forked from Minki/linux
ee9159ddce
The N_X25 line discipline may access the previous line discipline's closed and already-freed private data on open [1]. The tty->disc_data field _never_ refers to valid data on entry to the line discipline's open() method. Rather, the ldisc is expected to initialize that field for its own use for the lifetime of the instance (ie. from open() to close() only). [1] [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
824 lines
18 KiB
C
824 lines
18 KiB
C
/*
|
|
* Things to sort out:
|
|
*
|
|
* o tbusy handling
|
|
* o allow users to set the parameters
|
|
* o sync/async switching ?
|
|
*
|
|
* Note: This does _not_ implement CCITT X.25 asynchronous framing
|
|
* recommendations. Its primarily for testing purposes. If you wanted
|
|
* to do CCITT then in theory all you need is to nick the HDLC async
|
|
* checksum routines from ppp.c
|
|
* Changes:
|
|
*
|
|
* 2000-10-29 Henner Eisen lapb_data_indication() return status.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/uaccess.h>
|
|
#include <linux/bitops.h>
|
|
#include <linux/string.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/in.h>
|
|
#include <linux/tty.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/etherdevice.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/if_arp.h>
|
|
#include <linux/lapb.h>
|
|
#include <linux/init.h>
|
|
#include <linux/rtnetlink.h>
|
|
#include <linux/compat.h>
|
|
#include <linux/slab.h>
|
|
#include <net/x25device.h>
|
|
#include "x25_asy.h"
|
|
|
|
static struct net_device **x25_asy_devs;
|
|
static int x25_asy_maxdev = SL_NRUNIT;
|
|
|
|
module_param(x25_asy_maxdev, int, 0);
|
|
MODULE_LICENSE("GPL");
|
|
|
|
static int x25_asy_esc(unsigned char *p, unsigned char *d, int len);
|
|
static void x25_asy_unesc(struct x25_asy *sl, unsigned char c);
|
|
static void x25_asy_setup(struct net_device *dev);
|
|
|
|
/* Find a free X.25 channel, and link in this `tty' line. */
|
|
static struct x25_asy *x25_asy_alloc(void)
|
|
{
|
|
struct net_device *dev = NULL;
|
|
struct x25_asy *sl;
|
|
int i;
|
|
|
|
if (x25_asy_devs == NULL)
|
|
return NULL; /* Master array missing ! */
|
|
|
|
for (i = 0; i < x25_asy_maxdev; i++) {
|
|
dev = x25_asy_devs[i];
|
|
|
|
/* Not allocated ? */
|
|
if (dev == NULL)
|
|
break;
|
|
|
|
sl = netdev_priv(dev);
|
|
/* Not in use ? */
|
|
if (!test_and_set_bit(SLF_INUSE, &sl->flags))
|
|
return sl;
|
|
}
|
|
|
|
|
|
/* Sorry, too many, all slots in use */
|
|
if (i >= x25_asy_maxdev)
|
|
return NULL;
|
|
|
|
/* If no channels are available, allocate one */
|
|
if (!dev) {
|
|
char name[IFNAMSIZ];
|
|
sprintf(name, "x25asy%d", i);
|
|
|
|
dev = alloc_netdev(sizeof(struct x25_asy), name,
|
|
NET_NAME_UNKNOWN, x25_asy_setup);
|
|
if (!dev)
|
|
return NULL;
|
|
|
|
/* Initialize channel control data */
|
|
sl = netdev_priv(dev);
|
|
dev->base_addr = i;
|
|
|
|
/* register device so that it can be ifconfig'ed */
|
|
if (register_netdev(dev) == 0) {
|
|
/* (Re-)Set the INUSE bit. Very Important! */
|
|
set_bit(SLF_INUSE, &sl->flags);
|
|
x25_asy_devs[i] = dev;
|
|
return sl;
|
|
} else {
|
|
pr_warn("%s(): register_netdev() failure\n", __func__);
|
|
free_netdev(dev);
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
|
|
