]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/wireless/util.c
iwmc3200wifi: fix a use-after-free bug
[mirror_ubuntu-bionic-kernel.git] / net / wireless / util.c
CommitLineData
8318d78a
JB
1/*
2 * Wireless utility functions
3 *
d3236553 4 * Copyright 2007-2009 Johannes Berg <johannes@sipsolutions.net>
8318d78a 5 */
d3236553 6#include <linux/bitops.h>
e31a16d6 7#include <linux/etherdevice.h>
d3236553 8#include <net/cfg80211.h>
e31a16d6 9#include <net/ip.h>
8318d78a
JB
10#include "core.h"
11
bd815252
JB
12struct ieee80211_rate *
13ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
881d948c 14 u32 basic_rates, int bitrate)
bd815252
JB
15{
16 struct ieee80211_rate *result = &sband->bitrates[0];
17 int i;
18
19 for (i = 0; i < sband->n_bitrates; i++) {
20 if (!(basic_rates & BIT(i)))
21 continue;
22 if (sband->bitrates[i].bitrate > bitrate)
23 continue;
24 result = &sband->bitrates[i];
25 }
26
27 return result;
28}
29EXPORT_SYMBOL(ieee80211_get_response_rate);
30
8318d78a
JB
31int ieee80211_channel_to_frequency(int chan)
32{
33 if (chan < 14)
34 return 2407 + chan * 5;
35
36 if (chan == 14)
37 return 2484;
38
39 /* FIXME: 802.11j 17.3.8.3.2 */
40 return (chan + 1000) * 5;
41}
42EXPORT_SYMBOL(ieee80211_channel_to_frequency);
43
44int ieee80211_frequency_to_channel(int freq)
45{
46 if (freq == 2484)
47 return 14;
48
49 if (freq < 2484)
50 return (freq - 2407) / 5;
51
52 /* FIXME: 802.11j 17.3.8.3.2 */
53 return freq/5 - 1000;
54}
55EXPORT_SYMBOL(ieee80211_frequency_to_channel);
56
6c507cd0
JB
57struct ieee80211_channel *__ieee80211_get_channel(struct wiphy *wiphy,
58 int freq)
906c730a
JB
59{
60 enum ieee80211_band band;
61 struct ieee80211_supported_band *sband;
62 int i;
63
64 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
65 sband = wiphy->bands[band];
66
67 if (!sband)
68 continue;
69
70 for (i = 0; i < sband->n_channels; i++) {
71 if (sband->channels[i].center_freq == freq)
72 return &sband->channels[i];
73 }
74 }
75
76 return NULL;
77}
6c507cd0 78EXPORT_SYMBOL(__ieee80211_get_channel);
906c730a 79
8318d78a
JB
80static void set_mandatory_flags_band(struct ieee80211_supported_band *sband,
81 enum ieee80211_band band)
82{
83 int i, want;
84
85 switch (band) {
86 case IEEE80211_BAND_5GHZ:
87 want = 3;
88 for (i = 0; i < sband->n_bitrates; i++) {
89 if (sband->bitrates[i].bitrate == 60 ||
90 sband->bitrates[i].bitrate == 120 ||
91 sband->bitrates[i].bitrate == 240) {
92 sband->bitrates[i].flags |=
93 IEEE80211_RATE_MANDATORY_A;
94 want--;
95 }
96 }
97 WARN_ON(want);
98 break;
99 case IEEE80211_BAND_2GHZ:
100 want = 7;
101 for (i = 0; i < sband->n_bitrates; i++) {
102 if (sband->bitrates[i].bitrate == 10) {
103 sband->bitrates[i].flags |=
104 IEEE80211_RATE_MANDATORY_B |
105 IEEE80211_RATE_MANDATORY_G;
106 want--;
107 }
108
109 if (sband->bitrates[i].bitrate == 20 ||
110 sband->bitrates[i].bitrate == 55 ||
111 sband->bitrates[i].bitrate == 110 ||
112 sband->bitrates[i].bitrate == 60 ||
113 sband->bitrates[i].bitrate == 120 ||
114 sband->bitrates[i].bitrate == 240) {
115 sband->bitrates[i].flags |=
116 IEEE80211_RATE_MANDATORY_G;
117 want--;
118 }
119
aac09fbf
JB
120 if (sband->bitrates[i].bitrate != 10 &&
121 sband->bitrates[i].bitrate != 20 &&
122 sband->bitrates[i].bitrate != 55 &&
123 sband->bitrates[i].bitrate != 110)
8318d78a
JB
124 sband->bitrates[i].flags |=
125 IEEE80211_RATE_ERP_G;
126 }
406f2388 127 WARN_ON(want != 0 && want != 3 && want != 6);
8318d78a
JB
128 break;
129 case IEEE80211_NUM_BANDS:
130 WARN_ON(1);
131 break;
132 }
133}
134
135void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
136{
137 enum ieee80211_band band;
138
139 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
140 if (wiphy->bands[band])
141 set_mandatory_flags_band(wiphy->bands[band], band);
142}
08645126 143
fffd0934
JB
144int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
145 struct key_params *params, int key_idx,
08645126
JB
146 const u8 *mac_addr)
147{
fffd0934
JB
148 int i;
