1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * VMware vSockets Driver 4 * 5 * Copyright (C) 2007-2013 VMware, Inc. All rights reserved. 6 */ 7 8 /* Implementation notes: 9 * 10 * - There are two kinds of sockets: those created by user action (such as 11 * calling socket(2)) and those created by incoming connection request packets. 12 * 13 * - There are two "global" tables, one for bound sockets (sockets that have 14 * specified an address that they are responsible for) and one for connected 15 * sockets (sockets that have established a connection with another socket). 16 * These tables are "global" in that all sockets on the system are placed 17 * within them. - Note, though, that the bound table contains an extra entry 18 * for a list of unbound sockets and SOCK_DGRAM sockets will always remain in 19 * that list. The bound table is used solely for lookup of sockets when packets 20 * are received and that's not necessary for SOCK_DGRAM sockets since we create 21 * a datagram handle for each and need not perform a lookup. Keeping SOCK_DGRAM 22 * sockets out of the bound hash buckets will reduce the chance of collisions 23 * when looking for SOCK_STREAM sockets and prevents us from having to check the 24 * socket type in the hash table lookups. 25 * 26 * - Sockets created by user action will either be "client" sockets that 27 * initiate a connection or "server" sockets that listen for connections; we do 28 * not support simultaneous connects (two "client" sockets connecting). 29 * 30 * - "Server" sockets are referred to as listener sockets throughout this 31 * implementation because they are in the TCP_LISTEN state. When a 32 * connection request is received (the second kind of socket mentioned above), 33 * we create a new socket and refer to it as a pending socket. These pending 34 * sockets are placed on the pending connection list of the listener socket. 35 * When future packets are received for the address the listener socket is 36 * bound to, we check if the source of the packet is from one that has an 37 * existing pending connection. If it does, we process the packet for the 38 * pending socket. When that socket reaches the connected state, it is removed 39 * from the listener socket's pending list and enqueued in the listener 40 * socket's accept queue. Callers of accept(2) will accept connected sockets 41 * from the listener socket's accept queue. If the socket cannot be accepted 42 * for some reason then it is marked rejected. Once the connection is 43 * accepted, it is owned by the user process and the responsibility for cleanup 44 * falls with that user process. 45 * 46 * - It is possible that these pending sockets will never reach the connected 47 * state; in fact, we may never receive another packet after the connection 48 * request. Because of this, we must schedule a cleanup function to run in the 49 * future, after some amount of time passes where a connection should have been 50 * established. This function ensures that the socket is off all lists so it 51 * cannot be retrieved, then drops all references to the socket so it is cleaned 52 * up (sock_put() -> sk_free() -> our sk_destruct implementation). Note this 53 * function will also cleanup rejected sockets, those that reach the connected 54 * state but leave it before they have been accepted. 55 * 56 * - Lock ordering for pending or accept queue sockets is: 57 * 58 * lock_sock(listener); 59 * lock_sock_nested(pending, SINGLE_DEPTH_NESTING); 60 * 61 * Using explicit nested locking keeps lockdep happy since normally only one 62 * lock of a given class may be taken at a time. 63 * 64 * - Sockets created by user action will be cleaned up when the user process 65 * calls close(2), causing our release implementation to be called. Our release 66 * implementation will perform some cleanup then drop the last reference so our 67 * sk_destruct implementation is invoked. Our sk_destruct implementation will 68 * perform additional cleanup that's common for both types of sockets. 69 * 70 * - A socket's reference count is what ensures that the structure won't be 71 * freed. Each entry in a list (such as the "global" bound and connected tables 72 * and the listener socket's pending list and connected queue) ensures a 73 * reference. When we defer work until process context and pass a socket as our 74 * argument, we must ensure the reference count is increased to ensure the 75 * socket isn't freed before the function is run; the deferred function will 76 * then drop the reference. 77 * 78 * - sk->sk_state uses the TCP state constants because they are widely used by 79 * other address families and exposed to userspace tools like ss(8): 80 * 81 * TCP_CLOSE - unconnected 82 * TCP_SYN_SENT - connecting 83 * TCP_ESTABLISHED - connected 84 * TCP_CLOSING - disconnecting 85 * TCP_LISTEN - listening 86 */ 87 88 #include <linux/compat.h> 89 #include <linux/types.h> 90 #include <linux/bitops.h> 91 #include <linux/cred.h> 92 #include <linux/errqueue.h> 93 #include <linux/init.h> 94 #include <linux/io.h> 95 #include <linux/kernel.h> 96 #include <linux/sched/signal.h> 97 #include <linux/kmod.h> 98 #include <linux/list.h> 99 #include <linux/miscdevice.h> 100 #include <linux/module.h> 101 #include <linux/mutex.h> 102 #include <linux/net.h> 103 #include <linux/poll.h> 104 #include <linux/random.h> 105 #include <linux/skbuff.h> 106 #include <linux/smp.h> 107 #include <linux/socket.h> 108 #include <linux/stddef.h> 109 #include <linux/unistd.h> 110 #include <linux/wait.h> 111 #include <linux/workqueue.h> 112 #include <net/sock.h> 113 #include <net/af_vsock.h> 114 #include <uapi/linux/vm_sockets.h> 115 #include <uapi/asm-generic/ioctls.h> 116 117 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr); 118 static void vsock_sk_destruct(struct sock *sk); 119 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); 120 static void vsock_close(struct sock *sk, long timeout); 121 122 /* Protocol family. */ 123 struct proto vsock_proto = { 124 .name = "AF_VSOCK", 125 .owner = THIS_MODULE, 126 .obj_size = sizeof(struct vsock_sock), 127 .close = vsock_close, 128 #ifdef CONFIG_BPF_SYSCALL 129 .psock_update_sk_prot = vsock_bpf_update_proto, 130 #endif 131 }; 132 133 /* The default peer timeout indicates how long we will wait for a peer response 134 * to a control message. 135 */ 136 #define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ) 137 138 #define VSOCK_DEFAULT_BUFFER_SIZE (1024 * 256) 139 #define VSOCK_DEFAULT_BUFFER_MAX_SIZE (1024 * 256) 140 #define VSOCK_DEFAULT_BUFFER_MIN_SIZE 128 141 142 /* Transport used for host->guest communication */ 143 static const struct vsock_transport *transport_h2g; 144 /* Transport used for guest->host communication */ 145 static const struct vsock_transport *transport_g2h; 146 /* Transport used for DGRAM communication */ 147 static const struct vsock_transport *transport_dgram; 148 /* Transport used for local communication */ 149 static const struct vsock_transport *transport_local; 150 static DEFINE_MUTEX(vsock_register_mutex); 151 152 /**** UTILS ****/ 153 154 /* Each bound VSocket is stored in the bind hash table and each connected 155 * VSocket is stored in the connected hash table. 156 * 157 * Unbound sockets are all put on the same list attached to the end of the hash 158 * table (vsock_unbound_sockets). Bound sockets are added to the hash table in 159 * the bucket that their local address hashes to (vsock_bound_sockets(addr) 160 * represents the list that addr hashes to). 