1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * VMware vSockets Driver 4 * 5 * Copyright (C) 2007-2013 VMware, Inc. All rights reserved. 6 */ 7 8 /* Implementation notes: 9 * 10 * - There are two kinds of sockets: those created by user action (such as 11 * calling socket(2)) and those created by incoming connection request packets. 12 * 13 * - There are two "global" tables, one for bound sockets (sockets that have 14 * specified an address that they are responsible for) and one for connected 15 * sockets (sockets that have established a connection with another socket). 16 * These tables are "global" in that all sockets on the system are placed 17 * within them. - Note, though, that the bound table contains an extra entry 18 * for a list of unbound sockets and SOCK_DGRAM sockets will always remain in 19 * that list. The bound table is used solely for lookup of sockets when packets 20 * are received and that's not necessary for SOCK_DGRAM sockets since we create 21 * a datagram handle for each and need not perform a lookup. Keeping SOCK_DGRAM 22 * sockets out of the bound hash buckets will reduce the chance of collisions 23 * when looking for SOCK_STREAM sockets and prevents us from having to check the 24 * socket type in the hash table lookups. 25 * 26 * - Sockets created by user action will either be "client" sockets that 27 * initiate a connection or "server" sockets that listen for connections; we do 28 * not support simultaneous connects (two "client" sockets connecting). 29 * 30 * - "Server" sockets are referred to as listener sockets throughout this 31 * implementation because they are in the TCP_LISTEN state. When a 32 * connection request is received (the second kind of socket mentioned above), 33 * we create a new socket and refer to it as a pending socket. These pending 34 * sockets are placed on the pending connection list of the listener socket. 35 * When future packets are received for the address the listener socket is 36 * bound to, we check if the source of the packet is from one that has an 37 * existing pending connection. If it does, we process the packet for the 38 * pending socket. When that socket reaches the connected state, it is removed 39 * from the listener socket's pending list and enqueued in the listener 40 * socket's accept queue. Callers of accept(2) will accept connected sockets 41 * from the listener socket's accept queue. If the socket cannot be accepted 42 * for some reason then it is marked rejected. Once the connection is 43 * accepted, it is owned by the user process and the responsibility for cleanup 44 * falls with that user process. 45 * 46 * - It is possible that these pending sockets will never reach the connected 47 * state; in fact, we may never receive another packet after the connection 48 * request. Because of this, we must schedule a cleanup function to run in the 49 * future, after some amount of time passes where a connection should have been 50 * established. This function ensures that the socket is off all lists so it 51 * cannot be retrieved, then drops all references to the socket so it is cleaned 52 * up (sock_put() -> sk_free() -> our sk_destruct implementation). Note this 53 * function will also cleanup rejected sockets, those that reach the connected 54 * state but leave it before they have been accepted. 55 * 56 * - Lock ordering for pending or accept queue sockets is: 57 * 58 * lock_sock(listener); 59 * lock_sock_nested(pending, SINGLE_DEPTH_NESTING); 60 * 61 * Using explicit nested locking keeps lockdep happy since normally only one 62 * lock of a given class may be taken at a time. 63 * 64 * - Sockets created by user action will be cleaned up when the user process 65 * calls close(2), causing our release implementation to be called. Our release 66 * implementation will perform some cleanup then drop the last reference so our 67 * sk_destruct implementation is invoked. Our sk_destruct implementation will 68 * perform additional cleanup that's common for both types of sockets. 69 * 70 * - A socket's reference count is what ensures that the structure won't be 71 * freed. Each entry in a list (such as the "global" bound and connected tables 72 * and the listener socket's pending list and connected queue) ensures a 73 * reference. When we defer work until process context and pass a socket as our 74 * argument, we must ensure the reference count is increased to ensure the 75 * socket isn't freed before the function is run; the deferred function will 76 * then drop the reference. 77 * 78 * - sk->sk_state uses the TCP state constants because they are widely used by 79 * other address families and exposed to userspace tools like ss(8): 80 * 81 * TCP_CLOSE - unconnected 82 * TCP_SYN_SENT - connecting 83 * TCP_ESTABLISHED - connected 84 * TCP_CLOSING - disconnecting 85 * TCP_LISTEN - listening 86 */ 87 88 #include <linux/compat.h> 89 #include <linux/types.h> 90 #include <linux/bitops.h> 91 #include <linux/cred.h> 92 #include <linux/errqueue.h> 93 #include <linux/init.h> 94 #include <linux/io.h> 95 #include <linux/kernel.h> 96 #include <linux/sched/signal.h> 97 #include <linux/kmod.h> 98 #include <linux/list.h> 99 #include <linux/miscdevice.h> 100 #include <linux/module.h> 101 #include <linux/mutex.h> 102 #include <linux/net.h> 103 #include <linux/poll.h> 104 #include <linux/random.h> 105 #include <linux/skbuff.h> 106 #include <linux/smp.h> 107 #include <linux/socket.h> 108 #include <linux/stddef.h> 109 #include <linux/unistd.h> 110 #include <linux/wait.h> 111 #include <linux/workqueue.h> 112 #include <net/sock.h> 113 #include <net/af_vsock.h> 114 #include <uapi/linux/vm_sockets.h> 115 #include <uapi/asm-generic/ioctls.h> 116 117 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr); 118 static void vsock_sk_destruct(struct sock *sk); 119 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); 120 static void vsock_close(struct sock *sk, long timeout); 121 122 /* Protocol family. */ 123 struct proto vsock_proto = { 124 .name = "AF_VSOCK", 125 .owner = THIS_MODULE, 126 .obj_size = sizeof(struct vsock_sock), 127 .close = vsock_close, 128 #ifdef CONFIG_BPF_SYSCALL 129 .psock_update_sk_prot = vsock_bpf_update_proto, 130 #endif 131 }; 132 133 /* The default peer timeout indicates how long we will wait for a peer response 134 * to a control message. 135 */ 136 #define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ) 137 138 #define VSOCK_DEFAULT_BUFFER_SIZE (1024 * 256) 139 #define VSOCK_DEFAULT_BUFFER_MAX_SIZE (1024 * 256) 140 #define VSOCK_DEFAULT_BUFFER_MIN_SIZE 128 141 142 /* Transport used for host->guest communication */ 143 static const struct vsock_transport *transport_h2g; 144 /* Transport used for guest->host communication */ 145 static const struct vsock_transport *transport_g2h; 146 /* Transport used for DGRAM communication */ 147 static const struct vsock_transport *transport_dgram; 148 /* Transport used for local communication */ 149 static const struct vsock_transport *transport_local; 150 static DEFINE_MUTEX(vsock_register_mutex); 151 152 /**** UTILS ****/ 153 154 /* Each bound VSocket is stored in the bind hash table and each connected 155 * VSocket is stored in the connected hash table. 156 * 157 * Unbound sockets are all put on the same list attached to the end of the hash 158 * table (vsock_unbound_sockets). Bound sockets are added to the hash table in 159 * the bucket that their local address hashes to (vsock_bound_sockets(addr) 160 * represents the list that addr hashes to). 161 * 162 * Specifically, we initialize the vsock_bind_table array to a size of 163 * VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through 164 * vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and 165 * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets. The hash function 166 * mods with VSOCK_HASH_SIZE to ensure this. 167 */ 168 #define MAX_PORT_RETRIES 24 169 170 #define VSOCK_HASH(addr) ((addr)->svm_port % VSOCK_HASH_SIZE) 171 #define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)]) 172 #define vsock_unbound_sockets (&vsock_bind_table[VSOCK_HASH_SIZE]) 173 174 /* XXX This can probably be implemented in a better way. */ 175 #define VSOCK_CONN_HASH(src, dst) \ 176 (((src)->svm_cid ^ (dst)->svm_port) % VSOCK_HASH_SIZE) 177 #define vsock_connected_sockets(src, dst) \ 178 (&vsock_connected_table[VSOCK_CONN_HASH(src, dst)]) 179 #define vsock_connected_sockets_vsk(vsk) \ 180 vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr) 181 182 struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1]; 183 EXPORT_SYMBOL_GPL(vsock_bind_table); 184 struct list_head vsock_connected_table[VSOCK_HASH_SIZE]; 185 EXPORT_SYMBOL_GPL(vsock_connected_table); 186 DEFINE_SPINLOCK(vsock_table_lock); 187 EXPORT_SYMBOL_GPL(vsock_table_lock); 188 189 /* Autobind this socket to the local address if necessary. */ 190 static int vsock_auto_bind(struct vsock_sock *vsk) 191 { 192 struct sock *sk = sk_vsock(vsk); 193 struct sockaddr_vm local_addr; 194 195 if (vsock_addr_bound(&vsk->local_addr)) 196 return 0; 197 vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 198 return __vsock_bind(sk, &local_addr); 199 } 200 201 static void vsock_init_tables(void) 202 { 203 int i; 204 205 for (i = 0; i < ARRAY_SIZE(vsock_bind_table); i++) 206 INIT_LIST_HEAD(&vsock_bind_table[i]); 207 208 for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) 209 INIT_LIST_HEAD(&vsock_connected_table[i]); 210 } 211 212 static void __vsock_insert_bound(struct list_head *list, 213 struct vsock_sock *vsk) 214 { 215 sock_hold(&vsk->sk); 