149
08645126
JB
150 if (key_idx > 5)
151 return -EINVAL;
152
153 /*
154 * Disallow pairwise keys with non-zero index unless it's WEP
155 * (because current deployments use pairwise WEP keys with
156 * non-zero indizes but 802.11i clearly specifies to use zero)
157 */
158 if (mac_addr && key_idx &&
159 params->cipher != WLAN_CIPHER_SUITE_WEP40 &&
160 params->cipher != WLAN_CIPHER_SUITE_WEP104)
161 return -EINVAL;
162
08645126
JB
163 switch (params->cipher) {
164 case WLAN_CIPHER_SUITE_WEP40:
8fc0fee0 165 if (params->key_len != WLAN_KEY_LEN_WEP40)
08645126
JB
166 return -EINVAL;
167 break;
168 case WLAN_CIPHER_SUITE_TKIP:
8fc0fee0 169 if (params->key_len != WLAN_KEY_LEN_TKIP)
08645126
JB
170 return -EINVAL;
171 break;
172 case WLAN_CIPHER_SUITE_CCMP:
8fc0fee0 173 if (params->key_len != WLAN_KEY_LEN_CCMP)
08645126
JB
174 return -EINVAL;
175 break;
176 case WLAN_CIPHER_SUITE_WEP104:
8fc0fee0 177 if (params->key_len != WLAN_KEY_LEN_WEP104)
08645126
JB
178 return -EINVAL;
179 break;
180 case WLAN_CIPHER_SUITE_AES_CMAC:
8fc0fee0 181 if (params->key_len != WLAN_KEY_LEN_AES_CMAC)
08645126
JB
182 return -EINVAL;
183 break;
184 default:
185 return -EINVAL;
186 }
187
9f26a952
JM
188 if (params->seq) {
189 switch (params->cipher) {
190 case WLAN_CIPHER_SUITE_WEP40:
191 case WLAN_CIPHER_SUITE_WEP104:
192 /* These ciphers do not use key sequence */
193 return -EINVAL;
194 case WLAN_CIPHER_SUITE_TKIP:
195 case WLAN_CIPHER_SUITE_CCMP:
196 case WLAN_CIPHER_SUITE_AES_CMAC:
197 if (params->seq_len != 6)
198 return -EINVAL;
199 break;
200 }
201 }
202
fffd0934
JB
203 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
204 if (params->cipher == rdev->wiphy.cipher_suites[i])
205 break;
206 if (i == rdev->wiphy.n_cipher_suites)
207 return -EINVAL;
208
08645126
JB
209 return 0;
210}
e31a16d6
ZY
211
212/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
213/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
214const unsigned char rfc1042_header[] __aligned(2) =
215 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
216EXPORT_SYMBOL(rfc1042_header);
217
218/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
219const unsigned char bridge_tunnel_header[] __aligned(2) =
220 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
221EXPORT_SYMBOL(bridge_tunnel_header);
222
223unsigned int ieee80211_hdrlen(__le16 fc)
224{
225 unsigned int hdrlen = 24;
226
227 if (ieee80211_is_data(fc)) {
228 if (ieee80211_has_a4(fc))
229 hdrlen = 30;
230 if (ieee80211_is_data_qos(fc))
231 hdrlen += IEEE80211_QOS_CTL_LEN;
232 goto out;
233 }
234
235 if (ieee80211_is_ctl(fc)) {
236 /*
237 * ACK and CTS are 10 bytes, all others 16. To see how
238 * to get this condition consider
239 * subtype mask: 0b0000000011110000 (0x00F0)
240 * ACK subtype: 0b0000000011010000 (0x00D0)
241 * CTS subtype: 0b0000000011000000 (0x00C0)
242 * bits that matter: ^^^ (0x00E0)
243 * value of those: 0b0000000011000000 (0x00C0)
244 */
245 if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
246 hdrlen = 10;
247 else
248 hdrlen = 16;
249 }
250out:
251 return hdrlen;
252}
253EXPORT_SYMBOL(ieee80211_hdrlen);
254
255unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
256{
257 const struct ieee80211_hdr *hdr =
258 (const struct ieee80211_hdr *)skb->data;
259 unsigned int hdrlen;
260
261 if (unlikely(skb->len < 10))
262 return 0;
263 hdrlen = ieee80211_hdrlen(hdr->frame_control);
264 if (unlikely(hdrlen > skb->len))
265 return 0;
266 return hdrlen;
267}
268EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
269
60fd2b67 270static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
e31a16d6
ZY
271{
272 int ae = meshhdr->flags & MESH_FLAGS_AE;
273 /* 7.1.3.5a.2 */
274 switch (ae) {
275 case 0:
276 return 6;
277 case 1:
278 return 12;
279 case 2:
280 return 18;
281 case 3:
282 return 24;
283 default:
284 return 6;
285 }
286}
287
288int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
289 enum nl80211_iftype iftype)
290{
