1/* 2 * This file implement the Wireless Extensions core API. 3 * 4 * Authors : Jean Tourrilhes - HPL - <jt@hpl.hp.com> 5 * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved. 6 * Copyright 2009 Johannes Berg <johannes@sipsolutions.net> 7 * 8 * (As all part of the Linux kernel, this file is GPL) 9 */ 10#include <linux/kernel.h> 11#include <linux/netdevice.h> 12#include <linux/rtnetlink.h> 13#include <linux/slab.h> 14#include <linux/wireless.h> 15#include <linux/uaccess.h> 16#include <linux/export.h> 17#include <net/cfg80211.h> 18#include <net/iw_handler.h> 19#include <net/netlink.h> 20#include <net/wext.h> 21#include <net/net_namespace.h> 22 23typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *, 24 unsigned int, struct iw_request_info *, 25 iw_handler); 26 27 28/* 29 * Meta-data about all the standard Wireless Extension request we 30 * know about. 31 */ 32static const struct iw_ioctl_description standard_ioctl[] = { 33 [IW_IOCTL_IDX(SIOCSIWCOMMIT)] = { 34 .header_type = IW_HEADER_TYPE_NULL, 35 }, 36 [IW_IOCTL_IDX(SIOCGIWNAME)] = { 37 .header_type = IW_HEADER_TYPE_CHAR, 38 .flags = IW_DESCR_FLAG_DUMP, 39 }, 40 [IW_IOCTL_IDX(SIOCSIWNWID)] = { 41 .header_type = IW_HEADER_TYPE_PARAM, 42 .flags = IW_DESCR_FLAG_EVENT, 43 }, 44 [IW_IOCTL_IDX(SIOCGIWNWID)] = { 45 .header_type = IW_HEADER_TYPE_PARAM, 46 .flags = IW_DESCR_FLAG_DUMP, 47 }, 48 [IW_IOCTL_IDX(SIOCSIWFREQ)] = { 49 .header_type = IW_HEADER_TYPE_FREQ, 50 .flags = IW_DESCR_FLAG_EVENT, 51 }, 52 [IW_IOCTL_IDX(SIOCGIWFREQ)] = { 53 .header_type = IW_HEADER_TYPE_FREQ, 54 .flags = IW_DESCR_FLAG_DUMP, 55 }, 56 [IW_IOCTL_IDX(SIOCSIWMODE)] = { 57 .header_type = IW_HEADER_TYPE_UINT, 58 .flags = IW_DESCR_FLAG_EVENT, 59 }, 60 [IW_IOCTL_IDX(SIOCGIWMODE)] = { 61 .header_type = IW_HEADER_TYPE_UINT, 62 .flags = IW_DESCR_FLAG_DUMP, 63 }, 64 [IW_IOCTL_IDX(SIOCSIWSENS)] = { 65 .header_type = IW_HEADER_TYPE_PARAM, 66 }, 67 [IW_IOCTL_IDX(SIOCGIWSENS)] = { 68 .header_type = IW_HEADER_TYPE_PARAM, 69 }, 70 [IW_IOCTL_IDX(SIOCSIWRANGE)] = { 71 .header_type = IW_HEADER_TYPE_NULL, 72 }, 73 [IW_IOCTL_IDX(SIOCGIWRANGE)] = { 74 .header_type = IW_HEADER_TYPE_POINT, 75 .token_size = 1, 76 .max_tokens = sizeof(struct iw_range), 77 .flags = IW_DESCR_FLAG_DUMP, 78 }, 79 [IW_IOCTL_IDX(SIOCSIWPRIV)] = { 80 .header_type = IW_HEADER_TYPE_NULL, 81 }, 82 [IW_IOCTL_IDX(SIOCGIWPRIV)] = { /* (handled directly by us) */ 83 .header_type = IW_HEADER_TYPE_POINT, 84 .token_size = sizeof(struct iw_priv_args), 85 .max_tokens = 16, 86 .flags = IW_DESCR_FLAG_NOMAX, 87 }, 88 [IW_IOCTL_IDX(SIOCSIWSTATS)] = { 89 .header_type = IW_HEADER_TYPE_NULL, 90 }, 91 [IW_IOCTL_IDX(SIOCGIWSTATS)] = { /* (handled directly by us) */ 92 .header_type = IW_HEADER_TYPE_POINT, 93 .token_size = 1, 94 .max_tokens = sizeof(struct iw_statistics), 95 .flags = IW_DESCR_FLAG_DUMP, 96 }, 97 [IW_IOCTL_IDX(SIOCSIWSPY)] = { 98 .header_type = IW_HEADER_TYPE_POINT, 99 .token_size = sizeof(struct sockaddr), 100 .max_tokens = IW_MAX_SPY, 101 }, 102 [IW_IOCTL_IDX(SIOCGIWSPY)] = { 103 .header_type = IW_HEADER_TYPE_POINT, 104 .token_size = sizeof(struct sockaddr) + 105 sizeof(struct iw_quality), 106 .max_tokens = IW_MAX_SPY, 107 }, 108 [IW_IOCTL_IDX(SIOCSIWTHRSPY)] = { 109 .header_type = IW_HEADER_TYPE_POINT, 110 .token_size = sizeof(struct iw_thrspy), 111 .min_tokens = 1, 112 .max_tokens = 1, 113 }, 114 [IW_IOCTL_IDX(SIOCGIWTHRSPY)] = { 115 .header_type = IW_HEADER_TYPE_POINT, 116 .token_size = sizeof(struct iw_thrspy), 117 .min_tokens = 1, 118 .max_tokens = 1, 119 }, 120 [IW_IOCTL_IDX(SIOCSIWAP)] = { 121 .header_type = IW_HEADER_TYPE_ADDR, 122 }, 123 [IW_IOCTL_IDX(SIOCGIWAP)] = { 124 .header_type = IW_HEADER_TYPE_ADDR, 125 .flags = IW_DESCR_FLAG_DUMP, 126 }, 127 [IW_IOCTL_IDX(SIOCSIWMLME)] = { 128 .header_type = IW_HEADER_TYPE_POINT, 129 .token_size = 1, 130 .min_tokens = sizeof(struct iw_mlme), 131 .max_tokens = sizeof(struct iw_mlme), 132 }, 133 [IW_IOCTL_IDX(SIOCGIWAPLIST)] = { 134 .header_type = IW_HEADER_TYPE_POINT, 135 .token_size = sizeof(struct