Showing error 1800

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/isdn/gigaset/i4l.c
Line in file: 517
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC

Source: 

  1/*
  2 * Stuff used by all variants of the driver
  3 *
  4 * Copyright (c) 2001 by Stefan Eilers,
  5 *                       Hansjoerg Lipp <hjlipp@web.de>,
  6 *                       Tilman Schmidt <tilman@imap.cc>.
  7 *
  8 * =====================================================================
  9 *        This program is free software; you can redistribute it and/or
 10 *        modify it under the terms of the GNU General Public License as
 11 *        published by the Free Software Foundation; either version 2 of
 12 *        the License, or (at your option) any later version.
 13 * =====================================================================
 14 */
 15
 16#include "gigaset.h"
 17
 18/* == Handling of I4L IO =====================================================*/
 19
 20/* writebuf_from_LL
 21 * called by LL to transmit data on an open channel
 22 * inserts the buffer data into the send queue and starts the transmission
 23 * Note that this operation must not sleep!
 24 * When the buffer is processed completely, gigaset_skb_sent() should be called.
 25 * parameters:
 26 *        driverID        driver ID as assigned by LL
 27 *        channel                channel number
 28 *        ack                if != 0 LL wants to be notified on completion via
 29 *                        statcallb(ISDN_STAT_BSENT)
 30 *        skb                skb containing data to send
 31 * return value:
 32 *        number of accepted bytes
 33 *        0 if temporarily unable to accept data (out of buffer space)
 34 *        <0 on error (eg. -EINVAL)
 35 */
 36static int writebuf_from_LL(int driverID, int channel, int ack,
 37                            struct sk_buff *skb)
 38{
 39        struct cardstate *cs;
 40        struct bc_state *bcs;
 41        unsigned len;
 42        unsigned skblen;
 43
 44        if (!(cs = gigaset_get_cs_by_id(driverID))) {
 45                err("%s: invalid driver ID (%d)", __func__, driverID);
 46                return -ENODEV;
 47        }
 48        if (channel < 0 || channel >= cs->channels) {
 49                dev_err(cs->dev, "%s: invalid channel ID (%d)\n",
 50                        __func__, channel);
 51                return -ENODEV;
 52        }
 53        bcs = &cs->bcs[channel];
 54        len = skb->len;
 55
 56        gig_dbg(DEBUG_LLDATA,
 57                "Receiving data from LL (id: %d, ch: %d, ack: %d, sz: %d)",
 58                driverID, channel, ack, len);
 59
 60        if (!len) {
 61                if (ack)
 62                        dev_notice(cs->dev, "%s: not ACKing empty packet\n",
 63                                   __func__);
 64                return 0;
 65        }
 66        if (len > MAX_BUF_SIZE) {
 67                dev_err(cs->dev, "%s: packet too large (%d bytes)\n",
 68                        __func__, len);
 69                return -EINVAL;
 70        }
 71
 72        skblen = ack ? len : 0;
 73        skb->head[0] = skblen & 0xff;
 74        skb->head[1] = skblen >> 8;
 75        gig_dbg(DEBUG_MCMD, "skb: len=%u, skblen=%u: %02x %02x",
 76                len, skblen, (unsigned) skb->head[0], (unsigned) skb->head[1]);
 77
 78        /* pass to device-specific module */
 79        return cs->ops->send_skb(bcs, skb);
 80}
 81
 82void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
 83{
 84        unsigned len;
 85        isdn_ctrl response;
 86
 87        ++bcs->trans_up;
 88
 89        if (skb->len)
 90                dev_warn(bcs->cs->dev, "%s: skb->len==%d\n",
 91                         __func__, skb->len);
 92
 93        len = (unsigned char) skb->head[0] |
 94              (unsigned) (unsigned char) skb->head[1] << 8;
 95        if (len) {
 96                gig_dbg(DEBUG_MCMD, "ACKing to LL (id: %d, ch: %d, sz: %u)",
 97                        bcs->cs->myid, bcs->channel, len);
 98
 99                response.driver = bcs->cs->myid;
100                response.command = ISDN_STAT_BSENT;
101                response.arg = bcs->channel;
102                response.parm.length = len;
103                bcs->cs->iif.statcallb(&response);
104        }
105}
106EXPORT_SYMBOL_GPL(gigaset_skb_sent);
107
108/* This function will be called by LL to send commands
109 * NOTE: LL ignores the returned value, for commands other than ISDN_CMD_IOCTL,
110 * so don't put too much effort into it.
