brintos / linux-shallow public Read only

1// SPDX-License-Identifier: GPL-2.0-or-later2/*3 * Generic PPP layer for Linux.4 *5 * Copyright 1999-2002 Paul Mackerras.6 *7 * The generic PPP layer handles the PPP network interfaces, the8 * /dev/ppp device, packet and VJ compression, and multilink.9 * It talks to PPP `channels' via the interface defined in10 * include/linux/ppp_channel.h.  Channels provide the basic means for11 * sending and receiving PPP frames on some kind of communications12 * channel.13 *14 * Part of the code in this driver was inspired by the old async-only15 * PPP driver, written by Michael Callahan and Al Longyear, and16 * subsequently hacked by Paul Mackerras.17 *18 * ==FILEVERSION 20041108==19 */20 21#include <linux/module.h>22#include <linux/kernel.h>23#include <linux/sched/signal.h>24#include <linux/kmod.h>25#include <linux/init.h>26#include <linux/list.h>27#include <linux/idr.h>28#include <linux/netdevice.h>29#include <linux/poll.h>30#include <linux/ppp_defs.h>31#include <linux/filter.h>32#include <linux/ppp-ioctl.h>33#include <linux/ppp_channel.h>34#include <linux/ppp-comp.h>35#include <linux/skbuff.h>36#include <linux/rtnetlink.h>37#include <linux/if_arp.h>38#include <linux/ip.h>39#include <linux/tcp.h>40#include <linux/spinlock.h>41#include <linux/rwsem.h>42#include <linux/stddef.h>43#include <linux/device.h>44#include <linux/mutex.h>45#include <linux/slab.h>46#include <linux/file.h>47#include <linux/unaligned.h>48#include <net/slhc_vj.h>49#include <linux/atomic.h>50#include <linux/refcount.h>51 52#include <linux/nsproxy.h>53#include <net/net_namespace.h>54#include <net/netns/generic.h>55 56#define PPP_VERSION	"2.4.2"57 58/*59 * Network protocols we support.60 */61#define NP_IP	0		/* Internet Protocol V4 */62#define NP_IPV6	1		/* Internet Protocol V6 */63#define NP_IPX	2		/* IPX protocol */64#define NP_AT	3		/* Appletalk protocol */65#define NP_MPLS_UC 4		/* MPLS unicast */66#define NP_MPLS_MC 5		/* MPLS multicast */67#define NUM_NP	6		/* Number of NPs. */68 69#define MPHDRLEN	6	/* multilink protocol header length */70#define MPHDRLEN_SSN	4	/* ditto with short sequence numbers */71 72#define PPP_PROTO_LEN	273#define PPP_LCP_HDRLEN	474 75/*76 * An instance of /dev/ppp can be associated with either a ppp77 * interface unit or a ppp channel.  In both cases, file->private_data78 * points to one of these.79 */80struct ppp_file {81	enum {82		INTERFACE=1, CHANNEL83	}		kind;84	struct sk_buff_head xq;		/* pppd transmit queue */85	struct sk_buff_head rq;		/* receive queue for pppd */86	wait_queue_head_t rwait;	/* for poll on reading /dev/ppp */87	refcount_t	refcnt;		/* # refs (incl /dev/ppp attached) */88	int		hdrlen;		/* space to leave for headers */89	int		index;		/* interface unit / channel number */90	int		dead;		/* unit/channel has been shut down */91};92 93#define PF_TO_X(pf, X)		container_of(pf, X, file)94 95#define PF_TO_PPP(pf)		PF_TO_X(pf, struct ppp)96#define PF_TO_CHANNEL(pf)	PF_TO_X(pf, struct channel)97 98/*99 * Data structure to hold primary network stats for which100 * we want to use 64 bit storage.  Other network stats101 * are stored in dev->stats of the ppp strucute.102 */103struct ppp_link_stats {104	u64 rx_packets;105	u64 tx_packets;106	u64 rx_bytes;107	u64 tx_bytes;108};109 110/*111 * Data structure describing one ppp unit.112 * A ppp unit corresponds to a ppp network interface device113 * and represents a multilink bundle.114 * It can have 0 or more ppp channels connected to it.115 */116struct ppp {117	struct ppp_file	file;		/* stuff for read/write/poll 0 */118	struct file	*owner;		/* file that owns this unit 48 */119	struct list_head channels;	/* list of attached channels 4c */120	int		n_channels;	/* how many channels are attached 54 */121	spinlock_t	rlock;		/* lock for receive side 58 */122	spinlock_t	wlock;		/* lock for transmit side 5c */123	int __percpu	*xmit_recursion; /* xmit recursion detect */124	int		mru;		/* max receive unit 60 */125	unsigned int	flags;		/* control bits 64 */126	unsigned int	xstate;		/* transmit state bits 68 */127	unsigned int	rstate;		/* receive state bits 6c */128	int		debug;		/* debug flags 70 */129	struct slcompress *vj;		/* state for VJ header compression */130	enum NPmode	npmode[NUM_NP];	/* what to do with each net proto 78 */131	struct sk_buff	*xmit_pending;	/* a packet ready to go out 88 */132	struct compressor *xcomp;	/* transmit packet compressor 8c */133	void		*xc_state;	/* its internal state 90 */134	struct compressor *rcomp;	/* receive decompressor 94 */135	void		*rc_state;	/* its internal state 98 */136	unsigned long	last_xmit;	/* jiffies when last pkt sent 9c */137	unsigned long	last_recv;	/* jiffies when last pkt rcvd a0 */138	struct net_device *dev;		/* network interface device a4 */139	int		closing;	/* is device closing down? a8 */140#ifdef CONFIG_PPP_MULTILINK141	int		nxchan;		/* next channel to send something on */142	u32		nxseq;		/* next sequence number to send */143	int		mrru;		/* MP: max reconst. receive unit */144	u32		nextseq;	/* MP: seq no of next packet */145	u32		minseq;		/* MP: min of most recent seqnos */146	struct sk_buff_head mrq;	/* MP: receive reconstruction queue */147#endif /* CONFIG_PPP_MULTILINK */148#ifdef CONFIG_PPP_FILTER149	struct bpf_prog *pass_filter;	/* filter for packets to pass */150	struct bpf_prog *active_filter; /* filter for pkts to reset idle */151#endif /* CONFIG_PPP_FILTER */152	struct net	*ppp_net;	/* the net we belong to */153	struct ppp_link_stats stats64;	/* 64 bit network stats */154};155 156/*157 * Bits in flags: SC_NO_TCP_CCID, SC_CCP_OPEN, SC_CCP_UP, SC_LOOP_TRAFFIC,158 * SC_MULTILINK, SC_MP_SHORTSEQ, SC_MP_XSHORTSEQ, SC_COMP_TCP, SC_REJ_COMP_TCP,159 * SC_MUST_COMP160 * Bits in rstate: SC_DECOMP_RUN, SC_DC_ERROR, SC_DC_FERROR.161 * Bits in xstate: SC_COMP_RUN162 */163#define SC_FLAG_BITS	(SC_NO_TCP_CCID|SC_CCP_OPEN|SC_CCP_UP|SC_LOOP_TRAFFIC \164			 |SC_MULTILINK|SC_MP_SHORTSEQ|SC_MP_XSHORTSEQ \165			 |SC_COMP_TCP|SC_REJ_COMP_TCP|SC_MUST_COMP)166 167/*168 * Private data structure for each channel.169 * This includes the data structure used for multilink.170 */171struct channel {172	struct ppp_file	file;		/* stuff for read/write/poll */173	struct list_head list;		/* link in all/new_channels list */174	struct ppp_channel *chan;	/* public channel data structure */175	struct rw_semaphore chan_sem;	/* protects `chan' during chan ioctl */176	spinlock_t	downl;		/* protects `chan', file.xq dequeue */177	struct ppp	*ppp;		/* ppp unit we're connected to */178	struct net	*chan_net;	/* the net channel belongs to */179	netns_tracker	ns_tracker;180	struct list_head clist;		/* link in list of channels per unit */181	rwlock_t	upl;		/* protects `ppp' and 'bridge' */182	struct channel __rcu *bridge;	/* "bridged" ppp channel */183#ifdef CONFIG_PPP_MULTILINK184	u8		avail;		/* flag used in multilink stuff */185	u8		had_frag;	/* >= 1 fragments have been sent */186	u32		lastseq;	/* MP: last sequence # received */187	int		speed;		/* speed of the corresponding ppp channel*/188#endif /* CONFIG_PPP_MULTILINK */189};190 191struct ppp_config {192	struct file *file;193	s32 unit;194	bool ifname_is_set;195};196 197/*198 * SMP locking issues:199 * Both the ppp.rlock and ppp.wlock locks protect the ppp.channels200 * list and the ppp.n_channels field, you need to take both locks201 * before you modify them.202 * The lock ordering is: channel.upl -> ppp.wlock -> ppp.rlock ->203 * channel.downl.204 */205 206static DEFINE_MUTEX(ppp_mutex);207static atomic_t ppp_unit_count = ATOMIC_INIT(0);208static atomic_t channel_count = ATOMIC_INIT(0);209 210/* per-net private data for this module */211static unsigned int ppp_net_id __read_mostly;212struct ppp_net {213	/* units to ppp mapping */214	struct idr units_idr;215 216	/*217	 * all_ppp_mutex protects the units_idr mapping.218	 * It also ensures that finding a ppp unit in the units_idr219	 * map and updating its file.refcnt field is atomic.220	 */221	struct mutex all_ppp_mutex;222 223	/* channels */224	struct list_head all_channels;225	struct list_head new_channels;226	int last_channel_index;227 228	/*229	 * all_channels_lock protects all_channels and230	 * last_channel_index, and the atomicity of find231	 * a channel and updating its file.refcnt field.232	 */233	spinlock_t all_channels_lock;234};235 236/* Get the PPP protocol number from a skb */237#define PPP_PROTO(skb)	get_unaligned_be16((skb)->data)238 239/* We limit the length of ppp->file.rq to this (arbitrary) value */240#define PPP_MAX_RQLEN	32241 242/*243 * Maximum number of multilink fragments queued up.244 * This has to be large enough to cope with the maximum latency of245 * the slowest channel relative to the others.  Strictly it should246 * depend on the number of channels and their characteristics.247 */248#define PPP_MP_MAX_QLEN	128249 250/* Multilink header bits. */251#define B	0x80		/* this fragment begins a packet */252#define E	0x40		/* this fragment ends a packet */253 254/* Compare multilink sequence numbers (assumed to be 32 bits wide) */255#define seq_before(a, b)	((s32)((a) - (b)) < 0)256#define seq_after(a, b)		((s32)((a) - (b)) > 0)257 258/* Prototypes. */259static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,260			struct file *file, unsigned int cmd, unsigned long arg);261static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb);262static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);263static void ppp_push(struct ppp *ppp);264static void ppp_channel_push(struct channel *pch);265static void ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb,266			      struct channel *pch);267static void ppp_receive_error(struct ppp *ppp);268static void ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb);269static struct sk_buff *ppp_decompress_frame(struct ppp *ppp,270					    struct sk_buff *skb);271#ifdef CONFIG_PPP_MULTILINK272static void ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb,273				struct channel *pch);274static void ppp_mp_insert(struct ppp *ppp, struct sk_buff *skb);275static struct sk_buff *ppp_mp_reconstruct(struct ppp *ppp);276static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb);277#endif /* CONFIG_PPP_MULTILINK */278static int ppp_set_compress(struct ppp *ppp, struct ppp_option_data *data);279static void ppp_ccp_peek(struct ppp *ppp, struct sk_buff *skb, int inbound);280static void ppp_ccp_closed(struct ppp *ppp);281static struct compressor *find_compressor(int type);282static void ppp_get_stats(struct ppp *ppp, struct ppp_stats *st);283static int ppp_create_interface(struct net *net, struct file *file, int *unit);284static void init_ppp_file(struct ppp_file *pf, int kind);285static void ppp_destroy_interface(struct ppp *ppp);286static struct ppp *ppp_find_unit(struct ppp_net *pn, int unit);287static struct channel *ppp_find_channel(struct ppp_net *pn, int unit);288static int ppp_connect_channel(struct channel *pch, int unit);289static int ppp_disconnect_channel(struct channel *pch);290static void ppp_destroy_channel(struct channel *pch);291static int unit_get(struct idr *p, void *ptr, int min);292static int unit_set(struct idr *p, void *ptr, int n);293static void unit_put(struct idr *p, int n);294static void *unit_find(struct idr *p, int n);295static void ppp_setup(struct net_device *dev);296 297static const struct net_device_ops ppp_netdev_ops;298 299static const struct class ppp_class = {300	.name = "ppp",301};302 303/* per net-namespace data */304static inline struct ppp_net *ppp_pernet(struct net *net)305{306	return net_generic(net, ppp_net_id);307}308 309/* Translates a PPP protocol number to a NP index (NP == network protocol) */310static inline int proto_to_npindex(int proto)311{312	switch (proto) {313	case PPP_IP:314		return NP_IP;315	case PPP_IPV6:316		return NP_IPV6;317	case PPP_IPX:318		return NP_IPX;319	case PPP_AT:320		return NP_AT;321	case PPP_MPLS_UC:322		return NP_MPLS_UC;323	case PPP_MPLS_MC:324		return NP_MPLS_MC;325	}326	return -EINVAL;327}328 329/* Translates an NP index into a PPP protocol number */330static const int npindex_to_proto[NUM_NP] = {331	PPP_IP,332	PPP_IPV6,333	PPP_IPX,334	PPP_AT,335	PPP_MPLS_UC,336	PPP_MPLS_MC,337};338 339/* Translates an ethertype into an NP index */340static inline int