net/wireless/mlme.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * cfg80211 MLME SAP interface
   4  *
   5  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   6  * Copyright (c) 2015           Intel Deutschland GmbH
   7  * Copyright (C) 2019-2020, 2022 Intel Corporation
   8  */
   9
  10 #include <linux/kernel.h>
  11 #include <linux/module.h>
  12 #include <linux/etherdevice.h>
  13 #include <linux/netdevice.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/slab.h>
  16 #include <linux/wireless.h>
  17 #include <net/cfg80211.h>
  18 #include <net/iw_handler.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "rdev-ops.h"
  22
  23
  24 void cfg80211_rx_assoc_resp(struct net_device *dev,
  25                             struct cfg80211_rx_assoc_resp *data)
  26 {
  27         struct wireless_dev *wdev = dev->ieee80211_ptr;
  28         struct wiphy *wiphy = wdev->wiphy;
  29         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  30         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)data->buf;
  31         struct cfg80211_connect_resp_params cr = {
  32                 .timeout_reason = NL80211_TIMEOUT_UNSPECIFIED,
  33                 .req_ie = data->req_ies,
  34                 .req_ie_len = data->req_ies_len,
  35                 .resp_ie = mgmt->u.assoc_resp.variable,
  36                 .resp_ie_len = data->len -
  37                                offsetof(struct ieee80211_mgmt,
  38                                         u.assoc_resp.variable),
  39                 .status = le16_to_cpu(mgmt->u.assoc_resp.status_code),
  40                 .ap_mld_addr = data->ap_mld_addr,
  41         };
  42         unsigned int link_id;
  43
  44         for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
  45                 cr.links[link_id].status = data->links[link_id].status;
  46                 cr.links[link_id].bss = data->links[link_id].bss;
  47
  48                 WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS &&
  49                              (!cr.ap_mld_addr || !cr.links[link_id].bss));
  50
  51                 if (!cr.links[link_id].bss)
  52                         continue;
  53                 cr.links[link_id].bssid = data->links[link_id].bss->bssid;
  54                 cr.links[link_id].addr = data->links[link_id].addr;
  55                 /* need to have local link addresses for MLO connections */
  56                 WARN_ON(cr.ap_mld_addr &&
  57                         !is_valid_ether_addr(cr.links[link_id].addr));
  58
  59                 BUG_ON(!cr.links[link_id].bss->channel);
  60
  61                 if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) {
  62                         WARN_ON(link_id);
  63                         cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable;
  64                         cr.resp_ie_len = data->len -
  65                                          offsetof(struct ieee80211_mgmt,
  66                                                   u.s1g_assoc_resp.variable);
  67                 }
  68
  69                 if (cr.ap_mld_addr)
  70                         cr.valid_links |= BIT(link_id);
  71         }
  72
  73         trace_cfg80211_send_rx_assoc(dev, data);
  74
  75         /*
  76          * This is a bit of a hack, we don't notify userspace of
  77          * a (re-)association reply if we tried to send a reassoc
  78          * and got a reject -- we only try again with an assoc
  79          * frame instead of reassoc.
  80          */
  81         if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
  82                 for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {
  83                         struct cfg80211_bss *bss = data->links[link_id].bss;
  84
  85                         if (!bss)
  86                                 continue;
  87
  88                         cfg80211_unhold_bss(bss_from_pub(bss));
  89                         cfg80211_put_bss(wiphy, bss);
  90                 }
  91                 return;
  92         }
  93
  94         nl80211_send_rx_assoc(rdev, dev, data);
  95         /* update current_bss etc., consumes the bss reference */
  96         __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
  97 }
  98 EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
  99
 100 static void cfg80211_process_auth(struct wireless_dev *wdev,
 101                                   const u8 *buf, size_t len)
 102 {
 103         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 104
 105         nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
 106         cfg80211_sme_rx_auth(wdev, buf, len);
 107 }
 108
 109 static void cfg80211_process_deauth(struct wireless_dev *wdev,
 110                                     const u8 *buf, size_t len,
 111                                     bool reconnect)
 112 {
 113         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 114         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 115         const u8 *bssid = mgmt->bssid;
 116         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 117         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 118
 119         nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL);
 120
 121         if (!wdev->connected || !ether_addr_equal(wdev->u.client.connected_addr, bssid))
 122                 return;
 123
 124         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 125         cfg80211_sme_deauth(wdev);
 126 }
 127
 128 static void cfg80211_process_disassoc(struct wireless_dev *wdev,
 129                                       const u8 *buf, size_t len,