sockaddr) + 136 sizeof(struct iw_quality), 137 .max_tokens = IW_MAX_AP, 138 .flags = IW_DESCR_FLAG_NOMAX, 139 }, 140 [IW_IOCTL_IDX(SIOCSIWSCAN)] = { 141 .header_type = IW_HEADER_TYPE_POINT, 142 .token_size = 1, 143 .min_tokens = 0, 144 .max_tokens = sizeof(struct iw_scan_req), 145 }, 146 [IW_IOCTL_IDX(SIOCGIWSCAN)] = { 147 .header_type = IW_HEADER_TYPE_POINT, 148 .token_size = 1, 149 .max_tokens = IW_SCAN_MAX_DATA, 150 .flags = IW_DESCR_FLAG_NOMAX, 151 }, 152 [IW_IOCTL_IDX(SIOCSIWESSID)] = { 153 .header_type = IW_HEADER_TYPE_POINT, 154 .token_size = 1, 155 .max_tokens = IW_ESSID_MAX_SIZE, 156 .flags = IW_DESCR_FLAG_EVENT, 157 }, 158 [IW_IOCTL_IDX(SIOCGIWESSID)] = { 159 .header_type = IW_HEADER_TYPE_POINT, 160 .token_size = 1, 161 .max_tokens = IW_ESSID_MAX_SIZE, 162 .flags = IW_DESCR_FLAG_DUMP, 163 }, 164 [IW_IOCTL_IDX(SIOCSIWNICKN)] = { 165 .header_type = IW_HEADER_TYPE_POINT, 166 .token_size = 1, 167 .max_tokens = IW_ESSID_MAX_SIZE, 168 }, 169 [IW_IOCTL_IDX(SIOCGIWNICKN)] = { 170 .header_type = IW_HEADER_TYPE_POINT, 171 .token_size = 1, 172 .max_tokens = IW_ESSID_MAX_SIZE, 173 }, 174 [IW_IOCTL_IDX(SIOCSIWRATE)] = { 175 .header_type = IW_HEADER_TYPE_PARAM, 176 }, 177 [IW_IOCTL_IDX(SIOCGIWRATE)] = { 178 .header_type = IW_HEADER_TYPE_PARAM, 179 }, 180 [IW_IOCTL_IDX(SIOCSIWRTS)] = { 181 .header_type = IW_HEADER_TYPE_PARAM, 182 }, 183 [IW_IOCTL_IDX(SIOCGIWRTS)] = { 184 .header_type = IW_HEADER_TYPE_PARAM, 185 }, 186 [IW_IOCTL_IDX(SIOCSIWFRAG)] = { 187 .header_type = IW_HEADER_TYPE_PARAM, 188 }, 189 [IW_IOCTL_IDX(SIOCGIWFRAG)] = { 190 .header_type = IW_HEADER_TYPE_PARAM, 191 }, 192 [IW_IOCTL_IDX(SIOCSIWTXPOW)] = { 193 .header_type = IW_HEADER_TYPE_PARAM, 194 }, 195 [IW_IOCTL_IDX(SIOCGIWTXPOW)] = { 196 .header_type = IW_HEADER_TYPE_PARAM, 197 }, 198 [IW_IOCTL_IDX(SIOCSIWRETRY)] = { 199 .header_type = IW_HEADER_TYPE_PARAM, 200 }, 201 [IW_IOCTL_IDX(SIOCGIWRETRY)] = { 202 .header_type = IW_HEADER_TYPE_PARAM, 203 }, 204 [IW_IOCTL_IDX(SIOCSIWENCODE)] = { 205 .header_type = IW_HEADER_TYPE_POINT, 206 .token_size = 1, 207 .max_tokens = IW_ENCODING_TOKEN_MAX, 208 .flags = IW_DESCR_FLAG_EVENT | IW_DESCR_FLAG_RESTRICT, 209 }, 210 [IW_IOCTL_IDX(SIOCGIWENCODE)] = { 211 .header_type = IW_HEADER_TYPE_POINT, 212 .token_size = 1, 213 .max_tokens = IW_ENCODING_TOKEN_MAX, 214 .flags = IW_DESCR_FLAG_DUMP | IW_DESCR_FLAG_RESTRICT, 215 }, 216 [IW_IOCTL_IDX(SIOCSIWPOWER)] = { 217 .header_type = IW_HEADER_TYPE_PARAM, 218 }, 219 [IW_IOCTL_IDX(SIOCGIWPOWER)] = { 220 .header_type = IW_HEADER_TYPE_PARAM, 221 }, 222 [IW_IOCTL_IDX(SIOCSIWGENIE)] = { 223 .header_type = IW_HEADER_TYPE_POINT, 224 .token_size = 1, 225 .max_tokens = IW_GENERIC_IE_MAX, 226 }, 227 [IW_IOCTL_IDX(SIOCGIWGENIE)] = { 228 .header_type = IW_HEADER_TYPE_POINT, 229 .token_size = 1, 230 .max_tokens = IW_GENERIC_IE_MAX, 231 }, 232 [IW_IOCTL_IDX(SIOCSIWAUTH)] = { 233 .header_type = IW_HEADER_TYPE_PARAM, 234 }, 235 [IW_IOCTL_IDX(SIOCGIWAUTH)] = { 236 .header_type = IW_HEADER_TYPE_PARAM, 237 }, 238 [IW_IOCTL_IDX(SIOCSIWENCODEEXT)] = { 239 .header_type = IW_HEADER_TYPE_POINT, 240 .token_size = 1, 241 .min_tokens = sizeof(struct iw_encode_ext), 242 .max_tokens = sizeof(struct iw_encode_ext) + 243 IW_ENCODING_TOKEN_MAX, 244 }, 245 [IW_IOCTL_IDX(SIOCGIWENCODEEXT)] = { 246 .header_type = IW_HEADER_TYPE_POINT, 247 .token_size = 1, 248 .min_tokens = sizeof(struct iw_encode_ext), 249 .max_tokens = sizeof(struct iw_encode_ext) + 250 IW_ENCODING_TOKEN_MAX, 251 }, 252 [IW_IOCTL_IDX(SIOCSIWPMKSA)] = { 253 .header_type = IW_HEADER_TYPE_POINT, 254 .token_size = 1, 255 .min_tokens = sizeof(struct iw_pmksa), 256 .max_tokens = sizeof(struct iw_pmksa), 257 }, 258}; 259static const unsigned int standard_ioctl_num = ARRAY_SIZE(standard_ioctl); 260 261/* 262 * Meta-data about all the additional standard Wireless Extension events 263 * we know about. 