1 /*
2 * This is the new netlink-based wireless configuration interface.
3 *
4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
5 * Copyright 2013-2014 Intel Mobile Communications GmbH
6 * Copyright 2015-2017 Intel Deutschland GmbH
7 * Copyright (C) 2018 Intel Corporation
8 */
9
10 #include <linux/if.h>
11 #include <linux/module.h>
12 #include <linux/err.h>
13 #include <linux/slab.h>
14 #include <linux/list.h>
15 #include <linux/if_ether.h>
16 #include <linux/ieee80211.h>
17 #include <linux/nl80211.h>
18 #include <linux/rtnetlink.h>
19 #include <linux/netlink.h>
20 #include <linux/nospec.h>
21 #include <linux/etherdevice.h>
22 #include <net/net_namespace.h>
23 #include <net/genetlink.h>
24 #include <net/cfg80211.h>
25 #include <net/sock.h>
26 #include <net/inet_connection_sock.h>
27 #include "core.h"
28 #include "nl80211.h"
29 #include "reg.h"
30 #include "rdev-ops.h"
31
32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
33 struct genl_info *info,
34 struct cfg80211_crypto_settings *settings,
35 int cipher_limit);
36
37 /* the netlink family */
38 static struct genl_family nl80211_fam;
39
40 /* multicast groups */
41 enum nl80211_multicast_groups {
42 NL80211_MCGRP_CONFIG,
43 NL80211_MCGRP_SCAN,
44 NL80211_MCGRP_REGULATORY,
45 NL80211_MCGRP_MLME,
46 NL80211_MCGRP_VENDOR,
47 NL80211_MCGRP_NAN,
48 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
49 };
50
51 static const struct genl_multicast_group nl80211_mcgrps[] = {
52 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
53 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
54 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
55 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
56 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
57 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
58 #ifdef CONFIG_NL80211_TESTMODE
59 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
60 #endif
61 };
62
63 /* returns ERR_PTR values */
64 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct net * netns,struct nlattr ** attrs)65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
66 {
67 struct cfg80211_registered_device *rdev;
68 struct wireless_dev *result = NULL;
69 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
70 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
71 u64 wdev_id;
72 int wiphy_idx = -1;
73 int ifidx = -1;
74
75 ASSERT_RTNL();
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
88 struct wireless_dev *wdev;
89
90 if (wiphy_net(&rdev->wiphy) != netns)
91 continue;
92
93 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
94 continue;
95
96 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
97 if (have_ifidx && wdev->netdev &&
98 wdev->netdev->ifindex == ifidx) {
99 result = wdev;
100 break;
101 }
102 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
103 result = wdev;
104 break;
105 }
106 }
107
108 if (result)
109 break;
110 }
111
112 if (result)
113 return result;
114 return ERR_PTR(-ENODEV);
115 }
116
117 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
119 {
120 struct cfg80211_registered_device *rdev = NULL, *tmp;
121 struct net_device *netdev;
122
123 ASSERT_RTNL();
124
125 if (!attrs[NL80211_ATTR_WIPHY] &&
126 !attrs[NL80211_ATTR_IFINDEX] &&
127 !attrs[NL80211_ATTR_WDEV])
128 return ERR_PTR(-EINVAL);
129
130 if (attrs[NL80211_ATTR_WIPHY])
131 rdev = cfg80211_rdev_by_wiphy_idx(
132 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
133
134 if (attrs[NL80211_ATTR_WDEV]) {
135 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
136 struct wireless_dev *wdev;
137 bool found = false;
138
139 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
140 if (tmp) {
141 /* make sure wdev exists */
142 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
143 if (wdev->identifier != (u32)wdev_id)
144 continue;
145 found = true;
146 break;
147 }
148
149 if (!found)
150 tmp = NULL;
151
152 if (rdev && tmp != rdev)
153 return ERR_PTR(-EINVAL);
154 rdev = tmp;
155 }
156 }
157
158 if (attrs[NL80211_ATTR_IFINDEX]) {
159 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
160
161 netdev = __dev_get_by_index(netns, ifindex);
162 if (netdev) {
163 if (netdev->ieee80211_ptr)
164 tmp = wiphy_to_rdev(
165 netdev->ieee80211_ptr->wiphy);
166 else
167 tmp = NULL;
168
169 /* not wireless device -- return error */
170 if (!tmp)
171 return ERR_PTR(-EINVAL);
172
173 /* mismatch -- return error */
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176
177 rdev = tmp;
178 }
179 }
180
181 if (!rdev)
182 return ERR_PTR(-ENODEV);
183
184 if (netns != wiphy_net(&rdev->wiphy))
185 return ERR_PTR(-ENODEV);
186
187 return rdev;
188 }
189
190 /*
191 * This function returns a pointer to the driver
192 * that the genl_info item that is passed refers to.
193 *
194 * The result of this can be a PTR_ERR and hence must
195 * be checked with IS_ERR() for errors.
196 */
197 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
199 {
200 return __cfg80211_rdev_from_attrs(netns, info->attrs);
201 }
202
203 /* policy for the attributes */
204 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
205 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
206 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
207 .len = 20-1 },
208 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
209
210 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
211 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
212 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
213 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
214 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
215
216 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
217 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
218 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
219 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
220 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
221 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
222
223 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
224 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
225 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
226
227 [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
228 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
229
230 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
231 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
232 .len = WLAN_MAX_KEY_LEN },
233 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
234 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
235 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
236 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
237 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
238
239 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
240 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
241 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
242 .len = IEEE80211_MAX_DATA_LEN },
243 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
244 .len = IEEE80211_MAX_DATA_LEN },
245 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
246 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
247 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
248 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
249 .len = NL80211_MAX_SUPP_RATES },
250 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
251 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
252 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
253 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
254 .len = IEEE80211_MAX_MESH_ID_LEN },
255 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
256
257 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
258 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
259
260 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
261 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
262 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
263 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
264 .len = NL80211_MAX_SUPP_RATES },
265 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
266
267 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
268 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
269
270 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
271
272 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
273 [NL80211_ATTR_IE] = { .type = NLA_BINARY,
274 .len = IEEE80211_MAX_DATA_LEN },
275 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
276 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
277
278 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
279 .len = IEEE80211_MAX_SSID_LEN },
280 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
281 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
282 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
283 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
284 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
285 [NL80211_ATTR_STA_FLAGS2] = {
286 .len = sizeof(struct nl80211_sta_flag_update),
287 },
288 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
289 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
290 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
291 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
292 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
293 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
294 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
295 [NL80211_ATTR_PID] = { .type = NLA_U32 },
296 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
297 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
298 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
299 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
300 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
301 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
302 .len = IEEE80211_MAX_DATA_LEN },
303 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
304 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
305 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
306 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
307 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
308 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
309 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
310 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
311 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
312 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
313 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
314 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
315 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
316 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
317 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
318 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
319 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
320 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
321 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
322 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
323 .len = IEEE80211_MAX_DATA_LEN },
324 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
325 .len = IEEE80211_MAX_DATA_LEN },
326 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
327 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
328 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
329 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
330 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
331 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
332 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
333 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
334 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
335 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
336 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
337 .len = IEEE80211_MAX_DATA_LEN },
338 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
339 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
340 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
341 .len = NL80211_HT_CAPABILITY_LEN
342 },
343 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
344 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
345 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
346 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
347 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
348 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
349 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
350 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
351 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
352 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
353 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
354 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
355 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
356 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
357 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
358 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
359 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
360 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
361 .len = NL80211_VHT_CAPABILITY_LEN,
362 },
363 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
364 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
365 .len = IEEE80211_MAX_DATA_LEN },
366 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
367 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
368 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
369 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
370 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
371 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
372 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
373 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
374 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
375 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
376 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
377 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
378 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
379 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
380 .len = IEEE80211_QOS_MAP_LEN_MAX },
381 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
382 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
383 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
384 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
385 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
386 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
387 [NL80211_ATTR_TSID] = { .type = NLA_U8 },
388 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
389 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
390 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
391 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
392 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
393 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
394 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
395 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
396 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
397 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
398 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
399 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
400 .len = VHT_MUMIMO_GROUPS_DATA_LEN
401 },
402 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
403 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
404 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
405 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
406 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
407 .len = FILS_MAX_KEK_LEN },
408 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
409 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
410 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
411 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
412 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
413 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
414 },
415 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
416 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
417 .len = FILS_ERP_MAX_USERNAME_LEN },
418 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
419 .len = FILS_ERP_MAX_REALM_LEN },
420 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
421 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
422 .len = FILS_ERP_MAX_RRK_LEN },
423 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
424 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
425 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
426 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
427
428 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
429 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
430 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
431 [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
432 .len = NL80211_HE_MAX_CAPABILITY_LEN },
433 };
434
435 /* policy for the key attributes */
436 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
437 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
438 [NL80211_KEY_IDX] = { .type = NLA_U8 },
439 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
440 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
441 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
442 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
443 [NL80211_KEY_TYPE] = { .type = NLA_U32 },
444 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
445 };
446
447 /* policy for the key default flags */
448 static const struct nla_policy
449 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
450 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
451 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
452 };
453
454 #ifdef CONFIG_PM
455 /* policy for WoWLAN attributes */
456 static const struct nla_policy
457 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
458 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
459 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
460 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
461 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
462 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
463 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
464 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
465 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
466 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
467 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
468 };
469
470 static const struct nla_policy
471 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
472 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
473 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
474 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
475 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
476 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
477 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
478 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
479 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
480 },
481 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
482 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
483 },
484 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
485 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
486 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
487 };
488 #endif /* CONFIG_PM */
489
490 /* policy for coalesce rule attributes */
491 static const struct nla_policy
492 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
493 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
494 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
495 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
496 };
497
498 /* policy for GTK rekey offload attributes */
499 static const struct nla_policy
500 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
501 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
502 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
503 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
504 };
505
506 static const struct nla_policy
507 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
508 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
509 .len = IEEE80211_MAX_SSID_LEN },
510 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
511 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
512 };
513
514 static const struct nla_policy
515 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
516 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
517 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
518 };
519
520 static const struct nla_policy
521 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
522 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
523 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
524 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
525 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
526 },
527 };
528
529 /* policy for NAN function attributes */
530 static const struct nla_policy
531 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
532 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
533 [NL80211_NAN_FUNC_SERVICE_ID] = {
534 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
535 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
536 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
537 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
538 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
539 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
540 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
541 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
542 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
543 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
544 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
545 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
546 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
547 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
548 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
549 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
550 };
551
552 /* policy for Service Response Filter attributes */
553 static const struct nla_policy
554 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
555 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
556 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
557 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
558 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
559 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
560 };
561
562 /* policy for packet pattern attributes */
563 static const struct nla_policy
564 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
565 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
566 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
567 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
568 };
569
nl80211_prepare_wdev_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)570 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
571 struct netlink_callback *cb,
572 struct cfg80211_registered_device **rdev,
573 struct wireless_dev **wdev)
574 {
575 int err;
576
577 if (!cb->args[0]) {
578 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
579 genl_family_attrbuf(&nl80211_fam),
580 nl80211_fam.maxattr, nl80211_policy, NULL);
581 if (err)
582 return err;
583
584 *wdev = __cfg80211_wdev_from_attrs(
585 sock_net(skb->sk),
586 genl_family_attrbuf(&nl80211_fam));
587 if (IS_ERR(*wdev))
588 return PTR_ERR(*wdev);
589 *rdev = wiphy_to_rdev((*wdev)->wiphy);
590 /* 0 is the first index - add 1 to parse only once */
591 cb->args[0] = (*rdev)->wiphy_idx + 1;
592 cb->args[1] = (*wdev)->identifier;
593 } else {
594 /* subtract the 1 again here */
595 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
596 struct wireless_dev *tmp;
597
598 if (!wiphy)
599 return -ENODEV;
600 *rdev = wiphy_to_rdev(wiphy);
601 *wdev = NULL;
602
603 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
604 if (tmp->identifier == cb->args[1]) {
605 *wdev = tmp;
606 break;
607 }
608 }
609
610 if (!*wdev)
611 return -ENODEV;
612 }
613
614 return 0;
615 }
616
617 /* IE validation */
is_valid_ie_attr(const struct nlattr * attr)618 static bool is_valid_ie_attr(const struct nlattr *attr)
619 {
620 const u8 *pos;
621 int len;
622
623 if (!attr)
624 return true;
625
626 pos = nla_data(attr);
627 len = nla_len(attr);
628
629 while (len) {
630 u8 elemlen;
631
632 if (len < 2)
633 return false;
634 len -= 2;
635
636 elemlen = pos[1];
637 if (elemlen > len)
638 return false;
639
640 len -= elemlen;
641 pos += 2 + elemlen;
642 }
643
644 return true;
645 }
646
647 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)648 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
649 int flags, u8 cmd)
650 {
651 /* since there is no private header just add the generic one */
652 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
653 }
654
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)655 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
656 const struct ieee80211_reg_rule *rule)
657 {
658 int j;
659 struct nlattr *nl_wmm_rules =
660 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
661
662 if (!nl_wmm_rules)
663 goto nla_put_failure;
664
665 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
666 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
667
668 if (!nl_wmm_rule)
669 goto nla_put_failure;
670
671 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
672 rule->wmm_rule.client[j].cw_min) ||
673 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
674 rule->wmm_rule.client[j].cw_max) ||
675 nla_put_u8(msg, NL80211_WMMR_AIFSN,
676 rule->wmm_rule.client[j].aifsn) ||
677 nla_put_u16(msg, NL80211_WMMR_TXOP,
678 rule->wmm_rule.client[j].cot))
679 goto nla_put_failure;
680
681 nla_nest_end(msg, nl_wmm_rule);
682 }
683 nla_nest_end(msg, nl_wmm_rules);
684
685 return 0;
686
687 nla_put_failure:
688 return -ENOBUFS;
689 }
690
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)691 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
692 struct ieee80211_channel *chan,
693 bool large)
694 {
695 /* Some channels must be completely excluded from the
696 * list to protect old user-space tools from breaking
697 */
698 if (!large && chan->flags &
699 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
700 return 0;
701
702 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
703 chan->center_freq))
704 goto nla_put_failure;
705
706 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
707 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
708 goto nla_put_failure;
709 if (chan->flags & IEEE80211_CHAN_NO_IR) {
710 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
711 goto nla_put_failure;
712 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
713 goto nla_put_failure;
714 }
715 if (chan->flags & IEEE80211_CHAN_RADAR) {
716 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
717 goto nla_put_failure;
718 if (large) {
719 u32 time;
720
721 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
722
723 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
724 chan->dfs_state))
725 goto nla_put_failure;
726 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
727 time))
728 goto nla_put_failure;
729 if (nla_put_u32(msg,
730 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
731 chan->dfs_cac_ms))
732 goto nla_put_failure;
733 }
734 }
735
736 if (large) {
737 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
738 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
739 goto nla_put_failure;
740 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
741 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
742 goto nla_put_failure;
743 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
744 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
745 goto nla_put_failure;
746 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
747 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
748 goto nla_put_failure;
749 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
750 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
751 goto nla_put_failure;
752 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
753 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
754 goto nla_put_failure;
755 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
756 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
757 goto nla_put_failure;
758 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
759 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
760 goto nla_put_failure;
761 }
762
763 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
764 DBM_TO_MBM(chan->max_power)))
765 goto nla_put_failure;
766
767 if (large) {
768 const struct ieee80211_reg_rule *rule =
769 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
770
771 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
772 if (nl80211_msg_put_wmm_rules(msg, rule))
773 goto nla_put_failure;
774 }
775 }
776
777 return 0;
778
779 nla_put_failure:
780 return -ENOBUFS;
781 }
782
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)783 static bool nl80211_put_txq_stats(struct sk_buff *msg,
784 struct cfg80211_txq_stats *txqstats,
785 int attrtype)
786 {
787 struct nlattr *txqattr;
788
789 #define PUT_TXQVAL_U32(attr, memb) do { \
790 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
791 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
792 return false; \
793 } while (0)
794
795 txqattr = nla_nest_start(msg, attrtype);
796 if (!txqattr)
797 return false;
798
799 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
800 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
801 PUT_TXQVAL_U32(FLOWS, flows);
802 PUT_TXQVAL_U32(DROPS, drops);
803 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
804 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
805 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
806 PUT_TXQVAL_U32(COLLISIONS, collisions);
807 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
808 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
809 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
810 nla_nest_end(msg, txqattr);
811
812 #undef PUT_TXQVAL_U32
813 return true;
814 }
815
816 /* netlink command implementations */
817
818 struct key_parse {
819 struct key_params p;
820 int idx;
821 int type;
822 bool def, defmgmt;
823 bool def_uni, def_multi;
824 };
825
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)826 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
827 struct key_parse *k)
828 {
829 struct nlattr *tb[NL80211_KEY_MAX + 1];
830 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
831 nl80211_key_policy, info->extack);
832 if (err)
833 return err;
834
835 k->def = !!tb[NL80211_KEY_DEFAULT];
836 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
837
838 if (k->def) {
839 k->def_uni = true;
840 k->def_multi = true;
841 }
842 if (k->defmgmt)
843 k->def_multi = true;
844
845 if (tb[NL80211_KEY_IDX])
846 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
847
848 if (tb[NL80211_KEY_DATA]) {
849 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
850 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
851 }
852
853 if (tb[NL80211_KEY_SEQ]) {
854 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
855 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
856 }
857
858 if (tb[NL80211_KEY_CIPHER])
859 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
860
861 if (tb[NL80211_KEY_TYPE]) {
862 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
863 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
864 return genl_err_attr(info, -EINVAL,
865 tb[NL80211_KEY_TYPE]);
866 }
867
868 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
869 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
870
871 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
872 tb[NL80211_KEY_DEFAULT_TYPES],
873 nl80211_key_default_policy,
874 info->extack);
875 if (err)
876 return err;
877
878 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
879 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
880 }
881
882 return 0;
883 }
884
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)885 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
886 {
887 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
888 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
889 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
890 }
891
892 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
893 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
894 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
895 }
896
897 if (info->attrs[NL80211_ATTR_KEY_IDX])
898 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
899
900 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
901 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
902
903 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
904 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
905
906 if (k->def) {
907 k->def_uni = true;
908 k->def_multi = true;
909 }
910 if (k->defmgmt)
911 k->def_multi = true;
912
913 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
914 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
915 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) {
916 GENL_SET_ERR_MSG(info, "key type out of range");
917 return -EINVAL;
918 }
919 }
920
921 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
922 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
923 int err = nla_parse_nested(kdt,
924 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
925 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
926 nl80211_key_default_policy,
927 info->extack);
928 if (err)
929 return err;
930
931 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
932 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
933 }
934
935 return 0;
936 }
937
nl80211_parse_key(struct genl_info * info,struct key_parse * k)938 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
939 {
940 int err;
941
942 memset(k, 0, sizeof(*k));
943 k->idx = -1;
944 k->type = -1;
945
946 if (info->attrs[NL80211_ATTR_KEY])
947 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
948 else
949 err = nl80211_parse_key_old(info, k);
950
951 if (err)
952 return err;
953
954 if (k->def && k->defmgmt) {
955 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
956 return -EINVAL;
957 }
958
959 if (k->defmgmt) {
960 if (k->def_uni || !k->def_multi) {
961 GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
962 return -EINVAL;
963 }
964 }
965
966 if (k->idx != -1) {
967 if (k->defmgmt) {
968 if (k->idx < 4 || k->idx > 5) {
969 GENL_SET_ERR_MSG(info,
970 "defmgmt key idx not 4 or 5");
971 return -EINVAL;
972 }
973 } else if (k->def) {
974 if (k->idx < 0 || k->idx > 3) {
975 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
976 return -EINVAL;
977 }
978 } else {
979 if (k->idx < 0 || k->idx > 5) {
980 GENL_SET_ERR_MSG(info, "key idx not 0-5");
981 return -EINVAL;
982 }
983 }
984 }
985
986 return 0;
987 }
988
989 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)990 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
991 struct genl_info *info, bool *no_ht)
992 {
993 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
994 struct key_parse parse;
995 struct nlattr *key;
996 struct cfg80211_cached_keys *result;
997 int rem, err, def = 0;
998 bool have_key = false;
999
1000 nla_for_each_nested(key, keys, rem) {
1001 have_key = true;
1002 break;
1003 }
1004
1005 if (!have_key)
1006 return NULL;
1007
1008 result = kzalloc(sizeof(*result), GFP_KERNEL);
1009 if (!result)
1010 return ERR_PTR(-ENOMEM);
1011
1012 result->def = -1;
1013
1014 nla_for_each_nested(key, keys, rem) {
1015 memset(&parse, 0, sizeof(parse));
1016 parse.idx = -1;
1017
1018 err = nl80211_parse_key_new(info, key, &parse);
1019 if (err)
1020 goto error;
1021 err = -EINVAL;
1022 if (!parse.p.key)
1023 goto error;
1024 if (parse.idx < 0 || parse.idx > 3) {
1025 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1026 goto error;
1027 }
1028 if (parse.def) {
1029 if (def) {
1030 GENL_SET_ERR_MSG(info,
1031 "only one key can be default");
1032 goto error;
1033 }
1034 def = 1;
1035 result->def = parse.idx;
1036 if (!parse.def_uni || !parse.def_multi)
1037 goto error;
1038 } else if (parse.defmgmt)
1039 goto error;
1040 err = cfg80211_validate_key_settings(rdev, &parse.p,
1041 parse.idx, false, NULL);
1042 if (err)
1043 goto error;
1044 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1045 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1046 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1047 err = -EINVAL;
1048 goto error;
1049 }
1050 result->params[parse.idx].cipher = parse.p.cipher;
1051 result->params[parse.idx].key_len = parse.p.key_len;
1052 result->params[parse.idx].key = result->data[parse.idx];
1053 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1054
1055 /* must be WEP key if we got here */
1056 if (no_ht)
1057 *no_ht = true;
1058 }
1059
1060 if (result->def < 0) {
1061 err = -EINVAL;
1062 GENL_SET_ERR_MSG(info, "need a default/TX key");
1063 goto error;
1064 }
1065
1066 return result;
1067 error:
1068 kfree(result);
1069 return ERR_PTR(err);
1070 }
1071
nl80211_key_allowed(struct wireless_dev * wdev)1072 static int nl80211_key_allowed(struct wireless_dev *wdev)
1073 {
1074 ASSERT_WDEV_LOCK(wdev);
1075
1076 switch (wdev->iftype) {
1077 case NL80211_IFTYPE_AP:
1078 case NL80211_IFTYPE_AP_VLAN:
1079 case NL80211_IFTYPE_P2P_GO:
1080 case NL80211_IFTYPE_MESH_POINT:
1081 break;
1082 case NL80211_IFTYPE_ADHOC:
1083 case NL80211_IFTYPE_STATION:
1084 case NL80211_IFTYPE_P2P_CLIENT:
1085 if (!wdev->current_bss)
1086 return -ENOLINK;
1087 break;
1088 case NL80211_IFTYPE_UNSPECIFIED:
1089 case NL80211_IFTYPE_OCB:
1090 case NL80211_IFTYPE_MONITOR:
1091 case NL80211_IFTYPE_NAN:
1092 case NL80211_IFTYPE_P2P_DEVICE:
1093 case NL80211_IFTYPE_WDS:
1094 case NUM_NL80211_IFTYPES:
1095 return -EINVAL;
1096 }
1097
1098 return 0;
1099 }
1100
nl80211_get_valid_chan(struct wiphy * wiphy,struct nlattr * tb)1101 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1102 struct nlattr *tb)
1103 {
1104 struct ieee80211_channel *chan;
1105
1106 if (tb == NULL)
1107 return NULL;
1108 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1109 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1110 return NULL;
1111 return chan;
1112 }
1113
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1114 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1115 {
1116 struct nlattr *nl_modes = nla_nest_start(msg, attr);
1117 int i;
1118
1119 if (!nl_modes)
1120 goto nla_put_failure;
1121
1122 i = 0;
1123 while (ifmodes) {
1124 if ((ifmodes & 1) && nla_put_flag(msg, i))
1125 goto nla_put_failure;
1126 ifmodes >>= 1;
1127 i++;
1128 }
1129
1130 nla_nest_end(msg, nl_modes);
1131 return 0;
1132
1133 nla_put_failure:
1134 return -ENOBUFS;
1135 }
1136
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,bool large)1137 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1138 struct sk_buff *msg,
1139 bool large)
1140 {
1141 struct nlattr *nl_combis;
1142 int i, j;
1143
1144 nl_combis = nla_nest_start(msg,
1145 NL80211_ATTR_INTERFACE_COMBINATIONS);
1146 if (!nl_combis)
1147 goto nla_put_failure;
1148
1149 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1150 const struct ieee80211_iface_combination *c;
1151 struct nlattr *nl_combi, *nl_limits;
1152
1153 c = &wiphy->iface_combinations[i];
1154
1155 nl_combi = nla_nest_start(msg, i + 1);
1156 if (!nl_combi)
1157 goto nla_put_failure;
1158
1159 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1160 if (!nl_limits)
1161 goto nla_put_failure;
1162
1163 for (j = 0; j < c->n_limits; j++) {
1164 struct nlattr *nl_limit;
1165
1166 nl_limit = nla_nest_start(msg, j + 1);
1167 if (!nl_limit)
1168 goto nla_put_failure;
1169 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1170 c->limits[j].max))
1171 goto nla_put_failure;
1172 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1173 c->limits[j].types))
1174 goto nla_put_failure;
1175 nla_nest_end(msg, nl_limit);
1176 }
1177
1178 nla_nest_end(msg, nl_limits);
1179
1180 if (c->beacon_int_infra_match &&
1181 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1182 goto nla_put_failure;
1183 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1184 c->num_different_channels) ||
1185 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1186 c->max_interfaces))
1187 goto nla_put_failure;
1188 if (large &&
1189 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1190 c->radar_detect_widths) ||
1191 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1192 c->radar_detect_regions)))
1193 goto nla_put_failure;
1194 if (c->beacon_int_min_gcd &&
1195 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1196 c->beacon_int_min_gcd))
1197 goto nla_put_failure;
1198
1199 nla_nest_end(msg, nl_combi);
1200 }
1201
1202 nla_nest_end(msg, nl_combis);
1203
1204 return 0;
1205 nla_put_failure:
1206 return -ENOBUFS;
1207 }
1208
1209 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1210 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1211 struct sk_buff *msg)
1212 {
1213 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1214 struct nlattr *nl_tcp;
1215
1216 if (!tcp)
1217 return 0;
1218
1219 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1220 if (!nl_tcp)
1221 return -ENOBUFS;
1222
1223 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1224 tcp->data_payload_max))
1225 return -ENOBUFS;
1226
1227 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1228 tcp->data_payload_max))
1229 return -ENOBUFS;
1230
1231 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1232 return -ENOBUFS;
1233
1234 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1235 sizeof(*tcp->tok), tcp->tok))
1236 return -ENOBUFS;
1237
1238 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1239 tcp->data_interval_max))
1240 return -ENOBUFS;
1241
1242 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1243 tcp->wake_payload_max))
1244 return -ENOBUFS;
1245
1246 nla_nest_end(msg, nl_tcp);
1247 return 0;
1248 }
1249
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1250 static int nl80211_send_wowlan(struct sk_buff *msg,
1251 struct cfg80211_registered_device *rdev,
1252 bool large)
1253 {
1254 struct nlattr *nl_wowlan;
1255
1256 if (!rdev->wiphy.wowlan)
1257 return 0;
1258
1259 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1260 if (!nl_wowlan)
1261 return -ENOBUFS;
1262
1263 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1264 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1265 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1266 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1267 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1268 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1269 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1270 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1271 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1272 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1273 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1274 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1275 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1276 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1277 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1278 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1279 return -ENOBUFS;
1280
1281 if (rdev->wiphy.wowlan->n_patterns) {
1282 struct nl80211_pattern_support pat = {
1283 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1284 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1285 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1286 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1287 };
1288
1289 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1290 sizeof(pat), &pat))
1291 return -ENOBUFS;
1292 }
1293
1294 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1295 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1296 rdev->wiphy.wowlan->max_nd_match_sets))
1297 return -ENOBUFS;
1298
1299 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1300 return -ENOBUFS;
1301
1302 nla_nest_end(msg, nl_wowlan);
1303
1304 return 0;
1305 }
1306 #endif
1307
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1308 static int nl80211_send_coalesce(struct sk_buff *msg,
1309 struct cfg80211_registered_device *rdev)
1310 {
1311 struct nl80211_coalesce_rule_support rule;
1312
1313 if (!rdev->wiphy.coalesce)
1314 return 0;
1315
1316 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1317 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1318 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1319 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1320 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1321 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1322
1323 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1324 return -ENOBUFS;
1325
1326 return 0;
1327 }
1328
1329 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_sband_iftype_data * iftdata)1330 nl80211_send_iftype_data(struct sk_buff *msg,
1331 const struct ieee80211_sband_iftype_data *iftdata)
1332 {
1333 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1334
1335 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1336 iftdata->types_mask))
1337 return -ENOBUFS;
1338
1339 if (he_cap->has_he) {
1340 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1341 sizeof(he_cap->he_cap_elem.mac_cap_info),
1342 he_cap->he_cap_elem.mac_cap_info) ||
1343 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1344 sizeof(he_cap->he_cap_elem.phy_cap_info),
1345 he_cap->he_cap_elem.phy_cap_info) ||
1346 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1347 sizeof(he_cap->he_mcs_nss_supp),
1348 &he_cap->he_mcs_nss_supp) ||
1349 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1350 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1351 return -ENOBUFS;
1352 }
1353
1354 return 0;
1355 }
1356
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband)1357 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1358 struct ieee80211_supported_band *sband)
1359 {
1360 struct nlattr *nl_rates, *nl_rate;
1361 struct ieee80211_rate *rate;
1362 int i;
1363
1364 /* add HT info */
1365 if (sband->ht_cap.ht_supported &&
1366 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1367 sizeof(sband->ht_cap.mcs),
1368 &sband->ht_cap.mcs) ||
1369 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1370 sband->ht_cap.cap) ||
1371 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1372 sband->ht_cap.ampdu_factor) ||
1373 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1374 sband->ht_cap.ampdu_density)))
1375 return -ENOBUFS;
1376
1377 /* add VHT info */
1378 if (sband->vht_cap.vht_supported &&
1379 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1380 sizeof(sband->vht_cap.vht_mcs),
1381 &sband->vht_cap.vht_mcs) ||
1382 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1383 sband->vht_cap.cap)))
1384 return -ENOBUFS;
1385
1386 if (sband->n_iftype_data) {
1387 struct nlattr *nl_iftype_data =
1388 nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1389 int err;
1390
1391 if (!nl_iftype_data)
1392 return -ENOBUFS;
1393
1394 for (i = 0; i < sband->n_iftype_data; i++) {
1395 struct nlattr *iftdata;
1396
1397 iftdata = nla_nest_start(msg, i + 1);
1398 if (!iftdata)
1399 return -ENOBUFS;
1400
1401 err = nl80211_send_iftype_data(msg,
1402 &sband->iftype_data[i]);
1403 if (err)
1404 return err;
1405
1406 nla_nest_end(msg, iftdata);
1407 }
1408
1409 nla_nest_end(msg, nl_iftype_data);
1410 }
1411
1412 /* add bitrates */
1413 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1414 if (!nl_rates)
1415 return -ENOBUFS;
1416
1417 for (i = 0; i < sband->n_bitrates; i++) {
1418 nl_rate = nla_nest_start(msg, i);
1419 if (!nl_rate)
1420 return -ENOBUFS;
1421
1422 rate = &sband->bitrates[i];
1423 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1424 rate->bitrate))
1425 return -ENOBUFS;
1426 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1427 nla_put_flag(msg,
1428 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1429 return -ENOBUFS;
1430
1431 nla_nest_end(msg, nl_rate);
1432 }
1433
1434 nla_nest_end(msg, nl_rates);
1435
1436 return 0;
1437 }
1438
1439 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)1440 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1441 const struct ieee80211_txrx_stypes *mgmt_stypes)
1442 {
1443 u16 stypes;
1444 struct nlattr *nl_ftypes, *nl_ifs;
1445 enum nl80211_iftype ift;
1446 int i;
1447
1448 if (!mgmt_stypes)
1449 return 0;
1450
1451 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1452 if (!nl_ifs)
1453 return -ENOBUFS;
1454
1455 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1456 nl_ftypes = nla_nest_start(msg, ift);
1457 if (!nl_ftypes)
1458 return -ENOBUFS;
1459 i = 0;
1460 stypes = mgmt_stypes[ift].tx;
1461 while (stypes) {
1462 if ((stypes & 1) &&
1463 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1464 (i << 4) | IEEE80211_FTYPE_MGMT))
1465 return -ENOBUFS;
1466 stypes >>= 1;
1467 i++;
1468 }
1469 nla_nest_end(msg, nl_ftypes);
1470 }
1471
1472 nla_nest_end(msg, nl_ifs);
1473
1474 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1475 if (!nl_ifs)
1476 return -ENOBUFS;
1477
1478 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1479 nl_ftypes = nla_nest_start(msg, ift);
1480 if (!nl_ftypes)
1481 return -ENOBUFS;
1482 i = 0;
1483 stypes = mgmt_stypes[ift].rx;
1484 while (stypes) {
1485 if ((stypes & 1) &&
1486 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1487 (i << 4) | IEEE80211_FTYPE_MGMT))
1488 return -ENOBUFS;
1489 stypes >>= 1;
1490 i++;
1491 }
1492 nla_nest_end(msg, nl_ftypes);
1493 }
1494 nla_nest_end(msg, nl_ifs);
1495
1496 return 0;
1497 }
1498
1499 #define CMD(op, n) \
1500 do { \
1501 if (rdev->ops->op) { \
1502 i++; \
1503 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1504 goto nla_put_failure; \
1505 } \
1506 } while (0)
1507
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1508 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1509 struct sk_buff *msg)
1510 {
1511 int i = 0;
1512
1513 /*
1514 * do *NOT* add anything into this function, new things need to be
1515 * advertised only to new versions of userspace that can deal with
1516 * the split (and they can't possibly care about new features...
1517 */
1518 CMD(add_virtual_intf, NEW_INTERFACE);
1519 CMD(change_virtual_intf, SET_INTERFACE);
1520 CMD(add_key, NEW_KEY);
1521 CMD(start_ap, START_AP);
1522 CMD(add_station, NEW_STATION);
1523 CMD(add_mpath, NEW_MPATH);
1524 CMD(update_mesh_config, SET_MESH_CONFIG);
1525 CMD(change_bss, SET_BSS);
1526 CMD(auth, AUTHENTICATE);
1527 CMD(assoc, ASSOCIATE);
1528 CMD(deauth, DEAUTHENTICATE);
1529 CMD(disassoc, DISASSOCIATE);
1530 CMD(join_ibss, JOIN_IBSS);
1531 CMD(join_mesh, JOIN_MESH);
1532 CMD(set_pmksa, SET_PMKSA);
1533 CMD(del_pmksa, DEL_PMKSA);
1534 CMD(flush_pmksa, FLUSH_PMKSA);
1535 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1536 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1537 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1538 CMD(mgmt_tx, FRAME);
1539 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1540 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1541 i++;
1542 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1543 goto nla_put_failure;
1544 }
1545 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1546 rdev->ops->join_mesh) {
1547 i++;
1548 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1549 goto nla_put_failure;
1550 }
1551 CMD(set_wds_peer, SET_WDS_PEER);
1552 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1553 CMD(tdls_mgmt, TDLS_MGMT);
1554 CMD(tdls_oper, TDLS_OPER);
1555 }
1556 if (rdev->wiphy.max_sched_scan_reqs)
1557 CMD(sched_scan_start, START_SCHED_SCAN);
1558 CMD(probe_client, PROBE_CLIENT);
1559 CMD(set_noack_map, SET_NOACK_MAP);
1560 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1561 i++;
1562 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1563 goto nla_put_failure;
1564 }
1565 CMD(start_p2p_device, START_P2P_DEVICE);
1566 CMD(set_mcast_rate, SET_MCAST_RATE);
1567 #ifdef CONFIG_NL80211_TESTMODE
1568 CMD(testmode_cmd, TESTMODE);
1569 #endif
1570
1571 if (rdev->ops->connect || rdev->ops->auth) {
1572 i++;
1573 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1574 goto nla_put_failure;
1575 }
1576
1577 if (rdev->ops->disconnect || rdev->ops->deauth) {
1578 i++;
1579 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1580 goto nla_put_failure;
1581 }
1582
1583 return i;
1584 nla_put_failure:
1585 return -ENOBUFS;
1586 }
1587
1588 struct nl80211_dump_wiphy_state {
1589 s64 filter_wiphy;
1590 long start;
1591 long split_start, band_start, chan_start, capa_start;
1592 bool split;
1593 };
1594
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)1595 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1596 enum nl80211_commands cmd,
1597 struct sk_buff *msg, u32 portid, u32 seq,
1598 int flags, struct nl80211_dump_wiphy_state *state)
1599 {
1600 void *hdr;
1601 struct nlattr *nl_bands, *nl_band;
1602 struct nlattr *nl_freqs, *nl_freq;
1603 struct nlattr *nl_cmds;
1604 enum nl80211_band band;
1605 struct ieee80211_channel *chan;
1606 int i;
1607 const struct ieee80211_txrx_stypes *mgmt_stypes =
1608 rdev->wiphy.mgmt_stypes;
1609 u32 features;
1610
1611 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1612 if (!hdr)
1613 return -ENOBUFS;
1614
1615 if (WARN_ON(!state))
1616 return -EINVAL;
1617
1618 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1619 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1620 wiphy_name(&rdev->wiphy)) ||
1621 nla_put_u32(msg, NL80211_ATTR_GENERATION,
1622 cfg80211_rdev_list_generation))
1623 goto nla_put_failure;
1624
1625 if (cmd != NL80211_CMD_NEW_WIPHY)
1626 goto finish;
1627
1628 switch (state->split_start) {
1629 case 0:
1630 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1631 rdev->wiphy.retry_short) ||
1632 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1633 rdev->wiphy.retry_long) ||
1634 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1635 rdev->wiphy.frag_threshold) ||
1636 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1637 rdev->wiphy.rts_threshold) ||
1638 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1639 rdev->wiphy.coverage_class) ||
1640 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1641 rdev->wiphy.max_scan_ssids) ||
1642 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1643 rdev->wiphy.max_sched_scan_ssids) ||
1644 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1645 rdev->wiphy.max_scan_ie_len) ||
1646 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1647 rdev->wiphy.max_sched_scan_ie_len) ||
1648 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1649 rdev->wiphy.max_match_sets) ||
1650 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1651 rdev->wiphy.max_sched_scan_plans) ||
1652 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1653 rdev->wiphy.max_sched_scan_plan_interval) ||
1654 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1655 rdev->wiphy.max_sched_scan_plan_iterations))
1656 goto nla_put_failure;
1657
1658 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1659 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1660 goto nla_put_failure;
1661 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1662 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1663 goto nla_put_failure;
1664 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1665 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1666 goto nla_put_failure;
1667 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1668 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1669 goto nla_put_failure;
1670 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1671 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1672 goto nla_put_failure;
1673 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1674 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1675 goto nla_put_failure;
1676 state->split_start++;
1677 if (state->split)
1678 break;
1679 case 1:
1680 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1681 sizeof(u32) * rdev->wiphy.n_cipher_suites,
1682 rdev->wiphy.cipher_suites))
1683 goto nla_put_failure;
1684
1685 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1686 rdev->wiphy.max_num_pmkids))
1687 goto nla_put_failure;
1688
1689 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1690 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1691 goto nla_put_failure;
1692
1693 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1694 rdev->wiphy.available_antennas_tx) ||
1695 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1696 rdev->wiphy.available_antennas_rx))
1697 goto nla_put_failure;
1698
1699 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1700 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1701 rdev->wiphy.probe_resp_offload))
1702 goto nla_put_failure;
1703
1704 if ((rdev->wiphy.available_antennas_tx ||
1705 rdev->wiphy.available_antennas_rx) &&
1706 rdev->ops->get_antenna) {
1707 u32 tx_ant = 0, rx_ant = 0;
1708 int res;
1709
1710 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1711 if (!res) {
1712 if (nla_put_u32(msg,
1713 NL80211_ATTR_WIPHY_ANTENNA_TX,
1714 tx_ant) ||
1715 nla_put_u32(msg,
1716 NL80211_ATTR_WIPHY_ANTENNA_RX,
1717 rx_ant))
1718 goto nla_put_failure;
1719 }
1720 }
1721
1722 state->split_start++;
1723 if (state->split)
1724 break;
1725 case 2:
1726 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1727 rdev->wiphy.interface_modes))
1728 goto nla_put_failure;
1729 state->split_start++;
1730 if (state->split)
1731 break;
1732 case 3:
1733 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1734 if (!nl_bands)
1735 goto nla_put_failure;
1736
1737 for (band = state->band_start;
1738 band < NUM_NL80211_BANDS; band++) {
1739 struct ieee80211_supported_band *sband;
1740
1741 sband = rdev->wiphy.bands[band];
1742
1743 if (!sband)
1744 continue;
1745
1746 nl_band = nla_nest_start(msg, band);
1747 if (!nl_band)
1748 goto nla_put_failure;
1749
1750 switch (state->chan_start) {
1751 case 0:
1752 if (nl80211_send_band_rateinfo(msg, sband))
1753 goto nla_put_failure;
1754 state->chan_start++;
1755 if (state->split)
1756 break;
1757 default:
1758 /* add frequencies */
1759 nl_freqs = nla_nest_start(
1760 msg, NL80211_BAND_ATTR_FREQS);
1761 if (!nl_freqs)
1762 goto nla_put_failure;
1763
1764 for (i = state->chan_start - 1;
1765 i < sband->n_channels;
1766 i++) {
1767 nl_freq = nla_nest_start(msg, i);
1768 if (!nl_freq)
1769 goto nla_put_failure;
1770
1771 chan = &sband->channels[i];
1772
1773 if (nl80211_msg_put_channel(
1774 msg, &rdev->wiphy, chan,
1775 state->split))
1776 goto nla_put_failure;
1777
1778 nla_nest_end(msg, nl_freq);
1779 if (state->split)
1780 break;
1781 }
1782 if (i < sband->n_channels)
1783 state->chan_start = i + 2;
1784 else
1785 state->chan_start = 0;
1786 nla_nest_end(msg, nl_freqs);
1787 }
1788
1789 nla_nest_end(msg, nl_band);
1790
1791 if (state->split) {
1792 /* start again here */
1793 if (state->chan_start)
1794 band--;
1795 break;
1796 }
1797 }
1798 nla_nest_end(msg, nl_bands);
1799
1800 if (band < NUM_NL80211_BANDS)
1801 state->band_start = band + 1;
1802 else
1803 state->band_start = 0;
1804
1805 /* if bands & channels are done, continue outside */
1806 if (state->band_start == 0 && state->chan_start == 0)
1807 state->split_start++;
1808 if (state->split)
1809 break;
1810 case 4:
1811 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1812 if (!nl_cmds)
1813 goto nla_put_failure;
1814
1815 i = nl80211_add_commands_unsplit(rdev, msg);
1816 if (i < 0)
1817 goto nla_put_failure;
1818 if (state->split) {
1819 CMD(crit_proto_start, CRIT_PROTOCOL_START);
1820 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1821 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1822 CMD(channel_switch, CHANNEL_SWITCH);
1823 CMD(set_qos_map, SET_QOS_MAP);
1824 if (rdev->wiphy.features &
1825 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1826 CMD(add_tx_ts, ADD_TX_TS);
1827 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1828 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1829 }
1830 #undef CMD
1831
1832 nla_nest_end(msg, nl_cmds);
1833 state->split_start++;
1834 if (state->split)
1835 break;
1836 case 5:
1837 if (rdev->ops->remain_on_channel &&
1838 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1839 nla_put_u32(msg,
1840 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1841 rdev->wiphy.max_remain_on_channel_duration))
1842 goto nla_put_failure;
1843
1844 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1845 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1846 goto nla_put_failure;
1847
1848 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1849 goto nla_put_failure;
1850 state->split_start++;
1851 if (state->split)
1852 break;
1853 case 6:
1854 #ifdef CONFIG_PM
1855 if (nl80211_send_wowlan(msg, rdev, state->split))
1856 goto nla_put_failure;
1857 state->split_start++;
1858 if (state->split)
1859 break;
1860 #else
1861 state->split_start++;
1862 #endif
1863 case 7:
1864 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1865 rdev->wiphy.software_iftypes))
1866 goto nla_put_failure;
1867
1868 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1869 state->split))
1870 goto nla_put_failure;
1871
1872 state->split_start++;
1873 if (state->split)
1874 break;
1875 case 8:
1876 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1877 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1878 rdev->wiphy.ap_sme_capa))
1879 goto nla_put_failure;
1880
1881 features = rdev->wiphy.features;
1882 /*
1883 * We can only add the per-channel limit information if the
1884 * dump is split, otherwise it makes it too big. Therefore
1885 * only advertise it in that case.
1886 */
1887 if (state->split)
1888 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1889 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1890 goto nla_put_failure;
1891
1892 if (rdev->wiphy.ht_capa_mod_mask &&
1893 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1894 sizeof(*rdev->wiphy.ht_capa_mod_mask),
1895 rdev->wiphy.ht_capa_mod_mask))
1896 goto nla_put_failure;
1897
1898 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1899 rdev->wiphy.max_acl_mac_addrs &&
1900 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1901 rdev->wiphy.max_acl_mac_addrs))
1902 goto nla_put_failure;
1903
1904 /*
1905 * Any information below this point is only available to
1906 * applications that can deal with it being split. This
1907 * helps ensure that newly added capabilities don't break
1908 * older tools by overrunning their buffers.
1909 *
1910 * We still increment split_start so that in the split
1911 * case we'll continue with more data in the next round,
1912 * but break unconditionally so unsplit data stops here.
1913 */
1914 state->split_start++;
1915 break;
1916 case 9:
1917 if (rdev->wiphy.extended_capabilities &&
1918 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1919 rdev->wiphy.extended_capabilities_len,
1920 rdev->wiphy.extended_capabilities) ||
1921 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1922 rdev->wiphy.extended_capabilities_len,
1923 rdev->wiphy.extended_capabilities_mask)))
1924 goto nla_put_failure;
1925
1926 if (rdev->wiphy.vht_capa_mod_mask &&
1927 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1928 sizeof(*rdev->wiphy.vht_capa_mod_mask),
1929 rdev->wiphy.vht_capa_mod_mask))
1930 goto nla_put_failure;
1931
1932 state->split_start++;
1933 break;
1934 case 10:
1935 if (nl80211_send_coalesce(msg, rdev))
1936 goto nla_put_failure;
1937
1938 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1939 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1940 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1941 goto nla_put_failure;
1942
1943 if (rdev->wiphy.max_ap_assoc_sta &&
1944 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1945 rdev->wiphy.max_ap_assoc_sta))
1946 goto nla_put_failure;
1947
1948 state->split_start++;
1949 break;
1950 case 11:
1951 if (rdev->wiphy.n_vendor_commands) {
1952 const struct nl80211_vendor_cmd_info *info;
1953 struct nlattr *nested;
1954
1955 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1956 if (!nested)
1957 goto nla_put_failure;
1958
1959 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1960 info = &rdev->wiphy.vendor_commands[i].info;
1961 if (nla_put(msg, i + 1, sizeof(*info), info))
1962 goto nla_put_failure;
1963 }
1964 nla_nest_end(msg, nested);
1965 }
1966
1967 if (rdev->wiphy.n_vendor_events) {
1968 const struct nl80211_vendor_cmd_info *info;
1969 struct nlattr *nested;
1970
1971 nested = nla_nest_start(msg,
1972 NL80211_ATTR_VENDOR_EVENTS);
1973 if (!nested)
1974 goto nla_put_failure;
1975
1976 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1977 info = &rdev->wiphy.vendor_events[i];
1978 if (nla_put(msg, i + 1, sizeof(*info), info))
1979 goto nla_put_failure;
1980 }
1981 nla_nest_end(msg, nested);
1982 }
1983 state->split_start++;
1984 break;
1985 case 12:
1986 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1987 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1988 rdev->wiphy.max_num_csa_counters))
1989 goto nla_put_failure;
1990
1991 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1992 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1993 goto nla_put_failure;
1994
1995 if (rdev->wiphy.max_sched_scan_reqs &&
1996 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1997 rdev->wiphy.max_sched_scan_reqs))
1998 goto nla_put_failure;
1999
2000 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2001 sizeof(rdev->wiphy.ext_features),
2002 rdev->wiphy.ext_features))
2003 goto nla_put_failure;
2004
2005 if (rdev->wiphy.bss_select_support) {
2006 struct nlattr *nested;
2007 u32 bss_select_support = rdev->wiphy.bss_select_support;
2008
2009 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2010 if (!nested)
2011 goto nla_put_failure;
2012
2013 i = 0;
2014 while (bss_select_support) {
2015 if ((bss_select_support & 1) &&
2016 nla_put_flag(msg, i))
2017 goto nla_put_failure;
2018 i++;
2019 bss_select_support >>= 1;
2020 }
2021 nla_nest_end(msg, nested);
2022 }
2023
2024 state->split_start++;
2025 break;
2026 case 13:
2027 if (rdev->wiphy.num_iftype_ext_capab &&
2028 rdev->wiphy.iftype_ext_capab) {
2029 struct nlattr *nested_ext_capab, *nested;
2030
2031 nested = nla_nest_start(msg,
2032 NL80211_ATTR_IFTYPE_EXT_CAPA);
2033 if (!nested)
2034 goto nla_put_failure;
2035
2036 for (i = state->capa_start;
2037 i < rdev->wiphy.num_iftype_ext_capab; i++) {
2038 const struct wiphy_iftype_ext_capab *capab;
2039
2040 capab = &rdev->wiphy.iftype_ext_capab[i];
2041
2042 nested_ext_capab = nla_nest_start(msg, i);
2043 if (!nested_ext_capab ||
2044 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2045 capab->iftype) ||
2046 nla_put(msg, NL80211_ATTR_EXT_CAPA,
2047 capab->extended_capabilities_len,
2048 capab->extended_capabilities) ||
2049 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2050 capab->extended_capabilities_len,
2051 capab->extended_capabilities_mask))
2052 goto nla_put_failure;
2053
2054 nla_nest_end(msg, nested_ext_capab);
2055 if (state->split)
2056 break;
2057 }
2058 nla_nest_end(msg, nested);
2059 if (i < rdev->wiphy.num_iftype_ext_capab) {
2060 state->capa_start = i + 1;
2061 break;
2062 }
2063 }
2064
2065 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2066 rdev->wiphy.nan_supported_bands))
2067 goto nla_put_failure;
2068
2069 if (wiphy_ext_feature_isset(&rdev->wiphy,
2070 NL80211_EXT_FEATURE_TXQS)) {
2071 struct cfg80211_txq_stats txqstats = {};
2072 int res;
2073
2074 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2075 if (!res &&
2076 !nl80211_put_txq_stats(msg, &txqstats,
2077 NL80211_ATTR_TXQ_STATS))
2078 goto nla_put_failure;
2079
2080 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2081 rdev->wiphy.txq_limit))
2082 goto nla_put_failure;
2083 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2084 rdev->wiphy.txq_memory_limit))
2085 goto nla_put_failure;
2086 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2087 rdev->wiphy.txq_quantum))
2088 goto nla_put_failure;
2089 }
2090
2091 /* done */
2092 state->split_start = 0;
2093 break;
2094 }
2095 finish:
2096 genlmsg_end(msg, hdr);
2097 return 0;
2098
2099 nla_put_failure:
2100 genlmsg_cancel(msg, hdr);
2101 return -EMSGSIZE;
2102 }
2103
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)2104 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2105 struct netlink_callback *cb,
2106 struct nl80211_dump_wiphy_state *state)
2107 {
2108 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2109 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2110 nl80211_fam.maxattr, nl80211_policy, NULL);
2111 /* ignore parse errors for backward compatibility */
2112 if (ret)
2113 return 0;
2114
2115 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2116 if (tb[NL80211_ATTR_WIPHY])
2117 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2118 if (tb[NL80211_ATTR_WDEV])
2119 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2120 if (tb[NL80211_ATTR_IFINDEX]) {
2121 struct net_device *netdev;
2122 struct cfg80211_registered_device *rdev;
2123 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2124
2125 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2126 if (!netdev)
2127 return -ENODEV;
2128 if (netdev->ieee80211_ptr) {
2129 rdev = wiphy_to_rdev(
2130 netdev->ieee80211_ptr->wiphy);
2131 state->filter_wiphy = rdev->wiphy_idx;
2132 }
2133 }
2134
2135 return 0;
2136 }
2137
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)2138 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2139 {
2140 int idx = 0, ret;
2141 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2142 struct cfg80211_registered_device *rdev;
2143
2144 rtnl_lock();
2145 if (!state) {
2146 state = kzalloc(sizeof(*state), GFP_KERNEL);
2147 if (!state) {
2148 rtnl_unlock();
2149 return -ENOMEM;
2150 }
2151 state->filter_wiphy = -1;
2152 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2153 if (ret) {
2154 kfree(state);
2155 rtnl_unlock();
2156 return ret;
2157 }
2158 cb->args[0] = (long)state;
2159 }
2160
2161 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2162 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2163 continue;
2164 if (++idx <= state->start)
2165 continue;
2166 if (state->filter_wiphy != -1 &&
2167 state->filter_wiphy != rdev->wiphy_idx)
2168 continue;
2169 /* attempt to fit multiple wiphy data chunks into the skb */
2170 do {
2171 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2172 skb,
2173 NETLINK_CB(cb->skb).portid,
2174 cb->nlh->nlmsg_seq,
2175 NLM_F_MULTI, state);
2176 if (ret < 0) {
2177 /*
2178 * If sending the wiphy data didn't fit (ENOBUFS
2179 * or EMSGSIZE returned), this SKB is still
2180 * empty (so it's not too big because another
2181 * wiphy dataset is already in the skb) and
2182 * we've not tried to adjust the dump allocation
2183 * yet ... then adjust the alloc size to be
2184 * bigger, and return 1 but with the empty skb.
