Showing error 1461

User: Jiri Slaby
Error type: Leaving function in locked state
Error type description: Some lock is not unlocked on all paths of a function, so it is leaked
File location: net/ax25/af_ax25.c
Line in file: 1867
Project: Linux Kernel
Project version: 2.6.28
Tools: Stanse (1.2)
Entered: 2012-05-21 20:30:05 UTC


Source:

   1/*
   2 * This program is free software; you can redistribute it and/or modify
   3 * it under the terms of the GNU General Public License as published by
   4 * the Free Software Foundation; either version 2 of the License, or
   5 * (at your option) any later version.
   6 *
   7 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
   8 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
   9 * Copyright (C) Darryl Miles G7LED (dlm@g7led.demon.co.uk)
  10 * Copyright (C) Steven Whitehouse GW7RRM (stevew@acm.org)
  11 * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
  12 * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
  13 * Copyright (C) Hans Alblas PE1AYX (hans@esrac.ele.tue.nl)
  14 * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
  15 */
  16#include <linux/capability.h>
  17#include <linux/module.h>
  18#include <linux/errno.h>
  19#include <linux/types.h>
  20#include <linux/socket.h>
  21#include <linux/in.h>
  22#include <linux/kernel.h>
  23#include <linux/sched.h>
  24#include <linux/timer.h>
  25#include <linux/string.h>
  26#include <linux/sockios.h>
  27#include <linux/net.h>
  28#include <net/ax25.h>
  29#include <linux/inet.h>
  30#include <linux/netdevice.h>
  31#include <linux/if_arp.h>
  32#include <linux/skbuff.h>
  33#include <net/sock.h>
  34#include <asm/uaccess.h>
  35#include <asm/system.h>
  36#include <linux/fcntl.h>
  37#include <linux/termios.h>        /* For TIOCINQ/OUTQ */
  38#include <linux/mm.h>
  39#include <linux/interrupt.h>
  40#include <linux/notifier.h>
  41#include <linux/proc_fs.h>
  42#include <linux/stat.h>
  43#include <linux/netfilter.h>
  44#include <linux/sysctl.h>
  45#include <linux/init.h>
  46#include <linux/spinlock.h>
  47#include <net/net_namespace.h>
  48#include <net/tcp_states.h>
  49#include <net/ip.h>
  50#include <net/arp.h>
  51
  52
  53
  54HLIST_HEAD(ax25_list);
  55DEFINE_SPINLOCK(ax25_list_lock);
  56
  57static const struct proto_ops ax25_proto_ops;
  58
  59static void ax25_free_sock(struct sock *sk)
  60{
  61        ax25_cb_put(ax25_sk(sk));
  62}
  63
  64/*
  65 *        Socket removal during an interrupt is now safe.
  66 */
  67static void ax25_cb_del(ax25_cb *ax25)
  68{
  69        if (!hlist_unhashed(&ax25->ax25_node)) {
  70                spin_lock_bh(&ax25_list_lock);
  71                hlist_del_init(&ax25->ax25_node);
  72                spin_unlock_bh(&ax25_list_lock);
  73                ax25_cb_put(ax25);
  74        }
  75}
  76
  77/*
  78 *        Kill all bound sockets on a dropped device.
  79 */
  80static void ax25_kill_by_device(struct net_device *dev)
  81{
  82        ax25_dev *ax25_dev;
  83        ax25_cb *s;
  84        struct hlist_node *node;
  85
  86        if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
  87                return;
  88
  89        spin_lock_bh(&ax25_list_lock);
  90again:
  91        ax25_for_each(s, node, &ax25_list) {
  92                if (s->ax25_dev == ax25_dev) {
  93                        s->ax25_dev = NULL;
  94                        spin_unlock_bh(&ax25_list_lock);
  95                        ax25_disconnect(s, ENETUNREACH);
  96                        spin_lock_bh(&ax25_list_lock);
  97
  98                        /* The entry could have been deleted from the
  99                         * list meanwhile and thus the next pointer is
 100                         * no longer valid.  Play it safe and restart
 101                         * the scan.  Forward progress is ensured
 102                         * because we set s->ax25_dev to NULL and we
 103                         * are never passed a NULL 'dev' argument.
 104                         */
 105                        goto again;
 106                }
 107        }
 108        spin_unlock_bh(&ax25_list_lock);
 109}
 110
 111/*
 112 *        Handle device status changes.
 113 */
 114static int ax25_device_event(struct notifier_block *this, unsigned long event,
 115        void *ptr)
 116{
 117        struct net_device *dev = (struct net_device *)ptr;
 118
 119        if (!net_eq(dev_net(dev), &init_net))
 120                return NOTIFY_DONE;
 121
 122        /* Reject non AX.25 devices */
 123        if (dev->type != ARPHRD_AX25)
 124                return NOTIFY_DONE;
 125
 126        switch (event) {
 127        case NETDEV_UP:
 128                ax25_dev_device_up(dev);
 129                break;
 130        case NETDEV_DOWN:
 131                ax25_kill_by_device(dev);
 132                ax25_rt_device_down(dev);
 133                ax25_dev_device_down(dev);
 134                break;
 135        default:
 136                break;
 137        }
 138
 139        return NOTIFY_DONE;
 140}
 141
 142/*
 143 *        Add a socket to the bound sockets list.
 144 */
 145void ax25_cb_add(ax25_cb *ax25)
 146{
 147        spin_lock_bh(&ax25_list_lock);
 148        ax25_cb_hold(ax25);
 149        hlist_add_head(&ax25->ax25_node, &ax25_list);
 150        spin_unlock_bh(&ax25_list_lock);
 151}
 152
 153/*
 154 *        Find a socket that wants to accept the SABM we have just
 155 *        received.
 156 */
 157struct sock *ax25_find_listener(ax25_address *addr, int digi,
 158        struct net_device *dev, int type)
 159{
 160        ax25_cb *s;
 161        struct hlist_node *node;
 162
 163        spin_lock(&ax25_list_lock);
 164        ax25_for_each(s, node, &ax25_list) {
 165                if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
 166                        continue;
 167                if (s->sk && !ax25cmp(&s->source_addr, addr) &&
 168                    s->sk->sk_type == type && s->sk->sk_state == TCP_LISTEN) {
 169                        /* If device is null we match any device */
 170                        if (s->ax25_dev == NULL || s->ax25_dev->dev == dev) {
 171                                sock_hold(s->sk);
 172                                spin_unlock(&ax25_list_lock);
 173                                return s->sk;
 174                        }
 175                }
 176        }
 177        spin_unlock(&ax25_list_lock);
 178
 179        return NULL;
 180}
 181
 182/*
 183 *        Find an AX.25 socket given both ends.
 184 */
 185struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
 186        int type)
 187{
 188        struct sock *sk = NULL;
 189        ax25_cb *s;
 190        struct hlist_node *node;
 191
 192        spin_lock(&ax25_list_lock);
 193        ax25_for_each(s, node, &ax25_list) {
 194                if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
 195                    !ax25cmp(&s->dest_addr, dest_addr) &&
 196                    s->sk->sk_type == type) {
 197                        sk = s->sk;
 198                        sock_hold(sk);
 199                        break;
 200                }
 201        }
 202
 203        spin_unlock(&ax25_list_lock);
 204
 205        return sk;
 206}
 207
 208/*
 209 *        Find an AX.25 control block given both ends. It will only pick up
 210 *        floating AX.25 control blocks or non Raw socket bound control blocks.
 211 */
 212ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
 213        ax25_digi *digi, struct net_device *dev)
 214{
 215        ax25_cb *s;
 216        struct hlist_node *node;
 217
 218        spin_lock_bh(&ax25_list_lock);
 219        ax25_for_each(s, node, &ax25_list) {
 220                if (s->sk && s->sk->sk_type != SOCK_SEQPACKET)
 221                        continue;
 222                if (s->ax25_dev == NULL)
 223                        continue;
 224                if (ax25cmp(&s->source_addr, src_addr) == 0 && ax25cmp(&s->dest_addr, dest_addr) == 0 && s->ax25_dev->dev == dev) {
 225                        if (digi != NULL && digi->ndigi != 0) {
 226                                if (s->digipeat == NULL)
 227                                        continue;
 228                                if (ax25digicmp(s->digipeat, digi) != 0)
 229                                        continue;
 230                        } else {
 231                                if (s->digipeat != NULL && s->digipeat->ndigi != 0)
 232                                        continue;
 233                        }
 234                        ax25_cb_hold(s);
 235                        spin_unlock_bh(&ax25_list_lock);
 236
 237                        return s;
 238                }
 239        }
 240        spin_unlock_bh(&ax25_list_lock);
 241
 242        return NULL;
 243}
 244
 245EXPORT_SYMBOL(ax25_find_cb);
 246
 247void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
 248{
 249        ax25_cb *s;
 250        struct sk_buff *copy;
 251        struct hlist_node *node;
 252
 253        spin_lock(&ax25_list_lock);
 254        ax25_for_each(s, node, &ax25_list) {
 255                if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
 256                    s->sk->sk_type == SOCK_RAW &&
 257                    s->sk->sk_protocol == proto &&
 258                    s->ax25_dev->dev == skb->dev &&
 259                    atomic_read(&s->sk->sk_rmem_alloc) <= s->sk->sk_rcvbuf) {
 260                        if ((copy = skb_clone(skb, GFP_ATOMIC)) == NULL)
 261                                continue;
 262                        if (sock_queue_rcv_skb(s->sk, copy) != 0)
 263                                kfree_skb(copy);
 264                }
 265        }
 266        spin_unlock(&ax25_list_lock);
 267}
 268
 269/*
 270 *        Deferred destroy.
