| 1 | /* |
| 2 | * NETLINK Kernel-user communication protocol. |
| 3 | * |
| 4 | * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk> |
| 5 | * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> |
| 6 | * Patrick McHardy <kaber@trash.net> |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or |
| 9 | * modify it under the terms of the GNU General Public License |
| 10 | * as published by the Free Software Foundation; either version |
| 11 | * 2 of the License, or (at your option) any later version. |
| 12 | * |
| 13 | * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith |
| 14 | * added netlink_proto_exit |
| 15 | * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br> |
| 16 | * use nlk_sk, as sk->protinfo is on a diet 8) |
| 17 | * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org> |
| 18 | * - inc module use count of module that owns |
| 19 | * the kernel socket in case userspace opens |
| 20 | * socket of same protocol |
| 21 | * - remove all module support, since netlink is |
| 22 | * mandatory if CONFIG_NET=y these days |
| 23 | */ |
| 24 | |
| 25 | #include <linux/module.h> |
| 26 | |
| 27 | #include <linux/capability.h> |
| 28 | #include <linux/kernel.h> |
| 29 | #include <linux/init.h> |
| 30 | #include <linux/signal.h> |
| 31 | #include <linux/sched.h> |
| 32 | #include <linux/errno.h> |
| 33 | #include <linux/string.h> |
| 34 | #include <linux/stat.h> |
| 35 | #include <linux/socket.h> |
| 36 | #include <linux/un.h> |
| 37 | #include <linux/fcntl.h> |
| 38 | #include <linux/termios.h> |
| 39 | #include <linux/sockios.h> |
| 40 | #include <linux/net.h> |
| 41 | #include <linux/fs.h> |
| 42 | #include <linux/slab.h> |
| 43 | #include <asm/uaccess.h> |
| 44 | #include <linux/skbuff.h> |
| 45 | #include <linux/netdevice.h> |
| 46 | #include <linux/rtnetlink.h> |
| 47 | #include <linux/proc_fs.h> |
| 48 | #include <linux/seq_file.h> |
| 49 | #include <linux/notifier.h> |
| 50 | #include <linux/security.h> |
| 51 | #include <linux/jhash.h> |
| 52 | #include <linux/jiffies.h> |
| 53 | #include <linux/random.h> |
| 54 | #include <linux/bitops.h> |
| 55 | #include <linux/mm.h> |
| 56 | #include <linux/types.h> |
| 57 | #include <linux/audit.h> |
| 58 | #include <linux/mutex.h> |
| 59 | #include <linux/vmalloc.h> |
| 60 | #include <linux/if_arp.h> |
| 61 | #include <linux/rhashtable.h> |
| 62 | #include <asm/cacheflush.h> |
| 63 | #include <linux/hash.h> |
| 64 | |
| 65 | #include <net/net_namespace.h> |
| 66 | #include <net/sock.h> |
| 67 | #include <net/scm.h> |
| 68 | #include <net/netlink.h> |
| 69 | |
| 70 | #include "af_netlink.h" |
| 71 | |
| 72 | struct listeners { |
| 73 | struct rcu_head rcu; |
| 74 | unsigned long masks[0]; |
| 75 | }; |
| 76 | |
| 77 | /* state bits */ |
| 78 | #define NETLINK_CONGESTED 0x0 |
| 79 | |
| 80 | /* flags */ |
| 81 | #define NETLINK_KERNEL_SOCKET 0x1 |
| 82 | #define NETLINK_RECV_PKTINFO 0x2 |
| 83 | #define NETLINK_BROADCAST_SEND_ERROR 0x4 |
| 84 | #define NETLINK_RECV_NO_ENOBUFS 0x8 |
| 85 | |
| 86 | static inline int netlink_is_kernel(struct sock *sk) |
| 87 | { |
| 88 | return nlk_sk(sk)->flags & NETLINK_KERNEL_SOCKET; |
| 89 | } |
| 90 | |
| 91 | struct netlink_table *nl_table; |
| 92 | EXPORT_SYMBOL_GPL(nl_table); |
| 93 | |
| 94 | static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); |
| 95 | |
| 96 | static int netlink_dump(struct sock *sk); |
| 97 | static void netlink_skb_destructor(struct sk_buff *skb); |
| 98 | |
| 99 | /* nl_table locking explained: |
| 100 | * Lookup and traversal are protected with nl_sk_hash_lock or nl_table_lock |
| 101 | * combined with an RCU read-side lock. Insertion and removal are protected |
| 102 | * with nl_sk_hash_lock while using RCU list modification primitives and may |
| 103 | * run in parallel to nl_table_lock protected lookups. Destruction of the |
| 104 | * Netlink socket may only occur *after* nl_table_lock has been acquired |
| 105 | * either during or after the socket has been removed from the list. |
| 106 | */ |
| 107 | DEFINE_RWLOCK(nl_table_lock); |
| 108 | EXPORT_SYMBOL_GPL(nl_table_lock); |
| 109 | static atomic_t nl_table_users = ATOMIC_INIT(0); |
| 110 | |
| 111 | #define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock)); |
| 112 | |
| 113 | /* Protects netlink socket hash table mutations */ |
| 114 | DEFINE_MUTEX(nl_sk_hash_lock); |
| 115 | EXPORT_SYMBOL_GPL(nl_sk_hash_lock); |
| 116 | |
| 117 | #ifdef CONFIG_PROVE_LOCKING |
| 118 | static int lockdep_nl_sk_hash_is_held(void *parent) |
| 119 | { |
| 120 | if (debug_locks) |
| 121 | return lockdep_is_held(&nl_sk_hash_lock) || lockdep_is_held(&nl_table_lock); |
| 122 | return 1; |
| 123 | } |
| 124 | #endif |
| 125 | |
| 126 | static ATOMIC_NOTIFIER_HEAD(netlink_chain); |
| 127 | |
| 128 | static DEFINE_SPINLOCK(netlink_tap_lock); |
| 129 | static struct list_head netlink_tap_all __read_mostly; |
| 130 | |
| 131 | static inline u32 netlink_group_mask(u32 group) |
| 132 | { |
| 133 | return group ? 1 << (group - 1) : 0; |
| 134 | } |
| 135 | |
| 136 | int netlink_add_tap(struct netlink_tap *nt) |
| 137 | { |
| 138 | if (unlikely(nt->dev->type != ARPHRD_NETLINK)) |
| 139 | return -EINVAL; |
| 140 | |
| 141 | spin_lock(&netlink_tap_lock); |
| 142 | list_add_rcu(&nt->list, &netlink_tap_all); |
| 143 | spin_unlock(&netlink_tap_lock); |
| 144 | |
| 145 | __module_get(nt->module); |
| 146 | |
| 147 | return 0; |
| 148 | } |
| 149 | EXPORT_SYMBOL_GPL(netlink_add_tap); |
| 150 | |
| 151 | static int __netlink_remove_tap(struct netlink_tap *nt) |
| 152 | { |
| 153 | bool found = false; |
| 154 | struct netlink_tap *tmp; |
| 155 | |
| 156 | spin_lock(&netlink_tap_lock); |
| 157 | |
| 158 | list_for_each_entry(tmp, &netlink_tap_all, list) { |
| 159 | if (nt == tmp) { |
| 160 | list_del_rcu(&nt->list); |
| 161 | found = true; |
| 162 | goto out; |
| 163 | } |
| 164 | } |
| 165 | |
| 166 | pr_warn("__netlink_remove_tap: %p not found\n", nt); |
| 167 | out: |
| 168 | spin_unlock(&netlink_tap_lock); |
| 169 | |
| 170 | if (found && nt->module) |
| 171 | module_put(nt->module); |
| 172 | |
| 173 | return found ? 0 : -ENODEV; |
| 174 | } |
| 175 | |
| 176 | int netlink_remove_tap(struct netlink_tap *nt) |
| 177 | { |
| 178 | int ret; |
| 179 | |
| 180 | ret = __netlink_remove_tap(nt); |
| 181 | synchronize_net(); |
| 182 | |
| 183 | return ret; |
| 184 | } |
| 185 | EXPORT_SYMBOL_GPL(netlink_remove_tap); |
| 186 | |
| 187 | static bool netlink_filter_tap(const struct sk_buff *skb) |
| 188 | { |
| 189 | struct sock *sk = skb->sk; |
| 190 | |
| 191 | /* We take the more conservative approach and |
| 192 | * whitelist socket protocols that may pass. |
| 193 | */ |
| 194 | switch (sk->sk_protocol) { |
| 195 | case NETLINK_ROUTE: |
| 196 | case NETLINK_USERSOCK: |
| 197 | case NETLINK_SOCK_DIAG: |
| 198 | case NETLINK_NFLOG: |
| 199 | case NETLINK_XFRM: |
| 200 | case NETLINK_FIB_LOOKUP: |
| 201 | case NETLINK_NETFILTER: |
| 202 | case NETLINK_GENERIC: |
| 203 | return true; |
| 204 | } |
| 205 | |
| 206 | return false; |
| 207 | } |
| 208 | |
| 209 | static int __netlink_deliver_tap_skb(struct sk_buff *skb, |
| 210 | struct net_device *dev) |
| 211 | { |
| 212 | struct sk_buff *nskb; |
| 213 | struct sock *sk = skb->sk; |
| 214 | int ret = -ENOMEM; |
| 215 | |
| 216 | dev_hold(dev); |
| 217 | nskb = skb_clone(skb, GFP_ATOMIC); |
| 218 | if (nskb) { |
| 219 | nskb->dev = dev; |
| 220 | nskb->protocol = htons((u16) sk->sk_protocol); |
| 221 | nskb->pkt_type = netlink_is_kernel(sk) ? |
| 222 | PACKET_KERNEL : PACKET_USER; |
| 223 | skb_reset_network_header(nskb); |
| 224 | ret = dev_queue_xmit(nskb); |
| 225 | if (unlikely(ret > 0)) |
| 226 | ret = net_xmit_errno(ret); |
| 227 | } |
| 228 | |
| 229 | dev_put(dev); |
| 230 | return ret; |
| 231 | } |
| 232 | |
| 233 | static void __netlink_deliver_tap(struct sk_buff *skb) |
| 234 | { |
| 235 | int ret; |
| 236 | struct netlink_tap *tmp; |
| 237 | |
| 238 | if (!netlink_filter_tap(skb)) |
| 239 | return; |
| 240 | |
| 241 | list_for_each_entry_rcu(tmp, &netlink_tap_all, list) { |
| 242 | ret = __netlink_deliver_tap_skb(skb, tmp->dev); |
| 243 | if (unlikely(ret)) |
| 244 | break; |
| 245 | } |
| 246 | } |
| 247 | |
| 248 | static void netlink_deliver_tap(struct sk_buff *skb) |
| 249 | { |
| 250 | rcu_read_lock(); |
| 251 | |
| 252 | if (unlikely(!list_empty(&netlink_tap_all))) |
| 253 | __netlink_deliver_tap(skb); |
| 254 | |
| 255 | rcu_read_unlock(); |
| 256 | } |
| 257 | |
| 258 | static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src, |
| 259 | struct sk_buff *skb) |
| 260 | { |
| 261 | if (!(netlink_is_kernel(dst) && netlink_is_kernel(src))) |
| 262 | netlink_deliver_tap(skb); |
| 263 | } |
| 264 | |
| 265 | static void netlink_overrun(struct sock *sk) |
| 266 | { |
| 267 | struct netlink_sock *nlk = nlk_sk(sk); |
| 268 | |
| 269 | if (!(nlk->flags & NETLINK_RECV_NO_ENOBUFS)) { |
| 270 | if (!test_and_set_bit(NETLINK_CONGESTED, &nlk_sk(sk)->state)) { |
| 271 | sk->sk_err = ENOBUFS; |
| 272 | sk->sk_error_report(sk); |
| 273 | } |
| 274 | } |
| 275 | atomic_inc(&sk->sk_drops); |
| 276 | } |
| 277 | |
| 278 | static void netlink_rcv_wake(struct sock *sk) |
| 279 | { |
| 280 | struct netlink_sock *nlk = nlk_sk(sk); |
| 281 | |
| 282 | if (skb_queue_empty(&sk->sk_receive_queue)) |
| 283 | clear_bit(NETLINK_CONGESTED, &nlk->state); |
| 284 | if (!test_bit(NETLINK_CONGESTED, &nlk->state)) |
| 285 | wake_up_interruptible(&nlk->wait); |
| 286 | } |
| 287 | |
| 288 | #ifdef CONFIG_NETLINK_MMAP |
| 289 | static bool netlink_skb_is_mmaped(const struct sk_buff *skb) |
| 290 | { |
| 291 | return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED; |
| 292 | } |
| 293 | |
| 294 | static bool netlink_rx_is_mmaped(struct sock *sk) |
| 295 | { |
| 296 | return nlk_sk(sk)->rx_ring.pg_vec != NULL; |
| 297 | } |
| 298 | |
| 299 | static bool netlink_tx_is_mmaped(struct sock *sk) |
| 300 | { |
| 301 | return nlk_sk(sk)->tx_ring.pg_vec != NULL; |
| 302 | } |
| 303 | |
| 304 | static __pure struct page *pgvec_to_page(const void *addr) |
| 305 | { |
| 306 | if (is_vmalloc_addr(addr)) |
| 307 | return vmalloc_to_page(addr); |
| 308 | else |
| 309 | return virt_to_page(addr); |
| 310 | } |
| 311 | |
| 312 | static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len) |
| 313 | { |
| 314 | unsigned int i; |
| 315 | |
| 316 | for (i = 0; i < len; i++) { |
| 317 | if (pg_vec[i] != NULL) { |
| 318 | if (is_vmalloc_addr(pg_vec[i])) |
| 319 | vfree(pg_vec[i]); |
| 320 | else |
| 321 | free_pages((unsigned long)pg_vec[i], order); |
| 322 | } |
| 323 | } |
| 324 | kfree(pg_vec); |
| 325 | } |
| 326 | |
| 327 | static void *alloc_one_pg_vec_page(unsigned long order) |
| 328 | { |
| 329 | void *buffer; |
| 330 | gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO | |
| 331 | __GFP_NOWARN | __GFP_NORETRY; |
| 332 | |
| 333 | buffer = (void *)__get_free_pages(gfp_flags, order); |
| 334 | if (buffer != NULL) |
| 335 | return buffer; |
| 336 | |
| 337 | buffer = vzalloc((1 << order) * PAGE_SIZE); |
| 338 | if (buffer != NULL) |
| 339 | return buffer; |
| 340 | |
| 341 | gfp_flags &= ~__GFP_NORETRY; |
| 342 | return (void *)__get_free_pages(gfp_flags, order); |
| 343 | } |
| 344 | |
| 345 | static void **alloc_pg_vec(struct netlink_sock *nlk, |
| 346 | struct nl_mmap_req *req, unsigned int order) |
| 347 | { |
| 348 | unsigned int block_nr = req->nm_block_nr; |
| 349 | unsigned int i; |
| 350 | void **pg_vec; |
| 351 | |
| 352 | pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL); |
| 353 | if (pg_vec == NULL) |
| 354 | return NULL; |
| 355 | |
| 356 | for (i = 0; i < block_nr; i++) { |
| 357 | pg_vec[i] = alloc_one_pg_vec_page(order); |
| 358 | if (pg_vec[i] == NULL) |
| 359 | goto err1; |
| 360 | } |
| 361 | |
| 362 | return pg_vec; |
| 363 | err1: |
| 364 | free_pg_vec(pg_vec, order, block_nr); |
| 365 | return NULL; |
| 366 | } |
| 367 | |
| 368 | static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, |
| 369 | bool closing, bool tx_ring) |
| 370 | { |
| 371 | struct netlink_sock *nlk = nlk_sk(sk); |
| 372 | struct netlink_ring *ring; |
| 373 | struct sk_buff_head *queue; |
| 374 | void **pg_vec = NULL; |
| 375 | unsigned int order = 0; |
| 376 | int err; |
| 377 | |
| 378 | ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; |
| 379 | queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; |
| 380 | |
| 381 | if (!closing) { |
| 382 | if (atomic_read(&nlk->mapped)) |
| 383 | return -EBUSY; |
| 384 | if (atomic_read(&ring->pending)) |
| 385 | return -EBUSY; |
| 386 | } |
| 387 | |
| 388 | if (req->nm_block_nr) { |
| 389 | if (ring->pg_vec != NULL) |
| 390 | return -EBUSY; |
| 391 | |
| 392 | if ((int)req->nm_block_size <= 0) |
| 393 | return -EINVAL; |
| 394 | if (!PAGE_ALIGNED(req->nm_block_size)) |
| 395 | return -EINVAL; |
| 396 | if (req->nm_frame_size < NL_MMAP_HDRLEN) |
| 397 | return -EINVAL; |
| 398 | if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT)) |
