8cfad496c4
ieee802154 sockets do not properly unshare received skbs, which leads to panics (at least) when they are used in conjunction with 6lowpan, so run skb_share_check on received skbs. 6lowpan also contains a use-after-free, which is trivially fixed by replacing the inlined skb_share_check with the explicit call. Signed-off-by: Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de> Tested-by: Alexander Aring <alex.aring@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
278 lines
5.7 KiB
C
278 lines
5.7 KiB
C
/*
|
|
* Raw IEEE 802.15.4 sockets
|
|
*
|
|
* Copyright 2007, 2008 Siemens AG
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2
|
|
* as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Written by:
|
|
* Sergey Lapin <slapin@ossfans.org>
|
|
* Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
|
|
*/
|
|
|
|
#include <linux/net.h>
|
|
#include <linux/module.h>
|
|
#include <linux/if_arp.h>
|
|
#include <linux/list.h>
|
|
#include <linux/slab.h>
|
|
#include <net/sock.h>
|
|
#include <net/af_ieee802154.h>
|
|
#include <net/ieee802154_netdev.h>
|
|
|
|
#include "af802154.h"
|
|
|
|
static HLIST_HEAD(raw_head);
|
|
static DEFINE_RWLOCK(raw_lock);
|
|
|
|
static void raw_hash(struct sock *sk)
|
|
{
|
|
write_lock_bh(&raw_lock);
|
|
sk_add_node(sk, &raw_head);
|
|
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
|
|
write_unlock_bh(&raw_lock);
|
|
}
|
|
|
|
static void raw_unhash(struct sock *sk)
|
|
{
|
|
write_lock_bh(&raw_lock);
|
|
if (sk_del_node_init(sk))
|
|
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
|
|
write_unlock_bh(&raw_lock);
|
|
}
|
|
|
|
static void raw_close(struct sock *sk, long timeout)
|
|
{
|
|
sk_common_release(sk);
|
|
}
|
|
|
|
static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len)
|
|
{
|
|
struct ieee802154_addr addr;
|
|
struct sockaddr_ieee802154 *uaddr = (struct sockaddr_ieee802154 *)_uaddr;
|
|
int err = 0;
|
|
struct net_device *dev = NULL;
|
|
|
|
if (len < sizeof(*uaddr))
|
|
return -EINVAL;
|
|
|
|
uaddr = (struct sockaddr_ieee802154 *)_uaddr;
|
|
if (uaddr->family != AF_IEEE802154)
|
|
return -EINVAL;
|
|
|
|
lock_sock(sk);
|
|
|
|
ieee802154_addr_from_sa(&addr, &uaddr->addr);
|
|
dev = ieee802154_get_dev(sock_net(sk), &addr);
|
|
if (!dev) {
|
|
err = -ENODEV;
|
|
goto out;
|
|
}
|
|
|
|
if (dev->type != ARPHRD_IEEE802154) {
|
|
err = -ENODEV;
|
|
goto out_put;
|
|
}
|
|
|
|
sk->sk_bound_dev_if = dev->ifindex;
|
|
sk_dst_reset(sk);
|
|
|
|
out_put:
|
|
dev_put(dev);
|
|
out:
|
|
release_sock(sk);
|
|
|
|
return err;
|
|
}
|
|
|
|
static int raw_connect(struct sock *sk, struct sockaddr *uaddr,
|
|
int addr_len)
|
|
{
|
|
return -ENOTSUPP;
|
|
}
|
|
|
|
static int raw_disconnect(struct sock *sk, int flags)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
|
|
size_t size)
|
|
{
|
|
struct net_device *dev;
|
|
unsigned int mtu;
|
|
struct sk_buff *skb;
|
|
int hlen, tlen;
|
|
int err;
|
|
|
|
if (msg->msg_flags & MSG_OOB) {
|
|
pr_debug("msg->msg_flags = 0x%x\n", msg->msg_flags);
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
lock_sock(sk);
|
|
if (!sk->sk_bound_dev_if)
|
|
dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
|
|
else
|
|
dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
