mac80211: fix use-after-free in defragmentation
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / mac80211 / debugfs_sta.c
CommitLineData
e9f207f0
JB
1/*
2 * Copyright 2003-2005 Devicescape Software, Inc.
3 * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
4 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/debugfs.h>
12#include <linux/ieee80211.h>
13#include "ieee80211_i.h"
14#include "debugfs.h"
15#include "debugfs_sta.h"
16#include "sta_info.h"
77d2ece6 17#include "driver-ops.h"
e9f207f0
JB
18
19/* sta attributtes */
20
07caf9d6 21#define STA_READ(name, field, format_string) \
e9f207f0
JB
22static ssize_t sta_ ##name## _read(struct file *file, \
23 char __user *userbuf, \
24 size_t count, loff_t *ppos) \
25{ \
e9f207f0 26 struct sta_info *sta = file->private_data; \
07caf9d6
EP
27 return mac80211_format_buffer(userbuf, count, ppos, \
28 format_string, sta->field); \
e9f207f0 29}
07caf9d6
EP
30#define STA_READ_D(name, field) STA_READ(name, field, "%d\n")
31#define STA_READ_U(name, field) STA_READ(name, field, "%u\n")
32#define STA_READ_S(name, field) STA_READ(name, field, "%s\n")
e9f207f0 33
e9f207f0
JB
34#define STA_OPS(name) \
35static const struct file_operations sta_ ##name## _ops = { \
36 .read = sta_##name##_read, \
234e3405 37 .open = simple_open, \
2b18ab36 38 .llseek = generic_file_llseek, \
e9f207f0
JB
39}
40
a75b4363
JB
41#define STA_OPS_RW(name) \
42static const struct file_operations sta_ ##name## _ops = { \
43 .read = sta_##name##_read, \
44 .write = sta_##name##_write, \
234e3405 45 .open = simple_open, \
2b18ab36 46 .llseek = generic_file_llseek, \
a75b4363
JB
47}
48
e9f207f0
JB
49#define STA_FILE(name, field, format) \
50 STA_READ_##format(name, field) \
51 STA_OPS(name)
52
17741cdc 53STA_FILE(aid, sta.aid, D);
47846c9b 54STA_FILE(dev, sdata->name, S);
e9f207f0 55STA_FILE(last_signal, last_signal, D);
db94357d 56STA_FILE(last_ack_signal, last_ack_signal, D);
78e443e4 57STA_FILE(beacon_loss_count, beacon_loss_count, D);
e9f207f0
JB
58
59static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
60 size_t count, loff_t *ppos)
61{
5bade101 62 char buf[121];
e9f207f0 63 struct sta_info *sta = file->private_data;
c2c98fde 64
5bade101
JB
65#define TEST(flg) \
66 test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
67
68 int res = scnprintf(buf, sizeof(buf),
3f52b7e3 69 "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
5bade101
JB
70 TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
71 TEST(PS_DRIVER), TEST(AUTHORIZED),
fb4431bf 72 TEST(SHORT_PREAMBLE),
5bade101
JB
73 TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
74 TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
75 TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
83d5cc01 76 TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
dbf498fb 77 TEST(INSERTED), TEST(RATE_CONTROL),
3f52b7e3
MP
78 TEST(TOFFSET_KNOWN), TEST(MPSP_OWNER),
79 TEST(MPSP_RECIPIENT));
5bade101 80#undef TEST
e9f207f0
JB
81 return simple_read_from_buffer(userbuf, count, ppos, buf, res);
82}
83STA_OPS(flags);
84
85static ssize_t sta_num_ps_buf_frames_read(struct file *file,
86 char __user *userbuf,
87 size_t count, loff_t *ppos)
88{
e9f207f0 89 struct sta_info *sta = file->private_data;
948d887d
JB
90 char buf[17*IEEE80211_NUM_ACS], *p = buf;
91 int ac;
92
93 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
94 p += scnprintf(p, sizeof(buf)+buf-p, "AC%d: %d\n", ac,
95 skb_queue_len(&sta->ps_tx_buf[ac]) +
96 skb_queue_len(&sta->tx_filtered[ac]));
97 return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
