ax25: fix reference count leaks of ax25_dev
[linux-2.6-block.git] / net / ax25 / ax25_route.c
CommitLineData
2874c5fd 1// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 2/*
1da177e4
LT
3 *
4 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
5 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
6 * Copyright (C) Steven Whitehouse GW7RRM (stevew@acm.org)
7 * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
8 * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
9 * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
10 */
4fc268d2
RD
11
12#include <linux/capability.h>
1da177e4
LT
13#include <linux/errno.h>
14#include <linux/types.h>
15#include <linux/socket.h>
16#include <linux/timer.h>
17#include <linux/in.h>
18#include <linux/kernel.h>
19#include <linux/sched.h>
20#include <linux/string.h>
21#include <linux/sockios.h>
22#include <linux/net.h>
5a0e3ad6 23#include <linux/slab.h>
1da177e4
LT
24#include <net/ax25.h>
25#include <linux/inet.h>
26#include <linux/netdevice.h>
27#include <linux/if_arp.h>
28#include <linux/skbuff.h>
29#include <linux/spinlock.h>
30#include <net/sock.h>
7c0f6ba6 31#include <linux/uaccess.h>
1da177e4
LT
32#include <linux/fcntl.h>
33#include <linux/mm.h>
34#include <linux/interrupt.h>
35#include <linux/init.h>
36#include <linux/seq_file.h>
bc3b2d7f 37#include <linux/export.h>
1da177e4
LT
38
39static ax25_route *ax25_route_list;
63530aba 40DEFINE_RWLOCK(ax25_route_lock);
1da177e4 41
1da177e4
LT
42void ax25_rt_device_down(struct net_device *dev)
43{
44 ax25_route *s, *t, *ax25_rt;
45
4de211f1 46 write_lock_bh(&ax25_route_lock);
1da177e4
LT
47 ax25_rt = ax25_route_list;
48 while (ax25_rt != NULL) {
49 s = ax25_rt;
50 ax25_rt = ax25_rt->next;
51
52 if (s->dev == dev) {
53 if (ax25_route_list == s) {
54 ax25_route_list = s->next;
a51482bd 55 kfree(s->digipeat);
1da177e4
LT
56 kfree(s);
57 } else {
58 for (t = ax25_route_list; t != NULL; t = t->next) {
59 if (t->next == s) {
60 t->next = s->next;
a51482bd 61 kfree(s->digipeat);
1da177e4
LT
62 kfree(s);
63 break;
64 }
65 }
66 }
67 }
68 }
4de211f1 69 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
70}
71
c9266b99 72static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
1da177e4
LT
73{
74 ax25_route *ax25_rt;
75 ax25_dev *ax25_dev;
76 int i;
77
1da177e4
LT
78 if (route->digi_count > AX25_MAX_DIGIS)
79 return -EINVAL;
80
87563a04
DZ
81 ax25_dev = ax25_addr_ax25dev(&route->port_addr);
82 if (!ax25_dev)
83 return -EINVAL;
84
4de211f1 85 write_lock_bh(&ax25_route_lock);
1da177e4
LT
86
87 ax25_rt = ax25_route_list;
88 while (ax25_rt != NULL) {
89 if (ax25cmp(&ax25_rt->callsign, &route->dest_addr) == 0 &&
528930b9 90 ax25_rt->dev == ax25_dev->dev) {
a51482bd
JJ
91 kfree(ax25_rt->digipeat);
92 ax25_rt->digipeat = NULL;
1da177e4
LT
93 if (route->digi_count != 0) {
94 if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
4de211f1 95 write_unlock_bh(&ax25_route_lock);
87563a04 96 ax25_dev_put(ax25_dev);
1da177e4
LT
97 return -ENOMEM;
98 }
99 ax25_rt->digipeat->lastrepeat = -1;
100 ax25_rt->digipeat->ndigi = route->digi_count;
101 for (i = 0; i < route->digi_count; i++) {
102 ax25_rt->digipeat->repeated[i] = 0;
103 ax25_rt->digipeat->calls[i] = route->digi_addr[i];
104 }
105 }
4de211f1 106 write_unlock_bh(&ax25_route_lock);
87563a04 107 ax25_dev_put(ax25_dev);
1da177e4
LT
108 return 0;
109 }
110 ax25_rt = ax25_rt->next;
111 }
112
113 if ((ax25_rt = kmalloc(sizeof(ax25_route), GFP_ATOMIC)) == NULL) {
4de211f1 114 write_unlock_bh(&ax25_route_lock);
