]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/ax25/ax25_route.c
ax25: add refcount in ax25_dev to avoid UAF bugs
[mirror_ubuntu-jammy-kernel.git] / net / ax25 / ax25_route.c
CommitLineData
2874c5fd 1// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 2/*
1da177e4
LT
3 *
4 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
5 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
6 * Copyright (C) Steven Whitehouse GW7RRM (stevew@acm.org)
7 * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
8 * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
9 * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
10 */
4fc268d2
RD
11
12#include <linux/capability.h>
1da177e4
LT
13#include <linux/errno.h>
14#include <linux/types.h>
15#include <linux/socket.h>
16#include <linux/timer.h>
17#include <linux/in.h>
18#include <linux/kernel.h>
19#include <linux/sched.h>
20#include <linux/string.h>
21#include <linux/sockios.h>
22#include <linux/net.h>
5a0e3ad6 23#include <linux/slab.h>
1da177e4
LT
24#include <net/ax25.h>
25#include <linux/inet.h>
26#include <linux/netdevice.h>
27#include <linux/if_arp.h>
28#include <linux/skbuff.h>
29#include <linux/spinlock.h>
30#include <net/sock.h>
7c0f6ba6 31#include <linux/uaccess.h>
1da177e4
LT
32#include <linux/fcntl.h>
33#include <linux/mm.h>
34#include <linux/interrupt.h>
35#include <linux/init.h>
36#include <linux/seq_file.h>
bc3b2d7f 37#include <linux/export.h>
1da177e4
LT
38
39static ax25_route *ax25_route_list;
63530aba 40DEFINE_RWLOCK(ax25_route_lock);
1da177e4 41
1da177e4
LT
42void ax25_rt_device_down(struct net_device *dev)
43{
44 ax25_route *s, *t, *ax25_rt;
45
4de211f1 46 write_lock_bh(&ax25_route_lock);
1da177e4
LT
47 ax25_rt = ax25_route_list;
48 while (ax25_rt != NULL) {
49 s = ax25_rt;
50 ax25_rt = ax25_rt->next;
51
52 if (s->dev == dev) {
53 if (ax25_route_list == s) {
54 ax25_route_list = s->next;
a51482bd 55 kfree(s->digipeat);
1da177e4
LT
56 kfree(s);
57 } else {
58 for (t = ax25_route_list; t != NULL; t = t->next) {
59 if (t->next == s) {
60 t->next = s->next;
a51482bd 61 kfree(s->digipeat);
1da177e4
LT
62 kfree(s);
63 break;
64 }
65 }
66 }
67 }
68 }
4de211f1 69 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
70}
71
c9266b99 72static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
1da177e4
LT
73{
74 ax25_route *ax25_rt;
75 ax25_dev *ax25_dev;
76 int i;
77
78 if ((ax25_dev = ax25_addr_ax25dev(&route->port_addr)) == NULL)
79 return -EINVAL;
80 if (route->digi_count > AX25_MAX_DIGIS)
81 return -EINVAL;
82
4de211f1 83 write_lock_bh(&ax25_route_lock);
1da177e4
LT
84
85 ax25_rt = ax25_route_list;
86 while (ax25_rt != NULL) {
87 if (ax25cmp(&ax25_rt->callsign, &route->dest_addr) == 0 &&
528930b9 88 ax25_rt->dev == ax25_dev->dev) {
a51482bd
JJ
89 kfree(ax25_rt->digipeat);
90 ax25_rt->digipeat = NULL;
1da177e4
LT
91 if (route->digi_count != 0) {
92 if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
4de211f1 93 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
94 return -ENOMEM;
95 }
96 ax25_rt->digipeat->lastrepeat = -1;
97 ax25_rt->digipeat->ndigi = route->digi_count;
98 for (i = 0; i < route->digi_count; i++) {
99 ax25_rt->digipeat->repeated[i] = 0;
100 ax25_rt->digipeat->calls[i] = route->digi_addr[i];
101 }
102 }
4de211f1 103 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
104 return 0;
105 }
106 ax25_rt = ax25_rt->next;
107 }
108
109 if ((ax25_rt = kmalloc(sizeof(ax25_route), GFP_ATOMIC)) == NULL) {
4de211f1 110 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
