1 files changed, 156 insertions, 110 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 07bd8db00af8..9f7fb4eec37b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -20,7 +20,6 @@
 #include <linux/bitmap.h>
 #include <linux/rcupdate.h>
 #include <linux/export.h>
-#include <linux/time.h>
 #include <net/net_namespace.h>
 #include <net/ieee80211_radiotap.h>
 #include <net/cfg80211.h>
@@ -595,23 +594,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         else if (!is_multicast_ether_addr(hdr->addr1) &&
                  (key = rcu_dereference(tx->sdata->default_unicast_key)))
                 tx->key = key;
-        else if (info->flags & IEEE80211_TX_CTL_INJECTED)
-                tx->key = NULL;
-        else if (!tx->sdata->drop_unencrypted)
-                tx->key = NULL;
-        else if (tx->skb->protocol == tx->sdata->control_port_protocol)
-                tx->key = NULL;
-        else if (ieee80211_is_robust_mgmt_frame(tx->skb) &&
-                 !(ieee80211_is_action(hdr->frame_control) &&
-                   tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
-                tx->key = NULL;
-        else if (ieee80211_is_mgmt(hdr->frame_control) &&
-                 !ieee80211_is_robust_mgmt_frame(tx->skb))
+        else
                 tx->key = NULL;
-        else {
-                I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
-                return TX_DROP;
-        }
 
         if (tx->key) {
                 bool skip_hw = false;
@@ -1137,11 +1121,13 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
 
 /*
  * initialises @tx
+ * pass %NULL for the station if unknown, a valid pointer if known
+ * or an ERR_PTR() if the station is known not to exist
  */
 static ieee80211_tx_result
 ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                      struct ieee80211_tx_data *tx,
-                     struct sk_buff *skb)
+                     struct sta_info *sta, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
@@ -1164,17 +1150,22 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         hdr = (struct ieee80211_hdr *) skb->data;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
-                tx->sta = rcu_dereference(sdata->u.vlan.sta);
-                if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
-                        return TX_DROP;
-        } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
-                                  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
-                   tx->sdata->control_port_protocol == tx->skb->protocol) {
-                tx->sta = sta_info_get_bss(sdata, hdr->addr1);
+        if (likely(sta)) {
+                if (!IS_ERR(sta))
+                        tx->sta = sta;
+        } else {
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                        tx->sta = rcu_dereference(sdata->u.vlan.sta);
+                        if (!tx->sta && sdata->wdev.use_4addr)
+                                return TX_DROP;
+                } else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                                          IEEE80211_TX_CTL_INJECTED) ||
+                           tx->sdata->control_port_protocol == tx->skb->protocol) {
+                        tx->sta = sta_info_get_bss(sdata, hdr->addr1);
+                }
+                if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
+                        tx->sta = sta_info_get(sdata, hdr->addr1);
         }
-        if (!tx->sta)
-                tx->sta = sta_info_get(sdata, hdr->addr1);
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
             !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
@@ -1422,8 +1413,9 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_data tx;
+        struct sk_buff *skb2;
 
-        if (ieee80211_tx_prepare(sdata, &tx, skb) == TX_DROP)
+        if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
                 return false;
 
         info->band = band;
@@ -1440,6 +1432,14 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
                         *sta = NULL;
         }
 
+        /* this function isn't suitable for fragmented data frames */
+        skb2 = __skb_dequeue(&tx.skbs);
+        if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
+                ieee80211_free_txskb(hw, skb2);
+                ieee80211_purge_tx_queue(hw, &tx.skbs);
+                return false;
+        }
+
         return true;
 }
 EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
@@ -1448,7 +1448,8 @@ EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
  * Returns false if the frame couldn't be transmitted but was queued instead.
  */
 static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
-                         struct sk_buff *skb, bool txpending)
+                         struct sta_info *sta, struct sk_buff *skb,
+                         bool txpending)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_data tx;
@@ -1464,7 +1465,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
 
         /* initialises tx */
         led_len = skb->len;
-        res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
+        res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
 
         if (unlikely(res_prepare == TX_DROP)) {
                 ieee80211_free_txskb(&local->hw, skb);
@@ -1520,7 +1521,8 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
+void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+                    struct sta_info *sta, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1555,7 +1557,7 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         }
 
         ieee80211_set_qos_hdr(sdata, skb);
-        ieee80211_tx(sdata, skb, false);
+        ieee80211_tx(sdata, sta, skb, false);
 }
 
 static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
@@ -1776,7 +1778,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                 goto fail_rcu;
 
         info->band = chandef->chan->band;
-        ieee80211_xmit(sdata, skb);
+        ieee80211_xmit(sdata, NULL, skb);
         rcu_read_unlock();
 
         return NETDEV_TX_OK;
@@ -1788,21 +1790,89 @@ fail:
         return NETDEV_TX_OK; /* meaning, we dealt with the skb */
 }
 
