mac80211: add missing null return check from call to ieee80211_get_sband

[linux.git] / net / mac80211 / agg-rx.c

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 01b0dad245000405b70ca3209560ee2481450e00..4d1c335e06e57edcbbb49ca021ea717844cc281a 100644 (file)
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -178,17 +178,54 @@ static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
        rcu_read_unlock();
 }
 
-static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
+static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata,
+                                  struct sk_buff *skb,
+                                  const struct ieee80211_addba_ext_ie *req)
+{
+       struct ieee80211_supported_band *sband;
+       struct ieee80211_addba_ext_ie *resp;
+       const struct ieee80211_sta_he_cap *he_cap;
+       u8 frag_level, cap_frag_level;
+       u8 *pos;
+
+       sband = ieee80211_get_sband(sdata);
+       if (!sband)
+               return;
+       he_cap = ieee80211_get_he_iftype_cap(sband, sdata->vif.type);
+       if (!he_cap)
+               return;
+
+       pos = skb_put_zero(skb, 2 + sizeof(struct ieee80211_addba_ext_ie));
+       *pos++ = WLAN_EID_ADDBA_EXT;
+       *pos++ = sizeof(struct ieee80211_addba_ext_ie);
+       resp = (struct ieee80211_addba_ext_ie *)pos;
+       resp->data = req->data & IEEE80211_ADDBA_EXT_NO_FRAG;
+
+       frag_level = u32_get_bits(req->data,
+                                 IEEE80211_ADDBA_EXT_FRAG_LEVEL_MASK);
+       cap_frag_level = u32_get_bits(he_cap->he_cap_elem.mac_cap_info[0],
+                                     IEEE80211_HE_MAC_CAP0_DYNAMIC_FRAG_MASK);
+       if (frag_level > cap_frag_level)
+               frag_level = cap_frag_level;
+       resp->data |= u8_encode_bits(frag_level,
+                                    IEEE80211_ADDBA_EXT_FRAG_LEVEL_MASK);
+}
+
+static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
                                      u8 dialog_token, u16 status, u16 policy,
-                                     u16 buf_size, u16 timeout)
+                                     u16 buf_size, u16 timeout,
+                                     const struct ieee80211_addba_ext_ie *addbaext)
 {
+       struct ieee80211_sub_if_data *sdata = sta->sdata;
        struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
        struct ieee80211_mgmt *mgmt;
        bool amsdu = ieee80211_hw_check(&local->hw, SUPPORTS_AMSDU_IN_AMPDU);
        u16 capab;
 
-       skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+       skb = dev_alloc_skb(sizeof(*mgmt) +
+                   2 + sizeof(struct ieee80211_addba_ext_ie) +
+                   local->hw.extra_tx_headroom);
        if (!skb)
                return;
 
@@ -222,13 +259,17 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
 
+       if (sta->sta.he_cap.has_he && addbaext)
+               ieee80211_add_addbaext(sdata, skb, addbaext);
+
        ieee80211_tx_skb(sdata, skb);
 }
 
 void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
                                      u8 dialog_token, u16 timeout,
                                      u16 start_seq_num, u16 ba_policy, u16 tid,
-                                     u16 buf_size, bool tx, bool auto_seq)
+                                     u16 buf_size, bool tx, bool auto_seq,
+                                     const struct ieee80211_addba_ext_ie *addbaext)
 {
        struct ieee80211_local *local = sta->sdata->local;
        struct tid_ampdu_rx *tid_agg_rx;
@@ -410,21 +451,22 @@ void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
        }
 
        if (tx)
-               ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
+               ieee80211_send_addba_resp(sta, sta->sta.addr, tid,
                                          dialog_token, status, 1, buf_size,
-                                         timeout);
+                                         timeout, addbaext);
 }
 
 static void __ieee80211_start_rx_ba_session(struct sta_info *sta,
                                            u8 dialog_token, u16 timeout,
                                            u16 start_seq_num, u16 ba_policy,
                                            u16 tid, u16 buf_size, bool tx,
-                                           bool auto_seq)
+                                           bool auto_seq,
+                                           const struct ieee80211_addba_ext_ie *addbaext)
 {
        mutex_lock(&sta->ampdu_mlme.mtx);
        ___ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
                                         start_seq_num, ba_policy, tid,
-                                        buf_size, tx, auto_seq);
+                                        buf_size, tx, auto_seq, addbaext);
        mutex_unlock(&sta->ampdu_mlme.mtx);
 }
 
@@ -434,7 +476,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                     size_t len)
 {
        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
+       struct ieee802_11_elems elems = { 0 };
        u8 dialog_token;
+       int ies_len;
 
        /* extract session parameters from addba request frame */
        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
@@ -447,9 +491,19 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
 
+       ies_len = len - offsetof(struct ieee80211_mgmt,
+                                u.action.u.addba_req.variable);
+       if (ies_len) {
+               ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
+                                ies_len, true, &elems, mgmt->bssid, NULL);
+               if (elems.parse_error)
+                       return;
+       }
+
        __ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
                                        start_seq_num, ba_policy, tid,
-                                       buf_size, true, false);
+                                       buf_size, true, false,
+                                       elems.addba_ext_ie);
 }
 
 void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,