87563a04 115 ax25_dev_put(ax25_dev);
1da177e4
LT
116 return -ENOMEM;
117 }
118
39f25d42 119 refcount_set(&ax25_rt->refcount, 1);
1da177e4
LT
120 ax25_rt->callsign = route->dest_addr;
121 ax25_rt->dev = ax25_dev->dev;
122 ax25_rt->digipeat = NULL;
123 ax25_rt->ip_mode = ' ';
124 if (route->digi_count != 0) {
125 if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
4de211f1 126 write_unlock_bh(&ax25_route_lock);
1da177e4 127 kfree(ax25_rt);
87563a04 128 ax25_dev_put(ax25_dev);
1da177e4
LT
129 return -ENOMEM;
130 }
131 ax25_rt->digipeat->lastrepeat = -1;
132 ax25_rt->digipeat->ndigi = route->digi_count;
133 for (i = 0; i < route->digi_count; i++) {
134 ax25_rt->digipeat->repeated[i] = 0;
135 ax25_rt->digipeat->calls[i] = route->digi_addr[i];
136 }
137 }
138 ax25_rt->next = ax25_route_list;
139 ax25_route_list = ax25_rt;
4de211f1 140 write_unlock_bh(&ax25_route_lock);
87563a04 141 ax25_dev_put(ax25_dev);
1da177e4
LT
142
143 return 0;
144}
145
006f68b8 146void __ax25_put_route(ax25_route *ax25_rt)
1da177e4 147{
006f68b8
RBD
148 kfree(ax25_rt->digipeat);
149 kfree(ax25_rt);
1da177e4
LT
150}
151
152static int ax25_rt_del(struct ax25_routes_struct *route)
153{
154 ax25_route *s, *t, *ax25_rt;
155 ax25_dev *ax25_dev;
156
157 if ((ax25_dev = ax25_addr_ax25dev(&route->port_addr)) == NULL)
158 return -EINVAL;
159
4de211f1 160 write_lock_bh(&ax25_route_lock);
1da177e4
LT
161
162 ax25_rt = ax25_route_list;
163 while (ax25_rt != NULL) {
164 s = ax25_rt;
165 ax25_rt = ax25_rt->next;
166 if (s->dev == ax25_dev->dev &&
167 ax25cmp(&route->dest_addr, &s->callsign) == 0) {
168 if (ax25_route_list == s) {
169 ax25_route_list = s->next;
006f68b8 170 ax25_put_route(s);
1da177e4
LT
171 } else {
172 for (t = ax25_route_list; t != NULL; t = t->next) {
173 if (t->next == s) {
174 t->next = s->next;
006f68b8 175 ax25_put_route(s);
1da177e4
LT
176 break;
177 }
178 }
179 }
180 }
181 }
4de211f1 182 write_unlock_bh(&ax25_route_lock);
87563a04 183 ax25_dev_put(ax25_dev);
1da177e4
LT
184
185 return 0;
186}
187
188static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option)
189{
190 ax25_route *ax25_rt;
191 ax25_dev *ax25_dev;
192 int err = 0;
193
194 if ((ax25_dev = ax25_addr_ax25dev(&rt_option->port_addr)) == NULL)
195 return -EINVAL;
196
4de211f1 197 write_lock_bh(&ax25_route_lock);
1da177e4
LT
198
199 ax25_rt = ax25_route_list;
200 while (ax25_rt != NULL) {
201 if (ax25_rt->dev == ax25_dev->dev &&
202 ax25cmp(&rt_option->dest_addr, &ax25_rt->callsign) == 0) {
203 switch (rt_option->cmd) {
204 case AX25_SET_RT_IPMODE:
205 switch (rt_option->arg) {
206 case ' ':
207 case 'D':
208 case 'V':
209 ax25_rt->ip_mode = rt_option->arg;
210 break;
211 default:
212 err = -EINVAL;
213 goto out;
214 }
215 break;
216 default:
217 err = -EINVAL;
218 goto out;
219 }
220 }
221 ax25_rt = ax25_rt->next;
222 }
223
224out:
4de211f1 225 write_unlock_bh(&ax25_route_lock);
87563a04 226 ax25_dev_put(ax25_dev);
1da177e4
LT
227 return err;
228}
229
230int ax25_rt_ioctl(unsigned int cmd, void __user *arg)
231{
232 struct ax25_route_opt_struct rt_option;
233 struct ax25_routes_struct route;
234
235 switch (cmd) {
236 case SIOCADDRT:
237 if (copy_from_user(&route, arg, sizeof(route)))
238 return -EFAULT;
239 return ax25_rt_add(&route);
240
241 case SIOCDELRT:
242 if (copy_from_user(&route, arg, sizeof(route)))
243 return -EFAULT;
244 return ax25_rt_del(&route);
245
246 case SIOCAX25OPTRT:
247 if (copy_from_user(&rt_option, arg, sizeof(rt_option)))
248 return -EFAULT;
249 return ax25_rt_opt(&rt_option);
