projects / GitHub / exynos8895 / android_kernel_samsung_universal8895.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
usb: gadget: f_mtp: Avoid race between mtp_read and mtp_function_disable
[GitHub/exynos8895/android_kernel_samsung_universal8895.git] / net / netlink / af_netlink.c
... / ...
CommitLineData
1/*
2 * NETLINK Kernel-user communication protocol.
3 *
4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk>
5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6 * Patrick McHardy <kaber@trash.net>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
12 *
13 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
14 * added netlink_proto_exit
15 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
16 * use nlk_sk, as sk->protinfo is on a diet 8)
17 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
18 * - inc module use count of module that owns
19 * the kernel socket in case userspace opens
20 * socket of same protocol
21 * - remove all module support, since netlink is
22 * mandatory if CONFIG_NET=y these days
23 */
24
25#include <linux/module.h>
26
27#include <linux/capability.h>
28#include <linux/kernel.h>
29#include <linux/init.h>
30#include <linux/signal.h>
31#include <linux/sched.h>
32#include <linux/errno.h>
33#include <linux/string.h>
34#include <linux/stat.h>
35#include <linux/socket.h>
36#include <linux/un.h>
37#include <linux/fcntl.h>
38#include <linux/termios.h>
39#include <linux/sockios.h>
40#include <linux/net.h>
41#include <linux/fs.h>
42#include <linux/slab.h>
43#include <asm/uaccess.h>
44#include <linux/skbuff.h>
45#include <linux/netdevice.h>
46#include <linux/rtnetlink.h>
47#include <linux/proc_fs.h>
48#include <linux/seq_file.h>
49#include <linux/notifier.h>
50#include <linux/security.h>
51#include <linux/jhash.h>
52#include <linux/jiffies.h>
53#include <linux/random.h>
54#include <linux/bitops.h>
55#include <linux/mm.h>
56#include <linux/types.h>
57#include <linux/audit.h>
58#include <linux/mutex.h>
59#include <linux/vmalloc.h>
60#include <linux/if_arp.h>
61#include <linux/rhashtable.h>
62#include <asm/cacheflush.h>
63#include <linux/hash.h>
64#include <linux/genetlink.h>
65
66#include <net/net_namespace.h>
67#include <net/sock.h>
68#include <net/scm.h>
69#include <net/netlink.h>
70
71#include "af_netlink.h"
72
73struct listeners {
74 struct rcu_head rcu;
75 unsigned long masks[0];
76};
77
78/* state bits */
79#define NETLINK_S_CONGESTED 0x0
80
81/* flags */
82#define NETLINK_F_KERNEL_SOCKET 0x1
83#define NETLINK_F_RECV_PKTINFO 0x2
84#define NETLINK_F_BROADCAST_SEND_ERROR 0x4
85#define NETLINK_F_RECV_NO_ENOBUFS 0x8
86#define NETLINK_F_LISTEN_ALL_NSID 0x10
87#define NETLINK_F_CAP_ACK 0x20
88
89static inline int netlink_is_kernel(struct sock *sk)
90{
91 return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
92}
93
94struct netlink_table *nl_table __read_mostly;
95EXPORT_SYMBOL_GPL(nl_table);
96
97static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
98
99static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS];
100
101static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
102 "nlk_cb_mutex-ROUTE",
103 "nlk_cb_mutex-1",
104 "nlk_cb_mutex-USERSOCK",
105 "nlk_cb_mutex-FIREWALL",
106 "nlk_cb_mutex-SOCK_DIAG",
107 "nlk_cb_mutex-NFLOG",
108 "nlk_cb_mutex-XFRM",
109 "nlk_cb_mutex-SELINUX",
110 "nlk_cb_mutex-ISCSI",
111 "nlk_cb_mutex-AUDIT",
112 "nlk_cb_mutex-FIB_LOOKUP",
113 "nlk_cb_mutex-CONNECTOR",
114 "nlk_cb_mutex-NETFILTER",
115 "nlk_cb_mutex-IP6_FW",
116 "nlk_cb_mutex-DNRTMSG",
117 "nlk_cb_mutex-KOBJECT_UEVENT",
118 "nlk_cb_mutex-GENERIC",
119 "nlk_cb_mutex-17",
120 "nlk_cb_mutex-SCSITRANSPORT",
121 "nlk_cb_mutex-ECRYPTFS",
122 "nlk_cb_mutex-RDMA",
123 "nlk_cb_mutex-CRYPTO",
124 "nlk_cb_mutex-SMC",
125 "nlk_cb_mutex-23",
126 "nlk_cb_mutex-24",
127 "nlk_cb_mutex-25",
128 "nlk_cb_mutex-26",
129 "nlk_cb_mutex-27",
130 "nlk_cb_mutex-28",
131 "nlk_cb_mutex-29",
132 "nlk_cb_mutex-30",
133 "nlk_cb_mutex-31",
134 "nlk_cb_mutex-MAX_LINKS"
135};
136
137static int netlink_dump(struct sock *sk);
138static void netlink_skb_destructor(struct sk_buff *skb);
139
140/* nl_table locking explained:
141 * Lookup and traversal are protected with an RCU read-side lock. Insertion
142 * and removal are protected with per bucket lock while using RCU list
143 * modification primitives and may run in parallel to RCU protected lookups.
144 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
145 * been acquired * either during or after the socket has been removed from
146 * the list and after an RCU grace period.
147 */
148DEFINE_RWLOCK(nl_table_lock);
149EXPORT_SYMBOL_GPL(nl_table_lock);
150static atomic_t nl_table_users = ATOMIC_INIT(0);
151
152#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
153
154static ATOMIC_NOTIFIER_HEAD(netlink_chain);
155
156static DEFINE_SPINLOCK(netlink_tap_lock);
157static struct list_head netlink_tap_all __read_mostly;
158
159static const struct rhashtable_params netlink_rhashtable_params;
160
161static inline u32 netlink_group_mask(u32 group)
162{
163 return group ? 1 << (group - 1) : 0;
164}
165
166static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
167 gfp_t gfp_mask)
168{
169 unsigned int len = skb_end_offset(skb);
170 struct sk_buff *new;
171
172 new = alloc_skb(len, gfp_mask);
173 if (new == NULL)
174 return NULL;
175
176 NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
177 NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
178 NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
179
180 memcpy(skb_put(new, len), skb->data, len);
181 return new;
182}
183
184int netlink_add_tap(struct netlink_tap *nt)
185{
186 if (unlikely(nt->dev->type != ARPHRD_NETLINK))
187 return -EINVAL;
188
189 spin_lock(&netlink_tap_lock);
190 list_add_rcu(&nt->list, &netlink_tap_all);
191 spin_unlock(&netlink_tap_lock);
192
193 __module_get(nt->module);
194
195 return 0;
196}
197EXPORT_SYMBOL_GPL(netlink_add_tap);
198
199static int __netlink_remove_tap(struct netlink_tap *nt)
200{
201 bool found = false;
202 struct netlink_tap *tmp;
203
204 spin_lock(&netlink_tap_lock);
205
206 list_for_each_entry(tmp, &netlink_tap_all, list) {
207 if (nt == tmp) {
208 list_del_rcu(&nt->list);
209 found = true;
210 goto out;
211 }
212 }
213
214 pr_warn("__netlink_remove_tap: %p not found\n", nt);
215out:
216 spin_unlock(&netlink_tap_lock);
217
218 if (found)
219 module_put(nt->module);
220
221 return found ? 0 : -ENODEV;
222}
223
224int netlink_remove_tap(struct netlink_tap *nt)
225{
226 int ret;
227
228 ret = __netlink_remove_tap(nt);
229 synchronize_net();
230
231 return ret;
232}
233EXPORT_SYMBOL_GPL(netlink_remove_tap);
234
235static bool netlink_filter_tap(const struct sk_buff *skb)
236{
237 struct sock *sk = skb->sk;
238
239 /* We take the more conservative approach and
240 * whitelist socket protocols that may pass.
241 */
242 switch (sk->sk_protocol) {
243 case NETLINK_ROUTE:
244 case NETLINK_USERSOCK:
245 case NETLINK_SOCK_DIAG:
246 case NETLINK_NFLOG:
247 case NETLINK_XFRM:
248 case NETLINK_FIB_LOOKUP:
249 case NETLINK_NETFILTER:
250 case NETLINK_GENERIC:
251 return true;
252 }
253
254 return false;
255}
256
257static int __netlink_deliver_tap_skb(struct sk_buff *skb,
258 struct net_device *dev)
259{
260 struct sk_buff *nskb;
261 struct sock *sk = skb->sk;
262 int ret = -ENOMEM;
263
264 if (!net_eq(dev_net(dev), sock_net(sk)))
265 return 0;
266
267 dev_hold(dev);
268
269 if (is_vmalloc_addr(skb->head))
270 nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
271 else
272 nskb = skb_clone(skb, GFP_ATOMIC);
273 if (nskb) {
274 nskb->dev = dev;
275 nskb->protocol = htons((u16) sk->sk_protocol);
276 nskb->pkt_type = netlink_is_kernel(sk) ?