264 */ 265static const struct iw_ioctl_description standard_event[] = { 266 [IW_EVENT_IDX(IWEVTXDROP)] = { 267 .header_type = IW_HEADER_TYPE_ADDR, 268 }, 269 [IW_EVENT_IDX(IWEVQUAL)] = { 270 .header_type = IW_HEADER_TYPE_QUAL, 271 }, 272 [IW_EVENT_IDX(IWEVCUSTOM)] = { 273 .header_type = IW_HEADER_TYPE_POINT, 274 .token_size = 1, 275 .max_tokens = IW_CUSTOM_MAX, 276 }, 277 [IW_EVENT_IDX(IWEVREGISTERED)] = { 278 .header_type = IW_HEADER_TYPE_ADDR, 279 }, 280 [IW_EVENT_IDX(IWEVEXPIRED)] = { 281 .header_type = IW_HEADER_TYPE_ADDR, 282 }, 283 [IW_EVENT_IDX(IWEVGENIE)] = { 284 .header_type = IW_HEADER_TYPE_POINT, 285 .token_size = 1, 286 .max_tokens = IW_GENERIC_IE_MAX, 287 }, 288 [IW_EVENT_IDX(IWEVMICHAELMICFAILURE)] = { 289 .header_type = IW_HEADER_TYPE_POINT, 290 .token_size = 1, 291 .max_tokens = sizeof(struct iw_michaelmicfailure), 292 }, 293 [IW_EVENT_IDX(IWEVASSOCREQIE)] = { 294 .header_type = IW_HEADER_TYPE_POINT, 295 .token_size = 1, 296 .max_tokens = IW_GENERIC_IE_MAX, 297 }, 298 [IW_EVENT_IDX(IWEVASSOCRESPIE)] = { 299 .header_type = IW_HEADER_TYPE_POINT, 300 .token_size = 1, 301 .max_tokens = IW_GENERIC_IE_MAX, 302 }, 303 [IW_EVENT_IDX(IWEVPMKIDCAND)] = { 304 .header_type = IW_HEADER_TYPE_POINT, 305 .token_size = 1, 306 .max_tokens = sizeof(struct iw_pmkid_cand), 307 }, 308}; 309static const unsigned int standard_event_num = ARRAY_SIZE(standard_event); 310 311/* Size (in bytes) of various events */ 312static const int event_type_size[] = { 313 IW_EV_LCP_LEN, /* IW_HEADER_TYPE_NULL */ 314 0, 315 IW_EV_CHAR_LEN, /* IW_HEADER_TYPE_CHAR */ 316 0, 317 IW_EV_UINT_LEN, /* IW_HEADER_TYPE_UINT */ 318 IW_EV_FREQ_LEN, /* IW_HEADER_TYPE_FREQ */ 319 IW_EV_ADDR_LEN, /* IW_HEADER_TYPE_ADDR */ 320 0, 321 IW_EV_POINT_LEN, /* Without variable payload */ 322 IW_EV_PARAM_LEN, /* IW_HEADER_TYPE_PARAM */ 323 IW_EV_QUAL_LEN, /* IW_HEADER_TYPE_QUAL */ 324}; 325 326#ifdef CONFIG_COMPAT 327static const int compat_event_type_size[] = { 328 IW_EV_COMPAT_LCP_LEN, /* IW_HEADER_TYPE_NULL */ 329 0, 330 IW_EV_COMPAT_CHAR_LEN, /* IW_HEADER_TYPE_CHAR */ 331 0, 332 IW_EV_COMPAT_UINT_LEN, /* IW_HEADER_TYPE_UINT */ 333 IW_EV_COMPAT_FREQ_LEN, /* IW_HEADER_TYPE_FREQ */ 334 IW_EV_COMPAT_ADDR_LEN, /* IW_HEADER_TYPE_ADDR */ 335 0, 336 IW_EV_COMPAT_POINT_LEN, /* Without variable payload */ 337 IW_EV_COMPAT_PARAM_LEN, /* IW_HEADER_TYPE_PARAM */ 338 IW_EV_COMPAT_QUAL_LEN, /* IW_HEADER_TYPE_QUAL */ 339}; 340#endif 341 342 343/* IW event code */ 344 345static int __net_init wext_pernet_init(struct net *net) 346{ 347 skb_queue_head_init(&net->wext_nlevents); 348 return 0; 349} 350 351static void __net_exit wext_pernet_exit(struct net *net) 352{ 353 skb_queue_purge(&net->wext_nlevents); 354} 355 356static struct pernet_operations wext_pernet_ops = { 357 .init = wext_pernet_init, 358 .exit = wext_pernet_exit, 359}; 360 361static int __init wireless_nlevent_init(void) 362{ 363 return register_pernet_subsys(&wext_pernet_ops); 364} 365 366subsys_initcall(wireless_nlevent_init); 367 368/* Process events generated by the wireless layer or the driver. */ 369static void wireless_nlevent_process(struct work_struct *work) 370{ 371 struct sk_buff *skb; 372 struct net *net; 373 374 rtnl_lock(); 375 376 for_each_net(net) { 377 while ((skb = skb_dequeue(&net->wext_nlevents))) 378 rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, 379 GFP_KERNEL); 380 } 381 382 rtnl_unlock(); 383} 384 385static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process); 386 387static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev, 388 struct sk_buff *skb) 389{ 390 struct ifinfomsg *r; 391 struct nlmsghdr *nlh; 392 393 nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0); 394 if (!nlh) 395 return NULL; 396 397 r = nlmsg_data(nlh); 398 r->ifi_family = AF_UNSPEC; 399 r->__ifi_pad = 0; 400 r->ifi_type = dev->type; 401 r->ifi_index = dev->ifindex; 402 r->ifi_flags = dev_get_flags(dev); 403 r->ifi_change = 0; /* Wireless changes don't affect those flags */ 404 405 if (nla_put_string(skb, IFLA_IFNAME, dev->name)) 406 goto nla_put_failure; 407 408 return nlh; 409 nla_put_failure: 410 nlmsg_cancel(skb, nlh); 411 return NULL; 412} 413 414 415/* 416 * Main event dispatcher. Called from other parts and drivers. 