nl80211: fix possible memory leak nl80211_connect()
[firefly-linux-kernel-4.4.55.git] / net / wireless / nl80211.c
index 0dc3356eea4030b54146d3f72776ef12fc907df6..1e37dbf00cb3f3850d3785827f896ca09339873b 100644 (file)
@@ -354,6 +354,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
        [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
        [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
        [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
+       [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 };
 
 /* policy for the key attributes */
@@ -1759,11 +1760,17 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                        (cfg80211_rdev_list_generation << 2)))
                goto nla_put_failure;
 
-       if (rdev->monitor_channel) {
-               if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
-                               rdev->monitor_channel->center_freq) ||
-                   nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
-                               rdev->monitor_channel_type))
+       if (rdev->ops->get_channel) {
+               struct ieee80211_channel *chan;
+               enum nl80211_channel_type channel_type;
+
+               chan = rdev->ops->get_channel(&rdev->wiphy, wdev,
+                                             &channel_type);
+               if (chan &&
+                   (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
+                                chan->center_freq) ||
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
+                                channel_type)))
                        goto nla_put_failure;
        }
 
@@ -1971,7 +1978,8 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
        struct vif_params params;
-       struct net_device *dev;
+       struct wireless_dev *wdev;
+       struct sk_buff *msg;
        int err;
        enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
        u32 flags;
@@ -1998,19 +2006,23 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                        return err;
        }
 
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+       if (!msg)
+               return -ENOMEM;
+
        err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                  &flags);
-       dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
+       wdev = rdev->ops->add_virtual_intf(&rdev->wiphy,
                nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                type, err ? NULL : &flags, &params);
-       if (IS_ERR(dev))
-               return PTR_ERR(dev);
+       if (IS_ERR(wdev)) {
+               nlmsg_free(msg);
+               return PTR_ERR(wdev);
+       }
 
        if (type == NL80211_IFTYPE_MESH_POINT &&
            info->attrs[NL80211_ATTR_MESH_ID]) {
-               struct wireless_dev *wdev = dev->ieee80211_ptr;
-
                wdev_lock(wdev);
                BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
                             IEEE80211_MAX_MESH_ID_LEN);
@@ -2021,18 +2033,34 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                wdev_unlock(wdev);
        }
 
-       return 0;
+       if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
+                              rdev, wdev) < 0) {
+               nlmsg_free(msg);
+               return -ENOBUFS;
+       }
+
+       return genlmsg_reply(msg, info);
 }
 
 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
-       struct net_device *dev = info->user_ptr[1];
+       struct wireless_dev *wdev = info->user_ptr[1];
 
        if (!rdev->ops->del_virtual_intf)
                return -EOPNOTSUPP;
 
-       return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
+       /*
+        * If we remove a wireless device without a netdev then clear
+        * user_ptr[1] so that nl80211_post_doit won't dereference it
+        * to check if it needs to do dev_put(). Otherwise it crashes
+        * since the wdev has been freed, unlike with a netdev where
+        * we need the dev_put() for the netdev to really be freed.
+        */
+       if (!wdev->netdev)
+               info->user_ptr[1] = NULL;
+
+       return rdev->ops->del_virtual_intf(&rdev->wiphy, wdev);
 }
 
 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
@@ -3555,6 +3583,7 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
        int r;
        char *data = NULL;
+       enum nl80211_user_reg_hint_type user_reg_hint_type;
 
        /*
         * You should only get this when cfg80211 hasn't yet initialized
@@ -3574,7 +3603,21 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 
        data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 
-       r = regulatory_hint_user(data);
+       if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
+               user_reg_hint_type =
+                 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
+       else
+               user_reg_hint_type = NL80211_USER_REG_HINT_USER;
+
+       switch (user_reg_hint_type) {
+       case NL80211_USER_REG_HINT_USER:
+       case NL80211_USER_REG_HINT_CELL_BASE:
+               break;
+       default:
+               return -EINVAL;
+       }
+
+       r = regulatory_hint_user(data, user_reg_hint_type);
 
        return r;
 }
@@ -3944,6 +3987,11 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                        cfg80211_regdomain->dfs_region)))
                goto nla_put_failure;
 
