Skip to content

L
linux
Commit 5d24828d authored by Johannes Berg's avatar Johannes Berg
Browse files
Options

mac80211: always allocate struct ieee802_11_elems 

As the 802.11 spec evolves, we need to parse more and more
elements. This is causing the struct to grow, and we can no
longer get away with putting it on the stack.

Change the API to always dynamically allocate and return an
allocated pointer that must be kfree()d later.

As an alternative, I contemplated a scheme whereby we'd say
in the code which elements we needed, e.g.

    DECLARE_ELEMENT_PARSER(elems,
                           SUPPORTED_CHANNELS,
                           CHANNEL_SWITCH,
                           EXT(KEY_DELIVERY));

    ieee802_11_parse_elems(..., &elems, ...);

and while I think this is possible and will save us a lot
since most individual places only care about a small subset
of the elements, it ended up being a bit more work since a
lot of places do the parsing and then pass the struct to
other functions, sometimes with multiple levels.

Link: https://lore.kernel.org/r/20210920154009.26caff6b5998.I05ae58768e990e611aee8eca8abefd9d7bc15e05@changeidSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 49a765d6
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 272 additions and 201 deletions
net/mac80211/agg-rx.c
View file @ 5d24828d
...@@ -477,7 +477,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local, ...@@ -477,7 +477,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
size_t len) size_t len)
{ {
u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num; u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
struct ieee802_11_elems elems = { }; struct ieee802_11_elems *elems = NULL;
u8 dialog_token; u8 dialog_token;
int ies_len; int ies_len;
...@@ -495,16 +495,17 @@ void ieee80211_process_addba_request(struct ieee80211_local *local, ...@@ -495,16 +495,17 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
ies_len = len - offsetof(struct ieee80211_mgmt, ies_len = len - offsetof(struct ieee80211_mgmt,
u.action.u.addba_req.variable); u.action.u.addba_req.variable);
if (ies_len) { if (ies_len) {
ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable, elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
ies_len, true, &elems, mgmt->bssid, NULL); ies_len, true, mgmt->bssid, NULL);
if (elems.parse_error) if (!elems || elems->parse_error)
return; return;
} }
__ieee80211_start_rx_ba_session(sta, dialog_token, timeout, __ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
start_seq_num, ba_policy, tid, start_seq_num, ba_policy, tid,
buf_size, true, false, buf_size, true, false,
elems.addba_ext_ie); elems ? elems->addba_ext_ie : NULL);
kfree(elems);
} }
void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif, void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
......
net/mac80211/ibss.c
View file @ 5d24828d
...@@ -9,7 +9,7 @@ ...@@ -9,7 +9,7 @@
* Copyright 2009, Johannes Berg <johannes@sipsolutions.net> * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright(c) 2016 Intel Deutschland GmbH * Copyright(c) 2016 Intel Deutschland GmbH
* Copyright(c) 2018-2020 Intel Corporation * Copyright(c) 2018-2021 Intel Corporation
*/ */
#include <linux/delay.h> #include <linux/delay.h>
...@@ -1589,7 +1589,7 @@ void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata, ...@@ -1589,7 +1589,7 @@ void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
struct ieee80211_rx_status *rx_status) struct ieee80211_rx_status *rx_status)
{ {
size_t baselen; size_t baselen;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) != BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) !=
offsetof(typeof(mgmt->u.beacon), variable)); offsetof(typeof(mgmt->u.beacon), variable));
...@@ -1602,10 +1602,14 @@ void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata, ...@@ -1602,10 +1602,14 @@ void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
if (baselen > len) if (baselen > len)
return; return;
ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen, elems = ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
false, &elems, mgmt->bssid, NULL); len - baselen, false,
mgmt->bssid, NULL);
ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems); if (elems) {
ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, elems);
kfree(elems);
}
} }
void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
...@@ -1614,7 +1618,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, ...@@ -1614,7 +1618,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
struct ieee80211_rx_status *rx_status; struct ieee80211_rx_status *rx_status;
struct ieee80211_mgmt *mgmt; struct ieee80211_mgmt *mgmt;
u16 fc; u16 fc;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
int ies_len; int ies_len;
rx_status = IEEE80211_SKB_RXCB(skb); rx_status = IEEE80211_SKB_RXCB(skb);
...@@ -1651,15 +1655,16 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, ...@@ -1651,15 +1655,16 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
if (ies_len < 0) if (ies_len < 0)
break; break;
ieee802_11_parse_elems( elems = ieee802_11_parse_elems(
mgmt->u.action.u.chan_switch.variable, mgmt->u.action.u.chan_switch.variable,
ies_len, true, &elems, mgmt->bssid, NULL); ies_len, true, mgmt->bssid, NULL);
if (elems.parse_error) if (!elems || elems->parse_error)
break; break;
ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len, ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,
rx_status, &elems); rx_status, elems);
kfree(elems);
break; break;
} }
} }
......
