1 files changed, 67 insertions, 17 deletions

diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index f60c0c2aacba..73aee7f2fcdc 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 #include <net/sock.h>
 
@@ -35,7 +36,6 @@
 
 /* Transport protocol registration */
 static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
 
 static struct phonet_protocol *phonet_proto_get(int protocol)
 {
@@ -44,11 +44,11 @@ static struct phonet_protocol *phonet_proto_get(int protocol)
         if (protocol >= PHONET_NPROTO)
                 return NULL;
 
-        spin_lock(&proto_tab_lock);
-        pp = proto_tab[protocol];
+        rcu_read_lock();
+        pp = rcu_dereference(proto_tab[protocol]);
         if (pp && !try_module_get(pp->prot->owner))
                 pp = NULL;
-        spin_unlock(&proto_tab_lock);
+        rcu_read_unlock();
 
         return pp;
 }
@@ -60,7 +60,8 @@ static inline void phonet_proto_put(struct phonet_protocol *pp)
 
 /* protocol family functions */
 
-static int pn_socket_create(struct net *net, struct socket *sock, int protocol)
+static int pn_socket_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
         struct pn_sock *pn;
@@ -118,7 +119,7 @@ out:
         return err;
 }
 
-static struct net_proto_family phonet_proto_family = {
+static const struct net_proto_family phonet_proto_family = {
         .family = PF_PHONET,
         .create = pn_socket_create,
         .owner = THIS_MODULE,
@@ -190,9 +191,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
         skb->priority = 0;
         skb->dev = dev;
 
-        if (pn_addr(src) == pn_addr(dst)) {
+        if (skb->pkt_type == PACKET_LOOPBACK) {
                 skb_reset_mac_header(skb);
-                skb->pkt_type = PACKET_LOOPBACK;
                 skb_orphan(skb);
                 if (irq)
                         netif_rx(skb);
@@ -222,6 +222,9 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
         if (skb == NULL)
                 return -ENOMEM;
 
+        if (phonet_address_lookup(dev_net(dev), pn_addr(dst)) == 0)
+                skb->pkt_type = PACKET_LOOPBACK;
+
         skb_reserve(skb, MAX_PHONET_HEADER);
         __skb_put(skb, len);
         skb_copy_to_linear_data(skb, data, len);
@@ -235,6 +238,7 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
                 const struct sockaddr_pn *target)
 {
+        struct net *net = sock_net(sk);
         struct net_device *dev;
         struct pn_sock *pn = pn_sk(sk);
         int err;
@@ -243,9 +247,13 @@ int pn_skb_send(struct sock *sk, struct sk_buff *skb,
 
         err = -EHOSTUNREACH;
         if (sk->sk_bound_dev_if)
-                dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
-        else
-                dev = phonet_device_get(sock_net(sk));
+                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+        else if (phonet_address_lookup(net, daddr) == 0) {
+                dev = phonet_device_get(net);
+                skb->pkt_type = PACKET_LOOPBACK;
+        } else
+                dev = phonet_route_output(net, daddr);
+
         if (!dev || !(dev->flags & IFF_UP))
                 goto drop;
 
@@ -369,6 +377,12 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         pn_skb_get_dst_sockaddr(skb, &sa);
 
+        /* check if this is broadcasted */
+        if (pn_sockaddr_get_addr(&sa) == PNADDR_BROADCAST) {
+                pn_deliver_sock_broadcast(net, skb);
+                goto out;
+        }
+
         /* check if we are the destination */
         if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
                 /* Phonet packet input */
@@ -381,6 +395,38 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
                         send_obj_unreachable(skb);
                         send_reset_indications(skb);
                 }
+        } else if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
+                goto out; /* Race between address deletion and loopback */
+        else {
+                /* Phonet packet routing */
+                struct net_device *out_dev;
+
+                out_dev = phonet_route_output(net, pn_sockaddr_get_addr(&sa));
+                if (!out_dev) {
+                        LIMIT_NETDEBUG(KERN_WARNING"No Phonet route to %02X\n",
+                                        pn_sockaddr_get_addr(&sa));
+                        goto out;
+                }
+
+                __skb_push(skb, sizeof(struct phonethdr));
+                skb->dev = out_dev;
+                if (out_dev == dev) {
+                        LIMIT_NETDEBUG(KERN_ERR"Phonet loop to %02X on %s\n",
+                                        pn_sockaddr_get_addr(&sa), dev->name);
+                        goto out_dev;
+                }
+                /* Some drivers (e.g. TUN) do not allocate HW header space */
+                if (skb_cow_head(skb, out_dev->hard_header_len))
+                        goto out_dev;
+
+                if (dev_hard_header(skb, out_dev, ETH_P_PHONET, NULL, NULL,
+                                        skb->len) < 0)
+                        goto out_dev;
+                dev_queue_xmit(skb);
+                dev_put(out_dev);
+                return NET_RX_SUCCESS;
+out_dev:
+                dev_put(out_dev);
         }
 
 out:
@@ -393,6 +439,8 @@ static struct packet_type phonet_packet_type __read_mostly = {
         .func = phonet_rcv,
 };
 
+static DEFINE_MUTEX(proto_tab_lock);
+
 int __init_or_module phonet_proto_register(int protocol,
                                                 struct phonet_protocol *pp)
 {
@@ -405,12 +453,12 @@ int __init_or_module phonet_proto_register(int protocol,
         if (err)
                 return err;
 
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
         if (proto_tab[protocol])
                 err = -EBUSY;
         else
-                proto_tab[protocol] = pp;
-        spin_unlock(&proto_tab_lock);
+                rcu_assign_pointer(proto_tab[protocol], pp);
+        mutex_unlock(&proto_tab_lock);
 
         return err;
 }
@@ -418,10 +466,11 @@ EXPORT_SYMBOL(phonet_proto_register);
 
 void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 {
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
         BUG_ON(proto_tab[protocol] != pp);
-        proto_tab[protocol] = NULL;
-        spin_unlock(&proto_tab_lock);
+        rcu_assign_pointer(proto_tab[protocol], NULL);
+        mutex_unlock(&proto_tab_lock);
+        synchronize_rcu();
         proto_unregister(pp->prot);
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
@@ -435,6 +484,7 @@ static int __init phonet_init(void)
         if (err)
                 return err;
 
+        pn_sock_init();
         err = sock_register(&phonet_proto_family);
         if (err) {
                 printk(KERN_ALERT