]> rtime.felk.cvut.cz Git - linux-lin.git/blobdiff - sllin/sllin.c
sllin: Fixed potential invalid pointer dereference.
[linux-lin.git] / sllin / sllin.c
index e2d430ac9e1b2bb5d36e4e8e8c657ab23ff34cdf..601979a2213232c5beae2081126b2ef17ca3b591 100644 (file)
@@ -157,7 +157,9 @@ struct sllin {
 #define SLF_RXEVENT            2               /* Rx wake event             */
 #define SLF_TXEVENT            3               /* Tx wake event             */
 #define SLF_MSGEVENT           4               /* CAN message to sent       */
-#define SLF_TMOUTEVENT          5               /* Timeout on received data  */
+#define SLF_TMOUTEVENT         5               /* Timeout on received data  */
+#define SLF_TXBUFF_RQ          6               /* Req. to send buffer to UART*/
+#define SLF_TXBUFF_INPR                7               /* Above request in progress */
 
        dev_t                   line;
        struct task_struct      *kwthread;
@@ -169,10 +171,15 @@ struct sllin {
 
        /* List with configurations for each of 0 to LIN_ID_MAX LIN IDs */
        struct sllin_conf_entry linfr_cache[LIN_ID_MAX + 1];
+       spinlock_t              linfr_lock;     /* frame cache and buffers lock */
 };
 
 static struct net_device **sllin_devs;
 static int sllin_configure_frame_cache(struct sllin *sl, struct can_frame *cf);
+static void sllin_slave_receive_buf(struct tty_struct *tty,
+                             const unsigned char *cp, char *fp, int count);
+static void sllin_master_receive_buf(struct tty_struct *tty,
+                             const unsigned char *cp, char *fp, int count);
 
 
 /* Values of two parity bits in LIN Protected
@@ -234,9 +241,8 @@ static void sllin_send_canfr(struct sllin *sl, canid_t id, char *data, int len)
 
        cf.can_id = id;
        cf.can_dlc = len;
-       if (cf.can_dlc > 0) {
+       if (cf.can_dlc > 0)
                memcpy(&cf.data, data, cf.can_dlc);
-       }
 
        skb = dev_alloc_skb(sizeof(struct can_frame));
        if (!skb)
@@ -281,7 +287,7 @@ static void sll_send_rtr(struct sllin *sl)
  */
 static void sllin_write_wakeup(struct tty_struct *tty)
 {
-       int actual;
+       int actual = 0;
        int remains;
        struct sllin *sl = (struct sllin *) tty->disc_data;
 
@@ -289,22 +295,35 @@ static void sllin_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLLIN_MAGIC || !netif_running(sl->dev))
                return;
 
-       if (sl->lin_state != SLSTATE_BREAK_SENT)
-               remains = sl->tx_lim - sl->tx_cnt;
-       else
-               remains = SLLIN_BUFF_BREAK + 1 - sl->tx_cnt;
-
-       if (remains > 0) {
-               actual = tty->ops->write(tty, sl->tx_buff + sl->tx_cnt,
-                       sl->tx_cnt - sl->tx_lim);
-               sl->tx_cnt += actual;
-
-               if (sl->tx_cnt < sl->tx_lim) {
-                       pr_debug("sllin: sllin_write_wakeup sent %d, "
-                               "remains %d, waiting\n",
-                               sl->tx_cnt, sl->tx_lim - sl->tx_cnt);
-                       return;
+       set_bit(SLF_TXBUFF_RQ, &sl->flags);
+       do {
+               if (unlikely(test_and_set_bit(SLF_TXBUFF_INPR, &sl->flags)))
+                       return; /* ongoing concurrent processing */
+
+               clear_bit(SLF_TXBUFF_RQ, &sl->flags);
+               smp_mb__after_clear_bit();
+
+               if (sl->lin_state != SLSTATE_BREAK_SENT)
+                       remains = sl->tx_lim - sl->tx_cnt;
+               else
+                       remains = SLLIN_BUFF_BREAK + 1 - sl->tx_cnt;
+
+               if (remains > 0) {
+                       actual = tty->ops->write(tty, sl->tx_buff + sl->tx_cnt,
+                               sl->tx_cnt - sl->tx_lim);
+                       sl->tx_cnt += actual;
+                       remains -= actual;
                }
+               clear_bit(SLF_TXBUFF_INPR, &sl->flags);
+               smp_mb__after_clear_bit();
+
+       } while (unlikely(test_bit(SLF_TXBUFF_RQ, &sl->flags)));
+
+       if ((remains > 0) && (actual >= 0)) {
+               pr_debug("sllin: sllin_write_wakeup sent %d, "
+                       "remains %d, waiting\n",
+                       sl->tx_cnt, sl->tx_lim - sl->tx_cnt);
+               return;
        }
 