/* Free an X.25 channel. */
|
|
static void x25_asy_free(struct x25_asy *sl)
|
|
{
|
|
/* Free all X.25 frame buffers. */
|
|
kfree(sl->rbuff);
|
|
sl->rbuff = NULL;
|
|
kfree(sl->xbuff);
|
|
sl->xbuff = NULL;
|
|
|
|
if (!test_and_clear_bit(SLF_INUSE, &sl->flags))
|
|
netdev_err(sl->dev, "x25_asy_free for already free unit\n");
|
|
}
|
|
|
|
static int x25_asy_change_mtu(struct net_device *dev, int newmtu)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
unsigned char *xbuff, *rbuff;
|
|
int len;
|
|
|
|
if (newmtu > 65534)
|
|
return -EINVAL;
|
|
|
|
len = 2 * newmtu;
|
|
xbuff = kmalloc(len + 4, GFP_ATOMIC);
|
|
rbuff = kmalloc(len + 4, GFP_ATOMIC);
|
|
|
|
if (xbuff == NULL || rbuff == NULL) {
|
|
kfree(xbuff);
|
|
kfree(rbuff);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
spin_lock_bh(&sl->lock);
|
|
xbuff = xchg(&sl->xbuff, xbuff);
|
|
if (sl->xleft) {
|
|
if (sl->xleft <= len) {
|
|
memcpy(sl->xbuff, sl->xhead, sl->xleft);
|
|
} else {
|
|
sl->xleft = 0;
|
|
dev->stats.tx_dropped++;
|
|
}
|
|
}
|
|
sl->xhead = sl->xbuff;
|
|
|
|
rbuff = xchg(&sl->rbuff, rbuff);
|
|
if (sl->rcount) {
|
|
if (sl->rcount <= len) {
|
|
memcpy(sl->rbuff, rbuff, sl->rcount);
|
|
} else {
|
|
sl->rcount = 0;
|
|
dev->stats.rx_over_errors++;
|
|
set_bit(SLF_ERROR, &sl->flags);
|
|
}
|
|
}
|
|
|
|
dev->mtu = newmtu;
|
|
sl->buffsize = len;
|
|
|
|
spin_unlock_bh(&sl->lock);
|
|
|
|
kfree(xbuff);
|
|
kfree(rbuff);
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Set the "sending" flag. This must be atomic, hence the ASM. */
|
|
|
|
static inline void x25_asy_lock(struct x25_asy *sl)
|
|
{
|
|
netif_stop_queue(sl->dev);
|
|
}
|
|
|
|
|
|
/* Clear the "sending" flag. This must be atomic, hence the ASM. */
|
|
|
|
static inline void x25_asy_unlock(struct x25_asy *sl)
|
|
{
|
|
netif_wake_queue(sl->dev);
|
|
}
|
|
|
|
/* Send one completely decapsulated IP datagram to the IP layer. */
|
|
|
|
static void x25_asy_bump(struct x25_asy *sl)
|
|
{
|
|
struct net_device *dev = sl->dev;
|
|
struct sk_buff *skb;
|
|
int count;
|
|
int err;
|
|
|
|
count = sl->rcount;
|
|
dev->stats.rx_bytes += count;
|
|
|
|
skb = dev_alloc_skb(count+1);
|
|
if (skb == NULL) {
|
|
netdev_warn(sl->dev, "memory squeeze, dropping packet\n");
|
|
dev->stats.rx_dropped++;
|
|
return;
|
|
}
|
|
skb_push(skb, 1); /* LAPB internal control */
|
|
memcpy(skb_put(skb, count), sl->rbuff, count);
|
|
skb->protocol = x25_type_trans(skb, sl->dev);
|
|
err = lapb_data_received(skb->dev, skb);
|
|
if (err != LAPB_OK) {
|
|
kfree_skb(skb);
|
|
printk(KERN_DEBUG "x25_asy: data received err - %d\n", err);
|
|
} else {
|
|
netif_rx(skb);
|
|
dev->stats.rx_packets++;
|
|
}
|
|
}
|
|
|
|
/* Encapsulate one IP datagram and stuff into a TTY queue. */
|
|
static void x25_asy_encaps(struct x25_asy *sl, unsigned char *icp, int len)
|
|
{
|
|
unsigned char *p;
|
|
int actual, count, mtu = sl->dev->mtu;
|
|
|
|
if (len > mtu) {
|
|
/* Sigh, shouldn't occur BUT ... */
|
|
len = mtu;
|
|
printk(KERN_DEBUG "%s: truncating oversized transmit packet!\n",
|
|
sl->dev->name);
|
|
sl->dev->stats.tx_dropped++;
|
|
x25_asy_unlock(sl);
|
|
return;
|
|
}
|
|
|
|
p = icp;
|
|
count = x25_asy_esc(p, sl->xbuff, len);
|
|
|
|
/* Order of next two lines is *very* important.