+       if (reg_last_request_cell_base() &&
+           nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
+                       NL80211_USER_REG_HINT_CELL_BASE))
+               goto nla_put_failure;
+
        nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
        if (!nl_reg_rules)
                goto nla_put_failure;
@@ -4109,7 +4157,7 @@ static int validate_scan_freqs(struct nlattr *freqs)
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
-       struct net_device *dev = info->user_ptr[1];
+       struct wireless_dev *wdev = info->user_ptr[1];
        struct cfg80211_scan_request *request;
        struct nlattr *attr;
        struct wiphy *wiphy;
@@ -4269,15 +4317,16 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
        request->no_cck =
                nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
 
-       request->dev = dev;
+       request->wdev = wdev;
        request->wiphy = &rdev->wiphy;
 
        rdev->scan_req = request;
-       err = rdev->ops->scan(&rdev->wiphy, dev, request);
+       err = rdev->ops->scan(&rdev->wiphy, request);
 
        if (!err) {
-               nl80211_send_scan_start(rdev, dev);
-               dev_hold(dev);
+               nl80211_send_scan_start(rdev, wdev);
+               if (wdev->netdev)
+                       dev_hold(wdev->netdev);
        } else {
  out_free:
                rdev->scan_req = NULL;
@@ -5584,8 +5633,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                       sizeof(connect.ht_capa_mask));
 
        if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
-               if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+               if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
+                       kfree(connkeys);
                        return -EINVAL;
+               }
                memcpy(&connect.ht_capa,
                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
                       sizeof(connect.ht_capa));
@@ -6239,8 +6290,35 @@ nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
        [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
        [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
        [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
+       [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
+       [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
+       [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
 };
 
+static int nl80211_set_cqm_txe(struct genl_info *info,
+                               u32 rate, u32 pkts, u32 intvl)
+{
+       struct cfg80211_registered_device *rdev = info->user_ptr[0];
+       struct wireless_dev *wdev;
+       struct net_device *dev = info->user_ptr[1];
+
+       if ((rate < 0 || rate > 100) ||
+           (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
+               return -EINVAL;
+
+       wdev = dev->ieee80211_ptr;
+
+       if (!rdev->ops->set_cqm_txe_config)
+               return -EOPNOTSUPP;
+
+       if (wdev->iftype != NL80211_IFTYPE_STATION &&
+           wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
+               return -EOPNOTSUPP;
+
+       return rdev->ops->set_cqm_txe_config(wdev->wiphy, dev,
+                                            rate, pkts, intvl);
+}
+
 static int nl80211_set_cqm_rssi(struct genl_info *info,
                                s32 threshold, u32 hysteresis)
 {
@@ -6288,6 +6366,14 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
                threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
                hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
                err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
+       } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
+                  attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
+                  attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
+               u32 rate, pkts, intvl;
+               rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
+               pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
+               intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
+               err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
        } else
                err = -EINVAL;
 
@@ -6444,8 +6530,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
        struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
-       struct cfg80211_wowlan no_triggers = {};
        struct cfg80211_wowlan new_triggers = {};
+       struct cfg80211_wowlan *ntrig;
        struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
        int err, i;
        bool prev_enabled = rdev->wowlan;
@@ -6453,8 +6539,11 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
                return -EOPNOTSUPP;
 
-       if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
-               goto no_triggers;
+       if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
+               cfg80211_rdev_free_wowlan(rdev);
+               rdev->wowlan = NULL;
+               goto set_wakeup;
+       }
 
        err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
                        nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
@@ -6565,22 +6654,15 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                }
        }
 
-       if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
-               struct cfg80211_wowlan *ntrig;
-               ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
-                               GFP_KERNEL);
-               if (!ntrig) {
-                       err = -ENOMEM;
-                       goto error;
-               }
-               cfg80211_rdev_free_wowlan(rdev);
-               rdev->wowlan = ntrig;
-       } else {
- no_triggers:
-               cfg80211_rdev_free_wowlan(rdev);
-               rdev->wowlan = NULL;
+       ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
+       if (!ntrig) {
+               err = -ENOMEM;
+               goto error;
        }
+       cfg80211_rdev_free_wowlan(rdev);
+       rdev->wowlan = ntrig;
 
+ set_wakeup:
        if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
                rdev->ops->set_wakeup(&rdev->wiphy, rdev->wowlan);
 
