Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 10 Feb 2019 20:25:45 +0000 (UTC)
From:      Andriy Voskoboinyk <avos@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r343972 - stable/11/sys/net80211
Message-ID:  <201902102025.x1AKPj81025128@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: avos
Date: Sun Feb 10 20:25:45 2019
New Revision: 343972
URL: https://svnweb.freebsd.org/changeset/base/343972

Log:
  MFC r343837:
  net80211(4): validate supplied roam:rate values from ifconfig(8)

Modified:
  stable/11/sys/net80211/ieee80211_ioctl.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/net80211/ieee80211_ioctl.c
==============================================================================
--- stable/11/sys/net80211/ieee80211_ioctl.c	Sun Feb 10 20:25:15 2019	(r343971)
+++ stable/11/sys/net80211/ieee80211_ioctl.c	Sun Feb 10 20:25:45 2019	(r343972)
@@ -2136,18 +2136,6 @@ ieee80211_ioctl_setregdomain(struct ieee80211vap *vap,
 }
 
 static int
-ieee80211_ioctl_setroam(struct ieee80211vap *vap,
-	const struct ieee80211req *ireq)
-{
-	if (ireq->i_len != sizeof(vap->iv_roamparms))
-		return EINVAL;
-	/* XXX validate params */
-	/* XXX? ENETRESET to push to device? */
-	return copyin(ireq->i_data, vap->iv_roamparms,
-	    sizeof(vap->iv_roamparms));
-}
-
-static int
 checkrate(const struct ieee80211_rateset *rs, int rate)
 {
 	int i;
@@ -2168,6 +2156,70 @@ checkmcs(int mcs)
 	if ((mcs & IEEE80211_RATE_MCS) == 0)	/* MCS always have 0x80 set */
 		return 0;
 	return (mcs & 0x7f) <= 15;	/* XXX could search ht rate set */
+}
+
+static int
+ieee80211_ioctl_setroam(struct ieee80211vap *vap,
+        const struct ieee80211req *ireq)
+{
+	struct ieee80211com *ic = vap->iv_ic;
+	struct ieee80211_roamparams_req *parms;
+	struct ieee80211_roamparam *src, *dst;
+	const struct ieee80211_rateset *rs;
+	int changed, error, mode, is11n, nmodes;
+
+	if (ireq->i_len != sizeof(vap->iv_roamparms))
+		return EINVAL;
+
+	parms = IEEE80211_MALLOC(sizeof(*parms), M_TEMP,
+	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
+	if (parms == NULL)
+		return ENOMEM;
+
+	error = copyin(ireq->i_data, parms, ireq->i_len);
+	if (error != 0)
+		goto fail;
+
+	changed = 0;
+	nmodes = IEEE80211_MODE_MAX;
+
+	/* validate parameters and check if anything changed */
+	for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
+		if (isclr(ic->ic_modecaps, mode))
+			continue;
+		src = &parms->params[mode];
+		dst = &vap->iv_roamparms[mode];
+		rs = &ic->ic_sup_rates[mode];	/* NB: 11n maps to legacy */
+		is11n = (mode == IEEE80211_MODE_11NA ||
+			 mode == IEEE80211_MODE_11NG);
+		if (src->rate != dst->rate) {
+			if (!checkrate(rs, src->rate) &&
+			    (!is11n || !checkmcs(src->rate))) {
+				error = EINVAL;
+				goto fail;
+			}
+			changed++;
+		}
+		if (src->rssi != dst->rssi)
+			changed++;
+	}
+	if (changed) {
+		/*
+		 * Copy new parameters in place and notify the
+		 * driver so it can push state to the device.
+		 */
+		/* XXX locking? */
+		for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
+			if (isset(ic->ic_modecaps, mode))
+				vap->iv_roamparms[mode] = parms->params[mode];
+		}
+
+		if (vap->iv_roaming == IEEE80211_ROAMING_DEVICE)
+			error = ERESTART;
+	}
+
+fail:	IEEE80211_FREE(parms, M_TEMP);
+	return error;
 }
 
 static int

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201902102025.x1AKPj81025128>