2185 * This results in an empty message being RX'ed
2186 * in userspace, but that is ignored.
2187 *
2188 * We can then retry with the larger buffer.
2189 */
2190 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2191 !skb->len && !state->split &&
2192 cb->min_dump_alloc < 4096) {
2193 cb->min_dump_alloc = 4096;
2194 state->split_start = 0;
2195 rtnl_unlock();
2196 return 1;
2197 }
2198 idx--;
2199 break;
2200 }
2201 } while (state->split_start > 0);
2202 break;
2203 }
2204 rtnl_unlock();
2205
2206 state->start = idx;
2207
2208 return skb->len;
2209 }
2210
nl80211_dump_wiphy_done(struct netlink_callback * cb)2211 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2212 {
2213 kfree((void *)cb->args[0]);
2214 return 0;
2215 }
2216
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)2217 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2218 {
2219 struct sk_buff *msg;
2220 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2221 struct nl80211_dump_wiphy_state state = {};
2222
2223 msg = nlmsg_new(4096, GFP_KERNEL);
2224 if (!msg)
2225 return -ENOMEM;
2226
2227 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2228 info->snd_portid, info->snd_seq, 0,
2229 &state) < 0) {
2230 nlmsg_free(msg);
2231 return -ENOBUFS;
2232 }
2233
2234 return genlmsg_reply(msg, info);
2235 }
2236
2237 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2238 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
2239 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
2240 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
2241 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
2242 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
2243 };
2244
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)2245 static int parse_txq_params(struct nlattr *tb[],
2246 struct ieee80211_txq_params *txq_params)
2247 {
2248 u8 ac;
2249
2250 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2251 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2252 !tb[NL80211_TXQ_ATTR_AIFS])
2253 return -EINVAL;
2254
2255 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2256 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2257 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2258 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2259 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2260
2261 if (ac >= NL80211_NUM_ACS)
2262 return -EINVAL;
2263 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2264 return 0;
2265 }
2266
nl80211_can_set_dev_channel(struct wireless_dev * wdev)2267 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2268 {
2269 /*
2270 * You can only set the channel explicitly for WDS interfaces,
2271 * all others have their channel managed via their respective
2272 * "establish a connection" command (connect, join, ...)
2273 *
2274 * For AP/GO and mesh mode, the channel can be set with the
2275 * channel userspace API, but is only stored and passed to the
2276 * low-level driver when the AP starts or the mesh is joined.
2277 * This is for backward compatibility, userspace can also give
2278 * the channel in the start-ap or join-mesh commands instead.
2279 *
2280 * Monitors are special as they are normally slaved to
2281 * whatever else is going on, so they have their own special
2282 * operation to set the monitor channel if possible.
2283 */
2284 return !wdev ||
2285 wdev->iftype == NL80211_IFTYPE_AP ||
2286 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2287 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2288 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2289 }
2290
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)2291 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2292 struct genl_info *info,
2293 struct cfg80211_chan_def *chandef)
2294 {
2295 u32 control_freq;
2296
2297 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2298 return -EINVAL;
2299
2300 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2301
2302 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2303 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2304 chandef->center_freq1 = control_freq;
2305 chandef->center_freq2 = 0;
2306
2307 /* Primary channel not allowed */
2308 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2309 return -EINVAL;
2310
2311 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2312 enum nl80211_channel_type chantype;
2313
2314 chantype = nla_get_u32(
2315 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2316
2317 switch (chantype) {
2318 case NL80211_CHAN_NO_HT:
2319 case NL80211_CHAN_HT20:
2320 case NL80211_CHAN_HT40PLUS:
2321 case NL80211_CHAN_HT40MINUS:
2322 cfg80211_chandef_create(chandef, chandef->chan,
2323 chantype);
2324 /* user input for center_freq is incorrect */
2325 if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2326 chandef->center_freq1 != nla_get_u32(
2327 info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2328 return -EINVAL;
2329 /* center_freq2 must be zero */
2330 if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2331 nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2332 return -EINVAL;
2333 break;
2334 default:
2335 return -EINVAL;
2336 }
2337 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2338 chandef->width =
2339 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2340 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2341 chandef->center_freq1 =
2342 nla_get_u32(
2343 info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2344 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2345 chandef->center_freq2 =
2346 nla_get_u32(
2347 info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2348 }
2349
2350 if (!cfg80211_chandef_valid(chandef))
2351 return -EINVAL;
2352
2353 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2354 IEEE80211_CHAN_DISABLED))
2355 return -EINVAL;
2356
2357 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2358 chandef->width == NL80211_CHAN_WIDTH_10) &&
2359 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2360 return -EINVAL;
2361
2362 return 0;
2363 }
2364
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info)2365 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2366 struct net_device *dev,
2367 struct genl_info *info)
2368 {
2369 struct cfg80211_chan_def chandef;
2370 int result;
2371 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2372 struct wireless_dev *wdev = NULL;
2373
2374 if (dev)
2375 wdev = dev->ieee80211_ptr;
2376 if (!nl80211_can_set_dev_channel(wdev))
2377 return -EOPNOTSUPP;
2378 if (wdev)
2379 iftype = wdev->iftype;
2380
2381 result = nl80211_parse_chandef(rdev, info, &chandef);
2382 if (result)
2383 return result;
2384
2385 switch (iftype) {
2386 case NL80211_IFTYPE_AP:
2387 case NL80211_IFTYPE_P2P_GO:
2388 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2389 iftype)) {
2390 result = -EINVAL;
2391 break;
2392 }
2393 if (wdev->beacon_interval) {
2394 if (!dev || !rdev->ops->set_ap_chanwidth ||
2395 !(rdev->wiphy.features &
2396 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2397 result = -EBUSY;
2398 break;
2399 }
2400
2401 /* Only allow dynamic channel width changes */
2402 if (chandef.chan != wdev->preset_chandef.chan) {
2403 result = -EBUSY;
2404 break;
2405 }
2406 result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2407 if (result)
2408 break;
2409 }
2410 wdev->preset_chandef = chandef;
2411 result = 0;
2412 break;
2413 case NL80211_IFTYPE_MESH_POINT:
2414 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2415 break;
2416 case NL80211_IFTYPE_MONITOR:
2417 result = cfg80211_set_monitor_channel(rdev, &chandef);
2418 break;
2419 default:
2420 result = -EINVAL;
2421 }
2422
2423 return result;
2424 }
2425
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)2426 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2427 {
2428 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2429 struct net_device *netdev = info->user_ptr[1];
2430
2431 return __nl80211_set_channel(rdev, netdev, info);
2432 }
2433
nl80211_set_wds_peer(struct sk_buff * skb,struct genl_info * info)2434 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2435 {
2436 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2437 struct net_device *dev = info->user_ptr[1];
2438 struct wireless_dev *wdev = dev->ieee80211_ptr;
2439 const u8 *bssid;
2440
2441 if (!info->attrs[NL80211_ATTR_MAC])
2442 return -EINVAL;
2443
2444 if (netif_running(dev))
2445 return -EBUSY;
2446
2447 if (!rdev->ops->set_wds_peer)
2448 return -EOPNOTSUPP;
2449
2450 if (wdev->iftype != NL80211_IFTYPE_WDS)
2451 return -EOPNOTSUPP;
2452
2453 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2454 return rdev_set_wds_peer(rdev, dev, bssid);
2455 }
2456
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)2457 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2458 {
2459 struct cfg80211_registered_device *rdev;
2460 struct net_device *netdev = NULL;
2461 struct wireless_dev *wdev;
2462 int result = 0, rem_txq_params = 0;
2463 struct nlattr *nl_txq_params;
2464 u32 changed;
2465 u8 retry_short = 0, retry_long = 0;
2466 u32 frag_threshold = 0, rts_threshold = 0;
2467 u8 coverage_class = 0;
2468 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2469
2470 ASSERT_RTNL();
2471
2472 /*
2473 * Try to find the wiphy and netdev. Normally this
2474 * function shouldn't need the netdev, but this is
2475 * done for backward compatibility -- previously
2476 * setting the channel was done per wiphy, but now
2477 * it is per netdev. Previous userland like hostapd
2478 * also passed a netdev to set_wiphy, so that it is
2479 * possible to let that go to the right netdev!
2480 */
2481
2482 if (info->attrs[NL80211_ATTR_IFINDEX]) {
2483 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2484
2485 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2486 if (netdev && netdev->ieee80211_ptr)
2487 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2488 else
2489 netdev = NULL;
2490 }
2491
2492 if (!netdev) {
2493 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2494 info->attrs);
2495 if (IS_ERR(rdev))
2496 return PTR_ERR(rdev);
2497 wdev = NULL;
2498 netdev = NULL;
2499 result = 0;
2500 } else
2501 wdev = netdev->ieee80211_ptr;
2502
2503 /*
2504 * end workaround code, by now the rdev is available
2505 * and locked, and wdev may or may not be NULL.
2506 */
2507
2508 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2509 result = cfg80211_dev_rename(
2510 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2511
2512 if (result)
2513 return result;
2514
2515 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2516 struct ieee80211_txq_params txq_params;
2517 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2518
2519 if (!rdev->ops->set_txq_params)
2520 return -EOPNOTSUPP;
2521
2522 if (!netdev)
2523 return -EINVAL;
2524
2525 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2526 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2527 return -EINVAL;
2528
2529 if (!netif_running(netdev))
2530 return -ENETDOWN;
2531
2532 nla_for_each_nested(nl_txq_params,
2533 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2534 rem_txq_params) {
2535 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2536 nl_txq_params,
2537 txq_params_policy,
2538 info->extack);
2539 if (result)
2540 return result;
2541 result = parse_txq_params(tb, &txq_params);
2542 if (result)
2543 return result;
2544
2545 result = rdev_set_txq_params(rdev, netdev,
2546 &txq_params);
2547 if (result)
2548 return result;
2549 }
2550 }
2551
2552 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2553 result = __nl80211_set_channel(
2554 rdev,
2555 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2556 info);
2557 if (result)
2558 return result;
2559 }
2560
2561 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2562 struct wireless_dev *txp_wdev = wdev;
2563 enum nl80211_tx_power_setting type;
2564 int idx, mbm = 0;
2565
2566 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2567 txp_wdev = NULL;
2568
2569 if (!rdev->ops->set_tx_power)
2570 return -EOPNOTSUPP;
2571
2572 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2573 type = nla_get_u32(info->attrs[idx]);
2574
2575 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2576 (type != NL80211_TX_POWER_AUTOMATIC))
2577 return -EINVAL;
2578
2579 if (type != NL80211_TX_POWER_AUTOMATIC) {
2580 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2581 mbm = nla_get_u32(info->attrs[idx]);
2582 }
2583
2584 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2585 if (result)
2586 return result;
2587 }
2588
2589 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2590 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2591 u32 tx_ant, rx_ant;
2592
2593 if ((!rdev->wiphy.available_antennas_tx &&
2594 !rdev->wiphy.available_antennas_rx) ||
2595 !rdev->ops->set_antenna)
2596 return -EOPNOTSUPP;
2597
2598 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2599 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2600
2601 /* reject antenna configurations which don't match the
2602 * available antenna masks, except for the "all" mask */
2603 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2604 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2605 return -EINVAL;
2606
2607 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2608 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2609
2610 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2611 if (result)
2612 return result;
2613 }
2614
2615 changed = 0;
2616
2617 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2618 retry_short = nla_get_u8(
2619 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2620 if (retry_short == 0)
2621 return -EINVAL;
2622
2623 changed |= WIPHY_PARAM_RETRY_SHORT;
2624 }
2625
2626 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2627 retry_long = nla_get_u8(
2628 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2629 if (retry_long == 0)
2630 return -EINVAL;
2631
2632 changed |= WIPHY_PARAM_RETRY_LONG;
2633 }
2634
2635 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2636 frag_threshold = nla_get_u32(
2637 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2638 if (frag_threshold < 256)
2639 return -EINVAL;
2640
2641 if (frag_threshold != (u32) -1) {
2642 /*
2643 * Fragments (apart from the last one) are required to
2644 * have even length. Make the fragmentation code
2645 * simpler by stripping LSB should someone try to use
2646 * odd threshold value.
2647 */
2648 frag_threshold &= ~0x1;
2649 }
2650 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2651 }
2652
2653 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2654 rts_threshold = nla_get_u32(
2655 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2656 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2657 }
2658
2659 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2660 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2661 return -EINVAL;
2662
2663 coverage_class = nla_get_u8(
2664 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2665 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2666 }
2667
2668 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2669 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2670 return -EOPNOTSUPP;
2671
2672 changed |= WIPHY_PARAM_DYN_ACK;
2673 }
2674
2675 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2676 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2677 NL80211_EXT_FEATURE_TXQS))
2678 return -EOPNOTSUPP;
2679 txq_limit = nla_get_u32(
2680 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2681 changed |= WIPHY_PARAM_TXQ_LIMIT;
2682 }
2683
2684 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2685 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2686 NL80211_EXT_FEATURE_TXQS))
2687 return -EOPNOTSUPP;
2688 txq_memory_limit = nla_get_u32(
2689 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2690 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2691 }
2692
2693 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2694 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2695 NL80211_EXT_FEATURE_TXQS))
2696 return -EOPNOTSUPP;
2697 txq_quantum = nla_get_u32(
2698 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2699 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2700 }
2701
2702 if (changed) {
2703 u8 old_retry_short, old_retry_long;
2704 u32 old_frag_threshold, old_rts_threshold;
2705 u8 old_coverage_class;
2706 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2707
2708 if (!rdev->ops->set_wiphy_params)
2709 return -EOPNOTSUPP;
2710
2711 old_retry_short = rdev->wiphy.retry_short;
2712 old_retry_long = rdev->wiphy.retry_long;
2713 old_frag_threshold = rdev->wiphy.frag_threshold;
2714 old_rts_threshold = rdev->wiphy.rts_threshold;
2715 old_coverage_class = rdev->wiphy.coverage_class;
2716 old_txq_limit = rdev->wiphy.txq_limit;
2717 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2718 old_txq_quantum = rdev->wiphy.txq_quantum;
2719
2720 if (changed & WIPHY_PARAM_RETRY_SHORT)
2721 rdev->wiphy.retry_short = retry_short;
2722 if (changed & WIPHY_PARAM_RETRY_LONG)
2723 rdev->wiphy.retry_long = retry_long;
2724 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2725 rdev->wiphy.frag_threshold = frag_threshold;
2726 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2727 rdev->wiphy.rts_threshold = rts_threshold;
2728 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2729 rdev->wiphy.coverage_class = coverage_class;
2730 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2731 rdev->wiphy.txq_limit = txq_limit;
2732 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2733 rdev->wiphy.txq_memory_limit = txq_memory_limit;
2734 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2735 rdev->wiphy.txq_quantum = txq_quantum;
2736
2737 result = rdev_set_wiphy_params(rdev, changed);
2738 if (result) {
2739 rdev->wiphy.retry_short = old_retry_short;
2740 rdev->wiphy.retry_long = old_retry_long;
2741 rdev->wiphy.frag_threshold = old_frag_threshold;
2742 rdev->wiphy.rts_threshold = old_rts_threshold;
2743 rdev->wiphy.coverage_class = old_coverage_class;
2744 rdev->wiphy.txq_limit = old_txq_limit;
2745 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2746 rdev->wiphy.txq_quantum = old_txq_quantum;
2747 return result;
2748 }
2749 }
2750 return 0;
2751 }
2752
wdev_id(struct wireless_dev * wdev)2753 static inline u64 wdev_id(struct wireless_dev *wdev)
2754 {
2755 return (u64)wdev->identifier |
2756 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2757 }
2758
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)2759 static int nl80211_send_chandef(struct sk_buff *msg,
2760 const struct cfg80211_chan_def *chandef)
2761 {
2762 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2763 return -EINVAL;
2764
2765 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2766 chandef->chan->center_freq))
2767 return -ENOBUFS;
2768 switch (chandef->width) {
2769 case NL80211_CHAN_WIDTH_20_NOHT:
2770 case NL80211_CHAN_WIDTH_20:
2771 case NL80211_CHAN_WIDTH_40:
2772 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2773 cfg80211_get_chandef_type(chandef)))
2774 return -ENOBUFS;
2775 break;
2776 default:
2777 break;
2778 }
2779 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2780 return -ENOBUFS;
2781 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2782 return -ENOBUFS;
2783 if (chandef->center_freq2 &&
2784 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2785 return -ENOBUFS;
2786 return 0;
2787 }
2788
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool removal)2789 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2790 struct cfg80211_registered_device *rdev,
2791 struct wireless_dev *wdev, bool removal)
2792 {
2793 struct net_device *dev = wdev->netdev;
2794 u8 cmd = NL80211_CMD_NEW_INTERFACE;
2795 void *hdr;
2796
2797 if (removal)
2798 cmd = NL80211_CMD_DEL_INTERFACE;
2799
2800 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2801 if (!hdr)
2802 return -1;
2803
2804 if (dev &&
2805 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2806 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2807 goto nla_put_failure;
2808
2809 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2810 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2811 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2812 NL80211_ATTR_PAD) ||
2813 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2814 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2815 rdev->devlist_generation ^
2816 (cfg80211_rdev_list_generation << 2)) ||
2817 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
2818 goto nla_put_failure;
2819
2820 if (rdev->ops->get_channel) {
2821 int ret;
2822 struct cfg80211_chan_def chandef;
2823
2824 ret = rdev_get_channel(rdev, wdev, &chandef);
2825 if (ret == 0) {
2826 if (nl80211_send_chandef(msg, &chandef))
2827 goto nla_put_failure;
2828 }
2829 }
2830
2831 if (rdev->ops->get_tx_power) {
2832 int dbm, ret;
2833
2834 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2835 if (ret == 0 &&
2836 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2837 DBM_TO_MBM(dbm)))
2838 goto nla_put_failure;
2839 }
2840
2841 wdev_lock(wdev);
2842 switch (wdev->iftype) {
2843 case NL80211_IFTYPE_AP:
2844 if (wdev->ssid_len &&
2845 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2846 goto nla_put_failure_locked;
2847 break;
2848 case NL80211_IFTYPE_STATION:
2849 case NL80211_IFTYPE_P2P_CLIENT:
2850 case NL80211_IFTYPE_ADHOC: {
2851 const u8 *ssid_ie;
2852 if (!wdev->current_bss)
2853 break;
2854 rcu_read_lock();
2855 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2856 WLAN_EID_SSID);
2857 if (ssid_ie &&
2858 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2859 goto nla_put_failure_rcu_locked;
2860 rcu_read_unlock();
2861 break;
2862 }
2863 default:
2864 /* nothing */
2865 break;
2866 }
2867 wdev_unlock(wdev);
2868
2869 if (rdev->ops->get_txq_stats) {
2870 struct cfg80211_txq_stats txqstats = {};
2871 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
2872
2873 if (ret == 0 &&
2874 !nl80211_put_txq_stats(msg, &txqstats,
2875 NL80211_ATTR_TXQ_STATS))
2876 goto nla_put_failure;
2877 }
2878
2879 genlmsg_end(msg, hdr);
2880 return 0;
2881
2882 nla_put_failure_rcu_locked:
2883 rcu_read_unlock();
2884 nla_put_failure_locked:
2885 wdev_unlock(wdev);
2886 nla_put_failure:
2887 genlmsg_cancel(msg, hdr);
2888 return -EMSGSIZE;
2889 }
2890
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)2891 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2892 {
2893 int wp_idx = 0;
2894 int if_idx = 0;
2895 int wp_start = cb->args[0];
2896 int if_start = cb->args[1];
2897 int filter_wiphy = -1;
2898 struct cfg80211_registered_device *rdev;
2899 struct wireless_dev *wdev;
2900 int ret;
2901
2902 rtnl_lock();
2903 if (!cb->args[2]) {
2904 struct nl80211_dump_wiphy_state state = {
2905 .filter_wiphy = -1,
2906 };
2907
2908 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2909 if (ret)
2910 goto out_unlock;
2911
2912 filter_wiphy = state.filter_wiphy;
2913
2914 /*
2915 * if filtering, set cb->args[2] to +1 since 0 is the default
2916 * value needed to determine that parsing is necessary.
2917 */
2918 if (filter_wiphy >= 0)
2919 cb->args[2] = filter_wiphy + 1;
2920 else
2921 cb->args[2] = -1;
2922 } else if (cb->args[2] > 0) {
2923 filter_wiphy = cb->args[2] - 1;
2924 }
2925
2926 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2927 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2928 continue;
2929 if (wp_idx < wp_start) {
2930 wp_idx++;
2931 continue;
2932 }
2933
2934 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2935 continue;
2936
2937 if_idx = 0;
2938
2939 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2940 if (if_idx < if_start) {
2941 if_idx++;
2942 continue;
2943 }
2944 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2945 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2946 rdev, wdev, false) < 0) {
2947 goto out;
2948 }
2949 if_idx++;
2950 }
2951
2952 wp_idx++;
2953 }
2954 out:
2955 cb->args[0] = wp_idx;
2956 cb->args[1] = if_idx;
2957
2958 ret = skb->len;
2959 out_unlock:
2960 rtnl_unlock();
2961
2962 return ret;
2963 }
2964
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)2965 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2966 {
2967 struct sk_buff *msg;
2968 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2969 struct wireless_dev *wdev = info->user_ptr[1];
2970
2971 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2972 if (!msg)
2973 return -ENOMEM;
2974
2975 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2976 rdev, wdev, false) < 0) {
2977 nlmsg_free(msg);
2978 return -ENOBUFS;
2979 }
2980
2981 return genlmsg_reply(msg, info);
2982 }
2983
2984 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2985 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2986 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2987 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2988 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2989 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2990 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2991 };
2992
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)2993 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2994 {
2995 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2996 int flag;
2997
2998 *mntrflags = 0;
2999
3000 if (!nla)
3001 return -EINVAL;
3002
3003 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3004 mntr_flags_policy, NULL))
3005 return -EINVAL;
3006
3007 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3008 if (flags[flag])
3009 *mntrflags |= (1<<flag);
3010
3011 *mntrflags |= MONITOR_FLAG_CHANGED;
3012
3013 return 0;
3014 }
3015
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)3016 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3017 enum nl80211_iftype type,
3018 struct genl_info *info,
3019 struct vif_params *params)
3020 {
3021 bool change = false;
3022 int err;
3023
3024 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3025 if (type != NL80211_IFTYPE_MONITOR)
3026 return -EINVAL;
3027
3028 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3029 ¶ms->flags);
3030 if (err)
3031 return err;
3032
3033 change = true;
3034 }
3035
3036 if (params->flags & MONITOR_FLAG_ACTIVE &&
3037 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3038 return -EOPNOTSUPP;
3039
3040 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3041 const u8 *mumimo_groups;
3042 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3043
3044 if (type != NL80211_IFTYPE_MONITOR)
3045 return -EINVAL;
3046
3047 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3048 return -EOPNOTSUPP;
3049
3050 mumimo_groups =
3051 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3052
3053 /* bits 0 and 63 are reserved and must be zero */
3054 if ((mumimo_groups[0] & BIT(0)) ||
3055 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3056 return -EINVAL;
3057
3058 params->vht_mumimo_groups = mumimo_groups;
3059 change = true;
3060 }
3061
3062 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3063 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3064
3065 if (type != NL80211_IFTYPE_MONITOR)
3066 return -EINVAL;
3067
3068 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3069 return -EOPNOTSUPP;
3070
3071 params->vht_mumimo_follow_addr =
3072 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3073 change = true;
3074 }
3075
3076 return change ? 1 : 0;
3077 }
3078
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)3079 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3080 struct net_device *netdev, u8 use_4addr,
3081 enum nl80211_iftype iftype)
3082 {
3083 if (!use_4addr) {
3084 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3085 return -EBUSY;
3086 return 0;
3087 }
3088
3089 switch (iftype) {
3090 case NL80211_IFTYPE_AP_VLAN:
3091 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3092 return 0;
3093 break;
3094 case NL80211_IFTYPE_STATION:
3095 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3096 return 0;
3097 break;
3098 default:
3099 break;
3100 }
3101
3102 return -EOPNOTSUPP;
3103 }
3104
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)3105 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3106 {
3107 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3108 struct vif_params params;
3109 int err;
3110 enum nl80211_iftype otype, ntype;
3111 struct net_device *dev = info->user_ptr[1];
3112 bool change = false;
3113
3114 memset(¶ms, 0, sizeof(params));
3115
3116 otype = ntype = dev->ieee80211_ptr->iftype;
3117
3118 if (info->attrs[NL80211_ATTR_IFTYPE]) {
3119 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3120 if (otype != ntype)
3121 change = true;
3122 if (ntype > NL80211_IFTYPE_MAX)
3123 return -EINVAL;
3124 }
3125
3126 if (info->attrs[NL80211_ATTR_MESH_ID]) {
3127 struct wireless_dev *wdev = dev->ieee80211_ptr;
3128
3129 if (ntype != NL80211_IFTYPE_MESH_POINT)
3130 return -EINVAL;
3131 if (netif_running(dev))
3132 return -EBUSY;
3133
3134 wdev_lock(wdev);
3135 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3136 IEEE80211_MAX_MESH_ID_LEN);
3137 wdev->mesh_id_up_len =
3138 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3139 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3140 wdev->mesh_id_up_len);
3141 wdev_unlock(wdev);
3142 }
3143
3144 if (info->attrs[NL80211_ATTR_4ADDR]) {
3145 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3146 change = true;
3147 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3148 if (err)
3149 return err;
3150 } else {
3151 params.use_4addr = -1;
3152 }
3153
3154 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
3155 if (err < 0)
3156 return err;
3157 if (err > 0)
3158 change = true;
3159
3160 if (change)
3161 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
3162 else
3163 err = 0;
3164
3165 if (!err && params.use_4addr != -1)
3166 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3167
3168 return err;
3169 }
3170
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)3171 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3172 {
3173 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3174 struct vif_params params;
3175 struct wireless_dev *wdev;
3176 struct sk_buff *msg;
3177 int err;
3178 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3179
3180 /* to avoid failing a new interface creation due to pending removal */
3181 cfg80211_destroy_ifaces(rdev);
3182
3183 memset(¶ms, 0, sizeof(params));
3184
3185 if (!info->attrs[NL80211_ATTR_IFNAME])
3186 return -EINVAL;
3187
3188 if (info->attrs[NL80211_ATTR_IFTYPE]) {
3189 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3190 if (type > NL80211_IFTYPE_MAX)
3191 return -EINVAL;
3192 }
3193
3194 if (!rdev->ops->add_virtual_intf ||
3195 !(rdev->wiphy.interface_modes & (1 << type)))
3196 return -EOPNOTSUPP;
3197
3198 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3199 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3200 info->attrs[NL80211_ATTR_MAC]) {
3201 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3202 ETH_ALEN);
3203 if (!is_valid_ether_addr(params.macaddr))
3204 return -EADDRNOTAVAIL;
3205 }
3206
3207 if (info->attrs[NL80211_ATTR_4ADDR]) {
3208 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3209 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3210 if (err)
3211 return err;
3212 }
3213
3214 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
3215 if (err < 0)
3216 return err;
3217
3218 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3219 if (!msg)
3220 return -ENOMEM;
3221
3222 wdev = rdev_add_virtual_intf(rdev,
3223 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3224 NET_NAME_USER, type, ¶ms);
3225 if (WARN_ON(!wdev)) {
3226 nlmsg_free(msg);
3227 return -EPROTO;
3228 } else if (IS_ERR(wdev)) {
3229 nlmsg_free(msg);
3230 return PTR_ERR(wdev);
3231 }
3232
3233 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3234 wdev->owner_nlportid = info->snd_portid;
3235
3236 switch (type) {
3237 case NL80211_IFTYPE_MESH_POINT:
3238 if (!info->attrs[NL80211_ATTR_MESH_ID])
3239 break;
3240 wdev_lock(wdev);
3241 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3242 IEEE80211_MAX_MESH_ID_LEN);
3243 wdev->mesh_id_up_len =
3244 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3245 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3246 wdev->mesh_id_up_len);
3247 wdev_unlock(wdev);
3248 break;
3249 case NL80211_IFTYPE_NAN:
3250 case NL80211_IFTYPE_P2P_DEVICE:
3251 /*
3252 * P2P Device and NAN do not have a netdev, so don't go
3253 * through the netdev notifier and must be added here
3254 */
3255 mutex_init(&wdev->mtx);
3256 INIT_LIST_HEAD(&wdev->event_list);
3257 spin_lock_init(&wdev->event_lock);
3258 INIT_LIST_HEAD(&wdev->mgmt_registrations);
3259 spin_lock_init(&wdev->mgmt_registrations_lock);
3260
3261 wdev->identifier = ++rdev->wdev_id;
3262 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3263 rdev->devlist_generation++;
3264 break;
3265 default:
3266 break;
3267 }
3268
3269 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3270 rdev, wdev, false) < 0) {
3271 nlmsg_free(msg);
3272 return -ENOBUFS;
3273 }
3274
3275 /*
3276 * For wdevs which have no associated netdev object (e.g. of type
3277 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3278 * For all other types, the event will be generated from the
3279 * netdev notifier
3280 */
3281 if (!wdev->netdev)
3282 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3283
3284 return genlmsg_reply(msg, info);
3285 }
3286
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)3287 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3288 {
3289 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3290 struct wireless_dev *wdev = info->user_ptr[1];
3291
3292 if (!rdev->ops->del_virtual_intf)
3293 return -EOPNOTSUPP;
3294
3295 /*
3296 * If we remove a wireless device without a netdev then clear
3297 * user_ptr[1] so that nl80211_post_doit won't dereference it
3298 * to check if it needs to do dev_put(). Otherwise it crashes
3299 * since the wdev has been freed, unlike with a netdev where
3300 * we need the dev_put() for the netdev to really be freed.
3301 */
3302 if (!wdev->netdev)
3303 info->user_ptr[1] = NULL;
3304
3305 return rdev_del_virtual_intf(rdev, wdev);
3306 }
3307
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)3308 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3309 {
3310 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3311 struct net_device *dev = info->user_ptr[1];
3312 u16 noack_map;
3313
3314 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3315 return -EINVAL;
3316
3317 if (!rdev->ops->set_noack_map)
3318 return -EOPNOTSUPP;
3319
3320 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3321
3322 return rdev_set_noack_map(rdev, dev, noack_map);
3323 }
3324
3325 struct get_key_cookie {
3326 struct sk_buff *msg;
3327 int error;
3328 int idx;
3329 };
3330
get_key_callback(void * c,struct key_params * params)3331 static void get_key_callback(void *c, struct key_params *params)
3332 {
3333 struct nlattr *key;
3334 struct get_key_cookie *cookie = c;
3335
3336 if ((params->key &&
3337 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3338 params->key_len, params->key)) ||
3339 (params->seq &&
3340 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3341 params->seq_len, params->seq)) ||
3342 (params->cipher &&
3343 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3344 params->cipher)))
3345 goto nla_put_failure;
3346
3347 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3348 if (!key)
3349 goto nla_put_failure;
3350
3351 if ((params->key &&
3352 nla_put(cookie->msg, NL80211_KEY_DATA,
3353 params->key_len, params->key)) ||
3354 (params->seq &&
3355 nla_put(cookie->msg, NL80211_KEY_SEQ,
3356 params->seq_len, params->seq)) ||
3357 (params->cipher &&
3358 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3359 params->cipher)))
3360 goto nla_put_failure;
3361
3362 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3363 goto nla_put_failure;
3364
3365 nla_nest_end(cookie->msg, key);
3366
3367 return;
3368 nla_put_failure:
3369 cookie->error = 1;
3370 }
3371
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)3372 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3373 {
3374 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3375 int err;
3376 struct net_device *dev = info->user_ptr[1];
3377 u8 key_idx = 0;
3378 const u8 *mac_addr = NULL;
3379 bool pairwise;
3380 struct get_key_cookie cookie = {
3381 .error = 0,
3382 };
3383 void *hdr;
3384 struct sk_buff *msg;
3385
3386 if (info->attrs[NL80211_ATTR_KEY_IDX])
3387 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3388
3389 if (key_idx > 5)
3390 return -EINVAL;
3391
3392 if (info->attrs[NL80211_ATTR_MAC])
3393 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3394
3395 pairwise = !!mac_addr;
3396 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3397 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3398
3399 if (kt >= NUM_NL80211_KEYTYPES)
3400 return -EINVAL;
3401 if (kt != NL80211_KEYTYPE_GROUP &&
3402 kt != NL80211_KEYTYPE_PAIRWISE)
3403 return -EINVAL;
3404 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3405 }
3406
3407 if (!rdev->ops->get_key)
3408 return -EOPNOTSUPP;
3409
3410 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3411 return -ENOENT;
3412
3413 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3414 if (!msg)
3415 return -ENOMEM;
3416
3417 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3418 NL80211_CMD_NEW_KEY);
3419 if (!hdr)
3420 goto nla_put_failure;
3421
3422 cookie.msg = msg;
3423 cookie.idx = key_idx;
3424
3425 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3426 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3427 goto nla_put_failure;
3428 if (mac_addr &&
3429 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3430 goto nla_put_failure;
3431
3432 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3433 get_key_callback);
3434
3435 if (err)
3436 goto free_msg;
3437
3438 if (cookie.error)
3439 goto nla_put_failure;
3440
3441 genlmsg_end(msg, hdr);
3442 return genlmsg_reply(msg, info);
3443
3444 nla_put_failure:
3445 err = -ENOBUFS;
3446 free_msg:
3447 nlmsg_free(msg);
3448 return err;
3449 }
3450
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)3451 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3452 {
3453 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3454 struct key_parse key;
3455 int err;
3456 struct net_device *dev = info->user_ptr[1];
3457
3458 err = nl80211_parse_key(info, &key);
3459 if (err)
3460 return err;
3461
3462 if (key.idx < 0)
3463 return -EINVAL;
3464
3465 /* only support setting default key */
3466 if (!key.def && !key.defmgmt)
3467 return -EINVAL;
3468
3469 wdev_lock(dev->ieee80211_ptr);
3470
3471 if (key.def) {
3472 if (!rdev->ops->set_default_key) {
3473 err = -EOPNOTSUPP;
3474 goto out;
3475 }
3476
3477 err = nl80211_key_allowed(dev->ieee80211_ptr);
3478 if (err)
3479 goto out;
3480
3481 err = rdev_set_default_key(rdev, dev, key.idx,
3482 key.def_uni, key.def_multi);
3483
3484 if (err)
3485 goto out;
3486
3487 #ifdef CONFIG_CFG80211_WEXT
3488 dev->ieee80211_ptr->wext.default_key = key.idx;
3489 #endif
3490 } else {
3491 if (key.def_uni || !key.def_multi) {
3492 err = -EINVAL;
3493 goto out;
3494 }
3495
3496 if (!rdev->ops->set_default_mgmt_key) {
3497 err = -EOPNOTSUPP;
3498 goto out;
3499 }
3500
3501 err = nl80211_key_allowed(dev->ieee80211_ptr);
3502 if (err)
3503 goto out;
3504
3505 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3506 if (err)
3507 goto out;
3508
3509 #ifdef CONFIG_CFG80211_WEXT
3510 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3511 #endif
3512 }
3513
3514 out:
3515 wdev_unlock(dev->ieee80211_ptr);
3516
3517 return err;
3518 }
3519
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)3520 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3521 {
3522 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3523 int err;
3524 struct net_device *dev = info->user_ptr[1];
3525 struct key_parse key;
3526 const u8 *mac_addr = NULL;
3527
3528 err = nl80211_parse_key(info, &key);
3529 if (err)
3530 return err;
3531
3532 if (!key.p.key)
3533 return -EINVAL;
3534
3535 if (info->attrs[NL80211_ATTR_MAC])
3536 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3537
3538 if (key.type == -1) {
3539 if (mac_addr)
3540 key.type = NL80211_KEYTYPE_PAIRWISE;
3541 else
3542 key.type = NL80211_KEYTYPE_GROUP;
3543 }
3544
3545 /* for now */
3546 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3547 key.type != NL80211_KEYTYPE_GROUP)
3548 return -EINVAL;
3549
3550 if (!rdev->ops->add_key)
3551 return -EOPNOTSUPP;
3552
3553 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3554 key.type == NL80211_KEYTYPE_PAIRWISE,
3555 mac_addr))
3556 return -EINVAL;
3557
3558 wdev_lock(dev->ieee80211_ptr);
3559 err = nl80211_key_allowed(dev->ieee80211_ptr);
3560 if (!err)
3561 err = rdev_add_key(rdev, dev, key.idx,
3562 key.type == NL80211_KEYTYPE_PAIRWISE,
3563 mac_addr, &key.p);
3564 wdev_unlock(dev->ieee80211_ptr);
3565
3566 return err;
3567 }
3568
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)3569 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3570 {
3571 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3572 int err;
3573 struct net_device *dev = info->user_ptr[1];
3574 u8 *mac_addr = NULL;
3575 struct key_parse key;
3576
3577 err = nl80211_parse_key(info, &key);
3578 if (err)
3579 return err;
3580
3581 if (info->attrs[NL80211_ATTR_MAC])
3582 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3583
3584 if (key.type == -1) {
3585 if (mac_addr)
3586 key.type = NL80211_KEYTYPE_PAIRWISE;
3587 else
3588 key.type = NL80211_KEYTYPE_GROUP;
3589 }
3590
3591 /* for now */
3592 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3593 key.type != NL80211_KEYTYPE_GROUP)
3594 return -EINVAL;
3595
3596 if (!rdev->ops->del_key)
3597 return -EOPNOTSUPP;
3598
3599 wdev_lock(dev->ieee80211_ptr);
3600 err = nl80211_key_allowed(dev->ieee80211_ptr);
3601
3602 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3603 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3604 err = -ENOENT;
3605
3606 if (!err)
3607 err = rdev_del_key(rdev, dev, key.idx,
3608 key.type == NL80211_KEYTYPE_PAIRWISE,
3609 mac_addr);
3610
3611 #ifdef CONFIG_CFG80211_WEXT
3612 if (!err) {
3613 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3614 dev->ieee80211_ptr->wext.default_key = -1;
3615 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3616 dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3617 }
3618 #endif
3619 wdev_unlock(dev->ieee80211_ptr);
3620
3621 return err;
3622 }
3623
3624 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)3625 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3626 {
3627 struct nlattr *attr;
3628 int n_entries = 0, tmp;
3629
3630 nla_for_each_nested(attr, nl_attr, tmp) {
3631 if (nla_len(attr) != ETH_ALEN)
3632 return -EINVAL;
3633
3634 n_entries++;
3635 }
3636
3637 return n_entries;
3638 }
3639
3640 /*
3641 * This function parses ACL information and allocates memory for ACL data.
3642 * On successful return, the calling function is responsible to free the
3643 * ACL buffer returned by this function.
3644 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)3645 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3646 struct genl_info *info)
3647 {
3648 enum nl80211_acl_policy acl_policy;
3649 struct nlattr *attr;
3650 struct cfg80211_acl_data *acl;
3651 int i = 0, n_entries, tmp;
3652
3653 if (!wiphy->max_acl_mac_addrs)
3654 return ERR_PTR(-EOPNOTSUPP);
3655
3656 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3657 return ERR_PTR(-EINVAL);
3658
3659 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3660 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3661 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3662 return ERR_PTR(-EINVAL);
3663
3664 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3665 return ERR_PTR(-EINVAL);
3666
3667 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3668 if (n_entries < 0)
3669 return ERR_PTR(n_entries);
3670
3671 if (n_entries > wiphy->max_acl_mac_addrs)
3672 return ERR_PTR(-ENOTSUPP);
3673
3674 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3675 GFP_KERNEL);
3676 if (!acl)
3677 return ERR_PTR(-ENOMEM);
3678
3679 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3680 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3681 i++;
3682 }
3683
3684 acl->n_acl_entries = n_entries;
3685 acl->acl_policy = acl_policy;
3686
3687 return acl;
3688 }
3689
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)3690 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3691 {
3692 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3693 struct net_device *dev = info->user_ptr[1];
3694 struct cfg80211_acl_data *acl;
3695 int err;
3696
3697 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3698 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3699 return -EOPNOTSUPP;
3700
3701 if (!dev->ieee80211_ptr->beacon_interval)
3702 return -EINVAL;
3703
3704 acl = parse_acl_data(&rdev->wiphy, info);
3705 if (IS_ERR(acl))
3706 return PTR_ERR(acl);
3707
3708 err = rdev_set_mac_acl(rdev, dev, acl);
3709
3710 kfree(acl);
3711
3712 return err;
3713 }
3714
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)3715 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3716 u8 *rates, u8 rates_len)
3717 {
3718 u8 i;
3719 u32 mask = 0;
3720
3721 for (i = 0; i < rates_len; i++) {
3722 int rate = (rates[i] & 0x7f) * 5;
3723 int ridx;
3724
3725 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3726 struct ieee80211_rate *srate =
3727 &sband->bitrates[ridx];
3728 if (rate == srate->bitrate) {
3729 mask |= 1 << ridx;
3730 break;
3731 }
3732 }
3733 if (ridx == sband->n_bitrates)
3734 return 0; /* rate not found */
3735 }
3736
3737 return mask;
3738 }
3739
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])3740 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3741 u8 *rates, u8 rates_len,
3742 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3743 {
3744 u8 i;
3745
3746 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3747
3748 for (i = 0; i < rates_len; i++) {
3749 int ridx, rbit;
3750
3751 ridx = rates[i] / 8;
3752 rbit = BIT(rates[i] % 8);
3753
3754 /* check validity */
3755 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3756 return false;
3757
3758 /* check availability */
3759 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3760 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3761 mcs[ridx] |= rbit;
3762 else
3763 return false;
3764 }
3765
3766 return true;
3767 }
3768
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)3769 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3770 {
3771 u16 mcs_mask = 0;
3772
3773 switch (vht_mcs_map) {
3774 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3775 break;
3776 case IEEE80211_VHT_MCS_SUPPORT_0_7:
3777 mcs_mask = 0x00FF;
3778 break;
3779 case IEEE80211_VHT_MCS_SUPPORT_0_8:
3780 mcs_mask = 0x01FF;
3781 break;
3782 case IEEE80211_VHT_MCS_SUPPORT_0_9:
3783 mcs_mask = 0x03FF;
3784 break;
3785 default:
3786 break;
3787 }
3788
3789 return mcs_mask;
3790 }
3791
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])3792 static void vht_build_mcs_mask(u16 vht_mcs_map,
3793 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3794 {
3795 u8 nss;
3796
3797 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3798 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3799 vht_mcs_map >>= 2;
3800 }
3801 }
3802
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])3803 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3804 struct nl80211_txrate_vht *txrate,
3805 u16 mcs[NL80211_VHT_NSS_MAX])
3806 {
3807 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3808 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3809 u8 i;
3810
3811 if (!sband->vht_cap.vht_supported)
3812 return false;
3813
3814 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3815
3816 /* Build vht_mcs_mask from VHT capabilities */
3817 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3818
3819 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3820 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3821 mcs[i] = txrate->mcs[i];
3822 else
3823 return false;
3824 }
3825
3826 return true;
3827 }
3828
3829 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3830 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3831 .len = NL80211_MAX_SUPP_RATES },
3832 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3833 .len = NL80211_MAX_SUPP_HT_RATES },
3834 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3835 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3836 };
3837
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct cfg80211_bitrate_mask * mask)3838 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3839 struct cfg80211_bitrate_mask *mask)
3840 {
3841 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3842 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3843 int rem, i;
3844 struct nlattr *tx_rates;
3845 struct ieee80211_supported_band *sband;
3846 u16 vht_tx_mcs_map;
3847
3848 memset(mask, 0, sizeof(*mask));
3849 /* Default to all rates enabled */
3850 for (i = 0; i < NUM_NL80211_BANDS; i++) {
3851 sband = rdev->wiphy.bands[i];
3852
3853 if (!sband)
3854 continue;
3855
3856 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3857 memcpy(mask->control[i].ht_mcs,
3858 sband->ht_cap.mcs.rx_mask,
3859 sizeof(mask->control[i].ht_mcs));
3860
3861 if (!sband->vht_cap.vht_supported)
3862 continue;
3863
3864 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3865 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3866 }
3867
3868 /* if no rates are given set it back to the defaults */
3869 if (!info->attrs[NL80211_ATTR_TX_RATES])
3870 goto out;
3871
3872 /* The nested attribute uses enum nl80211_band as the index. This maps
3873 * directly to the enum nl80211_band values used in cfg80211.
3874 */
3875 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3876 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3877 enum nl80211_band band = nla_type(tx_rates);
3878 int err;
3879
3880 if (band < 0 || band >= NUM_NL80211_BANDS)
3881 return -EINVAL;
3882 sband = rdev->wiphy.bands[band];
3883 if (sband == NULL)
3884 return -EINVAL;
3885 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3886 nl80211_txattr_policy, info->extack);
3887 if (err)
3888 return err;
3889 if (tb[NL80211_TXRATE_LEGACY]) {
3890 mask->control[band].legacy = rateset_to_mask(
3891 sband,
3892 nla_data(tb[NL80211_TXRATE_LEGACY]),
3893 nla_len(tb[NL80211_TXRATE_LEGACY]));
3894 if ((mask->control[band].legacy == 0) &&
3895 nla_len(tb[NL80211_TXRATE_LEGACY]))
3896 return -EINVAL;
3897 }
3898 if (tb[NL80211_TXRATE_HT]) {
3899 if (!ht_rateset_to_mask(
3900 sband,
3901 nla_data(tb[NL80211_TXRATE_HT]),
3902 nla_len(tb[NL80211_TXRATE_HT]),
3903 mask->control[band].ht_mcs))
3904 return -EINVAL;
3905 }
3906 if (tb[NL80211_TXRATE_VHT]) {
3907 if (!vht_set_mcs_mask(
3908 sband,
3909 nla_data(tb[NL80211_TXRATE_VHT]),
3910 mask->control[band].vht_mcs))
3911 return -EINVAL;
3912 }
3913 if (tb[NL80211_TXRATE_GI]) {
3914 mask->control[band].gi =
3915 nla_get_u8(tb[NL80211_TXRATE_GI]);
3916 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3917 return -EINVAL;
3918 }
3919
3920 if (mask->control[band].legacy == 0) {
3921 /* don't allow empty legacy rates if HT or VHT
3922 * are not even supported.
3923 */
3924 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3925 rdev->wiphy.bands[band]->vht_cap.vht_supported))
3926 return -EINVAL;
3927
3928 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3929 if (mask->control[band].ht_mcs[i])
3930 goto out;
3931
3932 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3933 if (mask->control[band].vht_mcs[i])
3934 goto out;
3935
3936 /* legacy and mcs rates may not be both empty */
3937 return -EINVAL;
3938 }
3939 }
3940
3941 out:
3942 return 0;
3943 }
3944
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)3945 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3946 enum nl80211_band band,
3947 struct cfg80211_bitrate_mask *beacon_rate)
3948 {
3949 u32 count_ht, count_vht, i;
3950 u32 rate = beacon_rate->control[band].legacy;
3951
3952 /* Allow only one rate */
3953 if (hweight32(rate) > 1)
3954 return -EINVAL;
3955
3956 count_ht = 0;
3957 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3958 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3959 return -EINVAL;
3960 } else if (beacon_rate->control[band].ht_mcs[i]) {
3961 count_ht++;
3962 if (count_ht > 1)
3963 return -EINVAL;
3964 }
3965 if (count_ht && rate)
3966 return -EINVAL;
3967 }
3968
3969 count_vht = 0;
3970 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3971 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3972 return -EINVAL;
3973 } else if (beacon_rate->control[band].vht_mcs[i]) {
3974 count_vht++;
3975 if (count_vht > 1)
3976 return -EINVAL;
3977 }
3978 if (count_vht && rate)
3979 return -EINVAL;
3980 }
3981
3982 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3983 return -EINVAL;
3984
3985 if (rate &&
3986 !wiphy_ext_feature_isset(&rdev->wiphy,
3987 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3988 return -EINVAL;
3989 if (count_ht &&
3990 !wiphy_ext_feature_isset(&rdev->wiphy,
3991 NL80211_EXT_FEATURE_BEACON_RATE_HT))
3992 return -EINVAL;
3993 if (count_vht &&
3994 !wiphy_ext_feature_isset(&rdev->wiphy,
3995 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3996 return -EINVAL;
3997
3998 return 0;
3999 }
4000
nl80211_parse_beacon(struct nlattr * attrs[],struct cfg80211_beacon_data * bcn)4001 static int nl80211_parse_beacon(struct nlattr *attrs[],
4002 struct cfg80211_beacon_data *bcn)
4003 {
4004 bool haveinfo = false;
4005
4006 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
4007 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
4008 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
4009 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
4010 return -EINVAL;
4011
4012 memset(bcn, 0, sizeof(*bcn));
4013
4014 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4015 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4016 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4017 if (!bcn->head_len)
4018 return -EINVAL;
4019 haveinfo = true;
4020 }
4021
4022 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4023 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4024 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4025 haveinfo = true;
4026 }
4027
4028 if (!haveinfo)
4029 return -EINVAL;
4030
4031 if (attrs[NL80211_ATTR_IE]) {
4032 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4033 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4034 }
4035
4036 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4037 bcn->proberesp_ies =
4038 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4039 bcn->proberesp_ies_len =
4040 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4041 }
4042
4043 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4044 bcn->assocresp_ies =
4045 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4046 bcn->assocresp_ies_len =
4047 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4048 }
4049
4050 if (attrs[NL80211_ATTR_PROBE_RESP]) {
4051 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4052 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4053 }
4054
4055 return 0;
4056 }
4057
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const u8 * rates)4058 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4059 const u8 *rates)
4060 {
4061 int i;
4062
4063 if (!rates)
4064 return;
4065
4066 for (i = 0; i < rates[1]; i++) {
4067 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4068 params->ht_required = true;
4069 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4070 params->vht_required = true;
4071 }
4072 }
4073
4074 /*
4075 * Since the nl80211 API didn't include, from the beginning, attributes about
4076 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4077 * benefit of drivers that rebuild IEs in the firmware.
