1 files changed, 104 insertions, 36 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0f1b18f209d6..62bdb1adaa4d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -371,8 +371,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
-        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
-        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
+        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
+        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
@@ -386,6 +386,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 };
 
 /* policy for the key attributes */
@@ -970,8 +971,10 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                                 c->max_interfaces))
                         goto nla_put_failure;
                 if (large &&
-                    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
-                                c->radar_detect_widths))
+                    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
+                                c->radar_detect_widths) ||
+                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
+                                c->radar_detect_regions)))
                         goto nla_put_failure;
 
                 nla_nest_end(msg, nl_combi);
@@ -1667,6 +1670,13 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
                         }
                         nla_nest_end(msg, nested);
                 }
+                state->split_start++;
+                break;
+        case 12:
+                if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
+                    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
+                               rdev->wiphy.max_num_csa_counters))
+                        goto nla_put_failure;
 
                 /* done */
                 state->split_start = 0;
@@ -3640,6 +3650,10 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
                         sinfo->tx_failed))
                 goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
+            nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
+                        sinfo->expected_throughput))
+                goto nla_put_failure;
         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
                         sinfo->beacon_loss_count))
@@ -5820,7 +5834,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
                 return -EBUSY;
 
         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
-                                            NL80211_IFTYPE_UNSPECIFIED);
+                                            wdev->iftype);
         if (err < 0)
                 return err;
 
@@ -5861,6 +5875,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         u8 radar_detect_width = 0;
         int err;
         bool need_new_beacon = false;
+        int len, i;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
@@ -5919,26 +5934,55 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
                 return -EINVAL;
 
-        params.counter_offset_beacon =
-                nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
-        if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
+        len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
+        if (!len || (len % sizeof(u16)))
                 return -EINVAL;
 
-        /* sanity check - counters should be the same */
-        if (params.beacon_csa.tail[params.counter_offset_beacon] !=
-            params.count)
+        params.n_counter_offsets_beacon = len / sizeof(u16);
+        if (rdev->wiphy.max_num_csa_counters &&
+            (params.n_counter_offsets_beacon >
+             rdev->wiphy.max_num_csa_counters))
                 return -EINVAL;
 
+        params.counter_offsets_beacon =
+                nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
+
+        /* sanity checks - counters should fit and be the same */
+        for (i = 0; i < params.n_counter_offsets_beacon; i++) {
+                u16 offset = params.counter_offsets_beacon[i];
+
+                if (offset >= params.beacon_csa.tail_len)
+                        return -EINVAL;
+
+                if (params.beacon_csa.tail[offset] != params.count)
+                        return -EINVAL;
+        }
+
         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
-                params.counter_offset_presp =
-                        nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
-                if (params.counter_offset_presp >=
-                    params.beacon_csa.probe_resp_len)
+                len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
+                if (!len || (len % sizeof(u16)))
                         return -EINVAL;
 
-                if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
-                    params.count)
+                params.n_counter_offsets_presp = len / sizeof(u16);
+                if (rdev->wiphy.max_num_csa_counters &&
+                    (params.n_counter_offsets_beacon >
+                     rdev->wiphy.max_num_csa_counters))
                         return -EINVAL;
+
+                params.counter_offsets_presp =
+                        nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
+
+                /* sanity checks - counters should fit and be the same */
+                for (i = 0; i < params.n_counter_offsets_presp; i++) {
+                        u16 offset = params.counter_offsets_presp[i];
+
+                        if (offset >= params.beacon_csa.probe_resp_len)
+                                return -EINVAL;
+
+                        if (params.beacon_csa.probe_resp[offset] !=
+                            params.count)
+                                return -EINVAL;
+                }
         }
 
 skip_beacons:
@@ -7784,6 +7828,27 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         if (!chandef.chan && params.offchan)
                 return -EINVAL;
 
+        params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
+        params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
+
+        if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
+                int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
+                int i;
+
+                if (len % sizeof(u16))
+                        return -EINVAL;
+
+                params.n_csa_offsets = len / sizeof(u16);
+                params.csa_offsets =
+                        nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
+
+                /* check that all the offsets fit the frame */
+                for (i = 0; i < params.n_csa_offsets; i++) {
+                        if (params.csa_offsets[i] >= params.len)
+                                return -EINVAL;
+                }
+        }
+
         if (!params.dont_wait_for_ack) {
                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
                 if (!msg)
@@ -7797,8 +7862,6 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
-        params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
         params.chan = chandef.chan;
         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
         if (err)
@@ -8495,6 +8558,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
                                     rem) {
+                        u8 *mask_pat;
+
                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
                                   nla_len(pat), NULL);
                         err = -EINVAL;
@@ -8518,19 +8583,18 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                                 goto error;
                         new_triggers.patterns[i].pkt_offset = pkt_offset;
 
-                        new_triggers.patterns[i].mask =
-                                kmalloc(mask_len + pat_len, GFP_KERNEL);
-                        if (!new_triggers.patterns[i].mask) {
+                        mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
+                        if (!mask_pat) {
                                 err = -ENOMEM;
                                 goto error;
                         }
-                        new_triggers.patterns[i].pattern =
-                                new_triggers.patterns[i].mask + mask_len;
-                        memcpy(new_triggers.patterns[i].mask,
-                               nla_data(pat_tb[NL80211_PKTPAT_MASK]),
+                        new_triggers.patterns[i].mask = mask_pat;
+                        memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
                                mask_len);
+                        mask_pat += mask_len;
+                        new_triggers.patterns[i].pattern = mask_pat;
                         new_triggers.patterns[i].pattern_len = pat_len;
-                        memcpy(new_triggers.patterns[i].pattern,
+                        memcpy(mask_pat,
                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
                                pat_len);
                         i++;
@@ -8722,6 +8786,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
 
         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
                             rem) {
+                u8 *mask_pat;
+
                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
                           nla_len(pat), NULL);
                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
@@ -8743,17 +8809,19 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
                         return -EINVAL;
                 new_rule->patterns[i].pkt_offset = pkt_offset;
 
-                new_rule->patterns[i].mask =
-                        kmalloc(mask_len + pat_len, GFP_KERNEL);
-                if (!new_rule->patterns[i].mask)
+                mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
+                if (!mask_pat)
                         return -ENOMEM;
-                new_rule->patterns[i].pattern =
-                        new_rule->patterns[i].mask + mask_len;
-                memcpy(new_rule->patterns[i].mask,
-                       nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
+
+                new_rule->patterns[i].mask = mask_pat;
+                memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
+                       mask_len);
+
+                mask_pat += mask_len;
+                new_rule->patterns[i].pattern = mask_pat;
                 new_rule->patterns[i].pattern_len = pat_len;
-                memcpy(new_rule->patterns[i].pattern,
-                       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
+                memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
+                       pat_len);
                 i++;
         }