net/mac80211/ieee80211_i.h
View file @ 5d24828d
...@@ -2192,18 +2192,18 @@ static inline void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, ...@@ -2192,18 +2192,18 @@ static inline void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata,
ieee80211_tx_skb_tid(sdata, skb, 7); ieee80211_tx_skb_tid(sdata, skb, 7);
} }
void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, struct ieee802_11_elems *ieee802_11_parse_elems_crc(const u8 *start, size_t len,
struct ieee802_11_elems *elems, bool action,
u64 filter, u32 crc, u8 *transmitter_bssid, u64 filter, u32 crc,
u8 *bss_bssid); const u8 *transmitter_bssid,
static inline void ieee802_11_parse_elems(const u8 *start, size_t len, const u8 *bss_bssid);
bool action, static inline struct ieee802_11_elems *
struct ieee802_11_elems *elems, ieee802_11_parse_elems(const u8 *start, size_t len, bool action,
u8 *transmitter_bssid, const u8 *transmitter_bssid,
u8 *bss_bssid) const u8 *bss_bssid)
{ {
ieee802_11_parse_elems_crc(start, len, action, elems, 0, 0, return ieee802_11_parse_elems_crc(start, len, action, 0, 0,
transmitter_bssid, bss_bssid); transmitter_bssid, bss_bssid);
} }
......
net/mac80211/mesh.c
View file @ 5d24828d
...@@ -1246,7 +1246,7 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata, ...@@ -1246,7 +1246,7 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
struct sk_buff *presp; struct sk_buff *presp;
struct beacon_data *bcn; struct beacon_data *bcn;
struct ieee80211_mgmt *hdr; struct ieee80211_mgmt *hdr;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
size_t baselen; size_t baselen;
u8 *pos; u8 *pos;
...@@ -1255,22 +1255,24 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata, ...@@ -1255,22 +1255,24 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
if (baselen > len) if (baselen > len)
return; return;
ieee802_11_parse_elems(pos, len - baselen, false, &elems, mgmt->bssid, elems = ieee802_11_parse_elems(pos, len - baselen, false, mgmt->bssid,
NULL); NULL);
if (!elems)
if (!elems.mesh_id)
return; return;
if (!elems->mesh_id)
goto free;
/* 802.11-2012 10.1.4.3.2 */ /* 802.11-2012 10.1.4.3.2 */
if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) && if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
!is_broadcast_ether_addr(mgmt->da)) || !is_broadcast_ether_addr(mgmt->da)) ||
elems.ssid_len != 0) elems->ssid_len != 0)
return; goto free;
if (elems.mesh_id_len != 0 && if (elems->mesh_id_len != 0 &&
(elems.mesh_id_len != ifmsh->mesh_id_len || (elems->mesh_id_len != ifmsh->mesh_id_len ||
memcmp(elems.mesh_id, ifmsh->mesh_id, ifmsh->mesh_id_len))) memcmp(elems->mesh_id, ifmsh->mesh_id, ifmsh->mesh_id_len)))
return; goto free;
rcu_read_lock(); rcu_read_lock();
bcn = rcu_dereference(ifmsh->beacon); bcn = rcu_dereference(ifmsh->beacon);
...@@ -1294,6 +1296,8 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata, ...@@ -1294,6 +1296,8 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
ieee80211_tx_skb(sdata, presp); ieee80211_tx_skb(sdata, presp);
out: out:
rcu_read_unlock(); rcu_read_unlock();
free:
kfree(elems);
} }
static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata, static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
...@@ -1304,7 +1308,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata, ...@@ -1304,7 +1308,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
{ {
struct ieee80211_local *local = sdata->local; struct ieee80211_local *local = sdata->local;
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
struct ieee80211_channel *channel; struct ieee80211_channel *channel;
size_t baselen; size_t baselen;
int freq; int freq;
...@@ -1319,42 +1323,47 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata, ...@@ -1319,42 +1323,47 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
if (baselen > len) if (baselen > len)
return; return;
ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen, elems = ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
false, &elems, mgmt->bssid, NULL); len - baselen,
false, mgmt->bssid, NULL);
if (!elems)
return;
/* ignore non-mesh or secure / unsecure mismatch */ /* ignore non-mesh or secure / unsecure mismatch */
if ((!elems.mesh_id || !elems.mesh_config) || if ((!elems->mesh_id || !elems->mesh_config) ||
(elems.rsn && sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) || (elems->rsn && sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) ||
(!elems.rsn && sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)) (!elems->rsn && sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE))
return; goto free;
if (elems.ds_params) if (elems->ds_params)
freq = ieee80211_channel_to_frequency(elems.ds_params[0], band); freq = ieee80211_channel_to_frequency(elems->ds_params[0], band);
else else
freq = rx_status->freq; freq = rx_status->freq;
channel = ieee80211_get_channel(local->hw.wiphy, freq); channel = ieee80211_get_channel(local->hw.wiphy, freq);
if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
return; goto free;
if (mesh_matches_local(sdata, &elems)) { if (mesh_matches_local(sdata, elems)) {
mpl_dbg(sdata, "rssi_threshold=%d,rx_status->signal=%d\n", mpl_dbg(sdata, "rssi_threshold=%d,rx_status->signal=%d\n",
sdata->u.mesh.mshcfg.rssi_threshold, rx_status->signal); sdata->u.mesh.mshcfg.rssi_threshold, rx_status->signal);
if (!sdata->u.mesh.user_mpm || if (!sdata->u.mesh.user_mpm ||
sdata->u.mesh.mshcfg.rssi_threshold == 0 || sdata->u.mesh.mshcfg.rssi_threshold == 0 ||
sdata->u.mesh.mshcfg.rssi_threshold < rx_status->signal) sdata->u.mesh.mshcfg.rssi_threshold < rx_status->signal)
mesh_neighbour_update(sdata, mgmt->sa, &elems, mesh_neighbour_update(sdata, mgmt->sa, elems,
rx_status); rx_status);
if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT && if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT &&
!sdata->vif.csa_active) !sdata->vif.csa_active)
ieee80211_mesh_process_chnswitch(sdata, &elems, true); ieee80211_mesh_process_chnswitch(sdata, elems, true);
} }
if (ifmsh->sync_ops) if (ifmsh->sync_ops)
ifmsh->sync_ops->rx_bcn_presp(sdata, stype, mgmt, len, ifmsh->sync_ops->rx_bcn_presp(sdata, stype, mgmt, len,
elems.mesh_config, rx_status); elems->mesh_config, rx_status);
free:
kfree(elems);
} }
int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata) int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
...@@ -1446,7 +1455,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata, ...@@ -1446,7 +1455,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *mgmt, size_t len) struct ieee80211_mgmt *mgmt, size_t len)
{ {
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
u16 pre_value; u16 pre_value;
bool fwd_csa = true; bool fwd_csa = true;
size_t baselen; size_t baselen;
...@@ -1459,33 +1468,37 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata, ...@@ -1459,33 +1468,37 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
pos = mgmt->u.action.u.chan_switch.variable; pos = mgmt->u.action.u.chan_switch.variable;
baselen = offsetof(struct ieee80211_mgmt, baselen = offsetof(struct ieee80211_mgmt,
u.action.u.chan_switch.variable); u.action.u.chan_switch.variable);
ieee802_11_parse_elems(pos, len - baselen, true, &elems, elems = ieee802_11_parse_elems(pos, len - baselen, true,
mgmt->bssid, NULL); mgmt->bssid, NULL);
if (!elems)
if (!mesh_matches_local(sdata, &elems))
return; return;
ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl; if (!mesh_matches_local(sdata, elems))
goto free;
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
if (!--ifmsh->chsw_ttl) if (!--ifmsh->chsw_ttl)
fwd_csa = false; fwd_csa = false;
pre_value = le16_to_cpu(elems.mesh_chansw_params_ie->mesh_pre_value); pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