-/*
- * Measure Tx frame arrival time for Tx latency statistics calculation
- * A single Tx frame latency should be measured from when it is entering the
- * Kernel until we receive Tx complete confirmation indication and the skb is
- * freed.
- */
-static void ieee80211_tx_latency_start_msrmnt(struct ieee80211_local *local,
-                                              struct sk_buff *skb)
+static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
 {
-        struct ieee80211_tx_latency_bin_ranges *tx_latency;
+        u16 ethertype = (skb->data[12] << 8) | skb->data[13];
 
-        tx_latency = rcu_dereference(local->tx_latency);
-        if (!tx_latency)
-                return;
-        skb->tstamp = ktime_get();
+        return ethertype == ETH_P_TDLS &&
+               skb->len > 14 &&
+               skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
+}
+
+static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
+                                   struct sk_buff *skb,
+                                   struct sta_info **sta_out)
+{
+        struct sta_info *sta;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP_VLAN:
+                sta = rcu_dereference(sdata->u.vlan.sta);
+                if (sta) {
+                        *sta_out = sta;
+                        return 0;
+                } else if (sdata->wdev.use_4addr) {
+                        return -ENOLINK;
+                }
+                /* fall through */
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_OCB:
+        case NL80211_IFTYPE_ADHOC:
+                if (is_multicast_ether_addr(skb->data)) {
+                        *sta_out = ERR_PTR(-ENOENT);
+                        return 0;
+                }
+                sta = sta_info_get_bss(sdata, skb->data);
+                break;
+        case NL80211_IFTYPE_WDS:
+                sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
+                break;
+#ifdef CONFIG_MAC80211_MESH
+        case NL80211_IFTYPE_MESH_POINT:
+                /* determined much later */
+                *sta_out = NULL;
+                return 0;
+#endif
+        case NL80211_IFTYPE_STATION:
+                if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
+                        sta = sta_info_get(sdata, skb->data);
+                        if (sta) {
+                                bool tdls_peer, tdls_auth;
+
+                                tdls_peer = test_sta_flag(sta,
+                                                          WLAN_STA_TDLS_PEER);
+                                tdls_auth = test_sta_flag(sta,
+                                                WLAN_STA_TDLS_PEER_AUTH);
+
+                                if (tdls_peer && tdls_auth) {
+                                        *sta_out = sta;
+                                        return 0;
+                                }
+
+                                /*
+                                 * TDLS link during setup - throw out frames to
+                                 * peer. Allow TDLS-setup frames to unauthorized
+                                 * peers for the special case of a link teardown
+                                 * after a TDLS sta is removed due to being
+                                 * unreachable.
+                                 */
+                                if (tdls_peer && !tdls_auth &&
+                                    !ieee80211_is_tdls_setup(skb))
+                                        return -EINVAL;
+                        }
+
+                }
+
+                sta = sta_info_get(sdata, sdata->u.mgd.bssid);
+                if (!sta)
+                        return -ENOLINK;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        *sta_out = sta ?: ERR_PTR(-ENOENT);
+        return 0;
 }
 
 /**
@@ -1824,7 +1894,8 @@ static void ieee80211_tx_latency_start_msrmnt(struct ieee80211_local *local,
  * Returns: the (possibly reallocated) skb or an ERR_PTR() code
  */
 static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
-                                           struct sk_buff *skb, u32 info_flags)
+                                           struct sk_buff *skb, u32 info_flags,
+                                           struct sta_info *sta)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info;
@@ -1837,9 +1908,8 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
         const u8 *encaps_data;
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
-        struct sta_info *sta = NULL;
-        bool wme_sta = false, authorized = false, tdls_auth = false;
-        bool tdls_peer = false, tdls_setup_frame = false;
+        bool wme_sta = false, authorized = false;
+        bool tdls_peer;
         bool multicast;
         u16 info_id = 0;
         struct ieee80211_chanctx_conf *chanctx_conf;
@@ -1847,6 +1917,9 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
         enum ieee80211_band band;
         int ret;
 
