net/rose: Fix Use-After-Free in rose_ioctl
[platform/kernel/linux-starfive.git] / net / rose / af_rose.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *
4  * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
5  * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
6  * Copyright (C) Terry Dawson VK2KTJ (terry@animats.net)
7  * Copyright (C) Tomi Manninen OH2BNS (oh2bns@sral.fi)
8  */
9
10 #include <linux/capability.h>
11 #include <linux/module.h>
12 #include <linux/moduleparam.h>
13 #include <linux/init.h>
14 #include <linux/errno.h>
15 #include <linux/types.h>
16 #include <linux/socket.h>
17 #include <linux/in.h>
18 #include <linux/slab.h>
19 #include <linux/kernel.h>
20 #include <linux/sched/signal.h>
21 #include <linux/spinlock.h>
22 #include <linux/timer.h>
23 #include <linux/string.h>
24 #include <linux/sockios.h>
25 #include <linux/net.h>
26 #include <linux/stat.h>
27 #include <net/net_namespace.h>
28 #include <net/ax25.h>
29 #include <linux/inet.h>
30 #include <linux/netdevice.h>
31 #include <linux/if_arp.h>
32 #include <linux/skbuff.h>
33 #include <net/sock.h>
34 #include <linux/uaccess.h>
35 #include <linux/fcntl.h>
36 #include <linux/termios.h>
37 #include <linux/mm.h>
38 #include <linux/interrupt.h>
39 #include <linux/notifier.h>
40 #include <net/rose.h>
41 #include <linux/proc_fs.h>
42 #include <linux/seq_file.h>
43 #include <net/tcp_states.h>
44 #include <net/ip.h>
45 #include <net/arp.h>
46
47 static int rose_ndevs = 10;
48
49 int sysctl_rose_restart_request_timeout = ROSE_DEFAULT_T0;
50 int sysctl_rose_call_request_timeout    = ROSE_DEFAULT_T1;
51 int sysctl_rose_reset_request_timeout   = ROSE_DEFAULT_T2;
52 int sysctl_rose_clear_request_timeout   = ROSE_DEFAULT_T3;
53 int sysctl_rose_no_activity_timeout     = ROSE_DEFAULT_IDLE;
54 int sysctl_rose_ack_hold_back_timeout   = ROSE_DEFAULT_HB;
55 int sysctl_rose_routing_control         = ROSE_DEFAULT_ROUTING;
56 int sysctl_rose_link_fail_timeout       = ROSE_DEFAULT_FAIL_TIMEOUT;
57 int sysctl_rose_maximum_vcs             = ROSE_DEFAULT_MAXVC;
58 int sysctl_rose_window_size             = ROSE_DEFAULT_WINDOW_SIZE;
59
60 static HLIST_HEAD(rose_list);
61 static DEFINE_SPINLOCK(rose_list_lock);
62
63 static const struct proto_ops rose_proto_ops;
64
65 ax25_address rose_callsign;
66
67 /*
68  * ROSE network devices are virtual network devices encapsulating ROSE
69  * frames into AX.25 which will be sent through an AX.25 device, so form a
70  * special "super class" of normal net devices; split their locks off into a
71  * separate class since they always nest.
72  */
73 static struct lock_class_key rose_netdev_xmit_lock_key;
74 static struct lock_class_key rose_netdev_addr_lock_key;
75
76 static void rose_set_lockdep_one(struct net_device *dev,
77                                  struct netdev_queue *txq,
78                                  void *_unused)
79 {
80         lockdep_set_class(&txq->_xmit_lock, &rose_netdev_xmit_lock_key);
81 }
82
83 static void rose_set_lockdep_key(struct net_device *dev)
84 {
85         lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
86         netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
87 }
88
89 /*
90  *      Convert a ROSE address into text.
91  */
92 char *rose2asc(char *buf, const rose_address *addr)
93 {
94         if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
95             addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
96             addr->rose_addr[4] == 0x00) {
97                 strcpy(buf, "*");
98         } else {
99                 sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
100                                                 addr->rose_addr[1] & 0xFF,
101                                                 addr->rose_addr[2] & 0xFF,
102                                                 addr->rose_addr[3] & 0xFF,
103                                                 addr->rose_addr[4] & 0xFF);
104         }
105
106         return buf;
107 }
108
109 /*
110  *      Compare two ROSE addresses, 0 == equal.
111  */
112 int rosecmp(const rose_address *addr1, const rose_address *addr2)
113 {
114         int i;
115
116         for (i = 0; i < 5; i++)
117                 if (addr1->rose_addr[i] != addr2->rose_addr[i])
118                         return 1;
119
120         return 0;
121 }
122
123 /*
124  *      Compare two ROSE addresses for only mask digits, 0 == equal.
125  */
126 int rosecmpm(const rose_address *addr1, const rose_address *addr2,
127              unsigned short mask)
128 {
129         unsigned int i, j;
130
131         if (mask > 10)
132                 return 1;
133
134         for (i = 0; i < mask; i++) {
135                 j = i / 2;
136
137                 if ((i % 2) != 0) {
138                         if ((addr1->rose_addr[j] & 0x0F) != (addr2->rose_addr[j] & 0x0F))
139                                 return 1;
140                 } else {
141                         if ((addr1->rose_addr[j] & 0xF0) != (addr2->rose_addr[j] & 0xF0))
142                                 return 1;
143                 }
144         }
145
146         return 0;
147 }
148
149 /*
150  *      Socket removal during an interrupt is now safe.
151  */
152 static void rose_remove_socket(struct sock *sk)
153 {
154         spin_lock_bh(&rose_list_lock);
155         sk_del_node_init(sk);
156         spin_unlock_bh(&rose_list_lock);
157 }
158
159 /*
160  *      Kill all bound sockets on a broken link layer connection to a
161  *      particular neighbour.
162  */
163 void rose_kill_by_neigh(struct rose_neigh *neigh)
164 {
165         struct sock *s;
166
167         spin_lock_bh(&rose_list_lock);
168         sk_for_each(s, &rose_list) {
169                 struct rose_sock *rose = rose_sk(s);
170
171                 if (rose->neighbour == neigh) {
172                         rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
173                         rose->neighbour->use--;
174                         rose->neighbour = NULL;
175                 }
176         }
177         spin_unlock_bh(&rose_list_lock);
178 }
179
180 /*
181  *      Kill all bound sockets on a dropped device.
182  */
183 static void rose_kill_by_device(struct net_device *dev)
184 {
185         struct sock *s;
186
187         spin_lock_bh(&rose_list_lock);
188         sk_for_each(s, &rose_list) {
189                 struct rose_sock *rose = rose_sk(s);
190
191                 if (rose->device == dev) {
192                         rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
193                         if (rose->neighbour)
194                                 rose->neighbour->use--;
195                         netdev_put(rose->device, &rose->dev_tracker);
196                         rose->device = NULL;
197                 }
198         }
199         spin_unlock_bh(&rose_list_lock);
200 }
201
202 /*
203  *      Handle device status changes.