277 PACKET_KERNEL : PACKET_USER;
278 skb_reset_network_header(nskb);
279 ret = dev_queue_xmit(nskb);
280 if (unlikely(ret > 0))
281 ret = net_xmit_errno(ret);
282 }
283
284 dev_put(dev);
285 return ret;
286}
287
288static void __netlink_deliver_tap(struct sk_buff *skb)
289{
290 int ret;
291 struct netlink_tap *tmp;
292
293 if (!netlink_filter_tap(skb))
294 return;
295
296 list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
297 ret = __netlink_deliver_tap_skb(skb, tmp->dev);
298 if (unlikely(ret))
299 break;
300 }
301}
302
303static void netlink_deliver_tap(struct sk_buff *skb)
304{
305 rcu_read_lock();
306
307 if (unlikely(!list_empty(&netlink_tap_all)))
308 __netlink_deliver_tap(skb);
309
310 rcu_read_unlock();
311}
312
313static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
314 struct sk_buff *skb)
315{
316 if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
317 netlink_deliver_tap(skb);
318}
319
320static void netlink_overrun(struct sock *sk)
321{
322 struct netlink_sock *nlk = nlk_sk(sk);
323
324 if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
325 if (!test_and_set_bit(NETLINK_S_CONGESTED,
326 &nlk_sk(sk)->state)) {
327 sk->sk_err = ENOBUFS;
328 sk->sk_error_report(sk);
329 }
330 }
331 atomic_inc(&sk->sk_drops);
332}
333
334static void netlink_rcv_wake(struct sock *sk)
335{
336 struct netlink_sock *nlk = nlk_sk(sk);
337
338 if (skb_queue_empty(&sk->sk_receive_queue))
339 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
340 if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
341 wake_up_interruptible(&nlk->wait);
342}
343
344static void netlink_skb_destructor(struct sk_buff *skb)
345{
346 if (is_vmalloc_addr(skb->head)) {
347 if (!skb->cloned ||
348 !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
349 vfree(skb->head);
350
351 skb->head = NULL;
352 }
353 if (skb->sk != NULL)
354 sock_rfree(skb);
355}
356
357static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
358{
359 WARN_ON(skb->sk != NULL);
360 skb->sk = sk;
361 skb->destructor = netlink_skb_destructor;
362 atomic_add(skb->truesize, &sk->sk_rmem_alloc);
363 sk_mem_charge(sk, skb->truesize);
364}
365
366static void netlink_sock_destruct(struct sock *sk)
367{
368 struct netlink_sock *nlk = nlk_sk(sk);
369
370 if (nlk->cb_running) {
371 if (nlk->cb.done)
372 nlk->cb.done(&nlk->cb);
373 module_put(nlk->cb.module);
374 kfree_skb(nlk->cb.skb);
375 }
376
377 skb_queue_purge(&sk->sk_receive_queue);
378
379 if (!sock_flag(sk, SOCK_DEAD)) {
380 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
381 return;
382 }
383
384 WARN_ON(atomic_read(&sk->sk_rmem_alloc));
385 WARN_ON(atomic_read(&sk->sk_wmem_alloc));
386 WARN_ON(nlk_sk(sk)->groups);
387}
388
389static void netlink_sock_destruct_work(struct work_struct *work)
390{
391 struct netlink_sock *nlk = container_of(work, struct netlink_sock,
392 work);
393
394 sk_free(&nlk->sk);
395}
396
397/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
398 * SMP. Look, when several writers sleep and reader wakes them up, all but one
399 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
400 * this, _but_ remember, it adds useless work on UP machines.
401 */
402
403void netlink_table_grab(void)
404 __acquires(nl_table_lock)
405{
406 might_sleep();
407
408 write_lock_irq(&nl_table_lock);
409
410 if (atomic_read(&nl_table_users)) {
411 DECLARE_WAITQUEUE(wait, current);
412
413 add_wait_queue_exclusive(&nl_table_wait, &wait);
414 for (;;) {
415 set_current_state(TASK_UNINTERRUPTIBLE);
416 if (atomic_read(&nl_table_users) == 0)
417 break;
418 write_unlock_irq(&nl_table_lock);
419 schedule();
420 write_lock_irq(&nl_table_lock);
421 }
422
423 __set_current_state(TASK_RUNNING);
424 remove_wait_queue(&nl_table_wait, &wait);
425 }
426}
427
428void netlink_table_ungrab(void)
429 __releases(nl_table_lock)
430{
431 write_unlock_irq(&nl_table_lock);
432 wake_up(&nl_table_wait);
433}
434
435static inline void
436netlink_lock_table(void)
437{
438 /* read_lock() synchronizes us to netlink_table_grab */
439
440 read_lock(&nl_table_lock);
441 atomic_inc(&nl_table_users);
442 read_unlock(&nl_table_lock);
443}
444
445static inline void
446netlink_unlock_table(void)
447{
448 if (atomic_dec_and_test(&nl_table_users))
449 wake_up(&nl_table_wait);
450}
451
452struct netlink_compare_arg
453{
454 possible_net_t pnet;
455 u32 portid;
456};
457
458/* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
459#define netlink_compare_arg_len \
460 (offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
461
462static inline int netlink_compare(struct rhashtable_compare_arg *arg,
463 const void *ptr)
464{
465 const struct netlink_compare_arg *x = arg->key;
466 const struct netlink_sock *nlk = ptr;
467
468 return nlk->portid != x->portid ||
469 !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
470}
471
472static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
473 struct net *net, u32 portid)
474{
475 memset(arg, 0, sizeof(*arg));
476 write_pnet(&arg->pnet, net);
477 arg->portid = portid;
478}
479
480static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
481 struct net *net)
482{
483 struct netlink_compare_arg arg;
484
485 netlink_compare_arg_init(&arg, net, portid);
486 return rhashtable_lookup_fast(&table->hash, &arg,
487 netlink_rhashtable_params);
488}
489
490static int __netlink_insert(struct netlink_table *table, struct sock *sk)
491{
492 struct netlink_compare_arg arg;
493
494 netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
495 return rhashtable_lookup_insert_key(&table->hash, &arg,
496 &nlk_sk(sk)->node,
497 netlink_rhashtable_params);
498}
499
500static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
501{
502 struct netlink_table *table = &nl_table[protocol];
503 struct sock *sk;
504
505 rcu_read_lock();
506 sk = __netlink_lookup(table, portid, net);
507 if (sk)
508 sock_hold(sk);
509 rcu_read_unlock();
510
511 return sk;
512}
513
514static const struct proto_ops netlink_ops;
515
516static void
517netlink_update_listeners(struct sock *sk)
518{
519 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
520 unsigned long mask;
521 unsigned int i;
522 struct listeners *listeners;
523
524 listeners = nl_deref_protected(tbl->listeners);
525 if (!listeners)
526 return;
527
528 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
529 mask = 0;
530 sk_for_each_bound(sk, &tbl->mc_list) {
531 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
532 mask |= nlk_sk(sk)->groups[i];
533 }
534 listeners->masks[i] = mask;
535 }
536 /* this function is only called with the netlink table "grabbed", which
537 * makes sure updates are visible before bind or setsockopt return. */
538}
539
540static int netlink_insert(struct sock *sk, u32 portid)
541{
542 struct netlink_table *table = &nl_table[sk->sk_protocol];
543 int err;
544
545 lock_sock(sk);
546
547 err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
548 if (nlk_sk(sk)->bound)
549 goto err;
550
551 err = -ENOMEM;
552 if (BITS_PER_LONG > 32 &&
553 unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
554 goto err;
555
556 nlk_sk(sk)->portid = portid;
557 sock_hold(sk);
558
559 err = __netlink_insert(table, sk);
560 if (err) {
561 /* In case the hashtable backend returns with -EBUSY
562 * from here, it must not escape to the caller.
563 */
564 if (unlikely(err == -EBUSY))
565 err = -EOVERFLOW;
566 if (err == -EEXIST)
567 err = -EADDRINUSE;
568 sock_put(sk);
569 goto err;
570 }
571
572 /* We need to ensure that the socket is hashed and visible. */
573 smp_wmb();
574 nlk_sk(sk)->bound = portid;
575
576err:
577 release_sock(sk);
578 return err;
579}
580
581static void netlink_remove(struct sock *sk)
582{
583 struct netlink_table *table;
584
585 table = &nl_table[sk->sk_protocol];
586 if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
587 netlink_rhashtable_params)) {
588 WARN_ON(atomic_read(&sk->sk_refcnt) == 1);
589 __sock_put(sk);
590 }
591
592 netlink_table_grab();
593 if (nlk_sk(sk)->subscriptions) {
594 __sk_del_bind_node(sk);
595 netlink_update_listeners(sk);
596 }
597 if (sk->sk_protocol == NETLINK_GENERIC)
598 atomic_inc(&genl_sk_destructing_cnt);
599 netlink_table_ungrab();
600}
601
602static struct proto netlink_proto = {
603 .name = "NETLINK",
604 .owner = THIS_MODULE,
605 .obj_size = sizeof(struct netlink_sock),
606};
607
608static int __netlink_create(struct net *net, struct socket *sock,
609 struct mutex *cb_mutex, int protocol,
610 int kern)
611{
612 struct sock *sk;
613 struct netlink_sock *nlk;
614
615 sock->ops = &netlink_ops;
616
617 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
618 if (!sk)
619 return -ENOMEM;
620
621 sock_init_data(sock, sk);
622
623 nlk = nlk_sk(sk);
624 if (cb_mutex) {
625 nlk->cb_mutex = cb_mutex;
626 } else {
627 nlk->cb_mutex = &nlk->cb_def_mutex;
628 mutex_init(nlk->cb_mutex);
629 lockdep_set_class_and_name(nlk->cb_mutex,
630 nlk_cb_mutex_keys + protocol,
631 nlk_cb_mutex_key_strings[protocol]);
632 }
633 init_waitqueue_head(&nlk->wait);
634
635 sk->sk_destruct = netlink_sock_destruct;
636 sk->sk_protocol = protocol;
637 return 0;
638}
639
640static int netlink_create(struct net *net, struct socket *sock, int protocol,
641 int kern)
642{
643 struct module *module = NULL;
644 struct mutex *cb_mutex;
645 struct netlink_sock *nlk;
646 int (*bind)(struct net *net, int group);
647 void (*unbind)(struct net *net, int group);
648 int err = 0;
649
650 sock->state = SS_UNCONNECTED;
651
652 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
653 return -ESOCKTNOSUPPORT;
654
655 if (protocol < 0 || protocol >= MAX_LINKS)
656 return -EPROTONOSUPPORT;
657
658 netlink_lock_table();
659#ifdef CONFIG_MODULES
660 if (!nl_table[protocol].registered) {
661 netlink_unlock_table();
662 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
663 netlink_lock_table();
664 }
665#endif
666 if (nl_table[protocol].registered &&
667 try_module_get(nl_table[protocol].module))
668 module = nl_table[protocol].module;
669 else
670 err = -EPROTONOSUPPORT;
671 cb_mutex = nl_table[protocol].cb_mutex;
672 bind = nl_table[protocol].bind;
673 unbind = nl_table[protocol].unbind;
674 netlink_unlock_table();
675
676 if (err < 0)
677 goto out;
678
679 err = __netlink_create(net, sock, cb_mutex, protocol, kern);
680 if (err < 0)
681 goto out_module;
682
683 local_bh_disable();
684 sock_prot_inuse_add(net, &netlink_proto, 1);
685 local_bh_enable();
686
687 nlk = nlk_sk(sock->sk);
688 nlk->module = module;
689 nlk->netlink_bind = bind;
690 nlk->netlink_unbind = unbind;
691out:
692 return err;
693
694out_module:
695 module_put(module);
696 goto out;
697}
698
699static void deferred_put_nlk_sk(struct rcu_head *head)
700{
701 struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
702 struct sock *sk = &nlk->sk;
703
704 if (!atomic_dec_and_test(&sk->sk_refcnt))
705 return;
706
707 if (nlk->cb_running && nlk->cb.done) {
708 INIT_WORK(&nlk->work, netlink_sock_destruct_work);
709 schedule_work(&nlk->work);
710 return;
711 }
712
713 sk_free(sk);
714}
715
716static int netlink_release(struct socket *sock)
717{
718 struct sock *sk = sock->sk;
719 struct netlink_sock *nlk;
720
721 if (!sk)
722 return 0;
723
724 netlink_remove(sk);
725 sock_orphan(sk);
726 nlk = nlk_sk(sk);
727
728 /*
729 * OK. Socket is unlinked, any packets that arrive now
730 * will be purged.
