Properly dereference files in case of bad socket type

[can-eth-gw-linux.git] / net / can / canethgw.c

diff --git a/net/can/canethgw.c b/net/can/canethgw.c
index d5b030215614a7d5c8312060163f0993a7d13840..8bed57c9d76aa57754c97b521e07931de2f90704 100644 (file)
--- a/net/can/canethgw.c
+++ b/net/can/canethgw.c
@@ -20,10 +20,23 @@
 #include <net/sock.h>
 #include <linux/can.h>
 #include <linux/miscdevice.h>
-#include "canethgw.h"
+#include <linux/can/canethgw.h>
 
 MODULE_LICENSE("GPL");
 
+enum msg_types {
+       CAN_FRAME,
+};
+
+struct cegw_job
+{
+       struct kref refcount;
+       struct socket* can_sock;
+       struct socket* udp_sock;
+       __u32  udp_dstcnt;
+       struct sockaddr_in udp_dst[0];
+};
+
 static int cegw_udp2can(void *data);
 static int cegw_udp_send(struct socket *udp_sock, struct can_frame *cf,
                struct sockaddr_in* addr);
@@ -36,8 +49,9 @@ static void cegw_job_release(struct kref *ref);
 static int cegw_udp_send(struct socket *udp_sock, struct can_frame *cf, struct sockaddr_in* addr)
 {
        struct msghdr mh;
-       struct kvec vec;
+       struct kvec vec[2];
        int err;
+       __u16 type = CAN_FRAME;
 
        mh.msg_name = addr;
        mh.msg_namelen = sizeof(*addr);
@@ -45,10 +59,12 @@ static int cegw_udp_send(struct socket *udp_sock, struct can_frame *cf, struct s
        mh.msg_controllen = 0;
        mh.msg_flags = 0;
 
-       vec.iov_base = cf;
-       vec.iov_len = sizeof(*cf);
+       type = cpu_to_be16(type);
+       vec[0].iov_base = &type;
+       vec[1].iov_base = cf;
+       vec[1].iov_len = sizeof(*cf);
 
-       err = kernel_sendmsg(udp_sock, &mh, &vec, 1, sizeof(*cf));
+       err = kernel_sendmsg(udp_sock, &mh, vec, 2, sizeof(*cf));
 
        return err;
 }
@@ -81,26 +97,34 @@ static int cegw_can_send(struct socket* can_sock, struct can_frame* cf)
 static int cegw_udp2can(void *data)
 {
        struct can_frame cf;
-       struct kvec vec;
+       struct kvec vec[2];
        struct msghdr mh;
        struct cegw_job *job = (struct cegw_job *)data;
        struct socket *udp_sock = NULL, *can_sock = NULL;
        int ret = 0;
+       __u16 type;
 
        memset(&mh, 0, sizeof(mh));
        udp_sock = job->udp_sock;
        can_sock = job->can_sock;
 
        while (1) {
-               vec.iov_base = &cf;
-               vec.iov_len = sizeof(cf);
-               ret = kernel_recvmsg(udp_sock, &mh, &vec, 1,
-                               sizeof(cf), 0);
-               if (ret < 1)
+               vec[0].iov_base = &type;
+               vec[0].iov_len = sizeof(type);
+               vec[1].iov_base = &cf;
+               vec[1].iov_len = sizeof(cf);
+               ret = kernel_recvmsg(udp_sock, &mh, vec, 2,
+                                    sizeof(cf), 0);
+               if (ret != sizeof(type) + sizeof(cf))
                        break;
 
-               cf.can_id = be32_to_cpu(cf.can_id);
-               cegw_can_send(can_sock, &cf);
+               type = be16_to_cpu(type);
+               switch (type) {
+               case CAN_FRAME:
+                       cf.can_id = be32_to_cpu(cf.can_id);
+                       cegw_can_send(can_sock, &cf);
+               default:;
+               }
        }
 
        cegw_thread_stop(job);
@@ -131,8 +155,8 @@ static int cegw_can2udp(void* data)
                vec.iov_len = sizeof(cf);
 
                ret = kernel_recvmsg(can_sock, &mh, &vec, 1,
-                                          sizeof(cf), 0);
-               if (ret < 1)
+                                    sizeof(cf), 0);
+               if (ret != sizeof(cf))
                        break;
 
                cf.can_id = cpu_to_be32(cf.can_id);
@@ -168,14 +192,14 @@ static int cegw_thread_start(void *data)
        struct cegw_job *job = (struct cegw_job *)data;
 
        kref_init(&job->refcount);
-       kref_get(&job->refcount);
 
        task = kthread_run(cegw_udp2can, data, "canethgw_udp2can");
        if (IS_ERR(task)) {
-               kref_sub(&job->refcount, 2, cegw_job_release);
+               kref_put(&job->refcount, cegw_job_release);
                return -ENOMEM;
        }
 
+       kref_get(&job->refcount);
        task = kthread_run(cegw_can2udp, data, "canethgw_can2udp");
        if (IS_ERR(task)) {
                cegw_thread_stop(job);
@@ -258,7 +282,6 @@ static long cegw_ioctl_start(struct file *file, unsigned long arg)
        if (addrlen != sizeof(struct sockaddr_in))
                return -EAFNOSUPPORT;
 
-       /* */
        job = kmalloc(GFP_KERNEL, sizeof(*job) + dstcnt*addrlen );
        if (job == NULL)
                return -ENOMEM;
@@ -289,6 +312,14 @@ static long cegw_ioctl_start(struct file *file, unsigned long arg)
                return err;
        }
 
+       if (job->can_sock->ops->family != AF_CAN ||
+           job->can_sock->type != SOCK_RAW) {
+               fput(job->udp_sock->file);
+               fput(job->can_sock->file);
+               kfree(job);
+               return -EBADF;
+       }
+
        job->udp_dstcnt = dstcnt;
 
        err = cegw_thread_start(job);
@@ -301,7 +332,7 @@ static long cegw_ioctl_start(struct file *file, unsigned long arg)
 
 static long cegw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-       int err;
+       long err;
 
        switch (cmd) {
                case CEGW_IOCTL_START:
@@ -330,9 +361,8 @@ static struct miscdevice cegw_device = {
 
 static int __init cegw_init(void)
 {
-       misc_register(&cegw_device);
-
-       return 0;
+       pr_info("can: can-eth gateway\n");
+       return misc_register(&cegw_device);
 }
 
 static void __exit cegw_exit(void)
@@ -344,4 +374,3 @@ static void __exit cegw_exit(void)
 
 module_init(cegw_init);
 module_exit(cegw_exit);
-