| 399 | return -EINVAL; |
| 400 | |
| 401 | ring->frames_per_block = req->nm_block_size / |
| 402 | req->nm_frame_size; |
| 403 | if (ring->frames_per_block == 0) |
| 404 | return -EINVAL; |
| 405 | if (ring->frames_per_block * req->nm_block_nr != |
| 406 | req->nm_frame_nr) |
| 407 | return -EINVAL; |
| 408 | |
| 409 | order = get_order(req->nm_block_size); |
| 410 | pg_vec = alloc_pg_vec(nlk, req, order); |
| 411 | if (pg_vec == NULL) |
| 412 | return -ENOMEM; |
| 413 | } else { |
| 414 | if (req->nm_frame_nr) |
| 415 | return -EINVAL; |
| 416 | } |
| 417 | |
| 418 | err = -EBUSY; |
| 419 | mutex_lock(&nlk->pg_vec_lock); |
| 420 | if (closing || atomic_read(&nlk->mapped) == 0) { |
| 421 | err = 0; |
| 422 | spin_lock_bh(&queue->lock); |
| 423 | |
| 424 | ring->frame_max = req->nm_frame_nr - 1; |
| 425 | ring->head = 0; |
| 426 | ring->frame_size = req->nm_frame_size; |
| 427 | ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; |
| 428 | |
| 429 | swap(ring->pg_vec_len, req->nm_block_nr); |
| 430 | swap(ring->pg_vec_order, order); |
| 431 | swap(ring->pg_vec, pg_vec); |
| 432 | |
| 433 | __skb_queue_purge(queue); |
| 434 | spin_unlock_bh(&queue->lock); |
| 435 | |
| 436 | WARN_ON(atomic_read(&nlk->mapped)); |
| 437 | } |
| 438 | mutex_unlock(&nlk->pg_vec_lock); |
| 439 | |
| 440 | if (pg_vec) |
| 441 | free_pg_vec(pg_vec, order, req->nm_block_nr); |
| 442 | return err; |
| 443 | } |
| 444 | |
| 445 | static void netlink_mm_open(struct vm_area_struct *vma) |
| 446 | { |
| 447 | struct file *file = vma->vm_file; |
| 448 | struct socket *sock = file->private_data; |
| 449 | struct sock *sk = sock->sk; |
| 450 | |
| 451 | if (sk) |
| 452 | atomic_inc(&nlk_sk(sk)->mapped); |
| 453 | } |
| 454 | |
| 455 | static void netlink_mm_close(struct vm_area_struct *vma) |
| 456 | { |
| 457 | struct file *file = vma->vm_file; |
| 458 | struct socket *sock = file->private_data; |
| 459 | struct sock *sk = sock->sk; |
| 460 | |
| 461 | if (sk) |
| 462 | atomic_dec(&nlk_sk(sk)->mapped); |
| 463 | } |
| 464 | |
| 465 | static const struct vm_operations_struct netlink_mmap_ops = { |
| 466 | .open = netlink_mm_open, |
| 467 | .close = netlink_mm_close, |
| 468 | }; |
| 469 | |
| 470 | static int netlink_mmap(struct file *file, struct socket *sock, |
| 471 | struct vm_area_struct *vma) |
| 472 | { |
| 473 | struct sock *sk = sock->sk; |
| 474 | struct netlink_sock *nlk = nlk_sk(sk); |
| 475 | struct netlink_ring *ring; |
| 476 | unsigned long start, size, expected; |
| 477 | unsigned int i; |
| 478 | int err = -EINVAL; |
| 479 | |
| 480 | if (vma->vm_pgoff) |
| 481 | return -EINVAL; |
| 482 | |
| 483 | mutex_lock(&nlk->pg_vec_lock); |
| 484 | |
| 485 | expected = 0; |
| 486 | for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { |
| 487 | if (ring->pg_vec == NULL) |
| 488 | continue; |
| 489 | expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE; |
| 490 | } |
| 491 | |
| 492 | if (expected == 0) |
| 493 | goto out; |
| 494 | |
| 495 | size = vma->vm_end - vma->vm_start; |
| 496 | if (size != expected) |
| 497 | goto out; |
| 498 | |
| 499 | start = vma->vm_start; |
| 500 | for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { |
| 501 | if (ring->pg_vec == NULL) |
| 502 | continue; |
| 503 | |
| 504 | for (i = 0; i < ring->pg_vec_len; i++) { |
| 505 | struct page *page; |
| 506 | void *kaddr = ring->pg_vec[i]; |
| 507 | unsigned int pg_num; |
| 508 | |
| 509 | for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) { |
| 510 | page = pgvec_to_page(kaddr); |
| 511 | err = vm_insert_page(vma, start, page); |
| 512 | if (err < 0) |
| 513 | goto out; |
| 514 | start += PAGE_SIZE; |
| 515 | kaddr += PAGE_SIZE; |
| 516 | } |
| 517 | } |
| 518 | } |
| 519 | |
| 520 | atomic_inc(&nlk->mapped); |
| 521 | vma->vm_ops = &netlink_mmap_ops; |
| 522 | err = 0; |
| 523 | out: |
| 524 | mutex_unlock(&nlk->pg_vec_lock); |
| 525 | return err; |
| 526 | } |
| 527 | |
| 528 | static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) |
| 529 | { |
| 530 | #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 |
| 531 | struct page *p_start, *p_end; |
| 532 | |
| 533 | /* First page is flushed through netlink_{get,set}_status */ |
| 534 | p_start = pgvec_to_page(hdr + PAGE_SIZE); |
| 535 | p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); |
| 536 | while (p_start <= p_end) { |
| 537 | flush_dcache_page(p_start); |
| 538 | p_start++; |
| 539 | } |
| 540 | #endif |
| 541 | } |
| 542 | |
| 543 | static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) |
| 544 | { |
| 545 | smp_rmb(); |
| 546 | flush_dcache_page(pgvec_to_page(hdr)); |
| 547 | return hdr->nm_status; |
| 548 | } |
| 549 | |
| 550 | static void netlink_set_status(struct nl_mmap_hdr *hdr, |
| 551 | enum nl_mmap_status status) |
| 552 | { |
| 553 | smp_mb(); |
| 554 | hdr->nm_status = status; |
| 555 | flush_dcache_page(pgvec_to_page(hdr)); |
| 556 | } |
| 557 | |
| 558 | static struct nl_mmap_hdr * |
| 559 | __netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos) |
| 560 | { |
| 561 | unsigned int pg_vec_pos, frame_off; |
| 562 | |
| 563 | pg_vec_pos = pos / ring->frames_per_block; |
| 564 | frame_off = pos % ring->frames_per_block; |
| 565 | |
| 566 | return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size); |
| 567 | } |
| 568 | |
| 569 | static struct nl_mmap_hdr * |
| 570 | netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos, |
| 571 | enum nl_mmap_status status) |
| 572 | { |
| 573 | struct nl_mmap_hdr *hdr; |
| 574 | |
| 575 | hdr = __netlink_lookup_frame(ring, pos); |
| 576 | if (netlink_get_status(hdr) != status) |
| 577 | return NULL; |
| 578 | |
| 579 | return hdr; |
| 580 | } |
| 581 | |
| 582 | static struct nl_mmap_hdr * |
| 583 | netlink_current_frame(const struct netlink_ring *ring, |
| 584 | enum nl_mmap_status status) |
| 585 | { |
| 586 | return netlink_lookup_frame(ring, ring->head, status); |
| 587 | } |
| 588 | |
| 589 | static struct nl_mmap_hdr * |
| 590 | netlink_previous_frame(const struct netlink_ring *ring, |
| 591 | enum nl_mmap_status status) |
| 592 | { |
| 593 | unsigned int prev; |
| 594 | |
| 595 | prev = ring->head ? ring->head - 1 : ring->frame_max; |
| 596 | return netlink_lookup_frame(ring, prev, status); |
| 597 | } |
| 598 | |
| 599 | static void netlink_increment_head(struct netlink_ring *ring) |
| 600 | { |
| 601 | ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0; |
| 602 | } |
| 603 | |
| 604 | static void netlink_forward_ring(struct netlink_ring *ring) |
| 605 | { |
| 606 | unsigned int head = ring->head, pos = head; |
| 607 | const struct nl_mmap_hdr *hdr; |
| 608 | |
| 609 | do { |
| 610 | hdr = __netlink_lookup_frame(ring, pos); |
| 611 | if (hdr->nm_status == NL_MMAP_STATUS_UNUSED) |
| 612 | break; |
| 613 | if (hdr->nm_status != NL_MMAP_STATUS_SKIP) |
| 614 | break; |
| 615 | netlink_increment_head(ring); |
| 616 | } while (ring->head != head); |
| 617 | } |
| 618 | |
| 619 | static bool netlink_dump_space(struct netlink_sock *nlk) |
| 620 | { |
| 621 | struct netlink_ring *ring = &nlk->rx_ring; |
| 622 | struct nl_mmap_hdr *hdr; |
| 623 | unsigned int n; |
| 624 | |
| 625 | hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); |
| 626 | if (hdr == NULL) |
| 627 | return false; |
| 628 | |
| 629 | n = ring->head + ring->frame_max / 2; |
| 630 | if (n > ring->frame_max) |
| 631 | n -= ring->frame_max; |
| 632 | |
| 633 | hdr = __netlink_lookup_frame(ring, n); |
| 634 | |
| 635 | return hdr->nm_status == NL_MMAP_STATUS_UNUSED; |
| 636 | } |
| 637 | |
| 638 | static unsigned int netlink_poll(struct file *file, struct socket *sock, |
| 639 | poll_table *wait) |
| 640 | { |
| 641 | struct sock *sk = sock->sk; |
| 642 | struct netlink_sock *nlk = nlk_sk(sk); |
| 643 | unsigned int mask; |
| 644 | int err; |
| 645 | |
| 646 | if (nlk->rx_ring.pg_vec != NULL) { |
| 647 | /* Memory mapped sockets don't call recvmsg(), so flow control |
| 648 | * for dumps is performed here. A dump is allowed to continue |
| 649 | * if at least half the ring is unused. |
| 650 | */ |
| 651 | while (nlk->cb_running && netlink_dump_space(nlk)) { |
| 652 | err = netlink_dump(sk); |
| 653 | if (err < 0) { |
| 654 | sk->sk_err = -err; |
| 655 | sk->sk_error_report(sk); |
| 656 | break; |
| 657 | } |
| 658 | } |
| 659 | netlink_rcv_wake(sk); |
| 660 | } |
| 661 | |
| 662 | mask = datagram_poll(file, sock, wait); |
| 663 | |
| 664 | spin_lock_bh(&sk->sk_receive_queue.lock); |
| 665 | if (nlk->rx_ring.pg_vec) { |
| 666 | netlink_forward_ring(&nlk->rx_ring); |
| 667 | if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED)) |
| 668 | mask |= POLLIN | POLLRDNORM; |
| 669 | } |
| 670 | spin_unlock_bh(&sk->sk_receive_queue.lock); |
| 671 | |
| 672 | spin_lock_bh(&sk->sk_write_queue.lock); |
| 673 | if (nlk->tx_ring.pg_vec) { |
| 674 | if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED)) |
| 675 | mask |= POLLOUT | POLLWRNORM; |
| 676 | } |
| 677 | spin_unlock_bh(&sk->sk_write_queue.lock); |
| 678 | |
| 679 | return mask; |
| 680 | } |
| 681 | |
| 682 | static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb) |
| 683 | { |
| 684 | return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN); |
| 685 | } |
| 686 | |
| 687 | static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk, |
| 688 | struct netlink_ring *ring, |
| 689 | struct nl_mmap_hdr *hdr) |
| 690 | { |
| 691 | unsigned int size; |
| 692 | void *data; |
| 693 | |
| 694 | size = ring->frame_size - NL_MMAP_HDRLEN; |
| 695 | data = (void *)hdr + NL_MMAP_HDRLEN; |
| 696 | |
| 697 | skb->head = data; |
| 698 | skb->data = data; |
| 699 | skb_reset_tail_pointer(skb); |
| 700 | skb->end = skb->tail + size; |
| 701 | skb->len = 0; |
| 702 | |
| 703 | skb->destructor = netlink_skb_destructor; |
| 704 | NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED; |
| 705 | NETLINK_CB(skb).sk = sk; |
| 706 | } |
| 707 | |
| 708 | static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, |
| 709 | u32 dst_portid, u32 dst_group, |
| 710 | struct sock_iocb *siocb) |
| 711 | { |
| 712 | struct netlink_sock *nlk = nlk_sk(sk); |
| 713 | struct netlink_ring *ring; |
| 714 | struct nl_mmap_hdr *hdr; |
| 715 | struct sk_buff *skb; |
| 716 | unsigned int maxlen; |
| 717 | int err = 0, len = 0; |
| 718 | |
| 719 | mutex_lock(&nlk->pg_vec_lock); |
| 720 | |
| 721 | ring = &nlk->tx_ring; |
| 722 | maxlen = ring->frame_size - NL_MMAP_HDRLEN; |
| 723 | |
| 724 | do { |
| 725 | unsigned int nm_len; |
| 726 | |
| 727 | hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); |
| 728 | if (hdr == NULL) { |
| 729 | if (!(msg->msg_flags & MSG_DONTWAIT) && |
| 730 | atomic_read(&nlk->tx_ring.pending)) |
| 731 | schedule(); |
| 732 | continue; |
| 733 | } |
| 734 | |
| 735 | nm_len = ACCESS_ONCE(hdr->nm_len); |
| 736 | if (nm_len > maxlen) { |
| 737 | err = -EINVAL; |
| 738 | goto out; |
| 739 | } |
| 740 | |
| 741 | netlink_frame_flush_dcache(hdr, nm_len); |
| 742 | |
| 743 | skb = alloc_skb(nm_len, GFP_KERNEL); |
| 744 | if (skb == NULL) { |
| 745 | err = -ENOBUFS; |
| 746 | goto out; |
| 747 | } |
| 748 | __skb_put(skb, nm_len); |
| 749 | memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); |
| 750 | netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); |
| 751 | |
| 752 | netlink_increment_head(ring); |
| 753 | |
| 754 | NETLINK_CB(skb).portid = nlk->portid; |
| 755 | NETLINK_CB(skb).dst_group = dst_group; |
| 756 | NETLINK_CB(skb).creds = siocb->scm->creds; |
| 757 | |
| 758 | err = security_netlink_send(sk, skb); |
| 759 | if (err) { |
| 760 | kfree_skb(skb); |
| 761 | goto out; |
| 762 | } |
| 763 | |
| 764 | if (unlikely(dst_group)) { |
| 765 | atomic_inc(&skb->users); |
| 766 | netlink_broadcast(sk, skb, dst_portid, dst_group, |
| 767 | GFP_KERNEL); |
| 768 | } |
| 769 | err = netlink_unicast(sk, skb, dst_portid, |
| 770 | msg->msg_flags & MSG_DONTWAIT); |
| 771 | if (err < 0) |
| 772 | goto out; |
| 773 | len += err; |
| 774 | |
| 775 | } while (hdr != NULL || |
| 776 | (!(msg->msg_flags & MSG_DONTWAIT) && |
| 777 | atomic_read(&nlk->tx_ring.pending))); |
| 778 | |
| 779 | if (len > 0) |
| 780 | err = len; |
| 781 | out: |
| 782 | mutex_unlock(&nlk->pg_vec_lock); |
| 783 | return err; |
| 784 | } |
| 785 | |
| 786 | static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) |
| 787 | { |
| 788 | struct nl_mmap_hdr *hdr; |
| 789 | |
| 790 | hdr = netlink_mmap_hdr(skb); |
| 791 | hdr->nm_len = skb->len; |
| 792 | hdr->nm_group = NETLINK_CB(skb).dst_group; |
| 793 | hdr->nm_pid = NETLINK_CB(skb).creds.pid; |
| 794 | hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); |
| 795 | hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); |
| 796 | netlink_frame_flush_dcache(hdr, hdr->nm_len); |
| 797 | netlink_set_status(hdr, NL_MMAP_STATUS_VALID); |
| 798 | |
| 799 | NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; |
| 800 | kfree_skb(skb); |
| 801 | } |
| 802 | |