731 */
732
733 /* must not acquire netlink_table_lock in any way again before unbind
734 * and notifying genetlink is done as otherwise it might deadlock
735 */
736 if (nlk->netlink_unbind) {
737 int i;
738
739 for (i = 0; i < nlk->ngroups; i++)
740 if (test_bit(i, nlk->groups))
741 nlk->netlink_unbind(sock_net(sk), i + 1);
742 }
743 if (sk->sk_protocol == NETLINK_GENERIC &&
744 atomic_dec_return(&genl_sk_destructing_cnt) == 0)
745 wake_up(&genl_sk_destructing_waitq);
746
747 sock->sk = NULL;
748 wake_up_interruptible_all(&nlk->wait);
749
750 skb_queue_purge(&sk->sk_write_queue);
751
752 if (nlk->portid && nlk->bound) {
753 struct netlink_notify n = {
754 .net = sock_net(sk),
755 .protocol = sk->sk_protocol,
756 .portid = nlk->portid,
757 };
758 atomic_notifier_call_chain(&netlink_chain,
759 NETLINK_URELEASE, &n);
760 }
761
762 module_put(nlk->module);
763
764 if (netlink_is_kernel(sk)) {
765 netlink_table_grab();
766 BUG_ON(nl_table[sk->sk_protocol].registered == 0);
767 if (--nl_table[sk->sk_protocol].registered == 0) {
768 struct listeners *old;
769
770 old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
771 RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
772 kfree_rcu(old, rcu);
773 nl_table[sk->sk_protocol].module = NULL;
774 nl_table[sk->sk_protocol].bind = NULL;
775 nl_table[sk->sk_protocol].unbind = NULL;
776 nl_table[sk->sk_protocol].flags = 0;
777 nl_table[sk->sk_protocol].registered = 0;
778 }
779 netlink_table_ungrab();
780 }
781
782 kfree(nlk->groups);
783 nlk->groups = NULL;
784
785 local_bh_disable();
786 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
787 local_bh_enable();
788 call_rcu(&nlk->rcu, deferred_put_nlk_sk);
789 return 0;
790}
791
792static int netlink_autobind(struct socket *sock)
793{
794 struct sock *sk = sock->sk;
795 struct net *net = sock_net(sk);
796 struct netlink_table *table = &nl_table[sk->sk_protocol];
797 s32 portid = task_tgid_vnr(current);
798 int err;
799 s32 rover = -4096;
800 bool ok;
801
802retry:
803 cond_resched();
804 rcu_read_lock();
805 ok = !__netlink_lookup(table, portid, net);
806 rcu_read_unlock();
807 if (!ok) {
808 /* Bind collision, search negative portid values. */
809 if (rover == -4096)
810 /* rover will be in range [S32_MIN, -4097] */
811 rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
812 else if (rover >= -4096)
813 rover = -4097;
814 portid = rover--;
815 goto retry;
816 }
817
818 err = netlink_insert(sk, portid);
819 if (err == -EADDRINUSE)
820 goto retry;
821
822 /* If 2 threads race to autobind, that is fine. */
823 if (err == -EBUSY)
824 err = 0;
825
826 return err;
827}
828
829/**
830 * __netlink_ns_capable - General netlink message capability test
831 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
832 * @user_ns: The user namespace of the capability to use
833 * @cap: The capability to use
834 *
835 * Test to see if the opener of the socket we received the message
836 * from had when the netlink socket was created and the sender of the
837 * message has has the capability @cap in the user namespace @user_ns.
838 */
839bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
840 struct user_namespace *user_ns, int cap)
841{
842 return ((nsp->flags & NETLINK_SKB_DST) ||
843 file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
844 ns_capable(user_ns, cap);
845}
846EXPORT_SYMBOL(__netlink_ns_capable);
847
848/**
849 * netlink_ns_capable - General netlink message capability test
850 * @skb: socket buffer holding a netlink command from userspace
851 * @user_ns: The user namespace of the capability to use
852 * @cap: The capability to use
853 *
854 * Test to see if the opener of the socket we received the message
855 * from had when the netlink socket was created and the sender of the
856 * message has has the capability @cap in the user namespace @user_ns.
857 */
858bool netlink_ns_capable(const struct sk_buff *skb,
859 struct user_namespace *user_ns, int cap)
860{
861 return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
862}
863EXPORT_SYMBOL(netlink_ns_capable);
864
865/**
866 * netlink_capable - Netlink global message capability test
867 * @skb: socket buffer holding a netlink command from userspace
868 * @cap: The capability to use
869 *
870 * Test to see if the opener of the socket we received the message
871 * from had when the netlink socket was created and the sender of the
872 * message has has the capability @cap in all user namespaces.
873 */
874bool netlink_capable(const struct sk_buff *skb, int cap)
875{
876 return netlink_ns_capable(skb, &init_user_ns, cap);
877}
878EXPORT_SYMBOL(netlink_capable);
879
880/**
881 * netlink_net_capable - Netlink network namespace message capability test
882 * @skb: socket buffer holding a netlink command from userspace
883 * @cap: The capability to use
884 *
885 * Test to see if the opener of the socket we received the message
886 * from had when the netlink socket was created and the sender of the
887 * message has has the capability @cap over the network namespace of
888 * the socket we received the message from.
889 */
890bool netlink_net_capable(const struct sk_buff *skb, int cap)
891{
892 return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
893}
894EXPORT_SYMBOL(netlink_net_capable);
895
896static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
897{
898 return (nl_table[sock->sk->sk_protocol].flags & flag) ||
899 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
900}
901
902static void
903netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
904{
905 struct netlink_sock *nlk = nlk_sk(sk);
906
907 if (nlk->subscriptions && !subscriptions)
908 __sk_del_bind_node(sk);
909 else if (!nlk->subscriptions && subscriptions)
910 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
911 nlk->subscriptions = subscriptions;
912}
913
914static int netlink_realloc_groups(struct sock *sk)
915{
916 struct netlink_sock *nlk = nlk_sk(sk);
917 unsigned int groups;
918 unsigned long *new_groups;
919 int err = 0;
920
921 netlink_table_grab();
922
923 groups = nl_table[sk->sk_protocol].groups;
924 if (!nl_table[sk->sk_protocol].registered) {
925 err = -ENOENT;
926 goto out_unlock;
927 }
928
929 if (nlk->ngroups >= groups)
930 goto out_unlock;
931
932 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
933 if (new_groups == NULL) {
934 err = -ENOMEM;
935 goto out_unlock;
936 }
937 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
938 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));
939
940 nlk->groups = new_groups;
941 nlk->ngroups = groups;
942 out_unlock:
943 netlink_table_ungrab();
944 return err;
945}
946
947static void netlink_undo_bind(int group, long unsigned int groups,
948 struct sock *sk)
949{
950 struct netlink_sock *nlk = nlk_sk(sk);
951 int undo;
952
953 if (!nlk->netlink_unbind)
954 return;
955
956 for (undo = 0; undo < group; undo++)
957 if (test_bit(undo, &groups))
958 nlk->netlink_unbind(sock_net(sk), undo + 1);
959}
960
961static int netlink_bind(struct socket *sock, struct sockaddr *addr,
962 int addr_len)
963{
964 struct sock *sk = sock->sk;
965 struct net *net = sock_net(sk);
966 struct netlink_sock *nlk = nlk_sk(sk);
967 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
968 int err;
969 long unsigned int groups = nladdr->nl_groups;
970 bool bound;
971
972 if (addr_len < sizeof(struct sockaddr_nl))
973 return -EINVAL;
974
975 if (nladdr->nl_family != AF_NETLINK)
976 return -EINVAL;
977
978 /* Only superuser is allowed to listen multicasts */
979 if (groups) {
980 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
981 return -EPERM;
982 err = netlink_realloc_groups(sk);
983 if (err)
984 return err;
985 }
986
987 bound = nlk->bound;
988 if (bound) {
989 /* Ensure nlk->portid is up-to-date. */
990 smp_rmb();
991
992 if (nladdr->nl_pid != nlk->portid)
993 return -EINVAL;
994 }
995
996 if (nlk->netlink_bind && groups) {
997 int group;
998
999 for (group = 0; group < nlk->ngroups; group++) {
1000 if (!test_bit(group, &groups))
1001 continue;
1002 err = nlk->netlink_bind(net, group + 1);
1003 if (!err)
1004 continue;
1005 netlink_undo_bind(group, groups, sk);
1006 return err;
1007 }
1008 }
1009
1010 /* No need for barriers here as we return to user-space without
1011 * using any of the bound attributes.
