tipc: fix connection abort when receiving invalid cancel request
[deliverable/linux.git] / net / tipc / subscr.c
1 /*
2 * net/tipc/subscr.c: TIPC network topology service
3 *
4 * Copyright (c) 2000-2006, Ericsson AB
5 * Copyright (c) 2005-2007, 2010-2013, Wind River Systems
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the names of the copyright holders nor the names of its
17 * contributors may be used to endorse or promote products derived from
18 * this software without specific prior written permission.
19 *
20 * Alternatively, this software may be distributed under the terms of the
21 * GNU General Public License ("GPL") version 2 as published by the Free
22 * Software Foundation.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
35 */
36
37 #include "core.h"
38 #include "name_table.h"
39 #include "subscr.h"
40
41 /**
42 * struct tipc_subscriber - TIPC network topology subscriber
43 * @kref: reference counter to tipc_subscription object
44 * @conid: connection identifier to server connecting to subscriber
45 * @lock: control access to subscriber
46 * @subscrp_list: list of subscription objects for this subscriber
47 */
48 struct tipc_subscriber {
49 struct kref kref;
50 int conid;
51 spinlock_t lock;
52 struct list_head subscrp_list;
53 };
54
55 static void tipc_subscrp_delete(struct tipc_subscription *sub);
56 static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
57
58 /**
59 * htohl - convert value to endianness used by destination
60 * @in: value to convert
61 * @swap: non-zero if endianness must be reversed
62 *
63 * Returns converted value
64 */
65 static u32 htohl(u32 in, int swap)
66 {
67 return swap ? swab32(in) : in;
68 }
69
70 static void tipc_subscrp_send_event(struct tipc_subscription *sub,
71 u32 found_lower, u32 found_upper,
72 u32 event, u32 port_ref, u32 node)
73 {
74 struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
75 struct tipc_subscriber *subscriber = sub->subscriber;
76 struct kvec msg_sect;
77
78 msg_sect.iov_base = (void *)&sub->evt;
79 msg_sect.iov_len = sizeof(struct tipc_event);
80 sub->evt.event = htohl(event, sub->swap);
81 sub->evt.found_lower = htohl(found_lower, sub->swap);
82 sub->evt.found_upper = htohl(found_upper, sub->swap);
83 sub->evt.port.ref = htohl(port_ref, sub->swap);
84 sub->evt.port.node = htohl(node, sub->swap);
85 tipc_conn_sendmsg(tn->topsrv, subscriber->conid, NULL,
86 msg_sect.iov_base, msg_sect.iov_len);
87 }
88
89 /**
90 * tipc_subscrp_check_overlap - test for subscription overlap with the
91 * given values
92 *
93 * Returns 1 if there is overlap, otherwise 0.
94 */
95 int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
96 u32 found_upper)
97 {
98 if (found_lower < seq->lower)
99 found_lower = seq->lower;
100 if (found_upper > seq->upper)
101 found_upper = seq->upper;
102 if (found_lower > found_upper)
103 return 0;
104 return 1;
105 }
106
107 u32 tipc_subscrp_convert_seq_type(u32 type, int swap)
108 {
109 return htohl(type, swap);
110 }
111
112 void tipc_subscrp_convert_seq(struct tipc_name_seq *in, int swap,
113 struct tipc_name_seq *out)
114 {
115 out->type = htohl(in->type, swap);
116 out->lower = htohl(in->lower, swap);
117 out->upper = htohl(in->upper, swap);
118 }
119
120 void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
121 u32 found_upper, u32 event, u32 port_ref,
122 u32 node, int must)
123 {
124 struct tipc_name_seq seq;
125
126 tipc_subscrp_convert_seq(&sub->evt.s.seq, sub->swap, &seq);
127 if (!tipc_subscrp_check_overlap(&seq, found_lower, found_upper))
128 return;
129 if (!must &&
130 !(htohl(sub->evt.s.filter, sub->swap) & TIPC_SUB_PORTS))
131 return;
132
133 tipc_subscrp_send_event(sub, found_lower, found_upper, event, port_ref,