161 * 162 * Specifically, we initialize the vsock_bind_table array to a size of 163 * VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through 164 * vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and 165 * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets. The hash function 166 * mods with VSOCK_HASH_SIZE to ensure this. 167 */ 168 #define MAX_PORT_RETRIES 24 169 170 #define VSOCK_HASH(addr) ((addr)->svm_port % VSOCK_HASH_SIZE) 171 #define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)]) 172 #define vsock_unbound_sockets (&vsock_bind_table[VSOCK_HASH_SIZE]) 173 174 /* XXX This can probably be implemented in a better way. */ 175 #define VSOCK_CONN_HASH(src, dst) \ 176 (((src)->svm_cid ^ (dst)->svm_port) % VSOCK_HASH_SIZE) 177 #define vsock_connected_sockets(src, dst) \ 178 (&vsock_connected_table[VSOCK_CONN_HASH(src, dst)]) 179 #define vsock_connected_sockets_vsk(vsk) \ 180 vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr) 181 182 struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1]; 183 EXPORT_SYMBOL_GPL(vsock_bind_table); 184 struct list_head vsock_connected_table[VSOCK_HASH_SIZE]; 185 EXPORT_SYMBOL_GPL(vsock_connected_table); 186 DEFINE_SPINLOCK(vsock_table_lock); 187 EXPORT_SYMBOL_GPL(vsock_table_lock); 188 189 /* Autobind this socket to the local address if necessary. */ 190 static int vsock_auto_bind(struct vsock_sock *vsk) 191 { 192 struct sock *sk = sk_vsock(vsk); 193 struct sockaddr_vm local_addr; 194 195 if (vsock_addr_bound(&vsk->local_addr)) 196 return 0; 197 vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 198 return __vsock_bind(sk, &local_addr); 199 } 200 201 static void vsock_init_tables(void) 202 { 203 int i; 204 205 for (i = 0; i < ARRAY_SIZE(vsock_bind_table); i++) 206 INIT_LIST_HEAD(&vsock_bind_table[i]); 207 208 for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) 209 INIT_LIST_HEAD(&vsock_connected_table[i]); 210 } 211 212 static void __vsock_insert_bound(struct list_head *list, 213 struct vsock_sock *vsk) 214 { 215 sock_hold(&vsk->sk); 216 list_add(&vsk->bound_table, list); 217 } 218 219 static void __vsock_insert_connected(struct list_head *list, 220 struct vsock_sock *vsk) 221 { 222 sock_hold(&vsk->sk); 223 list_add(&vsk->connected_table, list); 224 } 225 226 static void __vsock_remove_bound(struct vsock_sock *vsk) 227 { 228 list_del_init(&vsk->bound_table); 229 sock_put(&vsk->sk); 230 } 231 232 static void __vsock_remove_connected(struct vsock_sock *vsk) 233 { 234 list_del_init(&vsk->connected_table); 235 sock_put(&vsk->sk); 236 } 237 238 static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr) 239 { 240 struct vsock_sock *vsk; 241 242 list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) { 243 if (vsock_addr_equals_addr(addr, &vsk->local_addr)) 244 return sk_vsock(vsk); 245 246 if (addr->svm_port == vsk->local_addr.svm_port && 247 (vsk->local_addr.svm_cid == VMADDR_CID_ANY || 248 addr->svm_cid == VMADDR_CID_ANY)) 249 return sk_vsock(vsk); 250 } 251 252 return NULL; 253 } 254 255 static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src, 256 struct sockaddr_vm *dst) 257 { 258 struct vsock_sock *vsk; 259 260 list_for_each_entry(vsk, vsock_connected_sockets(src, dst), 261 connected_table) { 262 if (vsock_addr_equals_addr(src, &vsk->remote_addr) && 263 dst->svm_port == vsk->local_addr.svm_port) { 264 return sk_vsock(vsk); 265 } 266 } 267 268 return NULL; 269 } 270 271 static void vsock_insert_unbound(struct vsock_sock *vsk) 272 { 273 spin_lock_bh(&vsock_table_lock); 274 __vsock_insert_bound(vsock_unbound_sockets, vsk); 275 spin_unlock_bh(&vsock_table_lock); 276 } 277 278 void vsock_insert_connected(struct vsock_sock *vsk) 279 { 280 struct list_head *list = vsock_connected_sockets( 281 &vsk->remote_addr, &vsk->local_addr); 282 283 spin_lock_bh(&vsock_table_lock); 284 __vsock_insert_connected(list, vsk); 285 spin_unlock_bh(&vsock_table_lock); 286 } 287 EXPORT_SYMBOL_GPL(vsock_insert_connected); 288 289 void vsock_remove_bound(struct vsock_sock *vsk) 290 { 291 spin_lock_bh(&vsock_table_lock); 292 if (__vsock_in_bound_table(vsk)) 293 __vsock_remove_bound(vsk); 294 spin_unlock_bh(&vsock_table_lock); 295 } 296 EXPORT_SYMBOL_GPL(vsock_remove_bound); 297 298 void vsock_remove_connected(struct vsock_sock *vsk) 299 { 300 spin_lock_bh(&vsock_table_lock); 301 if (__vsock_in_connected_table(vsk)) 302 __vsock_remove_connected(vsk); 303 spin_unlock_bh(&vsock_table_lock); 304 } 305 EXPORT_SYMBOL_GPL(vsock_remove_connected); 306 307 struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) 308 { 309 struct sock *sk; 310 311 spin_lock_bh(&vsock_table_lock); 312 sk = __vsock_find_bound_socket(addr); 313 if (sk) 314 sock_hold(sk); 315 316 spin_unlock_bh(&vsock_table_lock); 317 318 return sk; 319 } 320 EXPORT_SYMBOL_GPL(vsock_find_bound_socket); 321 322 struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, 323 struct sockaddr_vm *dst) 324 { 325 struct sock *sk; 326 327 spin_lock_bh(&vsock_table_lock); 328 sk = __vsock_find_connected_socket(src, dst); 329 if (sk) 330 sock_hold(sk); 331 332 spin_unlock_bh(&vsock_table_lock); 333 334 return sk; 335 } 336 EXPORT_SYMBOL_GPL(vsock_find_connected_socket); 337 338 void vsock_remove_sock(struct vsock_sock *vsk) 339 { 340 /* Transport reassignment must not remove the binding. */ 341 if (sock_flag(sk_vsock(vsk), SOCK_DEAD)) 342 vsock_remove_bound(vsk); 343 344 vsock_remove_connected(vsk); 345 } 346 EXPORT_SYMBOL_GPL(vsock_remove_sock); 347 348 void vsock_for_each_connected_socket(struct vsock_transport *transport, 349 void (*fn)(struct sock *sk)) 350 { 351 int i; 352 353 spin_lock_bh(&vsock_table_lock); 354 355 for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) { 356 struct vsock_sock *vsk; 357 list_for_each_entry(vsk, &vsock_connected_table[i], 358 connected_table) { 359 if (vsk->transport != transport) 360 continue; 361 362 fn(sk_vsock(vsk)); 363 } 364 } 365 366 spin_unlock_bh(&vsock_table_lock); 367 } 368 EXPORT_SYMBOL_GPL(vsock_for_each_connected_socket); 369 370 void vsock_add_pending(struct sock *listener, struct sock *pending) 371 { 372 struct vsock_sock *vlistener; 373 struct vsock_sock *vpending; 374 375 vlistener = vsock_sk(listener); 376 vpending = vsock_sk(pending); 377 378 sock_hold(pending); 379 sock_hold(listener); 380 list_add_tail(&vpending->pending_links, &vlistener->pending_links); 381 } 382 EXPORT_SYMBOL_GPL(vsock_add_pending); 383 384 void vsock_remove_pending(struct sock *listener, struct sock *pending) 385 { 386 struct vsock_sock *vpending = vsock_sk(pending); 387 388 list_del_init(&vpending->pending_links); 389 sock_put(listener); 390 sock_put(pending); 391 } 392 EXPORT_SYMBOL_GPL(vsock_remove_pending); 393 394 void vsock_enqueue_accept(struct sock *listener, struct sock *connected) 395 { 396 struct vsock_sock *vlistener; 397 struct vsock_sock *vconnected; 398 399 vlistener = vsock_sk(listener); 400 vconnected = vsock_sk(connected); 401 402 sock_hold(connected); 403 sock_hold(listener); 404 list_add_tail(&vconnected->accept_queue, &vlistener->accept_queue); 405 } 406 EXPORT_SYMBOL_GPL(vsock_enqueue_accept); 407 408 static bool vsock_use_local_transport(unsigned int remote_cid) 409 { 410 lockdep_assert_held(&vsock_register_mutex); 411 412 if (!transport_local) 413 return false; 414 415 if (remote_cid == VMADDR_CID_LOCAL) 416 return true; 417 418 if (transport_g2h) { 419 return remote_cid == transport_g2h->get_local_cid(); 420 } else { 421 return remote_cid == VMADDR_CID_HOST; 422 } 423 } 424 425 static void vsock_deassign_transport(struct vsock_sock *vsk) 426 { 427 if (!vsk->transport) 428 return; 429 430 vsk->transport->destruct(vsk); 431 module_put(vsk->transport->module); 432 vsk->transport = NULL; 433 } 434 435 /* Assign a transport to a socket and call the .init transport callback. 436 * 437 * Note: for connection oriented socket this must be called when vsk->remote_addr 438 * is set (e.g. during the connect() or when a connection request on a listener 439 * socket is received). 440 * The vsk->remote_addr is used to decide which transport to use: 441 * - remote CID == VMADDR_CID_LOCAL or g2h->local_cid or VMADDR_CID_HOST if 442 * g2h is not loaded, will use local transport; 443 * - remote CID <= VMADDR_CID_HOST or h2g is not loaded or remote flags field 444 * includes VMADDR_FLAG_TO_HOST flag value, will use guest->host transport; 445 * - remote CID > VMADDR_CID_HOST will use host->guest transport; 446 */ 447 int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) 448 { 449 const struct vsock_transport *new_transport; 450 struct sock *sk = sk_vsock(vsk); 451 unsigned int remote_cid = vsk->remote_addr.svm_cid; 452 __u8 remote_flags; 453 int ret; 454 455 /* If the packet is coming with the source and destination CIDs higher 456 * than VMADDR_CID_HOST, then a vsock channel where all the packets are 457 * forwarded to the host should be established. Then the host will 458 * need to forward the packets to the guest. 459 * 460 * The flag is set on the (listen) receive path (psk is not NULL). On 461 * the connect path the flag can be set by the user space application. 