4078 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)4079 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4080 {
4081 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
4082 size_t ies_len = bcn->tail_len;
4083 const u8 *ies = bcn->tail;
4084 const u8 *rates;
4085 const u8 *cap;
4086
4087 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4088 nl80211_check_ap_rate_selectors(params, rates);
4089
4090 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4091 nl80211_check_ap_rate_selectors(params, rates);
4092
4093 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4094 if (cap && cap[1] >= sizeof(*params->ht_cap))
4095 params->ht_cap = (void *)(cap + 2);
4096 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4097 if (cap && cap[1] >= sizeof(*params->vht_cap))
4098 params->vht_cap = (void *)(cap + 2);
4099 }
4100
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)4101 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4102 struct cfg80211_ap_settings *params)
4103 {
4104 struct wireless_dev *wdev;
4105 bool ret = false;
4106
4107 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4108 if (wdev->iftype != NL80211_IFTYPE_AP &&
4109 wdev->iftype != NL80211_IFTYPE_P2P_GO)
4110 continue;
4111
4112 if (!wdev->preset_chandef.chan)
4113 continue;
4114
4115 params->chandef = wdev->preset_chandef;
4116 ret = true;
4117 break;
4118 }
4119
4120 return ret;
4121 }
4122
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)4123 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4124 enum nl80211_auth_type auth_type,
4125 enum nl80211_commands cmd)
4126 {
4127 if (auth_type > NL80211_AUTHTYPE_MAX)
4128 return false;
4129
4130 switch (cmd) {
4131 case NL80211_CMD_AUTHENTICATE:
4132 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4133 auth_type == NL80211_AUTHTYPE_SAE)
4134 return false;
4135 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4136 NL80211_EXT_FEATURE_FILS_STA) &&
4137 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4138 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4139 auth_type == NL80211_AUTHTYPE_FILS_PK))
4140 return false;
4141 return true;
4142 case NL80211_CMD_CONNECT:
4143 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4144 auth_type == NL80211_AUTHTYPE_SAE)
4145 return false;
4146
4147 /* FILS with SK PFS or PK not supported yet */
4148 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4149 auth_type == NL80211_AUTHTYPE_FILS_PK)
4150 return false;
4151 if (!wiphy_ext_feature_isset(
4152 &rdev->wiphy,
4153 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4154 auth_type == NL80211_AUTHTYPE_FILS_SK)
4155 return false;
4156 return true;
4157 case NL80211_CMD_START_AP:
4158 /* SAE not supported yet */
4159 if (auth_type == NL80211_AUTHTYPE_SAE)
4160 return false;
4161 /* FILS not supported yet */
4162 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4163 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4164 auth_type == NL80211_AUTHTYPE_FILS_PK)
4165 return false;
4166 return true;
4167 default:
4168 return false;
4169 }
4170 }
4171
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)4172 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4173 {
4174 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4175 struct net_device *dev = info->user_ptr[1];
4176 struct wireless_dev *wdev = dev->ieee80211_ptr;
4177 struct cfg80211_ap_settings params;
4178 int err;
4179
4180 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4181 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4182 return -EOPNOTSUPP;
4183
4184 if (!rdev->ops->start_ap)
4185 return -EOPNOTSUPP;
4186
4187 if (wdev->beacon_interval)
4188 return -EALREADY;
4189
4190 memset(¶ms, 0, sizeof(params));
4191
4192 /* these are required for START_AP */
4193 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4194 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4195 !info->attrs[NL80211_ATTR_BEACON_HEAD])
4196 return -EINVAL;
4197
4198 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon);
4199 if (err)
4200 return err;
4201
4202 params.beacon_interval =
4203 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4204 params.dtim_period =
4205 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4206
4207 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4208 params.beacon_interval);
4209 if (err)
4210 return err;
4211
4212 /*
4213 * In theory, some of these attributes should be required here
4214 * but since they were not used when the command was originally
4215 * added, keep them optional for old user space programs to let
4216 * them continue to work with drivers that do not need the
4217 * additional information -- drivers must check!
4218 */
4219 if (info->attrs[NL80211_ATTR_SSID]) {
4220 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4221 params.ssid_len =
4222 nla_len(info->attrs[NL80211_ATTR_SSID]);
4223 if (params.ssid_len == 0 ||
4224 params.ssid_len > IEEE80211_MAX_SSID_LEN)
4225 return -EINVAL;
4226 }
4227
4228 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
4229 params.hidden_ssid = nla_get_u32(
4230 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4231 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
4232 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
4233 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
4234 return -EINVAL;
4235 }
4236
4237 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4238
4239 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4240 params.auth_type = nla_get_u32(
4241 info->attrs[NL80211_ATTR_AUTH_TYPE]);
4242 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4243 NL80211_CMD_START_AP))
4244 return -EINVAL;
4245 } else
4246 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4247
4248 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto,
4249 NL80211_MAX_NR_CIPHER_SUITES);
4250 if (err)
4251 return err;
4252
4253 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4254 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4255 return -EOPNOTSUPP;
4256 params.inactivity_timeout = nla_get_u16(
4257 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4258 }
4259
4260 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4261 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4262 return -EINVAL;
4263 params.p2p_ctwindow =
4264 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4265 if (params.p2p_ctwindow > 127)
4266 return -EINVAL;
4267 if (params.p2p_ctwindow != 0 &&
4268 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4269 return -EINVAL;
4270 }
4271
4272 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4273 u8 tmp;
4274
4275 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4276 return -EINVAL;
4277 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4278 if (tmp > 1)
4279 return -EINVAL;
4280 params.p2p_opp_ps = tmp;
4281 if (params.p2p_opp_ps != 0 &&
4282 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4283 return -EINVAL;
4284 }
4285
4286 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4287 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
4288 if (err)
4289 return err;
4290 } else if (wdev->preset_chandef.chan) {
4291 params.chandef = wdev->preset_chandef;
4292 } else if (!nl80211_get_ap_channel(rdev, ¶ms))
4293 return -EINVAL;
4294
4295 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
4296 wdev->iftype))
4297 return -EINVAL;
4298
4299 if (info->attrs[NL80211_ATTR_TX_RATES]) {
4300 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate);
4301 if (err)
4302 return err;
4303
4304 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4305 ¶ms.beacon_rate);
4306 if (err)
4307 return err;
4308 }
4309
4310 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4311 params.smps_mode =
4312 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4313 switch (params.smps_mode) {
4314 case NL80211_SMPS_OFF:
4315 break;
4316 case NL80211_SMPS_STATIC:
4317 if (!(rdev->wiphy.features &
4318 NL80211_FEATURE_STATIC_SMPS))
4319 return -EINVAL;
4320 break;
4321 case NL80211_SMPS_DYNAMIC:
4322 if (!(rdev->wiphy.features &
4323 NL80211_FEATURE_DYNAMIC_SMPS))
4324 return -EINVAL;
4325 break;
4326 default:
4327 return -EINVAL;
4328 }
4329 } else {
4330 params.smps_mode = NL80211_SMPS_OFF;
4331 }
4332
4333 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4334 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4335 return -EOPNOTSUPP;
4336
4337 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4338 params.acl = parse_acl_data(&rdev->wiphy, info);
4339 if (IS_ERR(params.acl))
4340 return PTR_ERR(params.acl);
4341 }
4342
4343 nl80211_calculate_ap_params(¶ms);
4344
4345 wdev_lock(wdev);
4346 err = rdev_start_ap(rdev, dev, ¶ms);
4347 if (!err) {
4348 wdev->preset_chandef = params.chandef;
4349 wdev->beacon_interval = params.beacon_interval;
4350 wdev->chandef = params.chandef;
4351 wdev->ssid_len = params.ssid_len;
4352 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4353
4354 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4355 wdev->conn_owner_nlportid = info->snd_portid;
4356 }
4357 wdev_unlock(wdev);
4358
4359 kfree(params.acl);
4360
4361 return err;
4362 }
4363
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)4364 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4365 {
4366 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4367 struct net_device *dev = info->user_ptr[1];
4368 struct wireless_dev *wdev = dev->ieee80211_ptr;
4369 struct cfg80211_beacon_data params;
4370 int err;
4371
4372 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4373 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4374 return -EOPNOTSUPP;
4375
4376 if (!rdev->ops->change_beacon)
4377 return -EOPNOTSUPP;
4378
4379 if (!wdev->beacon_interval)
4380 return -EINVAL;
4381
4382 err = nl80211_parse_beacon(info->attrs, ¶ms);
4383 if (err)
4384 return err;
4385
4386 wdev_lock(wdev);
4387 err = rdev_change_beacon(rdev, dev, ¶ms);
4388 wdev_unlock(wdev);
4389
4390 return err;
4391 }
4392
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)4393 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4394 {
4395 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4396 struct net_device *dev = info->user_ptr[1];
4397
4398 return cfg80211_stop_ap(rdev, dev, false);
4399 }
4400
4401 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4402 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4403 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4404 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4405 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4406 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4407 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4408 };
4409
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)4410 static int parse_station_flags(struct genl_info *info,
4411 enum nl80211_iftype iftype,
4412 struct station_parameters *params)
4413 {
4414 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4415 struct nlattr *nla;
4416 int flag;
4417
4418 /*
4419 * Try parsing the new attribute first so userspace
4420 * can specify both for older kernels.
4421 */
4422 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4423 if (nla) {
4424 struct nl80211_sta_flag_update *sta_flags;
4425
4426 sta_flags = nla_data(nla);
4427 params->sta_flags_mask = sta_flags->mask;
4428 params->sta_flags_set = sta_flags->set;
4429 params->sta_flags_set &= params->sta_flags_mask;
4430 if ((params->sta_flags_mask |
4431 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4432 return -EINVAL;
4433 return 0;
4434 }
4435
4436 /* if present, parse the old attribute */
4437
4438 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4439 if (!nla)
4440 return 0;
4441
4442 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4443 sta_flags_policy, info->extack))
4444 return -EINVAL;
4445
4446 /*
4447 * Only allow certain flags for interface types so that
4448 * other attributes are silently ignored. Remember that
4449 * this is backward compatibility code with old userspace
4450 * and shouldn't be hit in other cases anyway.
4451 */
4452 switch (iftype) {
4453 case NL80211_IFTYPE_AP:
4454 case NL80211_IFTYPE_AP_VLAN:
4455 case NL80211_IFTYPE_P2P_GO:
4456 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4457 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4458 BIT(NL80211_STA_FLAG_WME) |
4459 BIT(NL80211_STA_FLAG_MFP);
4460 break;
4461 case NL80211_IFTYPE_P2P_CLIENT:
4462 case NL80211_IFTYPE_STATION:
4463 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4464 BIT(NL80211_STA_FLAG_TDLS_PEER);
4465 break;
4466 case NL80211_IFTYPE_MESH_POINT:
4467 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4468 BIT(NL80211_STA_FLAG_MFP) |
4469 BIT(NL80211_STA_FLAG_AUTHORIZED);
4470 break;
4471 default:
4472 return -EINVAL;
4473 }
4474
4475 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4476 if (flags[flag]) {
4477 params->sta_flags_set |= (1<<flag);
4478
4479 /* no longer support new API additions in old API */
4480 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4481 return -EINVAL;
4482 }
4483 }
4484
4485 return 0;
4486 }
4487
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)4488 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4489 int attr)
4490 {
4491 struct nlattr *rate;
4492 u32 bitrate;
4493 u16 bitrate_compat;
4494 enum nl80211_rate_info rate_flg;
4495
4496 rate = nla_nest_start(msg, attr);
4497 if (!rate)
4498 return false;
4499
4500 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4501 bitrate = cfg80211_calculate_bitrate(info);
4502 /* report 16-bit bitrate only if we can */
4503 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4504 if (bitrate > 0 &&
4505 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4506 return false;
4507 if (bitrate_compat > 0 &&
4508 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4509 return false;
4510
4511 switch (info->bw) {
4512 case RATE_INFO_BW_5:
4513 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4514 break;
4515 case RATE_INFO_BW_10:
4516 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4517 break;
4518 default:
4519 WARN_ON(1);
4520 /* fall through */
4521 case RATE_INFO_BW_20:
4522 rate_flg = 0;
4523 break;
4524 case RATE_INFO_BW_40:
4525 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4526 break;
4527 case RATE_INFO_BW_80:
4528 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4529 break;
4530 case RATE_INFO_BW_160:
4531 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4532 break;
4533 case RATE_INFO_BW_HE_RU:
4534 rate_flg = 0;
4535 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4536 }
4537
4538 if (rate_flg && nla_put_flag(msg, rate_flg))
4539 return false;
4540
4541 if (info->flags & RATE_INFO_FLAGS_MCS) {
4542 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4543 return false;
4544 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4545 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4546 return false;
4547 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4548 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4549 return false;
4550 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4551 return false;
4552 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4553 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4554 return false;
4555 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4556 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4557 return false;
4558 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4559 return false;
4560 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4561 return false;
4562 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4563 return false;
4564 if (info->bw == RATE_INFO_BW_HE_RU &&
4565 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4566 info->he_ru_alloc))
4567 return false;
4568 }
4569
4570 nla_nest_end(msg, rate);
4571 return true;
4572 }
4573
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)4574 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4575 int id)
4576 {
4577 void *attr;
4578 int i = 0;
4579
4580 if (!mask)
4581 return true;
4582
4583 attr = nla_nest_start(msg, id);
4584 if (!attr)
4585 return false;
4586
4587 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4588 if (!(mask & BIT(i)))
4589 continue;
4590
4591 if (nla_put_u8(msg, i, signal[i]))
4592 return false;
4593 }
4594
4595 nla_nest_end(msg, attr);
4596
4597 return true;
4598 }
4599
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)4600 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4601 u32 seq, int flags,
4602 struct cfg80211_registered_device *rdev,
4603 struct net_device *dev,
4604 const u8 *mac_addr, struct station_info *sinfo)
4605 {
4606 void *hdr;
4607 struct nlattr *sinfoattr, *bss_param;
4608
4609 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4610 if (!hdr)
4611 return -1;
4612
4613 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4614 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4615 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4616 goto nla_put_failure;
4617
4618 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4619 if (!sinfoattr)
4620 goto nla_put_failure;
4621
4622 #define PUT_SINFO(attr, memb, type) do { \
4623 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
4624 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
4625 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
4626 sinfo->memb)) \
4627 goto nla_put_failure; \
4628 } while (0)
4629 #define PUT_SINFO_U64(attr, memb) do { \
4630 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
4631 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
4632 sinfo->memb, NL80211_STA_INFO_PAD)) \
4633 goto nla_put_failure; \
4634 } while (0)
4635
4636 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4637 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4638
4639 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4640 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4641 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4642 (u32)sinfo->rx_bytes))
4643 goto nla_put_failure;
4644
4645 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4646 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4647 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4648 (u32)sinfo->tx_bytes))
4649 goto nla_put_failure;
4650
4651 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4652 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4653 PUT_SINFO(LLID, llid, u16);
4654 PUT_SINFO(PLID, plid, u16);
4655 PUT_SINFO(PLINK_STATE, plink_state, u8);
4656 PUT_SINFO_U64(RX_DURATION, rx_duration);
4657
4658 switch (rdev->wiphy.signal_type) {
4659 case CFG80211_SIGNAL_TYPE_MBM:
4660 PUT_SINFO(SIGNAL, signal, u8);
4661 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4662 break;
4663 default:
4664 break;
4665 }
4666 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4667 if (!nl80211_put_signal(msg, sinfo->chains,
4668 sinfo->chain_signal,
4669 NL80211_STA_INFO_CHAIN_SIGNAL))
4670 goto nla_put_failure;
4671 }
4672 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4673 if (!nl80211_put_signal(msg, sinfo->chains,
4674 sinfo->chain_signal_avg,
4675 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4676 goto nla_put_failure;
4677 }
4678 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4679 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4680 NL80211_STA_INFO_TX_BITRATE))
4681 goto nla_put_failure;
4682 }
4683 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4684 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4685 NL80211_STA_INFO_RX_BITRATE))
4686 goto nla_put_failure;
4687 }
4688
4689 PUT_SINFO(RX_PACKETS, rx_packets, u32);
4690 PUT_SINFO(TX_PACKETS, tx_packets, u32);
4691 PUT_SINFO(TX_RETRIES, tx_retries, u32);
4692 PUT_SINFO(TX_FAILED, tx_failed, u32);
4693 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4694 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4695 PUT_SINFO(LOCAL_PM, local_pm, u32);
4696 PUT_SINFO(PEER_PM, peer_pm, u32);
4697 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4698
4699 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4700 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4701 if (!bss_param)
4702 goto nla_put_failure;
4703
4704 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4705 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4706 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4707 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4708 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4709 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4710 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4711 sinfo->bss_param.dtim_period) ||
4712 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4713 sinfo->bss_param.beacon_interval))
4714 goto nla_put_failure;
4715
4716 nla_nest_end(msg, bss_param);
4717 }
4718 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4719 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4720 sizeof(struct nl80211_sta_flag_update),
4721 &sinfo->sta_flags))
4722 goto nla_put_failure;
4723
4724 PUT_SINFO_U64(T_OFFSET, t_offset);
4725 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4726 PUT_SINFO_U64(BEACON_RX, rx_beacon);
4727 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4728 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4729 if (wiphy_ext_feature_isset(&rdev->wiphy,
4730 NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT))
4731 PUT_SINFO(DATA_ACK_SIGNAL_AVG, avg_ack_signal, s8);
4732
4733 #undef PUT_SINFO
4734 #undef PUT_SINFO_U64
4735
4736 if (sinfo->pertid) {
4737 struct nlattr *tidsattr;
4738 int tid;
4739
4740 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4741 if (!tidsattr)
4742 goto nla_put_failure;
4743
4744 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4745 struct cfg80211_tid_stats *tidstats;
4746 struct nlattr *tidattr;
4747
4748 tidstats = &sinfo->pertid[tid];
4749
4750 if (!tidstats->filled)
4751 continue;
4752
4753 tidattr = nla_nest_start(msg, tid + 1);
4754 if (!tidattr)
4755 goto nla_put_failure;
4756
4757 #define PUT_TIDVAL_U64(attr, memb) do { \
4758 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
4759 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
4760 tidstats->memb, NL80211_TID_STATS_PAD)) \
4761 goto nla_put_failure; \
4762 } while (0)
4763
4764 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4765 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4766 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4767 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4768
4769 #undef PUT_TIDVAL_U64
4770 if ((tidstats->filled &
4771 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4772 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4773 NL80211_TID_STATS_TXQ_STATS))
4774 goto nla_put_failure;
4775
4776 nla_nest_end(msg, tidattr);
4777 }
4778
4779 nla_nest_end(msg, tidsattr);
4780 }
4781
4782 nla_nest_end(msg, sinfoattr);
4783
4784 if (sinfo->assoc_req_ies_len &&
4785 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4786 sinfo->assoc_req_ies))
4787 goto nla_put_failure;
4788
4789 cfg80211_sinfo_release_content(sinfo);
4790 genlmsg_end(msg, hdr);
4791 return 0;
4792
4793 nla_put_failure:
4794 cfg80211_sinfo_release_content(sinfo);
4795 genlmsg_cancel(msg, hdr);
4796 return -EMSGSIZE;
4797 }
4798
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)4799 static int nl80211_dump_station(struct sk_buff *skb,
4800 struct netlink_callback *cb)
4801 {
4802 struct station_info sinfo;
4803 struct cfg80211_registered_device *rdev;
4804 struct wireless_dev *wdev;
4805 u8 mac_addr[ETH_ALEN];
4806 int sta_idx = cb->args[2];
4807 int err;
4808
4809 rtnl_lock();
4810 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4811 if (err)
4812 goto out_err;
4813
4814 if (!wdev->netdev) {
4815 err = -EINVAL;
4816 goto out_err;
4817 }
4818
4819 if (!rdev->ops->dump_station) {
4820 err = -EOPNOTSUPP;
4821 goto out_err;
4822 }
4823
4824 while (1) {
4825 memset(&sinfo, 0, sizeof(sinfo));
4826 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4827 mac_addr, &sinfo);
4828 if (err == -ENOENT)
4829 break;
4830 if (err)
4831 goto out_err;
4832
4833 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4834 NETLINK_CB(cb->skb).portid,
4835 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4836 rdev, wdev->netdev, mac_addr,
4837 &sinfo) < 0)
4838 goto out;
4839
4840 sta_idx++;
4841 }
4842
4843 out:
4844 cb->args[2] = sta_idx;
4845 err = skb->len;
4846 out_err:
4847 rtnl_unlock();
4848
4849 return err;
4850 }
4851
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)4852 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4853 {
4854 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4855 struct net_device *dev = info->user_ptr[1];
4856 struct station_info sinfo;
4857 struct sk_buff *msg;
4858 u8 *mac_addr = NULL;
4859 int err;
4860
4861 memset(&sinfo, 0, sizeof(sinfo));
4862
4863 if (!info->attrs[NL80211_ATTR_MAC])
4864 return -EINVAL;
4865
4866 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4867
4868 if (!rdev->ops->get_station)
4869 return -EOPNOTSUPP;
4870
4871 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4872 if (err)
4873 return err;
4874
4875 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4876 if (!msg) {
4877 cfg80211_sinfo_release_content(&sinfo);
4878 return -ENOMEM;
4879 }
4880
4881 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4882 info->snd_portid, info->snd_seq, 0,
4883 rdev, dev, mac_addr, &sinfo) < 0) {
4884 nlmsg_free(msg);
4885 return -ENOBUFS;
4886 }
4887
4888 return genlmsg_reply(msg, info);
4889 }
4890
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)4891 int cfg80211_check_station_change(struct wiphy *wiphy,
4892 struct station_parameters *params,
4893 enum cfg80211_station_type statype)
4894 {
4895 if (params->listen_interval != -1 &&
4896 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4897 return -EINVAL;
4898
4899 if (params->support_p2p_ps != -1 &&
4900 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4901 return -EINVAL;
4902
4903 if (params->aid &&
4904 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4905 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4906 return -EINVAL;
4907
4908 /* When you run into this, adjust the code below for the new flag */
4909 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4910
4911 switch (statype) {
4912 case CFG80211_STA_MESH_PEER_KERNEL:
4913 case CFG80211_STA_MESH_PEER_USER:
4914 /*
4915 * No ignoring the TDLS flag here -- the userspace mesh
4916 * code doesn't have the bug of including TDLS in the
4917 * mask everywhere.
4918 */
4919 if (params->sta_flags_mask &
4920 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4921 BIT(NL80211_STA_FLAG_MFP) |
4922 BIT(NL80211_STA_FLAG_AUTHORIZED)))
4923 return -EINVAL;
4924 break;
4925 case CFG80211_STA_TDLS_PEER_SETUP:
4926 case CFG80211_STA_TDLS_PEER_ACTIVE:
4927 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4928 return -EINVAL;
4929 /* ignore since it can't change */
4930 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4931 break;
4932 default:
4933 /* disallow mesh-specific things */
4934 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4935 return -EINVAL;
4936 if (params->local_pm)
4937 return -EINVAL;
4938 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4939 return -EINVAL;
4940 }
4941
4942 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4943 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4944 /* TDLS can't be set, ... */
4945 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4946 return -EINVAL;
4947 /*
4948 * ... but don't bother the driver with it. This works around
4949 * a hostapd/wpa_supplicant issue -- it always includes the
4950 * TLDS_PEER flag in the mask even for AP mode.
4951 */
4952 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4953 }
4954
4955 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4956 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4957 /* reject other things that can't change */
4958 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4959 return -EINVAL;
4960 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4961 return -EINVAL;
4962 if (params->supported_rates)
4963 return -EINVAL;
4964 if (params->ext_capab || params->ht_capa || params->vht_capa ||
4965 params->he_capa)
4966 return -EINVAL;
4967 }
4968
4969 if (statype != CFG80211_STA_AP_CLIENT &&
4970 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4971 if (params->vlan)
4972 return -EINVAL;
4973 }
4974
4975 switch (statype) {
4976 case CFG80211_STA_AP_MLME_CLIENT:
4977 /* Use this only for authorizing/unauthorizing a station */
4978 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4979 return -EOPNOTSUPP;
4980 break;
4981 case CFG80211_STA_AP_CLIENT:
4982 case CFG80211_STA_AP_CLIENT_UNASSOC:
4983 /* accept only the listed bits */
4984 if (params->sta_flags_mask &
4985 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4986 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4987 BIT(NL80211_STA_FLAG_ASSOCIATED) |
4988 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4989 BIT(NL80211_STA_FLAG_WME) |
4990 BIT(NL80211_STA_FLAG_MFP)))
4991 return -EINVAL;
4992
4993 /* but authenticated/associated only if driver handles it */
4994 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4995 params->sta_flags_mask &
4996 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4997 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4998 return -EINVAL;
4999 break;
5000 case CFG80211_STA_IBSS:
5001 case CFG80211_STA_AP_STA:
5002 /* reject any changes other than AUTHORIZED */
5003 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5004 return -EINVAL;
5005 break;
5006 case CFG80211_STA_TDLS_PEER_SETUP:
5007 /* reject any changes other than AUTHORIZED or WME */
5008 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5009 BIT(NL80211_STA_FLAG_WME)))
5010 return -EINVAL;
5011 /* force (at least) rates when authorizing */
5012 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5013 !params->supported_rates)
5014 return -EINVAL;
5015 break;
5016 case CFG80211_STA_TDLS_PEER_ACTIVE:
5017 /* reject any changes */
5018 return -EINVAL;
5019 case CFG80211_STA_MESH_PEER_KERNEL:
5020 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5021 return -EINVAL;
5022 break;
5023 case CFG80211_STA_MESH_PEER_USER:
5024 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5025 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5026 return -EINVAL;
5027 break;
5028 }
5029
5030 /*
5031 * Older kernel versions ignored this attribute entirely, so don't
5032 * reject attempts to update it but mark it as unused instead so the
5033 * driver won't look at the data.
5034 */
5035 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5036 statype != CFG80211_STA_TDLS_PEER_SETUP)
5037 params->opmode_notif_used = false;
5038
5039 return 0;
5040 }
5041 EXPORT_SYMBOL(cfg80211_check_station_change);
5042
5043 /*
5044 * Get vlan interface making sure it is running and on the right wiphy.
5045 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)5046 static struct net_device *get_vlan(struct genl_info *info,
5047 struct cfg80211_registered_device *rdev)
5048 {
5049 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5050 struct net_device *v;
5051 int ret;
5052
5053 if (!vlanattr)
5054 return NULL;
5055
5056 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5057 if (!v)
5058 return ERR_PTR(-ENODEV);
5059
5060 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5061 ret = -EINVAL;
5062 goto error;
5063 }
5064
5065 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5066 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5067 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5068 ret = -EINVAL;
5069 goto error;
5070 }
5071
5072 if (!netif_running(v)) {
5073 ret = -ENETDOWN;
5074 goto error;
5075 }
5076
5077 return v;
5078 error:
5079 dev_put(v);
5080 return ERR_PTR(ret);
5081 }
5082
5083 static const struct nla_policy
5084 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5085 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5086 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5087 };
5088
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)5089 static int nl80211_parse_sta_wme(struct genl_info *info,
5090 struct station_parameters *params)
5091 {
5092 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5093 struct nlattr *nla;
5094 int err;
5095
5096 /* parse WME attributes if present */
5097 if (!info->attrs[NL80211_ATTR_STA_WME])
5098 return 0;
5099
5100 nla = info->attrs[NL80211_ATTR_STA_WME];
5101 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5102 nl80211_sta_wme_policy, info->extack);
5103 if (err)
5104 return err;
5105
5106 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5107 params->uapsd_queues = nla_get_u8(
5108 tb[NL80211_STA_WME_UAPSD_QUEUES]);
5109 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5110 return -EINVAL;
5111
5112 if (tb[NL80211_STA_WME_MAX_SP])
5113 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5114
5115 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5116 return -EINVAL;
5117
5118 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5119
5120 return 0;
5121 }
5122
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)5123 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5124 struct station_parameters *params)
5125 {
5126 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5127 params->supported_channels =
5128 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5129 params->supported_channels_len =
5130 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5131 /*
5132 * Need to include at least one (first channel, number of
5133 * channels) tuple for each subband, and must have proper
5134 * tuples for the rest of the data as well.
5135 */
5136 if (params->supported_channels_len < 2)
5137 return -EINVAL;
5138 if (params->supported_channels_len % 2)
5139 return -EINVAL;
5140 }
5141
5142 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5143 params->supported_oper_classes =
5144 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5145 params->supported_oper_classes_len =
5146 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5147 /*
5148 * The value of the Length field of the Supported Operating
5149 * Classes element is between 2 and 253.
5150 */
5151 if (params->supported_oper_classes_len < 2 ||
5152 params->supported_oper_classes_len > 253)
5153 return -EINVAL;
5154 }
5155 return 0;
5156 }
5157
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)5158 static int nl80211_set_station_tdls(struct genl_info *info,
5159 struct station_parameters *params)
5160 {
5161 int err;
5162 /* Dummy STA entry gets updated once the peer capabilities are known */
5163 if (info->attrs[NL80211_ATTR_PEER_AID])
5164 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5165 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5166 params->ht_capa =
5167 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5168 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5169 params->vht_capa =
5170 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5171 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5172 params->he_capa =
5173 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5174 params->he_capa_len =
5175 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5176
5177 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5178 return -EINVAL;
5179 }
5180
5181 err = nl80211_parse_sta_channel_info(info, params);
5182 if (err)
5183 return err;
5184
5185 return nl80211_parse_sta_wme(info, params);
5186 }
5187
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)5188 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5189 {
5190 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5191 struct net_device *dev = info->user_ptr[1];
5192 struct station_parameters params;
5193 u8 *mac_addr;
5194 int err;
5195
5196 memset(¶ms, 0, sizeof(params));
5197
5198 if (!rdev->ops->change_station)
5199 return -EOPNOTSUPP;
5200
5201 /*
5202 * AID and listen_interval properties can be set only for unassociated
5203 * station. Include these parameters here and will check them in
5204 * cfg80211_check_station_change().
5205 */
5206 if (info->attrs[NL80211_ATTR_STA_AID])
5207 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5208
5209 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5210 params.listen_interval =
5211 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5212 else
5213 params.listen_interval = -1;
5214
5215 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5216 u8 tmp;
5217
5218 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5219 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5220 return -EINVAL;
5221
5222 params.support_p2p_ps = tmp;
5223 } else {
5224 params.support_p2p_ps = -1;
5225 }
5226
5227 if (!info->attrs[NL80211_ATTR_MAC])
5228 return -EINVAL;
5229
5230 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5231
5232 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5233 params.supported_rates =
5234 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5235 params.supported_rates_len =
5236 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5237 }
5238
5239 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5240 params.capability =
5241 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5242 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5243 }
5244
5245 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5246 params.ext_capab =
5247 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5248 params.ext_capab_len =
5249 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5250 }
5251
5252 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
5253 return -EINVAL;
5254
5255 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5256 params.plink_action =
5257 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5258 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5259 return -EINVAL;
5260 }
5261
5262 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5263 params.plink_state =
5264 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5265 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
5266 return -EINVAL;
5267 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
5268 params.peer_aid = nla_get_u16(
5269 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5270 if (params.peer_aid > IEEE80211_MAX_AID)
5271 return -EINVAL;
5272 }
5273 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5274 }
5275
5276 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
5277 enum nl80211_mesh_power_mode pm = nla_get_u32(
5278 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5279
5280 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
5281 pm > NL80211_MESH_POWER_MAX)
5282 return -EINVAL;
5283
5284 params.local_pm = pm;
5285 }
5286
5287 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5288 params.opmode_notif_used = true;
5289 params.opmode_notif =
5290 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5291 }
5292
5293 /* Include parameters for TDLS peer (will check later) */
5294 err = nl80211_set_station_tdls(info, ¶ms);
5295 if (err)
5296 return err;
5297
5298 params.vlan = get_vlan(info, rdev);
5299 if (IS_ERR(params.vlan))
5300 return PTR_ERR(params.vlan);
5301
5302 switch (dev->ieee80211_ptr->iftype) {
5303 case NL80211_IFTYPE_AP:
5304 case NL80211_IFTYPE_AP_VLAN:
5305 case NL80211_IFTYPE_P2P_GO:
5306 case NL80211_IFTYPE_P2P_CLIENT:
5307 case NL80211_IFTYPE_STATION:
5308 case NL80211_IFTYPE_ADHOC:
5309 case NL80211_IFTYPE_MESH_POINT:
5310 break;
5311 default:
5312 err = -EOPNOTSUPP;
5313 goto out_put_vlan;
5314 }
5315
5316 /* driver will call cfg80211_check_station_change() */
5317 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
5318
5319 out_put_vlan:
5320 if (params.vlan)
5321 dev_put(params.vlan);
5322
5323 return err;
5324 }
5325
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)5326 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5327 {
5328 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5329 int err;
5330 struct net_device *dev = info->user_ptr[1];
5331 struct station_parameters params;
5332 u8 *mac_addr = NULL;
5333 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5334 BIT(NL80211_STA_FLAG_ASSOCIATED);
5335
5336 memset(¶ms, 0, sizeof(params));
5337
5338 if (!rdev->ops->add_station)
5339 return -EOPNOTSUPP;
5340
5341 if (!info->attrs[NL80211_ATTR_MAC])
5342 return -EINVAL;
5343
5344 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5345 return -EINVAL;
5346
5347 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5348 return -EINVAL;
5349
5350 if (!info->attrs[NL80211_ATTR_STA_AID] &&
5351 !info->attrs[NL80211_ATTR_PEER_AID])
5352 return -EINVAL;
5353
5354 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5355 params.supported_rates =
5356 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5357 params.supported_rates_len =
5358 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5359 params.listen_interval =
5360 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5361
5362 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5363 u8 tmp;
5364
5365 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5366 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5367 return -EINVAL;
5368
5369 params.support_p2p_ps = tmp;
5370 } else {
5371 /*
5372 * if not specified, assume it's supported for P2P GO interface,
5373 * and is NOT supported for AP interface
5374 */
5375 params.support_p2p_ps =
5376 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5377 }
5378
5379 if (info->attrs[NL80211_ATTR_PEER_AID])
5380 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5381 else
5382 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5383 if (!params.aid || params.aid > IEEE80211_MAX_AID)
5384 return -EINVAL;
5385
5386 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5387 params.capability =
5388 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5389 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5390 }
5391
5392 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5393 params.ext_capab =
5394 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5395 params.ext_capab_len =
5396 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5397 }
5398
5399 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5400 params.ht_capa =
5401 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5402
5403 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5404 params.vht_capa =
5405 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5406
5407 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5408 params.he_capa =
5409 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5410 params.he_capa_len =
5411 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5412
5413 /* max len is validated in nla policy */
5414 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5415 return -EINVAL;
5416 }
5417
5418 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5419 params.opmode_notif_used = true;
5420 params.opmode_notif =
5421 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5422 }
5423
5424 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5425 params.plink_action =
5426 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5427 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5428 return -EINVAL;
5429 }
5430
5431 err = nl80211_parse_sta_channel_info(info, ¶ms);
5432 if (err)
5433 return err;
5434
5435 err = nl80211_parse_sta_wme(info, ¶ms);
5436 if (err)
5437 return err;
5438
5439 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
5440 return -EINVAL;
5441
5442 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5443 * as userspace might just pass through the capabilities from the IEs
5444 * directly, rather than enforcing this restriction and returning an
5445 * error in this case.
5446 */
5447 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5448 params.ht_capa = NULL;
5449 params.vht_capa = NULL;
5450
5451 /* HE requires WME */
5452 if (params.he_capa_len)
5453 return -EINVAL;
5454 }
5455
5456 /* When you run into this, adjust the code below for the new flag */
5457 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5458
5459 switch (dev->ieee80211_ptr->iftype) {
5460 case NL80211_IFTYPE_AP:
5461 case NL80211_IFTYPE_AP_VLAN:
5462 case NL80211_IFTYPE_P2P_GO:
5463 /* ignore WME attributes if iface/sta is not capable */
5464 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5465 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5466 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5467
5468 /* TDLS peers cannot be added */
5469 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5470 info->attrs[NL80211_ATTR_PEER_AID])
5471 return -EINVAL;
5472 /* but don't bother the driver with it */
5473 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5474
5475 /* allow authenticated/associated only if driver handles it */
5476 if (!(rdev->wiphy.features &
5477 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5478 params.sta_flags_mask & auth_assoc)
5479 return -EINVAL;
5480
5481 /* Older userspace, or userspace wanting to be compatible with
5482 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5483 * and assoc flags in the mask, but assumes the station will be
5484 * added as associated anyway since this was the required driver
5485 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5486 * introduced.
5487 * In order to not bother drivers with this quirk in the API
5488 * set the flags in both the mask and set for new stations in
5489 * this case.
5490 */
5491 if (!(params.sta_flags_mask & auth_assoc)) {
5492 params.sta_flags_mask |= auth_assoc;
5493 params.sta_flags_set |= auth_assoc;
5494 }
5495
5496 /* must be last in here for error handling */
5497 params.vlan = get_vlan(info, rdev);
5498 if (IS_ERR(params.vlan))
5499 return PTR_ERR(params.vlan);
5500 break;
5501 case NL80211_IFTYPE_MESH_POINT:
5502 /* ignore uAPSD data */
5503 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5504
5505 /* associated is disallowed */
5506 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5507 return -EINVAL;
5508 /* TDLS peers cannot be added */
5509 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5510 info->attrs[NL80211_ATTR_PEER_AID])
5511 return -EINVAL;
5512 break;
5513 case NL80211_IFTYPE_STATION:
5514 case NL80211_IFTYPE_P2P_CLIENT:
5515 /* ignore uAPSD data */
5516 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5517
5518 /* these are disallowed */
5519 if (params.sta_flags_mask &
5520 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5521 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5522 return -EINVAL;
5523 /* Only TDLS peers can be added */
5524 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5525 return -EINVAL;
5526 /* Can only add if TDLS ... */
5527 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5528 return -EOPNOTSUPP;
5529 /* ... with external setup is supported */
5530 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5531 return -EOPNOTSUPP;
5532 /*
5533 * Older wpa_supplicant versions always mark the TDLS peer
5534 * as authorized, but it shouldn't yet be.
5535 */
5536 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5537 break;
5538 default:
5539 return -EOPNOTSUPP;
5540 }
5541
5542 /* be aware of params.vlan when changing code here */
5543
5544 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
5545
5546 if (params.vlan)
5547 dev_put(params.vlan);
5548 return err;
5549 }
5550
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)5551 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5552 {
5553 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5554 struct net_device *dev = info->user_ptr[1];
5555 struct station_del_parameters params;
5556
5557 memset(¶ms, 0, sizeof(params));
5558
5559 if (info->attrs[NL80211_ATTR_MAC])
5560 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5561
5562 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5563 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5564 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5565 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5566 return -EINVAL;
5567
5568 if (!rdev->ops->del_station)
5569 return -EOPNOTSUPP;
5570
5571 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5572 params.subtype =
5573 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5574 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5575 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5576 return -EINVAL;
5577 } else {
5578 /* Default to Deauthentication frame */
5579 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5580 }
5581
5582 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5583 params.reason_code =
5584 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5585 if (params.reason_code == 0)
5586 return -EINVAL; /* 0 is reserved */
5587 } else {
5588 /* Default to reason code 2 */
5589 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5590 }
5591
5592 return rdev_del_station(rdev, dev, ¶ms);
5593 }
5594
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)5595 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5596 int flags, struct net_device *dev,
5597 u8 *dst, u8 *next_hop,
5598 struct mpath_info *pinfo)
5599 {
5600 void *hdr;
5601 struct nlattr *pinfoattr;
5602
5603 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5604 if (!hdr)
5605 return -1;
5606
5607 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5608 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5609 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5610 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5611 goto nla_put_failure;
5612
5613 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5614 if (!pinfoattr)
5615 goto nla_put_failure;
5616 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5617 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5618 pinfo->frame_qlen))
5619 goto nla_put_failure;
5620 if (((pinfo->filled & MPATH_INFO_SN) &&
5621 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5622 ((pinfo->filled & MPATH_INFO_METRIC) &&
5623 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5624 pinfo->metric)) ||
5625 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5626 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5627 pinfo->exptime)) ||
5628 ((pinfo->filled & MPATH_INFO_FLAGS) &&
5629 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5630 pinfo->flags)) ||
5631 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5632 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5633 pinfo->discovery_timeout)) ||
5634 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5635 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5636 pinfo->discovery_retries)))
5637 goto nla_put_failure;
5638
5639 nla_nest_end(msg, pinfoattr);
5640
5641 genlmsg_end(msg, hdr);
5642 return 0;
5643
5644 nla_put_failure:
5645 genlmsg_cancel(msg, hdr);
5646 return -EMSGSIZE;
5647 }
5648
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)5649 static int nl80211_dump_mpath(struct sk_buff *skb,
5650 struct netlink_callback *cb)
5651 {
5652 struct mpath_info pinfo;
5653 struct cfg80211_registered_device *rdev;
5654 struct wireless_dev *wdev;
5655 u8 dst[ETH_ALEN];
5656 u8 next_hop[ETH_ALEN];
5657 int path_idx = cb->args[2];
5658 int err;
5659
5660 rtnl_lock();
5661 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5662 if (err)
5663 goto out_err;
5664
5665 if (!rdev->ops->dump_mpath) {
5666 err = -EOPNOTSUPP;
5667 goto out_err;
5668 }
5669
5670 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5671 err = -EOPNOTSUPP;
5672 goto out_err;
5673 }
5674
5675 while (1) {
5676 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5677 next_hop, &pinfo);
5678 if (err == -ENOENT)
5679 break;
5680 if (err)
5681 goto out_err;
5682
5683 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5684 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5685 wdev->netdev, dst, next_hop,
5686 &pinfo) < 0)
5687 goto out;
5688
5689 path_idx++;
5690 }
5691
5692 out:
5693 cb->args[2] = path_idx;
5694 err = skb->len;
5695 out_err:
5696 rtnl_unlock();
5697 return err;
5698 }
5699
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)5700 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5701 {
5702 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5703 int err;
5704 struct net_device *dev = info->user_ptr[1];
5705 struct mpath_info pinfo;
5706 struct sk_buff *msg;
5707 u8 *dst = NULL;
5708 u8 next_hop[ETH_ALEN];
5709
5710 memset(&pinfo, 0, sizeof(pinfo));
5711
5712 if (!info->attrs[NL80211_ATTR_MAC])
5713 return -EINVAL;
5714
5715 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5716
5717 if (!rdev->ops->get_mpath)
5718 return -EOPNOTSUPP;
5719
5720 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5721 return -EOPNOTSUPP;
5722
5723 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5724 if (err)
5725 return err;
5726
5727 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5728 if (!msg)
5729 return -ENOMEM;
5730
5731 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5732 dev, dst, next_hop, &pinfo) < 0) {
5733 nlmsg_free(msg);
5734 return -ENOBUFS;
5735 }
5736
5737 return genlmsg_reply(msg, info);
5738 }
5739
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)5740 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5741 {
5742 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5743 struct net_device *dev = info->user_ptr[1];
5744 u8 *dst = NULL;
5745 u8 *next_hop = NULL;
5746
5747 if (!info->attrs[NL80211_ATTR_MAC])
5748 return -EINVAL;
5749
5750 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5751 return -EINVAL;
5752
5753 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5754 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5755
5756 if (!rdev->ops->change_mpath)
5757 return -EOPNOTSUPP;
5758
5759 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5760 return -EOPNOTSUPP;
5761
5762 return rdev_change_mpath(rdev, dev, dst, next_hop);
5763 }
5764
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)5765 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5766 {
5767 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5768 struct net_device *dev = info->user_ptr[1];
5769 u8 *dst = NULL;
5770 u8 *next_hop = NULL;
5771
5772 if (!info->attrs[NL80211_ATTR_MAC])
5773 return -EINVAL;
5774
5775 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5776 return -EINVAL;
5777
5778 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5779 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5780
5781 if (!rdev->ops->add_mpath)
5782 return -EOPNOTSUPP;
5783
5784 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5785 return -EOPNOTSUPP;
5786
5787 return rdev_add_mpath(rdev, dev, dst, next_hop);
5788 }
5789
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)5790 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5791 {
5792 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5793 struct net_device *dev = info->user_ptr[1];
5794 u8 *dst = NULL;
5795
5796 if (info->attrs[NL80211_ATTR_MAC])
5797 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5798
5799 if (!rdev->ops->del_mpath)
5800 return -EOPNOTSUPP;
5801
5802 return rdev_del_mpath(rdev, dev, dst);
5803 }
5804
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)5805 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5806 {
5807 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5808 int err;
5809 struct net_device *dev = info->user_ptr[1];
5810 struct mpath_info pinfo;
5811 struct sk_buff *msg;
5812 u8 *dst = NULL;
5813 u8 mpp[ETH_ALEN];
5814
5815 memset(&pinfo, 0, sizeof(pinfo));
5816
5817 if (!info->attrs[NL80211_ATTR_MAC])
5818 return -EINVAL;
5819
5820 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5821
5822 if (!rdev->ops->get_mpp)
5823 return -EOPNOTSUPP;
5824
5825 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5826 return -EOPNOTSUPP;
5827
5828 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5829 if (err)
5830 return err;
5831
5832 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5833 if (!msg)
5834 return -ENOMEM;
5835
5836 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5837 dev, dst, mpp, &pinfo) < 0) {
5838 nlmsg_free(msg);
5839 return -ENOBUFS;
5840 }
5841
5842 return genlmsg_reply(msg, info);
5843 }
5844
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)5845 static int nl80211_dump_mpp(struct sk_buff *skb,
5846 struct netlink_callback *cb)
5847 {
5848 struct mpath_info pinfo;
5849 struct cfg80211_registered_device *rdev;
5850 struct wireless_dev *wdev;
5851 u8 dst[ETH_ALEN];
5852 u8 mpp[ETH_ALEN];
5853 int path_idx = cb->args[2];
5854 int err;
5855
5856 rtnl_lock();
5857 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5858 if (err)
5859 goto out_err;
5860
5861 if (!rdev->ops->dump_mpp) {
5862 err = -EOPNOTSUPP;
5863 goto out_err;
5864 }
5865
5866 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5867 err = -EOPNOTSUPP;
5868 goto out_err;
5869 }
5870
5871 while (1) {
5872 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5873 mpp, &pinfo);
5874 if (err == -ENOENT)
5875 break;
5876 if (err)
5877 goto out_err;
5878
5879 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5880 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5881 wdev->netdev, dst, mpp,
5882 &pinfo) < 0)
5883 goto out;
5884
5885 path_idx++;
5886 }
5887
5888 out:
5889 cb->args[2] = path_idx;
5890 err = skb->len;
5891 out_err:
5892 rtnl_unlock();
5893 return err;
5894 }
5895
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)5896 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5897 {
5898 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5899 struct net_device *dev = info->user_ptr[1];
5900 struct wireless_dev *wdev = dev->ieee80211_ptr;
5901 struct bss_parameters params;
5902 int err;
5903
5904 memset(¶ms, 0, sizeof(params));
5905 /* default to not changing parameters */
5906 params.use_cts_prot = -1;
5907 params.use_short_preamble = -1;
5908 params.use_short_slot_time = -1;
5909 params.ap_isolate = -1;
5910 params.ht_opmode = -1;
5911 params.p2p_ctwindow = -1;
5912 params.p2p_opp_ps = -1;
5913
5914 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5915 params.use_cts_prot =
5916 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5917 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5918 params.use_short_preamble =
5919 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5920 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5921 params.use_short_slot_time =
5922 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5923 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5924 params.basic_rates =
5925 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5926 params.basic_rates_len =
5927 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5928 }
5929 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5930 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5931 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5932 params.ht_opmode =
5933 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5934
5935 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5936 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5937 return -EINVAL;
5938 params.p2p_ctwindow =
5939 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5940 if (params.p2p_ctwindow < 0)
5941 return -EINVAL;
5942 if (params.p2p_ctwindow != 0 &&
5943 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5944 return -EINVAL;
5945 }
5946
5947 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5948 u8 tmp;
5949
5950 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5951 return -EINVAL;
5952 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5953 if (tmp > 1)
5954 return -EINVAL;
5955 params.p2p_opp_ps = tmp;
5956 if (params.p2p_opp_ps &&
5957 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5958 return -EINVAL;
5959 }
5960
5961 if (!rdev->ops->change_bss)
5962 return -EOPNOTSUPP;
5963
5964 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5965 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5966 return -EOPNOTSUPP;
5967
5968 wdev_lock(wdev);
5969 err = rdev_change_bss(rdev, dev, ¶ms);
5970 wdev_unlock(wdev);
5971
5972 return err;
5973 }
5974
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)5975 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5976 {
5977 char *data = NULL;
5978 bool is_indoor;
5979 enum nl80211_user_reg_hint_type user_reg_hint_type;
5980 u32 owner_nlportid;
5981
5982 /*
5983 * You should only get this when cfg80211 hasn't yet initialized
5984 * completely when built-in to the kernel right between the time
5985 * window between nl80211_init() and regulatory_init(), if that is
5986 * even possible.