111 */
112static int command_from_LL(isdn_ctrl *cntrl)
113{
114        struct cardstate *cs = gigaset_get_cs_by_id(cntrl->driver);
115        struct bc_state *bcs;
116        int retval = 0;
117        struct setup_parm *sp;
118
119        gigaset_debugdrivers();
120
121        if (!cs) {
122                err("%s: invalid driver ID (%d)", __func__, cntrl->driver);
123                return -ENODEV;
124        }
125
126        switch (cntrl->command) {
127        case ISDN_CMD_IOCTL:
128                gig_dbg(DEBUG_ANY, "ISDN_CMD_IOCTL (driver: %d, arg: %ld)",
129                        cntrl->driver, cntrl->arg);
130
131                dev_warn(cs->dev, "ISDN_CMD_IOCTL not supported\n");
132                return -EINVAL;
133
134        case ISDN_CMD_DIAL:
135                gig_dbg(DEBUG_ANY,
136                        "ISDN_CMD_DIAL (driver: %d, ch: %ld, "
137                        "phone: %s, ownmsn: %s, si1: %d, si2: %d)",
138                        cntrl->driver, cntrl->arg,
139                        cntrl->parm.setup.phone, cntrl->parm.setup.eazmsn,
140                        cntrl->parm.setup.si1, cntrl->parm.setup.si2);
141
142                if (cntrl->arg >= cs->channels) {
143                        dev_err(cs->dev,
144                                "ISDN_CMD_DIAL: invalid channel (%d)\n",
145                                (int) cntrl->arg);
146                        return -EINVAL;
147                }
148
149                bcs = cs->bcs + cntrl->arg;
150
151                if (!gigaset_get_channel(bcs)) {
152                        dev_err(cs->dev, "ISDN_CMD_DIAL: channel not free\n");
153                        return -EBUSY;
154                }
155
156                sp = kmalloc(sizeof *sp, GFP_ATOMIC);
157                if (!sp) {
158                        gigaset_free_channel(bcs);
159                        dev_err(cs->dev, "ISDN_CMD_DIAL: out of memory\n");
160                        return -ENOMEM;
161                }
162                *sp = cntrl->parm.setup;
163
164                if (!gigaset_add_event(cs, &bcs->at_state, EV_DIAL, sp,
165                                       bcs->at_state.seq_index, NULL)) {
166                        //FIXME what should we do?
167                        kfree(sp);
168                        gigaset_free_channel(bcs);
169                        return -ENOMEM;
170                }
171
172                gig_dbg(DEBUG_CMD, "scheduling DIAL");
173                gigaset_schedule_event(cs);
174                break;
175        case ISDN_CMD_ACCEPTD: //FIXME
176                gig_dbg(DEBUG_ANY, "ISDN_CMD_ACCEPTD");
177
178                if (cntrl->arg >= cs->channels) {
179                        dev_err(cs->dev,
180                                "ISDN_CMD_ACCEPTD: invalid channel (%d)\n",
181                                (int) cntrl->arg);
182                        return -EINVAL;
183                }
184
185                if (!gigaset_add_event(cs, &cs->bcs[cntrl->arg].at_state,
186                                       EV_ACCEPT, NULL, 0, NULL)) {
187                        //FIXME what should we do?
188                        return -ENOMEM;
189                }
190
191                gig_dbg(DEBUG_CMD, "scheduling ACCEPT");
192                gigaset_schedule_event(cs);
193
194                break;
195        case ISDN_CMD_ACCEPTB:
196                gig_dbg(DEBUG_ANY, "ISDN_CMD_ACCEPTB");
197                break;
198        case ISDN_CMD_HANGUP:
199                gig_dbg(DEBUG_ANY, "ISDN_CMD_HANGUP (ch: %d)",
200                        (int) cntrl->arg);
201
202                if (cntrl->arg >= cs->channels) {
203                        dev_err(cs->dev,
204                                "ISDN_CMD_HANGUP: invalid channel (%d)\n",
205                                (int) cntrl->arg);
206                        return -EINVAL;
207                }
208
209                if (!gigaset_add_event(cs, &cs->bcs[cntrl->arg].at_state,
210                                       EV_HUP, NULL, 0, NULL)) {
211                        //FIXME what should we do?
