Skip to content

L
linux
Commit 5976fac2 authored by Jean Tourrilhes's avatar Jean Tourrilhes Committed by Linus Torvalds
Browse files
Options

[PATCH] IrDA skb leak fixes 

ir259_skb_get-7.diff :
		<Inspired by patches from Jan Kiszka>
	o [CORRECT] Fix skb leaks in IrDA state machines
	o [CORRECT] Fix skb leaks in connect/request error paths
	o [FEATURE] Fix skb leaks in ASSERT
	o [FEATURE] Simplify & document skb handling throughout the stack
	o [FEATURE] other minor cleanups
parent ace40f57
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 553 additions and 413 deletions
include/net/irda/iriap.h
View file @ 5976fac2
...@@ -66,7 +66,7 @@ struct iriap_cb { ...@@ -66,7 +66,7 @@ struct iriap_cb {
__u32 daddr; __u32 daddr;
__u8 operation; __u8 operation;
struct sk_buff *skb; struct sk_buff *request_skb;
struct lsap_cb *lsap; struct lsap_cb *lsap;
__u8 slsap_sel; __u8 slsap_sel;
......
include/net/irda/irlmp_event.h
View file @ 5976fac2
...@@ -79,26 +79,6 @@ typedef enum { ...@@ -79,26 +79,6 @@ typedef enum {
LM_LAP_IDLE_TIMEOUT, LM_LAP_IDLE_TIMEOUT,
} IRLMP_EVENT; } IRLMP_EVENT;
/*
* Information which is used by the current thread, when executing in the
* state machine.
*/
struct irlmp_event {
IRLMP_EVENT *event;
struct sk_buff *skb;
__u8 hint;
__u32 daddr;
__u32 saddr;
__u8 slsap;
__u8 dlsap;
int reason;
struct discovery_t *discovery;
};
extern const char *irlmp_state[]; extern const char *irlmp_state[];
extern const char *irlsap_state[]; extern const char *irlsap_state[];
......
net/irda/af_irda.c
View file @ 5976fac2
...@@ -11,7 +11,7 @@ ...@@ -11,7 +11,7 @@
* Sources: af_netroom.c, af_ax25.c, af_rose.c, af_x25.c etc. * Sources: af_netroom.c, af_ax25.c, af_rose.c, af_x25.c etc.
* *
* Copyright (c) 1999 Dag Brattli <dagb@cs.uit.no> * Copyright (c) 1999 Dag Brattli <dagb@cs.uit.no>
* Copyright (c) 1999-2001 Jean Tourrilhes <jt@hpl.hp.com> * Copyright (c) 1999-2003 Jean Tourrilhes <jt@hpl.hp.com>
* All Rights Reserved. * All Rights Reserved.
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
...@@ -190,6 +190,9 @@ static void irda_connect_confirm(void *instance, void *sap, ...@@ -190,6 +190,9 @@ static void irda_connect_confirm(void *instance, void *sap,
if (sk == NULL) if (sk == NULL)
return; return;
dev_kfree_skb(skb);
// Should be ??? skb_queue_tail(&sk->receive_queue, skb);
/* How much header space do we need to reserve */ /* How much header space do we need to reserve */
self->max_header_size = max_header_size; self->max_header_size = max_header_size;
...@@ -220,8 +223,6 @@ static void irda_connect_confirm(void *instance, void *sap, ...@@ -220,8 +223,6 @@ static void irda_connect_confirm(void *instance, void *sap,
self->max_data_size); self->max_data_size);
memcpy(&self->qos_tx, qos, sizeof(struct qos_info)); memcpy(&self->qos_tx, qos, sizeof(struct qos_info));
dev_kfree_skb(skb);
// Should be ??? skb_queue_tail(&sk->receive_queue, skb);
/* We are now connected! */ /* We are now connected! */
sk->state = TCP_ESTABLISHED; sk->state = TCP_ESTABLISHED;
...@@ -260,6 +261,7 @@ static void irda_connect_indication(void *instance, void *sap, ...@@ -260,6 +261,7 @@ static void irda_connect_indication(void *instance, void *sap,
case SOCK_STREAM: case SOCK_STREAM:
if (max_sdu_size != 0) { if (max_sdu_size != 0) {
ERROR("%s: max_sdu_size must be 0\n", __FUNCTION__); ERROR("%s: max_sdu_size must be 0\n", __FUNCTION__);
kfree_skb(skb);
return; return;
} }
self->max_data_size = irttp_get_max_seg_size(self->tsap); self->max_data_size = irttp_get_max_seg_size(self->tsap);
...@@ -267,6 +269,7 @@ static void irda_connect_indication(void *instance, void *sap, ...@@ -267,6 +269,7 @@ static void irda_connect_indication(void *instance, void *sap,
case SOCK_SEQPACKET: case SOCK_SEQPACKET:
if (max_sdu_size == 0) { if (max_sdu_size == 0) {
ERROR("%s: max_sdu_size cannot be 0\n", __FUNCTION__); ERROR("%s: max_sdu_size cannot be 0\n", __FUNCTION__);
kfree_skb(skb);
return; return;
} }
self->max_data_size = max_sdu_size; self->max_data_size = max_sdu_size;
...@@ -359,7 +362,7 @@ static void irda_flow_indication(void *instance, void *sap, LOCAL_FLOW flow) ...@@ -359,7 +362,7 @@ static void irda_flow_indication(void *instance, void *sap, LOCAL_FLOW flow)
* doesn't touch the dtsap_sel and save the full value structure... * doesn't touch the dtsap_sel and save the full value structure...
*/ */
static void irda_getvalue_confirm(int result, __u16 obj_id, static void irda_getvalue_confirm(int result, __u16 obj_id,
struct ias_value *value, void *priv) struct ias_value *value, void *priv)
{ {
struct irda_sock *self; struct irda_sock *self;
...@@ -908,6 +911,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags) ...@@ -908,6 +911,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
new->tsap = irttp_dup(self->tsap, new); new->tsap = irttp_dup(self->tsap, new);
if (!new->tsap) { if (!new->tsap) {
IRDA_DEBUG(0, "%s(), dup failed!\n", __FUNCTION__); IRDA_DEBUG(0, "%s(), dup failed!\n", __FUNCTION__);
kfree_skb(skb);
return -1; return -1;
} }
...@@ -926,6 +930,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags) ...@@ -926,6 +930,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
/* Clean up the original one to keep it in listen state */ /* Clean up the original one to keep it in listen state */
irttp_listen(self->tsap); irttp_listen(self->tsap);
/* Wow ! What is that ? Jean II */
skb->sk = NULL; skb->sk = NULL;
skb->destructor = NULL; skb->destructor = NULL;
kfree_skb(skb); kfree_skb(skb);
......
net/irda/ircomm/ircomm_core.c
View file @ 5976fac2
...@@ -10,6 +10,7 @@ ...@@ -10,6 +10,7 @@
* Modified by: Dag Brattli <dagb@cs.uit.no> * Modified by: Dag Brattli <dagb@cs.uit.no>
* *
* Copyright (c) 1999 Dag Brattli, All Rights Reserved. * Copyright (c) 1999 Dag Brattli, All Rights Reserved.
* Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -251,7 +252,6 @@ void ircomm_connect_indication(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -251,7 +252,6 @@ void ircomm_connect_indication(struct ircomm_cb *self, struct sk_buff *skb,
info->max_header_size, skb); info->max_header_size, skb);
else { else {
IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ );
dev_kfree_skb(skb);
} }
} }
...@@ -295,7 +295,6 @@ void ircomm_connect_confirm(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -295,7 +295,6 @@ void ircomm_connect_confirm(struct ircomm_cb *self, struct sk_buff *skb,
info->max_header_size, skb); info->max_header_size, skb);
else { else {
IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ );
dev_kfree_skb(skb);
} }
} }
...@@ -338,7 +337,6 @@ void ircomm_data_indication(struct ircomm_cb *self, struct sk_buff *skb) ...@@ -338,7 +337,6 @@ void ircomm_data_indication(struct ircomm_cb *self, struct sk_buff *skb)
self->notify.data_indication(self->notify.instance, self, skb); self->notify.data_indication(self->notify.instance, self, skb);
else { else {
IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ );
dev_kfree_skb(skb);
} }
} }
...@@ -370,9 +368,8 @@ void ircomm_process_data(struct ircomm_cb *self, struct sk_buff *skb) ...@@ -370,9 +368,8 @@ void ircomm_process_data(struct ircomm_cb *self, struct sk_buff *skb)
if (skb->len) if (skb->len)
ircomm_data_indication(self, skb); ircomm_data_indication(self, skb);
else { else {
IRDA_DEBUG(4, IRDA_DEBUG(4, "%s(), data was control info only!\n",
"%s(), data was control info only!\n", __FUNCTION__ ); __FUNCTION__ );
dev_kfree_skb(skb);
} }
} }
...@@ -408,24 +405,28 @@ EXPORT_SYMBOL(ircomm_control_request); ...@@ -408,24 +405,28 @@ EXPORT_SYMBOL(ircomm_control_request);
static void ircomm_control_indication(struct ircomm_cb *self, static void ircomm_control_indication(struct ircomm_cb *self,
struct sk_buff *skb, int clen) struct sk_buff *skb, int clen)
{ {
struct sk_buff *ctrl_skb;
IRDA_DEBUG(2, "%s()\n", __FUNCTION__ ); IRDA_DEBUG(2, "%s()\n", __FUNCTION__ );
ctrl_skb = skb_clone(skb, GFP_ATOMIC); /* Use udata for delivering data on the control channel */
if (!ctrl_skb) if (self->notify.udata_indication) {
return; struct sk_buff *ctrl_skb;
/* We don't own the skb, so clone it */
ctrl_skb = skb_clone(skb, GFP_ATOMIC);
if (!ctrl_skb)
return;
/* Remove data channel from control channel */ /* Remove data channel from control channel */
skb_trim(ctrl_skb, clen+1); skb_trim(ctrl_skb, clen+1);
/* Use udata for delivering data on the control channel */
if (self->notify.udata_indication)
self->notify.udata_indication(self->notify.instance, self, self->notify.udata_indication(self->notify.instance, self,
ctrl_skb); ctrl_skb);
else {
/* Drop reference count -
* see ircomm_tty_control_indication(). */
dev_kfree_skb(ctrl_skb);
} else {
IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ );
dev_kfree_skb(skb);
} }
} }
...@@ -470,7 +471,6 @@ void ircomm_disconnect_indication(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -470,7 +471,6 @@ void ircomm_disconnect_indication(struct ircomm_cb *self, struct sk_buff *skb,
info->reason, skb); info->reason, skb);
} else { } else {
IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s(), missing handler\n", __FUNCTION__ );
dev_kfree_skb(skb);
} }
} }
......