5987 */
5988 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5989 return -EINPROGRESS;
5990
5991 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5992 user_reg_hint_type =
5993 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5994 else
5995 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5996
5997 switch (user_reg_hint_type) {
5998 case NL80211_USER_REG_HINT_USER:
5999 case NL80211_USER_REG_HINT_CELL_BASE:
6000 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6001 return -EINVAL;
6002
6003 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6004 return regulatory_hint_user(data, user_reg_hint_type);
6005 case NL80211_USER_REG_HINT_INDOOR:
6006 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6007 owner_nlportid = info->snd_portid;
6008 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6009 } else {
6010 owner_nlportid = 0;
6011 is_indoor = true;
6012 }
6013
6014 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6015 default:
6016 return -EINVAL;
6017 }
6018 }
6019
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)6020 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6021 {
6022 return reg_reload_regdb();
6023 }
6024
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)6025 static int nl80211_get_mesh_config(struct sk_buff *skb,
6026 struct genl_info *info)
6027 {
6028 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6029 struct net_device *dev = info->user_ptr[1];
6030 struct wireless_dev *wdev = dev->ieee80211_ptr;
6031 struct mesh_config cur_params;
6032 int err = 0;
6033 void *hdr;
6034 struct nlattr *pinfoattr;
6035 struct sk_buff *msg;
6036
6037 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6038 return -EOPNOTSUPP;
6039
6040 if (!rdev->ops->get_mesh_config)
6041 return -EOPNOTSUPP;
6042
6043 wdev_lock(wdev);
6044 /* If not connected, get default parameters */
6045 if (!wdev->mesh_id_len)
6046 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6047 else
6048 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6049 wdev_unlock(wdev);
6050
6051 if (err)
6052 return err;
6053
6054 /* Draw up a netlink message to send back */
6055 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6056 if (!msg)
6057 return -ENOMEM;
6058 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6059 NL80211_CMD_GET_MESH_CONFIG);
6060 if (!hdr)
6061 goto out;
6062 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6063 if (!pinfoattr)
6064 goto nla_put_failure;
6065 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6066 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6067 cur_params.dot11MeshRetryTimeout) ||
6068 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6069 cur_params.dot11MeshConfirmTimeout) ||
6070 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6071 cur_params.dot11MeshHoldingTimeout) ||
6072 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6073 cur_params.dot11MeshMaxPeerLinks) ||
6074 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6075 cur_params.dot11MeshMaxRetries) ||
6076 nla_put_u8(msg, NL80211_MESHCONF_TTL,
6077 cur_params.dot11MeshTTL) ||
6078 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6079 cur_params.element_ttl) ||
6080 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6081 cur_params.auto_open_plinks) ||
6082 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6083 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6084 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6085 cur_params.dot11MeshHWMPmaxPREQretries) ||
6086 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6087 cur_params.path_refresh_time) ||
6088 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6089 cur_params.min_discovery_timeout) ||
6090 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6091 cur_params.dot11MeshHWMPactivePathTimeout) ||
6092 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6093 cur_params.dot11MeshHWMPpreqMinInterval) ||
6094 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6095 cur_params.dot11MeshHWMPperrMinInterval) ||
6096 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6097 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6098 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6099 cur_params.dot11MeshHWMPRootMode) ||
6100 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6101 cur_params.dot11MeshHWMPRannInterval) ||
6102 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6103 cur_params.dot11MeshGateAnnouncementProtocol) ||
6104 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6105 cur_params.dot11MeshForwarding) ||
6106 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6107 cur_params.rssi_threshold) ||
6108 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6109 cur_params.ht_opmode) ||
6110 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6111 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6112 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6113 cur_params.dot11MeshHWMProotInterval) ||
6114 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6115 cur_params.dot11MeshHWMPconfirmationInterval) ||
6116 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6117 cur_params.power_mode) ||
6118 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6119 cur_params.dot11MeshAwakeWindowDuration) ||
6120 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6121 cur_params.plink_timeout))
6122 goto nla_put_failure;
6123 nla_nest_end(msg, pinfoattr);
6124 genlmsg_end(msg, hdr);
6125 return genlmsg_reply(msg, info);
6126
6127 nla_put_failure:
6128 out:
6129 nlmsg_free(msg);
6130 return -ENOBUFS;
6131 }
6132
6133 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6134 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
6135 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
6136 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
6137 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
6138 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
6139 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
6140 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
6141 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
6142 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
6143 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6144 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6145 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
6146 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6147 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
6148 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
6149 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
6150 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
6151 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
6152 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
6153 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
6154 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
6155 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6156 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6157 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
6158 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
6159 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
6160 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6161 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6162 };
6163
6164 static const struct nla_policy
6165 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6166 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6167 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6168 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6169 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6170 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6171 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6172 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
6173 .len = IEEE80211_MAX_DATA_LEN },
6174 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6175 };
6176
nl80211_check_bool(const struct nlattr * nla,u8 min,u8 max,bool * out)6177 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
6178 {
6179 u8 val = nla_get_u8(nla);
6180 if (val < min || val > max)
6181 return -EINVAL;
6182 *out = val;
6183 return 0;
6184 }
6185
nl80211_check_u8(const struct nlattr * nla,u8 min,u8 max,u8 * out)6186 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
6187 {
6188 u8 val = nla_get_u8(nla);
6189 if (val < min || val > max)
6190 return -EINVAL;
6191 *out = val;
6192 return 0;
6193 }
6194
nl80211_check_u16(const struct nlattr * nla,u16 min,u16 max,u16 * out)6195 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
6196 {
6197 u16 val = nla_get_u16(nla);
6198 if (val < min || val > max)
6199 return -EINVAL;
6200 *out = val;
6201 return 0;
6202 }
6203
nl80211_check_u32(const struct nlattr * nla,u32 min,u32 max,u32 * out)6204 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
6205 {
6206 u32 val = nla_get_u32(nla);
6207 if (val < min || val > max)
6208 return -EINVAL;
6209 *out = val;
6210 return 0;
6211 }
6212
nl80211_check_s32(const struct nlattr * nla,s32 min,s32 max,s32 * out)6213 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
6214 {
6215 s32 val = nla_get_s32(nla);
6216 if (val < min || val > max)
6217 return -EINVAL;
6218 *out = val;
6219 return 0;
6220 }
6221
nl80211_check_power_mode(const struct nlattr * nla,enum nl80211_mesh_power_mode min,enum nl80211_mesh_power_mode max,enum nl80211_mesh_power_mode * out)6222 static int nl80211_check_power_mode(const struct nlattr *nla,
6223 enum nl80211_mesh_power_mode min,
6224 enum nl80211_mesh_power_mode max,
6225 enum nl80211_mesh_power_mode *out)
6226 {
6227 u32 val = nla_get_u32(nla);
6228 if (val < min || val > max)
6229 return -EINVAL;
6230 *out = val;
6231 return 0;
6232 }
6233
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)6234 static int nl80211_parse_mesh_config(struct genl_info *info,
6235 struct mesh_config *cfg,
6236 u32 *mask_out)
6237 {
6238 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6239 u32 mask = 0;
6240 u16 ht_opmode;
6241
6242 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
6243 do { \
6244 if (tb[attr]) { \
6245 if (fn(tb[attr], min, max, &cfg->param)) \
6246 return -EINVAL; \
6247 mask |= (1 << (attr - 1)); \
6248 } \
6249 } while (0)
6250
6251 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6252 return -EINVAL;
6253 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6254 info->attrs[NL80211_ATTR_MESH_CONFIG],
6255 nl80211_meshconf_params_policy, info->extack))
6256 return -EINVAL;
6257
6258 /* This makes sure that there aren't more than 32 mesh config
6259 * parameters (otherwise our bitfield scheme would not work.) */
6260 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6261
6262 /* Fill in the params struct */
6263 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
6264 mask, NL80211_MESHCONF_RETRY_TIMEOUT,
6265 nl80211_check_u16);
6266 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
6267 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6268 nl80211_check_u16);
6269 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
6270 mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
6271 nl80211_check_u16);
6272 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
6273 mask, NL80211_MESHCONF_MAX_PEER_LINKS,
6274 nl80211_check_u16);
6275 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
6276 mask, NL80211_MESHCONF_MAX_RETRIES,
6277 nl80211_check_u8);
6278 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
6279 mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
6280 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
6281 mask, NL80211_MESHCONF_ELEMENT_TTL,
6282 nl80211_check_u8);
6283 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
6284 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6285 nl80211_check_bool);
6286 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6287 1, 255, mask,
6288 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6289 nl80211_check_u32);
6290 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
6291 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6292 nl80211_check_u8);
6293 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
6294 mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
6295 nl80211_check_u32);
6296 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
6297 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6298 nl80211_check_u16);
6299 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6300 1, 65535, mask,
6301 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6302 nl80211_check_u32);
6303 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
6304 1, 65535, mask,
6305 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6306 nl80211_check_u16);
6307 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
6308 1, 65535, mask,
6309 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6310 nl80211_check_u16);
6311 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6312 dot11MeshHWMPnetDiameterTraversalTime,
6313 1, 65535, mask,
6314 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6315 nl80211_check_u16);
6316 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
6317 mask, NL80211_MESHCONF_HWMP_ROOTMODE,
6318 nl80211_check_u8);
6319 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
6320 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6321 nl80211_check_u16);
6322 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6323 dot11MeshGateAnnouncementProtocol, 0, 1,
6324 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6325 nl80211_check_bool);
6326 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
6327 mask, NL80211_MESHCONF_FORWARDING,
6328 nl80211_check_bool);
6329 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6330 mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6331 nl80211_check_s32);
6332 /*
6333 * Check HT operation mode based on
6334 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6335 */
6336 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6337 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6338
6339 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6340 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6341 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6342 return -EINVAL;
6343
6344 /* NON_HT_STA bit is reserved, but some programs set it */
6345 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6346
6347 cfg->ht_opmode = ht_opmode;
6348 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6349 }
6350 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6351 1, 65535, mask,
6352 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6353 nl80211_check_u32);
6354 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6355 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6356 nl80211_check_u16);
6357 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6358 dot11MeshHWMPconfirmationInterval,
6359 1, 65535, mask,
6360 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6361 nl80211_check_u16);
6362 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6363 NL80211_MESH_POWER_ACTIVE,
6364 NL80211_MESH_POWER_MAX,
6365 mask, NL80211_MESHCONF_POWER_MODE,
6366 nl80211_check_power_mode);
6367 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6368 0, 65535, mask,
6369 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6370 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6371 mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6372 nl80211_check_u32);
6373 if (mask_out)
6374 *mask_out = mask;
6375
6376 return 0;
6377
6378 #undef FILL_IN_MESH_PARAM_IF_SET
6379 }
6380
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)6381 static int nl80211_parse_mesh_setup(struct genl_info *info,
6382 struct mesh_setup *setup)
6383 {
6384 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6385 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6386
6387 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6388 return -EINVAL;
6389 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6390 info->attrs[NL80211_ATTR_MESH_SETUP],
6391 nl80211_mesh_setup_params_policy, info->extack))
6392 return -EINVAL;
6393
6394 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6395 setup->sync_method =
6396 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6397 IEEE80211_SYNC_METHOD_VENDOR :
6398 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6399
6400 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6401 setup->path_sel_proto =
6402 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6403 IEEE80211_PATH_PROTOCOL_VENDOR :
6404 IEEE80211_PATH_PROTOCOL_HWMP;
6405
6406 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6407 setup->path_metric =
6408 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6409 IEEE80211_PATH_METRIC_VENDOR :
6410 IEEE80211_PATH_METRIC_AIRTIME;
6411
6412 if (tb[NL80211_MESH_SETUP_IE]) {
6413 struct nlattr *ieattr =
6414 tb[NL80211_MESH_SETUP_IE];
6415 if (!is_valid_ie_attr(ieattr))
6416 return -EINVAL;
6417 setup->ie = nla_data(ieattr);
6418 setup->ie_len = nla_len(ieattr);
6419 }
6420 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6421 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6422 return -EINVAL;
6423 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6424 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6425 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6426 if (setup->is_secure)
6427 setup->user_mpm = true;
6428
6429 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6430 if (!setup->user_mpm)
6431 return -EINVAL;
6432 setup->auth_id =
6433 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6434 }
6435
6436 return 0;
6437 }
6438
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)6439 static int nl80211_update_mesh_config(struct sk_buff *skb,
6440 struct genl_info *info)
6441 {
6442 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6443 struct net_device *dev = info->user_ptr[1];
6444 struct wireless_dev *wdev = dev->ieee80211_ptr;
6445 struct mesh_config cfg;
6446 u32 mask;
6447 int err;
6448
6449 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6450 return -EOPNOTSUPP;
6451
6452 if (!rdev->ops->update_mesh_config)
6453 return -EOPNOTSUPP;
6454
6455 err = nl80211_parse_mesh_config(info, &cfg, &mask);
6456 if (err)
6457 return err;
6458
6459 wdev_lock(wdev);
6460 if (!wdev->mesh_id_len)
6461 err = -ENOLINK;
6462
6463 if (!err)
6464 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6465
6466 wdev_unlock(wdev);
6467
6468 return err;
6469 }
6470
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)6471 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6472 struct sk_buff *msg)
6473 {
6474 struct nlattr *nl_reg_rules;
6475 unsigned int i;
6476
6477 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6478 (regdom->dfs_region &&
6479 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6480 goto nla_put_failure;
6481
6482 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6483 if (!nl_reg_rules)
6484 goto nla_put_failure;
6485
6486 for (i = 0; i < regdom->n_reg_rules; i++) {
6487 struct nlattr *nl_reg_rule;
6488 const struct ieee80211_reg_rule *reg_rule;
6489 const struct ieee80211_freq_range *freq_range;
6490 const struct ieee80211_power_rule *power_rule;
6491 unsigned int max_bandwidth_khz;
6492
6493 reg_rule = ®dom->reg_rules[i];
6494 freq_range = ®_rule->freq_range;
6495 power_rule = ®_rule->power_rule;
6496
6497 nl_reg_rule = nla_nest_start(msg, i);
6498 if (!nl_reg_rule)
6499 goto nla_put_failure;
6500
6501 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6502 if (!max_bandwidth_khz)
6503 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6504 reg_rule);
6505
6506 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6507 reg_rule->flags) ||
6508 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6509 freq_range->start_freq_khz) ||
6510 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6511 freq_range->end_freq_khz) ||
6512 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6513 max_bandwidth_khz) ||
6514 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6515 power_rule->max_antenna_gain) ||
6516 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6517 power_rule->max_eirp) ||
6518 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6519 reg_rule->dfs_cac_ms))
6520 goto nla_put_failure;
6521
6522 nla_nest_end(msg, nl_reg_rule);
6523 }
6524
6525 nla_nest_end(msg, nl_reg_rules);
6526 return 0;
6527
6528 nla_put_failure:
6529 return -EMSGSIZE;
6530 }
6531
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)6532 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6533 {
6534 const struct ieee80211_regdomain *regdom = NULL;
6535 struct cfg80211_registered_device *rdev;
6536 struct wiphy *wiphy = NULL;
6537 struct sk_buff *msg;
6538 void *hdr;
6539
6540 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6541 if (!msg)
6542 return -ENOBUFS;
6543
6544 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6545 NL80211_CMD_GET_REG);
6546 if (!hdr)
6547 goto put_failure;
6548
6549 if (info->attrs[NL80211_ATTR_WIPHY]) {
6550 bool self_managed;
6551
6552 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6553 if (IS_ERR(rdev)) {
6554 nlmsg_free(msg);
6555 return PTR_ERR(rdev);
6556 }
6557
6558 wiphy = &rdev->wiphy;
6559 self_managed = wiphy->regulatory_flags &
6560 REGULATORY_WIPHY_SELF_MANAGED;
6561 regdom = get_wiphy_regdom(wiphy);
6562
6563 /* a self-managed-reg device must have a private regdom */
6564 if (WARN_ON(!regdom && self_managed)) {
6565 nlmsg_free(msg);
6566 return -EINVAL;
6567 }
6568
6569 if (regdom &&
6570 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6571 goto nla_put_failure;
6572 }
6573
6574 if (!wiphy && reg_last_request_cell_base() &&
6575 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6576 NL80211_USER_REG_HINT_CELL_BASE))
6577 goto nla_put_failure;
6578
6579 rcu_read_lock();
6580
6581 if (!regdom)
6582 regdom = rcu_dereference(cfg80211_regdomain);
6583
6584 if (nl80211_put_regdom(regdom, msg))
6585 goto nla_put_failure_rcu;
6586
6587 rcu_read_unlock();
6588
6589 genlmsg_end(msg, hdr);
6590 return genlmsg_reply(msg, info);
6591
6592 nla_put_failure_rcu:
6593 rcu_read_unlock();
6594 nla_put_failure:
6595 put_failure:
6596 nlmsg_free(msg);
6597 return -EMSGSIZE;
6598 }
6599
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)6600 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6601 u32 seq, int flags, struct wiphy *wiphy,
6602 const struct ieee80211_regdomain *regdom)
6603 {
6604 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6605 NL80211_CMD_GET_REG);
6606
6607 if (!hdr)
6608 return -1;
6609
6610 genl_dump_check_consistent(cb, hdr);
6611
6612 if (nl80211_put_regdom(regdom, msg))
6613 goto nla_put_failure;
6614
6615 if (!wiphy && reg_last_request_cell_base() &&
6616 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6617 NL80211_USER_REG_HINT_CELL_BASE))
6618 goto nla_put_failure;
6619
6620 if (wiphy &&
6621 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6622 goto nla_put_failure;
6623
6624 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6625 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6626 goto nla_put_failure;
6627
6628 genlmsg_end(msg, hdr);
6629 return 0;
6630
6631 nla_put_failure:
6632 genlmsg_cancel(msg, hdr);
6633 return -EMSGSIZE;
6634 }
6635
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)6636 static int nl80211_get_reg_dump(struct sk_buff *skb,
6637 struct netlink_callback *cb)
6638 {
6639 const struct ieee80211_regdomain *regdom = NULL;
6640 struct cfg80211_registered_device *rdev;
6641 int err, reg_idx, start = cb->args[2];
6642
6643 rtnl_lock();
6644
6645 if (cfg80211_regdomain && start == 0) {
6646 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6647 NLM_F_MULTI, NULL,
6648 rtnl_dereference(cfg80211_regdomain));
6649 if (err < 0)
6650 goto out_err;
6651 }
6652
6653 /* the global regdom is idx 0 */
6654 reg_idx = 1;
6655 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6656 regdom = get_wiphy_regdom(&rdev->wiphy);
6657 if (!regdom)
6658 continue;
6659
6660 if (++reg_idx <= start)
6661 continue;
6662
6663 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6664 NLM_F_MULTI, &rdev->wiphy, regdom);
6665 if (err < 0) {
6666 reg_idx--;
6667 break;
6668 }
6669 }
6670
6671 cb->args[2] = reg_idx;
6672 err = skb->len;
6673 out_err:
6674 rtnl_unlock();
6675 return err;
6676 }
6677
6678 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6679 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6680 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6681 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6682 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6683 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6684 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6685 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6686 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
6687 };
6688
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)6689 static int parse_reg_rule(struct nlattr *tb[],
6690 struct ieee80211_reg_rule *reg_rule)
6691 {
6692 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
6693 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
6694
6695 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6696 return -EINVAL;
6697 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6698 return -EINVAL;
6699 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6700 return -EINVAL;
6701 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6702 return -EINVAL;
6703 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6704 return -EINVAL;
6705
6706 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6707
6708 freq_range->start_freq_khz =
6709 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6710 freq_range->end_freq_khz =
6711 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6712 freq_range->max_bandwidth_khz =
6713 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6714
6715 power_rule->max_eirp =
6716 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6717
6718 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6719 power_rule->max_antenna_gain =
6720 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6721
6722 if (tb[NL80211_ATTR_DFS_CAC_TIME])
6723 reg_rule->dfs_cac_ms =
6724 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6725
6726 return 0;
6727 }
6728
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)6729 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6730 {
6731 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6732 struct nlattr *nl_reg_rule;
6733 char *alpha2;
6734 int rem_reg_rules, r;
6735 u32 num_rules = 0, rule_idx = 0, size_of_regd;
6736 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6737 struct ieee80211_regdomain *rd;
6738
6739 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6740 return -EINVAL;
6741
6742 if (!info->attrs[NL80211_ATTR_REG_RULES])
6743 return -EINVAL;
6744
6745 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6746
6747 if (info->attrs[NL80211_ATTR_DFS_REGION])
6748 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6749
6750 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6751 rem_reg_rules) {
6752 num_rules++;
6753 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6754 return -EINVAL;
6755 }
6756
6757 if (!reg_is_valid_request(alpha2))
6758 return -EINVAL;
6759
6760 size_of_regd = sizeof(struct ieee80211_regdomain) +
6761 num_rules * sizeof(struct ieee80211_reg_rule);
6762
6763 rd = kzalloc(size_of_regd, GFP_KERNEL);
6764 if (!rd)
6765 return -ENOMEM;
6766
6767 rd->n_reg_rules = num_rules;
6768 rd->alpha2[0] = alpha2[0];
6769 rd->alpha2[1] = alpha2[1];
6770
6771 /*
6772 * Disable DFS master mode if the DFS region was
6773 * not supported or known on this kernel.
6774 */
6775 if (reg_supported_dfs_region(dfs_region))
6776 rd->dfs_region = dfs_region;
6777
6778 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6779 rem_reg_rules) {
6780 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6781 nl_reg_rule, reg_rule_policy,
6782 info->extack);
6783 if (r)
6784 goto bad_reg;
6785 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6786 if (r)
6787 goto bad_reg;
6788
6789 rule_idx++;
6790
6791 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6792 r = -EINVAL;
6793 goto bad_reg;
6794 }
6795 }
6796
6797 /* set_regdom takes ownership of rd */
6798 return set_regdom(rd, REGD_SOURCE_CRDA);
6799 bad_reg:
6800 kfree(rd);
6801 return r;
6802 }
6803 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6804
validate_scan_freqs(struct nlattr * freqs)6805 static int validate_scan_freqs(struct nlattr *freqs)
6806 {
6807 struct nlattr *attr1, *attr2;
6808 int n_channels = 0, tmp1, tmp2;
6809
6810 nla_for_each_nested(attr1, freqs, tmp1)
6811 if (nla_len(attr1) != sizeof(u32))
6812 return 0;
6813
6814 nla_for_each_nested(attr1, freqs, tmp1) {
6815 n_channels++;
6816 /*
6817 * Some hardware has a limited channel list for
6818 * scanning, and it is pretty much nonsensical
6819 * to scan for a channel twice, so disallow that
6820 * and don't require drivers to check that the
6821 * channel list they get isn't longer than what
6822 * they can scan, as long as they can scan all
6823 * the channels they registered at once.
6824 */
6825 nla_for_each_nested(attr2, freqs, tmp2)
6826 if (attr1 != attr2 &&
6827 nla_get_u32(attr1) == nla_get_u32(attr2))
6828 return 0;
6829 }
6830
6831 return n_channels;
6832 }
6833
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)6834 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6835 {
6836 return b < NUM_NL80211_BANDS && wiphy->bands[b];
6837 }
6838
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)6839 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6840 struct cfg80211_bss_selection *bss_select)
6841 {
6842 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6843 struct nlattr *nest;
6844 int err;
6845 bool found = false;
6846 int i;
6847
6848 /* only process one nested attribute */
6849 nest = nla_data(nla);
6850 if (!nla_ok(nest, nla_len(nest)))
6851 return -EINVAL;
6852
6853 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6854 nl80211_bss_select_policy, NULL);
6855 if (err)
6856 return err;
6857
6858 /* only one attribute may be given */
6859 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6860 if (attr[i]) {
6861 if (found)
6862 return -EINVAL;
6863 found = true;
6864 }
6865 }
6866
6867 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6868
6869 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6870 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6871
6872 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6873 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6874 bss_select->param.band_pref =
6875 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6876 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6877 return -EINVAL;
6878 }
6879
6880 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6881 struct nl80211_bss_select_rssi_adjust *adj_param;
6882
6883 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6884 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6885 bss_select->param.adjust.band = adj_param->band;
6886 bss_select->param.adjust.delta = adj_param->delta;
6887 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6888 return -EINVAL;
6889 }
6890
6891 /* user-space did not provide behaviour attribute */
6892 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6893 return -EINVAL;
6894
6895 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6896 return -EINVAL;
6897
6898 return 0;
6899 }
6900
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)6901 static int nl80211_parse_random_mac(struct nlattr **attrs,
6902 u8 *mac_addr, u8 *mac_addr_mask)
6903 {
6904 int i;
6905
6906 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6907 eth_zero_addr(mac_addr);
6908 eth_zero_addr(mac_addr_mask);
6909 mac_addr[0] = 0x2;
6910 mac_addr_mask[0] = 0x3;
6911
6912 return 0;
6913 }
6914
6915 /* need both or none */
6916 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6917 return -EINVAL;
6918
6919 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6920 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6921
6922 /* don't allow or configure an mcast address */
6923 if (!is_multicast_ether_addr(mac_addr_mask) ||
6924 is_multicast_ether_addr(mac_addr))
6925 return -EINVAL;
6926
6927 /*
6928 * allow users to pass a MAC address that has bits set outside
6929 * of the mask, but don't bother drivers with having to deal
6930 * with such bits
6931 */
6932 for (i = 0; i < ETH_ALEN; i++)
6933 mac_addr[i] &= mac_addr_mask[i];
6934
6935 return 0;
6936 }
6937
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev)6938 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6939 {
6940 ASSERT_WDEV_LOCK(wdev);
6941
6942 if (!cfg80211_beaconing_iface_active(wdev))
6943 return true;
6944
6945 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6946 return true;
6947
6948 return regulatory_pre_cac_allowed(wdev->wiphy);
6949 }
6950
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)6951 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
6952 enum nl80211_ext_feature_index feat)
6953 {
6954 if (!(flags & flag))
6955 return true;
6956 if (wiphy_ext_feature_isset(wiphy, feat))
6957 return true;
6958 return false;
6959 }
6960
6961 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,void * request,struct nlattr ** attrs,bool is_sched_scan)6962 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6963 void *request, struct nlattr **attrs,
6964 bool is_sched_scan)
6965 {
6966 u8 *mac_addr, *mac_addr_mask;
6967 u32 *flags;
6968 enum nl80211_feature_flags randomness_flag;
6969
6970 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6971 return 0;
6972
6973 if (is_sched_scan) {
6974 struct cfg80211_sched_scan_request *req = request;
6975
6976 randomness_flag = wdev ?
6977 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6978 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6979 flags = &req->flags;
6980 mac_addr = req->mac_addr;
6981 mac_addr_mask = req->mac_addr_mask;
6982 } else {
6983 struct cfg80211_scan_request *req = request;
6984
6985 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6986 flags = &req->flags;
6987 mac_addr = req->mac_addr;
6988 mac_addr_mask = req->mac_addr_mask;
6989 }
6990
6991 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6992
6993 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6994 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
6995 !nl80211_check_scan_feat(wiphy, *flags,
6996 NL80211_SCAN_FLAG_LOW_SPAN,
6997 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
6998 !nl80211_check_scan_feat(wiphy, *flags,
6999 NL80211_SCAN_FLAG_LOW_POWER,
7000 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7001 !nl80211_check_scan_feat(wiphy, *flags,
7002 NL80211_SCAN_FLAG_HIGH_ACCURACY,
7003 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7004 !nl80211_check_scan_feat(wiphy, *flags,
7005 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7006 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7007 !nl80211_check_scan_feat(wiphy, *flags,
7008 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7009 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7010 !nl80211_check_scan_feat(wiphy, *flags,
7011 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7012 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7013 !nl80211_check_scan_feat(wiphy, *flags,
7014 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7015 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7016 !nl80211_check_scan_feat(wiphy, *flags,
7017 NL80211_SCAN_FLAG_RANDOM_SN,
7018 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7019 !nl80211_check_scan_feat(wiphy, *flags,
7020 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7021 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7022 return -EOPNOTSUPP;
7023
7024 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7025 int err;
7026
7027 if (!(wiphy->features & randomness_flag) ||
7028 (wdev && wdev->current_bss))
7029 return -EOPNOTSUPP;
7030
7031 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7032 if (err)
7033 return err;
7034 }
7035
7036 return 0;
7037 }
7038
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)7039 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7040 {
7041 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7042 struct wireless_dev *wdev = info->user_ptr[1];
7043 struct cfg80211_scan_request *request;
7044 struct nlattr *attr;
7045 struct wiphy *wiphy;
7046 int err, tmp, n_ssids = 0, n_channels, i;
7047 size_t ie_len;
7048
7049 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7050 return -EINVAL;
7051
7052 wiphy = &rdev->wiphy;
7053
7054 if (wdev->iftype == NL80211_IFTYPE_NAN)
7055 return -EOPNOTSUPP;
7056
7057 if (!rdev->ops->scan)
7058 return -EOPNOTSUPP;
7059
7060 if (rdev->scan_req || rdev->scan_msg) {
7061 err = -EBUSY;
7062 goto unlock;
7063 }
7064
7065 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7066 n_channels = validate_scan_freqs(
7067 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7068 if (!n_channels) {
7069 err = -EINVAL;
7070 goto unlock;
7071 }
7072 } else {
7073 n_channels = ieee80211_get_num_supported_channels(wiphy);
7074 }
7075
7076 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7077 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7078 n_ssids++;
7079
7080 if (n_ssids > wiphy->max_scan_ssids) {
7081 err = -EINVAL;
7082 goto unlock;
7083 }
7084
7085 if (info->attrs[NL80211_ATTR_IE])
7086 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7087 else
7088 ie_len = 0;
7089
7090 if (ie_len > wiphy->max_scan_ie_len) {
7091 err = -EINVAL;
7092 goto unlock;
7093 }
7094
7095 request = kzalloc(sizeof(*request)
7096 + sizeof(*request->ssids) * n_ssids
7097 + sizeof(*request->channels) * n_channels
7098 + ie_len, GFP_KERNEL);
7099 if (!request) {
7100 err = -ENOMEM;
7101 goto unlock;
7102 }
7103
7104 if (n_ssids)
7105 request->ssids = (void *)&request->channels[n_channels];
7106 request->n_ssids = n_ssids;
7107 if (ie_len) {
7108 if (n_ssids)
7109 request->ie = (void *)(request->ssids + n_ssids);
7110 else
7111 request->ie = (void *)(request->channels + n_channels);
7112 }
7113
7114 i = 0;
7115 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7116 /* user specified, bail out if channel not found */
7117 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7118 struct ieee80211_channel *chan;
7119
7120 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7121
7122 if (!chan) {
7123 err = -EINVAL;
7124 goto out_free;
7125 }
7126
7127 /* ignore disabled channels */
7128 if (chan->flags & IEEE80211_CHAN_DISABLED)
7129 continue;
7130
7131 request->channels[i] = chan;
7132 i++;
7133 }
7134 } else {
7135 enum nl80211_band band;
7136
7137 /* all channels */
7138 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7139 int j;
7140
7141 if (!wiphy->bands[band])
7142 continue;
7143 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7144 struct ieee80211_channel *chan;
7145
7146 chan = &wiphy->bands[band]->channels[j];
7147
7148 if (chan->flags & IEEE80211_CHAN_DISABLED)
7149 continue;
7150
7151 request->channels[i] = chan;
7152 i++;
7153 }
7154 }
7155 }
7156
7157 if (!i) {
7158 err = -EINVAL;
7159 goto out_free;
7160 }
7161
7162 request->n_channels = i;
7163
7164 wdev_lock(wdev);
7165 if (!cfg80211_off_channel_oper_allowed(wdev)) {
7166 struct ieee80211_channel *chan;
7167
7168 if (request->n_channels != 1) {
7169 wdev_unlock(wdev);
7170 err = -EBUSY;
7171 goto out_free;
7172 }
7173
7174 chan = request->channels[0];
7175 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7176 wdev_unlock(wdev);
7177 err = -EBUSY;
7178 goto out_free;
7179 }
7180 }
7181 wdev_unlock(wdev);
7182
7183 i = 0;
7184 if (n_ssids) {
7185 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7186 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7187 err = -EINVAL;
7188 goto out_free;
7189 }
7190 request->ssids[i].ssid_len = nla_len(attr);
7191 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7192 i++;
7193 }
7194 }
7195
7196 if (info->attrs[NL80211_ATTR_IE]) {
7197 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7198 memcpy((void *)request->ie,
7199 nla_data(info->attrs[NL80211_ATTR_IE]),
7200 request->ie_len);
7201 }
7202
7203 for (i = 0; i < NUM_NL80211_BANDS; i++)
7204 if (wiphy->bands[i])
7205 request->rates[i] =
7206 (1 << wiphy->bands[i]->n_bitrates) - 1;
7207
7208 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7209 nla_for_each_nested(attr,
7210 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7211 tmp) {
7212 enum nl80211_band band = nla_type(attr);
7213
7214 if (band < 0 || band >= NUM_NL80211_BANDS) {
7215 err = -EINVAL;
7216 goto out_free;
7217 }
7218
7219 if (!wiphy->bands[band])
7220 continue;
7221
7222 err = ieee80211_get_ratemask(wiphy->bands[band],
7223 nla_data(attr),
7224 nla_len(attr),
7225 &request->rates[band]);
7226 if (err)
7227 goto out_free;
7228 }
7229 }
7230
7231 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7232 if (!wiphy_ext_feature_isset(wiphy,
7233 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7234 err = -EOPNOTSUPP;
7235 goto out_free;
7236 }
7237
7238 request->duration =
7239 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7240 request->duration_mandatory =
7241 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7242 }
7243
7244 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7245 false);
7246 if (err)
7247 goto out_free;
7248
7249 request->no_cck =
7250 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7251
7252 /* Initial implementation used NL80211_ATTR_MAC to set the specific
7253 * BSSID to scan for. This was problematic because that same attribute
7254 * was already used for another purpose (local random MAC address). The
7255 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7256 * compatibility with older userspace components, also use the
7257 * NL80211_ATTR_MAC value here if it can be determined to be used for
7258 * the specific BSSID use case instead of the random MAC address
7259 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7260 */
7261 if (info->attrs[NL80211_ATTR_BSSID])
7262 memcpy(request->bssid,
7263 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7264 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7265 info->attrs[NL80211_ATTR_MAC])
7266 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7267 ETH_ALEN);
7268 else
7269 eth_broadcast_addr(request->bssid);
7270
7271 request->wdev = wdev;
7272 request->wiphy = &rdev->wiphy;
7273 request->scan_start = jiffies;
7274
7275 rdev->scan_req = request;
7276 err = rdev_scan(rdev, request);
7277
7278 if (!err) {
7279 nl80211_send_scan_start(rdev, wdev);
7280 if (wdev->netdev)
7281 dev_hold(wdev->netdev);
7282 } else {
7283 out_free:
7284 rdev->scan_req = NULL;
7285 kfree(request);
7286 }
7287
7288 unlock:
7289 return err;
7290 }
7291
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)7292 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7293 {
7294 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7295 struct wireless_dev *wdev = info->user_ptr[1];
7296
7297 if (!rdev->ops->abort_scan)
7298 return -EOPNOTSUPP;
7299
7300 if (rdev->scan_msg)
7301 return 0;
7302
7303 if (!rdev->scan_req)
7304 return -ENOENT;
7305
7306 rdev_abort_scan(rdev, wdev);
7307 return 0;
7308 }
7309
7310 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)7311 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7312 struct cfg80211_sched_scan_request *request,
7313 struct nlattr **attrs)
7314 {
7315 int tmp, err, i = 0;
7316 struct nlattr *attr;
7317
7318 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7319 u32 interval;
7320
7321 /*
7322 * If scan plans are not specified,
7323 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7324 * case one scan plan will be set with the specified scan
7325 * interval and infinite number of iterations.
7326 */
7327 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7328 if (!interval)
7329 return -EINVAL;
7330
7331 request->scan_plans[0].interval =
7332 DIV_ROUND_UP(interval, MSEC_PER_SEC);
7333 if (!request->scan_plans[0].interval)
7334 return -EINVAL;
7335
7336 if (request->scan_plans[0].interval >
7337 wiphy->max_sched_scan_plan_interval)
7338 request->scan_plans[0].interval =
7339 wiphy->max_sched_scan_plan_interval;
7340
7341 return 0;
7342 }
7343
7344 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7345 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7346
7347 if (WARN_ON(i >= n_plans))
7348 return -EINVAL;
7349
7350 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7351 attr, nl80211_plan_policy, NULL);
7352 if (err)
7353 return err;
7354
7355 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7356 return -EINVAL;
7357
7358 request->scan_plans[i].interval =
7359 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7360 if (!request->scan_plans[i].interval ||
7361 request->scan_plans[i].interval >
7362 wiphy->max_sched_scan_plan_interval)
7363 return -EINVAL;
7364
7365 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7366 request->scan_plans[i].iterations =
7367 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7368 if (!request->scan_plans[i].iterations ||
7369 (request->scan_plans[i].iterations >
7370 wiphy->max_sched_scan_plan_iterations))
7371 return -EINVAL;
7372 } else if (i < n_plans - 1) {
7373 /*
7374 * All scan plans but the last one must specify
7375 * a finite number of iterations
7376 */
7377 return -EINVAL;
7378 }
7379
7380 i++;
7381 }
7382
7383 /*
7384 * The last scan plan must not specify the number of
7385 * iterations, it is supposed to run infinitely
7386 */
7387 if (request->scan_plans[n_plans - 1].iterations)
7388 return -EINVAL;
7389
7390 return 0;
7391 }
7392
7393 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)7394 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7395 struct nlattr **attrs, int max_match_sets)
7396 {
7397 struct cfg80211_sched_scan_request *request;
7398 struct nlattr *attr;
7399 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7400 enum nl80211_band band;
7401 size_t ie_len;
7402 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7403 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7404
7405 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7406 return ERR_PTR(-EINVAL);
7407
7408 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7409 n_channels = validate_scan_freqs(
7410 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7411 if (!n_channels)
7412 return ERR_PTR(-EINVAL);
7413 } else {
7414 n_channels = ieee80211_get_num_supported_channels(wiphy);
7415 }
7416
7417 if (attrs[NL80211_ATTR_SCAN_SSIDS])
7418 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7419 tmp)
7420 n_ssids++;
7421
7422 if (n_ssids > wiphy->max_sched_scan_ssids)
7423 return ERR_PTR(-EINVAL);
7424
7425 /*
7426 * First, count the number of 'real' matchsets. Due to an issue with
7427 * the old implementation, matchsets containing only the RSSI attribute
7428 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7429 * RSSI for all matchsets, rather than their own matchset for reporting
7430 * all APs with a strong RSSI. This is needed to be compatible with
7431 * older userspace that treated a matchset with only the RSSI as the
7432 * global RSSI for all other matchsets - if there are other matchsets.
7433 */
7434 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7435 nla_for_each_nested(attr,
7436 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7437 tmp) {
7438 struct nlattr *rssi;
7439
7440 err = nla_parse_nested(tb,
7441 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7442 attr, nl80211_match_policy,
7443 NULL);
7444 if (err)
7445 return ERR_PTR(err);
7446
7447 /* SSID and BSSID are mutually exclusive */
7448 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7449 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7450 return ERR_PTR(-EINVAL);
7451
7452 /* add other standalone attributes here */
7453 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7454 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7455 n_match_sets++;
7456 continue;
7457 }
7458 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7459 if (rssi)
7460 default_match_rssi = nla_get_s32(rssi);
7461 }
7462 }
7463
7464 /* However, if there's no other matchset, add the RSSI one */
7465 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7466 n_match_sets = 1;
7467
7468 if (n_match_sets > max_match_sets)
7469 return ERR_PTR(-EINVAL);
7470
7471 if (attrs[NL80211_ATTR_IE])
7472 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7473 else
7474 ie_len = 0;
7475
7476 if (ie_len > wiphy->max_sched_scan_ie_len)
7477 return ERR_PTR(-EINVAL);
7478
7479 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7480 /*
7481 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7482 * each scan plan already specifies its own interval
7483 */
7484 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7485 return ERR_PTR(-EINVAL);
7486
7487 nla_for_each_nested(attr,
7488 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7489 n_plans++;
7490 } else {
7491 /*
7492 * The scan interval attribute is kept for backward
7493 * compatibility. If no scan plans are specified and sched scan
7494 * interval is specified, one scan plan will be set with this
7495 * scan interval and infinite number of iterations.
7496 */
7497 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7498 return ERR_PTR(-EINVAL);
7499
7500 n_plans = 1;
7501 }
7502
7503 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7504 return ERR_PTR(-EINVAL);
7505
7506 if (!wiphy_ext_feature_isset(
7507 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7508 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7509 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7510 return ERR_PTR(-EINVAL);
7511
7512 request = kzalloc(sizeof(*request)
7513 + sizeof(*request->ssids) * n_ssids
7514 + sizeof(*request->match_sets) * n_match_sets
7515 + sizeof(*request->scan_plans) * n_plans
7516 + sizeof(*request->channels) * n_channels
7517 + ie_len, GFP_KERNEL);
7518 if (!request)
7519 return ERR_PTR(-ENOMEM);
7520
7521 if (n_ssids)
7522 request->ssids = (void *)&request->channels[n_channels];
7523 request->n_ssids = n_ssids;
7524 if (ie_len) {
7525 if (n_ssids)
7526 request->ie = (void *)(request->ssids + n_ssids);
7527 else
7528 request->ie = (void *)(request->channels + n_channels);
7529 }
7530
7531 if (n_match_sets) {
7532 if (request->ie)
7533 request->match_sets = (void *)(request->ie + ie_len);
7534 else if (n_ssids)
7535 request->match_sets =
7536 (void *)(request->ssids + n_ssids);
7537 else
7538 request->match_sets =
7539 (void *)(request->channels + n_channels);
7540 }
7541 request->n_match_sets = n_match_sets;
7542
7543 if (n_match_sets)
7544 request->scan_plans = (void *)(request->match_sets +
7545 n_match_sets);
7546 else if (request->ie)
7547 request->scan_plans = (void *)(request->ie + ie_len);
7548 else if (n_ssids)
7549 request->scan_plans = (void *)(request->ssids + n_ssids);
7550 else
7551 request->scan_plans = (void *)(request->channels + n_channels);
7552
7553 request->n_scan_plans = n_plans;
7554
7555 i = 0;
7556 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7557 /* user specified, bail out if channel not found */
7558 nla_for_each_nested(attr,
7559 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7560 tmp) {
7561 struct ieee80211_channel *chan;
7562
7563 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7564
7565 if (!chan) {
7566 err = -EINVAL;
7567 goto out_free;
7568 }
7569
7570 /* ignore disabled channels */
7571 if (chan->flags & IEEE80211_CHAN_DISABLED)
7572 continue;
7573
7574 request->channels[i] = chan;
7575 i++;
7576 }
7577 } else {
7578 /* all channels */
7579 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7580 int j;
7581
7582 if (!wiphy->bands[band])
7583 continue;
7584 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7585 struct ieee80211_channel *chan;
7586
7587 chan = &wiphy->bands[band]->channels[j];
7588
7589 if (chan->flags & IEEE80211_CHAN_DISABLED)
7590 continue;
7591
7592 request->channels[i] = chan;
7593 i++;
7594 }
7595 }
7596 }
7597
7598 if (!i) {
7599 err = -EINVAL;
7600 goto out_free;
7601 }
7602
7603 request->n_channels = i;
7604
7605 i = 0;
7606 if (n_ssids) {
7607 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7608 tmp) {
7609 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7610 err = -EINVAL;
7611 goto out_free;
7612 }
7613 request->ssids[i].ssid_len = nla_len(attr);
7614 memcpy(request->ssids[i].ssid, nla_data(attr),
7615 nla_len(attr));
7616 i++;
7617 }
7618 }
7619
7620 i = 0;
7621 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7622 nla_for_each_nested(attr,
7623 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7624 tmp) {
7625 struct nlattr *ssid, *bssid, *rssi;
7626
7627 err = nla_parse_nested(tb,
7628 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7629 attr, nl80211_match_policy,
7630 NULL);
7631 if (err)
7632 goto out_free;
7633 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7634 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7635 if (ssid || bssid) {
7636 if (WARN_ON(i >= n_match_sets)) {
7637 /* this indicates a programming error,
7638 * the loop above should have verified
7639 * things properly
7640 */
7641 err = -EINVAL;
7642 goto out_free;
7643 }
7644
7645 if (ssid) {
7646 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7647 err = -EINVAL;
7648 goto out_free;
7649 }
7650 memcpy(request->match_sets[i].ssid.ssid,
7651 nla_data(ssid), nla_len(ssid));
7652 request->match_sets[i].ssid.ssid_len =
7653 nla_len(ssid);
7654 }
7655 if (bssid) {
7656 if (nla_len(bssid) != ETH_ALEN) {
7657 err = -EINVAL;
7658 goto out_free;
7659 }
7660 memcpy(request->match_sets[i].bssid,
7661 nla_data(bssid), ETH_ALEN);
7662 }
7663
7664 /* special attribute - old implementation w/a */
7665 request->match_sets[i].rssi_thold =
7666 default_match_rssi;
7667 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7668 if (rssi)
7669 request->match_sets[i].rssi_thold =
7670 nla_get_s32(rssi);
7671 }
7672 i++;
7673 }
7674
7675 /* there was no other matchset, so the RSSI one is alone */
7676 if (i == 0 && n_match_sets)
7677 request->match_sets[0].rssi_thold = default_match_rssi;
7678
7679 request->min_rssi_thold = INT_MAX;
7680 for (i = 0; i < n_match_sets; i++)
7681 request->min_rssi_thold =
7682 min(request->match_sets[i].rssi_thold,
7683 request->min_rssi_thold);
7684 } else {
7685 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7686 }
7687
7688 if (ie_len) {
7689 request->ie_len = ie_len;
7690 memcpy((void *)request->ie,
7691 nla_data(attrs[NL80211_ATTR_IE]),
7692 request->ie_len);
7693 }
7694
7695 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7696 if (err)
7697 goto out_free;
7698
7699 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7700 request->delay =
7701 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7702
7703 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7704 request->relative_rssi = nla_get_s8(
7705 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7706 request->relative_rssi_set = true;
7707 }
7708
7709 if (request->relative_rssi_set &&
7710 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7711 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7712
7713 rssi_adjust = nla_data(
7714 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7715 request->rssi_adjust.band = rssi_adjust->band;
7716 request->rssi_adjust.delta = rssi_adjust->delta;
7717 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7718 err = -EINVAL;
7719 goto out_free;
7720 }
7721 }
7722
7723 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7724 if (err)
7725 goto out_free;
7726
7727 request->scan_start = jiffies;
7728
7729 return request;
7730
7731 out_free:
7732 kfree(request);
7733 return ERR_PTR(err);
7734 }
7735
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)7736 static int nl80211_start_sched_scan(struct sk_buff *skb,
7737 struct genl_info *info)
7738 {
7739 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7740 struct net_device *dev = info->user_ptr[1];
7741 struct wireless_dev *wdev = dev->ieee80211_ptr;
7742 struct cfg80211_sched_scan_request *sched_scan_req;
7743 bool want_multi;
7744 int err;
7745
7746 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7747 return -EOPNOTSUPP;
7748
7749 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7750 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7751 if (err)
7752 return err;
7753
7754 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7755 info->attrs,
7756 rdev->wiphy.max_match_sets);
7757
7758 err = PTR_ERR_OR_ZERO(sched_scan_req);
7759 if (err)
7760 goto out_err;
7761
7762 /* leave request id zero for legacy request
7763 * or if driver does not support multi-scheduled scan
7764 */
7765 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7766 while (!sched_scan_req->reqid)
7767 sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7768 }
7769
7770 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7771 if (err)
7772 goto out_free;
7773
7774 sched_scan_req->dev = dev;
7775 sched_scan_req->wiphy = &rdev->wiphy;
7776
7777 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7778 sched_scan_req->owner_nlportid = info->snd_portid;
7779
7780 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7781
7782 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7783 return 0;
7784
7785 out_free:
7786 kfree(sched_scan_req);
7787 out_err:
7788 return err;
7789 }
7790
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)7791 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7792 struct genl_info *info)
7793 {
7794 struct cfg80211_sched_scan_request *req;
7795 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7796 u64 cookie;
7797
7798 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7799 return -EOPNOTSUPP;
7800
7801 if (info->attrs[NL80211_ATTR_COOKIE]) {
7802 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7803 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7804 }
7805
7806 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7807 struct cfg80211_sched_scan_request,
7808 list);
7809 if (!req || req->reqid ||
7810 (req->owner_nlportid &&
7811 req->owner_nlportid != info->snd_portid))
7812 return -ENOENT;
7813
7814 return cfg80211_stop_sched_scan_req(rdev, req, false);
7815 }
7816
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)7817 static int nl80211_start_radar_detection(struct sk_buff *skb,
7818 struct genl_info *info)
7819 {
7820 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7821 struct net_device *dev = info->user_ptr[1];
7822 struct wireless_dev *wdev = dev->ieee80211_ptr;
7823 struct wiphy *wiphy = wdev->wiphy;
7824 struct cfg80211_chan_def chandef;
7825 enum nl80211_dfs_regions dfs_region;
7826 unsigned int cac_time_ms;
7827 int err;
7828
7829 dfs_region = reg_get_dfs_region(wiphy);
7830 if (dfs_region == NL80211_DFS_UNSET)
7831 return -EINVAL;
7832
7833 err = nl80211_parse_chandef(rdev, info, &chandef);
7834 if (err)
7835 return err;
7836
7837 if (netif_carrier_ok(dev))
7838 return -EBUSY;
7839
7840 if (wdev->cac_started)
7841 return -EBUSY;
7842
7843 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7844 if (err < 0)
7845 return err;
7846
7847 if (err == 0)
7848 return -EINVAL;
7849
7850 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7851 return -EINVAL;
7852
7853 /* CAC start is offloaded to HW and can't be started manually */
7854 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7855 return -EOPNOTSUPP;
7856
7857 if (!rdev->ops->start_radar_detection)
7858 return -EOPNOTSUPP;
7859
7860 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7861 if (WARN_ON(!cac_time_ms))
7862 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7863
7864 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7865 if (!err) {
7866 wdev->chandef = chandef;
7867 wdev->cac_started = true;
7868 wdev->cac_start_time = jiffies;
7869 wdev->cac_time_ms = cac_time_ms;
7870 }
7871 return err;
7872 }
7873
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)7874 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7875 {
7876 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7877 struct net_device *dev = info->user_ptr[1];
7878 struct wireless_dev *wdev = dev->ieee80211_ptr;
7879 struct cfg80211_csa_settings params;
7880 /* csa_attrs is defined static to avoid waste of stack size - this
7881 * function is called under RTNL lock, so this should not be a problem.
7882 */
7883 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7884 int err;
7885 bool need_new_beacon = false;
7886 bool need_handle_dfs_flag = true;
7887 int len, i;
7888 u32 cs_count;
7889
7890 if (!rdev->ops->channel_switch ||
7891 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7892 return -EOPNOTSUPP;
7893
7894 switch (dev->ieee80211_ptr->iftype) {
7895 case NL80211_IFTYPE_AP:
7896 case NL80211_IFTYPE_P2P_GO:
7897 need_new_beacon = true;
7898 /* For all modes except AP the handle_dfs flag needs to be
7899 * supplied to tell the kernel that userspace will handle radar
7900 * events when they happen. Otherwise a switch to a channel
7901 * requiring DFS will be rejected.
7902 */
7903 need_handle_dfs_flag = false;
7904
7905 /* useless if AP is not running */
7906 if (!wdev->beacon_interval)
7907 return -ENOTCONN;
7908 break;
7909 case NL80211_IFTYPE_ADHOC:
7910 if (!wdev->ssid_len)
7911 return -ENOTCONN;
7912 break;
7913 case NL80211_IFTYPE_MESH_POINT:
7914 if (!wdev->mesh_id_len)
7915 return -ENOTCONN;
7916 break;
7917 default:
7918 return -EOPNOTSUPP;
7919 }
7920
7921 memset(¶ms, 0, sizeof(params));
7922
7923 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7924 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7925 return -EINVAL;
7926
7927 /* only important for AP, IBSS and mesh create IEs internally */
7928 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7929 return -EINVAL;
7930
7931 /* Even though the attribute is u32, the specification says
7932 * u8, so let's make sure we don't overflow.
7933 */
7934 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7935 if (cs_count > 255)
7936 return -EINVAL;
7937
7938 params.count = cs_count;
7939
7940 if (!need_new_beacon)
7941 goto skip_beacons;
7942
7943 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon_after);
7944 if (err)
7945 return err;
7946
7947 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7948 info->attrs[NL80211_ATTR_CSA_IES],
7949 nl80211_policy, info->extack);
7950 if (err)
7951 return err;
7952
7953 err = nl80211_parse_beacon(csa_attrs, ¶ms.beacon_csa);
7954 if (err)
7955 return err;
7956
7957 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7958 return -EINVAL;
7959
7960 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7961 if (!len || (len % sizeof(u16)))
7962 return -EINVAL;
7963
7964 params.n_counter_offsets_beacon = len / sizeof(u16);
7965 if (rdev->wiphy.max_num_csa_counters &&
7966 (params.n_counter_offsets_beacon >
7967 rdev->wiphy.max_num_csa_counters))
7968 return -EINVAL;
7969
7970 params.counter_offsets_beacon =
7971 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7972
7973 /* sanity checks - counters should fit and be the same */
7974 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7975 u16 offset = params.counter_offsets_beacon[i];
7976
7977 if (offset >= params.beacon_csa.tail_len)
7978 return -EINVAL;
7979
7980 if (params.beacon_csa.tail[offset] != params.count)
7981 return -EINVAL;
7982 }
7983
7984 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7985 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7986 if (!len || (len % sizeof(u16)))
7987 return -EINVAL;
7988
7989 params.n_counter_offsets_presp = len / sizeof(u16);
7990 if (rdev->wiphy.max_num_csa_counters &&
7991 (params.n_counter_offsets_presp >
7992 rdev->wiphy.max_num_csa_counters))
7993 return -EINVAL;
7994
7995 params.counter_offsets_presp =
7996 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7997
7998 /* sanity checks - counters should fit and be the same */
7999 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8000 u16 offset = params.counter_offsets_presp[i];
8001
8002 if (offset >= params.beacon_csa.probe_resp_len)
8003 return -EINVAL;
8004
8005 if (params.beacon_csa.probe_resp[offset] !=
8006 params.count)
8007 return -EINVAL;
8008 }
8009 }
8010
8011 skip_beacons:
8012 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
8013 if (err)
8014 return err;
8015
8016 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
8017 wdev->iftype))
8018 return -EINVAL;
8019
8020 err = cfg80211_chandef_dfs_required(wdev->wiphy,
8021 ¶ms.chandef,
8022 wdev->iftype);
8023 if (err < 0)
8024 return err;
8025
8026 if (err > 0) {
8027 params.radar_required = true;
8028 if (need_handle_dfs_flag &&
8029 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8030 return -EINVAL;
8031 }
8032 }
8033
8034 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8035 params.block_tx = true;
8036
8037 wdev_lock(wdev);
8038 err = rdev_channel_switch(rdev, dev, ¶ms);
8039 wdev_unlock(wdev);
8040
8041 return err;
8042 }
8043
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)8044 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8045 u32 seq, int flags,
8046 struct cfg80211_registered_device *rdev,
8047 struct wireless_dev *wdev,
8048 struct cfg80211_internal_bss *intbss)
8049 {
8050 struct cfg80211_bss *res = &intbss->pub;
8051 const struct cfg80211_bss_ies *ies;
8052 void *hdr;
8053 struct nlattr *bss;
8054
8055 ASSERT_WDEV_LOCK(wdev);
8056
8057 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8058 NL80211_CMD_NEW_SCAN_RESULTS);
8059 if (!hdr)
8060 return -1;
8061
8062 genl_dump_check_consistent(cb, hdr);
8063
8064 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8065 goto nla_put_failure;
8066 if (wdev->netdev &&
8067 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8068 goto nla_put_failure;
8069 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8070 NL80211_ATTR_PAD))
8071 goto nla_put_failure;
8072
8073 bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8074 if (!bss)
8075 goto nla_put_failure;
8076 if ((!is_zero_ether_addr(res->bssid) &&
8077 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8078 goto nla_put_failure;
8079
8080 rcu_read_lock();
8081 /* indicate whether we have probe response data or not */
8082 if (rcu_access_pointer(res->proberesp_ies) &&
8083 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8084 goto fail_unlock_rcu;
8085
8086 /* this pointer prefers to be pointed to probe response data
8087 * but is always valid
8088 */
8089 ies = rcu_dereference(res->ies);
8090 if (ies) {
8091 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8092 NL80211_BSS_PAD))
8093 goto fail_unlock_rcu;
8094 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8095 ies->len, ies->data))
8096 goto fail_unlock_rcu;
8097 }
8098
8099 /* and this pointer is always (unless driver didn't know) beacon data */
8100 ies = rcu_dereference(res->beacon_ies);
8101 if (ies && ies->from_beacon) {
8102 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8103 NL80211_BSS_PAD))
8104 goto fail_unlock_rcu;
8105 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8106 ies->len, ies->data))
8107 goto fail_unlock_rcu;
8108 }
8109 rcu_read_unlock();
8110
8111 if (res->beacon_interval &&
8112 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8113 goto nla_put_failure;
8114 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8115 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8116 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8117 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8118 jiffies_to_msecs(jiffies - intbss->ts)))
8119 goto nla_put_failure;
8120
8121 if (intbss->parent_tsf &&
8122 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8123 intbss->parent_tsf, NL80211_BSS_PAD) ||
8124 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8125 intbss->parent_bssid)))
8126 goto nla_put_failure;
8127
8128 if (intbss->ts_boottime &&
8129 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8130 intbss->ts_boottime, NL80211_BSS_PAD))
8131 goto nla_put_failure;
8132
8133 if (!nl80211_put_signal(msg, intbss->pub.chains,
8134 intbss->pub.chain_signal,
8135 NL80211_BSS_CHAIN_SIGNAL))
8136 goto nla_put_failure;
8137
8138 switch (rdev->wiphy.signal_type) {
8139 case CFG80211_SIGNAL_TYPE_MBM:
8140 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8141 goto nla_put_failure;
8142 break;
8143 case CFG80211_SIGNAL_TYPE_UNSPEC:
8144 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8145 goto nla_put_failure;
8146 break;
8147 default:
8148 break;
8149 }
8150
8151 switch (wdev->iftype) {
8152 case NL80211_IFTYPE_P2P_CLIENT:
8153 case NL80211_IFTYPE_STATION:
8154 if (intbss == wdev->current_bss &&
8155 nla_put_u32(msg, NL80211_BSS_STATUS,
8156 NL80211_BSS_STATUS_ASSOCIATED))
8157 goto nla_put_failure;
8158 break;
8159 case NL80211_IFTYPE_ADHOC:
8160 if (intbss == wdev->current_bss &&
8161 nla_put_u32(msg, NL80211_BSS_STATUS,
8162 NL80211_BSS_STATUS_IBSS_JOINED))
8163 goto nla_put_failure;
8164 break;
8165 default:
8166 break;
8167 }
8168
8169 nla_nest_end(msg, bss);
8170
8171 genlmsg_end(msg, hdr);
8172 return 0;
8173
8174 fail_unlock_rcu:
8175 rcu_read_unlock();
8176 nla_put_failure:
8177 genlmsg_cancel(msg, hdr);
8178 return -EMSGSIZE;
8179 }
8180
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)8181 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8182 {
8183 struct cfg80211_registered_device *rdev;
8184 struct cfg80211_internal_bss *scan;
8185 struct wireless_dev *wdev;
8186 int start = cb->args[2], idx = 0;
8187 int err;
8188
8189 rtnl_lock();
8190 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8191 if (err) {
8192 rtnl_unlock();
8193 return err;
8194 }
8195
8196 wdev_lock(wdev);
8197 spin_lock_bh(&rdev->bss_lock);
8198
8199 /*
8200 * dump_scan will be called multiple times to break up the scan results
8201 * into multiple messages. It is unlikely that any more bss-es will be
8202 * expired after the first call, so only call only call this on the
8203 * first dump_scan invocation.
