intel_ips: potential null dereference
[wandboard.git] / net / sctp / chunk.c
blob476caaf100ed740e0b72138721f1baf6ff90f584
1 /* SCTP kernel implementation
2 * (C) Copyright IBM Corp. 2003, 2004
4 * This file is part of the SCTP kernel implementation
6 * This file contains the code relating the chunk abstraction.
8 * This SCTP implementation is free software;
9 * you can redistribute it and/or modify it under the terms of
10 * the GNU General Public License as published by
11 * the Free Software Foundation; either version 2, or (at your option)
12 * any later version.
14 * This SCTP implementation is distributed in the hope that it
15 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
16 * ************************
17 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
18 * See the GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with GNU CC; see the file COPYING. If not, write to
22 * the Free Software Foundation, 59 Temple Place - Suite 330,
23 * Boston, MA 02111-1307, USA.
25 * Please send any bug reports or fixes you make to the
26 * email address(es):
27 * lksctp developers <lksctp-developers@lists.sourceforge.net>
29 * Or submit a bug report through the following website:
30 * http://www.sf.net/projects/lksctp
32 * Written or modified by:
33 * Jon Grimm <jgrimm@us.ibm.com>
34 * Sridhar Samudrala <sri@us.ibm.com>
36 * Any bugs reported given to us we will try to fix... any fixes shared will
37 * be incorporated into the next SCTP release.
40 #include <linux/types.h>
41 #include <linux/kernel.h>
42 #include <linux/net.h>
43 #include <linux/inet.h>
44 #include <linux/skbuff.h>
45 #include <linux/slab.h>
46 #include <net/sock.h>
47 #include <net/sctp/sctp.h>
48 #include <net/sctp/sm.h>
50 /* This file is mostly in anticipation of future work, but initially
51 * populate with fragment tracking for an outbound message.
54 /* Initialize datamsg from memory. */
55 static void sctp_datamsg_init(struct sctp_datamsg *msg)
57 atomic_set(&msg->refcnt, 1);
58 msg->send_failed = 0;
59 msg->send_error = 0;
60 msg->can_abandon = 0;
61 msg->can_delay = 1;
62 msg->expires_at = 0;
63 INIT_LIST_HEAD(&msg->chunks);
66 /* Allocate and initialize datamsg. */
67 SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(gfp_t gfp)
69 struct sctp_datamsg *msg;
70 msg = kmalloc(sizeof(struct sctp_datamsg), gfp);
71 if (msg) {
72 sctp_datamsg_init(msg);
73 SCTP_DBG_OBJCNT_INC(datamsg);
75 return msg;
78 void sctp_datamsg_free(struct sctp_datamsg *msg)
80 struct sctp_chunk *chunk;
82 /* This doesn't have to be a _safe vairant because
83 * sctp_chunk_free() only drops the refs.
85 list_for_each_entry(chunk, &msg->chunks, frag_list)
86 sctp_chunk_free(chunk);
88 sctp_datamsg_put(msg);
91 /* Final destructruction of datamsg memory. */
92 static void sctp_datamsg_destroy(struct sctp_datamsg *msg)
94 struct list_head *pos, *temp;
95 struct sctp_chunk *chunk;
96 struct sctp_sock *sp;
97 struct sctp_ulpevent *ev;
98 struct sctp_association *asoc = NULL;
99 int error = 0, notify;
101 /* If we failed, we may need to notify. */
102 notify = msg->send_failed ? -1 : 0;
104 /* Release all references. */
105 list_for_each_safe(pos, temp, &msg->chunks) {
106 list_del_init(pos);
107 chunk = list_entry(pos, struct sctp_chunk, frag_list);
108 /* Check whether we _really_ need to notify. */
109 if (notify < 0) {