417 * Send the event on the appropriate channels. 418 * May be called from interrupt context. 419 */ 420void wireless_send_event(struct net_device * dev, 421 unsigned int cmd, 422 union iwreq_data * wrqu, 423 const char * extra) 424{ 425 const struct iw_ioctl_description * descr = NULL; 426 int extra_len = 0; 427 struct iw_event *event; /* Mallocated whole event */ 428 int event_len; /* Its size */ 429 int hdr_len; /* Size of the event header */ 430 int wrqu_off = 0; /* Offset in wrqu */ 431 /* Don't "optimise" the following variable, it will crash */ 432 unsigned int cmd_index; /* *MUST* be unsigned */ 433 struct sk_buff *skb; 434 struct nlmsghdr *nlh; 435 struct nlattr *nla; 436#ifdef CONFIG_COMPAT 437 struct __compat_iw_event *compat_event; 438 struct compat_iw_point compat_wrqu; 439 struct sk_buff *compskb; 440#endif 441 442 /* 443 * Nothing in the kernel sends scan events with data, be safe. 444 * This is necessary because we cannot fix up scan event data 445 * for compat, due to being contained in 'extra', but normally 446 * applications are required to retrieve the scan data anyway 447 * and no data is included in the event, this codifies that 448 * practice. 449 */ 450 if (WARN_ON(cmd == SIOCGIWSCAN && extra)) 451 extra = NULL; 452 453 /* Get the description of the Event */ 454 if (cmd <= SIOCIWLAST) { 455 cmd_index = IW_IOCTL_IDX(cmd); 456 if (cmd_index < standard_ioctl_num) 457 descr = &(standard_ioctl[cmd_index]); 458 } else { 459 cmd_index = IW_EVENT_IDX(cmd); 460 if (cmd_index < standard_event_num) 461 descr = &(standard_event[cmd_index]); 462 } 463 /* Don't accept unknown events */ 464 if (descr == NULL) { 465 /* Note : we don't return an error to the driver, because 466 * the driver would not know what to do about it. It can't 467 * return an error to the user, because the event is not 468 * initiated by a user request. 469 * The best the driver could do is to log an error message. 470 * We will do it ourselves instead... 471 */ 472 netdev_err(dev, "(WE) : Invalid/Unknown Wireless Event (0x%04X)\n", 473 cmd); 474 return; 475 } 476 477 /* Check extra parameters and set extra_len */ 478 if (descr->header_type == IW_HEADER_TYPE_POINT) { 479 /* Check if number of token fits within bounds */ 480 if (wrqu->data.length > descr->max_tokens) { 481 netdev_err(dev, "(WE) : Wireless Event (cmd=0x%04X) too big (%d)\n", 482 cmd, wrqu->data.length); 483 return; 484 } 485 if (wrqu->data.length < descr->min_tokens) { 486 netdev_err(dev, "(WE) : Wireless Event (cmd=0x%04X) too small (%d)\n", 487 cmd, wrqu->data.length); 488 return; 489 } 490 /* Calculate extra_len - extra is NULL for restricted events */ 491 if (extra != NULL) 492 extra_len = wrqu->data.length * descr->token_size; 493 /* Always at an offset in wrqu */ 494 wrqu_off = IW_EV_POINT_OFF; 495 } 496 497 /* Total length of the event */ 498 hdr_len = event_type_size[descr->header_type]; 499 event_len = hdr_len + extra_len; 500 501 /* 502 * The problem for 64/32 bit. 503 * 504 * On 64-bit, a regular event is laid out as follows: 505 * | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 506 * | event.len | event.cmd | p a d d i n g | 507 * | wrqu data ... (with the correct size) | 508 * 509 * This padding exists because we manipulate event->u, 510 * and 'event' is not packed. 511 * 512 * An iw_point event is laid out like this instead: 513 * | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 514 * | event.len | event.cmd | p a d d i n g | 515 * | iwpnt.len | iwpnt.flg | p a d d i n g | 516 * | extra data ... 517 * 518 * The second padding exists because struct iw_point is extended, 519 * but this depends on the platform... 520 * 521 * On 32-bit, all the padding shouldn't be there. 