        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
@@ -334,6 +353,7 @@ static netdev_tx_t sll_xmit(struct sk_buff *skb, struct net_device *dev)
                goto err_out_unlock;
        }
        if (sl->tty == NULL) {
+               printk(KERN_WARNING "%s: xmit: no tty device connected\n", dev->name);
                goto err_out_unlock;
        }
 
@@ -387,7 +407,7 @@ static int sll_open(struct net_device *dev)
 {
        struct sllin *sl = netdev_priv(dev);
 
-       pr_debug("sllin: %s() invoked\n", __FUNCTION__);
+       pr_debug("sllin: %s() invoked\n", __func__);
 
        if (sl->tty == NULL)
                return -ENODEV;
@@ -431,21 +451,10 @@ static void sll_setup(struct net_device *dev)
 /******************************************
   Routines looking at TTY side.
  ******************************************/
-#define SLL_RESPONSE_RECEIVED          ((sl->header_received == true) && \
-                                        ((sl->rx_cnt >= sl->rx_expect) || \
-                                        ((sl->rx_len_unknown == true) && (count == 0))))
-
-#define SLL_HEADER_RECEIVED            ((sl->header_received == false) && \
-                                        (sl->rx_cnt >= (SLLIN_BUFF_ID + 1)))
-
-static void sllin_receive_buf(struct tty_struct *tty,
+static void sllin_master_receive_buf(struct tty_struct *tty,
                              const unsigned char *cp, char *fp, int count)
 {
        struct sllin *sl = (struct sllin *) tty->disc_data;
-       pr_debug("sllin: sllin_receive_buf invoked, count = %u\n", count);
-
-       if (!sl || sl->magic != SLLIN_MAGIC || !netif_running(sl->dev))
-               return;
 
        /* Read the characters out of the buffer */
        while (count--) {
@@ -454,15 +463,11 @@ static void sllin_receive_buf(struct tty_struct *tty,
                                "due marker 0x%02x, flags 0x%lx\n",
                                *cp, *(fp-1), sl->flags);
 
-                       if (sl->lin_master == true) { /* Report error */
+                       /* i.e. Real error -- not Break */
+                       if (sl->rx_cnt > SLLIN_BUFF_BREAK) {
                                set_bit(SLF_ERROR, &sl->flags);
                                wake_up(&sl->kwt_wq);
                                return;
-                       } else { /* Received Break */
-                               sl->rx_cnt = 0;
-                               sl->rx_expect = SLLIN_BUFF_ID + 1;
-                               sl->rx_len_unknown = false; /* We do know exact length of the header */
-                               sl->header_received = false;
                        }
                }
 
@@ -472,63 +477,128 @@ static void sllin_receive_buf(struct tty_struct *tty,
                        pr_debug("sllin: LIN_RX[%d]: 0x00\n", sl->rx_cnt);
                        sl->rx_buff[sl->rx_cnt++] = 0x00;
                }
-#endif
+#endif /* BREAK_BY_BAUD */
+
                if (sl->rx_cnt < SLLIN_BUFF_LEN) {
                        pr_debug("sllin: LIN_RX[%d]: 0x%02x\n", sl->rx_cnt, *cp);
                        sl->rx_buff[sl->rx_cnt++] = *cp++;
                }
+       }
 
