projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
net/rose: Fix Use-After-Free in rose_ioctl
[linux-2.6-block.git] / net / rose / af_rose.c
CommitLineData
2874c5fd 1// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 2/*
1da177e4
LT		 3 *
4 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
5 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
6 * Copyright (C) Terry Dawson VK2KTJ (terry@animats.net)
7 * Copyright (C) Tomi Manninen OH2BNS (oh2bns@sral.fi)
8 */
4fc268d2 9
4fc268d2 10#include <linux/capability.h>
1da177e4
LT		 11#include <linux/module.h>
12#include <linux/moduleparam.h>
13#include <linux/init.h>
14#include <linux/errno.h>
15#include <linux/types.h>
16#include <linux/socket.h>
17#include <linux/in.h>
5a0e3ad6 18#include <linux/slab.h>
1da177e4 19#include <linux/kernel.h>
3f07c014 20#include <linux/sched/signal.h>
1da177e4
LT		 21#include <linux/spinlock.h>
22#include <linux/timer.h>
23#include <linux/string.h>
24#include <linux/sockios.h>
25#include <linux/net.h>
26#include <linux/stat.h>
457c4cbc 27#include <net/net_namespace.h>
1da177e4
LT		 28#include <net/ax25.h>
29#include <linux/inet.h>
30#include <linux/netdevice.h>
31#include <linux/if_arp.h>
32#include <linux/skbuff.h>
33#include <net/sock.h>
7c0f6ba6 34#include <linux/uaccess.h>
1da177e4
LT		 35#include <linux/fcntl.h>
36#include <linux/termios.h>
37#include <linux/mm.h>
38#include <linux/interrupt.h>
39#include <linux/notifier.h>
40#include <net/rose.h>
41#include <linux/proc_fs.h>
42#include <linux/seq_file.h>
c752f073 43#include <net/tcp_states.h>
1da177e4
LT		 44#include <net/ip.h>
45#include <net/arp.h>
46
47static int rose_ndevs = 10;
48
49int sysctl_rose_restart_request_timeout = ROSE_DEFAULT_T0;
50int sysctl_rose_call_request_timeout = ROSE_DEFAULT_T1;
51int sysctl_rose_reset_request_timeout = ROSE_DEFAULT_T2;
52int sysctl_rose_clear_request_timeout = ROSE_DEFAULT_T3;
53int sysctl_rose_no_activity_timeout = ROSE_DEFAULT_IDLE;
54int sysctl_rose_ack_hold_back_timeout = ROSE_DEFAULT_HB;
55int sysctl_rose_routing_control = ROSE_DEFAULT_ROUTING;
56int sysctl_rose_link_fail_timeout = ROSE_DEFAULT_FAIL_TIMEOUT;
57int sysctl_rose_maximum_vcs = ROSE_DEFAULT_MAXVC;
58int sysctl_rose_window_size = ROSE_DEFAULT_WINDOW_SIZE;
59
60static HLIST_HEAD(rose_list);
61static DEFINE_SPINLOCK(rose_list_lock);
62
5708e868 63static const struct proto_ops rose_proto_ops;
1da177e4
LT		 64
65ax25_address rose_callsign;
66
1a33e10e
CW		 67/*
68 * ROSE network devices are virtual network devices encapsulating ROSE
69 * frames into AX.25 which will be sent through an AX.25 device, so form a
70 * special "super class" of normal net devices; split their locks off into a
71 * separate class since they always nest.
72 */
73static struct lock_class_key rose_netdev_xmit_lock_key;
845e0ebb 74static struct lock_class_key rose_netdev_addr_lock_key;
1a33e10e
CW		 75
76static void rose_set_lockdep_one(struct net_device *dev,
77 struct netdev_queue *txq,
78 void *_unused)
79{
80 lockdep_set_class(&txq->_xmit_lock, &rose_netdev_xmit_lock_key);
81}
82
83static void rose_set_lockdep_key(struct net_device *dev)
84{
845e0ebb 85 lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
1a33e10e
CW		 86 netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
87}
88
1da177e4
LT		 89/*
90 * Convert a ROSE address into text.
91 */
dcf777f6 92char *rose2asc(char *buf, const rose_address *addr)
1da177e4 93{
1da177e4
LT		 94 if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
95 addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
96 addr->rose_addr[4] == 0x00) {
dcf777f6 97 strcpy(buf, "*");
1da177e4 98 } else {
dcf777f6 99 sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
1da177e4
LT		 100 addr->rose_addr[1] & 0xFF,
101 addr->rose_addr[2] & 0xFF,
102 addr->rose_addr[3] & 0xFF,
103 addr->rose_addr[4] & 0xFF);
104 }
105
dcf777f6 106 return buf;
1da177e4
LT		 107}
108
109/*
110 * Compare two ROSE addresses, 0 == equal.
111 */
db957324 112int rosecmp(const rose_address *addr1, const rose_address *addr2)
1da177e4
LT		 113{
114 int i;
115
116 for (i = 0; i < 5; i++)
117 if (addr1->rose_addr[i] != addr2->rose_addr[i])
118 return 1;
119
120 return 0;
121}
122
123/*
124 * Compare two ROSE addresses for only mask digits, 0 == equal.
125 */
db957324
JK		 126int rosecmpm(const rose_address *addr1, const rose_address *addr2,
127 unsigned short mask)
1da177e4 128{
95b7d924 129 unsigned int i, j;
1da177e4
LT		 130
131 if (mask > 10)
132 return 1;
133
134 for (i = 0; i < mask; i++) {
135 j = i / 2;
136
137 if ((i % 2) != 0) {
138 if ((addr1->rose_addr[j] & 0x0F) != (addr2->rose_addr[j] & 0x0F))
139 return 1;
140 } else {
141 if ((addr1->rose_addr[j] & 0xF0) != (addr2->rose_addr[j] & 0xF0))
142 return 1;
143 }
144 }
145
146 return 0;
147}
148
149/*
150 * Socket removal during an interrupt is now safe.
151 */
152static void rose_remove_socket(struct sock *sk)
153{
154 spin_lock_bh(&rose_list_lock);
155 sk_del_node_init(sk);
156 spin_unlock_bh(&rose_list_lock);
157}
158
159/*
160 * Kill all bound sockets on a broken link layer connection to a
161 * particular neighbour.
162 */
163void rose_kill_by_neigh(struct rose_neigh *neigh)
164{
165 struct sock *s;
1da177e4
LT		 166
167 spin_lock_bh(&rose_list_lock);
b67bfe0d 168 sk_for_each(s, &rose_list) {
1da177e4
LT		 169 struct rose_sock *rose = rose_sk(s);
170
171 if (rose->neighbour == neigh) {
172 rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
173 rose->neighbour->use--;
174 rose->neighbour = NULL;
175 }
176 }
177 spin_unlock_bh(&rose_list_lock);
178}
179
180/*
181 * Kill all bound sockets on a dropped device.
182 */
183static void rose_kill_by_device(struct net_device *dev)
184{
185 struct sock *s;
1da177e4
LT		 186
187 spin_lock_bh(&rose_list_lock);
b67bfe0d 188 sk_for_each(s, &rose_list) {
1da177e4
LT		 189 struct rose_sock *rose = rose_sk(s);
190
191 if (rose->device == dev) {
192 rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
d496f784
RB		 193 if (rose->neighbour)
194 rose->neighbour->use--;
2df91e39 195 netdev_put(rose->device, &rose->dev_tracker);
1da177e4
LT		 196 rose->device = NULL;
197 }
198 }
199 spin_unlock_bh(&rose_list_lock);
200}
201
202/*
203 * Handle device status changes.
