1// SPDX-License-Identifier: GPL-2.0-or-later 2/* AF_RXRPC implementation 3 * 4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 9 10#include <linux/module.h> 11#include <linux/kernel.h> 12#include <linux/net.h> 13#include <linux/slab.h> 14#include <linux/skbuff.h> 15#include <linux/random.h> 16#include <linux/poll.h> 17#include <linux/proc_fs.h> 18#include <linux/key-type.h> 19#include <net/net_namespace.h> 20#include <net/sock.h> 21#include <net/af_rxrpc.h> 22#define CREATE_TRACE_POINTS 23#include "ar-internal.h" 24 25MODULE_DESCRIPTION("RxRPC network protocol"); 26MODULE_AUTHOR("Red Hat, Inc."); 27MODULE_LICENSE("GPL"); 28MODULE_ALIAS_NETPROTO(PF_RXRPC); 29 30unsigned int rxrpc_debug; // = RXRPC_DEBUG_KPROTO; 31module_param_named(debug, rxrpc_debug, uint, 0644); 32MODULE_PARM_DESC(debug, "RxRPC debugging mask"); 33 34static struct proto rxrpc_proto; 35static const struct proto_ops rxrpc_rpc_ops; 36 37/* current debugging ID */ 38atomic_t rxrpc_debug_id; 39EXPORT_SYMBOL(rxrpc_debug_id); 40 41/* count of skbs currently in use */ 42atomic_t rxrpc_n_rx_skbs; 43 44struct workqueue_struct *rxrpc_workqueue; 45 46static void rxrpc_sock_destructor(struct sock *); 47 48/* 49 * see if an RxRPC socket is currently writable 50 */ 51static inline int rxrpc_writable(struct sock *sk) 52{ 53 return refcount_read(&sk->sk_wmem_alloc) < (size_t) sk->sk_sndbuf; 54} 55 56/* 57 * wait for write bufferage to become available 58 */ 59static void rxrpc_write_space(struct sock *sk) 60{ 61 _enter("%p", sk); 62 rcu_read_lock(); 63 if (rxrpc_writable(sk)) { 64 struct socket_wq *wq = rcu_dereference(sk->sk_wq); 65 66 if (skwq_has_sleeper(wq)) 67 wake_up_interruptible(&wq->wait); 68 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT); 69 } 70 rcu_read_unlock(); 71} 72 73/* 74 * validate an RxRPC address 75 */ 76static int rxrpc_validate_address(struct rxrpc_sock *rx, 77 struct sockaddr_rxrpc *srx, 78 int len) 79{ 80 unsigned int tail; 81 82 if (len < sizeof(struct sockaddr_rxrpc)) 83 return -EINVAL; 84 85 if (srx->srx_family != AF_RXRPC) 86 return -EAFNOSUPPORT; 87 88 if (srx->transport_type != SOCK_DGRAM) 89 return -ESOCKTNOSUPPORT; 90 91 len -= offsetof(struct sockaddr_rxrpc, transport); 92 if (srx->transport_len < sizeof(sa_family_t) || 93 srx->transport_len > len) 94 return -EINVAL; 95 96 switch (srx->transport.family) { 97 case AF_INET: 98 if (rx->family != AF_INET && 99 rx->family != AF_INET6) 100 return -EAFNOSUPPORT; 101 if (srx->transport_len < sizeof(struct sockaddr_in)) 102 return -EINVAL; 103 tail = offsetof(struct sockaddr_rxrpc, transport.sin.__pad); 104 break; 105 106#ifdef CONFIG_AF_RXRPC_IPV6 107 case AF_INET6: 108 if (rx->family != AF_INET6) 109 return -EAFNOSUPPORT; 110 if (srx->transport_len < sizeof(struct sockaddr_in6)) 111 return -EINVAL; 112 tail = offsetof(struct sockaddr_rxrpc, transport) + 113 sizeof(struct sockaddr_in6); 114 break; 115#endif 116 117 default: 118 return -EAFNOSUPPORT; 119 } 120 121 if (tail < len) 122 memset((void *)srx + tail, 0, len - tail); 123 _debug("INET: %pISp", &srx->transport); 124 return 0; 125} 126 127/* 128 * bind a local address to an RxRPC socket 129 */ 130static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len) 131{ 132 struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr; 133 struct rxrpc_local *local; 134 struct rxrpc_sock *rx = rxrpc_sk(sock->sk); 135 u16 service_id; 136 int ret; 137 138 _enter("%p,%p,%d", rx, saddr, len); 139 140 ret = rxrpc_validate_address(rx, srx, len); 141 if (ret < 0) 142 goto error; 143 service_id = srx->srx_service; 144 145 