if (ifmsh->pre_value >= pre_value) if (ifmsh->pre_value >= pre_value)
return; goto free;
ifmsh->pre_value = pre_value; ifmsh->pre_value = pre_value;
if (!sdata->vif.csa_active && if (!sdata->vif.csa_active &&
!ieee80211_mesh_process_chnswitch(sdata, &elems, false)) { !ieee80211_mesh_process_chnswitch(sdata, elems, false)) {
mcsa_dbg(sdata, "Failed to process CSA action frame"); mcsa_dbg(sdata, "Failed to process CSA action frame");
return; goto free;
} }
/* forward or re-broadcast the CSA frame */ /* forward or re-broadcast the CSA frame */
if (fwd_csa) { if (fwd_csa) {
if (mesh_fwd_csa_frame(sdata, mgmt, len, &elems) < 0) if (mesh_fwd_csa_frame(sdata, mgmt, len, elems) < 0)
mcsa_dbg(sdata, "Failed to forward the CSA frame"); mcsa_dbg(sdata, "Failed to forward the CSA frame");
} }
free:
kfree(elems);
} }
static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata, static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
......
net/mac80211/mesh_hwmp.c
View file @ 5d24828d
// SPDX-License-Identifier: GPL-2.0-only // SPDX-License-Identifier: GPL-2.0-only
/* /*
* Copyright (c) 2008, 2009 open80211s Ltd. * Copyright (c) 2008, 2009 open80211s Ltd.
* Copyright (C) 2019 Intel Corporation * Copyright (C) 2019, 2021 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com> * Author: Luis Carlos Cobo <luisca@cozybit.com>
*/ */
...@@ -908,7 +908,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, ...@@ -908,7 +908,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata, void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *mgmt, size_t len) struct ieee80211_mgmt *mgmt, size_t len)
{ {
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
size_t baselen; size_t baselen;
u32 path_metric; u32 path_metric;
struct sta_info *sta; struct sta_info *sta;
...@@ -926,37 +926,41 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata, ...@@ -926,37 +926,41 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
rcu_read_unlock(); rcu_read_unlock();
baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt; baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable, elems = ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
len - baselen, false, &elems, mgmt->bssid, NULL); len - baselen, false, mgmt->bssid, NULL);
if (!elems)
return;
if (elems.preq) { if (elems->preq) {
if (elems.preq_len != 37) if (elems->preq_len != 37)
/* Right now we support just 1 destination and no AE */ /* Right now we support just 1 destination and no AE */
return; goto free;
path_metric = hwmp_route_info_get(sdata, mgmt, elems.preq, path_metric = hwmp_route_info_get(sdata, mgmt, elems->preq,
MPATH_PREQ); MPATH_PREQ);
if (path_metric) if (path_metric)
hwmp_preq_frame_process(sdata, mgmt, elems.preq, hwmp_preq_frame_process(sdata, mgmt, elems->preq,
path_metric); path_metric);
} }
if (elems.prep) { if (elems->prep) {
if (elems.prep_len != 31) if (elems->prep_len != 31)
/* Right now we support no AE */ /* Right now we support no AE */
return; goto free;
path_metric = hwmp_route_info_get(sdata, mgmt, elems.prep, path_metric = hwmp_route_info_get(sdata, mgmt, elems->prep,
MPATH_PREP); MPATH_PREP);
if (path_metric) if (path_metric)
hwmp_prep_frame_process(sdata, mgmt, elems.prep, hwmp_prep_frame_process(sdata, mgmt, elems->prep,
path_metric); path_metric);
} }
if (elems.perr) { if (elems->perr) {
if (elems.perr_len != 15) if (elems->perr_len != 15)
/* Right now we support only one destination per PERR */ /* Right now we support only one destination per PERR */
return; goto free;
hwmp_perr_frame_process(sdata, mgmt, elems.perr); hwmp_perr_frame_process(sdata, mgmt, elems->perr);
} }
if (elems.rann) if (elems->rann)
hwmp_rann_frame_process(sdata, mgmt, elems.rann); hwmp_rann_frame_process(sdata, mgmt, elems->rann);
free:
kfree(elems);
} }
/** /**
......
