]> Pileus Git - ~andy/linux/blob - drivers/net/usb/gl620a.c
UBI: fix some use after free bugs
[~andy/linux] / drivers / net / usb / gl620a.c
1 /*
2  * GeneSys GL620USB-A based links
3  * Copyright (C) 2001 by Jiun-Jie Huang <huangjj@genesyslogic.com.tw>
4  * Copyright (C) 2001 by Stanislav Brabec <utx@penguin.cz>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 // #define      DEBUG                   // error path messages, extra info
21 // #define      VERBOSE                 // more; success messages
22
23 #include <linux/module.h>
24 #include <linux/netdevice.h>
25 #include <linux/etherdevice.h>
26 #include <linux/ethtool.h>
27 #include <linux/workqueue.h>
28 #include <linux/mii.h>
29 #include <linux/usb.h>
30 #include <linux/usb/usbnet.h>
31 #include <linux/gfp.h>
32
33
34 /*
35  * GeneSys GL620USB-A (www.genesyslogic.com.tw)
36  *
37  * ... should partially interop with the Win32 driver for this hardware.
38  * The GeneSys docs imply there's some NDIS issue motivating this framing.
39  *
40  * Some info from GeneSys:
41  *  - GL620USB-A is full duplex; GL620USB is only half duplex for bulk.
42  *    (Some cables, like the BAFO-100c, use the half duplex version.)
43  *  - For the full duplex model, the low bit of the version code says
44  *    which side is which ("left/right").
45  *  - For the half duplex type, a control/interrupt handshake settles
46  *    the transfer direction.  (That's disabled here, partially coded.)
47  *    A control URB would block until other side writes an interrupt.
48  *
49  * Original code from Jiun-Jie Huang <huangjj@genesyslogic.com.tw>
50  * and merged into "usbnet" by Stanislav Brabec <utx@penguin.cz>.
51  */
52
53 // control msg write command
54 #define GENELINK_CONNECT_WRITE                  0xF0
55 // interrupt pipe index
56 #define GENELINK_INTERRUPT_PIPE                 0x03
57 // interrupt read buffer size
58 #define INTERRUPT_BUFSIZE                       0x08
59 // interrupt pipe interval value
60 #define GENELINK_INTERRUPT_INTERVAL             0x10
61 // max transmit packet number per transmit
62 #define GL_MAX_TRANSMIT_PACKETS                 32
63 // max packet length
64 #define GL_MAX_PACKET_LEN                       1514
65 // max receive buffer size
66 #define GL_RCV_BUF_SIZE         \
67         (((GL_MAX_PACKET_LEN + 4) * GL_MAX_TRANSMIT_PACKETS) + 4)
68
69 struct gl_packet {
70         __le32          packet_length;
71         char            packet_data [1];
72 };
73
74 struct gl_header {
75         __le32                  packet_count;
76         struct gl_packet        packets;
77 };
78
79 static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
80 {
81         struct gl_header        *header;
82         struct gl_packet        *packet;
83         struct sk_buff          *gl_skb;
84         u32                     size;
85         u32                     count;
86
87         header = (struct gl_header *) skb->data;
88
89         // get the packet count of the received skb
90         count = le32_to_cpu(header->packet_count);
91         if (count > GL_MAX_TRANSMIT_PACKETS) {
92                 netdev_dbg(dev->net,
93                            "genelink: invalid received packet count %u\n",
94                            count);
95                 return 0;
96         }
97
98         // set the current packet pointer to the first packet
99         packet = &header->packets;
100
101         // decrement the length for the packet count size 4 bytes
102         skb_pull(skb, 4);
103
104         while (count > 1) {
105                 // get the packet length
106                 size = le32_to_cpu(packet->packet_length);
107
108                 // this may be a broken packet
109                 if (size > GL_MAX_PACKET_LEN) {
110                         netdev_dbg(dev->net, "genelink: invalid rx length %d\n",
111                                    size);
112                         return 0;
113                 }
114
115                 // allocate the skb for the individual packet
116                 gl_skb = alloc_skb(size, GFP_ATOMIC);
117                 if (gl_skb) {
118
119                         // copy the packet data to the new skb
