parse.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright 2002-2005, Instant802 Networks, Inc.
   4 * Copyright 2005-2006, Devicescape Software, Inc.
   5 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
   6 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
   7 * Copyright 2013-2014  Intel Mobile Communications GmbH
   8 * Copyright (C) 2015-2017	Intel Deutschland GmbH
   9 * Copyright (C) 2018-2025 Intel Corporation
  10 *
  11 * element parsing for mac80211
  12 */
  13
  14#include <net/mac80211.h>
  15#include <linux/netdevice.h>
  16#include <linux/export.h>
  17#include <linux/types.h>
  18#include <linux/slab.h>
  19#include <linux/skbuff.h>
  20#include <linux/etherdevice.h>
  21#include <linux/if_arp.h>
  22#include <linux/bitmap.h>
  23#include <linux/crc32.h>
  24#include <net/net_namespace.h>
  25#include <net/cfg80211.h>
  26#include <net/rtnetlink.h>
  27#include <kunit/visibility.h>
  28
  29#include "ieee80211_i.h"
  30#include "driver-ops.h"
  31#include "rate.h"
  32#include "mesh.h"
  33#include "wme.h"
  34#include "led.h"
  35#include "wep.h"
  36
  37struct ieee80211_elems_parse {
  38	/* must be first for kfree to work */
  39	struct ieee802_11_elems elems;
  40
  41	/* The basic Multi-Link element in the original elements */
  42	const struct element *ml_basic_elem;
  43
  44	/* The reconfiguration Multi-Link element in the original elements */
  45	const struct element *ml_reconf_elem;
  46
  47	/* The EPCS Multi-Link element in the original elements */
  48	const struct element *ml_epcs_elem;
  49
  50	bool multi_link_inner;
  51	bool skip_vendor;
  52
  53	/*
  54	 * scratch buffer that can be used for various element parsing related
  55	 * tasks, e.g., element de-fragmentation etc.
  56	 */
  57	size_t scratch_len;
  58	u8 *scratch_pos;
  59	u8 scratch[] __counted_by(scratch_len);
  60};
  61
  62static void
  63ieee80211_parse_extension_element(u32 *crc,
  64				  const struct element *elem,
  65				  struct ieee80211_elems_parse *elems_parse,
  66				  struct ieee80211_elems_parse_params *params)
  67{
  68	struct ieee802_11_elems *elems = &elems_parse->elems;
  69	const void *data = elem->data + 1;
  70	bool calc_crc = false;
  71	u8 len;
  72
  73	if (!elem->datalen)
  74		return;
  75
  76	len = elem->datalen - 1;
  77
  78	switch (elem->data[0]) {
  79	case WLAN_EID_EXT_HE_MU_EDCA:
  80		if (params->mode < IEEE80211_CONN_MODE_HE)
  81			break;
  82		calc_crc = true;
  83		if (len >= sizeof(*elems->mu_edca_param_set))
  84			elems->mu_edca_param_set = data;
  85		break;
  86	case WLAN_EID_EXT_HE_CAPABILITY:
  87		if (params->mode < IEEE80211_CONN_MODE_HE)
  88			break;
  89		if (ieee80211_he_capa_size_ok(data, len)) {
  90			elems->he_cap = data;
  91			elems->he_cap_len = len;
  92		}
  93		break;
  94	case WLAN_EID_EXT_HE_OPERATION:
  95		if (params->mode < IEEE80211_CONN_MODE_HE)
  96			break;
  97		calc_crc = true;
  98		if (len >= sizeof(*elems->he_operation) &&
  99		    len >= ieee80211_he_oper_size(data) - 1)
 100			elems->he_operation = data;
 101		break;
 102	case WLAN_EID_EXT_UORA:
 103		if (params->mode < IEEE80211_CONN_MODE_HE)
 104			break;
 105		if (len >= 1)
 106			elems->uora_element = data;
 107		break;
 108	case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME:
 109		if (len == 3)
 110			elems->max_channel_switch_time = data;
 111		break;
 112	case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION:
 113		if (len >= sizeof(*elems->mbssid_config_ie))
 114			elems->mbssid_config_ie = data;
 115		break;
 116	case WLAN_EID_EXT_HE_SPR:
 117		if (params->mode < IEEE80211_CONN_MODE_HE)
 118			break;
 119		if (len >= sizeof(*elems->he_spr) &&
 120		    len >= ieee80211_he_spr_size(data) - 1)
 121			elems->he_spr = data;
 122		break;
 123	case WLAN_EID_EXT_HE_6GHZ_CAPA:
 124		if (params->mode < IEEE80211_CONN_MODE_HE)
 125			break;
 126		if (len >= sizeof(*elems->he_6ghz_capa))
 127			elems->he_6ghz_capa = data;
 128		break;
 129	case WLAN_EID_EXT_EHT_CAPABILITY:
 130		if (params->mode < IEEE80211_CONN_MODE_EHT)
 131			break;
 132		if (ieee80211_eht_capa_size_ok(elems->he_cap,
 133					       data, len,
 134					       params->from_ap)) {
 135			elems->eht_cap = data;
 136			elems->eht_cap_len = len;
 137		}
 138		break;
 139	case WLAN_EID_EXT_EHT_OPERATION:
 140		if (params->mode < IEEE80211_CONN_MODE_EHT)
 141			break;
 142		if (ieee80211_eht_oper_size_ok(data, len))
 143			elems->eht_operation = data;
 144		calc_crc = true;
 145		break;
 146	case WLAN_EID_EXT_EHT_MULTI_LINK:
 147		if (params->mode < IEEE80211_CONN_MODE_EHT)