lock_sock(&rx->sk); 146 147 switch (rx->sk.sk_state) { 148 case RXRPC_UNBOUND: 149 rx->srx = *srx; 150 local = rxrpc_lookup_local(sock_net(&rx->sk), &rx->srx); 151 if (IS_ERR(local)) { 152 ret = PTR_ERR(local); 153 goto error_unlock; 154 } 155 156 if (service_id) { 157 write_lock(&local->services_lock); 158 if (local->service) 159 goto service_in_use; 160 rx->local = local; 161 local->service = rx; 162 write_unlock(&local->services_lock); 163 164 rx->sk.sk_state = RXRPC_SERVER_BOUND; 165 } else { 166 rx->local = local; 167 rx->sk.sk_state = RXRPC_CLIENT_BOUND; 168 } 169 break; 170 171 case RXRPC_SERVER_BOUND: 172 ret = -EINVAL; 173 if (service_id == 0) 174 goto error_unlock; 175 ret = -EADDRINUSE; 176 if (service_id == rx->srx.srx_service) 177 goto error_unlock; 178 ret = -EINVAL; 179 srx->srx_service = rx->srx.srx_service; 180 if (memcmp(srx, &rx->srx, sizeof(*srx)) != 0) 181 goto error_unlock; 182 rx->second_service = service_id; 183 rx->sk.sk_state = RXRPC_SERVER_BOUND2; 184 break; 185 186 default: 187 ret = -EINVAL; 188 goto error_unlock; 189 } 190 191 release_sock(&rx->sk); 192 _leave(" = 0"); 193 return 0; 194 195service_in_use: 196 write_unlock(&local->services_lock); 197 rxrpc_unuse_local(local, rxrpc_local_unuse_bind); 198 rxrpc_put_local(local, rxrpc_local_put_bind); 199 ret = -EADDRINUSE; 200error_unlock: 201 release_sock(&rx->sk); 202error: 203 _leave(" = %d", ret); 204 return ret; 205} 206 207/* 208 * set the number of pending calls permitted on a listening socket 209 */ 210static int rxrpc_listen(struct socket *sock, int backlog) 211{ 212 struct sock *sk = sock->sk; 213 struct rxrpc_sock *rx = rxrpc_sk(sk); 214 unsigned int max, old; 215 int ret; 216 217 _enter("%p,%d", rx, backlog); 218 219 lock_sock(&rx->sk); 220 221 switch (rx->sk.sk_state) { 222 case RXRPC_UNBOUND: 223 ret = -EADDRNOTAVAIL; 224 break; 225 case RXRPC_SERVER_BOUND: 226 case RXRPC_SERVER_BOUND2: 227 ASSERT(rx->local != NULL); 228 max = READ_ONCE(rxrpc_max_backlog); 229 ret = -EINVAL; 230 if (backlog == INT_MAX) 231 backlog = max; 232 else if (backlog < 0 || backlog > max) 233 break; 234 old = sk->sk_max_ack_backlog; 235 sk->sk_max_ack_backlog = backlog; 236 ret = rxrpc_service_prealloc(rx, GFP_KERNEL); 237 if (ret == 0) 238 rx->sk.sk_state = RXRPC_SERVER_LISTENING; 239 else 240 sk->sk_max_ack_backlog = old; 241 break; 242 case RXRPC_SERVER_LISTENING: 243 if (backlog == 0) { 244 rx->sk.sk_state = RXRPC_SERVER_LISTEN_DISABLED; 245 sk->sk_max_ack_backlog = 0; 246 rxrpc_discard_prealloc(rx); 247 ret = 0; 248 break; 249 } 250 fallthrough; 251 default: 252 ret = -EBUSY; 253 break; 254 } 255 256 release_sock(&rx->sk); 257 _leave(" = %d", ret); 258 return ret; 259} 260 261/** 262 * rxrpc_kernel_begin_call - Allow a kernel service to begin a call 263 * @sock: The socket on which to make the call 264 * @srx: The address of the peer to contact 265 * @key: The security context to use (defaults to socket setting) 266 * @user_call_ID: The ID to use 267 * @tx_total_len: Total length of data to transmit during the call (or -1) 268 * @hard_timeout: The maximum lifespan of the call in sec 269 * @gfp: The allocation constraints 270 * @notify_rx: Where to send notifications instead of socket queue 271 * @upgrade: Request service upgrade for call 272 * @interruptibility: The call is interruptible, or can be canceled. 273 * @debug_id: The debug ID for tracing to be assigned to the call 274 * 275 * Allow a kernel service to begin a call on the nominated socket. This just 276 * sets up all the internal tracking structures and allocates connection and 277 * call IDs as appropriate. The call to be used is returned. 