204 */
351638e7
JP		 205static int rose_device_event(struct notifier_block *this,
206 unsigned long event, void *ptr)
1da177e4 207{
351638e7 208 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1da177e4 209
721499e8 210 if (!net_eq(dev_net(dev), &init_net))
e9dc8653
EB		 211 return NOTIFY_DONE;
212
1da177e4
LT		 213 if (event != NETDEV_DOWN)
214 return NOTIFY_DONE;
215
216 switch (dev->type) {
217 case ARPHRD_ROSE:
218 rose_kill_by_device(dev);
219 break;
220 case ARPHRD_AX25:
221 rose_link_device_down(dev);
222 rose_rt_device_down(dev);
223 break;
224 }
225
226 return NOTIFY_DONE;
227}
228
229/*
230 * Add a socket to the bound sockets list.
231 */
232static void rose_insert_socket(struct sock *sk)
233{
234
235 spin_lock_bh(&rose_list_lock);
236 sk_add_node(sk, &rose_list);
237 spin_unlock_bh(&rose_list_lock);
238}
239
240/*
241 * Find a socket that wants to accept the Call Request we just
242 * received.
243 */
244static struct sock *rose_find_listener(rose_address *addr, ax25_address *call)
245{
246 struct sock *s;
1da177e4
LT		 247
248 spin_lock_bh(&rose_list_lock);
b67bfe0d 249 sk_for_each(s, &rose_list) {
1da177e4
LT		 250 struct rose_sock *rose = rose_sk(s);
251
252 if (!rosecmp(&rose->source_addr, addr) &&
253 !ax25cmp(&rose->source_call, call) &&
254 !rose->source_ndigis && s->sk_state == TCP_LISTEN)
255 goto found;
256 }
257
b67bfe0d 258 sk_for_each(s, &rose_list) {
1da177e4
LT		 259 struct rose_sock *rose = rose_sk(s);
260
261 if (!rosecmp(&rose->source_addr, addr) &&
262 !ax25cmp(&rose->source_call, &null_ax25_address) &&
263 s->sk_state == TCP_LISTEN)
264 goto found;
265 }
266 s = NULL;
267found:
268 spin_unlock_bh(&rose_list_lock);
269 return s;
270}
271
272/*
273 * Find a connected ROSE socket given my LCI and device.
274 */
275struct sock *rose_find_socket(unsigned int lci, struct rose_neigh *neigh)
276{
277 struct sock *s;
1da177e4
LT		 278
279 spin_lock_bh(&rose_list_lock);
b67bfe0d 280 sk_for_each(s, &rose_list) {
1da177e4
LT		 281 struct rose_sock *rose = rose_sk(s);
282
283 if (rose->lci == lci && rose->neighbour == neigh)
284 goto found;
285 }
286 s = NULL;
287found:
288 spin_unlock_bh(&rose_list_lock);
289 return s;
290}
291
292/*
293 * Find a unique LCI for a given device.
294 */
295unsigned int rose_new_lci(struct rose_neigh *neigh)
296{
297 int lci;
298
299 if (neigh->dce_mode) {
300 for (lci = 1; lci <= sysctl_rose_maximum_vcs; lci++)
301 if (rose_find_socket(lci, neigh) == NULL && rose_route_free_lci(lci, neigh) == NULL)
302 return lci;
303 } else {
304 for (lci = sysctl_rose_maximum_vcs; lci > 0; lci--)
305 if (rose_find_socket(lci, neigh) == NULL && rose_route_free_lci(lci, neigh) == NULL)
306 return lci;
307 }
308
309 return 0;
310}
311
312/*
313 * Deferred destroy.
314 */
315void rose_destroy_socket(struct sock *);
316
317/*
318 * Handler for deferred kills.
319 */
4966babd 320static void rose_destroy_timer(struct timer_list *t)
1da177e4 321{
4966babd
KC		 322 struct sock *sk = from_timer(sk, t, sk_timer);
323
324 rose_destroy_socket(sk);
1da177e4
LT		 325}
326
327/*
328 * This is called from user mode and the timers. Thus it protects itself
329 * against interrupt users but doesn't worry about being called during
330 * work. Once it is removed from the queue no interrupt or bottom half
331 * will touch it and we are (fairly 8-) ) safe.
332 */
333void rose_destroy_socket(struct sock *sk)
334{
335 struct sk_buff *skb;
336
337 rose_remove_socket(sk);
338 rose_stop_heartbeat(sk);
339 rose_stop_idletimer(sk);
340 rose_stop_timer(sk);
341
342 rose_clear_queues(sk); /* Flush the queues */
343
344 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
345 if (skb->sk != sk) { /* A pending connection */
346 /* Queue the unaccepted socket for death */
347 sock_set_flag(skb->sk, SOCK_DEAD);
348 rose_start_heartbeat(skb->sk);
349 rose_sk(skb->sk)->state = ROSE_STATE_0;
350 }
351
352 kfree_skb(skb);
353 }
354
c564039f 355 if (sk_has_allocations(sk)) {
1da177e4 356 /* Defer: outstanding buffers */
4966babd 357 timer_setup(&sk->sk_timer, rose_destroy_timer, 0);
1da177e4 358 sk->sk_timer.expires = jiffies + 10 * HZ;
1da177e4
LT		 359 add_timer(&sk->sk_timer);
360 } else
361 sock_put(sk);
362}
363
364/*
365 * Handling for system calls applied via the various interfaces to a
366 * ROSE socket object.