8204 */
8205 if (start == 0)
8206 cfg80211_bss_expire(rdev);
8207
8208 cb->seq = rdev->bss_generation;
8209
8210 list_for_each_entry(scan, &rdev->bss_list, list) {
8211 if (++idx <= start)
8212 continue;
8213 if (nl80211_send_bss(skb, cb,
8214 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8215 rdev, wdev, scan) < 0) {
8216 idx--;
8217 break;
8218 }
8219 }
8220
8221 spin_unlock_bh(&rdev->bss_lock);
8222 wdev_unlock(wdev);
8223
8224 cb->args[2] = idx;
8225 rtnl_unlock();
8226
8227 return skb->len;
8228 }
8229
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)8230 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8231 int flags, struct net_device *dev,
8232 bool allow_radio_stats,
8233 struct survey_info *survey)
8234 {
8235 void *hdr;
8236 struct nlattr *infoattr;
8237
8238 /* skip radio stats if userspace didn't request them */
8239 if (!survey->channel && !allow_radio_stats)
8240 return 0;
8241
8242 hdr = nl80211hdr_put(msg, portid, seq, flags,
8243 NL80211_CMD_NEW_SURVEY_RESULTS);
8244 if (!hdr)
8245 return -ENOMEM;
8246
8247 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8248 goto nla_put_failure;
8249
8250 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8251 if (!infoattr)
8252 goto nla_put_failure;
8253
8254 if (survey->channel &&
8255 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8256 survey->channel->center_freq))
8257 goto nla_put_failure;
8258
8259 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8260 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8261 goto nla_put_failure;
8262 if ((survey->filled & SURVEY_INFO_IN_USE) &&
8263 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8264 goto nla_put_failure;
8265 if ((survey->filled & SURVEY_INFO_TIME) &&
8266 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8267 survey->time, NL80211_SURVEY_INFO_PAD))
8268 goto nla_put_failure;
8269 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8270 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8271 survey->time_busy, NL80211_SURVEY_INFO_PAD))
8272 goto nla_put_failure;
8273 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8274 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8275 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8276 goto nla_put_failure;
8277 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8278 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8279 survey->time_rx, NL80211_SURVEY_INFO_PAD))
8280 goto nla_put_failure;
8281 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8282 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8283 survey->time_tx, NL80211_SURVEY_INFO_PAD))
8284 goto nla_put_failure;
8285 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8286 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8287 survey->time_scan, NL80211_SURVEY_INFO_PAD))
8288 goto nla_put_failure;
8289
8290 nla_nest_end(msg, infoattr);
8291
8292 genlmsg_end(msg, hdr);
8293 return 0;
8294
8295 nla_put_failure:
8296 genlmsg_cancel(msg, hdr);
8297 return -EMSGSIZE;
8298 }
8299
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)8300 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8301 {
8302 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8303 struct survey_info survey;
8304 struct cfg80211_registered_device *rdev;
8305 struct wireless_dev *wdev;
8306 int survey_idx = cb->args[2];
8307 int res;
8308 bool radio_stats;
8309
8310 rtnl_lock();
8311 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8312 if (res)
8313 goto out_err;
8314
8315 /* prepare_wdev_dump parsed the attributes */
8316 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8317
8318 if (!wdev->netdev) {
8319 res = -EINVAL;
8320 goto out_err;
8321 }
8322
8323 if (!rdev->ops->dump_survey) {
8324 res = -EOPNOTSUPP;
8325 goto out_err;
8326 }
8327
8328 while (1) {
8329 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8330 if (res == -ENOENT)
8331 break;
8332 if (res)
8333 goto out_err;
8334
8335 /* don't send disabled channels, but do send non-channel data */
8336 if (survey.channel &&
8337 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8338 survey_idx++;
8339 continue;
8340 }
8341
8342 if (nl80211_send_survey(skb,
8343 NETLINK_CB(cb->skb).portid,
8344 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8345 wdev->netdev, radio_stats, &survey) < 0)
8346 goto out;
8347 survey_idx++;
8348 }
8349
8350 out:
8351 cb->args[2] = survey_idx;
8352 res = skb->len;
8353 out_err:
8354 rtnl_unlock();
8355 return res;
8356 }
8357
nl80211_valid_wpa_versions(u32 wpa_versions)8358 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8359 {
8360 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8361 NL80211_WPA_VERSION_2));
8362 }
8363
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)8364 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8365 {
8366 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8367 struct net_device *dev = info->user_ptr[1];
8368 struct ieee80211_channel *chan;
8369 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8370 int err, ssid_len, ie_len = 0, auth_data_len = 0;
8371 enum nl80211_auth_type auth_type;
8372 struct key_parse key;
8373 bool local_state_change;
8374
8375 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8376 return -EINVAL;
8377
8378 if (!info->attrs[NL80211_ATTR_MAC])
8379 return -EINVAL;
8380
8381 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8382 return -EINVAL;
8383
8384 if (!info->attrs[NL80211_ATTR_SSID])
8385 return -EINVAL;
8386
8387 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8388 return -EINVAL;
8389
8390 err = nl80211_parse_key(info, &key);
8391 if (err)
8392 return err;
8393
8394 if (key.idx >= 0) {
8395 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8396 return -EINVAL;
8397 if (!key.p.key || !key.p.key_len)
8398 return -EINVAL;
8399 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8400 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8401 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8402 key.p.key_len != WLAN_KEY_LEN_WEP104))
8403 return -EINVAL;
8404 if (key.idx > 3)
8405 return -EINVAL;
8406 } else {
8407 key.p.key_len = 0;
8408 key.p.key = NULL;
8409 }
8410
8411 if (key.idx >= 0) {
8412 int i;
8413 bool ok = false;
8414
8415 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8416 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8417 ok = true;
8418 break;
8419 }
8420 }
8421 if (!ok)
8422 return -EINVAL;
8423 }
8424
8425 if (!rdev->ops->auth)
8426 return -EOPNOTSUPP;
8427
8428 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8429 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8430 return -EOPNOTSUPP;
8431
8432 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8433 chan = nl80211_get_valid_chan(&rdev->wiphy,
8434 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8435 if (!chan)
8436 return -EINVAL;
8437
8438 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8439 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8440
8441 if (info->attrs[NL80211_ATTR_IE]) {
8442 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8443 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8444 }
8445
8446 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8447 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8448 return -EINVAL;
8449
8450 if ((auth_type == NL80211_AUTHTYPE_SAE ||
8451 auth_type == NL80211_AUTHTYPE_FILS_SK ||
8452 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8453 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8454 !info->attrs[NL80211_ATTR_AUTH_DATA])
8455 return -EINVAL;
8456
8457 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8458 if (auth_type != NL80211_AUTHTYPE_SAE &&
8459 auth_type != NL80211_AUTHTYPE_FILS_SK &&
8460 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8461 auth_type != NL80211_AUTHTYPE_FILS_PK)
8462 return -EINVAL;
8463 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8464 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8465 /* need to include at least Auth Transaction and Status Code */
8466 if (auth_data_len < 4)
8467 return -EINVAL;
8468 }
8469
8470 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8471
8472 /*
8473 * Since we no longer track auth state, ignore
8474 * requests to only change local state.
8475 */
8476 if (local_state_change)
8477 return 0;
8478
8479 wdev_lock(dev->ieee80211_ptr);
8480 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8481 ssid, ssid_len, ie, ie_len,
8482 key.p.key, key.p.key_len, key.idx,
8483 auth_data, auth_data_len);
8484 wdev_unlock(dev->ieee80211_ptr);
8485 return err;
8486 }
8487
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)8488 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8489 struct genl_info *info)
8490 {
8491 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8492 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8493 return -EINVAL;
8494 }
8495
8496 if (!rdev->ops->tx_control_port ||
8497 !wiphy_ext_feature_isset(&rdev->wiphy,
8498 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8499 return -EOPNOTSUPP;
8500
8501 return 0;
8502 }
8503
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)8504 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8505 struct genl_info *info,
8506 struct cfg80211_crypto_settings *settings,
8507 int cipher_limit)
8508 {
8509 memset(settings, 0, sizeof(*settings));
8510
8511 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8512
8513 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8514 u16 proto;
8515
8516 proto = nla_get_u16(
8517 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8518 settings->control_port_ethertype = cpu_to_be16(proto);
8519 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8520 proto != ETH_P_PAE)
8521 return -EINVAL;
8522 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8523 settings->control_port_no_encrypt = true;
8524 } else
8525 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8526
8527 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8528 int r = validate_pae_over_nl80211(rdev, info);
8529
8530 if (r < 0)
8531 return r;
8532
8533 settings->control_port_over_nl80211 = true;
8534 }
8535
8536 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8537 void *data;
8538 int len, i;
8539
8540 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8541 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8542 settings->n_ciphers_pairwise = len / sizeof(u32);
8543
8544 if (len % sizeof(u32))
8545 return -EINVAL;
8546
8547 if (settings->n_ciphers_pairwise > cipher_limit)
8548 return -EINVAL;
8549
8550 memcpy(settings->ciphers_pairwise, data, len);
8551
8552 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8553 if (!cfg80211_supported_cipher_suite(
8554 &rdev->wiphy,
8555 settings->ciphers_pairwise[i]))
8556 return -EINVAL;
8557 }
8558
8559 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8560 settings->cipher_group =
8561 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8562 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8563 settings->cipher_group))
8564 return -EINVAL;
8565 }
8566
8567 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8568 settings->wpa_versions =
8569 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8570 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8571 return -EINVAL;
8572 }
8573
8574 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8575 void *data;
8576 int len;
8577
8578 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8579 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8580 settings->n_akm_suites = len / sizeof(u32);
8581
8582 if (len % sizeof(u32))
8583 return -EINVAL;
8584
8585 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8586 return -EINVAL;
8587
8588 memcpy(settings->akm_suites, data, len);
8589 }
8590
8591 if (info->attrs[NL80211_ATTR_PMK]) {
8592 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8593 return -EINVAL;
8594 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8595 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8596 return -EINVAL;
8597 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8598 }
8599
8600 return 0;
8601 }
8602
nl80211_associate(struct sk_buff * skb,struct genl_info * info)8603 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8604 {
8605 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8606 struct net_device *dev = info->user_ptr[1];
8607 struct ieee80211_channel *chan;
8608 struct cfg80211_assoc_request req = {};
8609 const u8 *bssid, *ssid;
8610 int err, ssid_len = 0;
8611
8612 if (dev->ieee80211_ptr->conn_owner_nlportid &&
8613 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8614 return -EPERM;
8615
8616 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8617 return -EINVAL;
8618
8619 if (!info->attrs[NL80211_ATTR_MAC] ||
8620 !info->attrs[NL80211_ATTR_SSID] ||
8621 !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8622 return -EINVAL;
8623
8624 if (!rdev->ops->assoc)
8625 return -EOPNOTSUPP;
8626
8627 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8628 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8629 return -EOPNOTSUPP;
8630
8631 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8632
8633 chan = nl80211_get_valid_chan(&rdev->wiphy,
8634 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8635 if (!chan)
8636 return -EINVAL;
8637
8638 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8639 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8640
8641 if (info->attrs[NL80211_ATTR_IE]) {
8642 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8643 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8644 }
8645
8646 if (info->attrs[NL80211_ATTR_USE_MFP]) {
8647 enum nl80211_mfp mfp =
8648 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8649 if (mfp == NL80211_MFP_REQUIRED)
8650 req.use_mfp = true;
8651 else if (mfp != NL80211_MFP_NO)
8652 return -EINVAL;
8653 }
8654
8655 if (info->attrs[NL80211_ATTR_PREV_BSSID])
8656 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8657
8658 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8659 req.flags |= ASSOC_REQ_DISABLE_HT;
8660
8661 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8662 memcpy(&req.ht_capa_mask,
8663 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8664 sizeof(req.ht_capa_mask));
8665
8666 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8667 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8668 return -EINVAL;
8669 memcpy(&req.ht_capa,
8670 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8671 sizeof(req.ht_capa));
8672 }
8673
8674 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8675 req.flags |= ASSOC_REQ_DISABLE_VHT;
8676
8677 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8678 memcpy(&req.vht_capa_mask,
8679 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8680 sizeof(req.vht_capa_mask));
8681
8682 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8683 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8684 return -EINVAL;
8685 memcpy(&req.vht_capa,
8686 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8687 sizeof(req.vht_capa));
8688 }
8689
8690 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8691 if (!((rdev->wiphy.features &
8692 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8693 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8694 !wiphy_ext_feature_isset(&rdev->wiphy,
8695 NL80211_EXT_FEATURE_RRM))
8696 return -EINVAL;
8697 req.flags |= ASSOC_REQ_USE_RRM;
8698 }
8699
8700 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8701 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8702 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8703 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8704 return -EINVAL;
8705 req.fils_nonces =
8706 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8707 }
8708
8709 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8710 if (!err) {
8711 wdev_lock(dev->ieee80211_ptr);
8712
8713 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8714 ssid, ssid_len, &req);
8715
8716 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8717 dev->ieee80211_ptr->conn_owner_nlportid =
8718 info->snd_portid;
8719 memcpy(dev->ieee80211_ptr->disconnect_bssid,
8720 bssid, ETH_ALEN);
8721 }
8722
8723 wdev_unlock(dev->ieee80211_ptr);
8724 }
8725
8726 return err;
8727 }
8728
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)8729 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8730 {
8731 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8732 struct net_device *dev = info->user_ptr[1];
8733 const u8 *ie = NULL, *bssid;
8734 int ie_len = 0, err;
8735 u16 reason_code;
8736 bool local_state_change;
8737
8738 if (dev->ieee80211_ptr->conn_owner_nlportid &&
8739 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8740 return -EPERM;
8741
8742 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8743 return -EINVAL;
8744
8745 if (!info->attrs[NL80211_ATTR_MAC])
8746 return -EINVAL;
8747
8748 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8749 return -EINVAL;
8750
8751 if (!rdev->ops->deauth)
8752 return -EOPNOTSUPP;
8753
8754 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8755 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8756 return -EOPNOTSUPP;
8757
8758 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8759
8760 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8761 if (reason_code == 0) {
8762 /* Reason Code 0 is reserved */
8763 return -EINVAL;
8764 }
8765
8766 if (info->attrs[NL80211_ATTR_IE]) {
8767 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8768 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8769 }
8770
8771 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8772
8773 wdev_lock(dev->ieee80211_ptr);
8774 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8775 local_state_change);
8776 wdev_unlock(dev->ieee80211_ptr);
8777 return err;
8778 }
8779
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)8780 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8781 {
8782 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8783 struct net_device *dev = info->user_ptr[1];
8784 const u8 *ie = NULL, *bssid;
8785 int ie_len = 0, err;
8786 u16 reason_code;
8787 bool local_state_change;
8788
8789 if (dev->ieee80211_ptr->conn_owner_nlportid &&
8790 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8791 return -EPERM;
8792
8793 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8794 return -EINVAL;
8795
8796 if (!info->attrs[NL80211_ATTR_MAC])
8797 return -EINVAL;
8798
8799 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8800 return -EINVAL;
8801
8802 if (!rdev->ops->disassoc)
8803 return -EOPNOTSUPP;
8804
8805 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8806 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8807 return -EOPNOTSUPP;
8808
8809 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8810
8811 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8812 if (reason_code == 0) {
8813 /* Reason Code 0 is reserved */
8814 return -EINVAL;
8815 }
8816
8817 if (info->attrs[NL80211_ATTR_IE]) {
8818 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8819 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8820 }
8821
8822 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8823
8824 wdev_lock(dev->ieee80211_ptr);
8825 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8826 local_state_change);
8827 wdev_unlock(dev->ieee80211_ptr);
8828 return err;
8829 }
8830
8831 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)8832 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8833 int mcast_rate[NUM_NL80211_BANDS],
8834 int rateval)
8835 {
8836 struct wiphy *wiphy = &rdev->wiphy;
8837 bool found = false;
8838 int band, i;
8839
8840 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8841 struct ieee80211_supported_band *sband;
8842
8843 sband = wiphy->bands[band];
8844 if (!sband)
8845 continue;
8846
8847 for (i = 0; i < sband->n_bitrates; i++) {
8848 if (sband->bitrates[i].bitrate == rateval) {
8849 mcast_rate[band] = i + 1;
8850 found = true;
8851 break;
8852 }
8853 }
8854 }
8855
8856 return found;
8857 }
8858
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)8859 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8860 {
8861 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8862 struct net_device *dev = info->user_ptr[1];
8863 struct cfg80211_ibss_params ibss;
8864 struct wiphy *wiphy;
8865 struct cfg80211_cached_keys *connkeys = NULL;
8866 int err;
8867
8868 memset(&ibss, 0, sizeof(ibss));
8869
8870 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8871 return -EINVAL;
8872
8873 if (!info->attrs[NL80211_ATTR_SSID] ||
8874 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8875 return -EINVAL;
8876
8877 ibss.beacon_interval = 100;
8878
8879 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8880 ibss.beacon_interval =
8881 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8882
8883 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8884 ibss.beacon_interval);
8885 if (err)
8886 return err;
8887
8888 if (!rdev->ops->join_ibss)
8889 return -EOPNOTSUPP;
8890
8891 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8892 return -EOPNOTSUPP;
8893
8894 wiphy = &rdev->wiphy;
8895
8896 if (info->attrs[NL80211_ATTR_MAC]) {
8897 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8898
8899 if (!is_valid_ether_addr(ibss.bssid))
8900 return -EINVAL;
8901 }
8902 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8903 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8904
8905 if (info->attrs[NL80211_ATTR_IE]) {
8906 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8907 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8908 }
8909
8910 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8911 if (err)
8912 return err;
8913
8914 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8915 NL80211_IFTYPE_ADHOC))
8916 return -EINVAL;
8917
8918 switch (ibss.chandef.width) {
8919 case NL80211_CHAN_WIDTH_5:
8920 case NL80211_CHAN_WIDTH_10:
8921 case NL80211_CHAN_WIDTH_20_NOHT:
8922 break;
8923 case NL80211_CHAN_WIDTH_20:
8924 case NL80211_CHAN_WIDTH_40:
8925 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8926 return -EINVAL;
8927 break;
8928 case NL80211_CHAN_WIDTH_80:
8929 case NL80211_CHAN_WIDTH_80P80:
8930 case NL80211_CHAN_WIDTH_160:
8931 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8932 return -EINVAL;
8933 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8934 NL80211_EXT_FEATURE_VHT_IBSS))
8935 return -EINVAL;
8936 break;
8937 default:
8938 return -EINVAL;
8939 }
8940
8941 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8942 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8943
8944 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8945 u8 *rates =
8946 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8947 int n_rates =
8948 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8949 struct ieee80211_supported_band *sband =
8950 wiphy->bands[ibss.chandef.chan->band];
8951
8952 err = ieee80211_get_ratemask(sband, rates, n_rates,
8953 &ibss.basic_rates);
8954 if (err)
8955 return err;
8956 }
8957
8958 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8959 memcpy(&ibss.ht_capa_mask,
8960 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8961 sizeof(ibss.ht_capa_mask));
8962
8963 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8964 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8965 return -EINVAL;
8966 memcpy(&ibss.ht_capa,
8967 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8968 sizeof(ibss.ht_capa));
8969 }
8970
8971 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8972 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8973 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8974 return -EINVAL;
8975
8976 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8977 bool no_ht = false;
8978
8979 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
8980 if (IS_ERR(connkeys))
8981 return PTR_ERR(connkeys);
8982
8983 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8984 no_ht) {
8985 kzfree(connkeys);
8986 return -EINVAL;
8987 }
8988 }
8989
8990 ibss.control_port =
8991 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8992
8993 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8994 int r = validate_pae_over_nl80211(rdev, info);
8995
8996 if (r < 0)
8997 return r;
8998
8999 ibss.control_port_over_nl80211 = true;
9000 }
9001
9002 ibss.userspace_handles_dfs =
9003 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9004
9005 wdev_lock(dev->ieee80211_ptr);
9006 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9007 if (err)
9008 kzfree(connkeys);
9009 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9010 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9011 wdev_unlock(dev->ieee80211_ptr);
9012
9013 return err;
9014 }
9015
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)9016 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9017 {
9018 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9019 struct net_device *dev = info->user_ptr[1];
9020
9021 if (!rdev->ops->leave_ibss)
9022 return -EOPNOTSUPP;
9023
9024 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9025 return -EOPNOTSUPP;
9026
9027 return cfg80211_leave_ibss(rdev, dev, false);
9028 }
9029
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)9030 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9031 {
9032 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9033 struct net_device *dev = info->user_ptr[1];
9034 int mcast_rate[NUM_NL80211_BANDS];
9035 u32 nla_rate;
9036 int err;
9037
9038 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9039 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9040 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9041 return -EOPNOTSUPP;
9042
9043 if (!rdev->ops->set_mcast_rate)
9044 return -EOPNOTSUPP;
9045
9046 memset(mcast_rate, 0, sizeof(mcast_rate));
9047
9048 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9049 return -EINVAL;
9050
9051 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9052 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9053 return -EINVAL;
9054
9055 err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9056
9057 return err;
9058 }
9059
9060 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)9061 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9062 struct wireless_dev *wdev, int approxlen,
9063 u32 portid, u32 seq, enum nl80211_commands cmd,
9064 enum nl80211_attrs attr,
9065 const struct nl80211_vendor_cmd_info *info,
9066 gfp_t gfp)
9067 {
9068 struct sk_buff *skb;
9069 void *hdr;
9070 struct nlattr *data;
9071
9072 skb = nlmsg_new(approxlen + 100, gfp);
9073 if (!skb)
9074 return NULL;
9075
9076 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9077 if (!hdr) {
9078 kfree_skb(skb);
9079 return NULL;
9080 }
9081
9082 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9083 goto nla_put_failure;
9084
9085 if (info) {
9086 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9087 info->vendor_id))
9088 goto nla_put_failure;
9089 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9090 info->subcmd))
9091 goto nla_put_failure;
9092 }
9093
9094 if (wdev) {
9095 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9096 wdev_id(wdev), NL80211_ATTR_PAD))
9097 goto nla_put_failure;
9098 if (wdev->netdev &&
9099 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9100 wdev->netdev->ifindex))
9101 goto nla_put_failure;
9102 }
9103
9104 data = nla_nest_start(skb, attr);
9105 if (!data)
9106 goto nla_put_failure;
9107
9108 ((void **)skb->cb)[0] = rdev;
9109 ((void **)skb->cb)[1] = hdr;
9110 ((void **)skb->cb)[2] = data;
9111
9112 return skb;
9113
9114 nla_put_failure:
9115 kfree_skb(skb);
9116 return NULL;
9117 }
9118
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,int vendor_event_idx,int approxlen,gfp_t gfp)9119 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9120 struct wireless_dev *wdev,
9121 enum nl80211_commands cmd,
9122 enum nl80211_attrs attr,
9123 int vendor_event_idx,
9124 int approxlen, gfp_t gfp)
9125 {
9126 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9127 const struct nl80211_vendor_cmd_info *info;
9128
9129 switch (cmd) {
9130 case NL80211_CMD_TESTMODE:
9131 if (WARN_ON(vendor_event_idx != -1))
9132 return NULL;
9133 info = NULL;
9134 break;
9135 case NL80211_CMD_VENDOR:
9136 if (WARN_ON(vendor_event_idx < 0 ||
9137 vendor_event_idx >= wiphy->n_vendor_events))
9138 return NULL;
9139 info = &wiphy->vendor_events[vendor_event_idx];
9140 break;
9141 default:
9142 WARN_ON(1);
9143 return NULL;
9144 }
9145
9146 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
9147 cmd, attr, info, gfp);
9148 }
9149 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9150
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)9151 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9152 {
9153 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9154 void *hdr = ((void **)skb->cb)[1];
9155 struct nlattr *data = ((void **)skb->cb)[2];
9156 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9157
9158 /* clear CB data for netlink core to own from now on */
9159 memset(skb->cb, 0, sizeof(skb->cb));
9160
9161 nla_nest_end(skb, data);
9162 genlmsg_end(skb, hdr);
9163
9164 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9165 mcgrp = NL80211_MCGRP_VENDOR;
9166
9167 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
9168 mcgrp, gfp);
9169 }
9170 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9171
9172 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)9173 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9174 {
9175 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9176 struct wireless_dev *wdev =
9177 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9178 int err;
9179
9180 if (!rdev->ops->testmode_cmd)
9181 return -EOPNOTSUPP;
9182
9183 if (IS_ERR(wdev)) {
9184 err = PTR_ERR(wdev);
9185 if (err != -EINVAL)
9186 return err;
9187 wdev = NULL;
9188 } else if (wdev->wiphy != &rdev->wiphy) {
9189 return -EINVAL;
9190 }
9191
9192 if (!info->attrs[NL80211_ATTR_TESTDATA])
9193 return -EINVAL;
9194
9195 rdev->cur_cmd_info = info;
9196 err = rdev_testmode_cmd(rdev, wdev,
9197 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9198 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9199 rdev->cur_cmd_info = NULL;
9200
9201 return err;
9202 }
9203
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)9204 static int nl80211_testmode_dump(struct sk_buff *skb,
9205 struct netlink_callback *cb)
9206 {
9207 struct cfg80211_registered_device *rdev;
9208 int err;
9209 long phy_idx;
9210 void *data = NULL;
9211 int data_len = 0;
9212
9213 rtnl_lock();
9214
9215 if (cb->args[0]) {
9216 /*
9217 * 0 is a valid index, but not valid for args[0],
9218 * so we need to offset by 1.
9219 */
9220 phy_idx = cb->args[0] - 1;
9221
9222 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9223 if (!rdev) {
9224 err = -ENOENT;
9225 goto out_err;
9226 }
9227 } else {
9228 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9229
9230 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9231 attrbuf, nl80211_fam.maxattr,
9232 nl80211_policy, NULL);
9233 if (err)
9234 goto out_err;
9235
9236 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9237 if (IS_ERR(rdev)) {
9238 err = PTR_ERR(rdev);
9239 goto out_err;
9240 }
9241 phy_idx = rdev->wiphy_idx;
9242
9243 if (attrbuf[NL80211_ATTR_TESTDATA])
9244 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9245 }
9246
9247 if (cb->args[1]) {
9248 data = nla_data((void *)cb->args[1]);
9249 data_len = nla_len((void *)cb->args[1]);
9250 }
9251
9252 if (!rdev->ops->testmode_dump) {
9253 err = -EOPNOTSUPP;
9254 goto out_err;
9255 }
9256
9257 while (1) {
9258 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9259 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9260 NL80211_CMD_TESTMODE);
9261 struct nlattr *tmdata;
9262
9263 if (!hdr)
9264 break;
9265
9266 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9267 genlmsg_cancel(skb, hdr);
9268 break;
9269 }
9270
9271 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9272 if (!tmdata) {
9273 genlmsg_cancel(skb, hdr);
9274 break;
9275 }
9276 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9277 nla_nest_end(skb, tmdata);
9278
9279 if (err == -ENOBUFS || err == -ENOENT) {
9280 genlmsg_cancel(skb, hdr);
9281 break;
9282 } else if (err) {
9283 genlmsg_cancel(skb, hdr);
9284 goto out_err;
9285 }
9286
9287 genlmsg_end(skb, hdr);
9288 }
9289
9290 err = skb->len;
9291 /* see above */
9292 cb->args[0] = phy_idx + 1;
9293 out_err:
9294 rtnl_unlock();
9295 return err;
9296 }
9297 #endif
9298
nl80211_connect(struct sk_buff * skb,struct genl_info * info)9299 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9300 {
9301 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9302 struct net_device *dev = info->user_ptr[1];
9303 struct cfg80211_connect_params connect;
9304 struct wiphy *wiphy;
9305 struct cfg80211_cached_keys *connkeys = NULL;
9306 int err;
9307
9308 memset(&connect, 0, sizeof(connect));
9309
9310 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9311 return -EINVAL;
9312
9313 if (!info->attrs[NL80211_ATTR_SSID] ||
9314 !nla_len(info->attrs[NL80211_ATTR_SSID]))
9315 return -EINVAL;
9316
9317 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9318 connect.auth_type =
9319 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9320 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9321 NL80211_CMD_CONNECT))
9322 return -EINVAL;
9323 } else
9324 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9325
9326 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9327
9328 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9329 !wiphy_ext_feature_isset(&rdev->wiphy,
9330 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9331 return -EINVAL;
9332 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9333
9334 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9335 NL80211_MAX_NR_CIPHER_SUITES);
9336 if (err)
9337 return err;
9338
9339 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9340 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9341 return -EOPNOTSUPP;
9342
9343 wiphy = &rdev->wiphy;
9344
9345 connect.bg_scan_period = -1;
9346 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9347 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9348 connect.bg_scan_period =
9349 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9350 }
9351
9352 if (info->attrs[NL80211_ATTR_MAC])
9353 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9354 else if (info->attrs[NL80211_ATTR_MAC_HINT])
9355 connect.bssid_hint =
9356 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9357 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9358 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9359
9360 if (info->attrs[NL80211_ATTR_IE]) {
9361 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9362 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9363 }
9364
9365 if (info->attrs[NL80211_ATTR_USE_MFP]) {
9366 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9367 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9368 !wiphy_ext_feature_isset(&rdev->wiphy,
9369 NL80211_EXT_FEATURE_MFP_OPTIONAL))
9370 return -EOPNOTSUPP;
9371
9372 if (connect.mfp != NL80211_MFP_REQUIRED &&
9373 connect.mfp != NL80211_MFP_NO &&
9374 connect.mfp != NL80211_MFP_OPTIONAL)
9375 return -EINVAL;
9376 } else {
9377 connect.mfp = NL80211_MFP_NO;
9378 }
9379
9380 if (info->attrs[NL80211_ATTR_PREV_BSSID])
9381 connect.prev_bssid =
9382 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9383
9384 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9385 connect.channel = nl80211_get_valid_chan(
9386 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9387 if (!connect.channel)
9388 return -EINVAL;
9389 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9390 connect.channel_hint = nl80211_get_valid_chan(
9391 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9392 if (!connect.channel_hint)
9393 return -EINVAL;
9394 }
9395
9396 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9397 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9398 if (IS_ERR(connkeys))
9399 return PTR_ERR(connkeys);
9400 }
9401
9402 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9403 connect.flags |= ASSOC_REQ_DISABLE_HT;
9404
9405 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9406 memcpy(&connect.ht_capa_mask,
9407 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9408 sizeof(connect.ht_capa_mask));
9409
9410 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9411 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9412 kzfree(connkeys);
9413 return -EINVAL;
9414 }
9415 memcpy(&connect.ht_capa,
9416 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9417 sizeof(connect.ht_capa));
9418 }
9419
9420 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9421 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9422
9423 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9424 memcpy(&connect.vht_capa_mask,
9425 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9426 sizeof(connect.vht_capa_mask));
9427
9428 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9429 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9430 kzfree(connkeys);
9431 return -EINVAL;
9432 }
9433 memcpy(&connect.vht_capa,
9434 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9435 sizeof(connect.vht_capa));
9436 }
9437
9438 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9439 if (!((rdev->wiphy.features &
9440 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9441 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9442 !wiphy_ext_feature_isset(&rdev->wiphy,
9443 NL80211_EXT_FEATURE_RRM)) {
9444 kzfree(connkeys);
9445 return -EINVAL;
9446 }
9447 connect.flags |= ASSOC_REQ_USE_RRM;
9448 }
9449
9450 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9451 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9452 kzfree(connkeys);
9453 return -EOPNOTSUPP;
9454 }
9455
9456 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9457 /* bss selection makes no sense if bssid is set */
9458 if (connect.bssid) {
9459 kzfree(connkeys);
9460 return -EINVAL;
9461 }
9462
9463 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9464 wiphy, &connect.bss_select);
9465 if (err) {
9466 kzfree(connkeys);
9467 return err;
9468 }
9469 }
9470
9471 if (wiphy_ext_feature_isset(&rdev->wiphy,
9472 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9473 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9474 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9475 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9476 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9477 connect.fils_erp_username =
9478 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9479 connect.fils_erp_username_len =
9480 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9481 connect.fils_erp_realm =
9482 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9483 connect.fils_erp_realm_len =
9484 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9485 connect.fils_erp_next_seq_num =
9486 nla_get_u16(
9487 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9488 connect.fils_erp_rrk =
9489 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9490 connect.fils_erp_rrk_len =
9491 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9492 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9493 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9494 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9495 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9496 kzfree(connkeys);
9497 return -EINVAL;
9498 }
9499
9500 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9501 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9502 kzfree(connkeys);
9503 GENL_SET_ERR_MSG(info,
9504 "external auth requires connection ownership");
9505 return -EINVAL;
9506 }
9507 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9508 }
9509
9510 wdev_lock(dev->ieee80211_ptr);
9511
9512 err = cfg80211_connect(rdev, dev, &connect, connkeys,
9513 connect.prev_bssid);
9514 if (err)
9515 kzfree(connkeys);
9516
9517 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9518 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9519 if (connect.bssid)
9520 memcpy(dev->ieee80211_ptr->disconnect_bssid,
9521 connect.bssid, ETH_ALEN);
9522 else
9523 memset(dev->ieee80211_ptr->disconnect_bssid,
9524 0, ETH_ALEN);
9525 }
9526
9527 wdev_unlock(dev->ieee80211_ptr);
9528
9529 return err;
9530 }
9531
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)9532 static int nl80211_update_connect_params(struct sk_buff *skb,
9533 struct genl_info *info)
9534 {
9535 struct cfg80211_connect_params connect = {};
9536 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9537 struct net_device *dev = info->user_ptr[1];
9538 struct wireless_dev *wdev = dev->ieee80211_ptr;
9539 bool fils_sk_offload;
9540 u32 auth_type;
9541 u32 changed = 0;
9542 int ret;
9543
9544 if (!rdev->ops->update_connect_params)
9545 return -EOPNOTSUPP;
9546
9547 if (info->attrs[NL80211_ATTR_IE]) {
9548 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9549 return -EINVAL;
9550 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9551 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9552 changed |= UPDATE_ASSOC_IES;
9553 }
9554
9555 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9556 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9557
9558 /*
9559 * when driver supports fils-sk offload all attributes must be
9560 * provided. So the else covers "fils-sk-not-all" and
9561 * "no-fils-sk-any".
9562 */
9563 if (fils_sk_offload &&
9564 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9565 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9566 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9567 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9568 connect.fils_erp_username =
9569 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9570 connect.fils_erp_username_len =
9571 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9572 connect.fils_erp_realm =
9573 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9574 connect.fils_erp_realm_len =
9575 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9576 connect.fils_erp_next_seq_num =
9577 nla_get_u16(
9578 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9579 connect.fils_erp_rrk =
9580 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9581 connect.fils_erp_rrk_len =
9582 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9583 changed |= UPDATE_FILS_ERP_INFO;
9584 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9585 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9586 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9587 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9588 return -EINVAL;
9589 }
9590
9591 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9592 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9593 if (!nl80211_valid_auth_type(rdev, auth_type,
9594 NL80211_CMD_CONNECT))
9595 return -EINVAL;
9596
9597 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9598 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9599 return -EINVAL;
9600
9601 connect.auth_type = auth_type;
9602 changed |= UPDATE_AUTH_TYPE;
9603 }
9604
9605 wdev_lock(dev->ieee80211_ptr);
9606 if (!wdev->current_bss)
9607 ret = -ENOLINK;
9608 else
9609 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9610 wdev_unlock(dev->ieee80211_ptr);
9611
9612 return ret;
9613 }
9614
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)9615 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9616 {
9617 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9618 struct net_device *dev = info->user_ptr[1];
9619 u16 reason;
9620 int ret;
9621
9622 if (dev->ieee80211_ptr->conn_owner_nlportid &&
9623 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9624 return -EPERM;
9625
9626 if (!info->attrs[NL80211_ATTR_REASON_CODE])
9627 reason = WLAN_REASON_DEAUTH_LEAVING;
9628 else
9629 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9630
9631 if (reason == 0)
9632 return -EINVAL;
9633
9634 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9635 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9636 return -EOPNOTSUPP;
9637
9638 wdev_lock(dev->ieee80211_ptr);
9639 ret = cfg80211_disconnect(rdev, dev, reason, true);
9640 wdev_unlock(dev->ieee80211_ptr);
9641 return ret;
9642 }
9643
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)9644 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9645 {
9646 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9647 struct net *net;
9648 int err;
9649
9650 if (info->attrs[NL80211_ATTR_PID]) {
9651 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9652
9653 net = get_net_ns_by_pid(pid);
9654 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9655 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9656
9657 net = get_net_ns_by_fd(fd);
9658 } else {
9659 return -EINVAL;
9660 }
9661
9662 if (IS_ERR(net))
9663 return PTR_ERR(net);
9664
9665 err = 0;
9666
9667 /* check if anything to do */
9668 if (!net_eq(wiphy_net(&rdev->wiphy), net))
9669 err = cfg80211_switch_netns(rdev, net);
9670
9671 put_net(net);
9672 return err;
9673 }
9674
nl80211_setdel_pmksa(struct sk_buff * skb,struct genl_info * info)9675 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9676 {
9677 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9678 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9679 struct cfg80211_pmksa *pmksa) = NULL;
9680 struct net_device *dev = info->user_ptr[1];
9681 struct cfg80211_pmksa pmksa;
9682
9683 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9684
9685 if (!info->attrs[NL80211_ATTR_PMKID])
9686 return -EINVAL;
9687
9688 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9689
9690 if (info->attrs[NL80211_ATTR_MAC]) {
9691 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9692 } else if (info->attrs[NL80211_ATTR_SSID] &&
9693 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9694 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9695 info->attrs[NL80211_ATTR_PMK])) {
9696 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9697 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9698 pmksa.cache_id =
9699 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9700 } else {
9701 return -EINVAL;
9702 }
9703 if (info->attrs[NL80211_ATTR_PMK]) {
9704 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9705 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9706 }
9707
9708 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9709 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9710 return -EOPNOTSUPP;
9711
9712 switch (info->genlhdr->cmd) {
9713 case NL80211_CMD_SET_PMKSA:
9714 rdev_ops = rdev->ops->set_pmksa;
9715 break;
9716 case NL80211_CMD_DEL_PMKSA:
9717 rdev_ops = rdev->ops->del_pmksa;
9718 break;
9719 default:
9720 WARN_ON(1);
9721 break;
9722 }
9723
9724 if (!rdev_ops)
9725 return -EOPNOTSUPP;
9726
9727 return rdev_ops(&rdev->wiphy, dev, &pmksa);
9728 }
9729
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)9730 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9731 {
9732 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9733 struct net_device *dev = info->user_ptr[1];
9734
9735 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9736 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9737 return -EOPNOTSUPP;
9738
9739 if (!rdev->ops->flush_pmksa)
9740 return -EOPNOTSUPP;
9741
9742 return rdev_flush_pmksa(rdev, dev);
9743 }
9744
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)9745 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9746 {
9747 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9748 struct net_device *dev = info->user_ptr[1];
9749 u8 action_code, dialog_token;
9750 u32 peer_capability = 0;
9751 u16 status_code;
9752 u8 *peer;
9753 bool initiator;
9754
9755 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9756 !rdev->ops->tdls_mgmt)
9757 return -EOPNOTSUPP;
9758
9759 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9760 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9761 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9762 !info->attrs[NL80211_ATTR_IE] ||
9763 !info->attrs[NL80211_ATTR_MAC])
9764 return -EINVAL;
9765
9766 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9767 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9768 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9769 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9770 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9771 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9772 peer_capability =
9773 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9774
9775 return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9776 dialog_token, status_code, peer_capability,
9777 initiator,
9778 nla_data(info->attrs[NL80211_ATTR_IE]),
9779 nla_len(info->attrs[NL80211_ATTR_IE]));
9780 }
9781
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)9782 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9783 {
9784 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9785 struct net_device *dev = info->user_ptr[1];
9786 enum nl80211_tdls_operation operation;
9787 u8 *peer;
9788
9789 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9790 !rdev->ops->tdls_oper)
9791 return -EOPNOTSUPP;
9792
9793 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9794 !info->attrs[NL80211_ATTR_MAC])
9795 return -EINVAL;
9796
9797 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9798 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9799
9800 return rdev_tdls_oper(rdev, dev, peer, operation);
9801 }
9802
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)9803 static int nl80211_remain_on_channel(struct sk_buff *skb,
9804 struct genl_info *info)
9805 {
9806 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9807 struct wireless_dev *wdev = info->user_ptr[1];
9808 struct cfg80211_chan_def chandef;
9809 const struct cfg80211_chan_def *compat_chandef;
9810 struct sk_buff *msg;
9811 void *hdr;
9812 u64 cookie;
9813 u32 duration;
9814 int err;
9815
9816 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9817 !info->attrs[NL80211_ATTR_DURATION])
9818 return -EINVAL;
9819
9820 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9821
9822 if (!rdev->ops->remain_on_channel ||
9823 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9824 return -EOPNOTSUPP;
9825
9826 /*
9827 * We should be on that channel for at least a minimum amount of
9828 * time (10ms) but no longer than the driver supports.
9829 */
9830 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9831 duration > rdev->wiphy.max_remain_on_channel_duration)
9832 return -EINVAL;
9833
9834 err = nl80211_parse_chandef(rdev, info, &chandef);
9835 if (err)
9836 return err;
9837
9838 wdev_lock(wdev);
9839 if (!cfg80211_off_channel_oper_allowed(wdev) &&
9840 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9841 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9842 &chandef);
9843 if (compat_chandef != &chandef) {
9844 wdev_unlock(wdev);
9845 return -EBUSY;
9846 }
9847 }
9848 wdev_unlock(wdev);
9849
9850 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9851 if (!msg)
9852 return -ENOMEM;
9853
9854 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9855 NL80211_CMD_REMAIN_ON_CHANNEL);
9856 if (!hdr) {
9857 err = -ENOBUFS;
9858 goto free_msg;
9859 }
9860
9861 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9862 duration, &cookie);
9863
9864 if (err)
9865 goto free_msg;
9866
9867 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9868 NL80211_ATTR_PAD))
9869 goto nla_put_failure;
9870
9871 genlmsg_end(msg, hdr);
9872
9873 return genlmsg_reply(msg, info);
9874
9875 nla_put_failure:
9876 err = -ENOBUFS;
9877 free_msg:
9878 nlmsg_free(msg);
9879 return err;
9880 }
9881
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)9882 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9883 struct genl_info *info)
9884 {
9885 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9886 struct wireless_dev *wdev = info->user_ptr[1];
9887 u64 cookie;
9888
9889 if (!info->attrs[NL80211_ATTR_COOKIE])
9890 return -EINVAL;
9891
9892 if (!rdev->ops->cancel_remain_on_channel)
9893 return -EOPNOTSUPP;
9894
9895 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9896
9897 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9898 }
9899
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)9900 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9901 struct genl_info *info)
9902 {
9903 struct cfg80211_bitrate_mask mask;
9904 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9905 struct net_device *dev = info->user_ptr[1];
9906 int err;
9907
9908 if (!rdev->ops->set_bitrate_mask)
9909 return -EOPNOTSUPP;
9910
9911 err = nl80211_parse_tx_bitrate_mask(info, &mask);
9912 if (err)
9913 return err;
9914
9915 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9916 }
9917
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)9918 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9919 {
9920 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9921 struct wireless_dev *wdev = info->user_ptr[1];
9922 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9923
9924 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9925 return -EINVAL;
9926
9927 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9928 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9929
9930 switch (wdev->iftype) {
9931 case NL80211_IFTYPE_STATION:
9932 case NL80211_IFTYPE_ADHOC:
9933 case NL80211_IFTYPE_P2P_CLIENT:
9934 case NL80211_IFTYPE_AP:
9935 case NL80211_IFTYPE_AP_VLAN:
9936 case NL80211_IFTYPE_MESH_POINT:
9937 case NL80211_IFTYPE_P2P_GO:
9938 case NL80211_IFTYPE_P2P_DEVICE:
9939 break;
9940 case NL80211_IFTYPE_NAN:
9941 default:
9942 return -EOPNOTSUPP;
9943 }
9944
9945 /* not much point in registering if we can't reply */
9946 if (!rdev->ops->mgmt_tx)
9947 return -EOPNOTSUPP;
9948
9949 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9950 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9951 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9952 }
9953
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)9954 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9955 {
9956 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9957 struct wireless_dev *wdev = info->user_ptr[1];
9958 struct cfg80211_chan_def chandef;
9959 int err;
9960 void *hdr = NULL;
9961 u64 cookie;
9962 struct sk_buff *msg = NULL;
9963 struct cfg80211_mgmt_tx_params params = {
9964 .dont_wait_for_ack =
9965 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9966 };
9967
9968 if (!info->attrs[NL80211_ATTR_FRAME])
9969 return -EINVAL;
9970
9971 if (!rdev->ops->mgmt_tx)
9972 return -EOPNOTSUPP;
9973
9974 switch (wdev->iftype) {
9975 case NL80211_IFTYPE_P2P_DEVICE:
9976 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9977 return -EINVAL;
9978 case NL80211_IFTYPE_STATION:
9979 case NL80211_IFTYPE_ADHOC:
9980 case NL80211_IFTYPE_P2P_CLIENT:
9981 case NL80211_IFTYPE_AP:
9982 case NL80211_IFTYPE_AP_VLAN:
9983 case NL80211_IFTYPE_MESH_POINT:
9984 case NL80211_IFTYPE_P2P_GO:
9985 break;
9986 case NL80211_IFTYPE_NAN:
9987 default:
9988 return -EOPNOTSUPP;
9989 }
9990
9991 if (info->attrs[NL80211_ATTR_DURATION]) {
9992 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9993 return -EINVAL;
9994 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9995
9996 /*
9997 * We should wait on the channel for at least a minimum amount
9998 * of time (10ms) but no longer than the driver supports.