|
|
* When we are sending a little amount of data,
|
|
* the transfer may be completed inside driver.write()
|
|
* routine, because it's running with interrupts enabled.
|
|
* In this case we *never* got WRITE_WAKEUP event,
|
|
* if we did not request it before write operation.
|
|
* 14 Oct 1994 Dmitry Gorodchanin.
|
|
*/
|
|
set_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
|
|
actual = sl->tty->ops->write(sl->tty, sl->xbuff, count);
|
|
sl->xleft = count - actual;
|
|
sl->xhead = sl->xbuff + actual;
|
|
/* VSV */
|
|
clear_bit(SLF_OUTWAIT, &sl->flags); /* reset outfill flag */
|
|
}
|
|
|
|
/*
|
|
* Called by the driver when there's room for more data. If we have
|
|
* more packets to send, we send them here.
|
|
*/
|
|
static void x25_asy_write_wakeup(struct tty_struct *tty)
|
|
{
|
|
int actual;
|
|
struct x25_asy *sl = tty->disc_data;
|
|
|
|
/* First make sure we're connected. */
|
|
if (!sl || sl->magic != X25_ASY_MAGIC || !netif_running(sl->dev))
|
|
return;
|
|
|
|
if (sl->xleft <= 0) {
|
|
/* Now serial buffer is almost free & we can start
|
|
* transmission of another packet */
|
|
sl->dev->stats.tx_packets++;
|
|
clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
|
|
x25_asy_unlock(sl);
|
|
return;
|
|
}
|
|
|
|
actual = tty->ops->write(tty, sl->xhead, sl->xleft);
|
|
sl->xleft -= actual;
|
|
sl->xhead += actual;
|
|
}
|
|
|
|
static void x25_asy_timeout(struct net_device *dev)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
|
|
spin_lock(&sl->lock);
|
|
if (netif_queue_stopped(dev)) {
|
|
/* May be we must check transmitter timeout here ?
|
|
* 14 Oct 1994 Dmitry Gorodchanin.
|
|
*/
|
|
netdev_warn(dev, "transmit timed out, %s?\n",
|
|
(tty_chars_in_buffer(sl->tty) || sl->xleft) ?
|
|
"bad line quality" : "driver error");
|
|
sl->xleft = 0;
|
|
clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
|
|
x25_asy_unlock(sl);
|
|
}
|
|
spin_unlock(&sl->lock);
|
|
}
|
|
|
|
/* Encapsulate an IP datagram and kick it into a TTY queue. */
|
|
|
|
static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
|
|
struct net_device *dev)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
int err;
|
|
|
|
if (!netif_running(sl->dev)) {
|
|
netdev_err(dev, "xmit call when iface is down\n");
|
|
kfree_skb(skb);
|
|
return NETDEV_TX_OK;
|
|
}
|
|
|
|
switch (skb->data[0]) {
|
|
case X25_IFACE_DATA:
|
|
break;
|
|
case X25_IFACE_CONNECT: /* Connection request .. do nothing */
|
|
err = lapb_connect_request(dev);
|
|
if (err != LAPB_OK)
|
|
netdev_err(dev, "lapb_connect_request error: %d\n",
|
|
err);
|
|
kfree_skb(skb);
|
|
return NETDEV_TX_OK;
|
|
case X25_IFACE_DISCONNECT: /* do nothing - hang up ?? */
|
|
err = lapb_disconnect_request(dev);
|
|
if (err != LAPB_OK)
|
|
netdev_err(dev, "lapb_disconnect_request error: %d\n",
|
|
err);
|
|
default:
|
|
kfree_skb(skb);
|
|
return NETDEV_TX_OK;
|
|
}
|
|
skb_pull(skb, 1); /* Remove control byte */
|
|
/*
|
|
* If we are busy already- too bad. We ought to be able
|
|
* to queue things at this point, to allow for a little
|
|
* frame buffer. Oh well...
