admin/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-12-07 20:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mac80211: pass frame type to element parsing

Browse Source 
This will be needed for UHR operation parsing, and we
already pass whether or not the frame is an action
frame, replace that by the full type. Note this fixes
a few cases where 'false' was erroneously passed (mesh
and TDLS) and removes ieee802_11_parse_elems_crc() as
it's unused.

Link: https://patch.msgid.link/20251105160810.a476d20a6e01.Ie659535f9357f2f9a3c73f8c059ccfc96bf93b54@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg
2025-11-05 16:08:10 +01:00
parent 1fba157685
commit 68eb1b791a
12 changed files with 123 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/ieee80211.h
View File

@@ -43,6 +43,7 @@
#define IEEE80211_FCTL_VERS 0x0003
#define IEEE80211_FCTL_FTYPE 0x000c
#define IEEE80211_FCTL_STYPE 0x00f0
#define IEEE80211_FCTL_TYPE (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)
#define IEEE80211_FCTL_TODS 0x0100
#define IEEE80211_FCTL_FROMDS 0x0200
#define IEEE80211_FCTL_MOREFRAGS 0x0400

7
net/mac80211/agg-rx.c
View File

@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
* Copyright (C) 2018-2024 Intel Corporation
* Copyright (C) 2018-2025 Intel Corporation
*/
/**
@@ -206,7 +206,10 @@ u8 ieee80211_retrieve_addba_ext_data(struct sta_info *sta,
if (elem_len <= 0)
return 0;
elems = ieee802_11_parse_elems(elem_data, elem_len, true, NULL);
elems = ieee802_11_parse_elems(elem_data, elem_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems || elems->parse_error || !elems->addba_ext_ie)
goto free;

14
net/mac80211/ibss.c
View File

@@ -9,7 +9,7 @@
* Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright(c) 2016 Intel Deutschland GmbH
* Copyright(c) 2018-2024 Intel Corporation
* Copyright(c) 2018-2025 Intel Corporation
*/
#include <linux/delay.h>
@@ -1554,6 +1554,7 @@ void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
{
size_t baselen;
struct ieee802_11_elems *elems;
u16 type;
BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) !=
offsetof(typeof(mgmt->u.beacon), variable));
@@ -1566,8 +1567,9 @@ void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
if (baselen > len)
return;
type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE;
elems = ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
len - baselen, false, NULL);
len - baselen, type, NULL);
if (elems) {
ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, elems);
@@ -1616,9 +1618,11 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
if (ies_len < 0)
break;
elems = ieee802_11_parse_elems(
mgmt->u.action.u.chan_switch.variable,
ies_len, true, NULL);
elems = ieee802_11_parse_elems(mgmt->u.action.u.chan_switch.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (elems && !elems->parse_error)
ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt,

21
net/mac80211/ieee80211_i.h
View File

@@ -2422,7 +2422,8 @@ static inline void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata,
* @mode: connection mode for parsing
* @start: pointer to the elements
* @len: length of the elements
* @action: %true if the elements came from an action frame
* @type: type of the frame the elements came from
* (action, probe response, beacon, etc.)
* @filter: bitmap of element IDs to filter out while calculating
* the element CRC
* @crc: CRC starting value
@@ -2440,7 +2441,7 @@ struct ieee80211_elems_parse_params {
enum ieee80211_conn_mode mode;
const u8 *start;
size_t len;
bool action;
u8 type;
u64 filter;
u32 crc;
struct cfg80211_bss *bss;
@@ -2452,17 +2453,14 @@ struct ieee802_11_elems *
ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params);
static inline struct ieee802_11_elems *
ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
u64 filter, u32 crc,
struct cfg80211_bss *bss)
ieee802_11_parse_elems(const u8 *start, size_t len, u8 type,
struct cfg80211_bss *bss)
{
struct ieee80211_elems_parse_params params = {
.mode = IEEE80211_CONN_MODE_HIGHEST,
.start = start,
.len = len,
.action = action,
.filter = filter,
.crc = crc,
.type = type,
.bss = bss,
.link_id = -1,
};
@@ -2470,13 +2468,6 @@ ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
return ieee802_11_parse_elems_full(&params);
}
static inline struct ieee802_11_elems *
ieee802_11_parse_elems(const u8 *start, size_t len, bool action,
struct cfg80211_bss *bss)
{
return ieee802_11_parse_elems_crc(start, len, action, 0, 0, bss);
}
extern const int ieee802_1d_to_ac[8];
static inline int ieee80211_ac_from_tid(int tid)