net/mac80211/mesh_plink.c
View file @ 5d24828d
// SPDX-License-Identifier: GPL-2.0-only // SPDX-License-Identifier: GPL-2.0-only
/* /*
* Copyright (c) 2008, 2009 open80211s Ltd. * Copyright (c) 2008, 2009 open80211s Ltd.
* Copyright (C) 2019 Intel Corporation * Copyright (C) 2019, 2021 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com> * Author: Luis Carlos Cobo <luisca@cozybit.com>
*/ */
#include <linux/gfp.h> #include <linux/gfp.h>
...@@ -1200,7 +1200,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, ...@@ -1200,7 +1200,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *mgmt, size_t len, struct ieee80211_mgmt *mgmt, size_t len,
struct ieee80211_rx_status *rx_status) struct ieee80211_rx_status *rx_status)
{ {
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
size_t baselen; size_t baselen;
u8 *baseaddr; u8 *baseaddr;
...@@ -1228,7 +1228,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, ...@@ -1228,7 +1228,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
if (baselen > len) if (baselen > len)
return; return;
} }
ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems, elems = ieee802_11_parse_elems(baseaddr, len - baselen, true,
mgmt->bssid, NULL); mgmt->bssid, NULL);
mesh_process_plink_frame(sdata, mgmt, &elems, rx_status); mesh_process_plink_frame(sdata, mgmt, elems, rx_status);
kfree(elems);
} }
net/mac80211/mlme.c
View file @ 5d24828d
This diff is collapsed.
net/mac80211/scan.c
View file @ 5d24828d
...@@ -9,7 +9,7 @@ ...@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net> * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2013-2015 Intel Mobile Communications GmbH * Copyright 2013-2015 Intel Mobile Communications GmbH
* Copyright 2016-2017 Intel Deutschland GmbH * Copyright 2016-2017 Intel Deutschland GmbH
* Copyright (C) 2018-2020 Intel Corporation * Copyright (C) 2018-2021 Intel Corporation
*/ */
#include <linux/if_arp.h> #include <linux/if_arp.h>
...@@ -155,7 +155,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local, ...@@ -155,7 +155,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
}; };
bool signal_valid; bool signal_valid;
struct ieee80211_sub_if_data *scan_sdata; struct ieee80211_sub_if_data *scan_sdata;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
size_t baselen; size_t baselen;
u8 *elements; u8 *elements;
...@@ -209,8 +209,10 @@ ieee80211_bss_info_update(struct ieee80211_local *local, ...@@ -209,8 +209,10 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
if (baselen > len) if (baselen > len)
return NULL; return NULL;
ieee802_11_parse_elems(elements, len - baselen, false, &elems, elems = ieee802_11_parse_elems(elements, len - baselen, false,
mgmt->bssid, cbss->bssid); mgmt->bssid, cbss->bssid);
if (!elems)
return NULL;
/* In case the signal is invalid update the status */ /* In case the signal is invalid update the status */
signal_valid = channel == cbss->channel; signal_valid = channel == cbss->channel;
...@@ -218,15 +220,17 @@ ieee80211_bss_info_update(struct ieee80211_local *local, ...@@ -218,15 +220,17 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL; rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
bss = (void *)cbss->priv; bss = (void *)cbss->priv;
ieee80211_update_bss_from_elems(local, bss, &elems, rx_status, beacon); ieee80211_update_bss_from_elems(local, bss, elems, rx_status, beacon);
list_for_each_entry(non_tx_cbss, &cbss->nontrans_list, nontrans_list) { list_for_each_entry(non_tx_cbss, &cbss->nontrans_list, nontrans_list) {
non_tx_bss = (void *)non_tx_cbss->priv; non_tx_bss = (void *)non_tx_cbss->priv;
ieee80211_update_bss_from_elems(local, non_tx_bss, &elems, ieee80211_update_bss_from_elems(local, non_tx_bss, elems,
rx_status, beacon); rx_status, beacon);
} }
kfree(elems);
return bss; return bss;
} }
......
