net/wireless/wext-priv.c

   1 /*
   2  * This file implement the Wireless Extensions priv API.
   3  *
   4  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
   5  * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
   6  * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
   7  *
   8  * (As all part of the Linux kernel, this file is GPL)
   9  */
  10 #include <linux/slab.h>
  11 #include <linux/wireless.h>
  12 #include <linux/netdevice.h>
  13 #include <net/iw_handler.h>
  14 #include <net/wext.h>
  15
  16 int iw_handler_get_private(struct net_device *          dev,
  17                            struct iw_request_info *     info,
  18                            union iwreq_data *           wrqu,
  19                            char *                       extra)
  20 {
  21         /* Check if the driver has something to export */
  22         if ((dev->wireless_handlers->num_private_args == 0) ||
  23            (dev->wireless_handlers->private_args == NULL))
  24                 return -EOPNOTSUPP;
  25
  26         /* Check if there is enough buffer up there */
  27         if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
  28                 /* User space can't know in advance how large the buffer
  29                  * needs to be. Give it a hint, so that we can support
  30                  * any size buffer we want somewhat efficiently... */
  31                 wrqu->data.length = dev->wireless_handlers->num_private_args;
  32                 return -E2BIG;
  33         }
  34
  35         /* Set the number of available ioctls. */
  36         wrqu->data.length = dev->wireless_handlers->num_private_args;
  37
  38         /* Copy structure to the user buffer. */
  39         memcpy(extra, dev->wireless_handlers->private_args,
  40                sizeof(struct iw_priv_args) * wrqu->data.length);
  41
  42         return 0;
  43 }
  44
  45 /* Size (in bytes) of the various private data types */
  46 static const char iw_priv_type_size[] = {
  47         0,                              /* IW_PRIV_TYPE_NONE */
  48         1,                              /* IW_PRIV_TYPE_BYTE */
  49         1,                              /* IW_PRIV_TYPE_CHAR */
  50         0,                              /* Not defined */
  51         sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
  52         sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
  53         sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
  54         0,                              /* Not defined */
  55 };
  56
  57 static int get_priv_size(__u16 args)
  58 {
  59         int     num = args & IW_PRIV_SIZE_MASK;
  60         int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
  61
  62         return num * iw_priv_type_size[type];
  63 }
  64
  65 static int adjust_priv_size(__u16 args, struct iw_point *iwp)
  66 {
  67         int     num = iwp->length;
  68         int     max = args & IW_PRIV_SIZE_MASK;
  69         int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
  70
  71         /* Make sure the driver doesn't goof up */
  72         if (max < num)
  73                 num = max;
  74
  75         return num * iw_priv_type_size[type];
  76 }
  77
  78 /*
  79  * Wrapper to call a private Wireless Extension handler.
  80  * We do various checks and also take care of moving data between
  81  * user space and kernel space.
  82  * It's not as nice and slimline as the standard wrapper. The cause
  83  * is struct iw_priv_args, which was not really designed for the
  84  * job we are going here.
  85  *
  86  * IMPORTANT : This function prevent to set and get data on the same
  87  * IOCTL and enforce the SET/GET convention. Not doing it would be
  88  * far too hairy...
  89  * If you need to set and get data at the same time, please don't use
  90  * a iw_handler but process it in your ioctl handler (i.e. use the
  91  * old driver API).