-               if (sl->lin_master == true) {
-                       if (SLL_RESPONSE_RECEIVED) {
-                               set_bit(SLF_RXEVENT, &sl->flags);
-                               wake_up(&sl->kwt_wq);
-                               pr_debug("sllin: sllin_receive_buf count %d, wakeup\n", sl->rx_cnt);
-                       } else {
-                               pr_debug("sllin: sllin_receive_buf count %d, waiting\n", sl->rx_cnt);
+
+       if (sl->rx_cnt >= sl->rx_expect) {
+               set_bit(SLF_RXEVENT, &sl->flags);
+               wake_up(&sl->kwt_wq);
+               pr_debug("sllin: sllin_receive_buf count %d, wakeup\n", sl->rx_cnt);
+       } else {
+               pr_debug("sllin: sllin_receive_buf count %d, waiting\n", sl->rx_cnt);
+       }
+}
+
+
+static void sllin_slave_receive_buf(struct tty_struct *tty,
+                             const unsigned char *cp, char *fp, int count)
+{
+       struct sllin *sl = (struct sllin *) tty->disc_data;
+       int lin_id;
+       struct sllin_conf_entry *sce;
+
+
+       /* Read the characters out of the buffer */
+       while (count--) {
+               if (fp && *fp++) {
+                       pr_debug("sllin: sllin_receive_buf char 0x%02x ignored "
+                               "due marker 0x%02x, flags 0x%lx\n",
+                               *cp, *(fp-1), sl->flags);
+
+                       /* Received Break */
+                       sl->rx_cnt = 0;
+                       sl->rx_expect = SLLIN_BUFF_ID + 1;
+                       sl->rx_len_unknown = false; /* We do know exact length of the header */
+                       sl->header_received = false;
+               }
+
+               if (sl->rx_cnt < SLLIN_BUFF_LEN) {
+                       pr_debug("sllin: LIN_RX[%d]: 0x%02x\n", sl->rx_cnt, *cp);
+
+                       /* We did not receive break (0x00) character */
+                       if ((sl->rx_cnt == SLLIN_BUFF_BREAK) && (*cp == 0x55)) {
+                               sl->rx_buff[sl->rx_cnt++] = 0x00;
                        }
-               } else { /* LIN slave */
-                       int lin_id;
-                       struct sllin_conf_entry *sce;
-
-                       pr_debug("sllin: rx_cnt = %u; header_received = %u\n",
-                                       sl->rx_cnt, sl->header_received);
-
-                       if (SLL_HEADER_RECEIVED) {
-                               lin_id = sl->rx_buff[SLLIN_BUFF_ID] & LIN_ID_MASK;
-                               sce = &sl->linfr_cache[lin_id];
-
-                               spin_lock(&sl->lock);
-                               /* Is the length of data set in frame cache? */
-                               if (sce->frame_fl & LIN_LOC_SLAVE_CACHE) {
-                                       sl->rx_expect += sce->dlc;
-                                       sl->rx_len_unknown = false;
-                               } else {
-                                       sl->rx_expect += SLLIN_DATA_MAX + 1; /* + checksum */
-                                       sl->rx_len_unknown = true;
+
+                       if (sl->rx_cnt == SLLIN_BUFF_SYNC) {
+                               /* 'Duplicated' break character -- ignore */
+                               if (*cp == 0x00) {
+                                       cp++;
+                                       continue;
                                }
-                               spin_unlock(&sl->lock);
 
-                               sl->header_received = true;
-                               sll_send_rtr(sl);
-                               continue;
+                               /* Wrong sync character */
+                               if (*cp != 0x55)
+                                       break;
                        }
 