462 */ 463 if (psk && vsk->local_addr.svm_cid > VMADDR_CID_HOST && 464 vsk->remote_addr.svm_cid > VMADDR_CID_HOST) 465 vsk->remote_addr.svm_flags |= VMADDR_FLAG_TO_HOST; 466 467 remote_flags = vsk->remote_addr.svm_flags; 468 469 mutex_lock(&vsock_register_mutex); 470 471 switch (sk->sk_type) { 472 case SOCK_DGRAM: 473 new_transport = transport_dgram; 474 break; 475 case SOCK_STREAM: 476 case SOCK_SEQPACKET: 477 if (vsock_use_local_transport(remote_cid)) 478 new_transport = transport_local; 479 else if (remote_cid <= VMADDR_CID_HOST || !transport_h2g || 480 (remote_flags & VMADDR_FLAG_TO_HOST)) 481 new_transport = transport_g2h; 482 else 483 new_transport = transport_h2g; 484 break; 485 default: 486 ret = -ESOCKTNOSUPPORT; 487 goto err; 488 } 489 490 if (vsk->transport) { 491 if (vsk->transport == new_transport) { 492 ret = 0; 493 goto err; 494 } 495 496 /* transport->release() must be called with sock lock acquired. 497 * This path can only be taken during vsock_connect(), where we 498 * have already held the sock lock. In the other cases, this 499 * function is called on a new socket which is not assigned to 500 * any transport. 501 */ 502 vsk->transport->release(vsk); 503 vsock_deassign_transport(vsk); 504 505 /* transport's release() and destruct() can touch some socket 506 * state, since we are reassigning the socket to a new transport 507 * during vsock_connect(), let's reset these fields to have a 508 * clean state. 509 */ 510 sock_reset_flag(sk, SOCK_DONE); 511 sk->sk_state = TCP_CLOSE; 512 vsk->peer_shutdown = 0; 513 } 514 515 /* We increase the module refcnt to prevent the transport unloading 516 * while there are open sockets assigned to it. 517 */ 518 if (!new_transport || !try_module_get(new_transport->module)) { 519 ret = -ENODEV; 520 goto err; 521 } 522 523 /* It's safe to release the mutex after a successful try_module_get(). 524 * Whichever transport `new_transport` points at, it won't go away until 525 * the last module_put() below or in vsock_deassign_transport(). 526 */ 527 mutex_unlock(&vsock_register_mutex); 528 529 if (sk->sk_type == SOCK_SEQPACKET) { 530 if (!new_transport->seqpacket_allow || 531 !new_transport->seqpacket_allow(remote_cid)) { 532 module_put(new_transport->module); 533 return -ESOCKTNOSUPPORT; 534 } 535 } 536 537 ret = new_transport->init(vsk, psk); 538 if (ret) { 539 module_put(new_transport->module); 540 return ret; 541 } 542 543 vsk->transport = new_transport; 544 545 return 0; 546 err: 547 mutex_unlock(&vsock_register_mutex); 548 return ret; 549 } 550 EXPORT_SYMBOL_GPL(vsock_assign_transport); 551 552 /* 553 * Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks. 554 * Otherwise we may race with module removal. Do not use on `vsk->transport`. 555 */ 556 static u32 vsock_registered_transport_cid(const struct vsock_transport **transport) 557 { 558 u32 cid = VMADDR_CID_ANY; 559 560 mutex_lock(&vsock_register_mutex); 561 if (*transport) 562 cid = (*transport)->get_local_cid(); 563 mutex_unlock(&vsock_register_mutex); 564 565 return cid; 566 } 567 568 bool vsock_find_cid(unsigned int cid) 569 { 570 if (cid == vsock_registered_transport_cid(&transport_g2h)) 571 return true; 572 573 if (transport_h2g && cid == VMADDR_CID_HOST) 574 return true; 575 576 if (transport_local && cid == VMADDR_CID_LOCAL) 577 return true; 578 579 return false; 580 } 581 EXPORT_SYMBOL_GPL(vsock_find_cid); 582 583 static struct sock *vsock_dequeue_accept(struct sock *listener) 584 { 585 struct vsock_sock *vlistener; 586 struct vsock_sock *vconnected; 587 588 vlistener = vsock_sk(listener); 589 590 if (list_empty(&vlistener->accept_queue)) 591 return NULL; 592 593 vconnected = list_entry(vlistener->accept_queue.next, 594 struct vsock_sock, accept_queue); 595 596 list_del_init(&vconnected->accept_queue); 597 sock_put(listener); 598 /* The caller will need a reference on the connected socket so we let 599 * it call sock_put(). 600 */ 601 602 return sk_vsock(vconnected); 603 } 604 605 static bool vsock_is_accept_queue_empty(struct sock *sk) 606 { 607 struct vsock_sock *vsk = vsock_sk(sk); 608 return list_empty(&vsk->accept_queue); 609 } 610 611 static bool vsock_is_pending(struct sock *sk) 612 { 613 struct vsock_sock *vsk = vsock_sk(sk); 614 return !list_empty(&vsk->pending_links); 615 } 616 617 static int vsock_send_shutdown(struct sock *sk, int mode) 618 { 619 struct vsock_sock *vsk = vsock_sk(sk); 620 621 if (!vsk->transport) 622 return -ENODEV; 623 624 return vsk->transport->shutdown(vsk, mode); 625 } 626 627 static void vsock_pending_work(struct work_struct *work) 628 { 629 struct sock *sk; 630 struct sock *listener; 631 struct vsock_sock *vsk; 632 bool cleanup; 633 634 vsk = container_of(work, struct vsock_sock, pending_work.work); 635 sk = sk_vsock(vsk); 636 listener = vsk->listener; 637 cleanup = true; 638 639 lock_sock(listener); 640 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 641 642 if (vsock_is_pending(sk)) { 643 vsock_remove_pending(listener, sk); 644 645 sk_acceptq_removed(listener); 646 } else if (!vsk->rejected) { 647 /* We are not on the pending list and accept() did not reject 648 * us, so we must have been accepted by our user process. We 649 * just need to drop our references to the sockets and be on 650 * our way. 651 */ 652 cleanup = false; 653 goto out; 654 } 655 656 /* We need to remove ourself from the global connected sockets list so 657 * incoming packets can't find this socket, and to reduce the reference 658 * count. 659 */ 660 vsock_remove_connected(vsk); 661 662 sk->sk_state = TCP_CLOSE; 663 664 out: 665 release_sock(sk); 666 release_sock(listener); 667 if (cleanup) 668 sock_put(sk); 669 670 sock_put(sk); 671 sock_put(listener); 672 } 673 674 /**** SOCKET OPERATIONS ****/ 675 676 static int __vsock_bind_connectible(struct vsock_sock *vsk, 677 struct sockaddr_vm *addr) 678 { 679 static u32 port; 680 struct sockaddr_vm new_addr; 681 682 if (!port) 683 port = get_random_u32_above(LAST_RESERVED_PORT); 684 685 vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port); 686 687 if (addr->svm_port == VMADDR_PORT_ANY) { 688 bool found = false; 689 unsigned int i; 690 691 for (i = 0; i < MAX_PORT_RETRIES; i++) { 692 if (port == VMADDR_PORT_ANY || 693 port <= LAST_RESERVED_PORT) 694 port = LAST_RESERVED_PORT + 1; 695 696 new_addr.svm_port = port++; 697 698 if (!__vsock_find_bound_socket(&new_addr)) { 699 found = true; 700 break; 701 } 702 } 703 704 if (!found) 705 return -EADDRNOTAVAIL; 706 } else { 707 /* If port is in reserved range, ensure caller 708 * has necessary privileges. 709 */ 710 if (addr->svm_port <= LAST_RESERVED_PORT && 711 !capable(CAP_NET_BIND_SERVICE)) { 712 return -EACCES; 713 } 714 715 if (__vsock_find_bound_socket(&new_addr)) 716 return -EADDRINUSE; 717 } 718 719 vsock_addr_init(&vsk->local_addr, new_addr.svm_cid, new_addr.svm_port); 720 721 /* Remove connection oriented sockets from the unbound list and add them 722 * to the hash table for easy lookup by its address. The unbound list 723 * is simply an extra entry at the end of the hash table, a trick used 724 * by AF_UNIX. 725 */ 726 __vsock_remove_bound(vsk); 727 __vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk); 728 729 return 0; 730 } 731 732 static int __vsock_bind_dgram(struct vsock_sock *vsk, 733 struct sockaddr_vm *addr) 734 { 735 return vsk->transport->dgram_bind(vsk, addr); 736 } 737 738 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr) 739 { 740 struct vsock_sock *vsk = vsock_sk(sk); 741 int retval; 742 743 /* First ensure this socket isn't already bound. */ 744 if (vsock_addr_bound(&vsk->local_addr)) 745 return -EINVAL; 746 747 /* Now bind to the provided address or select appropriate values if 748 * none are provided (VMADDR_CID_ANY and VMADDR_PORT_ANY). Note that 749 * like AF_INET prevents binding to a non-local IP address (in most 750 * cases), we only allow binding to a local CID. 751 */ 752 if (addr->svm_cid != VMADDR_CID_ANY && !vsock_find_cid(addr->svm_cid)) 753 return -EADDRNOTAVAIL; 754 755 switch (sk->sk_socket->type) { 756 case SOCK_STREAM: 757 case SOCK_SEQPACKET: 758 spin_lock_bh(&vsock_table_lock); 759 retval = __vsock_bind_connectible(vsk, addr); 760 spin_unlock_bh(&vsock_table_lock); 761 break; 762 763 case SOCK_DGRAM: 764 retval = __vsock_bind_dgram(vsk, addr); 765 break; 766 767 default: 768 retval = -EINVAL; 769 break; 770 } 771 772 return retval; 773 } 774 775 static void vsock_connect_timeout(struct work_struct *work); 776 777 static struct sock *__vsock_create(struct net *net, 778 struct socket *sock, 779 struct sock *parent, 780 gfp_t priority, 781 unsigned short type, 782 int kern) 783 { 784 struct sock *sk; 785 struct vsock_sock *psk; 786 struct vsock_sock *vsk; 787 788 sk = sk_alloc(net, AF_VSOCK, priority, &vsock_proto, kern); 789 if (!sk) 790 return NULL; 791 792 sock_init_data(sock, sk); 793 794 /* sk->sk_type is normally set in sock_init_data, but only if sock is 795 * non-NULL. We make sure that our sockets always have a type by 796 * setting it here if needed. 