250
251 default:
252 return -EINVAL;
253 }
254}
255
256#ifdef CONFIG_PROC_FS
257
258static void *ax25_rt_seq_start(struct seq_file *seq, loff_t *pos)
f16f3026 259 __acquires(ax25_route_lock)
1da177e4
LT
260{
261 struct ax25_route *ax25_rt;
262 int i = 1;
528930b9
YH
263
264 read_lock(&ax25_route_lock);
1da177e4
LT
265 if (*pos == 0)
266 return SEQ_START_TOKEN;
267
268 for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
269 if (i == *pos)
270 return ax25_rt;
271 ++i;
272 }
273
274 return NULL;
275}
276
277static void *ax25_rt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
278{
279 ++*pos;
528930b9 280 return (v == SEQ_START_TOKEN) ? ax25_route_list :
1da177e4
LT
281 ((struct ax25_route *) v)->next;
282}
283
284static void ax25_rt_seq_stop(struct seq_file *seq, void *v)
f16f3026 285 __releases(ax25_route_lock)
1da177e4
LT
286{
287 read_unlock(&ax25_route_lock);
288}
289
290static int ax25_rt_seq_show(struct seq_file *seq, void *v)
291{
f75268cd
RB
292 char buf[11];
293
1da177e4
LT
294 if (v == SEQ_START_TOKEN)
295 seq_puts(seq, "callsign dev mode digipeaters\n");
296 else {
297 struct ax25_route *ax25_rt = v;
298 const char *callsign;
299 int i;
300
301 if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0)
302 callsign = "default";
303 else
f75268cd 304 callsign = ax2asc(buf, &ax25_rt->callsign);
1da177e4
LT
305
306 seq_printf(seq, "%-9s %-4s",
307 callsign,
308 ax25_rt->dev ? ax25_rt->dev->name : "???");
309
310 switch (ax25_rt->ip_mode) {
311 case 'V':
312 seq_puts(seq, " vc");
313 break;
314 case 'D':
315 seq_puts(seq, " dg");
316 break;
317 default:
318 seq_puts(seq, " *");
319 break;
320 }
321
322 if (ax25_rt->digipeat != NULL)
323 for (i = 0; i < ax25_rt->digipeat->ndigi; i++)
f75268cd
RB
324 seq_printf(seq, " %s",
325 ax2asc(buf, &ax25_rt->digipeat->calls[i]));
1da177e4
LT
326
327 seq_puts(seq, "\n");
328 }
329 return 0;
330}
331
fddda2b7 332const struct seq_operations ax25_rt_seqops = {
1da177e4
LT
333 .start = ax25_rt_seq_start,
334 .next = ax25_rt_seq_next,
335 .stop = ax25_rt_seq_stop,
336 .show = ax25_rt_seq_show,
337};
1da177e4
LT
338#endif
339
340/*
341 * Find AX.25 route
342 *
3f072310 343 * Only routes with a reference count of zero can be destroyed.
63530aba 344 * Must be called with ax25_route_lock read locked.
1da177e4 345 */
006f68b8 346ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
1da177e4
LT
347{
348 ax25_route *ax25_spe_rt = NULL;
349 ax25_route *ax25_def_rt = NULL;
350 ax25_route *ax25_rt;
351
1da177e4
LT
352 /*
353 * Bind to the physical interface we heard them on, or the default
354 * route if none is found;
355 */
356 for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
357 if (dev == NULL) {
358 if (ax25cmp(&ax25_rt->callsign, addr) == 0 && ax25_rt->dev != NULL)
359 ax25_spe_rt = ax25_rt;
360 if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0 && ax25_rt->dev != NULL)
361 ax25_def_rt = ax25_rt;
362 } else {
363 if (ax25cmp(&ax25_rt->callsign, addr) == 0 && ax25_rt->dev == dev)
364 ax25_spe_rt = ax25_rt;
365 if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0 && ax25_rt->dev == dev)
366 ax25_def_rt = ax25_rt;
367 }
368 }
369
370 ax25_rt = ax25_def_rt;
371 if (ax25_spe_rt != NULL)
372 ax25_rt = ax25_spe_rt;
373
1da177e4
LT
374 return ax25_rt;
375}
376
377/*
378 * Adjust path: If you specify a default route and want to connect
379 * a target on the digipeater path but w/o having a special route
380 * set before, the path has to be truncated from your target on.