26
net/mac80211/mesh.c
View File

@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
* Copyright (C) 2018 - 2024 Intel Corporation
* Copyright (C) 2018 - 2025 Intel Corporation
* Authors: Luis Carlos Cobo <luisca@cozybit.com>
* Javier Cardona <javier@cozybit.com>
*/
@@ -1410,7 +1410,10 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
if (baselen > len)
return;
elems = ieee802_11_parse_elems(pos, len - baselen, false, NULL);
elems = ieee802_11_parse_elems(pos, len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_PROBE_REQ,
NULL);
if (!elems)
return;
@@ -1455,11 +1458,11 @@ free:
}
static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
u16 stype,
struct ieee80211_mgmt *mgmt,
size_t len,
struct ieee80211_rx_status *rx_status)
{
u16 type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE;
struct ieee80211_local *local = sdata->local;
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
struct ieee802_11_elems *elems;
@@ -1469,7 +1472,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
enum nl80211_band band = rx_status->band;
/* ignore ProbeResp to foreign address */
if (stype == IEEE80211_STYPE_PROBE_RESP &&
if (type == (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP) &&
!ether_addr_equal(mgmt->da, sdata->vif.addr))
return;
@@ -1478,8 +1481,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
return;
elems = ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
len - baselen,
false, NULL);
len - baselen, type, NULL);
if (!elems)
return;
@@ -1514,7 +1516,9 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
}
if (ifmsh->sync_ops)
ifmsh->sync_ops->rx_bcn_presp(sdata, stype, mgmt, len,
ifmsh->sync_ops->rx_bcn_presp(sdata,
type & IEEE80211_FCTL_STYPE,
mgmt, len,
elems->mesh_config, rx_status);
free:
kfree(elems);
@@ -1622,7 +1626,10 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
pos = mgmt->u.action.u.chan_switch.variable;
baselen = offsetof(struct ieee80211_mgmt,
u.action.u.chan_switch.variable);
elems = ieee802_11_parse_elems(pos, len - baselen, true, NULL);
elems = ieee802_11_parse_elems(pos, len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems)
return;
@@ -1699,8 +1706,7 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
switch (stype) {
case IEEE80211_STYPE_PROBE_RESP:
case IEEE80211_STYPE_BEACON:
ieee80211_mesh_rx_bcn_presp(sdata, stype, mgmt, skb->len,
rx_status);
ieee80211_mesh_rx_bcn_presp(sdata, mgmt, skb->len, rx_status);
break;
case IEEE80211_STYPE_PROBE_REQ:
ieee80211_mesh_rx_probe_req(sdata, mgmt, skb->len);

7
net/mac80211/mesh_hwmp.c
View File

@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
* Copyright (C) 2019, 2021-2023 Intel Corporation
* Copyright (C) 2019, 2021-2023, 2025 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com>
*/
@@ -951,7 +951,10 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
elems = ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
len - baselen, false, NULL);
len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems)
return;

7
net/mac80211/mesh_plink.c
View File

@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
* Copyright (C) 2019, 2021-2024 Intel Corporation
* Copyright (C) 2019, 2021-2025 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com>
*/
#include <linux/gfp.h>
@@ -1248,7 +1248,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
if (baselen > len)
return;
}
elems = ieee802_11_parse_elems(baseaddr, len - baselen, true, NULL);
elems = ieee802_11_parse_elems(baseaddr, len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (elems) {
mesh_process_plink_frame(sdata, mgmt, elems, rx_status);
kfree(elems);

