wl12xx: Check buffer bound when processing nvs data
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / caif / cfveil.c
blob3ec83fbc28875a55ff141610f84ea6d6feea9d02
1 /*
2 * Copyright (C) ST-Ericsson AB 2010
3 * Author: Sjur Brendeland/sjur.brandeland@stericsson.com
4 * License terms: GNU General Public License (GPL) version 2
5 */
7 #define pr_fmt(fmt) KBUILD_MODNAME ":%s(): " fmt, __func__
9 #include <linux/stddef.h>
10 #include <linux/slab.h>
11 #include <net/caif/caif_layer.h>
12 #include <net/caif/cfsrvl.h>
13 #include <net/caif/cfpkt.h>
15 #define VEI_PAYLOAD 0x00
16 #define VEI_CMD_BIT 0x80
17 #define VEI_FLOW_OFF 0x81
18 #define VEI_FLOW_ON 0x80
19 #define VEI_SET_PIN 0x82
21 #define container_obj(layr) container_of(layr, struct cfsrvl, layer)
23 static int cfvei_receive(struct cflayer *layr, struct cfpkt *pkt);
24 static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt);
26 struct cflayer *cfvei_create(u8 channel_id, struct dev_info *dev_info)
28 struct cfsrvl *vei = kmalloc(sizeof(struct cfsrvl), GFP_ATOMIC);
29 if (!vei) {
30 pr_warn("Out of memory\n");
31 return NULL;
33 caif_assert(offsetof(struct cfsrvl, layer) == 0);
34 memset(vei, 0, sizeof(struct cfsrvl));
35 cfsrvl_init(vei, channel_id, dev_info, true);
36 vei->layer.receive = cfvei_receive;
37 vei->layer.transmit = cfvei_transmit;
38 snprintf(vei->layer.name, CAIF_LAYER_NAME_SZ - 1, "vei%d", channel_id);
39 return &vei->layer;
42 static int cfvei_receive(struct cflayer *layr, struct cfpkt *pkt)
44 u8 cmd;
45 int ret;
46 caif_assert(layr->up != NULL);
47 caif_assert(layr->receive != NULL);
48 caif_assert(layr->ctrlcmd != NULL);
51 if (cfpkt_extr_head(pkt, &cmd, 1) < 0) {
52 pr_err("Packet is erroneous!\n");
53 cfpkt_destroy(pkt);
54 return -EPROTO;
56 switch (cmd) {
57 case VEI_PAYLOAD:
58 ret = layr->up->receive(layr->up, pkt);
59 return ret;
60 case VEI_FLOW_OFF:
61 layr->ctrlcmd(layr, CAIF_CTRLCMD_FLOW_OFF_IND, 0);
62 cfpkt_destroy(pkt);
63 return 0;
64 case VEI_FLOW_ON:
65 layr->ctrlcmd(layr, CAIF_CTRLCMD_FLOW_ON_IND, 0);
66 cfpkt_destroy(pkt);
67 return 0;
68 case VEI_SET_PIN: /* SET RS232 PIN */
69 cfpkt_destroy(pkt);
70 return 0;
71 default: /* SET RS232 PIN */
72 pr_warn("Unknown VEI control packet %d (0x%x)!\n", cmd, cmd);
73 cfpkt_destroy(pkt);
74 return -EPROTO;
78 static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt)
80 u8 tmp = 0;
81 struct caif_payload_info *info;
82 int ret;
83 struct cfsrvl *service = container_obj(layr);
84 if (!cfsrvl_ready(service, &ret))
85 goto err;
86 caif_assert(layr->dn != NULL);
87 caif_assert(layr->dn->transmit != NULL);
89 if (cfpkt_add_head(pkt, &tmp, 1) < 0) {
90 pr_err("Packet is erroneous!\n");
91 ret = -EPROTO;
92 goto err;
95 /* Add info-> for MUX-layer to route the packet out. */
96 info = cfpkt_info(pkt);
97 info->channel_id = service->layer.id;
98 info->hdr_len = 1;
99 info->dev_info = &service->dev_info;
100 return layr->dn->transmit(layr->dn, pkt);
101 err:
102 cfpkt_destroy(pkt);
103 return ret;