 148			break;
 149		calc_crc = true;
 150
 151		if (ieee80211_mle_size_ok(data, len)) {
 152			const struct ieee80211_multi_link_elem *mle =
 153				(void *)data;
 154
 155			switch (le16_get_bits(mle->control,
 156					      IEEE80211_ML_CONTROL_TYPE)) {
 157			case IEEE80211_ML_CONTROL_TYPE_BASIC:
 158				if (elems_parse->multi_link_inner) {
 159					elems->parse_error |=
 160						IEEE80211_PARSE_ERR_DUP_NEST_ML_BASIC;
 161					break;
 162				}
 163				break;
 164			case IEEE80211_ML_CONTROL_TYPE_RECONF:
 165				elems_parse->ml_reconf_elem = elem;
 166				break;
 167			case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
 168				elems_parse->ml_epcs_elem = elem;
 169				break;
 170			default:
 171				break;
 172			}
 173		}
 174		break;
 175	case WLAN_EID_EXT_BANDWIDTH_INDICATION:
 176		if (params->mode < IEEE80211_CONN_MODE_EHT)
 177			break;
 178		if (ieee80211_bandwidth_indication_size_ok(data, len))
 179			elems->bandwidth_indication = data;
 180		calc_crc = true;
 181		break;
 182	case WLAN_EID_EXT_TID_TO_LINK_MAPPING:
 183		if (params->mode < IEEE80211_CONN_MODE_EHT)
 184			break;
 185		calc_crc = true;
 186		if (ieee80211_tid_to_link_map_size_ok(data, len) &&
 187		    elems->ttlm_num < ARRAY_SIZE(elems->ttlm)) {
 188			elems->ttlm[elems->ttlm_num] = (void *)data;
 189			elems->ttlm_num++;
 190		}
 191		break;
 192	}
 193
 194	if (crc && calc_crc)
 195		*crc = crc32_be(*crc, (void *)elem, elem->datalen + 2);
 196}
 197
 198static void ieee80211_parse_tpe(struct ieee80211_parsed_tpe *tpe,
 199				const u8 *data, u8 len)
 200{
 201	const struct ieee80211_tx_pwr_env *env = (const void *)data;
 202	u8 count, interpret, category;
 203	u8 *out, N, *cnt_out = NULL, *N_out = NULL;
 204
 205	if (!ieee80211_valid_tpe_element(data, len))
 206		return;
 207
 208	count = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_COUNT);
 209	interpret = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_INTERPRET);
 210	category = u8_get_bits(env->info, IEEE80211_TX_PWR_ENV_INFO_CATEGORY);
 211
 212	switch (interpret) {
 213	case IEEE80211_TPE_LOCAL_EIRP:
 214		out = tpe->max_local[category].power;
 215		cnt_out = &tpe->max_local[category].count;
 216		tpe->max_local[category].valid = true;
 217		break;
 218	case IEEE80211_TPE_REG_CLIENT_EIRP:
 219		out = tpe->max_reg_client[category].power;
 220		cnt_out = &tpe->max_reg_client[category].count;
 221		tpe->max_reg_client[category].valid = true;
 222		break;
 223	case IEEE80211_TPE_LOCAL_EIRP_PSD:
 224		out = tpe->psd_local[category].power;
 225		cnt_out = &tpe->psd_local[category].count;
 226		N_out = &tpe->psd_local[category].n;
 227		tpe->psd_local[category].valid = true;
 228		break;
 229	case IEEE80211_TPE_REG_CLIENT_EIRP_PSD:
 230		out = tpe->psd_reg_client[category].power;
 231		cnt_out = &tpe->psd_reg_client[category].count;
 232		N_out = &tpe->psd_reg_client[category].n;
 233		tpe->psd_reg_client[category].valid = true;
 234		break;
 235	}
 236
 237	switch (interpret) {
 238	case IEEE80211_TPE_LOCAL_EIRP:
 239	case IEEE80211_TPE_REG_CLIENT_EIRP:
 240		/* count was validated <= 3, plus 320 MHz */
 241		BUILD_BUG_ON(IEEE80211_TPE_EIRP_ENTRIES_320MHZ < 5);
 242		memcpy(out, env->variable, count + 1);
 243		*cnt_out = count + 1;
 244		/* separately take 320 MHz if present */
 245		if (count == 3 && len > sizeof(*env) + count + 1) {
 246			out[4] = env->variable[4];
 247			*cnt_out = 5;
 248		}
 249		break;
 250	case IEEE80211_TPE_LOCAL_EIRP_PSD:
 251	case IEEE80211_TPE_REG_CLIENT_EIRP_PSD:
 252		if (!count) {
 253			memset(out, env->variable[0],
 254			       IEEE80211_TPE_PSD_ENTRIES_320MHZ);
 255			*cnt_out = IEEE80211_TPE_PSD_ENTRIES_320MHZ;
 256			break;
 257		}
 258
 259		N = 1 << (count - 1);
 260		memcpy(out, env->variable, N);
 261		*cnt_out = N;
 262		*N_out = N;
 263
 264		if (len > sizeof(*env) + N) {
 265			int K = u8_get_bits(env->variable[N],
 266					    IEEE80211_TX_PWR_ENV_EXT_COUNT);
 267
 268			K = min(K, IEEE80211_TPE_PSD_ENTRIES_320MHZ - N);
 269			memcpy(out + N, env->variable + N + 1, K);
 270			(*cnt_out) += K;
 271		}
 272		break;
 273	}
 274}
 275
 276static u32
 277_ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
 278			     struct ieee80211_elems_parse *elems_parse,
 279			     const struct element *check_inherit)
 280{
 281	struct ieee802_11_elems *elems = &elems_parse->elems;
 282	const struct element *elem;
 283	bool calc_crc = params->filter != 0;
 284	DECLARE_BITMAP(seen_elems, 256);
 285	u32 crc = params->crc;
 286
 287	bitmap_zero(seen_elems, 256);
 288
 289	switch (params->type) {