367 */
368
369static int rose_setsockopt(struct socket *sock, int level, int optname,
a7b75c5a 370 sockptr_t optval, unsigned int optlen)
1da177e4
LT		 371{
372 struct sock *sk = sock->sk;
373 struct rose_sock *rose = rose_sk(sk);
374 int opt;
375
376 if (level != SOL_ROSE)
377 return -ENOPROTOOPT;
378
379 if (optlen < sizeof(int))
380 return -EINVAL;
381
a7b75c5a 382 if (copy_from_sockptr(&opt, optval, sizeof(int)))
1da177e4
LT		 383 return -EFAULT;
384
385 switch (optname) {
386 case ROSE_DEFER:
387 rose->defer = opt ? 1 : 0;
388 return 0;
389
390 case ROSE_T1:
391 if (opt < 1)
392 return -EINVAL;
393 rose->t1 = opt * HZ;
394 return 0;
395
396 case ROSE_T2:
397 if (opt < 1)
398 return -EINVAL;
399 rose->t2 = opt * HZ;
400 return 0;
401
402 case ROSE_T3:
403 if (opt < 1)
404 return -EINVAL;
405 rose->t3 = opt * HZ;
406 return 0;
407
408 case ROSE_HOLDBACK:
409 if (opt < 1)
410 return -EINVAL;
411 rose->hb = opt * HZ;
412 return 0;
413
414 case ROSE_IDLE:
415 if (opt < 0)
416 return -EINVAL;
417 rose->idle = opt * 60 * HZ;
418 return 0;
419
420 case ROSE_QBITINCL:
421 rose->qbitincl = opt ? 1 : 0;
422 return 0;
423
424 default:
425 return -ENOPROTOOPT;
426 }
427}
428
429static int rose_getsockopt(struct socket *sock, int level, int optname,
430 char __user *optval, int __user *optlen)
431{
432 struct sock *sk = sock->sk;
433 struct rose_sock *rose = rose_sk(sk);
434 int val = 0;
435 int len;
436
437 if (level != SOL_ROSE)
438 return -ENOPROTOOPT;
439
440 if (get_user(len, optlen))
441 return -EFAULT;
442
443 if (len < 0)
444 return -EINVAL;
445
446 switch (optname) {
447 case ROSE_DEFER:
448 val = rose->defer;
449 break;
450
451 case ROSE_T1:
452 val = rose->t1 / HZ;
453 break;
454
455 case ROSE_T2:
456 val = rose->t2 / HZ;
457 break;
458
459 case ROSE_T3:
460 val = rose->t3 / HZ;
461 break;
462
463 case ROSE_HOLDBACK:
464 val = rose->hb / HZ;
465 break;
466
467 case ROSE_IDLE:
468 val = rose->idle / (60 * HZ);
469 break;
470
471 case ROSE_QBITINCL:
472 val = rose->qbitincl;
473 break;
474
475 default:
476 return -ENOPROTOOPT;
477 }
478
479 len = min_t(unsigned int, len, sizeof(int));
480
481 if (put_user(len, optlen))
482 return -EFAULT;
483
484 return copy_to_user(optval, &val, len) ? -EFAULT : 0;
485}
486
487static int rose_listen(struct socket *sock, int backlog)
488{
489 struct sock *sk = sock->sk;
490
14caefcf
HK		 491 lock_sock(sk);
492 if (sock->state != SS_UNCONNECTED) {
493 release_sock(sk);
494 return -EINVAL;
495 }
496
1da177e4
LT		 497 if (sk->sk_state != TCP_LISTEN) {
498 struct rose_sock *rose = rose_sk(sk);
499
500 rose->dest_ndigis = 0;
501 memset(&rose->dest_addr, 0, ROSE_ADDR_LEN);
502 memset(&rose->dest_call, 0, AX25_ADDR_LEN);
503 memset(rose->dest_digis, 0, AX25_ADDR_LEN * ROSE_MAX_DIGIS);
504 sk->sk_max_ack_backlog = backlog;
505 sk->sk_state = TCP_LISTEN;
14caefcf 506 release_sock(sk);
1da177e4
LT		 507 return 0;
508 }
14caefcf 509 release_sock(sk);
1da177e4
LT		 510
511 return -EOPNOTSUPP;
512}
513
514static struct proto rose_proto = {
515 .name = "ROSE",
516 .owner = THIS_MODULE,
517 .obj_size = sizeof(struct rose_sock),
518};
519
3f378b68
EP		 520static int rose_create(struct net *net, struct socket *sock, int protocol,
521 int kern)
1da177e4
LT		 522{
523 struct sock *sk;
524 struct rose_sock *rose;
525
09ad9bc7 526 if (!net_eq(net, &init_net))
1b8d7ae4
EB		 527 return -EAFNOSUPPORT;
528
1da177e4
LT		 529 if (sock->type != SOCK_SEQPACKET || protocol != 0)
530 return -ESOCKTNOSUPPORT;
531
11aa9c28 532 sk = sk_alloc(net, PF_ROSE, GFP_ATOMIC, &rose_proto, kern);
6257ff21 533 if (sk == NULL)
1da177e4
LT		 534 return -ENOMEM;
535
536 rose = rose_sk(sk);
537
538 sock_init_data(sock, sk);
539
540 skb_queue_head_init(&rose->ack_queue);
541#ifdef M_BIT
542 skb_queue_head_init(&rose->frag_queue);
543 rose->fraglen = 0;
544#endif
545
546 sock->ops = &rose_proto_ops;
547 sk->sk_protocol = protocol;
548
4966babd
KC		 549 timer_setup(&rose->timer, NULL, 0);
550 timer_setup(&rose->idletimer, NULL, 0);
1da177e4 551
82e84249
RB		 552 rose->t1 = msecs_to_jiffies(sysctl_rose_call_request_timeout);
553 rose->t2 = msecs_to_jiffies(sysctl_rose_reset_request_timeout);
554 rose->t3 = msecs_to_jiffies(sysctl_rose_clear_request_timeout);
555 rose->hb = msecs_to_jiffies(sysctl_rose_ack_hold_back_timeout);
556 rose->idle = msecs_to_jiffies(sysctl_rose_no_activity_timeout);
1da177e4
LT		 557
558 rose->state = ROSE_STATE_0;
559
560 return 0;
561}
562
563static struct sock *rose_make_new(struct sock *osk)
564{
565 struct sock *sk;
566 struct rose_sock *rose, *orose;
567
568 if (osk->sk_type != SOCK_SEQPACKET)
569 return NULL;
570
11aa9c28 571 sk = sk_alloc(sock_net(osk), PF_ROSE, GFP_ATOMIC, &rose_proto, 0);
6257ff21 572 if (sk == NULL)
1da177e4
LT		 573 return NULL;
574
575 rose = rose_sk(sk);
576
577 sock_init_data(NULL, sk);
578
579 skb_queue_head_init(&rose->ack_queue);
580#ifdef M_BIT
581 skb_queue_head_init(&rose->frag_queue);
582 rose->fraglen = 0;
583#endif
584
585 sk->sk_type = osk->sk_type;
10bbf165 586 sk->sk_priority = READ_ONCE(osk->sk_priority);
1da177e4
LT		 587 sk->sk_protocol = osk->sk_protocol;
588 sk->sk_rcvbuf = osk->sk_rcvbuf;
589 sk->sk_sndbuf = osk->sk_sndbuf;
590 sk->sk_state = TCP_ESTABLISHED;
53b924b3 591 sock_copy_flags(sk, osk);
1da177e4 592
4966babd
KC		 593 timer_setup(&rose->timer, NULL, 0);
594 timer_setup(&rose->idletimer, NULL, 0);
1da177e4
LT		 595
596 orose = rose_sk(osk);
597 rose->t1 = orose->t1;
598 rose->t2 = orose->t2;
599 rose->t3 = orose->t3;
600 rose->hb = orose->hb;
601 rose->idle = orose->idle;
602 rose->defer = orose->defer;
603 rose->device = orose->device;
93102782 604 if (rose->device)
2df91e39 605 netdev_hold(rose->device, &rose->dev_tracker, GFP_ATOMIC);
1da177e4
LT		 606 rose->qbitincl = orose->qbitincl;
607
608 return sk;
609}
610
611static int rose_release(struct socket *sock)
612{
613 struct sock *sk = sock->sk;
614 struct rose_sock *rose;
615
616 if (sk == NULL) return 0;
617
4965291a
JP		 618 sock_hold(sk);
619 sock_orphan(sk);
620 lock_sock(sk);
1da177e4
LT		 621 rose = rose_sk(sk);
622
623 switch (rose->state) {
624 case ROSE_STATE_0:
4965291a 625 release_sock(sk);
1da177e4 626 rose_disconnect(sk, 0, -1, -1);
4965291a 627 lock_sock(sk);
1da177e4
LT		 628 rose_destroy_socket(sk);
629 break;
630
631 case ROSE_STATE_2:
632 rose->neighbour->use--;
4965291a 633 release_sock(sk);
1da177e4 634 rose_disconnect(sk, 0, -1, -1);