 130                                       bool reconnect)
 131 {
 132         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 133         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 134         const u8 *bssid = mgmt->bssid;
 135         u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 136         bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
 137
 138         nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,
 139                               GFP_KERNEL);
 140
 141         if (WARN_ON(!wdev->connected ||
 142                     !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 143                 return;
 144
 145         __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
 146         cfg80211_sme_disassoc(wdev);
 147 }
 148
 149 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 150 {
 151         struct wireless_dev *wdev = dev->ieee80211_ptr;
 152         struct ieee80211_mgmt *mgmt = (void *)buf;
 153
 154         ASSERT_WDEV_LOCK(wdev);
 155
 156         trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
 157
 158         if (WARN_ON(len < 2))
 159                 return;
 160
 161         if (ieee80211_is_auth(mgmt->frame_control))
 162                 cfg80211_process_auth(wdev, buf, len);
 163         else if (ieee80211_is_deauth(mgmt->frame_control))
 164                 cfg80211_process_deauth(wdev, buf, len, false);
 165         else if (ieee80211_is_disassoc(mgmt->frame_control))
 166                 cfg80211_process_disassoc(wdev, buf, len, false);
 167 }
 168 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
 169
 170 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 171 {
 172         struct wireless_dev *wdev = dev->ieee80211_ptr;
 173         struct wiphy *wiphy = wdev->wiphy;
 174         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 175
 176         trace_cfg80211_send_auth_timeout(dev, addr);
 177
 178         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 179         cfg80211_sme_auth_timeout(wdev);
 180 }
 181 EXPORT_SYMBOL(cfg80211_auth_timeout);
 182
 183 void cfg80211_assoc_failure(struct net_device *dev,
 184                             struct cfg80211_assoc_failure *data)
 185 {
 186         struct wireless_dev *wdev = dev->ieee80211_ptr;
 187         struct wiphy *wiphy = wdev->wiphy;
 188         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 189         const u8 *addr = data->ap_mld_addr ?: data->bss[0]->bssid;
 190         int i;
 191
 192         trace_cfg80211_send_assoc_failure(dev, data);
 193
 194         if (data->timeout) {
 195                 nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 196                 cfg80211_sme_assoc_timeout(wdev);
 197         } else {
 198                 cfg80211_sme_abandon_assoc(wdev);
 199         }
 200
 201         for (i = 0; i < ARRAY_SIZE(data->bss); i++) {
 202                 struct cfg80211_bss *bss = data->bss[i];
 203
 204                 if (!bss)
 205                         continue;
 206
 207                 cfg80211_unhold_bss(bss_from_pub(bss));
 208                 cfg80211_put_bss(wiphy, bss);
 209         }
 210 }
 211 EXPORT_SYMBOL(cfg80211_assoc_failure);
 212
 213 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,
 214                            bool reconnect)
 215 {
 216         struct wireless_dev *wdev = dev->ieee80211_ptr;
 217         struct ieee80211_mgmt *mgmt = (void *)buf;
 218
 219         ASSERT_WDEV_LOCK(wdev);
 220
 221         trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect);
 222
 223         if (WARN_ON(len < 2))
 224                 return;
 225
 226         if (ieee80211_is_deauth(mgmt->frame_control))
 227                 cfg80211_process_deauth(wdev, buf, len, reconnect);
 228         else
 229                 cfg80211_process_disassoc(wdev, buf, len, reconnect);
 230 }
 231 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
 232
 233 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 234                                   enum nl80211_key_type key_type, int key_id,
 235                                   const u8 *tsc, gfp_t gfp)
 236 {
 237         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 238         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 239 #ifdef CONFIG_CFG80211_WEXT
 240         union iwreq_data wrqu;
 241         char *buf = kmalloc(128, gfp);
 242
 243         if (buf) {
 244                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 245                         "keyid=%d %scast addr=%pM)", key_id,
 246                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 247                         addr);
 248                 memset(&wrqu, 0, sizeof(wrqu));
 249                 wrqu.data.length = strlen(buf);
 250                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 251                 kfree(buf);
 252         }
 253 #endif
 254
 255         trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
 256         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 257 }
 258 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 259
 260 /* some MLME handling for userspace SME */
 261 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 262                        struct net_device *dev,
 263                        struct cfg80211_auth_request *req)
 264 {
 265         struct wireless_dev *wdev = dev->ieee80211_ptr;
 266
 267         ASSERT_WDEV_LOCK(wdev);
 268
 269         if (!req->bss)
 270                 return -ENOENT;
 271
 272         if (req->link_id >= 0 &&
 273             !(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
 274                 return -EINVAL;
 275