 290	/* we don't need to parse assoc request, luckily (it's value 0) */
 291	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_REQ:
 292	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_REQ:
 293	default:
 294		WARN(1, "invalid frame type 0x%x for element parsing\n",
 295		     params->type);
 296		break;
 297	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_RESP:
 298	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_RESP:
 299	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ:
 300	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP:
 301	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON:
 302	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION:
 303	case IEEE80211_FTYPE_EXT | IEEE80211_STYPE_S1G_BEACON:
 304		break;
 305	}
 306
 307	for_each_element(elem, params->start, params->len) {
 308		const struct element *subelem;
 309		u8 elem_parse_failed;
 310		u8 id = elem->id;
 311		u8 elen = elem->datalen;
 312		const u8 *pos = elem->data;
 313
 314		if (check_inherit &&
 315		    !cfg80211_is_element_inherited(elem,
 316						   check_inherit))
 317			continue;
 318
 319		switch (id) {
 320		case WLAN_EID_SSID:
 321		case WLAN_EID_SUPP_RATES:
 322		case WLAN_EID_FH_PARAMS:
 323		case WLAN_EID_DS_PARAMS:
 324		case WLAN_EID_CF_PARAMS:
 325		case WLAN_EID_TIM:
 326		case WLAN_EID_IBSS_PARAMS:
 327		case WLAN_EID_CHALLENGE:
 328		case WLAN_EID_RSN:
 329		case WLAN_EID_ERP_INFO:
 330		case WLAN_EID_EXT_SUPP_RATES:
 331		case WLAN_EID_HT_CAPABILITY:
 332		case WLAN_EID_HT_OPERATION:
 333		case WLAN_EID_VHT_CAPABILITY:
 334		case WLAN_EID_VHT_OPERATION:
 335		case WLAN_EID_MESH_ID:
 336		case WLAN_EID_MESH_CONFIG:
 337		case WLAN_EID_PEER_MGMT:
 338		case WLAN_EID_PREQ:
 339		case WLAN_EID_PREP:
 340		case WLAN_EID_PERR:
 341		case WLAN_EID_RANN:
 342		case WLAN_EID_CHANNEL_SWITCH:
 343		case WLAN_EID_EXT_CHANSWITCH_ANN:
 344		case WLAN_EID_COUNTRY:
 345		case WLAN_EID_PWR_CONSTRAINT:
 346		case WLAN_EID_TIMEOUT_INTERVAL:
 347		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
 348		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
 349		case WLAN_EID_CHAN_SWITCH_PARAM:
 350		case WLAN_EID_EXT_CAPABILITY:
 351		case WLAN_EID_CHAN_SWITCH_TIMING:
 352		case WLAN_EID_LINK_ID:
 353		case WLAN_EID_BSS_MAX_IDLE_PERIOD:
 354		case WLAN_EID_RSNX:
 355		case WLAN_EID_S1G_BCN_COMPAT:
 356		case WLAN_EID_S1G_CAPABILITIES:
 357		case WLAN_EID_S1G_OPERATION:
 358		case WLAN_EID_AID_RESPONSE:
 359		case WLAN_EID_S1G_SHORT_BCN_INTERVAL:
 360		/*
 361		 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
 362		 * that if the content gets bigger it might be needed more than once
 363		 */
 364			if (test_bit(id, seen_elems)) {
 365				elems->parse_error |=
 366					IEEE80211_PARSE_ERR_DUP_ELEM;
 367				continue;
 368			}
 369			break;
 370		}
 371
 372		if (calc_crc && id < 64 && (params->filter & (1ULL << id)))
 373			crc = crc32_be(crc, pos - 2, elen + 2);
 374
 375		elem_parse_failed = 0;
 376
 377		switch (id) {
 378		case WLAN_EID_LINK_ID:
 379			if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) {
 380				elem_parse_failed =
 381					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 382				break;
 383			}
 384			elems->lnk_id = (void *)(pos - 2);
 385			break;
 386		case WLAN_EID_CHAN_SWITCH_TIMING:
 387			if (elen < sizeof(struct ieee80211_ch_switch_timing)) {
 388				elem_parse_failed =
 389					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 390				break;
 391			}
 392			elems->ch_sw_timing = (void *)pos;
 393			break;
 394		case WLAN_EID_EXT_CAPABILITY:
 395			elems->ext_capab = pos;
 396			elems->ext_capab_len = elen;
 397			break;
 398		case WLAN_EID_SSID:
 399			elems->ssid = pos;
 400			elems->ssid_len = elen;
 401			break;
 402		case WLAN_EID_SUPP_RATES:
 403			elems->supp_rates = pos;
 404			elems->supp_rates_len = elen;
 405			break;
 406		case WLAN_EID_DS_PARAMS:
 407			if (elen >= 1)
 408				elems->ds_params = pos;
 409			else
 410				elem_parse_failed =
 411					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 412			break;
 413		case WLAN_EID_TIM:
 414			if (elen >= sizeof(struct ieee80211_tim_ie)) {
 415				elems->tim = (void *)pos;
 416				elems->tim_len = elen;
 417			} else
 418				elem_parse_failed =
 419					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 420			break;
 421		case WLAN_EID_VENDOR_SPECIFIC:
 422			if (elems_parse->skip_vendor)
 423				break;
 424
 425			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 426			    pos[2] == 0xf2) {
 427				/* Microsoft OUI (00:50:F2) */
 428
 429				if (calc_crc)