| 803 | static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb) |
| 804 | { |
| 805 | struct netlink_sock *nlk = nlk_sk(sk); |
| 806 | struct netlink_ring *ring = &nlk->rx_ring; |
| 807 | struct nl_mmap_hdr *hdr; |
| 808 | |
| 809 | spin_lock_bh(&sk->sk_receive_queue.lock); |
| 810 | hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); |
| 811 | if (hdr == NULL) { |
| 812 | spin_unlock_bh(&sk->sk_receive_queue.lock); |
| 813 | kfree_skb(skb); |
| 814 | netlink_overrun(sk); |
| 815 | return; |
| 816 | } |
| 817 | netlink_increment_head(ring); |
| 818 | __skb_queue_tail(&sk->sk_receive_queue, skb); |
| 819 | spin_unlock_bh(&sk->sk_receive_queue.lock); |
| 820 | |
| 821 | hdr->nm_len = skb->len; |
| 822 | hdr->nm_group = NETLINK_CB(skb).dst_group; |
| 823 | hdr->nm_pid = NETLINK_CB(skb).creds.pid; |
| 824 | hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); |
| 825 | hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); |
| 826 | netlink_set_status(hdr, NL_MMAP_STATUS_COPY); |
| 827 | } |
| 828 | |
| 829 | #else /* CONFIG_NETLINK_MMAP */ |
| 830 | #define netlink_skb_is_mmaped(skb) false |
| 831 | #define netlink_rx_is_mmaped(sk) false |
| 832 | #define netlink_tx_is_mmaped(sk) false |
| 833 | #define netlink_mmap sock_no_mmap |
| 834 | #define netlink_poll datagram_poll |
| 835 | #define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, siocb) 0 |
| 836 | #endif /* CONFIG_NETLINK_MMAP */ |
| 837 | |
| 838 | static void netlink_skb_destructor(struct sk_buff *skb) |
| 839 | { |
| 840 | #ifdef CONFIG_NETLINK_MMAP |
| 841 | struct nl_mmap_hdr *hdr; |
| 842 | struct netlink_ring *ring; |
| 843 | struct sock *sk; |
| 844 | |
| 845 | /* If a packet from the kernel to userspace was freed because of an |
| 846 | * error without being delivered to userspace, the kernel must reset |
| 847 | * the status. In the direction userspace to kernel, the status is |
| 848 | * always reset here after the packet was processed and freed. |
| 849 | */ |
| 850 | if (netlink_skb_is_mmaped(skb)) { |
| 851 | hdr = netlink_mmap_hdr(skb); |
| 852 | sk = NETLINK_CB(skb).sk; |
| 853 | |
| 854 | if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) { |
| 855 | netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); |
| 856 | ring = &nlk_sk(sk)->tx_ring; |
| 857 | } else { |
| 858 | if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) { |
| 859 | hdr->nm_len = 0; |
| 860 | netlink_set_status(hdr, NL_MMAP_STATUS_VALID); |
| 861 | } |
| 862 | ring = &nlk_sk(sk)->rx_ring; |
| 863 | } |
| 864 | |
| 865 | WARN_ON(atomic_read(&ring->pending) == 0); |
| 866 | atomic_dec(&ring->pending); |
| 867 | sock_put(sk); |
| 868 | |
| 869 | skb->head = NULL; |
| 870 | } |
| 871 | #endif |
| 872 | if (is_vmalloc_addr(skb->head)) { |
| 873 | if (!skb->cloned || |
| 874 | !atomic_dec_return(&(skb_shinfo(skb)->dataref))) |
| 875 | vfree(skb->head); |
| 876 | |
| 877 | skb->head = NULL; |
| 878 | } |
| 879 | if (skb->sk != NULL) |
| 880 | sock_rfree(skb); |
| 881 | } |
| 882 | |
| 883 | static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) |
| 884 | { |
| 885 | WARN_ON(skb->sk != NULL); |
| 886 | skb->sk = sk; |
| 887 | skb->destructor = netlink_skb_destructor; |
| 888 | atomic_add(skb->truesize, &sk->sk_rmem_alloc); |
| 889 | sk_mem_charge(sk, skb->truesize); |
| 890 | } |
| 891 | |
| 892 | static void netlink_sock_destruct(struct sock *sk) |
| 893 | { |
| 894 | struct netlink_sock *nlk = nlk_sk(sk); |
| 895 | |
| 896 | if (nlk->cb_running) { |
| 897 | if (nlk->cb.done) |
| 898 | nlk->cb.done(&nlk->cb); |
| 899 | |
| 900 | module_put(nlk->cb.module); |
| 901 | kfree_skb(nlk->cb.skb); |
| 902 | } |
| 903 | |
| 904 | skb_queue_purge(&sk->sk_receive_queue); |
| 905 | #ifdef CONFIG_NETLINK_MMAP |
| 906 | if (1) { |
| 907 | struct nl_mmap_req req; |
| 908 | |
| 909 | memset(&req, 0, sizeof(req)); |
| 910 | if (nlk->rx_ring.pg_vec) |
| 911 | netlink_set_ring(sk, &req, true, false); |
| 912 | memset(&req, 0, sizeof(req)); |
| 913 | if (nlk->tx_ring.pg_vec) |
| 914 | netlink_set_ring(sk, &req, true, true); |
| 915 | } |
| 916 | #endif /* CONFIG_NETLINK_MMAP */ |
| 917 | |
| 918 | if (!sock_flag(sk, SOCK_DEAD)) { |
| 919 | printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); |
| 920 | return; |
| 921 | } |
| 922 | |
| 923 | WARN_ON(atomic_read(&sk->sk_rmem_alloc)); |
| 924 | WARN_ON(atomic_read(&sk->sk_wmem_alloc)); |
| 925 | WARN_ON(nlk_sk(sk)->groups); |
| 926 | } |
| 927 | |
| 928 | /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on |
| 929 | * SMP. Look, when several writers sleep and reader wakes them up, all but one |
| 930 | * immediately hit write lock and grab all the cpus. Exclusive sleep solves |
| 931 | * this, _but_ remember, it adds useless work on UP machines. |
| 932 | */ |
| 933 | |
| 934 | void netlink_table_grab(void) |
| 935 | __acquires(nl_table_lock) |
| 936 | { |
| 937 | might_sleep(); |
| 938 | |
| 939 | write_lock_irq(&nl_table_lock); |
| 940 | |
| 941 | if (atomic_read(&nl_table_users)) { |
| 942 | DECLARE_WAITQUEUE(wait, current); |
| 943 | |
| 944 | add_wait_queue_exclusive(&nl_table_wait, &wait); |
| 945 | for (;;) { |
| 946 | set_current_state(TASK_UNINTERRUPTIBLE); |
| 947 | if (atomic_read(&nl_table_users) == 0) |
| 948 | break; |
| 949 | write_unlock_irq(&nl_table_lock); |
| 950 | schedule(); |
| 951 | write_lock_irq(&nl_table_lock); |
| 952 | } |
| 953 | |
| 954 | __set_current_state(TASK_RUNNING); |
| 955 | remove_wait_queue(&nl_table_wait, &wait); |
| 956 | } |
| 957 | } |
| 958 | |
| 959 | void netlink_table_ungrab(void) |
| 960 | __releases(nl_table_lock) |
| 961 | { |
| 962 | write_unlock_irq(&nl_table_lock); |
| 963 | wake_up(&nl_table_wait); |
| 964 | } |
| 965 | |
| 966 | static inline void |
| 967 | netlink_lock_table(void) |
| 968 | { |
| 969 | /* read_lock() synchronizes us to netlink_table_grab */ |
| 970 | |
| 971 | read_lock(&nl_table_lock); |
| 972 | atomic_inc(&nl_table_users); |
| 973 | read_unlock(&nl_table_lock); |
| 974 | } |
| 975 | |
| 976 | static inline void |
| 977 | netlink_unlock_table(void) |
| 978 | { |
| 979 | if (atomic_dec_and_test(&nl_table_users)) |
| 980 | wake_up(&nl_table_wait); |
| 981 | } |
| 982 | |
| 983 | struct netlink_compare_arg |
| 984 | { |
| 985 | struct net *net; |
| 986 | u32 portid; |
| 987 | }; |
| 988 | |
| 989 | static bool netlink_compare(void *ptr, void *arg) |
| 990 | { |
| 991 | struct netlink_compare_arg *x = arg; |
| 992 | struct sock *sk = ptr; |
| 993 | |
| 994 | return nlk_sk(sk)->portid == x->portid && |
| 995 | net_eq(sock_net(sk), x->net); |
| 996 | } |
| 997 | |
| 998 | static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid, |
| 999 | struct net *net) |
| 1000 | { |
| 1001 | struct netlink_compare_arg arg = { |
| 1002 | .net = net, |
| 1003 | .portid = portid, |
| 1004 | }; |
| 1005 | u32 hash; |
| 1006 | |
| 1007 | hash = rhashtable_hashfn(&table->hash, &portid, sizeof(portid)); |
| 1008 | |
| 1009 | return rhashtable_lookup_compare(&table->hash, hash, |
| 1010 | &netlink_compare, &arg); |
| 1011 | } |
| 1012 | |
| 1013 | static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid) |
| 1014 | { |
| 1015 | struct netlink_table *table = &nl_table[protocol]; |
| 1016 | struct sock *sk; |
| 1017 | |
| 1018 | read_lock(&nl_table_lock); |
| 1019 | rcu_read_lock(); |
| 1020 | sk = __netlink_lookup(table, portid, net); |
| 1021 | if (sk) |
| 1022 | sock_hold(sk); |
| 1023 | rcu_read_unlock(); |
| 1024 | read_unlock(&nl_table_lock); |
| 1025 | |
| 1026 | return sk; |
| 1027 | } |
| 1028 | |
| 1029 | static const struct proto_ops netlink_ops; |
| 1030 | |
| 1031 | static void |
| 1032 | netlink_update_listeners(struct sock *sk) |
| 1033 | { |
| 1034 | struct netlink_table *tbl = &nl_table[sk->sk_protocol]; |
| 1035 | unsigned long mask; |
| 1036 | unsigned int i; |
| 1037 | struct listeners *listeners; |
| 1038 | |
| 1039 | listeners = nl_deref_protected(tbl->listeners); |
| 1040 | if (!listeners) |
| 1041 | return; |
| 1042 | |
| 1043 | for (i = 0; i < NLGRPLONGS(tbl->groups); i++) { |
| 1044 | mask = 0; |
| 1045 | sk_for_each_bound(sk, &tbl->mc_list) { |
| 1046 | if (i < NLGRPLONGS(nlk_sk(sk)->ngroups)) |
| 1047 | mask |= nlk_sk(sk)->groups[i]; |
| 1048 | } |
| 1049 | listeners->masks[i] = mask; |
| 1050 | } |
| 1051 | /* this function is only called with the netlink table "grabbed", which |
| 1052 | * makes sure updates are visible before bind or setsockopt return. */ |
| 1053 | } |
| 1054 | |
| 1055 | static int netlink_insert(struct sock *sk, struct net *net, u32 portid) |
| 1056 | { |
| 1057 | struct netlink_table *table = &nl_table[sk->sk_protocol]; |
| 1058 | int err = -EADDRINUSE; |
| 1059 | |
| 1060 | mutex_lock(&nl_sk_hash_lock); |
| 1061 | if (__netlink_lookup(table, portid, net)) |
| 1062 | goto err; |
| 1063 | |
| 1064 | err = -EBUSY; |
| 1065 | if (nlk_sk(sk)->portid) |
| 1066 | goto err; |
| 1067 | |
| 1068 | err = -ENOMEM; |
| 1069 | if (BITS_PER_LONG > 32 && unlikely(table->hash.nelems >= UINT_MAX)) |
| 1070 | goto err; |
| 1071 | |
| 1072 | nlk_sk(sk)->portid = portid; |
| 1073 | sock_hold(sk); |
| 1074 | rhashtable_insert(&table->hash, &nlk_sk(sk)->node); |
| 1075 | err = 0; |
| 1076 | err: |
| 1077 | mutex_unlock(&nl_sk_hash_lock); |
| 1078 | return err; |
| 1079 | } |
| 1080 | |
| 1081 | static void netlink_remove(struct sock *sk) |
| 1082 | { |
| 1083 | struct netlink_table *table; |
| 1084 | |
| 1085 | mutex_lock(&nl_sk_hash_lock); |
| 1086 | table = &nl_table[sk->sk_protocol]; |
| 1087 | if (rhashtable_remove(&table->hash, &nlk_sk(sk)->node)) { |
| 1088 | WARN_ON(atomic_read(&sk->sk_refcnt) == 1); |
| 1089 | __sock_put(sk); |
| 1090 | } |
| 1091 | mutex_unlock(&nl_sk_hash_lock); |
| 1092 | |
| 1093 | netlink_table_grab(); |
| 1094 | if (nlk_sk(sk)->subscriptions) |
| 1095 | __sk_del_bind_node(sk); |
| 1096 | netlink_table_ungrab(); |
| 1097 | } |
| 1098 | |
| 1099 | static struct proto netlink_proto = { |
| 1100 | .name = "NETLINK", |
| 1101 | .owner = THIS_MODULE, |
| 1102 | .obj_size = sizeof(struct netlink_sock), |
| 1103 | }; |
| 1104 | |
| 1105 | static int __netlink_create(struct net *net, struct socket *sock, |
| 1106 | struct mutex *cb_mutex, int protocol) |
| 1107 | { |
| 1108 | struct sock *sk; |
| 1109 | struct netlink_sock *nlk; |
| 1110 | |
| 1111 | sock->ops = &netlink_ops; |
| 1112 | |
| 1113 | sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto); |
| 1114 | if (!sk) |
| 1115 | return -ENOMEM; |
| 1116 | |
| 1117 | sock_init_data(sock, sk); |
| 1118 | |
| 1119 | nlk = nlk_sk(sk); |
| 1120 | if (cb_mutex) { |
| 1121 | nlk->cb_mutex = cb_mutex; |
| 1122 | } else { |
| 1123 | nlk->cb_mutex = &nlk->cb_def_mutex; |
| 1124 | mutex_init(nlk->cb_mutex); |
| 1125 | } |
| 1126 | init_waitqueue_head(&nlk->wait); |
| 1127 | #ifdef CONFIG_NETLINK_MMAP |
| 1128 | mutex_init(&nlk->pg_vec_lock); |
| 1129 | #endif |
| 1130 | |
| 1131 | sk->sk_destruct = netlink_sock_destruct; |
| 1132 | sk->sk_protocol = protocol; |
| 1133 | return 0; |
| 1134 | } |
| 1135 | |
| 1136 | static int netlink_create(struct net *net, struct socket *sock, int protocol, |
| 1137 | int kern) |
| 1138 | { |
| 1139 | struct module *module = NULL; |
| 1140 | struct mutex *cb_mutex; |
| 1141 | struct netlink_sock *nlk; |
| 1142 | int (*bind)(int group); |
| 1143 | void (*unbind)(int group); |
| 1144 | int err = 0; |
| 1145 | |
| 1146 | sock->state = SS_UNCONNECTED; |
| 1147 | |
| 1148 | if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) |
| 1149 | return -ESOCKTNOSUPPORT; |
| 1150 | |
| 1151 | if (protocol < 0 || protocol >= MAX_LINKS) |
| 1152 | return -EPROTONOSUPPORT; |
| 1153 | |
| 1154 | netlink_lock_table(); |
| 1155 | #ifdef CONFIG_MODULES |
| 1156 | if (!nl_table[protocol].registered) { |
| 1157 | netlink_unlock_table(); |
| 1158 | request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol); |
| 1159 | netlink_lock_table(); |
| 1160 | } |
| 1161 | #endif |
| 1162 | if (nl_table[protocol].registered && |
| 1163 | try_module_get(nl_table[protocol].module)) |
| 1164 | module = nl_table[protocol].module; |
| 1165 | else |
| 1166 | err = -EPROTONOSUPPORT; |
| 1167 | cb_mutex = nl_table[protocol].cb_mutex; |
| 1168 | bind = nl_table[protocol].bind; |
| 1169 | unbind = nl_table[protocol].unbind; |
| 1170 | netlink_unlock_table(); |
| 1171 | |
| 1172 | if (err < 0) |
| 1173 | goto out; |
| 1174 | |
| 1175 | err = __netlink_create(net, sock, cb_mutex, protocol); |
| 1176 | if (err < 0) |
| 1177 | goto out_module; |
| 1178 | |
| 1179 | local_bh_disable(); |
| 1180 | sock_prot_inuse_add(net, &netlink_proto, 1); |
| 1181 | local_bh_enable(); |
| 1182 | |
| 1183 | nlk = nlk_sk(sock->sk); |
| 1184 | nlk->module = module; |
| 1185 | nlk->netlink_bind = bind; |
| 1186 | nlk->netlink_unbind = unbind; |
| 1187 | out: |
| 1188 | return err; |
| 1189 | |
| 1190 | out_module: |
| 1191 | module_put(module); |
| 1192 | goto out; |
| 1193 | } |
| 1194 | |
| 1195 | static int netlink_release(struct socket *sock) |