 276         if (req->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
 277                 if (!req->key || !req->key_len ||
 278                     req->key_idx < 0 || req->key_idx > 3)
 279                         return -EINVAL;
 280         }
 281
 282         if (wdev->connected &&
 283             ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))
 284                 return -EALREADY;
 285
 286         if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||
 287             (req->link_id >= 0 &&
 288              ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
 289                 return -EINVAL;
 290
 291         return rdev_auth(rdev, dev, req);
 292 }
 293
 294 /*  Do a logical ht_capa &= ht_capa_mask.  */
 295 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 296                                const struct ieee80211_ht_cap *ht_capa_mask)
 297 {
 298         int i;
 299         u8 *p1, *p2;
 300         if (!ht_capa_mask) {
 301                 memset(ht_capa, 0, sizeof(*ht_capa));
 302                 return;
 303         }
 304
 305         p1 = (u8*)(ht_capa);
 306         p2 = (u8*)(ht_capa_mask);
 307         for (i = 0; i < sizeof(*ht_capa); i++)
 308                 p1[i] &= p2[i];
 309 }
 310
 311 /*  Do a logical vht_capa &= vht_capa_mask.  */
 312 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
 313                                 const struct ieee80211_vht_cap *vht_capa_mask)
 314 {
 315         int i;
 316         u8 *p1, *p2;
 317         if (!vht_capa_mask) {
 318                 memset(vht_capa, 0, sizeof(*vht_capa));
 319                 return;
 320         }
 321
 322         p1 = (u8*)(vht_capa);
 323         p2 = (u8*)(vht_capa_mask);
 324         for (i = 0; i < sizeof(*vht_capa); i++)
 325                 p1[i] &= p2[i];
 326 }
 327
 328 /* Note: caller must cfg80211_put_bss() regardless of result */
 329 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 330                         struct net_device *dev,
 331                         struct cfg80211_assoc_request *req)
 332 {
 333         struct wireless_dev *wdev = dev->ieee80211_ptr;
 334         int err, i, j;
 335
 336         ASSERT_WDEV_LOCK(wdev);
 337
 338         for (i = 1; i < ARRAY_SIZE(req->links); i++) {
 339                 if (!req->links[i].bss)
 340                         continue;
 341                 for (j = 0; j < i; j++) {
 342                         if (req->links[i].bss == req->links[j].bss)
 343                                 return -EINVAL;
 344                 }
 345
 346                 if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr))
 347                         return -EINVAL;
 348         }
 349
 350         if (wdev->connected &&
 351             (!req->prev_bssid ||
 352              !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))
 353                 return -EALREADY;
 354
 355         if ((req->bss && ether_addr_equal(req->bss->bssid, dev->dev_addr)) ||
 356             (req->link_id >= 0 &&
 357              ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))
 358                 return -EINVAL;
 359
 360         cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
 361                                   rdev->wiphy.ht_capa_mod_mask);
 362         cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
 363                                    rdev->wiphy.vht_capa_mod_mask);
 364
 365         err = rdev_assoc(rdev, dev, req);
 366         if (!err) {
 367                 int link_id;
 368
 369                 if (req->bss) {
 370                         cfg80211_ref_bss(&rdev->wiphy, req->bss);
 371                         cfg80211_hold_bss(bss_from_pub(req->bss));
 372                 }
 373
 374                 for (link_id = 0; link_id < ARRAY_SIZE(req->links); link_id++) {
 375                         if (!req->links[link_id].bss)
 376                                 continue;
 377                         cfg80211_ref_bss(&rdev->wiphy, req->links[link_id].bss);
 378                         cfg80211_hold_bss(bss_from_pub(req->links[link_id].bss));
 379                 }
 380         }
 381         return err;
 382 }
 383
 384 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 385                          struct net_device *dev, const u8 *bssid,
 386                          const u8 *ie, int ie_len, u16 reason,
 387                          bool local_state_change)
 388 {
 389         struct wireless_dev *wdev = dev->ieee80211_ptr;
 390         struct cfg80211_deauth_request req = {
 391                 .bssid = bssid,
 392                 .reason_code = reason,
 393                 .ie = ie,
 394                 .ie_len = ie_len,
 395                 .local_state_change = local_state_change,
 396         };
 397
 398         ASSERT_WDEV_LOCK(wdev);
 399
 400         if (local_state_change &&
 401             (!wdev->connected ||
 402              !ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 403                 return 0;
 404
 405         if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
 406             (wdev->connected &&
 407              ether_addr_equal(wdev->u.client.connected_addr, bssid)))
 408                 wdev->conn_owner_nlportid = 0;
 409
 410         return rdev_deauth(rdev, dev, &req);
 411 }
 412
 413 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 414                            struct net_device *dev, const u8 *ap_addr,
 415                            const u8 *ie, int ie_len, u16 reason,
 416                            bool local_state_change)
 417 {
 418         struct wireless_dev *wdev = dev->ieee80211_ptr;