4965291a 635 lock_sock(sk);
1da177e4
LT		 636 rose_destroy_socket(sk);
637 break;
638
639 case ROSE_STATE_1:
640 case ROSE_STATE_3:
641 case ROSE_STATE_4:
642 case ROSE_STATE_5:
643 rose_clear_queues(sk);
644 rose_stop_idletimer(sk);
645 rose_write_internal(sk, ROSE_CLEAR_REQUEST);
646 rose_start_t3timer(sk);
647 rose->state = ROSE_STATE_2;
648 sk->sk_state = TCP_CLOSE;
649 sk->sk_shutdown |= SEND_SHUTDOWN;
650 sk->sk_state_change(sk);
651 sock_set_flag(sk, SOCK_DEAD);
652 sock_set_flag(sk, SOCK_DESTROY);
653 break;
654
655 default:
656 break;
657 }
658
2df91e39 659 netdev_put(rose->device, &rose->dev_tracker);
1da177e4 660 sock->sk = NULL;
4965291a
JP		 661 release_sock(sk);
662 sock_put(sk);
1da177e4
LT		 663
664 return 0;
665}
666
667static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
668{
669 struct sock *sk = sock->sk;
670 struct rose_sock *rose = rose_sk(sk);
671 struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
672 struct net_device *dev;
01d7dd0e
RB		 673 ax25_address *source;
674 ax25_uid_assoc *user;
1da177e4
LT		 675 int n;
676
677 if (!sock_flag(sk, SOCK_ZAPPED))
678 return -EINVAL;
679
680 if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
681 return -EINVAL;
682
683 if (addr->srose_family != AF_ROSE)
684 return -EINVAL;
685
686 if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
687 return -EINVAL;
688
9828e6e6 689 if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
1da177e4
LT		 690 return -EINVAL;
691
8849b720 692 if ((dev = rose_dev_get(&addr->srose_addr)) == NULL)
1da177e4 693 return -EADDRNOTAVAIL;
1da177e4
LT		 694
695 source = &addr->srose_call;
696
c2a2b8d3 697 user = ax25_findbyuid(current_euid());
01d7dd0e
RB		 698 if (user) {
699 rose->source_call = user->call;
700 ax25_uid_put(user);
701 } else {
3b9c9f3b
Y		 702 if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
703 dev_put(dev);
1da177e4 704 return -EACCES;
3b9c9f3b 705 }
01d7dd0e 706 rose->source_call = *source;
1da177e4
LT		 707 }
708
709 rose->source_addr = addr->srose_addr;
1da177e4 710 rose->device = dev;
2df91e39 711 netdev_tracker_alloc(rose->device, &rose->dev_tracker, GFP_KERNEL);
1da177e4
LT		 712 rose->source_ndigis = addr->srose_ndigis;
713
714 if (addr_len == sizeof(struct full_sockaddr_rose)) {
715 struct full_sockaddr_rose *full_addr = (struct full_sockaddr_rose *)uaddr;
716 for (n = 0 ; n < addr->srose_ndigis ; n++)
717 rose->source_digis[n] = full_addr->srose_digis[n];
718 } else {
719 if (rose->source_ndigis == 1) {
720 rose->source_digis[0] = addr->srose_digi;
721 }
722 }
723
724 rose_insert_socket(sk);
725
726 sock_reset_flag(sk, SOCK_ZAPPED);
8849b720 727
1da177e4
LT		 728 return 0;
729}
730
731static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)
732{
733 struct sock *sk = sock->sk;
734 struct rose_sock *rose = rose_sk(sk);
735 struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
736 unsigned char cause, diagnostic;
01d7dd0e 737 ax25_uid_assoc *user;
2536b94a 738 int n, err = 0;
1da177e4
LT		 739
740 if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
741 return -EINVAL;
742
743 if (addr->srose_family != AF_ROSE)
744 return -EINVAL;
745
746 if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
747 return -EINVAL;
748
9828e6e6 749 if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
1da177e4
LT		 750 return -EINVAL;
751
752 /* Source + Destination digis should not exceed ROSE_MAX_DIGIS */
753 if ((rose->source_ndigis + addr->srose_ndigis) > ROSE_MAX_DIGIS)
754 return -EINVAL;
755
2536b94a
RB		 756 lock_sock(sk);
757
758 if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
759 /* Connect completed during a ERESTARTSYS event */
760 sock->state = SS_CONNECTED;
761 goto out_release;
762 }
763
764 if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
765 sock->state = SS_UNCONNECTED;
766 err = -ECONNREFUSED;
767 goto out_release;
768 }
769
770 if (sk->sk_state == TCP_ESTABLISHED) {
771 /* No reconnect on a seqpacket socket */
772 err = -EISCONN;
773 goto out_release;
774 }
775
776 sk->sk_state = TCP_CLOSE;
777 sock->state = SS_UNCONNECTED;
778
1da177e4 779 rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
fe2c802a 780 &diagnostic, 0);
43837b1e
BP		 781 if (!rose->neighbour) {
782 err = -ENETUNREACH;
783 goto out_release;
784 }
1da177e4
LT		 785
786 rose->lci = rose_new_lci(rose->neighbour);
2536b94a
RB		 787 if (!rose->lci) {
788 err = -ENETUNREACH;
789 goto out_release;
790 }
1da177e4
LT		 791
792 if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first - autobinding in this may or may not work */
93102782
ED		 793 struct net_device *dev;
794
1da177e4
LT		 795 sock_reset_flag(sk, SOCK_ZAPPED);
796
93102782
ED		 797 dev = rose_dev_first();
798 if (!dev) {
2536b94a
RB		 799 err = -ENETUNREACH;
800 goto out_release;
801 }
1da177e4 802
c2a2b8d3 803 user = ax25_findbyuid(current_euid());
2536b94a
RB		 804 if (!user) {
805 err = -EINVAL;
93102782 806 dev_put(dev);
2536b94a
RB		 807 goto out_release;
808 }
1da177e4
LT		 809
810 memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
01d7dd0e 811 rose->source_call = user->call;
1da177e4 812 rose->device = dev;
2df91e39
ED		 813 netdev_tracker_alloc(rose->device, &rose->dev_tracker,
814 GFP_KERNEL);
01d7dd0e 815 ax25_uid_put(user);
1da177e4
LT		 816
817 rose_insert_socket(sk); /* Finish the bind */
818 }
1da177e4
LT		 819 rose->dest_addr = addr->srose_addr;
820 rose->dest_call = addr->srose_call;
821 rose->rand = ((long)rose & 0xFFFF) + rose->lci;
822 rose->dest_ndigis = addr->srose_ndigis;
823
824 if (addr_len == sizeof(struct full_sockaddr_rose)) {
825 struct full_sockaddr_rose *full_addr = (struct full_sockaddr_rose *)uaddr;
826 for (n = 0 ; n < addr->srose_ndigis ; n++)
827 rose->dest_digis[n] = full_addr->srose_digis[n];
828 } else {
829 if (rose->dest_ndigis == 1) {
830 rose->dest_digis[0] = addr->srose_digi;
831 }
832 }
833
834 /* Move to connecting socket, start sending Connect Requests */
835 sock->state = SS_CONNECTING;
836 sk->sk_state = TCP_SYN_SENT;
837
838 rose->state = ROSE_STATE_1;
839
840 rose->neighbour->use++;
841
842 rose_write_internal(sk, ROSE_CALL_REQUEST);
843 rose_start_heartbeat(sk);
844 rose_start_t1timer(sk);
845
846 /* Now the loop */
2536b94a
RB		 847 if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
848 err = -EINPROGRESS;
849 goto out_release;
850 }
1da177e4
LT		 851
852 /*
853 * A Connect Ack with Choke or timeout or failed routing will go to
854 * closed.