216 list_add(&vsk->bound_table, list); 217 } 218 219 static void __vsock_insert_connected(struct list_head *list, 220 struct vsock_sock *vsk) 221 { 222 sock_hold(&vsk->sk); 223 list_add(&vsk->connected_table, list); 224 } 225 226 static void __vsock_remove_bound(struct vsock_sock *vsk) 227 { 228 list_del_init(&vsk->bound_table); 229 sock_put(&vsk->sk); 230 } 231 232 static void __vsock_remove_connected(struct vsock_sock *vsk) 233 { 234 list_del_init(&vsk->connected_table); 235 sock_put(&vsk->sk); 236 } 237 238 static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr) 239 { 240 struct vsock_sock *vsk; 241 242 list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) { 243 if (vsock_addr_equals_addr(addr, &vsk->local_addr)) 244 return sk_vsock(vsk); 245 246 if (addr->svm_port == vsk->local_addr.svm_port && 247 (vsk->local_addr.svm_cid == VMADDR_CID_ANY || 248 addr->svm_cid == VMADDR_CID_ANY)) 249 return sk_vsock(vsk); 250 } 251 252 return NULL; 253 } 254 255 static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src, 256 struct sockaddr_vm *dst) 257 { 258 struct vsock_sock *vsk; 259 260 list_for_each_entry(vsk, vsock_connected_sockets(src, dst), 261 connected_table) { 262 if (vsock_addr_equals_addr(src, &vsk->remote_addr) && 263 dst->svm_port == vsk->local_addr.svm_port) { 264 return sk_vsock(vsk); 265 } 266 } 267 268 return NULL; 269 } 270 271 static void vsock_insert_unbound(struct vsock_sock *vsk) 272 { 273 spin_lock_bh(&vsock_table_lock); 274 __vsock_insert_bound(vsock_unbound_sockets, vsk); 275 spin_unlock_bh(&vsock_table_lock); 276 } 277 278 void vsock_insert_connected(struct vsock_sock *vsk) 279 { 280 struct list_head *list = vsock_connected_sockets( 281 &vsk->remote_addr, &vsk->local_addr); 282 283 spin_lock_bh(&vsock_table_lock); 284 __vsock_insert_connected(list, vsk); 285 spin_unlock_bh(&vsock_table_lock); 286 } 287 EXPORT_SYMBOL_GPL(vsock_insert_connected); 288 289 void vsock_remove_bound(struct vsock_sock *vsk) 290 { 291 spin_lock_bh(&vsock_table_lock); 292 if (__vsock_in_bound_table(vsk)) 293 __vsock_remove_bound(vsk); 294 spin_unlock_bh(&vsock_table_lock); 295 } 296 EXPORT_SYMBOL_GPL(vsock_remove_bound); 297 298 void vsock_remove_connected(struct vsock_sock *vsk) 299 { 300 spin_lock_bh(&vsock_table_lock); 301 if (__vsock_in_connected_table(vsk)) 302 __vsock_remove_connected(vsk); 303 spin_unlock_bh(&vsock_table_lock); 304 } 305 EXPORT_SYMBOL_GPL(vsock_remove_connected); 306 307 struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) 308 { 309 struct sock *sk; 310 311 spin_lock_bh(&vsock_table_lock); 312 sk = __vsock_find_bound_socket(addr); 313 if (sk) 314 sock_hold(sk); 315 316 spin_unlock_bh(&vsock_table_lock); 317 318 return sk; 319 } 320 EXPORT_SYMBOL_GPL(vsock_find_bound_socket); 321 322 struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, 323 struct sockaddr_vm *dst) 324 { 325 struct sock *sk; 326 327 spin_lock_bh(&vsock_table_lock); 328 sk = __vsock_find_connected_socket(src, dst); 329 if (sk) 330 sock_hold(sk); 331 332 spin_unlock_bh(&vsock_table_lock); 333 334 return sk; 335 } 336 EXPORT_SYMBOL_GPL(vsock_find_connected_socket); 337 338 void vsock_remove_sock(struct vsock_sock *vsk) 339 { 340 /* Transport reassignment must not remove the binding. */ 341 if (sock_flag(sk_vsock(vsk), SOCK_DEAD)) 342 vsock_remove_bound(vsk); 343 344 vsock_remove_connected(vsk); 345 } 346 EXPORT_SYMBOL_GPL(vsock_remove_sock); 347 348 void vsock_for_each_connected_socket(struct vsock_transport *transport, 349 void (*fn)(struct sock *sk)) 350 { 351 int i; 352 353 spin_lock_bh(&vsock_table_lock); 354 355 for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) { 356 struct vsock_sock *vsk; 357 list_for_each_entry(vsk, &vsock_connected_table[i], 358 connected_table) { 359 if (vsk->transport != transport) 360 continue; 361 362 fn(sk_vsock(vsk)); 363 } 364 } 365 366 spin_unlock_bh(&vsock_table_lock); 367 } 368 EXPORT_SYMBOL_GPL(vsock_for_each_connected_socket); 369 370 void vsock_add_pending(struct sock *listener, struct sock *pending) 371 { 372 struct vsock_sock *vlistener; 373 struct vsock_sock *vpending; 374 375 vlistener = vsock_sk(listener); 376 vpending = vsock_sk(pending); 377 378 sock_hold(pending); 379 sock_hold(listener); 380 list_add_tail(&vpending->pending_links, &vlistener->pending_links); 381 } 382 EXPORT_SYMBOL_GPL(vsock_add_pending); 383 384 void vsock_remove_pending(struct sock *listener, struct sock *pending) 385 { 386 struct vsock_sock *vpending = vsock_sk(pending); 387 388 list_del_init(&vpending->pending_links); 389 sock_put(listener); 390 sock_put(pending); 391 } 392 EXPORT_SYMBOL_GPL(vsock_remove_pending); 393 394 void vsock_enqueue_accept(struct sock *listener, struct sock *connected) 395 { 396 struct vsock_sock *vlistener; 397 struct vsock_sock *vconnected; 398 399 vlistener = vsock_sk(listener); 400 vconnected = vsock_sk(connected); 401 402 sock_hold(connected); 403 sock_hold(listener); 404 list_add_tail(&vconnected->accept_queue, &vlistener->accept_queue); 405 } 406 EXPORT_SYMBOL_GPL(vsock_enqueue_accept); 407 408 static bool vsock_use_local_transport(unsigned int remote_cid) 409 { 410 lockdep_assert_held(&vsock_register_mutex); 411 412 if (!transport_local) 413 return false; 414 415 if (remote_cid == VMADDR_CID_LOCAL) 416 return true; 417 418 if (transport_g2h) { 419 return remote_cid == transport_g2h->get_local_cid(); 420 } else { 421 return remote_cid == VMADDR_CID_HOST; 422 } 423 } 424 425 static void vsock_deassign_transport(struct vsock_sock *vsk) 426 { 427 if (!vsk->transport) 428 return; 429 430 vsk->transport->destruct(vsk); 431 module_put(vsk->transport->module); 432 vsk->transport = NULL; 433 } 434 435 /* Assign a transport to a socket and call the .init transport callback. 436 * 437 * Note: for connection oriented socket this must be called when vsk->remote_addr 438 * is set (e.g. during the connect() or when a connection request on a listener 439 * socket is received). 440 * The vsk->remote_addr is used to decide which transport to use: 441 * - remote CID == VMADDR_CID_LOCAL or g2h->local_cid or VMADDR_CID_HOST if 442 * g2h is not loaded, will use local transport; 443 * - remote CID <= VMADDR_CID_HOST or h2g is not loaded or remote flags field 444 * includes VMADDR_FLAG_TO_HOST flag value, will use guest->host transport; 445 * - remote CID > VMADDR_CID_HOST will use host->guest transport; 446 */ 447 int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) 448 { 449 const struct vsock_transport *new_transport; 450 struct sock *sk = sk_vsock(vsk); 451 unsigned int remote_cid = vsk->remote_addr.svm_cid; 452 __u8 remote_flags; 453 int ret; 454 455 /* If the packet is coming with the source and destination CIDs higher 456 * than VMADDR_CID_HOST, then a vsock channel where all the packets are 457 * forwarded to the host should be established. Then the host will 458 * need to forward the packets to the guest. 459 * 460 * The flag is set on the (listen) receive path (psk is not NULL). On 461 * the connect path the flag can be set by the user space application. 462 */ 463 if (psk && vsk->local_addr.svm_cid > VMADDR_CID_HOST && 464 vsk->remote_addr.svm_cid > VMADDR_CID_HOST) 465 vsk->remote_addr.svm_flags |= VMADDR_FLAG_TO_HOST; 466 467 remote_flags = vsk->remote_addr.svm_flags; 468 469 mutex_lock(&vsock_register_mutex); 470 471 switch (sk->sk_type) { 472 case SOCK_DGRAM: 473 new_transport = transport_dgram; 474 break; 475 case SOCK_STREAM: 476 case SOCK_SEQPACKET: 477 if (vsock_use_local_transport(remote_cid)) 478 new_transport = transport_local; 479 else if (remote_cid <= VMADDR_CID_HOST || !transport_h2g || 480 (remote_flags & VMADDR_FLAG_TO_HOST)) 481 new_transport = transport_g2h; 482 else 483 new_transport = transport_h2g; 484 break; 485 default: 486 ret = -ESOCKTNOSUPPORT; 487 goto err; 488 } 489 490 if (vsk->transport) { 491 if (vsk->transport == new_transport) { 492 ret = 0; 493 goto err; 494 } 495 496 /* transport->release() must be called with sock lock acquired. 497 * This path can only be taken during vsock_connect(), where we 498 * have already held the sock lock. In the other cases, this 499 * function is called on a new socket which is not assigned to 500 * any transport. 501 */ 502 vsk->transport->release(vsk); 503 vsock_deassign_transport(vsk); 504 505 /* transport's release() and destruct() can touch some socket 506 * state, since we are reassigning the socket to a new transport 507 * during vsock_connect(), let's reset these fields to have a 508 * clean state. 509 */ 510 sock_reset_flag(sk, SOCK_DONE); 511 sk->sk_state = TCP_CLOSE; 512 vsk->peer_shutdown = 0; 513 } 514 515 /* We increase the module refcnt to prevent the transport unloading 516 * while there are open sockets assigned to it. 517 */ 518 if (!new_transport || !try_module_get(new_transport->module)) { 519 ret = -ENODEV; 520 goto err; 521 } 522 523 /* It's safe to release the mutex after a successful try_module_get(). 524 * Whichever transport `new_transport` points at, it won't go away until 525 * the last module_put() below or in vsock_deassign_transport(). 526 */ 527 mutex_unlock(&vsock_register_mutex); 528 529 if (sk->sk_type == SOCK_SEQPACKET) { 530 if (!new_transport->seqpacket_allow || 531 !new_transport->seqpacket_allow(remote_cid)) { 532 module_put(new_transport->module); 533 return -ESOCKTNOSUPPORT; 534 } 535 } 536 537 ret = new_transport->init(vsk, psk); 538 if (ret) { 539 module_put(new_transport->module); 540 return ret; 541 } 542 543 vsk->transport = new_transport; 544 545 return 0; 546 err: 547 mutex_unlock(&vsock_register_mutex); 548 return ret; 549 } 550 EXPORT_SYMBOL_GPL(vsock_assign_transport); 551 552 /* 553 * Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks. 554 * Otherwise we may race with module removal. Do not use on `vsk->transport`. 