| 1196 | { |
| 1197 | struct sock *sk = sock->sk; |
| 1198 | struct netlink_sock *nlk; |
| 1199 | |
| 1200 | if (!sk) |
| 1201 | return 0; |
| 1202 | |
| 1203 | netlink_remove(sk); |
| 1204 | sock_orphan(sk); |
| 1205 | nlk = nlk_sk(sk); |
| 1206 | |
| 1207 | /* |
| 1208 | * OK. Socket is unlinked, any packets that arrive now |
| 1209 | * will be purged. |
| 1210 | */ |
| 1211 | |
| 1212 | sock->sk = NULL; |
| 1213 | wake_up_interruptible_all(&nlk->wait); |
| 1214 | |
| 1215 | skb_queue_purge(&sk->sk_write_queue); |
| 1216 | |
| 1217 | if (nlk->portid) { |
| 1218 | struct netlink_notify n = { |
| 1219 | .net = sock_net(sk), |
| 1220 | .protocol = sk->sk_protocol, |
| 1221 | .portid = nlk->portid, |
| 1222 | }; |
| 1223 | atomic_notifier_call_chain(&netlink_chain, |
| 1224 | NETLINK_URELEASE, &n); |
| 1225 | } |
| 1226 | |
| 1227 | module_put(nlk->module); |
| 1228 | |
| 1229 | netlink_table_grab(); |
| 1230 | if (netlink_is_kernel(sk)) { |
| 1231 | BUG_ON(nl_table[sk->sk_protocol].registered == 0); |
| 1232 | if (--nl_table[sk->sk_protocol].registered == 0) { |
| 1233 | struct listeners *old; |
| 1234 | |
| 1235 | old = nl_deref_protected(nl_table[sk->sk_protocol].listeners); |
| 1236 | RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL); |
| 1237 | kfree_rcu(old, rcu); |
| 1238 | nl_table[sk->sk_protocol].module = NULL; |
| 1239 | nl_table[sk->sk_protocol].bind = NULL; |
| 1240 | nl_table[sk->sk_protocol].unbind = NULL; |
| 1241 | nl_table[sk->sk_protocol].flags = 0; |
| 1242 | nl_table[sk->sk_protocol].registered = 0; |
| 1243 | } |
| 1244 | } else if (nlk->subscriptions) { |
| 1245 | netlink_update_listeners(sk); |
| 1246 | } |
| 1247 | netlink_table_ungrab(); |
| 1248 | |
| 1249 | kfree(nlk->groups); |
| 1250 | nlk->groups = NULL; |
| 1251 | |
| 1252 | local_bh_disable(); |
| 1253 | sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1); |
| 1254 | local_bh_enable(); |
| 1255 | sock_put(sk); |
| 1256 | return 0; |
| 1257 | } |
| 1258 | |
| 1259 | static int netlink_autobind(struct socket *sock) |
| 1260 | { |
| 1261 | struct sock *sk = sock->sk; |
| 1262 | struct net *net = sock_net(sk); |
| 1263 | struct netlink_table *table = &nl_table[sk->sk_protocol]; |
| 1264 | s32 portid = task_tgid_vnr(current); |
| 1265 | int err; |
| 1266 | static s32 rover = -4097; |
| 1267 | |
| 1268 | retry: |
| 1269 | cond_resched(); |
| 1270 | netlink_table_grab(); |
| 1271 | rcu_read_lock(); |
| 1272 | if (__netlink_lookup(table, portid, net)) { |
| 1273 | /* Bind collision, search negative portid values. */ |
| 1274 | portid = rover--; |
| 1275 | if (rover > -4097) |
| 1276 | rover = -4097; |
| 1277 | rcu_read_unlock(); |
| 1278 | netlink_table_ungrab(); |
| 1279 | goto retry; |
| 1280 | } |
| 1281 | rcu_read_unlock(); |
| 1282 | netlink_table_ungrab(); |
| 1283 | |
| 1284 | err = netlink_insert(sk, net, portid); |
| 1285 | if (err == -EADDRINUSE) |
| 1286 | goto retry; |
| 1287 | |
| 1288 | /* If 2 threads race to autobind, that is fine. */ |
| 1289 | if (err == -EBUSY) |
| 1290 | err = 0; |
| 1291 | |
| 1292 | return err; |
| 1293 | } |
| 1294 | |
| 1295 | /** |
| 1296 | * __netlink_ns_capable - General netlink message capability test |
| 1297 | * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. |
| 1298 | * @user_ns: The user namespace of the capability to use |
| 1299 | * @cap: The capability to use |
| 1300 | * |
| 1301 | * Test to see if the opener of the socket we received the message |
| 1302 | * from had when the netlink socket was created and the sender of the |
| 1303 | * message has has the capability @cap in the user namespace @user_ns. |
| 1304 | */ |
| 1305 | bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, |
| 1306 | struct user_namespace *user_ns, int cap) |
| 1307 | { |
| 1308 | return ((nsp->flags & NETLINK_SKB_DST) || |
| 1309 | file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && |
| 1310 | ns_capable(user_ns, cap); |
| 1311 | } |
| 1312 | EXPORT_SYMBOL(__netlink_ns_capable); |
| 1313 | |
| 1314 | /** |
| 1315 | * netlink_ns_capable - General netlink message capability test |
| 1316 | * @skb: socket buffer holding a netlink command from userspace |
| 1317 | * @user_ns: The user namespace of the capability to use |
| 1318 | * @cap: The capability to use |
| 1319 | * |
| 1320 | * Test to see if the opener of the socket we received the message |
| 1321 | * from had when the netlink socket was created and the sender of the |
| 1322 | * message has has the capability @cap in the user namespace @user_ns. |
| 1323 | */ |
| 1324 | bool netlink_ns_capable(const struct sk_buff *skb, |
| 1325 | struct user_namespace *user_ns, int cap) |
| 1326 | { |
| 1327 | return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); |
| 1328 | } |
| 1329 | EXPORT_SYMBOL(netlink_ns_capable); |
| 1330 | |
| 1331 | /** |
| 1332 | * netlink_capable - Netlink global message capability test |
| 1333 | * @skb: socket buffer holding a netlink command from userspace |
| 1334 | * @cap: The capability to use |
| 1335 | * |
| 1336 | * Test to see if the opener of the socket we received the message |
| 1337 | * from had when the netlink socket was created and the sender of the |
| 1338 | * message has has the capability @cap in all user namespaces. |
| 1339 | */ |
| 1340 | bool netlink_capable(const struct sk_buff *skb, int cap) |
| 1341 | { |
| 1342 | return netlink_ns_capable(skb, &init_user_ns, cap); |
| 1343 | } |
| 1344 | EXPORT_SYMBOL(netlink_capable); |
| 1345 | |
| 1346 | /** |
| 1347 | * netlink_net_capable - Netlink network namespace message capability test |
| 1348 | * @skb: socket buffer holding a netlink command from userspace |
| 1349 | * @cap: The capability to use |
| 1350 | * |
| 1351 | * Test to see if the opener of the socket we received the message |
| 1352 | * from had when the netlink socket was created and the sender of the |
| 1353 | * message has has the capability @cap over the network namespace of |
| 1354 | * the socket we received the message from. |
| 1355 | */ |
| 1356 | bool netlink_net_capable(const struct sk_buff *skb, int cap) |
| 1357 | { |
| 1358 | return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); |
| 1359 | } |
| 1360 | EXPORT_SYMBOL(netlink_net_capable); |
| 1361 | |
| 1362 | static inline int netlink_allowed(const struct socket *sock, unsigned int flag) |
| 1363 | { |
| 1364 | return (nl_table[sock->sk->sk_protocol].flags & flag) || |
| 1365 | ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); |
| 1366 | } |
| 1367 | |
| 1368 | static void |
| 1369 | netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions) |
| 1370 | { |
| 1371 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1372 | |
| 1373 | if (nlk->subscriptions && !subscriptions) |
| 1374 | __sk_del_bind_node(sk); |
| 1375 | else if (!nlk->subscriptions && subscriptions) |
| 1376 | sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list); |
| 1377 | nlk->subscriptions = subscriptions; |
| 1378 | } |
| 1379 | |
| 1380 | static int netlink_realloc_groups(struct sock *sk) |
| 1381 | { |
| 1382 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1383 | unsigned int groups; |
| 1384 | unsigned long *new_groups; |
| 1385 | int err = 0; |
| 1386 | |
| 1387 | netlink_table_grab(); |
| 1388 | |
| 1389 | groups = nl_table[sk->sk_protocol].groups; |
| 1390 | if (!nl_table[sk->sk_protocol].registered) { |
| 1391 | err = -ENOENT; |
| 1392 | goto out_unlock; |
| 1393 | } |
| 1394 | |
| 1395 | if (nlk->ngroups >= groups) |
| 1396 | goto out_unlock; |
| 1397 | |
| 1398 | new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC); |
| 1399 | if (new_groups == NULL) { |
| 1400 | err = -ENOMEM; |
| 1401 | goto out_unlock; |
| 1402 | } |
| 1403 | memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0, |
| 1404 | NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups)); |
| 1405 | |
| 1406 | nlk->groups = new_groups; |
| 1407 | nlk->ngroups = groups; |
| 1408 | out_unlock: |
| 1409 | netlink_table_ungrab(); |
| 1410 | return err; |
| 1411 | } |
| 1412 | |
| 1413 | static void netlink_unbind(int group, long unsigned int groups, |
| 1414 | struct netlink_sock *nlk) |
| 1415 | { |
| 1416 | int undo; |
| 1417 | |
| 1418 | if (!nlk->netlink_unbind) |
| 1419 | return; |
| 1420 | |
| 1421 | for (undo = 0; undo < group; undo++) |
| 1422 | if (test_bit(undo, &groups)) |
| 1423 | nlk->netlink_unbind(undo); |
| 1424 | } |
| 1425 | |
| 1426 | static int netlink_bind(struct socket *sock, struct sockaddr *addr, |
| 1427 | int addr_len) |
| 1428 | { |
| 1429 | struct sock *sk = sock->sk; |
| 1430 | struct net *net = sock_net(sk); |
| 1431 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1432 | struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; |
| 1433 | int err; |
| 1434 | long unsigned int groups = nladdr->nl_groups; |
| 1435 | |
| 1436 | if (addr_len < sizeof(struct sockaddr_nl)) |
| 1437 | return -EINVAL; |
| 1438 | |
| 1439 | if (nladdr->nl_family != AF_NETLINK) |
| 1440 | return -EINVAL; |
| 1441 | |
| 1442 | /* Only superuser is allowed to listen multicasts */ |
| 1443 | if (groups) { |
| 1444 | if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) |
| 1445 | return -EPERM; |
| 1446 | err = netlink_realloc_groups(sk); |
| 1447 | if (err) |
| 1448 | return err; |
| 1449 | } |
| 1450 | |
| 1451 | if (nlk->portid) |
| 1452 | if (nladdr->nl_pid != nlk->portid) |
| 1453 | return -EINVAL; |
| 1454 | |
| 1455 | if (nlk->netlink_bind && groups) { |
| 1456 | int group; |
| 1457 | |
| 1458 | for (group = 0; group < nlk->ngroups; group++) { |
| 1459 | if (!test_bit(group, &groups)) |
| 1460 | continue; |
| 1461 | err = nlk->netlink_bind(group); |
| 1462 | if (!err) |
| 1463 | continue; |
| 1464 | netlink_unbind(group, groups, nlk); |
| 1465 | return err; |
| 1466 | } |
| 1467 | } |
| 1468 | |
| 1469 | if (!nlk->portid) { |
| 1470 | err = nladdr->nl_pid ? |
| 1471 | netlink_insert(sk, net, nladdr->nl_pid) : |
| 1472 | netlink_autobind(sock); |
| 1473 | if (err) { |
| 1474 | netlink_unbind(nlk->ngroups, groups, nlk); |
| 1475 | return err; |
| 1476 | } |
| 1477 | } |
| 1478 | |
| 1479 | if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0])) |
| 1480 | return 0; |
| 1481 | |
| 1482 | netlink_table_grab(); |
| 1483 | netlink_update_subscriptions(sk, nlk->subscriptions + |
| 1484 | hweight32(groups) - |
| 1485 | hweight32(nlk->groups[0])); |
| 1486 | nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups; |
| 1487 | netlink_update_listeners(sk); |
| 1488 | netlink_table_ungrab(); |
| 1489 | |
| 1490 | return 0; |
| 1491 | } |
| 1492 | |
| 1493 | static int netlink_connect(struct socket *sock, struct sockaddr *addr, |
| 1494 | int alen, int flags) |
| 1495 | { |
| 1496 | int err = 0; |
| 1497 | struct sock *sk = sock->sk; |
| 1498 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1499 | struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; |
| 1500 | |
| 1501 | if (alen < sizeof(addr->sa_family)) |
| 1502 | return -EINVAL; |
| 1503 | |
| 1504 | if (addr->sa_family == AF_UNSPEC) { |
| 1505 | sk->sk_state = NETLINK_UNCONNECTED; |
| 1506 | nlk->dst_portid = 0; |
| 1507 | nlk->dst_group = 0; |
| 1508 | return 0; |
| 1509 | } |
| 1510 | if (addr->sa_family != AF_NETLINK) |
| 1511 | return -EINVAL; |
| 1512 | |
| 1513 | if ((nladdr->nl_groups || nladdr->nl_pid) && |
| 1514 | !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) |
| 1515 | return -EPERM; |
| 1516 | |
| 1517 | if (!nlk->portid) |
| 1518 | err = netlink_autobind(sock); |
| 1519 | |
| 1520 | if (err == 0) { |
| 1521 | sk->sk_state = NETLINK_CONNECTED; |
| 1522 | nlk->dst_portid = nladdr->nl_pid; |
| 1523 | nlk->dst_group = ffs(nladdr->nl_groups); |
| 1524 | } |
| 1525 | |
| 1526 | return err; |
| 1527 | } |
| 1528 | |
| 1529 | static int netlink_getname(struct socket *sock, struct sockaddr *addr, |
| 1530 | int *addr_len, int peer) |
| 1531 | { |
| 1532 | struct sock *sk = sock->sk; |
| 1533 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1534 | DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr); |
| 1535 | |
| 1536 | nladdr->nl_family = AF_NETLINK; |
| 1537 | nladdr->nl_pad = 0; |
| 1538 | *addr_len = sizeof(*nladdr); |
| 1539 | |
| 1540 | if (peer) { |
| 1541 | nladdr->nl_pid = nlk->dst_portid; |
| 1542 | nladdr->nl_groups = netlink_group_mask(nlk->dst_group); |
| 1543 | } else { |
| 1544 | nladdr->nl_pid = nlk->portid; |
| 1545 | nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0; |
| 1546 | } |
| 1547 | return 0; |
| 1548 | } |
| 1549 | |
| 1550 | static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid) |
| 1551 | { |
| 1552 | struct sock *sock; |
| 1553 | struct netlink_sock *nlk; |
| 1554 | |
| 1555 | sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid); |
| 1556 | if (!sock) |
| 1557 | return ERR_PTR(-ECONNREFUSED); |
| 1558 | |
| 1559 | /* Don't bother queuing skb if kernel socket has no input function */ |
| 1560 | nlk = nlk_sk(sock); |