278 * 279 * The default socket destination address and security may be overridden by 280 * supplying @srx and @key. 281 */ 282struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, 283 struct sockaddr_rxrpc *srx, 284 struct key *key, 285 unsigned long user_call_ID, 286 s64 tx_total_len, 287 u32 hard_timeout, 288 gfp_t gfp, 289 rxrpc_notify_rx_t notify_rx, 290 bool upgrade, 291 enum rxrpc_interruptibility interruptibility, 292 unsigned int debug_id) 293{ 294 struct rxrpc_conn_parameters cp; 295 struct rxrpc_call_params p; 296 struct rxrpc_call *call; 297 struct rxrpc_sock *rx = rxrpc_sk(sock->sk); 298 int ret; 299 300 _enter(",,%x,%lx", key_serial(key), user_call_ID); 301 302 ret = rxrpc_validate_address(rx, srx, sizeof(*srx)); 303 if (ret < 0) 304 return ERR_PTR(ret); 305 306 lock_sock(&rx->sk); 307 308 if (!key) 309 key = rx->key; 310 if (key && !key->payload.data[0]) 311 key = NULL; /* a no-security key */ 312 313 memset(&p, 0, sizeof(p)); 314 p.user_call_ID = user_call_ID; 315 p.tx_total_len = tx_total_len; 316 p.interruptibility = interruptibility; 317 p.kernel = true; 318 p.timeouts.hard = hard_timeout; 319 320 memset(&cp, 0, sizeof(cp)); 321 cp.local = rx->local; 322 cp.key = key; 323 cp.security_level = rx->min_sec_level; 324 cp.exclusive = false; 325 cp.upgrade = upgrade; 326 cp.service_id = srx->srx_service; 327 call = rxrpc_new_client_call(rx, &cp, srx, &p, gfp, debug_id); 328 /* The socket has been unlocked. */ 329 if (!IS_ERR(call)) { 330 call->notify_rx = notify_rx; 331 mutex_unlock(&call->user_mutex); 332 } 333 334 _leave(" = %p", call); 335 return call; 336} 337EXPORT_SYMBOL(rxrpc_kernel_begin_call); 338 339/* 340 * Dummy function used to stop the notifier talking to recvmsg(). 341 */ 342static void rxrpc_dummy_notify_rx(struct sock *sk, struct rxrpc_call *rxcall, 343 unsigned long call_user_ID) 344{ 345} 346 347/** 348 * rxrpc_kernel_shutdown_call - Allow a kernel service to shut down a call it was using 349 * @sock: The socket the call is on 350 * @call: The call to end 351 * 352 * Allow a kernel service to shut down a call it was using. The call must be 353 * complete before this is called (the call should be aborted if necessary). 354 */ 355void rxrpc_kernel_shutdown_call(struct socket *sock, struct rxrpc_call *call) 356{ 357 _enter("%d{%d}", call->debug_id, refcount_read(&call->ref)); 358 359 mutex_lock(&call->user_mutex); 360 if (!test_bit(RXRPC_CALL_RELEASED, &call->flags)) { 361 rxrpc_release_call(rxrpc_sk(sock->sk), call); 362 363 /* Make sure we're not going to call back into a kernel service */ 364 if (call->notify_rx) { 365 spin_lock(&call->notify_lock); 366 call->notify_rx = rxrpc_dummy_notify_rx; 367 spin_unlock(&call->notify_lock); 368 } 369 } 370 mutex_unlock(&call->user_mutex); 371} 372EXPORT_SYMBOL(rxrpc_kernel_shutdown_call); 373 374/** 375 * rxrpc_kernel_put_call - Release a reference to a call 376 * @sock: The socket the call is on 377 * @call: The call to put 378 * 379 * Drop the application's ref on an rxrpc call. 380 */ 381void rxrpc_kernel_put_call(struct socket *sock, struct rxrpc_call *call) 382{ 383 rxrpc_put_call(call, rxrpc_call_put_kernel); 384} 385EXPORT_SYMBOL(rxrpc_kernel_put_call); 386 387/** 388 * rxrpc_kernel_check_life - Check to see whether a call is still alive 389 * @sock: The socket the call is on 390 * @call: The call to check 391 * 392 * Allow a kernel service to find out whether a call is still alive - whether 393 * it has completed successfully and all received data has been consumed. 