381 */
382static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
383{
384 int k;
385
386 for (k = 0; k < digipeat->ndigi; k++) {
387 if (ax25cmp(addr, &digipeat->calls[k]) == 0)
388 break;
389 }
390
391 digipeat->ndigi = k;
392}
393
394
395/*
396 * Find which interface to use.
397 */
398int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
399{
01d7dd0e 400 ax25_uid_assoc *user;
1da177e4 401 ax25_route *ax25_rt;
b3d18f15 402 int err = 0;
1da177e4 403
63530aba
ED
404 ax25_route_lock_use();
405 ax25_rt = ax25_get_route(addr, NULL);
406 if (!ax25_rt) {
407 ax25_route_lock_unuse();
1da177e4 408 return -EHOSTUNREACH;
63530aba 409 }
1da177e4
LT
410 if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
411 err = -EHOSTUNREACH;
412 goto put;
413 }
414
73400407 415 user = ax25_findbyuid(current_euid());
01d7dd0e
RB
416 if (user) {
417 ax25->source_addr = user->call;
418 ax25_uid_put(user);
419 } else {
1da177e4
LT
420 if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
421 err = -EPERM;
422 goto put;
423 }
01d7dd0e 424 ax25->source_addr = *(ax25_address *)ax25->ax25_dev->dev->dev_addr;
1da177e4
LT
425 }
426
1da177e4 427 if (ax25_rt->digipeat != NULL) {
0459d70a
ACM
428 ax25->digipeat = kmemdup(ax25_rt->digipeat, sizeof(ax25_digi),
429 GFP_ATOMIC);
430 if (ax25->digipeat == NULL) {
1da177e4
LT
431 err = -ENOMEM;
432 goto put;
433 }
1da177e4
LT
434 ax25_adjust_path(addr, ax25->digipeat);
435 }
436
437 if (ax25->sk != NULL) {
d4d5d8e8 438 local_bh_disable();
1da177e4
LT
439 bh_lock_sock(ax25->sk);
440 sock_reset_flag(ax25->sk, SOCK_ZAPPED);
441 bh_unlock_sock(ax25->sk);
d4d5d8e8 442 local_bh_enable();
1da177e4
LT
443 }
444
445put:
63530aba 446 ax25_route_lock_unuse();
b3d18f15 447 return err;
1da177e4
LT
448}
449
1da177e4
LT
450struct sk_buff *ax25_rt_build_path(struct sk_buff *skb, ax25_address *src,
451 ax25_address *dest, ax25_digi *digi)
452{
1da177e4
LT
453 unsigned char *bp;
454 int len;
455
456 len = digi->ndigi * AX25_ADDR_LEN;
457
53744a4a
VA
458 if (unlikely(skb_headroom(skb) < len)) {
459 skb = skb_expand_head(skb, len);
460 if (!skb) {
1da177e4
LT
461 printk(KERN_CRIT "AX.25: ax25_dg_build_path - out of memory\n");
462 return NULL;
463 }
1da177e4
LT
464 }
465
466 bp = skb_push(skb, len);
467
468 ax25_addr_build(bp, src, dest, digi, AX25_COMMAND, AX25_MODULUS);
469
470 return skb;
471}
472
473/*
474 * Free all memory associated with routing structures.
475 */
476void __exit ax25_rt_free(void)
477{
478 ax25_route *s, *ax25_rt = ax25_route_list;
479
4de211f1 480 write_lock_bh(&ax25_route_lock);
1da177e4
LT
481 while (ax25_rt != NULL) {
482 s = ax25_rt;
483 ax25_rt = ax25_rt->next;
484
a51482bd 485 kfree(s->digipeat);
1da177e4
LT
486 kfree(s);
487 }
4de211f1 488 write_unlock_bh(&ax25_route_lock);
1da177e4 489}