wifi: cfg80211: Fix use after free for wext
[linux-block.git] / net / mac80211 / link.c
CommitLineData
e73b5e51
JB
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * MLO link handling
4 *
5 * Copyright (C) 2022 Intel Corporation
6 */
7#include <linux/slab.h>
8#include <linux/kernel.h>
9#include <net/mac80211.h>
10#include "ieee80211_i.h"
11#include "driver-ops.h"
3d901102 12#include "key.h"
e73b5e51
JB
13
14void ieee80211_link_setup(struct ieee80211_link_data *link)
15{
16 if (link->sdata->vif.type == NL80211_IFTYPE_STATION)
17 ieee80211_mgd_setup_link(link);
18}
19
20void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
21 int link_id,
22 struct ieee80211_link_data *link,
23 struct ieee80211_bss_conf *link_conf)
24{
25 bool deflink = link_id < 0;
26
27 if (link_id < 0)
28 link_id = 0;
29
30 rcu_assign_pointer(sdata->vif.link_conf[link_id], link_conf);
31 rcu_assign_pointer(sdata->link[link_id], link);
32
33 link->sdata = sdata;
34 link->link_id = link_id;
35 link->conf = link_conf;
36 link_conf->link_id = link_id;
37
38 INIT_WORK(&link->csa_finalize_work,
39 ieee80211_csa_finalize_work);
40 INIT_WORK(&link->color_change_finalize_work,
41 ieee80211_color_change_finalize_work);
42 INIT_LIST_HEAD(&link->assigned_chanctx_list);
43 INIT_LIST_HEAD(&link->reserved_chanctx_list);
44 INIT_DELAYED_WORK(&link->dfs_cac_timer_work,
45 ieee80211_dfs_cac_timer_work);
46
47 if (!deflink) {
48 switch (sdata->vif.type) {
49 case NL80211_IFTYPE_AP:
50 ether_addr_copy(link_conf->addr,
51 sdata->wdev.links[link_id].addr);
52 link_conf->bssid = link_conf->addr;
53 WARN_ON(!(sdata->wdev.valid_links & BIT(link_id)));
54 break;
55 case NL80211_IFTYPE_STATION:
56 /* station sets the bssid in ieee80211_mgd_setup_link */
57 break;
58 default:
59 WARN_ON(1);
60 }
61 }
62}
63
64void ieee80211_link_stop(struct ieee80211_link_data *link)
65{
66 if (link->sdata->vif.type == NL80211_IFTYPE_STATION)
67 ieee80211_mgd_stop_link(link);
68
69 ieee80211_link_release_channel(link);
70}
71
72struct link_container {
73 struct ieee80211_link_data data;
74 struct ieee80211_bss_conf conf;
75};
76
efe9c2bf
JB
77static void ieee80211_tear_down_links(struct ieee80211_sub_if_data *sdata,
78 struct link_container **links, u16 mask)
e73b5e51 79{
efe9c2bf 80 struct ieee80211_link_data *link;
e73b5e51
JB
81 LIST_HEAD(keys);
82 unsigned int link_id;
83
84 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
efe9c2bf
JB
85 if (!(mask & BIT(link_id)))
86 continue;
87 link = &links[link_id]->data;
88 if (link_id == 0 && !link)
89 link = &sdata->deflink;
90 if (WARN_ON(!link))
e73b5e51 91 continue;
efe9c2bf
JB
92 ieee80211_remove_link_keys(link, &keys);
93 ieee80211_link_stop(link);
e73b5e51
JB
94 }
95
96 synchronize_rcu();
97
98 ieee80211_free_key_list(sdata->local, &keys);
efe9c2bf 99}
e73b5e51 100
efe9c2bf
JB
101static void ieee80211_free_links(struct ieee80211_sub_if_data *sdata,
102 struct link_container **links)
103{
104 unsigned int link_id;
105
106 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++)
e73b5e51 107 kfree(links[link_id]);
e73b5e51
JB
108}
109
110static int ieee80211_check_dup_link_addrs(struct ieee80211_sub_if_data *sdata)
111{
112 unsigned int i, j;
113
114 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
115 struct ieee80211_link_data *link1;
116
117 link1 = sdata_dereference(sdata->link[i], sdata);
118 if (!link1)
119 continue;
120 for (j = i + 1; j < IEEE80211_MLD_MAX_NUM_LINKS; j++) {
121 struct ieee80211_link_data *link2;
122
123 link2 = sdata_dereference(sdata->link[j], sdata);
124 if (!link2)
125 continue;
126
127 if (ether_addr_equal(link1->conf->addr,
128 link2->conf->addr))
129 return -EALREADY;
130 }
131 }
132
133 return 0;
134}
135
efe9c2bf
JB
136static void ieee80211_set_vif_links_bitmaps(struct ieee80211_sub_if_data *sdata,