291 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
292 u16 hdrlen, ethertype;
293 u8 *payload;
294 u8 dst[ETH_ALEN];
295 u8 src[ETH_ALEN] __aligned(2);
296
297 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
298 return -1;
299
300 hdrlen = ieee80211_hdrlen(hdr->frame_control);
301
302 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
303 * header
304 * IEEE 802.11 address fields:
305 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
306 * 0 0 DA SA BSSID n/a
307 * 0 1 DA BSSID SA n/a
308 * 1 0 BSSID SA DA n/a
309 * 1 1 RA TA DA SA
310 */
311 memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
312 memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
313
314 switch (hdr->frame_control &
315 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
316 case cpu_to_le16(IEEE80211_FCTL_TODS):
317 if (unlikely(iftype != NL80211_IFTYPE_AP &&
318 iftype != NL80211_IFTYPE_AP_VLAN))
319 return -1;
320 break;
321 case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
322 if (unlikely(iftype != NL80211_IFTYPE_WDS &&
323 iftype != NL80211_IFTYPE_MESH_POINT))
324 return -1;
325 if (iftype == NL80211_IFTYPE_MESH_POINT) {
326 struct ieee80211s_hdr *meshdr =
327 (struct ieee80211s_hdr *) (skb->data + hdrlen);
328 hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
329 if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
330 memcpy(dst, meshdr->eaddr1, ETH_ALEN);
331 memcpy(src, meshdr->eaddr2, ETH_ALEN);
332 }
333 }
334 break;
335 case cpu_to_le16(IEEE80211_FCTL_FROMDS):
336 if (iftype != NL80211_IFTYPE_STATION ||
337 (is_multicast_ether_addr(dst) &&
338 !compare_ether_addr(src, addr)))
339 return -1;
340 break;
341 case cpu_to_le16(0):
342 if (iftype != NL80211_IFTYPE_ADHOC)
343 return -1;
344 break;
345 }
346
347 if (unlikely(skb->len - hdrlen < 8))
348 return -1;
349
350 payload = skb->data + hdrlen;
351 ethertype = (payload[6] << 8) | payload[7];
352
353 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
354 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
355 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
356 /* remove RFC1042 or Bridge-Tunnel encapsulation and
357 * replace EtherType */
358 skb_pull(skb, hdrlen + 6);
359 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
360 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
361 } else {
362 struct ethhdr *ehdr;
363 __be16 len;
364
365 skb_pull(skb, hdrlen);
366 len = htons(skb->len);
367 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
368 memcpy(ehdr->h_dest, dst, ETH_ALEN);
369 memcpy(ehdr->h_source, src, ETH_ALEN);
370 ehdr->h_proto = len;
371 }
372 return 0;
373}
374EXPORT_SYMBOL(ieee80211_data_to_8023);
375
376int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
377 enum nl80211_iftype iftype, u8 *bssid, bool qos)
378{
379 struct ieee80211_hdr hdr;
380 u16 hdrlen, ethertype;
381 __le16 fc;
382 const u8 *encaps_data;
383 int encaps_len, skip_header_bytes;
384 int nh_pos, h_pos;
385 int head_need;
386
387 if (unlikely(skb->len < ETH_HLEN))
388 return -EINVAL;
389
390 nh_pos = skb_network_header(skb) - skb->data;
391 h_pos = skb_transport_header(skb) - skb->data;
392
393 /* convert Ethernet header to proper 802.11 header (based on
394 * operation mode) */
395 ethertype = (skb->data[12] << 8) | skb->data[13];
396 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
397
398 switch (iftype) {
399 case NL80211_IFTYPE_AP:
400 case NL80211_IFTYPE_AP_VLAN:
401 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
402 /* DA BSSID SA */
403 memcpy(hdr.addr1, skb->data, ETH_ALEN);
404 memcpy(hdr.addr2, addr, ETH_ALEN);
405 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
406 hdrlen = 24;
407 break;
408 case NL80211_IFTYPE_STATION:
409 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
410 /* BSSID SA DA */
411 memcpy(hdr.addr1, bssid, ETH_ALEN);
412 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
413 memcpy(hdr.addr3, skb->data, ETH_ALEN);
414 hdrlen = 24;
415 break;
416 case NL80211_IFTYPE_ADHOC:
417 /* DA SA BSSID */
418 memcpy(hdr.addr1, skb->data, ETH_ALEN);
419 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
420 memcpy(hdr.addr3, bssid, ETH_ALEN);
421 hdrlen = 24;
422 break;
423 default:
424 return -EOPNOTSUPP;
425 }
426
427 if (qos) {
428 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
429 hdrlen += 2;
430 }
431
432 hdr.frame_control = fc;
433 hdr.duration_id = 0;
434 hdr.seq_ctrl = 0;
435
436 skip_header_bytes = ETH_HLEN;
437 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
438 encaps_data = bridge_tunnel_header;
439 encaps_len = sizeof(bridge_tunnel_header);
440 skip_header_bytes -= 2;
441 } else if (ethertype > 0x600) {
442 encaps_data = rfc1042_header;
443 encaps_len = sizeof(rfc1042_header);
444 skip_header_bytes -= 2;
445 } else {
446 encaps_data = NULL;
447 encaps_len = 0;
448 }
449
450 skb_pull(skb, skip_header_bytes);
451 nh_pos -= skip_header_bytes;
452 h_pos -= skip_header_bytes;
453
454 head_need = hdrlen + encaps_len - skb_headroom(skb);
455
456 if (head_need > 0 || skb_cloned(skb)) {
457 head_need = max(head_need, 0);
458 if (head_need)
459 skb_orphan(skb);
460
461 if (pskb_expand_head(skb, head_need, 0, GFP_ATOMIC)) {
462 printk(KERN_ERR "failed to reallocate Tx buffer\n");
463 return -ENOMEM;
464 }
465 skb->truesize += head_need;
466 }
467
468 if (encaps_data) {
469 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
470 nh_pos += encaps_len;
471 h_pos += encaps_len;
472 }
473
474 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
475
476 nh_pos += hdrlen;
477 h_pos += hdrlen;
478
479 /* Update skb pointers to various headers since this modified frame
480 * is going to go through Linux networking code that may potentially
481 * need things like pointer to IP header. */
482 skb_set_mac_header(skb, 0);
483 skb_set_network_header(skb, nh_pos);
484 skb_set_transport_header(skb, h_pos);
485
486 return 0;
487}
488EXPORT_SYMBOL(ieee80211_data_from_8023);
489
490/* Given a data frame determine the 802.1p/1d tag to use. */
491unsigned int cfg80211_classify8021d(struct sk_buff *skb)
492{
493 unsigned int dscp;
494
495 /* skb->priority values from 256->263 are magic values to
496 * directly indicate a specific 802.1d priority. This is used
497 * to allow 802.1d priority to be passed directly in from VLAN
498 * tags, etc.
499 */
500 if (skb->priority >= 256 && skb->priority <= 263)
501 return skb->priority - 256;
502
503 switch (skb->protocol) {
504 case htons(ETH_P_IP):
505 dscp = ip_hdr(skb)->tos & 0xfc;
506 break;
507 default:
508 return 0;
509 }
510
511 return dscp >> 5;
512}
513EXPORT_SYMBOL(cfg80211_classify8021d);
517357c6
JB
514
515const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie)
516{
517 u8 *end, *pos;
518
519 pos = bss->information_elements;
520 if (pos == NULL)
521 return NULL;
522 end = pos + bss->len_information_elements;
523
524 while (pos + 1 < end) {
525 if (pos + 2 + pos[1] > end)
526 break;
527 if (pos[0] == ie)
528 return pos;
529 pos += 2 + pos[1];
530 }
531
532 return NULL;
533}
534EXPORT_SYMBOL(ieee80211_bss_get_ie);
fffd0934
JB
535
536void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
537{
538 struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
539 struct net_device *dev = wdev->netdev;
540 int i;
541
542 if (!wdev->connect_keys)
543 return;
544
545 for (i = 0; i < 6; i++) {
546 if (!wdev->connect_keys->params[i].cipher)
547 continue;
548 if (rdev->ops->add_key(wdev->wiphy, dev, i, NULL,
549 &wdev->connect_keys->params[i]))
550 printk(KERN_ERR "%s: failed to set key %d\n",
551 dev->name, i);
552 if (wdev->connect_keys->def == i)
553 if (rdev->ops->set_default_key(wdev->wiphy, dev, i))
554 printk(KERN_ERR "%s: failed to set defkey %d\n",
555 dev->name, i);
556 if (wdev->connect_keys->defmgmt == i)
557 if (rdev->ops->set_default_mgmt_key(wdev->wiphy, dev, i))
558 printk(KERN_ERR "%s: failed to set mgtdef %d\n",
559 dev->name, i);
560 }
561
562 kfree(wdev->connect_keys);
563 wdev->connect_keys = NULL;
564}