555 */ 556 static u32 vsock_registered_transport_cid(const struct vsock_transport **transport) 557 { 558 u32 cid = VMADDR_CID_ANY; 559 560 mutex_lock(&vsock_register_mutex); 561 if (*transport) 562 cid = (*transport)->get_local_cid(); 563 mutex_unlock(&vsock_register_mutex); 564 565 return cid; 566 } 567 568 bool vsock_find_cid(unsigned int cid) 569 { 570 if (cid == vsock_registered_transport_cid(&transport_g2h)) 571 return true; 572 573 if (transport_h2g && cid == VMADDR_CID_HOST) 574 return true; 575 576 if (transport_local && cid == VMADDR_CID_LOCAL) 577 return true; 578 579 return false; 580 } 581 EXPORT_SYMBOL_GPL(vsock_find_cid); 582 583 static struct sock *vsock_dequeue_accept(struct sock *listener) 584 { 585 struct vsock_sock *vlistener; 586 struct vsock_sock *vconnected; 587 588 vlistener = vsock_sk(listener); 589 590 if (list_empty(&vlistener->accept_queue)) 591 return NULL; 592 593 vconnected = list_entry(vlistener->accept_queue.next, 594 struct vsock_sock, accept_queue); 595 596 list_del_init(&vconnected->accept_queue); 597 sock_put(listener); 598 /* The caller will need a reference on the connected socket so we let 599 * it call sock_put(). 600 */ 601 602 return sk_vsock(vconnected); 603 } 604 605 static bool vsock_is_accept_queue_empty(struct sock *sk) 606 { 607 struct vsock_sock *vsk = vsock_sk(sk); 608 return list_empty(&vsk->accept_queue); 609 } 610 611 static bool vsock_is_pending(struct sock *sk) 612 { 613 struct vsock_sock *vsk = vsock_sk(sk); 614 return !list_empty(&vsk->pending_links); 615 } 616 617 static int vsock_send_shutdown(struct sock *sk, int mode) 618 { 619 struct vsock_sock *vsk = vsock_sk(sk); 620 621 if (!vsk->transport) 622 return -ENODEV; 623 624 return vsk->transport->shutdown(vsk, mode); 625 } 626 627 static void vsock_pending_work(struct work_struct *work) 628 { 629 struct sock *sk; 630 struct sock *listener; 631 struct vsock_sock *vsk; 632 bool cleanup; 633 634 vsk = container_of(work, struct vsock_sock, pending_work.work); 635 sk = sk_vsock(vsk); 636 listener = vsk->listener; 637 cleanup = true; 638 639 lock_sock(listener); 640 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 641 642 if (vsock_is_pending(sk)) { 643 vsock_remove_pending(listener, sk); 644 645 sk_acceptq_removed(listener); 646 } else if (!vsk->rejected) { 647 /* We are not on the pending list and accept() did not reject 648 * us, so we must have been accepted by our user process. We 649 * just need to drop our references to the sockets and be on 650 * our way. 651 */ 652 cleanup = false; 653 goto out; 654 } 655 656 /* We need to remove ourself from the global connected sockets list so 657 * incoming packets can't find this socket, and to reduce the reference 658 * count. 659 */ 660 vsock_remove_connected(vsk); 661 662 sk->sk_state = TCP_CLOSE; 663 664 out: 665 release_sock(sk); 666 release_sock(listener); 667 if (cleanup) 668 sock_put(sk); 669 670 sock_put(sk); 671 sock_put(listener); 672 } 673 674 /**** SOCKET OPERATIONS ****/ 675 676 static int __vsock_bind_connectible(struct vsock_sock *vsk, 677 struct sockaddr_vm *addr) 678 { 679 static u32 port; 680 struct sockaddr_vm new_addr; 681 682 if (!port) 683 port = get_random_u32_above(LAST_RESERVED_PORT); 684 685 vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port); 686 687 if (addr->svm_port == VMADDR_PORT_ANY) { 688 bool found = false; 689 unsigned int i; 690 691 for (i = 0; i < MAX_PORT_RETRIES; i++) { 692 if (port == VMADDR_PORT_ANY || 693 port <= LAST_RESERVED_PORT) 694 port = LAST_RESERVED_PORT + 1; 695 696 new_addr.svm_port = port++; 697 698 if (!__vsock_find_bound_socket(&new_addr)) { 699 found = true; 700 break; 701 } 702 } 703 704 if (!found) 705 return -EADDRNOTAVAIL; 706 } else { 707 /* If port is in reserved range, ensure caller 708 * has necessary privileges. 709 */ 710 if (addr->svm_port <= LAST_RESERVED_PORT && 711 !capable(CAP_NET_BIND_SERVICE)) { 712 return -EACCES; 713 } 714 715 if (__vsock_find_bound_socket(&new_addr)) 716 return -EADDRINUSE; 717 } 718 719 vsock_addr_init(&vsk->local_addr, new_addr.svm_cid, new_addr.svm_port); 720 721 /* Remove connection oriented sockets from the unbound list and add them 722 * to the hash table for easy lookup by its address. The unbound list 723 * is simply an extra entry at the end of the hash table, a trick used 724 * by AF_UNIX. 725 */ 726 __vsock_remove_bound(vsk); 727 __vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk); 728 729 return 0; 730 } 731 732 static int __vsock_bind_dgram(struct vsock_sock *vsk, 733 struct sockaddr_vm *addr) 734 { 735 return vsk->transport->dgram_bind(vsk, addr); 736 } 737 738 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr) 739 { 740 struct vsock_sock *vsk = vsock_sk(sk); 741 int retval; 742 743 /* First ensure this socket isn't already bound. */ 744 if (vsock_addr_bound(&vsk->local_addr)) 745 return -EINVAL; 746 747 /* Now bind to the provided address or select appropriate values if 748 * none are provided (VMADDR_CID_ANY and VMADDR_PORT_ANY). Note that 749 * like AF_INET prevents binding to a non-local IP address (in most 750 * cases), we only allow binding to a local CID. 751 */ 752 if (addr->svm_cid != VMADDR_CID_ANY && !vsock_find_cid(addr->svm_cid)) 753 return -EADDRNOTAVAIL; 754 755 switch (sk->sk_socket->type) { 756 case SOCK_STREAM: 757 case SOCK_SEQPACKET: 758 spin_lock_bh(&vsock_table_lock); 759 retval = __vsock_bind_connectible(vsk, addr); 760 spin_unlock_bh(&vsock_table_lock); 761 break; 762 763 case SOCK_DGRAM: 764 retval = __vsock_bind_dgram(vsk, addr); 765 break; 766 767 default: 768 retval = -EINVAL; 769 break; 770 } 771 772 return retval; 773 } 774 775 static void vsock_connect_timeout(struct work_struct *work); 776 777 static struct sock *__vsock_create(struct net *net, 778 struct socket *sock, 779 struct sock *parent, 780 gfp_t priority, 781 unsigned short type, 782 int kern) 783 { 784 struct sock *sk; 785 struct vsock_sock *psk; 786 struct vsock_sock *vsk; 787 788 sk = sk_alloc(net, AF_VSOCK, priority, &vsock_proto, kern); 789 if (!sk) 790 return NULL; 791 792 sock_init_data(sock, sk); 793 794 /* sk->sk_type is normally set in sock_init_data, but only if sock is 795 * non-NULL. We make sure that our sockets always have a type by 796 * setting it here if needed. 797 */ 798 if (!sock) 799 sk->sk_type = type; 800 801 vsk = vsock_sk(sk); 802 vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 803 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 804 805 sk->sk_destruct = vsock_sk_destruct; 806 sk->sk_backlog_rcv = vsock_queue_rcv_skb; 807 sock_reset_flag(sk, SOCK_DONE); 808 809 INIT_LIST_HEAD(&vsk->bound_table); 810 INIT_LIST_HEAD(&vsk->connected_table); 811 vsk->listener = NULL; 812 INIT_LIST_HEAD(&vsk->pending_links); 813 INIT_LIST_HEAD(&vsk->accept_queue); 814 vsk->rejected = false; 815 vsk->sent_request = false; 816 vsk->ignore_connecting_rst = false; 817 vsk->peer_shutdown = 0; 818 INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout); 819 INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work); 820 821 psk = parent ? vsock_sk(parent) : NULL; 822 if (parent) { 823 vsk->trusted = psk->trusted; 824 vsk->owner = get_cred(psk->owner); 825 vsk->connect_timeout = psk->connect_timeout; 826 vsk->buffer_size = psk->buffer_size; 827 vsk->buffer_min_size = psk->buffer_min_size; 828 vsk->buffer_max_size = psk->buffer_max_size; 829 security_sk_clone(parent, sk); 830 } else { 831 vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); 832 vsk->owner = get_current_cred(); 833 vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT; 834 vsk->buffer_size = VSOCK_DEFAULT_BUFFER_SIZE; 835 vsk->buffer_min_size = VSOCK_DEFAULT_BUFFER_MIN_SIZE; 836 vsk->buffer_max_size = VSOCK_DEFAULT_BUFFER_MAX_SIZE; 837 } 838 839 return sk; 840 } 841 842 static bool sock_type_connectible(u16 type) 843 { 844 return (type == SOCK_STREAM) || (type == SOCK_SEQPACKET); 845 } 846 847 static void __vsock_release(struct sock *sk, int level) 848 { 849 struct vsock_sock *vsk; 850 struct sock *pending; 851 852 vsk = vsock_sk(sk); 853 pending = NULL; /* Compiler warning. */ 854 855 /* When "level" is SINGLE_DEPTH_NESTING, use the nested 856 * version to avoid the warning "possible recursive locking 857 * detected". When "level" is 0, lock_sock_nested(sk, level) 858 * is the same as lock_sock(sk). 859 */ 860 lock_sock_nested(sk, level); 861 862 /* Indicate to vsock_remove_sock() that the socket is being released and 863 * can be removed from the bound_table. Unlike transport reassignment 864 * case, where the socket must remain bound despite vsock_remove_sock() 865 * being called from the transport release() callback. 866 */ 867 sock_set_flag(sk, SOCK_DEAD); 868 869 if (vsk->transport) 870 vsk->transport->release(vsk); 871 else if (sock_type_connectible(sk->sk_type)) 872 vsock_remove_sock(vsk); 873 874 sock_orphan(sk); 875 sk->sk_shutdown = SHUTDOWN_MASK; 876 877 skb_queue_purge(&sk->sk_receive_queue); 878 879 /* Clean up any sockets that never were accepted. */ 880 while ((pending = vsock_dequeue_accept(sk)) != NULL) { 881 __vsock_release(pending, SINGLE_DEPTH_NESTING); 882 sock_put(pending); 883 } 884 885 release_sock(sk); 886 sock_put(sk); 887 } 888 889 static void vsock_sk_destruct(struct sock *sk) 890 { 891 struct vsock_sock *vsk = vsock_sk(sk); 892 893 /* Flush MSG_ZEROCOPY leftovers. */ 894 __skb_queue_purge(&sk->sk_error_queue); 895 896 vsock_deassign_transport(vsk); 897 898 /* When clearing these addresses, there's no need to set the family and 899 * possibly register the address family with the kernel. 