212                        return -ENOMEM;
213                }
214
215                gig_dbg(DEBUG_CMD, "scheduling HUP");
216                gigaset_schedule_event(cs);
217
218                break;
219        case ISDN_CMD_CLREAZ: /* Do not signal incoming signals */ //FIXME
220                gig_dbg(DEBUG_ANY, "ISDN_CMD_CLREAZ");
221                break;
222        case ISDN_CMD_SETEAZ: /* Signal incoming calls for given MSN */ //FIXME
223                gig_dbg(DEBUG_ANY,
224                        "ISDN_CMD_SETEAZ (id: %d, ch: %ld, number: %s)",
225                        cntrl->driver, cntrl->arg, cntrl->parm.num);
226                break;
227        case ISDN_CMD_SETL2: /* Set L2 to given protocol */
228                gig_dbg(DEBUG_ANY, "ISDN_CMD_SETL2 (ch: %ld, proto: %lx)",
229                        cntrl->arg & 0xff, (cntrl->arg >> 8));
230
231                if ((cntrl->arg & 0xff) >= cs->channels) {
232                        dev_err(cs->dev,
233                                "ISDN_CMD_SETL2: invalid channel (%d)\n",
234                                (int) cntrl->arg & 0xff);
235                        return -EINVAL;
236                }
237
238                if (!gigaset_add_event(cs, &cs->bcs[cntrl->arg & 0xff].at_state,
239                                       EV_PROTO_L2, NULL, cntrl->arg >> 8,
240                                       NULL)) {
241                        //FIXME what should we do?
242                        return -ENOMEM;
243                }
244
245                gig_dbg(DEBUG_CMD, "scheduling PROTO_L2");
246                gigaset_schedule_event(cs);
247                break;
248        case ISDN_CMD_SETL3: /* Set L3 to given protocol */
249                gig_dbg(DEBUG_ANY, "ISDN_CMD_SETL3 (ch: %ld, proto: %lx)",
250                        cntrl->arg & 0xff, (cntrl->arg >> 8));
251
252                if ((cntrl->arg & 0xff) >= cs->channels) {
253                        dev_err(cs->dev,
254                                "ISDN_CMD_SETL3: invalid channel (%d)\n",
255                                (int) cntrl->arg & 0xff);
256                        return -EINVAL;
257                }
258
259                if (cntrl->arg >> 8 != ISDN_PROTO_L3_TRANS) {
260                        dev_err(cs->dev,
261                                "ISDN_CMD_SETL3: invalid protocol %lu\n",
262                                cntrl->arg >> 8);
263                        return -EINVAL;
264                }
265
266                break;
267        case ISDN_CMD_PROCEED:
268                gig_dbg(DEBUG_ANY, "ISDN_CMD_PROCEED"); //FIXME
269                break;
270        case ISDN_CMD_ALERT:
271                gig_dbg(DEBUG_ANY, "ISDN_CMD_ALERT"); //FIXME
272                if (cntrl->arg >= cs->channels) {
273                        dev_err(cs->dev,
274                                "ISDN_CMD_ALERT: invalid channel (%d)\n",
275                                (int) cntrl->arg);
276                        return -EINVAL;
277                }
278                //bcs = cs->bcs + cntrl->arg;
279                //bcs->proto2 = -1;
280                // FIXME
281                break;
282        case ISDN_CMD_REDIR:
283                gig_dbg(DEBUG_ANY, "ISDN_CMD_REDIR"); //FIXME
284                break;
285        case ISDN_CMD_PROT_IO:
286                gig_dbg(DEBUG_ANY, "ISDN_CMD_PROT_IO");
287                break;
288        case ISDN_CMD_FAXCMD:
289                gig_dbg(DEBUG_ANY, "ISDN_CMD_FAXCMD");
290                break;
291        case ISDN_CMD_GETL2:
292                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETL2");
293                break;
294        case ISDN_CMD_GETL3:
295                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETL3");
296                break;
297        case ISDN_CMD_GETEAZ:
298                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETEAZ");
299                break;
300        case ISDN_CMD_SETSIL:
301                gig_dbg(DEBUG_ANY, "ISDN_CMD_SETSIL");
302                break;
303        case ISDN_CMD_GETSIL:
304                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETSIL");
305                break;
306        default:
307                dev_err(cs->dev, "unknown command %d from LL\n",
308                        cntrl->command);
309                return -EINVAL;
310        }
311
312        return retval;
313}
314
315void gigaset_i4l_cmd(struct cardstate *cs, int cmd)
316{
317        isdn_ctrl command;
318
319        command.driver = cs->myid;
320        command.command = cmd;
321        command.arg = 0;
322        cs->iif.statcallb(&command);
323}
324
325void gigaset_i4l_channel_cmd(struct bc_state *bcs, int cmd)
326{
327        isdn_ctrl command;
328
329        command.driver = bcs->cs->myid;
330        command.command = cmd;
331        command.arg = bcs->channel;
332        bcs->cs->iif.statcallb(&command);
333}
334
335int gigaset_isdn_setup_dial(struct at_state_t *at_state, void *data)
336{
337        struct bc_state *bcs = at_state->bcs;
338        unsigned proto;
339        const char *bc;
340        size_t length[AT_NUM];
341        size_t l;
342        int i;
343        struct setup_parm *sp = data;
344
345        switch (bcs->proto2) {
346        case ISDN_PROTO_L2_HDLC:
347                proto = 1; /* 0: Bitsynchron, 1: HDLC, 2: voice */
348                break;
349        case ISDN_PROTO_L2_TRANS:
350                proto = 2; /* 0: Bitsynchron, 1: HDLC, 2: voice */
351                break;
352        default:
353                dev_err(bcs->cs->dev, "%s: invalid L2 protocol: %u\n",
354                        __func__, bcs->proto2);
355                return -EINVAL;
356        }
357
358        switch (sp->si1) {
359        case 1:                /* audio */
360                bc = "9090A3";        /* 3.1 kHz audio, A-law */
361                break;
362        case 7:                /* data */
363        default:        /* hope the app knows what it is doing */
364                bc = "8890";        /* unrestricted digital information */
365        }
366        //FIXME add missing si1 values from 1TR6, inspect si2, set HLC/LLC
367
368        length[AT_DIAL ] = 1 + strlen(sp->phone) + 1 + 1;
369        l = strlen(sp->eazmsn);
370        length[AT_MSN  ] = l ? 6 + l + 1 + 1 : 0;
371        length[AT_BC   ] = 5 + strlen(bc) + 1 + 1;
372        length[AT_PROTO] = 6 + 1 + 1 + 1; /* proto: 1 character */
373        length[AT_ISO  ] = 6 + 1 + 1 + 1; /* channel: 1 character */
374        length[AT_TYPE ] = 6 + 1 + 1 + 1; /* call type: 1 character */
375        length[AT_HLC  ] = 0;
376
377        for (i = 0; i < AT_NUM; ++i) {
378                kfree(bcs->commands[i]);
379                bcs->commands[i] = NULL;
380                if (length[i] &&
381                    !(bcs->commands[i] = kmalloc(length[i], GFP_ATOMIC))) {