797 */ 798 if (!sock) 799 sk->sk_type = type; 800 801 vsk = vsock_sk(sk); 802 vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 803 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 804 805 sk->sk_destruct = vsock_sk_destruct; 806 sk->sk_backlog_rcv = vsock_queue_rcv_skb; 807 sock_reset_flag(sk, SOCK_DONE); 808 809 INIT_LIST_HEAD(&vsk->bound_table); 810 INIT_LIST_HEAD(&vsk->connected_table); 811 vsk->listener = NULL; 812 INIT_LIST_HEAD(&vsk->pending_links); 813 INIT_LIST_HEAD(&vsk->accept_queue); 814 vsk->rejected = false; 815 vsk->sent_request = false; 816 vsk->ignore_connecting_rst = false; 817 vsk->peer_shutdown = 0; 818 INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout); 819 INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work); 820 821 psk = parent ? vsock_sk(parent) : NULL; 822 if (parent) { 823 vsk->trusted = psk->trusted; 824 vsk->owner = get_cred(psk->owner); 825 vsk->connect_timeout = psk->connect_timeout; 826 vsk->buffer_size = psk->buffer_size; 827 vsk->buffer_min_size = psk->buffer_min_size; 828 vsk->buffer_max_size = psk->buffer_max_size; 829 security_sk_clone(parent, sk); 830 } else { 831 vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN); 832 vsk->owner = get_current_cred(); 833 vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT; 834 vsk->buffer_size = VSOCK_DEFAULT_BUFFER_SIZE; 835 vsk->buffer_min_size = VSOCK_DEFAULT_BUFFER_MIN_SIZE; 836 vsk->buffer_max_size = VSOCK_DEFAULT_BUFFER_MAX_SIZE; 837 } 838 839 return sk; 840 } 841 842 static bool sock_type_connectible(u16 type) 843 { 844 return (type == SOCK_STREAM) || (type == SOCK_SEQPACKET); 845 } 846 847 static void __vsock_release(struct sock *sk, int level) 848 { 849 struct vsock_sock *vsk; 850 struct sock *pending; 851 852 vsk = vsock_sk(sk); 853 pending = NULL; /* Compiler warning. */ 854 855 /* When "level" is SINGLE_DEPTH_NESTING, use the nested 856 * version to avoid the warning "possible recursive locking 857 * detected". When "level" is 0, lock_sock_nested(sk, level) 858 * is the same as lock_sock(sk). 859 */ 860 lock_sock_nested(sk, level); 861 862 /* Indicate to vsock_remove_sock() that the socket is being released and 863 * can be removed from the bound_table. Unlike transport reassignment 864 * case, where the socket must remain bound despite vsock_remove_sock() 865 * being called from the transport release() callback. 866 */ 867 sock_set_flag(sk, SOCK_DEAD); 868 869 if (vsk->transport) 870 vsk->transport->release(vsk); 871 else if (sock_type_connectible(sk->sk_type)) 872 vsock_remove_sock(vsk); 873 874 sock_orphan(sk); 875 sk->sk_shutdown = SHUTDOWN_MASK; 876 877 skb_queue_purge(&sk->sk_receive_queue); 878 879 /* Clean up any sockets that never were accepted. */ 880 while ((pending = vsock_dequeue_accept(sk)) != NULL) { 881 __vsock_release(pending, SINGLE_DEPTH_NESTING); 882 sock_put(pending); 883 } 884 885 release_sock(sk); 886 sock_put(sk); 887 } 888 889 static void vsock_sk_destruct(struct sock *sk) 890 { 891 struct vsock_sock *vsk = vsock_sk(sk); 892 893 /* Flush MSG_ZEROCOPY leftovers. */ 894 __skb_queue_purge(&sk->sk_error_queue); 895 896 vsock_deassign_transport(vsk); 897 898 /* When clearing these addresses, there's no need to set the family and 899 * possibly register the address family with the kernel. 900 */ 901 vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 902 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY); 903 904 put_cred(vsk->owner); 905 } 906 907 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 908 { 909 int err; 910 911 err = sock_queue_rcv_skb(sk, skb); 912 if (err) 913 kfree_skb(skb); 914 915 return err; 916 } 917 918 struct sock *vsock_create_connected(struct sock *parent) 919 { 920 return __vsock_create(sock_net(parent), NULL, parent, GFP_KERNEL, 921 parent->sk_type, 0); 922 } 923 EXPORT_SYMBOL_GPL(vsock_create_connected); 924 925 s64 vsock_stream_has_data(struct vsock_sock *vsk) 926 { 927 if (WARN_ON(!vsk->transport)) 928 return 0; 929 930 return vsk->transport->stream_has_data(vsk); 931 } 932 EXPORT_SYMBOL_GPL(vsock_stream_has_data); 933 934 s64 vsock_connectible_has_data(struct vsock_sock *vsk) 935 { 936 struct sock *sk = sk_vsock(vsk); 937 938 if (WARN_ON(!vsk->transport)) 939 return 0; 940 941 if (sk->sk_type == SOCK_SEQPACKET) 942 return vsk->transport->seqpacket_has_data(vsk); 943 else 944 return vsock_stream_has_data(vsk); 945 } 946 EXPORT_SYMBOL_GPL(vsock_connectible_has_data); 947 948 s64 vsock_stream_has_space(struct vsock_sock *vsk) 949 { 950 if (WARN_ON(!vsk->transport)) 951 return 0; 952 953 return vsk->transport->stream_has_space(vsk); 954 } 955 EXPORT_SYMBOL_GPL(vsock_stream_has_space); 956 957 void vsock_data_ready(struct sock *sk) 958 { 959 struct vsock_sock *vsk = vsock_sk(sk); 960 961 if (vsock_stream_has_data(vsk) >= sk->sk_rcvlowat || 962 sock_flag(sk, SOCK_DONE)) 963 sk->sk_data_ready(sk); 964 } 965 EXPORT_SYMBOL_GPL(vsock_data_ready); 966 967 /* Dummy callback required by sockmap. 968 * See unconditional call of saved_close() in sock_map_close(). 969 */ 970 static void vsock_close(struct sock *sk, long timeout) 971 { 972 } 973 974 static int vsock_release(struct socket *sock) 975 { 976 struct sock *sk = sock->sk; 977 978 if (!sk) 979 return 0; 980 981 sk->sk_prot->close(sk, 0); 982 __vsock_release(sk, 0); 983 sock->sk = NULL; 984 sock->state = SS_FREE; 985 986 return 0; 987 } 988 989 static int 990 vsock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 991 { 992 int err; 993 struct sock *sk; 994 struct sockaddr_vm *vm_addr; 995 996 sk = sock->sk; 997 998 if (vsock_addr_cast(addr, addr_len, &vm_addr) != 0) 999 return -EINVAL; 1000 1001 lock_sock(sk); 1002 err = __vsock_bind(sk, vm_addr); 1003 release_sock(sk); 1004 1005 return err; 1006 } 1007 1008 static int vsock_getname(struct socket *sock, 1009 struct sockaddr *addr, int peer) 1010 { 1011 int err; 1012 struct sock *sk; 1013 struct vsock_sock *vsk; 1014 struct sockaddr_vm *vm_addr; 1015 1016 sk = sock->sk; 1017 vsk = vsock_sk(sk); 1018 err = 0; 1019 1020 lock_sock(sk); 1021 1022 if (peer) { 1023 if (sock->state != SS_CONNECTED) { 1024 err = -ENOTCONN; 1025 goto out; 1026 } 1027 vm_addr = &vsk->remote_addr; 1028 } else { 1029 vm_addr = &vsk->local_addr; 1030 } 1031 1032 /* sys_getsockname() and sys_getpeername() pass us a 1033 * MAX_SOCK_ADDR-sized buffer and don't set addr_len. Unfortunately 1034 * that macro is defined in socket.c instead of .h, so we hardcode its 1035 * value here. 1036 */ 1037 BUILD_BUG_ON(sizeof(*vm_addr) > 128); 1038 memcpy(addr, vm_addr, sizeof(*vm_addr)); 1039 err = sizeof(*vm_addr); 1040 1041 out: 1042 release_sock(sk); 1043 return err; 1044 } 1045 1046 void vsock_linger(struct sock *sk) 1047 { 1048 DEFINE_WAIT_FUNC(wait, woken_wake_function); 1049 ssize_t (*unsent)(struct vsock_sock *vsk); 1050 struct vsock_sock *vsk = vsock_sk(sk); 1051 long timeout; 1052 1053 if (!sock_flag(sk, SOCK_LINGER)) 1054 return; 1055 1056 timeout = sk->sk_lingertime; 1057 if (!timeout) 1058 return; 1059 1060 /* Transports must implement `unsent_bytes` if they want to support 1061 * SOCK_LINGER through `vsock_linger()` since we use it to check when 1062 * the socket can be closed. 1063 */ 1064 unsent = vsk->transport->unsent_bytes; 1065 if (!unsent) 1066 return; 1067 1068 add_wait_queue(sk_sleep(sk), &wait); 1069 1070 do { 1071 if (sk_wait_event(sk, &timeout, unsent(vsk) == 0, &wait)) 1072 break; 1073 } while (!signal_pending(current) && timeout); 1074 1075 remove_wait_queue(sk_sleep(sk), &wait); 1076 } 1077 EXPORT_SYMBOL_GPL(vsock_linger); 1078 1079 static int vsock_shutdown(struct socket *sock, int mode) 1080 { 1081 int err; 1082 struct sock *sk; 1083 1084 /* User level uses SHUT_RD (0) and SHUT_WR (1), but the kernel uses 1085 * RCV_SHUTDOWN (1) and SEND_SHUTDOWN (2), so we must increment mode 1086 * here like the other address families do. Note also that the 1087 * increment makes SHUT_RDWR (2) into RCV_SHUTDOWN | SEND_SHUTDOWN (3), 1088 * which is what we want. 1089 */ 1090 mode++; 1091 1092 if ((mode & ~SHUTDOWN_MASK) || !mode) 1093 return -EINVAL; 1094 1095 /* If this is a connection oriented socket and it is not connected then 1096 * bail out immediately. If it is a DGRAM socket then we must first 1097 * kick the socket so that it wakes up from any sleeping calls, for 1098 * example recv(), and then afterwards return the error. 