 419         struct cfg80211_disassoc_request req = {
 420                 .reason_code = reason,
 421                 .local_state_change = local_state_change,
 422                 .ie = ie,
 423                 .ie_len = ie_len,
 424                 .ap_addr = ap_addr,
 425         };
 426         int err;
 427
 428         ASSERT_WDEV_LOCK(wdev);
 429
 430         if (!wdev->connected)
 431                 return -ENOTCONN;
 432
 433         if (memcmp(wdev->u.client.connected_addr, ap_addr, ETH_ALEN))
 434                 return -ENOTCONN;
 435
 436         err = rdev_disassoc(rdev, dev, &req);
 437         if (err)
 438                 return err;
 439
 440         /* driver should have reported the disassoc */
 441         WARN_ON(wdev->connected);
 442         return 0;
 443 }
 444
 445 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 446                         struct net_device *dev)
 447 {
 448         struct wireless_dev *wdev = dev->ieee80211_ptr;
 449         u8 bssid[ETH_ALEN];
 450
 451         ASSERT_WDEV_LOCK(wdev);
 452
 453         if (!rdev->ops->deauth)
 454                 return;
 455
 456         if (!wdev->connected)
 457                 return;
 458
 459         memcpy(bssid, wdev->u.client.connected_addr, ETH_ALEN);
 460         cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
 461                              WLAN_REASON_DEAUTH_LEAVING, false);
 462 }
 463
 464 struct cfg80211_mgmt_registration {
 465         struct list_head list;
 466         struct wireless_dev *wdev;
 467
 468         u32 nlportid;
 469
 470         int match_len;
 471
 472         __le16 frame_type;
 473
 474         bool multicast_rx;
 475
 476         u8 match[];
 477 };
 478
 479 static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
 480 {
 481         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 482         struct wireless_dev *tmp;
 483         struct cfg80211_mgmt_registration *reg;
 484         struct mgmt_frame_regs upd = {};
 485
 486         lockdep_assert_held(&rdev->wiphy.mtx);
 487
 488         spin_lock_bh(&rdev->mgmt_registrations_lock);
 489         if (!wdev->mgmt_registrations_need_update) {
 490                 spin_unlock_bh(&rdev->mgmt_registrations_lock);
 491                 return;
 492         }
 493
 494         rcu_read_lock();
 495         list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) {
 496                 list_for_each_entry(reg, &tmp->mgmt_registrations, list) {
 497                         u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4);
 498                         u32 mcast_mask = 0;
 499
 500                         if (reg->multicast_rx)
 501                                 mcast_mask = mask;
 502
 503                         upd.global_stypes |= mask;
 504                         upd.global_mcast_stypes |= mcast_mask;
 505
 506                         if (tmp == wdev) {
 507                                 upd.interface_stypes |= mask;
 508                                 upd.interface_mcast_stypes |= mcast_mask;
 509                         }
 510                 }
 511         }
 512         rcu_read_unlock();
 513
 514         wdev->mgmt_registrations_need_update = 0;
 515         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 516
 517         rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
 518 }
 519
 520 void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk)
 521 {
 522         struct cfg80211_registered_device *rdev;
 523         struct wireless_dev *wdev;
 524
 525         rdev = container_of(wk, struct cfg80211_registered_device,
 526                             mgmt_registrations_update_wk);
 527
 528         wiphy_lock(&rdev->wiphy);
 529         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
 530                 cfg80211_mgmt_registrations_update(wdev);
 531         wiphy_unlock(&rdev->wiphy);
 532 }
 533
 534 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 535                                 u16 frame_type, const u8 *match_data,
 536                                 int match_len, bool multicast_rx,
 537                                 struct netlink_ext_ack *extack)
 538 {
 539         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 540         struct cfg80211_mgmt_registration *reg, *nreg;
 541         int err = 0;
 542         u16 mgmt_type;
 543         bool update_multicast = false;
 544
 545         if (!wdev->wiphy->mgmt_stypes)
 546                 return -EOPNOTSUPP;
 547
 548         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) {
 549                 NL_SET_ERR_MSG(extack, "frame type not management");
 550                 return -EINVAL;
 551         }
 552
 553         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) {
 554                 NL_SET_ERR_MSG(extack, "Invalid frame type");
 555                 return -EINVAL;
 556         }
 557
 558         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 559         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) {
 560                 NL_SET_ERR_MSG(extack,
 561                                "Registration to specific type not supported");
 562                 return -EINVAL;
 563         }
 564
 565         /*
 566          * To support Pre Association Security Negotiation (PASN), registration
 567          * for authentication frames should be supported. However, as some
 568          * versions of the user space daemons wrongly register to all types of
 569          * authentication frames (which might result in unexpected behavior)
 570          * allow such registration if the request is for a specific
 571          * authentication algorithm number.