| 1561 | if (sock->sk_state == NETLINK_CONNECTED && |
| 1562 | nlk->dst_portid != nlk_sk(ssk)->portid) { |
| 1563 | sock_put(sock); |
| 1564 | return ERR_PTR(-ECONNREFUSED); |
| 1565 | } |
| 1566 | return sock; |
| 1567 | } |
| 1568 | |
| 1569 | struct sock *netlink_getsockbyfilp(struct file *filp) |
| 1570 | { |
| 1571 | struct inode *inode = file_inode(filp); |
| 1572 | struct sock *sock; |
| 1573 | |
| 1574 | if (!S_ISSOCK(inode->i_mode)) |
| 1575 | return ERR_PTR(-ENOTSOCK); |
| 1576 | |
| 1577 | sock = SOCKET_I(inode)->sk; |
| 1578 | if (sock->sk_family != AF_NETLINK) |
| 1579 | return ERR_PTR(-EINVAL); |
| 1580 | |
| 1581 | sock_hold(sock); |
| 1582 | return sock; |
| 1583 | } |
| 1584 | |
| 1585 | static struct sk_buff *netlink_alloc_large_skb(unsigned int size, |
| 1586 | int broadcast) |
| 1587 | { |
| 1588 | struct sk_buff *skb; |
| 1589 | void *data; |
| 1590 | |
| 1591 | if (size <= NLMSG_GOODSIZE || broadcast) |
| 1592 | return alloc_skb(size, GFP_KERNEL); |
| 1593 | |
| 1594 | size = SKB_DATA_ALIGN(size) + |
| 1595 | SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); |
| 1596 | |
| 1597 | data = vmalloc(size); |
| 1598 | if (data == NULL) |
| 1599 | return NULL; |
| 1600 | |
| 1601 | skb = build_skb(data, size); |
| 1602 | if (skb == NULL) |
| 1603 | vfree(data); |
| 1604 | else { |
| 1605 | skb->head_frag = 0; |
| 1606 | skb->destructor = netlink_skb_destructor; |
| 1607 | } |
| 1608 | |
| 1609 | return skb; |
| 1610 | } |
| 1611 | |
| 1612 | /* |
| 1613 | * Attach a skb to a netlink socket. |
| 1614 | * The caller must hold a reference to the destination socket. On error, the |
| 1615 | * reference is dropped. The skb is not send to the destination, just all |
| 1616 | * all error checks are performed and memory in the queue is reserved. |
| 1617 | * Return values: |
| 1618 | * < 0: error. skb freed, reference to sock dropped. |
| 1619 | * 0: continue |
| 1620 | * 1: repeat lookup - reference dropped while waiting for socket memory. |
| 1621 | */ |
| 1622 | int netlink_attachskb(struct sock *sk, struct sk_buff *skb, |
| 1623 | long *timeo, struct sock *ssk) |
| 1624 | { |
| 1625 | struct netlink_sock *nlk; |
| 1626 | |
| 1627 | nlk = nlk_sk(sk); |
| 1628 | |
| 1629 | if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || |
| 1630 | test_bit(NETLINK_CONGESTED, &nlk->state)) && |
| 1631 | !netlink_skb_is_mmaped(skb)) { |
| 1632 | DECLARE_WAITQUEUE(wait, current); |
| 1633 | if (!*timeo) { |
| 1634 | if (!ssk || netlink_is_kernel(ssk)) |
| 1635 | netlink_overrun(sk); |
| 1636 | sock_put(sk); |
| 1637 | kfree_skb(skb); |
| 1638 | return -EAGAIN; |
| 1639 | } |
| 1640 | |
| 1641 | __set_current_state(TASK_INTERRUPTIBLE); |
| 1642 | add_wait_queue(&nlk->wait, &wait); |
| 1643 | |
| 1644 | if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || |
| 1645 | test_bit(NETLINK_CONGESTED, &nlk->state)) && |
| 1646 | !sock_flag(sk, SOCK_DEAD)) |
| 1647 | *timeo = schedule_timeout(*timeo); |
| 1648 | |
| 1649 | __set_current_state(TASK_RUNNING); |
| 1650 | remove_wait_queue(&nlk->wait, &wait); |
| 1651 | sock_put(sk); |
| 1652 | |
| 1653 | if (signal_pending(current)) { |
| 1654 | kfree_skb(skb); |
| 1655 | return sock_intr_errno(*timeo); |
| 1656 | } |
| 1657 | return 1; |
| 1658 | } |
| 1659 | netlink_skb_set_owner_r(skb, sk); |
| 1660 | return 0; |
| 1661 | } |
| 1662 | |
| 1663 | static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) |
| 1664 | { |
| 1665 | int len = skb->len; |
| 1666 | |
| 1667 | netlink_deliver_tap(skb); |
| 1668 | |
| 1669 | #ifdef CONFIG_NETLINK_MMAP |
| 1670 | if (netlink_skb_is_mmaped(skb)) |
| 1671 | netlink_queue_mmaped_skb(sk, skb); |
| 1672 | else if (netlink_rx_is_mmaped(sk)) |
| 1673 | netlink_ring_set_copied(sk, skb); |
| 1674 | else |
| 1675 | #endif /* CONFIG_NETLINK_MMAP */ |
| 1676 | skb_queue_tail(&sk->sk_receive_queue, skb); |
| 1677 | sk->sk_data_ready(sk); |
| 1678 | return len; |
| 1679 | } |
| 1680 | |
| 1681 | int netlink_sendskb(struct sock *sk, struct sk_buff *skb) |
| 1682 | { |
| 1683 | int len = __netlink_sendskb(sk, skb); |
| 1684 | |
| 1685 | sock_put(sk); |
| 1686 | return len; |
| 1687 | } |
| 1688 | |
| 1689 | void netlink_detachskb(struct sock *sk, struct sk_buff *skb) |
| 1690 | { |
| 1691 | kfree_skb(skb); |
| 1692 | sock_put(sk); |
| 1693 | } |
| 1694 | |
| 1695 | static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation) |
| 1696 | { |
| 1697 | int delta; |
| 1698 | |
| 1699 | WARN_ON(skb->sk != NULL); |
| 1700 | if (netlink_skb_is_mmaped(skb)) |
| 1701 | return skb; |
| 1702 | |
| 1703 | delta = skb->end - skb->tail; |
| 1704 | if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize) |
| 1705 | return skb; |
| 1706 | |
| 1707 | if (skb_shared(skb)) { |
| 1708 | struct sk_buff *nskb = skb_clone(skb, allocation); |
| 1709 | if (!nskb) |
| 1710 | return skb; |
| 1711 | consume_skb(skb); |
| 1712 | skb = nskb; |
| 1713 | } |
| 1714 | |
| 1715 | if (!pskb_expand_head(skb, 0, -delta, allocation)) |
| 1716 | skb->truesize -= delta; |
| 1717 | |
| 1718 | return skb; |
| 1719 | } |
| 1720 | |
| 1721 | static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb, |
| 1722 | struct sock *ssk) |
| 1723 | { |
| 1724 | int ret; |
| 1725 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1726 | |
| 1727 | ret = -ECONNREFUSED; |
| 1728 | if (nlk->netlink_rcv != NULL) { |
| 1729 | ret = skb->len; |
| 1730 | netlink_skb_set_owner_r(skb, sk); |
| 1731 | NETLINK_CB(skb).sk = ssk; |
| 1732 | netlink_deliver_tap_kernel(sk, ssk, skb); |
| 1733 | nlk->netlink_rcv(skb); |
| 1734 | consume_skb(skb); |
| 1735 | } else { |
| 1736 | kfree_skb(skb); |
| 1737 | } |
| 1738 | sock_put(sk); |
| 1739 | return ret; |
| 1740 | } |
| 1741 | |
| 1742 | int netlink_unicast(struct sock *ssk, struct sk_buff *skb, |
| 1743 | u32 portid, int nonblock) |
| 1744 | { |
| 1745 | struct sock *sk; |
| 1746 | int err; |
| 1747 | long timeo; |
| 1748 | |
| 1749 | skb = netlink_trim(skb, gfp_any()); |
| 1750 | |
| 1751 | timeo = sock_sndtimeo(ssk, nonblock); |
| 1752 | retry: |
| 1753 | sk = netlink_getsockbyportid(ssk, portid); |
| 1754 | if (IS_ERR(sk)) { |
| 1755 | kfree_skb(skb); |
| 1756 | return PTR_ERR(sk); |
| 1757 | } |
| 1758 | if (netlink_is_kernel(sk)) |
| 1759 | return netlink_unicast_kernel(sk, skb, ssk); |
| 1760 | |
| 1761 | if (sk_filter(sk, skb)) { |
| 1762 | err = skb->len; |
| 1763 | kfree_skb(skb); |
| 1764 | sock_put(sk); |
| 1765 | return err; |
| 1766 | } |
| 1767 | |
| 1768 | err = netlink_attachskb(sk, skb, &timeo, ssk); |
| 1769 | if (err == 1) |
| 1770 | goto retry; |
| 1771 | if (err) |
| 1772 | return err; |
| 1773 | |
| 1774 | return netlink_sendskb(sk, skb); |
| 1775 | } |
| 1776 | EXPORT_SYMBOL(netlink_unicast); |
| 1777 | |
| 1778 | struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size, |
| 1779 | u32 dst_portid, gfp_t gfp_mask) |
| 1780 | { |
| 1781 | #ifdef CONFIG_NETLINK_MMAP |
| 1782 | struct sock *sk = NULL; |
| 1783 | struct sk_buff *skb; |
| 1784 | struct netlink_ring *ring; |
| 1785 | struct nl_mmap_hdr *hdr; |
| 1786 | unsigned int maxlen; |
| 1787 | |
| 1788 | sk = netlink_getsockbyportid(ssk, dst_portid); |
| 1789 | if (IS_ERR(sk)) |
| 1790 | goto out; |
| 1791 | |
| 1792 | ring = &nlk_sk(sk)->rx_ring; |
| 1793 | /* fast-path without atomic ops for common case: non-mmaped receiver */ |
| 1794 | if (ring->pg_vec == NULL) |
| 1795 | goto out_put; |
| 1796 | |
| 1797 | if (ring->frame_size - NL_MMAP_HDRLEN < size) |
| 1798 | goto out_put; |
| 1799 | |
| 1800 | skb = alloc_skb_head(gfp_mask); |
| 1801 | if (skb == NULL) |
| 1802 | goto err1; |
| 1803 | |
| 1804 | spin_lock_bh(&sk->sk_receive_queue.lock); |
| 1805 | /* check again under lock */ |
| 1806 | if (ring->pg_vec == NULL) |
| 1807 | goto out_free; |
| 1808 | |
| 1809 | /* check again under lock */ |
| 1810 | maxlen = ring->frame_size - NL_MMAP_HDRLEN; |
| 1811 | if (maxlen < size) |
| 1812 | goto out_free; |
| 1813 | |
| 1814 | netlink_forward_ring(ring); |
| 1815 | hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); |
| 1816 | if (hdr == NULL) |
| 1817 | goto err2; |
| 1818 | netlink_ring_setup_skb(skb, sk, ring, hdr); |
| 1819 | netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); |
| 1820 | atomic_inc(&ring->pending); |
| 1821 | netlink_increment_head(ring); |
| 1822 | |
| 1823 | spin_unlock_bh(&sk->sk_receive_queue.lock); |
| 1824 | return skb; |
| 1825 | |
| 1826 | err2: |
| 1827 | kfree_skb(skb); |
| 1828 | spin_unlock_bh(&sk->sk_receive_queue.lock); |
| 1829 | netlink_overrun(sk); |
| 1830 | err1: |
| 1831 | sock_put(sk); |
| 1832 | return NULL; |
| 1833 | |
| 1834 | out_free: |
| 1835 | kfree_skb(skb); |
| 1836 | spin_unlock_bh(&sk->sk_receive_queue.lock); |
| 1837 | out_put: |
| 1838 | sock_put(sk); |
| 1839 | out: |
| 1840 | #endif |
| 1841 | return alloc_skb(size, gfp_mask); |
| 1842 | } |
| 1843 | EXPORT_SYMBOL_GPL(netlink_alloc_skb); |
| 1844 | |
| 1845 | int netlink_has_listeners(struct sock *sk, unsigned int group) |
| 1846 | { |
| 1847 | int res = 0; |
| 1848 | struct listeners *listeners; |
| 1849 | |
| 1850 | BUG_ON(!netlink_is_kernel(sk)); |
| 1851 | |
| 1852 | rcu_read_lock(); |
| 1853 | listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners); |
| 1854 | |
| 1855 | if (listeners && group - 1 < nl_table[sk->sk_protocol].groups) |
| 1856 | res = test_bit(group - 1, listeners->masks); |
| 1857 | |
| 1858 | rcu_read_unlock(); |
| 1859 | |
| 1860 | return res; |
| 1861 | } |
| 1862 | EXPORT_SYMBOL_GPL(netlink_has_listeners); |
| 1863 | |
| 1864 | static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb) |
| 1865 | { |
| 1866 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1867 | |
| 1868 | if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && |
| 1869 | !test_bit(NETLINK_CONGESTED, &nlk->state)) { |
| 1870 | netlink_skb_set_owner_r(skb, sk); |
| 1871 | __netlink_sendskb(sk, skb); |
| 1872 | return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1); |
| 1873 | } |
| 1874 | return -1; |
| 1875 | } |
| 1876 | |
| 1877 | struct netlink_broadcast_data { |
| 1878 | struct sock *exclude_sk; |
| 1879 | struct net *net; |
| 1880 | u32 portid; |
| 1881 | u32 group; |
| 1882 | int failure; |
| 1883 | int delivery_failure; |
| 1884 | int congested; |
| 1885 | int delivered; |
| 1886 | gfp_t allocation; |
| 1887 | struct sk_buff *skb, *skb2; |
| 1888 | int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data); |
| 1889 | void *tx_data; |
| 1890 | }; |
| 1891 | |
| 1892 | static void do_one_broadcast(struct sock *sk, |
| 1893 | struct netlink_broadcast_data *p) |
| 1894 | { |
| 1895 | struct netlink_sock *nlk = nlk_sk(sk); |
| 1896 | int val; |
| 1897 | |
| 1898 | if (p->exclude_sk == sk) |
| 1899 | return; |
| 1900 | |
| 1901 | if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups || |
| 1902 | !test_bit(p->group - 1, nlk->groups)) |
| 1903 | return; |
| 1904 | |
| 1905 | if (!net_eq(sock_net(sk), p->net)) |
| 1906 | return; |
| 1907 | |
| 1908 | if (p->failure) { |
| 1909 | netlink_overrun(sk); |
| 1910 | return; |
| 1911 | } |
| 1912 | |
| 1913 | sock_hold(sk); |
| 1914 | if (p->skb2 == NULL) { |
| 1915 | if (skb_shared(p->skb)) { |
| 1916 | p->skb2 = skb_clone(p->skb, p->allocation); |
| 1917 | } else { |
| 1918 | p->skb2 = skb_get(p->skb); |
| 1919 | /* |
| 1920 | * skb ownership may have been set when |
| 1921 | * delivered to a previous socket. |
| 1922 | */ |
| 1923 | skb_orphan(p->skb2); |
| 1924 | } |
| 1925 | } |
| 1926 | if (p->skb2 == NULL) { |
| 1927 | netlink_overrun(sk); |
| 1928 | /* Clone failed. Notify ALL listeners. */ |
| 1929 | p->failure = 1; |
| 1930 | if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) |
| 1931 | p->delivery_failure = 1; |
| 1932 | } else if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) { |
| 1933 | kfree_skb(p->skb2); |
| 1934 | p->skb2 = NULL; |
| 1935 | } else if (sk_filter(sk, p->skb2)) { |
| 1936 | kfree_skb(p->skb2); |
| 1937 | p->skb2 = NULL; |
| 1938 | } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) { |
| 1939 | netlink_overrun(sk); |
| 1940 | if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) |
| 1941 | p->delivery_failure = 1; |
| 1942 | } else { |
| 1943 | p->congested |= val; |
| 1944 | p->delivered = 1; |
| 1945 | p->skb2 = NULL; |
| 1946 | } |
| 1947 | sock_put(sk); |
| 1948 | } |
| 1949 | |
| 1950 | int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid, |
| 1951 | u32 group, gfp_t allocation, |
| 1952 | int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data), |
| 1953 | void *filter_data) |
| 1954 | { |
| 1955 | struct net *net = sock_net(ssk); |
| 1956 | struct netlink_broadcast_data info; |
| 1957 | struct sock *sk; |
| 1958 | |
| 1959 | skb = netlink_trim(skb, allocation); |
| 1960 | |
| 1961 | info.exclude_sk = ssk; |
| 1962 | info.net = net; |
| 1963 | info.portid = portid; |
| 1964 | info.group = group; |
| 1965 | info.failure = 0; |
| 1966 | info.delivery_failure = 0; |
