]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - net/netrom/nr_timer.c
can: af_can: fix NULL pointer dereference in can_rcv_filter
[mirror_ubuntu-jammy-kernel.git] / net / netrom / nr_timer.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 *
4 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
5 * Copyright (C) 2002 Ralf Baechle DO1GRB (ralf@gnu.org)
6 */
7 #include <linux/errno.h>
8 #include <linux/types.h>
9 #include <linux/socket.h>
10 #include <linux/in.h>
11 #include <linux/kernel.h>
12 #include <linux/jiffies.h>
13 #include <linux/timer.h>
14 #include <linux/string.h>
15 #include <linux/sockios.h>
16 #include <linux/net.h>
17 #include <net/ax25.h>
18 #include <linux/inet.h>
19 #include <linux/netdevice.h>
20 #include <linux/skbuff.h>
21 #include <net/sock.h>
22 #include <net/tcp_states.h>
23 #include <linux/uaccess.h>
24 #include <linux/fcntl.h>
25 #include <linux/mm.h>
26 #include <linux/interrupt.h>
27 #include <net/netrom.h>
28
29 static void nr_heartbeat_expiry(struct timer_list *);
30 static void nr_t1timer_expiry(struct timer_list *);
31 static void nr_t2timer_expiry(struct timer_list *);
32 static void nr_t4timer_expiry(struct timer_list *);
33 static void nr_idletimer_expiry(struct timer_list *);
34
35 void nr_init_timers(struct sock *sk)
36 {
37 struct nr_sock *nr = nr_sk(sk);
38
39 timer_setup(&nr->t1timer, nr_t1timer_expiry, 0);
40 timer_setup(&nr->t2timer, nr_t2timer_expiry, 0);
41 timer_setup(&nr->t4timer, nr_t4timer_expiry, 0);
42 timer_setup(&nr->idletimer, nr_idletimer_expiry, 0);
43
44 /* initialized by sock_init_data */
45 sk->sk_timer.function = nr_heartbeat_expiry;
46 }
47
48 void nr_start_t1timer(struct sock *sk)
49 {
50 struct nr_sock *nr = nr_sk(sk);
51
52 sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
53 }
54
55 void nr_start_t2timer(struct sock *sk)
56 {
57 struct nr_sock *nr = nr_sk(sk);
58
59 sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
60 }
61
62 void nr_start_t4timer(struct sock *sk)
63 {
64 struct nr_sock *nr = nr_sk(sk);
65
66 sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
67 }
68
69 void nr_start_idletimer(struct sock *sk)
70 {
71 struct nr_sock *nr = nr_sk(sk);
72
73 if (nr->idle > 0)
74 sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
75 }
76
77 void nr_start_heartbeat(struct sock *sk)
78 {
79 sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
80 }
81
82 void nr_stop_t1timer(struct sock *sk)
83 {
84 sk_stop_timer(sk, &nr_sk(sk)->t1timer);
85 }
86
87 void nr_stop_t2timer(struct sock *sk)
88 {
89 sk_stop_timer(sk, &nr_sk(sk)->t2timer);
90 }
91
92 void nr_stop_t4timer(struct sock *sk)
93 {
94 sk_stop_timer(sk, &nr_sk(sk)->t4timer);
95 }
96
97 void nr_stop_idletimer(struct sock *sk)
98 {
99 sk_stop_timer(sk, &nr_sk(sk)->idletimer);
100 }
101
102 void nr_stop_heartbeat(struct sock *sk)
103 {
104 sk_stop_timer(sk, &sk->sk_timer);
105 }
106
107 int nr_t1timer_running(struct sock *sk)
108 {
109 return timer_pending(&nr_sk(sk)->t1timer);
110 }
111
112 static void nr_heartbeat_expiry(struct timer_list *t)
113 {
114 struct sock *sk = from_timer(sk, t, sk_timer);
115 struct nr_sock *nr = nr_sk(sk);
116
117 bh_lock_sock(sk);
118 switch (nr->state) {
119 case NR_STATE_0:
120 /* Magic here: If we listen() and a new link dies before it
121 is accepted() it isn't 'dead' so doesn't get removed. */
122 if (sock_flag(sk, SOCK_DESTROY) ||
123 (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
124 bh_unlock_sock(sk);
125 nr_destroy_socket(sk);
126 goto out;
127 }
128 break;
129
130 case NR_STATE_3:
131 /*
132 * Check for the state of the receive buffer.