 572          */
 573         if (wdev->iftype == NL80211_IFTYPE_STATION &&
 574             (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH &&
 575             !(match_data && match_len >= 2)) {
 576                 NL_SET_ERR_MSG(extack,
 577                                "Authentication algorithm number required");
 578                 return -EINVAL;
 579         }
 580
 581         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 582         if (!nreg)
 583                 return -ENOMEM;
 584
 585         spin_lock_bh(&rdev->mgmt_registrations_lock);
 586
 587         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 588                 int mlen = min(match_len, reg->match_len);
 589
 590                 if (frame_type != le16_to_cpu(reg->frame_type))
 591                         continue;
 592
 593                 if (memcmp(reg->match, match_data, mlen) == 0) {
 594                         if (reg->multicast_rx != multicast_rx) {
 595                                 update_multicast = true;
 596                                 reg->multicast_rx = multicast_rx;
 597                                 break;
 598                         }
 599                         NL_SET_ERR_MSG(extack, "Match already configured");
 600                         err = -EALREADY;
 601                         break;
 602                 }
 603         }
 604
 605         if (err)
 606                 goto out;
 607
 608         if (update_multicast) {
 609                 kfree(nreg);
 610         } else {
 611                 memcpy(nreg->match, match_data, match_len);
 612                 nreg->match_len = match_len;
 613                 nreg->nlportid = snd_portid;
 614                 nreg->frame_type = cpu_to_le16(frame_type);
 615                 nreg->wdev = wdev;
 616                 nreg->multicast_rx = multicast_rx;
 617                 list_add(&nreg->list, &wdev->mgmt_registrations);
 618         }
 619         wdev->mgmt_registrations_need_update = 1;
 620         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 621
 622         cfg80211_mgmt_registrations_update(wdev);
 623
 624         return 0;
 625
 626  out:
 627         kfree(nreg);
 628         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 629
 630         return err;
 631 }
 632
 633 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 634 {
 635         struct wiphy *wiphy = wdev->wiphy;
 636         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 637         struct cfg80211_mgmt_registration *reg, *tmp;
 638
 639         spin_lock_bh(&rdev->mgmt_registrations_lock);
 640
 641         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 642                 if (reg->nlportid != nlportid)
 643                         continue;
 644
 645                 list_del(&reg->list);
 646                 kfree(reg);
 647
 648                 wdev->mgmt_registrations_need_update = 1;
 649                 schedule_work(&rdev->mgmt_registrations_update_wk);
 650         }
 651
 652         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 653
 654         if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 655                 rdev->crit_proto_nlportid = 0;
 656                 rdev_crit_proto_stop(rdev, wdev);
 657         }
 658
 659         if (nlportid == wdev->ap_unexpected_nlportid)
 660                 wdev->ap_unexpected_nlportid = 0;
 661 }
 662
 663 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 664 {
 665         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 666         struct cfg80211_mgmt_registration *reg, *tmp;
 667
 668         spin_lock_bh(&rdev->mgmt_registrations_lock);
 669         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 670                 list_del(&reg->list);
 671                 kfree(reg);
 672         }
 673         wdev->mgmt_registrations_need_update = 1;
 674         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 675
 676         cfg80211_mgmt_registrations_update(wdev);
 677 }
 678
 679 static bool cfg80211_allowed_address(struct wireless_dev *wdev, const u8 *addr)
 680 {
 681         int i;
 682
 683         for_each_valid_link(wdev, i) {
 684                 if (ether_addr_equal(addr, wdev->links[i].addr))
 685                         return true;
 686         }
 687
 688         return ether_addr_equal(addr, wdev_address(wdev));
 689 }
 690
 691 static bool cfg80211_allowed_random_address(struct wireless_dev *wdev,
 692                                             const struct ieee80211_mgmt *mgmt)
 693 {
 694         if (ieee80211_is_auth(mgmt->frame_control) ||
 695             ieee80211_is_deauth(mgmt->frame_control)) {
 696                 /* Allow random TA to be used with authentication and
 697                  * deauthentication frames if the driver has indicated support.
 698                  */
 699                 if (wiphy_ext_feature_isset(
 700                             wdev->wiphy,
 701                             NL80211_EXT_FEATURE_AUTH_AND_DEAUTH_RANDOM_TA))
 702                         return true;
 703         } else if (ieee80211_is_action(mgmt->frame_control) &&
 704                    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
 705                 /* Allow random TA to be used with Public Action frames if the
 706                  * driver has indicated support.