855 */
856 if (sk->sk_state == TCP_SYN_SENT) {
75606dc6 857 DEFINE_WAIT(wait);
1da177e4 858
1da177e4 859 for (;;) {
aa395145 860 prepare_to_wait(sk_sleep(sk), &wait,
6140efb5 861 TASK_INTERRUPTIBLE);
1da177e4
LT		 862 if (sk->sk_state != TCP_SYN_SENT)
863 break;
75606dc6
RB		 864 if (!signal_pending(current)) {
865 release_sock(sk);
1da177e4 866 schedule();
2536b94a 867 lock_sock(sk);
1da177e4
LT		 868 continue;
869 }
75606dc6
RB		 870 err = -ERESTARTSYS;
871 break;
1da177e4 872 }
aa395145 873 finish_wait(sk_sleep(sk), &wait);
75606dc6
RB		 874
875 if (err)
876 goto out_release;
1da177e4
LT		 877 }
878
879 if (sk->sk_state != TCP_ESTABLISHED) {
880 sock->state = SS_UNCONNECTED;
2536b94a
RB		 881 err = sock_error(sk); /* Always set at this point */
882 goto out_release;
1da177e4
LT		 883 }
884
885 sock->state = SS_CONNECTED;
886
2536b94a
RB		 887out_release:
888 release_sock(sk);
889
890 return err;
1da177e4
LT		 891}
892
cdfbabfb
DH		 893static int rose_accept(struct socket *sock, struct socket *newsock, int flags,
894 bool kern)
1da177e4 895{
1da177e4
LT		 896 struct sk_buff *skb;
897 struct sock *newsk;
75606dc6 898 DEFINE_WAIT(wait);
1da177e4
LT		 899 struct sock *sk;
900 int err = 0;
901
902 if ((sk = sock->sk) == NULL)
903 return -EINVAL;
904
905 lock_sock(sk);
906 if (sk->sk_type != SOCK_SEQPACKET) {
907 err = -EOPNOTSUPP;
75606dc6 908 goto out_release;
1da177e4
LT		 909 }
910
911 if (sk->sk_state != TCP_LISTEN) {
912 err = -EINVAL;
75606dc6 913 goto out_release;
1da177e4
LT		 914 }
915
916 /*
917 * The write queue this time is holding sockets ready to use
918 * hooked into the SABM we saved
919 */
1da177e4 920 for (;;) {
aa395145 921 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
75606dc6 922
1da177e4
LT		 923 skb = skb_dequeue(&sk->sk_receive_queue);
924 if (skb)
925 break;
926
1da177e4 927 if (flags & O_NONBLOCK) {
75606dc6
RB		 928 err = -EWOULDBLOCK;
929 break;
1da177e4 930 }
75606dc6
RB		 931 if (!signal_pending(current)) {
932 release_sock(sk);
1da177e4
LT		 933 schedule();
934 lock_sock(sk);
935 continue;
936 }
75606dc6
RB		 937 err = -ERESTARTSYS;
938 break;
1da177e4 939 }
aa395145 940 finish_wait(sk_sleep(sk), &wait);
75606dc6
RB		 941 if (err)
942 goto out_release;
1da177e4
LT		 943
944 newsk = skb->sk;
44ccff1f 945 sock_graft(newsk, newsock);
1da177e4
LT		 946
947 /* Now attach up the new socket */
948 skb->sk = NULL;
949 kfree_skb(skb);
7976a11b 950 sk_acceptq_removed(sk);
1da177e4 951
75606dc6 952out_release:
1da177e4
LT		 953 release_sock(sk);
954
955 return err;
956}
957
958static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
9b2c45d4 959 int peer)
1da177e4
LT		 960{
961 struct full_sockaddr_rose *srose = (struct full_sockaddr_rose *)uaddr;
962 struct sock *sk = sock->sk;
963 struct rose_sock *rose = rose_sk(sk);
964 int n;
965
17ac2e9c 966 memset(srose, 0, sizeof(*srose));
1da177e4
LT		 967 if (peer != 0) {
968 if (sk->sk_state != TCP_ESTABLISHED)
969 return -ENOTCONN;
970 srose->srose_family = AF_ROSE;
971 srose->srose_addr = rose->dest_addr;
972 srose->srose_call = rose->dest_call;
973 srose->srose_ndigis = rose->dest_ndigis;
974 for (n = 0; n < rose->dest_ndigis; n++)
975 srose->srose_digis[n] = rose->dest_digis[n];
976 } else {
977 srose->srose_family = AF_ROSE;
978 srose->srose_addr = rose->source_addr;
979 srose->srose_call = rose->source_call;
980 srose->srose_ndigis = rose->source_ndigis;
981 for (n = 0; n < rose->source_ndigis; n++)
982 srose->srose_digis[n] = rose->source_digis[n];
983 }
984
9b2c45d4 985 return sizeof(struct full_sockaddr_rose);
1da177e4
LT		 986}
987
988int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct rose_neigh *neigh, unsigned int lci)
989{
990 struct sock *sk;
991 struct sock *make;
992 struct rose_sock *make_rose;
993 struct rose_facilities_struct facilities;
e0bccd31 994 int n;
1da177e4
LT		 995
996 skb->sk = NULL; /* Initially we don't know who it's for */
997
998 /*
999 * skb->data points to the rose frame start
1000 */
1001 memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
1002
e0bccd31
BH		 1003 if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
1004 skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
1005 &facilities)) {
1da177e4
LT		 1006 rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
1007 return 0;
1008 }
1009
1010 sk = rose_find_listener(&facilities.source_addr, &facilities.source_call);
1011
1012 /*
1013 * We can't accept the Call Request.
1014 */
1015 if (sk == NULL || sk_acceptq_is_full(sk) ||
1016 (make = rose_make_new(sk)) == NULL) {
1017 rose_transmit_clear_request(neigh, lci, ROSE_NETWORK_CONGESTION, 120);
1018 return 0;
1019 }
1020
1021 skb->sk = make;
1022 make->sk_state = TCP_ESTABLISHED;
1023 make_rose = rose_sk(make);
1024
1025 make_rose->lci = lci;
1026 make_rose->dest_addr = facilities.dest_addr;
1027 make_rose->dest_call = facilities.dest_call;
1028 make_rose->dest_ndigis = facilities.dest_ndigis;
1029 for (n = 0 ; n < facilities.dest_ndigis ; n++)
1030 make_rose->dest_digis[n] = facilities.dest_digis[n];
1031 make_rose->source_addr = facilities.source_addr;
1032 make_rose->source_call = facilities.source_call;
1033 make_rose->source_ndigis = facilities.source_ndigis;
1034 for (n = 0 ; n < facilities.source_ndigis ; n++)
db34de93 1035 make_rose->source_digis[n] = facilities.source_digis[n];
1da177e4
LT		 1036 make_rose->neighbour = neigh;
1037 make_rose->device = dev;
2df91e39
ED		 1038 /* Caller got a reference for us. */
1039 netdev_tracker_alloc(make_rose->device, &make_rose->dev_tracker,
1040 GFP_ATOMIC);
1da177e4
LT		 1041 make_rose->facilities = facilities;
1042
1043 make_rose->neighbour->use++;
1044
1045 if (rose_sk(sk)->defer) {
1046 make_rose->state = ROSE_STATE_5;
1047 } else {
1048 rose_write_internal(make, ROSE_CALL_ACCEPTED);
1049 make_rose->state = ROSE_STATE_3;
1050 rose_start_idletimer(make);
1051 }
