]> bbs.cooldavid.org Git - net-next-2.6.git/blame - drivers/staging/batman-adv/device.c
Staging: batman-adv: return -EFAULT on copy_to_user errors
[net-next-2.6.git] / drivers / staging / batman-adv / device.c
CommitLineData
5beef3c9 1/*
9b6d10b7 2 * Copyright (C) 2007-2010 B.A.T.M.A.N. contributors:
5beef3c9
AL
3 *
4 * Marek Lindner
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
18 * 02110-1301, USA
19 *
20 */
21
b9b27e4e 22#include <linux/device.h>
5a0e3ad6 23#include <linux/slab.h>
5beef3c9
AL
24#include "main.h"
25#include "device.h"
5beef3c9
AL
26#include "send.h"
27#include "types.h"
28#include "hash.h"
eb50081d 29#include "hard-interface.h"
5beef3c9 30
5beef3c9
AL
31static struct class *batman_class;
32
33static int Major; /* Major number assigned to our device driver */
34
35static const struct file_operations fops = {
36 .open = bat_device_open,
37 .release = bat_device_release,
38 .read = bat_device_read,
39 .write = bat_device_write,
40 .poll = bat_device_poll,
41};
42
43static struct device_client *device_client_hash[256];
44
45void bat_device_init(void)
46{
db315014 47 memset(device_client_hash, 0, sizeof(device_client_hash));
5beef3c9
AL
48}
49
50int bat_device_setup(void)
51{
52 int tmp_major;
53
54 if (Major)
55 return 1;
56
57 /* register our device - kernel assigns a free major number */
58 tmp_major = register_chrdev(0, DRIVER_DEVICE, &fops);
59 if (tmp_major < 0) {
6d45d8df
SE
60 printk(KERN_ERR "batman-adv:"
61 "Registering the character device failed with %d\n",
5beef3c9
AL
62 tmp_major);
63 return 0;
64 }
65
66 batman_class = class_create(THIS_MODULE, "batman-adv");
67
68 if (IS_ERR(batman_class)) {
6d45d8df
SE
69 printk(KERN_ERR "batman-adv:"
70 "Could not register class 'batman-adv'\n");
5beef3c9
AL
71 return 0;
72 }
73
74 device_create(batman_class, NULL, MKDEV(tmp_major, 0), NULL,
75 "batman-adv");
76
77 Major = tmp_major;
78 return 1;
79}
80
81void bat_device_destroy(void)
82{
83 if (!Major)
84 return;
85
86 device_destroy(batman_class, MKDEV(Major, 0));
87 class_destroy(batman_class);
88
89 /* Unregister the device */
90 unregister_chrdev(Major, DRIVER_DEVICE);
91
92 Major = 0;
93}
94
95int bat_device_open(struct inode *inode, struct file *file)
96{
97 unsigned int i;
98 struct device_client *device_client;
99
100 device_client = kmalloc(sizeof(struct device_client), GFP_KERNEL);
101
102 if (!device_client)
103 return -ENOMEM;
104
db315014 105 for (i = 0; i < ARRAY_SIZE(device_client_hash); i++) {
5beef3c9
AL
106 if (!device_client_hash[i]) {
107 device_client_hash[i] = device_client;
108 break;
109 }
110 }
111
db315014 112 if (i == ARRAY_SIZE(device_client_hash)) {
6d45d8df
SE
113 printk(KERN_ERR "batman-adv:"
114 "Error - can't add another packet client: "
115 "maximum number of clients reached\n");
5beef3c9
AL
116 kfree(device_client);
117 return -EXFULL;
118 }
119
120 INIT_LIST_HEAD(&device_client->queue_list);
121 device_client->queue_len = 0;
122 device_client->index = i;
c852ab66 123 spin_lock_init(&device_client->lock);
5beef3c9
AL
124 init_waitqueue_head(&device_client->queue_wait);
125
126 file->private_data = device_client;
127
128 inc_module_count();
129 return 0;
130}
131
132int bat_device_release(struct inode *inode, struct file *file)
133{