 271 */
 272void ax25_destroy_socket(ax25_cb *);
 273
 274/*
 275 *        Handler for deferred kills.
 276 */
 277static void ax25_destroy_timer(unsigned long data)
 278{
 279        ax25_cb *ax25=(ax25_cb *)data;
 280        struct sock *sk;
 281
 282        sk=ax25->sk;
 283
 284        bh_lock_sock(sk);
 285        sock_hold(sk);
 286        ax25_destroy_socket(ax25);
 287        bh_unlock_sock(sk);
 288        sock_put(sk);
 289}
 290
 291/*
 292 *        This is called from user mode and the timers. Thus it protects itself
 293 *        against interrupt users but doesn't worry about being called during
 294 *        work. Once it is removed from the queue no interrupt or bottom half
 295 *        will touch it and we are (fairly 8-) ) safe.
 296 */
 297void ax25_destroy_socket(ax25_cb *ax25)
 298{
 299        struct sk_buff *skb;
 300
 301        ax25_cb_del(ax25);
 302
 303        ax25_stop_heartbeat(ax25);
 304        ax25_stop_t1timer(ax25);
 305        ax25_stop_t2timer(ax25);
 306        ax25_stop_t3timer(ax25);
 307        ax25_stop_idletimer(ax25);
 308
 309        ax25_clear_queues(ax25);        /* Flush the queues */
 310
 311        if (ax25->sk != NULL) {
 312                while ((skb = skb_dequeue(&ax25->sk->sk_receive_queue)) != NULL) {
 313                        if (skb->sk != ax25->sk) {
 314                                /* A pending connection */
 315                                ax25_cb *sax25 = ax25_sk(skb->sk);
 316
 317                                /* Queue the unaccepted socket for death */
 318                                sock_orphan(skb->sk);
 319
 320                                /* 9A4GL: hack to release unaccepted sockets */
 321                                skb->sk->sk_state = TCP_LISTEN;
 322
 323                                ax25_start_heartbeat(sax25);
 324                                sax25->state = AX25_STATE_0;
 325                        }
 326
 327                        kfree_skb(skb);
 328                }
 329                skb_queue_purge(&ax25->sk->sk_write_queue);
 330        }
 331
 332        if (ax25->sk != NULL) {
 333                if (atomic_read(&ax25->sk->sk_wmem_alloc) ||
 334                    atomic_read(&ax25->sk->sk_rmem_alloc)) {
 335                        /* Defer: outstanding buffers */
 336                        setup_timer(&ax25->dtimer, ax25_destroy_timer,
 337                                        (unsigned long)ax25);
 338                        ax25->dtimer.expires  = jiffies + 2 * HZ;
 339                        add_timer(&ax25->dtimer);
 340                } else {
 341                        struct sock *sk=ax25->sk;
 342                        ax25->sk=NULL;
 343                        sock_put(sk);
 344                }
 345        } else {
 346                ax25_cb_put(ax25);
 347        }
 348}
 349
 350/*
 351 * dl1bke 960311: set parameters for existing AX.25 connections,
 352 *                  includes a KILL command to abort any connection.
 353 *                  VERY useful for debugging ;-)
 354 */
 355static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
 356{
 357        struct ax25_ctl_struct ax25_ctl;
 358        ax25_digi digi;
 359        ax25_dev *ax25_dev;
 360        ax25_cb *ax25;
 361        unsigned int k;
 362
 363        if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))
 364                return -EFAULT;
 365
 366        if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)
 367                return -ENODEV;
 368
 369        if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
 370                return -EINVAL;
 371
 372        digi.ndigi = ax25_ctl.digi_count;
 373        for (k = 0; k < digi.ndigi; k++)
 374                digi.calls[k] = ax25_ctl.digi_addr[k];
 375
 376        if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL)
 377                return -ENOTCONN;
 378
 379        switch (ax25_ctl.cmd) {
 380        case AX25_KILL:
 381                ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 382#ifdef CONFIG_AX25_DAMA_SLAVE
 383                if (ax25_dev->dama.slave && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
 384                        ax25_dama_off(ax25);
 385#endif
 386                ax25_disconnect(ax25, ENETRESET);
 387                break;
 388
 389        case AX25_WINDOW:
 390                if (ax25->modulus == AX25_MODULUS) {
 391                        if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)
 392                                return -EINVAL;
 393                } else {
 394                        if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)
 395                                return -EINVAL;
 396                }
 397                ax25->window = ax25_ctl.arg;
 398                break;
 399
 400        case AX25_T1:
 401                if (ax25_ctl.arg < 1)
 402                        return -EINVAL;
 403                ax25->rtt = (ax25_ctl.arg * HZ) / 2;
 404                ax25->t1  = ax25_ctl.arg * HZ;
 405                break;
 406
 407        case AX25_T2:
 408                if (ax25_ctl.arg < 1)
 409                        return -EINVAL;
 410                ax25->t2 = ax25_ctl.arg * HZ;
 411                break;
 412
 413        case AX25_N2:
 414                if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)
 415                        return -EINVAL;
 416                ax25->n2count = 0;
 417                ax25->n2 = ax25_ctl.arg;
 418                break;
 419
 420        case AX25_T3:
 421                if (ax25_ctl.arg < 0)
 422                        return -EINVAL;
 423                ax25->t3 = ax25_ctl.arg * HZ;
 424                break;
 425
 426        case AX25_IDLE:
 427                if (ax25_ctl.arg < 0)
 428                        return -EINVAL;
 429                ax25->idle = ax25_ctl.arg * 60 * HZ;
 430                break;
 431
 432        case AX25_PACLEN:
 433                if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)
 434                        return -EINVAL;
 435                ax25->paclen = ax25_ctl.arg;
 436                break;
 437
 438        default:
 439                return -EINVAL;
 440          }
 441
 442        return 0;
 443}
 444
 445static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
 446{
 447        ax25->rtt     = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2;
 448        ax25->t1      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]);
 449        ax25->t2      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T2]);
 450        ax25->t3      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T3]);
 451        ax25->n2      = ax25_dev->values[AX25_VALUES_N2];
 452        ax25->paclen  = ax25_dev->values[AX25_VALUES_PACLEN];
 453        ax25->idle    = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_IDLE]);
 454        ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
 455
 456        if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
 457                ax25->modulus = AX25_EMODULUS;
 458                ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
 459        } else {
 460                ax25->modulus = AX25_MODULUS;
 461                ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
 462        }
 463}
 464
 465/*
 466 *        Fill in a created AX.25 created control block with the default
 467 *        values for a particular device.
 468 */
 469void ax25_fillin_cb(ax25_cb *ax25, ax25_dev *ax25_dev)
 470{
 471        ax25->ax25_dev = ax25_dev;
 472
 473        if (ax25->ax25_dev != NULL) {
 474                ax25_fillin_cb_from_dev(ax25, ax25_dev);
 475                return;
 476        }
 477
 478        /*
 479         * No device, use kernel / AX.25 spec default values
 480         */
 481        ax25->rtt     = msecs_to_jiffies(AX25_DEF_T1) / 2;
 482        ax25->t1      = msecs_to_jiffies(AX25_DEF_T1);
 483        ax25->t2      = msecs_to_jiffies(AX25_DEF_T2);
 484        ax25->t3      = msecs_to_jiffies(AX25_DEF_T3);
 485        ax25->n2      = AX25_DEF_N2;
 486        ax25->paclen  = AX25_DEF_PACLEN;
 487        ax25->idle    = msecs_to_jiffies(AX25_DEF_IDLE);
 488        ax25->backoff = AX25_DEF_BACKOFF;
 489
 490        if (AX25_DEF_AXDEFMODE) {
 491                ax25->modulus = AX25_EMODULUS;
 492                ax25->window  = AX25_DEF_EWINDOW;
 493        } else {
 494                ax25->modulus = AX25_MODULUS;
 495                ax25->window  = AX25_DEF_WINDOW;
 496        }
 497}
 498
 499/*
 500 * Create an empty AX.25 control block.