133 */
134 if (atomic_read(&sk->sk_rmem_alloc) < (sk->sk_rcvbuf / 2) &&
135 (nr->condition & NR_COND_OWN_RX_BUSY)) {
136 nr->condition &= ~NR_COND_OWN_RX_BUSY;
137 nr->condition &= ~NR_COND_ACK_PENDING;
138 nr->vl = nr->vr;
139 nr_write_internal(sk, NR_INFOACK);
140 break;
141 }
142 break;
143 }
144
145 nr_start_heartbeat(sk);
146 bh_unlock_sock(sk);
147 out:
148 sock_put(sk);
149 }
150
151 static void nr_t2timer_expiry(struct timer_list *t)
152 {
153 struct nr_sock *nr = from_timer(nr, t, t2timer);
154 struct sock *sk = &nr->sock;
155
156 bh_lock_sock(sk);
157 if (nr->condition & NR_COND_ACK_PENDING) {
158 nr->condition &= ~NR_COND_ACK_PENDING;
159 nr_enquiry_response(sk);
160 }
161 bh_unlock_sock(sk);
162 sock_put(sk);
163 }
164
165 static void nr_t4timer_expiry(struct timer_list *t)
166 {
167 struct nr_sock *nr = from_timer(nr, t, t4timer);
168 struct sock *sk = &nr->sock;
169
170 bh_lock_sock(sk);
171 nr_sk(sk)->condition &= ~NR_COND_PEER_RX_BUSY;
172 bh_unlock_sock(sk);
173 sock_put(sk);
174 }
175
176 static void nr_idletimer_expiry(struct timer_list *t)
177 {
178 struct nr_sock *nr = from_timer(nr, t, idletimer);
179 struct sock *sk = &nr->sock;
180
181 bh_lock_sock(sk);
182
183 nr_clear_queues(sk);
184
185 nr->n2count = 0;
186 nr_write_internal(sk, NR_DISCREQ);
187 nr->state = NR_STATE_2;
188
189 nr_start_t1timer(sk);
190 nr_stop_t2timer(sk);
191 nr_stop_t4timer(sk);
192
193 sk->sk_state = TCP_CLOSE;
194 sk->sk_err = 0;
195 sk->sk_shutdown |= SEND_SHUTDOWN;
196
197 if (!sock_flag(sk, SOCK_DEAD)) {
198 sk->sk_state_change(sk);
199 sock_set_flag(sk, SOCK_DEAD);
200 }
201 bh_unlock_sock(sk);
202 sock_put(sk);
203 }
204
205 static void nr_t1timer_expiry(struct timer_list *t)
206 {
207 struct nr_sock *nr = from_timer(nr, t, t1timer);
208 struct sock *sk = &nr->sock;
209
210 bh_lock_sock(sk);
211 switch (nr->state) {
212 case NR_STATE_1:
213 if (nr->n2count == nr->n2) {
214 nr_disconnect(sk, ETIMEDOUT);
215 goto out;
216 } else {
217 nr->n2count++;
218 nr_write_internal(sk, NR_CONNREQ);
219 }
220 break;
221
222 case NR_STATE_2:
223 if (nr->n2count == nr->n2) {
224 nr_disconnect(sk, ETIMEDOUT);
225 goto out;
226 } else {
227 nr->n2count++;
228 nr_write_internal(sk, NR_DISCREQ);
229 }
230 break;
231
232 case NR_STATE_3:
233 if (nr->n2count == nr->n2) {
234 nr_disconnect(sk, ETIMEDOUT);
235 goto out;
236 } else {
237 nr->n2count++;
238 nr_requeue_frames(sk);
239 }
240 break;
241 }
242
243 nr_start_t1timer(sk);
244 out:
245 bh_unlock_sock(sk);
246 sock_put(sk);
247 }