| 1967 | info.congested = 0; |
| 1968 | info.delivered = 0; |
| 1969 | info.allocation = allocation; |
| 1970 | info.skb = skb; |
| 1971 | info.skb2 = NULL; |
| 1972 | info.tx_filter = filter; |
| 1973 | info.tx_data = filter_data; |
| 1974 | |
| 1975 | /* While we sleep in clone, do not allow to change socket list */ |
| 1976 | |
| 1977 | netlink_lock_table(); |
| 1978 | |
| 1979 | sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) |
| 1980 | do_one_broadcast(sk, &info); |
| 1981 | |
| 1982 | consume_skb(skb); |
| 1983 | |
| 1984 | netlink_unlock_table(); |
| 1985 | |
| 1986 | if (info.delivery_failure) { |
| 1987 | kfree_skb(info.skb2); |
| 1988 | return -ENOBUFS; |
| 1989 | } |
| 1990 | consume_skb(info.skb2); |
| 1991 | |
| 1992 | if (info.delivered) { |
| 1993 | if (info.congested && (allocation & __GFP_WAIT)) |
| 1994 | yield(); |
| 1995 | return 0; |
| 1996 | } |
| 1997 | return -ESRCH; |
| 1998 | } |
| 1999 | EXPORT_SYMBOL(netlink_broadcast_filtered); |
| 2000 | |
| 2001 | int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid, |
| 2002 | u32 group, gfp_t allocation) |
| 2003 | { |
| 2004 | return netlink_broadcast_filtered(ssk, skb, portid, group, allocation, |
| 2005 | NULL, NULL); |
| 2006 | } |
| 2007 | EXPORT_SYMBOL(netlink_broadcast); |
| 2008 | |
| 2009 | struct netlink_set_err_data { |
| 2010 | struct sock *exclude_sk; |
| 2011 | u32 portid; |
| 2012 | u32 group; |
| 2013 | int code; |
| 2014 | }; |
| 2015 | |
| 2016 | static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p) |
| 2017 | { |
| 2018 | struct netlink_sock *nlk = nlk_sk(sk); |
| 2019 | int ret = 0; |
| 2020 | |
| 2021 | if (sk == p->exclude_sk) |
| 2022 | goto out; |
| 2023 | |
| 2024 | if (!net_eq(sock_net(sk), sock_net(p->exclude_sk))) |
| 2025 | goto out; |
| 2026 | |
| 2027 | if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups || |
| 2028 | !test_bit(p->group - 1, nlk->groups)) |
| 2029 | goto out; |
| 2030 | |
| 2031 | if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) { |
| 2032 | ret = 1; |
| 2033 | goto out; |
| 2034 | } |
| 2035 | |
| 2036 | sk->sk_err = p->code; |
| 2037 | sk->sk_error_report(sk); |
| 2038 | out: |
| 2039 | return ret; |
| 2040 | } |
| 2041 | |
| 2042 | /** |
| 2043 | * netlink_set_err - report error to broadcast listeners |
| 2044 | * @ssk: the kernel netlink socket, as returned by netlink_kernel_create() |
| 2045 | * @portid: the PORTID of a process that we want to skip (if any) |
| 2046 | * @group: the broadcast group that will notice the error |
| 2047 | * @code: error code, must be negative (as usual in kernelspace) |
| 2048 | * |
| 2049 | * This function returns the number of broadcast listeners that have set the |
| 2050 | * NETLINK_RECV_NO_ENOBUFS socket option. |
| 2051 | */ |
| 2052 | int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) |
| 2053 | { |
| 2054 | struct netlink_set_err_data info; |
| 2055 | struct sock *sk; |
| 2056 | int ret = 0; |
| 2057 | |
| 2058 | info.exclude_sk = ssk; |
| 2059 | info.portid = portid; |
| 2060 | info.group = group; |
| 2061 | /* sk->sk_err wants a positive error value */ |
| 2062 | info.code = -code; |
| 2063 | |
| 2064 | read_lock(&nl_table_lock); |
| 2065 | |
| 2066 | sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) |
| 2067 | ret += do_one_set_err(sk, &info); |
| 2068 | |
| 2069 | read_unlock(&nl_table_lock); |
| 2070 | return ret; |
| 2071 | } |
| 2072 | EXPORT_SYMBOL(netlink_set_err); |
| 2073 | |
| 2074 | /* must be called with netlink table grabbed */ |
| 2075 | static void netlink_update_socket_mc(struct netlink_sock *nlk, |
| 2076 | unsigned int group, |
| 2077 | int is_new) |
| 2078 | { |
| 2079 | int old, new = !!is_new, subscriptions; |
| 2080 | |
| 2081 | old = test_bit(group - 1, nlk->groups); |
| 2082 | subscriptions = nlk->subscriptions - old + new; |
| 2083 | if (new) |
| 2084 | __set_bit(group - 1, nlk->groups); |
| 2085 | else |
| 2086 | __clear_bit(group - 1, nlk->groups); |
| 2087 | netlink_update_subscriptions(&nlk->sk, subscriptions); |
| 2088 | netlink_update_listeners(&nlk->sk); |
| 2089 | } |
| 2090 | |
| 2091 | static int netlink_setsockopt(struct socket *sock, int level, int optname, |
| 2092 | char __user *optval, unsigned int optlen) |
| 2093 | { |
| 2094 | struct sock *sk = sock->sk; |
| 2095 | struct netlink_sock *nlk = nlk_sk(sk); |
| 2096 | unsigned int val = 0; |
| 2097 | int err; |
| 2098 | |
| 2099 | if (level != SOL_NETLINK) |
| 2100 | return -ENOPROTOOPT; |
| 2101 | |
| 2102 | if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING && |
| 2103 | optlen >= sizeof(int) && |
| 2104 | get_user(val, (unsigned int __user *)optval)) |
| 2105 | return -EFAULT; |
| 2106 | |
| 2107 | switch (optname) { |
| 2108 | case NETLINK_PKTINFO: |
| 2109 | if (val) |
| 2110 | nlk->flags |= NETLINK_RECV_PKTINFO; |
| 2111 | else |
| 2112 | nlk->flags &= ~NETLINK_RECV_PKTINFO; |
| 2113 | err = 0; |
| 2114 | break; |
| 2115 | case NETLINK_ADD_MEMBERSHIP: |
| 2116 | case NETLINK_DROP_MEMBERSHIP: { |
| 2117 | if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) |
| 2118 | return -EPERM; |
| 2119 | err = netlink_realloc_groups(sk); |
| 2120 | if (err) |
| 2121 | return err; |
| 2122 | if (!val || val - 1 >= nlk->ngroups) |
| 2123 | return -EINVAL; |
| 2124 | if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) { |
| 2125 | err = nlk->netlink_bind(val); |
| 2126 | if (err) |
| 2127 | return err; |
| 2128 | } |
| 2129 | netlink_table_grab(); |
| 2130 | netlink_update_socket_mc(nlk, val, |
| 2131 | optname == NETLINK_ADD_MEMBERSHIP); |
| 2132 | netlink_table_ungrab(); |
| 2133 | if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind) |
| 2134 | nlk->netlink_unbind(val); |
| 2135 | |
| 2136 | err = 0; |
| 2137 | break; |
| 2138 | } |
| 2139 | case NETLINK_BROADCAST_ERROR: |
| 2140 | if (val) |
| 2141 | nlk->flags |= NETLINK_BROADCAST_SEND_ERROR; |
| 2142 | else |
| 2143 | nlk->flags &= ~NETLINK_BROADCAST_SEND_ERROR; |
| 2144 | err = 0; |
| 2145 | break; |
| 2146 | case NETLINK_NO_ENOBUFS: |
| 2147 | if (val) { |
| 2148 | nlk->flags |= NETLINK_RECV_NO_ENOBUFS; |
| 2149 | clear_bit(NETLINK_CONGESTED, &nlk->state); |
| 2150 | wake_up_interruptible(&nlk->wait); |
| 2151 | } else { |
| 2152 | nlk->flags &= ~NETLINK_RECV_NO_ENOBUFS; |
| 2153 | } |
| 2154 | err = 0; |
| 2155 | break; |
| 2156 | #ifdef CONFIG_NETLINK_MMAP |
| 2157 | case NETLINK_RX_RING: |
| 2158 | case NETLINK_TX_RING: { |
| 2159 | struct nl_mmap_req req; |
| 2160 | |
| 2161 | /* Rings might consume more memory than queue limits, require |
| 2162 | * CAP_NET_ADMIN. |
| 2163 | */ |
| 2164 | if (!capable(CAP_NET_ADMIN)) |
| 2165 | return -EPERM; |
| 2166 | if (optlen < sizeof(req)) |
| 2167 | return -EINVAL; |
| 2168 | if (copy_from_user(&req, optval, sizeof(req))) |
| 2169 | return -EFAULT; |
| 2170 | err = netlink_set_ring(sk, &req, false, |
| 2171 | optname == NETLINK_TX_RING); |
| 2172 | break; |
| 2173 | } |
| 2174 | #endif /* CONFIG_NETLINK_MMAP */ |
| 2175 | default: |
| 2176 | err = -ENOPROTOOPT; |
| 2177 | } |
| 2178 | return err; |
| 2179 | } |
| 2180 | |
| 2181 | static int netlink_getsockopt(struct socket *sock, int level, int optname, |
| 2182 | char __user *optval, int __user *optlen) |
| 2183 | { |
| 2184 | struct sock *sk = sock->sk; |
| 2185 | struct netlink_sock *nlk = nlk_sk(sk); |
| 2186 | int len, val, err; |
| 2187 | |
| 2188 | if (level != SOL_NETLINK) |
| 2189 | return -ENOPROTOOPT; |
| 2190 | |
| 2191 | if (get_user(len, optlen)) |
| 2192 | return -EFAULT; |
| 2193 | if (len < 0) |
| 2194 | return -EINVAL; |
| 2195 | |
| 2196 | switch (optname) { |
| 2197 | case NETLINK_PKTINFO: |
| 2198 | if (len < sizeof(int)) |
| 2199 | return -EINVAL; |
| 2200 | len = sizeof(int); |
| 2201 | val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0; |
| 2202 | if (put_user(len, optlen) || |
| 2203 | put_user(val, optval)) |
| 2204 | return -EFAULT; |
| 2205 | err = 0; |
| 2206 | break; |
| 2207 | case NETLINK_BROADCAST_ERROR: |
| 2208 | if (len < sizeof(int)) |
| 2209 | return -EINVAL; |
| 2210 | len = sizeof(int); |
| 2211 | val = nlk->flags & NETLINK_BROADCAST_SEND_ERROR ? 1 : 0; |
| 2212 | if (put_user(len, optlen) || |
| 2213 | put_user(val, optval)) |
| 2214 | return -EFAULT; |
| 2215 | err = 0; |
| 2216 | break; |
| 2217 | case NETLINK_NO_ENOBUFS: |
| 2218 | if (len < sizeof(int)) |
| 2219 | return -EINVAL; |
| 2220 | len = sizeof(int); |
| 2221 | val = nlk->flags & NETLINK_RECV_NO_ENOBUFS ? 1 : 0; |
| 2222 | if (put_user(len, optlen) || |
| 2223 | put_user(val, optval)) |
| 2224 | return -EFAULT; |
| 2225 | err = 0; |
| 2226 | break; |
| 2227 | default: |
| 2228 | err = -ENOPROTOOPT; |
| 2229 | } |
| 2230 | return err; |
| 2231 | } |
| 2232 | |
| 2233 | static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) |
| 2234 | { |
| 2235 | struct nl_pktinfo info; |
| 2236 | |
| 2237 | info.group = NETLINK_CB(skb).dst_group; |
| 2238 | put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info); |
| 2239 | } |
| 2240 | |
| 2241 | static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, |
| 2242 | struct msghdr *msg, size_t len) |
| 2243 | { |
| 2244 | struct sock_iocb *siocb = kiocb_to_siocb(kiocb); |
| 2245 | struct sock *sk = sock->sk; |
| 2246 | struct netlink_sock *nlk = nlk_sk(sk); |
| 2247 | DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name); |
| 2248 | u32 dst_portid; |
| 2249 | u32 dst_group; |
| 2250 | struct sk_buff *skb; |
| 2251 | int err; |
| 2252 | struct scm_cookie scm; |
| 2253 | u32 netlink_skb_flags = 0; |
| 2254 | |
| 2255 | if (msg->msg_flags&MSG_OOB) |
| 2256 | return -EOPNOTSUPP; |
| 2257 | |
| 2258 | if (NULL == siocb->scm) |
| 2259 | siocb->scm = &scm; |
| 2260 | |
| 2261 | err = scm_send(sock, msg, siocb->scm, true); |
| 2262 | if (err < 0) |
| 2263 | return err; |
| 2264 | |
| 2265 | if (msg->msg_namelen) { |
| 2266 | err = -EINVAL; |
| 2267 | if (addr->nl_family != AF_NETLINK) |
| 2268 | goto out; |
| 2269 | dst_portid = addr->nl_pid; |
| 2270 | dst_group = ffs(addr->nl_groups); |
| 2271 | err = -EPERM; |
| 2272 | if ((dst_group || dst_portid) && |
| 2273 | !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) |
| 2274 | goto out; |
| 2275 | netlink_skb_flags |= NETLINK_SKB_DST; |
| 2276 | } else { |
| 2277 | dst_portid = nlk->dst_portid; |
| 2278 | dst_group = nlk->dst_group; |
| 2279 | } |
| 2280 | |
| 2281 | if (!nlk->portid) { |
| 2282 | err = netlink_autobind(sock); |
| 2283 | if (err) |
| 2284 | goto out; |
| 2285 | } |
| 2286 | |
| 2287 | if (netlink_tx_is_mmaped(sk) && |
| 2288 | msg->msg_iter.iov->iov_base == NULL) { |
| 2289 | err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, |
| 2290 | siocb); |
| 2291 | goto out; |
| 2292 | } |
| 2293 | |
| 2294 | err = -EMSGSIZE; |
| 2295 | if (len > sk->sk_sndbuf - 32) |
| 2296 | goto out; |
| 2297 | err = -ENOBUFS; |
| 2298 | skb = netlink_alloc_large_skb(len, dst_group); |
| 2299 | if (skb == NULL) |
| 2300 | goto out; |
| 2301 | |
| 2302 | NETLINK_CB(skb).portid = nlk->portid; |
| 2303 | NETLINK_CB(skb).dst_group = dst_group; |
| 2304 | NETLINK_CB(skb).creds = siocb->scm->creds; |
| 2305 | NETLINK_CB(skb).flags = netlink_skb_flags; |
| 2306 | |
| 2307 | err = -EFAULT; |
| 2308 | if (memcpy_from_msg(skb_put(skb, len), msg, len)) { |
| 2309 | kfree_skb(skb); |
| 2310 | goto out; |
| 2311 | } |
| 2312 | |
| 2313 | err = security_netlink_send(sk, skb); |
| 2314 | if (err) { |
| 2315 | kfree_skb(skb); |
| 2316 | goto out; |
| 2317 | } |
| 2318 | |
| 2319 | if (dst_group) { |
| 2320 | atomic_inc(&skb->users); |
| 2321 | netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL); |
| 2322 | } |
| 2323 | err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT); |
| 2324 | |
| 2325 | out: |
| 2326 | scm_destroy(siocb->scm); |
| 2327 | return err; |
| 2328 | } |
| 2329 | |
| 2330 | static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, |
| 2331 | struct msghdr *msg, size_t len, |
| 2332 | int flags) |
| 2333 | { |
| 2334 | struct sock_iocb *siocb = kiocb_to_siocb(kiocb); |
| 2335 | struct scm_cookie scm; |
| 2336 | struct sock *sk = sock->sk; |
| 2337 | struct netlink_sock *nlk = nlk_sk(sk); |
| 2338 | int noblock = flags&MSG_DONTWAIT; |
| 2339 | size_t copied; |
| 2340 | struct sk_buff *skb, *data_skb; |
| 2341 | int err, ret; |
| 2342 | |
| 2343 | if (flags&MSG_OOB) |
| 2344 | return -EOPNOTSUPP; |
| 2345 | |
| 2346 | copied = 0; |
| 2347 | |
| 2348 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
| 2349 | if (skb == NULL) |
| 2350 | goto out; |
| 2351 | |
| 2352 | data_skb = skb; |
| 2353 | |
| 2354 | #ifdef CONFIG_COMPAT_NETLINK_MESSAGES |
| 2355 | if (unlikely(skb_shinfo(skb)->frag_list)) { |
| 2356 | /* |
| 2357 | * If this skb has a frag_list, then here that means that we |
| 2358 | * will have to use the frag_list skb's data for compat tasks |
| 2359 | * and the regular skb's data for normal (non-compat) tasks. |
| 2360 | * |
| 2361 | * If we need to send the compat skb, assign it to the |