9999 */
10000 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10001 params.wait > rdev->wiphy.max_remain_on_channel_duration)
10002 return -EINVAL;
10003 }
10004
10005 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10006
10007 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10008 return -EINVAL;
10009
10010 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10011
10012 /* get the channel if any has been specified, otherwise pass NULL to
10013 * the driver. The latter will use the current one
10014 */
10015 chandef.chan = NULL;
10016 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10017 err = nl80211_parse_chandef(rdev, info, &chandef);
10018 if (err)
10019 return err;
10020 }
10021
10022 if (!chandef.chan && params.offchan)
10023 return -EINVAL;
10024
10025 wdev_lock(wdev);
10026 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10027 wdev_unlock(wdev);
10028 return -EBUSY;
10029 }
10030 wdev_unlock(wdev);
10031
10032 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10033 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10034
10035 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10036 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10037 int i;
10038
10039 if (len % sizeof(u16))
10040 return -EINVAL;
10041
10042 params.n_csa_offsets = len / sizeof(u16);
10043 params.csa_offsets =
10044 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10045
10046 /* check that all the offsets fit the frame */
10047 for (i = 0; i < params.n_csa_offsets; i++) {
10048 if (params.csa_offsets[i] >= params.len)
10049 return -EINVAL;
10050 }
10051 }
10052
10053 if (!params.dont_wait_for_ack) {
10054 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10055 if (!msg)
10056 return -ENOMEM;
10057
10058 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10059 NL80211_CMD_FRAME);
10060 if (!hdr) {
10061 err = -ENOBUFS;
10062 goto free_msg;
10063 }
10064 }
10065
10066 params.chan = chandef.chan;
10067 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
10068 if (err)
10069 goto free_msg;
10070
10071 if (msg) {
10072 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10073 NL80211_ATTR_PAD))
10074 goto nla_put_failure;
10075
10076 genlmsg_end(msg, hdr);
10077 return genlmsg_reply(msg, info);
10078 }
10079
10080 return 0;
10081
10082 nla_put_failure:
10083 err = -ENOBUFS;
10084 free_msg:
10085 nlmsg_free(msg);
10086 return err;
10087 }
10088
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)10089 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10090 {
10091 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10092 struct wireless_dev *wdev = info->user_ptr[1];
10093 u64 cookie;
10094
10095 if (!info->attrs[NL80211_ATTR_COOKIE])
10096 return -EINVAL;
10097
10098 if (!rdev->ops->mgmt_tx_cancel_wait)
10099 return -EOPNOTSUPP;
10100
10101 switch (wdev->iftype) {
10102 case NL80211_IFTYPE_STATION:
10103 case NL80211_IFTYPE_ADHOC:
10104 case NL80211_IFTYPE_P2P_CLIENT:
10105 case NL80211_IFTYPE_AP:
10106 case NL80211_IFTYPE_AP_VLAN:
10107 case NL80211_IFTYPE_P2P_GO:
10108 case NL80211_IFTYPE_P2P_DEVICE:
10109 break;
10110 case NL80211_IFTYPE_NAN:
10111 default:
10112 return -EOPNOTSUPP;
10113 }
10114
10115 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10116
10117 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10118 }
10119
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)10120 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10121 {
10122 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10123 struct wireless_dev *wdev;
10124 struct net_device *dev = info->user_ptr[1];
10125 u8 ps_state;
10126 bool state;
10127 int err;
10128
10129 if (!info->attrs[NL80211_ATTR_PS_STATE])
10130 return -EINVAL;
10131
10132 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10133
10134 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
10135 return -EINVAL;
10136
10137 wdev = dev->ieee80211_ptr;
10138
10139 if (!rdev->ops->set_power_mgmt)
10140 return -EOPNOTSUPP;
10141
10142 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10143
10144 if (state == wdev->ps)
10145 return 0;
10146
10147 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10148 if (!err)
10149 wdev->ps = state;
10150 return err;
10151 }
10152
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)10153 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10154 {
10155 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10156 enum nl80211_ps_state ps_state;
10157 struct wireless_dev *wdev;
10158 struct net_device *dev = info->user_ptr[1];
10159 struct sk_buff *msg;
10160 void *hdr;
10161 int err;
10162
10163 wdev = dev->ieee80211_ptr;
10164
10165 if (!rdev->ops->set_power_mgmt)
10166 return -EOPNOTSUPP;
10167
10168 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10169 if (!msg)
10170 return -ENOMEM;
10171
10172 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10173 NL80211_CMD_GET_POWER_SAVE);
10174 if (!hdr) {
10175 err = -ENOBUFS;
10176 goto free_msg;
10177 }
10178
10179 if (wdev->ps)
10180 ps_state = NL80211_PS_ENABLED;
10181 else
10182 ps_state = NL80211_PS_DISABLED;
10183
10184 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10185 goto nla_put_failure;
10186
10187 genlmsg_end(msg, hdr);
10188 return genlmsg_reply(msg, info);
10189
10190 nla_put_failure:
10191 err = -ENOBUFS;
10192 free_msg:
10193 nlmsg_free(msg);
10194 return err;
10195 }
10196
10197 static const struct nla_policy
10198 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10199 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10200 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10201 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10202 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10203 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10204 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10205 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10206 };
10207
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)10208 static int nl80211_set_cqm_txe(struct genl_info *info,
10209 u32 rate, u32 pkts, u32 intvl)
10210 {
10211 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10212 struct net_device *dev = info->user_ptr[1];
10213 struct wireless_dev *wdev = dev->ieee80211_ptr;
10214
10215 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10216 return -EINVAL;
10217
10218 if (!rdev->ops->set_cqm_txe_config)
10219 return -EOPNOTSUPP;
10220
10221 if (wdev->iftype != NL80211_IFTYPE_STATION &&
10222 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10223 return -EOPNOTSUPP;
10224
10225 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10226 }
10227
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev)10228 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10229 struct net_device *dev)
10230 {
10231 struct wireless_dev *wdev = dev->ieee80211_ptr;
10232 s32 last, low, high;
10233 u32 hyst;
10234 int i, n, low_index;
10235 int err;
10236
10237 /* RSSI reporting disabled? */
10238 if (!wdev->cqm_config)
10239 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10240
10241 /*
10242 * Obtain current RSSI value if possible, if not and no RSSI threshold
10243 * event has been received yet, we should receive an event after a
10244 * connection is established and enough beacons received to calculate
10245 * the average.
10246 */
10247 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10248 rdev->ops->get_station) {
10249 struct station_info sinfo = {};
10250 u8 *mac_addr;
10251
10252 mac_addr = wdev->current_bss->pub.bssid;
10253
10254 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10255 if (err)
10256 return err;
10257
10258 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10259 wdev->cqm_config->last_rssi_event_value =
10260 (s8) sinfo.rx_beacon_signal_avg;
10261 }
10262
10263 last = wdev->cqm_config->last_rssi_event_value;
10264 hyst = wdev->cqm_config->rssi_hyst;
10265 n = wdev->cqm_config->n_rssi_thresholds;
10266
10267 for (i = 0; i < n; i++)
10268 if (last < wdev->cqm_config->rssi_thresholds[i])
10269 break;
10270
10271 low_index = i - 1;
10272 if (low_index >= 0) {
10273 low_index = array_index_nospec(low_index, n);
10274 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10275 } else {
10276 low = S32_MIN;
10277 }
10278 if (i < n) {
10279 i = array_index_nospec(i, n);
10280 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10281 } else {
10282 high = S32_MAX;
10283 }
10284
10285 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10286 }
10287
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)10288 static int nl80211_set_cqm_rssi(struct genl_info *info,
10289 const s32 *thresholds, int n_thresholds,
10290 u32 hysteresis)
10291 {
10292 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10293 struct net_device *dev = info->user_ptr[1];
10294 struct wireless_dev *wdev = dev->ieee80211_ptr;
10295 int i, err;
10296 s32 prev = S32_MIN;
10297
10298 /* Check all values negative and sorted */
10299 for (i = 0; i < n_thresholds; i++) {
10300 if (thresholds[i] > 0 || thresholds[i] <= prev)
10301 return -EINVAL;
10302
10303 prev = thresholds[i];
10304 }
10305
10306 if (wdev->iftype != NL80211_IFTYPE_STATION &&
10307 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10308 return -EOPNOTSUPP;
10309
10310 wdev_lock(wdev);
10311 cfg80211_cqm_config_free(wdev);
10312 wdev_unlock(wdev);
10313
10314 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10315 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10316 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10317
10318 return rdev_set_cqm_rssi_config(rdev, dev,
10319 thresholds[0], hysteresis);
10320 }
10321
10322 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10323 NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10324 return -EOPNOTSUPP;
10325
10326 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10327 n_thresholds = 0;
10328
10329 wdev_lock(wdev);
10330 if (n_thresholds) {
10331 struct cfg80211_cqm_config *cqm_config;
10332
10333 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10334 n_thresholds * sizeof(s32), GFP_KERNEL);
10335 if (!cqm_config) {
10336 err = -ENOMEM;
10337 goto unlock;
10338 }
10339
10340 cqm_config->rssi_hyst = hysteresis;
10341 cqm_config->n_rssi_thresholds = n_thresholds;
10342 memcpy(cqm_config->rssi_thresholds, thresholds,
10343 n_thresholds * sizeof(s32));
10344
10345 wdev->cqm_config = cqm_config;
10346 }
10347
10348 err = cfg80211_cqm_rssi_update(rdev, dev);
10349
10350 unlock:
10351 wdev_unlock(wdev);
10352
10353 return err;
10354 }
10355
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)10356 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10357 {
10358 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10359 struct nlattr *cqm;
10360 int err;
10361
10362 cqm = info->attrs[NL80211_ATTR_CQM];
10363 if (!cqm)
10364 return -EINVAL;
10365
10366 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10367 nl80211_attr_cqm_policy, info->extack);
10368 if (err)
10369 return err;
10370
10371 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10372 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10373 const s32 *thresholds =
10374 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10375 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10376 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10377
10378 if (len % 4)
10379 return -EINVAL;
10380
10381 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10382 hysteresis);
10383 }
10384
10385 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10386 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10387 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10388 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10389 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10390 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10391
10392 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10393 }
10394
10395 return -EINVAL;
10396 }
10397
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)10398 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10399 {
10400 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10401 struct net_device *dev = info->user_ptr[1];
10402 struct ocb_setup setup = {};
10403 int err;
10404
10405 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10406 if (err)
10407 return err;
10408
10409 return cfg80211_join_ocb(rdev, dev, &setup);
10410 }
10411
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)10412 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10413 {
10414 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10415 struct net_device *dev = info->user_ptr[1];
10416
10417 return cfg80211_leave_ocb(rdev, dev);
10418 }
10419
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)10420 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10421 {
10422 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10423 struct net_device *dev = info->user_ptr[1];
10424 struct mesh_config cfg;
10425 struct mesh_setup setup;
10426 int err;
10427
10428 /* start with default */
10429 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10430 memcpy(&setup, &default_mesh_setup, sizeof(setup));
10431
10432 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10433 /* and parse parameters if given */
10434 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10435 if (err)
10436 return err;
10437 }
10438
10439 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10440 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10441 return -EINVAL;
10442
10443 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10444 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10445
10446 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10447 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10448 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10449 return -EINVAL;
10450
10451 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10452 setup.beacon_interval =
10453 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10454
10455 err = cfg80211_validate_beacon_int(rdev,
10456 NL80211_IFTYPE_MESH_POINT,
10457 setup.beacon_interval);
10458 if (err)
10459 return err;
10460 }
10461
10462 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10463 setup.dtim_period =
10464 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10465 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10466 return -EINVAL;
10467 }
10468
10469 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10470 /* parse additional setup parameters if given */
10471 err = nl80211_parse_mesh_setup(info, &setup);
10472 if (err)
10473 return err;
10474 }
10475
10476 if (setup.user_mpm)
10477 cfg.auto_open_plinks = false;
10478
10479 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10480 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10481 if (err)
10482 return err;
10483 } else {
10484 /* __cfg80211_join_mesh() will sort it out */
10485 setup.chandef.chan = NULL;
10486 }
10487
10488 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10489 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10490 int n_rates =
10491 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10492 struct ieee80211_supported_band *sband;
10493
10494 if (!setup.chandef.chan)
10495 return -EINVAL;
10496
10497 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10498
10499 err = ieee80211_get_ratemask(sband, rates, n_rates,
10500 &setup.basic_rates);
10501 if (err)
10502 return err;
10503 }
10504
10505 if (info->attrs[NL80211_ATTR_TX_RATES]) {
10506 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10507 if (err)
10508 return err;
10509
10510 if (!setup.chandef.chan)
10511 return -EINVAL;
10512
10513 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10514 &setup.beacon_rate);
10515 if (err)
10516 return err;
10517 }
10518
10519 setup.userspace_handles_dfs =
10520 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10521
10522 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10523 int r = validate_pae_over_nl80211(rdev, info);
10524
10525 if (r < 0)
10526 return r;
10527
10528 setup.control_port_over_nl80211 = true;
10529 }
10530
10531 wdev_lock(dev->ieee80211_ptr);
10532 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10533 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10534 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10535 wdev_unlock(dev->ieee80211_ptr);
10536
10537 return err;
10538 }
10539
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)10540 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10541 {
10542 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10543 struct net_device *dev = info->user_ptr[1];
10544
10545 return cfg80211_leave_mesh(rdev, dev);
10546 }
10547
10548 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)10549 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10550 struct cfg80211_registered_device *rdev)
10551 {
10552 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10553 struct nlattr *nl_pats, *nl_pat;
10554 int i, pat_len;
10555
10556 if (!wowlan->n_patterns)
10557 return 0;
10558
10559 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10560 if (!nl_pats)
10561 return -ENOBUFS;
10562
10563 for (i = 0; i < wowlan->n_patterns; i++) {
10564 nl_pat = nla_nest_start(msg, i + 1);
10565 if (!nl_pat)
10566 return -ENOBUFS;
10567 pat_len = wowlan->patterns[i].pattern_len;
10568 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10569 wowlan->patterns[i].mask) ||
10570 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10571 wowlan->patterns[i].pattern) ||
10572 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10573 wowlan->patterns[i].pkt_offset))
10574 return -ENOBUFS;
10575 nla_nest_end(msg, nl_pat);
10576 }
10577 nla_nest_end(msg, nl_pats);
10578
10579 return 0;
10580 }
10581
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)10582 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10583 struct cfg80211_wowlan_tcp *tcp)
10584 {
10585 struct nlattr *nl_tcp;
10586
10587 if (!tcp)
10588 return 0;
10589
10590 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10591 if (!nl_tcp)
10592 return -ENOBUFS;
10593
10594 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10595 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10596 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10597 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10598 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10599 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10600 tcp->payload_len, tcp->payload) ||
10601 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10602 tcp->data_interval) ||
10603 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10604 tcp->wake_len, tcp->wake_data) ||
10605 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10606 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10607 return -ENOBUFS;
10608
10609 if (tcp->payload_seq.len &&
10610 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10611 sizeof(tcp->payload_seq), &tcp->payload_seq))
10612 return -ENOBUFS;
10613
10614 if (tcp->payload_tok.len &&
10615 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10616 sizeof(tcp->payload_tok) + tcp->tokens_size,
10617 &tcp->payload_tok))
10618 return -ENOBUFS;
10619
10620 nla_nest_end(msg, nl_tcp);
10621
10622 return 0;
10623 }
10624
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)10625 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10626 struct cfg80211_sched_scan_request *req)
10627 {
10628 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10629 int i;
10630
10631 if (!req)
10632 return 0;
10633
10634 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10635 if (!nd)
10636 return -ENOBUFS;
10637
10638 if (req->n_scan_plans == 1 &&
10639 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10640 req->scan_plans[0].interval * 1000))
10641 return -ENOBUFS;
10642
10643 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10644 return -ENOBUFS;
10645
10646 if (req->relative_rssi_set) {
10647 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10648
10649 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10650 req->relative_rssi))
10651 return -ENOBUFS;
10652
10653 rssi_adjust.band = req->rssi_adjust.band;
10654 rssi_adjust.delta = req->rssi_adjust.delta;
10655 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10656 sizeof(rssi_adjust), &rssi_adjust))
10657 return -ENOBUFS;
10658 }
10659
10660 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10661 if (!freqs)
10662 return -ENOBUFS;
10663
10664 for (i = 0; i < req->n_channels; i++) {
10665 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10666 return -ENOBUFS;
10667 }
10668
10669 nla_nest_end(msg, freqs);
10670
10671 if (req->n_match_sets) {
10672 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10673 if (!matches)
10674 return -ENOBUFS;
10675
10676 for (i = 0; i < req->n_match_sets; i++) {
10677 match = nla_nest_start(msg, i);
10678 if (!match)
10679 return -ENOBUFS;
10680
10681 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10682 req->match_sets[i].ssid.ssid_len,
10683 req->match_sets[i].ssid.ssid))
10684 return -ENOBUFS;
10685 nla_nest_end(msg, match);
10686 }
10687 nla_nest_end(msg, matches);
10688 }
10689
10690 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10691 if (!scan_plans)
10692 return -ENOBUFS;
10693
10694 for (i = 0; i < req->n_scan_plans; i++) {
10695 scan_plan = nla_nest_start(msg, i + 1);
10696 if (!scan_plan)
10697 return -ENOBUFS;
10698
10699 if (!scan_plan ||
10700 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10701 req->scan_plans[i].interval) ||
10702 (req->scan_plans[i].iterations &&
10703 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10704 req->scan_plans[i].iterations)))
10705 return -ENOBUFS;
10706 nla_nest_end(msg, scan_plan);
10707 }
10708 nla_nest_end(msg, scan_plans);
10709
10710 nla_nest_end(msg, nd);
10711
10712 return 0;
10713 }
10714
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)10715 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10716 {
10717 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10718 struct sk_buff *msg;
10719 void *hdr;
10720 u32 size = NLMSG_DEFAULT_SIZE;
10721
10722 if (!rdev->wiphy.wowlan)
10723 return -EOPNOTSUPP;
10724
10725 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10726 /* adjust size to have room for all the data */
10727 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10728 rdev->wiphy.wowlan_config->tcp->payload_len +
10729 rdev->wiphy.wowlan_config->tcp->wake_len +
10730 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10731 }
10732
10733 msg = nlmsg_new(size, GFP_KERNEL);
10734 if (!msg)
10735 return -ENOMEM;
10736
10737 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10738 NL80211_CMD_GET_WOWLAN);
10739 if (!hdr)
10740 goto nla_put_failure;
10741
10742 if (rdev->wiphy.wowlan_config) {
10743 struct nlattr *nl_wowlan;
10744
10745 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10746 if (!nl_wowlan)
10747 goto nla_put_failure;
10748
10749 if ((rdev->wiphy.wowlan_config->any &&
10750 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10751 (rdev->wiphy.wowlan_config->disconnect &&
10752 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10753 (rdev->wiphy.wowlan_config->magic_pkt &&
10754 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10755 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10756 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10757 (rdev->wiphy.wowlan_config->eap_identity_req &&
10758 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10759 (rdev->wiphy.wowlan_config->four_way_handshake &&
10760 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10761 (rdev->wiphy.wowlan_config->rfkill_release &&
10762 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10763 goto nla_put_failure;
10764
10765 if (nl80211_send_wowlan_patterns(msg, rdev))
10766 goto nla_put_failure;
10767
10768 if (nl80211_send_wowlan_tcp(msg,
10769 rdev->wiphy.wowlan_config->tcp))
10770 goto nla_put_failure;
10771
10772 if (nl80211_send_wowlan_nd(
10773 msg,
10774 rdev->wiphy.wowlan_config->nd_config))
10775 goto nla_put_failure;
10776
10777 nla_nest_end(msg, nl_wowlan);
10778 }
10779
10780 genlmsg_end(msg, hdr);
10781 return genlmsg_reply(msg, info);
10782
10783 nla_put_failure:
10784 nlmsg_free(msg);
10785 return -ENOBUFS;
10786 }
10787
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)10788 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10789 struct nlattr *attr,
10790 struct cfg80211_wowlan *trig)
10791 {
10792 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10793 struct cfg80211_wowlan_tcp *cfg;
10794 struct nl80211_wowlan_tcp_data_token *tok = NULL;
10795 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10796 u32 size;
10797 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10798 int err, port;
10799
10800 if (!rdev->wiphy.wowlan->tcp)
10801 return -EINVAL;
10802
10803 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10804 nl80211_wowlan_tcp_policy, NULL);
10805 if (err)
10806 return err;
10807
10808 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10809 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10810 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10811 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10812 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10813 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10814 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10815 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10816 return -EINVAL;
10817
10818 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10819 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10820 return -EINVAL;
10821
10822 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10823 rdev->wiphy.wowlan->tcp->data_interval_max ||
10824 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10825 return -EINVAL;
10826
10827 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10828 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10829 return -EINVAL;
10830
10831 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10832 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10833 return -EINVAL;
10834
10835 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10836 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10837
10838 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10839 tokens_size = tokln - sizeof(*tok);
10840
10841 if (!tok->len || tokens_size % tok->len)
10842 return -EINVAL;
10843 if (!rdev->wiphy.wowlan->tcp->tok)
10844 return -EINVAL;
10845 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10846 return -EINVAL;
10847 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10848 return -EINVAL;
10849 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10850 return -EINVAL;
10851 if (tok->offset + tok->len > data_size)
10852 return -EINVAL;
10853 }
10854
10855 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10856 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10857 if (!rdev->wiphy.wowlan->tcp->seq)
10858 return -EINVAL;
10859 if (seq->len == 0 || seq->len > 4)
10860 return -EINVAL;
10861 if (seq->len + seq->offset > data_size)
10862 return -EINVAL;
10863 }
10864
10865 size = sizeof(*cfg);
10866 size += data_size;
10867 size += wake_size + wake_mask_size;
10868 size += tokens_size;
10869
10870 cfg = kzalloc(size, GFP_KERNEL);
10871 if (!cfg)
10872 return -ENOMEM;
10873 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10874 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10875 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10876 ETH_ALEN);
10877 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10878 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10879 else
10880 port = 0;
10881 #ifdef CONFIG_INET
10882 /* allocate a socket and port for it and use it */
10883 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10884 IPPROTO_TCP, &cfg->sock, 1);
10885 if (err) {
10886 kfree(cfg);
10887 return err;
10888 }
10889 if (inet_csk_get_port(cfg->sock->sk, port)) {
10890 sock_release(cfg->sock);
10891 kfree(cfg);
10892 return -EADDRINUSE;
10893 }
10894 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10895 #else
10896 if (!port) {
10897 kfree(cfg);
10898 return -EINVAL;
10899 }
10900 cfg->src_port = port;
10901 #endif
10902
10903 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10904 cfg->payload_len = data_size;
10905 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10906 memcpy((void *)cfg->payload,
10907 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10908 data_size);
10909 if (seq)
10910 cfg->payload_seq = *seq;
10911 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10912 cfg->wake_len = wake_size;
10913 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10914 memcpy((void *)cfg->wake_data,
10915 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10916 wake_size);
10917 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10918 data_size + wake_size;
10919 memcpy((void *)cfg->wake_mask,
10920 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10921 wake_mask_size);
10922 if (tok) {
10923 cfg->tokens_size = tokens_size;
10924 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10925 }
10926
10927 trig->tcp = cfg;
10928
10929 return 0;
10930 }
10931
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)10932 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10933 const struct wiphy_wowlan_support *wowlan,
10934 struct nlattr *attr,
10935 struct cfg80211_wowlan *trig)
10936 {
10937 struct nlattr **tb;
10938 int err;
10939
10940 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
10941 if (!tb)
10942 return -ENOMEM;
10943
10944 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10945 err = -EOPNOTSUPP;
10946 goto out;
10947 }
10948
10949 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10950 NULL);
10951 if (err)
10952 goto out;
10953
10954 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10955 wowlan->max_nd_match_sets);
10956 err = PTR_ERR_OR_ZERO(trig->nd_config);
10957 if (err)
10958 trig->nd_config = NULL;
10959
10960 out:
10961 kfree(tb);
10962 return err;
10963 }
10964
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)10965 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10966 {
10967 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10968 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10969 struct cfg80211_wowlan new_triggers = {};
10970 struct cfg80211_wowlan *ntrig;
10971 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10972 int err, i;
10973 bool prev_enabled = rdev->wiphy.wowlan_config;
10974 bool regular = false;
10975
10976 if (!wowlan)
10977 return -EOPNOTSUPP;
10978
10979 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10980 cfg80211_rdev_free_wowlan(rdev);
10981 rdev->wiphy.wowlan_config = NULL;
10982 goto set_wakeup;
10983 }
10984
10985 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10986 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10987 nl80211_wowlan_policy, info->extack);
10988 if (err)
10989 return err;
10990
10991 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10992 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10993 return -EINVAL;
10994 new_triggers.any = true;
10995 }
10996
10997 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10998 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10999 return -EINVAL;
11000 new_triggers.disconnect = true;
11001 regular = true;
11002 }
11003
11004 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11005 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11006 return -EINVAL;
11007 new_triggers.magic_pkt = true;
11008 regular = true;
11009 }
11010
11011 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11012 return -EINVAL;
11013
11014 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11015 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11016 return -EINVAL;
11017 new_triggers.gtk_rekey_failure = true;
11018 regular = true;
11019 }
11020
11021 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11022 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11023 return -EINVAL;
11024 new_triggers.eap_identity_req = true;
11025 regular = true;
11026 }
11027
11028 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11029 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11030 return -EINVAL;
11031 new_triggers.four_way_handshake = true;
11032 regular = true;
11033 }
11034
11035 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11036 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11037 return -EINVAL;
11038 new_triggers.rfkill_release = true;
11039 regular = true;
11040 }
11041
11042 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11043 struct nlattr *pat;
11044 int n_patterns = 0;
11045 int rem, pat_len, mask_len, pkt_offset;
11046 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11047
11048 regular = true;
11049
11050 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11051 rem)
11052 n_patterns++;
11053 if (n_patterns > wowlan->n_patterns)
11054 return -EINVAL;
11055
11056 new_triggers.patterns = kcalloc(n_patterns,
11057 sizeof(new_triggers.patterns[0]),
11058 GFP_KERNEL);
11059 if (!new_triggers.patterns)
11060 return -ENOMEM;
11061
11062 new_triggers.n_patterns = n_patterns;
11063 i = 0;
11064
11065 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11066 rem) {
11067 u8 *mask_pat;
11068
11069 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11070 nl80211_packet_pattern_policy,
11071 info->extack);
11072 if (err)
11073 goto error;
11074
11075 err = -EINVAL;
11076 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11077 !pat_tb[NL80211_PKTPAT_PATTERN])
11078 goto error;
11079 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11080 mask_len = DIV_ROUND_UP(pat_len, 8);
11081 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11082 goto error;
11083 if (pat_len > wowlan->pattern_max_len ||
11084 pat_len < wowlan->pattern_min_len)
11085 goto error;
11086
11087 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11088 pkt_offset = 0;
11089 else
11090 pkt_offset = nla_get_u32(
11091 pat_tb[NL80211_PKTPAT_OFFSET]);
11092 if (pkt_offset > wowlan->max_pkt_offset)
11093 goto error;
11094 new_triggers.patterns[i].pkt_offset = pkt_offset;
11095
11096 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11097 if (!mask_pat) {
11098 err = -ENOMEM;
11099 goto error;
11100 }
11101 new_triggers.patterns[i].mask = mask_pat;
11102 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11103 mask_len);
11104 mask_pat += mask_len;
11105 new_triggers.patterns[i].pattern = mask_pat;
11106 new_triggers.patterns[i].pattern_len = pat_len;
11107 memcpy(mask_pat,
11108 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11109 pat_len);
11110 i++;
11111 }
11112 }
11113
11114 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11115 regular = true;
11116 err = nl80211_parse_wowlan_tcp(
11117 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11118 &new_triggers);
11119 if (err)
11120 goto error;
11121 }
11122
11123 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11124 regular = true;
11125 err = nl80211_parse_wowlan_nd(
11126 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11127 &new_triggers);
11128 if (err)
11129 goto error;
11130 }
11131
11132 /* The 'any' trigger means the device continues operating more or less
11133 * as in its normal operation mode and wakes up the host on most of the
11134 * normal interrupts (like packet RX, ...)
11135 * It therefore makes little sense to combine with the more constrained
11136 * wakeup trigger modes.
11137 */
11138 if (new_triggers.any && regular) {
11139 err = -EINVAL;
11140 goto error;
11141 }
11142
11143 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11144 if (!ntrig) {
11145 err = -ENOMEM;
11146 goto error;
11147 }
11148 cfg80211_rdev_free_wowlan(rdev);
11149 rdev->wiphy.wowlan_config = ntrig;
11150
11151 set_wakeup:
11152 if (rdev->ops->set_wakeup &&
11153 prev_enabled != !!rdev->wiphy.wowlan_config)
11154 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11155
11156 return 0;
11157 error:
11158 for (i = 0; i < new_triggers.n_patterns; i++)
11159 kfree(new_triggers.patterns[i].mask);
11160 kfree(new_triggers.patterns);
11161 if (new_triggers.tcp && new_triggers.tcp->sock)
11162 sock_release(new_triggers.tcp->sock);
11163 kfree(new_triggers.tcp);
11164 kfree(new_triggers.nd_config);
11165 return err;
11166 }
11167 #endif
11168
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)11169 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11170 struct cfg80211_registered_device *rdev)
11171 {
11172 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11173 int i, j, pat_len;
11174 struct cfg80211_coalesce_rules *rule;
11175
11176 if (!rdev->coalesce->n_rules)
11177 return 0;
11178
11179 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11180 if (!nl_rules)
11181 return -ENOBUFS;
11182
11183 for (i = 0; i < rdev->coalesce->n_rules; i++) {
11184 nl_rule = nla_nest_start(msg, i + 1);
11185 if (!nl_rule)
11186 return -ENOBUFS;
11187
11188 rule = &rdev->coalesce->rules[i];
11189 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11190 rule->delay))
11191 return -ENOBUFS;
11192
11193 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11194 rule->condition))
11195 return -ENOBUFS;
11196
11197 nl_pats = nla_nest_start(msg,
11198 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11199 if (!nl_pats)
11200 return -ENOBUFS;
11201
11202 for (j = 0; j < rule->n_patterns; j++) {
11203 nl_pat = nla_nest_start(msg, j + 1);
11204 if (!nl_pat)
11205 return -ENOBUFS;
11206 pat_len = rule->patterns[j].pattern_len;
11207 if (nla_put(msg, NL80211_PKTPAT_MASK,
11208 DIV_ROUND_UP(pat_len, 8),
11209 rule->patterns[j].mask) ||
11210 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11211 rule->patterns[j].pattern) ||
11212 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11213 rule->patterns[j].pkt_offset))
11214 return -ENOBUFS;
11215 nla_nest_end(msg, nl_pat);
11216 }
11217 nla_nest_end(msg, nl_pats);
11218 nla_nest_end(msg, nl_rule);
11219 }
11220 nla_nest_end(msg, nl_rules);
11221
11222 return 0;
11223 }
11224
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)11225 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11226 {
11227 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11228 struct sk_buff *msg;
11229 void *hdr;
11230
11231 if (!rdev->wiphy.coalesce)
11232 return -EOPNOTSUPP;
11233
11234 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11235 if (!msg)
11236 return -ENOMEM;
11237
11238 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11239 NL80211_CMD_GET_COALESCE);
11240 if (!hdr)
11241 goto nla_put_failure;
11242
11243 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11244 goto nla_put_failure;
11245
11246 genlmsg_end(msg, hdr);
11247 return genlmsg_reply(msg, info);
11248
11249 nla_put_failure:
11250 nlmsg_free(msg);
11251 return -ENOBUFS;
11252 }
11253
cfg80211_rdev_free_coalesce(struct cfg80211_registered_device * rdev)11254 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11255 {
11256 struct cfg80211_coalesce *coalesce = rdev->coalesce;
11257 int i, j;
11258 struct cfg80211_coalesce_rules *rule;
11259
11260 if (!coalesce)
11261 return;
11262
11263 for (i = 0; i < coalesce->n_rules; i++) {
11264 rule = &coalesce->rules[i];
11265 for (j = 0; j < rule->n_patterns; j++)
11266 kfree(rule->patterns[j].mask);
11267 kfree(rule->patterns);
11268 }
11269 kfree(coalesce->rules);
11270 kfree(coalesce);
11271 rdev->coalesce = NULL;
11272 }
11273
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)11274 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11275 struct nlattr *rule,
11276 struct cfg80211_coalesce_rules *new_rule)
11277 {
11278 int err, i;
11279 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11280 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11281 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11282 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11283
11284 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11285 nl80211_coalesce_policy, NULL);
11286 if (err)
11287 return err;
11288
11289 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11290 new_rule->delay =
11291 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11292 if (new_rule->delay > coalesce->max_delay)
11293 return -EINVAL;
11294
11295 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11296 new_rule->condition =
11297 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11298 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
11299 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
11300 return -EINVAL;
11301
11302 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11303 return -EINVAL;
11304
11305 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11306 rem)
11307 n_patterns++;
11308 if (n_patterns > coalesce->n_patterns)
11309 return -EINVAL;
11310
11311 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11312 GFP_KERNEL);
11313 if (!new_rule->patterns)
11314 return -ENOMEM;
11315
11316 new_rule->n_patterns = n_patterns;
11317 i = 0;
11318
11319 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11320 rem) {
11321 u8 *mask_pat;
11322
11323 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11324 nl80211_packet_pattern_policy, NULL);
11325 if (err)
11326 return err;
11327
11328 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11329 !pat_tb[NL80211_PKTPAT_PATTERN])
11330 return -EINVAL;
11331 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11332 mask_len = DIV_ROUND_UP(pat_len, 8);
11333 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11334 return -EINVAL;
11335 if (pat_len > coalesce->pattern_max_len ||
11336 pat_len < coalesce->pattern_min_len)
11337 return -EINVAL;
11338
11339 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11340 pkt_offset = 0;
11341 else
11342 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11343 if (pkt_offset > coalesce->max_pkt_offset)
11344 return -EINVAL;
11345 new_rule->patterns[i].pkt_offset = pkt_offset;
11346
11347 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11348 if (!mask_pat)
11349 return -ENOMEM;
11350
11351 new_rule->patterns[i].mask = mask_pat;
11352 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11353 mask_len);
11354
11355 mask_pat += mask_len;
11356 new_rule->patterns[i].pattern = mask_pat;
11357 new_rule->patterns[i].pattern_len = pat_len;
11358 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11359 pat_len);
11360 i++;
11361 }
11362
11363 return 0;
11364 }
11365
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)11366 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11367 {
11368 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11369 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11370 struct cfg80211_coalesce new_coalesce = {};
11371 struct cfg80211_coalesce *n_coalesce;
11372 int err, rem_rule, n_rules = 0, i, j;
11373 struct nlattr *rule;
11374 struct cfg80211_coalesce_rules *tmp_rule;
11375
11376 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11377 return -EOPNOTSUPP;
11378
11379 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11380 cfg80211_rdev_free_coalesce(rdev);
11381 rdev_set_coalesce(rdev, NULL);
11382 return 0;
11383 }
11384
11385 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11386 rem_rule)
11387 n_rules++;
11388 if (n_rules > coalesce->n_rules)
11389 return -EINVAL;
11390
11391 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11392 GFP_KERNEL);
11393 if (!new_coalesce.rules)
11394 return -ENOMEM;
11395
11396 new_coalesce.n_rules = n_rules;
11397 i = 0;
11398
11399 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11400 rem_rule) {
11401 err = nl80211_parse_coalesce_rule(rdev, rule,
11402 &new_coalesce.rules[i]);
11403 if (err)
11404 goto error;
11405
11406 i++;
11407 }
11408
11409 err = rdev_set_coalesce(rdev, &new_coalesce);
11410 if (err)
11411 goto error;
11412
11413 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11414 if (!n_coalesce) {
11415 err = -ENOMEM;
11416 goto error;
11417 }
11418 cfg80211_rdev_free_coalesce(rdev);
11419 rdev->coalesce = n_coalesce;
11420
11421 return 0;
11422 error:
11423 for (i = 0; i < new_coalesce.n_rules; i++) {
11424 tmp_rule = &new_coalesce.rules[i];
11425 for (j = 0; j < tmp_rule->n_patterns; j++)
11426 kfree(tmp_rule->patterns[j].mask);
11427 kfree(tmp_rule->patterns);
11428 }
11429 kfree(new_coalesce.rules);
11430
11431 return err;
11432 }
11433
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)11434 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11435 {
11436 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11437 struct net_device *dev = info->user_ptr[1];
11438 struct wireless_dev *wdev = dev->ieee80211_ptr;
11439 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11440 struct cfg80211_gtk_rekey_data rekey_data;
11441 int err;
11442
11443 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11444 return -EINVAL;
11445
11446 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11447 info->attrs[NL80211_ATTR_REKEY_DATA],
11448 nl80211_rekey_policy, info->extack);
11449 if (err)
11450 return err;
11451
11452 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11453 !tb[NL80211_REKEY_DATA_KCK])
11454 return -EINVAL;
11455 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11456 return -ERANGE;
11457 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11458 return -ERANGE;
11459 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11460 return -ERANGE;
11461
11462 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11463 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11464 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11465
11466 wdev_lock(wdev);
11467 if (!wdev->current_bss) {
11468 err = -ENOTCONN;
11469 goto out;
11470 }
11471
11472 if (!rdev->ops->set_rekey_data) {
11473 err = -EOPNOTSUPP;
11474 goto out;
11475 }
11476
11477 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11478 out:
11479 wdev_unlock(wdev);
11480 return err;
11481 }
11482
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)11483 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11484 struct genl_info *info)
11485 {
11486 struct net_device *dev = info->user_ptr[1];
11487 struct wireless_dev *wdev = dev->ieee80211_ptr;
11488
11489 if (wdev->iftype != NL80211_IFTYPE_AP &&
11490 wdev->iftype != NL80211_IFTYPE_P2P_GO)
11491 return -EINVAL;
11492
11493 if (wdev->ap_unexpected_nlportid)
11494 return -EBUSY;
11495
11496 wdev->ap_unexpected_nlportid = info->snd_portid;
11497 return 0;
11498 }
11499
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)11500 static int nl80211_probe_client(struct sk_buff *skb,
11501 struct genl_info *info)
11502 {
11503 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11504 struct net_device *dev = info->user_ptr[1];
11505 struct wireless_dev *wdev = dev->ieee80211_ptr;
11506 struct sk_buff *msg;
11507 void *hdr;
11508 const u8 *addr;
11509 u64 cookie;
11510 int err;
11511
11512 if (wdev->iftype != NL80211_IFTYPE_AP &&
11513 wdev->iftype != NL80211_IFTYPE_P2P_GO)
11514 return -EOPNOTSUPP;
11515
11516 if (!info->attrs[NL80211_ATTR_MAC])
11517 return -EINVAL;
11518
11519 if (!rdev->ops->probe_client)
11520 return -EOPNOTSUPP;
11521
11522 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11523 if (!msg)
11524 return -ENOMEM;
11525
11526 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11527 NL80211_CMD_PROBE_CLIENT);
11528 if (!hdr) {
11529 err = -ENOBUFS;
11530 goto free_msg;
11531 }
11532
11533 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11534
11535 err = rdev_probe_client(rdev, dev, addr, &cookie);
11536 if (err)
11537 goto free_msg;
11538
11539 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11540 NL80211_ATTR_PAD))
11541 goto nla_put_failure;
11542
11543 genlmsg_end(msg, hdr);
11544
11545 return genlmsg_reply(msg, info);
11546
11547 nla_put_failure:
11548 err = -ENOBUFS;
11549 free_msg:
11550 nlmsg_free(msg);
11551 return err;
11552 }
11553
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)11554 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11555 {
11556 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11557 struct cfg80211_beacon_registration *reg, *nreg;
11558 int rv;
11559
11560 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11561 return -EOPNOTSUPP;
11562
11563 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11564 if (!nreg)
11565 return -ENOMEM;
11566
11567 /* First, check if already registered. */
11568 spin_lock_bh(&rdev->beacon_registrations_lock);
11569 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11570 if (reg->nlportid == info->snd_portid) {
11571 rv = -EALREADY;
11572 goto out_err;
11573 }
11574 }
11575 /* Add it to the list */
11576 nreg->nlportid = info->snd_portid;
11577 list_add(&nreg->list, &rdev->beacon_registrations);
11578
11579 spin_unlock_bh(&rdev->beacon_registrations_lock);
11580
11581 return 0;
11582 out_err:
11583 spin_unlock_bh(&rdev->beacon_registrations_lock);
11584 kfree(nreg);
11585 return rv;
11586 }
11587
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)11588 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11589 {
11590 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11591 struct wireless_dev *wdev = info->user_ptr[1];
11592 int err;
11593
11594 if (!rdev->ops->start_p2p_device)
11595 return -EOPNOTSUPP;
11596
11597 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11598 return -EOPNOTSUPP;
11599
11600 if (wdev_running(wdev))
11601 return 0;
11602
11603 if (rfkill_blocked(rdev->rfkill))
11604 return -ERFKILL;
11605
11606 err = rdev_start_p2p_device(rdev, wdev);
11607 if (err)
11608 return err;
11609
11610 wdev->is_running = true;
11611 rdev->opencount++;
11612
11613 return 0;
11614 }
11615
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)11616 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11617 {
11618 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11619 struct wireless_dev *wdev = info->user_ptr[1];
11620
11621 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11622 return -EOPNOTSUPP;
11623
11624 if (!rdev->ops->stop_p2p_device)
11625 return -EOPNOTSUPP;
11626
11627 cfg80211_stop_p2p_device(rdev, wdev);
11628
11629 return 0;
11630 }
11631
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)11632 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11633 {
11634 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11635 struct wireless_dev *wdev = info->user_ptr[1];
11636 struct cfg80211_nan_conf conf = {};
11637 int err;
11638
11639 if (wdev->iftype != NL80211_IFTYPE_NAN)
11640 return -EOPNOTSUPP;
11641
11642 if (wdev_running(wdev))
11643 return -EEXIST;
11644
11645 if (rfkill_blocked(rdev->rfkill))
11646 return -ERFKILL;
11647
11648 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11649 return -EINVAL;
11650
11651 conf.master_pref =
11652 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11653 if (!conf.master_pref)
11654 return -EINVAL;
11655
11656 if (info->attrs[NL80211_ATTR_BANDS]) {
11657 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11658
11659 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11660 return -EOPNOTSUPP;
11661
11662 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11663 return -EINVAL;
11664
11665 conf.bands = bands;
11666 }
11667
11668 err = rdev_start_nan(rdev, wdev, &conf);
11669 if (err)
11670 return err;
11671
11672 wdev->is_running = true;
11673 rdev->opencount++;
11674
11675 return 0;
11676 }
11677
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)11678 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11679 {
11680 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11681 struct wireless_dev *wdev = info->user_ptr[1];
11682
11683 if (wdev->iftype != NL80211_IFTYPE_NAN)
11684 return -EOPNOTSUPP;
11685
11686 cfg80211_stop_nan(rdev, wdev);
11687
11688 return 0;
11689 }
11690
validate_nan_filter(struct nlattr * filter_attr)11691 static int validate_nan_filter(struct nlattr *filter_attr)
11692 {
11693 struct nlattr *attr;
11694 int len = 0, n_entries = 0, rem;
11695
11696 nla_for_each_nested(attr, filter_attr, rem) {
11697 len += nla_len(attr);
11698 n_entries++;
11699 }
11700
11701 if (len >= U8_MAX)
11702 return -EINVAL;
11703
11704 return n_entries;
11705 }
11706
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)11707 static int handle_nan_filter(struct nlattr *attr_filter,
11708 struct cfg80211_nan_func *func,
11709 bool tx)
11710 {
11711 struct nlattr *attr;
11712 int n_entries, rem, i;
11713 struct cfg80211_nan_func_filter *filter;
11714
11715 n_entries = validate_nan_filter(attr_filter);
11716 if (n_entries < 0)
11717 return n_entries;
11718
11719 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11720
11721 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11722 if (!filter)
11723 return -ENOMEM;
11724
11725 i = 0;
11726 nla_for_each_nested(attr, attr_filter, rem) {
11727 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11728 filter[i].len = nla_len(attr);
11729 i++;
11730 }
11731 if (tx) {
11732 func->num_tx_filters = n_entries;
11733 func->tx_filters = filter;
11734 } else {
11735 func->num_rx_filters = n_entries;
11736 func->rx_filters = filter;
11737 }
11738
11739 return 0;
11740 }
11741
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)11742 static int nl80211_nan_add_func(struct sk_buff *skb,
11743 struct genl_info *info)
11744 {
11745 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11746 struct wireless_dev *wdev = info->user_ptr[1];
11747 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11748 struct cfg80211_nan_func *func;
11749 struct sk_buff *msg = NULL;
11750 void *hdr = NULL;
11751 int err = 0;
11752
11753 if (wdev->iftype != NL80211_IFTYPE_NAN)
11754 return -EOPNOTSUPP;
11755
11756 if (!wdev_running(wdev))
11757 return -ENOTCONN;
11758
11759 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11760 return -EINVAL;
11761
11762 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11763 info->attrs[NL80211_ATTR_NAN_FUNC],
11764 nl80211_nan_func_policy, info->extack);
11765 if (err)
11766 return err;
11767
11768 func = kzalloc(sizeof(*func), GFP_KERNEL);
11769 if (!func)
11770 return -ENOMEM;
11771
11772 func->cookie = wdev->wiphy->cookie_counter++;
11773
11774 if (!tb[NL80211_NAN_FUNC_TYPE] ||
11775 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11776 err = -EINVAL;
11777 goto out;
11778 }
11779
11780
11781 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11782
11783 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11784 err = -EINVAL;
11785 goto out;
11786 }
11787
11788 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11789 sizeof(func->service_id));
11790
11791 func->close_range =
11792 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11793
11794 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11795 func->serv_spec_info_len =
11796 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11797 func->serv_spec_info =
11798 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11799 func->serv_spec_info_len,
11800 GFP_KERNEL);
11801 if (!func->serv_spec_info) {
11802 err = -ENOMEM;
11803 goto out;
11804 }
11805 }
11806
11807 if (tb[NL80211_NAN_FUNC_TTL])
11808 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11809
11810 switch (func->type) {
11811 case NL80211_NAN_FUNC_PUBLISH:
11812 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11813 err = -EINVAL;
11814 goto out;
11815 }
11816
11817 func->publish_type =
11818 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11819 func->publish_bcast =
11820 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11821
11822 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11823 func->publish_bcast) {
11824 err = -EINVAL;
11825 goto out;
11826 }
11827 break;
11828 case NL80211_NAN_FUNC_SUBSCRIBE:
11829 func->subscribe_active =
11830 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11831 break;
11832 case NL80211_NAN_FUNC_FOLLOW_UP:
11833 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11834 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11835 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11836 err = -EINVAL;
11837 goto out;
11838 }
11839
11840 func->followup_id =
11841 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11842 func->followup_reqid =
11843 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11844 memcpy(func->followup_dest.addr,
11845 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11846 sizeof(func->followup_dest.addr));
11847 if (func->ttl) {
11848 err = -EINVAL;
11849 goto out;
11850 }
11851 break;
11852 default:
11853 err = -EINVAL;
11854 goto out;
11855 }
11856
11857 if (tb[NL80211_NAN_FUNC_SRF]) {
11858 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11859
11860 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11861 tb[NL80211_NAN_FUNC_SRF],
11862 nl80211_nan_srf_policy, info->extack);
11863 if (err)
11864 goto out;
11865
11866 func->srf_include =
11867 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11868
11869 if (srf_tb[NL80211_NAN_SRF_BF]) {
11870 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11871 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11872 err = -EINVAL;
11873 goto out;
11874 }
11875
11876 func->srf_bf_len =
11877 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11878 func->srf_bf =
11879 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11880 func->srf_bf_len, GFP_KERNEL);
11881 if (!func->srf_bf) {
11882 err = -ENOMEM;
11883 goto out;
11884 }
11885
11886 func->srf_bf_idx =
11887 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11888 } else {
11889 struct nlattr *attr, *mac_attr =
11890 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11891 int n_entries, rem, i = 0;
11892
11893 if (!mac_attr) {
11894 err = -EINVAL;
11895 goto out;
11896 }
11897
11898 n_entries = validate_acl_mac_addrs(mac_attr);
11899 if (n_entries <= 0) {
11900 err = -EINVAL;
11901 goto out;
11902 }
11903
11904 func->srf_num_macs = n_entries;
11905 func->srf_macs =
11906 kcalloc(n_entries, sizeof(*func->srf_macs),
11907 GFP_KERNEL);
11908 if (!func->srf_macs) {
11909 err = -ENOMEM;
11910 goto out;
11911 }
11912
11913 nla_for_each_nested(attr, mac_attr, rem)
11914 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11915 sizeof(*func->srf_macs));
11916 }
11917 }
11918
11919 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11920 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11921 func, true);
11922 if (err)
11923 goto out;
11924 }
11925
11926 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11927 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11928 func, false);
11929 if (err)
11930 goto out;
11931 }
11932
11933 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11934 if (!msg) {
11935 err = -ENOMEM;
11936 goto out;
11937 }
11938
11939 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11940 NL80211_CMD_ADD_NAN_FUNCTION);
11941 /* This can't really happen - we just allocated 4KB */
11942 if (WARN_ON(!hdr)) {
11943 err = -ENOMEM;
11944 goto out;
11945 }
11946
11947 err = rdev_add_nan_func(rdev, wdev, func);
11948 out:
11949 if (err < 0) {
11950 cfg80211_free_nan_func(func);
11951 nlmsg_free(msg);
11952 return err;
11953 }
11954
11955 /* propagate the instance id and cookie to userspace */
11956 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11957 NL80211_ATTR_PAD))
11958 goto nla_put_failure;
11959
11960 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11961 if (!func_attr)
11962 goto nla_put_failure;
11963
11964 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11965 func->instance_id))
11966 goto nla_put_failure;
11967
11968 nla_nest_end(msg, func_attr);
11969
11970 genlmsg_end(msg, hdr);
11971 return genlmsg_reply(msg, info);
11972
11973 nla_put_failure:
11974 nlmsg_free(msg);
11975 return -ENOBUFS;
11976 }
11977
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)11978 static int nl80211_nan_del_func(struct sk_buff *skb,
11979 struct genl_info *info)
11980 {
11981 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11982 struct wireless_dev *wdev = info->user_ptr[1];
11983 u64 cookie;
11984
11985 if (wdev->iftype != NL80211_IFTYPE_NAN)
11986 return -EOPNOTSUPP;
11987
11988 if (!wdev_running(wdev))
11989 return -ENOTCONN;
11990
11991 if (!info->attrs[NL80211_ATTR_COOKIE])
11992 return -EINVAL;
11993
11994 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11995
11996 rdev_del_nan_func(rdev, wdev, cookie);
11997
11998 return 0;
11999 }
12000
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)12001 static int nl80211_nan_change_config(struct sk_buff *skb,
12002 struct genl_info *info)
12003 {
12004 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12005 struct wireless_dev *wdev = info->user_ptr[1];
12006 struct cfg80211_nan_conf conf = {};
12007 u32 changed = 0;
12008
12009 if (wdev->iftype != NL80211_IFTYPE_NAN)
12010 return -EOPNOTSUPP;
12011
12012 if (!wdev_running(wdev))
12013 return -ENOTCONN;
12014
12015 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12016 conf.master_pref =
12017 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12018 if (conf.master_pref <= 1 || conf.master_pref == 255)
12019 return -EINVAL;
12020
12021 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12022 }
12023
12024 if (info->attrs[NL80211_ATTR_BANDS]) {
12025 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12026
12027 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12028 return -EOPNOTSUPP;
12029
12030 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12031 return -EINVAL;
12032
12033 conf.bands = bands;
12034 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12035 }
12036
12037 if (!changed)
12038 return -EINVAL;
12039
12040 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12041 }
12042
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)12043 void cfg80211_nan_match(struct wireless_dev *wdev,
12044 struct cfg80211_nan_match_params *match, gfp_t gfp)
12045 {
12046 struct wiphy *wiphy = wdev->wiphy;
12047 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12048 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12049 struct sk_buff *msg;
12050 void *hdr;
12051
12052 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12053 return;
12054
12055 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12056 if (!msg)
12057 return;
12058
12059 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12060 if (!hdr) {
12061 nlmsg_free(msg);
12062 return;
12063 }
12064
12065 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12066 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12067 wdev->netdev->ifindex)) ||
12068 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12069 NL80211_ATTR_PAD))
12070 goto nla_put_failure;
12071
12072 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12073 NL80211_ATTR_PAD) ||
12074 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12075 goto nla_put_failure;
12076
12077 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12078 if (!match_attr)
12079 goto nla_put_failure;
12080
12081 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12082 if (!local_func_attr)
12083 goto nla_put_failure;
12084
12085 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12086 goto nla_put_failure;
12087
12088 nla_nest_end(msg, local_func_attr);
12089
12090 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12091 if (!peer_func_attr)
12092 goto nla_put_failure;
12093
12094 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12095 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12096 goto nla_put_failure;
12097
12098 if (match->info && match->info_len &&
12099 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12100 match->info))
12101 goto nla_put_failure;
12102
12103 nla_nest_end(msg, peer_func_attr);
12104 nla_nest_end(msg, match_attr);
12105 genlmsg_end(msg, hdr);
12106
12107 if (!wdev->owner_nlportid)
12108 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12109 msg, 0, NL80211_MCGRP_NAN, gfp);
12110 else
12111 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12112 wdev->owner_nlportid);
12113
12114 return;
12115
12116 nla_put_failure:
12117 nlmsg_free(msg);
12118 }
12119 EXPORT_SYMBOL(cfg80211_nan_match);
12120
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)12121 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12122 u8 inst_id,
12123 enum nl80211_nan_func_term_reason reason,
12124 u64 cookie, gfp_t gfp)
12125 {
12126 struct wiphy *wiphy = wdev->wiphy;
12127 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12128 struct sk_buff *msg;
12129 struct nlattr *func_attr;
12130 void *hdr;
12131
12132 if (WARN_ON(!inst_id))
12133 return;
12134
12135 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12136 if (!msg)
12137 return;
12138
12139 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12140 if (!hdr) {
12141 nlmsg_free(msg);
12142 return;
12143 }
12144
12145 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12146 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12147 wdev->netdev->ifindex)) ||
12148 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12149 NL80211_ATTR_PAD))
12150 goto nla_put_failure;
12151
12152 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12153 NL80211_ATTR_PAD))
12154 goto nla_put_failure;
12155
12156 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12157 if (!func_attr)
12158 goto nla_put_failure;
12159
12160 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12161 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12162 goto nla_put_failure;
12163
12164 nla_nest_end(msg, func_attr);
12165 genlmsg_end(msg, hdr);
12166
12167 if (!wdev->owner_nlportid)
12168 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12169 msg, 0, NL80211_MCGRP_NAN, gfp);
12170 else
12171 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12172 wdev->owner_nlportid);
12173
12174 return;
12175
12176 nla_put_failure:
12177 nlmsg_free(msg);
12178 }
12179 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12180
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)12181 static int nl80211_get_protocol_features(struct sk_buff *skb,
12182 struct genl_info *info)
12183 {
12184 void *hdr;
12185 struct sk_buff *msg;
12186
12187 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12188 if (!msg)
12189 return -ENOMEM;
12190
12191 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12192 NL80211_CMD_GET_PROTOCOL_FEATURES);
12193 if (!hdr)
12194 goto nla_put_failure;
12195
12196 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12197 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12198 goto nla_put_failure;
12199
12200 genlmsg_end(msg, hdr);
12201 return genlmsg_reply(msg, info);
12202
12203 nla_put_failure:
12204 kfree_skb(msg);
12205 return -ENOBUFS;
12206 }
12207
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)12208 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12209 {
12210 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12211 struct cfg80211_update_ft_ies_params ft_params;
12212 struct net_device *dev = info->user_ptr[1];
12213
12214 if (!rdev->ops->update_ft_ies)
12215 return -EOPNOTSUPP;
12216
12217 if (!info->attrs[NL80211_ATTR_MDID] ||
12218 !info->attrs[NL80211_ATTR_IE] ||
12219 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
12220 return -EINVAL;
12221
12222 memset(&ft_params, 0, sizeof(ft_params));
12223 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12224 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12225 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12226
12227 return rdev_update_ft_ies(rdev, dev, &ft_params);
12228 }
12229
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)12230 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12231 struct genl_info *info)
12232 {
12233 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12234 struct wireless_dev *wdev = info->user_ptr[1];
12235 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12236 u16 duration;
12237 int ret;
12238
12239 if (!rdev->ops->crit_proto_start)
12240 return -EOPNOTSUPP;
12241
12242 if (WARN_ON(!rdev->ops->crit_proto_stop))
12243 return -EINVAL;
12244
12245 if (rdev->crit_proto_nlportid)
12246 return -EBUSY;
12247
12248 /* determine protocol if provided */
12249 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12250 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12251
12252 if (proto >= NUM_NL80211_CRIT_PROTO)
12253 return -EINVAL;
12254
12255 /* timeout must be provided */
12256 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12257 return -EINVAL;
12258
12259 duration =
12260 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12261
12262 if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12263 return -ERANGE;
12264
12265 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12266 if (!ret)
12267 rdev->crit_proto_nlportid = info->snd_portid;
12268
12269 return ret;
12270 }
12271
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)12272 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12273 struct genl_info *info)
12274 {
12275 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12276 struct wireless_dev *wdev = info->user_ptr[1];
12277
12278 if (!rdev->ops->crit_proto_stop)
12279 return -EOPNOTSUPP;
12280
12281 if (rdev->crit_proto_nlportid) {
12282 rdev->crit_proto_nlportid = 0;
12283 rdev_crit_proto_stop(rdev, wdev);
12284 }
12285 return 0;
12286 }
12287
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)12288 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12289 {
12290 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12291 struct wireless_dev *wdev =
12292 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12293 int i, err;
12294 u32 vid, subcmd;
12295
12296 if (!rdev->wiphy.vendor_commands)
12297 return -EOPNOTSUPP;
12298
12299 if (IS_ERR(wdev)) {
12300 err = PTR_ERR(wdev);
12301 if (err != -EINVAL)
12302 return err;
12303 wdev = NULL;
12304 } else if (wdev->wiphy != &rdev->wiphy) {
12305 return -EINVAL;
12306 }
12307
12308 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12309 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12310 return -EINVAL;
12311
12312 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12313 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12314 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12315 const struct wiphy_vendor_command *vcmd;
12316 void *data = NULL;
12317 int len = 0;
12318
12319 vcmd = &rdev->wiphy.vendor_commands[i];
12320
12321 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12322 continue;
12323
12324 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12325 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12326 if (!wdev)
12327 return -EINVAL;
12328 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12329 !wdev->netdev)
12330 return -EINVAL;
12331
12332 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12333 if (!wdev_running(wdev))
12334 return -ENETDOWN;
12335 }
12336
12337 if (!vcmd->doit)
12338 return -EOPNOTSUPP;
12339 } else {
12340 wdev = NULL;
12341 }
12342
12343 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12344 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12345 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12346 }
12347
12348 rdev->cur_cmd_info = info;
12349 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12350 data, len);
12351 rdev->cur_cmd_info = NULL;
12352 return err;
12353 }
12354
12355 return -EOPNOTSUPP;
12356 }
12357
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)12358 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12359 struct netlink_callback *cb,
12360 struct cfg80211_registered_device **rdev,
12361 struct wireless_dev **wdev)
12362 {
12363 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12364 u32 vid, subcmd;
12365 unsigned int i;
12366 int vcmd_idx = -1;
12367 int err;
12368 void *data = NULL;
12369 unsigned int data_len = 0;
12370
12371 if (cb->args[0]) {
12372 /* subtract the 1 again here */
12373 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12374 struct wireless_dev *tmp;
12375
12376 if (!wiphy)
12377 return -ENODEV;
12378 *rdev = wiphy_to_rdev(wiphy);
12379 *wdev = NULL;
12380
12381 if (cb->args[1]) {
12382 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12383 if (tmp->identifier == cb->args[1] - 1) {
12384 *wdev = tmp;
12385 break;
12386 }
12387 }
12388 }
12389
12390 /* keep rtnl locked in successful case */
12391 return 0;
12392 }
12393
12394 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12395 nl80211_fam.maxattr, nl80211_policy, NULL);
12396 if (err)
12397 return err;
12398
12399 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12400 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12401 return -EINVAL;
12402
12403 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12404 if (IS_ERR(*wdev))
12405 *wdev = NULL;
12406
12407 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12408 if (IS_ERR(*rdev))
12409 return PTR_ERR(*rdev);
12410
12411 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12412 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12413
12414 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12415 const struct wiphy_vendor_command *vcmd;
12416
12417 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12418
12419 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12420 continue;
12421
12422 if (!vcmd->dumpit)
12423 return -EOPNOTSUPP;
12424
12425 vcmd_idx = i;
12426 break;
12427 }
12428
12429 if (vcmd_idx < 0)
12430 return -EOPNOTSUPP;
12431
12432 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12433 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12434 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12435 }
12436
12437 /* 0 is the first index - add 1 to parse only once */
12438 cb->args[0] = (*rdev)->wiphy_idx + 1;
12439 /* add 1 to know if it was NULL */
12440 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12441 cb->args[2] = vcmd_idx;
12442 cb->args[3] = (unsigned long)data;
12443 cb->args[4] = data_len;
12444
12445 /* keep rtnl locked in successful case */
12446 return 0;
12447 }
12448
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)12449 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12450 struct netlink_callback *cb)
12451 {
12452 struct cfg80211_registered_device *rdev;
12453 struct wireless_dev *wdev;
12454 unsigned int vcmd_idx;
12455 const struct wiphy_vendor_command *vcmd;
12456 void *data;
12457 int data_len;
12458 int err;
12459 struct nlattr *vendor_data;
12460
12461 rtnl_lock();
12462 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12463 if (err)
12464 goto out;
12465
12466 vcmd_idx = cb->args[2];
12467 data = (void *)cb->args[3];
12468 data_len = cb->args[4];
12469 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12470
12471 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12472 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12473 if (!wdev) {
12474 err = -EINVAL;
12475 goto out;
12476 }
12477 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12478 !wdev->netdev) {
12479 err = -EINVAL;
12480 goto out;
12481 }
12482
12483 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12484 if (!wdev_running(wdev)) {
12485 err = -ENETDOWN;
12486 goto out;
12487 }
12488 }
12489 }
12490
12491 while (1) {
12492 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12493 cb->nlh->nlmsg_seq, NLM_F_MULTI,
12494 NL80211_CMD_VENDOR);
12495 if (!hdr)
12496 break;
12497
12498 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12499 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12500 wdev_id(wdev),
12501 NL80211_ATTR_PAD))) {
12502 genlmsg_cancel(skb, hdr);
12503 break;
12504 }
12505
12506 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12507 if (!vendor_data) {
12508 genlmsg_cancel(skb, hdr);
12509 break;
12510 }
12511
12512 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12513 (unsigned long *)&cb->args[5]);
12514 nla_nest_end(skb, vendor_data);
12515
12516 if (err == -ENOBUFS || err == -ENOENT) {
12517 genlmsg_cancel(skb, hdr);
12518 break;
12519 } else if (err) {
12520 genlmsg_cancel(skb, hdr);
12521 goto out;
12522 }
12523
12524 genlmsg_end(skb, hdr);
12525 }
12526
12527 err = skb->len;
12528 out:
12529 rtnl_unlock();
12530 return err;
12531 }
12532
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)12533 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12534 enum nl80211_commands cmd,
12535 enum nl80211_attrs attr,
12536 int approxlen)
12537 {
12538 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12539
12540 if (WARN_ON(!rdev->cur_cmd_info))
12541 return NULL;
12542
12543 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12544 rdev->cur_cmd_info->snd_portid,
12545 rdev->cur_cmd_info->snd_seq,
12546 cmd, attr, NULL, GFP_KERNEL);
12547 }
12548 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12549
cfg80211_vendor_cmd_reply(struct sk_buff * skb)12550 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12551 {
12552 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12553 void *hdr = ((void **)skb->cb)[1];
12554 struct nlattr *data = ((void **)skb->cb)[2];
12555
12556 /* clear CB data for netlink core to own from now on */
12557 memset(skb->cb, 0, sizeof(skb->cb));
12558
12559 if (WARN_ON(!rdev->cur_cmd_info)) {
12560 kfree_skb(skb);
12561 return -EINVAL;
12562 }
12563
12564 nla_nest_end(skb, data);
12565 genlmsg_end(skb, hdr);
12566 return genlmsg_reply(skb, rdev->cur_cmd_info);
12567 }
12568 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12569
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)12570 static int nl80211_set_qos_map(struct sk_buff *skb,
12571 struct genl_info *info)
12572 {
12573 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12574 struct cfg80211_qos_map *qos_map = NULL;
12575 struct net_device *dev = info->user_ptr[1];
12576 u8 *pos, len, num_des, des_len, des;
12577 int ret;
12578
12579 if (!rdev->ops->set_qos_map)
12580 return -EOPNOTSUPP;
12581
12582 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12583 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12584 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12585
12586 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12587 len > IEEE80211_QOS_MAP_LEN_MAX)
12588 return -EINVAL;
12589
12590 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12591 if (!qos_map)
12592 return -ENOMEM;
12593
12594 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12595 if (num_des) {
12596 des_len = num_des *
12597 sizeof(struct cfg80211_dscp_exception);
12598 memcpy(qos_map->dscp_exception, pos, des_len);
12599 qos_map->num_des = num_des;
12600 for (des = 0; des < num_des; des++) {
12601 if (qos_map->dscp_exception[des].up > 7) {
12602 kfree(qos_map);
12603 return -EINVAL;
12604 }
12605 }
12606 pos += des_len;
12607 }
12608 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12609 }
12610
12611 wdev_lock(dev->ieee80211_ptr);
12612 ret = nl80211_key_allowed(dev->ieee80211_ptr);
12613 if (!ret)
12614 ret = rdev_set_qos_map(rdev, dev, qos_map);
12615 wdev_unlock(dev->ieee80211_ptr);
12616
12617 kfree(qos_map);
12618 return ret;
12619 }
12620
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)12621 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12622 {
12623 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12624 struct net_device *dev = info->user_ptr[1];
12625 struct wireless_dev *wdev = dev->ieee80211_ptr;
12626 const u8 *peer;
12627 u8 tsid, up;
12628 u16 admitted_time = 0;
12629 int err;
12630
12631 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12632 return -EOPNOTSUPP;
12633
12634 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12635 !info->attrs[NL80211_ATTR_USER_PRIO])
12636 return -EINVAL;
12637
12638 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12639 if (tsid >= IEEE80211_NUM_TIDS)
12640 return -EINVAL;
12641
12642 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12643 if (up >= IEEE80211_NUM_UPS)
12644 return -EINVAL;
12645
12646 /* WMM uses TIDs 0-7 even for TSPEC */
12647 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12648 /* TODO: handle 802.11 TSPEC/admission control
12649 * need more attributes for that (e.g. BA session requirement);
12650 * change the WMM adminssion test above to allow both then
12651 */
12652 return -EINVAL;
12653 }
12654
12655 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12656
12657 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12658 admitted_time =
12659 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12660 if (!admitted_time)
12661 return -EINVAL;
12662 }
12663
12664 wdev_lock(wdev);
12665 switch (wdev->iftype) {
12666 case NL80211_IFTYPE_STATION:
12667 case NL80211_IFTYPE_P2P_CLIENT:
12668 if (wdev->current_bss)
12669 break;
12670 err = -ENOTCONN;
12671 goto out;
12672 default:
12673 err = -EOPNOTSUPP;
12674 goto out;
12675 }
12676
12677 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12678
12679 out:
12680 wdev_unlock(wdev);
12681 return err;
12682 }
12683
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)12684 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12685 {
12686 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12687 struct net_device *dev = info->user_ptr[1];
12688 struct wireless_dev *wdev = dev->ieee80211_ptr;
12689 const u8 *peer;
12690 u8 tsid;
12691 int err;
12692
12693 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12694 return -EINVAL;
12695
12696 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12697 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12698
12699 wdev_lock(wdev);
12700 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12701 wdev_unlock(wdev);
12702
12703 return err;
12704 }
12705
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)12706 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12707 struct genl_info *info)
12708 {
12709 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12710 struct net_device *dev = info->user_ptr[1];
12711 struct wireless_dev *wdev = dev->ieee80211_ptr;
12712 struct cfg80211_chan_def chandef = {};
12713 const u8 *addr;
12714 u8 oper_class;
12715 int err;
12716
12717 if (!rdev->ops->tdls_channel_switch ||
12718 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12719 return -EOPNOTSUPP;
12720
12721 switch (dev->ieee80211_ptr->iftype) {
12722 case NL80211_IFTYPE_STATION:
12723 case NL80211_IFTYPE_P2P_CLIENT:
12724 break;
12725 default:
12726 return -EOPNOTSUPP;
12727 }
12728
12729 if (!info->attrs[NL80211_ATTR_MAC] ||
12730 !info->attrs[NL80211_ATTR_OPER_CLASS])
12731 return -EINVAL;
12732
12733 err = nl80211_parse_chandef(rdev, info, &chandef);
12734 if (err)
12735 return err;
12736
12737 /*
12738 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12739 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12740 * specification is not defined for them.