1012 */
1013 if (!bound) {
1014 err = nladdr->nl_pid ?
1015 netlink_insert(sk, nladdr->nl_pid) :
1016 netlink_autobind(sock);
1017 if (err) {
1018 netlink_undo_bind(nlk->ngroups, groups, sk);
1019 return err;
1020 }
1021 }
1022
1023 if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
1024 return 0;
1025
1026 netlink_table_grab();
1027 netlink_update_subscriptions(sk, nlk->subscriptions +
1028 hweight32(groups) -
1029 hweight32(nlk->groups[0]));
1030 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
1031 netlink_update_listeners(sk);
1032 netlink_table_ungrab();
1033
1034 return 0;
1035}
1036
1037static int netlink_connect(struct socket *sock, struct sockaddr *addr,
1038 int alen, int flags)
1039{
1040 int err = 0;
1041 struct sock *sk = sock->sk;
1042 struct netlink_sock *nlk = nlk_sk(sk);
1043 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
1044
1045 if (alen < sizeof(addr->sa_family))
1046 return -EINVAL;
1047
1048 if (addr->sa_family == AF_UNSPEC) {
1049 sk->sk_state = NETLINK_UNCONNECTED;
1050 nlk->dst_portid = 0;
1051 nlk->dst_group = 0;
1052 return 0;
1053 }
1054 if (addr->sa_family != AF_NETLINK)
1055 return -EINVAL;
1056
1057 if ((nladdr->nl_groups || nladdr->nl_pid) &&
1058 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1059 return -EPERM;
1060
1061 /* No need for barriers here as we return to user-space without
1062 * using any of the bound attributes.
1063 */
1064 if (!nlk->bound)
1065 err = netlink_autobind(sock);
1066
1067 if (err == 0) {
1068 sk->sk_state = NETLINK_CONNECTED;
1069 nlk->dst_portid = nladdr->nl_pid;
1070 nlk->dst_group = ffs(nladdr->nl_groups);
1071 }
1072
1073 return err;
1074}
1075
1076static int netlink_getname(struct socket *sock, struct sockaddr *addr,
1077 int *addr_len, int peer)
1078{
1079 struct sock *sk = sock->sk;
1080 struct netlink_sock *nlk = nlk_sk(sk);
1081 DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1082
1083 nladdr->nl_family = AF_NETLINK;
1084 nladdr->nl_pad = 0;
1085 *addr_len = sizeof(*nladdr);
1086
1087 if (peer) {
1088 nladdr->nl_pid = nlk->dst_portid;
1089 nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
1090 } else {
1091 nladdr->nl_pid = nlk->portid;
1092 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
1093 }
1094 return 0;
1095}
1096
1097static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
1098{
1099 struct sock *sock;
1100 struct netlink_sock *nlk;
1101
1102 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
1103 if (!sock)
1104 return ERR_PTR(-ECONNREFUSED);
1105
1106 /* Don't bother queuing skb if kernel socket has no input function */
1107 nlk = nlk_sk(sock);
1108 if (sock->sk_state == NETLINK_CONNECTED &&
1109 nlk->dst_portid != nlk_sk(ssk)->portid) {
1110 sock_put(sock);
1111 return ERR_PTR(-ECONNREFUSED);
1112 }
1113 return sock;
1114}
1115
1116struct sock *netlink_getsockbyfilp(struct file *filp)
1117{
1118 struct inode *inode = file_inode(filp);
1119 struct sock *sock;
1120
1121 if (!S_ISSOCK(inode->i_mode))
1122 return ERR_PTR(-ENOTSOCK);
1123
1124 sock = SOCKET_I(inode)->sk;
1125 if (sock->sk_family != AF_NETLINK)
1126 return ERR_PTR(-EINVAL);
1127
1128 sock_hold(sock);
1129 return sock;
1130}
1131
1132static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
1133 int broadcast)
1134{
1135 struct sk_buff *skb;
1136 void *data;
1137
1138 if (size <= NLMSG_GOODSIZE || broadcast)
1139 return alloc_skb(size, GFP_KERNEL);
1140
1141 size = SKB_DATA_ALIGN(size) +
1142 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1143
1144 data = vmalloc(size);
1145 if (data == NULL)
1146 return NULL;
1147
1148 skb = __build_skb(data, size);
1149 if (skb == NULL)
1150 vfree(data);
1151 else
1152 skb->destructor = netlink_skb_destructor;
1153
1154 return skb;
1155}
1156
1157/*
1158 * Attach a skb to a netlink socket.
1159 * The caller must hold a reference to the destination socket. On error, the
1160 * reference is dropped. The skb is not send to the destination, just all
1161 * all error checks are performed and memory in the queue is reserved.
1162 * Return values:
1163 * < 0: error. skb freed, reference to sock dropped.
1164 * 0: continue
1165 * 1: repeat lookup - reference dropped while waiting for socket memory.
1166 */
1167int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
1168 long *timeo, struct sock *ssk)
1169{
1170 struct netlink_sock *nlk;
1171
1172 nlk = nlk_sk(sk);
1173
1174 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1175 test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
1176 DECLARE_WAITQUEUE(wait, current);
1177 if (!*timeo) {
1178 if (!ssk || netlink_is_kernel(ssk))
1179 netlink_overrun(sk);
1180 sock_put(sk);
1181 kfree_skb(skb);
1182 return -EAGAIN;
1183 }
1184
1185 __set_current_state(TASK_INTERRUPTIBLE);
1186 add_wait_queue(&nlk->wait, &wait);
1187
1188 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1189 test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1190 !sock_flag(sk, SOCK_DEAD))
1191 *timeo = schedule_timeout(*timeo);
1192
1193 __set_current_state(TASK_RUNNING);
1194 remove_wait_queue(&nlk->wait, &wait);
1195 sock_put(sk);
1196
1197 if (signal_pending(current)) {
1198 kfree_skb(skb);
1199 return sock_intr_errno(*timeo);
1200 }
1201 return 1;
1202 }
1203 netlink_skb_set_owner_r(skb, sk);
1204 return 0;
1205}
1206
1207static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1208{
1209 int len = skb->len;
1210
1211 netlink_deliver_tap(skb);
1212
1213 skb_queue_tail(&sk->sk_receive_queue, skb);
1214 sk->sk_data_ready(sk);
1215 return len;
1216}
1217
1218int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1219{
1220 int len = __netlink_sendskb(sk, skb);
1221
1222 sock_put(sk);
1223 return len;
1224}
1225
1226void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
1227{
1228 kfree_skb(skb);
1229 sock_put(sk);
1230}
1231
1232static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
1233{
1234 int delta;
1235
1236 WARN_ON(skb->sk != NULL);
1237 delta = skb->end - skb->tail;
1238 if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
1239 return skb;
1240
1241 if (skb_shared(skb)) {
1242 struct sk_buff *nskb = skb_clone(skb, allocation);
1243 if (!nskb)
1244 return skb;
1245 consume_skb(skb);
1246 skb = nskb;
1247 }
1248
1249 if (!pskb_expand_head(skb, 0, -delta, allocation))
1250 skb->truesize -= delta;
1251
1252 return skb;
1253}
1254
1255static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
1256 struct sock *ssk)
1257{
1258 int ret;
1259 struct netlink_sock *nlk = nlk_sk(sk);
1260
1261 ret = -ECONNREFUSED;
1262 if (nlk->netlink_rcv != NULL) {
1263 ret = skb->len;
1264 netlink_skb_set_owner_r(skb, sk);
1265 NETLINK_CB(skb).sk = ssk;
1266 netlink_deliver_tap_kernel(sk, ssk, skb);
1267 nlk->netlink_rcv(skb);
1268 consume_skb(skb);
1269 } else {
1270 kfree_skb(skb);
1271 }
1272 sock_put(sk);
1273 return ret;
1274}
1275
1276int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1277 u32 portid, int nonblock)
1278{
1279 struct sock *sk;
1280 int err;
1281 long timeo;
1282
1283 skb = netlink_trim(skb, gfp_any());
1284
1285 timeo = sock_sndtimeo(ssk, nonblock);
1286retry:
1287 sk = netlink_getsockbyportid(ssk, portid);
1288 if (IS_ERR(sk)) {
1289 kfree_skb(skb);
1290 return PTR_ERR(sk);
1291 }
1292 if (netlink_is_kernel(sk))
1293 return netlink_unicast_kernel(sk, skb, ssk);
1294
1295 if (sk_filter(sk, skb)) {
1296 err = skb->len;
1297 kfree_skb(skb);
1298 sock_put(sk);
1299 return err;
1300 }
1301
1302 err = netlink_attachskb(sk, skb, &timeo, ssk);
1303 if (err == 1)
1304 goto retry;
1305 if (err)
1306 return err;
1307
1308 return netlink_sendskb(sk, skb);
1309}
1310EXPORT_SYMBOL(netlink_unicast);
1311
1312struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
1313 unsigned int ldiff, u32 dst_portid,
1314 gfp_t gfp_mask)
1315{
1316 return alloc_skb(size, gfp_mask);
1317}
1318EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
1319
1320int netlink_has_listeners(struct sock *sk, unsigned int group)
1321{
1322 int res = 0;
1323 struct listeners *listeners;
1324
1325 BUG_ON(!netlink_is_kernel(sk));
1326
1327 rcu_read_lock();
1328 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
1329
1330 if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1331 res = test_bit(group - 1, listeners->masks);
1332
1333 rcu_read_unlock();
1334
1335 return res;
1336}
1337EXPORT_SYMBOL_GPL(netlink_has_listeners);
1338
1339static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
1340{
1341 struct netlink_sock *nlk = nlk_sk(sk);
1342
1343 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1344 !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1345 netlink_skb_set_owner_r(skb, sk);
1346 __netlink_sendskb(sk, skb);
1347 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
1348 }
1349 return -1;
1350}
1351
1352struct netlink_broadcast_data {
1353 struct sock *exclude_sk;
1354 struct net *net;
1355 u32 portid;
1356 u32 group;
1357 int failure;
1358 int delivery_failure;
1359 int congested;
1360 int delivered;
1361 gfp_t allocation;
1362 struct sk_buff *skb, *skb2;
1363 int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
1364 void *tx_data;
1365};
1366
1367static void do_one_broadcast(struct sock *sk,
1368 struct netlink_broadcast_data *p)
1369{
1370 struct netlink_sock *nlk = nlk_sk(sk);
1371 int val;
1372
1373 if (p->exclude_sk == sk)
1374 return;
1375
1376 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1377 !test_bit(p->group - 1, nlk->groups))
1378 return;
1379
1380 if (!net_eq(sock_net(sk), p->net)) {
1381 if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
1382 return;
1383
1384 if (!peernet_has_id(sock_net(sk), p->net))
1385 return;
1386
1387 if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
1388 CAP_NET_BROADCAST))
1389 return;
1390 }
1391
1392 if (p->failure) {
1393 netlink_overrun(sk);
1394 return;
1395 }
1396
1397 sock_hold(sk);
1398 if (p->skb2 == NULL) {
1399 if (skb_shared(p->skb)) {
1400 p->skb2 = skb_copy(p->skb, p->allocation);
1401 } else {
1402 p->skb2 = skb_get(p->skb);
1403 /*
1404 * skb ownership may have been set when
1405 * delivered to a previous socket.