111 return -ENOMEM;
112 }
113
39f25d42 114 refcount_set(&ax25_rt->refcount, 1);
1da177e4
LT
115 ax25_rt->callsign = route->dest_addr;
116 ax25_rt->dev = ax25_dev->dev;
117 ax25_rt->digipeat = NULL;
118 ax25_rt->ip_mode = ' ';
6f59a348 119 ax25_dev_put(ax25_dev);
1da177e4
LT
120 if (route->digi_count != 0) {
121 if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
4de211f1 122 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
123 kfree(ax25_rt);
124 return -ENOMEM;
125 }
126 ax25_rt->digipeat->lastrepeat = -1;
127 ax25_rt->digipeat->ndigi = route->digi_count;
128 for (i = 0; i < route->digi_count; i++) {
129 ax25_rt->digipeat->repeated[i] = 0;
130 ax25_rt->digipeat->calls[i] = route->digi_addr[i];
131 }
132 }
133 ax25_rt->next = ax25_route_list;
134 ax25_route_list = ax25_rt;
4de211f1 135 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
136
137 return 0;
138}
139
006f68b8 140void __ax25_put_route(ax25_route *ax25_rt)
1da177e4 141{
006f68b8
RB
142 kfree(ax25_rt->digipeat);
143 kfree(ax25_rt);
1da177e4
LT
144}
145
146static int ax25_rt_del(struct ax25_routes_struct *route)
147{
148 ax25_route *s, *t, *ax25_rt;
149 ax25_dev *ax25_dev;
150
151 if ((ax25_dev = ax25_addr_ax25dev(&route->port_addr)) == NULL)
152 return -EINVAL;
153
4de211f1 154 write_lock_bh(&ax25_route_lock);
1da177e4
LT
155
156 ax25_rt = ax25_route_list;
157 while (ax25_rt != NULL) {
158 s = ax25_rt;
159 ax25_rt = ax25_rt->next;
160 if (s->dev == ax25_dev->dev &&
161 ax25cmp(&route->dest_addr, &s->callsign) == 0) {
162 if (ax25_route_list == s) {
163 ax25_route_list = s->next;
006f68b8 164 ax25_put_route(s);
1da177e4
LT
165 } else {
166 for (t = ax25_route_list; t != NULL; t = t->next) {
167 if (t->next == s) {
168 t->next = s->next;
006f68b8 169 ax25_put_route(s);
1da177e4
LT
170 break;
171 }
172 }
173 }
174 }
175 }
6f59a348 176 ax25_dev_put(ax25_dev);
4de211f1 177 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
178
179 return 0;
180}
181
182static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option)
183{
184 ax25_route *ax25_rt;
185 ax25_dev *ax25_dev;
186 int err = 0;
187
188 if ((ax25_dev = ax25_addr_ax25dev(&rt_option->port_addr)) == NULL)
189 return -EINVAL;
190
4de211f1 191 write_lock_bh(&ax25_route_lock);
1da177e4
LT
192
193 ax25_rt = ax25_route_list;
194 while (ax25_rt != NULL) {
195 if (ax25_rt->dev == ax25_dev->dev &&
196 ax25cmp(&rt_option->dest_addr, &ax25_rt->callsign) == 0) {
197 switch (rt_option->cmd) {
198 case AX25_SET_RT_IPMODE:
199 switch (rt_option->arg) {
200 case ' ':
201 case 'D':
202 case 'V':
203 ax25_rt->ip_mode = rt_option->arg;
204 break;
205 default:
206 err = -EINVAL;
207 goto out;
208 }
209 break;
210 default:
211 err = -EINVAL;
212 goto out;
213 }
214 }
215 ax25_rt = ax25_rt->next;
216 }
217
218out:
6f59a348 219 ax25_dev_put(ax25_dev);
4de211f1 220 write_unlock_bh(&ax25_route_lock);
1da177e4
LT
221 return err;
222}
223
224int ax25_rt_ioctl(unsigned int cmd, void __user *arg)
225{
226 struct ax25_route_opt_struct rt_option;
227 struct ax25_routes_struct route;
228
229 switch (cmd) {
230 case SIOCADDRT:
231 if (copy_from_user(&route, arg, sizeof(route)))
232 return -EFAULT;
233 return ax25_rt_add(&route);
234
235 case SIOCDELRT:
236 if (copy_from_user(&route, arg, sizeof(route)))
237 return -EFAULT;
238 return ax25_rt_del(&route);
239
240 case SIOCAX25OPTRT:
241 if (copy_from_user(&rt_option, arg, sizeof(rt_option)))
242 return -EFAULT;
243 return ax25_rt_opt(&rt_option);
244
245 default:
246 return -EINVAL;
247 }
248}
249
250#ifdef CONFIG_PROC_FS
251
252static void *ax25_rt_seq_start(struct seq_file *seq, loff_t *pos)
f16f3026 253 __acquires(ax25_route_lock)
1da177e4
LT
254{
255 struct ax25_route *ax25_rt;
256 int i = 1;
528930b9
YH
257
258 read_lock(&ax25_route_lock);
1da177e4
LT
259 if (*pos == 0)
260 return SEQ_START_TOKEN;
261
262 for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
263 if (i == *pos)
264 return ax25_rt;
265 ++i;
266 }
267
268 return NULL;
269}
270
271static void *ax25_rt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
272{
273 ++*pos;
528930b9 274 return (v == SEQ_START_TOKEN) ? ax25_route_list :
1da177e4
LT
275 ((struct ax25_route *) v)->next;
276}
277
278static void ax25_rt_seq_stop(struct seq_file *seq, void *v)
f16f3026 279 __releases(ax25_route_lock)
1da177e4
LT
280{
281 read_unlock(&ax25_route_lock);
282}
283
284static int ax25_rt_seq_show(struct seq_file *seq, void *v)
285{
f75268cd
RB
286 char buf[11];
287
1da177e4
LT
288 if (v == SEQ_START_TOKEN)
289 seq_puts(seq, "callsign dev mode digipeaters\n");
290 else {
291 struct ax25_route *ax25_rt = v;
292 const char *callsign;
293 int i;
294
295 if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0)
296 callsign = "default";
297 else
f75268cd 298 callsign = ax2asc(buf, &ax25_rt->callsign);
1da177e4
LT
299
300 seq_printf(seq, "%-9s %-4s",
301 callsign,
302 ax25_rt->dev ? ax25_rt->dev->name : "???");
303
304 switch (ax25_rt->ip_mode) {
305 case 'V':
306 seq_puts(seq, " vc");
307 break;
308 case 'D':
309 seq_puts(seq, " dg");
310 break;
311 default:
312 seq_puts(seq, " *");
313 break;
314 }
315
316 if (ax25_rt->digipeat != NULL)
317 for (i = 0; i < ax25_rt->digipeat->ndigi; i++)
f75268cd
RB
318 seq_printf(seq, " %s",
319 ax2asc(buf, &ax25_rt->digipeat->calls[i]));
1da177e4
LT
320
321 seq_puts(seq, "\n");
322 }
323 return 0;
324}
325
fddda2b7 326const struct seq_operations ax25_rt_seqops = {
1da177e4
LT
327 .start = ax25_rt_seq_start,
328 .next = ax25_rt_seq_next,
329 .stop = ax25_rt_seq_stop,
330 .show = ax25_rt_seq_show,
331};
1da177e4
LT
332#endif
333
334/*
335 * Find AX.25 route
336 *
3f072310 337 * Only routes with a reference count of zero can be destroyed.
63530aba 338 * Must be called with ax25_route_lock read locked.
1da177e4 339 */
006f68b8 340ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
1da177e4
LT
341{
342 ax25_route *ax25_spe_rt = NULL;
343 ax25_route *ax25_def_rt = NULL;
344 ax25_route *ax25_rt;
345
1da177e4
LT
346 /*
347 * Bind to the physical interface we heard them on, or the default
348 * route if none is found;
349 */
350 for (ax25_rt = ax25_route_list; ax25_rt != NULL; ax25_rt = ax25_rt->next) {
351 if (dev == NULL) {
352 if (ax25cmp(&ax25_rt->callsign, addr) == 0 && ax25_rt->dev != NULL)
353 ax25_spe_rt = ax25_rt;
354 if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0 && ax25_rt->dev != NULL)
355 ax25_def_rt = ax25_rt;
356 } else {
357 if (ax25cmp(&ax25_rt->callsign, addr) == 0 && ax25_rt->dev == dev)
358 ax25_spe_rt = ax25_rt;
359 if (ax25cmp(&ax25_rt->callsign, &null_ax25_address) == 0 && ax25_rt->dev == dev)
360 ax25_def_rt = ax25_rt;
361 }
362 }
363
364 ax25_rt = ax25_def_rt;
365 if (ax25_spe_rt != NULL)
366 ax25_rt = ax25_spe_rt;
367
1da177e4
LT
368 return ax25_rt;
369}
370
371/*
372 * Adjust path: If you specify a default route and want to connect
373 * a target on the digipeater path but w/o having a special route
374 * set before, the path has to be truncated from your target on.