|
|
* -----------------------------------------------------
|
|
* I hate queues in X.25 driver. May be it's efficient,
|
|
* but for me latency is more important. ;)
|
|
* So, no queues !
|
|
* 14 Oct 1994 Dmitry Gorodchanin.
|
|
*/
|
|
|
|
err = lapb_data_request(dev, skb);
|
|
if (err != LAPB_OK) {
|
|
netdev_err(dev, "lapb_data_request error: %d\n", err);
|
|
kfree_skb(skb);
|
|
return NETDEV_TX_OK;
|
|
}
|
|
return NETDEV_TX_OK;
|
|
}
|
|
|
|
|
|
/*
|
|
* LAPB interface boilerplate
|
|
*/
|
|
|
|
/*
|
|
* Called when I frame data arrives. We did the work above - throw it
|
|
* at the net layer.
|
|
*/
|
|
|
|
static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb)
|
|
{
|
|
return netif_rx(skb);
|
|
}
|
|
|
|
/*
|
|
* Data has emerged from the LAPB protocol machine. We don't handle
|
|
* busy cases too well. Its tricky to see how to do this nicely -
|
|
* perhaps lapb should allow us to bounce this ?
|
|
*/
|
|
|
|
static void x25_asy_data_transmit(struct net_device *dev, struct sk_buff *skb)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
|
|
spin_lock(&sl->lock);
|
|
if (netif_queue_stopped(sl->dev) || sl->tty == NULL) {
|
|
spin_unlock(&sl->lock);
|
|
netdev_err(dev, "tbusy drop\n");
|
|
kfree_skb(skb);
|
|
return;
|
|
}
|
|
/* We were not busy, so we are now... :-) */
|
|
if (skb != NULL) {
|
|
x25_asy_lock(sl);
|
|
dev->stats.tx_bytes += skb->len;
|
|
x25_asy_encaps(sl, skb->data, skb->len);
|
|
dev_kfree_skb(skb);
|
|
}
|
|
spin_unlock(&sl->lock);
|
|
}
|
|
|
|
/*
|
|
* LAPB connection establish/down information.
|
|
*/
|
|
|
|
static void x25_asy_connected(struct net_device *dev, int reason)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
struct sk_buff *skb;
|
|
unsigned char *ptr;
|
|
|
|
skb = dev_alloc_skb(1);
|
|
if (skb == NULL) {
|
|
netdev_err(dev, "out of memory\n");
|
|
return;
|
|
}
|
|
|
|
ptr = skb_put(skb, 1);
|
|
*ptr = X25_IFACE_CONNECT;
|
|
|
|
skb->protocol = x25_type_trans(skb, sl->dev);
|
|
netif_rx(skb);
|
|
}
|
|
|
|
static void x25_asy_disconnected(struct net_device *dev, int reason)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
struct sk_buff *skb;
|
|
unsigned char *ptr;
|
|
|
|
skb = dev_alloc_skb(1);
|
|
if (skb == NULL) {
|
|
netdev_err(dev, "out of memory\n");
|
|
return;
|
|
}
|
|
|
|
ptr = skb_put(skb, 1);
|
|
*ptr = X25_IFACE_DISCONNECT;
|
|
|
|
skb->protocol = x25_type_trans(skb, sl->dev);
|
|
netif_rx(skb);
|
|
}
|
|
|
|
static const struct lapb_register_struct x25_asy_callbacks = {
|
|
.connect_confirmation = x25_asy_connected,
|
|
.connect_indication = x25_asy_connected,
|
|
.disconnect_confirmation = x25_asy_disconnected,
|
|
.disconnect_indication = x25_asy_disconnected,
|
|
.data_indication = x25_asy_data_indication,
|
|
.data_transmit = x25_asy_data_transmit,
|
|
};
|
|
|
|
|
|
/* Open the low-level part of the X.25 channel. Easy! */
|
|
static int x25_asy_open(struct net_device *dev)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
unsigned long len;
|
|
int err;
|
|
|
|
if (sl->tty == NULL)
|
|
return -ENODEV;
|
|
|
|
/*
|
|
* Allocate the X.25 frame buffers:
|
|
*
|
|
* rbuff Receive buffer.
|
|
* xbuff Transmit buffer.