1052
1053 make_rose->condition = 0x00;
1054 make_rose->vs = 0;
1055 make_rose->va = 0;
1056 make_rose->vr = 0;
1057 make_rose->vl = 0;
7976a11b 1058 sk_acceptq_added(sk);
1da177e4
LT		 1059
1060 rose_insert_socket(make);
1061
1062 skb_queue_head(&sk->sk_receive_queue, skb);
1063
1064 rose_start_heartbeat(make);
1065
1066 if (!sock_flag(sk, SOCK_DEAD))
676d2369 1067 sk->sk_data_ready(sk);
1da177e4
LT		 1068
1069 return 1;
1070}
1071
1b784140 1072static int rose_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1da177e4
LT		 1073{
1074 struct sock *sk = sock->sk;
1075 struct rose_sock *rose = rose_sk(sk);
342dfc30 1076 DECLARE_SOCKADDR(struct sockaddr_rose *, usrose, msg->msg_name);
1da177e4
LT		 1077 int err;
1078 struct full_sockaddr_rose srose;
1079 struct sk_buff *skb;
1080 unsigned char *asmptr;
1081 int n, size, qbit = 0;
1082
1083 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
1084 return -EINVAL;
1085
1086 if (sock_flag(sk, SOCK_ZAPPED))
1087 return -EADDRNOTAVAIL;
1088
1089 if (sk->sk_shutdown & SEND_SHUTDOWN) {
1090 send_sig(SIGPIPE, current, 0);
1091 return -EPIPE;
1092 }
1093
1094 if (rose->neighbour == NULL || rose->device == NULL)
1095 return -ENETUNREACH;
1096
1097 if (usrose != NULL) {
1098 if (msg->msg_namelen != sizeof(struct sockaddr_rose) && msg->msg_namelen != sizeof(struct full_sockaddr_rose))
1099 return -EINVAL;
1100 memset(&srose, 0, sizeof(struct full_sockaddr_rose));
1101 memcpy(&srose, usrose, msg->msg_namelen);
1102 if (rosecmp(&rose->dest_addr, &srose.srose_addr) != 0 ||
1103 ax25cmp(&rose->dest_call, &srose.srose_call) != 0)
1104 return -EISCONN;
1105 if (srose.srose_ndigis != rose->dest_ndigis)
1106 return -EISCONN;
1107 if (srose.srose_ndigis == rose->dest_ndigis) {
1108 for (n = 0 ; n < srose.srose_ndigis ; n++)
1109 if (ax25cmp(&rose->dest_digis[n],
1110 &srose.srose_digis[n]))
1111 return -EISCONN;
1112 }
1113 if (srose.srose_family != AF_ROSE)
1114 return -EINVAL;
1115 } else {
1116 if (sk->sk_state != TCP_ESTABLISHED)
1117 return -ENOTCONN;
1118
1119 srose.srose_family = AF_ROSE;
1120 srose.srose_addr = rose->dest_addr;
1121 srose.srose_call = rose->dest_call;
1122 srose.srose_ndigis = rose->dest_ndigis;
1123 for (n = 0 ; n < rose->dest_ndigis ; n++)
1124 srose.srose_digis[n] = rose->dest_digis[n];
1125 }
1126
1da177e4 1127 /* Build a packet */
83e0bbcb
AC		 1128 /* Sanity check the packet size */
1129 if (len > 65535)
1130 return -EMSGSIZE;
1131
1da177e4
LT		 1132 size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
1133
1134 if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
1135 return err;
1136
1137 skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN);
1138
1139 /*
1140 * Put the data on the end
1141 */
1da177e4 1142
eeeb0374
ACM		 1143 skb_reset_transport_header(skb);
1144 skb_put(skb, len);
1da177e4 1145
6ce8e9ce 1146 err = memcpy_from_msg(skb_transport_header(skb), msg, len);
1da177e4
LT		 1147 if (err) {
1148 kfree_skb(skb);
1149 return err;
1150 }
1151
1152 /*
1153 * If the Q BIT Include socket option is in force, the first
1154 * byte of the user data is the logical value of the Q Bit.
1155 */
1156 if (rose->qbitincl) {
1157 qbit = skb->data[0];
1158 skb_pull(skb, 1);
1159 }
1160
1161 /*
1162 * Push down the ROSE header
1163 */
1164 asmptr = skb_push(skb, ROSE_MIN_LEN);
1165
1da177e4
LT		 1166 /* Build a ROSE Network header */
1167 asmptr[0] = ((rose->lci >> 8) & 0x0F) | ROSE_GFI;
1168 asmptr[1] = (rose->lci >> 0) & 0xFF;
1169 asmptr[2] = ROSE_DATA;
1170
1171 if (qbit)
1172 asmptr[0] |= ROSE_Q_BIT;
1173
1da177e4
LT		 1174 if (sk->sk_state != TCP_ESTABLISHED) {
1175 kfree_skb(skb);
1176 return -ENOTCONN;
1177 }
1178
1179#ifdef M_BIT
1180#define ROSE_PACLEN (256-ROSE_MIN_LEN)
1181 if (skb->len - ROSE_MIN_LEN > ROSE_PACLEN) {
1182 unsigned char header[ROSE_MIN_LEN];
1183 struct sk_buff *skbn;
1184 int frontlen;
1185 int lg;
1186
1187 /* Save a copy of the Header */
d626f62b 1188 skb_copy_from_linear_data(skb, header, ROSE_MIN_LEN);
1da177e4
LT		 1189 skb_pull(skb, ROSE_MIN_LEN);
1190
1191 frontlen = skb_headroom(skb);
1192
1193 while (skb->len > 0) {
1194 if ((skbn = sock_alloc_send_skb(sk, frontlen + ROSE_PACLEN, 0, &err)) == NULL) {
1195 kfree_skb(skb);
1196 return err;
1197 }
1198
1199 skbn->sk = sk;
1200 skbn->free = 1;
1201 skbn->arp = 1;
1202
1203 skb_reserve(skbn, frontlen);
1204
1205 lg = (ROSE_PACLEN > skb->len) ? skb->len : ROSE_PACLEN;
1206
1207 /* Copy the user data */
d626f62b 1208 skb_copy_from_linear_data(skb, skb_put(skbn, lg), lg);
1da177e4
LT		 1209 skb_pull(skb, lg);
1210
1211 /* Duplicate the Header */
1212 skb_push(skbn, ROSE_MIN_LEN);
27d7ff46 1213 skb_copy_to_linear_data(skbn, header, ROSE_MIN_LEN);
1da177e4
LT		 1214
1215 if (skb->len > 0)
1216 skbn->data[2] |= M_BIT;
1217
1218 skb_queue_tail(&sk->sk_write_queue, skbn); /* Throw it on the queue */
1219 }
1220
1221 skb->free = 1;
1222 kfree_skb(skb);
1223 } else {
1224 skb_queue_tail(&sk->sk_write_queue, skb); /* Throw it on the queue */
1225 }
1226#else
1227 skb_queue_tail(&sk->sk_write_queue, skb); /* Shove it onto the queue */
1228#endif
1229
1230 rose_kick(sk);
1231
1232 return len;
1233}
1234
1235
1b784140
YX		 1236static int rose_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1237 int flags)
1da177e4
LT		 1238{
1239 struct sock *sk = sock->sk;
1240 struct rose_sock *rose = rose_sk(sk);
1da177e4
LT		 1241 size_t copied;
1242 unsigned char *asmptr;
1243 struct sk_buff *skb;
1244 int n, er, qbit;
1245
1246 /*
1247 * This works for seqpacket too. The receiver has ordered the queue for
1248 * us! We do one quick check first though
1249 */
1250 if (sk->sk_state != TCP_ESTABLISHED)
1251 return -ENOTCONN;
1252
1253 /* Now we can treat all alike */
f4b41f06
OH		 1254 skb = skb_recv_datagram(sk, flags, &er);
1255 if (!skb)
1da177e4
LT		 1256 return er;
1257
1258 qbit = (skb->data[0] & ROSE_Q_BIT) == ROSE_Q_BIT;