 501 */
 502ax25_cb *ax25_create_cb(void)
 503{
 504        ax25_cb *ax25;
 505
 506        if ((ax25 = kzalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
 507                return NULL;
 508
 509        atomic_set(&ax25->refcount, 1);
 510
 511        skb_queue_head_init(&ax25->write_queue);
 512        skb_queue_head_init(&ax25->frag_queue);
 513        skb_queue_head_init(&ax25->ack_queue);
 514        skb_queue_head_init(&ax25->reseq_queue);
 515
 516        ax25_setup_timers(ax25);
 517
 518        ax25_fillin_cb(ax25, NULL);
 519
 520        ax25->state = AX25_STATE_0;
 521
 522        return ax25;
 523}
 524
 525/*
 526 *        Handling for system calls applied via the various interfaces to an
 527 *        AX25 socket object
 528 */
 529
 530static int ax25_setsockopt(struct socket *sock, int level, int optname,
 531        char __user *optval, int optlen)
 532{
 533        struct sock *sk = sock->sk;
 534        ax25_cb *ax25;
 535        struct net_device *dev;
 536        char devname[IFNAMSIZ];
 537        int opt, res = 0;
 538
 539        if (level != SOL_AX25)
 540                return -ENOPROTOOPT;
 541
 542        if (optlen < sizeof(int))
 543                return -EINVAL;
 544
 545        if (get_user(opt, (int __user *)optval))
 546                return -EFAULT;
 547
 548        lock_sock(sk);
 549        ax25 = ax25_sk(sk);
 550
 551        switch (optname) {
 552        case AX25_WINDOW:
 553                if (ax25->modulus == AX25_MODULUS) {
 554                        if (opt < 1 || opt > 7) {
 555                                res = -EINVAL;
 556                                break;
 557                        }
 558                } else {
 559                        if (opt < 1 || opt > 63) {
 560                                res = -EINVAL;
 561                                break;
 562                        }
 563                }
 564                ax25->window = opt;
 565                break;
 566
 567        case AX25_T1:
 568                if (opt < 1) {
 569                        res = -EINVAL;
 570                        break;
 571                }
 572                ax25->rtt = (opt * HZ) >> 1;
 573                ax25->t1  = opt * HZ;
 574                break;
 575
 576        case AX25_T2:
 577                if (opt < 1) {
 578                        res = -EINVAL;
 579                        break;
 580                }
 581                ax25->t2 = opt * HZ;
 582                break;
 583
 584        case AX25_N2:
 585                if (opt < 1 || opt > 31) {
 586                        res = -EINVAL;
 587                        break;
 588                }
 589                ax25->n2 = opt;
 590                break;
 591
 592        case AX25_T3:
 593                if (opt < 1) {
 594                        res = -EINVAL;
 595                        break;
 596                }
 597                ax25->t3 = opt * HZ;
 598                break;
 599
 600        case AX25_IDLE:
 601                if (opt < 0) {
 602                        res = -EINVAL;
 603                        break;
 604                }
 605                ax25->idle = opt * 60 * HZ;
 606                break;
 607
 608        case AX25_BACKOFF:
 609                if (opt < 0 || opt > 2) {
 610                        res = -EINVAL;
 611                        break;
 612                }
 613                ax25->backoff = opt;
 614                break;
 615
 616        case AX25_EXTSEQ:
 617                ax25->modulus = opt ? AX25_EMODULUS : AX25_MODULUS;
 618                break;
 619
 620        case AX25_PIDINCL:
 621                ax25->pidincl = opt ? 1 : 0;
 622                break;
 623
 624        case AX25_IAMDIGI:
 625                ax25->iamdigi = opt ? 1 : 0;
 626                break;
 627
 628        case AX25_PACLEN:
 629                if (opt < 16 || opt > 65535) {
 630                        res = -EINVAL;
 631                        break;
 632                }
 633                ax25->paclen = opt;
 634                break;
 635
 636        case SO_BINDTODEVICE:
 637                if (optlen > IFNAMSIZ)
 638                        optlen=IFNAMSIZ;
 639                if (copy_from_user(devname, optval, optlen)) {
 640                res = -EFAULT;
 641                        break;
 642                }
 643
 644                dev = dev_get_by_name(&init_net, devname);
 645                if (dev == NULL) {
 646                        res = -ENODEV;
 647                        break;
 648                }
 649
 650                if (sk->sk_type == SOCK_SEQPACKET &&
 651                   (sock->state != SS_UNCONNECTED ||
 652                    sk->sk_state == TCP_LISTEN)) {
 653                        res = -EADDRNOTAVAIL;
 654                        dev_put(dev);
 655                        break;
 656                }
 657
 658                ax25->ax25_dev = ax25_dev_ax25dev(dev);
 659                ax25_fillin_cb(ax25, ax25->ax25_dev);
 660                break;
 661
 662        default:
 663                res = -ENOPROTOOPT;
 664        }
 665        release_sock(sk);
 666
 667        return res;
 668}
 669
 670static int ax25_getsockopt(struct socket *sock, int level, int optname,
 671        char __user *optval, int __user *optlen)
 672{
 673        struct sock *sk = sock->sk;
 674        ax25_cb *ax25;
 675        struct ax25_dev *ax25_dev;
 676        char devname[IFNAMSIZ];
 677        void *valptr;
 678        int val = 0;
 679        int maxlen, length;
 680
 681        if (level != SOL_AX25)
 682                return -ENOPROTOOPT;
 683
 684        if (get_user(maxlen, optlen))
 685                return -EFAULT;
 686
 687        if (maxlen < 1)
 688                return -EFAULT;
 689
 690        valptr = (void *) &val;
 691        length = min_t(unsigned int, maxlen, sizeof(int));
 692
 693        lock_sock(sk);
 694        ax25 = ax25_sk(sk);
 695
 696        switch (optname) {
 697        case AX25_WINDOW:
 698                val = ax25->window;
 699                break;
 700
 701        case AX25_T1:
 702                val = ax25->t1 / HZ;
 703                break;
 704
 705        case AX25_T2:
 706                val = ax25->t2 / HZ;
 707                break;
 708
 709        case AX25_N2:
 710                val = ax25->n2;
 711                break;
 712
 713        case AX25_T3:
 714                val = ax25->t3 / HZ;
 715                break;
 716
 717        case AX25_IDLE:
 718                val = ax25->idle / (60 * HZ);
 719                break;
 720
 721        case AX25_BACKOFF:
 722                val = ax25->backoff;
 723                break;
 724
 725        case AX25_EXTSEQ:
 726                val = (ax25->modulus == AX25_EMODULUS);
 727                break;
 728
 729        case AX25_PIDINCL:
 730                val = ax25->pidincl;
 731                break;
 732
 733        case AX25_IAMDIGI:
 734                val = ax25->iamdigi;
 735                break;
 736
 737        case AX25_PACLEN:
 738                val = ax25->paclen;
 739                break;
 740
 741        case SO_BINDTODEVICE:
 742                ax25_dev = ax25->ax25_dev;
 743
 744                if (ax25_dev != NULL && ax25_dev->dev != NULL) {
 745                        strlcpy(devname, ax25_dev->dev->name, sizeof(devname));
 746                        length = strlen(devname) + 1;
 747                } else {
 748                        *devname = '\0';
 749                        length = 1;
 750                }
 751
 752                valptr = (void *) devname;
 753                break;
 754
 755        default:
 756                release_sock(sk);
 757                return -ENOPROTOOPT;
 758        }
 759        release_sock(sk);
 760
 761        if (put_user(length, optlen))
 762                return -EFAULT;
 763
 764        return copy_to_user(optval, valptr, length) ? -EFAULT : 0;
 765}
 766
 767static int ax25_listen(struct socket *sock, int backlog)
 768{
 769        struct sock *sk = sock->sk;
 770        int res = 0;
 771
 772        lock_sock(sk);
 773        if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_LISTEN) {
 774                sk->sk_max_ack_backlog = backlog;
 775                sk->sk_state           = TCP_LISTEN;
 776                goto out;
 777        }
 778        res = -EOPNOTSUPP;
 779
 780out:
 781        release_sock(sk);
 782
 783        return res;
 784}
 785
 786/*
 787 * XXX: when creating ax25_sock we should update the .obj_size setting
 788 * below.