134 struct device_client *device_client =
135 (struct device_client *)file->private_data;
136 struct device_packet *device_packet;
137 struct list_head *list_pos, *list_pos_tmp;
e7017195 138 unsigned long flags;
5beef3c9 139
e7017195 140 spin_lock_irqsave(&device_client->lock, flags);
5beef3c9
AL
141
142 /* for all packets in the queue ... */
143 list_for_each_safe(list_pos, list_pos_tmp, &device_client->queue_list) {
144 device_packet = list_entry(list_pos,
145 struct device_packet, list);
146
147 list_del(list_pos);
148 kfree(device_packet);
149 }
150
151 device_client_hash[device_client->index] = NULL;
e7017195 152 spin_unlock_irqrestore(&device_client->lock, flags);
5beef3c9
AL
153
154 kfree(device_client);
155 dec_module_count();
156
157 return 0;
158}
159
160ssize_t bat_device_read(struct file *file, char __user *buf, size_t count,
161 loff_t *ppos)
162{
163 struct device_client *device_client =
164 (struct device_client *)file->private_data;
165 struct device_packet *device_packet;
166 int error;
e7017195 167 unsigned long flags;
5beef3c9
AL
168
169 if ((file->f_flags & O_NONBLOCK) && (device_client->queue_len == 0))
170 return -EAGAIN;
171
172 if ((!buf) || (count < sizeof(struct icmp_packet)))
173 return -EINVAL;
174
175 if (!access_ok(VERIFY_WRITE, buf, count))
176 return -EFAULT;
177
178 error = wait_event_interruptible(device_client->queue_wait,
179 device_client->queue_len);
180
181 if (error)
182 return error;
183
e7017195 184 spin_lock_irqsave(&device_client->lock, flags);
5beef3c9
AL
185
186 device_packet = list_first_entry(&device_client->queue_list,
187 struct device_packet, list);
188 list_del(&device_packet->list);
189 device_client->queue_len--;
190
e7017195 191 spin_unlock_irqrestore(&device_client->lock, flags);
5beef3c9
AL
192
193 error = __copy_to_user(buf, &device_packet->icmp_packet,
194 sizeof(struct icmp_packet));
195
196 kfree(device_packet);
197
198 if (error)
25477f23 199 return -EFAULT;
5beef3c9
AL
200
201 return sizeof(struct icmp_packet);
202}
203
204ssize_t bat_device_write(struct file *file, const char __user *buff,
205 size_t len, loff_t *off)
206{
207 struct device_client *device_client =
208 (struct device_client *)file->private_data;
209 struct icmp_packet icmp_packet;
210 struct orig_node *orig_node;
211 struct batman_if *batman_if;
eb50081d 212 uint8_t dstaddr[ETH_ALEN];
e7017195 213 unsigned long flags;
5beef3c9
AL
214
215 if (len < sizeof(struct icmp_packet)) {
6d45d8df
SE
216 bat_dbg(DBG_BATMAN, "batman-adv:"
217 "Error - can't send packet from char device: "
218 "invalid packet size\n");
5beef3c9
AL
219 return -EINVAL;
220 }
221
222 if (!access_ok(VERIFY_READ, buff, sizeof(struct icmp_packet)))
223 return -EFAULT;
224
225 if (__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet)))
226 return -EFAULT;
227
228 if (icmp_packet.packet_type != BAT_ICMP) {
6d45d8df
SE
229 bat_dbg(DBG_BATMAN, "batman-adv:"
230 "Error - can't send packet from char device: "
231 "got bogus packet type (expected: BAT_ICMP)\n");
5beef3c9
AL
232 return -EINVAL;
233 }
234
235 if (icmp_packet.msg_type != ECHO_REQUEST) {
6d45d8df
SE
236 bat_dbg(DBG_BATMAN, "batman-adv:"
237 "Error - can't send packet from char device: "
238 "got bogus message type (expected: ECHO_REQUEST)\n");
5beef3c9
AL