 430					crc = crc32_be(crc, pos - 2, elen + 2);
 431
 432				if (elen >= 5 && pos[3] == 2) {
 433					/* OUI Type 2 - WMM IE */
 434					if (pos[4] == 0) {
 435						elems->wmm_info = pos;
 436						elems->wmm_info_len = elen;
 437					} else if (pos[4] == 1) {
 438						elems->wmm_param = pos;
 439						elems->wmm_param_len = elen;
 440					}
 441				}
 442			}
 443			break;
 444		case WLAN_EID_RSN:
 445			elems->rsn = pos;
 446			elems->rsn_len = elen;
 447			break;
 448		case WLAN_EID_ERP_INFO:
 449			if (elen >= 1)
 450				elems->erp_info = pos;
 451			else
 452				elem_parse_failed =
 453					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 454			break;
 455		case WLAN_EID_EXT_SUPP_RATES:
 456			elems->ext_supp_rates = pos;
 457			elems->ext_supp_rates_len = elen;
 458			break;
 459		case WLAN_EID_HT_CAPABILITY:
 460			if (params->mode < IEEE80211_CONN_MODE_HT)
 461				break;
 462			if (elen >= sizeof(struct ieee80211_ht_cap))
 463				elems->ht_cap_elem = (void *)pos;
 464			else
 465				elem_parse_failed =
 466					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 467			break;
 468		case WLAN_EID_HT_OPERATION:
 469			if (params->mode < IEEE80211_CONN_MODE_HT)
 470				break;
 471			if (elen >= sizeof(struct ieee80211_ht_operation))
 472				elems->ht_operation = (void *)pos;
 473			else
 474				elem_parse_failed =
 475					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 476			break;
 477		case WLAN_EID_VHT_CAPABILITY:
 478			if (params->mode < IEEE80211_CONN_MODE_VHT)
 479				break;
 480			if (elen >= sizeof(struct ieee80211_vht_cap))
 481				elems->vht_cap_elem = (void *)pos;
 482			else
 483				elem_parse_failed =
 484					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 485			break;
 486		case WLAN_EID_VHT_OPERATION:
 487			if (params->mode < IEEE80211_CONN_MODE_VHT)
 488				break;
 489			if (elen >= sizeof(struct ieee80211_vht_operation)) {
 490				elems->vht_operation = (void *)pos;
 491				if (calc_crc)
 492					crc = crc32_be(crc, pos - 2, elen + 2);
 493				break;
 494			}
 495			elem_parse_failed =
 496				IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 497			break;
 498		case WLAN_EID_OPMODE_NOTIF:
 499			if (params->mode < IEEE80211_CONN_MODE_VHT)
 500				break;
 501			if (elen > 0) {
 502				elems->opmode_notif = pos;
 503				if (calc_crc)
 504					crc = crc32_be(crc, pos - 2, elen + 2);
 505				break;
 506			}
 507			elem_parse_failed =
 508				IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 509			break;
 510		case WLAN_EID_MESH_ID:
 511			elems->mesh_id = pos;
 512			elems->mesh_id_len = elen;
 513			break;
 514		case WLAN_EID_MESH_CONFIG:
 515			if (elen >= sizeof(struct ieee80211_meshconf_ie))
 516				elems->mesh_config = (void *)pos;
 517			else
 518				elem_parse_failed =
 519					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 520			break;
 521		case WLAN_EID_PEER_MGMT:
 522			elems->peering = pos;
 523			elems->peering_len = elen;
 524			break;
 525		case WLAN_EID_MESH_AWAKE_WINDOW:
 526			if (elen >= 2)
 527				elems->awake_window = (void *)pos;
 528			break;
 529		case WLAN_EID_PREQ:
 530			elems->preq = pos;
 531			elems->preq_len = elen;
 532			break;
 533		case WLAN_EID_PREP:
 534			elems->prep = pos;
 535			elems->prep_len = elen;
 536			break;
 537		case WLAN_EID_PERR:
 538			elems->perr = pos;
 539			elems->perr_len = elen;
 540			break;
 541		case WLAN_EID_RANN:
 542			if (elen >= sizeof(struct ieee80211_rann_ie))
 543				elems->rann = (void *)pos;
 544			else
 545				elem_parse_failed =
 546					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 547			break;
 548		case WLAN_EID_CHANNEL_SWITCH:
 549			if (elen != sizeof(struct ieee80211_channel_sw_ie)) {
 550				elem_parse_failed =
 551					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 552				break;
 553			}
 554			elems->ch_switch_ie = (void *)pos;
 555			break;
 556		case WLAN_EID_EXT_CHANSWITCH_ANN:
 557			if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
 558				elem_parse_failed =
 559					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 560				break;
 561			}
 562			elems->ext_chansw_ie = (void *)pos;
 563			break;
 564		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
 565			if (params->mode < IEEE80211_CONN_MODE_HT)
 566				break;
 567			if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
 568				elem_parse_failed =
 569					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 570				break;
 571			}
 572			elems->sec_chan_offs = (void *)pos;
 573			break;
 574		case WLAN_EID_CHAN_SWITCH_PARAM:
 575			if (elen <