900 */ 901 vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 902 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 903 904 put_cred(vsk->owner); 905 } 906 907 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 908 { 909 int err; 910 911 err = sock_queue_rcv_skb(sk, skb); 912 if (err) 913 kfree_skb(skb); 914 915 return err; 916 } 917 918 struct sock *vsock_create_connected(struct sock *parent) 919 { 920 return __vsock_create(sock_net(parent), NULL, parent, GFP_KERNEL, 921 parent->sk_type, 0); 922 } 923 EXPORT_SYMBOL_GPL(vsock_create_connected); 924 925 s64 vsock_stream_has_data(struct vsock_sock *vsk) 926 { 927 if (WARN_ON(!vsk->transport)) 928 return 0; 929 930 return vsk->transport->stream_has_data(vsk); 931 } 932 EXPORT_SYMBOL_GPL(vsock_stream_has_data); 933 934 s64 vsock_connectible_has_data(struct vsock_sock *vsk) 935 { 936 struct sock *sk = sk_vsock(vsk); 937 938 if (WARN_ON(!vsk->transport)) 939 return 0; 940 941 if (sk->sk_type == SOCK_SEQPACKET) 942 return vsk->transport->seqpacket_has_data(vsk); 943 else 944 return vsock_stream_has_data(vsk); 945 } 946 EXPORT_SYMBOL_GPL(vsock_connectible_has_data); 947 948 s64 vsock_stream_has_space(struct vsock_sock *vsk) 949 { 950 if (WARN_ON(!vsk->transport)) 951 return 0; 952 953 return vsk->transport->stream_has_space(vsk); 954 } 955 EXPORT_SYMBOL_GPL(vsock_stream_has_space); 956 957 void vsock_data_ready(struct sock *sk) 958 { 959 struct vsock_sock *vsk = vsock_sk(sk); 960 961 if (vsock_stream_has_data(vsk) >= sk->sk_rcvlowat || 962 sock_flag(sk, SOCK_DONE)) 963 sk->sk_data_ready(sk); 964 } 965 EXPORT_SYMBOL_GPL(vsock_data_ready); 966 967 /* Dummy callback required by sockmap. 968 * See unconditional call of saved_close() in sock_map_close(). 969 */ 970 static void vsock_close(struct sock *sk, long timeout) 971 { 972 } 973 974 static int vsock_release(struct socket *sock) 975 { 976 struct sock *sk = sock->sk; 977 978 if (!sk) 979 return 0; 980 981 sk->sk_prot->close(sk, 0); 982 __vsock_release(sk, 0); 983 sock->sk = NULL; 984 sock->state = SS_FREE; 985 986 return 0; 987 } 988 989 static int 990 vsock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 991 { 992 int err; 993 struct sock *sk; 994 struct sockaddr_vm *vm_addr; 995 996 sk = sock->sk; 997 998 if (vsock_addr_cast(addr, addr_len, &vm_addr) != 0) 999 return -EINVAL; 1000 1001 lock_sock(sk); 1002 err = __vsock_bind(sk, vm_addr); 1003 release_sock(sk); 1004 1005 return err; 1006 } 1007 1008 static int vsock_getname(struct socket *sock, 1009 struct sockaddr *addr, int peer) 1010 { 1011 int err; 1012 struct sock *sk; 1013 struct vsock_sock *vsk; 1014 struct sockaddr_vm *vm_addr; 1015 1016 sk = sock->sk; 1017 vsk = vsock_sk(sk); 1018 err = 0; 1019 1020 lock_sock(sk); 1021 1022 if (peer) { 1023 if (sock->state != SS_CONNECTED) { 1024 err = -ENOTCONN; 1025 goto out; 1026 } 1027 vm_addr = &vsk->remote_addr; 1028 } else { 1029 vm_addr = &vsk->local_addr; 1030 } 1031 1032 BUILD_BUG_ON(sizeof(*vm_addr) > sizeof(struct sockaddr_storage)); 1033 memcpy(addr, vm_addr, sizeof(*vm_addr)); 1034 err = sizeof(*vm_addr); 1035 1036 out: 1037 release_sock(sk); 1038 return err; 1039 } 1040 1041 void vsock_linger(struct sock *sk) 1042 { 1043 DEFINE_WAIT_FUNC(wait, woken_wake_function); 1044 ssize_t (*unsent)(struct vsock_sock *vsk); 1045 struct vsock_sock *vsk = vsock_sk(sk); 1046 long timeout; 1047 1048 if (!sock_flag(sk, SOCK_LINGER)) 1049 return; 1050 1051 timeout = sk->sk_lingertime; 1052 if (!timeout) 1053 return; 1054 1055 /* Transports must implement `unsent_bytes` if they want to support 1056 * SOCK_LINGER through `vsock_linger()` since we use it to check when 1057 * the socket can be closed. 1058 */ 1059 unsent = vsk->transport->unsent_bytes; 1060 if (!unsent) 1061 return; 1062 1063 add_wait_queue(sk_sleep(sk), &wait); 1064 1065 do { 1066 if (sk_wait_event(sk, &timeout, unsent(vsk) == 0, &wait)) 1067 break; 1068 } while (!signal_pending(current) && timeout); 1069 1070 remove_wait_queue(sk_sleep(sk), &wait); 1071 } 1072 EXPORT_SYMBOL_GPL(vsock_linger); 1073 1074 static int vsock_shutdown(struct socket *sock, int mode) 1075 { 1076 int err; 1077 struct sock *sk; 1078 1079 /* User level uses SHUT_RD (0) and SHUT_WR (1), but the kernel uses 1080 * RCV_SHUTDOWN (1) and SEND_SHUTDOWN (2), so we must increment mode 1081 * here like the other address families do. Note also that the 1082 * increment makes SHUT_RDWR (2) into RCV_SHUTDOWN | SEND_SHUTDOWN (3), 1083 * which is what we want. 1084 */ 1085 mode++; 1086 1087 if ((mode & ~SHUTDOWN_MASK) || !mode) 1088 return -EINVAL; 1089 1090 /* If this is a connection oriented socket and it is not connected then 1091 * bail out immediately. If it is a DGRAM socket then we must first 1092 * kick the socket so that it wakes up from any sleeping calls, for 1093 * example recv(), and then afterwards return the error. 1094 */ 1095 1096 sk = sock->sk; 1097 1098 lock_sock(sk); 1099 if (sock->state == SS_UNCONNECTED) { 1100 err = -ENOTCONN; 1101 if (sock_type_connectible(sk->sk_type)) 1102 goto out; 1103 } else { 1104 sock->state = SS_DISCONNECTING; 1105 err = 0; 1106 } 1107 1108 /* Receive and send shutdowns are treated alike. */ 1109 mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN); 1110 if (mode) { 1111 sk->sk_shutdown |= mode; 1112 sk->sk_state_change(sk); 1113 1114 if (sock_type_connectible(sk->sk_type)) { 1115 sock_reset_flag(sk, SOCK_DONE); 1116 vsock_send_shutdown(sk, mode); 1117 } 1118 } 1119 1120 out: 1121 release_sock(sk); 1122 return err; 1123 } 1124 1125 static __poll_t vsock_poll(struct file *file, struct socket *sock, 1126 poll_table *wait) 1127 { 1128 struct sock *sk; 1129 __poll_t mask; 1130 struct vsock_sock *vsk; 1131 1132 sk = sock->sk; 1133 vsk = vsock_sk(sk); 1134 1135 poll_wait(file, sk_sleep(sk), wait); 1136 mask = 0; 1137 1138 if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue)) 1139 /* Signify that there has been an error on this socket. */ 1140 mask |= EPOLLERR; 1141 1142 /* INET sockets treat local write shutdown and peer write shutdown as a 1143 * case of EPOLLHUP set. 1144 */ 1145 if ((sk->sk_shutdown == SHUTDOWN_MASK) || 1146 ((sk->sk_shutdown & SEND_SHUTDOWN) && 1147 (vsk->peer_shutdown & SEND_SHUTDOWN))) { 1148 mask |= EPOLLHUP; 1149 } 1150 1151 if (sk->sk_shutdown & RCV_SHUTDOWN || 1152 vsk->peer_shutdown & SEND_SHUTDOWN) { 1153 mask |= EPOLLRDHUP; 1154 } 1155 1156 if (sk_is_readable(sk)) 1157 mask |= EPOLLIN | EPOLLRDNORM; 1158 1159 if (sock->type == SOCK_DGRAM) { 1160 /* For datagram sockets we can read if there is something in 1161 * the queue and write as long as the socket isn't shutdown for 1162 * sending. 1163 */ 1164 if (!skb_queue_empty_lockless(&sk->sk_receive_queue) || 1165 (sk->sk_shutdown & RCV_SHUTDOWN)) { 1166 mask |= EPOLLIN | EPOLLRDNORM; 1167 } 1168 1169 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) 1170 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND; 1171 1172 } else if (sock_type_connectible(sk->sk_type)) { 1173 const struct vsock_transport *transport; 1174 1175 lock_sock(sk); 1176 1177 transport = vsk->transport; 1178 1179 /* Listening sockets that have connections in their accept 1180 * queue can be read. 1181 */ 1182 if (sk->sk_state == TCP_LISTEN 1183 && !vsock_is_accept_queue_empty(sk)) 1184 mask |= EPOLLIN | EPOLLRDNORM; 1185 1186 /* If there is something in the queue then we can read. */ 1187 if (transport && transport->stream_is_active(vsk) && 1188 !(sk->sk_shutdown & RCV_SHUTDOWN)) { 1189 bool data_ready_now = false; 1190 int target = sock_rcvlowat(sk, 0, INT_MAX); 1191 int ret = transport->notify_poll_in( 1192 vsk, target, &data_ready_now); 1193 if (ret < 0) { 1194 mask |= EPOLLERR; 1195 } else { 1196 if (data_ready_now) 1197 mask |= EPOLLIN | EPOLLRDNORM; 1198 1199 } 1200 } 1201 1202 /* Sockets whose connections have been closed, reset, or 1203 * terminated should also be considered read, and we check the 1204 * shutdown flag for that. 1205 */ 1206 if (sk->sk_shutdown & RCV_SHUTDOWN || 1207 vsk->peer_shutdown & SEND_SHUTDOWN) { 1208 mask |= EPOLLIN | EPOLLRDNORM; 1209 } 1210 1211 /* Connected sockets that can produce data can be written. */ 1212 if (transport && sk->sk_state == TCP_ESTABLISHED) { 1213 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) { 1214 bool space_avail_now = false; 1215 int ret = transport->notify_poll_out( 1216 vsk, 1, &space_avail_now); 1217 if (ret < 0) { 1218 mask |= EPOLLERR; 1219 } else { 1220 if (space_avail_now) 1221 /* Remove EPOLLWRBAND since INET 1222 * sockets are not setting it. 1223 */ 1224 mask |= EPOLLOUT | EPOLLWRNORM; 1225 1226 } 1227 } 1228 } 1229 1230 /* Simulate INET socket poll behaviors, which sets 1231 * EPOLLOUT|EPOLLWRNORM when peer is closed and nothing to read, 1232 * but local send is not shutdown. 