239 return -EINVAL;
240 }
241
242 icmp_packet.uid = device_client->index;
243
244 if (icmp_packet.version != COMPAT_VERSION) {
245 icmp_packet.msg_type = PARAMETER_PROBLEM;
246 icmp_packet.ttl = COMPAT_VERSION;
247 bat_device_add_packet(device_client, &icmp_packet);
248 goto out;
249 }
250
251 if (atomic_read(&module_state) != MODULE_ACTIVE)
252 goto dst_unreach;
253
e7017195 254 spin_lock_irqsave(&orig_hash_lock, flags);
5beef3c9
AL
255 orig_node = ((struct orig_node *)hash_find(orig_hash, icmp_packet.dst));
256
257 if (!orig_node)
258 goto unlock;
259
260 if (!orig_node->router)
261 goto unlock;
262
35bd69d4 263 batman_if = orig_node->router->if_incoming;
eb50081d
SW
264 memcpy(dstaddr, orig_node->router->addr, ETH_ALEN);
265
266 spin_unlock_irqrestore(&orig_hash_lock, flags);
5beef3c9
AL
267
268 if (!batman_if)
eb50081d
SW
269 goto dst_unreach;
270
208e13e4 271 if (batman_if->if_status != IF_ACTIVE)
eb50081d 272 goto dst_unreach;
5beef3c9
AL
273
274 memcpy(icmp_packet.orig,
275 batman_if->net_dev->dev_addr,
276 ETH_ALEN);
277
278 send_raw_packet((unsigned char *)&icmp_packet,
279 sizeof(struct icmp_packet),
eb50081d 280 batman_if, dstaddr);
5beef3c9 281
5beef3c9
AL
282 goto out;
283
284unlock:
e7017195 285 spin_unlock_irqrestore(&orig_hash_lock, flags);
5beef3c9
AL
286dst_unreach:
287 icmp_packet.msg_type = DESTINATION_UNREACHABLE;
288 bat_device_add_packet(device_client, &icmp_packet);
289out:
290 return len;
291}
292
293unsigned int bat_device_poll(struct file *file, poll_table *wait)
294{
295 struct device_client *device_client =
296 (struct device_client *)file->private_data;
297
298 poll_wait(file, &device_client->queue_wait, wait);
299
300 if (device_client->queue_len > 0)
301 return POLLIN | POLLRDNORM;
302
303 return 0;
304}
305
306void bat_device_add_packet(struct device_client *device_client,
307 struct icmp_packet *icmp_packet)
308{
309 struct device_packet *device_packet;
e7017195 310 unsigned long flags;
5beef3c9 311
0375fc4d 312 device_packet = kmalloc(sizeof(struct device_packet), GFP_ATOMIC);
5beef3c9
AL
313
314 if (!device_packet)
315 return;
316
317 INIT_LIST_HEAD(&device_packet->list);
318 memcpy(&device_packet->icmp_packet, icmp_packet,
319 sizeof(struct icmp_packet));
320
e7017195 321 spin_lock_irqsave(&device_client->lock, flags);
5beef3c9
AL
322
323 /* while waiting for the lock the device_client could have been
324 * deleted */
325 if (!device_client_hash[icmp_packet->uid]) {
e7017195 326 spin_unlock_irqrestore(&device_client->lock, flags);
5beef3c9
AL
327 kfree(device_packet);
328 return;
329 }
330
331 list_add_tail(&device_packet->list, &device_client->queue_list);
332 device_client->queue_len++;
333
334 if (device_client->queue_len > 100) {
335 device_packet = list_first_entry(&device_client->queue_list,
336 struct device_packet, list);
337
338 list_del(&device_packet->list);
339 kfree(device_packet);
340 device_client->queue_len--;
341 }
342
e7017195 343 spin_unlock_irqrestore(&device_client->lock, flags);
5beef3c9
AL
344
345 wake_up(&device_client->queue_wait);
346}
347
348void bat_device_receive_packet(struct icmp_packet *icmp_packet)
349{
350 struct device_client *hash = device_client_hash[icmp_packet->uid];
351
352 if (hash)
353 bat_device_add_packet(hash, icmp_packet);
354}