522 */ 523 524 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 525 if (!skb) 526 return; 527 528 /* Send via the RtNetlink event channel */ 529 nlh = rtnetlink_ifinfo_prep(dev, skb); 530 if (WARN_ON(!nlh)) { 531 kfree_skb(skb); 532 return; 533 } 534 535 /* Add the wireless events in the netlink packet */ 536 nla = nla_reserve(skb, IFLA_WIRELESS, event_len); 537 if (!nla) { 538 kfree_skb(skb); 539 return; 540 } 541 event = nla_data(nla); 542 543 /* Fill event - first clear to avoid data leaking */ 544 memset(event, 0, hdr_len); 545 event->len = event_len; 546 event->cmd = cmd; 547 memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN); 548 if (extra_len) 549 memcpy(((char *) event) + hdr_len, extra, extra_len); 550 551 nlmsg_end(skb, nlh); 552#ifdef CONFIG_COMPAT 553 hdr_len = compat_event_type_size[descr->header_type]; 554 event_len = hdr_len + extra_len; 555 556 compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 557 if (!compskb) { 558 kfree_skb(skb); 559 return; 560 } 561 562 /* Send via the RtNetlink event channel */ 563 nlh = rtnetlink_ifinfo_prep(dev, compskb); 564 if (WARN_ON(!nlh)) { 565 kfree_skb(skb); 566 kfree_skb(compskb); 567 return; 568 } 569 570 /* Add the wireless events in the netlink packet */ 571 nla = nla_reserve(compskb, IFLA_WIRELESS, event_len); 572 if (!nla) { 573 kfree_skb(skb); 574 kfree_skb(compskb); 575 return; 576 } 577 compat_event = nla_data(nla); 578 579 compat_event->len = event_len; 580 compat_event->cmd = cmd; 581 if (descr->header_type == IW_HEADER_TYPE_POINT) { 582 compat_wrqu.length = wrqu->data.length; 583 compat_wrqu.flags = wrqu->data.flags; 584 memcpy(&compat_event->pointer, 585 ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF, 586 hdr_len - IW_EV_COMPAT_LCP_LEN); 587 if (extra_len) 588 memcpy(((char *) compat_event) + hdr_len, 589 extra, extra_len); 590 } else { 591 /* extra_len must be zero, so no if (extra) needed */ 592 memcpy(&compat_event->pointer, wrqu, 593 hdr_len - IW_EV_COMPAT_LCP_LEN); 594 } 595 596 nlmsg_end(compskb, nlh); 597 598 skb_shinfo(skb)->frag_list = compskb; 599#endif 600 skb_queue_tail(&dev_net(dev)->wext_nlevents, skb); 601 schedule_work(&wireless_nlevent_work); 602} 603EXPORT_SYMBOL(wireless_send_event); 604 605 606 607/* IW handlers */ 608 609struct iw_statistics *get_wireless_stats(struct net_device *dev) 610{ 611#ifdef CONFIG_WIRELESS_EXT 612 if ((dev->wireless_handlers != NULL) && 613 (dev->wireless_handlers->get_wireless_stats != NULL)) 614 return dev->wireless_handlers->get_wireless_stats(dev); 615#endif 616 617#ifdef CONFIG_CFG80211_WEXT 618 if (dev->ieee80211_ptr && 619 dev->ieee80211_ptr->wiphy && 620 dev->ieee80211_ptr->wiphy->wext && 621 dev->ieee80211_ptr->wiphy->wext->get_wireless_stats) 622 return dev->ieee80211_ptr->wiphy->wext->get_wireless_stats(dev); 623#endif 624 625 /* not found */ 626 return NULL; 627} 628 629static int iw_handler_get_iwstats(struct net_device * dev, 630 struct iw_request_info * info, 631 union iwreq_data * wrqu, 632 char * extra) 633{ 634 /* Get stats from the driver */ 635 struct iw_statistics *stats; 636 637 stats = get_wireless_stats(dev); 638 if (stats) { 639 /* Copy statistics to extra */ 640 memcpy(extra, stats, sizeof(struct iw_statistics)); 641 wrqu->data.length = sizeof(struct iw_statistics); 642 643 /* Check if we need to clear the updated flag */ 644 if (wrqu->data.flags != 0) 645 stats->qual.updated &= ~IW_QUAL_ALL_UPDATED; 646 return 0; 647 } else 648 return -EOPNOTSUPP; 649} 650 651static iw_handler get_handler(struct net_device *dev, unsigned int cmd) 652{ 653 /* Don't "optimise" the following variable, it will crash */ 654 unsigned int index; /* *MUST* be unsigned */ 655 const struct iw_handler_def *handlers = NULL; 656 657#ifdef CONFIG_CFG80211_WEXT 658 if (dev->ieee80211_ptr && dev->ieee80211_ptr->wiphy) 659 handlers = dev->ieee80211_ptr->wiphy->wext; 660#endif 661#ifdef CONFIG_WIRELESS_EXT 662 if (dev->wireless_handlers) 663 handlers = dev->wireless_handlers; 664#endif 665 666 if (!handlers) 667 return NULL; 668 669 /* Try as a standard command */ 670 index = IW_IOCTL_IDX(cmd); 671 if (index < handlers->num_standard) 672 return handlers->standard[index]; 673 674#ifdef CONFIG_WEXT_PRIV 675 /* Try as a private command */ 676 index = cmd - SIOCIWFIRSTPRIV; 677 if (index < handlers->num_private) 678 return handlers->private[index]; 679#endif 680 681 /* Not found */ 682 return NULL; 683} 684 685static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, 686 const struct iw_ioctl_description *descr, 687 iw_handler handler, struct net_device *dev, 688 struct iw_request_info *info) 689{ 690 int err, extra_size, user_length = 0, essid_compat = 0; 691 char *extra; 692 693 /* Calculate space needed by arguments. Always allocate 694 * for max space. 