-                       if (SLL_RESPONSE_RECEIVED) {
-                               sll_bump(sl);
-                               pr_debug("sllin: Received LIN header & LIN response. "
-                                               "rx_cnt = %u, rx_expect = %u\n", sl->rx_cnt,
-                                               sl->rx_expect);
-
-                               /* Prepare for reception of new header */
-                               sl->rx_cnt = 0;
-                               sl->rx_expect = SLLIN_BUFF_ID + 1;
-                               sl->rx_len_unknown = false; /* We do know exact length of the header */
-                               sl->header_received = false;
+                       sl->rx_buff[sl->rx_cnt++] = *cp++;
+               }
+
+               /* Header received */
+               if ((sl->header_received == false) && (sl->rx_cnt >= (SLLIN_BUFF_ID + 1))) {
+                       unsigned long flags;
+
+                       lin_id = sl->rx_buff[SLLIN_BUFF_ID] & LIN_ID_MASK;
+                       sce = &sl->linfr_cache[lin_id];
+
+                       spin_lock_irqsave(&sl->linfr_lock, flags);
+                       /* Is the length of data set in frame cache? */
+                       if (sce->frame_fl & LIN_LOC_SLAVE_CACHE) {
+                               sl->rx_expect += sce->dlc;
+                               sl->rx_len_unknown = false;
+                       } else {
+                               sl->rx_expect += SLLIN_DATA_MAX + 1; /* + checksum */
+                               sl->rx_len_unknown = true;
                        }
+                       spin_unlock_irqrestore(&sl->linfr_lock, flags);
+
+                       sl->header_received = true;
+                       sll_send_rtr(sl);
+                       continue;
+               }
+
+               /* Response received */
+               if ((sl->header_received == true) &&
+                       ((sl->rx_cnt >= sl->rx_expect) ||
+                       ((sl->rx_len_unknown == true) && (count == 0)))) {
+
+                       sll_bump(sl);
+                       pr_debug("sllin: Received LIN header & LIN response. "
+                                       "rx_cnt = %u, rx_expect = %u\n", sl->rx_cnt,
+                                       sl->rx_expect);
+
+                       /* Prepare for reception of new header */
+                       sl->rx_cnt = 0;
+                       sl->rx_expect = SLLIN_BUFF_ID + 1;
+                       sl->rx_len_unknown = false; /* We do know exact length of the header */
+                       sl->header_received = false;
                }
        }
 }
 
+static void sllin_receive_buf(struct tty_struct *tty,
+                             const unsigned char *cp, char *fp, int count)
+{
+       struct sllin *sl = (struct sllin *) tty->disc_data;
+       pr_debug("sllin: sllin_receive_buf invoked, count = %u\n", count);
+
+       if (!sl || sl->magic != SLLIN_MAGIC || !netif_running(sl->dev))
+               return;
+
+       if (sl->lin_master)
+               sllin_master_receive_buf(tty, cp, fp, count);
+       else
+               sllin_slave_receive_buf(tty, cp, fp, count);
+
+}
+
 /*****************************************
  *  sllin message helper routines
  *****************************************/
@@ -565,12 +635,12 @@ void sllin_report_error(struct sllin *sl, int err)
  * @sl:
  * @cf: Pointer to CAN frame sent to this driver
  *     holding configuration information
- *
- * Called with sl->lock held. 
  */
 static int sllin_configure_frame_cache(struct sllin *sl, struct can_frame *cf)
 {
+       unsigned long flags;
        struct sllin_conf_entry *sce;
+
        if (!(cf->can_id & LIN_ID_CONF))
                return -1;
 
@@ -578,6 +648,8 @@ static int sllin_configure_frame_cache(struct sllin *sl, struct can_frame *cf)
        pr_debug("sllin: Setting frame cache with EFF CAN frame. "
                "LIN ID = %d\n", cf->can_id & LIN_ID_MASK);
 
+       spin_lock_irqsave(&sl->linfr_lock, flags);
+
        sce->dlc = cf->can_dlc;
        if (sce->dlc > SLLIN_DATA_MAX)
                sce->dlc = SLLIN_DATA_MAX;
@@ -585,6 +657,8 @@ static int sllin_configure_frame_cache(struct sllin *sl, struct can_frame *cf)
        sce->frame_fl = (cf->can_id & ~LIN_ID_MASK) & CAN_EFF_MASK;
        memcpy(sce->data, cf->data, cf->can_dlc);
 