| 2362 | * 'data_skb' variable so that it will be used below for data |
| 2363 | * copying. We keep 'skb' for everything else, including |
| 2364 | * freeing both later. |
| 2365 | */ |
| 2366 | if (flags & MSG_CMSG_COMPAT) |
| 2367 | data_skb = skb_shinfo(skb)->frag_list; |
| 2368 | } |
| 2369 | #endif |
| 2370 | |
| 2371 | /* Record the max length of recvmsg() calls for future allocations */ |
| 2372 | nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); |
| 2373 | nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, |
| 2374 | 16384); |
| 2375 | |
| 2376 | copied = data_skb->len; |
| 2377 | if (len < copied) { |
| 2378 | msg->msg_flags |= MSG_TRUNC; |
| 2379 | copied = len; |
| 2380 | } |
| 2381 | |
| 2382 | skb_reset_transport_header(data_skb); |
| 2383 | err = skb_copy_datagram_msg(data_skb, 0, msg, copied); |
| 2384 | |
| 2385 | if (msg->msg_name) { |
| 2386 | DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name); |
| 2387 | addr->nl_family = AF_NETLINK; |
| 2388 | addr->nl_pad = 0; |
| 2389 | addr->nl_pid = NETLINK_CB(skb).portid; |
| 2390 | addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group); |
| 2391 | msg->msg_namelen = sizeof(*addr); |
| 2392 | } |
| 2393 | |
| 2394 | if (nlk->flags & NETLINK_RECV_PKTINFO) |
| 2395 | netlink_cmsg_recv_pktinfo(msg, skb); |
| 2396 | |
| 2397 | if (NULL == siocb->scm) { |
| 2398 | memset(&scm, 0, sizeof(scm)); |
| 2399 | siocb->scm = &scm; |
| 2400 | } |
| 2401 | siocb->scm->creds = *NETLINK_CREDS(skb); |
| 2402 | if (flags & MSG_TRUNC) |
| 2403 | copied = data_skb->len; |
| 2404 | |
| 2405 | skb_free_datagram(sk, skb); |
| 2406 | |
| 2407 | if (nlk->cb_running && |
| 2408 | atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) { |
| 2409 | ret = netlink_dump(sk); |
| 2410 | if (ret) { |
| 2411 | sk->sk_err = -ret; |
| 2412 | sk->sk_error_report(sk); |
| 2413 | } |
| 2414 | } |
| 2415 | |
| 2416 | scm_recv(sock, msg, siocb->scm, flags); |
| 2417 | out: |
| 2418 | netlink_rcv_wake(sk); |
| 2419 | return err ? : copied; |
| 2420 | } |
| 2421 | |
| 2422 | static void netlink_data_ready(struct sock *sk) |
| 2423 | { |
| 2424 | BUG(); |
| 2425 | } |
| 2426 | |
| 2427 | /* |
| 2428 | * We export these functions to other modules. They provide a |
| 2429 | * complete set of kernel non-blocking support for message |
| 2430 | * queueing. |
| 2431 | */ |
| 2432 | |
| 2433 | struct sock * |
| 2434 | __netlink_kernel_create(struct net *net, int unit, struct module *module, |
| 2435 | struct netlink_kernel_cfg *cfg) |
| 2436 | { |
| 2437 | struct socket *sock; |
| 2438 | struct sock *sk; |
| 2439 | struct netlink_sock *nlk; |
| 2440 | struct listeners *listeners = NULL; |
| 2441 | struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL; |
| 2442 | unsigned int groups; |
| 2443 | |
| 2444 | BUG_ON(!nl_table); |
| 2445 | |
| 2446 | if (unit < 0 || unit >= MAX_LINKS) |
| 2447 | return NULL; |
| 2448 | |
| 2449 | if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock)) |
| 2450 | return NULL; |
| 2451 | |
| 2452 | /* |
| 2453 | * We have to just have a reference on the net from sk, but don't |
| 2454 | * get_net it. Besides, we cannot get and then put the net here. |
| 2455 | * So we create one inside init_net and the move it to net. |
| 2456 | */ |
| 2457 | |
| 2458 | if (__netlink_create(&init_net, sock, cb_mutex, unit) < 0) |
| 2459 | goto out_sock_release_nosk; |
| 2460 | |
| 2461 | sk = sock->sk; |
| 2462 | sk_change_net(sk, net); |
| 2463 | |
| 2464 | if (!cfg || cfg->groups < 32) |
| 2465 | groups = 32; |
| 2466 | else |
| 2467 | groups = cfg->groups; |
| 2468 | |
| 2469 | listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL); |
| 2470 | if (!listeners) |
| 2471 | goto out_sock_release; |
| 2472 | |
| 2473 | sk->sk_data_ready = netlink_data_ready; |
| 2474 | if (cfg && cfg->input) |
| 2475 | nlk_sk(sk)->netlink_rcv = cfg->input; |
| 2476 | |
| 2477 | if (netlink_insert(sk, net, 0)) |
| 2478 | goto out_sock_release; |
| 2479 | |
| 2480 | nlk = nlk_sk(sk); |
| 2481 | nlk->flags |= NETLINK_KERNEL_SOCKET; |
| 2482 | |
| 2483 | netlink_table_grab(); |
| 2484 | if (!nl_table[unit].registered) { |
| 2485 | nl_table[unit].groups = groups; |
| 2486 | rcu_assign_pointer(nl_table[unit].listeners, listeners); |
| 2487 | nl_table[unit].cb_mutex = cb_mutex; |
| 2488 | nl_table[unit].module = module; |
| 2489 | if (cfg) { |
| 2490 | nl_table[unit].bind = cfg->bind; |
| 2491 | nl_table[unit].unbind = cfg->unbind; |
| 2492 | nl_table[unit].flags = cfg->flags; |
| 2493 | if (cfg->compare) |
| 2494 | nl_table[unit].compare = cfg->compare; |
| 2495 | } |
| 2496 | nl_table[unit].registered = 1; |
| 2497 | } else { |
| 2498 | kfree(listeners); |
| 2499 | nl_table[unit].registered++; |
| 2500 | } |
| 2501 | netlink_table_ungrab(); |
| 2502 | return sk; |
| 2503 | |
| 2504 | out_sock_release: |
| 2505 | kfree(listeners); |
| 2506 | netlink_kernel_release(sk); |
| 2507 | return NULL; |
| 2508 | |
| 2509 | out_sock_release_nosk: |
| 2510 | sock_release(sock); |
| 2511 | return NULL; |
| 2512 | } |
| 2513 | EXPORT_SYMBOL(__netlink_kernel_create); |
| 2514 | |
| 2515 | void |
| 2516 | netlink_kernel_release(struct sock *sk) |
| 2517 | { |
| 2518 | sk_release_kernel(sk); |
| 2519 | } |
| 2520 | EXPORT_SYMBOL(netlink_kernel_release); |
| 2521 | |
| 2522 | int __netlink_change_ngroups(struct sock *sk, unsigned int groups) |
| 2523 | { |
| 2524 | struct listeners *new, *old; |
| 2525 | struct netlink_table *tbl = &nl_table[sk->sk_protocol]; |
| 2526 | |
| 2527 | if (groups < 32) |
| 2528 | groups = 32; |
| 2529 | |
| 2530 | if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) { |
| 2531 | new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC); |
| 2532 | if (!new) |
| 2533 | return -ENOMEM; |
| 2534 | old = nl_deref_protected(tbl->listeners); |
| 2535 | memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups)); |
| 2536 | rcu_assign_pointer(tbl->listeners, new); |
| 2537 | |
| 2538 | kfree_rcu(old, rcu); |
| 2539 | } |
| 2540 | tbl->groups = groups; |
| 2541 | |
| 2542 | return 0; |
| 2543 | } |
| 2544 | |
| 2545 | /** |
| 2546 | * netlink_change_ngroups - change number of multicast groups |
| 2547 | * |
| 2548 | * This changes the number of multicast groups that are available |
| 2549 | * on a certain netlink family. Note that it is not possible to |
| 2550 | * change the number of groups to below 32. Also note that it does |
| 2551 | * not implicitly call netlink_clear_multicast_users() when the |
| 2552 | * number of groups is reduced. |
| 2553 | * |
| 2554 | * @sk: The kernel netlink socket, as returned by netlink_kernel_create(). |
| 2555 | * @groups: The new number of groups. |
| 2556 | */ |
| 2557 | int netlink_change_ngroups(struct sock *sk, unsigned int groups) |
| 2558 | { |
| 2559 | int err; |
| 2560 | |
| 2561 | netlink_table_grab(); |
| 2562 | err = __netlink_change_ngroups(sk, groups); |
| 2563 | netlink_table_ungrab(); |
| 2564 | |
| 2565 | return err; |
| 2566 | } |
| 2567 | |
| 2568 | void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) |
| 2569 | { |
| 2570 | struct sock *sk; |
| 2571 | struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; |
| 2572 | |
| 2573 | sk_for_each_bound(sk, &tbl->mc_list) |
| 2574 | netlink_update_socket_mc(nlk_sk(sk), group, 0); |
| 2575 | } |
| 2576 | |
| 2577 | struct nlmsghdr * |
| 2578 | __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags) |
| 2579 | { |
| 2580 | struct nlmsghdr *nlh; |
| 2581 | int size = nlmsg_msg_size(len); |
| 2582 | |
| 2583 | nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size)); |
| 2584 | nlh->nlmsg_type = type; |
| 2585 | nlh->nlmsg_len = size; |
| 2586 | nlh->nlmsg_flags = flags; |
| 2587 | nlh->nlmsg_pid = portid; |
| 2588 | nlh->nlmsg_seq = seq; |
| 2589 | if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0) |
| 2590 | memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size); |
| 2591 | return nlh; |
| 2592 | } |
| 2593 | EXPORT_SYMBOL(__nlmsg_put); |
| 2594 | |
| 2595 | /* |
| 2596 | * It looks a bit ugly. |
| 2597 | * It would be better to create kernel thread. |
| 2598 | */ |
| 2599 | |
| 2600 | static int netlink_dump(struct sock *sk) |
| 2601 | { |
| 2602 | struct netlink_sock *nlk = nlk_sk(sk); |
| 2603 | struct netlink_callback *cb; |
| 2604 | struct sk_buff *skb = NULL; |
| 2605 | struct nlmsghdr *nlh; |
| 2606 | int len, err = -ENOBUFS; |
| 2607 | int alloc_size; |
| 2608 | |
| 2609 | mutex_lock(nlk->cb_mutex); |
| 2610 | if (!nlk->cb_running) { |
| 2611 | err = -EINVAL; |
| 2612 | goto errout_skb; |
| 2613 | } |
| 2614 | |
| 2615 | cb = &nlk->cb; |
| 2616 | alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); |
| 2617 | |
| 2618 | if (!netlink_rx_is_mmaped(sk) && |
| 2619 | atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) |
| 2620 | goto errout_skb; |
| 2621 | |
| 2622 | /* NLMSG_GOODSIZE is small to avoid high order allocations being |
| 2623 | * required, but it makes sense to _attempt_ a 16K bytes allocation |
| 2624 | * to reduce number of system calls on dump operations, if user |
| 2625 | * ever provided a big enough buffer. |
| 2626 | */ |
| 2627 | if (alloc_size < nlk->max_recvmsg_len) { |
| 2628 | skb = netlink_alloc_skb(sk, |
| 2629 | nlk->max_recvmsg_len, |
| 2630 | nlk->portid, |
| 2631 | GFP_KERNEL | |
| 2632 | __GFP_NOWARN | |
| 2633 | __GFP_NORETRY); |
| 2634 | /* available room should be exact amount to avoid MSG_TRUNC */ |
| 2635 | if (skb) |
| 2636 | skb_reserve(skb, skb_tailroom(skb) - |
| 2637 | nlk->max_recvmsg_len); |
| 2638 | } |
| 2639 | if (!skb) |
| 2640 | skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, |
| 2641 | GFP_KERNEL); |
| 2642 | if (!skb) |
| 2643 | goto errout_skb; |
| 2644 | netlink_skb_set_owner_r(skb, sk); |
| 2645 | |
| 2646 | len = cb->dump(skb, cb); |
| 2647 | |
| 2648 | if (len > 0) { |
| 2649 | mutex_unlock(nlk->cb_mutex); |
| 2650 | |
| 2651 | if (sk_filter(sk, skb)) |
| 2652 | kfree_skb(skb); |
| 2653 | else |
| 2654 | __netlink_sendskb(sk, skb); |
| 2655 | return 0; |
| 2656 | } |
| 2657 | |
| 2658 | nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI); |
| 2659 | if (!nlh) |
| 2660 | goto errout_skb; |
| 2661 | |
| 2662 | nl_dump_check_consistent(cb, nlh); |
| 2663 | |
| 2664 | memcpy(nlmsg_data(nlh), &len, sizeof(len)); |
| 2665 | |
| 2666 | if (sk_filter(sk, skb)) |
| 2667 | kfree_skb(skb); |
| 2668 | else |
| 2669 | __netlink_sendskb(sk, skb); |
| 2670 | |
| 2671 | if (cb->done) |
| 2672 | cb->done(cb); |
| 2673 | |
| 2674 | nlk->cb_running = false; |
| 2675 | mutex_unlock(nlk->cb_mutex); |
| 2676 | module_put(cb->module); |
| 2677 | consume_skb(cb->skb); |
| 2678 | return 0; |
| 2679 | |
| 2680 | errout_skb: |
| 2681 | mutex_unlock(nlk->cb_mutex); |
| 2682 | kfree_skb(skb); |
| 2683 | return err; |
| 2684 | } |
| 2685 | |
| 2686 | int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, |
| 2687 | const struct nlmsghdr *nlh, |
| 2688 | struct netlink_dump_control *control) |
| 2689 | { |
| 2690 | struct netlink_callback *cb; |
| 2691 | struct sock *sk; |
| 2692 | struct netlink_sock *nlk; |
| 2693 | int ret; |
| 2694 | |
| 2695 | /* Memory mapped dump requests need to be copied to avoid looping |
| 2696 | * on the pending state in netlink_mmap_sendmsg() while the CB hold |
| 2697 | * a reference to the skb. |
| 2698 | */ |
| 2699 | if (netlink_skb_is_mmaped(skb)) { |
| 2700 | skb = skb_copy(skb, GFP_KERNEL); |
| 2701 | if (skb == NULL) |
| 2702 | return -ENOBUFS; |
| 2703 | } else |
| 2704 | atomic_inc(&skb->users); |
| 2705 | |
| 2706 | sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid); |
| 2707 | if (sk == NULL) { |
| 2708 | ret = -ECONNREFUSED; |
| 2709 | goto error_free; |
| 2710 | } |
| 2711 | |
| 2712 | nlk = nlk_sk(sk); |
| 2713 | mutex_lock(nlk->cb_mutex); |
| 2714 | /* A dump is in progress... */ |
| 2715 | if (nlk->cb_running) { |
| 2716 | ret = -EBUSY; |
| 2717 | goto error_unlock; |
| 2718 | } |
| 2719 | /* add reference of module which cb->dump belongs to */ |
| 2720 | if (!try_module_get(control->module)) { |
| 2721 | ret = -EPROTONOSUPPORT; |
| 2722 | goto error_unlock; |
| 2723 | } |
| 2724 | |
| 2725 | cb = &nlk->cb; |
| 2726 | memset(cb, 0, sizeof(*cb)); |
| 2727 | cb->dump = control->dump; |
| 2728 | cb->done = control->done; |
| 2729 | cb->nlh = nlh; |
| 2730 | cb->data = control->data; |
| 2731 | cb->module = control->module; |
| 2732 | cb->min_dump_alloc = control->min_dump_alloc; |
| 2733 | cb->skb = skb; |
| 2734 | |
| 2735 | nlk->cb_running = true; |
| 2736 | |
| 2737 | mutex_unlock(nlk->cb_mutex); |
| 2738 | |
| 2739 | ret = netlink_dump(sk); |
| 2740 | sock_put(sk); |
| 2741 | |
| 2742 | if (ret) |
| 2743 | return ret; |
| 2744 | |
| 2745 | /* We successfully started a dump, by returning -EINTR we |
| 2746 | * signal not to send ACK even if it was requested. |
| 2747 | */ |
| 2748 | return -EINTR; |
| 2749 | |
| 2750 | error_unlock: |
| 2751 | sock_put(sk); |
