selinux: fix overflow and 0 length allocations
[deliverable/linux.git] / net / mac802154 / rx.c
1 /*
2 * Copyright (C) 2007-2012 Siemens AG
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2
6 * as published by the Free Software Foundation.
7 *
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
12 *
13 * Written by:
14 * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
15 * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
16 * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
17 * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
18 */
19
20 #include <linux/kernel.h>
21 #include <linux/module.h>
22 #include <linux/netdevice.h>
23 #include <linux/crc-ccitt.h>
24 #include <asm/unaligned.h>
25
26 #include <net/mac802154.h>
27 #include <net/ieee802154_netdev.h>
28 #include <net/nl802154.h>
29
30 #include "ieee802154_i.h"
31
32 static int ieee802154_deliver_skb(struct sk_buff *skb)
33 {
34 skb->ip_summed = CHECKSUM_UNNECESSARY;
35 skb->protocol = htons(ETH_P_IEEE802154);
36
37 return netif_receive_skb(skb);
38 }
39
40 static int
41 ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
42 struct sk_buff *skb, const struct ieee802154_hdr *hdr)
43 {
44 struct wpan_dev *wpan_dev = &sdata->wpan_dev;
45 __le16 span, sshort;
46 int rc;
47
48 pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
49
50 span = wpan_dev->pan_id;
51 sshort = wpan_dev->short_addr;
52
53 switch (mac_cb(skb)->dest.mode) {
54 case IEEE802154_ADDR_NONE:
55 if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
56 /* FIXME: check if we are PAN coordinator */
57 skb->pkt_type = PACKET_OTHERHOST;
58 else
59 /* ACK comes with both addresses empty */
60 skb->pkt_type = PACKET_HOST;
61 break;
62 case IEEE802154_ADDR_LONG:
63 if (mac_cb(skb)->dest.pan_id != span &&
64 mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
65 skb->pkt_type = PACKET_OTHERHOST;
66 else if (mac_cb(skb)->dest.extended_addr == wpan_dev->extended_addr)
67 skb->pkt_type = PACKET_HOST;
68 else
69 skb->pkt_type = PACKET_OTHERHOST;
70 break;
71 case IEEE802154_ADDR_SHORT:
72 if (mac_cb(skb)->dest.pan_id != span &&
73 mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
74 skb->pkt_type = PACKET_OTHERHOST;
75 else if (mac_cb(skb)->dest.short_addr == sshort)
76 skb->pkt_type = PACKET_HOST;
77 else if (mac_cb(skb)->dest.short_addr ==
78 cpu_to_le16(IEEE802154_ADDR_BROADCAST))
79 skb->pkt_type = PACKET_BROADCAST;
80 else
81 skb->pkt_type = PACKET_OTHERHOST;
82 break;
83 default:
84 pr_debug("invalid dest mode\n");
85 goto fail;
86 }
87
88 skb->dev = sdata->dev;
89
90 /* TODO this should be moved after netif_receive_skb call, otherwise
91 * wireshark will show a mac header with security fields and the
92 * payload is already decrypted.
93 */
94 rc = mac802154_llsec_decrypt(&sdata->sec, skb);
95 if (rc) {
96 pr_debug("decryption failed: %i\n", rc);
97 goto fail;
98 }
99
100 sdata->dev->stats.rx_packets++;
101 sdata->dev->stats.rx_bytes += skb->len;
102
103 switch (mac_cb(skb)->type) {
104 case IEEE802154_FC_TYPE_DATA:
105 return ieee802154_deliver_skb(skb);
106 default:
107 pr_warn("ieee802154: bad frame received (type = %d)\n",
108 mac_cb(skb)->type);
109 goto fail;
110 }
111
112 fail:
113 kfree_skb(skb);
114 return NET_RX_DROP;
115 }
116
117 static void
118 ieee802154_print_addr(const char *name, const struct ieee802154_addr *addr)
119 {
120 if (addr->mode == IEEE802154_ADDR_NONE)
121 pr_debug("%s not present\n", name);
122
123 pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
124 if (addr->mode == IEEE802154_ADDR_SHORT) {
125 pr_debug("%s is short: %04x\n", name,
126 le16_to_cpu(addr->short_addr));
127 } else {
128 u64 hw = swab64((__force u64)addr->extended_addr);
129
130 pr_debug("%s is hardware: %8phC\n", name, &hw);
131 }
132 }
133
134 static int
135 ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
136 {
137 int hlen;
138 struct ieee802154_mac_cb *cb = mac_cb_init(skb);
139
140 skb_reset_mac_header(skb);
141
142 hlen = ieee802154_hdr_pull(skb, hdr);
143 if (hlen < 0)