+       spin_unlock_irqrestore(&sl->linfr_lock, flags);
+
        return 0;
 }
 
@@ -602,11 +676,10 @@ static inline unsigned sllin_checksum(unsigned char *data, int length, int enhan
        unsigned csum = 0;
        int i;
 
-       if (enhanced_fl) {
+       if (enhanced_fl)
                i = SLLIN_BUFF_ID;
-       } else {
+       else
                i = SLLIN_BUFF_DATA;
-       }
 
        for (; i < length; i++) {
                csum += data[i];
@@ -668,38 +741,56 @@ int sllin_send_tx_buff(struct sllin *sl)
        int remains;
        int res;
 
+       set_bit(SLF_TXBUFF_RQ, &sl->flags);
+       do {
+               if (unlikely(test_and_set_bit(SLF_TXBUFF_INPR, &sl->flags)))
+                       return 0;       /* ongoing concurrent processing */
+
+               clear_bit(SLF_TXBUFF_RQ, &sl->flags);
+               smp_mb__after_clear_bit();
+
 #ifdef BREAK_BY_BAUD
-       if (sl->lin_state != SLSTATE_BREAK_SENT)
-               remains = sl->tx_lim - sl->tx_cnt;
-       else
-               remains = 1;
+               if (sl->lin_state != SLSTATE_BREAK_SENT)
+                       remains = sl->tx_lim - sl->tx_cnt;
+               else
+                       remains = 1;
 #else
-       remains = sl->tx_lim - sl->tx_cnt;
+               remains = sl->tx_lim - sl->tx_cnt;
 #endif
 
-       res = tty->ops->write(tty, sl->tx_buff + sl->tx_cnt, remains);
-       if (res < 0)
-               return -1;
-
-       remains -= res;
-       sl->tx_cnt += res;
-
-       if (remains > 0) {
-               set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
                res = tty->ops->write(tty, sl->tx_buff + sl->tx_cnt, remains);
-               if (res < 0) {
-                       clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-                       return -1;
-               }
+               if (res < 0)
+                       goto error_in_write;
 
                remains -= res;
                sl->tx_cnt += res;
-       }
 
-       pr_debug("sllin: sllin_send_tx_buff sent %d, remains %d\n",
-                       sl->tx_cnt, remains);
+               if (remains > 0) {
+                       set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                       res = tty->ops->write(tty, sl->tx_buff + sl->tx_cnt, remains);
+                       if (res < 0) {
+                               clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                               goto error_in_write;
+                       }
+
+                       remains -= res;
+                       sl->tx_cnt += res;
+               }
+
+               pr_debug("sllin: sllin_send_tx_buff sent %d, remains %d\n",
+                               sl->tx_cnt, remains);
+
+               clear_bit(SLF_TXBUFF_INPR, &sl->flags);
+               smp_mb__after_clear_bit();
+
+       } while (unlikely(test_bit(SLF_TXBUFF_RQ, &sl->flags)));
 
        return 0;
+
+error_in_write:
+       clear_bit(SLF_TXBUFF_INPR, &sl->flags);
+       return -1;
+
 }
 
 #ifdef BREAK_BY_BAUD
@@ -788,18 +879,20 @@ static enum hrtimer_restart sllin_rx_timeout_handler(struct hrtimer *hrtimer)
  */
 static int sllin_rx_validate(struct sllin *sl)
 {
+       unsigned long flags;
        int actual_id;
        int ext_chcks_fl;
        int lin_dlc;
        unsigned char rec_chcksm = sl->rx_buff[sl->rx_cnt - 1];
-       struct sllin_conf_entry *scf;
+       struct sllin_conf_entry *sce;
 
