1. 06 7月, 2018 1 次提交
    • D
      nl80211/mac80211: allow non-linear skb in rx_control_port · a948f713
      Denis Kenzior 提交于
      The current implementation of cfg80211_rx_control_port assumed that the
      caller could provide a contiguous region of memory for the control port
      frame to be sent up to userspace.  Unfortunately, many drivers produce
      non-linear skbs, especially for data frames.  This resulted in userspace
      getting notified of control port frames with correct metadata (from
      address, port, etc) yet garbage / nonsense contents, resulting in bad
      handshakes, disconnections, etc.
      
      mac80211 linearizes skbs containing management frames.  But it didn't
      seem worthwhile to do this for control port frames.  Thus the signature
      of cfg80211_rx_control_port was changed to take the skb directly.
      nl80211 then takes care of obtaining control port frame data directly
      from the (linear | non-linear) skb.
      
      The caller is still responsible for freeing the skb,
      cfg80211_rx_control_port does not take ownership of it.
      
      Fixes: 6a671a50 ("nl80211: Add CMD_CONTROL_PORT_FRAME API")
      Signed-off-by: NDenis Kenzior <denkenz@gmail.com>
      [fix some kernel-doc formatting, add fixes tag]
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      a948f713
  2. 29 6月, 2018 2 次提交
    • J
      nl80211: check nla_parse_nested() return values · 95bca62f
      Johannes Berg 提交于
      At the very least we should check the return value if
      nla_parse_nested() is called with a non-NULL policy.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      95bca62f
    • B
      nl80211: relax ht operation checks for mesh · 188f60ab
      Bob Copeland 提交于
      Commit 9757235f, "nl80211: correct checks for
      NL80211_MESHCONF_HT_OPMODE value") relaxed the range for the HT
      operation field in meshconf, while also adding checks requiring
      the non-greenfield and non-ht-sta bits to be set in certain
      circumstances.  The latter bit is actually reserved for mesh BSSes
      according to Table 9-168 in 802.11-2016, so in fact it should not
      be set.
      
      wpa_supplicant sets these bits because the mesh and AP code share
      the same implementation, but authsae does not.  As a result, some
      meshconf updates from authsae which set only the NONHT_MIXED
      protection bits were being rejected.
      
      In order to avoid breaking userspace by changing the rules again,
      simply accept the values with or without the bits set, and mask
      off the reserved bit to match the spec.
      
      While in here, update the 802.11-2012 reference to 802.11-2016.
      
      Fixes: 9757235f ("nl80211: correct checks for NL80211_MESHCONF_HT_OPMODE value")
      Cc: Masashi Honma <masashi.honma@gmail.com>
      Signed-off-by: NBob Copeland <bobcopeland@fb.com>
      Reviewed-by: NMasashi Honma <masashi.honma@gmail.com>
      Reviewed-by: NMasashi Honma <masashi.honma@gmail.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      188f60ab
  3. 15 6月, 2018 2 次提交
    • D
      cfg80211: fix rcu in cfg80211_unregister_wdev · bf2b61a6
      Dedy Lansky 提交于
      Callers of cfg80211_unregister_wdev can free the wdev object
      immediately after this function returns. This may crash the kernel
      because this wdev object is still in use by other threads.
      Add synchronize_rcu() after list_del_rcu to make sure wdev object can
      be safely freed.
      Signed-off-by: NDedy Lansky <dlansky@codeaurora.org>
      Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
      bf2b61a6
    • S
      cfg80211: initialize sinfo in cfg80211_get_station · 3c12d048
      Sven Eckelmann 提交于
      Most of the implementations behind cfg80211_get_station will not initialize
      sinfo to zero before manipulating it. For example, the member "filled",
      which indicates the filled in parts of this struct, is often only modified
      by enabling certain bits in the bitfield while keeping the remaining bits
      in their original state. A caller without a preinitialized sinfo.filled can
      then no longer decide which parts of sinfo were filled in by
      cfg80211_get_station (or actually the underlying implementations).
      
      cfg80211_get_station must therefore take care that sinfo is initialized to
      zero. Otherwise, the caller may tries to read information which was not
      filled in and which must therefore also be considered uninitialized. In
      batadv_v_elp_get_throughput's case, an invalid "random" expected throughput
      may be stored for this neighbor and thus the B.A.T.M.A.N V algorithm may
      switch to non-optimal neighbors for certain destinations.
      