1406 */
1407 skb_orphan(p->skb2);
1408 }
1409 }
1410 if (p->skb2 == NULL) {
1411 netlink_overrun(sk);
1412 /* Clone failed. Notify ALL listeners. */
1413 p->failure = 1;
1414 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1415 p->delivery_failure = 1;
1416 goto out;
1417 }
1418 if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
1419 kfree_skb(p->skb2);
1420 p->skb2 = NULL;
1421 goto out;
1422 }
1423 if (sk_filter(sk, p->skb2)) {
1424 kfree_skb(p->skb2);
1425 p->skb2 = NULL;
1426 goto out;
1427 }
1428 NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
1429 NETLINK_CB(p->skb2).nsid_is_set = true;
1430 val = netlink_broadcast_deliver(sk, p->skb2);
1431 if (val < 0) {
1432 netlink_overrun(sk);
1433 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1434 p->delivery_failure = 1;
1435 } else {
1436 p->congested |= val;
1437 p->delivered = 1;
1438 p->skb2 = NULL;
1439 }
1440out:
1441 sock_put(sk);
1442}
1443
1444int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
1445 u32 group, gfp_t allocation,
1446 int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
1447 void *filter_data)
1448{
1449 struct net *net = sock_net(ssk);
1450 struct netlink_broadcast_data info;
1451 struct sock *sk;
1452
1453 skb = netlink_trim(skb, allocation);
1454
1455 info.exclude_sk = ssk;
1456 info.net = net;
1457 info.portid = portid;
1458 info.group = group;
1459 info.failure = 0;
1460 info.delivery_failure = 0;
1461 info.congested = 0;
1462 info.delivered = 0;
1463 info.allocation = allocation;
1464 info.skb = skb;
1465 info.skb2 = NULL;
1466 info.tx_filter = filter;
1467 info.tx_data = filter_data;
1468
1469 /* While we sleep in clone, do not allow to change socket list */
1470
1471 netlink_lock_table();
1472
1473 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
1474 do_one_broadcast(sk, &info);
1475
1476 consume_skb(skb);
1477
1478 netlink_unlock_table();
1479
1480 if (info.delivery_failure) {
1481 kfree_skb(info.skb2);
1482 return -ENOBUFS;
1483 }
1484 consume_skb(info.skb2);
1485
1486 if (info.delivered) {
1487 if (info.congested && gfpflags_allow_blocking(allocation))
1488 yield();
1489 return 0;
1490 }
1491 return -ESRCH;
1492}
1493EXPORT_SYMBOL(netlink_broadcast_filtered);
1494
1495int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
1496 u32 group, gfp_t allocation)
1497{
1498 return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
1499 NULL, NULL);
1500}
1501EXPORT_SYMBOL(netlink_broadcast);
1502
1503struct netlink_set_err_data {
1504 struct sock *exclude_sk;
1505 u32 portid;
1506 u32 group;
1507 int code;
1508};
1509
1510static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
1511{
1512 struct netlink_sock *nlk = nlk_sk(sk);
1513 int ret = 0;
1514
1515 if (sk == p->exclude_sk)
1516 goto out;
1517
1518 if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
1519 goto out;
1520
1521 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1522 !test_bit(p->group - 1, nlk->groups))
1523 goto out;
1524
1525 if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
1526 ret = 1;
1527 goto out;
1528 }
1529
1530 sk->sk_err = p->code;
1531 sk->sk_error_report(sk);
1532out:
1533 return ret;
1534}
1535
1536/**
1537 * netlink_set_err - report error to broadcast listeners
1538 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
1539 * @portid: the PORTID of a process that we want to skip (if any)
1540 * @group: the broadcast group that will notice the error
1541 * @code: error code, must be negative (as usual in kernelspace)
1542 *
1543 * This function returns the number of broadcast listeners that have set the
1544 * NETLINK_NO_ENOBUFS socket option.
1545 */
1546int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
1547{
1548 struct netlink_set_err_data info;
1549 struct sock *sk;
1550 int ret = 0;
1551
1552 info.exclude_sk = ssk;
1553 info.portid = portid;
1554 info.group = group;
1555 /* sk->sk_err wants a positive error value */
1556 info.code = -code;
1557
1558 read_lock(&nl_table_lock);
1559
1560 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
1561 ret += do_one_set_err(sk, &info);
1562
1563 read_unlock(&nl_table_lock);
1564 return ret;
1565}
1566EXPORT_SYMBOL(netlink_set_err);
1567
1568/* must be called with netlink table grabbed */
1569static void netlink_update_socket_mc(struct netlink_sock *nlk,
1570 unsigned int group,
1571 int is_new)
1572{
1573 int old, new = !!is_new, subscriptions;
1574
1575 old = test_bit(group - 1, nlk->groups);
1576 subscriptions = nlk->subscriptions - old + new;
1577 if (new)
1578 __set_bit(group - 1, nlk->groups);
1579 else
1580 __clear_bit(group - 1, nlk->groups);
1581 netlink_update_subscriptions(&nlk->sk, subscriptions);
1582 netlink_update_listeners(&nlk->sk);
1583}
1584
1585static int netlink_setsockopt(struct socket *sock, int level, int optname,
1586 char __user *optval, unsigned int optlen)
1587{
1588 struct sock *sk = sock->sk;
1589 struct netlink_sock *nlk = nlk_sk(sk);
1590 unsigned int val = 0;
1591 int err;
1592
1593 if (level != SOL_NETLINK)
1594 return -ENOPROTOOPT;
1595
1596 if (optlen >= sizeof(int) &&
1597 get_user(val, (unsigned int __user *)optval))
1598 return -EFAULT;
1599
1600 switch (optname) {
1601 case NETLINK_PKTINFO:
1602 if (val)
1603 nlk->flags |= NETLINK_F_RECV_PKTINFO;
1604 else
1605 nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
1606 err = 0;
1607 break;
1608 case NETLINK_ADD_MEMBERSHIP:
1609 case NETLINK_DROP_MEMBERSHIP: {
1610 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1611 return -EPERM;
1612 err = netlink_realloc_groups(sk);
1613 if (err)
1614 return err;
1615 if (!val || val - 1 >= nlk->ngroups)
1616 return -EINVAL;
1617 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
1618 err = nlk->netlink_bind(sock_net(sk), val);
1619 if (err)
1620 return err;
1621 }
1622 netlink_table_grab();
1623 netlink_update_socket_mc(nlk, val,
1624 optname == NETLINK_ADD_MEMBERSHIP);
1625 netlink_table_ungrab();
1626 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
1627 nlk->netlink_unbind(sock_net(sk), val);
1628
1629 err = 0;
1630 break;
1631 }
1632 case NETLINK_BROADCAST_ERROR:
1633 if (val)
1634 nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
1635 else
1636 nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
1637 err = 0;
1638 break;
1639 case NETLINK_NO_ENOBUFS:
1640 if (val) {
1641 nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
1642 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
1643 wake_up_interruptible(&nlk->wait);
1644 } else {
1645 nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
1646 }
1647 err = 0;
1648 break;
1649 case NETLINK_LISTEN_ALL_NSID:
1650 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
1651 return -EPERM;
1652
1653 if (val)
1654 nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
1655 else
1656 nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
1657 err = 0;
1658 break;
1659 case NETLINK_CAP_ACK:
1660 if (val)
1661 nlk->flags |= NETLINK_F_CAP_ACK;
1662 else
1663 nlk->flags &= ~NETLINK_F_CAP_ACK;
1664 err = 0;
1665 break;
1666 default:
1667 err = -ENOPROTOOPT;
1668 }
1669 return err;
1670}
1671
1672static int netlink_getsockopt(struct socket *sock, int level, int optname,
1673 char __user *optval, int __user *optlen)
1674{
1675 struct sock *sk = sock->sk;
1676 struct netlink_sock *nlk = nlk_sk(sk);
1677 int len, val, err;
1678
1679 if (level != SOL_NETLINK)
1680 return -ENOPROTOOPT;
1681
1682 if (get_user(len, optlen))
1683 return -EFAULT;
1684 if (len < 0)
1685 return -EINVAL;
1686
1687 switch (optname) {
1688 case NETLINK_PKTINFO:
1689 if (len < sizeof(int))
1690 return -EINVAL;
1691 len = sizeof(int);
1692 val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
1693 if (put_user(len, optlen) ||
1694 put_user(val, optval))
1695 return -EFAULT;
1696 err = 0;
1697 break;
1698 case NETLINK_BROADCAST_ERROR:
1699 if (len < sizeof(int))
1700 return -EINVAL;
1701 len = sizeof(int);
1702 val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
1703 if (put_user(len, optlen) ||
1704 put_user(val, optval))
1705 return -EFAULT;
1706 err = 0;
1707 break;
1708 case NETLINK_NO_ENOBUFS:
1709 if (len < sizeof(int))
1710 return -EINVAL;
1711 len = sizeof(int);
1712 val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
1713 if (put_user(len, optlen) ||
1714 put_user(val, optval))
1715 return -EFAULT;
1716 err = 0;
1717 break;
1718 case NETLINK_LIST_MEMBERSHIPS: {
1719 int pos, idx, shift;
1720
1721 err = 0;
1722 netlink_lock_table();
1723 for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
1724 if (len - pos < sizeof(u32))
1725 break;
1726
1727 idx = pos / sizeof(unsigned long);
1728 shift = (pos % sizeof(unsigned long)) * 8;
1729 if (put_user((u32)(nlk->groups[idx] >> shift),
1730 (u32 __user *)(optval + pos))) {
1731 err = -EFAULT;
1732 break;
1733 }
1734 }
1735 if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
1736 err = -EFAULT;