        actual_id = sl->rx_buff[SLLIN_BUFF_ID] & LIN_ID_MASK;
-       scf = &sl->linfr_cache[actual_id];
-       spin_lock(&sl->lock);
-       lin_dlc = scf->dlc;
-       ext_chcks_fl = scf->frame_fl & LIN_CHECKSUM_EXTENDED;
-       spin_unlock(&sl->lock);
+       sce = &sl->linfr_cache[actual_id];
+
+       spin_lock_irqsave(&sl->linfr_lock, flags);
+       lin_dlc = sce->dlc;
+       ext_chcks_fl = sce->frame_fl & LIN_CHECKSUM_EXTENDED;
+       spin_unlock_irqrestore(&sl->linfr_lock, flags);
 
        if (sllin_checksum(sl->rx_buff, sl->rx_cnt - 1, ext_chcks_fl) !=
                rec_chcksm) {
@@ -900,30 +993,36 @@ int sllin_kwthread(void *ptr)
 
                        /* SFF RTR CAN frame -> LIN header */
                        if (cf->can_id & CAN_RTR_FLAG) {
-                               spin_lock(&sl->lock);
+                               unsigned long flags;
+                               struct sllin_conf_entry *sce;
+
                                pr_debug("sllin: %s: RTR SFF CAN frame, ID = %x\n",
-                                       __FUNCTION__, cf->can_id & LIN_ID_MASK);
+                                       __func__, cf->can_id & LIN_ID_MASK);
+
+                               sce = &sl->linfr_cache[cf->can_id & LIN_ID_MASK];
+                               spin_lock_irqsave(&sl->linfr_lock, flags);
 
                                /* Is there Slave response in linfr_cache to be sent? */
-                               if ((sl->linfr_cache[cf->can_id & LIN_ID_MASK].frame_fl &
-                                       LIN_LOC_SLAVE_CACHE)
-                                       && (sl->linfr_cache[cf->can_id & LIN_ID_MASK].dlc > 0)) {
+                               if ((sce->frame_fl & LIN_LOC_SLAVE_CACHE)
+                                       && (sce->dlc > 0)) {
 
                                        pr_debug("sllin: Sending LIN response from linfr_cache\n");
-                                       lin_data = sl->linfr_cache[cf->can_id & LIN_ID_MASK].data;
-                                       lin_dlc = sl->linfr_cache[cf->can_id & LIN_ID_MASK].dlc;
+
+                                       lin_data = sce->data;
+                                       lin_dlc = sce->dlc;
                                        if (lin_dlc > SLLIN_DATA_MAX)
                                                lin_dlc = SLLIN_DATA_MAX;
                                        memcpy(lin_data_buff, lin_data, lin_dlc);
                                        lin_data = lin_data_buff;
                                } else {
                                        lin_data = NULL;
-                                       lin_dlc = sl->linfr_cache[cf->can_id & LIN_ID_MASK].dlc;
+                                       lin_dlc = sce->dlc;
                                }
-                               spin_unlock(&sl->lock);
+                               spin_unlock_irqrestore(&sl->linfr_lock, flags);
+
                        } else { /* SFF NON-RTR CAN frame -> LIN header + LIN response */
                                pr_debug("sllin: %s: NON-RTR SFF CAN frame, ID = %x\n",
-                                       __FUNCTION__, (int)cf->can_id & LIN_ID_MASK);
+                                       __func__, (int)cf->can_id & LIN_ID_MASK);
 
                                lin_data = cf->data;
                                lin_dlc = cf->can_dlc;
@@ -1136,6 +1235,7 @@ static struct sllin *sll_alloc(dev_t line)
        sl->magic = SLLIN_MAGIC;
        sl->dev = dev;
        spin_lock_init(&sl->lock);
+       spin_lock_init(&sl->linfr_lock);
        sllin_devs[i] = dev;
 
        return sl;
@@ -1155,7 +1255,7 @@ static int sllin_open(struct tty_struct *tty)
 {
        struct sllin *sl;
        int err;
-       pr_debug("sllin: %s() invoked\n", __FUNCTION__);
+       pr_debug("sllin: %s() invoked\n", __func__);
 
        if (!capable(CAP_NET_ADMIN))
                return -EPERM;