137 u16 links)
138{
139 sdata->vif.valid_links = links;
140
141 if (!links) {
142 sdata->vif.active_links = 0;
143 return;
144 }
145
146 switch (sdata->vif.type) {
147 case NL80211_IFTYPE_AP:
148 /* in an AP all links are always active */
149 sdata->vif.active_links = links;
150 break;
151 case NL80211_IFTYPE_STATION:
152 if (sdata->vif.active_links)
153 break;
154 WARN_ON(hweight16(links) > 1);
155 sdata->vif.active_links = links;
156 break;
157 default:
158 WARN_ON(1);
159 }
160}
161
e73b5e51
JB
162static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,
163 struct link_container **to_free,
164 u16 new_links)
165{
166 u16 old_links = sdata->vif.valid_links;
efe9c2bf 167 u16 old_active = sdata->vif.active_links;
e73b5e51
JB
168 unsigned long add = new_links & ~old_links;
169 unsigned long rem = old_links & ~new_links;
170 unsigned int link_id;
171 int ret;
172 struct link_container *links[IEEE80211_MLD_MAX_NUM_LINKS] = {}, *link;
173 struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS];
174 struct ieee80211_link_data *old_data[IEEE80211_MLD_MAX_NUM_LINKS];
175 bool use_deflink = old_links == 0; /* set for error case */
176
177 sdata_assert_lock(sdata);
178
179 memset(to_free, 0, sizeof(links));
180
181 if (old_links == new_links)
182 return 0;
183
184 /* if there were no old links, need to clear the pointers to deflink */
185 if (!old_links)
186 rem |= BIT(0);
187
188 /* allocate new link structures first */
189 for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
190 link = kzalloc(sizeof(*link), GFP_KERNEL);
191 if (!link) {
192 ret = -ENOMEM;
193 goto free;
194 }
195 links[link_id] = link;
196 }
197
198 /* keep track of the old pointers for the driver */
199 BUILD_BUG_ON(sizeof(old) != sizeof(sdata->vif.link_conf));
200 memcpy(old, sdata->vif.link_conf, sizeof(old));
201 /* and for us in error cases */
202 BUILD_BUG_ON(sizeof(old_data) != sizeof(sdata->link));
203 memcpy(old_data, sdata->link, sizeof(old_data));
204
205 /* grab old links to free later */
206 for_each_set_bit(link_id, &rem, IEEE80211_MLD_MAX_NUM_LINKS) {
207 if (rcu_access_pointer(sdata->link[link_id]) != &sdata->deflink) {
208 /*
209 * we must have allocated the data through this path so
210 * we know we can free both at the same time
211 */
212 to_free[link_id] = container_of(rcu_access_pointer(sdata->link[link_id]),
213 typeof(*links[link_id]),
214 data);
215 }
216
217 RCU_INIT_POINTER(sdata->link[link_id], NULL);
218 RCU_INIT_POINTER(sdata->vif.link_conf[link_id], NULL);
219 }
220
221 /* link them into data structures */
222 for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
223 WARN_ON(!use_deflink &&
224 rcu_access_pointer(sdata->link[link_id]) == &sdata->deflink);
225
226 link = links[link_id];
227 ieee80211_link_init(sdata, link_id, &link->data, &link->conf);
228 ieee80211_link_setup(&link->data);
229 }
230
231 if (new_links == 0)
232 ieee80211_link_init(sdata, -1, &sdata->deflink,
233 &sdata->vif.bss_conf);
234
e73b5e51
JB
235 ret = ieee80211_check_dup_link_addrs(sdata);
236 if (!ret) {
efe9c2bf
JB
237 /* for keys we will not be able to undo this */
238 ieee80211_tear_down_links(sdata, to_free, rem);
239
240 ieee80211_set_vif_links_bitmaps(sdata, new_links);
241
e73b5e51
JB
242 /* tell the driver */
243 ret = drv_change_vif_links(sdata->local, sdata,
efe9c2bf
JB
244 old_links & old_active,
245 new_links & sdata->vif.active_links,
e73b5e51
JB
246 old);
247 }
248
249 if (ret) {
250 /* restore config */
251 memcpy(sdata->link, old_data, sizeof(old_data));
252 memcpy(sdata->vif.link_conf, old, sizeof(old));
efe9c2bf 253 ieee80211_set_vif_links_bitmaps(sdata, old_links);
e73b5e51
JB
254 /* and free (only) the newly allocated links */
255 memset(to_free, 0, sizeof(links));
256 goto free;
257 }
258
