZ)
2527 break;
2528
2529 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2530 break;
2531
2532
2533 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2534 break;
2535
2536 switch (mgmt->u.action.u.measurement.action_code) {
2537 case WLAN_ACTION_SPCT_MSR_REQ:
2538 if (len < (IEEE80211_MIN_ACTION_SIZE +
2539 sizeof(mgmt->u.action.u.measurement)))
2540 break;
2541 ieee80211_process_measurement_req(sdata, mgmt, len);
2542 goto handled;
2543 case WLAN_ACTION_SPCT_CHL_SWITCH:
2544 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2545 break;
2546
2547 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2548 break;
2549
2550 goto queue;
2551 }
2552 break;
2553 case WLAN_CATEGORY_SA_QUERY:
2554 if (len < (IEEE80211_MIN_ACTION_SIZE +
2555 sizeof(mgmt->u.action.u.sa_query)))
2556 break;
2557
2558 switch (mgmt->u.action.u.sa_query.action) {
2559 case WLAN_ACTION_SA_QUERY_REQUEST:
2560 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2561 break;
2562 ieee80211_process_sa_query_req(sdata, mgmt, len);
2563 goto handled;
2564 }
2565 break;
2566 case WLAN_CATEGORY_SELF_PROTECTED:
2567 if (len < (IEEE80211_MIN_ACTION_SIZE +
2568 sizeof(mgmt->u.action.u.self_prot.action_code)))
2569 break;
2570
2571 switch (mgmt->u.action.u.self_prot.action_code) {
2572 case WLAN_SP_MESH_PEERING_OPEN:
2573 case WLAN_SP_MESH_PEERING_CLOSE:
2574 case WLAN_SP_MESH_PEERING_CONFIRM:
2575 if (!ieee80211_vif_is_mesh(&sdata->vif))
2576 goto invalid;
2577 if (sdata->u.mesh.user_mpm)
2578
2579 break;
2580 goto queue;
2581 case WLAN_SP_MGK_INFORM:
2582 case WLAN_SP_MGK_ACK:
2583 if (!ieee80211_vif_is_mesh(&sdata->vif))
2584 goto invalid;
2585 break;
2586 }
2587 break;
2588 case WLAN_CATEGORY_MESH_ACTION:
2589 if (len < (IEEE80211_MIN_ACTION_SIZE +
2590 sizeof(mgmt->u.action.u.mesh_action.action_code)))
2591 break;
2592
2593 if (!ieee80211_vif_is_mesh(&sdata->vif))
2594 break;
2595 if (mesh_action_is_path_sel(mgmt) &&
2596 !mesh_path_sel_is_hwmp(sdata))
2597 break;
2598 goto queue;
2599 }
2600
2601 return RX_CONTINUE;
2602
2603 invalid:
2604 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2605
2606 return RX_CONTINUE;
2607
2608 handled:
2609 if (rx->sta)
2610 rx->sta->rx_packets++;
2611 dev_kfree_skb(rx->skb);
2612 return RX_QUEUED;
2613
2614 queue:
2615 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2616 skb_queue_tail(&sdata->skb_queue, rx->skb);
2617 ieee80211_queue_work(&local->hw, &sdata->work);
2618 if (rx->sta)
2619 rx->sta->rx_packets++;
2620 return RX_QUEUED;
2621}
2622
2623static ieee80211_rx_result debug_noinline
2624ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2625{
2626 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2627 int sig = 0;
2628
2629
2630 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2631 return RX_CONTINUE;
2632
2633
2634
2635
2636
2637
2638
2639
2640 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
2641 sig = status->signal;
2642
2643 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2644 rx->skb->data, rx->skb->len,
2645 GFP_ATOMIC)) {
2646 if (rx->sta)
2647 rx->sta->rx_packets++;
2648 dev_kfree_skb(rx->skb);
2649 return RX_QUEUED;
2650 }
2651
2652 return RX_CONTINUE;
2653}
2654
2655static ieee80211_rx_result debug_noinline
2656ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2657{
2658 struct ieee80211_local *local = rx->local;
2659 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2660 struct sk_buff *nskb;
2661 struct ieee80211_sub_if_data *sdata = rx->sdata;
2662 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2663
2664 if (!ieee80211_is_action(mgmt->frame_control))
2665 return RX_CONTINUE;
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2678 (sdata->vif.type == NL80211_IFTYPE_AP ||
2679 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2680 return RX_DROP_MONITOR;
2681
2682 if (is_multicast_ether_addr(mgmt->da))
2683 return RX_DROP_MONITOR;
2684
2685
2686 if (mgmt->u.action.category & 0x80)
2687 return RX_DROP_UNUSABLE;
2688
2689 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2690 GFP_ATOMIC);
2691 if (nskb) {
2692 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2693
2694 nmgmt->u.action.category |= 0x80;