134 node);
135 }
136
137 static void tipc_subscrp_timeout(unsigned long data)
138 {
139 struct tipc_subscription *sub = (struct tipc_subscription *)data;
140 struct tipc_subscriber *subscriber = sub->subscriber;
141
142 /* Notify subscriber of timeout */
143 tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
144 TIPC_SUBSCR_TIMEOUT, 0, 0);
145
146 spin_lock_bh(&subscriber->lock);
147 tipc_subscrp_delete(sub);
148 spin_unlock_bh(&subscriber->lock);
149
150 tipc_subscrb_put(subscriber);
151 }
152
153 static void tipc_subscrb_kref_release(struct kref *kref)
154 {
155 struct tipc_subscriber *subcriber = container_of(kref,
156 struct tipc_subscriber, kref);
157
158 kfree(subcriber);
159 }
160
161 static void tipc_subscrb_put(struct tipc_subscriber *subscriber)
162 {
163 kref_put(&subscriber->kref, tipc_subscrb_kref_release);
164 }
165
166 static void tipc_subscrb_get(struct tipc_subscriber *subscriber)
167 {
168 kref_get(&subscriber->kref);
169 }
170
171 static struct tipc_subscriber *tipc_subscrb_create(int conid)
172 {
173 struct tipc_subscriber *subscriber;
174
175 subscriber = kzalloc(sizeof(*subscriber), GFP_ATOMIC);
176 if (!subscriber) {
177 pr_warn("Subscriber rejected, no memory\n");
178 return NULL;
179 }
180 kref_init(&subscriber->kref);
181 INIT_LIST_HEAD(&subscriber->subscrp_list);
182 subscriber->conid = conid;
183 spin_lock_init(&subscriber->lock);
184
185 return subscriber;
186 }
187
188 static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
189 {
190 struct tipc_subscription *sub, *temp;
191
192 spin_lock_bh(&subscriber->lock);
193 /* Destroy any existing subscriptions for subscriber */
194 list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
195 subscrp_list) {
196 if (del_timer(&sub->timer)) {
197 tipc_subscrp_delete(sub);
198 tipc_subscrb_put(subscriber);
199 }
200 }
201 spin_unlock_bh(&subscriber->lock);
202
203 tipc_subscrb_put(subscriber);
204 }
205
206 static void tipc_subscrp_delete(struct tipc_subscription *sub)
207 {
208 struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
209
210 tipc_nametbl_unsubscribe(sub);
211 list_del(&sub->subscrp_list);
212 kfree(sub);
213 atomic_dec(&tn->subscription_count);
214 }
215
216 static void tipc_subscrp_cancel(struct tipc_subscr *s,
217 struct tipc_subscriber *subscriber)
218 {
219 struct tipc_subscription *sub, *temp;
220
221 spin_lock_bh(&subscriber->lock);
222 /* Find first matching subscription, exit if not found */
223 list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
224 subscrp_list) {
225 if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
226 if (del_timer(&sub->timer)) {
227 tipc_subscrp_delete(sub);
228 tipc_subscrb_put(subscriber);
229 }
230 break;
231 }
232 }
233 spin_unlock_bh(&subscriber->lock);
234 }
235
236 static struct tipc_subscription *tipc_subscrp_create(struct net *net,
237 struct tipc_subscr *s,
238 int swap)
239 {
240 struct tipc_net *tn = net_generic(net, tipc_net_id);
241 struct tipc_subscription *sub;
242 u32 filter = htohl(s->filter, swap);
243
244 /* Refuse subscription if global limit exceeded */
245 if (atomic_read(&tn->subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
246 pr_warn("Subscription rejected, limit reached (%u)\n",
247 TIPC_MAX_SUBSCRIPTIONS);
248 return NULL;
249 }
250
251 /* Allocate subscription object */
252 sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
253 if (!sub) {
254 pr_warn("Subscription rejected, no memory\n");
255 return NULL;
256 }
257
258 /* Initialize subscription object */
259 sub->net = net;
260 if (((filter & TIPC_SUB_PORTS) && (filter & TIPC_SUB_SERVICE)) ||
261 (htohl(s->seq.lower, swap) > htohl(s->seq.upper, swap))) {