204  */
205 static int rose_device_event(struct notifier_block *this,
206                              unsigned long event, void *ptr)
207 {
208         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
209
210         if (!net_eq(dev_net(dev), &init_net))
211                 return NOTIFY_DONE;
212
213         if (event != NETDEV_DOWN)
214                 return NOTIFY_DONE;
215
216         switch (dev->type) {
217         case ARPHRD_ROSE:
218                 rose_kill_by_device(dev);
219                 break;
220         case ARPHRD_AX25:
221                 rose_link_device_down(dev);
222                 rose_rt_device_down(dev);
223                 break;
224         }
225
226         return NOTIFY_DONE;
227 }
228
229 /*
230  *      Add a socket to the bound sockets list.
231  */
232 static void rose_insert_socket(struct sock *sk)
233 {
234
235         spin_lock_bh(&rose_list_lock);
236         sk_add_node(sk, &rose_list);
237         spin_unlock_bh(&rose_list_lock);
238 }
239
240 /*
241  *      Find a socket that wants to accept the Call Request we just
242  *      received.
243  */
244 static struct sock *rose_find_listener(rose_address *addr, ax25_address *call)
245 {
246         struct sock *s;
247
248         spin_lock_bh(&rose_list_lock);
249         sk_for_each(s, &rose_list) {
250                 struct rose_sock *rose = rose_sk(s);
251
252                 if (!rosecmp(&rose->source_addr, addr) &&
253                     !ax25cmp(&rose->source_call, call) &&
254                     !rose->source_ndigis && s->sk_state == TCP_LISTEN)
255                         goto found;
256         }
257
258         sk_for_each(s, &rose_list) {
259                 struct rose_sock *rose = rose_sk(s);
260
261                 if (!rosecmp(&rose->source_addr, addr) &&
262                     !ax25cmp(&rose->source_call, &null_ax25_address) &&
263                     s->sk_state == TCP_LISTEN)
264                         goto found;
265         }
266         s = NULL;
267 found:
268         spin_unlock_bh(&rose_list_lock);
269         return s;
270 }
271
272 /*
273  *      Find a connected ROSE socket given my LCI and device.
274  */
275 struct sock *rose_find_socket(unsigned int lci, struct rose_neigh *neigh)
276 {
277         struct sock *s;
278
279         spin_lock_bh(&rose_list_lock);
280         sk_for_each(s, &rose_list) {
281                 struct rose_sock *rose = rose_sk(s);
282
283                 if (rose->lci == lci && rose->neighbour == neigh)
284                         goto found;
285         }
286         s = NULL;
287 found:
288         spin_unlock_bh(&rose_list_lock);
289         return s;
290 }
291
292 /*
293  *      Find a unique LCI for a given device.
294  */
295 unsigned int rose_new_lci(struct rose_neigh *neigh)
296 {
297         int lci;
298
299         if (neigh->dce_mode) {
300                 for (lci = 1; lci <= sysctl_rose_maximum_vcs; lci++)
301                         if (rose_find_socket(lci, neigh) == NULL && rose_route_free_lci(lci, neigh) == NULL)
302                                 return lci;
303         } else {
304                 for (lci = sysctl_rose_maximum_vcs; lci > 0; lci--)
305                         if (rose_find_socket(lci, neigh) == NULL && rose_route_free_lci(lci, neigh) == NULL)
306                                 return lci;
307         }
308
309         return 0;
310 }
311
312 /*
313  *      Deferred destroy.
314  */
315 void rose_destroy_socket(struct sock *);
316
317 /*
318  *      Handler for deferred kills.
319  */
320 static void rose_destroy_timer(struct timer_list *t)
321 {
322         struct sock *sk = from_timer(sk, t, sk_timer);
323
324         rose_destroy_socket(sk);
325 }
326
327 /*
328  *      This is called from user mode and the timers. Thus it protects itself
329  *      against interrupt users but doesn't worry about being called during
330  *      work.  Once it is removed from the queue no interrupt or bottom half
331  *      will touch it and we are (fairly 8-) ) safe.
332  */
333 void rose_destroy_socket(struct sock *sk)
334 {
335         struct sk_buff *skb;
336
337         rose_remove_socket(sk);
338         rose_stop_heartbeat(sk);
339         rose_stop_idletimer(sk);
340         rose_stop_timer(sk);
341
342         rose_clear_queues(sk);          /* Flush the queues */
343
344         while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
345                 if (skb->sk != sk) {    /* A pending connection */
346                         /* Queue the unaccepted socket for death */
347                         sock_set_flag(skb->sk, SOCK_DEAD);
348                         rose_start_heartbeat(skb->sk);
349                         rose_sk(skb->sk)->state = ROSE_STATE_0;
350                 }
351
352                 kfree_skb(skb);
353         }
354
355         if (sk_has_allocations(sk)) {
356                 /* Defer: outstanding buffers */
357                 timer_setup(&sk->sk_timer, rose_destroy_timer, 0);
358                 sk->sk_timer.expires  = jiffies + 10 * HZ;
359                 add_timer(&sk->sk_timer);
360         } else
361                 sock_put(sk);
362 }
363
364 /*
365  *      Handling for system calls applied via the various interfaces to a
366  *      ROSE socket object.
