[ROSE/AX25] af_rose: rose_release() fix

[pandora-kernel.git] / net / rose / af_rose.c

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 976c3cc..063cbc5 100644 (file)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -26,6 +26,7 @@
 #include <linux/sockios.h>
 #include <linux/net.h>
 #include <linux/stat.h>
+#include <net/net_namespace.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -115,7 +116,7 @@ int rosecmp(rose_address *addr1, rose_address *addr2)
  */
 int rosecmpm(rose_address *addr1, rose_address *addr2, unsigned short mask)
 {
-       int i, j;
+       unsigned int i, j;
 
        if (mask > 10)
                return 1;
@@ -196,6 +197,9 @@ static int rose_device_event(struct notifier_block *this, unsigned long event,
 {
        struct net_device *dev = (struct net_device *)ptr;
 
+       if (dev->nd_net != &init_net)
+               return NOTIFY_DONE;
+
        if (event != NETDEV_DOWN)
                return NOTIFY_DONE;
 
@@ -341,10 +345,9 @@ void rose_destroy_socket(struct sock *sk)
        if (atomic_read(&sk->sk_wmem_alloc) ||
            atomic_read(&sk->sk_rmem_alloc)) {
                /* Defer: outstanding buffers */
-               init_timer(&sk->sk_timer);
+               setup_timer(&sk->sk_timer, rose_destroy_timer,
+                               (unsigned long)sk);
                sk->sk_timer.expires  = jiffies + 10 * HZ;
-               sk->sk_timer.function = rose_destroy_timer;
-               sk->sk_timer.data     = (unsigned long)sk;
                add_timer(&sk->sk_timer);
        } else
                sock_put(sk);
@@ -498,15 +501,19 @@ static struct proto rose_proto = {
        .obj_size = sizeof(struct rose_sock),
 };
 
-static int rose_create(struct socket *sock, int protocol)
+static int rose_create(struct net *net, struct socket *sock, int protocol)
 {
        struct sock *sk;
        struct rose_sock *rose;
 
+       if (net != &init_net)
+               return -EAFNOSUPPORT;
+
        if (sock->type != SOCK_SEQPACKET || protocol != 0)
                return -ESOCKTNOSUPPORT;
 
-       if ((sk = sk_alloc(PF_ROSE, GFP_ATOMIC, &rose_proto, 1)) == NULL)
+       sk = sk_alloc(net, PF_ROSE, GFP_ATOMIC, &rose_proto);
+       if (sk == NULL)
                return -ENOMEM;
 
        rose = rose_sk(sk);
@@ -544,7 +551,8 @@ static struct sock *rose_make_new(struct sock *osk)
        if (osk->sk_type != SOCK_SEQPACKET)
                return NULL;
 
-       if ((sk = sk_alloc(PF_ROSE, GFP_ATOMIC, &rose_proto, 1)) == NULL)
+       sk = sk_alloc(osk->sk_net, PF_ROSE, GFP_ATOMIC, &rose_proto);
+       if (sk == NULL)
                return NULL;
 
        rose = rose_sk(sk);
@@ -590,17 +598,24 @@ static int rose_release(struct socket *sock)
 
        if (sk == NULL) return 0;
 
+       sock_hold(sk);
+       sock_orphan(sk);
+       lock_sock(sk);
        rose = rose_sk(sk);
 
        switch (rose->state) {
        case ROSE_STATE_0:
+               release_sock(sk);
                rose_disconnect(sk, 0, -1, -1);
+               lock_sock(sk);
                rose_destroy_socket(sk);
                break;
 
        case ROSE_STATE_2:
                rose->neighbour->use--;
+               release_sock(sk);
                rose_disconnect(sk, 0, -1, -1);
+               lock_sock(sk);
                rose_destroy_socket(sk);
                break;
 
@@ -625,6 +640,8 @@ static int rose_release(struct socket *sock)
        }
 
        sock->sk = NULL;
+       release_sock(sk);
+       sock_put(sk);
 
        return 0;
 }
@@ -965,8 +982,8 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
         */
        memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
 
-       len  = (((skb->data[3] >> 4) & 0x0F) + 1) / 2;
-       len += (((skb->data[3] >> 0) & 0x0F) + 1) / 2;
+       len  = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
+       len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
        if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
                rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
                return 0;
@@ -1369,6 +1386,7 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 
 #ifdef CONFIG_PROC_FS
 static void *rose_info_start(struct seq_file *seq, loff_t *pos)
+       __acquires(rose_list_lock)
 {
        int i;
        struct sock *s;
@@ -1396,6 +1414,7 @@ static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void rose_info_stop(struct seq_file *seq, void *v)
+       __releases(rose_list_lock)
 {
        spin_unlock_bh(&rose_list_lock);
 }
@@ -1576,10 +1595,10 @@ static int __init rose_proto_init(void)
 
        rose_add_loopback_neigh();
 
-       proc_net_fops_create("rose", S_IRUGO, &rose_info_fops);
-       proc_net_fops_create("rose_neigh", S_IRUGO, &rose_neigh_fops);
-       proc_net_fops_create("rose_nodes", S_IRUGO, &rose_nodes_fops);
-       proc_net_fops_create("rose_routes", S_IRUGO, &rose_routes_fops);
+       proc_net_fops_create(&init_net, "rose", S_IRUGO, &rose_info_fops);
+       proc_net_fops_create(&init_net, "rose_neigh", S_IRUGO, &rose_neigh_fops);
+       proc_net_fops_create(&init_net, "rose_nodes", S_IRUGO, &rose_nodes_fops);
+       proc_net_fops_create(&init_net, "rose_routes", S_IRUGO, &rose_routes_fops);
 out:
        return rc;
 fail:
@@ -1606,10 +1625,10 @@ static void __exit rose_exit(void)
 {
        int i;
 
-       proc_net_remove("rose");
-       proc_net_remove("rose_neigh");
-       proc_net_remove("rose_nodes");
-       proc_net_remove("rose_routes");
+       proc_net_remove(&init_net, "rose");
+       proc_net_remove(&init_net, "rose_neigh");
+       proc_net_remove(&init_net, "rose_nodes");
+       proc_net_remove(&init_net, "rose_routes");
        rose_loopback_clear();
 
        rose_rt_free();