ethertype_to_npindex(int ethertype)341{342	switch (ethertype) {343	case ETH_P_IP:344		return NP_IP;345	case ETH_P_IPV6:346		return NP_IPV6;347	case ETH_P_IPX:348		return NP_IPX;349	case ETH_P_PPPTALK:350	case ETH_P_ATALK:351		return NP_AT;352	case ETH_P_MPLS_UC:353		return NP_MPLS_UC;354	case ETH_P_MPLS_MC:355		return NP_MPLS_MC;356	}357	return -1;358}359 360/* Translates an NP index into an ethertype */361static const int npindex_to_ethertype[NUM_NP] = {362	ETH_P_IP,363	ETH_P_IPV6,364	ETH_P_IPX,365	ETH_P_PPPTALK,366	ETH_P_MPLS_UC,367	ETH_P_MPLS_MC,368};369 370/*371 * Locking shorthand.372 */373#define ppp_xmit_lock(ppp)	spin_lock_bh(&(ppp)->wlock)374#define ppp_xmit_unlock(ppp)	spin_unlock_bh(&(ppp)->wlock)375#define ppp_recv_lock(ppp)	spin_lock_bh(&(ppp)->rlock)376#define ppp_recv_unlock(ppp)	spin_unlock_bh(&(ppp)->rlock)377#define ppp_lock(ppp)		do { ppp_xmit_lock(ppp); \378				     ppp_recv_lock(ppp); } while (0)379#define ppp_unlock(ppp)		do { ppp_recv_unlock(ppp); \380				     ppp_xmit_unlock(ppp); } while (0)381 382/*383 * /dev/ppp device routines.384 * The /dev/ppp device is used by pppd to control the ppp unit.385 * It supports the read, write, ioctl and poll functions.386 * Open instances of /dev/ppp can be in one of three states:387 * unattached, attached to a ppp unit, or attached to a ppp channel.388 */389static int ppp_open(struct inode *inode, struct file *file)390{391	/*392	 * This could (should?) be enforced by the permissions on /dev/ppp.393	 */394	if (!ns_capable(file->f_cred->user_ns, CAP_NET_ADMIN))395		return -EPERM;396	return 0;397}398 399static int ppp_release(struct inode *unused, struct file *file)400{401	struct ppp_file *pf = file->private_data;402	struct ppp *ppp;403 404	if (pf) {405		file->private_data = NULL;406		if (pf->kind == INTERFACE) {407			ppp = PF_TO_PPP(pf);408			rtnl_lock();409			if (file == ppp->owner)410				unregister_netdevice(ppp->dev);411			rtnl_unlock();412		}413		if (refcount_dec_and_test(&pf->refcnt)) {414			switch (pf->kind) {415			case INTERFACE:416				ppp_destroy_interface(PF_TO_PPP(pf));417				break;418			case CHANNEL:419				ppp_destroy_channel(PF_TO_CHANNEL(pf));420				break;421			}422		}423	}424	return 0;425}426 427static ssize_t ppp_read(struct file *file, char __user *buf,428			size_t count, loff_t *ppos)429{430	struct ppp_file *pf = file->private_data;431	DECLARE_WAITQUEUE(wait, current);432	ssize_t ret;433	struct sk_buff *skb = NULL;434	struct iovec iov;435	struct iov_iter to;436 437	ret = count;438 439	if (!pf)440		return -ENXIO;441	add_wait_queue(&pf->rwait, &wait);442	for (;;) {443		set_current_state(TASK_INTERRUPTIBLE);444		skb = skb_dequeue(&pf->rq);445		if (skb)446			break;447		ret = 0;448		if (pf->dead)449			break;450		if (pf->kind == INTERFACE) {451			/*452			 * Return 0 (EOF) on an interface that has no453			 * channels connected, unless it is looping454			 * network traffic (demand mode).455			 */456			struct ppp *ppp = PF_TO_PPP(pf);457 458			ppp_recv_lock(ppp);459			if (ppp->n_channels == 0 &&460			    (ppp->flags & SC_LOOP_TRAFFIC) == 0) {461				ppp_recv_unlock(ppp);462				break;463			}464			ppp_recv_unlock(ppp);465		}466		ret = -EAGAIN;467		if (file->f_flags & O_NONBLOCK)468			break;469		ret = -ERESTARTSYS;470		if (signal_pending(current))471			break;472		schedule();473	}474	set_current_state(TASK_RUNNING);475	remove_wait_queue(&pf->rwait, &wait);476 477	if (!skb)478		goto out;479 480	ret = -EOVERFLOW;481	if (skb->len > count)482		goto outf;483	ret = -EFAULT;484	iov.iov_base = buf;485	iov.iov_len = count;486	iov_iter_init(&to, ITER_DEST, &iov, 1, count);487	if (skb_copy_datagram_iter(skb, 0, &to, skb->len))488		goto outf;489	ret = skb->len;490 491 outf:492	kfree_skb(skb);493 out:494	return ret;495}496 497static bool ppp_check_packet(struct sk_buff *skb, size_t count)498{499	/* LCP packets must include LCP header which 4 bytes long:500	 * 1-byte code, 1-byte identifier, and 2-byte length.501	 */502	return get_unaligned_be16(skb->data) != PPP_LCP ||503		count >= PPP_PROTO_LEN + PPP_LCP_HDRLEN;504}505 506static ssize_t ppp_write(struct file *file, const char __user *buf,507			 size_t count, loff_t *ppos)508{509	struct ppp_file *pf = file->private_data;510	struct sk_buff *skb;511	ssize_t ret;512 513	if (!pf)514		return -ENXIO;515	/* All PPP packets should start with the 2-byte protocol */516	if (count < PPP_PROTO_LEN)517		return -EINVAL;518	ret = -ENOMEM;519	skb = alloc_skb(count + pf->hdrlen, GFP_KERNEL);520	if (!skb)521		goto out;522	skb_reserve(skb, pf->hdrlen);523	ret = -EFAULT;524	if (copy_from_user(skb_put(skb, count), buf, count)) {525		kfree_skb(skb);526		goto out;527	}528	ret = -EINVAL;529	if (unlikely(!ppp_check_packet(skb, count))) {530		kfree_skb(skb);531		goto out;532	}533 534	switch (pf->kind) {535	case INTERFACE:536		ppp_xmit_process(PF_TO_PPP(pf), skb);537		break;538	case CHANNEL:539		skb_queue_tail(&pf->xq, skb);540		ppp_channel_push(PF_TO_CHANNEL(pf));541		break;542	}543 544	ret = count;545 546 out:547	return ret;548}549 550/* No kernel lock - fine */551static __poll_t ppp_poll(struct file *file, poll_table *wait)552{553	struct ppp_file *pf = file->private_data;554	__poll_t mask;555 556	if (!pf)557		return 0;558	poll_wait(file, &pf->rwait, wait);559	mask = EPOLLOUT | EPOLLWRNORM;560	if (skb_peek(&pf->rq))561		mask |= EPOLLIN | EPOLLRDNORM;562	if (pf->dead)563		mask |= EPOLLHUP;564	else if (pf->kind == INTERFACE) {565		/* see comment in ppp_read */566		struct ppp *ppp = PF_TO_PPP(pf);567 568		ppp_recv_lock(ppp);569		if (ppp->n_channels == 0 &&570		    (ppp->flags & SC_LOOP_TRAFFIC) == 0)571			mask |= EPOLLIN | EPOLLRDNORM;572		ppp_recv_unlock(ppp);573	}574 575	return mask;576}577 578#ifdef CONFIG_PPP_FILTER579static struct bpf_prog *get_filter(struct sock_fprog *uprog)580{581	struct sock_fprog_kern fprog;582	struct bpf_prog *res = NULL;583	int err;584 585	if (!uprog->len)586		return NULL;587 588	/* uprog->len is unsigned short, so no overflow here */589	fprog.len = uprog->len;590	fprog.filter = memdup_array_user(uprog->filter,591					 uprog->len, sizeof(struct sock_filter));592	if (IS_ERR(fprog.filter))593		return ERR_CAST(fprog.filter);594 595	err = bpf_prog_create(&res, &fprog);596	kfree(fprog.filter);597 598	return err ? ERR_PTR(err) : res;599}600 601static struct bpf_prog *ppp_get_filter(struct sock_fprog __user *p)602{603	struct sock_fprog uprog;604 605	if (copy_from_user(&uprog, p, sizeof(struct sock_fprog)))606		return ERR_PTR(-EFAULT);607	return get_filter(&uprog);608}609 610#ifdef CONFIG_COMPAT611struct sock_fprog32 {612	unsigned short len;613	compat_caddr_t filter;614};615 616#define PPPIOCSPASS32		_IOW('t', 71, struct sock_fprog32)617#define PPPIOCSACTIVE32		_IOW('t', 70, struct sock_fprog32)618 619static struct bpf_prog *compat_ppp_get_filter(struct sock_fprog32 __user *p)620{621	struct sock_fprog32 uprog32;622	struct sock_fprog uprog;623 624	if (copy_from_user(&uprog32, p, sizeof(struct sock_fprog32)))625		return ERR_PTR(-EFAULT);626	uprog.len = uprog32.len;627	uprog.filter = compat_ptr(uprog32.filter);628	return get_filter(&uprog);629}630#endif631#endif632 633/* Bridge one PPP channel to another.634 * When two channels are bridged, ppp_input on one channel is redirected to635 * the other's ops->start_xmit handler.636 * In order to safely bridge channels we must reject channels which are already637 * part of a bridge instance, or which form part of an existing unit.638 * Once successfully bridged, each channel holds a reference on the other639 * to prevent it being freed while the bridge is extant.640 */641static int ppp_bridge_channels(struct channel *pch, struct channel *pchb)642{643	write_lock_bh(&pch->upl);644	if (pch->ppp ||645	    rcu_dereference_protected(pch->bridge, lockdep_is_held(&pch->upl))) {646		write_unlock_bh(&pch->upl);647		return -EALREADY;648	}649	refcount_inc(&pchb->file.refcnt);650	rcu_assign_pointer(pch->bridge, pchb);651	write_unlock_bh(&pch->upl);652 653	write_lock_bh(&pchb->upl);654	if (pchb->ppp ||655	    rcu_dereference_protected(pchb->bridge, lockdep_is_held(&pchb->upl))) {656		write_unlock_bh(&pchb->upl);657		goto err_unset;658	}659	refcount_inc(&pch->file.refcnt);660	rcu_assign_pointer(pchb->bridge, pch);661	write_unlock_bh(&pchb->upl);662 663	return 0;664 665err_unset:666	write_lock_bh(&pch->upl);667	/* Re-read pch->bridge with upl held in case it was modified concurrently */668	pchb = rcu_dereference_protected(pch->bridge, lockdep_is_held(&pch->upl));669	RCU_INIT_POINTER(pch->bridge, NULL);670	write_unlock_bh(&pch->upl);671	synchronize_rcu();672 673	if (pchb)674		if (refcount_dec_and_test(&pchb->file.refcnt))675			ppp_destroy_channel(pchb);676 677	return -EALREADY;678}679 680static int ppp_unbridge_channels(struct channel *pch)681{682	struct channel *pchb, *pchbb;683 684	write_lock_bh(&pch->upl);685	pchb = rcu_dereference_protected(pch->bridge, lockdep_is_held(&pch->upl));686	if (!pchb) {687		write_unlock_bh(&pch->upl);688		return -EINVAL;689	}690	RCU_INIT_POINTER(pch->bridge, NULL);691	write_unlock_bh(&pch->upl);692 693	/* Only modify pchb if phcb->bridge points back to pch.694	 * If not, it implies that there has been a race unbridging (and possibly695	 * even rebridging) pchb.  We should leave pchb alone to avoid either a696	 * refcount underflow, or breaking another established bridge instance.697	 */698	write_lock_bh(&pchb->upl);699	pchbb = rcu_dereference_protected(pchb->bridge, lockdep_is_held(&pchb->upl));700	if (pchbb == pch)701		RCU_INIT_POINTER(pchb->bridge, NULL);702	write_unlock_bh(&pchb->upl);703 704	synchronize_rcu();705 706	if (pchbb == pch)707		if (refcount_dec_and_test(&pch->file.refcnt))708			ppp_destroy_channel(pch);709 710	if (refcount_dec_and_test(&pchb->file.refcnt))711		ppp_destroy_channel(pchb);712 713	return 0;714}715 716static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)717{718	struct ppp_file *pf;719	struct ppp *ppp;720	int err = -EFAULT, val, val2, i;721	struct ppp_idle32 idle32;722	struct ppp_idle64 idle64;723	struct npioctl npi;724	int unit, cflags;725	struct slcompress *vj;726	void __user *argp = (void __user *)arg;727	int __user *p = argp;728 729	mutex_lock(&ppp_mutex);730 731	pf = file->private_data;732	if (!pf) {733		err = ppp_unattached_ioctl(current->nsproxy->net_ns,734					   pf, file, cmd, arg);735		goto out;736	}737 738	if (cmd == PPPIOCDETACH) {739		/*740		 * PPPIOCDETACH is no longer supported as it was heavily broken,741		 * and is only known to have been used by pppd older than742		 * ppp-2.4.2 (released November 2003).743		 */744		pr_warn_once("%s (%d) used obsolete PPPIOCDETACH ioctl\n",745			     current->comm, current->pid);746		err = -EINVAL;747		goto out;748	}749 750	if (pf->kind == CHANNEL) {751		struct channel *pch, *pchb;752		struct ppp_channel *chan;753		struct ppp_net *pn;754 755		pch = PF_TO_CHANNEL(pf);756 757		switch (cmd) {758		case PPPIOCCONNECT:759			if (get_user(unit, p))760				break;761			err = ppp_connect_channel(pch, unit);762			break;763 764		case PPPIOCDISCONN:765			err = ppp_disconnect_channel(pch);766			break;767 768		case PPPIOCBRIDGECHAN:769			if (get_user(unit, p))770				break;771			err = -ENXIO;772			pn = ppp_pernet(current->nsproxy->net_ns);773			spin_lock_bh(&pn->all_channels_lock);774			pchb = ppp_find_channel(pn, unit);775			/* Hold a reference to prevent pchb being freed while776			 * we establish the bridge.777			 */778			if (pchb)779				refcount_inc(&pchb->file.refcnt);780			spin_unlock_bh(&pn->all_channels_lock);781			if (!pchb)782				break;783			err = ppp_bridge_channels(pch, pchb);784			/* Drop earlier refcount now bridge establishment is complete */785			if (refcount_dec_and_test(&pchb->file.refcnt))786				ppp_destroy_channel(pchb);787			break;788 789		case PPPIOCUNBRIDGECHAN:790			err = ppp_unbridge_channels(pch);791			break;792 793		default:794			down_read(&pch->chan_sem);795			chan = pch->chan;796			err = -ENOTTY;797			if (chan && chan->ops->ioctl)798				err = chan->ops->ioctl(chan, cmd, arg);799			up_read(&pch->chan_sem);800		}801		goto out;802	}803 804	if (pf->kind != INTERFACE) {805		/* can't happen */806		pr_err("PPP: not interface or channel??