 707                  */
 708                 if (!wdev->connected &&
 709                     wiphy_ext_feature_isset(
 710                             wdev->wiphy,
 711                             NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
 712                         return true;
 713
 714                 if (wdev->connected &&
 715                     wiphy_ext_feature_isset(
 716                             wdev->wiphy,
 717                             NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
 718                         return true;
 719         }
 720
 721         return false;
 722 }
 723
 724 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 725                           struct wireless_dev *wdev,
 726                           struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 727 {
 728         const struct ieee80211_mgmt *mgmt;
 729         u16 stype;
 730
 731         if (!wdev->wiphy->mgmt_stypes)
 732                 return -EOPNOTSUPP;
 733
 734         if (!rdev->ops->mgmt_tx)
 735                 return -EOPNOTSUPP;
 736
 737         if (params->len < 24 + 1)
 738                 return -EINVAL;
 739
 740         mgmt = (const struct ieee80211_mgmt *)params->buf;
 741
 742         if (!ieee80211_is_mgmt(mgmt->frame_control))
 743                 return -EINVAL;
 744
 745         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 746         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 747                 return -EINVAL;
 748
 749         if (ieee80211_is_action(mgmt->frame_control) &&
 750             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 751                 int err = 0;
 752
 753                 wdev_lock(wdev);
 754
 755                 switch (wdev->iftype) {
 756                 case NL80211_IFTYPE_ADHOC:
 757                         /*
 758                          * check for IBSS DA must be done by driver as
 759                          * cfg80211 doesn't track the stations
 760                          */
 761                         if (!wdev->u.ibss.current_bss ||
 762                             !ether_addr_equal(wdev->u.ibss.current_bss->pub.bssid,
 763                                               mgmt->bssid)) {
 764                                 err = -ENOTCONN;
 765                                 break;
 766                         }
 767                         break;
 768                 case NL80211_IFTYPE_STATION:
 769                 case NL80211_IFTYPE_P2P_CLIENT:
 770                         if (!wdev->connected) {
 771                                 err = -ENOTCONN;
 772                                 break;
 773                         }
 774
 775                         /* FIXME: MLD may address this differently */
 776
 777                         if (!ether_addr_equal(wdev->u.client.connected_addr,
 778                                               mgmt->bssid)) {
 779                                 err = -ENOTCONN;
 780                                 break;
 781                         }
 782
 783                         /* for station, check that DA is the AP */
 784                         if (!ether_addr_equal(wdev->u.client.connected_addr,
 785                                               mgmt->da)) {
 786                                 err = -ENOTCONN;
 787                                 break;
 788                         }
 789                         break;
 790                 case NL80211_IFTYPE_AP:
 791                 case NL80211_IFTYPE_P2P_GO:
 792                 case NL80211_IFTYPE_AP_VLAN:
 793                         if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)) &&
 794                             (params->link_id < 0 ||
 795                              !ether_addr_equal(mgmt->bssid,
 796                                                wdev->links[params->link_id].addr)))
 797                                 err = -EINVAL;
 798                         break;
 799                 case NL80211_IFTYPE_MESH_POINT:
 800                         if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
 801                                 err = -EINVAL;
 802                                 break;
 803                         }
 804                         /*
 805                          * check for mesh DA must be done by driver as
 806                          * cfg80211 doesn't track the stations
 807                          */
 808                         break;
 809                 case NL80211_IFTYPE_P2P_DEVICE:
 810                         /*
 811                          * fall through, P2P device only supports
 812                          * public action frames
 813                          */
 814                 case NL80211_IFTYPE_NAN:
 815                 default:
 816                         err = -EOPNOTSUPP;
 817                         break;
 818                 }
 819                 wdev_unlock(wdev);
 820
 821                 if (err)
 822                         return err;
 823         }
 824
 825         if (!cfg80211_allowed_address(wdev, mgmt->sa) &&
 826             !cfg80211_allowed_random_address(wdev, mgmt))
 827                 return -EINVAL;
 828
 829         /* Transmit the management frame as requested by user space */
 830         return rdev_mgmt_tx(rdev, wdev, params, cookie);
 831 }
 832
 833 bool cfg80211_rx_mgmt_ext(struct wireless_dev *wdev,
 834                           struct cfg80211_rx_info *info)
 835 {
 836         struct wiphy *wiphy = wdev->wiphy;
 837         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 838         struct cfg80211_mgmt_registration *reg;
 839         const struct ieee80211_txrx_stypes *stypes =
 840                 &wiphy->mgmt_stypes[wdev->iftype];
 841         struct ieee80211_mgmt *mgmt = (void *)info->buf;
 842         const u8 *data;
 843         int data_len;
 844         bool result = false;
 845         __le16 ftype = mgmt->frame_control &
 846                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
 847         u16 stype;
 848
 849         trace_cfg80211_rx_mgmt(wdev, info);
 850         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
 851
 852         if (!(stypes->rx & BIT(stype))) {
 853                 trace_cfg80211_return_bool(false);
 854                 return false;
 855         }
 856
 857         data = info->buf + ieee80211_hdrlen(mgmt->frame_control);
 858         data_len = info->len - ieee80211_hdrlen(mgmt->frame_control);
 859
 860         spin_lock_bh(&rdev->mgmt_registrations_lock);
 861
 862         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 863                 if (reg->frame_type != ftype)