|
|
*/
|
|
|
|
len = dev->mtu * 2;
|
|
|
|
sl->rbuff = kmalloc(len + 4, GFP_KERNEL);
|
|
if (sl->rbuff == NULL)
|
|
goto norbuff;
|
|
sl->xbuff = kmalloc(len + 4, GFP_KERNEL);
|
|
if (sl->xbuff == NULL)
|
|
goto noxbuff;
|
|
|
|
sl->buffsize = len;
|
|
sl->rcount = 0;
|
|
sl->xleft = 0;
|
|
sl->flags &= (1 << SLF_INUSE); /* Clear ESCAPE & ERROR flags */
|
|
|
|
netif_start_queue(dev);
|
|
|
|
/*
|
|
* Now attach LAPB
|
|
*/
|
|
err = lapb_register(dev, &x25_asy_callbacks);
|
|
if (err == LAPB_OK)
|
|
return 0;
|
|
|
|
/* Cleanup */
|
|
kfree(sl->xbuff);
|
|
noxbuff:
|
|
kfree(sl->rbuff);
|
|
norbuff:
|
|
return -ENOMEM;
|
|
}
|
|
|
|
|
|
/* Close the low-level part of the X.25 channel. Easy! */
|
|
static int x25_asy_close(struct net_device *dev)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
|
|
spin_lock(&sl->lock);
|
|
if (sl->tty)
|
|
clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
|
|
|
|
netif_stop_queue(dev);
|
|
sl->rcount = 0;
|
|
sl->xleft = 0;
|
|
spin_unlock(&sl->lock);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Handle the 'receiver data ready' interrupt.
|
|
* This function is called by the 'tty_io' module in the kernel when
|
|
* a block of X.25 data has been received, which can now be decapsulated
|
|
* and sent on to some IP layer for further processing.
|
|
*/
|
|
|
|
static void x25_asy_receive_buf(struct tty_struct *tty,
|
|
const unsigned char *cp, char *fp, int count)
|
|
{
|
|
struct x25_asy *sl = tty->disc_data;
|
|
|
|
if (!sl || sl->magic != X25_ASY_MAGIC || !netif_running(sl->dev))
|
|
return;
|
|
|
|
|
|
/* Read the characters out of the buffer */
|
|
while (count--) {
|
|
if (fp && *fp++) {
|
|
if (!test_and_set_bit(SLF_ERROR, &sl->flags))
|
|
sl->dev->stats.rx_errors++;
|
|
cp++;
|
|
continue;
|
|
}
|
|
x25_asy_unesc(sl, *cp++);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Open the high-level part of the X.25 channel.
|
|
* This function is called by the TTY module when the
|
|
* X.25 line discipline is called for. Because we are
|
|
* sure the tty line exists, we only have to link it to
|
|
* a free X.25 channel...
|
|
*/
|
|
|
|
static int x25_asy_open_tty(struct tty_struct *tty)
|
|
{
|
|
struct x25_asy *sl;
|
|
int err;
|
|
|
|
if (tty->ops->write == NULL)
|
|
return -EOPNOTSUPP;
|
|
|
|
/* OK. Find a free X.25 channel to use. */
|
|
sl = x25_asy_alloc();
|
|
if (sl == NULL)
|
|
return -ENFILE;
|
|
|
|
sl->tty = tty;
|
|
tty->disc_data = sl;
|
|
tty->receive_room = 65536;
|
|
tty_driver_flush_buffer(tty);
|
|
tty_ldisc_flush(tty);
|
|
|
|
/* Restore default settings */
|
|
sl->dev->type = ARPHRD_X25;
|
|
|
|
/* Perform the low-level X.25 async init */
|
|
err = x25_asy_open(sl->dev);
|
|
if (err)
|
|
return err;
|
|
/* Done. We have linked the TTY line to a channel. */
|
|
return 0;
|
|
}
|
|
|
|
|
|
/*
|
|
* Close down an X.25 channel.
|
|
* This means flushing out any pending queues, and then restoring the
|
|
* TTY line discipline to what it was before it got hooked to X.25
|
|
* (which usually is TTY again).