1233 */ 1234 if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) { 1235 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) 1236 mask |= EPOLLOUT | EPOLLWRNORM; 1237 1238 } 1239 1240 release_sock(sk); 1241 } 1242 1243 return mask; 1244 } 1245 1246 static int vsock_read_skb(struct sock *sk, skb_read_actor_t read_actor) 1247 { 1248 struct vsock_sock *vsk = vsock_sk(sk); 1249 1250 if (WARN_ON_ONCE(!vsk->transport)) 1251 return -ENODEV; 1252 1253 return vsk->transport->read_skb(vsk, read_actor); 1254 } 1255 1256 static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg, 1257 size_t len) 1258 { 1259 int err; 1260 struct sock *sk; 1261 struct vsock_sock *vsk; 1262 struct sockaddr_vm *remote_addr; 1263 const struct vsock_transport *transport; 1264 1265 if (msg->msg_flags & MSG_OOB) 1266 return -EOPNOTSUPP; 1267 1268 /* For now, MSG_DONTWAIT is always assumed... */ 1269 err = 0; 1270 sk = sock->sk; 1271 vsk = vsock_sk(sk); 1272 1273 lock_sock(sk); 1274 1275 transport = vsk->transport; 1276 1277 err = vsock_auto_bind(vsk); 1278 if (err) 1279 goto out; 1280 1281 1282 /* If the provided message contains an address, use that. Otherwise 1283 * fall back on the socket's remote handle (if it has been connected). 1284 */ 1285 if (msg->msg_name && 1286 vsock_addr_cast(msg->msg_name, msg->msg_namelen, 1287 &remote_addr) == 0) { 1288 /* Ensure this address is of the right type and is a valid 1289 * destination. 1290 */ 1291 1292 if (remote_addr->svm_cid == VMADDR_CID_ANY) 1293 remote_addr->svm_cid = transport->get_local_cid(); 1294 1295 if (!vsock_addr_bound(remote_addr)) { 1296 err = -EINVAL; 1297 goto out; 1298 } 1299 } else if (sock->state == SS_CONNECTED) { 1300 remote_addr = &vsk->remote_addr; 1301 1302 if (remote_addr->svm_cid == VMADDR_CID_ANY) 1303 remote_addr->svm_cid = transport->get_local_cid(); 1304 1305 /* XXX Should connect() or this function ensure remote_addr is 1306 * bound? 1307 */ 1308 if (!vsock_addr_bound(&vsk->remote_addr)) { 1309 err = -EINVAL; 1310 goto out; 1311 } 1312 } else { 1313 err = -EINVAL; 1314 goto out; 1315 } 1316 1317 if (!transport->dgram_allow(remote_addr->svm_cid, 1318 remote_addr->svm_port)) { 1319 err = -EINVAL; 1320 goto out; 1321 } 1322 1323 err = transport->dgram_enqueue(vsk, remote_addr, msg, len); 1324 1325 out: 1326 release_sock(sk); 1327 return err; 1328 } 1329 1330 static int vsock_dgram_connect(struct socket *sock, 1331 struct sockaddr *addr, int addr_len, int flags) 1332 { 1333 int err; 1334 struct sock *sk; 1335 struct vsock_sock *vsk; 1336 struct sockaddr_vm *remote_addr; 1337 1338 sk = sock->sk; 1339 vsk = vsock_sk(sk); 1340 1341 err = vsock_addr_cast(addr, addr_len, &remote_addr); 1342 if (err == -EAFNOSUPPORT && remote_addr->svm_family == AF_UNSPEC) { 1343 lock_sock(sk); 1344 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, 1345 VMADDR_PORT_ANY); 1346 sock->state = SS_UNCONNECTED; 1347 release_sock(sk); 1348 return 0; 1349 } else if (err != 0) 1350 return -EINVAL; 1351 1352 lock_sock(sk); 1353 1354 err = vsock_auto_bind(vsk); 1355 if (err) 1356 goto out; 1357 1358 if (!vsk->transport->dgram_allow(remote_addr->svm_cid, 1359 remote_addr->svm_port)) { 1360 err = -EINVAL; 1361 goto out; 1362 } 1363 1364 memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr)); 1365 sock->state = SS_CONNECTED; 1366 1367 /* sock map disallows redirection of non-TCP sockets with sk_state != 1368 * TCP_ESTABLISHED (see sock_map_redirect_allowed()), so we set 1369 * TCP_ESTABLISHED here to allow redirection of connected vsock dgrams. 1370 * 1371 * This doesn't seem to be abnormal state for datagram sockets, as the 1372 * same approach can be see in other datagram socket types as well 1373 * (such as unix sockets). 1374 */ 1375 sk->sk_state = TCP_ESTABLISHED; 1376 1377 out: 1378 release_sock(sk); 1379 return err; 1380 } 1381 1382 int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, 1383 size_t len, int flags) 1384 { 1385 struct sock *sk = sock->sk; 1386 struct vsock_sock *vsk = vsock_sk(sk); 1387 1388 return vsk->transport->dgram_dequeue(vsk, msg, len, flags); 1389 } 1390 1391 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, 1392 size_t len, int flags) 1393 { 1394 #ifdef CONFIG_BPF_SYSCALL 1395 struct sock *sk = sock->sk; 1396 const struct proto *prot; 1397 1398 prot = READ_ONCE(sk->sk_prot); 1399 if (prot != &vsock_proto) 1400 return prot->recvmsg(sk, msg, len, flags, NULL); 1401 #endif 1402 1403 return __vsock_dgram_recvmsg(sock, msg, len, flags); 1404 } 1405 EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg); 1406 1407 static int vsock_do_ioctl(struct socket *sock, unsigned int cmd, 1408 int __user *arg) 1409 { 1410 struct sock *sk = sock->sk; 1411 struct vsock_sock *vsk; 1412 int ret; 1413 1414 vsk = vsock_sk(sk); 1415 1416 switch (cmd) { 1417 case SIOCINQ: { 1418 ssize_t n_bytes; 1419 1420 if (!vsk->transport) { 1421 ret = -EOPNOTSUPP; 1422 break; 1423 } 1424 1425 if (sock_type_connectible(sk->sk_type) && 1426 sk->sk_state == TCP_LISTEN) { 1427 ret = -EINVAL; 1428 break; 1429 } 1430 1431 n_bytes = vsock_stream_has_data(vsk); 1432 if (n_bytes < 0) { 1433 ret = n_bytes; 1434 break; 1435 } 1436 ret = put_user(n_bytes, arg); 1437 break; 1438 } 1439 case SIOCOUTQ: { 1440 ssize_t n_bytes; 1441 1442 if (!vsk->transport || !vsk->transport->unsent_bytes) { 1443 ret = -EOPNOTSUPP; 1444 break; 1445 } 1446 1447 if (sock_type_connectible(sk->sk_type) && sk->sk_state == TCP_LISTEN) { 1448 ret = -EINVAL; 1449 break; 1450 } 1451 1452 n_bytes = vsk->transport->unsent_bytes(vsk); 1453 if (n_bytes < 0) { 1454 ret = n_bytes; 1455 break; 1456 } 1457 1458 ret = put_user(n_bytes, arg); 1459 break; 1460 } 1461 default: 1462 ret = -ENOIOCTLCMD; 1463 } 1464 1465 return ret; 1466 } 1467 1468 static int vsock_ioctl(struct socket *sock, unsigned int cmd, 1469 unsigned long arg) 1470 { 1471 int ret; 1472 1473 lock_sock(sock->sk); 1474 ret = vsock_do_ioctl(sock, cmd, (int __user *)arg); 1475 release_sock(sock->sk); 1476 1477 return ret; 1478 } 1479 1480 static const struct proto_ops vsock_dgram_ops = { 1481 .family = PF_VSOCK, 1482 .owner = THIS_MODULE, 1483 .release = vsock_release, 1484 .bind = vsock_bind, 1485 .connect = vsock_dgram_connect, 1486 .socketpair = sock_no_socketpair, 1487 .accept = sock_no_accept, 1488 .getname = vsock_getname, 1489 .poll = vsock_poll, 1490 .ioctl = vsock_ioctl, 1491 .listen = sock_no_listen, 1492 .shutdown = vsock_shutdown, 1493 .sendmsg = vsock_dgram_sendmsg, 1494 .recvmsg = vsock_dgram_recvmsg, 1495 .mmap = sock_no_mmap, 1496 .read_skb = vsock_read_skb, 1497 }; 1498 1499 static int vsock_transport_cancel_pkt(struct vsock_sock *vsk) 1500 { 1501 const struct vsock_transport *transport = vsk->transport; 1502 1503 if (!transport || !transport->cancel_pkt) 1504 return -EOPNOTSUPP; 1505 1506 return transport->cancel_pkt(vsk); 1507 } 1508 1509 static void vsock_connect_timeout(struct work_struct *work) 1510 { 1511 struct sock *sk; 1512 struct vsock_sock *vsk; 1513 1514 vsk = container_of(work, struct vsock_sock, connect_work.work); 1515 sk = sk_vsock(vsk); 1516 1517 lock_sock(sk); 1518 if (sk->sk_state == TCP_SYN_SENT && 1519 (sk->sk_shutdown != SHUTDOWN_MASK)) { 1520 sk->sk_state = TCP_CLOSE; 1521 sk->sk_socket->state = SS_UNCONNECTED; 1522 sk->sk_err = ETIMEDOUT; 1523 sk_error_report(sk); 1524 vsock_transport_cancel_pkt(vsk); 1525 } 1526 release_sock(sk); 1527 1528 sock_put(sk); 1529 } 1530 1531 static int vsock_connect(struct socket *sock, struct sockaddr *addr, 1532 int addr_len, int flags) 1533 { 1534 int err; 1535 struct sock *sk; 1536 struct vsock_sock *vsk; 1537 const struct vsock_transport *transport; 1538 struct sockaddr_vm *remote_addr; 1539 long timeout; 1540 DEFINE_WAIT(wait); 1541 1542 err = 0; 1543 sk = sock->sk; 1544 vsk = vsock_sk(sk); 1545 1546 lock_sock(sk); 1547 1548 /* XXX AF_UNSPEC should make us disconnect like AF_INET. */ 1549 switch (sock->state) { 1550 case SS_CONNECTED: 1551 err = -EISCONN; 1552 goto out; 1553 case SS_DISCONNECTING: 1554 err = -EINVAL; 1555 goto out; 1556 case SS_CONNECTING: 1557 /* This continues on so we can move sock into the SS_CONNECTED 1558 * state once the connection has completed (at which point err 1559 * will be set to zero also). Otherwise, we will either wait 1560 * for the connection or return -EALREADY should this be a 1561 * non-blocking call. 1562 */ 1563 err = -EALREADY; 1564 if (flags & O_NONBLOCK) 1565 goto out; 1566 break; 1567 default: 1568 if ((sk->sk_state == TCP_LISTEN) || 1569 vsock_addr_cast(addr, addr_len, &remote_addr) != 0) { 1570 err = -EINVAL; 1571 goto out; 1572 } 1573 1574 /* Set the remote address that we are connecting to. */ 1575 memcpy(&vsk->remote_addr, remote_addr, 1576 sizeof(vsk->remote_addr)); 1577 1578 err = vsock_assign_transport(vsk, NULL); 1579 if (err) 1580 goto out; 1581 1582 transport = vsk->transport; 1583 1584 /* The hypervisor and well-known contexts do not have socket 1585 * endpoints. 1586 */ 1587 if (!transport || 1588 !transport->stream_allow(remote_addr->svm_cid, 1589 remote_addr->svm_port)) { 1590 err = -ENETUNREACH; 1591 goto out; 1592 } 1593 1594 if (vsock_msgzerocopy_allow(transport)) { 1595 set_bit(SOCK_SUPPORT_ZC, &sk->sk_socket->flags); 1596 } else if (sock_flag(sk, SOCK_ZEROCOPY)) { 1597 /* If this option was set before 'connect()', 1598 * when transport was unknown, check that this 1599 * feature is supported here. 1600 */ 1601 err = -EOPNOTSUPP; 1602 goto out; 1603 } 1604 1605 err = vsock_auto_bind(vsk); 1606 if (err) 1607 goto out; 1608 1609 sk->sk_state = TCP_SYN_SENT; 1610 1611 err = transport->connect(vsk); 1612 if (err < 0) 1613 goto out; 1614 1615 /* sk_err might have been set as a result of an earlier 1616 * (failed) connect attempt. 1617 */ 1618 sk->sk_err = 0; 1619 1620 /* Mark sock as connecting and set the error code to in 1621 * progress in case this is a non-blocking connect. 1622 */ 1623 sock->state = SS_CONNECTING; 1624 err = -EINPROGRESS; 1625 } 1626 1627 /* The receive path will handle all communication until we are able to 1628 * enter the connected state. Here we wait for the connection to be 1629 * completed or a notification of an error. 