12741 */
12742 if (chandef.chan->band == NL80211_BAND_2GHZ &&
12743 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12744 chandef.width != NL80211_CHAN_WIDTH_20)
12745 return -EINVAL;
12746
12747 /* we will be active on the TDLS link */
12748 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12749 wdev->iftype))
12750 return -EINVAL;
12751
12752 /* don't allow switching to DFS channels */
12753 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12754 return -EINVAL;
12755
12756 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12757 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12758
12759 wdev_lock(wdev);
12760 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12761 wdev_unlock(wdev);
12762
12763 return err;
12764 }
12765
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)12766 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12767 struct genl_info *info)
12768 {
12769 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12770 struct net_device *dev = info->user_ptr[1];
12771 struct wireless_dev *wdev = dev->ieee80211_ptr;
12772 const u8 *addr;
12773
12774 if (!rdev->ops->tdls_channel_switch ||
12775 !rdev->ops->tdls_cancel_channel_switch ||
12776 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12777 return -EOPNOTSUPP;
12778
12779 switch (dev->ieee80211_ptr->iftype) {
12780 case NL80211_IFTYPE_STATION:
12781 case NL80211_IFTYPE_P2P_CLIENT:
12782 break;
12783 default:
12784 return -EOPNOTSUPP;
12785 }
12786
12787 if (!info->attrs[NL80211_ATTR_MAC])
12788 return -EINVAL;
12789
12790 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12791
12792 wdev_lock(wdev);
12793 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12794 wdev_unlock(wdev);
12795
12796 return 0;
12797 }
12798
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)12799 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12800 struct genl_info *info)
12801 {
12802 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12803 struct net_device *dev = info->user_ptr[1];
12804 struct wireless_dev *wdev = dev->ieee80211_ptr;
12805 const struct nlattr *nla;
12806 bool enabled;
12807
12808 if (!rdev->ops->set_multicast_to_unicast)
12809 return -EOPNOTSUPP;
12810
12811 if (wdev->iftype != NL80211_IFTYPE_AP &&
12812 wdev->iftype != NL80211_IFTYPE_P2P_GO)
12813 return -EOPNOTSUPP;
12814
12815 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12816 enabled = nla_get_flag(nla);
12817
12818 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12819 }
12820
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)12821 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12822 {
12823 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12824 struct net_device *dev = info->user_ptr[1];
12825 struct wireless_dev *wdev = dev->ieee80211_ptr;
12826 struct cfg80211_pmk_conf pmk_conf = {};
12827 int ret;
12828
12829 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12830 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12831 return -EOPNOTSUPP;
12832
12833 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12834 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12835 return -EOPNOTSUPP;
12836
12837 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12838 return -EINVAL;
12839
12840 wdev_lock(wdev);
12841 if (!wdev->current_bss) {
12842 ret = -ENOTCONN;
12843 goto out;
12844 }
12845
12846 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12847 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12848 ret = -EINVAL;
12849 goto out;
12850 }
12851
12852 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12853 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12854 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12855 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12856 ret = -EINVAL;
12857 goto out;
12858 }
12859
12860 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12861 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12862
12863 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12864 ret = -EINVAL;
12865 goto out;
12866 }
12867
12868 pmk_conf.pmk_r0_name =
12869 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12870 }
12871
12872 ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12873 out:
12874 wdev_unlock(wdev);
12875 return ret;
12876 }
12877
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)12878 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12879 {
12880 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12881 struct net_device *dev = info->user_ptr[1];
12882 struct wireless_dev *wdev = dev->ieee80211_ptr;
12883 const u8 *aa;
12884 int ret;
12885
12886 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12887 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12888 return -EOPNOTSUPP;
12889
12890 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12891 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12892 return -EOPNOTSUPP;
12893
12894 if (!info->attrs[NL80211_ATTR_MAC])
12895 return -EINVAL;
12896
12897 wdev_lock(wdev);
12898 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12899 ret = rdev_del_pmk(rdev, dev, aa);
12900 wdev_unlock(wdev);
12901
12902 return ret;
12903 }
12904
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)12905 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12906 {
12907 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12908 struct net_device *dev = info->user_ptr[1];
12909 struct cfg80211_external_auth_params params;
12910
12911 if (!rdev->ops->external_auth)
12912 return -EOPNOTSUPP;
12913
12914 if (!info->attrs[NL80211_ATTR_SSID])
12915 return -EINVAL;
12916
12917 if (!info->attrs[NL80211_ATTR_BSSID])
12918 return -EINVAL;
12919
12920 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12921 return -EINVAL;
12922
12923 memset(¶ms, 0, sizeof(params));
12924
12925 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12926 if (params.ssid.ssid_len == 0 ||
12927 params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12928 return -EINVAL;
12929 memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12930 params.ssid.ssid_len);
12931
12932 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12933 ETH_ALEN);
12934
12935 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12936
12937 return rdev_external_auth(rdev, dev, ¶ms);
12938 }
12939
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)12940 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12941 {
12942 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12943 struct net_device *dev = info->user_ptr[1];
12944 struct wireless_dev *wdev = dev->ieee80211_ptr;
12945 const u8 *buf;
12946 size_t len;
12947 u8 *dest;
12948 u16 proto;
12949 bool noencrypt;
12950 int err;
12951
12952 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12953 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12954 return -EOPNOTSUPP;
12955
12956 if (!rdev->ops->tx_control_port)
12957 return -EOPNOTSUPP;
12958
12959 if (!info->attrs[NL80211_ATTR_FRAME] ||
12960 !info->attrs[NL80211_ATTR_MAC] ||
12961 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12962 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
12963 return -EINVAL;
12964 }
12965
12966 wdev_lock(wdev);
12967
12968 switch (wdev->iftype) {
12969 case NL80211_IFTYPE_AP:
12970 case NL80211_IFTYPE_P2P_GO:
12971 case NL80211_IFTYPE_MESH_POINT:
12972 break;
12973 case NL80211_IFTYPE_ADHOC:
12974 case NL80211_IFTYPE_STATION:
12975 case NL80211_IFTYPE_P2P_CLIENT:
12976 if (wdev->current_bss)
12977 break;
12978 err = -ENOTCONN;
12979 goto out;
12980 default:
12981 err = -EOPNOTSUPP;
12982 goto out;
12983 }
12984
12985 wdev_unlock(wdev);
12986
12987 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12988 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12989 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
12990 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12991 noencrypt =
12992 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
12993
12994 return rdev_tx_control_port(rdev, dev, buf, len,
12995 dest, cpu_to_be16(proto), noencrypt);
12996
12997 out:
12998 wdev_unlock(wdev);
12999 return err;
13000 }
13001
13002 #define NL80211_FLAG_NEED_WIPHY 0x01
13003 #define NL80211_FLAG_NEED_NETDEV 0x02
13004 #define NL80211_FLAG_NEED_RTNL 0x04
13005 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
13006 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
13007 NL80211_FLAG_CHECK_NETDEV_UP)
13008 #define NL80211_FLAG_NEED_WDEV 0x10
13009 /* If a netdev is associated, it must be UP, P2P must be started */
13010 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
13011 NL80211_FLAG_CHECK_NETDEV_UP)
13012 #define NL80211_FLAG_CLEAR_SKB 0x20
13013
nl80211_pre_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)13014 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13015 struct genl_info *info)
13016 {
13017 struct cfg80211_registered_device *rdev;
13018 struct wireless_dev *wdev;
13019 struct net_device *dev;
13020 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13021
13022 if (rtnl)
13023 rtnl_lock();
13024
13025 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13026 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13027 if (IS_ERR(rdev)) {
13028 if (rtnl)
13029 rtnl_unlock();
13030 return PTR_ERR(rdev);
13031 }
13032 info->user_ptr[0] = rdev;
13033 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13034 ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13035 ASSERT_RTNL();
13036
13037 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13038 info->attrs);
13039 if (IS_ERR(wdev)) {
13040 if (rtnl)
13041 rtnl_unlock();
13042 return PTR_ERR(wdev);
13043 }
13044
13045 dev = wdev->netdev;
13046 rdev = wiphy_to_rdev(wdev->wiphy);
13047
13048 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13049 if (!dev) {
13050 if (rtnl)
13051 rtnl_unlock();
13052 return -EINVAL;
13053 }
13054
13055 info->user_ptr[1] = dev;
13056 } else {
13057 info->user_ptr[1] = wdev;
13058 }
13059
13060 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13061 !wdev_running(wdev)) {
13062 if (rtnl)
13063 rtnl_unlock();
13064 return -ENETDOWN;
13065 }
13066
13067 if (dev)
13068 dev_hold(dev);
13069
13070 info->user_ptr[0] = rdev;
13071 }
13072
13073 return 0;
13074 }
13075
nl80211_post_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)13076 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13077 struct genl_info *info)
13078 {
13079 if (info->user_ptr[1]) {
13080 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13081 struct wireless_dev *wdev = info->user_ptr[1];
13082
13083 if (wdev->netdev)
13084 dev_put(wdev->netdev);
13085 } else {
13086 dev_put(info->user_ptr[1]);
13087 }
13088 }
13089
13090 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13091 rtnl_unlock();
13092
13093 /* If needed, clear the netlink message payload from the SKB
13094 * as it might contain key data that shouldn't stick around on
13095 * the heap after the SKB is freed. The netlink message header
13096 * is still needed for further processing, so leave it intact.
13097 */
13098 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13099 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13100
13101 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13102 }
13103 }
13104
13105 static const struct genl_ops nl80211_ops[] = {
13106 {
13107 .cmd = NL80211_CMD_GET_WIPHY,
13108 .doit = nl80211_get_wiphy,
13109 .dumpit = nl80211_dump_wiphy,
13110 .done = nl80211_dump_wiphy_done,
13111 .policy = nl80211_policy,
13112 /* can be retrieved by unprivileged users */
13113 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13114 NL80211_FLAG_NEED_RTNL,
13115 },
13116 {
13117 .cmd = NL80211_CMD_SET_WIPHY,
13118 .doit = nl80211_set_wiphy,
13119 .policy = nl80211_policy,
13120 .flags = GENL_UNS_ADMIN_PERM,
13121 .internal_flags = NL80211_FLAG_NEED_RTNL,
13122 },
13123 {
13124 .cmd = NL80211_CMD_GET_INTERFACE,
13125 .doit = nl80211_get_interface,
13126 .dumpit = nl80211_dump_interface,
13127 .policy = nl80211_policy,
13128 /* can be retrieved by unprivileged users */
13129 .internal_flags = NL80211_FLAG_NEED_WDEV |
13130 NL80211_FLAG_NEED_RTNL,
13131 },
13132 {
13133 .cmd = NL80211_CMD_SET_INTERFACE,
13134 .doit = nl80211_set_interface,
13135 .policy = nl80211_policy,
13136 .flags = GENL_UNS_ADMIN_PERM,
13137 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13138 NL80211_FLAG_NEED_RTNL,
13139 },
13140 {
13141 .cmd = NL80211_CMD_NEW_INTERFACE,
13142 .doit = nl80211_new_interface,
13143 .policy = nl80211_policy,
13144 .flags = GENL_UNS_ADMIN_PERM,
13145 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13146 NL80211_FLAG_NEED_RTNL,
13147 },
13148 {
13149 .cmd = NL80211_CMD_DEL_INTERFACE,
13150 .doit = nl80211_del_interface,
13151 .policy = nl80211_policy,
13152 .flags = GENL_UNS_ADMIN_PERM,
13153 .internal_flags = NL80211_FLAG_NEED_WDEV |
13154 NL80211_FLAG_NEED_RTNL,
13155 },
13156 {
13157 .cmd = NL80211_CMD_GET_KEY,
13158 .doit = nl80211_get_key,
13159 .policy = nl80211_policy,
13160 .flags = GENL_UNS_ADMIN_PERM,
13161 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13162 NL80211_FLAG_NEED_RTNL,
13163 },
13164 {
13165 .cmd = NL80211_CMD_SET_KEY,
13166 .doit = nl80211_set_key,
13167 .policy = nl80211_policy,
13168 .flags = GENL_UNS_ADMIN_PERM,
13169 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13170 NL80211_FLAG_NEED_RTNL |
13171 NL80211_FLAG_CLEAR_SKB,
13172 },
13173 {
13174 .cmd = NL80211_CMD_NEW_KEY,
13175 .doit = nl80211_new_key,
13176 .policy = nl80211_policy,
13177 .flags = GENL_UNS_ADMIN_PERM,
13178 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13179 NL80211_FLAG_NEED_RTNL |
13180 NL80211_FLAG_CLEAR_SKB,
13181 },
13182 {
13183 .cmd = NL80211_CMD_DEL_KEY,
13184 .doit = nl80211_del_key,
13185 .policy = nl80211_policy,
13186 .flags = GENL_UNS_ADMIN_PERM,
13187 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13188 NL80211_FLAG_NEED_RTNL,
13189 },
13190 {
13191 .cmd = NL80211_CMD_SET_BEACON,
13192 .policy = nl80211_policy,
13193 .flags = GENL_UNS_ADMIN_PERM,
13194 .doit = nl80211_set_beacon,
13195 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13196 NL80211_FLAG_NEED_RTNL,
13197 },
13198 {
13199 .cmd = NL80211_CMD_START_AP,
13200 .policy = nl80211_policy,
13201 .flags = GENL_UNS_ADMIN_PERM,
13202 .doit = nl80211_start_ap,
13203 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13204 NL80211_FLAG_NEED_RTNL,
13205 },
13206 {
13207 .cmd = NL80211_CMD_STOP_AP,
13208 .policy = nl80211_policy,
13209 .flags = GENL_UNS_ADMIN_PERM,
13210 .doit = nl80211_stop_ap,
13211 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13212 NL80211_FLAG_NEED_RTNL,
13213 },
13214 {
13215 .cmd = NL80211_CMD_GET_STATION,
13216 .doit = nl80211_get_station,
13217 .dumpit = nl80211_dump_station,
13218 .policy = nl80211_policy,
13219 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13220 NL80211_FLAG_NEED_RTNL,
13221 },
13222 {
13223 .cmd = NL80211_CMD_SET_STATION,
13224 .doit = nl80211_set_station,
13225 .policy = nl80211_policy,
13226 .flags = GENL_UNS_ADMIN_PERM,
13227 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13228 NL80211_FLAG_NEED_RTNL,
13229 },
13230 {
13231 .cmd = NL80211_CMD_NEW_STATION,
13232 .doit = nl80211_new_station,
13233 .policy = nl80211_policy,
13234 .flags = GENL_UNS_ADMIN_PERM,
13235 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13236 NL80211_FLAG_NEED_RTNL,
13237 },
13238 {
13239 .cmd = NL80211_CMD_DEL_STATION,
13240 .doit = nl80211_del_station,
13241 .policy = nl80211_policy,
13242 .flags = GENL_UNS_ADMIN_PERM,
13243 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13244 NL80211_FLAG_NEED_RTNL,
13245 },
13246 {
13247 .cmd = NL80211_CMD_GET_MPATH,
13248 .doit = nl80211_get_mpath,
13249 .dumpit = nl80211_dump_mpath,
13250 .policy = nl80211_policy,
13251 .flags = GENL_UNS_ADMIN_PERM,
13252 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13253 NL80211_FLAG_NEED_RTNL,
13254 },
13255 {
13256 .cmd = NL80211_CMD_GET_MPP,
13257 .doit = nl80211_get_mpp,
13258 .dumpit = nl80211_dump_mpp,
13259 .policy = nl80211_policy,
13260 .flags = GENL_UNS_ADMIN_PERM,
13261 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13262 NL80211_FLAG_NEED_RTNL,
13263 },
13264 {
13265 .cmd = NL80211_CMD_SET_MPATH,
13266 .doit = nl80211_set_mpath,
13267 .policy = nl80211_policy,
13268 .flags = GENL_UNS_ADMIN_PERM,
13269 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13270 NL80211_FLAG_NEED_RTNL,
13271 },
13272 {
13273 .cmd = NL80211_CMD_NEW_MPATH,
13274 .doit = nl80211_new_mpath,
13275 .policy = nl80211_policy,
13276 .flags = GENL_UNS_ADMIN_PERM,
13277 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13278 NL80211_FLAG_NEED_RTNL,
13279 },
13280 {
13281 .cmd = NL80211_CMD_DEL_MPATH,
13282 .doit = nl80211_del_mpath,
13283 .policy = nl80211_policy,
13284 .flags = GENL_UNS_ADMIN_PERM,
13285 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13286 NL80211_FLAG_NEED_RTNL,
13287 },
13288 {
13289 .cmd = NL80211_CMD_SET_BSS,
13290 .doit = nl80211_set_bss,
13291 .policy = nl80211_policy,
13292 .flags = GENL_UNS_ADMIN_PERM,
13293 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13294 NL80211_FLAG_NEED_RTNL,
13295 },
13296 {
13297 .cmd = NL80211_CMD_GET_REG,
13298 .doit = nl80211_get_reg_do,
13299 .dumpit = nl80211_get_reg_dump,
13300 .policy = nl80211_policy,
13301 .internal_flags = NL80211_FLAG_NEED_RTNL,
13302 /* can be retrieved by unprivileged users */
13303 },
13304 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13305 {
13306 .cmd = NL80211_CMD_SET_REG,
13307 .doit = nl80211_set_reg,
13308 .policy = nl80211_policy,
13309 .flags = GENL_ADMIN_PERM,
13310 .internal_flags = NL80211_FLAG_NEED_RTNL,
13311 },
13312 #endif
13313 {
13314 .cmd = NL80211_CMD_REQ_SET_REG,
13315 .doit = nl80211_req_set_reg,
13316 .policy = nl80211_policy,
13317 .flags = GENL_ADMIN_PERM,
13318 },
13319 {
13320 .cmd = NL80211_CMD_RELOAD_REGDB,
13321 .doit = nl80211_reload_regdb,
13322 .policy = nl80211_policy,
13323 .flags = GENL_ADMIN_PERM,
13324 },
13325 {
13326 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13327 .doit = nl80211_get_mesh_config,
13328 .policy = nl80211_policy,
13329 /* can be retrieved by unprivileged users */
13330 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13331 NL80211_FLAG_NEED_RTNL,
13332 },
13333 {
13334 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13335 .doit = nl80211_update_mesh_config,
13336 .policy = nl80211_policy,
13337 .flags = GENL_UNS_ADMIN_PERM,
13338 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13339 NL80211_FLAG_NEED_RTNL,
13340 },
13341 {
13342 .cmd = NL80211_CMD_TRIGGER_SCAN,
13343 .doit = nl80211_trigger_scan,
13344 .policy = nl80211_policy,
13345 .flags = GENL_UNS_ADMIN_PERM,
13346 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13347 NL80211_FLAG_NEED_RTNL,
13348 },
13349 {
13350 .cmd = NL80211_CMD_ABORT_SCAN,
13351 .doit = nl80211_abort_scan,
13352 .policy = nl80211_policy,
13353 .flags = GENL_UNS_ADMIN_PERM,
13354 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13355 NL80211_FLAG_NEED_RTNL,
13356 },
13357 {
13358 .cmd = NL80211_CMD_GET_SCAN,
13359 .policy = nl80211_policy,
13360 .dumpit = nl80211_dump_scan,
13361 },
13362 {
13363 .cmd = NL80211_CMD_START_SCHED_SCAN,
13364 .doit = nl80211_start_sched_scan,
13365 .policy = nl80211_policy,
13366 .flags = GENL_UNS_ADMIN_PERM,
13367 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13368 NL80211_FLAG_NEED_RTNL,
13369 },
13370 {
13371 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13372 .doit = nl80211_stop_sched_scan,
13373 .policy = nl80211_policy,
13374 .flags = GENL_UNS_ADMIN_PERM,
13375 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13376 NL80211_FLAG_NEED_RTNL,
13377 },
13378 {
13379 .cmd = NL80211_CMD_AUTHENTICATE,
13380 .doit = nl80211_authenticate,
13381 .policy = nl80211_policy,
13382 .flags = GENL_UNS_ADMIN_PERM,
13383 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13384 NL80211_FLAG_NEED_RTNL |
13385 NL80211_FLAG_CLEAR_SKB,
13386 },
13387 {
13388 .cmd = NL80211_CMD_ASSOCIATE,
13389 .doit = nl80211_associate,
13390 .policy = nl80211_policy,
13391 .flags = GENL_UNS_ADMIN_PERM,
13392 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13393 NL80211_FLAG_NEED_RTNL,
13394 },
13395 {
13396 .cmd = NL80211_CMD_DEAUTHENTICATE,
13397 .doit = nl80211_deauthenticate,
13398 .policy = nl80211_policy,
13399 .flags = GENL_UNS_ADMIN_PERM,
13400 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13401 NL80211_FLAG_NEED_RTNL,
13402 },
13403 {
13404 .cmd = NL80211_CMD_DISASSOCIATE,
13405 .doit = nl80211_disassociate,
13406 .policy = nl80211_policy,
13407 .flags = GENL_UNS_ADMIN_PERM,
13408 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13409 NL80211_FLAG_NEED_RTNL,
13410 },
13411 {
13412 .cmd = NL80211_CMD_JOIN_IBSS,
13413 .doit = nl80211_join_ibss,
13414 .policy = nl80211_policy,
13415 .flags = GENL_UNS_ADMIN_PERM,
13416 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13417 NL80211_FLAG_NEED_RTNL,
13418 },
13419 {
13420 .cmd = NL80211_CMD_LEAVE_IBSS,
13421 .doit = nl80211_leave_ibss,
13422 .policy = nl80211_policy,
13423 .flags = GENL_UNS_ADMIN_PERM,
13424 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13425 NL80211_FLAG_NEED_RTNL,
13426 },
13427 #ifdef CONFIG_NL80211_TESTMODE
13428 {
13429 .cmd = NL80211_CMD_TESTMODE,
13430 .doit = nl80211_testmode_do,
13431 .dumpit = nl80211_testmode_dump,
13432 .policy = nl80211_policy,
13433 .flags = GENL_UNS_ADMIN_PERM,
13434 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13435 NL80211_FLAG_NEED_RTNL,
13436 },
13437 #endif
13438 {
13439 .cmd = NL80211_CMD_CONNECT,
13440 .doit = nl80211_connect,
13441 .policy = nl80211_policy,
13442 .flags = GENL_UNS_ADMIN_PERM,
13443 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13444 NL80211_FLAG_NEED_RTNL,
13445 },
13446 {
13447 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13448 .doit = nl80211_update_connect_params,
13449 .policy = nl80211_policy,
13450 .flags = GENL_ADMIN_PERM,
13451 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13452 NL80211_FLAG_NEED_RTNL,
13453 },
13454 {
13455 .cmd = NL80211_CMD_DISCONNECT,
13456 .doit = nl80211_disconnect,
13457 .policy = nl80211_policy,
13458 .flags = GENL_UNS_ADMIN_PERM,
13459 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13460 NL80211_FLAG_NEED_RTNL,
13461 },
13462 {
13463 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13464 .doit = nl80211_wiphy_netns,
13465 .policy = nl80211_policy,
13466 .flags = GENL_UNS_ADMIN_PERM,
13467 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13468 NL80211_FLAG_NEED_RTNL,
13469 },
13470 {
13471 .cmd = NL80211_CMD_GET_SURVEY,
13472 .policy = nl80211_policy,
13473 .dumpit = nl80211_dump_survey,
13474 },
13475 {
13476 .cmd = NL80211_CMD_SET_PMKSA,
13477 .doit = nl80211_setdel_pmksa,
13478 .policy = nl80211_policy,
13479 .flags = GENL_UNS_ADMIN_PERM,
13480 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13481 NL80211_FLAG_NEED_RTNL,
13482 },
13483 {
13484 .cmd = NL80211_CMD_DEL_PMKSA,
13485 .doit = nl80211_setdel_pmksa,
13486 .policy = nl80211_policy,
13487 .flags = GENL_UNS_ADMIN_PERM,
13488 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13489 NL80211_FLAG_NEED_RTNL,
13490 },
13491 {
13492 .cmd = NL80211_CMD_FLUSH_PMKSA,
13493 .doit = nl80211_flush_pmksa,
13494 .policy = nl80211_policy,
13495 .flags = GENL_UNS_ADMIN_PERM,
13496 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13497 NL80211_FLAG_NEED_RTNL,
13498 },
13499 {
13500 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13501 .doit = nl80211_remain_on_channel,
13502 .policy = nl80211_policy,
13503 .flags = GENL_UNS_ADMIN_PERM,
13504 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13505 NL80211_FLAG_NEED_RTNL,
13506 },
13507 {
13508 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13509 .doit = nl80211_cancel_remain_on_channel,
13510 .policy = nl80211_policy,
13511 .flags = GENL_UNS_ADMIN_PERM,
13512 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13513 NL80211_FLAG_NEED_RTNL,
13514 },
13515 {
13516 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13517 .doit = nl80211_set_tx_bitrate_mask,
13518 .policy = nl80211_policy,
13519 .flags = GENL_UNS_ADMIN_PERM,
13520 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13521 NL80211_FLAG_NEED_RTNL,
13522 },
13523 {
13524 .cmd = NL80211_CMD_REGISTER_FRAME,
13525 .doit = nl80211_register_mgmt,
13526 .policy = nl80211_policy,
13527 .flags = GENL_UNS_ADMIN_PERM,
13528 .internal_flags = NL80211_FLAG_NEED_WDEV |
13529 NL80211_FLAG_NEED_RTNL,
13530 },
13531 {
13532 .cmd = NL80211_CMD_FRAME,
13533 .doit = nl80211_tx_mgmt,
13534 .policy = nl80211_policy,
13535 .flags = GENL_UNS_ADMIN_PERM,
13536 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13537 NL80211_FLAG_NEED_RTNL,
13538 },
13539 {
13540 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13541 .doit = nl80211_tx_mgmt_cancel_wait,
13542 .policy = nl80211_policy,
13543 .flags = GENL_UNS_ADMIN_PERM,
13544 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13545 NL80211_FLAG_NEED_RTNL,
13546 },
13547 {
13548 .cmd = NL80211_CMD_SET_POWER_SAVE,
13549 .doit = nl80211_set_power_save,
13550 .policy = nl80211_policy,
13551 .flags = GENL_UNS_ADMIN_PERM,
13552 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13553 NL80211_FLAG_NEED_RTNL,
13554 },
13555 {
13556 .cmd = NL80211_CMD_GET_POWER_SAVE,
13557 .doit = nl80211_get_power_save,
13558 .policy = nl80211_policy,
13559 /* can be retrieved by unprivileged users */
13560 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13561 NL80211_FLAG_NEED_RTNL,
13562 },
13563 {
13564 .cmd = NL80211_CMD_SET_CQM,
13565 .doit = nl80211_set_cqm,
13566 .policy = nl80211_policy,
13567 .flags = GENL_UNS_ADMIN_PERM,
13568 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13569 NL80211_FLAG_NEED_RTNL,
13570 },
13571 {
13572 .cmd = NL80211_CMD_SET_CHANNEL,
13573 .doit = nl80211_set_channel,
13574 .policy = nl80211_policy,
13575 .flags = GENL_UNS_ADMIN_PERM,
13576 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13577 NL80211_FLAG_NEED_RTNL,
13578 },
13579 {
13580 .cmd = NL80211_CMD_SET_WDS_PEER,
13581 .doit = nl80211_set_wds_peer,
13582 .policy = nl80211_policy,
13583 .flags = GENL_UNS_ADMIN_PERM,
13584 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13585 NL80211_FLAG_NEED_RTNL,
13586 },
13587 {
13588 .cmd = NL80211_CMD_JOIN_MESH,
13589 .doit = nl80211_join_mesh,
13590 .policy = nl80211_policy,
13591 .flags = GENL_UNS_ADMIN_PERM,
13592 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13593 NL80211_FLAG_NEED_RTNL,
13594 },
13595 {
13596 .cmd = NL80211_CMD_LEAVE_MESH,
13597 .doit = nl80211_leave_mesh,
13598 .policy = nl80211_policy,
13599 .flags = GENL_UNS_ADMIN_PERM,
13600 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13601 NL80211_FLAG_NEED_RTNL,
13602 },
13603 {
13604 .cmd = NL80211_CMD_JOIN_OCB,
13605 .doit = nl80211_join_ocb,
13606 .policy = nl80211_policy,
13607 .flags = GENL_UNS_ADMIN_PERM,
13608 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13609 NL80211_FLAG_NEED_RTNL,
13610 },
13611 {
13612 .cmd = NL80211_CMD_LEAVE_OCB,
13613 .doit = nl80211_leave_ocb,
13614 .policy = nl80211_policy,
13615 .flags = GENL_UNS_ADMIN_PERM,
13616 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13617 NL80211_FLAG_NEED_RTNL,
13618 },
13619 #ifdef CONFIG_PM
13620 {
13621 .cmd = NL80211_CMD_GET_WOWLAN,
13622 .doit = nl80211_get_wowlan,
13623 .policy = nl80211_policy,
13624 /* can be retrieved by unprivileged users */
13625 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13626 NL80211_FLAG_NEED_RTNL,
13627 },
13628 {
13629 .cmd = NL80211_CMD_SET_WOWLAN,
13630 .doit = nl80211_set_wowlan,
13631 .policy = nl80211_policy,
13632 .flags = GENL_UNS_ADMIN_PERM,
13633 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13634 NL80211_FLAG_NEED_RTNL,
13635 },
13636 #endif
13637 {
13638 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13639 .doit = nl80211_set_rekey_data,
13640 .policy = nl80211_policy,
13641 .flags = GENL_UNS_ADMIN_PERM,
13642 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13643 NL80211_FLAG_NEED_RTNL |
13644 NL80211_FLAG_CLEAR_SKB,
13645 },
13646 {
13647 .cmd = NL80211_CMD_TDLS_MGMT,
13648 .doit = nl80211_tdls_mgmt,
13649 .policy = nl80211_policy,
13650 .flags = GENL_UNS_ADMIN_PERM,
13651 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13652 NL80211_FLAG_NEED_RTNL,
13653 },
13654 {
13655 .cmd = NL80211_CMD_TDLS_OPER,
13656 .doit = nl80211_tdls_oper,
13657 .policy = nl80211_policy,
13658 .flags = GENL_UNS_ADMIN_PERM,
13659 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13660 NL80211_FLAG_NEED_RTNL,
13661 },
13662 {
13663 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13664 .doit = nl80211_register_unexpected_frame,
13665 .policy = nl80211_policy,
13666 .flags = GENL_UNS_ADMIN_PERM,
13667 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13668 NL80211_FLAG_NEED_RTNL,
13669 },
13670 {
13671 .cmd = NL80211_CMD_PROBE_CLIENT,
13672 .doit = nl80211_probe_client,
13673 .policy = nl80211_policy,
13674 .flags = GENL_UNS_ADMIN_PERM,
13675 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13676 NL80211_FLAG_NEED_RTNL,
13677 },
13678 {
13679 .cmd = NL80211_CMD_REGISTER_BEACONS,
13680 .doit = nl80211_register_beacons,
13681 .policy = nl80211_policy,
13682 .flags = GENL_UNS_ADMIN_PERM,
13683 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13684 NL80211_FLAG_NEED_RTNL,
13685 },
13686 {
13687 .cmd = NL80211_CMD_SET_NOACK_MAP,
13688 .doit = nl80211_set_noack_map,
13689 .policy = nl80211_policy,
13690 .flags = GENL_UNS_ADMIN_PERM,
13691 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13692 NL80211_FLAG_NEED_RTNL,
13693 },
13694 {
13695 .cmd = NL80211_CMD_START_P2P_DEVICE,
13696 .doit = nl80211_start_p2p_device,
13697 .policy = nl80211_policy,
13698 .flags = GENL_UNS_ADMIN_PERM,
13699 .internal_flags = NL80211_FLAG_NEED_WDEV |
13700 NL80211_FLAG_NEED_RTNL,
13701 },
13702 {
13703 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13704 .doit = nl80211_stop_p2p_device,
13705 .policy = nl80211_policy,
13706 .flags = GENL_UNS_ADMIN_PERM,
13707 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13708 NL80211_FLAG_NEED_RTNL,
13709 },
13710 {
13711 .cmd = NL80211_CMD_START_NAN,
13712 .doit = nl80211_start_nan,
13713 .policy = nl80211_policy,
13714 .flags = GENL_ADMIN_PERM,
13715 .internal_flags = NL80211_FLAG_NEED_WDEV |
13716 NL80211_FLAG_NEED_RTNL,
13717 },
13718 {
13719 .cmd = NL80211_CMD_STOP_NAN,
13720 .doit = nl80211_stop_nan,
13721 .policy = nl80211_policy,
13722 .flags = GENL_ADMIN_PERM,
13723 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13724 NL80211_FLAG_NEED_RTNL,
13725 },
13726 {
13727 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13728 .doit = nl80211_nan_add_func,
13729 .policy = nl80211_policy,
13730 .flags = GENL_ADMIN_PERM,
13731 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13732 NL80211_FLAG_NEED_RTNL,
13733 },
13734 {
13735 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13736 .doit = nl80211_nan_del_func,
13737 .policy = nl80211_policy,
13738 .flags = GENL_ADMIN_PERM,
13739 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13740 NL80211_FLAG_NEED_RTNL,
13741 },
13742 {
13743 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13744 .doit = nl80211_nan_change_config,
13745 .policy = nl80211_policy,
13746 .flags = GENL_ADMIN_PERM,
13747 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13748 NL80211_FLAG_NEED_RTNL,
13749 },
13750 {
13751 .cmd = NL80211_CMD_SET_MCAST_RATE,
13752 .doit = nl80211_set_mcast_rate,
13753 .policy = nl80211_policy,
13754 .flags = GENL_UNS_ADMIN_PERM,
13755 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13756 NL80211_FLAG_NEED_RTNL,
13757 },
13758 {
13759 .cmd = NL80211_CMD_SET_MAC_ACL,
13760 .doit = nl80211_set_mac_acl,
13761 .policy = nl80211_policy,
13762 .flags = GENL_UNS_ADMIN_PERM,
13763 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13764 NL80211_FLAG_NEED_RTNL,
13765 },
13766 {
13767 .cmd = NL80211_CMD_RADAR_DETECT,
13768 .doit = nl80211_start_radar_detection,
13769 .policy = nl80211_policy,
13770 .flags = GENL_UNS_ADMIN_PERM,
13771 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13772 NL80211_FLAG_NEED_RTNL,
13773 },
13774 {
13775 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13776 .doit = nl80211_get_protocol_features,
13777 .policy = nl80211_policy,
13778 },
13779 {
13780 .cmd = NL80211_CMD_UPDATE_FT_IES,
13781 .doit = nl80211_update_ft_ies,
13782 .policy = nl80211_policy,
13783 .flags = GENL_UNS_ADMIN_PERM,
13784 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13785 NL80211_FLAG_NEED_RTNL,
13786 },
13787 {
13788 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13789 .doit = nl80211_crit_protocol_start,
13790 .policy = nl80211_policy,
13791 .flags = GENL_UNS_ADMIN_PERM,
13792 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13793 NL80211_FLAG_NEED_RTNL,
13794 },
13795 {
13796 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13797 .doit = nl80211_crit_protocol_stop,
13798 .policy = nl80211_policy,
13799 .flags = GENL_UNS_ADMIN_PERM,
13800 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13801 NL80211_FLAG_NEED_RTNL,
13802 },
13803 {
13804 .cmd = NL80211_CMD_GET_COALESCE,
13805 .doit = nl80211_get_coalesce,
13806 .policy = nl80211_policy,
13807 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13808 NL80211_FLAG_NEED_RTNL,
13809 },
13810 {
13811 .cmd = NL80211_CMD_SET_COALESCE,
13812 .doit = nl80211_set_coalesce,
13813 .policy = nl80211_policy,
13814 .flags = GENL_UNS_ADMIN_PERM,
13815 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13816 NL80211_FLAG_NEED_RTNL,
13817 },
13818 {
13819 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13820 .doit = nl80211_channel_switch,
13821 .policy = nl80211_policy,
13822 .flags = GENL_UNS_ADMIN_PERM,
13823 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13824 NL80211_FLAG_NEED_RTNL,
13825 },
13826 {
13827 .cmd = NL80211_CMD_VENDOR,
13828 .doit = nl80211_vendor_cmd,
13829 .dumpit = nl80211_vendor_cmd_dump,
13830 .policy = nl80211_policy,
13831 .flags = GENL_UNS_ADMIN_PERM,
13832 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13833 NL80211_FLAG_NEED_RTNL,
13834 },
13835 {
13836 .cmd = NL80211_CMD_SET_QOS_MAP,
13837 .doit = nl80211_set_qos_map,
13838 .policy = nl80211_policy,
13839 .flags = GENL_UNS_ADMIN_PERM,
13840 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13841 NL80211_FLAG_NEED_RTNL,
13842 },
13843 {
13844 .cmd = NL80211_CMD_ADD_TX_TS,
13845 .doit = nl80211_add_tx_ts,
13846 .policy = nl80211_policy,
13847 .flags = GENL_UNS_ADMIN_PERM,
13848 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13849 NL80211_FLAG_NEED_RTNL,
13850 },
13851 {
13852 .cmd = NL80211_CMD_DEL_TX_TS,
13853 .doit = nl80211_del_tx_ts,
13854 .policy = nl80211_policy,
13855 .flags = GENL_UNS_ADMIN_PERM,
13856 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13857 NL80211_FLAG_NEED_RTNL,
13858 },
13859 {
13860 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13861 .doit = nl80211_tdls_channel_switch,
13862 .policy = nl80211_policy,
13863 .flags = GENL_UNS_ADMIN_PERM,
13864 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13865 NL80211_FLAG_NEED_RTNL,
13866 },
13867 {
13868 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13869 .doit = nl80211_tdls_cancel_channel_switch,
13870 .policy = nl80211_policy,
13871 .flags = GENL_UNS_ADMIN_PERM,
13872 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13873 NL80211_FLAG_NEED_RTNL,
13874 },
13875 {
13876 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13877 .doit = nl80211_set_multicast_to_unicast,
13878 .policy = nl80211_policy,
13879 .flags = GENL_UNS_ADMIN_PERM,
13880 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13881 NL80211_FLAG_NEED_RTNL,
13882 },
13883 {
13884 .cmd = NL80211_CMD_SET_PMK,
13885 .doit = nl80211_set_pmk,
13886 .policy = nl80211_policy,
13887 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13888 NL80211_FLAG_NEED_RTNL,
13889 },
13890 {
13891 .cmd = NL80211_CMD_DEL_PMK,
13892 .doit = nl80211_del_pmk,
13893 .policy = nl80211_policy,
13894 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13895 NL80211_FLAG_NEED_RTNL,
13896 },
13897 {
13898 .cmd = NL80211_CMD_EXTERNAL_AUTH,
13899 .doit = nl80211_external_auth,
13900 .policy = nl80211_policy,
13901 .flags = GENL_ADMIN_PERM,
13902 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13903 NL80211_FLAG_NEED_RTNL,
13904 },
13905 {
13906 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13907 .doit = nl80211_tx_control_port,
13908 .policy = nl80211_policy,
13909 .flags = GENL_UNS_ADMIN_PERM,
13910 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13911 NL80211_FLAG_NEED_RTNL,
13912 },
13913 };
13914
13915 static struct genl_family nl80211_fam __ro_after_init = {
13916 .name = NL80211_GENL_NAME, /* have users key off the name instead */
13917 .hdrsize = 0, /* no private header */
13918 .version = 1, /* no particular meaning now */
13919 .maxattr = NL80211_ATTR_MAX,
13920 .netnsok = true,
13921 .pre_doit = nl80211_pre_doit,
13922 .post_doit = nl80211_post_doit,
13923 .module = THIS_MODULE,
13924 .ops = nl80211_ops,
13925 .n_ops = ARRAY_SIZE(nl80211_ops),
13926 .mcgrps = nl80211_mcgrps,
13927 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13928 };
13929
13930 /* notification functions */
13931
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)13932 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13933 enum nl80211_commands cmd)
13934 {
13935 struct sk_buff *msg;
13936 struct nl80211_dump_wiphy_state state = {};
13937
13938 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13939 cmd != NL80211_CMD_DEL_WIPHY);
13940
13941 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13942 if (!msg)
13943 return;
13944
13945 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13946 nlmsg_free(msg);
13947 return;
13948 }
13949
13950 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13951 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13952 }
13953
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)13954 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13955 struct wireless_dev *wdev,
13956 enum nl80211_commands cmd)
13957 {
13958 struct sk_buff *msg;
13959
13960 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13961 cmd != NL80211_CMD_DEL_INTERFACE);
13962
13963 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13964 if (!msg)
13965 return;
13966
13967 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13968 cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13969 nlmsg_free(msg);
13970 return;
13971 }
13972
13973 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13974 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13975 }
13976
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13977 static int nl80211_add_scan_req(struct sk_buff *msg,
13978 struct cfg80211_registered_device *rdev)
13979 {
13980 struct cfg80211_scan_request *req = rdev->scan_req;
13981 struct nlattr *nest;
13982 int i;
13983
13984 if (WARN_ON(!req))
13985 return 0;
13986
13987 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13988 if (!nest)
13989 goto nla_put_failure;
13990 for (i = 0; i < req->n_ssids; i++) {
13991 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13992 goto nla_put_failure;
13993 }
13994 nla_nest_end(msg, nest);
13995
13996 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13997 if (!nest)
13998 goto nla_put_failure;
13999 for (i = 0; i < req->n_channels; i++) {
14000 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14001 goto nla_put_failure;
14002 }
14003 nla_nest_end(msg, nest);
14004
14005 if (req->ie &&
14006 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14007 goto nla_put_failure;
14008
14009 if (req->flags &&
14010 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14011 goto nla_put_failure;
14012
14013 if (req->info.scan_start_tsf &&
14014 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14015 req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14016 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14017 req->info.tsf_bssid)))
14018 goto nla_put_failure;
14019
14020 return 0;
14021 nla_put_failure:
14022 return -ENOBUFS;
14023 }
14024
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)14025 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14026 struct cfg80211_registered_device *rdev,
14027 struct wireless_dev *wdev,
14028 u32 portid, u32 seq, int flags,
14029 u32 cmd)
14030 {
14031 void *hdr;
14032
14033 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14034 if (!hdr)
14035 return -1;
14036
14037 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14038 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14039 wdev->netdev->ifindex)) ||
14040 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14041 NL80211_ATTR_PAD))
14042 goto nla_put_failure;
14043
14044 /* ignore errors and send incomplete event anyway */
14045 nl80211_add_scan_req(msg, rdev);
14046
14047 genlmsg_end(msg, hdr);
14048 return 0;
14049
14050 nla_put_failure:
14051 genlmsg_cancel(msg, hdr);
14052 return -EMSGSIZE;
14053 }
14054
14055 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)14056 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14057 struct cfg80211_sched_scan_request *req, u32 cmd)
14058 {
14059 void *hdr;
14060
14061 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14062 if (!hdr)
14063 return -1;
14064
14065 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14066 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14067 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14068 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14069 NL80211_ATTR_PAD))
14070 goto nla_put_failure;
14071
14072 genlmsg_end(msg, hdr);
14073 return 0;
14074
14075 nla_put_failure:
14076 genlmsg_cancel(msg, hdr);
14077 return -EMSGSIZE;
14078 }
14079
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)14080 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14081 struct wireless_dev *wdev)
14082 {
14083 struct sk_buff *msg;
14084
14085 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14086 if (!msg)
14087 return;
14088
14089 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14090 NL80211_CMD_TRIGGER_SCAN) < 0) {
14091 nlmsg_free(msg);
14092 return;
14093 }
14094
14095 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14096 NL80211_MCGRP_SCAN, GFP_KERNEL);
14097 }
14098
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)14099 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14100 struct wireless_dev *wdev, bool aborted)
14101 {
14102 struct sk_buff *msg;
14103
14104 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14105 if (!msg)
14106 return NULL;
14107
14108 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14109 aborted ? NL80211_CMD_SCAN_ABORTED :
14110 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14111 nlmsg_free(msg);
14112 return NULL;
14113 }
14114
14115 return msg;
14116 }
14117
14118 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)14119 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14120 struct sk_buff *msg)
14121 {
14122 if (!msg)
14123 return;
14124
14125 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14126 NL80211_MCGRP_SCAN, GFP_KERNEL);
14127 }
14128
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)14129 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14130 {
14131 struct sk_buff *msg;
14132
14133 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14134 if (!msg)
14135 return;
14136
14137 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14138 nlmsg_free(msg);
14139 return;
14140 }
14141
14142 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14143 NL80211_MCGRP_SCAN, GFP_KERNEL);
14144 }
14145
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)14146 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14147 struct regulatory_request *request)
14148 {
14149 /* Userspace can always count this one always being set */
14150 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14151 goto nla_put_failure;
14152
14153 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14154 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14155 NL80211_REGDOM_TYPE_WORLD))
14156 goto nla_put_failure;
14157 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14158 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14159 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14160 goto nla_put_failure;
14161 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14162 request->intersect) {
14163 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14164 NL80211_REGDOM_TYPE_INTERSECTION))
14165 goto nla_put_failure;
14166 } else {
14167 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14168 NL80211_REGDOM_TYPE_COUNTRY) ||
14169 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14170 request->alpha2))
14171 goto nla_put_failure;
14172 }
14173
14174 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14175 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14176
14177 if (wiphy &&
14178 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14179 goto nla_put_failure;
14180
14181 if (wiphy &&
14182 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14183 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14184 goto nla_put_failure;
14185 }
14186
14187 return true;
14188
14189 nla_put_failure:
14190 return false;
14191 }
14192
14193 /*
14194 * This can happen on global regulatory changes or device specific settings
14195 * based on custom regulatory domains.