367  */
368
369 static int rose_setsockopt(struct socket *sock, int level, int optname,
370                 sockptr_t optval, unsigned int optlen)
371 {
372         struct sock *sk = sock->sk;
373         struct rose_sock *rose = rose_sk(sk);
374         int opt;
375
376         if (level != SOL_ROSE)
377                 return -ENOPROTOOPT;
378
379         if (optlen < sizeof(int))
380                 return -EINVAL;
381
382         if (copy_from_sockptr(&opt, optval, sizeof(int)))
383                 return -EFAULT;
384
385         switch (optname) {
386         case ROSE_DEFER:
387                 rose->defer = opt ? 1 : 0;
388                 return 0;
389
390         case ROSE_T1:
391                 if (opt < 1)
392                         return -EINVAL;
393                 rose->t1 = opt * HZ;
394                 return 0;
395
396         case ROSE_T2:
397                 if (opt < 1)
398                         return -EINVAL;
399                 rose->t2 = opt * HZ;
400                 return 0;
401
402         case ROSE_T3:
403                 if (opt < 1)
404                         return -EINVAL;
405                 rose->t3 = opt * HZ;
406                 return 0;
407
408         case ROSE_HOLDBACK:
409                 if (opt < 1)
410                         return -EINVAL;
411                 rose->hb = opt * HZ;
412                 return 0;
413
414         case ROSE_IDLE:
415                 if (opt < 0)
416                         return -EINVAL;
417                 rose->idle = opt * 60 * HZ;
418                 return 0;
419
420         case ROSE_QBITINCL:
421                 rose->qbitincl = opt ? 1 : 0;
422                 return 0;
423
424         default:
425                 return -ENOPROTOOPT;
426         }
427 }
428
429 static int rose_getsockopt(struct socket *sock, int level, int optname,
430         char __user *optval, int __user *optlen)
431 {
432         struct sock *sk = sock->sk;
433         struct rose_sock *rose = rose_sk(sk);
434         int val = 0;
435         int len;
436
437         if (level != SOL_ROSE)
438                 return -ENOPROTOOPT;
439
440         if (get_user(len, optlen))
441                 return -EFAULT;
442
443         if (len < 0)
444                 return -EINVAL;
445
446         switch (optname) {
447         case ROSE_DEFER:
448                 val = rose->defer;
449                 break;
450
451         case ROSE_T1:
452                 val = rose->t1 / HZ;
453                 break;
454
455         case ROSE_T2:
456                 val = rose->t2 / HZ;
457                 break;
458
459         case ROSE_T3:
460                 val = rose->t3 / HZ;
461                 break;
462
463         case ROSE_HOLDBACK:
464                 val = rose->hb / HZ;
465                 break;
466
467         case ROSE_IDLE:
468                 val = rose->idle / (60 * HZ);
469                 break;
470
471         case ROSE_QBITINCL:
472                 val = rose->qbitincl;
473                 break;
474
475         default:
476                 return -ENOPROTOOPT;
477         }
478
479         len = min_t(unsigned int, len, sizeof(int));
480
481         if (put_user(len, optlen))
482                 return -EFAULT;
483
484         return copy_to_user(optval, &val, len) ? -EFAULT : 0;
485 }
486
487 static int rose_listen(struct socket *sock, int backlog)
488 {
489         struct sock *sk = sock->sk;
490
491         lock_sock(sk);
492         if (sock->state != SS_UNCONNECTED) {
493                 release_sock(sk);
494                 return -EINVAL;
495         }
496
497         if (sk->sk_state != TCP_LISTEN) {
498                 struct rose_sock *rose = rose_sk(sk);
499
500                 rose->dest_ndigis = 0;
501                 memset(&rose->dest_addr, 0, ROSE_ADDR_LEN);
502                 memset(&rose->dest_call, 0, AX25_ADDR_LEN);
503                 memset(rose->dest_digis, 0, AX25_ADDR_LEN * ROSE_MAX_DIGIS);
504                 sk->sk_max_ack_backlog = backlog;
505                 sk->sk_state           = TCP_LISTEN;
506                 release_sock(sk);
507                 return 0;
508         }
509         release_sock(sk);
510
511         return -EOPNOTSUPP;
512 }
513
514 static struct proto rose_proto = {
515         .name     = "ROSE",
516         .owner    = THIS_MODULE,
517         .obj_size = sizeof(struct rose_sock),
518 };
519
520 static int rose_create(struct net *net, struct socket *sock, int protocol,
521                        int kern)
522 {
523         struct sock *sk;
524         struct rose_sock *rose;
525
526         if (!net_eq(net, &init_net))
527                 return -EAFNOSUPPORT;
528
529         if (sock->type != SOCK_SEQPACKET || protocol != 0)
530                 return -ESOCKTNOSUPPORT;
531
532         sk = sk_alloc(net, PF_ROSE, GFP_ATOMIC, &rose_proto, kern);
533         if (sk == NULL)
534                 return -ENOMEM;
535
536         rose = rose_sk(sk);
537
538         sock_init_data(sock, sk);
539
540         skb_queue_head_init(&rose->ack_queue);
541 #ifdef M_BIT
542         skb_queue_head_init(&rose->frag_queue);
543         rose->fraglen    = 0;
544 #endif
545
546         sock->ops    = &rose_proto_ops;
547         sk->sk_protocol = protocol;
548
549         timer_setup(&rose->timer, NULL, 0);
550         timer_setup(&rose->idletimer, NULL, 0);
551
552         rose->t1   = msecs_to_jiffies(sysctl_rose_call_request_timeout);
553         rose->t2   = msecs_to_jiffies(sysctl_rose_reset_request_timeout);
554         rose->t3   = msecs_to_jiffies(sysctl_rose_clear_request_timeout);
555         rose->hb   = msecs_to_jiffies(sysctl_rose_ack_hold_back_timeout);
556         rose->idle = msecs_to_jiffies(sysctl_rose_no_activity_timeout);
557
558         rose->state = ROSE_STATE_0;
559
560         return 0;
561 }
562
563 static struct sock *rose_make_new(struct sock *osk)
564 {
565         struct sock *sk;
566         struct rose_sock *rose, *orose;
567
568         if (osk->sk_type != SOCK_SEQPACKET)
569                 return NULL;
570
571         sk = sk_alloc(sock_net(osk), PF_ROSE, GFP_ATOMIC, &rose_proto, 0);
572         if (sk == NULL)
573                 return NULL;
574
575         rose = rose_sk(sk);
576
577         sock_init_data(NULL, sk);
578
579         skb_queue_head_init(&rose->ack_queue);
580 #ifdef M_BIT
581         skb_queue_head_init(&rose->frag_queue);
582         rose->fraglen  = 0;
583 #endif
584
585         sk->sk_type     = osk->sk_type;
586         sk->sk_priority = osk->sk_priority;
587         sk->sk_protocol = osk->sk_protocol;
588         sk->sk_rcvbuf   = osk->sk_rcvbuf;
589         sk->sk_sndbuf   = osk->sk_sndbuf;
590         sk->sk_state    = TCP_ESTABLISHED;
591         sock_copy_flags(sk, osk);
592
593         timer_setup(&rose->timer, NULL, 0);
594         timer_setup(&rose->idletimer, NULL, 0);
595
596         orose           = rose_sk(osk);
597         rose->t1        = orose->t1;
598         rose->t2        = orose->t2;
599         rose->t3        = orose->t3;
600         rose->hb        = orose->hb;
601         rose->idle      = orose->idle;
602         rose->defer     = orose->defer;
603         rose->device    = orose->device;
604         if (rose->device)
605                 netdev_hold(rose->device, &rose->dev_tracker, GFP_ATOMIC);
606         rose->qbitincl  = orose->qbitincl;
607
608         return sk;
609 }
610
611 static int rose_release(struct socket *sock)
612 {
613         struct sock *sk = sock->sk;
614         struct rose_sock *rose;
615
616         if (sk == NULL) return 0;
617
618         sock_hold(sk);
619         sock_orphan(sk);
620         lock_sock(sk);
621         rose = rose_sk(sk);
622
623         switch (rose->state) {
624         case ROSE_STATE_0:
625                 release_sock(sk);
626                 rose_disconnect(sk, 0, -1, -1);
627                 lock_sock(sk);
628                 rose_destroy_socket(sk);
629                 break;
630
631         case ROSE_STATE_2:
632                 rose->neighbour->use--;