1737 netlink_unlock_table();
1738 break;
1739 }
1740 case NETLINK_CAP_ACK:
1741 if (len < sizeof(int))
1742 return -EINVAL;
1743 len = sizeof(int);
1744 val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
1745 if (put_user(len, optlen) ||
1746 put_user(val, optval))
1747 return -EFAULT;
1748 err = 0;
1749 break;
1750 default:
1751 err = -ENOPROTOOPT;
1752 }
1753 return err;
1754}
1755
1756static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
1757{
1758 struct nl_pktinfo info;
1759
1760 info.group = NETLINK_CB(skb).dst_group;
1761 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
1762}
1763
1764static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
1765 struct sk_buff *skb)
1766{
1767 if (!NETLINK_CB(skb).nsid_is_set)
1768 return;
1769
1770 put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
1771 &NETLINK_CB(skb).nsid);
1772}
1773
1774static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1775{
1776 struct sock *sk = sock->sk;
1777 struct netlink_sock *nlk = nlk_sk(sk);
1778 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
1779 u32 dst_portid;
1780 u32 dst_group;
1781 struct sk_buff *skb;
1782 int err;
1783 struct scm_cookie scm;
1784 u32 netlink_skb_flags = 0;
1785
1786 if (msg->msg_flags&MSG_OOB)
1787 return -EOPNOTSUPP;
1788
1789 err = scm_send(sock, msg, &scm, true);
1790 if (err < 0)
1791 return err;
1792
1793 if (msg->msg_namelen) {
1794 err = -EINVAL;
1795 if (addr->nl_family != AF_NETLINK)
1796 goto out;
1797 dst_portid = addr->nl_pid;
1798 dst_group = ffs(addr->nl_groups);
1799 err = -EPERM;
1800 if ((dst_group || dst_portid) &&
1801 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1802 goto out;
1803 netlink_skb_flags |= NETLINK_SKB_DST;
1804 } else {
1805 dst_portid = nlk->dst_portid;
1806 dst_group = nlk->dst_group;
1807 }
1808
1809 if (!nlk->bound) {
1810 err = netlink_autobind(sock);
1811 if (err)
1812 goto out;
1813 } else {
1814 /* Ensure nlk is hashed and visible. */
1815 smp_rmb();
1816 }
1817
1818 err = -EMSGSIZE;
1819 if (len > sk->sk_sndbuf - 32)
1820 goto out;
1821 err = -ENOBUFS;
1822 skb = netlink_alloc_large_skb(len, dst_group);
1823 if (skb == NULL)
1824 goto out;
1825
1826 NETLINK_CB(skb).portid = nlk->portid;
1827 NETLINK_CB(skb).dst_group = dst_group;
1828 NETLINK_CB(skb).creds = scm.creds;
1829 NETLINK_CB(skb).flags = netlink_skb_flags;
1830
1831 err = -EFAULT;
1832 if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1833 kfree_skb(skb);
1834 goto out;
1835 }
1836
1837 err = security_netlink_send(sk, skb);
1838 if (err) {
1839 kfree_skb(skb);
1840 goto out;
1841 }
1842
1843 if (dst_group) {
1844 atomic_inc(&skb->users);
1845 netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
1846 }
1847 err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
1848
1849out:
1850 scm_destroy(&scm);
1851 return err;
1852}
1853
1854static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
1855 int flags)
1856{
1857 struct scm_cookie scm;
1858 struct sock *sk = sock->sk;
1859 struct netlink_sock *nlk = nlk_sk(sk);
1860 int noblock = flags&MSG_DONTWAIT;
1861 size_t copied;
1862 struct sk_buff *skb, *data_skb;
1863 int err, ret;
1864
1865 if (flags&MSG_OOB)
1866 return -EOPNOTSUPP;
1867
1868 copied = 0;
1869
1870 skb = skb_recv_datagram(sk, flags, noblock, &err);
1871 if (skb == NULL)
1872 goto out;
1873
1874 data_skb = skb;
1875
1876#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
1877 if (unlikely(skb_shinfo(skb)->frag_list)) {
1878 /*
1879 * If this skb has a frag_list, then here that means that we
1880 * will have to use the frag_list skb's data for compat tasks
1881 * and the regular skb's data for normal (non-compat) tasks.
1882 *
1883 * If we need to send the compat skb, assign it to the
1884 * 'data_skb' variable so that it will be used below for data
1885 * copying. We keep 'skb' for everything else, including
1886 * freeing both later.
1887 */
1888 if (flags & MSG_CMSG_COMPAT)
1889 data_skb = skb_shinfo(skb)->frag_list;
1890 }
1891#endif
1892
1893 /* Record the max length of recvmsg() calls for future allocations */
1894 nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
1895 nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
1896 SKB_WITH_OVERHEAD(32768));
1897
1898 copied = data_skb->len;
1899 if (len < copied) {
1900 msg->msg_flags |= MSG_TRUNC;
1901 copied = len;
1902 }
1903
1904 skb_reset_transport_header(data_skb);
1905 err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
1906
1907 if (msg->msg_name) {
1908 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
1909 addr->nl_family = AF_NETLINK;
1910 addr->nl_pad = 0;
1911 addr->nl_pid = NETLINK_CB(skb).portid;
1912 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group);
1913 msg->msg_namelen = sizeof(*addr);
1914 }
1915
1916 if (nlk->flags & NETLINK_F_RECV_PKTINFO)
1917 netlink_cmsg_recv_pktinfo(msg, skb);
1918 if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
1919 netlink_cmsg_listen_all_nsid(sk, msg, skb);
1920
1921 memset(&scm, 0, sizeof(scm));
1922 scm.creds = *NETLINK_CREDS(skb);
1923 if (flags & MSG_TRUNC)
1924 copied = data_skb->len;
1925
1926 skb_free_datagram(sk, skb);
1927
1928 if (nlk->cb_running &&
1929 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
1930 ret = netlink_dump(sk);
1931 if (ret) {
1932 sk->sk_err = -ret;
1933 sk->sk_error_report(sk);
1934 }
1935 }
1936
1937 scm_recv(sock, msg, &scm, flags);
1938out:
1939 netlink_rcv_wake(sk);
1940 return err ? : copied;
1941}
1942
1943static void netlink_data_ready(struct sock *sk)
1944{
1945 BUG();
1946}
1947
1948/*
1949 * We export these functions to other modules. They provide a
1950 * complete set of kernel non-blocking support for message
1951 * queueing.
1952 */
1953
1954struct sock *
1955__netlink_kernel_create(struct net *net, int unit, struct module *module,
1956 struct netlink_kernel_cfg *cfg)
1957{
1958 struct socket *sock;
1959 struct sock *sk;
1960 struct netlink_sock *nlk;
1961 struct listeners *listeners = NULL;
1962 struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
1963 unsigned int groups;
1964
1965 BUG_ON(!nl_table);
1966
1967 if (unit < 0 || unit >= MAX_LINKS)
1968 return NULL;
1969
1970 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
1971 return NULL;
1972
1973 if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
1974 goto out_sock_release_nosk;
1975
1976 sk = sock->sk;
1977
1978 if (!cfg || cfg->groups < 32)
1979 groups = 32;
1980 else
1981 groups = cfg->groups;
1982
1983 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
1984 if (!listeners)
1985 goto out_sock_release;
1986
1987 sk->sk_data_ready = netlink_data_ready;
1988 if (cfg && cfg->input)
1989 nlk_sk(sk)->netlink_rcv = cfg->input;
1990
1991 if (netlink_insert(sk, 0))
1992 goto out_sock_release;
1993
1994 nlk = nlk_sk(sk);
1995 nlk->flags |= NETLINK_F_KERNEL_SOCKET;
1996
1997 netlink_table_grab();
1998 if (!nl_table[unit].registered) {
1999 nl_table[unit].groups = groups;
2000 rcu_assign_pointer(nl_table[unit].listeners, listeners);
2001 nl_table[unit].cb_mutex = cb_mutex;
2002 nl_table[unit].module = module;
2003 if (cfg) {
2004 nl_table[unit].bind = cfg->bind;
2005 nl_table[unit].unbind = cfg->unbind;
2006 nl_table[unit].flags = cfg->flags;
2007 if (cfg->compare)
2008 nl_table[unit].compare = cfg->compare;
2009 }
2010 nl_table[unit].registered = 1;
2011 } else {
2012 kfree(listeners);
2013 nl_table[unit].registered++;
2014 }
2015 netlink_table_ungrab();
2016 return sk;
2017
2018out_sock_release:
2019 kfree(listeners);
2020 netlink_kernel_release(sk);
2021 return NULL;
2022
2023out_sock_release_nosk:
2024 sock_release(sock);
2025 return NULL;
2026}
2027EXPORT_SYMBOL(__netlink_kernel_create);
2028
2029void
2030netlink_kernel_release(struct sock *sk)
2031{
2032 if (sk == NULL || sk->sk_socket == NULL)
2033 return;
2034
2035 sock_release(sk->sk_socket);
2036}
2037EXPORT_SYMBOL(netlink_kernel_release);
2038
2039int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
2040{
2041 struct listeners *new, *old;
2042 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
2043
2044 if (groups < 32)
2045 groups = 32;
2046
2047 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2048 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
2049 if (!new)
2050 return -ENOMEM;
2051 old = nl_deref_protected(tbl->listeners);
2052 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
2053 rcu_assign_pointer(tbl->listeners, new);
2054
2055 kfree_rcu(old, rcu);
2056 }
2057 tbl->groups = groups;
2058
2059 return 0;
2060}
2061
2062/**
2063 * netlink_change_ngroups - change number of multicast groups
2064 *
2065 * This changes the number of multicast groups that are available
2066 * on a certain netlink family. Note that it is not possible to
2067 * change the number of groups to below 32. Also note that it does
2068 * not implicitly call netlink_clear_multicast_users() when the
2069 * number of groups is reduced.