695 */ 696 extra_size = descr->max_tokens * descr->token_size; 697 698 /* Check need for ESSID compatibility for WE < 21 */ 699 switch (cmd) { 700 case SIOCSIWESSID: 701 case SIOCGIWESSID: 702 case SIOCSIWNICKN: 703 case SIOCGIWNICKN: 704 if (iwp->length == descr->max_tokens + 1) 705 essid_compat = 1; 706 else if (IW_IS_SET(cmd) && (iwp->length != 0)) { 707 char essid[IW_ESSID_MAX_SIZE + 1]; 708 unsigned int len; 709 len = iwp->length * descr->token_size; 710 711 if (len > IW_ESSID_MAX_SIZE) 712 return -EFAULT; 713 714 err = copy_from_user(essid, iwp->pointer, len); 715 if (err) 716 return -EFAULT; 717 718 if (essid[iwp->length - 1] == '\0') 719 essid_compat = 1; 720 } 721 break; 722 default: 723 break; 724 } 725 726 iwp->length -= essid_compat; 727 728 /* Check what user space is giving us */ 729 if (IW_IS_SET(cmd)) { 730 /* Check NULL pointer */ 731 if (!iwp->pointer && iwp->length != 0) 732 return -EFAULT; 733 /* Check if number of token fits within bounds */ 734 if (iwp->length > descr->max_tokens) 735 return -E2BIG; 736 if (iwp->length < descr->min_tokens) 737 return -EINVAL; 738 } else { 739 /* Check NULL pointer */ 740 if (!iwp->pointer) 741 return -EFAULT; 742 /* Save user space buffer size for checking */ 743 user_length = iwp->length; 744 745 /* Don't check if user_length > max to allow forward 746 * compatibility. The test user_length < min is 747 * implied by the test at the end. 748 */ 749 750 /* Support for very large requests */ 751 if ((descr->flags & IW_DESCR_FLAG_NOMAX) && 752 (user_length > descr->max_tokens)) { 753 /* Allow userspace to GET more than max so 754 * we can support any size GET requests. 755 * There is still a limit : -ENOMEM. 756 */ 757 extra_size = user_length * descr->token_size; 758 759 /* Note : user_length is originally a __u16, 760 * and token_size is controlled by us, 761 * so extra_size won't get negative and 762 * won't overflow... 763 */ 764 } 765 } 766 767 /* kzalloc() ensures NULL-termination for essid_compat. */ 768 extra = kzalloc(extra_size, GFP_KERNEL); 769 if (!extra) 770 return -ENOMEM; 771 772 /* If it is a SET, get all the extra data in here */ 773 if (IW_IS_SET(cmd) && (iwp->length != 0)) { 774 if (copy_from_user(extra, iwp->pointer, 775 iwp->length * 776 descr->token_size)) { 777 err = -EFAULT; 778 goto out; 779 } 780 781 if (cmd == SIOCSIWENCODEEXT) { 782 struct iw_encode_ext *ee = (void *) extra; 783 784 if (iwp->length < sizeof(*ee) + ee->key_len) { 785 err = -EFAULT; 786 goto out; 787 } 788 } 789 } 790 791 if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) { 792 /* 793 * If this is a GET, but not NOMAX, it means that the extra 794 * data is not bounded by userspace, but by max_tokens. Thus 795 * set the length to max_tokens. This matches the extra data 796 * allocation. 797 * The driver should fill it with the number of tokens it 798 * provided, and it may check iwp->length rather than having 799 * knowledge of max_tokens. If the driver doesn't change the 800 * iwp->length, this ioctl just copies back max_token tokens 801 * filled with zeroes. Hopefully the driver isn't claiming 802 * them to be valid data. 803 */ 804 iwp->length = descr->max_tokens; 805 } 806 807 err = handler(dev, info, (union iwreq_data *) iwp, extra); 808 809 iwp->length += essid_compat; 810 811 /* If we have something to return to the user */ 812 if (!err && IW_IS_GET(cmd)) { 813 /* Check if there is enough buffer up there */ 814 if (user_length < iwp->length) { 815 err = -E2BIG; 816 goto out; 817 } 818 819 if (copy_to_user(iwp->pointer, extra, 820 iwp->length * 821 descr->token_size)) { 822 err = -EFAULT; 823 goto out; 824 } 825 } 826 827 /* Generate an event to notify listeners of the change */ 828 if ((descr->flags & IW_DESCR_FLAG_EVENT) && 829 ((err == 0) || (err == -EIWCOMMIT))) { 830 union iwreq_data *data = (union iwreq_data *) iwp; 831 832 if (descr->flags & IW_DESCR_FLAG_RESTRICT) 833 /* If the event is restricted, don't 834 * export the payload. 