375 */
376static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
377{
378 int k;
379
380 for (k = 0; k < digipeat->ndigi; k++) {
381 if (ax25cmp(addr, &digipeat->calls[k]) == 0)
382 break;
383 }
384
385 digipeat->ndigi = k;
386}
387
388
389/*
390 * Find which interface to use.
391 */
392int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
393{
01d7dd0e 394 ax25_uid_assoc *user;
1da177e4 395 ax25_route *ax25_rt;
b3d18f15 396 int err = 0;
1da177e4 397
63530aba
ED
398 ax25_route_lock_use();
399 ax25_rt = ax25_get_route(addr, NULL);
400 if (!ax25_rt) {
401 ax25_route_lock_unuse();
1da177e4 402 return -EHOSTUNREACH;
63530aba 403 }
1da177e4
LT
404 if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
405 err = -EHOSTUNREACH;
406 goto put;
407 }
408
73400407 409 user = ax25_findbyuid(current_euid());
01d7dd0e
RB
410 if (user) {
411 ax25->source_addr = user->call;
412 ax25_uid_put(user);
413 } else {
1da177e4
LT
414 if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
415 err = -EPERM;
416 goto put;
417 }
01d7dd0e 418 ax25->source_addr = *(ax25_address *)ax25->ax25_dev->dev->dev_addr;
1da177e4
LT
419 }
420
1da177e4 421 if (ax25_rt->digipeat != NULL) {
0459d70a
ACM
422 ax25->digipeat = kmemdup(ax25_rt->digipeat, sizeof(ax25_digi),
423 GFP_ATOMIC);
424 if (ax25->digipeat == NULL) {
1da177e4
LT
425 err = -ENOMEM;
426 goto put;
427 }
1da177e4
LT
428 ax25_adjust_path(addr, ax25->digipeat);
429 }
430
431 if (ax25->sk != NULL) {
d4d5d8e8 432 local_bh_disable();
1da177e4
LT
433 bh_lock_sock(ax25->sk);
434 sock_reset_flag(ax25->sk, SOCK_ZAPPED);
435 bh_unlock_sock(ax25->sk);
d4d5d8e8 436 local_bh_enable();
1da177e4
LT
437 }
438
439put:
63530aba 440 ax25_route_lock_unuse();
b3d18f15 441 return err;
1da177e4
LT
442}
443
1da177e4
LT
444struct sk_buff *ax25_rt_build_path(struct sk_buff *skb, ax25_address *src,
445 ax25_address *dest, ax25_digi *digi)
446{
1da177e4
LT
447 unsigned char *bp;
448 int len;
449
450 len = digi->ndigi * AX25_ADDR_LEN;
451
53744a4a
VA
452 if (unlikely(skb_headroom(skb) < len)) {
453 skb = skb_expand_head(skb, len);
454 if (!skb) {
1da177e4
LT
455 printk(KERN_CRIT "AX.25: ax25_dg_build_path - out of memory\n");
456 return NULL;
457 }
1da177e4
LT
458 }
459
460 bp = skb_push(skb, len);
461
462 ax25_addr_build(bp, src, dest, digi, AX25_COMMAND, AX25_MODULUS);
463
464 return skb;
465}
466
467/*
468 * Free all memory associated with routing structures.
469 */
470void __exit ax25_rt_free(void)
471{
472 ax25_route *s, *ax25_rt = ax25_route_list;
473
4de211f1 474 write_lock_bh(&ax25_route_lock);
1da177e4
LT
475 while (ax25_rt != NULL) {
476 s = ax25_rt;
477 ax25_rt = ax25_rt->next;
478
a51482bd 479 kfree(s->digipeat);
1da177e4
LT
480 kfree(s);
481 }
4de211f1 482 write_unlock_bh(&ax25_route_lock);
1da177e4 483}