394 */ 395bool rxrpc_kernel_check_life(const struct socket *sock, 396 const struct rxrpc_call *call) 397{ 398 if (!rxrpc_call_is_complete(call)) 399 return true; 400 if (call->completion != RXRPC_CALL_SUCCEEDED) 401 return false; 402 return !skb_queue_empty(&call->recvmsg_queue); 403} 404EXPORT_SYMBOL(rxrpc_kernel_check_life); 405 406/** 407 * rxrpc_kernel_get_epoch - Retrieve the epoch value from a call. 408 * @sock: The socket the call is on 409 * @call: The call to query 410 * 411 * Allow a kernel service to retrieve the epoch value from a service call to 412 * see if the client at the other end rebooted. 413 */ 414u32 rxrpc_kernel_get_epoch(struct socket *sock, struct rxrpc_call *call) 415{ 416 return call->conn->proto.epoch; 417} 418EXPORT_SYMBOL(rxrpc_kernel_get_epoch); 419 420/** 421 * rxrpc_kernel_new_call_notification - Get notifications of new calls 422 * @sock: The socket to intercept received messages on 423 * @notify_new_call: Function to be called when new calls appear 424 * @discard_new_call: Function to discard preallocated calls 425 * 426 * Allow a kernel service to be given notifications about new calls. 427 */ 428void rxrpc_kernel_new_call_notification( 429 struct socket *sock, 430 rxrpc_notify_new_call_t notify_new_call, 431 rxrpc_discard_new_call_t discard_new_call) 432{ 433 struct rxrpc_sock *rx = rxrpc_sk(sock->sk); 434 435 rx->notify_new_call = notify_new_call; 436 rx->discard_new_call = discard_new_call; 437} 438EXPORT_SYMBOL(rxrpc_kernel_new_call_notification); 439 440/** 441 * rxrpc_kernel_set_max_life - Set maximum lifespan on a call 442 * @sock: The socket the call is on 443 * @call: The call to configure 444 * @hard_timeout: The maximum lifespan of the call in jiffies 445 * 446 * Set the maximum lifespan of a call. The call will end with ETIME or 447 * ETIMEDOUT if it takes longer than this. 448 */ 449void rxrpc_kernel_set_max_life(struct socket *sock, struct rxrpc_call *call, 450 unsigned long hard_timeout) 451{ 452 unsigned long now; 453 454 mutex_lock(&call->user_mutex); 455 456 now = jiffies; 457 hard_timeout += now; 458 WRITE_ONCE(call->expect_term_by, hard_timeout); 459 rxrpc_reduce_call_timer(call, hard_timeout, now, rxrpc_timer_set_for_hard); 460 461 mutex_unlock(&call->user_mutex); 462} 463EXPORT_SYMBOL(rxrpc_kernel_set_max_life); 464 465/* 466 * connect an RxRPC socket 467 * - this just targets it at a specific destination; no actual connection 468 * negotiation takes place 469 */ 470static int rxrpc_connect(struct socket *sock, struct sockaddr *addr, 471 int addr_len, int flags) 472{ 473 struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)addr; 474 struct rxrpc_sock *rx = rxrpc_sk(sock->sk); 475 int ret; 476 477 _enter("%p,%p,%d,%d", rx, addr, addr_len, flags); 478 479 ret = rxrpc_validate_address(rx, srx, addr_len); 480 if (ret < 0) { 481 _leave(" = %d [bad addr]", ret); 482 return ret; 483 } 484 485 lock_sock(&rx->sk); 486 487 ret = -EISCONN; 488 if (test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) 489 goto error; 490 491 switch (rx->sk.sk_state) { 492 case RXRPC_UNBOUND: 493 rx->sk.sk_state = RXRPC_CLIENT_UNBOUND; 494 break; 495 case RXRPC_CLIENT_UNBOUND: 496 case RXRPC_CLIENT_BOUND: 497 break; 498 default: 499 ret = -EBUSY; 500 goto error; 501 } 502 503 rx->connect_srx = *srx; 504 set_bit(RXRPC_SOCK_CONNECTED, &rx->flags); 505 ret = 0; 506 507error: 508 release_sock(&rx->sk); 509 return ret; 510} 511 512/* 513 * send a message through an RxRPC socket 514 * - in a client this does a number of things: 515 * - finds/sets up a connection for the security