633                 release_sock(sk);
634                 rose_disconnect(sk, 0, -1, -1);
635                 lock_sock(sk);
636                 rose_destroy_socket(sk);
637                 break;
638
639         case ROSE_STATE_1:
640         case ROSE_STATE_3:
641         case ROSE_STATE_4:
642         case ROSE_STATE_5:
643                 rose_clear_queues(sk);
644                 rose_stop_idletimer(sk);
645                 rose_write_internal(sk, ROSE_CLEAR_REQUEST);
646                 rose_start_t3timer(sk);
647                 rose->state  = ROSE_STATE_2;
648                 sk->sk_state    = TCP_CLOSE;
649                 sk->sk_shutdown |= SEND_SHUTDOWN;
650                 sk->sk_state_change(sk);
651                 sock_set_flag(sk, SOCK_DEAD);
652                 sock_set_flag(sk, SOCK_DESTROY);
653                 break;
654
655         default:
656                 break;
657         }
658
659         netdev_put(rose->device, &rose->dev_tracker);
660         sock->sk = NULL;
661         release_sock(sk);
662         sock_put(sk);
663
664         return 0;
665 }
666
667 static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
668 {
669         struct sock *sk = sock->sk;
670         struct rose_sock *rose = rose_sk(sk);
671         struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
672         struct net_device *dev;
673         ax25_address *source;
674         ax25_uid_assoc *user;
675         int n;
676
677         if (!sock_flag(sk, SOCK_ZAPPED))
678                 return -EINVAL;
679
680         if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
681                 return -EINVAL;
682
683         if (addr->srose_family != AF_ROSE)
684                 return -EINVAL;
685
686         if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
687                 return -EINVAL;
688
689         if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
690                 return -EINVAL;
691
692         if ((dev = rose_dev_get(&addr->srose_addr)) == NULL)
693                 return -EADDRNOTAVAIL;
694
695         source = &addr->srose_call;
696
697         user = ax25_findbyuid(current_euid());
698         if (user) {
699                 rose->source_call = user->call;
700                 ax25_uid_put(user);
701         } else {
702                 if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
703                         dev_put(dev);
704                         return -EACCES;
705                 }
706                 rose->source_call   = *source;
707         }
708
709         rose->source_addr   = addr->srose_addr;
710         rose->device        = dev;
711         netdev_tracker_alloc(rose->device, &rose->dev_tracker, GFP_KERNEL);
712         rose->source_ndigis = addr->srose_ndigis;
713
714         if (addr_len == sizeof(struct full_sockaddr_rose)) {
715                 struct full_sockaddr_rose *full_addr = (struct full_sockaddr_rose *)uaddr;
716                 for (n = 0 ; n < addr->srose_ndigis ; n++)
717                         rose->source_digis[n] = full_addr->srose_digis[n];
718         } else {
719                 if (rose->source_ndigis == 1) {
720                         rose->source_digis[0] = addr->srose_digi;
721                 }
722         }
723
724         rose_insert_socket(sk);
725
726         sock_reset_flag(sk, SOCK_ZAPPED);
727
728         return 0;
729 }
730
731 static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)
732 {
733         struct sock *sk = sock->sk;
734         struct rose_sock *rose = rose_sk(sk);
735         struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
736         unsigned char cause, diagnostic;
737         ax25_uid_assoc *user;
738         int n, err = 0;
739
740         if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
741                 return -EINVAL;
742
743         if (addr->srose_family != AF_ROSE)
744                 return -EINVAL;
745
746         if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
747                 return -EINVAL;
748
749         if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
750                 return -EINVAL;
751
752         /* Source + Destination digis should not exceed ROSE_MAX_DIGIS */
753         if ((rose->source_ndigis + addr->srose_ndigis) > ROSE_MAX_DIGIS)
754                 return -EINVAL;
755
756         lock_sock(sk);
757
758         if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
759                 /* Connect completed during a ERESTARTSYS event */
760                 sock->state = SS_CONNECTED;
761                 goto out_release;
762         }
763
764         if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
765                 sock->state = SS_UNCONNECTED;
766                 err = -ECONNREFUSED;
767                 goto out_release;
768         }
769
770         if (sk->sk_state == TCP_ESTABLISHED) {
771                 /* No reconnect on a seqpacket socket */
772                 err = -EISCONN;
773                 goto out_release;
774         }
775
776         sk->sk_state   = TCP_CLOSE;
777         sock->state = SS_UNCONNECTED;
778
779         rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
780                                          &diagnostic, 0);
781         if (!rose->neighbour) {
782                 err = -ENETUNREACH;
783                 goto out_release;
784         }
785
786         rose->lci = rose_new_lci(rose->neighbour);
787         if (!rose->lci) {
788                 err = -ENETUNREACH;
789                 goto out_release;
790         }
791
792         if (sock_flag(sk, SOCK_ZAPPED)) {       /* Must bind first - autobinding in this may or may not work */
793                 struct net_device *dev;
794
795                 sock_reset_flag(sk, SOCK_ZAPPED);
796
797                 dev = rose_dev_first();
798                 if (!dev) {
799                         err = -ENETUNREACH;
800                         goto out_release;
801                 }
802
803                 user = ax25_findbyuid(current_euid());
804                 if (!user) {
805                         err = -EINVAL;
806                         dev_put(dev);
807                         goto out_release;
808                 }
809
810                 memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
811                 rose->source_call = user->call;
812                 rose->device      = dev;
813                 netdev_tracker_alloc(rose->device, &rose->dev_tracker,
814                                      GFP_KERNEL);
815                 ax25_uid_put(user);
816
817                 rose_insert_socket(sk);         /* Finish the bind */
818         }
819         rose->dest_addr   = addr->srose_addr;
820         rose->dest_call   = addr->srose_call;
821         rose->rand        = ((long)rose & 0xFFFF) + rose->lci;
822         rose->dest_ndigis = addr->srose_ndigis;
823
824         if (addr_len == sizeof(struct full_sockaddr_rose)) {
825                 struct full_sockaddr_rose *full_addr = (struct full_sockaddr_rose *)uaddr;
826                 for (n = 0 ; n < addr->srose_ndigis ; n++)
827                         rose->dest_digis[n] = full_addr->srose_digis[n];
828         } else {
829                 if (rose->dest_ndigis == 1) {
830                         rose->dest_digis[0] = addr->srose_digi;
831                 }
832         }
833
834         /* Move to connecting socket, start sending Connect Requests */
835         sock->state   = SS_CONNECTING;
836         sk->sk_state     = TCP_SYN_SENT;
837
838         rose->state = ROSE_STATE_1;
839
840         rose->neighbour->use++;
841
842         rose_write_internal(sk, ROSE_CALL_REQUEST);
843         rose_start_heartbeat(sk);
844         rose_start_t1timer(sk);
845
846         /* Now the loop */
847         if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
848                 err = -EINPROGRESS;
849                 goto out_release;
850         }
851
852         /*
853          * A Connect Ack with Choke or timeout or failed routing will go to
854          * closed.