@@ -6874,7 +6956,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_del_interface,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-               .internal_flags = NL80211_FLAG_NEED_NETDEV |
+               .internal_flags = NL80211_FLAG_NEED_WDEV |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -7045,7 +7127,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_trigger_scan,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-               .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+               .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -7437,7 +7519,7 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
 
 static int nl80211_send_scan_msg(struct sk_buff *msg,
                                 struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev,
+                                struct wireless_dev *wdev,
                                 u32 pid, u32 seq, int flags,
                                 u32 cmd)
 {
@@ -7448,7 +7530,9 @@ static int nl80211_send_scan_msg(struct sk_buff *msg,
                return -1;
 
        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
-           nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
+           (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
+                                        wdev->netdev->ifindex)) ||
+           nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
                goto nla_put_failure;
 
        /* ignore errors and send incomplete event anyway */
@@ -7485,15 +7569,15 @@ nl80211_send_sched_scan_msg(struct sk_buff *msg,
 }
 
 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
-                            struct net_device *netdev)
+                            struct wireless_dev *wdev)
 {
        struct sk_buff *msg;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return;
 
-       if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+       if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
                                  NL80211_CMD_TRIGGER_SCAN) < 0) {
                nlmsg_free(msg);
                return;
@@ -7504,7 +7588,7 @@ void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
 }
 
 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
-                           struct net_device *netdev)
+                           struct wireless_dev *wdev)
 {
        struct sk_buff *msg;
 
@@ -7512,7 +7596,7 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
        if (!msg)
                return;
 
-       if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+       if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
                                  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
                nlmsg_free(msg);
                return;
@@ -7523,7 +7607,7 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
 }
 
 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
-                              struct net_device *netdev)
+                              struct wireless_dev *wdev)
 {
        struct sk_buff *msg;
 
@@ -7531,7 +7615,7 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
        if (!msg)
                return;
 
-       if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+       if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
                                  NL80211_CMD_SCAN_ABORTED) < 0) {
                nlmsg_free(msg);
                return;
@@ -7565,7 +7649,7 @@ void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
 {
        struct sk_buff *msg;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return;
 
@@ -7781,7 +7865,7 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
        struct sk_buff *msg;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -7821,7 +7905,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
        struct sk_buff *msg;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -7859,7 +7943,7 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
        struct sk_buff *msg;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return;
 
@@ -8075,7 +8159,7 @@ static void nl80211_send_remain_on_chan_event(
        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
            (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
                                         wdev->netdev->ifindex)) ||
-           nla_put_u32(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
+           nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
            nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
            nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
            nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
@@ -8124,7 +8208,7 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
 {
        struct sk_buff *msg;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8145,7 +8229,7 @@ void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
        struct sk_buff *msg;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8312,7 +8396,7 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
        struct nlattr *pinfoattr;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8355,7 +8439,7 @@ void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
        struct nlattr *rekey_attr;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8399,7 +8483,7 @@ void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
        struct nlattr *attr;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8443,7 +8527,7 @@ void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
        struct sk_buff *msg;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8469,6 +8553,56 @@ void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
        nlmsg_free(msg);
 }
 
+void
+nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
+                           struct net_device *netdev, const u8 *peer,
+                           u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
+{
+       struct sk_buff *msg;
+       struct nlattr *pinfoattr;
+       void *hdr;
+
+       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       if (!msg)
+               return;
+
+       hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
+       if (!hdr) {
+               nlmsg_free(msg);
+               return;
+       }
+
+       if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+           nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+           nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
+               goto nla_put_failure;
+
+       pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
+       if (!pinfoattr)
+               goto nla_put_failure;
+
+       if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
+               goto nla_put_failure;
+
+       if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
+               goto nla_put_failure;
+
+       if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
+               goto nla_put_failure;
+
+       nla_nest_end(msg, pinfoattr);
+
+       genlmsg_end(msg, hdr);
+
+       genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                               nl80211_mlme_mcgrp.id, gfp);
+       return;
+
+ nla_put_failure:
+       genlmsg_cancel(msg, hdr);
+       nlmsg_free(msg);
+}
+
 void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev, const u8 *peer,
@@ -8478,7 +8612,7 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
        struct nlattr *pinfoattr;
        void *hdr;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;
 
@@ -8522,7 +8656,7 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
        void *hdr;
        int err;
 
-       msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;