1630 */ 1631 timeout = vsk->connect_timeout; 1632 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); 1633 1634 /* If the socket is already closing or it is in an error state, there 1635 * is no point in waiting. 1636 */ 1637 while (sk->sk_state != TCP_ESTABLISHED && 1638 sk->sk_state != TCP_CLOSING && sk->sk_err == 0) { 1639 if (flags & O_NONBLOCK) { 1640 /* If we're not going to block, we schedule a timeout 1641 * function to generate a timeout on the connection 1642 * attempt, in case the peer doesn't respond in a 1643 * timely manner. We hold on to the socket until the 1644 * timeout fires. 1645 */ 1646 sock_hold(sk); 1647 1648 /* If the timeout function is already scheduled, 1649 * reschedule it, then ungrab the socket refcount to 1650 * keep it balanced. 1651 */ 1652 if (mod_delayed_work(system_percpu_wq, &vsk->connect_work, 1653 timeout)) 1654 sock_put(sk); 1655 1656 /* Skip ahead to preserve error code set above. */ 1657 goto out_wait; 1658 } 1659 1660 release_sock(sk); 1661 timeout = schedule_timeout(timeout); 1662 lock_sock(sk); 1663 1664 if (signal_pending(current)) { 1665 err = sock_intr_errno(timeout); 1666 sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; 1667 sock->state = SS_UNCONNECTED; 1668 vsock_transport_cancel_pkt(vsk); 1669 vsock_remove_connected(vsk); 1670 goto out_wait; 1671 } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) { 1672 err = -ETIMEDOUT; 1673 sk->sk_state = TCP_CLOSE; 1674 sock->state = SS_UNCONNECTED; 1675 vsock_transport_cancel_pkt(vsk); 1676 goto out_wait; 1677 } 1678 1679 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); 1680 } 1681 1682 if (sk->sk_err) { 1683 err = -sk->sk_err; 1684 sk->sk_state = TCP_CLOSE; 1685 sock->state = SS_UNCONNECTED; 1686 } else { 1687 err = 0; 1688 } 1689 1690 out_wait: 1691 finish_wait(sk_sleep(sk), &wait); 1692 out: 1693 release_sock(sk); 1694 return err; 1695 } 1696 1697 static int vsock_accept(struct socket *sock, struct socket *newsock, 1698 struct proto_accept_arg *arg) 1699 { 1700 struct sock *listener; 1701 int err; 1702 struct sock *connected; 1703 struct vsock_sock *vconnected; 1704 long timeout; 1705 DEFINE_WAIT(wait); 1706 1707 err = 0; 1708 listener = sock->sk; 1709 1710 lock_sock(listener); 1711 1712 if (!sock_type_connectible(sock->type)) { 1713 err = -EOPNOTSUPP; 1714 goto out; 1715 } 1716 1717 if (listener->sk_state != TCP_LISTEN) { 1718 err = -EINVAL; 1719 goto out; 1720 } 1721 1722 /* Wait for children sockets to appear; these are the new sockets 1723 * created upon connection establishment. 1724 */ 1725 timeout = sock_rcvtimeo(listener, arg->flags & O_NONBLOCK); 1726 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); 1727 1728 while ((connected = vsock_dequeue_accept(listener)) == NULL && 1729 listener->sk_err == 0) { 1730 release_sock(listener); 1731 timeout = schedule_timeout(timeout); 1732 finish_wait(sk_sleep(listener), &wait); 1733 lock_sock(listener); 1734 1735 if (signal_pending(current)) { 1736 err = sock_intr_errno(timeout); 1737 goto out; 1738 } else if (timeout == 0) { 1739 err = -EAGAIN; 1740 goto out; 1741 } 1742 1743 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); 1744 } 1745 finish_wait(sk_sleep(listener), &wait); 1746 1747 if (listener->sk_err) 1748 err = -listener->sk_err; 1749 1750 if (connected) { 1751 sk_acceptq_removed(listener); 1752 1753 lock_sock_nested(connected, SINGLE_DEPTH_NESTING); 1754 vconnected = vsock_sk(connected); 1755 1756 /* If the listener socket has received an error, then we should 1757 * reject this socket and return. Note that we simply mark the 1758 * socket rejected, drop our reference, and let the cleanup 1759 * function handle the cleanup; the fact that we found it in 1760 * the listener's accept queue guarantees that the cleanup 1761 * function hasn't run yet. 1762 */ 1763 if (err) { 1764 vconnected->rejected = true; 1765 } else { 1766 newsock->state = SS_CONNECTED; 1767 sock_graft(connected, newsock); 1768 if (vsock_msgzerocopy_allow(vconnected->transport)) 1769 set_bit(SOCK_SUPPORT_ZC, 1770 &connected->sk_socket->flags); 1771 } 1772 1773 release_sock(connected); 1774 sock_put(connected); 1775 } 1776 1777 out: 1778 release_sock(listener); 1779 return err; 1780 } 1781 1782 static int vsock_listen(struct socket *sock, int backlog) 1783 { 1784 int err; 1785 struct sock *sk; 1786 struct vsock_sock *vsk; 1787 1788 sk = sock->sk; 1789 1790 lock_sock(sk); 1791 1792 if (!sock_type_connectible(sk->sk_type)) { 1793 err = -EOPNOTSUPP; 1794 goto out; 1795 } 1796 1797 if (sock->state != SS_UNCONNECTED) { 1798 err = -EINVAL; 1799 goto out; 1800 } 1801 1802 vsk = vsock_sk(sk); 1803 1804 if (!vsock_addr_bound(&vsk->local_addr)) { 1805 err = -EINVAL; 1806 goto out; 1807 } 1808 1809 sk->sk_max_ack_backlog = backlog; 1810 sk->sk_state = TCP_LISTEN; 1811 1812 err = 0; 1813 1814 out: 1815 release_sock(sk); 1816 return err; 1817 } 1818 1819 static void vsock_update_buffer_size(struct vsock_sock *vsk, 1820 const struct vsock_transport *transport, 1821 u64 val) 1822 { 1823 if (val > vsk->buffer_max_size) 1824 val = vsk->buffer_max_size; 1825 1826 if (val < vsk->buffer_min_size) 1827 val = vsk->buffer_min_size; 1828 1829 if (val != vsk->buffer_size && 1830 transport && transport->notify_buffer_size) 1831 transport->notify_buffer_size(vsk, &val); 1832 1833 vsk->buffer_size = val; 1834 } 1835 1836 static int vsock_connectible_setsockopt(struct socket *sock, 1837 int level, 1838 int optname, 1839 sockptr_t optval, 1840 unsigned int optlen) 1841 { 1842 int err; 1843 struct sock *sk; 1844 struct vsock_sock *vsk; 1845 const struct vsock_transport *transport; 1846 u64 val; 1847 1848 if (level != AF_VSOCK && level != SOL_SOCKET) 1849 return -ENOPROTOOPT; 1850 1851 #define COPY_IN(_v) \ 1852 do { \ 1853 if (optlen < sizeof(_v)) { \ 1854 err = -EINVAL; \ 1855 goto exit; \ 1856 } \ 1857 if (copy_from_sockptr(&_v, optval, sizeof(_v)) != 0) { \ 1858 err = -EFAULT; \ 1859 goto exit; \ 1860 } \ 1861 } while (0) 1862 1863 err = 0; 1864 sk = sock->sk; 1865 vsk = vsock_sk(sk); 1866 1867 lock_sock(sk); 1868 1869 transport = vsk->transport; 1870 1871 if (level == SOL_SOCKET) { 1872 int zerocopy; 1873 1874 if (optname != SO_ZEROCOPY) { 1875 release_sock(sk); 1876 return sock_setsockopt(sock, level, optname, optval, optlen); 1877 } 1878 1879 /* Use 'int' type here, because variable to 1880 * set this option usually has this type. 1881 */ 1882 COPY_IN(zerocopy); 1883 1884 if (zerocopy < 0 || zerocopy > 1) { 1885 err = -EINVAL; 1886 goto exit; 1887 } 1888 1889 if (transport && !vsock_msgzerocopy_allow(transport)) { 1890 err = -EOPNOTSUPP; 1891 goto exit; 1892 } 1893 1894 sock_valbool_flag(sk, SOCK_ZEROCOPY, zerocopy); 1895 goto exit; 1896 } 1897 1898 switch (optname) { 1899 case SO_VM_SOCKETS_BUFFER_SIZE: 1900 COPY_IN(val); 1901 vsock_update_buffer_size(vsk, transport, val); 1902 break; 1903 1904 case SO_VM_SOCKETS_BUFFER_MAX_SIZE: 1905 COPY_IN(val); 1906 vsk->buffer_max_size = val; 1907 vsock_update_buffer_size(vsk, transport, vsk->buffer_size); 1908 break; 1909 1910 case SO_VM_SOCKETS_BUFFER_MIN_SIZE: 1911 COPY_IN(val); 1912 vsk->buffer_min_size = val; 1913 vsock_update_buffer_size(vsk, transport, vsk->buffer_size); 1914 break; 1915 1916 case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW: 1917 case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD: { 1918 struct __kernel_sock_timeval tv; 1919 1920 err = sock_copy_user_timeval(&tv, optval, optlen, 1921 optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD); 1922 if (err) 1923 break; 1924 if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC && 1925 tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) { 1926 vsk->connect_timeout = tv.tv_sec * HZ + 1927 DIV_ROUND_UP((unsigned long)tv.tv_usec, (USEC_PER_SEC / HZ)); 1928 if (vsk->connect_timeout == 0) 1929 vsk->connect_timeout = 1930 VSOCK_DEFAULT_CONNECT_TIMEOUT; 1931 1932 } else { 1933 err = -ERANGE; 1934 } 1935 break; 1936 } 1937 1938 default: 1939 err = -ENOPROTOOPT; 1940 break; 1941 } 1942 1943 #undef COPY_IN 1944 1945 exit: 1946 release_sock(sk); 1947 return err; 1948 } 1949 1950 static int vsock_connectible_getsockopt(struct socket *sock, 1951 int level, int optname, 1952 char __user *optval, 1953 int __user *optlen) 1954 { 1955 struct sock *sk = sock->sk; 1956 struct vsock_sock *vsk = vsock_sk(sk); 1957 1958 union { 1959 u64 val64; 1960 struct old_timeval32 tm32; 1961 struct __kernel_old_timeval tm; 1962 struct __kernel_sock_timeval stm; 1963 } v; 1964 1965 int lv = sizeof(v.val64); 1966 int len; 1967 1968 if (level != AF_VSOCK) 1969 return -ENOPROTOOPT; 1970 1971 if (get_user(len, optlen)) 1972 return -EFAULT; 1973 1974 memset(&v, 0, sizeof(v)); 1975 1976 switch (optname) { 1977 case SO_VM_SOCKETS_BUFFER_SIZE: 1978 v.val64 = vsk->buffer_size; 1979 break; 1980 1981 case SO_VM_SOCKETS_BUFFER_MAX_SIZE: 1982 v.val64 = vsk->buffer_max_size; 1983 break; 1984 1985 case SO_VM_SOCKETS_BUFFER_MIN_SIZE: 1986 v.val64 = vsk->buffer_min_size; 1987 break; 1988 1989 case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW: 1990 case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD: 1991 lv = sock_get_timeout(vsk->connect_timeout, &v, 1992 optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD); 1993 break; 1994 1995 default: 1996 return -ENOPROTOOPT; 1997 } 1998 1999 if (len < lv) 2000 return -EINVAL; 2001 if (len > lv) 2002 len = lv; 2003 if (copy_to_user(optval, &v, len)) 2004 return -EFAULT; 2005 2006 if (put_user(len, optlen)) 2007 return -EFAULT; 2008 2009 return 0; 2010 } 2011 2012 static int vsock_connectible_sendmsg(struct socket *sock, struct msghdr *msg, 2013 size_t len) 2014 { 2015 struct sock *sk; 2016 struct vsock_sock *vsk; 2017 const struct vsock_transport *transport; 2018 ssize_t total_written; 2019 long timeout; 2020 int err; 2021 struct vsock_transport_send_notify_data send_data; 2022 DEFINE_WAIT_FUNC(wait, woken_wake_function); 2023 2024 sk = sock->sk; 2025 vsk = vsock_sk(sk); 2026 total_written = 0; 2027 err = 0; 2028 2029 if (msg->msg_flags & MSG_OOB) 2030 return -EOPNOTSUPP; 2031 2032 lock_sock(sk); 2033 2034 transport = vsk->transport; 2035 2036 /* Callers should not provide a destination with connection oriented 2037 * sockets. 