855          */
856         if (sk->sk_state == TCP_SYN_SENT) {
857                 DEFINE_WAIT(wait);
858
859                 for (;;) {
860                         prepare_to_wait(sk_sleep(sk), &wait,
861                                         TASK_INTERRUPTIBLE);
862                         if (sk->sk_state != TCP_SYN_SENT)
863                                 break;
864                         if (!signal_pending(current)) {
865                                 release_sock(sk);
866                                 schedule();
867                                 lock_sock(sk);
868                                 continue;
869                         }
870                         err = -ERESTARTSYS;
871                         break;
872                 }
873                 finish_wait(sk_sleep(sk), &wait);
874
875                 if (err)
876                         goto out_release;
877         }
878
879         if (sk->sk_state != TCP_ESTABLISHED) {
880                 sock->state = SS_UNCONNECTED;
881                 err = sock_error(sk);   /* Always set at this point */
882                 goto out_release;
883         }
884
885         sock->state = SS_CONNECTED;
886
887 out_release:
888         release_sock(sk);
889
890         return err;
891 }
892
893 static int rose_accept(struct socket *sock, struct socket *newsock, int flags,
894                        bool kern)
895 {
896         struct sk_buff *skb;
897         struct sock *newsk;
898         DEFINE_WAIT(wait);
899         struct sock *sk;
900         int err = 0;
901
902         if ((sk = sock->sk) == NULL)
903                 return -EINVAL;
904
905         lock_sock(sk);
906         if (sk->sk_type != SOCK_SEQPACKET) {
907                 err = -EOPNOTSUPP;
908                 goto out_release;
909         }
910
911         if (sk->sk_state != TCP_LISTEN) {
912                 err = -EINVAL;
913                 goto out_release;
914         }
915
916         /*
917          *      The write queue this time is holding sockets ready to use
918          *      hooked into the SABM we saved
919          */
920         for (;;) {
921                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
922
923                 skb = skb_dequeue(&sk->sk_receive_queue);
924                 if (skb)
925                         break;
926
927                 if (flags & O_NONBLOCK) {
928                         err = -EWOULDBLOCK;
929                         break;
930                 }
931                 if (!signal_pending(current)) {
932                         release_sock(sk);
933                         schedule();
934                         lock_sock(sk);
935                         continue;
936                 }
937                 err = -ERESTARTSYS;
938                 break;
939         }
940         finish_wait(sk_sleep(sk), &wait);
941         if (err)
942                 goto out_release;
943
944         newsk = skb->sk;
945         sock_graft(newsk, newsock);
946
947         /* Now attach up the new socket */
948         skb->sk = NULL;
949         kfree_skb(skb);
950         sk_acceptq_removed(sk);
951
952 out_release:
953         release_sock(sk);
954
955         return err;
956 }
957
958 static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
959         int peer)
960 {
961         struct full_sockaddr_rose *srose = (struct full_sockaddr_rose *)uaddr;
962         struct sock *sk = sock->sk;
963         struct rose_sock *rose = rose_sk(sk);
964         int n;
965
966         memset(srose, 0, sizeof(*srose));
967         if (peer != 0) {
968                 if (sk->sk_state != TCP_ESTABLISHED)
969                         return -ENOTCONN;
970                 srose->srose_family = AF_ROSE;
971                 srose->srose_addr   = rose->dest_addr;
972                 srose->srose_call   = rose->dest_call;
973                 srose->srose_ndigis = rose->dest_ndigis;
974                 for (n = 0; n < rose->dest_ndigis; n++)
975                         srose->srose_digis[n] = rose->dest_digis[n];
976         } else {
977                 srose->srose_family = AF_ROSE;
978                 srose->srose_addr   = rose->source_addr;
979                 srose->srose_call   = rose->source_call;
980                 srose->srose_ndigis = rose->source_ndigis;
981                 for (n = 0; n < rose->source_ndigis; n++)
982                         srose->srose_digis[n] = rose->source_digis[n];
983         }
984
985         return sizeof(struct full_sockaddr_rose);
986 }
987
988 int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct rose_neigh *neigh, unsigned int lci)
989 {
990         struct sock *sk;
991         struct sock *make;
992         struct rose_sock *make_rose;
993         struct rose_facilities_struct facilities;
994         int n;
995
996         skb->sk = NULL;         /* Initially we don't know who it's for */
997
998         /*
999          *      skb->data points to the rose frame start
1000          */
1001         memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
1002
1003         if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
1004                                    skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
1005                                    &facilities)) {
1006                 rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
1007                 return 0;
1008         }
1009
1010         sk = rose_find_listener(&facilities.source_addr, &facilities.source_call);
1011
1012         /*
1013          * We can't accept the Call Request.
1014          */
1015         if (sk == NULL || sk_acceptq_is_full(sk) ||
1016             (make = rose_make_new(sk)) == NULL) {
1017                 rose_transmit_clear_request(neigh, lci, ROSE_NETWORK_CONGESTION, 120);
1018                 return 0;
1019         }
1020
1021         skb->sk     = make;
1022         make->sk_state = TCP_ESTABLISHED;
1023         make_rose = rose_sk(make);
1024
1025         make_rose->lci           = lci;
1026         make_rose->dest_addr     = facilities.dest_addr;
1027         make_rose->dest_call     = facilities.dest_call;
1028         make_rose->dest_ndigis   = facilities.dest_ndigis;
1029         for (n = 0 ; n < facilities.dest_ndigis ; n++)
1030                 make_rose->dest_digis[n] = facilities.dest_digis[n];
1031         make_rose->source_addr   = facilities.source_addr;
1032         make_rose->source_call   = facilities.source_call;
1033         make_rose->source_ndigis = facilities.source_ndigis;
1034         for (n = 0 ; n < facilities.source_ndigis ; n++)
1035                 make_rose->source_digis[n] = facilities.source_digis[n];
1036         make_rose->neighbour     = neigh;
1037         make_rose->device        = dev;
1038         /* Caller got a reference for us. */
1039         netdev_tracker_alloc(make_rose->device, &make_rose->dev_tracker,
1040                              GFP_ATOMIC);
1041         make_rose->facilities    = facilities;
1042
1043         make_rose->neighbour->use++;
1044
1045         if (rose_sk(sk)->defer) {
1046                 make_rose->state = ROSE_STATE_5;
1047         } else {
1048                 rose_write_internal(make, ROSE_CALL_ACCEPTED);
1049                 make_rose->state = ROSE_STATE_3;
1050                 rose_start_idletimer(make);
1051         }
1052
1053         make_rose->condition = 0x00;