\n");807		err = -EINVAL;808		goto out;809	}810 811	ppp = PF_TO_PPP(pf);812	switch (cmd) {813	case PPPIOCSMRU:814		if (get_user(val, p))815			break;816		ppp->mru = val;817		err = 0;818		break;819 820	case PPPIOCSFLAGS:821		if (get_user(val, p))822			break;823		ppp_lock(ppp);824		cflags = ppp->flags & ~val;825#ifdef CONFIG_PPP_MULTILINK826		if (!(ppp->flags & SC_MULTILINK) && (val & SC_MULTILINK))827			ppp->nextseq = 0;828#endif829		ppp->flags = val & SC_FLAG_BITS;830		ppp_unlock(ppp);831		if (cflags & SC_CCP_OPEN)832			ppp_ccp_closed(ppp);833		err = 0;834		break;835 836	case PPPIOCGFLAGS:837		val = ppp->flags | ppp->xstate | ppp->rstate;838		if (put_user(val, p))839			break;840		err = 0;841		break;842 843	case PPPIOCSCOMPRESS:844	{845		struct ppp_option_data data;846		if (copy_from_user(&data, argp, sizeof(data)))847			err = -EFAULT;848		else849			err = ppp_set_compress(ppp, &data);850		break;851	}852	case PPPIOCGUNIT:853		if (put_user(ppp->file.index, p))854			break;855		err = 0;856		break;857 858	case PPPIOCSDEBUG:859		if (get_user(val, p))860			break;861		ppp->debug = val;862		err = 0;863		break;864 865	case PPPIOCGDEBUG:866		if (put_user(ppp->debug, p))867			break;868		err = 0;869		break;870 871	case PPPIOCGIDLE32:872                idle32.xmit_idle = (jiffies - ppp->last_xmit) / HZ;873                idle32.recv_idle = (jiffies - ppp->last_recv) / HZ;874                if (copy_to_user(argp, &idle32, sizeof(idle32)))875			break;876		err = 0;877		break;878 879	case PPPIOCGIDLE64:880		idle64.xmit_idle = (jiffies - ppp->last_xmit) / HZ;881		idle64.recv_idle = (jiffies - ppp->last_recv) / HZ;882		if (copy_to_user(argp, &idle64, sizeof(idle64)))883			break;884		err = 0;885		break;886 887	case PPPIOCSMAXCID:888		if (get_user(val, p))889			break;890		val2 = 15;891		if ((val >> 16) != 0) {892			val2 = val >> 16;893			val &= 0xffff;894		}895		vj = slhc_init(val2+1, val+1);896		if (IS_ERR(vj)) {897			err = PTR_ERR(vj);898			break;899		}900		ppp_lock(ppp);901		if (ppp->vj)902			slhc_free(ppp->vj);903		ppp->vj = vj;904		ppp_unlock(ppp);905		err = 0;906		break;907 908	case PPPIOCGNPMODE:909	case PPPIOCSNPMODE:910		if (copy_from_user(&npi, argp, sizeof(npi)))911			break;912		err = proto_to_npindex(npi.protocol);913		if (err < 0)914			break;915		i = err;916		if (cmd == PPPIOCGNPMODE) {917			err = -EFAULT;918			npi.mode = ppp->npmode[i];919			if (copy_to_user(argp, &npi, sizeof(npi)))920				break;921		} else {922			ppp->npmode[i] = npi.mode;923			/* we may be able to transmit more packets now (??) */924			netif_wake_queue(ppp->dev);925		}926		err = 0;927		break;928 929#ifdef CONFIG_PPP_FILTER930	case PPPIOCSPASS:931	case PPPIOCSACTIVE:932	{933		struct bpf_prog *filter = ppp_get_filter(argp);934		struct bpf_prog **which;935 936		if (IS_ERR(filter)) {937			err = PTR_ERR(filter);938			break;939		}940		if (cmd == PPPIOCSPASS)941			which = &ppp->pass_filter;942		else943			which = &ppp->active_filter;944		ppp_lock(ppp);945		if (*which)946			bpf_prog_destroy(*which);947		*which = filter;948		ppp_unlock(ppp);949		err = 0;950		break;951	}952#endif /* CONFIG_PPP_FILTER */953 954#ifdef CONFIG_PPP_MULTILINK955	case PPPIOCSMRRU:956		if (get_user(val, p))957			break;958		ppp_recv_lock(ppp);959		ppp->mrru = val;960		ppp_recv_unlock(ppp);961		err = 0;962		break;963#endif /* CONFIG_PPP_MULTILINK */964 965	default:966		err = -ENOTTY;967	}968 969out:970	mutex_unlock(&ppp_mutex);971 972	return err;973}974 975#ifdef CONFIG_COMPAT976struct ppp_option_data32 {977	compat_uptr_t		ptr;978	u32			length;979	compat_int_t		transmit;980};981#define PPPIOCSCOMPRESS32	_IOW('t', 77, struct ppp_option_data32)982 983static long ppp_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)984{985	struct ppp_file *pf;986	int err = -ENOIOCTLCMD;987	void __user *argp = (void __user *)arg;988 989	mutex_lock(&ppp_mutex);990 991	pf = file->private_data;992	if (pf && pf->kind == INTERFACE) {993		struct ppp *ppp = PF_TO_PPP(pf);994		switch (cmd) {995#ifdef CONFIG_PPP_FILTER996		case PPPIOCSPASS32:997		case PPPIOCSACTIVE32:998		{999			struct bpf_prog *filter = compat_ppp_get_filter(argp);1000			struct bpf_prog **which;1001 1002			if (IS_ERR(filter)) {1003				err = PTR_ERR(filter);1004				break;1005			}1006			if (cmd == PPPIOCSPASS32)1007				which = &ppp->pass_filter;1008			else1009				which = &ppp->active_filter;1010			ppp_lock(ppp);1011			if (*which)1012				bpf_prog_destroy(*which);1013			*which = filter;1014			ppp_unlock(ppp);1015			err = 0;1016			break;1017		}1018#endif /* CONFIG_PPP_FILTER */1019		case PPPIOCSCOMPRESS32:1020		{1021			struct ppp_option_data32 data32;1022			if (copy_from_user(&data32, argp, sizeof(data32))) {1023				err = -EFAULT;1024			} else {1025				struct ppp_option_data data = {1026					.ptr = compat_ptr(data32.ptr),1027					.length = data32.length,1028					.transmit = data32.transmit1029				};1030				err = ppp_set_compress(ppp, &data);1031			}1032			break;1033		}1034		}1035	}1036	mutex_unlock(&ppp_mutex);1037 1038	/* all other commands have compatible arguments */1039	if (err == -ENOIOCTLCMD)1040		err = ppp_ioctl(file, cmd, (unsigned long)compat_ptr(arg));1041 1042	return err;1043}1044#endif1045 1046static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,1047			struct file *file, unsigned int cmd, unsigned long arg)1048{1049	int unit, err = -EFAULT;1050	struct ppp *ppp;1051	struct channel *chan;1052	struct ppp_net *pn;1053	int __user *p = (int __user *)arg;1054 1055	switch (cmd) {1056	case PPPIOCNEWUNIT:1057		/* Create a new ppp unit */1058		if (get_user(unit, p))1059			break;1060		err = ppp_create_interface(net, file, &unit);1061		if (err < 0)1062			break;1063 1064		err = -EFAULT;1065		if (put_user(unit, p))1066			break;1067		err = 0;1068		break;1069 1070	case PPPIOCATTACH:1071		/* Attach to an existing ppp unit */1072		if (get_user(unit, p))1073			break;1074		err = -ENXIO;1075		pn = ppp_pernet(net);1076		mutex_lock(&pn->all_ppp_mutex);1077		ppp = ppp_find_unit(pn, unit);1078		if (ppp) {1079			refcount_inc(&ppp->file.refcnt);1080			file->private_data = &ppp->file;1081			err = 0;1082		}1083		mutex_unlock(&pn->all_ppp_mutex);1084		break;1085 1086	case PPPIOCATTCHAN:1087		if (get_user(unit, p))1088			break;1089		err = -ENXIO;1090		pn = ppp_pernet(net);1091		spin_lock_bh(&pn->all_channels_lock);1092		chan = ppp_find_channel(pn, unit);1093		if (chan) {1094			refcount_inc(&chan->file.refcnt);1095			file->private_data = &chan->file;1096			err = 0;1097		}1098		spin_unlock_bh(&pn->all_channels_lock);1099		break;1100 1101	default:1102		err = -ENOTTY;1103	}1104 1105	return err;1106}1107 1108static const struct file_operations ppp_device_fops = {1109	.owner		= THIS_MODULE,1110	.read		= ppp_read,1111	.write		= ppp_write,1112	.poll		= ppp_poll,1113	.unlocked_ioctl	= ppp_ioctl,1114#ifdef CONFIG_COMPAT1115	.compat_ioctl	= ppp_compat_ioctl,1116#endif1117	.open		= ppp_open,1118	.release	= ppp_release,1119	.llseek		= noop_llseek,1120};1121 1122static __net_init int ppp_init_net(struct net *net)1123{1124	struct ppp_net *pn = net_generic(net, ppp_net_id);1125 1126	idr_init(&pn->units_idr);1127	mutex_init(&pn->all_ppp_mutex);1128 1129	INIT_LIST_HEAD(&pn->all_channels);1130	INIT_LIST_HEAD(&pn->new_channels);1131 1132	spin_lock_init(&pn->all_channels_lock);1133 1134	return 0;1135}1136 1137static __net_exit void ppp_exit_net(struct net *net)1138{1139	struct ppp_net *pn = net_generic(net, ppp_net_id);1140	struct net_device *dev;1141	struct net_device *aux;1142	struct ppp *ppp;1143	LIST_HEAD(list);1144	int id;1145 1146	rtnl_lock();1147	for_each_netdev_safe(net, dev, aux) {1148		if (dev->netdev_ops == &ppp_netdev_ops)1149			unregister_netdevice_queue(dev, &list);1150	}1151 1152	idr_for_each_entry(&pn->units_idr, ppp, id)1153		/* Skip devices already unregistered by previous loop */1154		if (!net_eq(dev_net(ppp->dev), net))1155			unregister_netdevice_queue(ppp->dev, &list);1156 1157	unregister_netdevice_many(&list);1158	rtnl_unlock();1159 1160	mutex_destroy(&pn->all_ppp_mutex);1161	idr_destroy(&pn->units_idr);1162	WARN_ON_ONCE(!list_empty(&pn->all_channels));1163	WARN_ON_ONCE(!list_empty(&pn->new_channels));1164}1165 1166static struct pernet_operations ppp_net_ops = {1167	.init = ppp_init_net,1168	.exit = ppp_exit_net,1169	.id   = &ppp_net_id,1170	.size = sizeof(struct ppp_net),1171};1172 1173static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set)1174{1175	struct ppp_net *pn = ppp_pernet(ppp->ppp_net);1176	int ret;1177 1178	mutex_lock(&pn->all_ppp_mutex);1179 1180	if (unit < 0) {1181		ret = unit_get(&pn->units_idr, ppp, 0);1182		if (ret < 0)1183			goto err;1184		if (!ifname_is_set) {1185			while (1) {1186				snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ret);1187				if (!netdev_name_in_use(ppp->ppp_net, ppp->dev->name))1188					break;1189				unit_put(&pn->units_idr, ret);1190				ret = unit_get(&pn->units_idr, ppp, ret + 1);1191				if (ret < 0)1192					goto err;1193			}1194		}1195	} else {1196		/* Caller asked for a specific unit number. Fail with -EEXIST1197		 * if unavailable. For backward compatibility, return -EEXIST1198		 * too if idr allocation fails; this makes pppd retry without1199		 * requesting a specific unit number.1200		 */1201		if (unit_find(&pn->units_idr, unit)) {1202			ret = -EEXIST;1203			goto err;1204		}1205		ret = unit_set(&pn->units_idr, ppp, unit);1206		if (ret < 0) {1207			/* Rewrite error for backward compatibility */1208			ret = -EEXIST;1209			goto err;1210		}1211	}1212	ppp->file.index = ret;1213 1214	if (!ifname_is_set)1215		snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index);1216 1217	mutex_unlock(&pn->all_ppp_mutex);1218 1219	ret = register_netdevice(ppp->dev);1220	if (ret < 0)1221		goto err_unit;1222 1223	atomic_inc(&ppp_unit_count);1224 1225	return 0;1226 1227err_unit:1228	mutex_lock(&pn->all_ppp_mutex);1229	unit_put(&pn->units_idr, ppp->file.index);1230err:1231	mutex_unlock(&pn->all_ppp_mutex);1232 1233	return ret;1234}1235 1236static int ppp_dev_configure(struct net *src_net, struct net_device *dev,1237			     const struct ppp_config *conf)1238{1239	struct ppp *ppp = netdev_priv(dev);1240	int indx;1241	int err;1242	int cpu;1243 1244	ppp->dev = dev;1245	ppp->ppp_net = src_net;1246	ppp->mru = PPP_MRU;1247	ppp->owner = conf->file;1248 1249	init_ppp_file(&ppp->file, INTERFACE);1250	ppp->file.hdrlen = PPP_HDRLEN - 2; /* don't count proto bytes */1251 1252	for (indx = 0; indx < NUM_NP; ++indx)1253		ppp->npmode[indx] = NPMODE_PASS;1254	INIT_LIST_HEAD(&ppp->channels);1255	spin_lock_init(&ppp->rlock);1256	spin_lock_init(&ppp->wlock);1257 1258	ppp->xmit_recursion = alloc_percpu(int);1259	if (!ppp->xmit_recursion) {1260		err = -ENOMEM;1261		goto err1;1262	}1263	for_each_possible_cpu(cpu)1264		(*per_cpu_ptr(ppp->xmit_recursion, cpu)) = 0;1265 1266#ifdef CONFIG_PPP_MULTILINK1267	ppp->minseq = -1;1268	skb_queue_head_init(&ppp->mrq);1269#endif /* CONFIG_PPP_MULTILINK */1270#ifdef CONFIG_PPP_FILTER1271	ppp->pass_filter = NULL;1272	ppp->active_filter = NULL;1273#endif /* CONFIG_PPP_FILTER */1274 1275	err = ppp_unit_register(ppp, conf->unit, conf->ifname_is_set);1276	if (err < 0)1277		goto err2;1278 1279	conf->file->private_data = &ppp->file;1280 1281	return 0;1282err2:1283	free_percpu(ppp->xmit_recursion);1284err1:1285	return err;1286}1287 1288static const struct nla_policy ppp_nl_policy[IFLA_PPP_MAX + 1] = {1289	[IFLA_PPP_DEV_FD]	= { .type = NLA_S32 },1290};1291 1292static int ppp_nl_validate(struct nlattr *tb[], struct nlattr *data[],1293			   struct netlink_ext_ack *extack)1294{1295	if (!data)1296		return -EINVAL;1297 1298	if (!data[IFLA_PPP_DEV_FD])1299		return -EINVAL;1300	if (nla_get_s32(data[IFLA_PPP_DEV_FD]) < 0)1301		return -EBADF;1302 1303	return 0;1304}1305 1306static int ppp_nl_newlink(struct net *src_net, struct net_device *dev,1307			  struct nlattr *tb[], struct nlattr *data[],1308			  struct netlink_ext_ack *extack)1309{1310	struct ppp_config conf = {1311		.unit = -1,1312		.ifname_is_set = true,1313	};1314	struct file *file;1315	int err;1316 1317	file = fget(nla_get_s32(data[IFLA_PPP_DEV_FD]));1318	if (!file)1319		return -EBADF;1320 1321	/* rtnl_lock is already held here, but ppp_create_interface() locks1322	 * ppp_mutex before holding rtnl_lock. Using mutex_trylock() avoids1323	 * possible deadlock due to lock order inversion, at the cost of1324	 * pushing the problem back to userspace.1325	 */1326	if (!mutex_trylock(&ppp_mutex)) {1327		err = -EBUSY;1328		goto out;1329	}1330 1331	if (file->f_op != &ppp_device_fops || file->private_data) {1332		err = -EBADF;1333		goto out_unlock;1334	}1335 1336	conf.file = file;1337 1338	/* Don't use device name generated by the rtnetlink layer when ifname1339	 * isn't specified. Let ppp_dev_configure() set the device name using1340	 * the PPP unit identifer as suffix (i.e. ppp<unit_id>). This allows1341	 * userspace to infer the device name using to the PPPIOCGUNIT ioctl.1342	 */1343	if (!tb[IFLA_IFNAME] || !nla_len(tb[IFLA_IFNAME]) || !