2070 *
2071 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
2072 * @groups: The new number of groups.
2073 */
2074int netlink_change_ngroups(struct sock *sk, unsigned int groups)
2075{
2076 int err;
2077
2078 netlink_table_grab();
2079 err = __netlink_change_ngroups(sk, groups);
2080 netlink_table_ungrab();
2081
2082 return err;
2083}
2084
2085void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
2086{
2087 struct sock *sk;
2088 struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
2089
2090 sk_for_each_bound(sk, &tbl->mc_list)
2091 netlink_update_socket_mc(nlk_sk(sk), group, 0);
2092}
2093
2094struct nlmsghdr *
2095__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2096{
2097 struct nlmsghdr *nlh;
2098 int size = nlmsg_msg_size(len);
2099
2100 nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2101 nlh->nlmsg_type = type;
2102 nlh->nlmsg_len = size;
2103 nlh->nlmsg_flags = flags;
2104 nlh->nlmsg_pid = portid;
2105 nlh->nlmsg_seq = seq;
2106 if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2107 memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2108 return nlh;
2109}
2110EXPORT_SYMBOL(__nlmsg_put);
2111
2112/*
2113 * It looks a bit ugly.
2114 * It would be better to create kernel thread.
2115 */
2116
2117static int netlink_dump(struct sock *sk)
2118{
2119 struct netlink_sock *nlk = nlk_sk(sk);
2120 struct netlink_callback *cb;
2121 struct sk_buff *skb = NULL;
2122 struct nlmsghdr *nlh;
2123 struct module *module;
2124 int err = -ENOBUFS;
2125 int alloc_min_size;
2126 int alloc_size;
2127
2128 mutex_lock(nlk->cb_mutex);
2129 if (!nlk->cb_running) {
2130 err = -EINVAL;
2131 goto errout_skb;
2132 }
2133
2134 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2135 goto errout_skb;
2136
2137 /* NLMSG_GOODSIZE is small to avoid high order allocations being
2138 * required, but it makes sense to _attempt_ a 16K bytes allocation
2139 * to reduce number of system calls on dump operations, if user
2140 * ever provided a big enough buffer.
2141 */
2142 cb = &nlk->cb;
2143 alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
2144
2145 if (alloc_min_size < nlk->max_recvmsg_len) {
2146 alloc_size = nlk->max_recvmsg_len;
2147 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
2148 (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) |
2149 __GFP_NOWARN | __GFP_NORETRY);
2150 }
2151 if (!skb) {
2152 alloc_size = alloc_min_size;
2153 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
2154 GFP_KERNEL);
2155 }
2156 if (!skb)
2157 goto errout_skb;
2158
2159 /* Trim skb to allocated size. User is expected to provide buffer as
2160 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
2161 * netlink_recvmsg())). dump will pack as many smaller messages as
2162 * could fit within the allocated skb. skb is typically allocated
2163 * with larger space than required (could be as much as near 2x the
2164 * requested size with align to next power of 2 approach). Allowing
2165 * dump to use the excess space makes it difficult for a user to have a
2166 * reasonable static buffer based on the expected largest dump of a
2167 * single netdev. The outcome is MSG_TRUNC error.
2168 */
2169 skb_reserve(skb, skb_tailroom(skb) - alloc_size);
2170 netlink_skb_set_owner_r(skb, sk);
2171
2172 if (nlk->dump_done_errno > 0)
2173 nlk->dump_done_errno = cb->dump(skb, cb);
2174
2175 if (nlk->dump_done_errno > 0 ||
2176 skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
2177 mutex_unlock(nlk->cb_mutex);
2178
2179 if (sk_filter(sk, skb))
2180 kfree_skb(skb);
2181 else
2182 __netlink_sendskb(sk, skb);
2183 return 0;
2184 }
2185
2186 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE,
2187 sizeof(nlk->dump_done_errno), NLM_F_MULTI);
2188 if (WARN_ON(!nlh))
2189 goto errout_skb;
2190
2191 nl_dump_check_consistent(cb, nlh);
2192
2193 memcpy(nlmsg_data(nlh), &nlk->dump_done_errno,
2194 sizeof(nlk->dump_done_errno));
2195
2196 if (sk_filter(sk, skb))
2197 kfree_skb(skb);
2198 else
2199 __netlink_sendskb(sk, skb);
2200
2201 if (cb->done)
2202 cb->done(cb);
2203
2204 nlk->cb_running = false;
2205 module = cb->module;
2206 skb = cb->skb;
2207 mutex_unlock(nlk->cb_mutex);
2208 module_put(module);
2209 consume_skb(skb);
2210 return 0;
2211
2212errout_skb:
2213 mutex_unlock(nlk->cb_mutex);
2214 kfree_skb(skb);
2215 return err;
2216}
2217
2218int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
2219 const struct nlmsghdr *nlh,
2220 struct netlink_dump_control *control)
2221{
2222 struct netlink_callback *cb;
2223 struct sock *sk;
2224 struct netlink_sock *nlk;
2225 int ret;
2226
2227 atomic_inc(&skb->users);
2228
2229 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
2230 if (sk == NULL) {
2231 ret = -ECONNREFUSED;
2232 goto error_free;
2233 }
2234
2235 nlk = nlk_sk(sk);
2236 mutex_lock(nlk->cb_mutex);
2237 /* A dump is in progress... */
2238 if (nlk->cb_running) {
2239 ret = -EBUSY;
2240 goto error_unlock;
2241 }
2242 /* add reference of module which cb->dump belongs to */
2243 if (!try_module_get(control->module)) {
2244 ret = -EPROTONOSUPPORT;
2245 goto error_unlock;
2246 }
2247
2248 cb = &nlk->cb;
2249 memset(cb, 0, sizeof(*cb));
2250 cb->start = control->start;
2251 cb->dump = control->dump;
2252 cb->done = control->done;
2253 cb->nlh = nlh;
2254 cb->data = control->data;
2255 cb->module = control->module;
2256 cb->min_dump_alloc = control->min_dump_alloc;
2257 cb->skb = skb;
2258
2259 nlk->cb_running = true;
2260 nlk->dump_done_errno = INT_MAX;
2261
2262 mutex_unlock(nlk->cb_mutex);
2263
2264 if (cb->start)
2265 cb->start(cb);
2266
2267 ret = netlink_dump(sk);
2268 sock_put(sk);
2269
2270 if (ret)
2271 return ret;
2272
2273 /* We successfully started a dump, by returning -EINTR we
2274 * signal not to send ACK even if it was requested.
2275 */
2276 return -EINTR;
2277
2278error_unlock:
2279 sock_put(sk);
2280 mutex_unlock(nlk->cb_mutex);
2281error_free:
2282 kfree_skb(skb);
2283 return ret;
2284}
2285EXPORT_SYMBOL(__netlink_dump_start);
2286
2287void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
2288{
2289 struct sk_buff *skb;
2290 struct nlmsghdr *rep;
2291 struct nlmsgerr *errmsg;
2292 size_t payload = sizeof(*errmsg);
2293 struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
2294
2295 /* Error messages get the original request appened, unless the user
2296 * requests to cap the error message.