 789 */
 790static struct proto ax25_proto = {
 791        .name          = "AX25",
 792        .owner          = THIS_MODULE,
 793        .obj_size = sizeof(struct sock),
 794};
 795
 796static int ax25_create(struct net *net, struct socket *sock, int protocol)
 797{
 798        struct sock *sk;
 799        ax25_cb *ax25;
 800
 801        if (net != &init_net)
 802                return -EAFNOSUPPORT;
 803
 804        switch (sock->type) {
 805        case SOCK_DGRAM:
 806                if (protocol == 0 || protocol == PF_AX25)
 807                        protocol = AX25_P_TEXT;
 808                break;
 809
 810        case SOCK_SEQPACKET:
 811                switch (protocol) {
 812                case 0:
 813                case PF_AX25:        /* For CLX */
 814                        protocol = AX25_P_TEXT;
 815                        break;
 816                case AX25_P_SEGMENT:
 817#ifdef CONFIG_INET
 818                case AX25_P_ARP:
 819                case AX25_P_IP:
 820#endif
 821#ifdef CONFIG_NETROM
 822                case AX25_P_NETROM:
 823#endif
 824#ifdef CONFIG_ROSE
 825                case AX25_P_ROSE:
 826#endif
 827                        return -ESOCKTNOSUPPORT;
 828#ifdef CONFIG_NETROM_MODULE
 829                case AX25_P_NETROM:
 830                        if (ax25_protocol_is_registered(AX25_P_NETROM))
 831                                return -ESOCKTNOSUPPORT;
 832#endif
 833#ifdef CONFIG_ROSE_MODULE
 834                case AX25_P_ROSE:
 835                        if (ax25_protocol_is_registered(AX25_P_ROSE))
 836                                return -ESOCKTNOSUPPORT;
 837#endif
 838                default:
 839                        break;
 840                }
 841                break;
 842
 843        case SOCK_RAW:
 844                break;
 845        default:
 846                return -ESOCKTNOSUPPORT;
 847        }
 848
 849        sk = sk_alloc(net, PF_AX25, GFP_ATOMIC, &ax25_proto);
 850        if (sk == NULL)
 851                return -ENOMEM;
 852
 853        ax25 = sk->sk_protinfo = ax25_create_cb();
 854        if (!ax25) {
 855                sk_free(sk);
 856                return -ENOMEM;
 857        }
 858
 859        sock_init_data(sock, sk);
 860
 861        sk->sk_destruct = ax25_free_sock;
 862        sock->ops    = &ax25_proto_ops;
 863        sk->sk_protocol = protocol;
 864
 865        ax25->sk    = sk;
 866
 867        return 0;
 868}
 869
 870struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
 871{
 872        struct sock *sk;
 873        ax25_cb *ax25, *oax25;
 874
 875        sk = sk_alloc(sock_net(osk), PF_AX25, GFP_ATOMIC,        osk->sk_prot);
 876        if (sk == NULL)
 877                return NULL;
 878
 879        if ((ax25 = ax25_create_cb()) == NULL) {
 880                sk_free(sk);
 881                return NULL;
 882        }
 883
 884        switch (osk->sk_type) {
 885        case SOCK_DGRAM:
 886                break;
 887        case SOCK_SEQPACKET:
 888                break;
 889        default:
 890                sk_free(sk);
 891                ax25_cb_put(ax25);
 892                return NULL;
 893        }
 894
 895        sock_init_data(NULL, sk);
 896
 897        sk->sk_destruct = ax25_free_sock;
 898        sk->sk_type     = osk->sk_type;
 899        sk->sk_priority = osk->sk_priority;
 900        sk->sk_protocol = osk->sk_protocol;
 901        sk->sk_rcvbuf   = osk->sk_rcvbuf;
 902        sk->sk_sndbuf   = osk->sk_sndbuf;
 903        sk->sk_state    = TCP_ESTABLISHED;
 904        sock_copy_flags(sk, osk);
 905
 906        oax25 = ax25_sk(osk);
 907
 908        ax25->modulus = oax25->modulus;
 909        ax25->backoff = oax25->backoff;
 910        ax25->pidincl = oax25->pidincl;
 911        ax25->iamdigi = oax25->iamdigi;
 912        ax25->rtt     = oax25->rtt;
 913        ax25->t1      = oax25->t1;
 914        ax25->t2      = oax25->t2;
 915        ax25->t3      = oax25->t3;
 916        ax25->n2      = oax25->n2;
 917        ax25->idle    = oax25->idle;
 918        ax25->paclen  = oax25->paclen;
 919        ax25->window  = oax25->window;
 920
 921        ax25->ax25_dev    = ax25_dev;
 922        ax25->source_addr = oax25->source_addr;
 923
 924        if (oax25->digipeat != NULL) {
 925                ax25->digipeat = kmemdup(oax25->digipeat, sizeof(ax25_digi),
 926                                         GFP_ATOMIC);
 927                if (ax25->digipeat == NULL) {
 928                        sk_free(sk);
 929                        ax25_cb_put(ax25);
 930                        return NULL;
 931                }
 932        }
 933
 934        sk->sk_protinfo = ax25;
 935        ax25->sk    = sk;
 936
 937        return sk;
 938}
 939
 940static int ax25_release(struct socket *sock)
 941{
 942        struct sock *sk = sock->sk;
 943        ax25_cb *ax25;
 944
 945        if (sk == NULL)
 946                return 0;
 947
 948        sock_hold(sk);
 949        sock_orphan(sk);
 950        lock_sock(sk);
 951        ax25 = ax25_sk(sk);
 952
 953        if (sk->sk_type == SOCK_SEQPACKET) {
 954                switch (ax25->state) {
 955                case AX25_STATE_0:
 956                        release_sock(sk);
 957                        ax25_disconnect(ax25, 0);
 958                        lock_sock(sk);
 959                        ax25_destroy_socket(ax25);
 960                        break;
 961
 962                case AX25_STATE_1:
 963                case AX25_STATE_2:
 964                        ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 965                        release_sock(sk);
 966                        ax25_disconnect(ax25, 0);
 967                        lock_sock(sk);
 968                        ax25_destroy_socket(ax25);
 969                        break;
 970
 971                case AX25_STATE_3:
 972                case AX25_STATE_4:
 973                        ax25_clear_queues(ax25);
 974                        ax25->n2count = 0;
 975
 976                        switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 977                        case AX25_PROTO_STD_SIMPLEX:
 978                        case AX25_PROTO_STD_DUPLEX:
 979                                ax25_send_control(ax25,
 980                                                  AX25_DISC,
 981                                                  AX25_POLLON,
 982                                                  AX25_COMMAND);
 983                                ax25_stop_t2timer(ax25);
 984                                ax25_stop_t3timer(ax25);
 985                                ax25_stop_idletimer(ax25);
 986                                break;
 987#ifdef CONFIG_AX25_DAMA_SLAVE
 988                        case AX25_PROTO_DAMA_SLAVE:
 989                                ax25_stop_t3timer(ax25);
 990                                ax25_stop_idletimer(ax25);
 991                                break;
 992#endif
 993                        }
 994                        ax25_calculate_t1(ax25);
 995                        ax25_start_t1timer(ax25);
 996                        ax25->state = AX25_STATE_2;
 997                        sk->sk_state                = TCP_CLOSE;
 998                        sk->sk_shutdown            |= SEND_SHUTDOWN;
 999                        sk->sk_state_change(sk);
1000                        sock_set_flag(sk, SOCK_DESTROY);
1001                        break;
1002
1003                default:
1004                        break;
1005                }
1006        } else {
1007                sk->sk_state     = TCP_CLOSE;
1008                sk->sk_shutdown |= SEND_SHUTDOWN;
1009                sk->sk_state_change(sk);
1010                ax25_destroy_socket(ax25);
1011        }
1012
1013        sock->sk   = NULL;
1014        release_sock(sk);
1015        sock_put(sk);
1016
1017        return 0;
1018}
1019
1020/*
1021 *        We support a funny extension here so you can (as root) give any callsign
1022 *        digipeated via a local address as source. This hack is obsolete now
1023 *        that we've implemented support for SO_BINDTODEVICE. It is however small
1024 *        and trivially backward compatible.
1025 */
1026static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
1027{
1028        struct sock *sk = sock->sk;
1029        struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
1030        ax25_dev *ax25_dev = NULL;
1031        ax25_uid_assoc *user;
1032        ax25_address call;
1033        ax25_cb *ax25;
1034        int err = 0;
1035
1036        if (addr_len != sizeof(struct sockaddr_ax25) &&
1037            addr_len != sizeof(struct full_sockaddr_ax25))
1038                /* support for old structure may go away some time
1039                 * ax25_bind(): uses old (6 digipeater) socket structure.