 576			    sizeof(*elems->mesh_chansw_params_ie)) {
 577				elem_parse_failed =
 578					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 579				break;
 580			}
 581			elems->mesh_chansw_params_ie = (void *)pos;
 582			break;
 583		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
 584			if (params->mode < IEEE80211_CONN_MODE_VHT)
 585				break;
 586
 587			if (params->type != (IEEE80211_FTYPE_MGMT |
 588					     IEEE80211_STYPE_ACTION)) {
 589				elem_parse_failed =
 590					IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
 591				break;
 592			}
 593
 594			if (elen < sizeof(*elems->wide_bw_chansw_ie)) {
 595				elem_parse_failed =
 596					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 597				break;
 598			}
 599			elems->wide_bw_chansw_ie = (void *)pos;
 600			break;
 601		case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
 602			if (params->mode < IEEE80211_CONN_MODE_VHT)
 603				break;
 604			if (params->type == (IEEE80211_FTYPE_MGMT |
 605					     IEEE80211_STYPE_ACTION)) {
 606				elem_parse_failed =
 607					IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
 608				break;
 609			}
 610			/*
 611			 * This is a bit tricky, but as we only care about
 612			 * a few elements, parse them out manually.
 613			 */
 614			subelem = cfg80211_find_elem(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
 615						     pos, elen);
 616			if (subelem) {
 617				if (subelem->datalen >= sizeof(*elems->wide_bw_chansw_ie))
 618					elems->wide_bw_chansw_ie =
 619						(void *)subelem->data;
 620				else
 621					elem_parse_failed =
 622						IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 623			}
 624
 625			if (params->mode < IEEE80211_CONN_MODE_EHT)
 626				break;
 627
 628			subelem = cfg80211_find_ext_elem(WLAN_EID_EXT_BANDWIDTH_INDICATION,
 629							 pos, elen);
 630			if (subelem) {
 631				const void *edata = subelem->data + 1;
 632				u8 edatalen = subelem->datalen - 1;
 633
 634				if (ieee80211_bandwidth_indication_size_ok(edata,
 635									   edatalen))
 636					elems->bandwidth_indication = edata;
 637				else
 638					elem_parse_failed =
 639						IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 640			}
 641
 642			subelem = cfg80211_find_ext_elem(WLAN_EID_TX_POWER_ENVELOPE,
 643							 pos, elen);
 644			if (subelem)
 645				ieee80211_parse_tpe(&elems->csa_tpe,
 646						    subelem->data + 1,
 647						    subelem->datalen - 1);
 648			break;
 649		case WLAN_EID_COUNTRY:
 650			elems->country_elem = pos;
 651			elems->country_elem_len = elen;
 652			break;
 653		case WLAN_EID_PWR_CONSTRAINT:
 654			if (elen != 1) {
 655				elem_parse_failed =
 656					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 657				break;
 658			}
 659			elems->pwr_constr_elem = pos;
 660			break;
 661		case WLAN_EID_CISCO_VENDOR_SPECIFIC:
 662			/* Lots of different options exist, but we only care
 663			 * about the Dynamic Transmit Power Control element.
 664			 * First check for the Cisco OUI, then for the DTPC
 665			 * tag (0x00).
 666			 */
 667			if (elen < 4) {
 668				elem_parse_failed =
 669					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 670				break;
 671			}
 672
 673			if (pos[0] != 0x00 || pos[1] != 0x40 ||
 674			    pos[2] != 0x96 || pos[3] != 0x00)
 675				break;
 676
 677			if (elen != 6) {
 678				elem_parse_failed =
 679					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 680				break;
 681			}
 682
 683			if (calc_crc)
 684				crc = crc32_be(crc, pos - 2, elen + 2);
 685
 686			elems->cisco_dtpc_elem = pos;
 687			break;
 688		case WLAN_EID_ADDBA_EXT:
 689			if (elen < sizeof(struct ieee80211_addba_ext_ie)) {
 690				elem_parse_failed =
 691					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 692				break;
 693			}
 694			elems->addba_ext_ie = (void *)pos;
 695			break;
 696		case WLAN_EID_TIMEOUT_INTERVAL:
 697			if (elen >= sizeof(struct ieee80211_timeout_interval_ie))
 698				elems->timeout_int = (void *)pos;
 699			else
 700				elem_parse_failed =
 701					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 702			break;
 703		case WLAN_EID_BSS_MAX_IDLE_PERIOD:
 704			if (elen >= sizeof(*elems->max_idle_period_ie))
 705				elems->max_idle_period_ie = (void *)pos;
 706			break;
 707		case WLAN_EID_RSNX:
 708			elems->rsnx = pos;
 709			elems->rsnx_len = elen;
 710			break;
 711		case WLAN_EID_TX_POWER_ENVELOPE:
 712			if (params->mode < IEEE80211_CONN_MODE_HE)
 713				break;
 714			ieee80211_parse_tpe(&elems->tpe, pos, elen);
 715			break;
 716		case WLAN_EID_EXTENSION:
 717			ieee80211_parse_extension_element(calc_crc ?