*(char *)nla_data(tb[IFLA_IFNAME]))1344		conf.ifname_is_set = false;1345 1346	err = ppp_dev_configure(src_net, dev, &conf);1347 1348out_unlock:1349	mutex_unlock(&ppp_mutex);1350out:1351	fput(file);1352 1353	return err;1354}1355 1356static void ppp_nl_dellink(struct net_device *dev, struct list_head *head)1357{1358	unregister_netdevice_queue(dev, head);1359}1360 1361static size_t ppp_nl_get_size(const struct net_device *dev)1362{1363	return 0;1364}1365 1366static int ppp_nl_fill_info(struct sk_buff *skb, const struct net_device *dev)1367{1368	return 0;1369}1370 1371static struct net *ppp_nl_get_link_net(const struct net_device *dev)1372{1373	struct ppp *ppp = netdev_priv(dev);1374 1375	return READ_ONCE(ppp->ppp_net);1376}1377 1378static struct rtnl_link_ops ppp_link_ops __read_mostly = {1379	.kind		= "ppp",1380	.maxtype	= IFLA_PPP_MAX,1381	.policy		= ppp_nl_policy,1382	.priv_size	= sizeof(struct ppp),1383	.setup		= ppp_setup,1384	.validate	= ppp_nl_validate,1385	.newlink	= ppp_nl_newlink,1386	.dellink	= ppp_nl_dellink,1387	.get_size	= ppp_nl_get_size,1388	.fill_info	= ppp_nl_fill_info,1389	.get_link_net	= ppp_nl_get_link_net,1390};1391 1392#define PPP_MAJOR	1081393 1394/* Called at boot time if ppp is compiled into the kernel,1395   or at module load time (from init_module) if compiled as a module. */1396static int __init ppp_init(void)1397{1398	int err;1399 1400	pr_info("PPP generic driver version " PPP_VERSION "\n");1401 1402	err = register_pernet_device(&ppp_net_ops);1403	if (err) {1404		pr_err("failed to register PPP pernet device (%d)\n", err);1405		goto out;1406	}1407 1408	err = register_chrdev(PPP_MAJOR, "ppp", &ppp_device_fops);1409	if (err) {1410		pr_err("failed to register PPP device (%d)\n", err);1411		goto out_net;1412	}1413 1414	err = class_register(&ppp_class);1415	if (err)1416		goto out_chrdev;1417 1418	err = rtnl_link_register(&ppp_link_ops);1419	if (err) {1420		pr_err("failed to register rtnetlink PPP handler\n");1421		goto out_class;1422	}1423 1424	/* not a big deal if we fail here :-) */1425	device_create(&ppp_class, NULL, MKDEV(PPP_MAJOR, 0), NULL, "ppp");1426 1427	return 0;1428 1429out_class:1430	class_unregister(&ppp_class);1431out_chrdev:1432	unregister_chrdev(PPP_MAJOR, "ppp");1433out_net:1434	unregister_pernet_device(&ppp_net_ops);1435out:1436	return err;1437}1438 1439/*1440 * Network interface unit routines.1441 */1442static netdev_tx_t1443ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)1444{1445	struct ppp *ppp = netdev_priv(dev);1446	int npi, proto;1447	unsigned char *pp;1448 1449	npi = ethertype_to_npindex(ntohs(skb->protocol));1450	if (npi < 0)1451		goto outf;1452 1453	/* Drop, accept or reject the packet */1454	switch (ppp->npmode[npi]) {1455	case NPMODE_PASS:1456		break;1457	case NPMODE_QUEUE:1458		/* it would be nice to have a way to tell the network1459		   system to queue this one up for later. */1460		goto outf;1461	case NPMODE_DROP:1462	case NPMODE_ERROR:1463		goto outf;1464	}1465 1466	/* Put the 2-byte PPP protocol number on the front,1467	   making sure there is room for the address and control fields. */1468	if (skb_cow_head(skb, PPP_HDRLEN))1469		goto outf;1470 1471	pp = skb_push(skb, 2);1472	proto = npindex_to_proto[npi];1473	put_unaligned_be16(proto, pp);1474 1475	skb_scrub_packet(skb, !net_eq(ppp->ppp_net, dev_net(dev)));1476	ppp_xmit_process(ppp, skb);1477 1478	return NETDEV_TX_OK;1479 1480 outf:1481	kfree_skb(skb);1482	++dev->stats.tx_dropped;1483	return NETDEV_TX_OK;1484}1485 1486static int1487ppp_net_siocdevprivate(struct net_device *dev, struct ifreq *ifr,1488		       void __user *addr, int cmd)1489{1490	struct ppp *ppp = netdev_priv(dev);1491	int err = -EFAULT;1492	struct ppp_stats stats;1493	struct ppp_comp_stats cstats;1494	char *vers;1495 1496	switch (cmd) {1497	case SIOCGPPPSTATS:1498		ppp_get_stats(ppp, &stats);1499		if (copy_to_user(addr, &stats, sizeof(stats)))1500			break;1501		err = 0;1502		break;1503 1504	case SIOCGPPPCSTATS:1505		memset(&cstats, 0, sizeof(cstats));1506		if (ppp->xc_state)1507			ppp->xcomp->comp_stat(ppp->xc_state, &cstats.c);1508		if (ppp->rc_state)1509			ppp->rcomp->decomp_stat(ppp->rc_state, &cstats.d);1510		if (copy_to_user(addr, &cstats, sizeof(cstats)))1511			break;1512		err = 0;1513		break;1514 1515	case SIOCGPPPVER:1516		vers = PPP_VERSION;1517		if (copy_to_user(addr, vers, strlen(vers) + 1))1518			break;1519		err = 0;1520		break;1521 1522	default:1523		err = -EINVAL;1524	}1525 1526	return err;1527}1528 1529static void1530ppp_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats64)1531{1532	struct ppp *ppp = netdev_priv(dev);1533 1534	ppp_recv_lock(ppp);1535	stats64->rx_packets = ppp->stats64.rx_packets;1536	stats64->rx_bytes   = ppp->stats64.rx_bytes;1537	ppp_recv_unlock(ppp);1538 1539	ppp_xmit_lock(ppp);1540	stats64->tx_packets = ppp->stats64.tx_packets;1541	stats64->tx_bytes   = ppp->stats64.tx_bytes;1542	ppp_xmit_unlock(ppp);1543 1544	stats64->rx_errors        = dev->stats.rx_errors;1545	stats64->tx_errors        = dev->stats.tx_errors;1546	stats64->rx_dropped       = dev->stats.rx_dropped;1547	stats64->tx_dropped       = dev->stats.tx_dropped;1548	stats64->rx_length_errors = dev->stats.rx_length_errors;1549}1550 1551static int ppp_dev_init(struct net_device *dev)1552{1553	struct ppp *ppp;1554 1555	netdev_lockdep_set_classes(dev);1556 1557	ppp = netdev_priv(dev);1558	/* Let the netdevice take a reference on the ppp file. This ensures1559	 * that ppp_destroy_interface() won't run before the device gets1560	 * unregistered.1561	 */1562	refcount_inc(&ppp->file.refcnt);1563 1564	return 0;1565}1566 1567static void ppp_dev_uninit(struct net_device *dev)1568{1569	struct ppp *ppp = netdev_priv(dev);1570	struct ppp_net *pn = ppp_pernet(ppp->ppp_net);1571 1572	ppp_lock(ppp);1573	ppp->closing = 1;1574	ppp_unlock(ppp);1575 1576	mutex_lock(&pn->all_ppp_mutex);1577	unit_put(&pn->units_idr, ppp->file.index);1578	mutex_unlock(&pn->all_ppp_mutex);1579 1580	ppp->owner = NULL;1581 1582	ppp->file.dead = 1;1583	wake_up_interruptible(&ppp->file.rwait);1584}1585 1586static void ppp_dev_priv_destructor(struct net_device *dev)1587{1588	struct ppp *ppp;1589 1590	ppp = netdev_priv(dev);1591	if (refcount_dec_and_test(&ppp->file.refcnt))1592		ppp_destroy_interface(ppp);1593}1594 1595static int ppp_fill_forward_path(struct net_device_path_ctx *ctx,1596				 struct net_device_path *path)1597{1598	struct ppp *ppp = netdev_priv(ctx->dev);1599	struct ppp_channel *chan;1600	struct channel *pch;1601 1602	if (ppp->flags & SC_MULTILINK)1603		return -EOPNOTSUPP;1604 1605	if (list_empty(&ppp->channels))1606		return -ENODEV;1607 1608	pch = list_first_entry(&ppp->channels, struct channel, clist);1609	chan = pch->chan;1610	if (!chan->ops->fill_forward_path)1611		return -EOPNOTSUPP;1612 1613	return chan->ops->fill_forward_path(ctx, path, chan);1614}1615 1616static const struct net_device_ops ppp_netdev_ops = {1617	.ndo_init	 = ppp_dev_init,1618	.ndo_uninit      = ppp_dev_uninit,1619	.ndo_start_xmit  = ppp_start_xmit,1620	.ndo_siocdevprivate = ppp_net_siocdevprivate,1621	.ndo_get_stats64 = ppp_get_stats64,1622	.ndo_fill_forward_path = ppp_fill_forward_path,1623};1624 1625static const struct device_type ppp_type = {1626	.name = "ppp",1627};1628 1629static void ppp_setup(struct net_device *dev)1630{1631	dev->netdev_ops = &ppp_netdev_ops;1632	SET_NETDEV_DEVTYPE(dev, &ppp_type);1633 1634	dev->lltx = true;1635 1636	dev->hard_header_len = PPP_HDRLEN;1637	dev->mtu = PPP_MRU;1638	dev->addr_len = 0;1639	dev->tx_queue_len = 3;1640	dev->type = ARPHRD_PPP;1641	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;1642	dev->priv_destructor = ppp_dev_priv_destructor;1643	netif_keep_dst(dev);1644}1645 1646/*1647 * Transmit-side routines.1648 */1649 1650/* Called to do any work queued up on the transmit side that can now be done */1651static void __ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)1652{1653	ppp_xmit_lock(ppp);1654	if (!ppp->closing) {1655		ppp_push(ppp);1656 1657		if (skb)1658			skb_queue_tail(&ppp->file.xq, skb);1659		while (!ppp->xmit_pending &&1660		       (skb = skb_dequeue(&ppp->file.xq)))1661			ppp_send_frame(ppp, skb);1662		/* If there's no work left to do, tell the core net1663		   code that we can accept some more. */1664		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))1665			netif_wake_queue(ppp->dev);1666		else1667			netif_stop_queue(ppp->dev);1668	} else {1669		kfree_skb(skb);1670	}1671	ppp_xmit_unlock(ppp);1672}1673 1674static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)1675{1676	local_bh_disable();1677 1678	if (unlikely(*this_cpu_ptr(ppp->xmit_recursion)))1679		goto err;1680 1681	(*this_cpu_ptr(ppp->xmit_recursion))++;1682	__ppp_xmit_process(ppp, skb);1683	(*this_cpu_ptr(ppp->xmit_recursion))--;1684 1685	local_bh_enable();1686 1687	return;1688 1689err:1690	local_bh_enable();1691 1692	kfree_skb(skb);1693 1694	if (net_ratelimit())1695		netdev_err(ppp->dev, "recursion detected\n");1696}1697 1698static inline struct sk_buff *1699pad_compress_skb(struct ppp *ppp, struct sk_buff *skb)1700{1701	struct sk_buff *new_skb;1702	int len;1703	int new_skb_size = ppp->dev->mtu +1704		ppp->xcomp->comp_extra + ppp->dev->hard_header_len;1705	int compressor_skb_size = ppp->dev->mtu +1706		ppp->xcomp->comp_extra + PPP_HDRLEN;1707	new_skb = alloc_skb(new_skb_size, GFP_ATOMIC);1708	if (!new_skb) {1709		if (net_ratelimit())1710			netdev_err(ppp->dev, "PPP: no memory (comp pkt)\n");1711		return NULL;1712	}1713	if (ppp->dev->hard_header_len > PPP_HDRLEN)1714		skb_reserve(new_skb,1715			    ppp->dev->hard_header_len - PPP_HDRLEN);1716 1717	/* compressor still expects A/C bytes in hdr */1718	len = ppp->xcomp->compress(ppp->xc_state, skb->data - 2,1719				   new_skb->data, skb->len + 2,1720				   compressor_skb_size);1721	if (len > 0 && (ppp->flags & SC_CCP_UP)) {1722		consume_skb(skb);1723		skb = new_skb;1724		skb_put(skb, len);1725		skb_pull(skb, 2);	/* pull off A/C bytes */1726	} else if (len == 0) {1727		/* didn't compress, or CCP not up yet */1728		consume_skb(new_skb);1729		new_skb = skb;1730	} else {1731		/*1732		 * (len < 0)1733		 * MPPE requires that we do not send unencrypted1734		 * frames.  The compressor will return -1 if we1735		 * should drop the frame.  We cannot simply test1736		 * the compress_proto because MPPE and MPPC share1737		 * the same number.1738		 */1739		if (net_ratelimit())1740			netdev_err(ppp->dev, "ppp: compressor dropped pkt\n");1741		kfree_skb(skb);1742		consume_skb(new_skb);1743		new_skb = NULL;1744	}1745	return new_skb;1746}1747 1748/*1749 * Compress and send a frame.1750 * The caller should have locked the xmit path,1751 * and xmit_pending should be 0.1752 */1753static void1754ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)1755{1756	int proto = PPP_PROTO(skb);1757	struct sk_buff *new_skb;1758	int len;1759	unsigned char *cp;1760 1761	skb->dev = ppp->dev;1762 1763	if (proto < 0x8000) {1764#ifdef CONFIG_PPP_FILTER1765		/* check if we should pass this packet */1766		/* the filter instructions are constructed assuming1767		   a four-byte PPP header on each packet */1768		*(u8 *)skb_push(skb, 2) = 1;1769		if (ppp->pass_filter &&1770		    bpf_prog_run(ppp->pass_filter, skb) == 0) {1771			if (ppp->debug & 1)1772				netdev_printk(KERN_DEBUG, ppp->dev,1773					      "PPP: outbound frame "1774					      "not passed\n");1775			kfree_skb(skb);1776			return;1777		}1778		/* if this packet passes the active filter, record the time */1779		if (!