netpoll: don't dereference NULL dev from np
[safe/jmp/linux-2.6] / net / wanrouter / wanmain.c
index 4d90a17..466e2d2 100644 (file)
@@ -46,7 +46,6 @@
 #include <linux/capability.h>
 #include <linux/errno.h>       /* return codes */
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/module.h>      /* support for loadable modules */
 #include <linux/slab.h>                /* kmalloc(), kfree() */
 #include <linux/mm.h>
 #include <linux/vmalloc.h>     /* vmalloc, vfree */
 #include <asm/uaccess.h>        /* copy_to/from_user */
 #include <linux/init.h>         /* __initfunc et al. */
-#include <net/syncppp.h>
 
 #define KMEM_SAFETYZONE 8
 
+#define DEV_TO_SLAVE(dev)      (*((struct net_device **)netdev_priv(dev)))
+
 /*
  *     Function Prototypes
  */
@@ -86,8 +86,10 @@ static int wanrouter_device_del_if(struct wan_device *wandev,
 
 static struct wan_device *wanrouter_find_device(char *name);
 static int wanrouter_delete_interface(struct wan_device *wandev, char *name);
-static void lock_adapter_irq(spinlock_t *lock, unsigned long *smp_flags);
-static void unlock_adapter_irq(spinlock_t *lock, unsigned long *smp_flags);
+static void lock_adapter_irq(spinlock_t *lock, unsigned long *smp_flags)
+       __acquires(lock);
+static void unlock_adapter_irq(spinlock_t *lock, unsigned long *smp_flags)
+       __releases(lock);
 
 
 
@@ -277,8 +279,8 @@ int wanrouter_encapsulate(struct sk_buff *skb, struct net_device *dev,
                skb_push(skb, 7);
                skb->data[0] = 0;
                skb->data[1] = NLPID_SNAP;
-               memcpy(&skb->data[2], wanrouter_oui_ether,
-                      sizeof(wanrouter_oui_ether));
+               skb_copy_to_linear_data_offset(skb, 2, wanrouter_oui_ether,
+                                              sizeof(wanrouter_oui_ether));
                *((unsigned short*)&skb->data[5]) = htons(type);
                break;
 
@@ -314,10 +316,10 @@ __be16 wanrouter_type_trans(struct sk_buff *skb, struct net_device *dev)
                cnt += 1;
                break;
 
-        case NLPID_SNAP:       /* SNAP encapsulation */
+       case NLPID_SNAP:        /* SNAP encapsulation */
                if (memcmp(&skb->data[cnt + 1], wanrouter_oui_ether,
                           sizeof(wanrouter_oui_ether))){
-                       printk(KERN_INFO
+                       printk(KERN_INFO
                                "%s: unsupported SNAP OUI %02X-%02X-%02X "
                                "on interface %s!\n", wanrouter_modname,
                                skb->data[cnt+1], skb->data[cnt+2],
@@ -339,7 +341,7 @@ __be16 wanrouter_type_trans(struct sk_buff *skb, struct net_device *dev)
        skb->protocol = ethertype;
        skb->pkt_type = PACKET_HOST;    /*      Physically point to point */
        skb_pull(skb, cnt);
-       skb->mac.raw  = skb->data;
+       skb_reset_mac_header(skb);
        return ethertype;
 }
 
@@ -351,9 +353,9 @@ __be16 wanrouter_type_trans(struct sk_buff *skb, struct net_device *dev)
  *     o execute requested action or pass command to the device driver
  */
 
-int wanrouter_ioctl(struct inode *inode, struct file *file,
-               unsigned int cmd, unsigned long arg)
+long wanrouter_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
+       struct inode *inode = file->f_path.dentry->d_inode;
        int err = 0;
        struct proc_dir_entry *dent;
        struct wan_device *wandev;
@@ -373,6 +375,7 @@ int wanrouter_ioctl(struct inode *inode, struct file *file,
        if (wandev->magic != ROUTER_MAGIC)
                return -EINVAL;
 
+       lock_kernel();
        switch (cmd) {
        case ROUTER_SETUP:
                err = wanrouter_device_setup(wandev, data);
@@ -404,6 +407,7 @@ int wanrouter_ioctl(struct inode *inode, struct file *file,
                        err = wandev->ioctl(wandev, cmd, arg);
                else err = -EINVAL;
        }
+       unlock_kernel();
        return err;
 }
 
@@ -450,22 +454,22 @@ static int wanrouter_device_setup(struct wan_device *wandev,
                kfree(conf);
                printk(KERN_INFO "%s: ERROR, Invalid MAGIC Number\n",
                                wandev->name);
-               return -EINVAL;
+               return -EINVAL;
        }
 
        if (conf->data_size && conf->data) {
-               if (conf->data_size > 128000 || conf->data_size < 0) {
+               if (conf->data_size > 128000) {
                        printk(KERN_INFO
                            "%s: ERROR, Invalid firmware data size %i !\n",
                                        wandev->name, conf->data_size);
                        kfree(conf);
-                       return -EINVAL;
+                       return -EINVAL;
                }
 
