net/packet: check length in getsockopt() called with PACKET_HDRLEN
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / rose / rose_loopback.c
CommitLineData
1da177e4
LT
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
6 *
7 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
8 */
9#include <linux/types.h>
5a0e3ad6 10#include <linux/slab.h>
1da177e4
LT
11#include <linux/socket.h>
12#include <linux/timer.h>
13#include <net/ax25.h>
14#include <linux/skbuff.h>
15#include <net/rose.h>
16#include <linux/init.h>
17
18static struct sk_buff_head loopback_queue;
19static struct timer_list loopback_timer;
20
21static void rose_set_loopback_timer(void);
22
23void rose_loopback_init(void)
24{
25 skb_queue_head_init(&loopback_queue);
26
27 init_timer(&loopback_timer);
28}
29
30static int rose_loopback_running(void)
31{
32 return timer_pending(&loopback_timer);
33}
34
35int rose_loopback_queue(struct sk_buff *skb, struct rose_neigh *neigh)
36{
37 struct sk_buff *skbn;
38
39 skbn = skb_clone(skb, GFP_ATOMIC);
40
41 kfree_skb(skb);
42
43 if (skbn != NULL) {
44 skb_queue_tail(&loopback_queue, skbn);
45
46 if (!rose_loopback_running())
47 rose_set_loopback_timer();
48 }
49
50 return 1;
51}
52
53static void rose_loopback_timer(unsigned long);
54
55static void rose_set_loopback_timer(void)
56{
57 del_timer(&loopback_timer);
58
59 loopback_timer.data = 0;
60 loopback_timer.function = &rose_loopback_timer;
61 loopback_timer.expires = jiffies + 10;
62
63 add_timer(&loopback_timer);
64}
65
66static void rose_loopback_timer(unsigned long param)
67{
68 struct sk_buff *skb;
69 struct net_device *dev;
70 rose_address *dest;
71 struct sock *sk;
72 unsigned short frametype;
73 unsigned int lci_i, lci_o;
74
75 while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
e0bccd31
BH
76 if (skb->len < ROSE_MIN_LEN) {
77 kfree_skb(skb);
78 continue;
79 }
1da177e4
LT
80 lci_i = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
81 frametype = skb->data[2];
e0bccd31
BH
82 if (frametype == ROSE_CALL_REQUEST &&
83 (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
84 skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
85 ROSE_CALL_REQ_ADDR_LEN_VAL)) {
86 kfree_skb(skb);
87 continue;
88 }
89 dest = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
1f731b63 90 lci_o = ROSE_DEFAULT_MAXVC + 1 - lci_i;
1da177e4 91
badff6d0 92 skb_reset_transport_header(skb);
1da177e4 93
891e6a93 94 sk = rose_find_socket(lci_o, rose_loopback_neigh);
a3d38402 95 if (sk) {
1da177e4
LT
96 if (rose_process_rx_frame(sk, skb) == 0)
97 kfree_skb(skb);
98 continue;
99 }
100
101 if (frametype == ROSE_CALL_REQUEST) {
102 if ((dev = rose_dev_get(dest)) != NULL) {
891e6a93 103 if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0)
1da177e4
LT
104 kfree_skb(skb);
105 } else {
106 kfree_skb(skb);
107 }
108 } else {
109 kfree_skb(skb);
110 }
111 }
112}
113
114void __exit rose_loopback_clear(void)
115{
116 struct sk_buff *skb;
117
118 del_timer(&loopback_timer);
119
120 while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
121 skb->sk = NULL;
122 kfree_skb(skb);
123 }
124}