(ppp->active_filter &&1780		      bpf_prog_run(ppp->active_filter, skb) == 0))1781			ppp->last_xmit = jiffies;1782		skb_pull(skb, 2);1783#else1784		/* for data packets, record the time */1785		ppp->last_xmit = jiffies;1786#endif /* CONFIG_PPP_FILTER */1787	}1788 1789	++ppp->stats64.tx_packets;1790	ppp->stats64.tx_bytes += skb->len - PPP_PROTO_LEN;1791 1792	switch (proto) {1793	case PPP_IP:1794		if (!ppp->vj || (ppp->flags & SC_COMP_TCP) == 0)1795			break;1796		/* try to do VJ TCP header compression */1797		new_skb = alloc_skb(skb->len + ppp->dev->hard_header_len - 2,1798				    GFP_ATOMIC);1799		if (!new_skb) {1800			netdev_err(ppp->dev, "PPP: no memory (VJ comp pkt)\n");1801			goto drop;1802		}1803		skb_reserve(new_skb, ppp->dev->hard_header_len - 2);1804		cp = skb->data + 2;1805		len = slhc_compress(ppp->vj, cp, skb->len - 2,1806				    new_skb->data + 2, &cp,1807				    !(ppp->flags & SC_NO_TCP_CCID));1808		if (cp == skb->data + 2) {1809			/* didn't compress */1810			consume_skb(new_skb);1811		} else {1812			if (cp[0] & SL_TYPE_COMPRESSED_TCP) {1813				proto = PPP_VJC_COMP;1814				cp[0] &= ~SL_TYPE_COMPRESSED_TCP;1815			} else {1816				proto = PPP_VJC_UNCOMP;1817				cp[0] = skb->data[2];1818			}1819			consume_skb(skb);1820			skb = new_skb;1821			cp = skb_put(skb, len + 2);1822			cp[0] = 0;1823			cp[1] = proto;1824		}1825		break;1826 1827	case PPP_CCP:1828		/* peek at outbound CCP frames */1829		ppp_ccp_peek(ppp, skb, 0);1830		break;1831	}1832 1833	/* try to do packet compression */1834	if ((ppp->xstate & SC_COMP_RUN) && ppp->xc_state &&1835	    proto != PPP_LCP && proto != PPP_CCP) {1836		if (!(ppp->flags & SC_CCP_UP) && (ppp->flags & SC_MUST_COMP)) {1837			if (net_ratelimit())1838				netdev_err(ppp->dev,1839					   "ppp: compression required but "1840					   "down - pkt dropped.\n");1841			goto drop;1842		}1843		skb = pad_compress_skb(ppp, skb);1844		if (!skb)1845			goto drop;1846	}1847 1848	/*1849	 * If we are waiting for traffic (demand dialling),1850	 * queue it up for pppd to receive.1851	 */1852	if (ppp->flags & SC_LOOP_TRAFFIC) {1853		if (ppp->file.rq.qlen > PPP_MAX_RQLEN)1854			goto drop;1855		skb_queue_tail(&ppp->file.rq, skb);1856		wake_up_interruptible(&ppp->file.rwait);1857		return;1858	}1859 1860	ppp->xmit_pending = skb;1861	ppp_push(ppp);1862	return;1863 1864 drop:1865	kfree_skb(skb);1866	++ppp->dev->stats.tx_errors;1867}1868 1869/*1870 * Try to send the frame in xmit_pending.1871 * The caller should have the xmit path locked.1872 */1873static void1874ppp_push(struct ppp *ppp)1875{1876	struct list_head *list;1877	struct channel *pch;1878	struct sk_buff *skb = ppp->xmit_pending;1879 1880	if (!skb)1881		return;1882 1883	list = &ppp->channels;1884	if (list_empty(list)) {1885		/* nowhere to send the packet, just drop it */1886		ppp->xmit_pending = NULL;1887		kfree_skb(skb);1888		return;1889	}1890 1891	if ((ppp->flags & SC_MULTILINK) == 0) {1892		/* not doing multilink: send it down the first channel */1893		list = list->next;1894		pch = list_entry(list, struct channel, clist);1895 1896		spin_lock(&pch->downl);1897		if (pch->chan) {1898			if (pch->chan->ops->start_xmit(pch->chan, skb))1899				ppp->xmit_pending = NULL;1900		} else {1901			/* channel got unregistered */1902			kfree_skb(skb);1903			ppp->xmit_pending = NULL;1904		}1905		spin_unlock(&pch->downl);1906		return;1907	}1908 1909#ifdef CONFIG_PPP_MULTILINK1910	/* Multilink: fragment the packet over as many links1911	   as can take the packet at the moment. */1912	if (!ppp_mp_explode(ppp, skb))1913		return;1914#endif /* CONFIG_PPP_MULTILINK */1915 1916	ppp->xmit_pending = NULL;1917	kfree_skb(skb);1918}1919 1920#ifdef CONFIG_PPP_MULTILINK1921static bool mp_protocol_compress __read_mostly = true;1922module_param(mp_protocol_compress, bool, 0644);1923MODULE_PARM_DESC(mp_protocol_compress,1924		 "compress protocol id in multilink fragments");1925 1926/*1927 * Divide a packet to be transmitted into fragments and1928 * send them out the individual links.1929 */1930static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)1931{1932	int len, totlen;1933	int i, bits, hdrlen, mtu;1934	int flen;1935	int navail, nfree, nzero;1936	int nbigger;1937	int totspeed;1938	int totfree;1939	unsigned char *p, *q;1940	struct list_head *list;1941	struct channel *pch;1942	struct sk_buff *frag;1943	struct ppp_channel *chan;1944 1945	totspeed = 0; /*total bitrate of the bundle*/1946	nfree = 0; /* # channels which have no packet already queued */1947	navail = 0; /* total # of usable channels (not deregistered) */1948	nzero = 0; /* number of channels with zero speed associated*/1949	totfree = 0; /*total # of channels available and1950				  *having no queued packets before1951				  *starting the fragmentation*/1952 1953	hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;1954	i = 0;1955	list_for_each_entry(pch, &ppp->channels, clist) {1956		if (pch->chan) {1957			pch->avail = 1;1958			navail++;1959			pch->speed = pch->chan->speed;1960		} else {1961			pch->avail = 0;1962		}1963		if (pch->avail) {1964			if (skb_queue_empty(&pch->file.xq) ||1965				!pch->had_frag) {1966					if (pch->speed == 0)1967						nzero++;1968					else1969						totspeed += pch->speed;1970 1971					pch->avail = 2;1972					++nfree;1973					++totfree;1974				}1975			if (!pch->had_frag && i < ppp->nxchan)1976				ppp->nxchan = i;1977		}1978		++i;1979	}1980	/*1981	 * Don't start sending this packet unless at least half of1982	 * the channels are free.  This gives much better TCP1983	 * performance if we have a lot of channels.1984	 */1985	if (nfree == 0 || nfree < navail / 2)1986		return 0; /* can't take now, leave it in xmit_pending */1987 1988	/* Do protocol field compression */1989	p = skb->data;1990	len = skb->len;1991	if (*p == 0 && mp_protocol_compress) {1992		++p;1993		--len;1994	}1995 1996	totlen = len;1997	nbigger = len % nfree;1998 1999	/* skip to the channel after the one we last used2000	   and start at that one */2001	list = &ppp->channels;2002	for (i = 0; i < ppp->nxchan; ++i) {2003		list = list->next;2004		if (list == &ppp->channels) {2005			i = 0;2006			break;2007		}2008	}2009 2010	/* create a fragment for each channel */2011	bits = B;2012	while (len > 0) {2013		list = list->next;2014		if (list == &ppp->channels) {2015			i = 0;2016			continue;2017		}2018		pch = list_entry(list, struct channel, clist);2019		++i;2020		if (!pch->avail)2021			continue;2022 2023		/*2024		 * Skip this channel if it has a fragment pending already and2025		 * we haven't given a fragment to all of the free channels.2026		 */2027		if (pch->avail == 1) {2028			if (nfree > 0)2029				continue;2030		} else {2031			pch->avail = 1;2032		}2033 2034		/* check the channel's mtu and whether it is still attached. */2035		spin_lock(&pch->downl);2036		if (pch->chan == NULL) {2037			/* can't use this channel, it's being deregistered */2038			if (pch->speed == 0)2039				nzero--;2040			else2041				totspeed -= pch->speed;2042 2043			spin_unlock(&pch->downl);2044			pch->avail = 0;2045			totlen = len;2046			totfree--;2047			nfree--;2048			if (--navail == 0)2049				break;2050			continue;2051		}2052 2053		/*2054		*if the channel speed is not set divide2055		*the packet evenly among the free channels;2056		*otherwise divide it according to the speed2057		*of the channel we are going to transmit on2058		*/2059		flen = len;2060		if (nfree > 0) {2061			if (pch->speed == 0) {2062				flen = len/nfree;2063				if (nbigger > 0) {2064					flen++;2065					nbigger--;2066				}2067			} else {2068				flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /2069					((totspeed*totfree)/pch->speed)) - hdrlen;2070				if (nbigger > 0) {2071					flen += ((totfree - nzero)*pch->speed)/totspeed;2072					nbigger -= ((totfree - nzero)*pch->speed)/2073							totspeed;2074				}2075			}2076			nfree--;2077		}2078 2079		/*2080		 *check if we are on the last channel or2081		 *we exceded the length of the data to2082		 *fragment2083		 */2084		if ((nfree <= 0) || (flen > len))2085			flen = len;2086		/*2087		 *it is not worth to tx on slow channels:2088		 *in that case from the resulting flen according to the2089		 *above formula will be equal or less than zero.2090		 *Skip the channel in this case2091		 */2092		if (flen <= 0) {2093			pch->avail = 2;2094			spin_unlock(&pch->downl);2095			continue;2096		}2097 2098		/*2099		 * hdrlen includes the 2-byte PPP protocol field, but the2100		 * MTU counts only the payload excluding the protocol field.2101		 * (RFC1661 Section 2)2102		 */2103		mtu = pch->chan->mtu - (hdrlen - 2);2104		if (mtu < 4)2105			mtu = 4;2106		if (flen > mtu)2107			flen = mtu;2108		if (flen == len)2109			bits |= E;2110		frag = alloc_skb(flen + hdrlen + (flen == 0), GFP_ATOMIC);2111		if (!frag)2112			goto noskb;2113		q = skb_put(frag, flen + hdrlen);2114 2115		/* make the MP header */2116		put_unaligned_be16(PPP_MP, q);2117		if (ppp->flags & SC_MP_XSHORTSEQ) {2118			q[2] = bits + ((ppp->nxseq >> 8) & 0xf);2119			q[3] = ppp->nxseq;2120		} else {2121			q[2] = bits;2122			q[3] = ppp->nxseq >> 16;2123			q[4] = ppp->nxseq >> 8;2124			q[5] = ppp->nxseq;2125		}2126 2127		memcpy(q + hdrlen, p, flen);2128 2129		/* try to send it down the channel */2130		chan = pch->chan;2131		if (!skb_queue_empty(&pch->file.xq) ||2132			!chan->ops->start_xmit(chan, frag))2133			skb_queue_tail(&pch->file.xq, frag);2134		pch->had_frag = 1;2135		p += flen;2136		len -= flen;2137		++ppp->nxseq;2138		bits = 0;2139		spin_unlock(&pch->downl);2140	}2141	ppp->nxchan = i;2142 2143	return 1;2144 2145 noskb:2146	spin_unlock(&pch->downl);2147	if (ppp->debug & 1)2148		netdev_err(ppp->dev, "PPP: no memory (fragment)\n");2149	++ppp->dev->stats.tx_errors;2150	++ppp->nxseq;2151	return 1;	/* abandon the frame */2152}2153#endif /* CONFIG_PPP_MULTILINK */2154 2155/* Try to send data out on a channel */2156static void __ppp_channel_push(struct channel *pch)2157{2158	struct sk_buff *skb;2159	struct ppp *ppp;2160 2161	spin_lock(&pch->downl);2162	if (pch->chan) {2163		while (!skb_queue_empty(&pch->file.xq)) {2164			skb = skb_dequeue(&pch->file.xq);2165			if (!pch->chan->ops->start_xmit(pch->chan, skb)) {2166				/* put the packet back and try again later */2167				skb_queue_head(&pch->file.xq, skb);2168				break;2169			}2170		}2171	} else {2172		/* channel got deregistered */2173		skb_queue_purge(&pch->file.xq);2174	}2175	spin_unlock(&pch->downl);2176	/* see if there is anything from the attached unit to be sent */2177	if (skb_queue_empty(&pch->file.xq)) {2178		ppp = pch->ppp;2179		if (ppp)2180			__ppp_xmit_process(ppp, NULL);2181	}2182}2183 2184static void ppp_channel_push(struct channel *pch)2185{2186	read_lock_bh(&pch->upl);2187	if (pch->ppp) {2188		(*this_cpu_ptr(pch->ppp->xmit_recursion))++;2189		__ppp_channel_push(pch);2190		(*this_cpu_ptr(pch->ppp->xmit_recursion))--;2191	} else {2192		__ppp_channel_push(pch);2193	}2194	read_unlock_bh(&pch->upl);2195}2196 2197/*2198 * Receive-side routines.2199 */2200 2201struct ppp_mp_skb_parm {2202	u32		sequence;2203	u8		BEbits;2204};2205#define PPP_MP_CB(skb)	((struct ppp_mp_skb_parm *)((skb)->cb))2206 2207static inline void2208ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)2209{2210	ppp_recv_lock(ppp);2211	if (!ppp->closing)2212		ppp_receive_frame(ppp, skb, pch);2213	else2214		kfree_skb(skb);2215	ppp_recv_unlock(ppp);2216}2217 2218/**2219 * __ppp_decompress_proto - Decompress protocol field, slim version.2220 * @skb: Socket buffer where protocol field should be decompressed. It must have2221 *	 at least 1 byte of head room and 1 byte of linear data. First byte of2222 *	 data must be a protocol field byte.2223 *2224 * Decompress protocol field in PPP header if it's compressed, e.g. when2225 * Protocol-Field-Compression (PFC) was negotiated. No checks w.r.t. skb data2226 * length are done in this function.2227 */2228static void __ppp_decompress_proto(struct sk_buff *skb)2229{2230	if (skb->data[0] & 0x01)2231		*(u8 *)skb_push(skb, 1) = 0x00;2232}2233 2234/**2235 * ppp_decompress_proto - Check skb data room and decompress protocol field.2236 * @skb: Socket buffer where protocol field should be decompressed. First byte2237 *	 of data must be a protocol field byte.2238 *2239 * Decompress protocol field in PPP header if it's compressed, e.g. when2240 * Protocol-Field-Compression (PFC) was negotiated. This function also makes2241 * sure that skb data room is sufficient for Protocol field, before and after2242 * decompression.2243 *2244 * Return: true - decompressed successfully, false - not enough room in skb.2245 */2246static bool ppp_decompress_proto(struct sk_buff *skb)2247{2248	/* At least one byte should be present (if protocol is compressed) */2249	if (!pskb_may_pull(skb, 1))2250		return false;2251 2252	__ppp_decompress_proto(skb);2253 2254	/* Protocol field should occupy 2 bytes when not compressed */2255	return pskb_may_pull(skb, 2);2256}2257 2258/* Attempt to handle a frame via. a bridged channel, if one exists.2259 * If the channel is bridged, the frame is consumed by the bridge.2260 * If not, the caller must handle the frame by normal recv mechanisms.2261 * Returns true if the frame is consumed, false otherwise.2262 */2263static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)2264{2265	struct channel *pchb;2266 2267	rcu_read_lock();2268	pchb = rcu_dereference(pch->bridge);2269	if (!pchb)2270		goto out_rcu;2271 2272	spin_lock_bh(&pchb->downl);2273	if (!pchb->chan) {2274		/* channel got unregistered */2275		kfree_skb(skb);2276		goto outl;2277	}2278 2279	skb_scrub_packet(skb, !net_eq(pch->chan_net, pchb->chan_net));2280	if (!pchb->chan->ops->start_xmit(pchb->chan, skb))2281		kfree_skb(skb);2282 2283outl:2284	spin_unlock_bh(&pchb->downl);2285out_rcu:2286	rcu_read_unlock();2287 2288	/* If pchb is set then we've consumed the packet */2289	return !!pchb;2290}2291 2292void2293ppp_input(struct ppp_channel *chan, struct sk_buff *skb)2294{2295	struct channel *pch = chan->ppp;2296	int proto;2297 2298	if (!pch) {2299		kfree_skb(skb);2300		return;2301	}2302 2303	/* If the channel is bridged, transmit via. bridge */2304	if (ppp_channel_bridge_input(pch, skb))2305		return;2306 2307	read_lock_bh(&pch->upl);2308	if (!ppp_decompress_proto(skb)) {2309		kfree_skb(skb);2310		if (pch->ppp) {2311			++pch->ppp->dev->stats.rx_length_errors;2312			ppp_receive_error(pch->ppp);2313		}2314		goto done;2315	}2316 2317	proto = PPP_PROTO(skb);2318	if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {2319		/* put it on the channel queue */2320		skb_queue_tail(&pch->file.rq, skb);2321		/* drop old frames if queue too long */2322		while (pch->file.rq.qlen > PPP_MAX_RQLEN &&2323		       (skb = skb_dequeue(&pch->file.rq)))2324			kfree_skb(skb);2325		wake_up_interruptible(&pch->file.rwait);2326	} else {2327		ppp_do_recv(pch->ppp, skb, pch);2328	}2329 2330done:2331	read_unlock_bh(&pch->upl);2332}2333 2334/* Put a 0-length skb in the receive queue as an error indication */2335void2336ppp_input_error(struct ppp_channel *chan, int code)2337{2338	struct channel *pch = chan->ppp;2339	struct sk_buff *skb;2340 2341	if (!pch)2342		return;2343 2344	read_lock_bh(&pch->upl);2345	if (pch->ppp) {2346		skb = alloc_skb(0, GFP_ATOMIC);2347		if (skb) {2348			skb->len = 0;		/* probably unnecessary */2349			skb->cb[0] = code;2350			ppp_do_recv(pch->ppp, skb, pch);2351		}2352	}2353	read_unlock_bh(&pch->upl);2354}2355 2356/*2357 * We come in here to process a received frame.2358 * The receive side of the ppp unit is locked.2359 */2360static void2361ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)2362{2363	/* note: a 0-length skb is used as an error indication */2364	if (skb->len > 0) {2365		skb_checksum_complete_unset(skb);2366#ifdef CONFIG_PPP_MULTILINK2367		/* XXX do channel-level decompression here */2368		if (PPP_PROTO(skb) == PPP_MP)2369			ppp_receive_mp_frame(ppp, skb, pch);2370		else2371#endif /* CONFIG_PPP_MULTILINK */2372			ppp_receive_nonmp_frame(ppp, skb);2373	} else {2374		kfree_skb(skb);2375		ppp_receive_error(ppp);2376	}2377}2378 2379static void2380ppp_receive_error(struct ppp *ppp)2381{2382	++ppp->dev->stats.rx_errors;2383	if (ppp->vj)2384		slhc_toss(ppp->vj);2385}2386 2387static void2388ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)2389{2390	struct sk_buff *ns;2391	int proto, len, npi;2392 2393	/*2394	 * Decompress the frame, if compressed.2395	 * Note that some decompressors need to see uncompressed frames2396	 * that come in as well as compressed frames.2397	 */2398	if (ppp->rc_state && (ppp->rstate & SC_DECOMP_RUN) &&2399	    (ppp->rstate & (SC_DC_FERROR | SC_DC_ERROR)) == 0)2400		skb = ppp_decompress_frame(ppp, skb);2401 2402	if (ppp->flags & SC_MUST_COMP && ppp->rstate & SC_DC_FERROR)2403		goto err;2404 2405	/* At this point the "Protocol" field MUST be decompressed, either in2406	 * ppp_input(), ppp_decompress_frame() or in ppp_receive_mp_frame().2407	 */2408	proto = PPP_PROTO(skb);2409	switch (proto) {2410	case PPP_VJC_COMP:2411		/* decompress VJ compressed packets */2412		if (!ppp->vj || (ppp->flags & SC_REJ_COMP_TCP))2413			goto err;2414 2415		if (skb_tailroom(skb) < 124 || skb_cloned(skb)) {2416			/* copy to a new sk_buff with more tailroom */2417			ns = dev_alloc_skb(skb->len + 128);2418			if (!ns) {2419				netdev_err(ppp->dev, "PPP: no memory "2420					   "(VJ decomp)\n");2421				goto err;2422			}2423			skb_reserve(ns, 2);2424			skb_copy_bits(skb, 0, skb_put(ns, skb->len), skb->len);2425			consume_skb(skb);2426			skb = ns;2427		}2428		else2429			skb->ip_summed = CHECKSUM_NONE;2430 2431		len = slhc_uncompress(ppp->vj, skb->data + 2, skb->len - 2);2432		if (len <= 0) {2433			netdev_printk(KERN_DEBUG, ppp->dev,2434				      "PPP: VJ decompression error\n");2435			goto err;2436		}2437		len += 2;2438		if (len > skb->len)2439			skb_put(skb, len - skb->len);2440		else if (len < skb->len)2441			skb_trim(skb, len);2442		proto = PPP_IP;2443		break;2444 2445	case PPP_VJC_UNCOMP:2446		if (!ppp->vj || (ppp->flags & SC_REJ_COMP_TCP))2447			goto err;2448 2449		/* Until we fix the decompressor need to make sure2450		 * data portion is linear.2451		 */2452		if (!pskb_may_pull(skb, skb->len))2453			goto err;2454 2455		if (slhc_remember(ppp->vj, skb->data + 2, skb->len - 2) <= 0) {2456			netdev_err(ppp->dev, "PPP: VJ uncompressed error\n");2457			goto err;2458		}2459		proto = PPP_IP;2460		break;2461 2462	case PPP_CCP:2463		ppp_ccp_peek(ppp, skb, 1);2464		break;2465	}2466 2467	++ppp->stats64.rx_packets;2468	ppp->stats64.rx_bytes += skb->len - 2;2469 2470	npi = proto_to_npindex(proto);2471	if (npi < 0) {2472		/* control or unknown frame - pass it to pppd */2473		skb_queue_tail(&ppp->file.rq, skb);2474		/* limit queue length by dropping old frames */2475		while (ppp->file.rq.qlen > PPP_MAX_RQLEN &&2476		       (skb = skb_dequeue(&ppp->file.rq)))2477			kfree_skb(skb);2478		/* wake up any process polling or blocking on read */2479		wake_up_interruptible(&ppp->file.rwait);2480 2481	} else {2482		/* network protocol frame - give it to the kernel */2483 2484#ifdef CONFIG_PPP_FILTER2485		/* check if the packet passes the pass and active filters */2486		/* the filter instructions are constructed assuming2487		   a four-byte PPP header on each packet */2488		if (ppp->pass_filter || ppp->active_filter) {2489			if (skb_unclone(skb, GFP_ATOMIC))2490				goto err;2491 2492			*(u8 *)skb_push(skb, 2) = 0;2493			if (ppp->pass_filter &&2494			    bpf_prog_run(ppp->pass_filter, skb) == 0) {2495				if (ppp->debug & 1)2496					netdev_printk(KERN_DEBUG, ppp->dev,2497						      "PPP: inbound frame "2498						      "not passed\n");2499				kfree_skb(skb);2500				return;2501			}2502			if (!(ppp->active_filter &&2503			      bpf_prog_run(ppp->active_filter, skb) == 0))2504				ppp->last_recv = jiffies;2505			__skb_pull(skb, 2);2506		} else2507#endif /* CONFIG_PPP_FILTER */2508			ppp->last_recv = jiffies;2509 2510		if ((ppp->dev->flags & IFF_UP) == 0 ||2511		    ppp->npmode[npi] != NPMODE_PASS) {2512			kfree_skb(skb);2513		} else {2514			/* chop off protocol */2515			skb_pull_rcsum(skb, 2);2516			skb->dev = ppp->dev;2517			skb->protocol = htons(npindex_to_ethertype[npi]);2518			skb_reset_mac_header(skb);2519			skb_scrub_packet(skb, !net_eq(ppp->ppp_net,2520						      dev_net(ppp->dev)));2521			netif_rx(skb);2522		}2523	}2524	return;2525 2526 err:2527	kfree_skb(skb);2528	ppp_receive_error(ppp);2529}2530 2531static struct sk_buff *2532ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)2533{2534	int proto = PPP_PROTO(skb);2535	struct sk_buff *ns;2536	int len;2537 2538	/* Until we fix all the decompressor's need to make sure2539	 * data portion is linear.2540	 */2541	if (!pskb_may_pull(skb, skb->len))2542		goto err;2543 2544	if (proto == PPP_COMP) {2545		int obuff_size;2546 2547		switch(ppp->rcomp->compress_proto) {2548		case CI_MPPE:2549			obuff_size = ppp->mru + PPP_HDRLEN + 1;2550			break;2551		default:2552			obuff_size = ppp->mru + PPP_HDRLEN;2553			break;2554		}2555 2556		ns = dev_alloc_skb(obuff_size);2557		if (!ns) {2558			netdev_err(ppp->dev, "ppp_decompress_frame: "2559				   "no memory\n");2560			goto err;2561		}2562		/* the decompressor still expects the A/C bytes in the hdr */2563		len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2,2564				skb->len + 2, ns->data, obuff_size);2565		if (len < 0) {2566			/* Pass the compressed frame to pppd as an2567			   error indication. */2568			if (len == DECOMP_FATALERROR)2569				ppp->rstate |= SC_DC_FERROR;2570			kfree_skb(ns);2571			goto err;2572		}2573 2574		consume_skb(skb);2575		skb = ns;2576		skb_put(skb, len);2577		skb_pull(skb, 2);	/* pull off the A/C bytes */2578 2579		/* Don't call __ppp_decompress_proto() here, but instead rely on2580		 * corresponding algo (mppe/bsd/deflate) to decompress it.2581		 */2582	} else {2583		/* Uncompressed frame - pass to decompressor so it2584		   can update its dictionary if necessary. */2585		if (ppp->rcomp->incomp)2586			ppp->rcomp->incomp(ppp->rc_state, skb->data - 2,2587					   skb->len + 2);2588	}2589 2590	return skb;2591 2592 err:2593	ppp->rstate |= SC_DC_ERROR;2594	ppp_receive_error(ppp);2595	return skb;2596}2597 2598#ifdef CONFIG_PPP_MULTILINK2599/*2600 * Receive a multilink frame.2601 * We put it on the reconstruction queue and then pull off2602 * as many completed frames as we can.2603 */2604static void2605ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)2606{2607	u32 mask, seq;2608	struct channel *ch;2609	int mphdrlen = (ppp->flags & SC_MP_SHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;2610 2611	if (!pskb_may_pull(skb, mphdrlen + 1) || ppp->mrru == 0)2612		goto err;		/* no good, throw it away */2613 2614	/* Decode sequence number and begin/end bits */2615	if (ppp->flags & SC_MP_SHORTSEQ) {2616		seq = ((skb->data[2] & 0x0f) << 8) | skb->data[3];2617		mask = 0xfff;2618	} else {2619		seq = (skb->data[3] << 16) | (skb->data[4] << 8)| skb->data[5];2620		mask = 0xffffff;2621	}2622	PPP_MP_CB(skb)->BEbits = skb->data[2];2623	skb_pull(skb, mphdrlen);	/* pull off PPP and MP headers */2624 2625	/*2626	 * Do protocol ID decompression on the first fragment of each packet.2627	 * We have to do that here, because ppp_receive_nonmp_frame() expects2628	 * decompressed protocol field.2629	 */2630	if (PPP_MP_CB(skb)->BEbits & B)2631		__ppp_decompress_proto(skb);2632 2633	/*2634	 * Expand sequence number to 32 bits, making it as close2635	 * as possible to ppp->minseq.2636	 */2637	seq |= ppp->minseq & ~mask;2638	if ((int)(ppp->minseq - seq) > (int)(mask >> 1))2639		seq += mask + 1;2640	else if ((int)(seq - ppp->minseq) > (int)(mask >> 1))2641		seq -= mask + 1;	/* should never happen */2642	PPP_MP_CB(skb)->sequence = seq;2643	pch->lastseq = seq;2644 2645	/*2646	 * If this packet comes before the next one we were expecting,2647	 * drop it.2648	 */2649	if (seq_before(seq, ppp->nextseq)) {2650		kfree_skb(skb);2651		++ppp->dev->stats.rx_dropped;2652		ppp_receive_error(ppp);2653		return;2654	}2655 2656	/*2657	 * Reevaluate minseq, the minimum over all channels of the2658	 * last sequence number received on each channel.  