2695 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2696 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2697
2698 memset(nskb->cb, 0, sizeof(nskb->cb));
2699
2700 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
2701 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
2702
2703 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
2704 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
2705 IEEE80211_TX_CTL_NO_CCK_RATE;
2706 if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
2707 info->hw_queue =
2708 local->hw.offchannel_tx_hw_queue;
2709 }
2710
2711 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
2712 status->band);
2713 }
2714 dev_kfree_skb(rx->skb);
2715 return RX_QUEUED;
2716}
2717
2718static ieee80211_rx_result debug_noinline
2719ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2720{
2721 struct ieee80211_sub_if_data *sdata = rx->sdata;
2722 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2723 __le16 stype;
2724
2725 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2726
2727 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2728 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2729 sdata->vif.type != NL80211_IFTYPE_STATION)
2730 return RX_DROP_MONITOR;
2731
2732 switch (stype) {
2733 case cpu_to_le16(IEEE80211_STYPE_AUTH):
2734 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2735 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2736
2737 break;
2738 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
2739 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
2740 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2741 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2742 if (is_multicast_ether_addr(mgmt->da) &&
2743 !is_broadcast_ether_addr(mgmt->da))
2744 return RX_DROP_MONITOR;
2745
2746
2747 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2748 return RX_DROP_MONITOR;
2749 break;
2750 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2751
2752 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2753 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2754 return RX_DROP_MONITOR;
2755 break;
2756 default:
2757 return RX_DROP_MONITOR;
2758 }
2759
2760
2761 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2762 skb_queue_tail(&sdata->skb_queue, rx->skb);
2763 ieee80211_queue_work(&rx->local->hw, &sdata->work);
2764 if (rx->sta)
2765 rx->sta->rx_packets++;
2766
2767 return RX_QUEUED;
2768}
2769
2770
2771static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2772 struct ieee80211_rate *rate)
2773{
2774 struct ieee80211_sub_if_data *sdata;
2775 struct ieee80211_local *local = rx->local;
2776 struct sk_buff *skb = rx->skb, *skb2;
2777 struct net_device *prev_dev = NULL;
2778 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2779 int needed_headroom;
2780
2781
2782
2783
2784
2785 if (rx->flags & IEEE80211_RX_CMNTR)
2786 goto out_free_skb;
2787 rx->flags |= IEEE80211_RX_CMNTR;
2788
2789
2790 if (!local->cooked_mntrs)
2791 goto out_free_skb;
2792
2793
2794 needed_headroom = ieee80211_rx_radiotap_space(local, status);
2795
2796 if (skb_headroom(skb) < needed_headroom &&
2797 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
2798 goto out_free_skb;
2799
2800
2801 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
2802 false);
2803
2804 skb_set_mac_header(skb, 0);
2805 skb->ip_summed = CHECKSUM_UNNECESSARY;
2806 skb->pkt_type = PACKET_OTHERHOST;
2807 skb->protocol = htons(ETH_P_802_2);
2808
2809 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2810 if (!ieee80211_sdata_running(sdata))
2811 continue;
2812
2813 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2814 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2815 continue;
2816
2817 if (prev_dev) {
2818 skb2 = skb_clone(skb, GFP_ATOMIC);
2819 if (skb2) {
2820 skb2->dev = prev_dev;
2821 netif_receive_skb(skb2);
2822 }
2823 }
2824
2825 prev_dev = sdata->dev;
2826 sdata->dev->stats.rx_packets++;
2827 sdata->dev->stats.rx_bytes += skb->len;
2828 }
2829
2830 if (prev_dev) {
2831 skb->dev = prev_dev;
2832 netif_receive_skb(skb);
2833 return;
2834 }
2835
2836 out_free_skb:
2837 dev_kfree_skb(skb);
2838}
2839