e9f207f0
JB
98}
99STA_OPS(num_ps_buf_frames);
100
e9f207f0
JB
101static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
102 size_t count, loff_t *ppos)
103{
e9f207f0 104 struct sta_info *sta = file->private_data;
07caf9d6
EP
105 return mac80211_format_buffer(userbuf, count, ppos, "%d\n",
106 jiffies_to_msecs(jiffies - sta->last_rx));
e9f207f0
JB
107}
108STA_OPS(inactive_ms);
109
ebe27c91
MSS
110
111static ssize_t sta_connected_time_read(struct file *file, char __user *userbuf,
112 size_t count, loff_t *ppos)
113{
114 struct sta_info *sta = file->private_data;
115 struct timespec uptime;
116 struct tm result;
117 long connected_time_secs;
118 char buf[100];
119 int res;
120 do_posix_clock_monotonic_gettime(&uptime);
121 connected_time_secs = uptime.tv_sec - sta->last_connected;
122 time_to_tm(connected_time_secs, 0, &result);
123 result.tm_year -= 70;
124 result.tm_mday -= 1;
125 res = scnprintf(buf, sizeof(buf),
7762bb02 126 "years - %ld\nmonths - %d\ndays - %d\nclock - %d:%d:%d\n\n",
ebe27c91
MSS
127 result.tm_year, result.tm_mon, result.tm_mday,
128 result.tm_hour, result.tm_min, result.tm_sec);
129 return simple_read_from_buffer(userbuf, count, ppos, buf, res);
130}
131STA_OPS(connected_time);
132
133
134
e9f207f0
JB
135static ssize_t sta_last_seq_ctrl_read(struct file *file, char __user *userbuf,
136 size_t count, loff_t *ppos)
137{
5a306f58 138 char buf[15*IEEE80211_NUM_TIDS], *p = buf;
e9f207f0
JB
139 int i;
140 struct sta_info *sta = file->private_data;
5a306f58 141 for (i = 0; i < IEEE80211_NUM_TIDS; i++)
e9f207f0 142 p += scnprintf(p, sizeof(buf)+buf-p, "%x ",
ba9b07d0 143 le16_to_cpu(sta->last_seq_ctrl[i]));
e9f207f0
JB
144 p += scnprintf(p, sizeof(buf)+buf-p, "\n");
145 return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
146}
147STA_OPS(last_seq_ctrl);
148
eb2ba62e
RR
149static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
150 size_t count, loff_t *ppos)
151{
5a306f58 152 char buf[71 + IEEE80211_NUM_TIDS * 40], *p = buf;
eb2ba62e
RR
153 int i;
154 struct sta_info *sta = file->private_data;
dd318575
JB
155 struct tid_ampdu_rx *tid_rx;
156 struct tid_ampdu_tx *tid_tx;
157
158 rcu_read_lock();
eb2ba62e 159
e0b20f1c 160 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
386aa23d 161 sta->ampdu_mlme.dialog_token_allocator + 1);
e0b20f1c 162 p += scnprintf(p, sizeof(buf) + buf - p,
0ab33703 163 "TID\t\tRX active\tDTKN\tSSN\t\tTX\tDTKN\tpending\n");
dd318575 164
5a306f58 165 for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
dd318575
JB
166 tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[i]);
167 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[i]);
168
e0b20f1c 169 p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
dd318575 170 p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x", !!tid_rx);
e0b20f1c 171 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
dd318575 172 tid_rx ? tid_rx->dialog_token : 0);
e0b20f1c 173 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
dd318575 174 tid_rx ? tid_rx->ssn : 0);
386aa23d 175
dd318575 176 p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x", !!tid_tx);
e0b20f1c 177 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
dd318575 178 tid_tx ? tid_tx->dialog_token : 0);
e0b20f1c 179 p += scnprintf(p, sizeof(buf) + buf - p, "\t%03d",
dd318575 180 tid_tx ? skb_queue_len(&tid_tx->pending) : 0);
e0b20f1c 181 p += scnprintf(p, sizeof(buf) + buf - p, "\n");
386aa23d 182 }
dd318575 183 rcu_read_unlock();
eb2ba62e
RR
184
185 return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