1054         make_rose->vs        = 0;
1055         make_rose->va        = 0;
1056         make_rose->vr        = 0;
1057         make_rose->vl        = 0;
1058         sk_acceptq_added(sk);
1059
1060         rose_insert_socket(make);
1061
1062         skb_queue_head(&sk->sk_receive_queue, skb);
1063
1064         rose_start_heartbeat(make);
1065
1066         if (!sock_flag(sk, SOCK_DEAD))
1067                 sk->sk_data_ready(sk);
1068
1069         return 1;
1070 }
1071
1072 static int rose_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1073 {
1074         struct sock *sk = sock->sk;
1075         struct rose_sock *rose = rose_sk(sk);
1076         DECLARE_SOCKADDR(struct sockaddr_rose *, usrose, msg->msg_name);
1077         int err;
1078         struct full_sockaddr_rose srose;
1079         struct sk_buff *skb;
1080         unsigned char *asmptr;
1081         int n, size, qbit = 0;
1082
1083         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
1084                 return -EINVAL;
1085
1086         if (sock_flag(sk, SOCK_ZAPPED))
1087                 return -EADDRNOTAVAIL;
1088
1089         if (sk->sk_shutdown & SEND_SHUTDOWN) {
1090                 send_sig(SIGPIPE, current, 0);
1091                 return -EPIPE;
1092         }
1093
1094         if (rose->neighbour == NULL || rose->device == NULL)
1095                 return -ENETUNREACH;
1096
1097         if (usrose != NULL) {
1098                 if (msg->msg_namelen != sizeof(struct sockaddr_rose) && msg->msg_namelen != sizeof(struct full_sockaddr_rose))
1099                         return -EINVAL;
1100                 memset(&srose, 0, sizeof(struct full_sockaddr_rose));
1101                 memcpy(&srose, usrose, msg->msg_namelen);
1102                 if (rosecmp(&rose->dest_addr, &srose.srose_addr) != 0 ||
1103                     ax25cmp(&rose->dest_call, &srose.srose_call) != 0)
1104                         return -EISCONN;
1105                 if (srose.srose_ndigis != rose->dest_ndigis)
1106                         return -EISCONN;
1107                 if (srose.srose_ndigis == rose->dest_ndigis) {
1108                         for (n = 0 ; n < srose.srose_ndigis ; n++)
1109                                 if (ax25cmp(&rose->dest_digis[n],
1110                                             &srose.srose_digis[n]))
1111                                         return -EISCONN;
1112                 }
1113                 if (srose.srose_family != AF_ROSE)
1114                         return -EINVAL;
1115         } else {
1116                 if (sk->sk_state != TCP_ESTABLISHED)
1117                         return -ENOTCONN;
1118
1119                 srose.srose_family = AF_ROSE;
1120                 srose.srose_addr   = rose->dest_addr;
1121                 srose.srose_call   = rose->dest_call;
1122                 srose.srose_ndigis = rose->dest_ndigis;
1123                 for (n = 0 ; n < rose->dest_ndigis ; n++)
1124                         srose.srose_digis[n] = rose->dest_digis[n];
1125         }
1126
1127         /* Build a packet */
1128         /* Sanity check the packet size */
1129         if (len > 65535)
1130                 return -EMSGSIZE;
1131
1132         size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
1133
1134         if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
1135                 return err;
1136
1137         skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN);
1138
1139         /*
1140          *      Put the data on the end
1141          */
1142
1143         skb_reset_transport_header(skb);
1144         skb_put(skb, len);
1145
1146         err = memcpy_from_msg(skb_transport_header(skb), msg, len);
1147         if (err) {
1148                 kfree_skb(skb);
1149                 return err;
1150         }
1151
1152         /*
1153          *      If the Q BIT Include socket option is in force, the first
1154          *      byte of the user data is the logical value of the Q Bit.
1155          */
1156         if (rose->qbitincl) {
1157                 qbit = skb->data[0];
1158                 skb_pull(skb, 1);
1159         }
1160
1161         /*
1162          *      Push down the ROSE header
1163          */
1164         asmptr = skb_push(skb, ROSE_MIN_LEN);
1165
1166         /* Build a ROSE Network header */
1167         asmptr[0] = ((rose->lci >> 8) & 0x0F) | ROSE_GFI;
1168         asmptr[1] = (rose->lci >> 0) & 0xFF;
1169         asmptr[2] = ROSE_DATA;
1170
1171         if (qbit)
1172                 asmptr[0] |= ROSE_Q_BIT;
1173
1174         if (sk->sk_state != TCP_ESTABLISHED) {
1175                 kfree_skb(skb);
1176                 return -ENOTCONN;
1177         }
1178
1179 #ifdef M_BIT
1180 #define ROSE_PACLEN (256-ROSE_MIN_LEN)
1181         if (skb->len - ROSE_MIN_LEN > ROSE_PACLEN) {
1182                 unsigned char header[ROSE_MIN_LEN];
1183                 struct sk_buff *skbn;
1184                 int frontlen;
1185                 int lg;
1186
1187                 /* Save a copy of the Header */
1188                 skb_copy_from_linear_data(skb, header, ROSE_MIN_LEN);
1189                 skb_pull(skb, ROSE_MIN_LEN);
1190
1191                 frontlen = skb_headroom(skb);
1192
1193                 while (skb->len > 0) {
1194                         if ((skbn = sock_alloc_send_skb(sk, frontlen + ROSE_PACLEN, 0, &err)) == NULL) {
1195                                 kfree_skb(skb);
1196                                 return err;
1197                         }
1198
1199                         skbn->sk   = sk;
1200                         skbn->free = 1;
1201                         skbn->arp  = 1;
1202
1203                         skb_reserve(skbn, frontlen);
1204
1205                         lg = (ROSE_PACLEN > skb->len) ? skb->len : ROSE_PACLEN;
1206
1207                         /* Copy the user data */
1208                         skb_copy_from_linear_data(skb, skb_put(skbn, lg), lg);
1209                         skb_pull(skb, lg);
1210
1211                         /* Duplicate the Header */
1212                         skb_push(skbn, ROSE_MIN_LEN);
1213                         skb_copy_to_linear_data(skbn, header, ROSE_MIN_LEN);
1214
1215                         if (skb->len > 0)
1216                                 skbn->data[2] |= M_BIT;
1217
1218                         skb_queue_tail(&sk->sk_write_queue, skbn); /* Throw it on the queue */
1219                 }
1220
1221                 skb->free = 1;
1222                 kfree_skb(skb);
1223         } else {
1224                 skb_queue_tail(&sk->sk_write_queue, skb);               /* Throw it on the queue */
1225         }
1226 #else
1227         skb_queue_tail(&sk->sk_write_queue, skb);       /* Shove it onto the queue */
1228 #endif
1229
1230         rose_kick(sk);
1231
1232         return len;
1233 }
1234
1235
1236 static int rose_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1237                         int flags)
1238 {
1239         struct sock *sk = sock->sk;
1240         struct rose_sock *rose = rose_sk(sk);
1241         size_t copied;
1242         unsigned char *asmptr;
1243         struct sk_buff *skb;
1244         int n, er, qbit;
1245
1246         /*
1247          * This works for seqpacket too. The receiver has ordered the queue for
1248          * us! We do one quick check first though
1249          */
1250         if (sk->sk_state != TCP_ESTABLISHED)