 718								&crc : NULL,
 719							  elem, elems_parse,
 720							  params);
 721			break;
 722		case WLAN_EID_S1G_CAPABILITIES:
 723			if (params->mode != IEEE80211_CONN_MODE_S1G)
 724				break;
 725			if (elen >= sizeof(*elems->s1g_capab))
 726				elems->s1g_capab = (void *)pos;
 727			else
 728				elem_parse_failed =
 729					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 730			break;
 731		case WLAN_EID_S1G_OPERATION:
 732			if (params->mode != IEEE80211_CONN_MODE_S1G)
 733				break;
 734			if (elen == sizeof(*elems->s1g_oper))
 735				elems->s1g_oper = (void *)pos;
 736			else
 737				elem_parse_failed =
 738					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 739			break;
 740		case WLAN_EID_S1G_BCN_COMPAT:
 741			if (params->mode != IEEE80211_CONN_MODE_S1G)
 742				break;
 743			if (elen == sizeof(*elems->s1g_bcn_compat))
 744				elems->s1g_bcn_compat = (void *)pos;
 745			else
 746				elem_parse_failed =
 747					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 748			break;
 749		case WLAN_EID_AID_RESPONSE:
 750			if (params->mode != IEEE80211_CONN_MODE_S1G)
 751				break;
 752			if (elen == sizeof(struct ieee80211_aid_response_ie))
 753				elems->aid_resp = (void *)pos;
 754			else
 755				elem_parse_failed =
 756					IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
 757			break;
 758		default:
 759			break;
 760		}
 761
 762		if (elem_parse_failed)
 763			elems->parse_error |= elem_parse_failed;
 764		else
 765			__set_bit(id, seen_elems);
 766	}
 767
 768	if (!for_each_element_completed(elem, params->start, params->len))
 769		elems->parse_error |= IEEE80211_PARSE_ERR_INVALID_END;
 770
 771	return crc;
 772}
 773
 774static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
 775					    struct ieee802_11_elems *elems,
 776					    struct cfg80211_bss *bss,
 777					    u8 *nontransmitted_profile)
 778{
 779	const struct element *elem, *sub;
 780	size_t profile_len = 0;
 781
 782	if (!bss || !bss->transmitted_bss)
 783		return profile_len;
 784
 785	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
 786		if (elem->datalen < 2)
 787			continue;
 788		if (elem->data[0] < 1 || elem->data[0] > 8)
 789			continue;
 790
 791		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
 792			u8 new_bssid[ETH_ALEN];
 793			const u8 *index;
 794
 795			if (sub->id != 0 || sub->datalen < 4) {
 796				/* not a valid BSS profile */
 797				continue;
 798			}
 799
 800			if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
 801			    sub->data[1] != 2) {
 802				/* The first element of the
 803				 * Nontransmitted BSSID Profile is not
 804				 * the Nontransmitted BSSID Capability
 805				 * element.
 806				 */
 807				continue;
 808			}
 809
 810			memset(nontransmitted_profile, 0, len);
 811			profile_len = cfg80211_merge_profile(start, len,
 812							     elem,
 813							     sub,
 814							     nontransmitted_profile,
 815							     len);
 816
 817			/* found a Nontransmitted BSSID Profile */
 818			index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
 819						 nontransmitted_profile,
 820						 profile_len);
 821			if (!index || index[1] < 1 || index[2] == 0) {
 822				/* Invalid MBSSID Index element */
 823				continue;
 824			}
 825
 826			cfg80211_gen_new_bssid(bss->transmitted_bss->bssid,
 827					       elem->data[0],
 828					       index[2],
 829					       new_bssid);
 830			if (ether_addr_equal(new_bssid, bss->bssid)) {
 831				elems->bssid_index_len = index[1];
 832				elems->bssid_index = (void *)&index[2];
 833				return profile_len;
 834			}
 835		}
 836	}
 837
 838	return 0;
 839}
 840
 841static void
 842ieee80211_mle_get_sta_prof(struct ieee80211_elems_parse *elems_parse,
 843			   u8 link_id)
 844{
 845	struct ieee802_11_elems *elems = &elems_parse->elems;
 846	const struct ieee80211_multi_link_elem *ml = elems->ml_basic;
 847	ssize_t ml_len = elems->ml_basic_len;
 848	const struct element *sub;
 849
 850	for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
 851		struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
 852		ssize_t sta_prof_len;
 853		u16 control;
 854
 855		if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
 856			continue;
 857
 858		if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data,
 859							  sub->datalen))
 860			return;
 861
 862		control = le16_to_cpu(prof->control);
 863
 864		if (link_id != u16_get_bits(control,