1040                 */
1041                if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1042                    (addr_len > sizeof(struct full_sockaddr_ax25)))
1043                        return -EINVAL;
1044
1045        if (addr->fsa_ax25.sax25_family != AF_AX25)
1046                return -EINVAL;
1047
1048        user = ax25_findbyuid(current->euid);
1049        if (user) {
1050                call = user->call;
1051                ax25_uid_put(user);
1052        } else {
1053                if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
1054                        return -EACCES;
1055
1056                call = addr->fsa_ax25.sax25_call;
1057        }
1058
1059        lock_sock(sk);
1060
1061        ax25 = ax25_sk(sk);
1062        if (!sock_flag(sk, SOCK_ZAPPED)) {
1063                err = -EINVAL;
1064                goto out;
1065        }
1066
1067        ax25->source_addr = call;
1068
1069        /*
1070         * User already set interface with SO_BINDTODEVICE
1071         */
1072        if (ax25->ax25_dev != NULL)
1073                goto done;
1074
1075        if (addr_len > sizeof(struct sockaddr_ax25) && addr->fsa_ax25.sax25_ndigis == 1) {
1076                if (ax25cmp(&addr->fsa_digipeater[0], &null_ax25_address) != 0 &&
1077                    (ax25_dev = ax25_addr_ax25dev(&addr->fsa_digipeater[0])) == NULL) {
1078                        err = -EADDRNOTAVAIL;
1079                        goto out;
1080                }
1081        } else {
1082                if ((ax25_dev = ax25_addr_ax25dev(&addr->fsa_ax25.sax25_call)) == NULL) {
1083                        err = -EADDRNOTAVAIL;
1084                        goto out;
1085                }
1086        }
1087
1088        if (ax25_dev != NULL)
1089                ax25_fillin_cb(ax25, ax25_dev);
1090
1091done:
1092        ax25_cb_add(ax25);
1093        sock_reset_flag(sk, SOCK_ZAPPED);
1094
1095out:
1096        release_sock(sk);
1097
1098        return 0;
1099}
1100
1101/*
1102 *        FIXME: nonblock behaviour looks like it may have a bug.
1103 */
1104static int __must_check ax25_connect(struct socket *sock,
1105        struct sockaddr *uaddr, int addr_len, int flags)
1106{
1107        struct sock *sk = sock->sk;
1108        ax25_cb *ax25 = ax25_sk(sk), *ax25t;
1109        struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1110        ax25_digi *digi = NULL;
1111        int ct = 0, err = 0;
1112
1113        /*
1114         * some sanity checks. code further down depends on this
1115         */
1116
1117        if (addr_len == sizeof(struct sockaddr_ax25))
1118                /* support for this will go away in early 2.5.x
1119                 * ax25_connect(): uses obsolete socket structure
1120                 */
1121                ;
1122        else if (addr_len != sizeof(struct full_sockaddr_ax25))
1123                /* support for old structure may go away some time
1124                 * ax25_connect(): uses old (6 digipeater) socket structure.
1125                 */
1126                if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1127                    (addr_len > sizeof(struct full_sockaddr_ax25)))
1128                        return -EINVAL;
1129
1130
1131        if (fsa->fsa_ax25.sax25_family != AF_AX25)
1132                return -EINVAL;
1133
1134        lock_sock(sk);
1135
1136        /* deal with restarts */
1137        if (sock->state == SS_CONNECTING) {
1138                switch (sk->sk_state) {
1139                case TCP_SYN_SENT: /* still trying */
1140                        err = -EINPROGRESS;
1141                        goto out_release;
1142
1143                case TCP_ESTABLISHED: /* connection established */
1144                        sock->state = SS_CONNECTED;
1145                        goto out_release;
1146
1147                case TCP_CLOSE: /* connection refused */
1148                        sock->state = SS_UNCONNECTED;
1149                        err = -ECONNREFUSED;
1150                        goto out_release;
1151                }
1152        }
1153
1154        if (sk->sk_state == TCP_ESTABLISHED && sk->sk_type == SOCK_SEQPACKET) {
1155                err = -EISCONN;        /* No reconnect on a seqpacket socket */
1156                goto out_release;
1157        }
1158
1159        sk->sk_state   = TCP_CLOSE;
1160        sock->state = SS_UNCONNECTED;
1161
1162        kfree(ax25->digipeat);
1163        ax25->digipeat = NULL;
1164
1165        /*
1166         *        Handle digi-peaters to be used.
1167         */
1168        if (addr_len > sizeof(struct sockaddr_ax25) &&
1169            fsa->fsa_ax25.sax25_ndigis != 0) {
1170                /* Valid number of digipeaters ? */
1171                if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
1172                        err = -EINVAL;
1173                        goto out_release;
1174                }
1175
1176                if ((digi = kmalloc(sizeof(ax25_digi), GFP_KERNEL)) == NULL) {
1177                        err = -ENOBUFS;
1178                        goto out_release;
1179                }
1180
1181                digi->ndigi      = fsa->fsa_ax25.sax25_ndigis;
1182                digi->lastrepeat = -1;
1183
1184                while (ct < fsa->fsa_ax25.sax25_ndigis) {
1185                        if ((fsa->fsa_digipeater[ct].ax25_call[6] &
1186                             AX25_HBIT) && ax25->iamdigi) {
1187                                digi->repeated[ct] = 1;
1188                                digi->lastrepeat   = ct;
1189                        } else {
1190                                digi->repeated[ct] = 0;
1191                        }
1192                        digi->calls[ct] = fsa->fsa_digipeater[ct];
1193                        ct++;
1194                }
1195        }
1196
1197        /*
1198         *        Must bind first - autobinding in this may or may not work. If
1199         *        the socket is already bound, check to see if the device has
1200         *        been filled in, error if it hasn't.
1201         */
1202        if (sock_flag(sk, SOCK_ZAPPED)) {
1203                /* check if we can remove this feature. It is broken. */
1204                printk(KERN_WARNING "ax25_connect(): %s uses autobind, please contact jreuter@yaina.de\n",
1205                        current->comm);
1206                if ((err = ax25_rt_autobind(ax25, &fsa->fsa_ax25.sax25_call)) < 0) {
1207                        kfree(digi);
1208                        goto out_release;
1209                }
1210
1211                ax25_fillin_cb(ax25, ax25->ax25_dev);
1212                ax25_cb_add(ax25);
1213        } else {
1214                if (ax25->ax25_dev == NULL) {
1215                        kfree(digi);
1216                        err = -EHOSTUNREACH;
1217                        goto out_release;
1218                }
1219        }
1220
1221        if (sk->sk_type == SOCK_SEQPACKET &&
1222            (ax25t=ax25_find_cb(&ax25->source_addr, &fsa->fsa_ax25.sax25_call, digi,
1223                         ax25->ax25_dev->dev))) {
1224                kfree(digi);
1225                err = -EADDRINUSE;                /* Already such a connection */
1226                ax25_cb_put(ax25t);
1227                goto out_release;
1228        }
1229
1230        ax25->dest_addr = fsa->fsa_ax25.sax25_call;
1231        ax25->digipeat  = digi;
1232
1233        /* First the easy one */
1234        if (sk->sk_type != SOCK_SEQPACKET) {
1235                sock->state = SS_CONNECTED;
1236                sk->sk_state   = TCP_ESTABLISHED;
1237                goto out_release;
1238        }
1239
1240        /* Move to connecting socket, ax.25 lapb WAIT_UA.. */
1241        sock->state        = SS_CONNECTING;
1242        sk->sk_state          = TCP_SYN_SENT;
1243
1244        switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
1245        case AX25_PROTO_STD_SIMPLEX:
1246        case AX25_PROTO_STD_DUPLEX:
1247                ax25_std_establish_data_link(ax25);
1248                break;
1249
1250#ifdef CONFIG_AX25_DAMA_SLAVE
1251        case AX25_PROTO_DAMA_SLAVE:
1252                ax25->modulus = AX25_MODULUS;
1253                ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
1254                if (ax25->ax25_dev->dama.slave)
1255                        ax25_ds_establish_data_link(ax25);
1256                else
1257                        ax25_std_establish_data_link(ax25);
1258                break;
1259#endif
1260        }
1261
1262        ax25->state = AX25_STATE_1;
1263
1264        ax25_start_heartbeat(ax25);
1265
1266        /* Now the loop */
1267        if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
1268                err = -EINPROGRESS;
1269                goto out_release;
1270        }
1271
1272        if (sk->sk_state == TCP_SYN_SENT) {
1273                DEFINE_WAIT(wait);
1274
1275                for (;;) {
1276                        prepare_to_wait(sk->sk_sleep, &wait,
1277                                        TASK_INTERRUPTIBLE);
1278                        if (sk->sk_state != TCP_SYN_SENT)
1279                                break;
1280                        if (!signal_pending(current)) {
1281                                release_sock(sk);
1282                                schedule();
1283                                lock_sock(sk);
1284                                continue;
1285                        }
1286                        err = -ERESTARTSYS;
1287                        break;
1288                }
1289                finish_wait(sk->sk_sleep, &wait);
1290
1291                if (err)
1292                        goto out_release;
1293        }
1294
1295        if (sk->sk_state != TCP_ESTABLISHED) {
1296                /* Not in ABM, not in WAIT_UA -> failed */
1297                sock->state = SS_UNCONNECTED;
1298                err = sock_error(sk);        /* Always set at this point */
1299                goto out_release;
1300        }
1301
1302        sock->state = SS_CONNECTED;
1303
1304        err = 0;
1305out_release:
1306        release_sock(sk);
1307
1308        return err;
1309}
1310
1311static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
1312{
1313        struct sk_buff *skb;
1314        struct sock *newsk;
1315        DEFINE_WAIT(wait);
1316        struct sock *sk;
1317        int err = 0;
1318
1319        if (sock->state != SS_UNCONNECTED)
1320                return -EINVAL;
1321
1322        if ((sk = sock->sk) == NULL)
1323                return -EINVAL;
1324
1325        lock_sock(sk);
1326        if (sk->sk_type != SOCK_SEQPACKET) {
1327                err = -EOPNOTSUPP;
1328                goto out;
1329        }
1330
1331        if (sk->sk_state != TCP_LISTEN) {
1332                err = -EINVAL;
1333                goto out;
1334        }
1335
1336        /*
1337         *        The read queue this time is holding sockets ready to use
1338         *        hooked into the SABM we saved
1339         */
1340        for (;;) {
1341                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
1342                skb = skb_dequeue(&sk->sk_receive_queue);
1343                if (skb)
1344                        break;
1345
1346                if (flags & O_NONBLOCK) {
1347                        err = -EWOULDBLOCK;
1348                        break;
1349                }
1350                if (!signal_pending(current)) {
1351                        release_sock(sk);
1352                        schedule();
1353                        lock_sock(sk);
1354                        continue;
1355                }
1356                err = -ERESTARTSYS;
1357                break;
1358        }
1359        finish_wait(sk->sk_sleep, &wait);
1360
1361        if (err)
1362                goto out;
1363
1364        newsk                 = skb->sk;
1365        sock_graft(newsk, newsock);
1366
1367        /* Now attach up the new socket */
1368        kfree_skb(skb);
1369        sk->sk_ack_backlog--;
1370        newsock->state = SS_CONNECTED;
1371
1372out:
1373        release_sock(sk);
1374
1375        return err;
1376}
1377
1378static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
1379        int *uaddr_len, int peer)
1380{
1381        struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1382        struct sock *sk = sock->sk;
1383        unsigned char ndigi, i;
1384        ax25_cb *ax25;
1385        int err = 0;
1386
1387        lock_sock(sk);
1388        ax25 = ax25_sk(sk);
1389
1390        if (peer != 0) {
1391                if (sk->sk_state != TCP_ESTABLISHED) {
1392                        err = -ENOTCONN;
1393                        goto out;
1394                }
1395
1396                fsa->fsa_ax25.sax25_family = AF_AX25;
1397                fsa->fsa_ax25.sax25_call   = ax25->dest_addr;
1398                fsa->fsa_ax25.sax25_ndigis = 0;
1399
1400                if (ax25->digipeat != NULL) {
1401                        ndigi = ax25->digipeat->ndigi;
1402                        fsa->fsa_ax25.sax25_ndigis = ndigi;
1403                        for (i = 0; i < ndigi; i++)
1404                                fsa->fsa_digipeater[i] =
1405                                                ax25->digipeat->calls[i];
1406                }
1407        } else {
1408                fsa->fsa_ax25.sax25_family = AF_AX25;
1409                fsa->fsa_ax25.sax25_call   = ax25->source_addr;
1410                fsa->fsa_ax25.sax25_ndigis = 1;
1411                if (ax25->ax25_dev != NULL) {
1412                        memcpy(&fsa->fsa_digipeater[0],
1413                               ax25->ax25_dev->dev->dev_addr, AX25_ADDR_LEN);
1414                } else {
1415                        fsa->fsa_digipeater[0] = null_ax25_address;
1416                }
1417        }
1418        *uaddr_len = sizeof (struct full_sockaddr_ax25);
1419
1420out:
1421        release_sock(sk);
1422
1423        return err;
1424}
1425
1426static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
1427                        struct msghdr *msg, size_t len)
1428{
1429        struct sockaddr_ax25 *usax = (struct sockaddr_ax25 *)msg->msg_name;
1430        struct sock *sk = sock->sk;
1431        struct sockaddr_ax25 sax;
1432        struct sk_buff *skb;
1433        ax25_digi dtmp, *dp;
1434        ax25_cb *ax25;
1435        size_t size;
1436        int lv, err, addr_len = msg->msg_namelen;
1437
1438        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
1439                return -EINVAL;
1440
1441        lock_sock(sk);
1442        ax25 = ax25_sk(sk);
1443
1444        if (sock_flag(sk, SOCK_ZAPPED)) {
1445                err = -EADDRNOTAVAIL;
1446                goto out;
1447        }
1448
1449        if (sk->sk_shutdown & SEND_SHUTDOWN) {
1450                send_sig(SIGPIPE, current, 0);
1451                err = -EPIPE;
1452                goto out;
1453        }
1454
1455        if (ax25->ax25_dev == NULL) {
1456                err = -ENETUNREACH;
1457                goto out;
1458        }
1459
1460        if (len > ax25->ax25_dev->dev->mtu) {
1461                err = -EMSGSIZE;
1462                goto out;
1463        }
1464
1465        if (usax != NULL) {
1466                if (usax->sax25_family != AF_AX25) {
1467                        err = -EINVAL;
1468                        goto out;
1469                }
1470
1471                if (addr_len == sizeof(struct sockaddr_ax25))
1472                        /* ax25_sendmsg(): uses obsolete socket structure */
1473                        ;
1474                else if (addr_len != sizeof(struct full_sockaddr_ax25))
1475                        /* support for old structure may go away some time
1476                         * ax25_sendmsg(): uses old (6 digipeater)
1477                         * socket structure.