net/irda/ircomm/ircomm_event.c
View file @ 5976fac2
...@@ -109,9 +109,7 @@ static int ircomm_state_idle(struct ircomm_cb *self, IRCOMM_EVENT event, ...@@ -109,9 +109,7 @@ static int ircomm_state_idle(struct ircomm_cb *self, IRCOMM_EVENT event,
default: default:
IRDA_DEBUG(4, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(4, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_event[event]); ircomm_event[event]);
if (skb) ret = -EINVAL;
dev_kfree_skb(skb);
return -EINVAL;
} }
return ret; return ret;
} }
...@@ -141,8 +139,6 @@ static int ircomm_state_waiti(struct ircomm_cb *self, IRCOMM_EVENT event, ...@@ -141,8 +139,6 @@ static int ircomm_state_waiti(struct ircomm_cb *self, IRCOMM_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(0, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_event[event]); ircomm_event[event]);
if (skb)
dev_kfree_skb(skb);
ret = -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
...@@ -176,8 +172,6 @@ static int ircomm_state_waitr(struct ircomm_cb *self, IRCOMM_EVENT event, ...@@ -176,8 +172,6 @@ static int ircomm_state_waitr(struct ircomm_cb *self, IRCOMM_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), unknown event = %s\n", __FUNCTION__ , IRDA_DEBUG(0, "%s(), unknown event = %s\n", __FUNCTION__ ,
ircomm_event[event]); ircomm_event[event]);
if (skb)
dev_kfree_skb(skb);
ret = -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
...@@ -220,8 +214,6 @@ static int ircomm_state_conn(struct ircomm_cb *self, IRCOMM_EVENT event, ...@@ -220,8 +214,6 @@ static int ircomm_state_conn(struct ircomm_cb *self, IRCOMM_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), unknown event = %s\n", __FUNCTION__ , IRDA_DEBUG(0, "%s(), unknown event = %s\n", __FUNCTION__ ,
ircomm_event[event]); ircomm_event[event]);
if (skb)
dev_kfree_skb(skb);
ret = -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
......
net/irda/ircomm/ircomm_lmp.c
View file @ 5976fac2
...@@ -11,6 +11,7 @@ ...@@ -11,6 +11,7 @@
* Sources: Previous IrLPT work by Thomas Davis * Sources: Previous IrLPT work by Thomas Davis
* *
* Copyright (c) 1999 Dag Brattli, All Rights Reserved. * Copyright (c) 1999 Dag Brattli, All Rights Reserved.
* Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -93,6 +94,10 @@ int ircomm_lmp_connect_request(struct ircomm_cb *self, ...@@ -93,6 +94,10 @@ int ircomm_lmp_connect_request(struct ircomm_cb *self,
IRDA_DEBUG(0, "%s()\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s()\n", __FUNCTION__ );
/* Don't forget to refcount it - should be NULL anyway */
if(userdata)
skb_get(userdata);
ret = irlmp_connect_request(self->lsap, info->dlsap_sel, ret = irlmp_connect_request(self->lsap, info->dlsap_sel,
info->saddr, info->daddr, NULL, userdata); info->saddr, info->daddr, NULL, userdata);
return ret; return ret;
...@@ -106,29 +111,32 @@ int ircomm_lmp_connect_request(struct ircomm_cb *self, ...@@ -106,29 +111,32 @@ int ircomm_lmp_connect_request(struct ircomm_cb *self,
*/ */
int ircomm_lmp_connect_response(struct ircomm_cb *self, struct sk_buff *userdata) int ircomm_lmp_connect_response(struct ircomm_cb *self, struct sk_buff *userdata)
{ {
struct sk_buff *skb; struct sk_buff *tx_skb;
int ret; int ret;
IRDA_DEBUG(0, "%s()\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s()\n", __FUNCTION__ );
/* Any userdata supplied? */ /* Any userdata supplied? */
if (userdata == NULL) { if (userdata == NULL) {
skb = dev_alloc_skb(64); tx_skb = dev_alloc_skb(64);
if (!skb) if (!tx_skb)
return -ENOMEM; return -ENOMEM;
/* Reserve space for MUX and LAP header */ /* Reserve space for MUX and LAP header */
skb_reserve(skb, LMP_MAX_HEADER); skb_reserve(tx_skb, LMP_MAX_HEADER);
} else { } else {
skb = userdata;
/* /*
* Check that the client has reserved enough space for * Check that the client has reserved enough space for
* headers * headers
*/ */
ASSERT(skb_headroom(skb) >= LMP_MAX_HEADER, return -1;); ASSERT(skb_headroom(userdata) >= LMP_MAX_HEADER, return -1;);
/* Don't forget to refcount it - should be NULL anyway */
skb_get(userdata);
tx_skb = userdata;
} }
ret = irlmp_connect_response(self->lsap, skb); ret = irlmp_connect_response(self->lsap, tx_skb);
return 0; return 0;
} }
...@@ -137,20 +145,24 @@ int ircomm_lmp_disconnect_request(struct ircomm_cb *self, ...@@ -137,20 +145,24 @@ int ircomm_lmp_disconnect_request(struct ircomm_cb *self,
struct sk_buff *userdata, struct sk_buff *userdata,
struct ircomm_info *info) struct ircomm_info *info)
{ {
struct sk_buff *skb; struct sk_buff *tx_skb;
int ret; int ret;
IRDA_DEBUG(0, "%s()\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s()\n", __FUNCTION__ );
if (!userdata) { if (!userdata) {
skb = dev_alloc_skb(64); tx_skb = dev_alloc_skb(64);
if (!skb) if (!tx_skb)
return -ENOMEM; return -ENOMEM;
/* Reserve space for MUX and LAP header */ /* Reserve space for MUX and LAP header */
skb_reserve(skb, LMP_MAX_HEADER); skb_reserve(tx_skb, LMP_MAX_HEADER);
userdata = skb; userdata = tx_skb;
} else {
/* Don't forget to refcount it - should be NULL anyway */
skb_get(userdata);
} }
ret = irlmp_disconnect_request(self->lsap, userdata); ret = irlmp_disconnect_request(self->lsap, userdata);
return ret; return ret;
...@@ -217,8 +229,11 @@ int ircomm_lmp_data_request(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -217,8 +229,11 @@ int ircomm_lmp_data_request(struct ircomm_cb *self, struct sk_buff *skb,
IRDA_DEBUG(4, "%s(), sending frame\n", __FUNCTION__ ); IRDA_DEBUG(4, "%s(), sending frame\n", __FUNCTION__ );
/* Don't forget to refcount it - see ircomm_tty_do_softint() */
skb_get(skb);
skb->destructor = ircomm_lmp_flow_control; skb->destructor = ircomm_lmp_flow_control;
if ((self->pkt_count++ > 7) && (self->flow_status == FLOW_START)) { if ((self->pkt_count++ > 7) && (self->flow_status == FLOW_START)) {
IRDA_DEBUG(2, "%s(), asking TTY to slow down!\n", __FUNCTION__ ); IRDA_DEBUG(2, "%s(), asking TTY to slow down!\n", __FUNCTION__ );
self->flow_status = FLOW_STOP; self->flow_status = FLOW_STOP;
...@@ -229,7 +244,7 @@ int ircomm_lmp_data_request(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -229,7 +244,7 @@ int ircomm_lmp_data_request(struct ircomm_cb *self, struct sk_buff *skb,
ret = irlmp_data_request(self->lsap, skb); ret = irlmp_data_request(self->lsap, skb);
if (ret) { if (ret) {
ERROR("%s(), failed\n", __FUNCTION__); ERROR("%s(), failed\n", __FUNCTION__);
dev_kfree_skb(skb); /* irlmp_data_request already free the packet */
} }
return ret; return ret;
...@@ -254,6 +269,9 @@ int ircomm_lmp_data_indication(void *instance, void *sap, ...@@ -254,6 +269,9 @@ int ircomm_lmp_data_indication(void *instance, void *sap,
ircomm_do_event(self, IRCOMM_LMP_DATA_INDICATION, skb, NULL); ircomm_do_event(self, IRCOMM_LMP_DATA_INDICATION, skb, NULL);
/* Drop reference count - see ircomm_tty_data_indication(). */
dev_kfree_skb(skb);
return 0; return 0;
} }
...@@ -285,6 +303,9 @@ void ircomm_lmp_connect_confirm(void *instance, void *sap, ...@@ -285,6 +303,9 @@ void ircomm_lmp_connect_confirm(void *instance, void *sap,
info.qos = qos; info.qos = qos;
ircomm_do_event(self, IRCOMM_LMP_CONNECT_CONFIRM, skb, &info); ircomm_do_event(self, IRCOMM_LMP_CONNECT_CONFIRM, skb, &info);
/* Drop reference count - see ircomm_tty_connect_confirm(). */
dev_kfree_skb(skb);
} }
/* /*
...@@ -315,6 +336,9 @@ void ircomm_lmp_connect_indication(void *instance, void *sap, ...@@ -315,6 +336,9 @@ void ircomm_lmp_connect_indication(void *instance, void *sap,
info.qos = qos; info.qos = qos;
ircomm_do_event(self, IRCOMM_LMP_CONNECT_INDICATION, skb, &info); ircomm_do_event(self, IRCOMM_LMP_CONNECT_INDICATION, skb, &info);
/* Drop reference count - see ircomm_tty_connect_indication(). */
dev_kfree_skb(skb);
} }
/* /*
...@@ -338,4 +362,8 @@ void ircomm_lmp_disconnect_indication(void *instance, void *sap, ...@@ -338,4 +362,8 @@ void ircomm_lmp_disconnect_indication(void *instance, void *sap,
info.reason = reason; info.reason = reason;
ircomm_do_event(self, IRCOMM_LMP_DISCONNECT_INDICATION, skb, &info); ircomm_do_event(self, IRCOMM_LMP_DISCONNECT_INDICATION, skb, &info);
/* Drop reference count - see ircomm_tty_disconnect_indication(). */
if(skb)
dev_kfree_skb(skb);
} }
net/irda/ircomm/ircomm_ttp.c
View file @ 5976fac2
...@@ -10,6 +10,7 @@ ...@@ -10,6 +10,7 @@
* Modified by: Dag Brattli <dagb@cs.uit.no> * Modified by: Dag Brattli <dagb@cs.uit.no>
* *
* Copyright (c) 1999 Dag Brattli, All Rights Reserved. * Copyright (c) 1999 Dag Brattli, All Rights Reserved.
* Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -94,9 +95,14 @@ int ircomm_ttp_connect_request(struct ircomm_cb *self, ...@@ -94,9 +95,14 @@ int ircomm_ttp_connect_request(struct ircomm_cb *self,
IRDA_DEBUG(4, "%s()\n", __FUNCTION__ ); IRDA_DEBUG(4, "%s()\n", __FUNCTION__ );
/* Don't forget to refcount it - should be NULL anyway */
if(userdata)
skb_get(userdata);
ret = irttp_connect_request(self->tsap, info->dlsap_sel, ret = irttp_connect_request(self->tsap, info->dlsap_sel,
info->saddr, info->daddr, NULL, info->saddr, info->daddr, NULL,
TTP_SAR_DISABLE, userdata); TTP_SAR_DISABLE, userdata);
return ret; return ret;
} }
...@@ -106,13 +112,18 @@ int ircomm_ttp_connect_request(struct ircomm_cb *self, ...@@ -106,13 +112,18 @@ int ircomm_ttp_connect_request(struct ircomm_cb *self,
* *
* *
*/ */
int ircomm_ttp_connect_response(struct ircomm_cb *self, struct sk_buff *skb) int ircomm_ttp_connect_response(struct ircomm_cb *self,
struct sk_buff *userdata)
{ {
int ret; int ret;
IRDA_DEBUG(4, "%s()\n", __FUNCTION__ ); IRDA_DEBUG(4, "%s()\n", __FUNCTION__ );
ret = irttp_connect_response(self->tsap, TTP_SAR_DISABLE, skb); /* Don't forget to refcount it - should be NULL anyway */
if(userdata)
skb_get(userdata);
ret = irttp_connect_response(self->tsap, TTP_SAR_DISABLE, userdata);
return ret; return ret;
} }
...@@ -126,7 +137,8 @@ int ircomm_ttp_connect_response(struct ircomm_cb *self, struct sk_buff *skb) ...@@ -126,7 +137,8 @@ int ircomm_ttp_connect_response(struct ircomm_cb *self, struct sk_buff *skb)
* some of them are sent after connection establishment, so this can * some of them are sent after connection establishment, so this can
* increase the latency a bit. * increase the latency a bit.
*/ */
int ircomm_ttp_data_request(struct ircomm_cb *self, struct sk_buff *skb, int ircomm_ttp_data_request(struct ircomm_cb *self,
struct sk_buff *skb,
int clen) int clen)
{ {
int ret; int ret;
...@@ -140,6 +152,10 @@ int ircomm_ttp_data_request(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -140,6 +152,10 @@ int ircomm_ttp_data_request(struct ircomm_cb *self, struct sk_buff *skb,
* only frames, to make things easier and avoid queueing * only frames, to make things easier and avoid queueing
*/ */
ASSERT(skb_headroom(skb) >= IRCOMM_HEADER_SIZE, return -1;); ASSERT(skb_headroom(skb) >= IRCOMM_HEADER_SIZE, return -1;);
/* Don't forget to refcount it - see ircomm_tty_do_softint() */
skb_get(skb);
skb_push(skb, IRCOMM_HEADER_SIZE); skb_push(skb, IRCOMM_HEADER_SIZE);
skb->data[0] = clen; skb->data[0] = clen;
...@@ -147,7 +163,7 @@ int ircomm_ttp_data_request(struct ircomm_cb *self, struct sk_buff *skb, ...@@ -147,7 +163,7 @@ int ircomm_ttp_data_request(struct ircomm_cb *self, struct sk_buff *skb,
ret = irttp_data_request(self->tsap, skb); ret = irttp_data_request(self->tsap, skb);
if (ret) { if (ret) {
ERROR("%s(), failed\n", __FUNCTION__); ERROR("%s(), failed\n", __FUNCTION__);
dev_kfree_skb(skb); /* irttp_data_request already free the packet */
} }
return ret; return ret;
...@@ -172,6 +188,9 @@ int ircomm_ttp_data_indication(void *instance, void *sap, ...@@ -172,6 +188,9 @@ int ircomm_ttp_data_indication(void *instance, void *sap,
ircomm_do_event(self, IRCOMM_TTP_DATA_INDICATION, skb, NULL); ircomm_do_event(self, IRCOMM_TTP_DATA_INDICATION, skb, NULL);
/* Drop reference count - see ircomm_tty_data_indication(). */
dev_kfree_skb(skb);
return 0; return 0;
} }
...@@ -189,12 +208,11 @@ void ircomm_ttp_connect_confirm(void *instance, void *sap, ...@@ -189,12 +208,11 @@ void ircomm_ttp_connect_confirm(void *instance, void *sap,
ASSERT(self != NULL, return;); ASSERT(self != NULL, return;);
ASSERT(self->magic == IRCOMM_MAGIC, return;); ASSERT(self->magic == IRCOMM_MAGIC, return;);
ASSERT(skb != NULL, return;); ASSERT(skb != NULL, return;);
ASSERT(qos != NULL, return;); ASSERT(qos != NULL, goto out;);
if (max_sdu_size != TTP_SAR_DISABLE) { if (max_sdu_size != TTP_SAR_DISABLE) {
ERROR("%s(), SAR not allowed for IrCOMM!\n", __FUNCTION__); ERROR("%s(), SAR not allowed for IrCOMM!\n", __FUNCTION__);
dev_kfree_skb(skb); goto out;
return;
} }
info.max_data_size = irttp_get_max_seg_size(self->tsap) info.max_data_size = irttp_get_max_seg_size(self->tsap)
...@@ -203,6 +221,10 @@ void ircomm_ttp_connect_confirm(void *instance, void *sap, ...@@ -203,6 +221,10 @@ void ircomm_ttp_connect_confirm(void *instance, void *sap,
info.qos = qos; info.qos = qos;
ircomm_do_event(self, IRCOMM_TTP_CONNECT_CONFIRM, skb, &info); ircomm_do_event(self, IRCOMM_TTP_CONNECT_CONFIRM, skb, &info);
out:
/* Drop reference count - see ircomm_tty_connect_confirm(). */
dev_kfree_skb(skb);
} }
/* /*
...@@ -226,12 +248,11 @@ void ircomm_ttp_connect_indication(void *instance, void *sap, ...@@ -226,12 +248,11 @@ void ircomm_ttp_connect_indication(void *instance, void *sap,
ASSERT(self != NULL, return;); ASSERT(self != NULL, return;);
ASSERT(self->magic == IRCOMM_MAGIC, return;); ASSERT(self->magic == IRCOMM_MAGIC, return;);
ASSERT(skb != NULL, return;); ASSERT(skb != NULL, return;);
ASSERT(qos != NULL, return;); ASSERT(qos != NULL, goto out;);
if (max_sdu_size != TTP_SAR_DISABLE) { if (max_sdu_size != TTP_SAR_DISABLE) {
ERROR("%s(), SAR not allowed for IrCOMM!\n", __FUNCTION__); ERROR("%s(), SAR not allowed for IrCOMM!\n", __FUNCTION__);
dev_kfree_skb(skb); goto out;
return;
} }
info.max_data_size = irttp_get_max_seg_size(self->tsap) info.max_data_size = irttp_get_max_seg_size(self->tsap)
...@@ -240,6 +261,10 @@ void ircomm_ttp_connect_indication(void *instance, void *sap, ...@@ -240,6 +261,10 @@ void ircomm_ttp_connect_indication(void *instance, void *sap,
info.qos = qos; info.qos = qos;
ircomm_do_event(self, IRCOMM_TTP_CONNECT_INDICATION, skb, &info); ircomm_do_event(self, IRCOMM_TTP_CONNECT_INDICATION, skb, &info);
out:
/* Drop reference count - see ircomm_tty_connect_indication(). */
dev_kfree_skb(skb);
} }
/* /*
...@@ -254,6 +279,10 @@ int ircomm_ttp_disconnect_request(struct ircomm_cb *self, ...@@ -254,6 +279,10 @@ int ircomm_ttp_disconnect_request(struct ircomm_cb *self,
{ {
int ret; int ret;
/* Don't forget to refcount it - should be NULL anyway */
if(userdata)
skb_get(userdata);
ret = irttp_disconnect_request(self->tsap, userdata, P_NORMAL); ret = irttp_disconnect_request(self->tsap, userdata, P_NORMAL);
return ret; return ret;
...@@ -280,6 +309,10 @@ void ircomm_ttp_disconnect_indication(void *instance, void *sap, ...@@ -280,6 +309,10 @@ void ircomm_ttp_disconnect_indication(void *instance, void *sap,
info.reason = reason; info.reason = reason;
ircomm_do_event(self, IRCOMM_TTP_DISCONNECT_INDICATION, skb, &info); ircomm_do_event(self, IRCOMM_TTP_DISCONNECT_INDICATION, skb, &info);
/* Drop reference count - see ircomm_tty_disconnect_indication(). */
if(skb)
dev_kfree_skb(skb);
} }
/* /*
......
net/irda/ircomm/ircomm_tty.c
View file @ 5976fac2
...@@ -11,6 +11,7 @@ ...@@ -11,6 +11,7 @@
* Sources: serial.c and previous IrCOMM work by Takahide Higuchi * Sources: serial.c and previous IrCOMM work by Takahide Higuchi
* *
* Copyright (c) 1999-2000 Dag Brattli, All Rights Reserved. * Copyright (c) 1999-2000 Dag Brattli, All Rights Reserved.
* Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -663,8 +664,12 @@ static void ircomm_tty_do_softint(void *private_) ...@@ -663,8 +664,12 @@ static void ircomm_tty_do_softint(void *private_)
spin_unlock_irqrestore(&self->spinlock, flags); spin_unlock_irqrestore(&self->spinlock, flags);
/* Flush control buffer if any */ /* Flush control buffer if any */
if (ctrl_skb && self->flow == FLOW_START) if(ctrl_skb) {
ircomm_control_request(self->ircomm, ctrl_skb); if(self->flow == FLOW_START)
ircomm_control_request(self->ircomm, ctrl_skb);
/* Drop reference count - see ircomm_ttp_data_request(). */
dev_kfree_skb(ctrl_skb);
}
if (tty->hw_stopped) if (tty->hw_stopped)
return; return;
...@@ -678,8 +683,11 @@ static void ircomm_tty_do_softint(void *private_) ...@@ -678,8 +683,11 @@ static void ircomm_tty_do_softint(void *private_)
spin_unlock_irqrestore(&self->spinlock, flags); spin_unlock_irqrestore(&self->spinlock, flags);
/* Flush transmit buffer if any */ /* Flush transmit buffer if any */
if (skb) if (skb) {
ircomm_tty_do_event(self, IRCOMM_TTY_DATA_REQUEST, skb, NULL); ircomm_tty_do_event(self, IRCOMM_TTY_DATA_REQUEST, skb, NULL);
/* Drop reference count - see ircomm_ttp_data_request(). */
dev_kfree_skb(skb);
}
/* Check if user (still) wants to be waken up */ /* Check if user (still) wants to be waken up */
if ((tty->flags & (1 << TTY_DO_WRITE_WAKEUP)) && if ((tty->flags & (1 << TTY_DO_WRITE_WAKEUP)) &&
...@@ -1179,7 +1187,6 @@ static int ircomm_tty_data_indication(void *instance, void *sap, ...@@ -1179,7 +1187,6 @@ static int ircomm_tty_data_indication(void *instance, void *sap,
if (!self->tty) { if (!self->tty) {
IRDA_DEBUG(0, "%s(), no tty!\n", __FUNCTION__ ); IRDA_DEBUG(0, "%s(), no tty!\n", __FUNCTION__ );
dev_kfree_skb(skb);
return 0; return 0;
} }
...@@ -1204,7 +1211,8 @@ static int ircomm_tty_data_indication(void *instance, void *sap, ...@@ -1204,7 +1211,8 @@ static int ircomm_tty_data_indication(void *instance, void *sap,
* handler * handler
*/ */
self->tty->ldisc.receive_buf(self->tty, skb->data, NULL, skb->len); self->tty->ldisc.receive_buf(self->tty, skb->data, NULL, skb->len);
dev_kfree_skb(skb);
/* No need to kfree_skb - see ircomm_ttp_data_indication() */
return 0; return 0;
} }
...@@ -1231,7 +1239,8 @@ static int ircomm_tty_control_indication(void *instance, void *sap, ...@@ -1231,7 +1239,8 @@ static int ircomm_tty_control_indication(void *instance, void *sap,
irda_param_extract_all(self, skb->data+1, IRDA_MIN(skb->len-1, clen), irda_param_extract_all(self, skb->data+1, IRDA_MIN(skb->len-1, clen),
&ircomm_param_info); &ircomm_param_info);
dev_kfree_skb(skb);
/* No need to kfree_skb - see ircomm_control_indication() */
return 0; return 0;
} }
......
net/irda/ircomm/ircomm_tty_attach.c
View file @ 5976fac2
...@@ -10,6 +10,7 @@ ...@@ -10,6 +10,7 @@
* Modified by: Dag Brattli <dagb@cs.uit.no> * Modified by: Dag Brattli <dagb@cs.uit.no>
* *
* Copyright (c) 1999-2000 Dag Brattli, All Rights Reserved. * Copyright (c) 1999-2000 Dag Brattli, All Rights Reserved.
* Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -236,8 +237,9 @@ static void ircomm_tty_ias_register(struct ircomm_tty_cb *self) ...@@ -236,8 +237,9 @@ static void ircomm_tty_ias_register(struct ircomm_tty_cb *self)
irias_insert_object(self->obj); irias_insert_object(self->obj);
} }
self->skey = irlmp_register_service(hints); self->skey = irlmp_register_service(hints);
self->ckey = irlmp_register_client( self->ckey = irlmp_register_client(hints,
hints, ircomm_tty_discovery_indication, NULL, (void *) self); ircomm_tty_discovery_indication,
NULL, (void *) self);
} }
/* /*
...@@ -459,7 +461,7 @@ void ircomm_tty_connect_confirm(void *instance, void *sap, ...@@ -459,7 +461,7 @@ void ircomm_tty_connect_confirm(void *instance, void *sap,
ircomm_tty_do_event(self, IRCOMM_TTY_CONNECT_CONFIRM, NULL, NULL); ircomm_tty_do_event(self, IRCOMM_TTY_CONNECT_CONFIRM, NULL, NULL);
dev_kfree_skb(skb); /* No need to kfree_skb - see ircomm_ttp_connect_confirm() */
} }
/* /*
...@@ -496,7 +498,7 @@ void ircomm_tty_connect_indication(void *instance, void *sap, ...@@ -496,7 +498,7 @@ void ircomm_tty_connect_indication(void *instance, void *sap,
ircomm_tty_do_event(self, IRCOMM_TTY_CONNECT_INDICATION, NULL, NULL); ircomm_tty_do_event(self, IRCOMM_TTY_CONNECT_INDICATION, NULL, NULL);
dev_kfree_skb(skb); /* No need to kfree_skb - see ircomm_ttp_connect_indication() */
} }
/* /*
...@@ -647,7 +649,7 @@ static int ircomm_tty_state_idle(struct ircomm_tty_cb *self, ...@@ -647,7 +649,7 @@ static int ircomm_tty_state_idle(struct ircomm_tty_cb *self,
default: default:
IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_tty_event[event]); ircomm_tty_event[event]);
return -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
} }
...@@ -718,7 +720,7 @@ static int ircomm_tty_state_search(struct ircomm_tty_cb *self, ...@@ -718,7 +720,7 @@ static int ircomm_tty_state_search(struct ircomm_tty_cb *self,
default: default:
IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_tty_event[event]); ircomm_tty_event[event]);
return -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
} }
...@@ -774,7 +776,7 @@ static int ircomm_tty_state_query_parameters(struct ircomm_tty_cb *self, ...@@ -774,7 +776,7 @@ static int ircomm_tty_state_query_parameters(struct ircomm_tty_cb *self,
default: default:
IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_tty_event[event]); ircomm_tty_event[event]);
return -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
} }
...@@ -822,7 +824,7 @@ static int ircomm_tty_state_query_lsap_sel(struct ircomm_tty_cb *self, ...@@ -822,7 +824,7 @@ static int ircomm_tty_state_query_lsap_sel(struct ircomm_tty_cb *self,
default: default:
IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_tty_event[event]); ircomm_tty_event[event]);
return -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
} }
...@@ -874,7 +876,7 @@ static int ircomm_tty_state_setup(struct ircomm_tty_cb *self, ...@@ -874,7 +876,7 @@ static int ircomm_tty_state_setup(struct ircomm_tty_cb *self,
default: default:
IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_tty_event[event]); ircomm_tty_event[event]);
return -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
} }
...@@ -917,7 +919,7 @@ static int ircomm_tty_state_ready(struct ircomm_tty_cb *self, ...@@ -917,7 +919,7 @@ static int ircomm_tty_state_ready(struct ircomm_tty_cb *self,
default: default:
IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ , IRDA_DEBUG(2, "%s(), unknown event: %s\n", __FUNCTION__ ,
ircomm_tty_event[event]); ircomm_tty_event[event]);
return -EINVAL; ret = -EINVAL;
} }
return ret; return ret;
} }
......
net/irda/iriap.c
View file @ 5976fac2
This diff is collapsed.
net/irda/iriap_event.c
View file @ 5976fac2
...@@ -11,6 +11,7 @@ ...@@ -11,6 +11,7 @@
* *
* Copyright (c) 1997, 1999-2000 Dag Brattli <dagb@cs.uit.no>, * Copyright (c) 1997, 1999-2000 Dag Brattli <dagb@cs.uit.no>,
* All Rights Reserved. * All Rights Reserved.
* Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -174,8 +175,11 @@ static void state_s_disconnect(struct iriap_cb *self, IRIAP_EVENT event, ...@@ -174,8 +175,11 @@ static void state_s_disconnect(struct iriap_cb *self, IRIAP_EVENT event,
switch (event) { switch (event) {
case IAP_CALL_REQUEST_GVBC: case IAP_CALL_REQUEST_GVBC:
iriap_next_client_state(self, S_CONNECTING); iriap_next_client_state(self, S_CONNECTING);
ASSERT(self->skb == NULL, return;); ASSERT(self->request_skb == NULL, return;);
self->skb = skb; /* Don't forget to refcount it -
* see iriap_getvaluebyclass_request(). */
skb_get(skb);
self->request_skb = skb;
iriap_connect_request(self); iriap_connect_request(self);
break; break;
case IAP_LM_DISCONNECT_INDICATION: case IAP_LM_DISCONNECT_INDICATION:
...@@ -251,20 +255,21 @@ static void state_s_call(struct iriap_cb *self, IRIAP_EVENT event, ...@@ -251,20 +255,21 @@ static void state_s_call(struct iriap_cb *self, IRIAP_EVENT event,
static void state_s_make_call(struct iriap_cb *self, IRIAP_EVENT event, static void state_s_make_call(struct iriap_cb *self, IRIAP_EVENT event,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct sk_buff *tx_skb;
ASSERT(self != NULL, return;); ASSERT(self != NULL, return;);
switch (event) { switch (event) {
case IAP_CALL_REQUEST: case IAP_CALL_REQUEST:
skb = self->skb; /* Already refcounted - see state_s_disconnect() */
self->skb = NULL; tx_skb = self->request_skb;
self->request_skb = NULL;
irlmp_data_request(self->lsap, skb); irlmp_data_request(self->lsap, tx_skb);
iriap_next_call_state(self, S_OUTSTANDING); iriap_next_call_state(self, S_OUTSTANDING);
break; break;
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %d\n", __FUNCTION__, event); IRDA_DEBUG(0, "%s(), Unknown event %d\n", __FUNCTION__, event);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
} }
...@@ -379,10 +384,6 @@ static void state_r_disconnect(struct iriap_cb *self, IRIAP_EVENT event, ...@@ -379,10 +384,6 @@ static void state_r_disconnect(struct iriap_cb *self, IRIAP_EVENT event,
* care about LM_Idle_request()! * care about LM_Idle_request()!
