linux-toradex.git/net/phonet/pep.c, branch v3.2.62

phonet: Check input from user before allocating

2012-05-11T12:14:19+00:00

[ Upstream commit bcf1b70ac6eb0ed8286c66e6bf37cb747cbaa04c ]

A phonet packet is limited to USHRT_MAX bytes, this is never checked during
tx which means that the user can specify any size he wishes, and the kernel
will attempt to allocate that size.

In the good case, it'll lead to the following warning, but it may also cause
the kernel to kick in the OOM and kill a random task on the server.

[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
[ 8921.749770] Pid: 5081, comm: trinity Tainted: G        W    3.4.0-rc1-next-20120402-sasha #46
[ 8921.756672] Call Trace:
[ 8921.758185]  [] warn_slowpath_common+0x87/0xb0
[ 8921.762868]  [] warn_slowpath_null+0x15/0x20
[ 8921.765399]  [] __alloc_pages_slowpath+0x65/0x730
[ 8921.769226]  [] ? zone_watermark_ok+0x1a/0x20
[ 8921.771686]  [] ? get_page_from_freelist+0x625/0x660
[ 8921.773919]  [] __alloc_pages_nodemask+0x1f8/0x240
[ 8921.776248]  [] kmalloc_large_node+0x70/0xc0
[ 8921.778294]  [] __kmalloc_node_track_caller+0x34/0x1c0
[ 8921.780847]  [] ? sock_alloc_send_pskb+0xbc/0x260
[ 8921.783179]  [] __alloc_skb+0x75/0x170
[ 8921.784971]  [] sock_alloc_send_pskb+0xbc/0x260
[ 8921.787111]  [] ? release_sock+0x7e/0x90
[ 8921.788973]  [] sock_alloc_send_skb+0x10/0x20
[ 8921.791052]  [] pep_sendmsg+0x60/0x380
[ 8921.792931]  [] ? pn_socket_bind+0x156/0x180
[ 8921.794917]  [] ? pn_socket_autobind+0x3f/0x90
[ 8921.797053]  [] pn_socket_sendmsg+0x4f/0x70
[ 8921.798992]  [] sock_aio_write+0x187/0x1b0
[ 8921.801395]  [] ? sub_preempt_count+0xae/0xf0
[ 8921.803501]  [] ? __lock_acquire+0x42c/0x4b0
[ 8921.805505]  [] ? __sock_recv_ts_and_drops+0x140/0x140
[ 8921.807860]  [] do_sync_readv_writev+0xbc/0x110
[ 8921.809986]  [] ? might_fault+0x97/0xa0
[ 8921.811998]  [] ? security_file_permission+0x1e/0x90
[ 8921.814595]  [] do_readv_writev+0xe2/0x1e0
[ 8921.816702]  [] ? do_setitimer+0x1ac/0x200
[ 8921.818819]  [] ? get_parent_ip+0x11/0x50
[ 8921.820863]  [] ? sub_preempt_count+0xae/0xf0
[ 8921.823318]  [] vfs_writev+0x46/0x60
[ 8921.825219]  [] sys_writev+0x4f/0xb0
[ 8921.827127]  [] system_call_fastpath+0x16/0x1b
[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---

Signed-off-by: Sasha Levin 
Acked-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

net: Fix files explicitly needing to include module.h

2011-10-31T23:30:28+00:00

With calls to modular infrastructure, these files really
needs the full module.h header.  Call it out so some of the
cleanups of implicit and unrequired includes elsewhere can be
cleaned up.

Signed-off-by: Paul Gortmaker

Phonet: fix aligned-mode pipe socket buffer header reserve

2011-03-15T21:55:49+00:00

When the pipe uses aligned-mode data packets, we must reserve 4 bytes
instead of 3 for the pipe protocol header. Otherwise the Phonet header
would not be aligned, resulting in potentially corrupted headers with
later unaligned memory writes.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: kill the ST-Ericsson pipe controller Kconfig

2011-03-09T19:59:33+00:00

This is now a run-time choice so that a single kernel can support both
old and new generation ISI modems. Support for manually enabling the
pipe flow is removed as it did not work properly, does not fit well
with the socket API, and I am not aware of any use at the moment.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: support active connection without pipe controller on modem

2011-03-09T19:59:33+00:00

This provides support for newer ISI modems with no need for the
earlier experimental compile-time alternative choice. With this,
we can now use the same kernel and userspace with both types of
modems.

This also avoids confusing two different and incompatible state
machines, actively connected vs accepted sockets, and adds
connection response error handling (processing "SYN/RST" of sorts).

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: provide pipe socket option to retrieve the pipe identifier

2011-03-09T19:59:32+00:00

User-space sometimes needs this information. In particular, the GPRS
context or the AT commands pipe setups may use the pipe handle as a
reference.

This removes the settable pipe handle with CONFIG_PHONET_PIPECTRLR.
It did not handle error cases correctly. Furthermore, the kernel
*could* implement a smart scheme for allocating handles (if ever
needed), but userspace really cannot.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: allocate sock from accept syscall rather than soft IRQ

2011-03-09T19:59:32+00:00

This moves most of the accept logic to process context like other
socket stacks do. Then we can use a few more common socket helpers
and simplify a bit.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: factor common code to send control messages

2011-03-09T19:59:31+00:00

With the addition of the pipe controller, there is now quite a bit
of repetitive code for small signaling messages. Lets factor it.

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

Phonet: correct pipe backlog callback return values

2011-03-09T19:59:30+00:00

In some cases, the Phonet pipe backlog callbacks returned negative
errno instead of NET_RX_* values.

In other cases, NET_RX_DROP was returned for invalid packets, even
though it seems only intended for buffering problems (not for
deliberately discarded packets).

Signed-off-by: Rémi Denis-Courmont 
Signed-off-by: David S. Miller

phonet: Protect pipe_do_remove() with appropriate ifdefs.

2011-02-25T19:23:22+00:00

It is only used when CONFIG_PHONET_PIPECTRLR is not set.

Signed-off-by: David S. Miller