262 pr_warn("Subscription rejected, illegal request\n");
263 kfree(sub);
264 return NULL;
265 }
266
267 sub->swap = swap;
268 memcpy(&sub->evt.s, s, sizeof(*s));
269 atomic_inc(&tn->subscription_count);
270 setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
271 return sub;
272 }
273
274 static void tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
275 struct tipc_subscriber *subscriber, int swap)
276 {
277 struct tipc_net *tn = net_generic(net, tipc_net_id);
278 struct tipc_subscription *sub = NULL;
279 u32 timeout;
280
281 sub = tipc_subscrp_create(net, s, swap);
282 if (!sub)
283 return tipc_conn_terminate(tn->topsrv, subscriber->conid);
284
285 spin_lock_bh(&subscriber->lock);
286 list_add(&sub->subscrp_list, &subscriber->subscrp_list);
287 spin_unlock_bh(&subscriber->lock);
288
289 sub->subscriber = subscriber;
290 timeout = htohl(sub->evt.s.timeout, swap);
291 if (!mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout)))
292 tipc_subscrb_get(subscriber);
293 tipc_nametbl_subscribe(sub);
294 }
295
296 /* Handle one termination request for the subscriber */
297 static void tipc_subscrb_shutdown_cb(int conid, void *usr_data)
298 {
299 tipc_subscrb_delete((struct tipc_subscriber *)usr_data);
300 }
301
302 /* Handle one request to create a new subscription for the subscriber */
303 static void tipc_subscrb_rcv_cb(struct net *net, int conid,
304 struct sockaddr_tipc *addr, void *usr_data,
305 void *buf, size_t len)
306 {
307 struct tipc_subscriber *subscriber = usr_data;
308 struct tipc_subscr *s = (struct tipc_subscr *)buf;
309 int swap;
310
311 /* Determine subscriber's endianness */
312 swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE |
313 TIPC_SUB_CANCEL));
314
315 /* Detect & process a subscription cancellation request */
316 if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
317 s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
318 return tipc_subscrp_cancel(s, subscriber);
319 }
320
321 tipc_subscrp_subscribe(net, s, subscriber, swap);
322 }
323
324 /* Handle one request to establish a new subscriber */
325 static void *tipc_subscrb_connect_cb(int conid)
326 {
327 return (void *)tipc_subscrb_create(conid);
328 }
329
330 int tipc_topsrv_start(struct net *net)
331 {
332 struct tipc_net *tn = net_generic(net, tipc_net_id);
333 const char name[] = "topology_server";
334 struct tipc_server *topsrv;
335 struct sockaddr_tipc *saddr;
336
337 saddr = kzalloc(sizeof(*saddr), GFP_ATOMIC);
338 if (!saddr)
339 return -ENOMEM;
340 saddr->family = AF_TIPC;
341 saddr->addrtype = TIPC_ADDR_NAMESEQ;
342 saddr->addr.nameseq.type = TIPC_TOP_SRV;
343 saddr->addr.nameseq.lower = TIPC_TOP_SRV;
344 saddr->addr.nameseq.upper = TIPC_TOP_SRV;
345 saddr->scope = TIPC_NODE_SCOPE;
346
347 topsrv = kzalloc(sizeof(*topsrv), GFP_ATOMIC);
348 if (!topsrv) {
349 kfree(saddr);
350 return -ENOMEM;
351 }
352 topsrv->net = net;
353 topsrv->saddr = saddr;
354 topsrv->imp = TIPC_CRITICAL_IMPORTANCE;
355 topsrv->type = SOCK_SEQPACKET;
356 topsrv->max_rcvbuf_size = sizeof(struct tipc_subscr);
357 topsrv->tipc_conn_recvmsg = tipc_subscrb_rcv_cb;
358 topsrv->tipc_conn_new = tipc_subscrb_connect_cb;
359 topsrv->tipc_conn_shutdown = tipc_subscrb_shutdown_cb;
360
361 strncpy(topsrv->name, name, strlen(name) + 1);
362 tn->topsrv = topsrv;
363 atomic_set(&tn->subscription_count, 0);
364
365 return tipc_server_start(topsrv);
366 }
367
368 void tipc_topsrv_stop(struct net *net)
369 {
370 struct tipc_net *tn = net_generic(net, tipc_net_id);
371 struct tipc_server *topsrv = tn->topsrv;
372
373 tipc_server_stop(topsrv);
374 kfree(topsrv->saddr);
375 kfree(topsrv);
376 }
This page took 0.038184 seconds and 5 git commands to generate.