|
|
*/
|
|
static void x25_asy_close_tty(struct tty_struct *tty)
|
|
{
|
|
struct x25_asy *sl = tty->disc_data;
|
|
int err;
|
|
|
|
/* First make sure we're connected. */
|
|
if (!sl || sl->magic != X25_ASY_MAGIC)
|
|
return;
|
|
|
|
rtnl_lock();
|
|
if (sl->dev->flags & IFF_UP)
|
|
dev_close(sl->dev);
|
|
rtnl_unlock();
|
|
|
|
err = lapb_unregister(sl->dev);
|
|
if (err != LAPB_OK)
|
|
pr_err("x25_asy_close: lapb_unregister error: %d\n",
|
|
err);
|
|
|
|
tty->disc_data = NULL;
|
|
sl->tty = NULL;
|
|
x25_asy_free(sl);
|
|
}
|
|
|
|
/************************************************************************
|
|
* STANDARD X.25 ENCAPSULATION *
|
|
************************************************************************/
|
|
|
|
static int x25_asy_esc(unsigned char *s, unsigned char *d, int len)
|
|
{
|
|
unsigned char *ptr = d;
|
|
unsigned char c;
|
|
|
|
/*
|
|
* Send an initial END character to flush out any
|
|
* data that may have accumulated in the receiver
|
|
* due to line noise.
|
|
*/
|
|
|
|
*ptr++ = X25_END; /* Send 10111110 bit seq */
|
|
|
|
/*
|
|
* For each byte in the packet, send the appropriate
|
|
* character sequence, according to the X.25 protocol.
|
|
*/
|
|
|
|
while (len-- > 0) {
|
|
switch (c = *s++) {
|
|
case X25_END:
|
|
*ptr++ = X25_ESC;
|
|
*ptr++ = X25_ESCAPE(X25_END);
|
|
break;
|
|
case X25_ESC:
|
|
*ptr++ = X25_ESC;
|
|
*ptr++ = X25_ESCAPE(X25_ESC);
|
|
break;
|
|
default:
|
|
*ptr++ = c;
|
|
break;
|
|
}
|
|
}
|
|
*ptr++ = X25_END;
|
|
return ptr - d;
|
|
}
|
|
|
|
static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
|
|
{
|
|
|
|
switch (s) {
|
|
case X25_END:
|
|
if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
|
|
sl->rcount > 2)
|
|
x25_asy_bump(sl);
|
|
clear_bit(SLF_ESCAPE, &sl->flags);
|
|
sl->rcount = 0;
|
|
return;
|
|
case X25_ESC:
|
|
set_bit(SLF_ESCAPE, &sl->flags);
|
|
return;
|
|
case X25_ESCAPE(X25_ESC):
|
|
case X25_ESCAPE(X25_END):
|
|
if (test_and_clear_bit(SLF_ESCAPE, &sl->flags))
|
|
s = X25_UNESCAPE(s);
|
|
break;
|
|
}
|
|
if (!test_bit(SLF_ERROR, &sl->flags)) {
|
|
if (sl->rcount < sl->buffsize) {
|
|
sl->rbuff[sl->rcount++] = s;
|
|
return;
|
|
}
|
|
sl->dev->stats.rx_over_errors++;
|
|
set_bit(SLF_ERROR, &sl->flags);
|
|
}
|
|
}
|
|
|
|
|
|
/* Perform I/O control on an active X.25 channel. */
|
|
static int x25_asy_ioctl(struct tty_struct *tty, struct file *file,
|
|
unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct x25_asy *sl = tty->disc_data;
|
|
|
|
/* First make sure we're connected. */
|
|
if (!sl || sl->magic != X25_ASY_MAGIC)
|
|
return -EINVAL;
|
|
|
|
switch (cmd) {
|
|
case SIOCGIFNAME:
|
|
if (copy_to_user((void __user *)arg, sl->dev->name,
|
|
strlen(sl->dev->name) + 1))
|
|
return -EFAULT;
|
|
return 0;
|
|
case SIOCSIFHWADDR:
|
|
return -EINVAL;
|
|
default:
|
|
return tty_mode_ioctl(tty, file, cmd, arg);
|
|
}