1259
1260 skb_pull(skb, ROSE_MIN_LEN);
1261
1262 if (rose->qbitincl) {
1263 asmptr = skb_push(skb, 1);
1264 *asmptr = qbit;
1265 }
1266
badff6d0 1267 skb_reset_transport_header(skb);
1da177e4
LT		 1268 copied = skb->len;
1269
1270 if (copied > size) {
1271 copied = size;
1272 msg->msg_flags |= MSG_TRUNC;
1273 }
1274
51f3d02b 1275 skb_copy_datagram_msg(skb, 0, msg, copied);
1da177e4 1276
f3d33426
HFS		 1277 if (msg->msg_name) {
1278 struct sockaddr_rose *srose;
342dfc30
SH		 1279 DECLARE_SOCKADDR(struct full_sockaddr_rose *, full_srose,
1280 msg->msg_name);
f3d33426
HFS		 1281
1282 memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
1283 srose = msg->msg_name;
1da177e4
LT		 1284 srose->srose_family = AF_ROSE;
1285 srose->srose_addr = rose->dest_addr;
1286 srose->srose_call = rose->dest_call;
1287 srose->srose_ndigis = rose->dest_ndigis;
f81152e3
FW		 1288 for (n = 0 ; n < rose->dest_ndigis ; n++)
1289 full_srose->srose_digis[n] = rose->dest_digis[n];
1290 msg->msg_namelen = sizeof(struct full_sockaddr_rose);
1da177e4
LT		 1291 }
1292
1293 skb_free_datagram(sk, skb);
1294
1295 return copied;
1296}
1297
1298
1299static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1300{
1301 struct sock *sk = sock->sk;
1302 struct rose_sock *rose = rose_sk(sk);
1303 void __user *argp = (void __user *)arg;
1304
1305 switch (cmd) {
1306 case TIOCOUTQ: {
1307 long amount;
31e6d363
ED		 1308
1309 amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1da177e4
LT		 1310 if (amount < 0)
1311 amount = 0;
20b7d10a 1312 return put_user(amount, (unsigned int __user *) argp);
1da177e4
LT		 1313 }
1314
1315 case TIOCINQ: {
1316 struct sk_buff *skb;
1317 long amount = 0L;
810c38a3
HK		 1318
1319 spin_lock_irq(&sk->sk_receive_queue.lock);
1da177e4
LT		 1320 if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1321 amount = skb->len;
810c38a3 1322 spin_unlock_irq(&sk->sk_receive_queue.lock);
20b7d10a 1323 return put_user(amount, (unsigned int __user *) argp);
1da177e4
LT		 1324 }
1325
1da177e4
LT		 1326 case SIOCGIFADDR:
1327 case SIOCSIFADDR:
1328 case SIOCGIFDSTADDR:
1329 case SIOCSIFDSTADDR:
1330 case SIOCGIFBRDADDR:
1331 case SIOCSIFBRDADDR:
1332 case SIOCGIFNETMASK:
1333 case SIOCSIFNETMASK:
1334 case SIOCGIFMETRIC:
1335 case SIOCSIFMETRIC:
1336 return -EINVAL;
1337
1338 case SIOCADDRT:
1339 case SIOCDELRT:
1340 case SIOCRSCLRRT:
1341 if (!capable(CAP_NET_ADMIN))
1342 return -EPERM;
1343 return rose_rt_ioctl(cmd, argp);
1344
1345 case SIOCRSGCAUSE: {
1346 struct rose_cause_struct rose_cause;
1347 rose_cause.cause = rose->cause;
1348 rose_cause.diagnostic = rose->diagnostic;
1349 return copy_to_user(argp, &rose_cause, sizeof(struct rose_cause_struct)) ? -EFAULT : 0;
1350 }
1351
1352 case SIOCRSSCAUSE: {
1353 struct rose_cause_struct rose_cause;
1354 if (copy_from_user(&rose_cause, argp, sizeof(struct rose_cause_struct)))
1355 return -EFAULT;
1356 rose->cause = rose_cause.cause;
1357 rose->diagnostic = rose_cause.diagnostic;
1358 return 0;
1359 }
1360
1361 case SIOCRSSL2CALL:
1362 if (!capable(CAP_NET_ADMIN)) return -EPERM;
1363 if (ax25cmp(&rose_callsign, &null_ax25_address) != 0)
1364 ax25_listen_release(&rose_callsign, NULL);
1365 if (copy_from_user(&rose_callsign, argp, sizeof(ax25_address)))
1366 return -EFAULT;
1367 if (ax25cmp(&rose_callsign, &null_ax25_address) != 0)
81dcd169
RB		 1368 return ax25_listen_register(&rose_callsign, NULL);
1369
1da177e4
LT		 1370 return 0;
1371
1372 case SIOCRSGL2CALL:
1373 return copy_to_user(argp, &rose_callsign, sizeof(ax25_address)) ? -EFAULT : 0;
1374
1375 case SIOCRSACCEPT:
1376 if (rose->state == ROSE_STATE_5) {
1377 rose_write_internal(sk, ROSE_CALL_ACCEPTED);
1378 rose_start_idletimer(sk);
1379 rose->condition = 0x00;
1380 rose->vs = 0;
1381 rose->va = 0;
1382 rose->vr = 0;
1383 rose->vl = 0;
1384 rose->state = ROSE_STATE_3;
1385 }
1386 return 0;
1387
1388 default:
b5e5fa5e 1389 return -ENOIOCTLCMD;
1da177e4
LT		 1390 }
1391
1392 return 0;
1393}
1394
1395#ifdef CONFIG_PROC_FS
1396static void *rose_info_start(struct seq_file *seq, loff_t *pos)
95b7d924 1397 __acquires(rose_list_lock)
1da177e4 1398{
1da177e4 1399 spin_lock_bh(&rose_list_lock);
b999748a 1400 return seq_hlist_start_head(&rose_list, *pos);
1da177e4
LT		 1401}
1402
1403static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
1404{
b999748a 1405 return seq_hlist_next(v, &rose_list, pos);
1da177e4 1406}
3dcf7c5e 1407
1da177e4 1408static void rose_info_stop(struct seq_file *seq, void *v)
95b7d924 1409 __releases(rose_list_lock)
1da177e4
LT		 1410{
1411 spin_unlock_bh(&rose_list_lock);
1412}
1413
1414static int rose_info_show(struct seq_file *seq, void *v)
1415{
dcf777f6 1416 char buf[11], rsbuf[11];
f75268cd 1417
1da177e4 1418 if (v == SEQ_START_TOKEN)
3dcf7c5e 1419 seq_puts(seq,
1da177e4
LT		 1420 "dest_addr dest_call src_addr src_call dev lci neigh st vs vr va t t1 t2 t3 hb idle Snd-Q Rcv-Q inode\n");
1421
1422 else {
b999748a 1423 struct sock *s = sk_entry(v);
1da177e4
LT		 1424 struct rose_sock *rose = rose_sk(s);
1425 const char *devname, *callsign;
1426 const struct net_device *dev = rose->device;
1427
1428 if (!dev)
1429 devname = "???";
1430 else
1431 devname = dev->name;
3dcf7c5e 1432
1da177e4 1433 seq_printf(seq, "%-10s %-9s ",
dcf777f6
RB		 1434 rose2asc(rsbuf, &rose->dest_addr),
1435 ax2asc(buf, &rose->dest_call));
1da177e4
LT		 1436
1437 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
1438 callsign = "??????-?";
1439 else
f75268cd 1440 callsign = ax2asc(buf, &rose->source_call);
1da177e4
LT		 1441
1442 seq_printf(seq,
1443 "%-10s %-9s %-5s %3.3X %05d %d %d %d %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
dcf777f6 1444 rose2asc(rsbuf, &rose->source_addr),
1da177e4
LT		 1445 callsign,
1446 devname,
1447 rose->lci & 0x0FFF,
1448 (rose->neighbour) ? rose->neighbour->number : 0,
1449 rose->state,
1450 rose->vs,