 864                         continue;
 865
 866                 if (reg->match_len > data_len)
 867                         continue;
 868
 869                 if (memcmp(reg->match, data, reg->match_len))
 870                         continue;
 871
 872                 /* found match! */
 873
 874                 /* Indicate the received Action frame to user space */
 875                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, info,
 876                                       GFP_ATOMIC))
 877                         continue;
 878
 879                 result = true;
 880                 break;
 881         }
 882
 883         spin_unlock_bh(&rdev->mgmt_registrations_lock);
 884
 885         trace_cfg80211_return_bool(result);
 886         return result;
 887 }
 888 EXPORT_SYMBOL(cfg80211_rx_mgmt_ext);
 889
 890 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
 891 {
 892         cancel_delayed_work(&rdev->dfs_update_channels_wk);
 893         queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
 894 }
 895
 896 void cfg80211_dfs_channels_update_work(struct work_struct *work)
 897 {
 898         struct delayed_work *delayed_work = to_delayed_work(work);
 899         struct cfg80211_registered_device *rdev;
 900         struct cfg80211_chan_def chandef;
 901         struct ieee80211_supported_band *sband;
 902         struct ieee80211_channel *c;
 903         struct wiphy *wiphy;
 904         bool check_again = false;
 905         unsigned long timeout, next_time = 0;
 906         unsigned long time_dfs_update;
 907         enum nl80211_radar_event radar_event;
 908         int bandid, i;
 909
 910         rdev = container_of(delayed_work, struct cfg80211_registered_device,
 911                             dfs_update_channels_wk);
 912         wiphy = &rdev->wiphy;
 913
 914         rtnl_lock();
 915         for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
 916                 sband = wiphy->bands[bandid];
 917                 if (!sband)
 918                         continue;
 919
 920                 for (i = 0; i < sband->n_channels; i++) {
 921                         c = &sband->channels[i];
 922
 923                         if (!(c->flags & IEEE80211_CHAN_RADAR))
 924                                 continue;
 925
 926                         if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
 927                             c->dfs_state != NL80211_DFS_AVAILABLE)
 928                                 continue;
 929
 930                         if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
 931                                 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
 932                                 radar_event = NL80211_RADAR_NOP_FINISHED;
 933                         } else {
 934                                 if (regulatory_pre_cac_allowed(wiphy) ||
 935                                     cfg80211_any_wiphy_oper_chan(wiphy, c))
 936                                         continue;
 937
 938                                 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
 939                                 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
 940                         }
 941
 942                         timeout = c->dfs_state_entered +
 943                                   msecs_to_jiffies(time_dfs_update);
 944
 945                         if (time_after_eq(jiffies, timeout)) {
 946                                 c->dfs_state = NL80211_DFS_USABLE;
 947                                 c->dfs_state_entered = jiffies;
 948
 949                                 cfg80211_chandef_create(&chandef, c,
 950                                                         NL80211_CHAN_NO_HT);
 951
 952                                 nl80211_radar_notify(rdev, &chandef,
 953                                                      radar_event, NULL,
 954                                                      GFP_ATOMIC);
 955
 956                                 regulatory_propagate_dfs_state(wiphy, &chandef,
 957                                                                c->dfs_state,
 958                                                                radar_event);
 959                                 continue;
 960                         }
 961
 962                         if (!check_again)
 963                                 next_time = timeout - jiffies;
 964                         else
 965                                 next_time = min(next_time, timeout - jiffies);
 966                         check_again = true;
 967                 }
 968         }
 969         rtnl_unlock();
 970
 971         /* reschedule if there are other channels waiting to be cleared again */
 972         if (check_again)
 973                 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
 974                                    next_time);
 975 }
 976
 977
 978 void __cfg80211_radar_event(struct wiphy *wiphy,
 979                             struct cfg80211_chan_def *chandef,
 980                             bool offchan, gfp_t gfp)
 981 {
 982         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 983
 984         trace_cfg80211_radar_event(wiphy, chandef, offchan);
 985
 986         /* only set the chandef supplied channel to unavailable, in
 987          * case the radar is detected on only one of multiple channels
 988          * spanned by the chandef.
 989          */
 990         cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
 991
 992         if (offchan)
 993                 queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
 994
 995         cfg80211_sched_dfs_chan_update(rdev);
 996
 997         nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
 998
 999         memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
1000         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
1001 }
1002 EXPORT_SYMBOL(__cfg80211_radar_event);
1003
1004 void cfg80211_cac_event(struct net_device *netdev,
1005                         const struct cfg80211_chan_def *chandef,
1006                         enum nl80211_radar_event event, gfp_t gfp)
1007 {
1008         struct wireless_dev *wdev = netdev->ieee80211_ptr;
1009         struct wiphy *wiphy = wdev->wiphy;
1010         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1011         unsigned long timeout;
1012
1013         /* not yet supported */
1014         if (wdev->valid_links)
1015                 return;
1016
1017         trace_cfg80211_cac_event(netdev, event);
1018
1019         if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
1020                 return;
1021