2840static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2841 ieee80211_rx_result res)
2842{
2843 switch (res) {
2844 case RX_DROP_MONITOR:
2845 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2846 if (rx->sta)
2847 rx->sta->rx_dropped++;
2848
2849 case RX_CONTINUE: {
2850 struct ieee80211_rate *rate = NULL;
2851 struct ieee80211_supported_band *sband;
2852 struct ieee80211_rx_status *status;
2853
2854 status = IEEE80211_SKB_RXCB((rx->skb));
2855
2856 sband = rx->local->hw.wiphy->bands[status->band];
2857 if (!(status->flag & RX_FLAG_HT) &&
2858 !(status->flag & RX_FLAG_VHT))
2859 rate = &sband->bitrates[status->rate_idx];
2860
2861 ieee80211_rx_cooked_monitor(rx, rate);
2862 break;
2863 }
2864 case RX_DROP_UNUSABLE:
2865 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2866 if (rx->sta)
2867 rx->sta->rx_dropped++;
2868 dev_kfree_skb(rx->skb);
2869 break;
2870 case RX_QUEUED:
2871 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2872 break;
2873 }
2874}
2875
2876static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
2877 struct sk_buff_head *frames)
2878{
2879 ieee80211_rx_result res = RX_DROP_MONITOR;
2880 struct sk_buff *skb;
2881
2882#define CALL_RXH(rxh) \
2883 do { \
2884 res = rxh(rx); \
2885 if (res != RX_CONTINUE) \
2886 goto rxh_next; \
2887 } while (0);
2888
2889 spin_lock_bh(&rx->local->rx_path_lock);
2890
2891 while ((skb = __skb_dequeue(frames))) {
2892
2893
2894
2895
2896
2897 rx->skb = skb;
2898
2899 CALL_RXH(ieee80211_rx_h_decrypt)
2900 CALL_RXH(ieee80211_rx_h_check_more_data)
2901 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
2902 CALL_RXH(ieee80211_rx_h_sta_process)
2903 CALL_RXH(ieee80211_rx_h_defragment)
2904 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2905
2906#ifdef CONFIG_MAC80211_MESH
2907 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2908 CALL_RXH(ieee80211_rx_h_mesh_fwding);
2909#endif
2910 CALL_RXH(ieee80211_rx_h_amsdu)
2911 CALL_RXH(ieee80211_rx_h_data)
2912
2913
2914 res = ieee80211_rx_h_ctrl(rx, frames);
2915 if (res != RX_CONTINUE)
2916 goto rxh_next;
2917
2918 CALL_RXH(ieee80211_rx_h_mgmt_check)
2919 CALL_RXH(ieee80211_rx_h_action)
2920 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2921 CALL_RXH(ieee80211_rx_h_action_return)
2922 CALL_RXH(ieee80211_rx_h_mgmt)
2923
2924 rxh_next:
2925 ieee80211_rx_handlers_result(rx, res);
2926
2927#undef CALL_RXH
2928 }
2929
2930 spin_unlock_bh(&rx->local->rx_path_lock);
2931}
2932
2933static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2934{
2935 struct sk_buff_head reorder_release;
2936 ieee80211_rx_result res = RX_DROP_MONITOR;
2937
2938 __skb_queue_head_init(&reorder_release);
2939
2940#define CALL_RXH(rxh) \
2941 do { \
2942 res = rxh(rx); \
2943 if (res != RX_CONTINUE) \
2944 goto rxh_next; \
2945 } while (0);
2946
2947 CALL_RXH(ieee80211_rx_h_check)
2948
2949 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
2950
2951 ieee80211_rx_handlers(rx, &reorder_release);
2952 return;
2953
2954 rxh_next:
2955 ieee80211_rx_handlers_result(rx, res);
2956
2957#undef CALL_RXH
2958}
2959
2960
2961
2962
2963
2964void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2965{
2966 struct sk_buff_head frames;
2967 struct ieee80211_rx_data rx = {
2968 .sta = sta,
2969 .sdata = sta->sdata,
2970 .local = sta->local,
2971
2972 .security_idx = tid,
2973 .seqno_idx = tid,
2974 .flags = 0,
2975 };
2976 struct tid_ampdu_rx *tid_agg_rx;
2977
2978 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2979 if (!tid_agg_rx)
2980 return;
2981
2982 __skb_queue_head_init(&frames);
2983
2984 spin_lock(&tid_agg_rx->reorder_lock);
2985 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
2986 spin_unlock(&tid_agg_rx->reorder_lock);
2987
2988 ieee80211_rx_handlers(&rx, &frames);
2989}
2990
2991
2992
2993static int prepare_for_handlers(struct ieee80211_rx_data *rx,
2994 struct ieee80211_hdr *hdr)
2995{
2996 struct ieee80211_sub_if_data *sdata = rx->sdata;
2997 struct sk_buff *skb = rx->skb;
2998 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2999 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3000 int multicast = is_multicast_ether_addr(hdr->addr1);
3001
3002 switch (sdata->vif.type) {
3003 case NL80211_IFTYPE_STATION:
3004 if (!bssid && !sdata->u.mgd.use_4addr)
3005 return 0;
3006 if (!multicast &&
3007 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3008 if (!(sdata->dev->flags & IFF_PROMISC) ||
3009 sdata->u.mgd.use_4addr)
3010 return 0;
3011 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3012 }
3013 break;
3014 case NL80211_IFTYPE_ADHOC:
3015 if (!bssid)
3016 return 0;
3017 if (ieee80211_is_beacon(hdr->frame_control)) {
3018 return 1;
3019 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
3020 return 0;
3021 } else if (!multicast &&
3022 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3023 if (!(sdata->dev->flags & IFF_PROMISC))
3024 return 0;
3025 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3026 } else if (!rx->sta) {
3027 int rate_idx;
3028 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3029 rate_idx = 0;
3030 else
3031 rate_idx = status->rate_idx;
3032 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3033 BIT(rate_idx));
3034 }
3035 break;
3036 case NL80211_IFTYPE_MESH_POINT:
3037 if (!multicast &&
3038 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3039 if (!(sdata->dev->flags & IFF_PROMISC))
3040 return 0;
3041
3042 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3043 }
3044 break;
3045 case NL80211_IFTYPE_AP_VLAN:
3046 case NL80211_IFTYPE_AP:
3047 if (!bssid) {
3048 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
3049 return 0;
3050 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3051
3052
3053
3054
3055
3056
3057 if (!multicast &&
3058 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3059 return 0;
3060 if (ieee80211_is_public_action(hdr, skb->len))
3061 return 1;
3062 if (!ieee80211_is_beacon(hdr->frame_control))
3063 return 0;
3064 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3065 }
3066 break;
3067 case NL80211_IFTYPE_WDS:
3068 if (bssid || !ieee80211_is_data(hdr->frame_control))
3069 return 0;
3070 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
3071 return 0;
3072 break;
3073 case NL80211_IFTYPE_P2P_DEVICE:
3074 if (!ieee80211_is_public_action(hdr, skb->len) &&
3075 !ieee80211_is_probe_req(hdr->frame_control) &&
3076 !ieee80211_is_probe_resp(hdr->frame_control) &&
3077 !ieee80211_is_beacon(hdr->frame_control))
3078 return 0;
3079 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
3080 !multicast)
3081 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3082 break;
3083 default:
3084
3085 WARN_ON_ONCE(1);
3086 break;
3087 }
3088
3089 return 1;
3090}
3091
3092
3093
3094
3095
3096
3097
3098static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
3099 struct sk_buff *skb, bool consume)
3100{
3101 struct ieee80211_local *local = rx->local;
3102 struct ieee80211_sub_if_data *sdata = rx->sdata;
3103 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3104 struct ieee80211_hdr *hdr = (void *)skb->data;
3105 int prepares;
3106
3107 rx->skb = skb;
3108 status->rx_flags |= IEEE80211_RX_RA_MATCH;
3109 prepares = prepare_for_handlers(rx, hdr);
3110
3111 if (!prepares)
3112 return false;
3113
3114 if (!consume) {
3115 skb = skb_copy(skb, GFP_ATOMIC);
3116 if (!skb) {
3117 if (net_ratelimit())
3118 wiphy_debug(local->hw.wiphy,
3119 "failed to copy skb for %s\n",
3120 sdata->name);
3121 return true;
3122 }
3123
3124 rx->skb = skb;
3125 }
3126
3127 ieee80211_invoke_rx_handlers(rx);
3128 return true;
3129}
3130
3131
3132
3133
3134
3135static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3136 struct sk_buff *skb)
3137{
3138 struct ieee80211_local *local = hw_to_local(hw);
3139 struct ieee80211_sub_if_data *sdata;
3140 struct ieee80211_hdr *hdr;
3141 __le16 fc;
3142 struct ieee80211_rx_data rx;
3143 struct ieee80211_sub_if_data *prev;
3144 struct sta_info *sta, *tmp, *prev_sta;
3145 int err = 0;
3146
3147 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3148 memset(&rx, 0, sizeof(rx));
3149 rx.skb = skb;
3150 rx.local = local;
3151
3152 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3153 local->dot11ReceivedFragmentCount++;
3154
3155 if (ieee80211_is_mgmt(fc)) {
3156
3157 if (skb->len < ieee80211_hdrlen(fc))
3158 err = -ENOBUFS;
3159 else
3160 err = skb_linearize(skb);
3161 } else {