835 */ 836 wireless_send_event(dev, cmd, data, NULL); 837 else 838 wireless_send_event(dev, cmd, data, extra); 839 } 840 841out: 842 kfree(extra); 843 return err; 844} 845 846/* 847 * Call the commit handler in the driver 848 * (if exist and if conditions are right) 849 * 850 * Note : our current commit strategy is currently pretty dumb, 851 * but we will be able to improve on that... 852 * The goal is to try to agreagate as many changes as possible 853 * before doing the commit. Drivers that will define a commit handler 854 * are usually those that need a reset after changing parameters, so 855 * we want to minimise the number of reset. 856 * A cool idea is to use a timer : at each "set" command, we re-set the 857 * timer, when the timer eventually fires, we call the driver. 858 * Hopefully, more on that later. 859 * 860 * Also, I'm waiting to see how many people will complain about the 861 * netif_running(dev) test. I'm open on that one... 862 * Hopefully, the driver will remember to do a commit in "open()" ;-) 863 */ 864int call_commit_handler(struct net_device *dev) 865{ 866#ifdef CONFIG_WIRELESS_EXT 867 if ((netif_running(dev)) && 868 (dev->wireless_handlers->standard[0] != NULL)) 869 /* Call the commit handler on the driver */ 870 return dev->wireless_handlers->standard[0](dev, NULL, 871 NULL, NULL); 872 else 873 return 0; /* Command completed successfully */ 874#else 875 /* cfg80211 has no commit */ 876 return 0; 877#endif 878} 879 880/* 881 * Main IOCTl dispatcher. 882 * Check the type of IOCTL and call the appropriate wrapper... 883 */ 884static int wireless_process_ioctl(struct net *net, struct ifreq *ifr, 885 unsigned int cmd, 886 struct iw_request_info *info, 887 wext_ioctl_func standard, 888 wext_ioctl_func private) 889{ 890 struct iwreq *iwr = (struct iwreq *) ifr; 891 struct net_device *dev; 892 iw_handler handler; 893 894 /* Permissions are already checked in dev_ioctl() before calling us. 895 * The copy_to/from_user() of ifr is also dealt with in there */ 896 897 /* Make sure the device exist */ 898 if ((dev = __dev_get_by_name(net, ifr->ifr_name)) == NULL) 899 return -ENODEV; 900 901 /* A bunch of special cases, then the generic case... 902 * Note that 'cmd' is already filtered in dev_ioctl() with 903 * (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) */ 904 if (cmd == SIOCGIWSTATS) 905 return standard(dev, iwr, cmd, info, 906 &iw_handler_get_iwstats); 907 908#ifdef CONFIG_WEXT_PRIV 909 if (cmd == SIOCGIWPRIV && dev->wireless_handlers) 910 return standard(dev, iwr, cmd, info, 911 iw_handler_get_private); 912#endif 913 914 /* Basic check */ 915 if (!netif_device_present(dev)) 916 return -ENODEV; 917 918 /* New driver API : try to find the handler */ 919 handler = get_handler(dev, cmd); 920 if (handler) { 921 /* Standard and private are not the same */ 922 if (cmd < SIOCIWFIRSTPRIV) 923 return standard(dev, iwr, cmd, info, handler); 924 else if (private) 925 return private(dev, iwr, cmd, info, handler); 926 } 927 /* Old driver API : call driver ioctl handler */ 928 if (dev->netdev_ops->ndo_do_ioctl) 929 return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd); 930 return -EOPNOTSUPP; 931} 932 933/* If command is `set a parameter', or `get the encoding parameters', 934 * check if the user has the right to do it. 935 */ 936static int wext_permission_check(unsigned int cmd) 937{ 938 if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE || 939 cmd == SIOCGIWENCODEEXT) && 940 !capable(CAP_NET_ADMIN)) 941 return -EPERM; 942 943 return 0; 944} 945 946/* entry point from dev ioctl */ 947static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr, 948 unsigned int cmd, struct iw_request_info *info, 949 wext_ioctl_func standard, 950 wext_ioctl_func private) 951{ 952 int ret = wext_permission_check(cmd); 953 954 if (ret) 955 return ret; 956 957 dev_load(net, ifr->ifr_name); 958 rtnl_lock(); 959 ret = wireless_process_ioctl(net, ifr, cmd, info, standard, private); 960 rtnl_unlock(); 961 962 return ret; 963} 964 965/* 966 * Wrapper to call a standard Wireless Extension handler. 