  92  */
  93 static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
  94                                    const struct iw_priv_args **descrp)
  95 {
  96         const struct iw_priv_args *descr;
  97         int i, extra_size;
  98
  99         descr = NULL;
 100         for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
 101                 if (cmd == dev->wireless_handlers->private_args[i].cmd) {
 102                         descr = &dev->wireless_handlers->private_args[i];
 103                         break;
 104                 }
 105         }
 106
 107         extra_size = 0;
 108         if (descr) {
 109                 if (IW_IS_SET(cmd)) {
 110                         int     offset = 0;     /* For sub-ioctls */
 111                         /* Check for sub-ioctl handler */
 112                         if (descr->name[0] == '\0')
 113                                 /* Reserve one int for sub-ioctl index */
 114                                 offset = sizeof(__u32);
 115
 116                         /* Size of set arguments */
 117                         extra_size = get_priv_size(descr->set_args);
 118
 119                         /* Does it fits in iwr ? */
 120                         if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
 121                            ((extra_size + offset) <= IFNAMSIZ))
 122                                 extra_size = 0;
 123                 } else {
 124                         /* Size of get arguments */
 125                         extra_size = get_priv_size(descr->get_args);
 126
 127                         /* Does it fits in iwr ? */
 128                         if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
 129                            (extra_size <= IFNAMSIZ))
 130                                 extra_size = 0;
 131                 }
 132         }
 133         *descrp = descr;
 134         return extra_size;
 135 }
 136
 137 static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
 138                                   const struct iw_priv_args *descr,
 139                                   iw_handler handler, struct net_device *dev,
 140                                   struct iw_request_info *info, int extra_size)
 141 {
 142         char *extra;
 143         int err;
 144
 145         /* Check what user space is giving us */
 146         if (IW_IS_SET(cmd)) {
 147                 if (!iwp->pointer && iwp->length != 0)
 148                         return -EFAULT;
 149
 150                 if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
 151                         return -E2BIG;
 152         } else if (!iwp->pointer)
 153                 return -EFAULT;
 154
 155         extra = kzalloc(extra_size, GFP_KERNEL);
 156         if (!extra)
 157                 return -ENOMEM;
 158
 159         /* If it is a SET, get all the extra data in here */
 160         if (IW_IS_SET(cmd) && (iwp->length != 0)) {
 161                 if (copy_from_user(extra, iwp->pointer, extra_size)) {
 162                         err = -EFAULT;
 163                         goto out;
 164                 }
 165         }
 166
 167         /* Call the handler */
 168         err = handler(dev, info, (union iwreq_data *) iwp, extra);
 169
 170         /* If we have something to return to the user */
 171         if (!err && IW_IS_GET(cmd)) {
 172                 /* Adjust for the actual length if it's variable,
 173                  * avoid leaking kernel bits outside.
 174                  */
 175                 if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
 176                         extra_size = adjust_priv_size(descr->get_args, iwp);
 177
 178                 if (copy_to_user(iwp->pointer, extra, extra_size))
 179                         err =  -EFAULT;
 180         }
 181
 182 out:
 183         kfree(extra);
 184         return err;
 185 }
 186
 187 int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
 188                        unsigned int cmd, struct iw_request_info *info,
 189                        iw_handler handler)
 190 {
 191         int extra_size = 0, ret = -EINVAL;
 192         const struct iw_priv_args *descr;
 193
 194         extra_size = get_priv_descr_and_size(dev, cmd, &descr);
 195
 196         /* Check if we have a pointer to user space data or not. */
 197         if (extra_size == 0) {
 198                 /* No extra arguments. Trivial to handle */
 199                 ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
 200         } else {
 201                 ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
 202                                              handler, dev, info, extra_size);
 203         }
 204
 205         /* Call commit handler if needed and defined */
 206         if (ret == -EIWCOMMIT)
 207                 ret = call_commit_handler(dev);
 208
 209         return ret;
 210 }
 211
 212 #ifdef CONFIG_COMPAT
 213 int compat_private_call(struct net_device *dev, struct iwreq *iwr,
 214                         unsigned int cmd, struct iw_request_info *info,
 215                         iw_handler handler)
 216 {
 217         const struct iw_priv_args *descr;
 218         int ret, extra_size;
 219
 220         extra_size = get_priv_descr_and_size(dev, cmd, &descr);
 221
 222         /* Check if we have a pointer to user space data or not. */
 223         if (extra_size == 0) {
 224                 /* No extra arguments. Trivial to handle */
 225                 ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
 226         } else {
 227                 struct compat_iw_point *iwp_compat;
 228                 struct iw_point iwp;
 229
 230                 iwp_compat = (struct compat_iw_point *) &iwr->u.data;
 231                 iwp.pointer = compat_ptr(iwp_compat->pointer);
 232                 iwp.length = iwp_compat->length;
 233                 iwp.flags = iwp_compat->flags;
 234
 235                 ret = ioctl_private_iw_point(&iwp, cmd, descr,
 236                                              handler, dev, info, extra_size);
 237
 238                 iwp_compat->pointer = ptr_to_compat(iwp.pointer);
 239                 iwp_compat->length = iwp.length;
 240                 iwp_compat->flags = iwp.flags;
 241         }
 242
 243         /* Call commit handler if needed and defined */
 244         if (ret == -EIWCOMMIT)
 245                 ret = call_commit_handler(dev);
 246
 247         return ret;
 248 }
 249 #endif