Commit 8d5cf596 authored by Ralf Baechle's avatar Ralf Baechle Committed by David S. Miller
Browse files

[AX.25]: Fix unchecked ax25_protocol_register uses. 



Replace ax25_protocol_register by ax25_register_pid which assumes the
caller has done the memory allocation.  This allows replacing the
kmalloc allocations entirely by static allocations.

Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c9266b99

include/net/ax25.h

+8 −1
Original line number Diff line number Diff line
@@ -333,7 +333,14 @@ extern void ax25_ds_t3timer_expiry(ax25_cb *); 
extern void ax25_ds_idletimer_expiry(ax25_cb *);



/* ax25_iface.c */

extern int __must_check ax25_protocol_register(unsigned int, int (*)(struct sk_buff *, ax25_cb *));



struct ax25_protocol {

	struct ax25_protocol *next;

	unsigned int pid;

	int (*func)(struct sk_buff *, ax25_cb *);

};



extern void ax25_register_pid(struct ax25_protocol *ap);

extern void ax25_protocol_release(unsigned int);

extern int __must_check ax25_linkfail_register(void (*)(ax25_cb *, int));

extern void ax25_linkfail_release(void (*)(ax25_cb *, int));

net/ax25/ax25_iface.c

+12 −29
Original line number Diff line number Diff line
@@ -29,11 +29,7 @@ 
#include <linux/mm.h>

#include <linux/interrupt.h>



static struct protocol_struct {

	struct protocol_struct *next;

	unsigned int pid;

	int (*func)(struct sk_buff *, ax25_cb *);

} *protocol_list = NULL;

static struct ax25_protocol *protocol_list;

static DEFINE_RWLOCK(protocol_list_lock);



static struct linkfail_struct {
@@ -49,36 +45,23 @@ static struct listen_struct { 
} *listen_list = NULL;

static DEFINE_SPINLOCK(listen_lock);



int ax25_protocol_register(unsigned int pid,

	int (*func)(struct sk_buff *, ax25_cb *))

/*

 * Do not register the internal protocols AX25_P_TEXT, AX25_P_SEGMENT,

 * AX25_P_IP or AX25_P_ARP ...

 */

void ax25_register_pid(struct ax25_protocol *ap)

{

	struct protocol_struct *protocol;



	if (pid == AX25_P_TEXT || pid == AX25_P_SEGMENT)

		return 0;

#ifdef CONFIG_INET

	if (pid == AX25_P_IP || pid == AX25_P_ARP)

		return 0;

#endif

	if ((protocol = kmalloc(sizeof(*protocol), GFP_ATOMIC)) == NULL)

		return 0;



	protocol->pid  = pid;

	protocol->func = func;



	write_lock_bh(&protocol_list_lock);

	protocol->next = protocol_list;

	protocol_list  = protocol;

	ap->next = protocol_list;

	protocol_list = ap;

	write_unlock_bh(&protocol_list_lock);



	return 1;

}



EXPORT_SYMBOL(ax25_protocol_register);

EXPORT_SYMBOL_GPL(ax25_register_pid);



void ax25_protocol_release(unsigned int pid)

{

	struct protocol_struct *s, *protocol;

	struct ax25_protocol *s, *protocol;



	write_lock_bh(&protocol_list_lock);

	protocol = protocol_list;
@@ -223,7 +206,7 @@ EXPORT_SYMBOL(ax25_listen_release); 
int (*ax25_protocol_function(unsigned int pid))(struct sk_buff *, ax25_cb *)

{

	int (*res)(struct sk_buff *, ax25_cb *) = NULL;

	struct protocol_struct *protocol;

	struct ax25_protocol *protocol;



	read_lock(&protocol_list_lock);

	for (protocol = protocol_list; protocol != NULL; protocol = protocol->next)
@@ -263,7 +246,7 @@ void ax25_link_failed(ax25_cb *ax25, int reason) 


int ax25_protocol_is_registered(unsigned int pid)

{

	struct protocol_struct *protocol;

	struct ax25_protocol *protocol;

	int res = 0;



	read_lock_bh(&protocol_list_lock);

net/netrom/af_netrom.c

+6 −1
Original line number Diff line number Diff line
@@ -1377,6 +1377,11 @@ static struct notifier_block nr_dev_notifier = { 


static struct net_device **dev_nr;



static struct ax25_protocol nr_pid = {

	.pid	= AX25_P_NETROM,

	.func	= nr_route_frame

};



static int __init nr_proto_init(void)

{

	int i;
@@ -1424,7 +1429,7 @@ static int __init nr_proto_init(void) 
		

	register_netdevice_notifier(&nr_dev_notifier);



	ax25_protocol_register(AX25_P_NETROM, nr_route_frame);

	ax25_register_pid(&nr_pid);

	ax25_linkfail_register(nr_link_failed);



#ifdef CONFIG_SYSCTL

net/rose/af_rose.c

+6 −1
Original line number Diff line number Diff line
@@ -1481,6 +1481,11 @@ static struct notifier_block rose_dev_notifier = { 


static struct net_device **dev_rose;



static struct ax25_protocol rose_pid = {

	.pid	= AX25_P_ROSE,

	.func	= rose_route_frame

};



static int __init rose_proto_init(void)

{

	int i;
@@ -1530,7 +1535,7 @@ static int __init rose_proto_init(void) 
	sock_register(&rose_family_ops);

	register_netdevice_notifier(&rose_dev_notifier);



	ax25_protocol_register(AX25_P_ROSE, rose_route_frame);

	ax25_register_pid(&rose_pid);

	ax25_linkfail_register(rose_link_failed);



#ifdef CONFIG_SYSCTL