1478                         */
1479                        if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1480                            (addr_len > sizeof(struct full_sockaddr_ax25))) {
1481                                err = -EINVAL;
1482                                goto out;
1483                        }
1484
1485
1486                if (addr_len > sizeof(struct sockaddr_ax25) && usax->sax25_ndigis != 0) {
1487                        int ct           = 0;
1488                        struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
1489
1490                        /* Valid number of digipeaters ? */
1491                        if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
1492                                err = -EINVAL;
1493                                goto out;
1494                        }
1495
1496                        dtmp.ndigi      = usax->sax25_ndigis;
1497
1498                        while (ct < usax->sax25_ndigis) {
1499                                dtmp.repeated[ct] = 0;
1500                                dtmp.calls[ct]    = fsa->fsa_digipeater[ct];
1501                                ct++;
1502                        }
1503
1504                        dtmp.lastrepeat = 0;
1505                }
1506
1507                sax = *usax;
1508                if (sk->sk_type == SOCK_SEQPACKET &&
1509                    ax25cmp(&ax25->dest_addr, &sax.sax25_call)) {
1510                        err = -EISCONN;
1511                        goto out;
1512                }
1513                if (usax->sax25_ndigis == 0)
1514                        dp = NULL;
1515                else
1516                        dp = &dtmp;
1517        } else {
1518                /*
1519                 *        FIXME: 1003.1g - if the socket is like this because
1520                 *        it has become closed (not started closed) and is VC
1521                 *        we ought to SIGPIPE, EPIPE
1522                 */
1523                if (sk->sk_state != TCP_ESTABLISHED) {
1524                        err = -ENOTCONN;
1525                        goto out;
1526                }
1527                sax.sax25_family = AF_AX25;
1528                sax.sax25_call   = ax25->dest_addr;
1529                dp = ax25->digipeat;
1530        }
1531
1532        SOCK_DEBUG(sk, "AX.25: sendto: Addresses built.\n");
1533
1534        /* Build a packet */
1535        SOCK_DEBUG(sk, "AX.25: sendto: building packet.\n");
1536
1537        /* Assume the worst case */
1538        size = len + ax25->ax25_dev->dev->hard_header_len;
1539
1540        skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT, &err);
1541        if (skb == NULL)
1542                goto out;
1543
1544        skb_reserve(skb, size - len);
1545
1546        SOCK_DEBUG(sk, "AX.25: Appending user data\n");
1547
1548        /* User data follows immediately after the AX.25 data */
1549        if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
1550                err = -EFAULT;
1551                kfree_skb(skb);
1552                goto out;
1553        }
1554
1555        skb_reset_network_header(skb);
1556
1557        /* Add the PID if one is not supplied by the user in the skb */
1558        if (!ax25->pidincl)
1559                *skb_push(skb, 1) = sk->sk_protocol;
1560
1561        SOCK_DEBUG(sk, "AX.25: Transmitting buffer\n");
1562
1563        if (sk->sk_type == SOCK_SEQPACKET) {
1564                /* Connected mode sockets go via the LAPB machine */
1565                if (sk->sk_state != TCP_ESTABLISHED) {
1566                        kfree_skb(skb);
1567                        err = -ENOTCONN;
1568                        goto out;
1569                }
1570
1571                /* Shove it onto the queue and kick */
1572                ax25_output(ax25, ax25->paclen, skb);
1573
1574                err = len;
1575                goto out;
1576        }
1577
1578        skb_push(skb, 1 + ax25_addr_size(dp));
1579
1580        SOCK_DEBUG(sk, "Building AX.25 Header (dp=%p).\n", dp);
1581
1582        if (dp != NULL)
1583                SOCK_DEBUG(sk, "Num digipeaters=%d\n", dp->ndigi);
1584
1585        /* Build an AX.25 header */
1586        lv = ax25_addr_build(skb->data, &ax25->source_addr, &sax.sax25_call,
1587                             dp, AX25_COMMAND, AX25_MODULUS);
1588
1589        SOCK_DEBUG(sk, "Built header (%d bytes)\n",lv);
1590
1591        skb_set_transport_header(skb, lv);
1592
1593        SOCK_DEBUG(sk, "base=%p pos=%p\n",
1594                   skb->data, skb_transport_header(skb));
1595
1596        *skb_transport_header(skb) = AX25_UI;
1597
1598        /* Datagram frames go straight out of the door as UI */
1599        ax25_queue_xmit(skb, ax25->ax25_dev->dev);
1600
1601        err = len;
1602
1603out:
1604        release_sock(sk);
1605
1606        return err;
1607}
1608
1609static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
1610        struct msghdr *msg, size_t size, int flags)
1611{
1612        struct sock *sk = sock->sk;
1613        struct sk_buff *skb;
1614        int copied;
1615        int err = 0;
1616
1617        lock_sock(sk);
1618        /*
1619         *         This works for seqpacket too. The receiver has ordered the
1620         *        queue for us! We do one quick check first though
1621         */
1622        if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_ESTABLISHED) {
1623                err =  -ENOTCONN;
1624                goto out;
1625        }
1626
1627        /* Now we can treat all alike */
1628        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1629                                flags & MSG_DONTWAIT, &err);
1630        if (skb == NULL)
1631                goto out;
1632
1633        if (!ax25_sk(sk)->pidincl)
1634                skb_pull(skb, 1);                /* Remove PID */
1635
1636        skb_reset_transport_header(skb);
1637        copied = skb->len;
1638
1639        if (copied > size) {
1640                copied = size;
1641                msg->msg_flags |= MSG_TRUNC;
1642        }
1643
1644        skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1645
1646        if (msg->msg_namelen != 0) {
1647                struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
1648                ax25_digi digi;
1649                ax25_address src;
1650                const unsigned char *mac = skb_mac_header(skb);
1651
1652                ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
1653                                &digi, NULL, NULL);
1654                sax->sax25_family = AF_AX25;
1655                /* We set this correctly, even though we may not let the
1656                   application know the digi calls further down (because it
1657                   did NOT ask to know them).  This could get political... **/
1658                sax->sax25_ndigis = digi.ndigi;
1659                sax->sax25_call   = src;
1660
1661                if (sax->sax25_ndigis != 0) {
1662                        int ct;
1663                        struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)sax;
1664
1665                        for (ct = 0; ct < digi.ndigi; ct++)
1666                                fsa->fsa_digipeater[ct] = digi.calls[ct];
1667                }
1668                msg->msg_namelen = sizeof(struct full_sockaddr_ax25);
1669        }
1670
1671        skb_free_datagram(sk, skb);
1672        err = copied;
1673
1674out:
1675        release_sock(sk);
1676
1677        return err;
1678}
1679
1680static int ax25_shutdown(struct socket *sk, int how)
1681{
1682        /* FIXME - generate DM and RNR states */
1683        return -EOPNOTSUPP;
1684}
1685
1686static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1687{
1688        struct sock *sk = sock->sk;
1689        void __user *argp = (void __user *)arg;
1690        int res = 0;
1691
1692        lock_sock(sk);
1693        switch (cmd) {
1694        case TIOCOUTQ: {
1695                long amount;
1696                amount = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
1697                if (amount < 0)
1698                        amount = 0;
1699                res = put_user(amount, (int __user *)argp);
1700                break;
1701        }
1702
1703        case TIOCINQ: {
1704                struct sk_buff *skb;
1705                long amount = 0L;
1706                /* These two are safe on a single CPU system as only user tasks fiddle here */
1707                if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1708                        amount = skb->len;
1709                res = put_user(amount, (int __user *) argp);
1710                break;
1711        }
1712
1713        case SIOCGSTAMP:
1714                res = sock_get_timestamp(sk, argp);
1715                break;
1716
1717        case SIOCGSTAMPNS:
1718                res = sock_get_timestampns(sk, argp);
1719                break;
1720
1721        case SIOCAX25ADDUID:        /* Add a uid to the uid/call map table */
1722        case SIOCAX25DELUID:        /* Delete a uid from the uid/call map table */
1723        case SIOCAX25GETUID: {
1724                struct sockaddr_ax25 sax25;
1725                if (copy_from_user(&sax25, argp, sizeof(sax25))) {
1726                        res = -EFAULT;
1727                        break;
1728                }
1729                res = ax25_uid_ioctl(cmd, &sax25);
1730                break;
1731        }
1732
1733        case SIOCAX25NOUID: {        /* Set the default policy (default/bar) */
1734                long amount;
1735                if (!capable(CAP_NET_ADMIN)) {
1736                        res = -EPERM;
1737                        break;
1738                }
1739                if (get_user(amount, (long __user *)argp)) {
1740                        res = -EFAULT;
1741                        break;
1742                }
1743                if (amount > AX25_NOUID_BLOCK) {
1744                        res = -EINVAL;
1745                        break;
1746                }
1747                ax25_uid_policy = amount;
1748                res = 0;
1749                break;
1750        }
1751
1752        case SIOCADDRT:
1753        case SIOCDELRT:
1754        case SIOCAX25OPTRT:
1755                if (!capable(CAP_NET_ADMIN)) {
1756                        res = -EPERM;
1757                        break;
1758                }