1451 rose->vr,
1452 rose->va,
1453 ax25_display_timer(&rose->timer) / HZ,
1454 rose->t1 / HZ,
1455 rose->t2 / HZ,
1456 rose->t3 / HZ,
1457 rose->hb / HZ,
1458 ax25_display_timer(&rose->idletimer) / (60 * HZ),
1459 rose->idle / (60 * HZ),
31e6d363
ED		 1460 sk_wmem_alloc_get(s),
1461 sk_rmem_alloc_get(s),
1da177e4
LT		 1462 s->sk_socket ? SOCK_INODE(s->sk_socket)->i_ino : 0L);
1463 }
1464
1465 return 0;
1466}
1467
56b3d975 1468static const struct seq_operations rose_info_seqops = {
1da177e4
LT		 1469 .start = rose_info_start,
1470 .next = rose_info_next,
1471 .stop = rose_info_stop,
1472 .show = rose_info_show,
1473};
1da177e4
LT		 1474#endif /* CONFIG_PROC_FS */
1475
ec1b4cf7 1476static const struct net_proto_family rose_family_ops = {
1da177e4
LT		 1477 .family = PF_ROSE,
1478 .create = rose_create,
1479 .owner = THIS_MODULE,
1480};
1481
5708e868 1482static const struct proto_ops rose_proto_ops = {
1da177e4
LT		 1483 .family = PF_ROSE,
1484 .owner = THIS_MODULE,
1485 .release = rose_release,
1486 .bind = rose_bind,
1487 .connect = rose_connect,
1488 .socketpair = sock_no_socketpair,
1489 .accept = rose_accept,
1490 .getname = rose_getname,
a11e1d43 1491 .poll = datagram_poll,
1da177e4 1492 .ioctl = rose_ioctl,
c7cbdbf2 1493 .gettstamp = sock_gettstamp,
1da177e4
LT		 1494 .listen = rose_listen,
1495 .shutdown = sock_no_shutdown,
1496 .setsockopt = rose_setsockopt,
1497 .getsockopt = rose_getsockopt,
1498 .sendmsg = rose_sendmsg,
1499 .recvmsg = rose_recvmsg,
1500 .mmap = sock_no_mmap,
1da177e4
LT		 1501};
1502
1503static struct notifier_block rose_dev_notifier = {
1504 .notifier_call = rose_device_event,
1505};
1506
1507static struct net_device **dev_rose;
1508
8d5cf596
RB		 1509static struct ax25_protocol rose_pid = {
1510 .pid = AX25_P_ROSE,
1511 .func = rose_route_frame
1512};
1513
a4282717
RB		 1514static struct ax25_linkfail rose_linkfail_notifier = {
1515 .func = rose_link_failed
1516};
1517
1da177e4
LT		 1518static int __init rose_proto_init(void)
1519{
1520 int i;
a83cd2cc 1521 int rc;
1da177e4 1522
a83cd2cc 1523 if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
4d299f18 1524 printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter too large\n");
a83cd2cc
AD		 1525 rc = -EINVAL;
1526 goto out;
1527 }
1528
1529 rc = proto_register(&rose_proto, 0);
1da177e4
LT		 1530 if (rc != 0)
1531 goto out;
1532
1533 rose_callsign = null_ax25_address;
1534
6396bb22
KC		 1535 dev_rose = kcalloc(rose_ndevs, sizeof(struct net_device *),
1536 GFP_KERNEL);
1da177e4
LT		 1537 if (dev_rose == NULL) {
1538 printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate device structure\n");
a83cd2cc
AD		 1539 rc = -ENOMEM;
1540 goto out_proto_unregister;
1da177e4
LT		 1541 }
1542
1da177e4
LT		 1543 for (i = 0; i < rose_ndevs; i++) {
1544 struct net_device *dev;
1545 char name[IFNAMSIZ];
1546
1547 sprintf(name, "rose%d", i);
c835a677 1548 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, rose_setup);
1da177e4
LT		 1549 if (!dev) {
1550 printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate memory\n");
70ff3b66 1551 rc = -ENOMEM;
1da177e4
LT		 1552 goto fail;
1553 }
70ff3b66
AD		 1554 rc = register_netdev(dev);
1555 if (rc) {
520d1b83 1556 printk(KERN_ERR "ROSE: netdevice registration failed\n");
1da177e4
LT		 1557 free_netdev(dev);
1558 goto fail;
1559 }
1a33e10e 1560 rose_set_lockdep_key(dev);
1da177e4
LT		 1561 dev_rose[i] = dev;
1562 }
1563
1564 sock_register(&rose_family_ops);
1565 register_netdevice_notifier(&rose_dev_notifier);
1da177e4 1566
8d5cf596 1567 ax25_register_pid(&rose_pid);
a4282717 1568 ax25_linkfail_register(&rose_linkfail_notifier);
1da177e4
LT		 1569
1570#ifdef CONFIG_SYSCTL
1571 rose_register_sysctl();
1572#endif
1573 rose_loopback_init();
1574
1575 rose_add_loopback_neigh();
1576
fddda2b7
CH		 1577 proc_create_seq("rose", 0444, init_net.proc_net, &rose_info_seqops);
1578 proc_create_seq("rose_neigh", 0444, init_net.proc_net,
1579 &rose_neigh_seqops);
1580 proc_create_seq("rose_nodes", 0444, init_net.proc_net,
1581 &rose_node_seqops);
1582 proc_create_seq("rose_routes", 0444, init_net.proc_net,
1583 &rose_route_seqops);
1da177e4
LT		 1584out:
1585 return rc;
1586fail:
1587 while (--i >= 0) {
1588 unregister_netdev(dev_rose[i]);
1589 free_netdev(dev_rose[i]);
1590 }
1591 kfree(dev_rose);
a83cd2cc 1592out_proto_unregister:
1da177e4 1593 proto_unregister(&rose_proto);
70ff3b66 1594 goto out;
1da177e4
LT		 1595}
1596module_init(rose_proto_init);
1597
1598module_param(rose_ndevs, int, 0);
1599MODULE_PARM_DESC(rose_ndevs, "number of ROSE devices");
1600
1601MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
1602MODULE_DESCRIPTION("The amateur radio ROSE network layer protocol");
1603MODULE_LICENSE("GPL");
1604MODULE_ALIAS_NETPROTO(PF_ROSE);
1605
1606static void __exit rose_exit(void)
1607{
1608 int i;
1609
ece31ffd
G		 1610 remove_proc_entry("rose", init_net.proc_net);
1611 remove_proc_entry("rose_neigh", init_net.proc_net);
1612 remove_proc_entry("rose_nodes", init_net.proc_net);
1613 remove_proc_entry("rose_routes", init_net.proc_net);
1da177e4
LT		 1614 rose_loopback_clear();
1615
1616 rose_rt_free();
1617
1618 ax25_protocol_release(AX25_P_ROSE);
a4282717 1619 ax25_linkfail_release(&rose_linkfail_notifier);
1da177e4
LT		 1620
1621 if (ax25cmp(&rose_callsign, &null_ax25_address) != 0)
1622 ax25_listen_release(&rose_callsign, NULL);
1623
1624#ifdef CONFIG_SYSCTL
1625 rose_unregister_sysctl();
1626#endif
1627 unregister_netdevice_notifier(&rose_dev_notifier);
1628
1629 sock_unregister(PF_ROSE);
1630
1631 for (i = 0; i < rose_ndevs; i++) {
1632 struct net_device *dev = dev_rose[i];
1633
1634 if (dev) {
1635 unregister_netdev(dev);
1636 free_netdev(dev);
1637 }
1638 }
1639
1640 kfree(dev_rose);
1641 proto_unregister(&rose_proto);
1642}
1643
1644module_exit(rose_exit);
Linux 6.x block layer and io_uring tree(s)