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
static long x25_asy_compat_ioctl(struct tty_struct *tty, struct file *file,
|
|
unsigned int cmd, unsigned long arg)
|
|
{
|
|
switch (cmd) {
|
|
case SIOCGIFNAME:
|
|
case SIOCSIFHWADDR:
|
|
return x25_asy_ioctl(tty, file, cmd,
|
|
(unsigned long)compat_ptr(arg));
|
|
}
|
|
|
|
return -ENOIOCTLCMD;
|
|
}
|
|
#endif
|
|
|
|
static int x25_asy_open_dev(struct net_device *dev)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
if (sl->tty == NULL)
|
|
return -ENODEV;
|
|
return 0;
|
|
}
|
|
|
|
static const struct net_device_ops x25_asy_netdev_ops = {
|
|
.ndo_open = x25_asy_open_dev,
|
|
.ndo_stop = x25_asy_close,
|
|
.ndo_start_xmit = x25_asy_xmit,
|
|
.ndo_tx_timeout = x25_asy_timeout,
|
|
.ndo_change_mtu = x25_asy_change_mtu,
|
|
};
|
|
|
|
/* Initialise the X.25 driver. Called by the device init code */
|
|
static void x25_asy_setup(struct net_device *dev)
|
|
{
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
|
|
sl->magic = X25_ASY_MAGIC;
|
|
sl->dev = dev;
|
|
spin_lock_init(&sl->lock);
|
|
set_bit(SLF_INUSE, &sl->flags);
|
|
|
|
/*
|
|
* Finish setting up the DEVICE info.
|
|
*/
|
|
|
|
dev->mtu = SL_MTU;
|
|
dev->netdev_ops = &x25_asy_netdev_ops;
|
|
dev->watchdog_timeo = HZ*20;
|
|
dev->hard_header_len = 0;
|
|
dev->addr_len = 0;
|
|
dev->type = ARPHRD_X25;
|
|
dev->tx_queue_len = 10;
|
|
|
|
/* New-style flags. */
|
|
dev->flags = IFF_NOARP;
|
|
}
|
|
|
|
static struct tty_ldisc_ops x25_ldisc = {
|
|
.owner = THIS_MODULE,
|
|
.magic = TTY_LDISC_MAGIC,
|
|
.name = "X.25",
|
|
.open = x25_asy_open_tty,
|
|
.close = x25_asy_close_tty,
|
|
.ioctl = x25_asy_ioctl,
|
|
#ifdef CONFIG_COMPAT
|
|
.compat_ioctl = x25_asy_compat_ioctl,
|
|
#endif
|
|
.receive_buf = x25_asy_receive_buf,
|
|
.write_wakeup = x25_asy_write_wakeup,
|
|
};
|
|
|
|
static int __init init_x25_asy(void)
|
|
{
|
|
if (x25_asy_maxdev < 4)
|
|
x25_asy_maxdev = 4; /* Sanity */
|
|
|
|
pr_info("X.25 async: version 0.00 ALPHA (dynamic channels, max=%d)\n",
|
|
x25_asy_maxdev);
|
|
|
|
x25_asy_devs = kcalloc(x25_asy_maxdev, sizeof(struct net_device *),
|
|
GFP_KERNEL);
|
|
if (!x25_asy_devs)
|
|
return -ENOMEM;
|
|
|
|
return tty_register_ldisc(N_X25, &x25_ldisc);
|
|
}
|
|
|
|
|
|
static void __exit exit_x25_asy(void)
|
|
{
|
|
struct net_device *dev;
|
|
int i;
|
|
|
|
for (i = 0; i < x25_asy_maxdev; i++) {
|
|
dev = x25_asy_devs[i];
|
|
if (dev) {
|
|
struct x25_asy *sl = netdev_priv(dev);
|
|
|
|
spin_lock_bh(&sl->lock);
|
|
if (sl->tty)
|
|
tty_hangup(sl->tty);
|
|
|
|
spin_unlock_bh(&sl->lock);
|
|
/*
|
|
* VSV = if dev->start==0, then device
|
|
* unregistered while close proc.
|
|
*/
|
|
unregister_netdev(dev);
|
|
free_netdev(dev);
|
|
}
|
|
}
|
|
|
|
kfree(x25_asy_devs);
|
|
tty_unregister_ldisc(N_X25);
|
|
}
|
|
|
|
module_init(init_x25_asy);
|
|
module_exit(exit_x25_asy);
|