 865					    IEEE80211_MLE_STA_CONTROL_LINK_ID))
 866			continue;
 867
 868		if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
 869			return;
 870
 871		/* the sub element can be fragmented */
 872		sta_prof_len =
 873			cfg80211_defragment_element(sub,
 874						    (u8 *)ml, ml_len,
 875						    elems_parse->scratch_pos,
 876						    elems_parse->scratch +
 877							elems_parse->scratch_len -
 878							elems_parse->scratch_pos,
 879						    IEEE80211_MLE_SUBELEM_FRAGMENT);
 880
 881		if (sta_prof_len < 0)
 882			return;
 883
 884		elems->prof = (void *)elems_parse->scratch_pos;
 885		elems->sta_prof_len = sta_prof_len;
 886		elems_parse->scratch_pos += sta_prof_len;
 887
 888		return;
 889	}
 890}
 891
 892static const struct element *
 893ieee80211_prep_mle_link_parse(struct ieee80211_elems_parse *elems_parse,
 894			      struct ieee80211_elems_parse_params *params,
 895			      struct ieee80211_elems_parse_params *sub)
 896{
 897	struct ieee802_11_elems *elems = &elems_parse->elems;
 898	struct ieee80211_mle_per_sta_profile *prof;
 899	const struct element *tmp;
 900	ssize_t ml_len;
 901	const u8 *end;
 902
 903	if (params->mode < IEEE80211_CONN_MODE_EHT)
 904		return NULL;
 905
 906	for_each_element_extid(tmp, WLAN_EID_EXT_EHT_MULTI_LINK,
 907			       elems->ie_start, elems->total_len) {
 908		const struct ieee80211_multi_link_elem *mle =
 909			(void *)tmp->data + 1;
 910
 911		if (!ieee80211_mle_size_ok(tmp->data + 1, tmp->datalen - 1))
 912			continue;
 913
 914		if (le16_get_bits(mle->control, IEEE80211_ML_CONTROL_TYPE) !=
 915		    IEEE80211_ML_CONTROL_TYPE_BASIC)
 916			continue;
 917
 918		elems_parse->ml_basic_elem = tmp;
 919		break;
 920	}
 921
 922	ml_len = cfg80211_defragment_element(elems_parse->ml_basic_elem,
 923					     elems->ie_start,
 924					     elems->total_len,
 925					     elems_parse->scratch_pos,
 926					     elems_parse->scratch +
 927						elems_parse->scratch_len -
 928						elems_parse->scratch_pos,
 929					     WLAN_EID_FRAGMENT);
 930
 931	if (ml_len < 0)
 932		return NULL;
 933
 934	elems->ml_basic = (const void *)elems_parse->scratch_pos;
 935	elems->ml_basic_len = ml_len;
 936	elems_parse->scratch_pos += ml_len;
 937
 938	if (params->link_id == -1)
 939		return NULL;
 940
 941	ieee80211_mle_get_sta_prof(elems_parse, params->link_id);
 942	prof = elems->prof;
 943
 944	if (!prof)
 945		return NULL;
 946
 947	/* check if we have the 4 bytes for the fixed part in assoc response */
 948	if (elems->sta_prof_len < sizeof(*prof) + prof->sta_info_len - 1 + 4) {
 949		elems->prof = NULL;
 950		elems->sta_prof_len = 0;
 951		return NULL;
 952	}
 953
 954	/*
 955	 * Skip the capability information and the status code that are expected
 956	 * as part of the station profile in association response frames. Note
 957	 * the -1 is because the 'sta_info_len' is accounted to as part of the
 958	 * per-STA profile, but not part of the 'u8 variable[]' portion.
 959	 */
 960	sub->start = prof->variable + prof->sta_info_len - 1 + 4;
 961	end = (const u8 *)prof + elems->sta_prof_len;
 962	sub->len = end - sub->start;
 963
 964	sub->mode = params->mode;
 965	sub->type = params->type;
 966	sub->from_ap = params->from_ap;
 967	sub->link_id = -1;
 968
 969	return cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
 970				      sub->start, sub->len);
 971}
 972
 973static void
 974ieee80211_mle_defrag_reconf(struct ieee80211_elems_parse *elems_parse)
 975{
 976	struct ieee802_11_elems *elems = &elems_parse->elems;
 977	ssize_t ml_len;
 978
 979	ml_len = cfg80211_defragment_element(elems_parse->ml_reconf_elem,
 980					     elems->ie_start,
 981					     elems->total_len,
 982					     elems_parse->scratch_pos,
 983					     elems_parse->scratch +
 984						elems_parse->scratch_len -
 985						elems_parse->scratch_pos,
 986					     WLAN_EID_FRAGMENT);
 987	if (ml_len < 0)
 988		return;
 989	elems->ml_reconf = (void *)elems_parse->scratch_pos;
 990	elems->ml_reconf_len = ml_len;
 991	elems_parse->scratch_pos += ml_len;
 992}
 993
 994static void
 995ieee80211_mle_defrag_epcs(struct ieee80211_elems_parse *elems_parse)
 996{
 997	struct ieee802_11_elems *elems = &elems_parse->elems;
 998	ssize_t ml_len;
 999
1000	ml_len = cfg80211_defragment_element(elems_parse->ml_epcs_elem,
1001					     elems->ie_start,
1002					     elems->total_len,
1003					     elems_parse->scratch_pos,
1004					     elems_parse->scratch +
1005						elems_parse->scratch_len -