110 asoc = chunk->asoc;
111 if (msg->send_error)
112 error = msg->send_error;
113 else
114 error = asoc->outqueue.error;
116 sp = sctp_sk(asoc->base.sk);
117 notify = sctp_ulpevent_type_enabled(SCTP_SEND_FAILED,
118 &sp->subscribe);
121 /* Generate a SEND FAILED event only if enabled. */
122 if (notify > 0) {
123 int sent;
124 if (chunk->has_tsn)
125 sent = SCTP_DATA_SENT;
126 else
127 sent = SCTP_DATA_UNSENT;
129 ev = sctp_ulpevent_make_send_failed(asoc, chunk, sent,
130 error, GFP_ATOMIC);
131 if (ev)
132 sctp_ulpq_tail_event(&asoc->ulpq, ev);
135 sctp_chunk_put(chunk);
138 SCTP_DBG_OBJCNT_DEC(datamsg);
139 kfree(msg);
142 /* Hold a reference. */
143 static void sctp_datamsg_hold(struct sctp_datamsg *msg)
145 atomic_inc(&msg->refcnt);
148 /* Release a reference. */
149 void sctp_datamsg_put(struct sctp_datamsg *msg)
151 if (atomic_dec_and_test(&msg->refcnt))
152 sctp_datamsg_destroy(msg);
155 /* Assign a chunk to this datamsg. */
156 static void sctp_datamsg_assign(struct sctp_datamsg *msg, struct sctp_chunk *chunk)
158 sctp_datamsg_hold(msg);
159 chunk->msg = msg;
163 /* A data chunk can have a maximum payload of (2^16 - 20). Break
164 * down any such message into smaller chunks. Opportunistically, fragment
165 * the chunks down to the current MTU constraints. We may get refragmented
166 * later if the PMTU changes, but it is _much better_ to fragment immediately
167 * with a reasonable guess than always doing our fragmentation on the
168 * soft-interrupt.
170 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
171 struct sctp_sndrcvinfo *sinfo,
172 struct msghdr *msgh, int msg_len)
174 int max, whole, i, offset, over, err;
175 int len, first_len;
176 int max_data;
177 struct sctp_chunk *chunk;
178 struct sctp_datamsg *msg;
179 struct list_head *pos, *temp;
180 __u8 frag;
182 msg = sctp_datamsg_new(GFP_KERNEL);
183 if (!msg)
184 return NULL;
186 /* Note: Calculate this outside of the loop, so that all fragments
187 * have the same expiration.
189 if (sinfo->sinfo_timetolive) {
190 /* sinfo_timetolive is in milliseconds */
191 msg->expires_at = jiffies +
192 msecs_to_jiffies(sinfo->sinfo_timetolive);
193 msg->can_abandon = 1;
194 SCTP_DEBUG_PRINTK("%s: msg:%p expires_at: %ld jiffies:%ld\n",
195 __func__, msg, msg->expires_at, jiffies);
198 /* This is the biggest possible DATA chunk that can fit into
199 * the packet
201 max_data = asoc->pathmtu -
202 sctp_sk(asoc->base.sk)->pf->af->net_header_len -
203 sizeof(struct sctphdr) - sizeof(struct sctp_data_chunk);
205 max = asoc->frag_point;
206 /* If the the peer requested that we authenticate DATA chunks
207 * we need to accound for bundling of the AUTH chunks along with
208 * DATA.
210 if (sctp_auth_send_cid(SCTP_CID_DATA, asoc)) {
211 struct sctp_hmac *hmac_desc = sctp_auth_asoc_get_hmac(asoc);
213 if (hmac_desc)
214 max_data -= WORD_ROUND(sizeof(sctp_auth_chunk_t) +
215 hmac_desc->hmac_len);
218 /* Now, check if we need to reduce our max */
219 if (max > max_data)
220 max = max_data;
222 whole = 0;
223 first_len = max;
225 /* Check to see if we have a pending SACK and try to let it be bundled
226 * with this message. Do this if we don't have any data queued already.
227 * To check that, look at out_qlen and retransmit list.
228 * NOTE: we will not reduce to account for SACK, if the message would
229 * not have been fragmented.