1099 */ 1100 1101 sk = sock->sk; 1102 1103 lock_sock(sk); 1104 if (sock->state == SS_UNCONNECTED) { 1105 err = -ENOTCONN; 1106 if (sock_type_connectible(sk->sk_type)) 1107 goto out; 1108 } else { 1109 sock->state = SS_DISCONNECTING; 1110 err = 0; 1111 } 1112 1113 /* Receive and send shutdowns are treated alike. */ 1114 mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN); 1115 if (mode) { 1116 sk->sk_shutdown |= mode; 1117 sk->sk_state_change(sk); 1118 1119 if (sock_type_connectible(sk->sk_type)) { 1120 sock_reset_flag(sk, SOCK_DONE); 1121 vsock_send_shutdown(sk, mode); 1122 } 1123 } 1124 1125 out: 1126 release_sock(sk); 1127 return err; 1128 } 1129 1130 static __poll_t vsock_poll(struct file *file, struct socket *sock, 1131 poll_table *wait) 1132 { 1133 struct sock *sk; 1134 __poll_t mask; 1135 struct vsock_sock *vsk; 1136 1137 sk = sock->sk; 1138 vsk = vsock_sk(sk); 1139 1140 poll_wait(file, sk_sleep(sk), wait); 1141 mask = 0; 1142 1143 if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue)) 1144 /* Signify that there has been an error on this socket. */ 1145 mask |= EPOLLERR; 1146 1147 /* INET sockets treat local write shutdown and peer write shutdown as a 1148 * case of EPOLLHUP set. 1149 */ 1150 if ((sk->sk_shutdown == SHUTDOWN_MASK) || 1151 ((sk->sk_shutdown & SEND_SHUTDOWN) && 1152 (vsk->peer_shutdown & SEND_SHUTDOWN))) { 1153 mask |= EPOLLHUP; 1154 } 1155 1156 if (sk->sk_shutdown & RCV_SHUTDOWN || 1157 vsk->peer_shutdown & SEND_SHUTDOWN) { 1158 mask |= EPOLLRDHUP; 1159 } 1160 1161 if (sk_is_readable(sk)) 1162 mask |= EPOLLIN | EPOLLRDNORM; 1163 1164 if (sock->type == SOCK_DGRAM) { 1165 /* For datagram sockets we can read if there is something in 1166 * the queue and write as long as the socket isn't shutdown for 1167 * sending. 1168 */ 1169 if (!skb_queue_empty_lockless(&sk->sk_receive_queue) || 1170 (sk->sk_shutdown & RCV_SHUTDOWN)) { 1171 mask |= EPOLLIN | EPOLLRDNORM; 1172 } 1173 1174 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) 1175 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND; 1176 1177 } else if (sock_type_connectible(sk->sk_type)) { 1178 const struct vsock_transport *transport; 1179 1180 lock_sock(sk); 1181 1182 transport = vsk->transport; 1183 1184 /* Listening sockets that have connections in their accept 1185 * queue can be read. 1186 */ 1187 if (sk->sk_state == TCP_LISTEN 1188 && !vsock_is_accept_queue_empty(sk)) 1189 mask |= EPOLLIN | EPOLLRDNORM; 1190 1191 /* If there is something in the queue then we can read. */ 1192 if (transport && transport->stream_is_active(vsk) && 1193 !(sk->sk_shutdown & RCV_SHUTDOWN)) { 1194 bool data_ready_now = false; 1195 int target = sock_rcvlowat(sk, 0, INT_MAX); 1196 int ret = transport->notify_poll_in( 1197 vsk, target, &data_ready_now); 1198 if (ret < 0) { 1199 mask |= EPOLLERR; 1200 } else { 1201 if (data_ready_now) 1202 mask |= EPOLLIN | EPOLLRDNORM; 1203 1204 } 1205 } 1206 1207 /* Sockets whose connections have been closed, reset, or 1208 * terminated should also be considered read, and we check the 1209 * shutdown flag for that. 1210 */ 1211 if (sk->sk_shutdown & RCV_SHUTDOWN || 1212 vsk->peer_shutdown & SEND_SHUTDOWN) { 1213 mask |= EPOLLIN | EPOLLRDNORM; 1214 } 1215 1216 /* Connected sockets that can produce data can be written. */ 1217 if (transport && sk->sk_state == TCP_ESTABLISHED) { 1218 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) { 1219 bool space_avail_now = false; 1220 int ret = transport->notify_poll_out( 1221 vsk, 1, &space_avail_now); 1222 if (ret < 0) { 1223 mask |= EPOLLERR; 1224 } else { 1225 if (space_avail_now) 1226 /* Remove EPOLLWRBAND since INET 1227 * sockets are not setting it. 1228 */ 1229 mask |= EPOLLOUT | EPOLLWRNORM; 1230 1231 } 1232 } 1233 } 1234 1235 /* Simulate INET socket poll behaviors, which sets 1236 * EPOLLOUT|EPOLLWRNORM when peer is closed and nothing to read, 1237 * but local send is not shutdown. 1238 */ 1239 if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) { 1240 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) 1241 mask |= EPOLLOUT | EPOLLWRNORM; 1242 1243 } 1244 1245 release_sock(sk); 1246 } 1247 1248 return mask; 1249 } 1250 1251 static int vsock_read_skb(struct sock *sk, skb_read_actor_t read_actor) 1252 { 1253 struct vsock_sock *vsk = vsock_sk(sk); 1254 1255 if (WARN_ON_ONCE(!vsk->transport)) 1256 return -ENODEV; 1257 1258 return vsk->transport->read_skb(vsk, read_actor); 1259 } 1260 1261 static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg, 1262 size_t len) 1263 { 1264 int err; 1265 struct sock *sk; 1266 struct vsock_sock *vsk; 1267 struct sockaddr_vm *remote_addr; 1268 const struct vsock_transport *transport; 1269 1270 if (msg->msg_flags & MSG_OOB) 1271 return -EOPNOTSUPP; 1272 1273 /* For now, MSG_DONTWAIT is always assumed... */ 1274 err = 0; 1275 sk = sock->sk; 1276 vsk = vsock_sk(sk); 1277 1278 lock_sock(sk); 1279 1280 transport = vsk->transport; 1281 1282 err = vsock_auto_bind(vsk); 1283 if (err) 1284 goto out; 1285 1286 1287 /* If the provided message contains an address, use that. Otherwise 1288 * fall back on the socket's remote handle (if it has been connected). 1289 */ 1290 if (msg->msg_name && 1291 vsock_addr_cast(msg->msg_name, msg->msg_namelen, 1292 &remote_addr) == 0) { 1293 /* Ensure this address is of the right type and is a valid 1294 * destination. 1295 */ 1296 1297 if (remote_addr->svm_cid == VMADDR_CID_ANY) 1298 remote_addr->svm_cid = transport->get_local_cid(); 1299 1300 if (!vsock_addr_bound(remote_addr)) { 1301 err = -EINVAL; 1302 goto out; 1303 } 1304 } else if (sock->state == SS_CONNECTED) { 1305 remote_addr = &vsk->remote_addr; 1306 1307 if (remote_addr->svm_cid == VMADDR_CID_ANY) 1308 remote_addr->svm_cid = transport->get_local_cid(); 1309 1310 /* XXX Should connect() or this function ensure remote_addr is 1311 * bound? 1312 */ 1313 if (!vsock_addr_bound(&vsk->remote_addr)) { 1314 err = -EINVAL; 1315 goto out; 1316 } 1317 } else { 1318 err = -EINVAL; 1319 goto out; 1320 } 1321 1322 if (!transport->dgram_allow(remote_addr->svm_cid, 1323 remote_addr->svm_port)) { 1324 err = -EINVAL; 1325 goto out; 1326 } 1327 1328 err = transport->dgram_enqueue(vsk, remote_addr, msg, len); 1329 1330 out: 1331 release_sock(sk); 1332 return err; 1333 } 1334 1335 static int vsock_dgram_connect(struct socket *sock, 1336 struct sockaddr *addr, int addr_len, int flags) 1337 { 1338 int err; 1339 struct sock *sk; 1340 struct vsock_sock *vsk; 1341 struct sockaddr_vm *remote_addr; 1342 1343 sk = sock->sk; 1344 vsk = vsock_sk(sk); 1345 1346 err = vsock_addr_cast(addr, addr_len, &remote_addr); 1347 if (err == -EAFNOSUPPORT && remote_addr->svm_family == AF_UNSPEC) { 1348 lock_sock(sk); 1349 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, 1350 VMADDR_PORT_ANY); 1351 sock->state = SS_UNCONNECTED; 1352 release_sock(sk); 1353 return 0; 1354 } else if (err != 0) 1355 return -EINVAL; 1356 1357 lock_sock(sk); 1358 1359 err = vsock_auto_bind(vsk); 1360 if (err) 1361 goto out; 1362 1363 if (!vsk->transport->dgram_allow(remote_addr->svm_cid, 1364 remote_addr->svm_port)) { 1365 err = -EINVAL; 1366 goto out; 1367 } 1368 1369 memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr)); 1370 sock->state = SS_CONNECTED; 1371 1372 /* sock map disallows redirection of non-TCP sockets with sk_state != 1373 * TCP_ESTABLISHED (see sock_map_redirect_allowed()), so we set 1374 * TCP_ESTABLISHED here to allow redirection of connected vsock dgrams. 1375 * 1376 * This doesn't seem to be abnormal state for datagram sockets, as the 1377 * same approach can be see in other datagram socket types as well 1378 * (such as unix sockets). 