2038 */ 2039 if (msg->msg_namelen) { 2040 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP; 2041 goto out; 2042 } 2043 2044 /* Send data only if both sides are not shutdown in the direction. */ 2045 if (sk->sk_shutdown & SEND_SHUTDOWN || 2046 vsk->peer_shutdown & RCV_SHUTDOWN) { 2047 err = -EPIPE; 2048 goto out; 2049 } 2050 2051 if (!transport || sk->sk_state != TCP_ESTABLISHED || 2052 !vsock_addr_bound(&vsk->local_addr)) { 2053 err = -ENOTCONN; 2054 goto out; 2055 } 2056 2057 if (!vsock_addr_bound(&vsk->remote_addr)) { 2058 err = -EDESTADDRREQ; 2059 goto out; 2060 } 2061 2062 if (msg->msg_flags & MSG_ZEROCOPY && 2063 !vsock_msgzerocopy_allow(transport)) { 2064 err = -EOPNOTSUPP; 2065 goto out; 2066 } 2067 2068 /* Wait for room in the produce queue to enqueue our user's data. */ 2069 timeout = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 2070 2071 err = transport->notify_send_init(vsk, &send_data); 2072 if (err < 0) 2073 goto out; 2074 2075 while (total_written < len) { 2076 ssize_t written; 2077 2078 add_wait_queue(sk_sleep(sk), &wait); 2079 while (vsock_stream_has_space(vsk) == 0 && 2080 sk->sk_err == 0 && 2081 !(sk->sk_shutdown & SEND_SHUTDOWN) && 2082 !(vsk->peer_shutdown & RCV_SHUTDOWN)) { 2083 2084 /* Don't wait for non-blocking sockets. */ 2085 if (timeout == 0) { 2086 err = -EAGAIN; 2087 remove_wait_queue(sk_sleep(sk), &wait); 2088 goto out_err; 2089 } 2090 2091 err = transport->notify_send_pre_block(vsk, &send_data); 2092 if (err < 0) { 2093 remove_wait_queue(sk_sleep(sk), &wait); 2094 goto out_err; 2095 } 2096 2097 release_sock(sk); 2098 timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); 2099 lock_sock(sk); 2100 if (signal_pending(current)) { 2101 err = sock_intr_errno(timeout); 2102 remove_wait_queue(sk_sleep(sk), &wait); 2103 goto out_err; 2104 } else if (timeout == 0) { 2105 err = -EAGAIN; 2106 remove_wait_queue(sk_sleep(sk), &wait); 2107 goto out_err; 2108 } 2109 } 2110 remove_wait_queue(sk_sleep(sk), &wait); 2111 2112 /* These checks occur both as part of and after the loop 2113 * conditional since we need to check before and after 2114 * sleeping. 2115 */ 2116 if (sk->sk_err) { 2117 err = -sk->sk_err; 2118 goto out_err; 2119 } else if ((sk->sk_shutdown & SEND_SHUTDOWN) || 2120 (vsk->peer_shutdown & RCV_SHUTDOWN)) { 2121 err = -EPIPE; 2122 goto out_err; 2123 } 2124 2125 err = transport->notify_send_pre_enqueue(vsk, &send_data); 2126 if (err < 0) 2127 goto out_err; 2128 2129 /* Note that enqueue will only write as many bytes as are free 2130 * in the produce queue, so we don't need to ensure len is 2131 * smaller than the queue size. It is the caller's 2132 * responsibility to check how many bytes we were able to send. 2133 */ 2134 2135 if (sk->sk_type == SOCK_SEQPACKET) { 2136 written = transport->seqpacket_enqueue(vsk, 2137 msg, len - total_written); 2138 } else { 2139 written = transport->stream_enqueue(vsk, 2140 msg, len - total_written); 2141 } 2142 2143 if (written < 0) { 2144 err = written; 2145 goto out_err; 2146 } 2147 2148 total_written += written; 2149 2150 err = transport->notify_send_post_enqueue( 2151 vsk, written, &send_data); 2152 if (err < 0) 2153 goto out_err; 2154 2155 } 2156 2157 out_err: 2158 if (total_written > 0) { 2159 /* Return number of written bytes only if: 2160 * 1) SOCK_STREAM socket. 2161 * 2) SOCK_SEQPACKET socket when whole buffer is sent. 2162 */ 2163 if (sk->sk_type == SOCK_STREAM || total_written == len) 2164 err = total_written; 2165 } 2166 out: 2167 if (sk->sk_type == SOCK_STREAM) 2168 err = sk_stream_error(sk, msg->msg_flags, err); 2169 2170 release_sock(sk); 2171 return err; 2172 } 2173 2174 static int vsock_connectible_wait_data(struct sock *sk, 2175 struct wait_queue_entry *wait, 2176 long timeout, 2177 struct vsock_transport_recv_notify_data *recv_data, 2178 size_t target) 2179 { 2180 const struct vsock_transport *transport; 2181 struct vsock_sock *vsk; 2182 s64 data; 2183 int err; 2184 2185 vsk = vsock_sk(sk); 2186 err = 0; 2187 transport = vsk->transport; 2188 2189 while (1) { 2190 prepare_to_wait(sk_sleep(sk), wait, TASK_INTERRUPTIBLE); 2191 data = vsock_connectible_has_data(vsk); 2192 if (data != 0) 2193 break; 2194 2195 if (sk->sk_err != 0 || 2196 (sk->sk_shutdown & RCV_SHUTDOWN) || 2197 (vsk->peer_shutdown & SEND_SHUTDOWN)) { 2198 break; 2199 } 2200 2201 /* Don't wait for non-blocking sockets. */ 2202 if (timeout == 0) { 2203 err = -EAGAIN; 2204 break; 2205 } 2206 2207 if (recv_data) { 2208 err = transport->notify_recv_pre_block(vsk, target, recv_data); 2209 if (err < 0) 2210 break; 2211 } 2212 2213 release_sock(sk); 2214 timeout = schedule_timeout(timeout); 2215 lock_sock(sk); 2216 2217 if (signal_pending(current)) { 2218 err = sock_intr_errno(timeout); 2219 break; 2220 } else if (timeout == 0) { 2221 err = -EAGAIN; 2222 break; 2223 } 2224 } 2225 2226 finish_wait(sk_sleep(sk), wait); 2227 2228 if (err) 2229 return err; 2230 2231 /* Internal transport error when checking for available 2232 * data. XXX This should be changed to a connection 2233 * reset in a later change. 2234 */ 2235 if (data < 0) 2236 return -ENOMEM; 2237 2238 return data; 2239 } 2240 2241 static int __vsock_stream_recvmsg(struct sock *sk, struct msghdr *msg, 2242 size_t len, int flags) 2243 { 2244 struct vsock_transport_recv_notify_data recv_data; 2245 const struct vsock_transport *transport; 2246 struct vsock_sock *vsk; 2247 ssize_t copied; 2248 size_t target; 2249 long timeout; 2250 int err; 2251 2252 DEFINE_WAIT(wait); 2253 2254 vsk = vsock_sk(sk); 2255 transport = vsk->transport; 2256 2257 /* We must not copy less than target bytes into the user's buffer 2258 * before returning successfully, so we wait for the consume queue to 2259 * have that much data to consume before dequeueing. Note that this 2260 * makes it impossible to handle cases where target is greater than the 2261 * queue size. 2262 */ 2263 target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); 2264 if (target >= transport->stream_rcvhiwat(vsk)) { 2265 err = -ENOMEM; 2266 goto out; 2267 } 2268 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 2269 copied = 0; 2270 2271 err = transport->notify_recv_init(vsk, target, &recv_data); 2272 if (err < 0) 2273 goto out; 2274 2275 2276 while (1) { 2277 ssize_t read; 2278 2279 err = vsock_connectible_wait_data(sk, &wait, timeout, 2280 &recv_data, target); 2281 if (err <= 0) 2282 break; 2283 2284 err = transport->notify_recv_pre_dequeue(vsk, target, 2285 &recv_data); 2286 if (err < 0) 2287 break; 2288 2289 read = transport->stream_dequeue(vsk, msg, len - copied, flags); 2290 if (read < 0) { 2291 err = read; 2292 break; 2293 } 2294 2295 copied += read; 2296 2297 err = transport->notify_recv_post_dequeue(vsk, target, read, 2298 !(flags & MSG_PEEK), &recv_data); 2299 if (err < 0) 2300 goto out; 2301 2302 if (read >= target || flags & MSG_PEEK) 2303 break; 2304 2305 target -= read; 2306 } 2307 2308 if (sk->sk_err) 2309 err = -sk->sk_err; 2310 else if (sk->sk_shutdown & RCV_SHUTDOWN) 2311 err = 0; 2312 2313 if (copied > 0) 2314 err = copied; 2315 2316 out: 2317 return err; 2318 } 2319 2320 static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg, 2321 size_t len, int flags) 2322 { 2323 const struct vsock_transport *transport; 2324 struct vsock_sock *vsk; 2325 ssize_t msg_len; 2326 long timeout; 2327 int err = 0; 2328 DEFINE_WAIT(wait); 2329 2330 vsk = vsock_sk(sk); 2331 transport = vsk->transport; 2332 2333 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 2334 2335 err = vsock_connectible_wait_data(sk, &wait, timeout, NULL, 0); 2336 if (err <= 0) 2337 goto out; 2338 2339 msg_len = transport->seqpacket_dequeue(vsk, msg, flags); 2340 2341 if (msg_len < 0) { 2342 err = msg_len; 2343 goto out; 2344 } 2345 2346 if (sk->sk_err) { 2347 err = -sk->sk_err; 2348 } else if (sk->sk_shutdown & RCV_SHUTDOWN) { 2349 err = 0; 2350 } else { 2351 /* User sets MSG_TRUNC, so return real length of 2352 * packet. 2353 */ 2354 if (flags & MSG_TRUNC) 2355 err = msg_len; 2356 else 2357 err = len - msg_data_left(msg); 2358 2359 /* Always set MSG_TRUNC if real length of packet is 2360 * bigger than user's buffer. 2361 */ 2362 if (msg_len > len) 2363 msg->msg_flags |= MSG_TRUNC; 2364 } 2365 2366 out: 2367 return err; 2368 } 2369 2370 int 2371 __vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 2372 int flags) 2373 { 2374 struct sock *sk; 2375 struct vsock_sock *vsk; 2376 const struct vsock_transport *transport; 2377 int err; 2378 2379 sk = sock->sk; 2380 2381 if (unlikely(flags & MSG_ERRQUEUE)) 2382 return sock_recv_errqueue(sk, msg, len, SOL_VSOCK, VSOCK_RECVERR); 2383 2384 vsk = vsock_sk(sk); 2385 err = 0; 2386 2387 lock_sock(sk); 2388 2389 transport = vsk->transport; 2390 2391 if (!transport || sk->sk_state != TCP_ESTABLISHED) { 2392 /* Recvmsg is supposed to return 0 if a peer performs an 2393 * orderly shutdown. Differentiate between that case and when a 2394 * peer has not connected or a local shutdown occurred with the 2395 * SOCK_DONE flag. 2396 */ 2397 if (sock_flag(sk, SOCK_DONE)) 2398 err = 0; 2399 else 2400 err = -ENOTCONN; 2401 2402 goto out; 2403 } 2404 2405 if (flags & MSG_OOB) { 2406 err = -EOPNOTSUPP; 2407 goto out; 2408 } 2409 2410 /* We don't check peer_shutdown flag here since peer may actually shut 2411 * down, but there can be data in the queue that a local socket can 2412 * receive. 