967 * We do various checks and also take care of moving data between 968 * user space and kernel space. 969 */ 970static int ioctl_standard_call(struct net_device * dev, 971 struct iwreq *iwr, 972 unsigned int cmd, 973 struct iw_request_info *info, 974 iw_handler handler) 975{ 976 const struct iw_ioctl_description * descr; 977 int ret = -EINVAL; 978 979 /* Get the description of the IOCTL */ 980 if (IW_IOCTL_IDX(cmd) >= standard_ioctl_num) 981 return -EOPNOTSUPP; 982 descr = &(standard_ioctl[IW_IOCTL_IDX(cmd)]); 983 984 /* Check if we have a pointer to user space data or not */ 985 if (descr->header_type != IW_HEADER_TYPE_POINT) { 986 987 /* No extra arguments. Trivial to handle */ 988 ret = handler(dev, info, &(iwr->u), NULL); 989 990 /* Generate an event to notify listeners of the change */ 991 if ((descr->flags & IW_DESCR_FLAG_EVENT) && 992 ((ret == 0) || (ret == -EIWCOMMIT))) 993 wireless_send_event(dev, cmd, &(iwr->u), NULL); 994 } else { 995 ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr, 996 handler, dev, info); 997 } 998 999 /* Call commit handler if needed and defined */ 1000 if (ret == -EIWCOMMIT) 1001 ret = call_commit_handler(dev); 1002 1003 /* Here, we will generate the appropriate event if needed */ 1004 1005 return ret; 1006} 1007 1008 1009int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd, 1010 void __user *arg) 1011{ 1012 struct iw_request_info info = { .cmd = cmd, .flags = 0 }; 1013 int ret; 1014 1015 ret = wext_ioctl_dispatch(net, ifr, cmd, &info, 1016 ioctl_standard_call, 1017 ioctl_private_call); 1018 if (ret >= 0 && 1019 IW_IS_GET(cmd) && 1020 copy_to_user(arg, ifr, sizeof(struct iwreq))) 1021 return -EFAULT; 1022 1023 return ret; 1024} 1025 1026#ifdef CONFIG_COMPAT 1027static int compat_standard_call(struct net_device *dev, 1028 struct iwreq *iwr, 1029 unsigned int cmd, 1030 struct iw_request_info *info, 1031 iw_handler handler) 1032{ 1033 const struct iw_ioctl_description *descr; 1034 struct compat_iw_point *iwp_compat; 1035 struct iw_point iwp; 1036 int err; 1037 1038 descr = standard_ioctl + IW_IOCTL_IDX(cmd); 1039 1040 if (descr->header_type != IW_HEADER_TYPE_POINT) 1041 return ioctl_standard_call(dev, iwr, cmd, info, handler); 1042 1043 iwp_compat = (struct compat_iw_point *) &iwr->u.data; 1044 iwp.pointer = compat_ptr(iwp_compat->pointer); 1045 iwp.length = iwp_compat->length; 1046 iwp.flags = iwp_compat->flags; 1047 1048 err = ioctl_standard_iw_point(&iwp, cmd, descr, handler, dev, info); 1049 1050 iwp_compat->pointer = ptr_to_compat(iwp.pointer); 1051 iwp_compat->length = iwp.length; 1052 iwp_compat->flags = iwp.flags; 1053 1054 return err; 1055} 1056 1057int compat_wext_handle_ioctl(struct net *net, unsigned int cmd, 1058 unsigned long arg) 1059{ 1060 void __user *argp = (void __user *)arg; 1061 struct iw_request_info info; 1062 struct iwreq iwr; 1063 char *colon; 1064 int ret; 1065 1066 if (copy_from_user(&iwr, argp, sizeof(struct iwreq))) 1067 return -EFAULT; 1068 1069 iwr.ifr_name[IFNAMSIZ-1] = 0; 1070 colon = strchr(iwr.ifr_name, ':'); 1071 if (colon) 1072 *colon = 0; 1073 1074 info.cmd = cmd; 1075 info.flags = IW_REQUEST_FLAG_COMPAT; 1076 1077 ret = wext_ioctl_dispatch(net, (struct ifreq *) &iwr, cmd, &info, 1078 compat_standard_call, 1079 compat_private_call); 1080 1081 if (ret >= 0 && 1082 IW_IS_GET(cmd) && 1083 copy_to_user(argp, &iwr, sizeof(struct iwreq))) 1084 return -EFAULT; 1085 1086 return ret; 1087} 1088#endif 1089