mac80211: Accept broadcast probe responses on 6GHz band

An AP that operates on 6GHz may respond with a broadcast probe response.
Don't ignore such frames.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20200131111300.891737-14-luca@coelho.fi
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2733555a5f3bab068d7eb8dc135ecb1e8cf78482..320a2b3b0f5aa97999e9cd2c23d69557522fd40c 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3683,13 +3683,28 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_mgmt *mgmt = (void *)skb->data;
        struct ieee80211_if_managed *ifmgd;
        struct ieee80211_rx_status *rx_status = (void *) skb->cb;
+       struct ieee80211_channel *channel;
        size_t baselen, len = skb->len;
 
        ifmgd = &sdata->u.mgd;
 
        sdata_assert_lock(sdata);
 
-       if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
+       /*
+        * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
+        * "If a 6 GHz AP receives a Probe Request frame  and responds with
+        * a Probe Response frame [..], the Address 1 field of the Probe
+        * Response frame shall be set to the broadcast address [..]"
+        * So, on 6GHz band we should also accept broadcast responses.
+        */
+       channel = ieee80211_get_channel(sdata->local->hw.wiphy,
+                                       rx_status->freq);
+       if (!channel)
+               return;
+
+       if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+           (channel->band != NL80211_BAND_6GHZ ||
+            !is_broadcast_ether_addr(mgmt->da)))
                return; /* ignore ProbeResp to foreign address */
 
        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;