186}
a75b4363
JB
187
188static ssize_t sta_agg_status_write(struct file *file, const char __user *userbuf,
189 size_t count, loff_t *ppos)
190{
191 char _buf[12], *buf = _buf;
192 struct sta_info *sta = file->private_data;
193 bool start, tx;
194 unsigned long tid;
195 int ret;
196
197 if (count > sizeof(_buf))
198 return -EINVAL;
199
200 if (copy_from_user(buf, userbuf, count))
201 return -EFAULT;
202
203 buf[sizeof(_buf) - 1] = '\0';
204
205 if (strncmp(buf, "tx ", 3) == 0) {
206 buf += 3;
207 tx = true;
208 } else if (strncmp(buf, "rx ", 3) == 0) {
209 buf += 3;
210 tx = false;
211 } else
212 return -EINVAL;
213
214 if (strncmp(buf, "start ", 6) == 0) {
215 buf += 6;
216 start = true;
217 if (!tx)
218 return -EINVAL;
219 } else if (strncmp(buf, "stop ", 5) == 0) {
220 buf += 5;
221 start = false;
222 } else
223 return -EINVAL;
224
4b5511eb
AP
225 ret = kstrtoul(buf, 0, &tid);
226 if (ret)
227 return ret;
a75b4363 228
5a306f58 229 if (tid >= IEEE80211_NUM_TIDS)
a75b4363
JB
230 return -EINVAL;
231
232 if (tx) {
233 if (start)
bd2ce6e4 234 ret = ieee80211_start_tx_ba_session(&sta->sta, tid, 5000);
a75b4363 235 else
6a8579d0 236 ret = ieee80211_stop_tx_ba_session(&sta->sta, tid);
a75b4363 237 } else {
53f73c09
JB
238 __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
239 3, true);
a75b4363
JB
240 ret = 0;
241 }
242
243 return ret ?: count;
244}
245STA_OPS_RW(agg_status);
eb2ba62e 246
64491f0e
JB
247static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
248 size_t count, loff_t *ppos)
249{
7db94e21
LR
250#define PRINT_HT_CAP(_cond, _str) \
251 do { \
252 if (_cond) \
253 p += scnprintf(p, sizeof(buf)+buf-p, "\t" _str "\n"); \
254 } while (0)
4c82bf8e 255 char buf[512], *p = buf;
64491f0e
JB
256 int i;
257 struct sta_info *sta = file->private_data;
258 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
259
260 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
261 htc->ht_supported ? "" : "not ");
262 if (htc->ht_supported) {
cb136f54 263 p += scnprintf(p, sizeof(buf)+buf-p, "cap: %#.4x\n", htc->cap);
7db94e21 264
c15cf5fc 265 PRINT_HT_CAP((htc->cap & BIT(0)), "RX LDPC");
7db94e21
LR
266 PRINT_HT_CAP((htc->cap & BIT(1)), "HT20/HT40");
267 PRINT_HT_CAP(!(htc->cap & BIT(1)), "HT20");
268
269 PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 0, "Static SM Power Save");
270 PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 1, "Dynamic SM Power Save");
271 PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 3, "SM Power Save disabled");
272
273 PRINT_HT_CAP((htc->cap & BIT(4)), "RX Greenfield");
274 PRINT_HT_CAP((htc->cap & BIT(5)), "RX HT20 SGI");
275 PRINT_HT_CAP((htc->cap & BIT(6)), "RX HT40 SGI");
276 PRINT_HT_CAP((htc->cap & BIT(7)), "TX STBC");
277
278 PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 0, "No RX STBC");
279 PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 1, "RX STBC 1-stream");
280 PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 2, "RX STBC 2-streams");
281 PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 3, "RX STBC 3-streams");
282
283 PRINT_HT_CAP((htc->cap & BIT(10)), "HT Delayed Block Ack");
284
7db94e21 285 PRINT_HT_CAP(!(htc->cap & BIT(11)), "Max AMSDU length: "
904603f9
BG
286 "3839 bytes");
287 PRINT_HT_CAP((htc->cap & BIT(11)), "Max AMSDU length: "
7db94e21
LR
288 "7935 bytes");
289
290 /*
291 * For beacons and probe response this would mean the BSS
292 * does or does not allow the usage of DSSS/CCK HT40.
293 * Otherwise it means the STA does or does not use
294 * DSSS/CCK HT40.