259 /* use deflink/bss_conf again if and only if there are no more links */
260 use_deflink = new_links == 0;
261
262 goto deinit;
263free:
264 /* if we failed during allocation, only free all */
265 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
266 kfree(links[link_id]);
267 links[link_id] = NULL;
268 }
269deinit:
270 if (use_deflink)
271 ieee80211_link_init(sdata, -1, &sdata->deflink,
272 &sdata->vif.bss_conf);
273 return ret;
274}
275
276int ieee80211_vif_set_links(struct ieee80211_sub_if_data *sdata,
277 u16 new_links)
278{
279 struct link_container *links[IEEE80211_MLD_MAX_NUM_LINKS];
280 int ret;
281
282 ret = ieee80211_vif_update_links(sdata, links, new_links);
283 ieee80211_free_links(sdata, links);
284
285 return ret;
286}
287
288void ieee80211_vif_clear_links(struct ieee80211_sub_if_data *sdata)
289{
290 struct link_container *links[IEEE80211_MLD_MAX_NUM_LINKS];
291
292 /*
293 * The locking here is different because when we free links
294 * in the station case we need to be able to cancel_work_sync()
295 * something that also takes the lock.
296 */
297
298 sdata_lock(sdata);
299 ieee80211_vif_update_links(sdata, links, 0);
300 sdata_unlock(sdata);
301
302 ieee80211_free_links(sdata, links);
303}
3d901102
JB
304
305static int _ieee80211_set_active_links(struct ieee80211_sub_if_data *sdata,
306 u16 active_links)
307{
308 struct ieee80211_bss_conf *link_confs[IEEE80211_MLD_MAX_NUM_LINKS];
309 struct ieee80211_local *local = sdata->local;
310 u16 old_active = sdata->vif.active_links;
311 unsigned long rem = old_active & ~active_links;
312 unsigned long add = active_links & ~old_active;
313 struct sta_info *sta;
314 unsigned int link_id;
315 int ret, i;
316
317 if (!ieee80211_sdata_running(sdata))
318 return -ENETDOWN;
319
320 if (sdata->vif.type != NL80211_IFTYPE_STATION)
321 return -EINVAL;
322
323 /* cannot activate links that don't exist */
324 if (active_links & ~sdata->vif.valid_links)
325 return -EINVAL;
326
327 /* nothing to do */
328 if (old_active == active_links)
329 return 0;
330
331 for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
332 link_confs[i] = sdata_dereference(sdata->vif.link_conf[i],
333 sdata);
334
335 if (add) {
336 sdata->vif.active_links |= active_links;
337 ret = drv_change_vif_links(local, sdata,
338 old_active,
339 sdata->vif.active_links,
340 link_confs);
341 if (ret) {
342 sdata->vif.active_links = old_active;
343 return ret;
344 }
345 }
346
347 for_each_set_bit(link_id, &rem, IEEE80211_MLD_MAX_NUM_LINKS) {
348 struct ieee80211_link_data *link;
349
350 link = sdata_dereference(sdata->link[link_id], sdata);
351
352 /* FIXME: kill TDLS connections on the link */
353
354 ieee80211_link_release_channel(link);
355 }
356
357 list_for_each_entry(sta, &local->sta_list, list) {
358 if (sdata != sta->sdata)
359 continue;
9b41a9d7
JB
360
361 /* this is very temporary, but do it anyway */
362 __ieee80211_sta_recalc_aggregates(sta,
363 old_active | active_links);
364
3d901102
JB
365 ret = drv_change_sta_links(local, sdata, &sta->sta,
366 old_active,
367 old_active | active_links);
368 WARN_ON_ONCE(ret);
369 }
370
371 ret = ieee80211_key_switch_links(sdata, rem, add);
372 WARN_ON_ONCE(ret);
373
374 list_for_each_entry(sta, &local->sta_list, list) {
375 if (sdata != sta->sdata)
376 continue;
9b41a9d7
JB
377
378 __ieee80211_sta_recalc_aggregates(sta, active_links);
379
3d901102
JB
380 ret = drv_change_sta_links(local, sdata, &sta->sta,
381 old_active | active_links,
382 active_links);
383 WARN_ON_ONCE(ret);
9b41a9d7
JB
384
385 /*
386 * Do it again, just in case - the driver might very
387 * well have called ieee80211_sta_recalc_aggregates()
388 * from there when filling in the new links, which
389 * would set it wrong since the vif's active links are
390 * not switched yet...