*/ */
iriap_next_r_connect_state(self, R_RECEIVING); iriap_next_r_connect_state(self, R_RECEIVING);
if (skb)
dev_kfree_skb(skb);
break; break;
default: default:
IRDA_DEBUG(0, "%s(), unknown event %d\n", __FUNCTION__, event); IRDA_DEBUG(0, "%s(), unknown event %d\n", __FUNCTION__, event);
...@@ -450,7 +451,6 @@ static void state_r_receiving(struct iriap_cb *self, IRIAP_EVENT event, ...@@ -450,7 +451,6 @@ static void state_r_receiving(struct iriap_cb *self, IRIAP_EVENT event,
IRDA_DEBUG(0, "%s(), unknown event!\n", __FUNCTION__); IRDA_DEBUG(0, "%s(), unknown event!\n", __FUNCTION__);
break; break;
} }
} }
/* /*
...@@ -465,11 +465,8 @@ static void state_r_execute(struct iriap_cb *self, IRIAP_EVENT event, ...@@ -465,11 +465,8 @@ static void state_r_execute(struct iriap_cb *self, IRIAP_EVENT event,
IRDA_DEBUG(4, "%s()\n", __FUNCTION__); IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
ASSERT(skb != NULL, return;); ASSERT(skb != NULL, return;);
ASSERT(self != NULL, return;);
if (!self || self->magic != IAS_MAGIC) { ASSERT(self->magic == IAS_MAGIC, return;);
IRDA_DEBUG(0, "%s(), bad pointer self\n", __FUNCTION__);
return;
}
switch (event) { switch (event) {
case IAP_CALL_RESPONSE: case IAP_CALL_RESPONSE:
...@@ -479,6 +476,10 @@ static void state_r_execute(struct iriap_cb *self, IRIAP_EVENT event, ...@@ -479,6 +476,10 @@ static void state_r_execute(struct iriap_cb *self, IRIAP_EVENT event,
*/ */
iriap_next_r_connect_state(self, R_RECEIVING); iriap_next_r_connect_state(self, R_RECEIVING);
/* Don't forget to refcount it - see
* iriap_getvaluebyclass_response(). */
skb_get(skb);
irlmp_data_request(self->lsap, skb); irlmp_data_request(self->lsap, skb);
break; break;
default: default:
......
net/irda/irlan/irlan_eth.c
View file @ 5976fac2
...@@ -206,7 +206,7 @@ int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -206,7 +206,7 @@ int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev)
* confuse do_dev_queue_xmit() in dev.c! I have * confuse do_dev_queue_xmit() in dev.c! I have
* tried :-) DB * tried :-) DB
*/ */
dev_kfree_skb(skb); /* irttp_data_request already free the packet */
self->stats.tx_dropped++; self->stats.tx_dropped++;
} else { } else {
self->stats.tx_packets++; self->stats.tx_packets++;
......
net/irda/irlap.c
View file @ 5976fac2
...@@ -10,7 +10,7 @@ ...@@ -10,7 +10,7 @@
* Modified by: Dag Brattli <dagb@cs.uit.no> * Modified by: Dag Brattli <dagb@cs.uit.no>
* *
* Copyright (c) 1998-1999 Dag Brattli, All Rights Reserved. * Copyright (c) 1998-1999 Dag Brattli, All Rights Reserved.
* Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com> * Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -244,7 +244,6 @@ void irlap_connect_indication(struct irlap_cb *self, struct sk_buff *skb) ...@@ -244,7 +244,6 @@ void irlap_connect_indication(struct irlap_cb *self, struct sk_buff *skb)
irlap_init_qos_capabilities(self, NULL); /* No user QoS! */ irlap_init_qos_capabilities(self, NULL); /* No user QoS! */
skb_get(skb); /*LEVEL4*/
irlmp_link_connect_indication(self->notify.instance, self->saddr, irlmp_link_connect_indication(self->notify.instance, self->saddr,
self->daddr, &self->qos_tx, skb); self->daddr, &self->qos_tx, skb);
} }
...@@ -255,12 +254,11 @@ void irlap_connect_indication(struct irlap_cb *self, struct sk_buff *skb) ...@@ -255,12 +254,11 @@ void irlap_connect_indication(struct irlap_cb *self, struct sk_buff *skb)
* Service user has accepted incoming connection * Service user has accepted incoming connection
* *
*/ */
void irlap_connect_response(struct irlap_cb *self, struct sk_buff *skb) void irlap_connect_response(struct irlap_cb *self, struct sk_buff *userdata)
{ {
IRDA_DEBUG(4, "%s()\n", __FUNCTION__); IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
irlap_do_event(self, CONNECT_RESPONSE, skb, NULL); irlap_do_event(self, CONNECT_RESPONSE, userdata, NULL);
kfree_skb(skb);
} }
/* /*
...@@ -305,7 +303,6 @@ void irlap_connect_confirm(struct irlap_cb *self, struct sk_buff *skb) ...@@ -305,7 +303,6 @@ void irlap_connect_confirm(struct irlap_cb *self, struct sk_buff *skb)
ASSERT(self != NULL, return;); ASSERT(self != NULL, return;);
ASSERT(self->magic == LAP_MAGIC, return;); ASSERT(self->magic == LAP_MAGIC, return;);
skb_get(skb); /*LEVEL4*/
irlmp_link_connect_confirm(self->notify.instance, &self->qos_tx, skb); irlmp_link_connect_confirm(self->notify.instance, &self->qos_tx, skb);
} }
...@@ -322,7 +319,6 @@ void irlap_data_indication(struct irlap_cb *self, struct sk_buff *skb, ...@@ -322,7 +319,6 @@ void irlap_data_indication(struct irlap_cb *self, struct sk_buff *skb,
/* Hide LAP header from IrLMP layer */ /* Hide LAP header from IrLMP layer */
skb_pull(skb, LAP_ADDR_HEADER+LAP_CTRL_HEADER); skb_pull(skb, LAP_ADDR_HEADER+LAP_CTRL_HEADER);
skb_get(skb); /*LEVEL4*/
irlmp_link_data_indication(self->notify.instance, skb, unreliable); irlmp_link_data_indication(self->notify.instance, skb, unreliable);
} }
...@@ -354,6 +350,9 @@ void irlap_data_request(struct irlap_cb *self, struct sk_buff *skb, ...@@ -354,6 +350,9 @@ void irlap_data_request(struct irlap_cb *self, struct sk_buff *skb,
else else
skb->data[1] = I_FRAME; skb->data[1] = I_FRAME;
/* Don't forget to refcount it - see irlmp_connect_request(). */
skb_get(skb);
/* Add at the end of the queue (keep ordering) - Jean II */ /* Add at the end of the queue (keep ordering) - Jean II */
skb_queue_tail(&self->txq, skb); skb_queue_tail(&self->txq, skb);
...@@ -392,6 +391,8 @@ void irlap_unitdata_request(struct irlap_cb *self, struct sk_buff *skb) ...@@ -392,6 +391,8 @@ void irlap_unitdata_request(struct irlap_cb *self, struct sk_buff *skb)
skb->data[0] = CBROADCAST; skb->data[0] = CBROADCAST;
skb->data[1] = UI_FRAME; skb->data[1] = UI_FRAME;
/* Don't need to refcount, see irlmp_connless_data_request() */
skb_queue_tail(&self->txq_ultra, skb); skb_queue_tail(&self->txq_ultra, skb);
irlap_do_event(self, SEND_UI_FRAME, NULL, NULL); irlap_do_event(self, SEND_UI_FRAME, NULL, NULL);
...@@ -416,7 +417,6 @@ void irlap_unitdata_indication(struct irlap_cb *self, struct sk_buff *skb) ...@@ -416,7 +417,6 @@ void irlap_unitdata_indication(struct irlap_cb *self, struct sk_buff *skb)
/* Hide LAP header from IrLMP layer */ /* Hide LAP header from IrLMP layer */
skb_pull(skb, LAP_ADDR_HEADER+LAP_CTRL_HEADER); skb_pull(skb, LAP_ADDR_HEADER+LAP_CTRL_HEADER);
skb_get(skb); /*LEVEL4*/
irlmp_link_unitdata_indication(self->notify.instance, skb); irlmp_link_unitdata_indication(self->notify.instance, skb);
} }
#endif /* CONFIG_IRDA_ULTRA */ #endif /* CONFIG_IRDA_ULTRA */
......
net/irda/irlap_event.c
View file @ 5976fac2
...@@ -12,7 +12,7 @@ ...@@ -12,7 +12,7 @@
* Copyright (c) 1998-2000 Dag Brattli <dag@brattli.net>, * Copyright (c) 1998-2000 Dag Brattli <dag@brattli.net>,
* Copyright (c) 1998 Thomas Davis <ratbert@radiks.net> * Copyright (c) 1998 Thomas Davis <ratbert@radiks.net>
* All Rights Reserved. * All Rights Reserved.
* Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com> * Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -287,6 +287,9 @@ void irlap_do_event(struct irlap_cb *self, IRLAP_EVENT event, ...@@ -287,6 +287,9 @@ void irlap_do_event(struct irlap_cb *self, IRLAP_EVENT event,
/* Send one frame */ /* Send one frame */
ret = (*state[self->state])(self, SEND_I_CMD, ret = (*state[self->state])(self, SEND_I_CMD,
skb, NULL); skb, NULL);
/* Drop reference count.
* It will be increase as needed in
* irlap_send_data_xxx() */
kfree_skb(skb); kfree_skb(skb);
/* Poll the higher layers for one more frame */ /* Poll the higher layers for one more frame */
...@@ -517,6 +520,8 @@ static int irlap_state_ndm(struct irlap_cb *self, IRLAP_EVENT event, ...@@ -517,6 +520,8 @@ static int irlap_state_ndm(struct irlap_cb *self, IRLAP_EVENT event,
CMD_FRAME); CMD_FRAME);
else else
break; break;
/* irlap_send_ui_frame() won't increase skb reference
* count, so no dev_kfree_skb() - Jean II */
} }
if (i == 2) { if (i == 2) {
/* Force us to listen 500 ms again */ /* Force us to listen 500 ms again */
......
net/irda/irlap_frame.c
View file @ 5976fac2
This diff is collapsed.
net/irda/irlmp.c
View file @ 5976fac2
This diff is collapsed.
net/irda/irlmp_event.c
View file @ 5976fac2
...@@ -11,7 +11,7 @@ ...@@ -11,7 +11,7 @@
* *
* Copyright (c) 1998-1999 Dag Brattli <dagb@cs.uit.no>, * Copyright (c) 1998-1999 Dag Brattli <dagb@cs.uit.no>,
* All Rights Reserved. * All Rights Reserved.
* Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com> * Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -295,8 +295,6 @@ static void irlmp_state_standby(struct lap_cb *self, IRLMP_EVENT event, ...@@ -295,8 +295,6 @@ static void irlmp_state_standby(struct lap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s\n", IRDA_DEBUG(0, "%s(), Unknown event %s\n",
__FUNCTION__, irlmp_event[event]); __FUNCTION__, irlmp_event[event]);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
} }
...@@ -373,8 +371,6 @@ static void irlmp_state_u_connect(struct lap_cb *self, IRLMP_EVENT event, ...@@ -373,8 +371,6 @@ static void irlmp_state_u_connect(struct lap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s\n", IRDA_DEBUG(0, "%s(), Unknown event %s\n",
__FUNCTION__, irlmp_event[event]); __FUNCTION__, irlmp_event[event]);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
} }
...@@ -468,8 +464,6 @@ static void irlmp_state_active(struct lap_cb *self, IRLMP_EVENT event, ...@@ -468,8 +464,6 @@ static void irlmp_state_active(struct lap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s\n", IRDA_DEBUG(0, "%s(), Unknown event %s\n",
__FUNCTION__, irlmp_event[event]); __FUNCTION__, irlmp_event[event]);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
} }
...@@ -499,6 +493,9 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -499,6 +493,9 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event,
switch (event) { switch (event) {
#ifdef CONFIG_IRDA_ULTRA #ifdef CONFIG_IRDA_ULTRA
case LM_UDATA_INDICATION: case LM_UDATA_INDICATION:
/* This is most bizzare. Those packets are aka unreliable
* connected, aka IrLPT or SOCK_DGRAM/IRDAPROTO_UNITDATA.
* Why do we pass them as Ultra ??? Jean II */
irlmp_connless_data_indication(self, skb); irlmp_connless_data_indication(self, skb);
break; break;
#endif /* CONFIG_IRDA_ULTRA */ #endif /* CONFIG_IRDA_ULTRA */
...@@ -510,6 +507,8 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -510,6 +507,8 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event,
__FUNCTION__); __FUNCTION__);
return -EBUSY; return -EBUSY;
} }
/* Don't forget to refcount it (see irlmp_connect_request()) */
skb_get(skb);
self->conn_skb = skb; self->conn_skb = skb;
irlmp_next_lsap_state(self, LSAP_SETUP_PEND); irlmp_next_lsap_state(self, LSAP_SETUP_PEND);
...@@ -525,6 +524,8 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -525,6 +524,8 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event,
__FUNCTION__); __FUNCTION__);
return -EBUSY; return -EBUSY;
} }
/* Don't forget to refcount it (see irlap_driver_rcv()) */
skb_get(skb);
self->conn_skb = skb; self->conn_skb = skb;
irlmp_next_lsap_state(self, LSAP_CONNECT_PEND); irlmp_next_lsap_state(self, LSAP_CONNECT_PEND);
...@@ -547,8 +548,6 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -547,8 +548,6 @@ static int irlmp_state_disconnected(struct lsap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(1, "%s(), Unknown event %s on LSAP %#02x\n", IRDA_DEBUG(1, "%s(), Unknown event %s on LSAP %#02x\n",
__FUNCTION__, irlmp_event[event], self->slsap_sel); __FUNCTION__, irlmp_event[event], self->slsap_sel);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
return ret; return ret;
...@@ -606,8 +605,6 @@ static int irlmp_state_connect(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -606,8 +605,6 @@ static int irlmp_state_connect(struct lsap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n", IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n",
__FUNCTION__, irlmp_event[event], self->slsap_sel); __FUNCTION__, irlmp_event[event], self->slsap_sel);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
return ret; return ret;
...@@ -622,6 +619,7 @@ static int irlmp_state_connect(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -622,6 +619,7 @@ static int irlmp_state_connect(struct lsap_cb *self, IRLMP_EVENT event,
static int irlmp_state_connect_pend(struct lsap_cb *self, IRLMP_EVENT event, static int irlmp_state_connect_pend(struct lsap_cb *self, IRLMP_EVENT event,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct sk_buff *tx_skb;
int ret = 0; int ret = 0;
IRDA_DEBUG(4, "%s()\n", __FUNCTION__); IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
...@@ -647,10 +645,12 @@ static int irlmp_state_connect_pend(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -647,10 +645,12 @@ static int irlmp_state_connect_pend(struct lsap_cb *self, IRLMP_EVENT event,
IRDA_DEBUG(4, "%s(), LS_CONNECT_CONFIRM\n", __FUNCTION__); IRDA_DEBUG(4, "%s(), LS_CONNECT_CONFIRM\n", __FUNCTION__);
irlmp_next_lsap_state(self, LSAP_CONNECT); irlmp_next_lsap_state(self, LSAP_CONNECT);
skb = self->conn_skb; tx_skb = self->conn_skb;
self->conn_skb = NULL; self->conn_skb = NULL;
irlmp_connect_indication(self, skb); irlmp_connect_indication(self, tx_skb);
/* Drop reference count - see irlmp_connect_indication(). */
dev_kfree_skb(tx_skb);
break; break;
case LM_WATCHDOG_TIMEOUT: case LM_WATCHDOG_TIMEOUT:
/* Will happen in some rare cases because of a race condition. /* Will happen in some rare cases because of a race condition.
...@@ -668,8 +668,6 @@ static int irlmp_state_connect_pend(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -668,8 +668,6 @@ static int irlmp_state_connect_pend(struct lsap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n", IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n",
__FUNCTION__, irlmp_event[event], self->slsap_sel); __FUNCTION__, irlmp_event[event], self->slsap_sel);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
return ret; return ret;
...@@ -759,8 +757,6 @@ static int irlmp_state_dtr(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -759,8 +757,6 @@ static int irlmp_state_dtr(struct lsap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n", IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n",
__FUNCTION__, irlmp_event[event], self->slsap_sel); __FUNCTION__, irlmp_event[event], self->slsap_sel);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
return ret; return ret;
...@@ -832,8 +828,6 @@ static int irlmp_state_setup(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -832,8 +828,6 @@ static int irlmp_state_setup(struct lsap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n", IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n",
__FUNCTION__, irlmp_event[event], self->slsap_sel); __FUNCTION__, irlmp_event[event], self->slsap_sel);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
return ret; return ret;
...@@ -850,6 +844,7 @@ static int irlmp_state_setup(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -850,6 +844,7 @@ static int irlmp_state_setup(struct lsap_cb *self, IRLMP_EVENT event,
static int irlmp_state_setup_pend(struct lsap_cb *self, IRLMP_EVENT event, static int irlmp_state_setup_pend(struct lsap_cb *self, IRLMP_EVENT event,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct sk_buff *tx_skb;
LM_REASON reason; LM_REASON reason;
int ret = 0; int ret = 0;
...@@ -862,11 +857,13 @@ static int irlmp_state_setup_pend(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -862,11 +857,13 @@ static int irlmp_state_setup_pend(struct lsap_cb *self, IRLMP_EVENT event,
case LM_LAP_CONNECT_CONFIRM: case LM_LAP_CONNECT_CONFIRM:
ASSERT(self->conn_skb != NULL, return -1;); ASSERT(self->conn_skb != NULL, return -1;);
skb = self->conn_skb; tx_skb = self->conn_skb;
self->conn_skb = NULL; self->conn_skb = NULL;
irlmp_send_lcf_pdu(self->lap, self->dlsap_sel, irlmp_send_lcf_pdu(self->lap, self->dlsap_sel,
self->slsap_sel, CONNECT_CMD, skb); self->slsap_sel, CONNECT_CMD, tx_skb);
/* Drop reference count - see irlap_data_request(). */
dev_kfree_skb(tx_skb);
irlmp_next_lsap_state(self, LSAP_SETUP); irlmp_next_lsap_state(self, LSAP_SETUP);
break; break;
...@@ -891,8 +888,6 @@ static int irlmp_state_setup_pend(struct lsap_cb *self, IRLMP_EVENT event, ...@@ -891,8 +888,6 @@ static int irlmp_state_setup_pend(struct lsap_cb *self, IRLMP_EVENT event,
default: default:
IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n", IRDA_DEBUG(0, "%s(), Unknown event %s on LSAP %#02x\n",
__FUNCTION__, irlmp_event[event], self->slsap_sel); __FUNCTION__, irlmp_event[event], self->slsap_sel);
if (skb)
dev_kfree_skb(skb);
break; break;
} }
return ret; return ret;
......
net/irda/irlmp_frame.c
View file @ 5976fac2
...@@ -11,7 +11,7 @@ ...@@ -11,7 +11,7 @@
* *
* Copyright (c) 1998-1999 Dag Brattli <dagb@cs.uit.no> * Copyright (c) 1998-1999 Dag Brattli <dagb@cs.uit.no>
* All Rights Reserved. * All Rights Reserved.
* Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com> * Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -144,7 +144,6 @@ void irlmp_link_data_indication(struct lap_cb *self, struct sk_buff *skb, ...@@ -144,7 +144,6 @@ void irlmp_link_data_indication(struct lap_cb *self, struct sk_buff *skb,
} else { } else {
IRDA_DEBUG(2, "%s(), received data frame\n", __FUNCTION__); IRDA_DEBUG(2, "%s(), received data frame\n", __FUNCTION__);
} }
dev_kfree_skb(skb);
return; return;
} }
...@@ -168,16 +167,13 @@ void irlmp_link_data_indication(struct lap_cb *self, struct sk_buff *skb, ...@@ -168,16 +167,13 @@ void irlmp_link_data_indication(struct lap_cb *self, struct sk_buff *skb,
break; break;
case ACCESSMODE_CMD: case ACCESSMODE_CMD:
IRDA_DEBUG(0, "Access mode cmd not implemented!\n"); IRDA_DEBUG(0, "Access mode cmd not implemented!\n");
dev_kfree_skb(skb);
break; break;
case ACCESSMODE_CNF: case ACCESSMODE_CNF:
IRDA_DEBUG(0, "Access mode cnf not implemented!\n"); IRDA_DEBUG(0, "Access mode cnf not implemented!\n");
dev_kfree_skb(skb);
break; break;
default: default:
IRDA_DEBUG(0, "%s(), Unknown control frame %02x\n", IRDA_DEBUG(0, "%s(), Unknown control frame %02x\n",
__FUNCTION__, fp[2]); __FUNCTION__, fp[2]);
dev_kfree_skb(skb);
break; break;
} }
} else if (unreliable) { } else if (unreliable) {
...@@ -230,16 +226,12 @@ void irlmp_link_unitdata_indication(struct lap_cb *self, struct sk_buff *skb) ...@@ -230,16 +226,12 @@ void irlmp_link_unitdata_indication(struct lap_cb *self, struct sk_buff *skb)
if (pid & 0x80) { if (pid & 0x80) {
IRDA_DEBUG(0, "%s(), extension in PID not supp!\n", IRDA_DEBUG(0, "%s(), extension in PID not supp!\n",
__FUNCTION__); __FUNCTION__);
dev_kfree_skb(skb);
return; return;
} }
/* Check if frame is addressed to the connectionless LSAP */ /* Check if frame is addressed to the connectionless LSAP */
if ((slsap_sel != LSAP_CONNLESS) || (dlsap_sel != LSAP_CONNLESS)) { if ((slsap_sel != LSAP_CONNLESS) || (dlsap_sel != LSAP_CONNLESS)) {
IRDA_DEBUG(0, "%s(), dropping frame!\n", __FUNCTION__); IRDA_DEBUG(0, "%s(), dropping frame!\n", __FUNCTION__);
dev_kfree_skb(skb);
return; return;
} }
...@@ -264,7 +256,6 @@ void irlmp_link_unitdata_indication(struct lap_cb *self, struct sk_buff *skb) ...@@ -264,7 +256,6 @@ void irlmp_link_unitdata_indication(struct lap_cb *self, struct sk_buff *skb)
irlmp_connless_data_indication(lsap, skb); irlmp_connless_data_indication(lsap, skb);
else { else {
IRDA_DEBUG(0, "%s(), found no matching LSAP!\n", __FUNCTION__); IRDA_DEBUG(0, "%s(), found no matching LSAP!\n", __FUNCTION__);
dev_kfree_skb(skb);
} }
} }
#endif /* CONFIG_IRDA_ULTRA */ #endif /* CONFIG_IRDA_ULTRA */
...@@ -278,7 +269,7 @@ void irlmp_link_unitdata_indication(struct lap_cb *self, struct sk_buff *skb) ...@@ -278,7 +269,7 @@ void irlmp_link_unitdata_indication(struct lap_cb *self, struct sk_buff *skb)
void irlmp_link_disconnect_indication(struct lap_cb *lap, void irlmp_link_disconnect_indication(struct lap_cb *lap,
struct irlap_cb *irlap, struct irlap_cb *irlap,
LAP_REASON reason, LAP_REASON reason,
struct sk_buff *userdata) struct sk_buff *skb)
{ {
IRDA_DEBUG(2, "%s()\n", __FUNCTION__); IRDA_DEBUG(2, "%s()\n", __FUNCTION__);
...@@ -288,9 +279,7 @@ void irlmp_link_disconnect_indication(struct lap_cb *lap, ...@@ -288,9 +279,7 @@ void irlmp_link_disconnect_indication(struct lap_cb *lap,
lap->reason = reason; lap->reason = reason;
lap->daddr = DEV_ADDR_ANY; lap->daddr = DEV_ADDR_ANY;
/* FIXME: must do something with the userdata if any */ /* FIXME: must do something with the skb if any */
if (userdata)
dev_kfree_skb(userdata);
/* /*
* Inform station state machine * Inform station state machine
...@@ -327,7 +316,7 @@ void irlmp_link_connect_indication(struct lap_cb *self, __u32 saddr, ...@@ -327,7 +316,7 @@ void irlmp_link_connect_indication(struct lap_cb *self, __u32 saddr,
* *
*/ */
void irlmp_link_connect_confirm(struct lap_cb *self, struct qos_info *qos, void irlmp_link_connect_confirm(struct lap_cb *self, struct qos_info *qos,
struct sk_buff *userdata) struct sk_buff *skb)
{ {
IRDA_DEBUG(4, "%s()\n", __FUNCTION__); IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
...@@ -335,9 +324,7 @@ void irlmp_link_connect_confirm(struct lap_cb *self, struct qos_info *qos, ...@@ -335,9 +324,7 @@ void irlmp_link_connect_confirm(struct lap_cb *self, struct qos_info *qos,
ASSERT(self->magic == LMP_LAP_MAGIC, return;); ASSERT(self->magic == LMP_LAP_MAGIC, return;);
ASSERT(qos != NULL, return;); ASSERT(qos != NULL, return;);
/* Don't need use the userdata for now */ /* Don't need use the skb for now */
if (userdata)
dev_kfree_skb(userdata);
/* Copy QoS settings for this session */ /* Copy QoS settings for this session */
self->qos = qos; self->qos = qos;
......
net/irda/irnet/irnet_ppp.c
View file @ 5976fac2
...@@ -927,7 +927,7 @@ ppp_irnet_send(struct ppp_channel * chan, ...@@ -927,7 +927,7 @@ ppp_irnet_send(struct ppp_channel * chan,
* Jean II * Jean II
*/ */
DERROR(PPP_ERROR, "IrTTP doesn't like this packet !!! (0x%X)\n", ret); DERROR(PPP_ERROR, "IrTTP doesn't like this packet !!! (0x%X)\n", ret);
dev_kfree_skb(skb); /* irttp_data_request already free the packet */
} }
DEXIT(PPP_TRACE, "\n"); DEXIT(PPP_TRACE, "\n");
......
net/irda/irttp.c
View file @ 5976fac2
...@@ -11,7 +11,7 @@ ...@@ -11,7 +11,7 @@
* *
* Copyright (c) 1998-2000 Dag Brattli <dagb@cs.uit.no>, * Copyright (c) 1998-2000 Dag Brattli <dagb@cs.uit.no>,
* All Rights Reserved. * All Rights Reserved.
* Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com> * Copyright (c) 2000-2003 Jean Tourrilhes <jt@hpl.hp.com>
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as * modify it under the terms of the GNU General Public License as
...@@ -259,11 +259,17 @@ static struct sk_buff *irttp_reassemble_skb(struct tsap_cb *self) ...@@ -259,11 +259,17 @@ static struct sk_buff *irttp_reassemble_skb(struct tsap_cb *self)
dev_kfree_skb(frag); dev_kfree_skb(frag);
} }
IRDA_DEBUG(2, "%s(), frame len=%d\n", __FUNCTION__, n);
IRDA_DEBUG(2, "%s(), rx_sdu_size=%d\n", __FUNCTION__, IRDA_DEBUG(2,
self->rx_sdu_size); "%s(), frame len=%d, rx_sdu_size=%d, rx_max_sdu_size=%d\n",
ASSERT(n <= self->rx_sdu_size, return NULL;); __FUNCTION__, n, self->rx_sdu_size, self->rx_max_sdu_size);
/* Note : irttp_run_rx_queue() calculate self->rx_sdu_size
* by summing the size of all fragments, so we should always
* have n == self->rx_sdu_size, except in cases where we
* droped the last fragment (when self->rx_sdu_size exceed
* self->rx_max_sdu_size), where n < self->rx_sdu_size.
* Jean II */
ASSERT(n <= self->rx_sdu_size, n = self->rx_sdu_size;);
/* Set the new length */ /* Set the new length */
skb_trim(skb, n); skb_trim(skb, n);
...@@ -537,19 +543,23 @@ int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -537,19 +543,23 @@ int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb)
if ((skb->len == 0) || (!self->connected)) { if ((skb->len == 0) || (!self->connected)) {
IRDA_DEBUG(1, "%s(), No data, or not connected\n", IRDA_DEBUG(1, "%s(), No data, or not connected\n",
__FUNCTION__); __FUNCTION__);
return -1; goto err;
} }
if (skb->len > self->max_seg_size) { if (skb->len > self->max_seg_size) {
IRDA_DEBUG(1, "%s(), UData is to large for IrLAP!\n", IRDA_DEBUG(1, "%s(), UData is to large for IrLAP!\n",
__FUNCTION__); __FUNCTION__);
return -1; goto err;
} }
irlmp_udata_request(self->lsap, skb); irlmp_udata_request(self->lsap, skb);
self->stats.tx_packets++; self->stats.tx_packets++;
return 0; return 0;
err:
dev_kfree_skb(skb);
return -1;
} }
/* /*
...@@ -561,6 +571,7 @@ int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -561,6 +571,7 @@ int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb)
int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb) int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
{ {
__u8 *frame; __u8 *frame;
int ret;
ASSERT(self != NULL, return -1;); ASSERT(self != NULL, return -1;);
ASSERT(self->magic == TTP_TSAP_MAGIC, return -1;); ASSERT(self->magic == TTP_TSAP_MAGIC, return -1;);
...@@ -572,7 +583,8 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -572,7 +583,8 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
/* Check that nothing bad happens */ /* Check that nothing bad happens */
if ((skb->len == 0) || (!self->connected)) { if ((skb->len == 0) || (!self->connected)) {
WARNING("%s: No data, or not connected\n", __FUNCTION__); WARNING("%s: No data, or not connected\n", __FUNCTION__);
return -ENOTCONN; ret = -ENOTCONN;
goto err;
} }
/* /*
...@@ -582,7 +594,8 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -582,7 +594,8 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
if ((self->tx_max_sdu_size == 0) && (skb->len > self->max_seg_size)) { if ((self->tx_max_sdu_size == 0) && (skb->len > self->max_seg_size)) {
ERROR("%s: SAR disabled, and data is to large for IrLAP!\n", ERROR("%s: SAR disabled, and data is to large for IrLAP!\n",
__FUNCTION__); __FUNCTION__);
return -EMSGSIZE; ret = -EMSGSIZE;
goto err;
} }
/* /*
...@@ -595,7 +608,8 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -595,7 +608,8 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
{ {
ERROR("%s: SAR enabled, but data is larger than TxMaxSduSize!\n", ERROR("%s: SAR enabled, but data is larger than TxMaxSduSize!\n",
__FUNCTION__); __FUNCTION__);
return -EMSGSIZE; ret = -EMSGSIZE;
goto err;
} }
/* /*
* Check if transmit queue is full * Check if transmit queue is full
...@@ -607,8 +621,9 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -607,8 +621,9 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
irttp_run_tx_queue(self); irttp_run_tx_queue(self);