3162 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3163 }
3164
3165 if (err) {
3166 dev_kfree_skb(skb);
3167 return;
3168 }
3169
3170 hdr = (struct ieee80211_hdr *)skb->data;
3171 ieee80211_parse_qos(&rx);
3172 ieee80211_verify_alignment(&rx);
3173
3174 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
3175 ieee80211_is_beacon(hdr->frame_control)))
3176 ieee80211_scan_rx(local, skb);
3177
3178 if (ieee80211_is_data(fc)) {
3179 prev_sta = NULL;
3180
3181 for_each_sta_info(local, hdr->addr2, sta, tmp) {
3182 if (!prev_sta) {
3183 prev_sta = sta;
3184 continue;
3185 }
3186
3187 rx.sta = prev_sta;
3188 rx.sdata = prev_sta->sdata;
3189 ieee80211_prepare_and_rx_handle(&rx, skb, false);
3190
3191 prev_sta = sta;
3192 }
3193
3194 if (prev_sta) {
3195 rx.sta = prev_sta;
3196 rx.sdata = prev_sta->sdata;
3197
3198 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3199 return;
3200 goto out;
3201 }
3202 }
3203
3204 prev = NULL;
3205
3206 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3207 if (!ieee80211_sdata_running(sdata))
3208 continue;
3209
3210 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
3211 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3212 continue;
3213
3214
3215
3216
3217
3218
3219
3220 if (!prev) {
3221 prev = sdata;
3222 continue;
3223 }
3224
3225 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3226 rx.sdata = prev;
3227 ieee80211_prepare_and_rx_handle(&rx, skb, false);
3228
3229 prev = sdata;
3230 }
3231
3232 if (prev) {
3233 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3234 rx.sdata = prev;
3235
3236 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3237 return;
3238 }
3239
3240 out:
3241 dev_kfree_skb(skb);
3242}
3243
3244
3245
3246
3247
3248void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
3249{
3250 struct ieee80211_local *local = hw_to_local(hw);
3251 struct ieee80211_rate *rate = NULL;
3252 struct ieee80211_supported_band *sband;
3253 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3254
3255 WARN_ON_ONCE(softirq_count() == 0);
3256
3257 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
3258 goto drop;
3259
3260 sband = local->hw.wiphy->bands[status->band];
3261 if (WARN_ON(!sband))
3262 goto drop;
3263
3264
3265
3266
3267
3268
3269
3270
3271 if (unlikely(local->quiescing || local->suspended))
3272 goto drop;
3273
3274
3275 if (unlikely(local->in_reconfig))
3276 goto drop;
3277
3278
3279
3280
3281
3282 if (WARN_ON(!local->started))
3283 goto drop;
3284
3285 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3286
3287
3288
3289
3290
3291 if (status->flag & RX_FLAG_HT) {
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302 if (WARN(status->rate_idx > 76,
3303 "Rate marked as an HT rate but passed "
3304 "status->rate_idx is not "
3305 "an MCS index [0-76]: %d (0x%02x)\n",
3306 status->rate_idx,
3307 status->rate_idx))
3308 goto drop;
3309 } else if (status->flag & RX_FLAG_VHT) {
3310 if (WARN_ONCE(status->rate_idx > 9 ||
3311 !status->vht_nss ||
3312 status->vht_nss > 8,
3313 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
3314 status->rate_idx, status->vht_nss))
3315 goto drop;
3316 } else {
3317 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3318 goto drop;
3319 rate = &sband->bitrates[status->rate_idx];
3320 }
3321 }
3322
3323 status->rx_flags = 0;
3324
3325
3326
3327
3328
3329
3330 rcu_read_lock();
3331
3332
3333
3334
3335
3336
3337
3338 skb = ieee80211_rx_monitor(local, skb, rate);
3339 if (!skb) {
3340 rcu_read_unlock();
3341 return;
3342 }
3343
3344 ieee80211_tpt_led_trig_rx(local,
3345 ((struct ieee80211_hdr *)skb->data)->frame_control,
3346 skb->len);
3347 __ieee80211_rx_handle_packet(hw, skb);
3348
3349 rcu_read_unlock();
3350
3351 return;
3352 drop:
3353 kfree_skb(skb);
3354}
3355EXPORT_SYMBOL(ieee80211_rx);
3356
3357
3358
3359void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3360{
3361 struct ieee80211_local *local = hw_to_local(hw);
3362
3363 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
3364
3365 skb->pkt_type = IEEE80211_RX_MSG;
3366 skb_queue_tail(&local->skb_queue, skb);
3367 tasklet_schedule(&local->tasklet);
3368}
3369EXPORT_SYMBOL(ieee80211_rx_irqsafe);
3370