1022         switch (event) {
1023         case NL80211_RADAR_CAC_FINISHED:
1024                 timeout = wdev->cac_start_time +
1025                           msecs_to_jiffies(wdev->cac_time_ms);
1026                 WARN_ON(!time_after_eq(jiffies, timeout));
1027                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1028                 memcpy(&rdev->cac_done_chandef, chandef,
1029                        sizeof(struct cfg80211_chan_def));
1030                 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1031                 cfg80211_sched_dfs_chan_update(rdev);
1032                 fallthrough;
1033         case NL80211_RADAR_CAC_ABORTED:
1034                 wdev->cac_started = false;
1035                 break;
1036         case NL80211_RADAR_CAC_STARTED:
1037                 wdev->cac_started = true;
1038                 break;
1039         default:
1040                 WARN_ON(1);
1041                 return;
1042         }
1043
1044         nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
1045 }
1046 EXPORT_SYMBOL(cfg80211_cac_event);
1047
1048 static void
1049 __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1050                                 struct wireless_dev *wdev,
1051                                 const struct cfg80211_chan_def *chandef,
1052                                 enum nl80211_radar_event event)
1053 {
1054         struct wiphy *wiphy = &rdev->wiphy;
1055         struct net_device *netdev;
1056
1057         lockdep_assert_wiphy(&rdev->wiphy);
1058
1059         if (!cfg80211_chandef_valid(chandef))
1060                 return;
1061
1062         if (!rdev->background_radar_wdev)
1063                 return;
1064
1065         switch (event) {
1066         case NL80211_RADAR_CAC_FINISHED:
1067                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
1068                 memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
1069                 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
1070                 cfg80211_sched_dfs_chan_update(rdev);
1071                 wdev = rdev->background_radar_wdev;
1072                 break;
1073         case NL80211_RADAR_CAC_ABORTED:
1074                 if (!cancel_delayed_work(&rdev->background_cac_done_wk))
1075                         return;
1076                 wdev = rdev->background_radar_wdev;
1077                 break;
1078         case NL80211_RADAR_CAC_STARTED:
1079                 break;
1080         default:
1081                 return;
1082         }
1083
1084         netdev = wdev ? wdev->netdev : NULL;
1085         nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
1086 }
1087
1088 static void
1089 cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
1090                               const struct cfg80211_chan_def *chandef,
1091                               enum nl80211_radar_event event)
1092 {
1093         wiphy_lock(&rdev->wiphy);
1094         __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
1095                                         chandef, event);
1096         wiphy_unlock(&rdev->wiphy);
1097 }
1098
1099 void cfg80211_background_cac_done_wk(struct work_struct *work)
1100 {
1101         struct delayed_work *delayed_work = to_delayed_work(work);
1102         struct cfg80211_registered_device *rdev;
1103
1104         rdev = container_of(delayed_work, struct cfg80211_registered_device,
1105                             background_cac_done_wk);
1106         cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
1107                                       NL80211_RADAR_CAC_FINISHED);
1108 }
1109
1110 void cfg80211_background_cac_abort_wk(struct work_struct *work)
1111 {
1112         struct cfg80211_registered_device *rdev;
1113
1114         rdev = container_of(work, struct cfg80211_registered_device,
1115                             background_cac_abort_wk);
1116         cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
1117                                       NL80211_RADAR_CAC_ABORTED);
1118 }
1119
1120 void cfg80211_background_cac_abort(struct wiphy *wiphy)
1121 {
1122         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1123
1124         queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
1125 }
1126 EXPORT_SYMBOL(cfg80211_background_cac_abort);
1127
1128 int
1129 cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
1130                                           struct wireless_dev *wdev,
1131                                           struct cfg80211_chan_def *chandef)
1132 {
1133         unsigned int cac_time_ms;
1134         int err;
1135
1136         lockdep_assert_wiphy(&rdev->wiphy);
1137
1138         if (!wiphy_ext_feature_isset(&rdev->wiphy,
1139                                      NL80211_EXT_FEATURE_RADAR_BACKGROUND))
1140                 return -EOPNOTSUPP;
1141
1142         /* Offchannel chain already locked by another wdev */
1143         if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
1144                 return -EBUSY;
1145
1146         /* CAC already in progress on the offchannel chain */
1147         if (rdev->background_radar_wdev == wdev &&
1148             delayed_work_pending(&rdev->background_cac_done_wk))
1149                 return -EBUSY;
1150
1151         err = rdev_set_radar_background(rdev, chandef);
1152         if (err)
1153                 return err;
1154
1155         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
1156         if (!cac_time_ms)
1157                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1158
1159         rdev->background_radar_chandef = *chandef;
1160         rdev->background_radar_wdev = wdev; /* Get offchain ownership */
1161
1162         __cfg80211_background_cac_event(rdev, wdev, chandef,
1163                                         NL80211_RADAR_CAC_STARTED);
1164         queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
1165                            msecs_to_jiffies(cac_time_ms));
1166
1167         return 0;
1168 }
1169
1170 void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
1171 {
1172         struct wiphy *wiphy = wdev->wiphy;
1173         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1174
1175         lockdep_assert_wiphy(wiphy);
1176
1177         if (wdev != rdev->background_radar_wdev)
1178                 return;
1179
1180         rdev_set_radar_background(rdev, NULL);
1181         rdev->background_radar_wdev = NULL; /* Release offchain ownership */
1182
1183         __cfg80211_background_cac_event(rdev, wdev,
1184                                         &rdev->background_radar_chandef,
1185                                         NL80211_RADAR_CAC_ABORTED);
1186 }