/* Drop packet. This error code should trigger the caller /* Drop packet. This error code should trigger the caller
* to requeue the packet in the client code - Jean II */ * to resend the data in the client code - Jean II */
return -ENOBUFS; ret = -ENOBUFS;
goto err;
} }
/* Queue frame, or queue frame segments */ /* Queue frame, or queue frame segments */
...@@ -651,6 +666,10 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb) ...@@ -651,6 +666,10 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
irttp_run_tx_queue(self); irttp_run_tx_queue(self);
return 0; return 0;
err:
dev_kfree_skb(skb);
return ret;
} }
/* /*
...@@ -822,6 +841,7 @@ static int irttp_udata_indication(void *instance, void *sap, ...@@ -822,6 +841,7 @@ static int irttp_udata_indication(void *instance, void *sap,
struct sk_buff *skb) struct sk_buff *skb)
{ {
struct tsap_cb *self; struct tsap_cb *self;
int err;
IRDA_DEBUG(4, "%s()\n", __FUNCTION__); IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
...@@ -831,14 +851,19 @@ static int irttp_udata_indication(void *instance, void *sap, ...@@ -831,14 +851,19 @@ static int irttp_udata_indication(void *instance, void *sap,
ASSERT(self->magic == TTP_TSAP_MAGIC, return -1;); ASSERT(self->magic == TTP_TSAP_MAGIC, return -1;);
ASSERT(skb != NULL, return -1;); ASSERT(skb != NULL, return -1;);
/* Just pass data to layer above */
if (self->notify.udata_indication)
self->notify.udata_indication(self->notify.instance, self,skb);
else
dev_kfree_skb(skb);
self->stats.rx_packets++; self->stats.rx_packets++;
/* Just pass data to layer above */
if (self->notify.udata_indication) {
err = self->notify.udata_indication(self->notify.instance,
self,skb);
/* Same comment as in irttp_do_data_indication() */
if (err != -ENOMEM)
return 0;
}
/* Either no handler, or -ENOMEM */
dev_kfree_skb(skb);
return 0; return 0;
} }
...@@ -1040,7 +1065,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel, ...@@ -1040,7 +1065,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
struct qos_info *qos, __u32 max_sdu_size, struct qos_info *qos, __u32 max_sdu_size,
struct sk_buff *userdata) struct sk_buff *userdata)
{ {
struct sk_buff *skb; struct sk_buff *tx_skb;
__u8 *frame; __u8 *frame;
__u8 n; __u8 n;
...@@ -1049,19 +1074,22 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel, ...@@ -1049,19 +1074,22 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
ASSERT(self != NULL, return -EBADR;); ASSERT(self != NULL, return -EBADR;);
ASSERT(self->magic == TTP_TSAP_MAGIC, return -EBADR;); ASSERT(self->magic == TTP_TSAP_MAGIC, return -EBADR;);
if (self->connected) if (self->connected) {
if(userdata)
dev_kfree_skb(userdata);
return -EISCONN; return -EISCONN;
}
/* Any userdata supplied? */ /* Any userdata supplied? */
if (userdata == NULL) { if (userdata == NULL) {
skb = dev_alloc_skb(64); tx_skb = dev_alloc_skb(64);
if (!skb) if (!tx_skb)
return -ENOMEM; return -ENOMEM;
/* Reserve space for MUX_CONTROL and LAP header */ /* Reserve space for MUX_CONTROL and LAP header */
skb_reserve(skb, TTP_MAX_HEADER); skb_reserve(tx_skb, TTP_MAX_HEADER);
} else { } else {
skb = userdata; tx_skb = userdata;
/* /*
* Check that the client has reserved enough space for * Check that the client has reserved enough space for
* headers * headers
...@@ -1094,11 +1122,11 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel, ...@@ -1094,11 +1122,11 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
/* SAR enabled? */ /* SAR enabled? */
if (max_sdu_size > 0) { if (max_sdu_size > 0) {
ASSERT(skb_headroom(skb) >= (TTP_MAX_HEADER + TTP_SAR_HEADER), ASSERT(skb_headroom(tx_skb) >= (TTP_MAX_HEADER + TTP_SAR_HEADER),
return -1;); return -1;);
/* Insert SAR parameters */ /* Insert SAR parameters */
frame = skb_push(skb, TTP_HEADER+TTP_SAR_HEADER); frame = skb_push(tx_skb, TTP_HEADER+TTP_SAR_HEADER);
frame[0] = TTP_PARAMETERS | n; frame[0] = TTP_PARAMETERS | n;
frame[1] = 0x04; /* Length */ frame[1] = 0x04; /* Length */
...@@ -1109,7 +1137,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel, ...@@ -1109,7 +1137,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
(__u16 *)(frame+4)); (__u16 *)(frame+4));
} else { } else {
/* Insert plain TTP header */ /* Insert plain TTP header */
frame = skb_push(skb, TTP_HEADER); frame = skb_push(tx_skb, TTP_HEADER);
/* Insert initial credit in frame */ /* Insert initial credit in frame */
frame[0] = n & 0x7f; frame[0] = n & 0x7f;
...@@ -1117,7 +1145,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel, ...@@ -1117,7 +1145,7 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
/* Connect with IrLMP. No QoS parameters for now */ /* Connect with IrLMP. No QoS parameters for now */
return irlmp_connect_request(self->lsap, dtsap_sel, saddr, daddr, qos, return irlmp_connect_request(self->lsap, dtsap_sel, saddr, daddr, qos,
skb); tx_skb);
} }
/* /*
...@@ -1201,7 +1229,8 @@ static void irttp_connect_confirm(void *instance, void *sap, ...@@ -1201,7 +1229,8 @@ static void irttp_connect_confirm(void *instance, void *sap,
self->notify.connect_confirm(self->notify.instance, self, qos, self->notify.connect_confirm(self->notify.instance, self, qos,
self->tx_max_sdu_size, self->tx_max_sdu_size,
self->max_header_size, skb); self->max_header_size, skb);
} } else
dev_kfree_skb(skb);
} }
/* /*
...@@ -1286,7 +1315,7 @@ void irttp_connect_indication(void *instance, void *sap, struct qos_info *qos, ...@@ -1286,7 +1315,7 @@ void irttp_connect_indication(void *instance, void *sap, struct qos_info *qos,
int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size, int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
struct sk_buff *userdata) struct sk_buff *userdata)
{ {
struct sk_buff *skb; struct sk_buff *tx_skb;
__u8 *frame; __u8 *frame;
int ret; int ret;
__u8 n; __u8 n;
...@@ -1299,19 +1328,19 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size, ...@@ -1299,19 +1328,19 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
/* Any userdata supplied? */ /* Any userdata supplied? */
if (userdata == NULL) { if (userdata == NULL) {
skb = dev_alloc_skb(64); tx_skb = dev_alloc_skb(64);
if (!skb) if (!tx_skb)
return -ENOMEM; return -ENOMEM;
/* Reserve space for MUX_CONTROL and LAP header */ /* Reserve space for MUX_CONTROL and LAP header */
skb_reserve(skb, TTP_MAX_HEADER); skb_reserve(tx_skb, TTP_MAX_HEADER);
} else { } else {
skb = userdata; tx_skb = userdata;
/* /*
* Check that the client has reserved enough space for * Check that the client has reserved enough space for
* headers * headers
*/ */
ASSERT(skb_headroom(skb) >= TTP_MAX_HEADER, return -1;); ASSERT(skb_headroom(tx_skb) >= TTP_MAX_HEADER, return -1;);
} }
self->avail_credit = 0; self->avail_credit = 0;
...@@ -1333,11 +1362,11 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size, ...@@ -1333,11 +1362,11 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
/* SAR enabled? */ /* SAR enabled? */
if (max_sdu_size > 0) { if (max_sdu_size > 0) {
ASSERT(skb_headroom(skb) >= (TTP_MAX_HEADER+TTP_SAR_HEADER), ASSERT(skb_headroom(tx_skb) >= (TTP_MAX_HEADER+TTP_SAR_HEADER),
return -1;); return -1;);
/* Insert TTP header with SAR parameters */ /* Insert TTP header with SAR parameters */
frame = skb_push(skb, TTP_HEADER+TTP_SAR_HEADER); frame = skb_push(tx_skb, TTP_HEADER+TTP_SAR_HEADER);
frame[0] = TTP_PARAMETERS | n; frame[0] = TTP_PARAMETERS | n;
frame[1] = 0x04; /* Length */ frame[1] = 0x04; /* Length */
...@@ -1352,12 +1381,12 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size, ...@@ -1352,12 +1381,12 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
(__u16 *)(frame+4)); (__u16 *)(frame+4));
} else { } else {
/* Insert TTP header */ /* Insert TTP header */
frame = skb_push(skb, TTP_HEADER); frame = skb_push(tx_skb, TTP_HEADER);
frame[0] = n & 0x7f; frame[0] = n & 0x7f;
} }
ret = irlmp_connect_response(self->lsap, skb); ret = irlmp_connect_response(self->lsap, tx_skb);
return ret; return ret;
} }
...@@ -1423,7 +1452,6 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance) ...@@ -1423,7 +1452,6 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata, int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata,
int priority) int priority)
{ {
struct sk_buff *skb;
int ret; int ret;
ASSERT(self != NULL, return -1;); ASSERT(self != NULL, return -1;);
...@@ -1488,16 +1516,17 @@ int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata, ...@@ -1488,16 +1516,17 @@ int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata,
self->connected = FALSE; self->connected = FALSE;
if (!userdata) { if (!userdata) {
skb = dev_alloc_skb(64); struct sk_buff *tx_skb;
if (!skb) tx_skb = dev_alloc_skb(64);
if (!tx_skb)
return -ENOMEM; return -ENOMEM;
/* /*
* Reserve space for MUX and LAP header * Reserve space for MUX and LAP header
*/ */
skb_reserve(skb, TTP_MAX_HEADER); skb_reserve(tx_skb, TTP_MAX_HEADER);
userdata = skb; userdata = tx_skb;
} }
ret = irlmp_disconnect_request(self->lsap, userdata); ret = irlmp_disconnect_request(self->lsap, userdata);
...@@ -1556,7 +1585,7 @@ void irttp_disconnect_indication(void *instance, void *sap, LM_REASON reason, ...@@ -1556,7 +1585,7 @@ void irttp_disconnect_indication(void *instance, void *sap, LM_REASON reason,
/* /*
* Function irttp_do_data_indication (self, skb) * Function irttp_do_data_indication (self, skb)
* *
* Try to deliver reassebled skb to layer above, and requeue it if that * Try to deliver reassembled skb to layer above, and requeue it if that
* for some reason should fail. We mark rx sdu as busy to apply back * for some reason should fail. We mark rx sdu as busy to apply back
* pressure is necessary. * pressure is necessary.
*/ */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7