1251                 return -ENOTCONN;
1252
1253         /* Now we can treat all alike */
1254         skb = skb_recv_datagram(sk, flags, &er);
1255         if (!skb)
1256                 return er;
1257
1258         qbit = (skb->data[0] & ROSE_Q_BIT) == ROSE_Q_BIT;
1259
1260         skb_pull(skb, ROSE_MIN_LEN);
1261
1262         if (rose->qbitincl) {
1263                 asmptr  = skb_push(skb, 1);
1264                 *asmptr = qbit;
1265         }
1266
1267         skb_reset_transport_header(skb);
1268         copied     = skb->len;
1269
1270         if (copied > size) {
1271                 copied = size;
1272                 msg->msg_flags |= MSG_TRUNC;
1273         }
1274
1275         skb_copy_datagram_msg(skb, 0, msg, copied);
1276
1277         if (msg->msg_name) {
1278                 struct sockaddr_rose *srose;
1279                 DECLARE_SOCKADDR(struct full_sockaddr_rose *, full_srose,
1280                                  msg->msg_name);
1281
1282                 memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
1283                 srose = msg->msg_name;
1284                 srose->srose_family = AF_ROSE;
1285                 srose->srose_addr   = rose->dest_addr;
1286                 srose->srose_call   = rose->dest_call;
1287                 srose->srose_ndigis = rose->dest_ndigis;
1288                 for (n = 0 ; n < rose->dest_ndigis ; n++)
1289                         full_srose->srose_digis[n] = rose->dest_digis[n];
1290                 msg->msg_namelen = sizeof(struct full_sockaddr_rose);
1291         }
1292
1293         skb_free_datagram(sk, skb);
1294
1295         return copied;
1296 }
1297
1298
1299 static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1300 {
1301         struct sock *sk = sock->sk;
1302         struct rose_sock *rose = rose_sk(sk);
1303         void __user *argp = (void __user *)arg;
1304
1305         switch (cmd) {
1306         case TIOCOUTQ: {
1307                 long amount;
1308
1309                 amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1310                 if (amount < 0)
1311                         amount = 0;
1312                 return put_user(amount, (unsigned int __user *) argp);
1313         }
1314
1315         case TIOCINQ: {
1316                 struct sk_buff *skb;
1317                 long amount = 0L;
1318
1319                 spin_lock_irq(&sk->sk_receive_queue.lock);
1320                 if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1321                         amount = skb->len;
1322                 spin_unlock_irq(&sk->sk_receive_queue.lock);
1323                 return put_user(amount, (unsigned int __user *) argp);
1324         }
1325
1326         case SIOCGIFADDR:
1327         case SIOCSIFADDR:
1328         case SIOCGIFDSTADDR:
1329         case SIOCSIFDSTADDR:
1330         case SIOCGIFBRDADDR:
1331         case SIOCSIFBRDADDR:
1332         case SIOCGIFNETMASK:
1333         case SIOCSIFNETMASK:
1334         case SIOCGIFMETRIC:
1335         case SIOCSIFMETRIC:
1336                 return -EINVAL;
1337
1338         case SIOCADDRT:
1339         case SIOCDELRT:
1340         case SIOCRSCLRRT:
1341                 if (!capable(CAP_NET_ADMIN))
1342                         return -EPERM;
1343                 return rose_rt_ioctl(cmd, argp);
1344
1345         case SIOCRSGCAUSE: {
1346                 struct rose_cause_struct rose_cause;
1347                 rose_cause.cause      = rose->cause;
1348                 rose_cause.diagnostic = rose->diagnostic;
1349                 return copy_to_user(argp, &rose_cause, sizeof(struct rose_cause_struct)) ? -EFAULT : 0;
1350         }
1351
1352         case SIOCRSSCAUSE: {
1353                 struct rose_cause_struct rose_cause;
1354                 if (copy_from_user(&rose_cause, argp, sizeof(struct rose_cause_struct)))
1355                         return -EFAULT;
1356                 rose->cause      = rose_cause.cause;
1357                 rose->diagnostic = rose_cause.diagnostic;
1358                 return 0;
1359         }
1360
1361         case SIOCRSSL2CALL:
1362                 if (!capable(CAP_NET_ADMIN)) return -EPERM;
1363                 if (ax25cmp(&rose_callsign, &null_ax25_address) != 0)
1364                         ax25_listen_release(&rose_callsign, NULL);
1365                 if (copy_from_user(&rose_callsign, argp, sizeof(ax25_address)))
1366                         return -EFAULT;
1367                 if (ax25cmp(&rose_callsign, &null_ax25_address) != 0)
1368                         return ax25_listen_register(&rose_callsign, NULL);
1369
1370                 return 0;
1371
1372         case SIOCRSGL2CALL:
1373                 return copy_to_user(argp, &rose_callsign, sizeof(ax25_address)) ? -EFAULT : 0;
1374
1375         case SIOCRSACCEPT:
1376                 if (rose->state == ROSE_STATE_5) {
1377                         rose_write_internal(sk, ROSE_CALL_ACCEPTED);
1378                         rose_start_idletimer(sk);
1379                         rose->condition = 0x00;
1380                         rose->vs        = 0;
1381                         rose->va        = 0;
1382                         rose->vr        = 0;
1383                         rose->vl        = 0;
1384                         rose->state     = ROSE_STATE_3;
1385                 }
1386                 return 0;
1387
1388         default:
1389                 return -ENOIOCTLCMD;
1390         }
1391
1392         return 0;
1393 }
1394
1395 #ifdef CONFIG_PROC_FS
1396 static void *rose_info_start(struct seq_file *seq, loff_t *pos)
1397         __acquires(rose_list_lock)
1398 {
1399         spin_lock_bh(&rose_list_lock);
1400         return seq_hlist_start_head(&rose_list, *pos);
1401 }
1402
1403 static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
1404 {
1405         return seq_hlist_next(v, &rose_list, pos);
1406 }
1407
1408 static void rose_info_stop(struct seq_file *seq, void *v)
1409         __releases(rose_list_lock)
1410 {
1411         spin_unlock_bh(&rose_list_lock);
1412 }
1413
1414 static int rose_info_show(struct seq_file *seq, void *v)
1415 {
1416         char buf[11], rsbuf[11];
1417
1418         if (v == SEQ_START_TOKEN)
1419                 seq_puts(seq,
1420                          "dest_addr  dest_call src_addr   src_call  dev   lci neigh st vs vr va   t  t1  t2  t3  hb    idle Snd-Q Rcv-Q inode\n");
1421
1422         else {
1423                 struct sock *s = sk_entry(v);
1424                 struct rose_sock *rose = rose_sk(s);
1425                 const char *devname, *callsign;
1426                 const struct net_device *dev = rose->device;
1427
1428                 if (!dev)
1429                         devname = "???";
1430                 else
1431                         devname = dev->name;
1432
1433                 seq_printf(seq, "%-10s %-9s ",
1434                            rose2asc(rsbuf, &rose->dest_addr),
1435                            ax2asc(buf, &rose->dest_call));
1436
1437                 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
1438                         callsign = "??????-?";
1439                 else
1440                         callsign = ax2asc(buf, &rose->source_call);
1441
1442                 seq_printf(seq,
1443                            "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
1444                         rose2asc(rsbuf, &rose->source_addr),