net/mac80211/tdls.c
View file @ 5d24828d
...@@ -6,7 +6,7 @@ ...@@ -6,7 +6,7 @@
* Copyright 2014, Intel Corporation * Copyright 2014, Intel Corporation
* Copyright 2014 Intel Mobile Communications GmbH * Copyright 2014 Intel Mobile Communications GmbH
* Copyright 2015 - 2016 Intel Deutschland GmbH * Copyright 2015 - 2016 Intel Deutschland GmbH
* Copyright (C) 2019 Intel Corporation * Copyright (C) 2019, 2021 Intel Corporation
*/ */
#include <linux/ieee80211.h> #include <linux/ieee80211.h>
...@@ -1684,7 +1684,7 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata, ...@@ -1684,7 +1684,7 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct ieee80211_local *local = sdata->local; struct ieee80211_local *local = sdata->local;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems = NULL;
struct sta_info *sta; struct sta_info *sta;
struct ieee80211_tdls_data *tf = (void *)skb->data; struct ieee80211_tdls_data *tf = (void *)skb->data;
bool local_initiator; bool local_initiator;
...@@ -1718,16 +1718,20 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata, ...@@ -1718,16 +1718,20 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata,
goto call_drv; goto call_drv;
} }
ieee802_11_parse_elems(tf->u.chan_switch_resp.variable, elems = ieee802_11_parse_elems(tf->u.chan_switch_resp.variable,
skb->len - baselen, false, &elems, skb->len - baselen, false, NULL, NULL);
NULL, NULL); if (!elems) {
if (elems.parse_error) { ret = -ENOMEM;
goto out;
}
if (elems->parse_error) {
tdls_dbg(sdata, "Invalid IEs in TDLS channel switch resp\n"); tdls_dbg(sdata, "Invalid IEs in TDLS channel switch resp\n");
ret = -EINVAL; ret = -EINVAL;
goto out; goto out;
} }
if (!elems.ch_sw_timing || !elems.lnk_id) { if (!elems->ch_sw_timing || !elems->lnk_id) {
tdls_dbg(sdata, "TDLS channel switch resp - missing IEs\n"); tdls_dbg(sdata, "TDLS channel switch resp - missing IEs\n");
ret = -EINVAL; ret = -EINVAL;
goto out; goto out;
...@@ -1735,15 +1739,15 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata, ...@@ -1735,15 +1739,15 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata,
/* validate the initiator is set correctly */ /* validate the initiator is set correctly */
local_initiator = local_initiator =
!memcmp(elems.lnk_id->init_sta, sdata->vif.addr, ETH_ALEN); !memcmp(elems->lnk_id->init_sta, sdata->vif.addr, ETH_ALEN);
if (local_initiator == sta->sta.tdls_initiator) { if (local_initiator == sta->sta.tdls_initiator) {
tdls_dbg(sdata, "TDLS chan switch invalid lnk-id initiator\n"); tdls_dbg(sdata, "TDLS chan switch invalid lnk-id initiator\n");
ret = -EINVAL; ret = -EINVAL;
goto out; goto out;
} }
params.switch_time = le16_to_cpu(elems.ch_sw_timing->switch_time); params.switch_time = le16_to_cpu(elems->ch_sw_timing->switch_time);
params.switch_timeout = le16_to_cpu(elems.ch_sw_timing->switch_timeout); params.switch_timeout = le16_to_cpu(elems->ch_sw_timing->switch_timeout);
params.tmpl_skb = params.tmpl_skb =
ieee80211_tdls_ch_sw_resp_tmpl_get(sta, &params.ch_sw_tm_ie); ieee80211_tdls_ch_sw_resp_tmpl_get(sta, &params.ch_sw_tm_ie);
...@@ -1763,6 +1767,7 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata, ...@@ -1763,6 +1767,7 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata,
out: out:
mutex_unlock(&local->sta_mtx); mutex_unlock(&local->sta_mtx);
dev_kfree_skb_any(params.tmpl_skb); dev_kfree_skb_any(params.tmpl_skb);
kfree(elems);
return ret; return ret;
} }
...@@ -1771,7 +1776,7 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata, ...@@ -1771,7 +1776,7 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct ieee80211_local *local = sdata->local; struct ieee80211_local *local = sdata->local;
struct ieee802_11_elems elems; struct ieee802_11_elems *elems;
struct cfg80211_chan_def chandef; struct cfg80211_chan_def chandef;
struct ieee80211_channel *chan; struct ieee80211_channel *chan;
enum nl80211_channel_type chan_type; enum nl80211_channel_type chan_type;
...@@ -1831,22 +1836,27 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata, ...@@ -1831,22 +1836,27 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
return -EINVAL; return -EINVAL;
} }
ieee802_11_parse_elems(tf->u.chan_switch_req.variable, elems = ieee802_11_parse_elems(tf->u.chan_switch_req.variable,
skb->len - baselen, false, &elems, NULL, NULL); skb->len - baselen, false, NULL, NULL);
if (elems.parse_error) { if (!elems)
return -ENOMEM;
if (elems->parse_error) {
tdls_dbg(sdata, "Invalid IEs in TDLS channel switch req\n"); tdls_dbg(sdata, "Invalid IEs in TDLS channel switch req\n");
return -EINVAL; ret = -EINVAL;
goto free;
} }
if (!elems.ch_sw_timing || !elems.lnk_id) { if (!elems->ch_sw_timing || !elems->lnk_id) {
tdls_dbg(sdata, "TDLS channel switch req - missing IEs\n"); tdls_dbg(sdata, "TDLS channel switch req - missing IEs\n");
return -EINVAL; ret = -EINVAL;
goto free;
} }
if (!elems.sec_chan_offs) { if (!elems->sec_chan_offs) {
chan_type = NL80211_CHAN_HT20; chan_type = NL80211_CHAN_HT20;
} else { } else {
switch (elems.sec_chan_offs->sec_chan_offs) { switch (elems->sec_chan_offs->sec_chan_offs) {
case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
chan_type = NL80211_CHAN_HT40PLUS; chan_type = NL80211_CHAN_HT40PLUS;
break; break;
...@@ -1865,7 +1875,8 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata, ...@@ -1865,7 +1875,8 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
if (!cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &chandef, if (!cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &chandef,
sdata->wdev.iftype)) { sdata->wdev.iftype)) {
tdls_dbg(sdata, "TDLS chan switch to forbidden channel\n"); tdls_dbg(sdata, "TDLS chan switch to forbidden channel\n");
return -EINVAL; ret = -EINVAL;
goto free;
} }
mutex_lock(&local->sta_mtx); mutex_lock(&local->sta_mtx);
...@@ -1881,7 +1892,7 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata, ...@@ -1881,7 +1892,7 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
/* validate the initiator is set correctly */ /* validate the initiator is set correctly */
local_initiator = local_initiator =
!memcmp(elems.lnk_id->init_sta, sdata->vif.addr, ETH_ALEN); !memcmp(elems->lnk_id->init_sta, sdata->vif.addr, ETH_ALEN);
if (local_initiator == sta->sta.tdls_initiator) { if (local_initiator == sta->sta.tdls_initiator) {
tdls_dbg(sdata, "TDLS chan switch invalid lnk-id initiator\n"); tdls_dbg(sdata, "TDLS chan switch invalid lnk-id initiator\n");
ret = -EINVAL; ret = -EINVAL;