Because of2659	 * the increasing sequence number rule, we know that any fragment2660	 * before `minseq' which hasn't arrived is never going to arrive.2661	 * The list of channels can't change because we have the receive2662	 * side of the ppp unit locked.2663	 */2664	list_for_each_entry(ch, &ppp->channels, clist) {2665		if (seq_before(ch->lastseq, seq))2666			seq = ch->lastseq;2667	}2668	if (seq_before(ppp->minseq, seq))2669		ppp->minseq = seq;2670 2671	/* Put the fragment on the reconstruction queue */2672	ppp_mp_insert(ppp, skb);2673 2674	/* If the queue is getting long, don't wait any longer for packets2675	   before the start of the queue. */2676	if (skb_queue_len(&ppp->mrq) >= PPP_MP_MAX_QLEN) {2677		struct sk_buff *mskb = skb_peek(&ppp->mrq);2678		if (seq_before(ppp->minseq, PPP_MP_CB(mskb)->sequence))2679			ppp->minseq = PPP_MP_CB(mskb)->sequence;2680	}2681 2682	/* Pull completed packets off the queue and receive them. */2683	while ((skb = ppp_mp_reconstruct(ppp))) {2684		if (pskb_may_pull(skb, 2))2685			ppp_receive_nonmp_frame(ppp, skb);2686		else {2687			++ppp->dev->stats.rx_length_errors;2688			kfree_skb(skb);2689			ppp_receive_error(ppp);2690		}2691	}2692 2693	return;2694 2695 err:2696	kfree_skb(skb);2697	ppp_receive_error(ppp);2698}2699 2700/*2701 * Insert a fragment on the MP reconstruction queue.2702 * The queue is ordered by increasing sequence number.2703 */2704static void2705ppp_mp_insert(struct ppp *ppp, struct sk_buff *skb)2706{2707	struct sk_buff *p;2708	struct sk_buff_head *list = &ppp->mrq;2709	u32 seq = PPP_MP_CB(skb)->sequence;2710 2711	/* N.B. we don't need to lock the list lock because we have the2712	   ppp unit receive-side lock. */2713	skb_queue_walk(list, p) {2714		if (seq_before(seq, PPP_MP_CB(p)->sequence))2715			break;2716	}2717	__skb_queue_before(list, p, skb);2718}2719 2720/*2721 * Reconstruct a packet from the MP fragment queue.2722 * We go through increasing sequence numbers until we find a2723 * complete packet, or we get to the sequence number for a fragment2724 * which hasn't arrived but might still do so.2725 */2726static struct sk_buff *2727ppp_mp_reconstruct(struct ppp *ppp)2728{2729	u32 seq = ppp->nextseq;2730	u32 minseq = ppp->minseq;2731	struct sk_buff_head *list = &ppp->mrq;2732	struct sk_buff *p, *tmp;2733	struct sk_buff *head, *tail;2734	struct sk_buff *skb = NULL;2735	int lost = 0, len = 0;2736 2737	if (ppp->mrru == 0)	/* do nothing until mrru is set */2738		return NULL;2739	head = __skb_peek(list);2740	tail = NULL;2741	skb_queue_walk_safe(list, p, tmp) {2742	again:2743		if (seq_before(PPP_MP_CB(p)->sequence, seq)) {2744			/* this can't happen, anyway ignore the skb */2745			netdev_err(ppp->dev, "ppp_mp_reconstruct bad "2746				   "seq %u < %u\n",2747				   PPP_MP_CB(p)->sequence, seq);2748			__skb_unlink(p, list);2749			kfree_skb(p);2750			continue;2751		}2752		if (PPP_MP_CB(p)->sequence != seq) {2753			u32 oldseq;2754			/* Fragment `seq' is missing.  If it is after2755			   minseq, it might arrive later, so stop here. */2756			if (seq_after(seq, minseq))2757				break;2758			/* Fragment `seq' is lost, keep going. */2759			lost = 1;2760			oldseq = seq;2761			seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?2762				minseq + 1: PPP_MP_CB(p)->sequence;2763 2764			if (ppp->debug & 1)2765				netdev_printk(KERN_DEBUG, ppp->dev,2766					      "lost frag %u..%u\n",2767					      oldseq, seq-1);2768 2769			goto again;2770		}2771 2772		/*2773		 * At this point we know that all the fragments from2774		 * ppp->nextseq to seq are either present or lost.2775		 * Also, there are no complete packets in the queue2776		 * that have no missing fragments and end before this2777		 * fragment.2778		 */2779 2780		/* B bit set indicates this fragment starts a packet */2781		if (PPP_MP_CB(p)->BEbits & B) {2782			head = p;2783			lost = 0;2784			len = 0;2785		}2786 2787		len += p->len;2788 2789		/* Got a complete packet yet? */2790		if (lost == 0 && (PPP_MP_CB(p)->BEbits & E) &&2791		    (PPP_MP_CB(head)->BEbits & B)) {2792			if (len > ppp->mrru + 2) {2793				++ppp->dev->stats.rx_length_errors;2794				netdev_printk(KERN_DEBUG, ppp->dev,2795					      "PPP: reconstructed packet"2796					      " is too long (%d)\n", len);2797			} else {2798				tail = p;2799				break;2800			}2801			ppp->nextseq = seq + 1;2802		}2803 2804		/*2805		 * If this is the ending fragment of a packet,2806		 * and we haven't found a complete valid packet yet,2807		 * we can discard up to and including this fragment.2808		 */2809		if (PPP_MP_CB(p)->BEbits & E) {2810			struct sk_buff *tmp2;2811 2812			skb_queue_reverse_walk_from_safe(list, p, tmp2) {2813				if (ppp->debug & 1)2814					netdev_printk(KERN_DEBUG, ppp->dev,2815						      "discarding frag %u\n",2816						      PPP_MP_CB(p)->sequence);2817				__skb_unlink(p, list);2818				kfree_skb(p);2819			}2820			head = skb_peek(list);2821			if (!head)2822				break;2823		}2824		++seq;2825	}2826 2827	/* If we have a complete packet, copy it all into one skb. */2828	if (tail != NULL) {2829		/* If we have discarded any fragments,2830		   signal a receive error. */2831		if (PPP_MP_CB(head)->sequence != ppp->nextseq) {2832			skb_queue_walk_safe(list, p, tmp) {2833				if (p == head)2834					break;2835				if (ppp->debug & 1)2836					netdev_printk(KERN_DEBUG, ppp->dev,2837						      "discarding frag %u\n",2838						      PPP_MP_CB(p)->sequence);2839				__skb_unlink(p, list);2840				kfree_skb(p);2841			}2842 2843			if (ppp->debug & 1)2844				netdev_printk(KERN_DEBUG, ppp->dev,2845					      "  missed pkts %u..%u\n",2846					      ppp->nextseq,2847					      PPP_MP_CB(head)->sequence-1);2848			++ppp->dev->stats.rx_dropped;2849			ppp_receive_error(ppp);2850		}2851 2852		skb = head;2853		if (head != tail) {2854			struct sk_buff **fragpp = &skb_shinfo(skb)->frag_list;2855			p = skb_queue_next(list, head);2856			__skb_unlink(skb, list);2857			skb_queue_walk_from_safe(list, p, tmp) {2858				__skb_unlink(p, list);2859				*fragpp = p;2860				p->next = NULL;2861				fragpp = &p->next;2862 2863				skb->len += p->len;2864				skb->data_len += p->len;2865				skb->truesize += p->truesize;2866 2867				if (p == tail)2868					break;2869			}2870		} else {2871			__skb_unlink(skb, list);2872		}2873 2874		ppp->nextseq = PPP_MP_CB(tail)->sequence + 1;2875	}2876 2877	return skb;2878}2879#endif /* CONFIG_PPP_MULTILINK */2880 2881/*2882 * Channel interface.2883 */2884 2885/* Create a new, unattached ppp channel. */2886int ppp_register_channel(struct ppp_channel *chan)2887{2888	return ppp_register_net_channel(current->nsproxy->net_ns, chan);2889}2890 2891/* Create a new, unattached ppp channel for specified net. */2892int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)2893{2894	struct channel *pch;2895	struct ppp_net *pn;2896 2897	pch = kzalloc(sizeof(struct channel), GFP_KERNEL);2898	if (!pch)2899		return -ENOMEM;2900 2901	pn = ppp_pernet(net);2902 2903	pch->ppp = NULL;2904	pch->chan = chan;2905	pch->chan_net = get_net_track(net, &pch->ns_tracker, GFP_KERNEL);2906	chan->ppp = pch;2907	init_ppp_file(&pch->file, CHANNEL);2908	pch->file.hdrlen = chan->hdrlen;2909#ifdef CONFIG_PPP_MULTILINK2910	pch->lastseq = -1;2911#endif /* CONFIG_PPP_MULTILINK */2912	init_rwsem(&pch->chan_sem);2913	spin_lock_init(&pch->downl);2914	rwlock_init(&pch->upl);2915 2916	spin_lock_bh(&pn->all_channels_lock);2917	pch->file.index = ++pn->last_channel_index;2918	list_add(&pch->list, &pn->new_channels);2919	atomic_inc(&channel_count);2920	spin_unlock_bh(&pn->all_channels_lock);2921 2922	return 0;2923}2924 2925/*2926 * Return the index of a channel.2927 */2928int ppp_channel_index(struct ppp_channel *chan)2929{2930	struct channel *pch = chan->ppp;2931 2932	if (pch)2933		return pch->file.index;2934	return -1;2935}2936 2937/*2938 * Return the PPP unit number to which a channel is connected.2939 */2940int ppp_unit_number(struct ppp_channel *chan)2941{2942	struct channel *pch = chan->ppp;2943	int unit = -1;2944 2945	if (pch) {2946		read_lock_bh(&pch->upl);2947		if (pch->ppp)2948			unit = pch->ppp->file.index;2949		read_unlock_bh(&pch->upl);2950	}2951	return unit;2952}2953 2954/*2955 * Return the PPP device interface name of a channel.2956 */2957char *ppp_dev_name(struct ppp_channel *chan)2958{2959	struct channel *pch = chan->ppp;2960	char *name = NULL;2961 2962	if (pch) {2963		read_lock_bh(&pch->upl);2964		if (pch->ppp && pch->ppp->dev)2965			name = pch->ppp->dev->name;2966		read_unlock_bh(&pch->upl);2967	}2968	return name;2969}2970 2971 2972/*2973 * Disconnect a channel from the generic layer.2974 * This must be called in process context.2975 */2976void2977ppp_unregister_channel(struct ppp_channel *chan)2978{2979	struct channel *pch = chan->ppp;2980	struct ppp_net *pn;2981 2982	if (!pch)2983		return;		/* should never happen */2984 2985	chan->ppp = NULL;2986 2987	/*2988	 * This ensures that we have returned from any calls into2989	 * the channel's start_xmit or ioctl routine before we proceed.2990	 */2991	down_write(&pch->chan_sem);2992	spin_lock_bh(&pch->downl);2993	pch->chan = NULL;2994	spin_unlock_bh(&pch->downl);2995	up_write(&pch->chan_sem);2996	ppp_disconnect_channel(pch);2997 2998	pn = ppp_pernet(pch->chan_net);2999	spin_lock_bh(&pn->all_channels_lock);3000	list_del(&pch->list);3001	spin_unlock_bh(&pn->all_channels_lock);3002 3003	ppp_unbridge_channels(pch);3004 3005	pch->file.dead = 1;3006	wake_up_interruptible(&pch->file.rwait);3007 3008	if (refcount_dec_and_test(&pch->file.refcnt))3009		ppp_destroy_channel(pch);3010}3011 3012/*3013 * Callback from a channel when it can accept more to transmit.3014 * This should be called at BH/softirq level, not interrupt level.3015 */3016void3017ppp_output_wakeup(struct ppp_channel *chan)3018{3019	struct channel *pch = chan->ppp;3020 3021	if (!pch)3022		return;3023	ppp_channel_push(pch);3024}3025 3026/*3027 * Compression control.3028 */3029 3030/* Process the PPPIOCSCOMPRESS ioctl. */3031static int3032ppp_set_compress(struct ppp *ppp, struct ppp_option_data *data)3033{3034	int err = -EFAULT;3035	struct compressor *cp, *ocomp;3036	void *state, *ostate;3037	unsigned char ccp_option[CCP_MAX_OPTION_LENGTH];3038 3039	if (data->length > CCP_MAX_OPTION_LENGTH)3040		goto out;3041	if (copy_from_user(ccp_option, data->ptr, data->length))3042		goto out;3043 3044	err = -EINVAL;3045	if (data->length < 2 || ccp_option[1] < 2 || ccp_option[1] > data->length)3046		goto out;3047 3048	cp = try_then_request_module(3049		find_compressor(ccp_option[0]),3050		"ppp-compress-%d", ccp_option[0]);3051	if (!cp)3052		goto out;3053 3054	err = -ENOBUFS;3055	if (data->transmit) {3056		state = cp->comp_alloc(ccp_option, data->length);3057		if (state) {3058			ppp_xmit_lock(ppp);3059			ppp->xstate &= ~SC_COMP_RUN;3060			ocomp = ppp->xcomp;3061			ostate = ppp->xc_state;3062			ppp->xcomp = cp;3063			ppp->xc_state = state;3064			ppp_xmit_unlock(ppp);3065			if (ostate) {3066				ocomp->comp_free(ostate);3067				module_put(ocomp->owner);3068			}3069			err = 0;3070		} else3071			module_put(cp->owner);3072 3073	} else {3074		state = cp->decomp_alloc(ccp_option, data->length);3075		if (state) {3076			ppp_recv_lock(ppp);3077			ppp->rstate &= ~SC_DECOMP_RUN;3078			ocomp = ppp->rcomp;3079			ostate = ppp->rc_state;3080			ppp->rcomp = cp;3081			ppp->rc_state = state;3082			ppp_recv_unlock(ppp);3083			if (ostate) {3084				ocomp->decomp_free(ostate);3085				module_put(ocomp->owner);3086			}3087			err = 0;3088		} else3089			module_put(cp->owner);3090	}3091 3092 out:3093	return err;3094}3095 3096/*3097 * Look at a CCP packet and update our state accordingly.3098 * We assume the caller has the xmit or recv path locked.3099 */3100static void3101ppp_ccp_peek(struct ppp *ppp, struct sk_buff *skb, int inbound)3102{3103	unsigned char *dp;3104	int len;3105 3106	if (!pskb_may_pull(skb, CCP_HDRLEN + 2))3107		return;	/* no header */3108	dp = skb->data + 2;3109 3110	switch (CCP_CODE(dp)) {3111	case CCP_CONFREQ:3112 3113		/* A ConfReq starts negotiation of compression3114		 * in one direction of transmission,3115		 * and hence brings it down...but which way?3116		 *3117		 * Remember:3118		 * A ConfReq indicates what the sender would like to receive3119		 */3120		if(inbound)3121			/* He is proposing what I should send */3122			ppp->xstate &= ~SC_COMP_RUN;3123		else3124			/* I am proposing to what he should send */3125			ppp->rstate &= ~SC_DECOMP_RUN;3126 3127		break;3128 3129	case CCP_TERMREQ:3130	case CCP_TERMACK:3131		/*3132		 * CCP is going down, both directions of transmission3133		 */3134		ppp->rstate &= ~SC_DECOMP_RUN;3135		ppp->xstate &= ~SC_COMP_RUN;3136		break;3137 3138	case CCP_CONFACK:3139		if ((ppp->flags & (SC_CCP_OPEN | SC_CCP_UP)) != SC_CCP_OPEN)3140			break;3141		len = CCP_LENGTH(dp);3142		if (!pskb_may_pull(skb, len + 2))3143			return;		/* too short */3144		dp += CCP_HDRLEN;3145		len -= CCP_HDRLEN;3146		if (len < CCP_OPT_MINLEN || len < CCP_OPT_LENGTH(dp))3147			