1445                         callsign,
1446                         devname,
1447                         rose->lci & 0x0FFF,
1448                         (rose->neighbour) ? rose->neighbour->number : 0,
1449                         rose->state,
1450                         rose->vs,
1451                         rose->vr,
1452                         rose->va,
1453                         ax25_display_timer(&rose->timer) / HZ,
1454                         rose->t1 / HZ,
1455                         rose->t2 / HZ,
1456                         rose->t3 / HZ,
1457                         rose->hb / HZ,
1458                         ax25_display_timer(&rose->idletimer) / (60 * HZ),
1459                         rose->idle / (60 * HZ),
1460                         sk_wmem_alloc_get(s),
1461                         sk_rmem_alloc_get(s),
1462                         s->sk_socket ? SOCK_INODE(s->sk_socket)->i_ino : 0L);
1463         }
1464
1465         return 0;
1466 }
1467
1468 static const struct seq_operations rose_info_seqops = {
1469         .start = rose_info_start,
1470         .next = rose_info_next,
1471         .stop = rose_info_stop,
1472         .show = rose_info_show,
1473 };
1474 #endif  /* CONFIG_PROC_FS */
1475
1476 static const struct net_proto_family rose_family_ops = {
1477         .family         =       PF_ROSE,
1478         .create         =       rose_create,
1479         .owner          =       THIS_MODULE,
1480 };
1481
1482 static const struct proto_ops rose_proto_ops = {
1483         .family         =       PF_ROSE,
1484         .owner          =       THIS_MODULE,
1485         .release        =       rose_release,
1486         .bind           =       rose_bind,
1487         .connect        =       rose_connect,
1488         .socketpair     =       sock_no_socketpair,
1489         .accept         =       rose_accept,
1490         .getname        =       rose_getname,
1491         .poll           =       datagram_poll,
1492         .ioctl          =       rose_ioctl,
1493         .gettstamp      =       sock_gettstamp,
1494         .listen         =       rose_listen,
1495         .shutdown       =       sock_no_shutdown,
1496         .setsockopt     =       rose_setsockopt,
1497         .getsockopt     =       rose_getsockopt,
1498         .sendmsg        =       rose_sendmsg,
1499         .recvmsg        =       rose_recvmsg,
1500         .mmap           =       sock_no_mmap,
1501 };
1502
1503 static struct notifier_block rose_dev_notifier = {
1504         .notifier_call  =       rose_device_event,
1505 };
1506
1507 static struct net_device **dev_rose;
1508
1509 static struct ax25_protocol rose_pid = {
1510         .pid    = AX25_P_ROSE,
1511         .func   = rose_route_frame
1512 };
1513
1514 static struct ax25_linkfail rose_linkfail_notifier = {
1515         .func   = rose_link_failed
1516 };
1517
1518 static int __init rose_proto_init(void)
1519 {
1520         int i;
1521         int rc;
1522
1523         if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
1524                 printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter too large\n");
1525                 rc = -EINVAL;
1526                 goto out;
1527         }
1528
1529         rc = proto_register(&rose_proto, 0);
1530         if (rc != 0)
1531                 goto out;
1532
1533         rose_callsign = null_ax25_address;
1534
1535         dev_rose = kcalloc(rose_ndevs, sizeof(struct net_device *),
1536                            GFP_KERNEL);
1537         if (dev_rose == NULL) {
1538                 printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate device structure\n");
1539                 rc = -ENOMEM;
1540                 goto out_proto_unregister;
1541         }
1542
1543         for (i = 0; i < rose_ndevs; i++) {
1544                 struct net_device *dev;
1545                 char name[IFNAMSIZ];
1546
1547                 sprintf(name, "rose%d", i);
1548                 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, rose_setup);
1549                 if (!dev) {
1550                         printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate memory\n");
1551                         rc = -ENOMEM;
1552                         goto fail;
1553                 }
1554                 rc = register_netdev(dev);
1555                 if (rc) {
1556                         printk(KERN_ERR "ROSE: netdevice registration failed\n");
1557                         free_netdev(dev);
1558                         goto fail;
1559                 }
1560                 rose_set_lockdep_key(dev);
1561                 dev_rose[i] = dev;
1562         }
1563
1564         sock_register(&rose_family_ops);
1565         register_netdevice_notifier(&rose_dev_notifier);
1566
1567         ax25_register_pid(&rose_pid);
1568         ax25_linkfail_register(&rose_linkfail_notifier);
1569
1570 #ifdef CONFIG_SYSCTL
1571         rose_register_sysctl();
1572 #endif
1573         rose_loopback_init();
1574
1575         rose_add_loopback_neigh();
1576
1577         proc_create_seq("rose", 0444, init_net.proc_net, &rose_info_seqops);
1578         proc_create_seq("rose_neigh", 0444, init_net.proc_net,
1579                     &rose_neigh_seqops);
1580         proc_create_seq("rose_nodes", 0444, init_net.proc_net,
1581                     &rose_node_seqops);
1582         proc_create_seq("rose_routes", 0444, init_net.proc_net,
1583                     &rose_route_seqops);
1584 out:
1585         return rc;
1586 fail:
1587         while (--i >= 0) {
1588                 unregister_netdev(dev_rose[i]);
1589                 free_netdev(dev_rose[i]);
1590         }
1591         kfree(dev_rose);
1592 out_proto_unregister:
1593         proto_unregister(&rose_proto);
1594         goto out;
1595 }
1596 module_init(rose_proto_init);
1597
1598 module_param(rose_ndevs, int, 0);
1599 MODULE_PARM_DESC(rose_ndevs, "number of ROSE devices");
1600
1601 MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
1602 MODULE_DESCRIPTION("The amateur radio ROSE network layer protocol");
1603 MODULE_LICENSE("GPL");
1604 MODULE_ALIAS_NETPROTO(PF_ROSE);
1605
1606 static void __exit rose_exit(void)
1607 {
1608         int i;
1609
1610         remove_proc_entry("rose", init_net.proc_net);
1611         remove_proc_entry("rose_neigh", init_net.proc_net);
1612         remove_proc_entry("rose_nodes", init_net.proc_net);
1613         remove_proc_entry("rose_routes", init_net.proc_net);
1614         rose_loopback_clear();
1615
1616         rose_rt_free();
1617
1618         ax25_protocol_release(AX25_P_ROSE);
1619         ax25_linkfail_release(&rose_linkfail_notifier);
1620
1621         if (ax25cmp(&rose_callsign, &null_ax25_address) != 0)
1622                 ax25_listen_release(&rose_callsign, NULL);
1623
1624 #ifdef CONFIG_SYSCTL
1625         rose_unregister_sysctl();
1626 #endif
1627         unregister_netdevice_notifier(&rose_dev_notifier);
1628
1629         sock_unregister(PF_ROSE);
1630
1631         for (i = 0; i < rose_ndevs; i++) {
1632                 struct net_device *dev = dev_rose[i];
1633
1634                 if (dev) {
1635                         unregister_netdev(dev);
1636                         free_netdev(dev);
1637                 }
1638         }
1639
1640         kfree(dev_rose);
1641         proto_unregister(&rose_proto);
1642 }
1643
1644 module_exit(rose_exit);