144 return -EINVAL;
145
146 skb->mac_len = hlen;
147
148 pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
149 hdr->seq);
150
151 cb->type = hdr->fc.type;
152 cb->ackreq = hdr->fc.ack_request;
153 cb->secen = hdr->fc.security_enabled;
154
155 ieee802154_print_addr("destination", &hdr->dest);
156 ieee802154_print_addr("source", &hdr->source);
157
158 cb->source = hdr->source;
159 cb->dest = hdr->dest;
160
161 if (hdr->fc.security_enabled) {
162 u64 key;
163
164 pr_debug("seclevel %i\n", hdr->sec.level);
165
166 switch (hdr->sec.key_id_mode) {
167 case IEEE802154_SCF_KEY_IMPLICIT:
168 pr_debug("implicit key\n");
169 break;
170
171 case IEEE802154_SCF_KEY_INDEX:
172 pr_debug("key %02x\n", hdr->sec.key_id);
173 break;
174
175 case IEEE802154_SCF_KEY_SHORT_INDEX:
176 pr_debug("key %04x:%04x %02x\n",
177 le32_to_cpu(hdr->sec.short_src) >> 16,
178 le32_to_cpu(hdr->sec.short_src) & 0xffff,
179 hdr->sec.key_id);
180 break;
181
182 case IEEE802154_SCF_KEY_HW_INDEX:
183 key = swab64((__force u64)hdr->sec.extended_src);
184 pr_debug("key source %8phC %02x\n", &key,
185 hdr->sec.key_id);
186 break;
187 }
188 }
189
190 return 0;
191 }
192
193 static void
194 __ieee802154_rx_handle_packet(struct ieee802154_local *local,
195 struct sk_buff *skb)
196 {
197 int ret;
198 struct ieee802154_sub_if_data *sdata;
199 struct ieee802154_hdr hdr;
200
201 ret = ieee802154_parse_frame_start(skb, &hdr);
202 if (ret) {
203 pr_debug("got invalid frame\n");
204 kfree_skb(skb);
205 return;
206 }
207
208 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
209 if (sdata->wpan_dev.iftype != NL802154_IFTYPE_NODE)
210 continue;
211
212 if (!ieee802154_sdata_running(sdata))
213 continue;
214
215 ieee802154_subif_frame(sdata, skb, &hdr);
216 skb = NULL;
217 break;
218 }
219
220 kfree_skb(skb);
221 }
222
223 static void
224 ieee802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
225 {
226 struct sk_buff *skb2;
227 struct ieee802154_sub_if_data *sdata;
228
229 skb_reset_mac_header(skb);
230 skb->ip_summed = CHECKSUM_UNNECESSARY;
231 skb->pkt_type = PACKET_OTHERHOST;
232 skb->protocol = htons(ETH_P_IEEE802154);
233
234 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
235 if (sdata->wpan_dev.iftype != NL802154_IFTYPE_MONITOR)
236 continue;
237
238 if (!ieee802154_sdata_running(sdata))
239 continue;
240
241 skb2 = skb_clone(skb, GFP_ATOMIC);
242 if (skb2) {
243 skb2->dev = sdata->dev;
244 ieee802154_deliver_skb(skb2);
245
246 sdata->dev->stats.rx_packets++;
247 sdata->dev->stats.rx_bytes += skb->len;
248 }
249 }
250 }
251
252 void ieee802154_rx(struct ieee802154_local *local, struct sk_buff *skb)
253 {
254 u16 crc;
255
256 WARN_ON_ONCE(softirq_count() == 0);
257
258 if (local->suspended)
259 goto drop;
260
261 /* TODO: When a transceiver omits the checksum here, we
262 * add an own calculated one. This is currently an ugly
263 * solution because the monitor needs a crc here.
264 */
265 if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) {
266 crc = crc_ccitt(0, skb->data, skb->len);
267 put_unaligned_le16(crc, skb_put(skb, 2));
268 }
269
270 rcu_read_lock();
271
272 ieee802154_monitors_rx(local, skb);
273
274 /* Check if transceiver doesn't validate the checksum.
275 * If not we validate the checksum here.
276 */
277 if (local->hw.flags & IEEE802154_HW_RX_DROP_BAD_CKSUM) {
278 crc = crc_ccitt(0, skb->data, skb->len);
279 if (crc) {
280 rcu_read_unlock();
281 goto drop;
282 }
283 }
284 /* remove crc */
285 skb_trim(skb, skb->len - 2);
286
287 __ieee802154_rx_handle_packet(local, skb);
288
289 rcu_read_unlock();
290
291 return;
292 drop:
293 kfree_skb(skb);
294 }
295
296 void
297 ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
298 {
299 struct ieee802154_local *local = hw_to_local(hw);
300
301 mac_cb(skb)->lqi = lqi;
302 skb->pkt_type = IEEE802154_RX_MSG;
303 skb_queue_tail(&local->skb_queue, skb);
304 tasklet_schedule(&local->tasklet);
305 }
306 EXPORT_SYMBOL(ieee802154_rx_irqsafe);
This page took 0.03985 seconds and 5 git commands to generate.