2297 */
2298 if (!(nlk->flags & NETLINK_F_CAP_ACK) && err)
2299 payload += nlmsg_len(nlh);
2300
2301 skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload),
2302 NETLINK_CB(in_skb).portid, GFP_KERNEL);
2303 if (!skb) {
2304 struct sock *sk;
2305
2306 sk = netlink_lookup(sock_net(in_skb->sk),
2307 in_skb->sk->sk_protocol,
2308 NETLINK_CB(in_skb).portid);
2309 if (sk) {
2310 sk->sk_err = ENOBUFS;
2311 sk->sk_error_report(sk);
2312 sock_put(sk);
2313 }
2314 return;
2315 }
2316
2317 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2318 NLMSG_ERROR, payload, 0);
2319 errmsg = nlmsg_data(rep);
2320 errmsg->error = err;
2321 memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
2322 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
2323}
2324EXPORT_SYMBOL(netlink_ack);
2325
2326int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2327 struct nlmsghdr *))
2328{
2329 struct nlmsghdr *nlh;
2330 int err;
2331
2332 while (skb->len >= nlmsg_total_size(0)) {
2333 int msglen;
2334
2335 nlh = nlmsg_hdr(skb);
2336 err = 0;
2337
2338 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2339 return 0;
2340
2341 /* Only requests are handled by the kernel */
2342 if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2343 goto ack;
2344
2345 /* Skip control messages */
2346 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2347 goto ack;
2348
2349 err = cb(skb, nlh);
2350 if (err == -EINTR)
2351 goto skip;
2352
2353ack:
2354 if (nlh->nlmsg_flags & NLM_F_ACK || err)
2355 netlink_ack(skb, nlh, err);
2356
2357skip:
2358 msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2359 if (msglen > skb->len)
2360 msglen = skb->len;
2361 skb_pull(skb, msglen);
2362 }
2363
2364 return 0;
2365}
2366EXPORT_SYMBOL(netlink_rcv_skb);
2367
2368/**
2369 * nlmsg_notify - send a notification netlink message
2370 * @sk: netlink socket to use
2371 * @skb: notification message
2372 * @portid: destination netlink portid for reports or 0
2373 * @group: destination multicast group or 0
2374 * @report: 1 to report back, 0 to disable
2375 * @flags: allocation flags
2376 */
2377int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
2378 unsigned int group, int report, gfp_t flags)
2379{
2380 int err = 0;
2381
2382 if (group) {
2383 int exclude_portid = 0;
2384
2385 if (report) {
2386 atomic_inc(&skb->users);
2387 exclude_portid = portid;
2388 }
2389
2390 /* errors reported via destination sk->sk_err, but propagate
2391 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
2392 err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
2393 }
2394
2395 if (report) {
2396 int err2;
2397
2398 err2 = nlmsg_unicast(sk, skb, portid);
2399 if (!err || err == -ESRCH)
2400 err = err2;
2401 }
2402
2403 return err;
2404}
2405EXPORT_SYMBOL(nlmsg_notify);
2406
2407#ifdef CONFIG_PROC_FS
2408struct nl_seq_iter {
2409 struct seq_net_private p;
2410 struct rhashtable_iter hti;
2411 int link;
2412};
2413
2414static int netlink_walk_start(struct nl_seq_iter *iter)
2415{
2416 int err;
2417
2418 err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti);
2419 if (err) {
2420 iter->link = MAX_LINKS;
2421 return err;
2422 }
2423
2424 err = rhashtable_walk_start(&iter->hti);
2425 return err == -EAGAIN ? 0 : err;
2426}
2427
2428static void netlink_walk_stop(struct nl_seq_iter *iter)
2429{
2430 rhashtable_walk_stop(&iter->hti);
2431 rhashtable_walk_exit(&iter->hti);
2432}
2433
2434static void *__netlink_seq_next(struct seq_file *seq)
2435{
2436 struct nl_seq_iter *iter = seq->private;
2437 struct netlink_sock *nlk;
2438
2439 do {
2440 for (;;) {
2441 int err;
2442
2443 nlk = rhashtable_walk_next(&iter->hti);
2444
2445 if (IS_ERR(nlk)) {
2446 if (PTR_ERR(nlk) == -EAGAIN)
2447 continue;
2448
2449 return nlk;
2450 }
2451
2452 if (nlk)
2453 break;
2454
2455 netlink_walk_stop(iter);
2456 if (++iter->link >= MAX_LINKS)
2457 return NULL;
2458
2459 err = netlink_walk_start(iter);
2460 if (err)
2461 return ERR_PTR(err);
2462 }
2463 } while (sock_net(&nlk->sk) != seq_file_net(seq));
2464
2465 return nlk;
2466}
2467
2468static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
2469{
2470 struct nl_seq_iter *iter = seq->private;
2471 void *obj = SEQ_START_TOKEN;
2472 loff_t pos;
2473 int err;
2474
2475 iter->link = 0;
2476
2477 err = netlink_walk_start(iter);
2478 if (err)
2479 return ERR_PTR(err);
2480
2481 for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
2482 obj = __netlink_seq_next(seq);
2483
2484 return obj;
2485}
2486
2487static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2488{
2489 ++*pos;
2490 return __netlink_seq_next(seq);
2491}
2492
2493static void netlink_seq_stop(struct seq_file *seq, void *v)
2494{
2495 struct nl_seq_iter *iter = seq->private;
2496
2497 if (iter->link >= MAX_LINKS)
2498 return;
2499
2500 netlink_walk_stop(iter);
2501}
2502
2503
2504static int netlink_seq_show(struct seq_file *seq, void *v)
2505{
2506 if (v == SEQ_START_TOKEN) {
2507 seq_puts(seq,
2508 "sk Eth Pid Groups "
2509 "Rmem Wmem Dump Locks Drops Inode\n");
2510 } else {
2511 struct sock *s = v;
2512 struct netlink_sock *nlk = nlk_sk(s);
2513
2514 seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
2515 s,
2516 s->sk_protocol,
2517 nlk->portid,
2518 nlk->groups ? (u32)nlk->groups[0] : 0,
2519 sk_rmem_alloc_get(s),
2520 sk_wmem_alloc_get(s),
2521 nlk->cb_running,
2522 atomic_read(&s->sk_refcnt),
2523 atomic_read(&s->sk_drops),
2524 sock_i_ino(s)
2525 );
2526
2527 }
2528 return 0;
2529}
2530
2531static const struct seq_operations netlink_seq_ops = {
2532 .start = netlink_seq_start,
2533 .next = netlink_seq_next,
2534 .stop = netlink_seq_stop,
2535 .show = netlink_seq_show,
2536};
2537
2538
2539static int netlink_seq_open(struct inode *inode, struct file *file)
2540{
2541 return seq_open_net(inode, file, &netlink_seq_ops,
2542 sizeof(struct nl_seq_iter));
2543}
2544
2545static const struct file_operations netlink_seq_fops = {
2546 .owner = THIS_MODULE,
2547 .open = netlink_seq_open,
2548 .read = seq_read,
2549 .llseek = seq_lseek,
2550 .release = seq_release_net,
2551};
2552
2553#endif
2554
2555int netlink_register_notifier(struct notifier_block *nb)
2556{
2557 return atomic_notifier_chain_register(&netlink_chain, nb);
2558}
2559EXPORT_SYMBOL(netlink_register_notifier);
2560
2561int netlink_unregister_notifier(struct notifier_block *nb)
2562{
2563 return atomic_notifier_chain_unregister(&netlink_chain, nb);
2564}
2565EXPORT_SYMBOL(netlink_unregister_notifier);
2566
2567static const struct proto_ops netlink_ops = {
2568 .family = PF_NETLINK,
2569 .owner = THIS_MODULE,
2570 .release = netlink_release,
2571 .bind = netlink_bind,
2572 .connect = netlink_connect,
2573 .socketpair = sock_no_socketpair,
2574 .accept = sock_no_accept,
2575 .getname = netlink_getname,
2576 .poll = datagram_poll,
2577 .ioctl = sock_no_ioctl,
2578 .listen = sock_no_listen,
2579 .shutdown = sock_no_shutdown,
2580 .setsockopt = netlink_setsockopt,
2581 .getsockopt = netlink_getsockopt,
2582 .sendmsg = netlink_sendmsg,
2583 .recvmsg = netlink_recvmsg,
2584 .mmap = sock_no_mmap,
2585 .sendpage = sock_no_sendpage,
2586};
2587
2588static const struct net_proto_family netlink_family_ops = {
2589 .family = PF_NETLINK,
2590 .create = netlink_create,
2591 .owner = THIS_MODULE, /* for consistency 8) */
2592};
2593
2594static int __net_init netlink_net_init(struct net *net)
2595{
2596#ifdef CONFIG_PROC_FS
2597 if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
2598 return -ENOMEM;
2599#endif
2600 return 0;
2601}
2602
2603static void __net_exit netlink_net_exit(struct net *net)
2604{
2605#ifdef CONFIG_PROC_FS
2606 remove_proc_entry("netlink", net->proc_net);
2607#endif
2608}
2609
2610static void __init netlink_add_usersock_entry(void)
2611{
2612 struct listeners *listeners;
2613 int groups = 32;
2614
2615 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2616 if (!listeners)
2617 panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
2618
2619 netlink_table_grab();
2620
2621 nl_table[NETLINK_USERSOCK].groups = groups;
2622 rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
2623 nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
2624 nl_table[NETLINK_USERSOCK].registered = 1;
2625 nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
2626
2627 netlink_table_ungrab();
2628}
2629
2630static struct pernet_operations __net_initdata netlink_net_ops = {
2631 .init = netlink_net_init,
2632 .exit = netlink_net_exit,
2633};
2634
2635static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
2636{
2637 const struct netlink_sock *nlk = data;
2638 struct netlink_compare_arg arg;
2639
2640 netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
2641 return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
2642}
2643
2644static const struct rhashtable_params netlink_rhashtable_params = {
2645 .head_offset = offsetof(struct netlink_sock, node),
2646 .key_len = netlink_compare_arg_len,
2647 .obj_hashfn = netlink_hash,
2648 .obj_cmpfn = netlink_compare,
2649 .automatic_shrinking = true,
2650};
2651
2652static int __init netlink_proto_init(void)
2653{
2654 int i;
2655 int err = proto_register(&netlink_proto, 0);
2656
2657 if (err != 0)
2658 goto out;
2659
2660 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
2661
2662 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
2663 if (!nl_table)
2664 goto panic;
2665
2666 for (i = 0; i < MAX_LINKS; i++) {
2667 if (rhashtable_init(&nl_table[i].hash,
2668 &netlink_rhashtable_params) < 0) {
2669 while (--i > 0)
2670 rhashtable_destroy(&nl_table[i].hash);
2671 kfree(nl_table);
2672 goto panic;
2673 }
2674 }
2675
2676 INIT_LIST_HEAD(&netlink_tap_all);
2677
2678 netlink_add_usersock_entry();
2679
2680 sock_register(&netlink_family_ops);
2681 register_pernet_subsys(&netlink_net_ops);
2682 /* The netlink device handler may be needed early. */
2683 rtnetlink_init();
2684out:
2685 return err;
2686panic:
2687 panic("netlink_init: Cannot allocate nl_table\n");
2688}
2689
2690core_initcall(netlink_proto_init);