1379 */ 1380 sk->sk_state = TCP_ESTABLISHED; 1381 1382 out: 1383 release_sock(sk); 1384 return err; 1385 } 1386 1387 int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, 1388 size_t len, int flags) 1389 { 1390 struct sock *sk = sock->sk; 1391 struct vsock_sock *vsk = vsock_sk(sk); 1392 1393 return vsk->transport->dgram_dequeue(vsk, msg, len, flags); 1394 } 1395 1396 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, 1397 size_t len, int flags) 1398 { 1399 #ifdef CONFIG_BPF_SYSCALL 1400 struct sock *sk = sock->sk; 1401 const struct proto *prot; 1402 1403 prot = READ_ONCE(sk->sk_prot); 1404 if (prot != &vsock_proto) 1405 return prot->recvmsg(sk, msg, len, flags, NULL); 1406 #endif 1407 1408 return __vsock_dgram_recvmsg(sock, msg, len, flags); 1409 } 1410 EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg); 1411 1412 static int vsock_do_ioctl(struct socket *sock, unsigned int cmd, 1413 int __user *arg) 1414 { 1415 struct sock *sk = sock->sk; 1416 struct vsock_sock *vsk; 1417 int ret; 1418 1419 vsk = vsock_sk(sk); 1420 1421 switch (cmd) { 1422 case SIOCINQ: { 1423 ssize_t n_bytes; 1424 1425 if (!vsk->transport) { 1426 ret = -EOPNOTSUPP; 1427 break; 1428 } 1429 1430 if (sock_type_connectible(sk->sk_type) && 1431 sk->sk_state == TCP_LISTEN) { 1432 ret = -EINVAL; 1433 break; 1434 } 1435 1436 n_bytes = vsock_stream_has_data(vsk); 1437 if (n_bytes < 0) { 1438 ret = n_bytes; 1439 break; 1440 } 1441 ret = put_user(n_bytes, arg); 1442 break; 1443 } 1444 case SIOCOUTQ: { 1445 ssize_t n_bytes; 1446 1447 if (!vsk->transport || !vsk->transport->unsent_bytes) { 1448 ret = -EOPNOTSUPP; 1449 break; 1450 } 1451 1452 if (sock_type_connectible(sk->sk_type) && sk->sk_state == TCP_LISTEN) { 1453 ret = -EINVAL; 1454 break; 1455 } 1456 1457 n_bytes = vsk->transport->unsent_bytes(vsk); 1458 if (n_bytes < 0) { 1459 ret = n_bytes; 1460 break; 1461 } 1462 1463 ret = put_user(n_bytes, arg); 1464 break; 1465 } 1466 default: 1467 ret = -ENOIOCTLCMD; 1468 } 1469 1470 return ret; 1471 } 1472 1473 static int vsock_ioctl(struct socket *sock, unsigned int cmd, 1474 unsigned long arg) 1475 { 1476 int ret; 1477 1478 lock_sock(sock->sk); 1479 ret = vsock_do_ioctl(sock, cmd, (int __user *)arg); 1480 release_sock(sock->sk); 1481 1482 return ret; 1483 } 1484 1485 static const struct proto_ops vsock_dgram_ops = { 1486 .family = PF_VSOCK, 1487 .owner = THIS_MODULE, 1488 .release = vsock_release, 1489 .bind = vsock_bind, 1490 .connect = vsock_dgram_connect, 1491 .socketpair = sock_no_socketpair, 1492 .accept = sock_no_accept, 1493 .getname = vsock_getname, 1494 .poll = vsock_poll, 1495 .ioctl = vsock_ioctl, 1496 .listen = sock_no_listen, 1497 .shutdown = vsock_shutdown, 1498 .sendmsg = vsock_dgram_sendmsg, 1499 .recvmsg = vsock_dgram_recvmsg, 1500 .mmap = sock_no_mmap, 1501 .read_skb = vsock_read_skb, 1502 }; 1503 1504 static int vsock_transport_cancel_pkt(struct vsock_sock *vsk) 1505 { 1506 const struct vsock_transport *transport = vsk->transport; 1507 1508 if (!transport || !transport->cancel_pkt) 1509 return -EOPNOTSUPP; 1510 1511 return transport->cancel_pkt(vsk); 1512 } 1513 1514 static void vsock_connect_timeout(struct work_struct *work) 1515 { 1516 struct sock *sk; 1517 struct vsock_sock *vsk; 1518 1519 vsk = container_of(work, struct vsock_sock, connect_work.work); 1520 sk = sk_vsock(vsk); 1521 1522 lock_sock(sk); 1523 if (sk->sk_state == TCP_SYN_SENT && 1524 (sk->sk_shutdown != SHUTDOWN_MASK)) { 1525 sk->sk_state = TCP_CLOSE; 1526 sk->sk_socket->state = SS_UNCONNECTED; 1527 sk->sk_err = ETIMEDOUT; 1528 sk_error_report(sk); 1529 vsock_transport_cancel_pkt(vsk); 1530 } 1531 release_sock(sk); 1532 1533 sock_put(sk); 1534 } 1535 1536 static int vsock_connect(struct socket *sock, struct sockaddr *addr, 1537 int addr_len, int flags) 1538 { 1539 int err; 1540 struct sock *sk; 1541 struct vsock_sock *vsk; 1542 const struct vsock_transport *transport; 1543 struct sockaddr_vm *remote_addr; 1544 long timeout; 1545 DEFINE_WAIT(wait); 1546 1547 err = 0; 1548 sk = sock->sk; 1549 vsk = vsock_sk(sk); 1550 1551 lock_sock(sk); 1552 1553 /* XXX AF_UNSPEC should make us disconnect like AF_INET. */ 1554 switch (sock->state) { 1555 case SS_CONNECTED: 1556 err = -EISCONN; 1557 goto out; 1558 case SS_DISCONNECTING: 1559 err = -EINVAL; 1560 goto out; 1561 case SS_CONNECTING: 1562 /* This continues on so we can move sock into the SS_CONNECTED 1563 * state once the connection has completed (at which point err 1564 * will be set to zero also). Otherwise, we will either wait 1565 * for the connection or return -EALREADY should this be a 1566 * non-blocking call. 1567 */ 1568 err = -EALREADY; 1569 if (flags & O_NONBLOCK) 1570 goto out; 1571 break; 1572 default: 1573 if ((sk->sk_state == TCP_LISTEN) || 1574 vsock_addr_cast(addr, addr_len, &remote_addr) != 0) { 1575 err = -EINVAL; 1576 goto out; 1577 } 1578 1579 /* Set the remote address that we are connecting to. */ 1580 memcpy(&vsk->remote_addr, remote_addr, 1581 sizeof(vsk->remote_addr)); 1582 1583 err = vsock_assign_transport(vsk, NULL); 1584 if (err) 1585 goto out; 1586 1587 transport = vsk->transport; 1588 1589 /* The hypervisor and well-known contexts do not have socket 1590 * endpoints. 1591 */ 1592 if (!transport || 1593 !transport->stream_allow(remote_addr->svm_cid, 1594 remote_addr->svm_port)) { 1595 err = -ENETUNREACH; 1596 goto out; 1597 } 1598 1599 if (vsock_msgzerocopy_allow(transport)) { 1600 set_bit(SOCK_SUPPORT_ZC, &sk->sk_socket->flags); 1601 } else if (sock_flag(sk, SOCK_ZEROCOPY)) { 1602 /* If this option was set before 'connect()', 1603 * when transport was unknown, check that this 1604 * feature is supported here. 1605 */ 1606 err = -EOPNOTSUPP; 1607 goto out; 1608 } 1609 1610 err = vsock_auto_bind(vsk); 1611 if (err) 1612 goto out; 1613 1614 sk->sk_state = TCP_SYN_SENT; 1615 1616 err = transport->connect(vsk); 1617 if (err < 0) 1618 goto out; 1619 1620 /* sk_err might have been set as a result of an earlier 1621 * (failed) connect attempt. 1622 */ 1623 sk->sk_err = 0; 1624 1625 /* Mark sock as connecting and set the error code to in 1626 * progress in case this is a non-blocking connect. 1627 */ 1628 sock->state = SS_CONNECTING; 1629 err = -EINPROGRESS; 1630 } 1631 1632 /* The receive path will handle all communication until we are able to 1633 * enter the connected state. Here we wait for the connection to be 1634 * completed or a notification of an error. 1635 */ 1636 timeout = vsk->connect_timeout; 1637 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); 1638 1639 /* If the socket is already closing or it is in an error state, there 1640 * is no point in waiting. 1641 */ 1642 while (sk->sk_state != TCP_ESTABLISHED && 1643 sk->sk_state != TCP_CLOSING && sk->sk_err == 0) { 1644 if (flags & O_NONBLOCK) { 1645 /* If we're not going to block, we schedule a timeout 1646 * function to generate a timeout on the connection 1647 * attempt, in case the peer doesn't respond in a 1648 * timely manner. We hold on to the socket until the 1649 * timeout fires. 1650 */ 1651 sock_hold(sk); 1652 1653 /* If the timeout function is already scheduled, 1654 * reschedule it, then ungrab the socket refcount to 1655 * keep it balanced. 1656 */ 1657 if (mod_delayed_work(system_wq, &vsk->connect_work, 1658 timeout)) 1659 sock_put(sk); 1660 1661 /* Skip ahead to preserve error code set above. */ 1662 goto out_wait; 1663 } 1664 1665 release_sock(sk); 1666 timeout = schedule_timeout(timeout); 1667 lock_sock(sk); 1668 1669 if (signal_pending(current)) { 1670 err = sock_intr_errno(timeout); 1671 sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; 1672 sock->state = SS_UNCONNECTED; 1673 vsock_transport_cancel_pkt(vsk); 1674 vsock_remove_connected(vsk); 1675 goto out_wait; 1676 } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) { 1677 err = -ETIMEDOUT; 1678 sk->sk_state = TCP_CLOSE; 1679 sock->state = SS_UNCONNECTED; 1680 vsock_transport_cancel_pkt(vsk); 1681 goto out_wait; 1682 } 1683 1684 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); 1685 } 1686 1687 if (sk->sk_err) { 1688 err = -sk->sk_err; 1689 sk->sk_state = TCP_CLOSE; 1690 sock->state = SS_UNCONNECTED; 1691 } else { 1692 err = 0; 1693 } 1694 1695 out_wait: 1696 finish_wait(sk_sleep(sk), &wait); 1697 out: 1698 release_sock(sk); 1699 return err; 1700 } 1701 1702 static int vsock_accept(struct socket *sock, struct socket *newsock, 1703 struct proto_accept_arg *arg) 1704 { 1705 struct sock *listener; 1706 int err; 1707 struct sock *connected; 1708 struct vsock_sock *vconnected; 1709 long timeout; 1710 DEFINE_WAIT(wait); 1711 1712 err = 0; 1713 listener = sock->sk; 1714 1715 lock_sock(listener); 1716 1717 if (!sock_type_connectible(sock->type)) { 1718 err = -EOPNOTSUPP; 1719 goto out; 1720 } 1721 1722 if (listener->sk_state != TCP_LISTEN) { 1723 err = -EINVAL; 1724 goto out; 1725 } 1726 1727 /* Wait for children sockets to appear; these are the new sockets 1728 * created upon connection establishment. 