...@@ -1889,16 +1900,16 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata, ...@@ -1889,16 +1900,16 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
} }
/* peer should have known better */ /* peer should have known better */
if (!sta->sta.ht_cap.ht_supported && elems.sec_chan_offs && if (!sta->sta.ht_cap.ht_supported && elems->sec_chan_offs &&
elems.sec_chan_offs->sec_chan_offs) { elems->sec_chan_offs->sec_chan_offs) {
tdls_dbg(sdata, "TDLS chan switch - wide chan unsupported\n"); tdls_dbg(sdata, "TDLS chan switch - wide chan unsupported\n");
ret = -ENOTSUPP; ret = -ENOTSUPP;
goto out; goto out;
} }
params.chandef = &chandef; params.chandef = &chandef;
params.switch_time = le16_to_cpu(elems.ch_sw_timing->switch_time); params.switch_time = le16_to_cpu(elems->ch_sw_timing->switch_time);
params.switch_timeout = le16_to_cpu(elems.ch_sw_timing->switch_timeout); params.switch_timeout = le16_to_cpu(elems->ch_sw_timing->switch_timeout);
params.tmpl_skb = params.tmpl_skb =
ieee80211_tdls_ch_sw_resp_tmpl_get(sta, ieee80211_tdls_ch_sw_resp_tmpl_get(sta,
...@@ -1917,6 +1928,8 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata, ...@@ -1917,6 +1928,8 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
out: out:
mutex_unlock(&local->sta_mtx); mutex_unlock(&local->sta_mtx);
dev_kfree_skb_any(params.tmpl_skb); dev_kfree_skb_any(params.tmpl_skb);
free:
kfree(elems);
return ret; return ret;
} }
......
net/mac80211/util.c
View file @ 5d24828d
...@@ -1391,8 +1391,8 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, ...@@ -1391,8 +1391,8 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
struct ieee802_11_elems *elems, struct ieee802_11_elems *elems,
u8 *transmitter_bssid, const u8 *transmitter_bssid,
u8 *bss_bssid, const u8 *bss_bssid,
u8 *nontransmitted_profile) u8 *nontransmitted_profile)
{ {
const struct element *elem, *sub; const struct element *elem, *sub;
...@@ -1457,16 +1457,20 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, ...@@ -1457,16 +1457,20 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
return found ? profile_len : 0; return found ? profile_len : 0;
} }
void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, struct ieee802_11_elems *ieee802_11_parse_elems_crc(const u8 *start, size_t len,
struct ieee802_11_elems *elems, bool action, u64 filter,
u64 filter, u32 crc, u8 *transmitter_bssid, u32 crc,
u8 *bss_bssid) const u8 *transmitter_bssid,
const u8 *bss_bssid)
{ {
struct ieee802_11_elems *elems;
const struct element *non_inherit = NULL; const struct element *non_inherit = NULL;
u8 *nontransmitted_profile; u8 *nontransmitted_profile;
int nontransmitted_profile_len = 0; int nontransmitted_profile_len = 0;
memset(elems, 0, sizeof(*elems)); elems = kzalloc(sizeof(*elems), GFP_ATOMIC);
if (!elems)
return NULL;
elems->ie_start = start; elems->ie_start = start;
elems->total_len = len; elems->total_len = len;
...@@ -1513,6 +1517,8 @@ void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, ...@@ -1513,6 +1517,8 @@ void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
kfree(nontransmitted_profile); kfree(nontransmitted_profile);
elems->crc = crc; elems->crc = crc;
return elems;
} }
void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata, void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7