Currently, when the driver attempts to connect to an AP MLD with multiple
APs, the cfg80211_mlme_check_mlo_compat() function requires the Medium
Synchronization Delay values from different APs of the same AP MLD to be
equal, which may result in connection failures.
This is because when the driver receives a multi-link probe response from
an AP MLD with multiple APs, cfg80211 updates the Elements for each AP
based on the multi-link probe response. If the Medium Synchronization Delay
is set in the multi-link probe response, the Elements for each AP belonging
to the same AP MLD will have the Medium Synchronization Delay set
simultaneously. If non-multi-link probe responses are received from
different APs of the same MLD AP, cfg80211 will still update the Elements
based on the non-multi-link probe response. Since the non-multi-link probe
response does not set the Medium Synchronization Delay
(IEEE 802.11be-2024-35.3.4.4), if the Elements from a non-multi-link probe
response overwrite those from a multi-link probe response that has set the
Medium Synchronization Delay, the Medium Synchronization Delay values for
APs belonging to the same AP MLD will not be equal. This discrepancy causes
the cfg80211_mlme_check_mlo_compat() function to fail, leading to
connection failures. Commit ccb964b4ab16
("wifi: cfg80211: validate MLO connections better") did not take this into
account.
To address this issue, add a u16 type member to the struct cfg80211_bss to
store the Medium Synchronization Delay. When the driver receives a probe
response with the Medium Synchronization Delay set, update this member’s
value; otherwise, do not update it. Additionally, modify the parameter list
of cfg80211_mlme_check_mlo_compat() so that this member variable can be
directly accessed within the cfg80211_mlme_check_mlo_compat() function viaq
a pointer to the struct cfg80211_bss. This will allow checking whether the
Medium Synchronization Delay values from different APs of the same AP MLD
are equal.
Fixes: ccb964b4ab16 ("wifi: cfg80211: validate MLO connections better")
Signed-off-by: Lingbo Kong <quic_lingbok@xxxxxxxxxxx>
---
include/net/cfg80211.h | 4 ++++
net/wireless/mlme.c | 11 +++++++----
net/wireless/scan.c | 15 +++++++++++++++
3 files changed, 26 insertions(+), 4 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 27acf1292a5c..ebeb305c1d0c 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2956,6 +2956,8 @@ struct cfg80211_bss_ies {
* @cannot_use_reasons: the reasons (bitmap) for not being able to connect,
* if @restrict_use is set and @use_for is zero (empty); may be 0 for
* unspecified reasons; see &enum nl80211_bss_cannot_use_reasons
+ * @med_sync_delay: Medium Synchronization delay as described in
+ * IEEE 802.11be-2024 Figure 9-1074q.
* @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
*/
struct cfg80211_bss {
@@ -2986,6 +2988,8 @@ struct cfg80211_bss {
u8 use_for;
u8 cannot_use_reasons;
+ u16 med_sync_delay;
+
u8 priv[] __aligned(sizeof(void *));
};
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 4dac81854721..ae00c36779d2 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -326,7 +326,9 @@ void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
}
static int
-cfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a,
+cfg80211_mlme_check_mlo_compat(const struct cfg80211_bss *bss_a,
+ const struct cfg80211_bss *bss_b,
+ const struct ieee80211_multi_link_elem *mle_a,
const struct ieee80211_multi_link_elem *mle_b,
struct netlink_ext_ack *extack)
{
@@ -340,8 +342,7 @@ cfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a,
return -EINVAL;
}
- if (ieee80211_mle_get_eml_med_sync_delay((const u8 *)mle_a) !=
- ieee80211_mle_get_eml_med_sync_delay((const u8 *)mle_b)) {
+ if (bss_a->med_sync_delay != bss_b->med_sync_delay) {
NL_SET_ERR_MSG(extack, "link EML medium sync delay mismatch");
return -EINVAL;
}
@@ -426,7 +427,9 @@ static int cfg80211_mlme_check_mlo(struct net_device *dev,
if (WARN_ON(!mles[i]))
goto error;
- if (cfg80211_mlme_check_mlo_compat(mles[req->link_id], mles[i],
+ if (cfg80211_mlme_check_mlo_compat(req->links[req->link_id].bss,
+ req->links[i].bss,
+ mles[req->link_id], mles[i],
extack)) {
req->links[i].error = -EINVAL;
goto error;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1c6fd45aa809..6ad935475484 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1899,6 +1899,13 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
*/
if (signal_valid)
known->pub.signal = new->pub.signal;
+
+ /* update medium synchronization delay when its value is not
+ * the default.
+ */
+ if (new->pub.med_sync_delay != IEEE80211_MED_SYNC_DELAY_DEFAULT)
+ known->pub.med_sync_delay = new->pub.med_sync_delay;
+
known->pub.capability = new->pub.capability;
known->ts = new->ts;
known->ts_boottime = new->ts_boottime;
@@ -2224,6 +2231,7 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
int bss_type;
bool signal_valid;
unsigned long ts;
+ const struct element *ml;
if (WARN_ON(!wiphy))
return NULL;
@@ -2267,6 +2275,7 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
tmp.pub.use_for = data->use_for;
tmp.pub.cannot_use_reasons = data->cannot_use_reasons;
tmp.bss_source = data->bss_source;
+ tmp.pub.med_sync_delay = IEEE80211_MED_SYNC_DELAY_DEFAULT;
switch (data->bss_source) {
case BSS_SOURCE_MBSSID:
@@ -2321,6 +2330,12 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
break;
case CFG80211_BSS_FTYPE_PRESP:
rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
+ ml = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,
+ ies->data, ies->len);
+ if (ml)
+ tmp.pub.med_sync_delay =
+ ieee80211_mle_get_eml_med_sync_delay(ml->data + 1);
+
break;
}
rcu_assign_pointer(tmp.pub.ies, ies);
base-commit: e7e2957f403ba4655199f2ba9920c1a015a7be44
--
2.34.1