1729 */ 1730 timeout = sock_rcvtimeo(listener, arg->flags & O_NONBLOCK); 1731 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); 1732 1733 while ((connected = vsock_dequeue_accept(listener)) == NULL && 1734 listener->sk_err == 0) { 1735 release_sock(listener); 1736 timeout = schedule_timeout(timeout); 1737 finish_wait(sk_sleep(listener), &wait); 1738 lock_sock(listener); 1739 1740 if (signal_pending(current)) { 1741 err = sock_intr_errno(timeout); 1742 goto out; 1743 } else if (timeout == 0) { 1744 err = -EAGAIN; 1745 goto out; 1746 } 1747 1748 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); 1749 } 1750 finish_wait(sk_sleep(listener), &wait); 1751 1752 if (listener->sk_err) 1753 err = -listener->sk_err; 1754 1755 if (connected) { 1756 sk_acceptq_removed(listener); 1757 1758 lock_sock_nested(connected, SINGLE_DEPTH_NESTING); 1759 vconnected = vsock_sk(connected); 1760 1761 /* If the listener socket has received an error, then we should 1762 * reject this socket and return. Note that we simply mark the 1763 * socket rejected, drop our reference, and let the cleanup 1764 * function handle the cleanup; the fact that we found it in 1765 * the listener's accept queue guarantees that the cleanup 1766 * function hasn't run yet. 1767 */ 1768 if (err) { 1769 vconnected->rejected = true; 1770 } else { 1771 newsock->state = SS_CONNECTED; 1772 sock_graft(connected, newsock); 1773 if (vsock_msgzerocopy_allow(vconnected->transport)) 1774 set_bit(SOCK_SUPPORT_ZC, 1775 &connected->sk_socket->flags); 1776 } 1777 1778 release_sock(connected); 1779 sock_put(connected); 1780 } 1781 1782 out: 1783 release_sock(listener); 1784 return err; 1785 } 1786 1787 static int vsock_listen(struct socket *sock, int backlog) 1788 { 1789 int err; 1790 struct sock *sk; 1791 struct vsock_sock *vsk; 1792 1793 sk = sock->sk; 1794 1795 lock_sock(sk); 1796 1797 if (!sock_type_connectible(sk->sk_type)) { 1798 err = -EOPNOTSUPP; 1799 goto out; 1800 } 1801 1802 if (sock->state != SS_UNCONNECTED) { 1803 err = -EINVAL; 1804 goto out; 1805 } 1806 1807 vsk = vsock_sk(sk); 1808 1809 if (!vsock_addr_bound(&vsk->local_addr)) { 1810 err = -EINVAL; 1811 goto out; 1812 } 1813 1814 sk->sk_max_ack_backlog = backlog; 1815 sk->sk_state = TCP_LISTEN; 1816 1817 err = 0; 1818 1819 out: 1820 release_sock(sk); 1821 return err; 1822 } 1823 1824 static void vsock_update_buffer_size(struct vsock_sock *vsk, 1825 const struct vsock_transport *transport, 1826 u64 val) 1827 { 1828 if (val > vsk->buffer_max_size) 1829 val = vsk->buffer_max_size; 1830 1831 if (val < vsk->buffer_min_size) 1832 val = vsk->buffer_min_size; 1833 1834 if (val != vsk->buffer_size && 1835 transport && transport->notify_buffer_size) 1836 transport->notify_buffer_size(vsk, &val); 1837 1838 vsk->buffer_size = val; 1839 } 1840 1841 static int vsock_connectible_setsockopt(struct socket *sock, 1842 int level, 1843 int optname, 1844 sockptr_t optval, 1845 unsigned int optlen) 1846 { 1847 int err; 1848 struct sock *sk; 1849 struct vsock_sock *vsk; 1850 const struct vsock_transport *transport; 1851 u64 val; 1852 1853 if (level != AF_VSOCK && level != SOL_SOCKET) 1854 return -ENOPROTOOPT; 1855 1856 #define COPY_IN(_v) \ 1857 do { \ 1858 if (optlen < sizeof(_v)) { \ 1859 err = -EINVAL; \ 1860 goto exit; \ 1861 } \ 1862 if (copy_from_sockptr(&_v, optval, sizeof(_v)) != 0) { \ 1863 err = -EFAULT; \ 1864 goto exit; \ 1865 } \ 1866 } while (0) 1867 1868 err = 0; 1869 sk = sock->sk; 1870 vsk = vsock_sk(sk); 1871 1872 lock_sock(sk); 1873 1874 transport = vsk->transport; 1875 1876 if (level == SOL_SOCKET) { 1877 int zerocopy; 1878 1879 if (optname != SO_ZEROCOPY) { 1880 release_sock(sk); 1881 return sock_setsockopt(sock, level, optname, optval, optlen); 1882 } 1883 1884 /* Use 'int' type here, because variable to 1885 * set this option usually has this type. 1886 */ 1887 COPY_IN(zerocopy); 1888 1889 if (zerocopy < 0 || zerocopy > 1) { 1890 err = -EINVAL; 1891 goto exit; 1892 } 1893 1894 if (transport && !vsock_msgzerocopy_allow(transport)) { 1895 err = -EOPNOTSUPP; 1896 goto exit; 1897 } 1898 1899 sock_valbool_flag(sk, SOCK_ZEROCOPY, zerocopy); 1900 goto exit; 1901 } 1902 1903 switch (optname) { 1904 case SO_VM_SOCKETS_BUFFER_SIZE: 1905 COPY_IN(val); 1906 vsock_update_buffer_size(vsk, transport, val); 1907 break; 1908 1909 case SO_VM_SOCKETS_BUFFER_MAX_SIZE: 1910 COPY_IN(val); 1911 vsk->buffer_max_size = val; 1912 vsock_update_buffer_size(vsk, transport, vsk->buffer_size); 1913 break; 1914 1915 case SO_VM_SOCKETS_BUFFER_MIN_SIZE: 1916 COPY_IN(val); 1917 vsk->buffer_min_size = val; 1918 vsock_update_buffer_size(vsk, transport, vsk->buffer_size); 1919 break; 1920 1921 case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW: 1922 case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD: { 1923 struct __kernel_sock_timeval tv; 1924 1925 err = sock_copy_user_timeval(&tv, optval, optlen, 1926 optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD); 1927 if (err) 1928 break; 1929 if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC && 1930 tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) { 1931 vsk->connect_timeout = tv.tv_sec * HZ + 1932 DIV_ROUND_UP((unsigned long)tv.tv_usec, (USEC_PER_SEC / HZ)); 1933 if (vsk->connect_timeout == 0) 1934 vsk->connect_timeout = 1935 VSOCK_DEFAULT_CONNECT_TIMEOUT; 1936 1937 } else { 1938 err = -ERANGE; 1939 } 1940 break; 1941 } 1942 1943 default: 1944 err = -ENOPROTOOPT; 1945 break; 1946 } 1947 1948 #undef COPY_IN 1949 1950 exit: 1951 release_sock(sk); 1952 return err; 1953 } 1954 1955 static int vsock_connectible_getsockopt(struct socket *sock, 1956 int level, int optname, 1957 char __user *optval, 1958 int __user *optlen) 1959 { 1960 struct sock *sk = sock->sk; 1961 struct vsock_sock *vsk = vsock_sk(sk); 1962 1963 union { 1964 u64 val64; 1965 struct old_timeval32 tm32; 1966 struct __kernel_old_timeval tm; 1967 struct __kernel_sock_timeval stm; 1968 } v; 1969 1970 int lv = sizeof(v.val64); 1971 int len; 1972 1973 if (level != AF_VSOCK) 1974 return -ENOPROTOOPT; 1975 1976 if (get_user(len, optlen)) 1977 return -EFAULT; 1978 1979 memset(&v, 0, sizeof(v)); 1980 1981 switch (optname) { 1982 case SO_VM_SOCKETS_BUFFER_SIZE: 1983 v.val64 = vsk->buffer_size; 1984 break; 1985 1986 case SO_VM_SOCKETS_BUFFER_MAX_SIZE: 1987 v.val64 = vsk->buffer_max_size; 1988 break; 1989 1990 case SO_VM_SOCKETS_BUFFER_MIN_SIZE: 1991 v.val64 = vsk->buffer_min_size; 1992 break; 1993 1994 case SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW: 1995 case SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD: 1996 lv = sock_get_timeout(vsk->connect_timeout, &v, 1997 optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD); 1998 break; 1999 2000 default: 2001 return -ENOPROTOOPT; 2002 } 2003 2004 if (len < lv) 2005 return -EINVAL; 2006 if (len > lv) 2007 len = lv; 2008 if (copy_to_user(optval, &v, len)) 2009 return -EFAULT; 2010 2011 if (put_user(len, optlen)) 2012 return -EFAULT; 2013 2014 return 0; 2015 } 2016 2017 static int vsock_connectible_sendmsg(struct socket *sock, struct msghdr *msg, 2018 size_t len) 2019 { 2020 struct sock *sk; 2021 struct vsock_sock *vsk; 2022 const struct vsock_transport *transport; 2023 ssize_t total_written; 2024 long timeout; 2025 int err; 2026 struct vsock_transport_send_notify_data send_data; 2027 DEFINE_WAIT_FUNC(wait, woken_wake_function); 2028 2029 sk = sock->sk; 2030 vsk = vsock_sk(sk); 2031 total_written = 0; 2032 err = 0; 2033 2034 if (msg->msg_flags & MSG_OOB) 2035 return -EOPNOTSUPP; 2036 2037 lock_sock(sk); 2038 2039 transport = vsk->transport; 2040 2041 /* Callers should not provide a destination with connection oriented 2042 * sockets. 2043 */ 2044 if (msg->msg_namelen) { 2045 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP; 2046 goto out; 2047 } 2048 2049 /* Send data only if both sides are not shutdown in the direction. */ 2050 if (sk->sk_shutdown & SEND_SHUTDOWN || 2051 vsk->peer_shutdown & RCV_SHUTDOWN) { 2052 err = -EPIPE; 2053 goto out; 2054 } 2055 2056 if (!transport || sk->sk_state != TCP_ESTABLISHED || 2057 !vsock_addr_bound(&vsk->local_addr)) { 2058 err = -ENOTCONN; 2059 goto out; 2060 } 2061 2062 if (!vsock_addr_bound(&vsk->remote_addr)) { 2063 err = -EDESTADDRREQ; 2064 goto out; 2065 } 2066 2067 if (msg->msg_flags & MSG_ZEROCOPY && 2068 !vsock_msgzerocopy_allow(transport)) { 2069 err = -EOPNOTSUPP; 2070 goto out; 2071 } 2072 2073 /* Wait for room in the produce queue to enqueue our user's data. */ 2074 timeout = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 2075 2076 err = transport->notify_send_init(vsk, &send_data); 2077 if (err < 0) 2078 goto out; 2079 2080 while (total_written < len) { 2081 ssize_t written; 2082 2083 add_wait_queue(sk_sleep(sk), &wait); 2084 while (vsock_stream_has_space(vsk) == 0 && 2085 sk->sk_err == 0 && 2086 !