14196 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)14197 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14198 struct regulatory_request *request)
14199 {
14200 struct sk_buff *msg;
14201 void *hdr;
14202
14203 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14204 if (!msg)
14205 return;
14206
14207 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14208 if (!hdr) {
14209 nlmsg_free(msg);
14210 return;
14211 }
14212
14213 if (nl80211_reg_change_event_fill(msg, request) == false)
14214 goto nla_put_failure;
14215
14216 genlmsg_end(msg, hdr);
14217
14218 rcu_read_lock();
14219 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14220 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14221 rcu_read_unlock();
14222
14223 return;
14224
14225 nla_put_failure:
14226 nlmsg_free(msg);
14227 }
14228
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,enum nl80211_commands cmd,gfp_t gfp,int uapsd_queues)14229 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14230 struct net_device *netdev,
14231 const u8 *buf, size_t len,
14232 enum nl80211_commands cmd, gfp_t gfp,
14233 int uapsd_queues)
14234 {
14235 struct sk_buff *msg;
14236 void *hdr;
14237
14238 msg = nlmsg_new(100 + len, gfp);
14239 if (!msg)
14240 return;
14241
14242 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14243 if (!hdr) {
14244 nlmsg_free(msg);
14245 return;
14246 }
14247
14248 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14249 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14250 nla_put(msg, NL80211_ATTR_FRAME, len, buf))
14251 goto nla_put_failure;
14252
14253 if (uapsd_queues >= 0) {
14254 struct nlattr *nla_wmm =
14255 nla_nest_start(msg, NL80211_ATTR_STA_WME);
14256 if (!nla_wmm)
14257 goto nla_put_failure;
14258
14259 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14260 uapsd_queues))
14261 goto nla_put_failure;
14262
14263 nla_nest_end(msg, nla_wmm);
14264 }
14265
14266 genlmsg_end(msg, hdr);
14267
14268 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14269 NL80211_MCGRP_MLME, gfp);
14270 return;
14271
14272 nla_put_failure:
14273 nlmsg_free(msg);
14274 }
14275
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)14276 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14277 struct net_device *netdev, const u8 *buf,
14278 size_t len, gfp_t gfp)
14279 {
14280 nl80211_send_mlme_event(rdev, netdev, buf, len,
14281 NL80211_CMD_AUTHENTICATE, gfp, -1);
14282 }
14283
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp,int uapsd_queues)14284 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14285 struct net_device *netdev, const u8 *buf,
14286 size_t len, gfp_t gfp, int uapsd_queues)
14287 {
14288 nl80211_send_mlme_event(rdev, netdev, buf, len,
14289 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
14290 }
14291
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)14292 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14293 struct net_device *netdev, const u8 *buf,
14294 size_t len, gfp_t gfp)
14295 {
14296 nl80211_send_mlme_event(rdev, netdev, buf, len,
14297 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
14298 }
14299
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)14300 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14301 struct net_device *netdev, const u8 *buf,
14302 size_t len, gfp_t gfp)
14303 {
14304 nl80211_send_mlme_event(rdev, netdev, buf, len,
14305 NL80211_CMD_DISASSOCIATE, gfp, -1);
14306 }
14307
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)14308 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14309 size_t len)
14310 {
14311 struct wireless_dev *wdev = dev->ieee80211_ptr;
14312 struct wiphy *wiphy = wdev->wiphy;
14313 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14314 const struct ieee80211_mgmt *mgmt = (void *)buf;
14315 u32 cmd;
14316
14317 if (WARN_ON(len < 2))
14318 return;
14319
14320 if (ieee80211_is_deauth(mgmt->frame_control))
14321 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14322 else
14323 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14324
14325 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14326 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
14327 }
14328 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14329
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)14330 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14331 struct net_device *netdev, int cmd,
14332 const u8 *addr, gfp_t gfp)
14333 {
14334 struct sk_buff *msg;
14335 void *hdr;
14336
14337 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14338 if (!msg)
14339 return;
14340
14341 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14342 if (!hdr) {
14343 nlmsg_free(msg);
14344 return;
14345 }
14346
14347 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14348 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14349 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14350 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14351 goto nla_put_failure;
14352
14353 genlmsg_end(msg, hdr);
14354
14355 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14356 NL80211_MCGRP_MLME, gfp);
14357 return;
14358
14359 nla_put_failure:
14360 nlmsg_free(msg);
14361 }
14362
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)14363 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14364 struct net_device *netdev, const u8 *addr,
14365 gfp_t gfp)
14366 {
14367 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14368 addr, gfp);
14369 }
14370
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)14371 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14372 struct net_device *netdev, const u8 *addr,
14373 gfp_t gfp)
14374 {
14375 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14376 addr, gfp);
14377 }
14378
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)14379 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14380 struct net_device *netdev,
14381 struct cfg80211_connect_resp_params *cr,
14382 gfp_t gfp)
14383 {
14384 struct sk_buff *msg;
14385 void *hdr;
14386
14387 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14388 cr->fils.kek_len + cr->fils.pmk_len +
14389 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14390 if (!msg)
14391 return;
14392
14393 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14394 if (!hdr) {
14395 nlmsg_free(msg);
14396 return;
14397 }
14398
14399 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14400 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14401 (cr->bssid &&
14402 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14403 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14404 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14405 cr->status) ||
14406 (cr->status < 0 &&
14407 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14408 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14409 cr->timeout_reason))) ||
14410 (cr->req_ie &&
14411 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14412 (cr->resp_ie &&
14413 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14414 cr->resp_ie)) ||
14415 (cr->fils.update_erp_next_seq_num &&
14416 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14417 cr->fils.erp_next_seq_num)) ||
14418 (cr->status == WLAN_STATUS_SUCCESS &&
14419 ((cr->fils.kek &&
14420 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14421 cr->fils.kek)) ||
14422 (cr->fils.pmk &&
14423 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14424 (cr->fils.pmkid &&
14425 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14426 goto nla_put_failure;
14427
14428 genlmsg_end(msg, hdr);
14429
14430 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14431 NL80211_MCGRP_MLME, gfp);
14432 return;
14433
14434 nla_put_failure:
14435 nlmsg_free(msg);
14436 }
14437
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)14438 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14439 struct net_device *netdev,
14440 struct cfg80211_roam_info *info, gfp_t gfp)
14441 {
14442 struct sk_buff *msg;
14443 void *hdr;
14444 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14445
14446 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14447 info->fils.kek_len + info->fils.pmk_len +
14448 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14449 if (!msg)
14450 return;
14451
14452 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14453 if (!hdr) {
14454 nlmsg_free(msg);
14455 return;
14456 }
14457
14458 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14459 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14460 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14461 (info->req_ie &&
14462 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14463 info->req_ie)) ||
14464 (info->resp_ie &&
14465 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14466 info->resp_ie)) ||
14467 (info->fils.update_erp_next_seq_num &&
14468 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14469 info->fils.erp_next_seq_num)) ||
14470 (info->fils.kek &&
14471 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14472 info->fils.kek)) ||
14473 (info->fils.pmk &&
14474 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14475 (info->fils.pmkid &&
14476 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14477 goto nla_put_failure;
14478
14479 genlmsg_end(msg, hdr);
14480
14481 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14482 NL80211_MCGRP_MLME, gfp);
14483 return;
14484
14485 nla_put_failure:
14486 nlmsg_free(msg);
14487 }
14488
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid)14489 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14490 struct net_device *netdev, const u8 *bssid)
14491 {
14492 struct sk_buff *msg;
14493 void *hdr;
14494
14495 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14496 if (!msg)
14497 return;
14498
14499 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14500 if (!hdr) {
14501 nlmsg_free(msg);
14502 return;
14503 }
14504
14505 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14506 goto nla_put_failure;
14507
14508 genlmsg_end(msg, hdr);
14509
14510 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14511 NL80211_MCGRP_MLME, GFP_KERNEL);
14512 return;
14513
14514 nla_put_failure:
14515 nlmsg_free(msg);
14516 }
14517
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)14518 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14519 struct net_device *netdev, u16 reason,
14520 const u8 *ie, size_t ie_len, bool from_ap)
14521 {
14522 struct sk_buff *msg;
14523 void *hdr;
14524
14525 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14526 if (!msg)
14527 return;
14528
14529 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14530 if (!hdr) {
14531 nlmsg_free(msg);
14532 return;
14533 }
14534
14535 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14536 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14537 (reason &&
14538 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14539 (from_ap &&
14540 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14541 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14542 goto nla_put_failure;
14543
14544 genlmsg_end(msg, hdr);
14545
14546 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14547 NL80211_MCGRP_MLME, GFP_KERNEL);
14548 return;
14549
14550 nla_put_failure:
14551 nlmsg_free(msg);
14552 }
14553
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)14554 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14555 struct net_device *netdev, const u8 *bssid,
14556 gfp_t gfp)
14557 {
14558 struct sk_buff *msg;
14559 void *hdr;
14560
14561 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14562 if (!msg)
14563 return;
14564
14565 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14566 if (!hdr) {
14567 nlmsg_free(msg);
14568 return;
14569 }
14570
14571 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14572 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14573 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14574 goto nla_put_failure;
14575
14576 genlmsg_end(msg, hdr);
14577
14578 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14579 NL80211_MCGRP_MLME, gfp);
14580 return;
14581
14582 nla_put_failure:
14583 nlmsg_free(msg);
14584 }
14585
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,gfp_t gfp)14586 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14587 const u8* ie, u8 ie_len, gfp_t gfp)
14588 {
14589 struct wireless_dev *wdev = dev->ieee80211_ptr;
14590 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14591 struct sk_buff *msg;
14592 void *hdr;
14593
14594 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14595 return;
14596
14597 trace_cfg80211_notify_new_peer_candidate(dev, addr);
14598
14599 msg = nlmsg_new(100 + ie_len, gfp);
14600 if (!msg)
14601 return;
14602
14603 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14604 if (!hdr) {
14605 nlmsg_free(msg);
14606 return;
14607 }
14608
14609 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14610 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14611 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14612 (ie_len && ie &&
14613 nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14614 goto nla_put_failure;
14615
14616 genlmsg_end(msg, hdr);
14617
14618 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14619 NL80211_MCGRP_MLME, gfp);
14620 return;
14621
14622 nla_put_failure:
14623 nlmsg_free(msg);
14624 }
14625 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14626
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)14627 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14628 struct net_device *netdev, const u8 *addr,
14629 enum nl80211_key_type key_type, int key_id,
14630 const u8 *tsc, gfp_t gfp)
14631 {
14632 struct sk_buff *msg;
14633 void *hdr;
14634
14635 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14636 if (!msg)
14637 return;
14638
14639 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14640 if (!hdr) {
14641 nlmsg_free(msg);
14642 return;
14643 }
14644
14645 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14646 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14647 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14648 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14649 (key_id != -1 &&
14650 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14651 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14652 goto nla_put_failure;
14653
14654 genlmsg_end(msg, hdr);
14655
14656 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14657 NL80211_MCGRP_MLME, gfp);
14658 return;
14659
14660 nla_put_failure:
14661 nlmsg_free(msg);
14662 }
14663
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)14664 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14665 struct ieee80211_channel *channel_before,
14666 struct ieee80211_channel *channel_after)
14667 {
14668 struct sk_buff *msg;
14669 void *hdr;
14670 struct nlattr *nl_freq;
14671
14672 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14673 if (!msg)
14674 return;
14675
14676 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14677 if (!hdr) {
14678 nlmsg_free(msg);
14679 return;
14680 }
14681
14682 /*
14683 * Since we are applying the beacon hint to a wiphy we know its
14684 * wiphy_idx is valid
14685 */
14686 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14687 goto nla_put_failure;
14688
14689 /* Before */
14690 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14691 if (!nl_freq)
14692 goto nla_put_failure;
14693
14694 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14695 goto nla_put_failure;
14696 nla_nest_end(msg, nl_freq);
14697
14698 /* After */
14699 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14700 if (!nl_freq)
14701 goto nla_put_failure;
14702
14703 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14704 goto nla_put_failure;
14705 nla_nest_end(msg, nl_freq);
14706
14707 genlmsg_end(msg, hdr);
14708
14709 rcu_read_lock();
14710 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14711 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14712 rcu_read_unlock();
14713
14714 return;
14715
14716 nla_put_failure:
14717 nlmsg_free(msg);
14718 }
14719
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)14720 static void nl80211_send_remain_on_chan_event(
14721 int cmd, struct cfg80211_registered_device *rdev,
14722 struct wireless_dev *wdev, u64 cookie,
14723 struct ieee80211_channel *chan,
14724 unsigned int duration, gfp_t gfp)
14725 {
14726 struct sk_buff *msg;
14727 void *hdr;
14728
14729 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14730 if (!msg)
14731 return;
14732
14733 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14734 if (!hdr) {
14735 nlmsg_free(msg);
14736 return;
14737 }
14738
14739 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14740 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14741 wdev->netdev->ifindex)) ||
14742 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14743 NL80211_ATTR_PAD) ||
14744 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14745 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14746 NL80211_CHAN_NO_HT) ||
14747 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14748 NL80211_ATTR_PAD))
14749 goto nla_put_failure;
14750
14751 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14752 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14753 goto nla_put_failure;
14754
14755 genlmsg_end(msg, hdr);
14756
14757 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14758 NL80211_MCGRP_MLME, gfp);
14759 return;
14760
14761 nla_put_failure:
14762 nlmsg_free(msg);
14763 }
14764
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)14765 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14766 struct ieee80211_channel *chan,
14767 unsigned int duration, gfp_t gfp)
14768 {
14769 struct wiphy *wiphy = wdev->wiphy;
14770 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14771
14772 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14773 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14774 rdev, wdev, cookie, chan,
14775 duration, gfp);
14776 }
14777 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14778
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)14779 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14780 struct ieee80211_channel *chan,
14781 gfp_t gfp)
14782 {
14783 struct wiphy *wiphy = wdev->wiphy;
14784 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14785
14786 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14787 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14788 rdev, wdev, cookie, chan, 0, gfp);
14789 }
14790 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14791
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)14792 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14793 struct station_info *sinfo, gfp_t gfp)
14794 {
14795 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14796 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14797 struct sk_buff *msg;
14798
14799 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14800
14801 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14802 if (!msg)
14803 return;
14804
14805 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14806 rdev, dev, mac_addr, sinfo) < 0) {
14807 nlmsg_free(msg);
14808 return;
14809 }
14810
14811 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14812 NL80211_MCGRP_MLME, gfp);
14813 }
14814 EXPORT_SYMBOL(cfg80211_new_sta);
14815
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)14816 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14817 struct station_info *sinfo, gfp_t gfp)
14818 {
14819 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14820 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14821 struct sk_buff *msg;
14822 struct station_info empty_sinfo = {};
14823
14824 if (!sinfo)
14825 sinfo = &empty_sinfo;
14826
14827 trace_cfg80211_del_sta(dev, mac_addr);
14828
14829 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14830 if (!msg) {
14831 cfg80211_sinfo_release_content(sinfo);
14832 return;
14833 }
14834
14835 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14836 rdev, dev, mac_addr, sinfo) < 0) {
14837 nlmsg_free(msg);
14838 return;
14839 }
14840
14841 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14842 NL80211_MCGRP_MLME, gfp);
14843 }
14844 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14845
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)14846 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14847 enum nl80211_connect_failed_reason reason,
14848 gfp_t gfp)
14849 {
14850 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14851 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14852 struct sk_buff *msg;
14853 void *hdr;
14854
14855 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14856 if (!msg)
14857 return;
14858
14859 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14860 if (!hdr) {
14861 nlmsg_free(msg);
14862 return;
14863 }
14864
14865 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14866 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14867 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14868 goto nla_put_failure;
14869
14870 genlmsg_end(msg, hdr);
14871
14872 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14873 NL80211_MCGRP_MLME, gfp);
14874 return;
14875
14876 nla_put_failure:
14877 nlmsg_free(msg);
14878 }
14879 EXPORT_SYMBOL(cfg80211_conn_failed);
14880
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)14881 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14882 const u8 *addr, gfp_t gfp)
14883 {
14884 struct wireless_dev *wdev = dev->ieee80211_ptr;
14885 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14886 struct sk_buff *msg;
14887 void *hdr;
14888 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14889
14890 if (!nlportid)
14891 return false;
14892
14893 msg = nlmsg_new(100, gfp);
14894 if (!msg)
14895 return true;
14896
14897 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14898 if (!hdr) {
14899 nlmsg_free(msg);
14900 return true;
14901 }
14902
14903 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14904 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14905 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14906 goto nla_put_failure;
14907
14908 genlmsg_end(msg, hdr);
14909 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14910 return true;
14911
14912 nla_put_failure:
14913 nlmsg_free(msg);
14914 return true;
14915 }
14916
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)14917 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14918 const u8 *addr, gfp_t gfp)
14919 {
14920 struct wireless_dev *wdev = dev->ieee80211_ptr;
14921 bool ret;
14922
14923 trace_cfg80211_rx_spurious_frame(dev, addr);
14924
14925 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14926 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14927 trace_cfg80211_return_bool(false);
14928 return false;
14929 }
14930 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14931 addr, gfp);
14932 trace_cfg80211_return_bool(ret);
14933 return ret;
14934 }
14935 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14936
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)14937 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14938 const u8 *addr, gfp_t gfp)
14939 {
14940 struct wireless_dev *wdev = dev->ieee80211_ptr;
14941 bool ret;
14942
14943 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14944
14945 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14946 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14947 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14948 trace_cfg80211_return_bool(false);
14949 return false;
14950 }
14951 ret = __nl80211_unexpected_frame(dev,
14952 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14953 addr, gfp);
14954 trace_cfg80211_return_bool(ret);
14955 return ret;
14956 }
14957 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14958
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,int freq,int sig_dbm,const u8 * buf,size_t len,u32 flags,gfp_t gfp)14959 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14960 struct wireless_dev *wdev, u32 nlportid,
14961 int freq, int sig_dbm,
14962 const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14963 {
14964 struct net_device *netdev = wdev->netdev;
14965 struct sk_buff *msg;
14966 void *hdr;
14967
14968 msg = nlmsg_new(100 + len, gfp);
14969 if (!msg)
14970 return -ENOMEM;
14971
14972 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14973 if (!hdr) {
14974 nlmsg_free(msg);
14975 return -ENOMEM;
14976 }
14977
14978 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14979 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14980 netdev->ifindex)) ||
14981 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14982 NL80211_ATTR_PAD) ||
14983 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14984 (sig_dbm &&
14985 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14986 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14987 (flags &&
14988 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14989 goto nla_put_failure;
14990
14991 genlmsg_end(msg, hdr);
14992
14993 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14994
14995 nla_put_failure:
14996 nlmsg_free(msg);
14997 return -ENOBUFS;
14998 }
14999
cfg80211_mgmt_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)15000 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15001 const u8 *buf, size_t len, bool ack, gfp_t gfp)
15002 {
15003 struct wiphy *wiphy = wdev->wiphy;
15004 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15005 struct net_device *netdev = wdev->netdev;
15006 struct sk_buff *msg;
15007 void *hdr;
15008
15009 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15010
15011 msg = nlmsg_new(100 + len, gfp);
15012 if (!msg)
15013 return;
15014
15015 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15016 if (!hdr) {
15017 nlmsg_free(msg);
15018 return;
15019 }
15020
15021 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15022 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15023 netdev->ifindex)) ||
15024 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15025 NL80211_ATTR_PAD) ||
15026 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15027 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15028 NL80211_ATTR_PAD) ||
15029 (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15030 goto nla_put_failure;
15031
15032 genlmsg_end(msg, hdr);
15033
15034 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15035 NL80211_MCGRP_MLME, gfp);
15036 return;
15037
15038 nla_put_failure:
15039 nlmsg_free(msg);
15040 }
15041 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15042
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,gfp_t gfp)15043 static int __nl80211_rx_control_port(struct net_device *dev,
15044 struct sk_buff *skb,
15045 bool unencrypted, gfp_t gfp)
15046 {
15047 struct wireless_dev *wdev = dev->ieee80211_ptr;
15048 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15049 struct ethhdr *ehdr = eth_hdr(skb);
15050 const u8 *addr = ehdr->h_source;
15051 u16 proto = be16_to_cpu(skb->protocol);
15052 struct sk_buff *msg;
15053 void *hdr;
15054 struct nlattr *frame;
15055
15056 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15057
15058 if (!nlportid)
15059 return -ENOENT;
15060
15061 msg = nlmsg_new(100 + skb->len, gfp);
15062 if (!msg)
15063 return -ENOMEM;
15064
15065 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15066 if (!hdr) {
15067 nlmsg_free(msg);
15068 return -ENOBUFS;
15069 }
15070
15071 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15072 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15073 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15074 NL80211_ATTR_PAD) ||
15075 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15076 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15077 (unencrypted && nla_put_flag(msg,
15078 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15079 goto nla_put_failure;
15080
15081 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15082 if (!frame)
15083 goto nla_put_failure;
15084
15085 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15086 genlmsg_end(msg, hdr);
15087
15088 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15089
15090 nla_put_failure:
15091 nlmsg_free(msg);
15092 return -ENOBUFS;
15093 }
15094
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted)15095 bool cfg80211_rx_control_port(struct net_device *dev,
15096 struct sk_buff *skb, bool unencrypted)
15097 {
15098 int ret;
15099
15100 trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15101 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15102 trace_cfg80211_return_bool(ret == 0);
15103 return ret == 0;
15104 }
15105 EXPORT_SYMBOL(cfg80211_rx_control_port);
15106
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)15107 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15108 const char *mac, gfp_t gfp)
15109 {
15110 struct wireless_dev *wdev = dev->ieee80211_ptr;
15111 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15112 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15113 void **cb;
15114
15115 if (!msg)
15116 return NULL;
15117
15118 cb = (void **)msg->cb;
15119
15120 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15121 if (!cb[0]) {
15122 nlmsg_free(msg);
15123 return NULL;
15124 }
15125
15126 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15127 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15128 goto nla_put_failure;
15129
15130 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15131 goto nla_put_failure;
15132
15133 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15134 if (!cb[1])
15135 goto nla_put_failure;
15136
15137 cb[2] = rdev;
15138
15139 return msg;
15140 nla_put_failure:
15141 nlmsg_free(msg);
15142 return NULL;
15143 }
15144
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)15145 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15146 {
15147 void **cb = (void **)msg->cb;
15148 struct cfg80211_registered_device *rdev = cb[2];
15149
15150 nla_nest_end(msg, cb[1]);
15151 genlmsg_end(msg, cb[0]);
15152
15153 memset(msg->cb, 0, sizeof(msg->cb));
15154
15155 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15156 NL80211_MCGRP_MLME, gfp);
15157 }
15158
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)15159 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15160 enum nl80211_cqm_rssi_threshold_event rssi_event,
15161 s32 rssi_level, gfp_t gfp)
15162 {
15163 struct sk_buff *msg;
15164 struct wireless_dev *wdev = dev->ieee80211_ptr;
15165 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15166
15167 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15168
15169 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15170 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15171 return;
15172
15173 if (wdev->cqm_config) {
15174 wdev->cqm_config->last_rssi_event_value = rssi_level;
15175
15176 cfg80211_cqm_rssi_update(rdev, dev);
15177
15178 if (rssi_level == 0)
15179 rssi_level = wdev->cqm_config->last_rssi_event_value;
15180 }
15181
15182 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15183 if (!msg)
15184 return;
15185
15186 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15187 rssi_event))
15188 goto nla_put_failure;
15189
15190 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15191 rssi_level))
15192 goto nla_put_failure;
15193
15194 cfg80211_send_cqm(msg, gfp);
15195
15196 return;
15197
15198 nla_put_failure:
15199 nlmsg_free(msg);
15200 }
15201 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15202
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)15203 void cfg80211_cqm_txe_notify(struct net_device *dev,
15204 const u8 *peer, u32 num_packets,
15205 u32 rate, u32 intvl, gfp_t gfp)
15206 {
15207 struct sk_buff *msg;
15208
15209 msg = cfg80211_prepare_cqm(dev, peer, gfp);
15210 if (!msg)
15211 return;
15212
15213 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15214 goto nla_put_failure;
15215
15216 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15217 goto nla_put_failure;
15218
15219 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15220 goto nla_put_failure;
15221
15222 cfg80211_send_cqm(msg, gfp);
15223 return;
15224
15225 nla_put_failure:
15226 nlmsg_free(msg);
15227 }
15228 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15229
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)15230 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15231 const u8 *peer, u32 num_packets, gfp_t gfp)
15232 {
15233 struct sk_buff *msg;
15234
15235 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15236
15237 msg = cfg80211_prepare_cqm(dev, peer, gfp);
15238 if (!msg)
15239 return;
15240
15241 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15242 goto nla_put_failure;
15243
15244 cfg80211_send_cqm(msg, gfp);
15245 return;
15246
15247 nla_put_failure:
15248 nlmsg_free(msg);
15249 }
15250 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15251
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)15252 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15253 {
15254 struct sk_buff *msg;
15255
15256 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15257 if (!msg)
15258 return;
15259
15260 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15261 goto nla_put_failure;
15262
15263 cfg80211_send_cqm(msg, gfp);
15264 return;
15265
15266 nla_put_failure:
15267 nlmsg_free(msg);
15268 }
15269 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15270
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)15271 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15272 struct net_device *netdev, const u8 *bssid,
15273 const u8 *replay_ctr, gfp_t gfp)
15274 {
15275 struct sk_buff *msg;
15276 struct nlattr *rekey_attr;
15277 void *hdr;
15278
15279 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15280 if (!msg)
15281 return;
15282
15283 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15284 if (!hdr) {
15285 nlmsg_free(msg);
15286 return;
15287 }
15288
15289 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15290 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15291 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15292 goto nla_put_failure;
15293
15294 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15295 if (!rekey_attr)
15296 goto nla_put_failure;
15297
15298 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15299 NL80211_REPLAY_CTR_LEN, replay_ctr))
15300 goto nla_put_failure;
15301
15302 nla_nest_end(msg, rekey_attr);
15303
15304 genlmsg_end(msg, hdr);
15305
15306 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15307 NL80211_MCGRP_MLME, gfp);
15308 return;
15309
15310 nla_put_failure:
15311 nlmsg_free(msg);
15312 }
15313
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)15314 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15315 const u8 *replay_ctr, gfp_t gfp)
15316 {
15317 struct wireless_dev *wdev = dev->ieee80211_ptr;
15318 struct wiphy *wiphy = wdev->wiphy;
15319 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15320
15321 trace_cfg80211_gtk_rekey_notify(dev, bssid);
15322 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15323 }
15324 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15325
15326 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)15327 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15328 struct net_device *netdev, int index,
15329 const u8 *bssid, bool preauth, gfp_t gfp)
15330 {
15331 struct sk_buff *msg;
15332 struct nlattr *attr;
15333 void *hdr;
15334
15335 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15336 if (!msg)
15337 return;
15338
15339 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15340 if (!hdr) {
15341 nlmsg_free(msg);
15342 return;
15343 }
15344
15345 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15346 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15347 goto nla_put_failure;
15348
15349 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15350 if (!attr)
15351 goto nla_put_failure;
15352
15353 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15354 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15355 (preauth &&
15356 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15357 goto nla_put_failure;
15358
15359 nla_nest_end(msg, attr);
15360
15361 genlmsg_end(msg, hdr);
15362
15363 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15364 NL80211_MCGRP_MLME, gfp);
15365 return;
15366
15367 nla_put_failure:
15368 nlmsg_free(msg);
15369 }
15370
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)15371 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15372 const u8 *bssid, bool preauth, gfp_t gfp)
15373 {
15374 struct wireless_dev *wdev = dev->ieee80211_ptr;
15375 struct wiphy *wiphy = wdev->wiphy;
15376 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15377
15378 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15379 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15380 }
15381 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15382
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count)15383 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15384 struct net_device *netdev,
15385 struct cfg80211_chan_def *chandef,
15386 gfp_t gfp,
15387 enum nl80211_commands notif,
15388 u8 count)
15389 {
15390 struct sk_buff *msg;
15391 void *hdr;
15392
15393 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15394 if (!msg)
15395 return;
15396
15397 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15398 if (!hdr) {
15399 nlmsg_free(msg);
15400 return;
15401 }
15402
15403 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15404 goto nla_put_failure;
15405
15406 if (nl80211_send_chandef(msg, chandef))
15407 goto nla_put_failure;
15408
15409 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15410 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15411 goto nla_put_failure;
15412
15413 genlmsg_end(msg, hdr);
15414
15415 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15416 NL80211_MCGRP_MLME, gfp);
15417 return;
15418
15419 nla_put_failure:
15420 nlmsg_free(msg);
15421 }
15422
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef)15423 void cfg80211_ch_switch_notify(struct net_device *dev,
15424 struct cfg80211_chan_def *chandef)
15425 {
15426 struct wireless_dev *wdev = dev->ieee80211_ptr;
15427 struct wiphy *wiphy = wdev->wiphy;
15428 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15429
15430 ASSERT_WDEV_LOCK(wdev);
15431
15432 trace_cfg80211_ch_switch_notify(dev, chandef);
15433
15434 wdev->chandef = *chandef;
15435 wdev->preset_chandef = *chandef;
15436 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15437 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15438 }
15439 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15440
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,u8 count)15441 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15442 struct cfg80211_chan_def *chandef,
15443 u8 count)
15444 {
15445 struct wireless_dev *wdev = dev->ieee80211_ptr;
15446 struct wiphy *wiphy = wdev->wiphy;
15447 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15448
15449 trace_cfg80211_ch_switch_started_notify(dev, chandef);
15450
15451 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15452 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15453 }
15454 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15455
15456 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)15457 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15458 const struct cfg80211_chan_def *chandef,
15459 enum nl80211_radar_event event,
15460 struct net_device *netdev, gfp_t gfp)
15461 {
15462 struct sk_buff *msg;
15463 void *hdr;
15464
15465 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15466 if (!msg)
15467 return;
15468
15469 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15470 if (!hdr) {
15471 nlmsg_free(msg);
15472 return;
15473 }
15474
15475 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15476 goto nla_put_failure;
15477
15478 /* NOP and radar events don't need a netdev parameter */
15479 if (netdev) {
15480 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15481
15482 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15483 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15484 NL80211_ATTR_PAD))
15485 goto nla_put_failure;
15486 }
15487
15488 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15489 goto nla_put_failure;
15490
15491 if (nl80211_send_chandef(msg, chandef))
15492 goto nla_put_failure;
15493
15494 genlmsg_end(msg, hdr);
15495
15496 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15497 NL80211_MCGRP_MLME, gfp);
15498 return;
15499
15500 nla_put_failure:
15501 nlmsg_free(msg);
15502 }
15503
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)15504 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15505 struct sta_opmode_info *sta_opmode,
15506 gfp_t gfp)
15507 {
15508 struct sk_buff *msg;
15509 struct wireless_dev *wdev = dev->ieee80211_ptr;
15510 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15511 void *hdr;
15512
15513 if (WARN_ON(!mac))
15514 return;
15515
15516 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15517 if (!msg)
15518 return;
15519
15520 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15521 if (!hdr) {
15522 nlmsg_free(msg);
15523 return;
15524 }
15525
15526 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15527 goto nla_put_failure;
15528
15529 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15530 goto nla_put_failure;
15531
15532 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15533 goto nla_put_failure;
15534
15535 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15536 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15537 goto nla_put_failure;
15538
15539 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15540 nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15541 goto nla_put_failure;
15542
15543 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15544 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15545 goto nla_put_failure;
15546
15547 genlmsg_end(msg, hdr);
15548
15549 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15550 NL80211_MCGRP_MLME, gfp);
15551
15552 return;
15553
15554 nla_put_failure:
15555 nlmsg_free(msg);
15556 }
15557 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15558
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)15559 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15560 u64 cookie, bool acked, s32 ack_signal,
15561 bool is_valid_ack_signal, gfp_t gfp)
15562 {
15563 struct wireless_dev *wdev = dev->ieee80211_ptr;
15564 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15565 struct sk_buff *msg;
15566 void *hdr;
15567
15568 trace_cfg80211_probe_status(dev, addr, cookie, acked);
15569
15570 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15571
15572 if (!msg)
15573 return;
15574
15575 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15576 if (!hdr) {
15577 nlmsg_free(msg);
15578 return;
15579 }
15580
15581 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15582 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15583 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15584 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15585 NL80211_ATTR_PAD) ||
15586 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15587 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15588 ack_signal)))
15589 goto nla_put_failure;
15590
15591 genlmsg_end(msg, hdr);
15592
15593 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15594 NL80211_MCGRP_MLME, gfp);
15595 return;
15596
15597 nla_put_failure:
15598 nlmsg_free(msg);
15599 }
15600 EXPORT_SYMBOL(cfg80211_probe_status);
15601
cfg80211_report_obss_beacon(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)15602 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15603 const u8 *frame, size_t len,
15604 int freq, int sig_dbm)
15605 {
15606 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15607 struct sk_buff *msg;
15608 void *hdr;
15609 struct cfg80211_beacon_registration *reg;
15610
15611 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15612
15613 spin_lock_bh(&rdev->beacon_registrations_lock);
15614 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15615 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15616 if (!msg) {
15617 spin_unlock_bh(&rdev->beacon_registrations_lock);
15618 return;
15619 }
15620
15621 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15622 if (!hdr)
15623 goto nla_put_failure;
15624
15625 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15626 (freq &&
15627 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15628 (sig_dbm &&
15629 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15630 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15631 goto nla_put_failure;
15632
15633 genlmsg_end(msg, hdr);
15634
15635 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15636 }
15637 spin_unlock_bh(&rdev->beacon_registrations_lock);
15638 return;
15639
15640 nla_put_failure:
15641 spin_unlock_bh(&rdev->beacon_registrations_lock);
15642 nlmsg_free(msg);
15643 }
15644 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15645
15646 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)15647 static int cfg80211_net_detect_results(struct sk_buff *msg,
15648 struct cfg80211_wowlan_wakeup *wakeup)
15649 {
15650 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15651 struct nlattr *nl_results, *nl_match, *nl_freqs;
15652 int i, j;
15653
15654 nl_results = nla_nest_start(
15655 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15656 if (!nl_results)
15657 return -EMSGSIZE;
15658
15659 for (i = 0; i < nd->n_matches; i++) {
15660 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15661
15662 nl_match = nla_nest_start(msg, i);
15663 if (!nl_match)
15664 break;
15665
15666 /* The SSID attribute is optional in nl80211, but for
15667 * simplicity reasons it's always present in the
15668 * cfg80211 structure. If a driver can't pass the
15669 * SSID, that needs to be changed. A zero length SSID
15670 * is still a valid SSID (wildcard), so it cannot be
15671 * used for this purpose.
15672 */
15673 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15674 match->ssid.ssid)) {
15675 nla_nest_cancel(msg, nl_match);
15676 goto out;
15677 }
15678
15679 if (match->n_channels) {
15680 nl_freqs = nla_nest_start(
15681 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15682 if (!nl_freqs) {
15683 nla_nest_cancel(msg, nl_match);
15684 goto out;
15685 }
15686
15687 for (j = 0; j < match->n_channels; j++) {
15688 if (nla_put_u32(msg, j, match->channels[j])) {
15689 nla_nest_cancel(msg, nl_freqs);
15690 nla_nest_cancel(msg, nl_match);
15691 goto out;
15692 }
15693 }
15694
15695 nla_nest_end(msg, nl_freqs);
15696 }
15697
15698 nla_nest_end(msg, nl_match);
15699 }
15700
15701 out:
15702 nla_nest_end(msg, nl_results);
15703 return 0;
15704 }
15705
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)15706 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15707 struct cfg80211_wowlan_wakeup *wakeup,
15708 gfp_t gfp)
15709 {
15710 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15711 struct sk_buff *msg;
15712 void *hdr;
15713 int size = 200;
15714
15715 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15716
15717 if (wakeup)
15718 size += wakeup->packet_present_len;
15719
15720 msg = nlmsg_new(size, gfp);
15721 if (!msg)
15722 return;
15723
15724 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15725 if (!hdr)
15726 goto free_msg;
15727
15728 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15729 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15730 NL80211_ATTR_PAD))
15731 goto free_msg;
15732
15733 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15734 wdev->netdev->ifindex))
15735 goto free_msg;
15736
15737 if (wakeup) {
15738 struct nlattr *reasons;
15739
15740 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15741 if (!reasons)
15742 goto free_msg;
15743
15744 if (wakeup->disconnect &&
15745 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15746 goto free_msg;
15747 if (wakeup->magic_pkt &&
15748 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15749 goto free_msg;
15750 if (wakeup->gtk_rekey_failure &&
15751 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15752 goto free_msg;
15753 if (wakeup->eap_identity_req &&
15754 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15755 goto free_msg;
15756 if (wakeup->four_way_handshake &&
15757 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15758 goto free_msg;
15759 if (wakeup->rfkill_release &&
15760 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15761 goto free_msg;
15762
15763 if (wakeup->pattern_idx >= 0 &&
15764 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15765 wakeup->pattern_idx))
15766 goto free_msg;
15767
15768 if (wakeup->tcp_match &&
15769 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15770 goto free_msg;
15771
15772 if (wakeup->tcp_connlost &&
15773 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15774 goto free_msg;
15775
15776 if (wakeup->tcp_nomoretokens &&
15777 nla_put_flag(msg,
15778 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15779 goto free_msg;
15780
15781 if (wakeup->packet) {
15782 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15783 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15784
15785 if (!wakeup->packet_80211) {
15786 pkt_attr =
15787 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15788 len_attr =
15789 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15790 }
15791
15792 if (wakeup->packet_len &&
15793 nla_put_u32(msg, len_attr, wakeup->packet_len))
15794 goto free_msg;
15795
15796 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15797 wakeup->packet))
15798 goto free_msg;
15799 }
15800
15801 if (wakeup->net_detect &&
15802 cfg80211_net_detect_results(msg, wakeup))
15803 goto free_msg;
15804
15805 nla_nest_end(msg, reasons);
15806 }
15807
15808 genlmsg_end(msg, hdr);
15809
15810 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15811 NL80211_MCGRP_MLME, gfp);
15812 return;
15813
15814 free_msg:
15815 nlmsg_free(msg);
15816 }
15817 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15818 #endif
15819
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)15820 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15821 enum nl80211_tdls_operation oper,
15822 u16 reason_code, gfp_t gfp)
15823 {
15824 struct wireless_dev *wdev = dev->ieee80211_ptr;
15825 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15826 struct sk_buff *msg;
15827 void *hdr;
15828
15829 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15830 reason_code);
15831
15832 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15833 if (!msg)
15834 return;
15835
15836 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15837 if (!hdr) {
15838 nlmsg_free(msg);
15839 return;
15840 }
15841
15842 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15843 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15844 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15845 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15846 (reason_code > 0 &&
15847 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15848 goto nla_put_failure;
15849
15850 genlmsg_end(msg, hdr);
15851
15852 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15853 NL80211_MCGRP_MLME, gfp);
15854 return;
15855
15856 nla_put_failure:
15857 nlmsg_free(msg);
15858 }
15859 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15860
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)15861 static int nl80211_netlink_notify(struct notifier_block * nb,
15862 unsigned long state,
15863 void *_notify)
15864 {
15865 struct netlink_notify *notify = _notify;
15866 struct cfg80211_registered_device *rdev;
15867 struct wireless_dev *wdev;
15868 struct cfg80211_beacon_registration *reg, *tmp;
15869
15870 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15871 return NOTIFY_DONE;
15872
15873 rcu_read_lock();
15874
15875 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15876 struct cfg80211_sched_scan_request *sched_scan_req;
15877
15878 list_for_each_entry_rcu(sched_scan_req,
15879 &rdev->sched_scan_req_list,
15880 list) {
15881 if (sched_scan_req->owner_nlportid == notify->portid) {
15882 sched_scan_req->nl_owner_dead = true;
15883 schedule_work(&rdev->sched_scan_stop_wk);
15884 }
15885 }
15886
15887 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15888 cfg80211_mlme_unregister_socket(wdev, notify->portid);
15889
15890 if (wdev->owner_nlportid == notify->portid) {
15891 wdev->nl_owner_dead = true;
15892 schedule_work(&rdev->destroy_work);
15893 } else if (wdev->conn_owner_nlportid == notify->portid) {
15894 schedule_work(&wdev->disconnect_wk);
15895 }
15896 }
15897
15898 spin_lock_bh(&rdev->beacon_registrations_lock);
15899 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15900 list) {
15901 if (reg->nlportid == notify->portid) {
15902 list_del(®->list);
15903 kfree(reg);
15904 break;
15905 }
15906 }
15907 spin_unlock_bh(&rdev->beacon_registrations_lock);
15908 }
15909
15910 rcu_read_unlock();
15911
15912 /*
15913 * It is possible that the user space process that is controlling the
15914 * indoor setting disappeared, so notify the regulatory core.
15915 */
15916 regulatory_netlink_notify(notify->portid);
15917 return NOTIFY_OK;
15918 }
15919
15920 static struct notifier_block nl80211_netlink_notifier = {
15921 .notifier_call = nl80211_netlink_notify,
15922 };
15923
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)15924 void cfg80211_ft_event(struct net_device *netdev,
15925 struct cfg80211_ft_event_params *ft_event)
15926 {
15927 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15928 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15929 struct sk_buff *msg;
15930 void *hdr;
15931
15932 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15933
15934 if (!ft_event->target_ap)
15935 return;
15936
15937 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
15938 GFP_KERNEL);
15939 if (!msg)
15940 return;
15941
15942 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15943 if (!hdr)
15944 goto out;
15945
15946 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15947 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15948 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15949 goto out;
15950
15951 if (ft_event->ies &&
15952 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15953 goto out;
15954 if (ft_event->ric_ies &&
15955 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15956 ft_event->ric_ies))
15957 goto out;
15958
15959 genlmsg_end(msg, hdr);
15960
15961 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15962 NL80211_MCGRP_MLME, GFP_KERNEL);
15963 return;
15964 out:
15965 nlmsg_free(msg);
15966 }
15967 EXPORT_SYMBOL(cfg80211_ft_event);
15968
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)15969 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15970 {
15971 struct cfg80211_registered_device *rdev;
15972 struct sk_buff *msg;
15973 void *hdr;
15974 u32 nlportid;
15975
15976 rdev = wiphy_to_rdev(wdev->wiphy);
15977 if (!rdev->crit_proto_nlportid)
15978 return;
15979
15980 nlportid = rdev->crit_proto_nlportid;
15981 rdev->crit_proto_nlportid = 0;
15982
15983 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15984 if (!msg)
15985 return;
15986
15987 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15988 if (!hdr)
15989 goto nla_put_failure;
15990
15991 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15992 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15993 NL80211_ATTR_PAD))
15994 goto nla_put_failure;
15995
15996 genlmsg_end(msg, hdr);
15997
15998 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15999 return;
16000
16001 nla_put_failure:
16002 nlmsg_free(msg);
16003 }
16004 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16005
nl80211_send_ap_stopped(struct wireless_dev * wdev)16006 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16007 {
16008 struct wiphy *wiphy = wdev->wiphy;
16009 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16010 struct sk_buff *msg;
16011 void *hdr;
16012
16013 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16014 if (!msg)
16015 return;
16016
16017 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16018 if (!hdr)
16019 goto out;
16020
16021 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16022 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16023 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16024 NL80211_ATTR_PAD))
16025 goto out;
16026
16027 genlmsg_end(msg, hdr);
16028
16029 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16030 NL80211_MCGRP_MLME, GFP_KERNEL);
16031 return;
16032 out:
16033 nlmsg_free(msg);
16034 }
16035
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)16036 int cfg80211_external_auth_request(struct net_device *dev,
16037 struct cfg80211_external_auth_params *params,
16038 gfp_t gfp)
16039 {
16040 struct wireless_dev *wdev = dev->ieee80211_ptr;
16041 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16042 struct sk_buff *msg;
16043 void *hdr;
16044
16045 if (!wdev->conn_owner_nlportid)
16046 return -EINVAL;
16047
16048 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16049 if (!msg)
16050 return -ENOMEM;
16051
16052 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16053 if (!hdr)
16054 goto nla_put_failure;
16055
16056 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16057 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16058 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16059 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16060 params->action) ||
16061 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16062 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16063 params->ssid.ssid))
16064 goto nla_put_failure;
16065
16066 genlmsg_end(msg, hdr);
16067 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16068 wdev->conn_owner_nlportid);
16069 return 0;
16070
16071 nla_put_failure:
16072 nlmsg_free(msg);
16073 return -ENOBUFS;
16074 }
16075 EXPORT_SYMBOL(cfg80211_external_auth_request);
16076
16077 /* initialisation/exit functions */
16078
nl80211_init(void)16079 int __init nl80211_init(void)
16080 {
16081 int err;
16082
16083 err = genl_register_family(&nl80211_fam);
16084 if (err)
16085 return err;
16086
16087 err = netlink_register_notifier(&nl80211_netlink_notifier);
16088 if (err)
16089 goto err_out;
16090
16091 return 0;
16092 err_out:
16093 genl_unregister_family(&nl80211_fam);
16094 return err;
16095 }
16096
nl80211_exit(void)16097 void nl80211_exit(void)
16098 {
16099 netlink_unregister_notifier(&nl80211_netlink_notifier);
16100 genl_unregister_family(&nl80211_fam);
16101 }
16102