295 */
296 PRINT_HT_CAP((htc->cap & BIT(12)), "DSSS/CCK HT40");
297 PRINT_HT_CAP(!(htc->cap & BIT(12)), "No DSSS/CCK HT40");
298
299 /* BIT(13) is reserved */
300
301 PRINT_HT_CAP((htc->cap & BIT(14)), "40 MHz Intolerant");
302
303 PRINT_HT_CAP((htc->cap & BIT(15)), "L-SIG TXOP protection");
304
64491f0e
JB
305 p += scnprintf(p, sizeof(buf)+buf-p, "ampdu factor/density: %d/%d\n",
306 htc->ampdu_factor, htc->ampdu_density);
307 p += scnprintf(p, sizeof(buf)+buf-p, "MCS mask:");
9da3e068 308
64491f0e
JB
309 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
310 p += scnprintf(p, sizeof(buf)+buf-p, " %.2x",
311 htc->mcs.rx_mask[i]);
9da3e068
LR
312 p += scnprintf(p, sizeof(buf)+buf-p, "\n");
313
314 /* If not set this is meaningless */
315 if (le16_to_cpu(htc->mcs.rx_highest)) {
316 p += scnprintf(p, sizeof(buf)+buf-p,
317 "MCS rx highest: %d Mbps\n",
318 le16_to_cpu(htc->mcs.rx_highest));
319 }
320
64491f0e
JB
321 p += scnprintf(p, sizeof(buf)+buf-p, "MCS tx params: %x\n",
322 htc->mcs.tx_params);
323 }
324
325 return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
326}
327STA_OPS(ht_capa);
328
90fcba65
JB
329static ssize_t sta_vht_capa_read(struct file *file, char __user *userbuf,
330 size_t count, loff_t *ppos)
331{
332 char buf[128], *p = buf;
333 struct sta_info *sta = file->private_data;
334 struct ieee80211_sta_vht_cap *vhtc = &sta->sta.vht_cap;
335
336 p += scnprintf(p, sizeof(buf) + buf - p, "VHT %ssupported\n",
337 vhtc->vht_supported ? "" : "not ");
338 if (vhtc->vht_supported) {
339 p += scnprintf(p, sizeof(buf)+buf-p, "cap: %#.8x\n", vhtc->cap);
340
341 p += scnprintf(p, sizeof(buf)+buf-p, "RX MCS: %.4x\n",
342 le16_to_cpu(vhtc->vht_mcs.rx_mcs_map));
343 if (vhtc->vht_mcs.rx_highest)
344 p += scnprintf(p, sizeof(buf)+buf-p,
345 "MCS RX highest: %d Mbps\n",
346 le16_to_cpu(vhtc->vht_mcs.rx_highest));
347 p += scnprintf(p, sizeof(buf)+buf-p, "TX MCS: %.4x\n",
348 le16_to_cpu(vhtc->vht_mcs.tx_mcs_map));
349 if (vhtc->vht_mcs.tx_highest)
350 p += scnprintf(p, sizeof(buf)+buf-p,
351 "MCS TX highest: %d Mbps\n",
352 le16_to_cpu(vhtc->vht_mcs.tx_highest));
353 }
354
355 return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
356}
357STA_OPS(vht_capa);
358
91b8c050
S
359static ssize_t sta_current_tx_rate_read(struct file *file, char __user *userbuf,
360 size_t count, loff_t *ppos)
361{
362 struct sta_info *sta = file->private_data;
363 struct rate_info rinfo;
364 u16 rate;
365 sta_set_rate_info_tx(sta, &sta->last_tx_rate, &rinfo);
366 rate = cfg80211_calculate_bitrate(&rinfo);
367
368 return mac80211_format_buffer(userbuf, count, ppos,
369 "%d.%d MBit/s\n",
370 rate/10, rate%10);
371}
372STA_OPS(current_tx_rate);
373
1f2e651c
S
374static ssize_t sta_last_rx_rate_read(struct file *file, char __user *userbuf,
375 size_t count, loff_t *ppos)
376{
377 struct sta_info *sta = file->private_data;
378 struct rate_info rinfo;
379 u16 rate;
380
381 sta_set_rate_info_rx(sta, &rinfo);
382
383 rate = cfg80211_calculate_bitrate(&rinfo);
384
385 return mac80211_format_buffer(userbuf, count, ppos,
386 "%d.%d MBit/s\n",
387 rate/10, rate%10);
388}