1759                res = ax25_rt_ioctl(cmd, argp);
1760                break;
1761
1762        case SIOCAX25CTLCON:
1763                if (!capable(CAP_NET_ADMIN)) {
1764                        res = -EPERM;
1765                        break;
1766                }
1767                res = ax25_ctl_ioctl(cmd, argp);
1768                break;
1769
1770        case SIOCAX25GETINFO:
1771        case SIOCAX25GETINFOOLD: {
1772                ax25_cb *ax25 = ax25_sk(sk);
1773                struct ax25_info_struct ax25_info;
1774
1775                ax25_info.t1        = ax25->t1   / HZ;
1776                ax25_info.t2        = ax25->t2   / HZ;
1777                ax25_info.t3        = ax25->t3   / HZ;
1778                ax25_info.idle      = ax25->idle / (60 * HZ);
1779                ax25_info.n2        = ax25->n2;
1780                ax25_info.t1timer   = ax25_display_timer(&ax25->t1timer)   / HZ;
1781                ax25_info.t2timer   = ax25_display_timer(&ax25->t2timer)   / HZ;
1782                ax25_info.t3timer   = ax25_display_timer(&ax25->t3timer)   / HZ;
1783                ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
1784                ax25_info.n2count   = ax25->n2count;
1785                ax25_info.state     = ax25->state;
1786                ax25_info.rcv_q     = atomic_read(&sk->sk_rmem_alloc);
1787                ax25_info.snd_q     = atomic_read(&sk->sk_wmem_alloc);
1788                ax25_info.vs        = ax25->vs;
1789                ax25_info.vr        = ax25->vr;
1790                ax25_info.va        = ax25->va;
1791                ax25_info.vs_max    = ax25->vs; /* reserved */
1792                ax25_info.paclen    = ax25->paclen;
1793                ax25_info.window    = ax25->window;
1794
1795                /* old structure? */
1796                if (cmd == SIOCAX25GETINFOOLD) {
1797                        static int warned = 0;
1798                        if (!warned) {
1799                                printk(KERN_INFO "%s uses old SIOCAX25GETINFO\n",
1800                                        current->comm);
1801                                warned=1;
1802                        }
1803
1804                        if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct_deprecated))) {
1805                                res = -EFAULT;
1806                                break;
1807                        }
1808                } else {
1809                        if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct))) {
1810                                res = -EINVAL;
1811                                break;
1812                        }
1813                }
1814                res = 0;
1815                break;
1816        }
1817
1818        case SIOCAX25ADDFWD:
1819        case SIOCAX25DELFWD: {
1820                struct ax25_fwd_struct ax25_fwd;
1821                if (!capable(CAP_NET_ADMIN)) {
1822                        res = -EPERM;
1823                        break;
1824                }
1825                if (copy_from_user(&ax25_fwd, argp, sizeof(ax25_fwd))) {
1826                        res = -EFAULT;
1827                        break;
1828                }
1829                res = ax25_fwd_ioctl(cmd, &ax25_fwd);
1830                break;
1831        }
1832
1833        case SIOCGIFADDR:
1834        case SIOCSIFADDR:
1835        case SIOCGIFDSTADDR:
1836        case SIOCSIFDSTADDR:
1837        case SIOCGIFBRDADDR:
1838        case SIOCSIFBRDADDR:
1839        case SIOCGIFNETMASK:
1840        case SIOCSIFNETMASK:
1841        case SIOCGIFMETRIC:
1842        case SIOCSIFMETRIC:
1843                res = -EINVAL;
1844                break;
1845
1846        default:
1847                res = -ENOIOCTLCMD;
1848                break;
1849        }
1850        release_sock(sk);
1851
1852        return res;
1853}
1854
1855#ifdef CONFIG_PROC_FS
1856
1857static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
1858        __acquires(ax25_list_lock)
1859{
1860        struct ax25_cb *ax25;
1861        struct hlist_node *node;
1862        int i = 0;
1863
1864        spin_lock_bh(&ax25_list_lock);
1865        ax25_for_each(ax25, node, &ax25_list) {
1866                if (i == *pos)
1867                        return ax25;
1868                ++i;
1869        }
1870        return NULL;
1871}
1872
1873static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
1874{
1875        ++*pos;
1876
1877        return hlist_entry( ((struct ax25_cb *)v)->ax25_node.next,
1878                            struct ax25_cb, ax25_node);
1879}
1880
1881static void ax25_info_stop(struct seq_file *seq, void *v)
1882        __releases(ax25_list_lock)
1883{
1884        spin_unlock_bh(&ax25_list_lock);
1885}
1886
1887static int ax25_info_show(struct seq_file *seq, void *v)
1888{
1889        ax25_cb *ax25 = v;
1890        char buf[11];
1891        int k;
1892
1893
1894        /*
1895         * New format:
1896         * magic dev src_addr dest_addr,digi1,digi2,.. st vs vr va t1 t1 t2 t2 t3 t3 idle idle n2 n2 rtt window paclen Snd-Q Rcv-Q inode
1897         */
1898
1899        seq_printf(seq, "%8.8lx %s %s%s ",
1900                   (long) ax25,
1901                   ax25->ax25_dev == NULL? "???" : ax25->ax25_dev->dev->name,
1902                   ax2asc(buf, &ax25->source_addr),
1903                   ax25->iamdigi? "*":"");
1904        seq_printf(seq, "%s", ax2asc(buf, &ax25->dest_addr));
1905
1906        for (k=0; (ax25->digipeat != NULL) && (k < ax25->digipeat->ndigi); k++) {
1907                seq_printf(seq, ",%s%s",
1908                           ax2asc(buf, &ax25->digipeat->calls[k]),
1909                           ax25->digipeat->repeated[k]? "*":"");
1910        }
1911
1912        seq_printf(seq, " %d %d %d %d %lu %lu %lu %lu %lu %lu %lu %lu %d %d %lu %d %d",
1913                   ax25->state,
1914                   ax25->vs, ax25->vr, ax25->va,
1915                   ax25_display_timer(&ax25->t1timer) / HZ, ax25->t1 / HZ,
1916                   ax25_display_timer(&ax25->t2timer) / HZ, ax25->t2 / HZ,
1917                   ax25_display_timer(&ax25->t3timer) / HZ, ax25->t3 / HZ,
1918                   ax25_display_timer(&ax25->idletimer) / (60 * HZ),
1919                   ax25->idle / (60 * HZ),
1920                   ax25->n2count, ax25->n2,
1921                   ax25->rtt / HZ,
1922                   ax25->window,
1923                   ax25->paclen);
1924
1925        if (ax25->sk != NULL) {
1926                seq_printf(seq, " %d %d %lu\n",
1927                           atomic_read(&ax25->sk->sk_wmem_alloc),
1928                           atomic_read(&ax25->sk->sk_rmem_alloc),
1929                           sock_i_ino(ax25->sk));
1930        } else {
1931                seq_puts(seq, " * * *\n");
1932        }
1933        return 0;
1934}
1935
1936static const struct seq_operations ax25_info_seqops = {
1937        .start = ax25_info_start,
1938        .next = ax25_info_next,
1939        .stop = ax25_info_stop,
1940        .show = ax25_info_show,
1941};
1942
1943static int ax25_info_open(struct inode *inode, struct file *file)
1944{
1945        return seq_open(file, &ax25_info_seqops);
1946}
1947
1948static const struct file_operations ax25_info_fops = {
1949        .owner = THIS_MODULE,
1950        .open = ax25_info_open,
1951        .read = seq_read,
1952        .llseek = seq_lseek,
1953        .release = seq_release,
1954};
1955
1956#endif
1957
1958static struct net_proto_family ax25_family_ops = {
1959        .family =        PF_AX25,
1960        .create =        ax25_create,
1961        .owner        =        THIS_MODULE,
1962};
1963
1964static const struct proto_ops ax25_proto_ops = {
1965        .family                = PF_AX25,
1966        .owner                = THIS_MODULE,
1967        .release        = ax25_release,
1968        .bind                = ax25_bind,
1969        .connect        = ax25_connect,
1970        .socketpair        = sock_no_socketpair,
1971        .accept                = ax25_accept,
1972        .getname        = ax25_getname,
1973        .poll                = datagram_poll,
1974        .ioctl                = ax25_ioctl,
1975        .listen                = ax25_listen,
1976        .shutdown        = ax25_shutdown,
1977        .setsockopt        = ax25_setsockopt,
1978        .getsockopt        = ax25_getsockopt,
1979        .sendmsg        = ax25_sendmsg,
1980        .recvmsg        = ax25_recvmsg,
1981        .mmap                = sock_no_mmap,
1982        .sendpage        = sock_no_sendpage,
1983};
1984
1985/*
1986 *        Called by socket.c on kernel start up
1987 */
1988static struct packet_type ax25_packet_type = {
1989        .type        =        __constant_htons(ETH_P_AX25),
1990        .dev        =        NULL,                                /* All devices */
1991        .func        =        ax25_kiss_rcv,
1992};
1993
1994static struct notifier_block ax25_dev_notifier = {
1995        .notifier_call =ax25_device_event,
1996};
1997
1998static int __init ax25_init(void)
1999{
2000        int rc = proto_register(&ax25_proto, 0);
2001
2002        if (rc != 0)
2003                goto out;
2004
2005        sock_register(&ax25_family_ops);
2006        dev_add_pack(&ax25_packet_type);
2007        register_netdevice_notifier(&ax25_dev_notifier);
2008        ax25_register_sysctl();
2009
2010        proc_net_fops_create(&init_net, "ax25_route", S_IRUGO, &ax25_route_fops);
2011        proc_net_fops_create(&init_net, "ax25", S_IRUGO, &ax25_info_fops);
2012        proc_net_fops_create(&init_net, "ax25_calls", S_IRUGO, &ax25_uid_fops);
2013out:
2014        return rc;
2015}
2016module_init(ax25_init);
2017
2018
2019MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
2020MODULE_DESCRIPTION("The amateur radio AX.25 link layer protocol");
2021MODULE_LICENSE("GPL");
2022MODULE_ALIAS_NETPROTO(PF_AX25);
2023
2024static void __exit ax25_exit(void)
2025{
2026        proc_net_remove(&init_net, "ax25_route");
2027        proc_net_remove(&init_net, "ax25");
2028        proc_net_remove(&init_net, "ax25_calls");
2029        ax25_rt_free();
2030        ax25_uid_free();
2031        ax25_dev_free();
2032
2033        ax25_unregister_sysctl();
2034        unregister_netdevice_notifier(&ax25_dev_notifier);
2035
2036        dev_remove_pack(&ax25_packet_type);
2037
2038        sock_unregister(PF_AX25);
2039        proto_unregister(&ax25_proto);
2040}
2041module_exit(ax25_exit);