231 if (timer_pending(&asoc->timers[SCTP_EVENT_TIMEOUT_SACK]) &&
232 asoc->outqueue.out_qlen == 0 &&
233 list_empty(&asoc->outqueue.retransmit) &&
234 msg_len > max)
235 max_data -= WORD_ROUND(sizeof(sctp_sack_chunk_t));
237 /* Encourage Cookie-ECHO bundling. */
238 if (asoc->state < SCTP_STATE_COOKIE_ECHOED)
239 max_data -= SCTP_ARBITRARY_COOKIE_ECHO_LEN;
241 /* Now that we adjusted completely, reset first_len */
242 if (first_len > max_data)
243 first_len = max_data;
245 /* Account for a different sized first fragment */
246 if (msg_len >= first_len) {
247 msg_len -= first_len;
248 whole = 1;
249 msg->can_delay = 0;
252 /* How many full sized? How many bytes leftover? */
253 whole += msg_len / max;
254 over = msg_len % max;
255 offset = 0;
257 if ((whole > 1) || (whole && over))
258 SCTP_INC_STATS_USER(SCTP_MIB_FRAGUSRMSGS);
260 /* Create chunks for all the full sized DATA chunks. */
261 for (i=0, len=first_len; i < whole; i++) {
262 frag = SCTP_DATA_MIDDLE_FRAG;
264 if (0 == i)
265 frag |= SCTP_DATA_FIRST_FRAG;
267 if ((i == (whole - 1)) && !over) {
268 frag |= SCTP_DATA_LAST_FRAG;
270 /* The application requests to set the I-bit of the
271 * last DATA chunk of a user message when providing
272 * the user message to the SCTP implementation.
274 if ((sinfo->sinfo_flags & SCTP_EOF) ||
275 (sinfo->sinfo_flags & SCTP_SACK_IMMEDIATELY))
276 frag |= SCTP_DATA_SACK_IMM;
279 chunk = sctp_make_datafrag_empty(asoc, sinfo, len, frag, 0);
281 if (!chunk)
282 goto errout;
283 err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
284 if (err < 0)
285 goto errout;
287 offset += len;
289 /* Put the chunk->skb back into the form expected by send. */
290 __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
291 - (__u8 *)chunk->skb->data);
293 sctp_datamsg_assign(msg, chunk);
294 list_add_tail(&chunk->frag_list, &msg->chunks);
296 /* The first chunk, the first chunk was likely short
297 * to allow bundling, so reset to full size.
299 if (0 == i)
300 len = max;
303 /* .. now the leftover bytes. */
304 if (over) {
305 if (!whole)
306 frag = SCTP_DATA_NOT_FRAG;
307 else
308 frag = SCTP_DATA_LAST_FRAG;
310 if ((sinfo->sinfo_flags & SCTP_EOF) ||
311 (sinfo->sinfo_flags & SCTP_SACK_IMMEDIATELY))
312 frag |= SCTP_DATA_SACK_IMM;
314 chunk = sctp_make_datafrag_empty(asoc, sinfo, over, frag, 0);
316 if (!chunk)
317 goto errout;
319 err = sctp_user_addto_chunk(chunk, offset, over,msgh->msg_iov);
321 /* Put the chunk->skb back into the form expected by send. */
322 __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
323 - (__u8 *)chunk->skb->data);
324 if (err < 0)
325 goto errout;
327 sctp_datamsg_assign(msg, chunk);
328 list_add_tail(&chunk->frag_list, &msg->chunks);
331 return msg;
333 errout:
334 list_for_each_safe(pos, temp, &msg->chunks) {
335 list_del_init(pos);
336 chunk = list_entry(pos, struct sctp_chunk, frag_list);
337 sctp_chunk_free(chunk);
339 sctp_datamsg_put(msg);
340 return NULL;
343 /* Check whether this message has expired. */
344 int sctp_chunk_abandoned(struct sctp_chunk *chunk)
346 struct sctp_datamsg *msg = chunk->msg;
348 if (!msg->can_abandon)
349 return 0;
351 if (time_after(jiffies, msg->expires_at))
352 return 1;
354 return 0;
357 /* This chunk (and consequently entire message) has failed in its sending. */
358 void sctp_chunk_fail(struct sctp_chunk *chunk, int error)
360 chunk->msg->send_failed = 1;
361 chunk->msg->send_error = error;