382                        dev_err(bcs->cs->dev, "out of memory\n");
383                        return -ENOMEM;
384                }
385        }
386
387        /* type = 1: extern, 0: intern, 2: recall, 3: door, 4: centrex */
388        if (sp->phone[0] == '*' && sp->phone[1] == '*') {
389                /* internal call: translate ** prefix to CTP value */
390                snprintf(bcs->commands[AT_DIAL], length[AT_DIAL],
391                         "D%s\r", sp->phone+2);
392                strncpy(bcs->commands[AT_TYPE], "^SCTP=0\r", length[AT_TYPE]);
393        } else {
394                snprintf(bcs->commands[AT_DIAL], length[AT_DIAL],
395                         "D%s\r", sp->phone);
396                strncpy(bcs->commands[AT_TYPE], "^SCTP=1\r", length[AT_TYPE]);
397        }
398
399        if (bcs->commands[AT_MSN])
400                snprintf(bcs->commands[AT_MSN], length[AT_MSN],
401                         "^SMSN=%s\r", sp->eazmsn);
402        snprintf(bcs->commands[AT_BC   ], length[AT_BC   ],
403                 "^SBC=%s\r", bc);
404        snprintf(bcs->commands[AT_PROTO], length[AT_PROTO],
405                 "^SBPR=%u\r", proto);
406        snprintf(bcs->commands[AT_ISO  ], length[AT_ISO  ],
407                 "^SISO=%u\r", (unsigned)bcs->channel + 1);
408
409        return 0;
410}
411
412int gigaset_isdn_setup_accept(struct at_state_t *at_state)
413{
414        unsigned proto;
415        size_t length[AT_NUM];
416        int i;
417        struct bc_state *bcs = at_state->bcs;
418
419        switch (bcs->proto2) {
420        case ISDN_PROTO_L2_HDLC:
421                proto = 1; /* 0: Bitsynchron, 1: HDLC, 2: voice */
422                break;
423        case ISDN_PROTO_L2_TRANS:
424                proto = 2; /* 0: Bitsynchron, 1: HDLC, 2: voice */
425                break;
426        default:
427                dev_err(at_state->cs->dev, "%s: invalid protocol: %u\n",
428                        __func__, bcs->proto2);
429                return -EINVAL;
430        }
431
432        length[AT_DIAL ] = 0;
433        length[AT_MSN  ] = 0;
434        length[AT_BC   ] = 0;
435        length[AT_PROTO] = 6 + 1 + 1 + 1; /* proto: 1 character */
436        length[AT_ISO  ] = 6 + 1 + 1 + 1; /* channel: 1 character */
437        length[AT_TYPE ] = 0;
438        length[AT_HLC  ] = 0;
439
440        for (i = 0; i < AT_NUM; ++i) {
441                kfree(bcs->commands[i]);
442                bcs->commands[i] = NULL;
443                if (length[i] &&
444                    !(bcs->commands[i] = kmalloc(length[i], GFP_ATOMIC))) {
445                        dev_err(at_state->cs->dev, "out of memory\n");
446                        return -ENOMEM;
447                }
448        }
449
450        snprintf(bcs->commands[AT_PROTO], length[AT_PROTO],
451                 "^SBPR=%u\r", proto);
452        snprintf(bcs->commands[AT_ISO  ], length[AT_ISO  ],
453                 "^SISO=%u\r", (unsigned) bcs->channel + 1);
454
455        return 0;
456}
457
458int gigaset_isdn_icall(struct at_state_t *at_state)
459{
460        struct cardstate *cs = at_state->cs;
461        struct bc_state *bcs = at_state->bcs;
462        isdn_ctrl response;
463        int retval;
464
465        /* fill ICALL structure */
466        response.parm.setup.si1 = 0;        /* default: unknown */
467        response.parm.setup.si2 = 0;
468        response.parm.setup.screen = 0;        //FIXME how to set these?