45
net/mac80211/mlme.c
View File

@@ -999,6 +999,9 @@ ieee80211_determine_chan_mode(struct ieee80211_sub_if_data *sdata,
.from_ap = true,
.start = ies->data,
.len = ies->len,
.type = ies->from_beacon ?
IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON :
IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP,
};
struct ieee802_11_elems *elems;
struct ieee80211_supported_band *sband;
@@ -5177,7 +5180,9 @@ static void ieee80211_epcs_teardown(struct ieee80211_sub_if_data *sdata)
continue;
}
elems = ieee802_11_parse_elems(ies->data, ies->len, false,
elems = ieee802_11_parse_elems(ies->data, ies->len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_BEACON,
NULL);
if (!elems) {
rcu_read_unlock();
@@ -5223,6 +5228,7 @@ static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
.len = elem_len,
.link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
.from_ap = true,
.type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE,
};
bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
@@ -6356,6 +6362,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
.bss = NULL,
.link_id = -1,
.from_ap = true,
.type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE,
};
struct ieee802_11_elems *elems;
int ac;
@@ -7264,7 +7271,9 @@ ieee80211_mgd_check_cross_link_csa(struct ieee80211_sub_if_data *sdata,
(prof->sta_info_len - 1),
len -
(prof->sta_info_len - 1),
false, NULL);
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_BEACON,
NULL);
/* memory allocation failed - let's hope that's transient */
if (!prof_elems)
@@ -7368,6 +7377,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
.mode = link->u.mgd.conn.mode,
.link_id = -1,
.from_ap = true,
.type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE,
};
lockdep_assert_wiphy(local->hw.wiphy);
@@ -7970,7 +7980,10 @@ void ieee80211_process_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
ies_len = len - offsetof(struct ieee80211_mgmt,
u.action.u.ttlm_req.variable);
elems = ieee802_11_parse_elems(mgmt->u.action.u.ttlm_req.variable,
ies_len, true, NULL);
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems) {
ttlm_res = NEG_TTLM_RES_REJECT;
goto out;
@@ -8176,9 +8189,11 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
break;
/* CSA IE cannot be overridden, no need for BSSID */
elems = ieee802_11_parse_elems(
mgmt->u.action.u.chan_switch.variable,
ies_len, true, NULL);
elems = ieee802_11_parse_elems(mgmt->u.action.u.chan_switch.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (elems && !elems->parse_error) {
enum ieee80211_csa_source src =
@@ -8205,9 +8220,11 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
* extended CSA IE can't be overridden, no need for
* BSSID
*/
elems = ieee802_11_parse_elems(
mgmt->u.action.u.ext_chan_switch.variable,
ies_len, true, NULL);
elems = ieee802_11_parse_elems(mgmt->u.action.u.ext_chan_switch.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (elems && !elems->parse_error) {
enum ieee80211_csa_source src;
@@ -10985,7 +11002,10 @@ static void ieee80211_ml_epcs(struct ieee80211_sub_if_data *sdata,
pos = scratch + sizeof(control);
len -= sizeof(control);
link_elems = ieee802_11_parse_elems(pos, len, false, NULL);
link_elems = ieee802_11_parse_elems(pos, len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!link_elems)
continue;
@@ -11036,7 +11056,10 @@ void ieee80211_process_epcs_ena_resp(struct ieee80211_sub_if_data *sdata,
u.action.u.epcs.variable) -
IEEE80211_EPCS_ENA_RESP_BODY_LEN;
elems = ieee802_11_parse_elems(pos, ies_len, true, NULL);
elems = ieee802_11_parse_elems(pos, ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems)
return;