                data = vmalloc(conf->data_size);
                if (!data) {
                        printk(KERN_INFO
-                               "%s: ERROR, Faild allocate kernel memory !\n",
+                               "%s: ERROR, Faild allocate kernel memory !\n",
                                wandev->name);
                        kfree(conf);
                        return -ENOBUFS;
@@ -511,7 +515,7 @@ static int wanrouter_device_shutdown(struct wan_device *wandev)
                if (err)
                        return err;
                /* The above function deallocates the current dev
-                * structure. Therefore, we cannot use dev->priv
+                * structure. Therefore, we cannot use netdev_priv(dev)
                 * as the next element: wandev->dev points to the
                 * next element */
                dev = wandev->dev;
@@ -566,9 +570,6 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
 {
        wanif_conf_t *cnf;
        struct net_device *dev = NULL;
-#ifdef CONFIG_WANPIPE_MULTPPP
-       struct ppp_device *pppdev=NULL;
-#endif
        int err;
 
        if ((wandev->state == WAN_UNCONFIGURED) || (wandev->new_if == NULL))
@@ -587,30 +588,11 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                goto out;
 
        if (cnf->config_id == WANCONFIG_MPPP) {
-#ifdef CONFIG_WANPIPE_MULTPPP
-               pppdev = kzalloc(sizeof(struct ppp_device), GFP_KERNEL);
-               err = -ENOBUFS;
-               if (pppdev == NULL)
-                       goto out;
-               pppdev->dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
-               if (pppdev->dev == NULL) {
-                       kfree(pppdev);
-                       err = -ENOBUFS;
-                       goto out;
-               }
-               err = wandev->new_if(wandev, (struct net_device *)pppdev, cnf);
-               dev = pppdev->dev;
-#else
                printk(KERN_INFO "%s: Wanpipe Mulit-Port PPP support has not been compiled in!\n",
                                wandev->name);
                err = -EPROTONOSUPPORT;
                goto out;
-#endif
        } else {
-               dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
-               err = -ENOBUFS;
-               if (dev == NULL)
-                       goto out;
                err = wandev->new_if(wandev, dev, cnf);
        }
 
@@ -640,10 +622,9 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                                        wandev->dev = dev;
                                } else {
                                        for (slave=wandev->dev;
-                                        *((struct net_device **)slave->priv);
-                                slave = *((struct net_device **)slave->priv));
-
-                                    *((struct net_device **)slave->priv) = dev;
+                                            DEV_TO_SLAVE(slave);
+                                            slave = DEV_TO_SLAVE(slave))
+                                               DEV_TO_SLAVE(slave) = dev;
                                }
                                ++wandev->ndev;
 
@@ -654,23 +635,9 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                }
                if (wandev->del_if)
                        wandev->del_if(wandev, dev);
+               free_netdev(dev);
        }
 
-       /* This code has moved from del_if() function */
-       kfree(dev->priv);
-       dev->priv = NULL;
-
-#ifdef CONFIG_WANPIPE_MULTPPP
-       if (cnf->config_id == WANCONFIG_MPPP)
-               kfree(pppdev);
-       else
-               kfree(dev);
-#else
-       /* Sync PPP is disabled */
-       if (cnf->config_id != WANCONFIG_MPPP)
-               kfree(dev);
-#endif
-
 out:
        kfree(cnf);
        return err;
@@ -686,7 +653,7 @@ out:
 static int wanrouter_device_del_if(struct wan_device *wandev, char __user *u_name)
 {
        char name[WAN_IFNAME_SZ + 1];
-        int err = 0;
+       int err = 0;
 
        if (wandev->state == WAN_UNCONFIGURED)
                return -ENODEV;
@@ -709,8 +676,8 @@ static int wanrouter_device_del_if(struct wan_device *wandev, char __user *u_nam
         * interfaces are deleted and the link irrecoverably disconnected.
         */
 
-        if (!wandev->ndev && wandev->shutdown)
-                err = wandev->shutdown(wandev);
+       if (!wandev->ndev && wandev->shutdown)
+               err = wandev->shutdown(wandev);
 
        return err;
 }
@@ -760,7 +727,7 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
        dev = wandev->dev;
        prev = NULL;
        while (dev && strcmp(name, dev->name)) {
-               struct net_device **slave = dev->priv;
+               struct net_device **slave = netdev_priv(dev);
                prev = dev;
                dev = *slave;
        }
@@ -777,12 +744,12 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
 
        lock_adapter_irq(&wandev->lock, &smp_flags);
        if (prev) {
-               struct net_device **prev_slave = prev->priv;
-               struct net_device **slave = dev->priv;
+               struct net_device **prev_slave = netdev_priv(prev);
+               struct net_device **slave = netdev_priv(dev);
 
                *prev_slave = *slave;
        } else {
-               struct net_device **slave = dev->priv;
+               struct net_device **slave = netdev_priv(dev);
                wandev->dev = *slave;
        }
        --wandev->ndev;
@@ -790,11 +757,6 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
 
        printk(KERN_INFO "%s: unregistering '%s'\n", wandev->name, dev->name);
 
-       /* Due to new interface linking method using dev->priv,
-        * this code has moved from del_if() function.*/
-       kfree(dev->priv);
-       dev->priv=NULL;
-
        unregister_netdev(dev);
 
        free_netdev(dev);
@@ -803,12 +765,14 @@ static int wanrouter_delete_interface(struct wan_device *wandev, char *name)
 }
 
 static void lock_adapter_irq(spinlock_t *lock, unsigned long *smp_flags)
+       __acquires(lock)
 {
-               spin_lock_irqsave(lock, *smp_flags);
+       spin_lock_irqsave(lock, *smp_flags);
 }
 
 
 static void unlock_adapter_irq(spinlock_t *lock, unsigned long *smp_flags)
+       __releases(lock)
 {
        spin_unlock_irqrestore(lock, *smp_flags);
 }