specified (if any) 516 * - initiates a call (ID in control data) 517 * - ends the request phase of a call (if MSG_MORE is not set) 518 * - sends a call data packet 519 * - may send an abort (abort code in control data) 520 */ 521static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len) 522{ 523 struct rxrpc_local *local; 524 struct rxrpc_sock *rx = rxrpc_sk(sock->sk); 525 int ret; 526 527 _enter(",{%d},,%zu", rx->sk.sk_state, len); 528 529 if (m->msg_flags & MSG_OOB) 530 return -EOPNOTSUPP; 531 532 if (m->msg_name) { 533 ret = rxrpc_validate_address(rx, m->msg_name, m->msg_namelen); 534 if (ret < 0) { 535 _leave(" = %d [bad addr]", ret); 536 return ret; 537 } 538 } 539 540 lock_sock(&rx->sk); 541 542 switch (rx->sk.sk_state) { 543 case RXRPC_UNBOUND: 544 case RXRPC_CLIENT_UNBOUND: 545 rx->srx.srx_family = AF_RXRPC; 546 rx->srx.srx_service = 0; 547 rx->srx.transport_type = SOCK_DGRAM; 548 rx->srx.transport.family = rx->family; 549 switch (rx->family) { 550 case AF_INET: 551 rx->srx.transport_len = sizeof(struct sockaddr_in); 552 break; 553#ifdef CONFIG_AF_RXRPC_IPV6 554 case AF_INET6: 555 rx->srx.transport_len = sizeof(struct sockaddr_in6); 556 break; 557#endif 558 default: 559 ret = -EAFNOSUPPORT; 560 goto error_unlock; 561 } 562 local = rxrpc_lookup_local(sock_net(sock->sk), &rx->srx); 563 if (IS_ERR(local)) { 564 ret = PTR_ERR(local); 565 goto error_unlock; 566 } 567 568 rx->local = local; 569 rx->sk.sk_state = RXRPC_CLIENT_BOUND; 570 fallthrough; 571 572 case RXRPC_CLIENT_BOUND: 573 if (!m->msg_name && 574 test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) { 575 m->msg_name = &rx->connect_srx; 576 m->msg_namelen = sizeof(rx->connect_srx); 577 } 578 fallthrough; 579 case RXRPC_SERVER_BOUND: 580 case RXRPC_SERVER_LISTENING: 581 ret = rxrpc_do_sendmsg(rx, m, len); 582 /* The socket has been unlocked */ 583 goto out; 584 default: 585 ret = -EINVAL; 586 goto error_unlock; 587 } 588 589error_unlock: 590 release_sock(&rx->sk); 591out: 592 _leave(" = %d", ret); 593 return ret; 594} 595 596int rxrpc_sock_set_min_security_level(struct sock *sk, unsigned int val) 597{ 598 if (sk->sk_state != RXRPC_UNBOUND) 599 return -EISCONN; 600 if (val > RXRPC_SECURITY_MAX) 601 return -EINVAL; 602 lock_sock(sk); 603 rxrpc_sk(sk)->min_sec_level = val; 604 release_sock(sk); 605 return 0; 606} 607EXPORT_SYMBOL(rxrpc_sock_set_min_security_level); 608 609/* 610 * set RxRPC socket options 611 */ 612static int rxrpc_setsockopt(struct socket *sock, int level, int optname, 613 sockptr_t optval, unsigned int optlen) 614{ 615 struct rxrpc_sock *rx = rxrpc_sk(sock->sk); 616 unsigned int min_sec_level; 617 u16 service_upgrade[2]; 618 int ret; 619 620 _enter(",%d,%d,,%d", level, optname, optlen); 621 622 lock_sock(&rx->sk); 623 ret = -EOPNOTSUPP; 624 625 if (level == SOL_RXRPC) { 626 switch (optname) { 627 case RXRPC_EXCLUSIVE_CONNECTION: 628 ret = -EINVAL; 629 if (optlen != 0) 630 goto error; 631 ret = -EISCONN; 632 if (rx->sk.sk_state != RXRPC_UNBOUND) 633 goto error; 634 rx->exclusive = true; 635 goto success; 636 637 case RXRPC_SECURITY_KEY: 638 ret = -EINVAL; 639 if (rx->key) 640 goto error; 641 ret = -EISCONN; 642 if (rx->sk.sk_state != RXRPC_UNBOUND) 643 goto error; 644 ret = rxrpc_request_key(rx, optval, optlen); 645 goto error; 646 647 case RXRPC_SECURITY_KEYRING: 648 ret = -EINVAL; 649 if (rx->key) 650 goto error; 651 ret = -EISCONN; 652 if (rx->sk.sk_state != RXRPC_UNBOUND) 653 goto error; 654 ret = rxrpc_server_keyring(rx, optval, optlen); 655 goto error; 656 657 case RXRPC_MIN_SECURITY_LEVEL: 658 ret = -EINVAL; 659 