      Fixes: 7406353d ("cfg80211: implement cfg80211_get_station cfg80211 API")
      Reported-by: NThomas Lauer <holminateur@gmail.com>
      Reported-by: NMarcel Schmidt <ff.z-casparistrasse@mailbox.org>
      Cc: b.a.t.m.a.n@lists.open-mesh.org
      Signed-off-by: NSven Eckelmann <sven@narfation.org>
      Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
      3c12d048
  4. 13 6月, 2018 1 次提交
    • K
      treewide: kzalloc() -> kcalloc() · 6396bb22
      Kees Cook 提交于
      The kzalloc() function has a 2-factor argument form, kcalloc(). This
      patch replaces cases of:
      
              kzalloc(a * b, gfp)
      
      with:
              kcalloc(a * b, gfp)
      
      as well as handling cases of:
      
              kzalloc(a * b * c, gfp)
      
      with:
      
              kzalloc(array3_size(a, b, c), gfp)
      
      as it's slightly less ugly than:
      
              kzalloc_array(array_size(a, b), c, gfp)
      
      This does, however, attempt to ignore constant size factors like:
      
              kzalloc(4 * 1024, gfp)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      type TYPE;
      expression THING, E;
      @@
      
      (
        kzalloc(
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        kzalloc(
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        kzalloc(
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        kzalloc(
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * (COUNT_ID)
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * COUNT_ID
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * COUNT_CONST
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * (COUNT_ID)
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * COUNT_ID
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * COUNT_CONST
      +	COUNT_CONST, sizeof(THING)
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      identifier SIZE, COUNT;
      @@
      
      - kzalloc
      + kcalloc
        (
      -	SIZE * COUNT
      +	COUNT, SIZE
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        kzalloc(
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kzalloc(
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        kzalloc(
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kzalloc(
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kzalloc(
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        kzalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        kzalloc(
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kzalloc(
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products,
      // when they're not all constants...
      @@
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        kzalloc(C1 * C2 * C3, ...)
      |
        kzalloc(
      -	(E1) * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kzalloc(
      -	(E1) * (E2) * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kzalloc(
      -	(E1) * (E2) * (E3)
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kzalloc(
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants,
      // keeping sizeof() as the second factor argument.
      @@
      expression THING, E1, E2;
      type TYPE;
      constant C1, C2, C3;
      @@
      
      (
        kzalloc(sizeof(THING) * C2, ...)
      |
        kzalloc(sizeof(TYPE) * C2, ...)
      |
        kzalloc(C1 * C2 * C3, ...)
      |
        kzalloc(C1 * C2, ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * (E2)
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(TYPE) * E2
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * (E2)
      +	E2, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	sizeof(THING) * E2
      +	E2, sizeof(THING)
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	(E1) * E2
      +	E1, E2
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	(E1) * (E2)
      +	E1, E2
        , ...)
      |
      - kzalloc
      + kcalloc
        (
      -	E1 * E2
      +	E1, E2
        , ...)
      )
      Signed-off-by: NKees Cook <keescook@chromium.org>
      6396bb22
  5. 23 5月, 2018 5 次提交
  6. 22 5月, 2018 2 次提交
  7. 18 5月, 2018 5 次提交
  8. 16 5月, 2018 1 次提交
  9. 08 5月, 2018 4 次提交
    • T
      cfg80211: Expose TXQ stats and parameters to userspace · 52539ca8
      Toke Høiland-Jørgensen 提交于
      This adds support for exporting the mac80211 TXQ stats via nl80211 by
      way of a nested TXQ stats attribute, as well as for configuring the
      quantum and limits that were previously only changeable through debugfs.
      
      This commit adds just the nl80211 API, a subsequent commit adds support to
      mac80211 itself.
      Signed-off-by: NToke Høiland-Jørgensen <toke@toke.dk>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      52539ca8
    • B
      cfg80211: average ack rssi support for data frames · 81d5439d
      Balaji Pothunoori 提交于
      Average ack rssi will be given to userspace via NL80211 interface
      if firmware is capable. Userspace tool ‘iw’ can process this
      information and give the output as one of the fields in
      ‘iw dev wlanX station dump’.
      