120                         memcpy(skb_put(gl_skb, size),
121                                         packet->packet_data, size);
122                         usbnet_skb_return(dev, gl_skb);
123                 }
124
125                 // advance to the next packet
126                 packet = (struct gl_packet *)&packet->packet_data[size];
127                 count--;
128
129                 // shift the data pointer to the next gl_packet
130                 skb_pull(skb, size + 4);
131         }
132
133         // skip the packet length field 4 bytes
134         skb_pull(skb, 4);
135
136         if (skb->len > GL_MAX_PACKET_LEN) {
137                 netdev_dbg(dev->net, "genelink: invalid rx length %d\n",
138                            skb->len);
139                 return 0;
140         }
141         return 1;
142 }
143
144 static struct sk_buff *
145 genelink_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
146 {
147         int     padlen;
148         int     length = skb->len;
149         int     headroom = skb_headroom(skb);
150         int     tailroom = skb_tailroom(skb);
151         __le32  *packet_count;
152         __le32  *packet_len;
153
154         // FIXME:  magic numbers, bleech
155         padlen = ((skb->len + (4 + 4*1)) % 64) ? 0 : 1;
156
157         if ((!skb_cloned(skb))
158                         && ((headroom + tailroom) >= (padlen + (4 + 4*1)))) {
159                 if ((headroom < (4 + 4*1)) || (tailroom < padlen)) {
160                         skb->data = memmove(skb->head + (4 + 4*1),
161                                              skb->data, skb->len);
162                         skb_set_tail_pointer(skb, skb->len);
163                 }
164         } else {
165                 struct sk_buff  *skb2;
166                 skb2 = skb_copy_expand(skb, (4 + 4*1) , padlen, flags);
167                 dev_kfree_skb_any(skb);
168                 skb = skb2;
169                 if (!skb)
170                         return NULL;
171         }
172
173         // attach the packet count to the header
174         packet_count = (__le32 *) skb_push(skb, (4 + 4*1));
175         packet_len = packet_count + 1;
176
177         *packet_count = cpu_to_le32(1);
178         *packet_len = cpu_to_le32(length);
179
180         // add padding byte
181         if ((skb->len % dev->maxpacket) == 0)
182                 skb_put(skb, 1);
183
184         return skb;
185 }
186
187 static int genelink_bind(struct usbnet *dev, struct usb_interface *intf)
188 {
189         dev->hard_mtu = GL_RCV_BUF_SIZE;
190         dev->net->hard_header_len += 4;
191         dev->in = usb_rcvbulkpipe(dev->udev, dev->driver_info->in);
192         dev->out = usb_sndbulkpipe(dev->udev, dev->driver_info->out);
193         return 0;
194 }
195
196 static const struct driver_info genelink_info = {
197         .description =  "Genesys GeneLink",
198         .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_GL | FLAG_NO_SETINT,
199         .bind =         genelink_bind,
200         .rx_fixup =     genelink_rx_fixup,
201         .tx_fixup =     genelink_tx_fixup,
202
203         .in = 1, .out = 2,
204
205 #ifdef  GENELINK_ACK
206         .check_connect =genelink_check_connect,
207 #endif
208 };
209
210 static const struct usb_device_id       products [] = {
211
212 {
213         USB_DEVICE(0x05e3, 0x0502),     // GL620USB-A
214         .driver_info =  (unsigned long) &genelink_info,
215 },
216         /* NOT: USB_DEVICE(0x05e3, 0x0501),     // GL620USB
217          * that's half duplex, not currently supported
218          */
219         { },            // END
220 };
221 MODULE_DEVICE_TABLE(usb, products);
222
223 static struct usb_driver gl620a_driver = {
224         .name =         "gl620a",
225         .id_table =     products,
226         .probe =        usbnet_probe,
227         .disconnect =   usbnet_disconnect,
228         .suspend =      usbnet_suspend,
229         .resume =       usbnet_resume,
230         .disable_hub_initiated_lpm = 1,
231 };
232
233 module_usb_driver(gl620a_driver);
234
235 MODULE_AUTHOR("Jiun-Jie Huang");
236 MODULE_DESCRIPTION("GL620-USB-A Host-to-Host Link cables");
237 MODULE_LICENSE("GPL");
238