Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp

Conflicts:
	litmus/sched_cedf.c

5 files changed, 119 insertions, 80 deletions

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index d952e7eac188..f9ea925ad9cb 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -682,10 +682,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
-        if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) {
-                SOCK_DEBUG(sk, "ROSE: bind failed: invalid address\n");
+        if ((dev = rose_dev_get(&addr->srose_addr)) == NULL)
                 return -EADDRNOTAVAIL;
-        }
 
         source = &addr->srose_call;
 
@@ -716,7 +714,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         rose_insert_socket(sk);
 
         sock_reset_flag(sk, SOCK_ZAPPED);
-        SOCK_DEBUG(sk, "ROSE: socket is bound\n");
+
         return 0;
 }
 
@@ -803,7 +801,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
 
                 rose_insert_socket(sk);         /* Finish the bind */
         }
-rose_try_next_neigh:
         rose->dest_addr   = addr->srose_addr;
         rose->dest_call   = addr->srose_call;
         rose->rand        = ((long)rose & 0xFFFF) + rose->lci;
@@ -865,12 +862,6 @@ rose_try_next_neigh:
         }
 
         if (sk->sk_state != TCP_ESTABLISHED) {
-        /* Try next neighbour */
-                rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, &diagnostic, 0);
-                if (rose->neighbour)
-                        goto rose_try_next_neigh;
-
-                /* No more neighbours */
                 sock->state = SS_UNCONNECTED;
                 err = sock_error(sk);   /* Always set at this point */
                 goto out_release;
@@ -985,7 +976,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
         struct sock *make;
         struct rose_sock *make_rose;
         struct rose_facilities_struct facilities;
-        int n, len;
+        int n;
 
         skb->sk = NULL;         /* Initially we don't know who it's for */
 
@@ -994,9 +985,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
          */
         memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
 
-        len  = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-        len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
-        if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
+        if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
+                                   skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
+                                   &facilities)) {
                 rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
                 return 0;
         }
@@ -1116,10 +1107,7 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
                         srose.srose_digis[n] = rose->dest_digis[n];
         }
 
-        SOCK_DEBUG(sk, "ROSE: sendto: Addresses built.\n");
-
         /* Build a packet */
-        SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
         /* Sanity check the packet size */
         if (len > 65535)
                 return -EMSGSIZE;
@@ -1134,7 +1122,6 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         /*
          *      Put the data on the end
          */
-        SOCK_DEBUG(sk, "ROSE: Appending user data\n");
 
         skb_reset_transport_header(skb);
         skb_put(skb, len);
@@ -1159,8 +1146,6 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
          */
         asmptr = skb_push(skb, ROSE_MIN_LEN);
 
-        SOCK_DEBUG(sk, "ROSE: Building Network Header.\n");
-
         /* Build a ROSE Network header */
         asmptr[0] = ((rose->lci >> 8) & 0x0F) | ROSE_GFI;
         asmptr[1] = (rose->lci >> 0) & 0xFF;
@@ -1169,10 +1154,6 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (qbit)
                 asmptr[0] |= ROSE_Q_BIT;
 
-        SOCK_DEBUG(sk, "ROSE: Built header.\n");
-
-        SOCK_DEBUG(sk, "ROSE: Transmitting buffer\n");
-
         if (sk->sk_state != TCP_ESTABLISHED) {
                 kfree_skb(skb);
                 return -ENOTCONN;
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index a750a28e0221..fa5f5641a2c2 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -114,7 +114,7 @@ static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh)
         if (ax25s)
                 ax25_cb_put(ax25s);
 
-        return (neigh->ax25 != NULL);
+        return neigh->ax25 != NULL;
 }
 
 /*
@@ -137,7 +137,7 @@ static int rose_link_up(struct rose_neigh *neigh)
         if (ax25s)
                 ax25_cb_put(ax25s);
 
-        return (neigh->ax25 != NULL);
+        return neigh->ax25 != NULL;
 }
 
 /*
diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index ae4a9d99aec7..344456206b70 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -73,9 +73,20 @@ static void rose_loopback_timer(unsigned long param)
         unsigned int lci_i, lci_o;
 
         while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
+                if (skb->len < ROSE_MIN_LEN) {
+                        kfree_skb(skb);
+                        continue;
+                }
                 lci_i     = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
                 frametype = skb->data[2];
-                dest      = (rose_address *)(skb->data + 4);
+                if (frametype == ROSE_CALL_REQUEST &&
+                    (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
+                     skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
+                     ROSE_CALL_REQ_ADDR_LEN_VAL)) {
+                        kfree_skb(skb);
+                        continue;
+                }
+                dest      = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
                 lci_o     = ROSE_DEFAULT_MAXVC + 1 - lci_i;
 
                 skb_reset_transport_header(skb);
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index b4fdaac233f7..479cae57d187 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -587,7 +587,7 @@ static int rose_clear_routes(void)
 