if (optlen != sizeof(unsigned int)) 660 goto error; 661 ret = -EISCONN; 662 if (rx->sk.sk_state != RXRPC_UNBOUND) 663 goto error; 664 ret = copy_from_sockptr(&min_sec_level, optval, 665 sizeof(unsigned int)); 666 if (ret < 0) 667 goto error; 668 ret = -EINVAL; 669 if (min_sec_level > RXRPC_SECURITY_MAX) 670 goto error; 671 rx->min_sec_level = min_sec_level; 672 goto success; 673 674 case RXRPC_UPGRADEABLE_SERVICE: 675 ret = -EINVAL; 676 if (optlen != sizeof(service_upgrade) || 677 rx->service_upgrade.from != 0) 678 goto error; 679 ret = -EISCONN; 680 if (rx->sk.sk_state != RXRPC_SERVER_BOUND2) 681 goto error; 682 ret = -EFAULT; 683 if (copy_from_sockptr(service_upgrade, optval, 684 sizeof(service_upgrade)) != 0) 685 goto error; 686 ret = -EINVAL; 687 if ((service_upgrade[0] != rx->srx.srx_service || 688 service_upgrade[1] != rx->second_service) && 689 (service_upgrade[0] != rx->second_service || 690 service_upgrade[1] != rx->srx.srx_service)) 691 goto error; 692 rx->service_upgrade.from = service_upgrade[0]; 693 rx->service_upgrade.to = service_upgrade[1]; 694 goto success; 695 696 default: 697 break; 698 } 699 } 700 701success: 702 ret = 0; 703error: 704 release_sock(&rx->sk); 705 return ret; 706} 707 708/* 709 * Get socket options. 710 */ 711static int rxrpc_getsockopt(struct socket *sock, int level, int optname, 712 char __user *optval, int __user *_optlen) 713{ 714 int optlen; 715 716 if (level != SOL_RXRPC) 717 return -EOPNOTSUPP; 718 719 if (get_user(optlen, _optlen)) 720 return -EFAULT; 721 722 switch (optname) { 723 case RXRPC_SUPPORTED_CMSG: 724 if (optlen < sizeof(int)) 725 return -ETOOSMALL; 726 if (put_user(RXRPC__SUPPORTED - 1, (int __user *)optval) || 727 put_user(sizeof(int), _optlen)) 728 return -EFAULT; 729 return 0; 730 731 default: 732 return -EOPNOTSUPP; 733 } 734} 735 736/* 737 * permit an RxRPC socket to be polled 738 */ 739static __poll_t rxrpc_poll(struct file *file, struct socket *sock, 740 poll_table *wait) 741{ 742 struct sock *sk = sock->sk; 743 struct rxrpc_sock *rx = rxrpc_sk(sk); 744 __poll_t mask; 745 746 sock_poll_wait(file, sock, wait); 747 mask = 0; 748 749 /* the socket is readable if there are any messages waiting on the Rx 750 * queue */ 751 if (!list_empty(&rx->recvmsg_q)) 752 mask |= EPOLLIN | EPOLLRDNORM; 753 754 /* the socket is writable if there is space to add new data to the 755 * socket; there is no guarantee that any particular call in progress 756 * on the socket may have space in the Tx ACK window */ 757 if (rxrpc_writable(sk)) 758 mask |= EPOLLOUT | EPOLLWRNORM; 759 760 return mask; 761} 762 763/* 764 * create an RxRPC socket 765 */ 766static int rxrpc_create(struct net *net, struct socket *sock, int protocol, 767 int kern) 768{ 769 struct rxrpc_net *rxnet; 770 struct rxrpc_sock *rx; 771 struct sock *sk; 772 773 _enter("%p,%d", sock, protocol); 774 775 /* we support transport protocol UDP/UDP6 only */ 776 if (protocol != PF_INET && 777 IS_ENABLED(CONFIG_AF_RXRPC_IPV6) && protocol != PF_INET6) 778 return -EPROTONOSUPPORT; 779 780 if (sock->type != SOCK_DGRAM) 781 return -ESOCKTNOSUPPORT; 782 783 sock->ops = &rxrpc_rpc_ops; 784 sock->state = SS_UNCONNECTED; 785 786 sk = sk_alloc(net, PF_RXRPC, GFP_KERNEL, &rxrpc_proto, kern); 787 if (!sk) 788 return -ENOMEM; 789 790 sock_init_data(sock, sk); 791 sock_set_flag(sk, SOCK_RCU_FREE); 792 sk->sk_state = RXRPC_UNBOUND; 793 sk->sk_write_space = rxrpc_write_space; 794 sk->sk_max_ack_backlog = 0; 795 sk->sk_destruct = rxrpc_sock_destructor; 796 797 rx = rxrpc_sk(sk); 798 rx->family = protocol; 799 rx->calls = RB_ROOT; 