+        if (IS_ERR(sta))
+                sta = NULL;
+
         /* convert Ethernet header to proper 802.11 header (based on
          * operation mode) */
         ethertype = (skb->data[12] << 8) | skb->data[13];
@@ -1854,8 +1927,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
-                sta = rcu_dereference(sdata->u.vlan.sta);
-                if (sta) {
+                if (sdata->wdev.use_4addr) {
                         fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                         /* RA TA DA SA */
                         memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
@@ -1874,7 +1946,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
                         goto free;
                 }
                 band = chanctx_conf->def.chan->band;
-                if (sta)
+                if (sdata->wdev.use_4addr)
                         break;
                 /* fall through */
         case NL80211_IFTYPE_AP:
@@ -1978,38 +2050,10 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
-                if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
-                        sta = sta_info_get(sdata, skb->data);
-                        if (sta) {
-                                authorized = test_sta_flag(sta,
-                                                        WLAN_STA_AUTHORIZED);
-                                wme_sta = sta->sta.wme;
-                                tdls_peer = test_sta_flag(sta,
-                                                          WLAN_STA_TDLS_PEER);
-                                tdls_auth = test_sta_flag(sta,
-                                                WLAN_STA_TDLS_PEER_AUTH);
-                        }
-
-                        if (tdls_peer)
-                                tdls_setup_frame =
-                                        ethertype == ETH_P_TDLS &&
-                                        skb->len > 14 &&
-                                        skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
-                }
+                /* we already did checks when looking up the RA STA */
+                tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
 
-                /*
-                 * TDLS link during setup - throw out frames to peer. We allow
-                 * TDLS-setup frames to unauthorized peers for the special case
-                 * of a link teardown after a TDLS sta is removed due to being
-                 * unreachable.
-                 */
-                if (tdls_peer && !tdls_auth && !tdls_setup_frame) {
-                        ret = -EINVAL;
-                        goto free;
-                }
-
-                /* send direct packets to authorized TDLS peers */
-                if (tdls_peer && tdls_auth) {
+                if (tdls_peer) {
                         /* DA SA BSSID */
                         memcpy(hdr.addr1, skb->data, ETH_ALEN);
                         memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
@@ -2071,26 +2115,19 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
                 goto free;
         }
 
-        /*
-         * There's no need to try to look up the destination
-         * if it is a multicast address (which can only happen
-         * in AP mode)
-         */
         multicast = is_multicast_ether_addr(hdr.addr1);
-        if (!multicast) {
-                sta = sta_info_get(sdata, hdr.addr1);
-                if (sta) {
-                        authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-                        wme_sta = sta->sta.wme;
-                }
-        }
 
-        /* For mesh, the use of the QoS header is mandatory */
-        if (ieee80211_vif_is_mesh(&sdata->vif))
+        /* sta is always NULL for mesh */
+        if (sta) {
+                authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                wme_sta = sta->sta.wme;
+        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                /* For mesh, the use of the QoS header is mandatory */
                 wme_sta = true;
+        }
 
-        /* receiver and we are QoS enabled, use a QoS type frame */
-        if (wme_sta && local->hw.queues >= IEEE80211_NUM_ACS) {
+        /* receiver does QoS (which also means we do) use it */
+        if (wme_sta) {
                 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
@@ -2260,7 +2297,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
                                   u32 info_flags)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
 
         if (unlikely(skb->len < ETH_HLEN)) {
                 kfree_skb(skb);
@@ -2269,10 +2306,12 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
 
         rcu_read_lock();
 
-        /* Measure frame arrival for Tx latency statistics calculation */
-        ieee80211_tx_latency_start_msrmnt(local, skb);
+        if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
+                kfree_skb(skb);
+                goto out;
+        }
 
-        skb = ieee80211_build_hdr(sdata, skb, info_flags);
+        skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
         if (IS_ERR(skb))
                 goto out;
 
@@ -2280,7 +2319,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
         dev->stats.tx_bytes += skb->len;
         dev->trans_start = jiffies;
 
-        ieee80211_xmit(sdata, skb);
+        ieee80211_xmit(sdata, sta, skb);
  out:
         rcu_read_unlock();
 }
@@ -2308,10 +2347,17 @@ ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
                 .local = sdata->local,
                 .sdata = sdata,
         };
+        struct sta_info *sta;
 
         rcu_read_lock();
 
-        skb = ieee80211_build_hdr(sdata, skb, info_flags);
+        if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
+                kfree_skb(skb);
+                skb = ERR_PTR(-EINVAL);
+                goto out;
+        }
+
+        skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
         if (IS_ERR(skb))
                 goto out;
 
@@ -2369,7 +2415,7 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
                         return true;
                 }
                 info->band = chanctx_conf->def.chan->band;
-                result = ieee80211_tx(sdata, skb, true);
+                result = ieee80211_tx(sdata, NULL, skb, true);
         } else {
                 struct sk_buff_head skbs;
 
@@ -3107,7 +3153,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 
                 if (sdata->vif.type == NL80211_IFTYPE_AP)
                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
-                if (!ieee80211_tx_prepare(sdata, &tx, skb))
+                if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
                         break;
                 dev_kfree_skb_any(skb);
         }
@@ -3239,6 +3285,6 @@ void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
          */
         local_bh_disable();
         IEEE80211_SKB_CB(skb)->band = band;
-        ieee80211_xmit(sdata, skb);
+        ieee80211_xmit(sdata, NULL, skb);
         local_bh_enable();
 }