 /*
  *      Check that the device given is a valid AX.25 interface that is "up".
- *      called whith RTNL
+ *      called with RTNL
  */
 static struct net_device *rose_ax25_dev_find(char *devname)
 {
@@ -674,29 +674,34 @@ struct rose_route *rose_route_free_lci(unsigned int lci, struct rose_neigh *neig
  *      Find a neighbour or a route given a ROSE address.
  */
 struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,
-        unsigned char *diagnostic, int new)
+        unsigned char *diagnostic, int route_frame)
 {
         struct rose_neigh *res = NULL;
         struct rose_node *node;
         int failed = 0;
         int i;
 
-        if (!new) spin_lock_bh(&rose_node_list_lock);
+        if (!route_frame) spin_lock_bh(&rose_node_list_lock);
         for (node = rose_node_list; node != NULL; node = node->next) {
                 if (rosecmpm(addr, &node->address, node->mask) == 0) {
                         for (i = 0; i < node->count; i++) {
-                                if (new) {
-                                        if (node->neighbour[i]->restarted) {
-                                                res = node->neighbour[i];
-                                                goto out;
-                                        }
+                                if (node->neighbour[i]->restarted) {
+                                        res = node->neighbour[i];
+                                        goto out;
                                 }
-                                else {
+                        }
+                }
+        }
+        if (!route_frame) { /* connect request */
+                for (node = rose_node_list; node != NULL; node = node->next) {
+                        if (rosecmpm(addr, &node->address, node->mask) == 0) {
+                                for (i = 0; i < node->count; i++) {
                                         if (!rose_ftimer_running(node->neighbour[i])) {
                                                 res = node->neighbour[i];
+                                                failed = 0;
                                                 goto out;
-                                        } else
-                                                failed = 1;
+                                        }
+                                        failed = 1;
                                 }
                         }
                 }
@@ -711,8 +716,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,
         }
 
 out:
-        if (!new) spin_unlock_bh(&rose_node_list_lock);
-
+        if (!route_frame) spin_unlock_bh(&rose_node_list_lock);
         return res;
 }
 
@@ -857,7 +861,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
         unsigned int lci, new_lci;
         unsigned char cause, diagnostic;
         struct net_device *dev;
-        int len, res = 0;
+        int res = 0;
         char buf[11];
 
 #if 0
@@ -865,10 +869,17 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
                 return res;
 #endif
 
+        if (skb->len < ROSE_MIN_LEN)
+                return res;
         frametype = skb->data[2];
         lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
-        src_addr  = (rose_address *)(skb->data + 9);
-        dest_addr = (rose_address *)(skb->data + 4);
+        if (frametype == ROSE_CALL_REQUEST &&
+            (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
+             skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
+             ROSE_CALL_REQ_ADDR_LEN_VAL))
+                return res;
+        src_addr  = (rose_address *)(skb->data + ROSE_CALL_REQ_SRC_ADDR_OFF);
+        dest_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
 
         spin_lock_bh(&rose_neigh_list_lock);
         spin_lock_bh(&rose_route_list_lock);
@@ -1006,12 +1017,11 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
                 goto out;
         }
 
-        len  = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-        len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
-
         memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
 
-        if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
+        if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
+                                   skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
+                                   &facilities)) {
                 rose_transmit_clear_request(rose_neigh, lci, ROSE_INVALID_FACILITY, 76);
                 goto out;
         }
diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
index 1734abba26a2..f6c71caa94b9 100644
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -142,7 +142,7 @@ void rose_write_internal(struct sock *sk, int frametype)
                 *dptr++ = ROSE_GFI | lci1;
                 *dptr++ = lci2;
                 *dptr++ = frametype;
-                *dptr++ = 0xAA;
+                *dptr++ = ROSE_CALL_REQ_ADDR_LEN_VAL;
                 memcpy(dptr, &rose->dest_addr,  ROSE_ADDR_LEN);
                 dptr   += ROSE_ADDR_LEN;
                 memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
@@ -246,12 +246,16 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
         do {
                 switch (*p & 0xC0) {
                 case 0x00:
+                        if (len < 2)
+                                return -1;
                         p   += 2;
                         n   += 2;
                         len -= 2;
                         break;
 
                 case 0x40:
+                        if (len < 3)
+                                return -1;
                         if (*p == FAC_NATIONAL_RAND)
                                 facilities->rand = ((p[1] << 8) & 0xFF00) + ((p[2] << 0) & 0x00FF);
                         p   += 3;
@@ -260,40 +264,61 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
                         break;
 
                 case 0x80:
+                        if (len < 4)
+                                return -1;
                         p   += 4;
                         n   += 4;
                         len -= 4;
                         break;
 