break;3148		if (inbound) {3149			/* we will start receiving compressed packets */3150			if (!ppp->rc_state)3151				break;3152			if (ppp->rcomp->decomp_init(ppp->rc_state, dp, len,3153					ppp->file.index, 0, ppp->mru, ppp->debug)) {3154				ppp->rstate |= SC_DECOMP_RUN;3155				ppp->rstate &= ~(SC_DC_ERROR | SC_DC_FERROR);3156			}3157		} else {3158			/* we will soon start sending compressed packets */3159			if (!ppp->xc_state)3160				break;3161			if (ppp->xcomp->comp_init(ppp->xc_state, dp, len,3162					ppp->file.index, 0, ppp->debug))3163				ppp->xstate |= SC_COMP_RUN;3164		}3165		break;3166 3167	case CCP_RESETACK:3168		/* reset the [de]compressor */3169		if ((ppp->flags & SC_CCP_UP) == 0)3170			break;3171		if (inbound) {3172			if (ppp->rc_state && (ppp->rstate & SC_DECOMP_RUN)) {3173				ppp->rcomp->decomp_reset(ppp->rc_state);3174				ppp->rstate &= ~SC_DC_ERROR;3175			}3176		} else {3177			if (ppp->xc_state && (ppp->xstate & SC_COMP_RUN))3178				ppp->xcomp->comp_reset(ppp->xc_state);3179		}3180		break;3181	}3182}3183 3184/* Free up compression resources. */3185static void3186ppp_ccp_closed(struct ppp *ppp)3187{3188	void *xstate, *rstate;3189	struct compressor *xcomp, *rcomp;3190 3191	ppp_lock(ppp);3192	ppp->flags &= ~(SC_CCP_OPEN | SC_CCP_UP);3193	ppp->xstate = 0;3194	xcomp = ppp->xcomp;3195	xstate = ppp->xc_state;3196	ppp->xc_state = NULL;3197	ppp->rstate = 0;3198	rcomp = ppp->rcomp;3199	rstate = ppp->rc_state;3200	ppp->rc_state = NULL;3201	ppp_unlock(ppp);3202 3203	if (xstate) {3204		xcomp->comp_free(xstate);3205		module_put(xcomp->owner);3206	}3207	if (rstate) {3208		rcomp->decomp_free(rstate);3209		module_put(rcomp->owner);3210	}3211}3212 3213/* List of compressors. */3214static LIST_HEAD(compressor_list);3215static DEFINE_SPINLOCK(compressor_list_lock);3216 3217struct compressor_entry {3218	struct list_head list;3219	struct compressor *comp;3220};3221 3222static struct compressor_entry *3223find_comp_entry(int proto)3224{3225	struct compressor_entry *ce;3226 3227	list_for_each_entry(ce, &compressor_list, list) {3228		if (ce->comp->compress_proto == proto)3229			return ce;3230	}3231	return NULL;3232}3233 3234/* Register a compressor */3235int3236ppp_register_compressor(struct compressor *cp)3237{3238	struct compressor_entry *ce;3239	int ret;3240	spin_lock(&compressor_list_lock);3241	ret = -EEXIST;3242	if (find_comp_entry(cp->compress_proto))3243		goto out;3244	ret = -ENOMEM;3245	ce = kmalloc(sizeof(struct compressor_entry), GFP_ATOMIC);3246	if (!ce)3247		goto out;3248	ret = 0;3249	ce->comp = cp;3250	list_add(&ce->list, &compressor_list);3251 out:3252	spin_unlock(&compressor_list_lock);3253	return ret;3254}3255 3256/* Unregister a compressor */3257void3258ppp_unregister_compressor(struct compressor *cp)3259{3260	struct compressor_entry *ce;3261 3262	spin_lock(&compressor_list_lock);3263	ce = find_comp_entry(cp->compress_proto);3264	if (ce && ce->comp == cp) {3265		list_del(&ce->list);3266		kfree(ce);3267	}3268	spin_unlock(&compressor_list_lock);3269}3270 3271/* Find a compressor. */3272static struct compressor *3273find_compressor(int type)3274{3275	struct compressor_entry *ce;3276	struct compressor *cp = NULL;3277 3278	spin_lock(&compressor_list_lock);3279	ce = find_comp_entry(type);3280	if (ce) {3281		cp = ce->comp;3282		if (!try_module_get(cp->owner))3283			cp = NULL;3284	}3285	spin_unlock(&compressor_list_lock);3286	return cp;3287}3288 3289/*3290 * Miscelleneous stuff.3291 */3292 3293static void3294ppp_get_stats(struct ppp *ppp, struct ppp_stats *st)3295{3296	struct slcompress *vj = ppp->vj;3297 3298	memset(st, 0, sizeof(*st));3299	st->p.ppp_ipackets = ppp->stats64.rx_packets;3300	st->p.ppp_ierrors = ppp->dev->stats.rx_errors;3301	st->p.ppp_ibytes = ppp->stats64.rx_bytes;3302	st->p.ppp_opackets = ppp->stats64.tx_packets;3303	st->p.ppp_oerrors = ppp->dev->stats.tx_errors;3304	st->p.ppp_obytes = ppp->stats64.tx_bytes;3305	if (!vj)3306		return;3307	st->vj.vjs_packets = vj->sls_o_compressed + vj->sls_o_uncompressed;3308	st->vj.vjs_compressed = vj->sls_o_compressed;3309	st->vj.vjs_searches = vj->sls_o_searches;3310	st->vj.vjs_misses = vj->sls_o_misses;3311	st->vj.vjs_errorin = vj->sls_i_error;3312	st->vj.vjs_tossed = vj->sls_i_tossed;3313	st->vj.vjs_uncompressedin = vj->sls_i_uncompressed;3314	st->vj.vjs_compressedin = vj->sls_i_compressed;3315}3316 3317/*3318 * Stuff for handling the lists of ppp units and channels3319 * and for initialization.3320 */3321 3322/*3323 * Create a new ppp interface unit.  Fails if it can't allocate memory3324 * or if there is already a unit with the requested number.3325 * unit == -1 means allocate a new number.3326 */3327static int ppp_create_interface(struct net *net, struct file *file, int *unit)3328{3329	struct ppp_config conf = {3330		.file = file,3331		.unit = *unit,3332		.ifname_is_set = false,3333	};3334	struct net_device *dev;3335	struct ppp *ppp;3336	int err;3337 3338	dev = alloc_netdev(sizeof(struct ppp), "", NET_NAME_ENUM, ppp_setup);3339	if (!dev) {3340		err = -ENOMEM;3341		goto err;3342	}3343	dev_net_set(dev, net);3344	dev->rtnl_link_ops = &ppp_link_ops;3345 3346	rtnl_lock();3347 3348	err = ppp_dev_configure(net, dev, &conf);3349	if (err < 0)3350		goto err_dev;3351	ppp = netdev_priv(dev);3352	*unit = ppp->file.index;3353 3354	rtnl_unlock();3355 3356	return 0;3357 3358err_dev:3359	rtnl_unlock();3360	free_netdev(dev);3361err:3362	return err;3363}3364 3365/*3366 * Initialize a ppp_file structure.3367 */3368static void3369init_ppp_file(struct ppp_file *pf, int kind)3370{3371	pf->kind = kind;3372	skb_queue_head_init(&pf->xq);3373	skb_queue_head_init(&pf->rq);3374	refcount_set(&pf->refcnt, 1);3375	init_waitqueue_head(&pf->rwait);3376}3377 3378/*3379 * Free the memory used by a ppp unit.  This is only called once3380 * there are no channels connected to the unit and no file structs3381 * that reference the unit.3382 */3383static void ppp_destroy_interface(struct ppp *ppp)3384{3385	atomic_dec(&ppp_unit_count);3386 3387	if (!ppp->file.dead || ppp->n_channels) {3388		/* "can't happen" */3389		netdev_err(ppp->dev, "ppp: destroying ppp struct %p "3390			   "but dead=%d n_channels=%d !\n",3391			   ppp, ppp->file.dead, ppp->n_channels);3392		return;3393	}3394 3395	ppp_ccp_closed(ppp);3396	if (ppp->vj) {3397		slhc_free(ppp->vj);3398		ppp->vj = NULL;3399	}3400	skb_queue_purge(&ppp->file.xq);3401	skb_queue_purge(&ppp->file.rq);3402#ifdef CONFIG_PPP_MULTILINK3403	skb_queue_purge(&ppp->mrq);3404#endif /* CONFIG_PPP_MULTILINK */3405#ifdef CONFIG_PPP_FILTER3406	if (ppp->pass_filter) {3407		bpf_prog_destroy(ppp->pass_filter);3408		ppp->pass_filter = NULL;3409	}3410 3411	if (ppp->active_filter) {3412		bpf_prog_destroy(ppp->active_filter);3413		ppp->active_filter = NULL;3414	}3415#endif /* CONFIG_PPP_FILTER */3416 3417	kfree_skb(ppp->xmit_pending);3418	free_percpu(ppp->xmit_recursion);3419 3420	free_netdev(ppp->dev);3421}3422 3423/*3424 * Locate an existing ppp unit.3425 * The caller should have locked the all_ppp_mutex.3426 */3427static struct ppp *3428ppp_find_unit(struct ppp_net *pn, int unit)3429{3430	return unit_find(&pn->units_idr, unit);3431}3432 3433/*3434 * Locate an existing ppp channel.3435 * The caller should have locked the all_channels_lock.3436 * First we look in the new_channels list, then in the3437 * all_channels list.  If found in the new_channels list,3438 * we move it to the all_channels list.  This is for speed3439 * when we have a lot of channels in use.3440 */3441static struct channel *3442ppp_find_channel(struct ppp_net *pn, int unit)3443{3444	struct channel *pch;3445 3446	list_for_each_entry(pch, &pn->new_channels, list) {3447		if (pch->file.index == unit) {3448			list_move(&pch->list, &pn->all_channels);3449			return pch;3450		}3451	}3452 3453	list_for_each_entry(pch, &pn->all_channels, list) {3454		if (pch->file.index == unit)3455			return pch;3456	}3457 3458	return NULL;3459}3460 3461/*3462 * Connect a PPP channel to a PPP interface unit.3463 */3464static int3465ppp_connect_channel(struct channel *pch, int unit)3466{3467	struct ppp *ppp;3468	struct ppp_net *pn;3469	int ret = -ENXIO;3470	int hdrlen;3471 3472	pn = ppp_pernet(pch->chan_net);3473 3474	mutex_lock(&pn->all_ppp_mutex);3475	ppp = ppp_find_unit(pn, unit);3476	if (!ppp)3477		goto out;3478	write_lock_bh(&pch->upl);3479	ret = -EINVAL;3480	if (pch->ppp ||3481	    rcu_dereference_protected(pch->bridge, lockdep_is_held(&pch->upl)))3482		goto outl;3483 3484	ppp_lock(ppp);3485	spin_lock_bh(&pch->downl);3486	if (!pch->chan) {3487		/* Don't connect unregistered channels */3488		spin_unlock_bh(&pch->downl);3489		ppp_unlock(ppp);3490		ret = -ENOTCONN;3491		goto outl;3492	}3493	spin_unlock_bh(&pch->downl);3494	if (pch->file.hdrlen > ppp->file.hdrlen)3495		ppp->file.hdrlen = pch->file.hdrlen;3496	hdrlen = pch->file.hdrlen + 2;	/* for protocol bytes */3497	if (hdrlen > ppp->dev->hard_header_len)3498		ppp->dev->hard_header_len = hdrlen;3499	list_add_tail(&pch->clist, &ppp->channels);3500	++ppp->n_channels;3501	pch->ppp = ppp;3502	refcount_inc(&ppp->file.refcnt);3503	ppp_unlock(ppp);3504	ret = 0;3505 3506 outl:3507	write_unlock_bh(&pch->upl);3508 out:3509	mutex_unlock(&pn->all_ppp_mutex);3510	return ret;3511}3512 3513/*3514 * Disconnect a channel from its ppp unit.3515 */3516static int3517ppp_disconnect_channel(struct channel *pch)3518{3519	struct ppp *ppp;3520	int err = -EINVAL;3521 3522	write_lock_bh(&pch->upl);3523	ppp = pch->ppp;3524	pch->ppp = NULL;3525	write_unlock_bh(&pch->upl);3526	if (ppp) {3527		/* remove it from the ppp unit's list */3528		ppp_lock(ppp);3529		list_del(&pch->clist);3530		if (--ppp->n_channels == 0)3531			wake_up_interruptible(&ppp->file.rwait);3532		ppp_unlock(ppp);3533		if (refcount_dec_and_test(&ppp->file.refcnt))3534			ppp_destroy_interface(ppp);3535		err = 0;3536	}3537	return err;3538}3539 3540/*3541 * Free up the resources used by a ppp channel.3542 */3543static void ppp_destroy_channel(struct channel *pch)3544{3545	put_net_track(pch->chan_net, &pch->ns_tracker);3546	pch->chan_net = NULL;3547 3548	atomic_dec(&channel_count);3549 3550	if (!pch->file.dead) {3551		/* "can't happen" */3552		pr_err("ppp: destroying undead channel %p !\n", pch);3553		return;3554	}3555	skb_queue_purge(&pch->file.xq);3556	skb_queue_purge(&pch->file.rq);3557	kfree(pch);3558}3559 3560static void __exit ppp_cleanup(void)3561{3562	/* should never happen */3563	if (atomic_read(&ppp_unit_count) || atomic_read(&channel_count))3564		pr_err("PPP: removing module but units remain!\n");3565	rtnl_link_unregister(&ppp_link_ops);3566	unregister_chrdev(PPP_MAJOR, "ppp");3567	device_destroy(&ppp_class, MKDEV(PPP_MAJOR, 0));3568	class_unregister(&ppp_class);3569	unregister_pernet_device(&ppp_net_ops);3570}3571 3572/*3573 * Units handling. Caller must protect concurrent access3574 * by holding all_ppp_mutex3575 */3576 3577/* associate pointer with specified number */3578static int unit_set(struct idr *p, void *ptr, int n)3579{3580	int unit;3581 3582	unit = idr_alloc(p, ptr, n, n + 1, GFP_KERNEL);3583	if (unit == -ENOSPC)3584		unit = -EINVAL;3585	return unit;3586}3587 3588/* get new free unit number and associate pointer with it */3589static int unit_get(struct idr *p, void *ptr, int min)3590{3591	return idr_alloc(p, ptr, min, 0, GFP_KERNEL);3592}3593 3594/* put unit number back to a pool */3595static void unit_put(struct idr *p, int n)3596{3597	idr_remove(p, n);3598}3599 3600/* get pointer associated with the number */3601static void *unit_find(struct idr *p, int n)3602{3603	return idr_find(p, n);3604}3605 3606/* Module/initialization stuff */3607 3608module_init(ppp_init);3609module_exit(ppp_cleanup);3610 3611EXPORT_SYMBOL(ppp_register_net_channel);3612EXPORT_SYMBOL(ppp_register_channel);3613EXPORT_SYMBOL(ppp_unregister_channel);3614EXPORT_SYMBOL(ppp_channel_index);3615EXPORT_SYMBOL(ppp_unit_number);3616EXPORT_SYMBOL(ppp_dev_name);3617EXPORT_SYMBOL(ppp_input);3618EXPORT_SYMBOL(ppp_input_error);3619EXPORT_SYMBOL(ppp_output_wakeup);3620EXPORT_SYMBOL(ppp_register_compressor);3621EXPORT_SYMBOL(ppp_unregister_compressor);3622MODULE_DESCRIPTION("Generic PPP layer driver");3623MODULE_LICENSE("GPL");3624MODULE_ALIAS_CHARDEV(PPP_MAJOR, 0);3625MODULE_ALIAS_RTNL_LINK("ppp");3626MODULE_ALIAS("devname:ppp");3627