30
net/mac80211/parse.c
View File

@@ -6,7 +6,7 @@
* Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright (C) 2015-2017 Intel Deutschland GmbH
* Copyright (C) 2018-2024 Intel Corporation
* Copyright (C) 2018-2025 Intel Corporation
*
* element parsing for mac80211
*/
@@ -286,6 +286,24 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
bitmap_zero(seen_elems, 256);
switch (params->type) {
/* we don't need to parse assoc request, luckily (it's value 0) */
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_REQ:
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_REQ:
default:
WARN(1, "invalid frame type 0x%x for element parsing\n",
params->type);
break;
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_RESP:
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_RESP:
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ:
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP:
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON:
case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION:
case IEEE80211_FTYPE_EXT | IEEE80211_STYPE_S1G_BEACON:
break;
}
for_each_element(elem, params->start, params->len) {
const struct element *subelem;
u8 elem_parse_failed;
@@ -566,7 +584,8 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
if (params->mode < IEEE80211_CONN_MODE_VHT)
break;
if (!params->action) {
if (params->type != (IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION)) {
elem_parse_failed =
IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
break;
@@ -582,7 +601,8 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
if (params->mode < IEEE80211_CONN_MODE_VHT)
break;
if (params->action) {
if (params->type == (IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION)) {
elem_parse_failed =
IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
break;
@@ -942,7 +962,7 @@ ieee80211_prep_mle_link_parse(struct ieee80211_elems_parse *elems_parse,
sub->len = end - sub->start;
sub->mode = params->mode;
sub->action = params->action;
sub->type = params->type;
sub->from_ap = params->from_ap;
sub->link_id = -1;
@@ -1041,7 +1061,7 @@ ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
sub.start = elems_parse->scratch_pos;
sub.mode = params->mode;
sub.len = nontx_len;
sub.action = params->action;
sub.type = params->type;
sub.link_id = params->link_id;
/* consume the space used for non-transmitted profile */

6
net/mac80211/scan.c
View File

@@ -76,7 +76,11 @@ void ieee80211_inform_bss(struct wiphy *wiphy,
if (!update_data)
return;
elems = ieee802_11_parse_elems(ies->data, ies->len, false, NULL);
elems = ieee802_11_parse_elems(ies->data, ies->len,
update_data->beacon ?
IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON :
IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP,
NULL);
if (!elems)
return;

12
net/mac80211/tdls.c
View File

@@ -6,7 +6,7 @@
* Copyright 2014, Intel Corporation
* Copyright 2014 Intel Mobile Communications GmbH
* Copyright 2015 - 2016 Intel Deutschland GmbH
* Copyright (C) 2019, 2021-2024 Intel Corporation
* Copyright (C) 2019, 2021-2025 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -1783,7 +1783,10 @@ ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata,
}
elems = ieee802_11_parse_elems(tf->u.chan_switch_resp.variable,
skb->len - baselen, false, NULL);
skb->len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems) {
ret = -ENOMEM;
goto out;
@@ -1902,7 +1905,10 @@ ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
}
elems = ieee802_11_parse_elems(tf->u.chan_switch_req.variable,
skb->len - baselen, false, NULL);
skb->len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
NULL);
if (!elems)
return -ENOMEM;

4
net/mac80211/tests/elems.c
View File

@@ -2,7 +2,7 @@
/*
* KUnit tests for element parsing
*
* Copyright (C) 2023-2024 Intel Corporation
* Copyright (C) 2023-2025 Intel Corporation
*/
#include <kunit/test.h>
#include "../ieee80211_i.h"
@@ -15,6 +15,8 @@ static void mle_defrag(struct kunit *test)
.link_id = 12,
.from_ap = true,
.mode = IEEE80211_CONN_MODE_EHT,
/* type is not really relevant here */
.type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON,
};
struct ieee802_11_elems *parsed;
struct sk_buff *skb;