                 case 0xC0:
+                        if (len < 2)
+                                return -1;
                         l = p[1];
+                        if (len < 2 + l)
+                                return -1;
                         if (*p == FAC_NATIONAL_DEST_DIGI) {
                                 if (!fac_national_digis_received) {
+                                        if (l < AX25_ADDR_LEN)
+                                                return -1;
                                         memcpy(&facilities->source_digis[0], p + 2, AX25_ADDR_LEN);
                                         facilities->source_ndigis = 1;
                                 }
                         }
                         else if (*p == FAC_NATIONAL_SRC_DIGI) {
                                 if (!fac_national_digis_received) {
+                                        if (l < AX25_ADDR_LEN)
+                                                return -1;
                                         memcpy(&facilities->dest_digis[0], p + 2, AX25_ADDR_LEN);
                                         facilities->dest_ndigis = 1;
                                 }
                         }
                         else if (*p == FAC_NATIONAL_FAIL_CALL) {
+                                if (l < AX25_ADDR_LEN)
+                                        return -1;
                                 memcpy(&facilities->fail_call, p + 2, AX25_ADDR_LEN);
                         }
                         else if (*p == FAC_NATIONAL_FAIL_ADD) {
+                                if (l < 1 + ROSE_ADDR_LEN)
+                                        return -1;
                                 memcpy(&facilities->fail_addr, p + 3, ROSE_ADDR_LEN);
                         }
                         else if (*p == FAC_NATIONAL_DIGIS) {
+                                if (l % AX25_ADDR_LEN)
+                                        return -1;
                                 fac_national_digis_received = 1;
                                 facilities->source_ndigis = 0;
                                 facilities->dest_ndigis   = 0;
                                 for (pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_ADDR_LEN) {
-                                        if (pt[6] & AX25_HBIT)
+                                        if (pt[6] & AX25_HBIT) {
+                                                if (facilities->dest_ndigis >= ROSE_MAX_DIGIS)
+                                                        return -1;
                                                 memcpy(&facilities->dest_digis[facilities->dest_ndigis++], pt, AX25_ADDR_LEN);
-                                        else
+                                        } else {
+                                                if (facilities->source_ndigis >= ROSE_MAX_DIGIS)
+                                                        return -1;
                                                 memcpy(&facilities->source_digis[facilities->source_ndigis++], pt, AX25_ADDR_LEN);
+                                        }
                                 }
                         }
                         p   += l + 2;
@@ -314,25 +339,38 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
         do {
                 switch (*p & 0xC0) {
                 case 0x00:
+                        if (len < 2)
+                                return -1;
                         p   += 2;
                         n   += 2;
                         len -= 2;
                         break;
 
                 case 0x40:
+                        if (len < 3)
+                                return -1;
                         p   += 3;
                         n   += 3;
                         len -= 3;
                         break;
 
                 case 0x80:
+                        if (len < 4)
+                                return -1;
                         p   += 4;
                         n   += 4;
                         len -= 4;
                         break;
 
                 case 0xC0:
+                        if (len < 2)
+                                return -1;
                         l = p[1];
+
+                        /* Prevent overflows*/
+                        if (l < 10 || l > 20)
+                                return -1;
+
                         if (*p == FAC_CCITT_DEST_NSAP) {
                                 memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);
                                 memcpy(callsign, p + 12,   l - 10);
@@ -355,45 +393,44 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
         return n;
 }
 
-int rose_parse_facilities(unsigned char *p,
+int rose_parse_facilities(unsigned char *p, unsigned packet_len,
         struct rose_facilities_struct *facilities)
 {
         int facilities_len, len;
 
         facilities_len = *p++;
 
-        if (facilities_len == 0)
+        if (facilities_len == 0 || (unsigned)facilities_len > packet_len)
                 return 0;
 
-        while (facilities_len > 0) {
-                if (*p == 0x00) {
-                        facilities_len--;
-                        p++;
-
-                        switch (*p) {
-                        case FAC_NATIONAL:              /* National */
-                                len = rose_parse_national(p + 1, facilities, facilities_len - 1);
-                                facilities_len -= len + 1;
-                                p += len + 1;
-                                break;
-
-                        case FAC_CCITT:         /* CCITT */
-                                len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
-                                facilities_len -= len + 1;
-                                p += len + 1;
-                                break;
-
-                        default:
-                                printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
-                                facilities_len--;
-                                p++;
-                                break;
-                        }
-                } else
-                        break;  /* Error in facilities format */
+        while (facilities_len >= 3 && *p == 0x00) {
+                facilities_len--;
+                p++;
+
+                switch (*p) {
+                case FAC_NATIONAL:              /* National */
+                        len = rose_parse_national(p + 1, facilities, facilities_len - 1);
+                        break;
+
+                case FAC_CCITT:         /* CCITT */
+                        len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
+                        break;
+
+                default:
+                        printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
+                        len = 1;
+                        break;
+                }
+
+                if (len < 0)
+                        return 0;
+                if (WARN_ON(len >= facilities_len))
+                        return 0;
+                facilities_len -= len + 1;
+                p += len + 1;
         }
 
-        return 1;
+        return facilities_len == 0;
 }
 
 static int rose_create_facilities(unsigned char *buffer, struct rose_sock *rose)