Merge branch 'linus' into sched/core

Merge reason: merge the latest fixes, update to -rc4.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

9 files changed, 104 insertions, 13 deletions

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 9796f3ed1edb..cbddd0cb83f1 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -47,6 +47,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
@@ -82,6 +83,41 @@ struct compat_x25_subscrip_struct {
 };
 #endif
 
+
+int x25_parse_address_block(struct sk_buff *skb,
+                struct x25_address *called_addr,
+                struct x25_address *calling_addr)
+{
+        unsigned char len;
+        int needed;
+        int rc;
+
+        if (skb->len < 1) {
+                /* packet has no address block */
+                rc = 0;
+                goto empty;
+        }
+
+        len = *skb->data;
+        needed = 1 + (len >> 4) + (len & 0x0f);
+
+        if (skb->len < needed) {
+                /* packet is too short to hold the addresses it claims
+                   to hold */
+                rc = -1;
+                goto empty;
+        }
+
+        return x25_addr_ntoa(skb->data, called_addr, calling_addr);
+
+empty:
+        *called_addr->x25_addr = 0;
+        *calling_addr->x25_addr = 0;
+
+        return rc;
+}
+
+
 int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
                   struct x25_address *calling_addr)
 {
@@ -553,7 +589,8 @@ static int x25_create(struct net *net, struct socket *sock, int protocol,
         x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
         x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
         x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
-        x25->facilities.throughput  = X25_DEFAULT_THROUGHPUT;
+        x25->facilities.throughput  = 0;        /* by default don't negotiate
+                                                   throughput */
         x25->facilities.reverse     = X25_DEFAULT_REVERSE;
         x25->dte_facilities.calling_len = 0;
         x25->dte_facilities.called_len = 0;
@@ -921,16 +958,26 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         /*
          *      Extract the X.25 addresses and convert them to ASCII strings,
          *      and remove them.
+         *
+         *      Address block is mandatory in call request packets
          */
-        addr_len = x25_addr_ntoa(skb->data, &source_addr, &dest_addr);
+        addr_len = x25_parse_address_block(skb, &source_addr, &dest_addr);
+        if (addr_len <= 0)
+                goto out_clear_request;
         skb_pull(skb, addr_len);
 
         /*
          *      Get the length of the facilities, skip past them for the moment
          *      get the call user data because this is needed to determine
          *      the correct listener
+         *
+         *      Facilities length is mandatory in call request packets
          */
+        if (skb->len < 1)
+                goto out_clear_request;
         len = skb->data[0] + 1;
+        if (skb->len < len)
+                goto out_clear_request;
         skb_pull(skb,len);
 
         /*
@@ -1414,9 +1461,20 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (facilities.winsize_in < 1 ||
                             facilities.winsize_in > 127)
                                 break;
-                        if (facilities.throughput < 0x03 ||
-                            facilities.throughput > 0xDD)
-                                break;
+                        if (facilities.throughput) {
+                                int out = facilities.throughput & 0xf0;
+                                int in  = facilities.throughput & 0x0f;
+                                if (!out)
+                                        facilities.throughput |=
+                                                X25_DEFAULT_THROUGHPUT << 4;
+                                else if (out < 0x30 || out > 0xD0)
+                                        break;
+                                if (!in)
+                                        facilities.throughput |=
+                                                X25_DEFAULT_THROUGHPUT;
+                                else if (in < 0x03 || in > 0x0D)
+                                        break;
+                        }
                         if (facilities.reverse &&
                                 (facilities.reverse & 0x81) != 0x81)
                                 break;
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 52e304212241..b9ef682230a0 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -20,6 +20,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/if_arp.h>
 #include <net/x25.h>
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index a21f6646eb3a..771bab00754b 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -35,7 +35,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                 struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
 {
         unsigned char *p = skb->data;
-        unsigned int len = *p++;
+        unsigned int len;
 
         *vc_fac_mask = 0;
 
@@ -50,6 +50,14 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
         memset(dte_facs->called_ae, '\0', sizeof(dte_facs->called_ae));
         memset(dte_facs->calling_ae, '\0', sizeof(dte_facs->calling_ae));
 
+        if (skb->len < 1)
+                return 0;
+
+        len = *p++;
+
+        if (len >= skb->len)
+                return -1;
+
         while (len > 0) {
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
@@ -247,6 +255,8 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         memcpy(new, ours, sizeof(*new));
 
         len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
+        if (len < 0)
+                return len;
 
         /*
          *      They want reverse charging, we won't accept it.
@@ -259,9 +269,18 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         new->reverse = theirs.reverse;
 
         if (theirs.throughput) {
-                if (theirs.throughput < ours->throughput) {
-                        SOCK_DEBUG(sk, "X.25: throughput negotiated down\n");
-                        new->throughput = theirs.throughput;
+                int theirs_in =  theirs.throughput & 0x0f;
+                int theirs_out = theirs.throughput & 0xf0;
+                int ours_in  = ours->throughput & 0x0f;
+                int ours_out = ours->throughput & 0xf0;
+                if (!ours_in || theirs_in < ours_in) {
+                        SOCK_DEBUG(sk, "X.25: inbound throughput negotiated\n");
+                        new->throughput = (new->throughput & 0xf0) | theirs_in;
+                }
+                if (!ours_out || theirs_out < ours_out) {
+                        SOCK_DEBUG(sk,
+                                "X.25: outbound throughput negotiated\n");
+                        new->throughput = (new->throughput & 0x0f) | theirs_out;
                 }
         }
 
diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index 056a55f3a871..25a810793968 100644
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -10,6 +10,7 @@
  */
 #include <linux/if_arp.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/x25.h>
 
 LIST_HEAD(x25_forward_list);
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 96d922783547..372ac226e648 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -23,6 +23,7 @@
  *                                        i-frames.
  */
 
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -89,6 +90,7 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
 static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametype)
 {
         struct x25_address source_addr, dest_addr;
+        int len;
 
         switch (frametype) {
                 case X25_CALL_ACCEPTED: {
@@ -106,11 +108,17 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                          *      Parse the data in the frame.
                          */
                         skb_pull(skb, X25_STD_MIN_LEN);
-                        skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
-                        skb_pull(skb,
-                                 x25_parse_facilities(skb, &x25->facilities,
+
+                        len = x25_parse_address_block(skb, &source_addr,
+                                                &dest_addr);
+                        if (len > 0)
+                                skb_pull(skb, len);
+
+                        len = x25_parse_facilities(skb, &x25->facilities,
                                                 &x25->dte_facilities,
-                                                &x25->vc_facil_mask));
+                                                &x25->vc_facil_mask);
+                        if (len > 0)
+                                skb_pull(skb, len);
                         /*
                          *      Copy any Call User Data.
                          */
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index e4e1b6e49538..73e7b954ad28 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -24,6 +24,7 @@
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
diff --git a/net/x25/x25_out.c b/net/x25/x25_out.c
index 2b96b52114d6..52351a26b6fc 100644
--- a/net/x25/x25_out.c
+++ b/net/x25/x25_out.c
@@ -22,6 +22,7 @@
  *                                      needed cleaned seq-number fields.
  */
 
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/x25/x25_route.c b/net/x25/x25_route.c
index b95fae9ab393..97d77c532d8c 100644
--- a/net/x25/x25_route.c
+++ b/net/x25/x25_route.c
@@ -19,6 +19,7 @@
 
 #include <linux/if_arp.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/x25.h>
 
 LIST_HEAD(x25_route_list);
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 352b32d216fc..dc20cf12f39b 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -23,6 +23,7 @@
  *                                              restriction on response.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/skbuff.h>