2413 */ 2414 if (sk->sk_shutdown & RCV_SHUTDOWN) { 2415 err = 0; 2416 goto out; 2417 } 2418 2419 /* It is valid on Linux to pass in a zero-length receive buffer. This 2420 * is not an error. We may as well bail out now. 2421 */ 2422 if (!len) { 2423 err = 0; 2424 goto out; 2425 } 2426 2427 if (sk->sk_type == SOCK_STREAM) 2428 err = __vsock_stream_recvmsg(sk, msg, len, flags); 2429 else 2430 err = __vsock_seqpacket_recvmsg(sk, msg, len, flags); 2431 2432 out: 2433 release_sock(sk); 2434 return err; 2435 } 2436 2437 int 2438 vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 2439 int flags) 2440 { 2441 #ifdef CONFIG_BPF_SYSCALL 2442 struct sock *sk = sock->sk; 2443 const struct proto *prot; 2444 2445 prot = READ_ONCE(sk->sk_prot); 2446 if (prot != &vsock_proto) 2447 return prot->recvmsg(sk, msg, len, flags, NULL); 2448 #endif 2449 2450 return __vsock_connectible_recvmsg(sock, msg, len, flags); 2451 } 2452 EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg); 2453 2454 static int vsock_set_rcvlowat(struct sock *sk, int val) 2455 { 2456 const struct vsock_transport *transport; 2457 struct vsock_sock *vsk; 2458 2459 vsk = vsock_sk(sk); 2460 2461 if (val > vsk->buffer_size) 2462 return -EINVAL; 2463 2464 transport = vsk->transport; 2465 2466 if (transport && transport->notify_set_rcvlowat) { 2467 int err; 2468 2469 err = transport->notify_set_rcvlowat(vsk, val); 2470 if (err) 2471 return err; 2472 } 2473 2474 WRITE_ONCE(sk->sk_rcvlowat, val ? : 1); 2475 return 0; 2476 } 2477 2478 static const struct proto_ops vsock_stream_ops = { 2479 .family = PF_VSOCK, 2480 .owner = THIS_MODULE, 2481 .release = vsock_release, 2482 .bind = vsock_bind, 2483 .connect = vsock_connect, 2484 .socketpair = sock_no_socketpair, 2485 .accept = vsock_accept, 2486 .getname = vsock_getname, 2487 .poll = vsock_poll, 2488 .ioctl = vsock_ioctl, 2489 .listen = vsock_listen, 2490 .shutdown = vsock_shutdown, 2491 .setsockopt = vsock_connectible_setsockopt, 2492 .getsockopt = vsock_connectible_getsockopt, 2493 .sendmsg = vsock_connectible_sendmsg, 2494 .recvmsg = vsock_connectible_recvmsg, 2495 .mmap = sock_no_mmap, 2496 .set_rcvlowat = vsock_set_rcvlowat, 2497 .read_skb = vsock_read_skb, 2498 }; 2499 2500 static const struct proto_ops vsock_seqpacket_ops = { 2501 .family = PF_VSOCK, 2502 .owner = THIS_MODULE, 2503 .release = vsock_release, 2504 .bind = vsock_bind, 2505 .connect = vsock_connect, 2506 .socketpair = sock_no_socketpair, 2507 .accept = vsock_accept, 2508 .getname = vsock_getname, 2509 .poll = vsock_poll, 2510 .ioctl = vsock_ioctl, 2511 .listen = vsock_listen, 2512 .shutdown = vsock_shutdown, 2513 .setsockopt = vsock_connectible_setsockopt, 2514 .getsockopt = vsock_connectible_getsockopt, 2515 .sendmsg = vsock_connectible_sendmsg, 2516 .recvmsg = vsock_connectible_recvmsg, 2517 .mmap = sock_no_mmap, 2518 .read_skb = vsock_read_skb, 2519 }; 2520 2521 static int vsock_create(struct net *net, struct socket *sock, 2522 int protocol, int kern) 2523 { 2524 struct vsock_sock *vsk; 2525 struct sock *sk; 2526 int ret; 2527 2528 if (!sock) 2529 return -EINVAL; 2530 2531 if (protocol && protocol != PF_VSOCK) 2532 return -EPROTONOSUPPORT; 2533 2534 switch (sock->type) { 2535 case SOCK_DGRAM: 2536 sock->ops = &vsock_dgram_ops; 2537 break; 2538 case SOCK_STREAM: 2539 sock->ops = &vsock_stream_ops; 2540 break; 2541 case SOCK_SEQPACKET: 2542 sock->ops = &vsock_seqpacket_ops; 2543 break; 2544 default: 2545 return -ESOCKTNOSUPPORT; 2546 } 2547 2548 sock->state = SS_UNCONNECTED; 2549 2550 sk = __vsock_create(net, sock, NULL, GFP_KERNEL, 0, kern); 2551 if (!sk) 2552 return -ENOMEM; 2553 2554 vsk = vsock_sk(sk); 2555 2556 if (sock->type == SOCK_DGRAM) { 2557 ret = vsock_assign_transport(vsk, NULL); 2558 if (ret < 0) { 2559 sock->sk = NULL; 2560 sock_put(sk); 2561 return ret; 2562 } 2563 } 2564 2565 /* SOCK_DGRAM doesn't have 'setsockopt' callback set in its 2566 * proto_ops, so there is no handler for custom logic. 2567 */ 2568 if (sock_type_connectible(sock->type)) 2569 set_bit(SOCK_CUSTOM_SOCKOPT, &sk->sk_socket->flags); 2570 2571 vsock_insert_unbound(vsk); 2572 2573 return 0; 2574 } 2575 2576 static const struct net_proto_family vsock_family_ops = { 2577 .family = AF_VSOCK, 2578 .create = vsock_create, 2579 .owner = THIS_MODULE, 2580 }; 2581 2582 static long vsock_dev_do_ioctl(struct file *filp, 2583 unsigned int cmd, void __user *ptr) 2584 { 2585 u32 __user *p = ptr; 2586 int retval = 0; 2587 u32 cid; 2588 2589 switch (cmd) { 2590 case IOCTL_VM_SOCKETS_GET_LOCAL_CID: 2591 /* To be compatible with the VMCI behavior, we prioritize the 2592 * guest CID instead of well-know host CID (VMADDR_CID_HOST). 2593 */ 2594 cid = vsock_registered_transport_cid(&transport_g2h); 2595 if (cid == VMADDR_CID_ANY) 2596 cid = vsock_registered_transport_cid(&transport_h2g); 2597 if (cid == VMADDR_CID_ANY) 2598 cid = vsock_registered_transport_cid(&transport_local); 2599 2600 if (put_user(cid, p) != 0) 2601 retval = -EFAULT; 2602 break; 2603 2604 default: 2605 retval = -ENOIOCTLCMD; 2606 } 2607 2608 return retval; 2609 } 2610 2611 static long vsock_dev_ioctl(struct file *filp, 2612 unsigned int cmd, unsigned long arg) 2613 { 2614 return vsock_dev_do_ioctl(filp, cmd, (void __user *)arg); 2615 } 2616 2617 #ifdef CONFIG_COMPAT 2618 static long vsock_dev_compat_ioctl(struct file *filp, 2619 unsigned int cmd, unsigned long arg) 2620 { 2621 return vsock_dev_do_ioctl(filp, cmd, compat_ptr(arg)); 2622 } 2623 #endif 2624 2625 static const struct file_operations vsock_device_ops = { 2626 .owner = THIS_MODULE, 2627 .unlocked_ioctl = vsock_dev_ioctl, 2628 #ifdef CONFIG_COMPAT 2629 .compat_ioctl = vsock_dev_compat_ioctl, 2630 #endif 2631 .open = nonseekable_open, 2632 }; 2633 2634 static struct miscdevice vsock_device = { 2635 .name = "vsock", 2636 .fops = &vsock_device_ops, 2637 }; 2638 2639 static int __init vsock_init(void) 2640 { 2641 int err = 0; 2642 2643 vsock_init_tables(); 2644 2645 vsock_proto.owner = THIS_MODULE; 2646 vsock_device.minor = MISC_DYNAMIC_MINOR; 2647 err = misc_register(&vsock_device); 2648 if (err) { 2649 pr_err("Failed to register misc device\n"); 2650 goto err_reset_transport; 2651 } 2652 2653 err = proto_register(&vsock_proto, 1); /* we want our slab */ 2654 if (err) { 2655 pr_err("Cannot register vsock protocol\n"); 2656 goto err_deregister_misc; 2657 } 2658 2659 err = sock_register(&vsock_family_ops); 2660 if (err) { 2661 pr_err("could not register af_vsock (%d) address family: %d\n", 2662 AF_VSOCK, err); 2663 goto err_unregister_proto; 2664 } 2665 2666 vsock_bpf_build_proto(); 2667 2668 return 0; 2669 2670 err_unregister_proto: 2671 proto_unregister(&vsock_proto); 2672 err_deregister_misc: 2673 misc_deregister(&vsock_device); 2674 err_reset_transport: 2675 return err; 2676 } 2677 2678 static void __exit vsock_exit(void) 2679 { 2680 misc_deregister(&vsock_device); 2681 sock_unregister(AF_VSOCK); 2682 proto_unregister(&vsock_proto); 2683 } 2684 2685 const struct vsock_transport *vsock_core_get_transport(struct vsock_sock *vsk) 2686 { 2687 return vsk->transport; 2688 } 2689 EXPORT_SYMBOL_GPL(vsock_core_get_transport); 2690 2691 int vsock_core_register(const struct vsock_transport *t, int features) 2692 { 2693 const struct vsock_transport *t_h2g, *t_g2h, *t_dgram, *t_local; 2694 int err = mutex_lock_interruptible(&vsock_register_mutex); 2695 2696 if (err) 2697 return err; 2698 2699 t_h2g = transport_h2g; 2700 t_g2h = transport_g2h; 2701 t_dgram = transport_dgram; 2702 t_local = transport_local; 2703 2704 if (features & VSOCK_TRANSPORT_F_H2G) { 2705 if (t_h2g) { 2706 err = -EBUSY; 2707 goto err_busy; 2708 } 2709 t_h2g = t; 2710 } 2711 2712 if (features & VSOCK_TRANSPORT_F_G2H) { 2713 if (t_g2h) { 2714 err = -EBUSY; 2715 goto err_busy; 2716 } 2717 t_g2h = t; 2718 } 2719 2720 if (features & VSOCK_TRANSPORT_F_DGRAM) { 2721 if (t_dgram) { 2722 err = -EBUSY; 2723 goto err_busy; 2724 } 2725 t_dgram = t; 2726 } 2727 2728 if (features & VSOCK_TRANSPORT_F_LOCAL) { 2729 if (t_local) { 2730 err = -EBUSY; 2731 goto err_busy; 2732 } 2733 t_local = t; 2734 } 2735 2736 transport_h2g = t_h2g; 2737 transport_g2h = t_g2h; 2738 transport_dgram = t_dgram; 2739 transport_local = t_local; 2740 2741 err_busy: 2742 mutex_unlock(&vsock_register_mutex); 2743 return err; 2744 } 2745 EXPORT_SYMBOL_GPL(vsock_core_register); 2746 2747 void vsock_core_unregister(const struct vsock_transport *t) 2748 { 2749 mutex_lock(&vsock_register_mutex); 2750 2751 if (transport_h2g == t) 2752 transport_h2g = NULL; 2753 2754 if (transport_g2h == t) 2755 transport_g2h = NULL; 2756 2757 if (transport_dgram == t) 2758 transport_dgram = NULL; 2759 2760 if (transport_local == t) 2761 transport_local = NULL; 2762 2763 mutex_unlock(&vsock_register_mutex); 2764 } 2765 EXPORT_SYMBOL_GPL(vsock_core_unregister); 2766 2767 module_init(vsock_init); 2768 module_exit(vsock_exit); 2769 2770 MODULE_AUTHOR("VMware, Inc."); 2771 MODULE_DESCRIPTION("VMware Virtual Socket Family"); 2772 MODULE_VERSION("1.0.2.0-k"); 2773 MODULE_LICENSE("GPL v2"); 2774