|
|
release_sock(sk);
|
|
|
|
if (!dev) {
|
|
pr_debug("no dev\n");
|
|
err = -ENXIO;
|
|
goto out;
|
|
}
|
|
|
|
mtu = dev->mtu;
|
|
pr_debug("name = %s, mtu = %u\n", dev->name, mtu);
|
|
|
|
if (size > mtu) {
|
|
pr_debug("size = %Zu, mtu = %u\n", size, mtu);
|
|
err = -EINVAL;
|
|
goto out_dev;
|
|
}
|
|
|
|
hlen = LL_RESERVED_SPACE(dev);
|
|
tlen = dev->needed_tailroom;
|
|
skb = sock_alloc_send_skb(sk, hlen + tlen + size,
|
|
msg->msg_flags & MSG_DONTWAIT, &err);
|
|
if (!skb)
|
|
goto out_dev;
|
|
|
|
skb_reserve(skb, hlen);
|
|
|
|
skb_reset_mac_header(skb);
|
|
skb_reset_network_header(skb);
|
|
|
|
err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
|
|
if (err < 0)
|
|
goto out_skb;
|
|
|
|
skb->dev = dev;
|
|
skb->sk = sk;
|
|
skb->protocol = htons(ETH_P_IEEE802154);
|
|
|
|
dev_put(dev);
|
|
|
|
err = dev_queue_xmit(skb);
|
|
if (err > 0)
|
|
err = net_xmit_errno(err);
|
|
|
|
return err ?: size;
|
|
|
|
out_skb:
|
|
kfree_skb(skb);
|
|
out_dev:
|
|
dev_put(dev);
|
|
out:
|
|
return err;
|
|
}
|
|
|
|
static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
|
|
size_t len, int noblock, int flags, int *addr_len)
|
|
{
|
|
size_t copied = 0;
|
|
int err = -EOPNOTSUPP;
|
|
struct sk_buff *skb;
|
|
|
|
skb = skb_recv_datagram(sk, flags, noblock, &err);
|
|
if (!skb)
|
|
goto out;
|
|
|
|
copied = skb->len;
|
|
if (len < copied) {
|
|
msg->msg_flags |= MSG_TRUNC;
|
|
copied = len;
|
|
}
|
|
|
|
err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
|
|
if (err)
|
|
goto done;
|
|
|
|
sock_recv_ts_and_drops(msg, sk, skb);
|
|
|
|
if (flags & MSG_TRUNC)
|
|
copied = skb->len;
|
|
done:
|
|
skb_free_datagram(sk, skb);
|
|
out:
|
|
if (err)
|
|
return err;
|
|
return copied;
|
|
}
|
|
|
|
static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
skb = skb_share_check(skb, GFP_ATOMIC);
|
|
if (!skb)
|
|
return NET_RX_DROP;
|
|
|
|
if (sock_queue_rcv_skb(sk, skb) < 0) {
|
|
kfree_skb(skb);
|
|
return NET_RX_DROP;
|
|
}
|
|
|
|
return NET_RX_SUCCESS;
|
|
}
|
|
|
|
|
|
void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
|
|
{
|
|
struct sock *sk;
|
|
|
|
read_lock(&raw_lock);
|
|
sk_for_each(sk, &raw_head) {
|
|
bh_lock_sock(sk);
|
|
if (!sk->sk_bound_dev_if ||
|
|
sk->sk_bound_dev_if == dev->ifindex) {
|
|
|
|
struct sk_buff *clone;
|
|
|
|
clone = skb_clone(skb, GFP_ATOMIC);
|
|
if (clone)
|
|
raw_rcv_skb(sk, clone);
|
|
}
|
|
bh_unlock_sock(sk);
|
|
}
|
|
read_unlock(&raw_lock);
|
|
}
|
|
|
|
static int raw_getsockopt(struct sock *sk, int level, int optname,
|
|
char __user *optval, int __user *optlen)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static int raw_setsockopt(struct sock *sk, int level, int optname,
|
|
char __user *optval, unsigned int optlen)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
struct proto ieee802154_raw_prot = {
|
|
.name = "IEEE-802.15.4-RAW",
|
|
.owner = THIS_MODULE,
|
|
.obj_size = sizeof(struct sock),
|
|
.close = raw_close,
|
|
.bind = raw_bind,
|
|
.sendmsg = raw_sendmsg,
|
|
.recvmsg = raw_recvmsg,
|
|
.hash = raw_hash,
|
|
.unhash = raw_unhash,
|
|
.connect = raw_connect,
|
|
.disconnect = raw_disconnect,
|
|
.getsockopt = raw_getsockopt,
|
|
.setsockopt = raw_setsockopt,
|
|
};
|
|
|