800 801 spin_lock_init(&rx->incoming_lock); 802 INIT_LIST_HEAD(&rx->sock_calls); 803 INIT_LIST_HEAD(&rx->to_be_accepted); 804 INIT_LIST_HEAD(&rx->recvmsg_q); 805 spin_lock_init(&rx->recvmsg_lock); 806 rwlock_init(&rx->call_lock); 807 memset(&rx->srx, 0, sizeof(rx->srx)); 808 809 rxnet = rxrpc_net(sock_net(&rx->sk)); 810 timer_reduce(&rxnet->peer_keepalive_timer, jiffies + 1); 811 812 _leave(" = 0 [%p]", rx); 813 return 0; 814} 815 816/* 817 * Kill all the calls on a socket and shut it down. 818 */ 819static int rxrpc_shutdown(struct socket *sock, int flags) 820{ 821 struct sock *sk = sock->sk; 822 struct rxrpc_sock *rx = rxrpc_sk(sk); 823 int ret = 0; 824 825 _enter("%p,%d", sk, flags); 826 827 if (flags != SHUT_RDWR) 828 return -EOPNOTSUPP; 829 if (sk->sk_state == RXRPC_CLOSE) 830 return -ESHUTDOWN; 831 832 lock_sock(sk); 833 834 if (sk->sk_state < RXRPC_CLOSE) { 835 sk->sk_state = RXRPC_CLOSE; 836 sk->sk_shutdown = SHUTDOWN_MASK; 837 } else { 838 ret = -ESHUTDOWN; 839 } 840 841 rxrpc_discard_prealloc(rx); 842 843 release_sock(sk); 844 return ret; 845} 846 847/* 848 * RxRPC socket destructor 849 */ 850static void rxrpc_sock_destructor(struct sock *sk) 851{ 852 _enter("%p", sk); 853 854 rxrpc_purge_queue(&sk->sk_receive_queue); 855 856 WARN_ON(refcount_read(&sk->sk_wmem_alloc)); 857 WARN_ON(!sk_unhashed(sk)); 858 WARN_ON(sk->sk_socket); 859 860 if (!sock_flag(sk, SOCK_DEAD)) { 861 printk("Attempt to release alive rxrpc socket: %p\n", sk); 862 return; 863 } 864} 865 866/* 867 * release an RxRPC socket 868 */ 869static int rxrpc_release_sock(struct sock *sk) 870{ 871 struct rxrpc_sock *rx = rxrpc_sk(sk); 872 873 _enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt)); 874 875 /* declare the socket closed for business */ 876 sock_orphan(sk); 877 sk->sk_shutdown = SHUTDOWN_MASK; 878 879 /* We want to kill off all connections from a service socket 880 * as fast as possible because we can't share these; client 881 * sockets, on the other hand, can share an endpoint. 882 */ 883 switch (sk->sk_state) { 884 case RXRPC_SERVER_BOUND: 885 case RXRPC_SERVER_BOUND2: 886 case RXRPC_SERVER_LISTENING: 887 case RXRPC_SERVER_LISTEN_DISABLED: 888 rx->local->service_closed = true; 889 break; 890 } 891 892 sk->sk_state = RXRPC_CLOSE; 893 894 if (rx->local && rx->local->service == rx) { 895 write_lock(&rx->local->services_lock); 896 rx->local->service = NULL; 897 write_unlock(&rx->local->services_lock); 898 } 899 900 /* try to flush out this socket */ 901 rxrpc_discard_prealloc(rx); 902 rxrpc_release_calls_on_socket(rx); 903 flush_workqueue(rxrpc_workqueue); 904 rxrpc_purge_queue(&sk->sk_receive_queue); 905 906 rxrpc_unuse_local(rx->local, rxrpc_local_unuse_release_sock); 907 rxrpc_put_local(rx->local, rxrpc_local_put_release_sock); 908 rx->local = NULL; 909 key_put(rx->key); 910 rx->key = NULL; 911 key_put(rx->securities); 912 rx->securities = NULL; 913 sock_put(sk); 914 915 _leave(" = 0"); 916 return 0; 917} 918 919/* 920 * release an RxRPC BSD socket on close() or equivalent 921 */ 922static int rxrpc_release(struct socket *sock) 923{ 924 struct sock *sk = sock->sk; 925 926 _enter("%p{%p}", sock, sk); 927 928 if (!sk) 929 return 0; 930 931 sock->sk = NULL; 932 933 return rxrpc_release_sock(sk); 934} 935 936/* 937 * RxRPC network protocol 938 */ 939static const struct proto_ops rxrpc_rpc_ops = { 940 .family = PF_RXRPC, 941 .owner = THIS_MODULE, 942 .release = rxrpc_release, 943 .bind = rxrpc_bind, 944 .connect = rxrpc_connect, 945 .socketpair = sock_no_socketpair, 946 .accept = sock_no_accept, 947 .getname = sock_no_getname, 