      Example output :
      
      localhost ~ #iw dev wlan-5000mhz station dump Station
      34:f3:9a:aa:3b:29 (on wlan-5000mhz)
              inactive time:  5370 ms
              rx bytes:       85321
              rx packets:     576
              tx bytes:       14225
              tx packets:     71
              tx retries:     0
              tx failed:      2
              beacon loss:    0
              rx drop misc:   0
              signal:         -54 dBm
              signal avg:     -53 dBm
              tx bitrate:     866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2
              rx bitrate:     866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2
              avg ack signal: -56 dBm
              authorized:     yes
              authenticated:  yes
              associated:     yes
              preamble:       short
              WMM/WME:        yes
              MFP:            no
              TDLS peer:      no
              DTIM period:    2
              beacon interval:100
             short preamble: yes
             short slot time:yes
             connected time: 203 seconds
      
      Main use case is to measure the signal strength of a connected station
      to AP. Data packet transmit rates and bandwidth used by station can vary
      a lot even if the station is at fixed location, especially if the rates
      used are multi stream(2stream, 3stream) rates with different bandwidth(20/40/80 Mhz).
      These multi stream rates are sensitive and station can use different transmit power
      for each of the rate and bandwidth combinations. RSSI measured from these RX packets
      on AP will be not stable and can vary a lot with in a short time.
      Whereas 802.11 ack frames from station are sent relatively at a constant
      rate (6/12/24 Mbps) with constant bandwidth(20 Mhz).
      So average rssi of the ack packets is good and more accurate.
      Signed-off-by: NBalaji Pothunoori <bpothuno@codeaurora.org>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      81d5439d
    • A
      cfg80211: Call reg_notifier for self managed hints conditionally · aced43ce
      Amar Singhal 提交于
      Currently the regulatory core does not call the regulatory callback
      reg_notifier for self managed wiphys, but regulatory_hint_user() call is
      independent of wiphy and is meant for all wiphys in the system. Even a
      self managed wiphy may be interested in regulatory_hint_user() to know
      the country code from a trusted regulatory domain change like a cellular
      base station. Therefore, for the regulatory source
      NL80211_REGDOM_SET_BY_USER and the user hint type
      NL80211_USER_REG_HINT_CELL_BASE, call the regulatory notifier.
      
      No current wlan driver uses the REGULATORY_WIPHY_SELF_MANAGED flag while
      also registering the reg_notifier regulatory callback, therefore there
      will be no impact on existing drivers without them being explicitly
      modified to take advantage of this new possibility.
      Signed-off-by: NAmar Singhal <asinghal@codeaurora.org>
      Signed-off-by: NJouni Malinen <jouni@codeaurora.org>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      aced43ce
    • H
      nl80211: Add wmm rule attribute to NL80211_CMD_GET_WIPHY dump command · 50f32718
      Haim Dreyfuss 提交于
      This will serve userspace entity to maintain its regulatory limitation.
      More specifcally APs can use this data to calculate the WMM IE when
      building: beacons, probe responses, assoc responses etc...
      Signed-off-by: NHaim Dreyfuss <haim.dreyfuss@intel.com>
      Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      50f32718
  10. 20 4月, 2018 1 次提交
  11. 19 4月, 2018 3 次提交
  12. 30 3月, 2018 2 次提交
    • K
      net: Don't take rtnl_lock() in wireless_nlevent_flush() · 10256deb
      Kirill Tkhai 提交于
      This function iterates over net_namespace_list and flushes
      the queue for every of them. What does this rtnl_lock()
      protects?! Since we may add skbs to net::wext_nlevents
      without rtnl_lock(), it does not protects us about queuers.
      
      It guarantees, two threads can't flush the queue in parallel,
      that can change the order, but since skb can be queued
      in any order, it doesn't matter, how many threads do this
      in parallel. In case of several threads, this will be even
      faster.
      
      So, we can remove rtnl_lock() here, as it was used for
      iteration over net_namespace_list only.
      Signed-off-by: NKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      10256deb
    • K
      net: Introduce net_rwsem to protect net_namespace_list · f0b07bb1
      Kirill Tkhai 提交于
      rtnl_lock() is used everywhere, and contention is very high.
      When someone wants to iterate over alive net namespaces,
      he/she has no a possibility to do that without exclusive lock.
      But the exclusive rtnl_lock() in such places is overkill,
      and it just increases the contention. Yes, there is already
      for_each_net_rcu() in kernel, but it requires rcu_read_lock(),
      and this can't be sleepable. Also, sometimes it may be need
      really prevent net_namespace_list growth, so for_each_net_rcu()
      is not fit there.
      
      This patch introduces new rw_semaphore, which will be used
      instead of rtnl_mutex to protect net_namespace_list. It is
      sleepable and allows not-exclusive iterations over net
      namespaces list. It allows to stop using rtnl_lock()
      in several places (what is made in next patches) and makes
      less the time, we keep rtnl_mutex. Here we just add new lock,
      while the explanation of we can remove rtnl_lock() there are
      in next patches.
      
      Fine grained locks generally are better, then one big lock,
      so let's do that with net_namespace_list, while the situation
      allows that.
      Signed-off-by: NKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f0b07bb1
  13. 29 3月, 2018 11 次提交