| 2752 | mutex_unlock(nlk->cb_mutex); |
| 2753 | error_free: |
| 2754 | kfree_skb(skb); |
| 2755 | return ret; |
| 2756 | } |
| 2757 | EXPORT_SYMBOL(__netlink_dump_start); |
| 2758 | |
| 2759 | void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err) |
| 2760 | { |
| 2761 | struct sk_buff *skb; |
| 2762 | struct nlmsghdr *rep; |
| 2763 | struct nlmsgerr *errmsg; |
| 2764 | size_t payload = sizeof(*errmsg); |
| 2765 | |
| 2766 | /* error messages get the original request appened */ |
| 2767 | if (err) |
| 2768 | payload += nlmsg_len(nlh); |
| 2769 | |
| 2770 | skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload), |
| 2771 | NETLINK_CB(in_skb).portid, GFP_KERNEL); |
| 2772 | if (!skb) { |
| 2773 | struct sock *sk; |
| 2774 | |
| 2775 | sk = netlink_lookup(sock_net(in_skb->sk), |
| 2776 | in_skb->sk->sk_protocol, |
| 2777 | NETLINK_CB(in_skb).portid); |
| 2778 | if (sk) { |
| 2779 | sk->sk_err = ENOBUFS; |
| 2780 | sk->sk_error_report(sk); |
| 2781 | sock_put(sk); |
| 2782 | } |
| 2783 | return; |
| 2784 | } |
| 2785 | |
| 2786 | rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, |
| 2787 | NLMSG_ERROR, payload, 0); |
| 2788 | errmsg = nlmsg_data(rep); |
| 2789 | errmsg->error = err; |
| 2790 | memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh)); |
| 2791 | netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT); |
| 2792 | } |
| 2793 | EXPORT_SYMBOL(netlink_ack); |
| 2794 | |
| 2795 | int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *, |
| 2796 | struct nlmsghdr *)) |
| 2797 | { |
| 2798 | struct nlmsghdr *nlh; |
| 2799 | int err; |
| 2800 | |
| 2801 | while (skb->len >= nlmsg_total_size(0)) { |
| 2802 | int msglen; |
| 2803 | |
| 2804 | nlh = nlmsg_hdr(skb); |
| 2805 | err = 0; |
| 2806 | |
| 2807 | if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len) |
| 2808 | return 0; |
| 2809 | |
| 2810 | /* Only requests are handled by the kernel */ |
| 2811 | if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) |
| 2812 | goto ack; |
| 2813 | |
| 2814 | /* Skip control messages */ |
| 2815 | if (nlh->nlmsg_type < NLMSG_MIN_TYPE) |
| 2816 | goto ack; |
| 2817 | |
| 2818 | err = cb(skb, nlh); |
| 2819 | if (err == -EINTR) |
| 2820 | goto skip; |
| 2821 | |
| 2822 | ack: |
| 2823 | if (nlh->nlmsg_flags & NLM_F_ACK || err) |
| 2824 | netlink_ack(skb, nlh, err); |
| 2825 | |
| 2826 | skip: |
| 2827 | msglen = NLMSG_ALIGN(nlh->nlmsg_len); |
| 2828 | if (msglen > skb->len) |
| 2829 | msglen = skb->len; |
| 2830 | skb_pull(skb, msglen); |
| 2831 | } |
| 2832 | |
| 2833 | return 0; |
| 2834 | } |
| 2835 | EXPORT_SYMBOL(netlink_rcv_skb); |
| 2836 | |
| 2837 | /** |
| 2838 | * nlmsg_notify - send a notification netlink message |
| 2839 | * @sk: netlink socket to use |
| 2840 | * @skb: notification message |
| 2841 | * @portid: destination netlink portid for reports or 0 |
| 2842 | * @group: destination multicast group or 0 |
| 2843 | * @report: 1 to report back, 0 to disable |
| 2844 | * @flags: allocation flags |
| 2845 | */ |
| 2846 | int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid, |
| 2847 | unsigned int group, int report, gfp_t flags) |
| 2848 | { |
| 2849 | int err = 0; |
| 2850 | |
| 2851 | if (group) { |
| 2852 | int exclude_portid = 0; |
| 2853 | |
| 2854 | if (report) { |
| 2855 | atomic_inc(&skb->users); |
| 2856 | exclude_portid = portid; |
| 2857 | } |
| 2858 | |
| 2859 | /* errors reported via destination sk->sk_err, but propagate |
| 2860 | * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ |
| 2861 | err = nlmsg_multicast(sk, skb, exclude_portid, group, flags); |
| 2862 | } |
| 2863 | |
| 2864 | if (report) { |
| 2865 | int err2; |
| 2866 | |
| 2867 | err2 = nlmsg_unicast(sk, skb, portid); |
| 2868 | if (!err || err == -ESRCH) |
| 2869 | err = err2; |
| 2870 | } |
| 2871 | |
| 2872 | return err; |
| 2873 | } |
| 2874 | EXPORT_SYMBOL(nlmsg_notify); |
| 2875 | |
| 2876 | #ifdef CONFIG_PROC_FS |
| 2877 | struct nl_seq_iter { |
| 2878 | struct seq_net_private p; |
| 2879 | int link; |
| 2880 | int hash_idx; |
| 2881 | }; |
| 2882 | |
| 2883 | static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos) |
| 2884 | { |
| 2885 | struct nl_seq_iter *iter = seq->private; |
| 2886 | int i, j; |
| 2887 | struct netlink_sock *nlk; |
| 2888 | struct sock *s; |
| 2889 | loff_t off = 0; |
| 2890 | |
| 2891 | for (i = 0; i < MAX_LINKS; i++) { |
| 2892 | struct rhashtable *ht = &nl_table[i].hash; |
| 2893 | const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht); |
| 2894 | |
| 2895 | for (j = 0; j < tbl->size; j++) { |
| 2896 | rht_for_each_entry_rcu(nlk, tbl->buckets[j], node) { |
| 2897 | s = (struct sock *)nlk; |
| 2898 | |
| 2899 | if (sock_net(s) != seq_file_net(seq)) |
| 2900 | continue; |
| 2901 | if (off == pos) { |
| 2902 | iter->link = i; |
| 2903 | iter->hash_idx = j; |
| 2904 | return s; |
| 2905 | } |
| 2906 | ++off; |
| 2907 | } |
| 2908 | } |
| 2909 | } |
| 2910 | return NULL; |
| 2911 | } |
| 2912 | |
| 2913 | static void *netlink_seq_start(struct seq_file *seq, loff_t *pos) |
| 2914 | __acquires(nl_table_lock) __acquires(RCU) |
| 2915 | { |
| 2916 | read_lock(&nl_table_lock); |
| 2917 | rcu_read_lock(); |
| 2918 | return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN; |
| 2919 | } |
| 2920 | |
| 2921 | static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) |
| 2922 | { |
| 2923 | struct rhashtable *ht; |
| 2924 | struct netlink_sock *nlk; |
| 2925 | struct nl_seq_iter *iter; |
| 2926 | struct net *net; |
| 2927 | int i, j; |
| 2928 | |
| 2929 | ++*pos; |
| 2930 | |
| 2931 | if (v == SEQ_START_TOKEN) |
| 2932 | return netlink_seq_socket_idx(seq, 0); |
| 2933 | |
| 2934 | net = seq_file_net(seq); |
| 2935 | iter = seq->private; |
| 2936 | nlk = v; |
| 2937 | |
| 2938 | i = iter->link; |
| 2939 | ht = &nl_table[i].hash; |
| 2940 | rht_for_each_entry(nlk, nlk->node.next, ht, node) |
| 2941 | if (net_eq(sock_net((struct sock *)nlk), net)) |
| 2942 | return nlk; |
| 2943 | |
| 2944 | j = iter->hash_idx + 1; |
| 2945 | |
| 2946 | do { |
| 2947 | const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht); |
| 2948 | |
| 2949 | for (; j < tbl->size; j++) { |
| 2950 | rht_for_each_entry(nlk, tbl->buckets[j], ht, node) { |
| 2951 | if (net_eq(sock_net((struct sock *)nlk), net)) { |
| 2952 | iter->link = i; |
| 2953 | iter->hash_idx = j; |
| 2954 | return nlk; |
| 2955 | } |
| 2956 | } |
| 2957 | } |
| 2958 | |
| 2959 | j = 0; |
| 2960 | } while (++i < MAX_LINKS); |
| 2961 | |
| 2962 | return NULL; |
| 2963 | } |
| 2964 | |
| 2965 | static void netlink_seq_stop(struct seq_file *seq, void *v) |
| 2966 | __releases(RCU) __releases(nl_table_lock) |
| 2967 | { |
| 2968 | rcu_read_unlock(); |
| 2969 | read_unlock(&nl_table_lock); |
| 2970 | } |
| 2971 | |
| 2972 | |
| 2973 | static int netlink_seq_show(struct seq_file *seq, void *v) |
| 2974 | { |
| 2975 | if (v == SEQ_START_TOKEN) { |
| 2976 | seq_puts(seq, |
| 2977 | "sk Eth Pid Groups " |
| 2978 | "Rmem Wmem Dump Locks Drops Inode\n"); |
| 2979 | } else { |
| 2980 | struct sock *s = v; |
| 2981 | struct netlink_sock *nlk = nlk_sk(s); |
| 2982 | |
| 2983 | seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n", |
| 2984 | s, |
| 2985 | s->sk_protocol, |
| 2986 | nlk->portid, |
| 2987 | nlk->groups ? (u32)nlk->groups[0] : 0, |
| 2988 | sk_rmem_alloc_get(s), |
| 2989 | sk_wmem_alloc_get(s), |
| 2990 | nlk->cb_running, |
| 2991 | atomic_read(&s->sk_refcnt), |
| 2992 | atomic_read(&s->sk_drops), |
| 2993 | sock_i_ino(s) |
| 2994 | ); |
| 2995 | |
| 2996 | } |
| 2997 | return 0; |
| 2998 | } |
| 2999 | |
| 3000 | static const struct seq_operations netlink_seq_ops = { |
| 3001 | .start = netlink_seq_start, |
| 3002 | .next = netlink_seq_next, |
| 3003 | .stop = netlink_seq_stop, |
| 3004 | .show = netlink_seq_show, |
| 3005 | }; |
| 3006 | |
| 3007 | |
| 3008 | static int netlink_seq_open(struct inode *inode, struct file *file) |
| 3009 | { |
| 3010 | return seq_open_net(inode, file, &netlink_seq_ops, |
| 3011 | sizeof(struct nl_seq_iter)); |
| 3012 | } |
| 3013 | |
| 3014 | static const struct file_operations netlink_seq_fops = { |
| 3015 | .owner = THIS_MODULE, |
| 3016 | .open = netlink_seq_open, |
| 3017 | .read = seq_read, |
| 3018 | .llseek = seq_lseek, |
| 3019 | .release = seq_release_net, |
| 3020 | }; |
| 3021 | |
| 3022 | #endif |
| 3023 | |
| 3024 | int netlink_register_notifier(struct notifier_block *nb) |
| 3025 | { |
| 3026 | return atomic_notifier_chain_register(&netlink_chain, nb); |
| 3027 | } |
| 3028 | EXPORT_SYMBOL(netlink_register_notifier); |
| 3029 | |
| 3030 | int netlink_unregister_notifier(struct notifier_block *nb) |
| 3031 | { |
| 3032 | return atomic_notifier_chain_unregister(&netlink_chain, nb); |
| 3033 | } |
| 3034 | EXPORT_SYMBOL(netlink_unregister_notifier); |
| 3035 | |
| 3036 | static const struct proto_ops netlink_ops = { |
| 3037 | .family = PF_NETLINK, |
| 3038 | .owner = THIS_MODULE, |
| 3039 | .release = netlink_release, |
| 3040 | .bind = netlink_bind, |
| 3041 | .connect = netlink_connect, |
| 3042 | .socketpair = sock_no_socketpair, |
| 3043 | .accept = sock_no_accept, |
| 3044 | .getname = netlink_getname, |
| 3045 | .poll = netlink_poll, |
| 3046 | .ioctl = sock_no_ioctl, |
| 3047 | .listen = sock_no_listen, |
| 3048 | .shutdown = sock_no_shutdown, |
| 3049 | .setsockopt = netlink_setsockopt, |
| 3050 | .getsockopt = netlink_getsockopt, |
| 3051 | .sendmsg = netlink_sendmsg, |
| 3052 | .recvmsg = netlink_recvmsg, |
| 3053 | .mmap = netlink_mmap, |
| 3054 | .sendpage = sock_no_sendpage, |
| 3055 | }; |
| 3056 | |
| 3057 | static const struct net_proto_family netlink_family_ops = { |
| 3058 | .family = PF_NETLINK, |
| 3059 | .create = netlink_create, |
| 3060 | .owner = THIS_MODULE, /* for consistency 8) */ |
| 3061 | }; |
| 3062 | |
| 3063 | static int __net_init netlink_net_init(struct net *net) |
| 3064 | { |
| 3065 | #ifdef CONFIG_PROC_FS |
| 3066 | if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops)) |
| 3067 | return -ENOMEM; |
| 3068 | #endif |
| 3069 | return 0; |
| 3070 | } |
| 3071 | |
| 3072 | static void __net_exit netlink_net_exit(struct net *net) |
| 3073 | { |
| 3074 | #ifdef CONFIG_PROC_FS |
| 3075 | remove_proc_entry("netlink", net->proc_net); |
| 3076 | #endif |
| 3077 | } |
| 3078 | |
| 3079 | static void __init netlink_add_usersock_entry(void) |
| 3080 | { |
| 3081 | struct listeners *listeners; |
| 3082 | int groups = 32; |
| 3083 | |
| 3084 | listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL); |
| 3085 | if (!listeners) |
| 3086 | panic("netlink_add_usersock_entry: Cannot allocate listeners\n"); |
| 3087 | |
| 3088 | netlink_table_grab(); |
| 3089 | |
| 3090 | nl_table[NETLINK_USERSOCK].groups = groups; |
| 3091 | rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners); |
| 3092 | nl_table[NETLINK_USERSOCK].module = THIS_MODULE; |
| 3093 | nl_table[NETLINK_USERSOCK].registered = 1; |
| 3094 | nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND; |
| 3095 | |
| 3096 | netlink_table_ungrab(); |
| 3097 | } |
| 3098 | |
| 3099 | static struct pernet_operations __net_initdata netlink_net_ops = { |
| 3100 | .init = netlink_net_init, |
| 3101 | .exit = netlink_net_exit, |
| 3102 | }; |
| 3103 | |
| 3104 | static int __init netlink_proto_init(void) |
| 3105 | { |
| 3106 | int i; |
| 3107 | int err = proto_register(&netlink_proto, 0); |
| 3108 | struct rhashtable_params ht_params = { |
| 3109 | .head_offset = offsetof(struct netlink_sock, node), |
| 3110 | .key_offset = offsetof(struct netlink_sock, portid), |
| 3111 | .key_len = sizeof(u32), /* portid */ |
| 3112 | .hashfn = jhash, |
| 3113 | .max_shift = 16, /* 64K */ |
| 3114 | .grow_decision = rht_grow_above_75, |
| 3115 | .shrink_decision = rht_shrink_below_30, |
| 3116 | #ifdef CONFIG_PROVE_LOCKING |
| 3117 | .mutex_is_held = lockdep_nl_sk_hash_is_held, |
| 3118 | #endif |
| 3119 | }; |
| 3120 | |
| 3121 | if (err != 0) |
| 3122 | goto out; |
| 3123 | |
| 3124 | BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb)); |
| 3125 | |
| 3126 | nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL); |
| 3127 | if (!nl_table) |
| 3128 | goto panic; |
| 3129 | |
| 3130 | for (i = 0; i < MAX_LINKS; i++) { |
| 3131 | if (rhashtable_init(&nl_table[i].hash, &ht_params) < 0) { |
| 3132 | while (--i > 0) |
| 3133 | rhashtable_destroy(&nl_table[i].hash); |
| 3134 | kfree(nl_table); |
| 3135 | goto panic; |
| 3136 | } |
| 3137 | } |
| 3138 | |
| 3139 | INIT_LIST_HEAD(&netlink_tap_all); |
| 3140 | |
| 3141 | netlink_add_usersock_entry(); |
| 3142 | |
| 3143 | sock_register(&netlink_family_ops); |
| 3144 | register_pernet_subsys(&netlink_net_ops); |
| 3145 | /* The netlink device handler may be needed early. */ |
| 3146 | rtnetlink_init(); |
| 3147 | out: |
| 3148 | return err; |
| 3149 | panic: |
| 3150 | panic("netlink_init: Cannot allocate nl_table\n"); |
| 3151 | } |
| 3152 | |
| 3153 | core_initcall(netlink_proto_init); |