1006						elems_parse->scratch_pos,
1007					     WLAN_EID_FRAGMENT);
1008	if (ml_len < 0)
1009		return;
1010	elems->ml_epcs = (void *)elems_parse->scratch_pos;
1011	elems->ml_epcs_len = ml_len;
1012	elems_parse->scratch_pos += ml_len;
1013}
1014
1015struct ieee802_11_elems *
1016ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
1017{
1018	struct ieee80211_elems_parse_params sub = {};
1019	struct ieee80211_elems_parse *elems_parse;
1020	const struct element *non_inherit = NULL;
1021	struct ieee802_11_elems *elems;
1022	size_t scratch_len = 3 * params->len;
1023	bool multi_link_inner = false;
1024
1025	BUILD_BUG_ON(offsetof(typeof(*elems_parse), elems) != 0);
1026
1027	/* cannot parse for both a specific link and non-transmitted BSS */
1028	if (WARN_ON(params->link_id >= 0 && params->bss))
1029		return NULL;
1030
1031	elems_parse = kzalloc(struct_size(elems_parse, scratch, scratch_len),
1032			      GFP_ATOMIC);
1033	if (!elems_parse)
1034		return NULL;
1035
1036	elems_parse->scratch_len = scratch_len;
1037	elems_parse->scratch_pos = elems_parse->scratch;
1038
1039	elems = &elems_parse->elems;
1040	elems->ie_start = params->start;
1041	elems->total_len = params->len;
1042
1043	/* set all TPE entries to unlimited (but invalid) */
1044	ieee80211_clear_tpe(&elems->tpe);
1045	ieee80211_clear_tpe(&elems->csa_tpe);
1046
1047	/*
1048	 * If we're looking for a non-transmitted BSS then we cannot at
1049	 * the same time be looking for a second link as the two can only
1050	 * appear in the same frame carrying info for different BSSes.
1051	 *
1052	 * In any case, we only look for one at a time, as encoded by
1053	 * the WARN_ON above.
1054	 */
1055	if (params->bss) {
1056		int nontx_len =
1057			ieee802_11_find_bssid_profile(params->start,
1058						      params->len,
1059						      elems, params->bss,
1060						      elems_parse->scratch_pos);
1061		sub.start = elems_parse->scratch_pos;
1062		sub.mode = params->mode;
1063		sub.len = nontx_len;
1064		sub.type = params->type;
1065		sub.link_id = params->link_id;
1066
1067		/* consume the space used for non-transmitted profile */
1068		elems_parse->scratch_pos += nontx_len;
1069
1070		non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1071						     sub.start, nontx_len);
1072	} else {
1073		/* must always parse to get elems_parse->ml_basic_elem */
1074		non_inherit = ieee80211_prep_mle_link_parse(elems_parse, params,
1075							    &sub);
1076		multi_link_inner = true;
1077	}
1078
1079	elems_parse->skip_vendor =
1080		cfg80211_find_elem(WLAN_EID_VENDOR_SPECIFIC,
1081				   sub.start, sub.len);
1082	elems->crc = _ieee802_11_parse_elems_full(params, elems_parse,
1083						  non_inherit);
1084
1085	/* Override with nontransmitted/per-STA profile if found */
1086	if (sub.len) {
1087		elems_parse->multi_link_inner = multi_link_inner;
1088		elems_parse->skip_vendor = false;
1089		_ieee802_11_parse_elems_full(&sub, elems_parse, NULL);
1090	}
1091
1092	ieee80211_mle_defrag_reconf(elems_parse);
1093
1094	ieee80211_mle_defrag_epcs(elems_parse);
1095
1096	if (elems->tim && !elems->parse_error) {
1097		const struct ieee80211_tim_ie *tim_ie = elems->tim;
1098
1099		elems->dtim_period = tim_ie->dtim_period;
1100		elems->dtim_count = tim_ie->dtim_count;
1101	}
1102
1103	/* Override DTIM period and count if needed */
1104	if (elems->bssid_index &&
1105	    elems->bssid_index_len >=
1106	    offsetofend(struct ieee80211_bssid_index, dtim_period))
1107		elems->dtim_period = elems->bssid_index->dtim_period;
1108
1109	if (elems->bssid_index &&
1110	    elems->bssid_index_len >=
1111	    offsetofend(struct ieee80211_bssid_index, dtim_count))
1112		elems->dtim_count = elems->bssid_index->dtim_count;
1113
1114	return elems;
1115}
1116EXPORT_SYMBOL_IF_KUNIT(ieee802_11_parse_elems_full);
1117
1118int ieee80211_parse_bitrates(enum nl80211_chan_width width,
1119			     const struct ieee80211_supported_band *sband,
1120			     const u8 *srates, int srates_len, u32 *rates)
1121{
1122	struct ieee80211_rate *br;
1123	int brate, rate, i, j, count = 0;
1124
1125	*rates = 0;
1126
1127	for (i = 0; i < srates_len; i++) {
1128		rate = srates[i] & 0x7f;
1129
1130		for (j = 0; j < sband->n_bitrates; j++) {
1131			br = &sband->bitrates[j];
1132
1133			brate = DIV_ROUND_UP(br->bitrate, 5);
1134			if (brate == rate) {
1135				*rates |= BIT(j);
1136				count++;
1137				break;
1138			}
1139		}
1140	}
1141	return count;
1142}