948 .poll = rxrpc_poll, 949 .ioctl = sock_no_ioctl, 950 .listen = rxrpc_listen, 951 .shutdown = rxrpc_shutdown, 952 .setsockopt = rxrpc_setsockopt, 953 .getsockopt = rxrpc_getsockopt, 954 .sendmsg = rxrpc_sendmsg, 955 .recvmsg = rxrpc_recvmsg, 956 .mmap = sock_no_mmap, 957}; 958 959static struct proto rxrpc_proto = { 960 .name = "RXRPC", 961 .owner = THIS_MODULE, 962 .obj_size = sizeof(struct rxrpc_sock), 963 .max_header = sizeof(struct rxrpc_wire_header), 964}; 965 966static const struct net_proto_family rxrpc_family_ops = { 967 .family = PF_RXRPC, 968 .create = rxrpc_create, 969 .owner = THIS_MODULE, 970}; 971 972/* 973 * initialise and register the RxRPC protocol 974 */ 975static int __init af_rxrpc_init(void) 976{ 977 int ret = -1; 978 979 BUILD_BUG_ON(sizeof(struct rxrpc_skb_priv) > sizeof_field(struct sk_buff, cb)); 980 981 ret = -ENOMEM; 982 rxrpc_gen_version_string(); 983 rxrpc_call_jar = kmem_cache_create( 984 "rxrpc_call_jar", sizeof(struct rxrpc_call), 0, 985 SLAB_HWCACHE_ALIGN, NULL); 986 if (!rxrpc_call_jar) { 987 pr_notice("Failed to allocate call jar\n"); 988 goto error_call_jar; 989 } 990 991 rxrpc_workqueue = alloc_ordered_workqueue("krxrpcd", WQ_HIGHPRI | WQ_MEM_RECLAIM); 992 if (!rxrpc_workqueue) { 993 pr_notice("Failed to allocate work queue\n"); 994 goto error_work_queue; 995 } 996 997 ret = rxrpc_init_security(); 998 if (ret < 0) { 999 pr_crit("Cannot initialise security\n"); 1000 goto error_security; 1001 } 1002 1003 ret = register_pernet_device(&rxrpc_net_ops); 1004 if (ret) 1005 goto error_pernet; 1006 1007 ret = proto_register(&rxrpc_proto, 1); 1008 if (ret < 0) { 1009 pr_crit("Cannot register protocol\n"); 1010 goto error_proto; 1011 } 1012 1013 ret = sock_register(&rxrpc_family_ops); 1014 if (ret < 0) { 1015 pr_crit("Cannot register socket family\n"); 1016 goto error_sock; 1017 } 1018 1019 ret = register_key_type(&key_type_rxrpc); 1020 if (ret < 0) { 1021 pr_crit("Cannot register client key type\n"); 1022 goto error_key_type; 1023 } 1024 1025 ret = register_key_type(&key_type_rxrpc_s); 1026 if (ret < 0) { 1027 pr_crit("Cannot register server key type\n"); 1028 goto error_key_type_s; 1029 } 1030 1031 ret = rxrpc_sysctl_init(); 1032 if (ret < 0) { 1033 pr_crit("Cannot register sysctls\n"); 1034 goto error_sysctls; 1035 } 1036 1037 return 0; 1038 1039error_sysctls: 1040 unregister_key_type(&key_type_rxrpc_s); 1041error_key_type_s: 1042 unregister_key_type(&key_type_rxrpc); 1043error_key_type: 1044 sock_unregister(PF_RXRPC); 1045error_sock: 1046 proto_unregister(&rxrpc_proto); 1047error_proto: 1048 unregister_pernet_device(&rxrpc_net_ops); 1049error_pernet: 1050 rxrpc_exit_security(); 1051error_security: 1052 destroy_workqueue(rxrpc_workqueue); 1053error_work_queue: 1054 kmem_cache_destroy(rxrpc_call_jar); 1055error_call_jar: 1056 return ret; 1057} 1058 1059/* 1060 * unregister the RxRPC protocol 1061 */ 1062static void __exit af_rxrpc_exit(void) 1063{ 1064 _enter(""); 1065 rxrpc_sysctl_exit(); 1066 unregister_key_type(&key_type_rxrpc_s); 1067 unregister_key_type(&key_type_rxrpc); 1068 sock_unregister(PF_RXRPC); 1069 proto_unregister(&rxrpc_proto); 1070 unregister_pernet_device(&rxrpc_net_ops); 1071 ASSERTCMP(atomic_read(&rxrpc_n_rx_skbs), ==, 0); 1072 1073 /* Make sure the local and peer records pinned by any dying connections 1074 * are released. 1075 */ 1076 rcu_barrier(); 1077 1078 destroy_workqueue(rxrpc_workqueue); 1079 rxrpc_exit_security(); 1080 kmem_cache_destroy(rxrpc_call_jar); 1081 _leave(""); 1082} 1083 1084module_init(af_rxrpc_init); 1085module_exit(af_rxrpc_exit); 1086