389STA_OPS(last_rx_rate);
390
e9f207f0 391#define DEBUGFS_ADD(name) \
7bcfaf2f 392 debugfs_create_file(#name, 0400, \
e9f207f0
JB
393 sta->debugfs.dir, sta, &sta_ ##name## _ops);
394
2826bcd8
FF
395#define DEBUGFS_ADD_COUNTER(name, field) \
396 if (sizeof(sta->field) == sizeof(u32)) \
397 debugfs_create_u32(#name, 0400, sta->debugfs.dir, \
398 (u32 *) &sta->field); \
399 else \
400 debugfs_create_u64(#name, 0400, sta->debugfs.dir, \
401 (u64 *) &sta->field);
e9f207f0
JB
402
403void ieee80211_sta_debugfs_add(struct sta_info *sta)
404{
77d2ece6
SM
405 struct ieee80211_local *local = sta->local;
406 struct ieee80211_sub_if_data *sdata = sta->sdata;
295bafb4 407 struct dentry *stations_dir = sta->sdata->debugfs.subdir_stations;
0c68ae26 408 u8 mac[3*ETH_ALEN];
e9f207f0 409
63044e9f
JB
410 sta->debugfs.add_has_run = true;
411
e9f207f0
JB
412 if (!stations_dir)
413 return;
414
0c68ae26 415 snprintf(mac, sizeof(mac), "%pM", sta->sta.addr);
e9f207f0 416
63044e9f
JB
417 /*
418 * This might fail due to a race condition:
419 * When mac80211 unlinks a station, the debugfs entries
420 * remain, but it is already possible to link a new
421 * station with the same address which triggers adding
422 * it to debugfs; therefore, if the old station isn't
423 * destroyed quickly enough the old station's debugfs
424 * dir might still be around.
425 */
0795af57 426 sta->debugfs.dir = debugfs_create_dir(mac, stations_dir);
e9f207f0
JB
427 if (!sta->debugfs.dir)
428 return;
429
430 DEBUGFS_ADD(flags);
431 DEBUGFS_ADD(num_ps_buf_frames);
e9f207f0 432 DEBUGFS_ADD(inactive_ms);
ebe27c91 433 DEBUGFS_ADD(connected_time);
e9f207f0 434 DEBUGFS_ADD(last_seq_ctrl);
eb2ba62e 435 DEBUGFS_ADD(agg_status);
386aa23d 436 DEBUGFS_ADD(dev);
386aa23d 437 DEBUGFS_ADD(last_signal);
78e443e4 438 DEBUGFS_ADD(beacon_loss_count);
64491f0e 439 DEBUGFS_ADD(ht_capa);
90fcba65 440 DEBUGFS_ADD(vht_capa);
db94357d 441 DEBUGFS_ADD(last_ack_signal);
91b8c050 442 DEBUGFS_ADD(current_tx_rate);
1f2e651c 443 DEBUGFS_ADD(last_rx_rate);
2826bcd8
FF
444
445 DEBUGFS_ADD_COUNTER(rx_packets, rx_packets);
446 DEBUGFS_ADD_COUNTER(tx_packets, tx_packets);
447 DEBUGFS_ADD_COUNTER(rx_bytes, rx_bytes);
448 DEBUGFS_ADD_COUNTER(tx_bytes, tx_bytes);
449 DEBUGFS_ADD_COUNTER(rx_duplicates, num_duplicates);
450 DEBUGFS_ADD_COUNTER(rx_fragments, rx_fragments);
451 DEBUGFS_ADD_COUNTER(rx_dropped, rx_dropped);
452 DEBUGFS_ADD_COUNTER(tx_fragments, tx_fragments);
453 DEBUGFS_ADD_COUNTER(tx_filtered, tx_filtered_count);
454 DEBUGFS_ADD_COUNTER(tx_retry_failed, tx_retry_failed);
455 DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
456 DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
77d2ece6
SM
457
458 drv_sta_add_debugfs(local, sdata, &sta->sta, sta->debugfs.dir);
e9f207f0
JB
459}
460
461void ieee80211_sta_debugfs_remove(struct sta_info *sta)
462{
77d2ece6
SM
463 struct ieee80211_local *local = sta->local;
464 struct ieee80211_sub_if_data *sdata = sta->sdata;
465
466 drv_sta_remove_debugfs(local, sdata, &sta->sta, sta->debugfs.dir);
7bcfaf2f 467 debugfs_remove_recursive(sta->debugfs.dir);
e9f207f0
JB
468 sta->debugfs.dir = NULL;
469}