391 */
392 __ieee80211_sta_recalc_aggregates(sta, active_links);
3d901102
JB
393 }
394
395 for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
396 struct ieee80211_link_data *link;
397
398 link = sdata_dereference(sdata->link[link_id], sdata);
399
400 ret = ieee80211_link_use_channel(link, &link->conf->chandef,
401 IEEE80211_CHANCTX_SHARED);
402 WARN_ON_ONCE(ret);
403
404 ieee80211_link_info_change_notify(sdata, link,
405 BSS_CHANGED_ERP_CTS_PROT |
406 BSS_CHANGED_ERP_PREAMBLE |
407 BSS_CHANGED_ERP_SLOT |
408 BSS_CHANGED_HT |
409 BSS_CHANGED_BASIC_RATES |
410 BSS_CHANGED_BSSID |
411 BSS_CHANGED_CQM |
412 BSS_CHANGED_QOS |
413 BSS_CHANGED_TXPOWER |
414 BSS_CHANGED_BANDWIDTH |
415 BSS_CHANGED_TWT |
416 BSS_CHANGED_HE_OBSS_PD |
417 BSS_CHANGED_HE_BSS_COLOR);
418 ieee80211_mgd_set_link_qos_params(link);
419 }
420
421 old_active = sdata->vif.active_links;
422 sdata->vif.active_links = active_links;
423
424 if (rem) {
425 ret = drv_change_vif_links(local, sdata, old_active,
426 active_links, link_confs);
427 WARN_ON_ONCE(ret);
428 }
429
430 return 0;
431}
432
433int ieee80211_set_active_links(struct ieee80211_vif *vif, u16 active_links)
434{
435 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
436 struct ieee80211_local *local = sdata->local;
437 u16 old_active;
438 int ret;
439
440 sdata_lock(sdata);
441 mutex_lock(&local->sta_mtx);
442 mutex_lock(&local->mtx);
443 mutex_lock(&local->key_mtx);
444 old_active = sdata->vif.active_links;
445 if (old_active & active_links) {
446 /*
447 * if there's at least one link that stays active across
448 * the change then switch to it (to those) first, and
449 * then enable the additional links
450 */
451 ret = _ieee80211_set_active_links(sdata,
452 old_active & active_links);
453 if (!ret)
454 ret = _ieee80211_set_active_links(sdata, active_links);
455 } else {
456 /* otherwise switch directly */
457 ret = _ieee80211_set_active_links(sdata, active_links);
458 }
459 mutex_unlock(&local->key_mtx);
460 mutex_unlock(&local->mtx);
461 mutex_unlock(&local->sta_mtx);
462 sdata_unlock(sdata);
463
464 return ret;
465}
466EXPORT_SYMBOL_GPL(ieee80211_set_active_links);
467
468void ieee80211_set_active_links_async(struct ieee80211_vif *vif,
469 u16 active_links)
470{
471 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
472
473 if (!ieee80211_sdata_running(sdata))
474 return;
475
476 if (sdata->vif.type != NL80211_IFTYPE_STATION)
477 return;
478
479 /* cannot activate links that don't exist */
480 if (active_links & ~sdata->vif.valid_links)
481 return;
482
483 /* nothing to do */
484 if (sdata->vif.active_links == active_links)
485 return;
486
487 sdata->desired_active_links = active_links;
488 schedule_work(&sdata->activate_links_work);
489}
490EXPORT_SYMBOL_GPL(ieee80211_set_active_links_async);