469        response.parm.setup.plan = 0;
470        if (!at_state->str_var[STR_ZBC]) {
471                /* no BC (internal call): assume speech, A-law */
472                response.parm.setup.si1 = 1;
473        } else if (!strcmp(at_state->str_var[STR_ZBC], "8890")) {
474                /* unrestricted digital information */
475                response.parm.setup.si1 = 7;
476        } else if (!strcmp(at_state->str_var[STR_ZBC], "8090A3")) {
477                /* speech, A-law */
478                response.parm.setup.si1 = 1;
479        } else if (!strcmp(at_state->str_var[STR_ZBC], "9090A3")) {
480                /* 3,1 kHz audio, A-law */
481                response.parm.setup.si1 = 1;
482                response.parm.setup.si2 = 2;
483        } else {
484                dev_warn(cs->dev, "RING ignored - unsupported BC %s\n",
485                     at_state->str_var[STR_ZBC]);
486                return ICALL_IGNORE;
487        }
488        if (at_state->str_var[STR_NMBR]) {
489                strncpy(response.parm.setup.phone, at_state->str_var[STR_NMBR],
490                        sizeof response.parm.setup.phone - 1);
491                response.parm.setup.phone[sizeof response.parm.setup.phone - 1] = 0;
492        } else
493                response.parm.setup.phone[0] = 0;
494        if (at_state->str_var[STR_ZCPN]) {
495                strncpy(response.parm.setup.eazmsn, at_state->str_var[STR_ZCPN],
496                        sizeof response.parm.setup.eazmsn - 1);
497                response.parm.setup.eazmsn[sizeof response.parm.setup.eazmsn - 1] = 0;
498        } else
499                response.parm.setup.eazmsn[0] = 0;
500
501        if (!bcs) {
502                dev_notice(cs->dev, "no channel for incoming call\n");
503                response.command = ISDN_STAT_ICALLW;
504                response.arg = 0; //FIXME
505        } else {
506                gig_dbg(DEBUG_CMD, "Sending ICALL");
507                response.command = ISDN_STAT_ICALL;
508                response.arg = bcs->channel; //FIXME
509        }
510        response.driver = cs->myid;
511        retval = cs->iif.statcallb(&response);
512        gig_dbg(DEBUG_CMD, "Response: %d", retval);
513        switch (retval) {
514        case 0:        /* no takers */
515                return ICALL_IGNORE;
516        case 1:        /* alerting */
517                bcs->chstate |= CHS_NOTIFY_LL;
518                return ICALL_ACCEPT;
519        case 2:        /* reject */
520                return ICALL_REJECT;
521        case 3:        /* incomplete */
522                dev_warn(cs->dev,
523                       "LL requested unsupported feature: Incomplete Number\n");
524                return ICALL_IGNORE;
525        case 4:        /* proceeding */
526                /* Gigaset will send ALERTING anyway.
527                 * There doesn't seem to be a way to avoid this.
528                 */
529                return ICALL_ACCEPT;
530        case 5:        /* deflect */
531                dev_warn(cs->dev,
532                         "LL requested unsupported feature: Call Deflection\n");
533                return ICALL_IGNORE;
534        default:
535                dev_err(cs->dev, "LL error %d on ICALL\n", retval);
536                return ICALL_IGNORE;
537        }
538}
539
540/* Set Callback function pointer */
541int gigaset_register_to_LL(struct cardstate *cs, const char *isdnid)
542{
543        isdn_if *iif = &cs->iif;
544
545        gig_dbg(DEBUG_ANY, "Register driver capabilities to LL");
546
547        //iif->id[sizeof(iif->id) - 1]=0;
548        //strncpy(iif->id, isdnid, sizeof(iif->id) - 1);
549        if (snprintf(iif->id, sizeof iif->id, "%s_%u", isdnid, cs->minor_index)
550            >= sizeof iif->id)
551                return -ENOMEM; //FIXME EINVAL/...??
552
553        iif->owner = THIS_MODULE;
554        iif->channels = cs->channels;
555        iif->maxbufsize = MAX_BUF_SIZE;
556        iif->features = ISDN_FEATURE_L2_TRANS |
557                ISDN_FEATURE_L2_HDLC |
558#ifdef GIG_X75
559                ISDN_FEATURE_L2_X75I |
560#endif
561                ISDN_FEATURE_L3_TRANS |
562                ISDN_FEATURE_P_EURO;
563        iif->hl_hdrlen = HW_HDR_LEN;                /* Area for storing ack */
564        iif->command = command_from_LL;
565        iif->writebuf_skb = writebuf_from_LL;
566        iif->writecmd = NULL;                        /* Don't support isdnctrl */
567        iif->readstat = NULL;                        /* Don't support isdnctrl */
568        iif->rcvcallb_skb = NULL;                /* Will be set by LL */
569        iif->statcallb = NULL;                        /* Will be set by LL */
570
571        if (!register_isdn(iif))
572                return 0;
573
574        cs->myid = iif->channels;                /* Set my device id */
575        return 1;
576}
↑