(sk->sk_shutdown & SEND_SHUTDOWN) && 2087 !(vsk->peer_shutdown & RCV_SHUTDOWN)) { 2088 2089 /* Don't wait for non-blocking sockets. */ 2090 if (timeout == 0) { 2091 err = -EAGAIN; 2092 remove_wait_queue(sk_sleep(sk), &wait); 2093 goto out_err; 2094 } 2095 2096 err = transport->notify_send_pre_block(vsk, &send_data); 2097 if (err < 0) { 2098 remove_wait_queue(sk_sleep(sk), &wait); 2099 goto out_err; 2100 } 2101 2102 release_sock(sk); 2103 timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); 2104 lock_sock(sk); 2105 if (signal_pending(current)) { 2106 err = sock_intr_errno(timeout); 2107 remove_wait_queue(sk_sleep(sk), &wait); 2108 goto out_err; 2109 } else if (timeout == 0) { 2110 err = -EAGAIN; 2111 remove_wait_queue(sk_sleep(sk), &wait); 2112 goto out_err; 2113 } 2114 } 2115 remove_wait_queue(sk_sleep(sk), &wait); 2116 2117 /* These checks occur both as part of and after the loop 2118 * conditional since we need to check before and after 2119 * sleeping. 2120 */ 2121 if (sk->sk_err) { 2122 err = -sk->sk_err; 2123 goto out_err; 2124 } else if ((sk->sk_shutdown & SEND_SHUTDOWN) || 2125 (vsk->peer_shutdown & RCV_SHUTDOWN)) { 2126 err = -EPIPE; 2127 goto out_err; 2128 } 2129 2130 err = transport->notify_send_pre_enqueue(vsk, &send_data); 2131 if (err < 0) 2132 goto out_err; 2133 2134 /* Note that enqueue will only write as many bytes as are free 2135 * in the produce queue, so we don't need to ensure len is 2136 * smaller than the queue size. It is the caller's 2137 * responsibility to check how many bytes we were able to send. 2138 */ 2139 2140 if (sk->sk_type == SOCK_SEQPACKET) { 2141 written = transport->seqpacket_enqueue(vsk, 2142 msg, len - total_written); 2143 } else { 2144 written = transport->stream_enqueue(vsk, 2145 msg, len - total_written); 2146 } 2147 2148 if (written < 0) { 2149 err = written; 2150 goto out_err; 2151 } 2152 2153 total_written += written; 2154 2155 err = transport->notify_send_post_enqueue( 2156 vsk, written, &send_data); 2157 if (err < 0) 2158 goto out_err; 2159 2160 } 2161 2162 out_err: 2163 if (total_written > 0) { 2164 /* Return number of written bytes only if: 2165 * 1) SOCK_STREAM socket. 2166 * 2) SOCK_SEQPACKET socket when whole buffer is sent. 2167 */ 2168 if (sk->sk_type == SOCK_STREAM || total_written == len) 2169 err = total_written; 2170 } 2171 out: 2172 if (sk->sk_type == SOCK_STREAM) 2173 err = sk_stream_error(sk, msg->msg_flags, err); 2174 2175 release_sock(sk); 2176 return err; 2177 } 2178 2179 static int vsock_connectible_wait_data(struct sock *sk, 2180 struct wait_queue_entry *wait, 2181 long timeout, 2182 struct vsock_transport_recv_notify_data *recv_data, 2183 size_t target) 2184 { 2185 const struct vsock_transport *transport; 2186 struct vsock_sock *vsk; 2187 s64 data; 2188 int err; 2189 2190 vsk = vsock_sk(sk); 2191 err = 0; 2192 transport = vsk->transport; 2193 2194 while (1) { 2195 prepare_to_wait(sk_sleep(sk), wait, TASK_INTERRUPTIBLE); 2196 data = vsock_connectible_has_data(vsk); 2197 if (data != 0) 2198 break; 2199 2200 if (sk->sk_err != 0 || 2201 (sk->sk_shutdown & RCV_SHUTDOWN) || 2202 (vsk->peer_shutdown & SEND_SHUTDOWN)) { 2203 break; 2204 } 2205 2206 /* Don't wait for non-blocking sockets. */ 2207 if (timeout == 0) { 2208 err = -EAGAIN; 2209 break; 2210 } 2211 2212 if (recv_data) { 2213 err = transport->notify_recv_pre_block(vsk, target, recv_data); 2214 if (err < 0) 2215 break; 2216 } 2217 2218 release_sock(sk); 2219 timeout = schedule_timeout(timeout); 2220 lock_sock(sk); 2221 2222 if (signal_pending(current)) { 2223 err = sock_intr_errno(timeout); 2224 break; 2225 } else if (timeout == 0) { 2226 err = -EAGAIN; 2227 break; 2228 } 2229 } 2230 2231 finish_wait(sk_sleep(sk), wait); 2232 2233 if (err) 2234 return err; 2235 2236 /* Internal transport error when checking for available 2237 * data. XXX This should be changed to a connection 2238 * reset in a later change. 2239 */ 2240 if (data < 0) 2241 return -ENOMEM; 2242 2243 return data; 2244 } 2245 2246 static int __vsock_stream_recvmsg(struct sock *sk, struct msghdr *msg, 2247 size_t len, int flags) 2248 { 2249 struct vsock_transport_recv_notify_data recv_data; 2250 const struct vsock_transport *transport; 2251 struct vsock_sock *vsk; 2252 ssize_t copied; 2253 size_t target; 2254 long timeout; 2255 int err; 2256 2257 DEFINE_WAIT(wait); 2258 2259 vsk = vsock_sk(sk); 2260 transport = vsk->transport; 2261 2262 /* We must not copy less than target bytes into the user's buffer 2263 * before returning successfully, so we wait for the consume queue to 2264 * have that much data to consume before dequeueing. Note that this 2265 * makes it impossible to handle cases where target is greater than the 2266 * queue size. 2267 */ 2268 target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); 2269 if (target >= transport->stream_rcvhiwat(vsk)) { 2270 err = -ENOMEM; 2271 goto out; 2272 } 2273 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 2274 copied = 0; 2275 2276 err = transport->notify_recv_init(vsk, target, &recv_data); 2277 if (err < 0) 2278 goto out; 2279 2280 2281 while (1) { 2282 ssize_t read; 2283 2284 err = vsock_connectible_wait_data(sk, &wait, timeout, 2285 &recv_data, target); 2286 if (err <= 0) 2287 break; 2288 2289 err = transport->notify_recv_pre_dequeue(vsk, target, 2290 &recv_data); 2291 if (err < 0) 2292 break; 2293 2294 read = transport->stream_dequeue(vsk, msg, len - copied, flags); 2295 if (read < 0) { 2296 err = read; 2297 break; 2298 } 2299 2300 copied += read; 2301 2302 err = transport->notify_recv_post_dequeue(vsk, target, read, 2303 !(flags & MSG_PEEK), &recv_data); 2304 if (err < 0) 2305 goto out; 2306 2307 if (read >= target || flags & MSG_PEEK) 2308 break; 2309 2310 target -= read; 2311 } 2312 2313 if (sk->sk_err) 2314 err = -sk->sk_err; 2315 else if (sk->sk_shutdown & RCV_SHUTDOWN) 2316 err = 0; 2317 2318 if (copied > 0) 2319 err = copied; 2320 2321 out: 2322 return err; 2323 } 2324 2325 static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg, 2326 size_t len, int flags) 2327 { 2328 const struct vsock_transport *transport; 2329 struct vsock_sock *vsk; 2330 ssize_t msg_len; 2331 long timeout; 2332 int err = 0; 2333 DEFINE_WAIT(wait); 2334 2335 vsk = vsock_sk(sk); 2336 transport = vsk->transport; 2337 2338 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 2339 2340 err = vsock_connectible_wait_data(sk, &wait, timeout, NULL, 0); 2341 if (err <= 0) 2342 goto out; 2343 2344 msg_len = transport->seqpacket_dequeue(vsk, msg, flags); 2345 2346 if (msg_len < 0) { 2347 err = msg_len; 2348 goto out; 2349 } 2350 2351 if (sk->sk_err) { 2352 err = -sk->sk_err; 2353 } else if (sk->sk_shutdown & RCV_SHUTDOWN) { 2354 err = 0; 2355 } else { 2356 /* User sets MSG_TRUNC, so return real length of 2357 * packet. 2358 */ 2359 if (flags & MSG_TRUNC) 2360 err = msg_len; 2361 else 2362 err = len - msg_data_left(msg); 2363 2364 /* Always set MSG_TRUNC if real length of packet is 2365 * bigger than user's buffer. 2366 */ 2367 if (msg_len > len) 2368 msg->msg_flags |= MSG_TRUNC; 2369 } 2370 2371 out: 2372 return err; 2373 } 2374 2375 int 2376 __vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 2377 int flags) 2378 { 2379 struct sock *sk; 2380 struct vsock_sock *vsk; 2381 const struct vsock_transport *transport; 2382 int err; 2383 2384 sk = sock->sk; 2385 2386 if (unlikely(flags & MSG_ERRQUEUE)) 2387 return sock_recv_errqueue(sk, msg, len, SOL_VSOCK, VSOCK_RECVERR); 2388 2389 vsk = vsock_sk(sk); 2390 err = 0; 2391 2392 lock_sock(sk); 2393 2394 transport = vsk->transport; 2395 2396 if (!transport || sk->sk_state != TCP_ESTABLISHED) { 2397 /* Recvmsg is supposed to return 0 if a peer performs an 2398 * orderly shutdown. Differentiate between that case and when a 2399 * peer has not connected or a local shutdown occurred with the 2400 * SOCK_DONE flag. 2401 */ 2402 if (sock_flag(sk, SOCK_DONE)) 2403 err = 0; 2404 else 2405 err = -ENOTCONN; 2406 2407 goto out; 2408 } 2409 2410 if (flags & MSG_OOB) { 2411 err = -EOPNOTSUPP; 2412 goto out; 2413 } 2414 2415 /* We don't check peer_shutdown flag here since peer may actually shut 2416 * down, but there can be data in the queue that a local socket can 2417 * receive. 2418 */ 2419 if (sk->sk_shutdown & RCV_SHUTDOWN) { 2420 err = 0; 2421 goto out; 2422 } 2423 2424 /* It is valid on Linux to pass in a zero-length receive buffer. This 2425 * is not an error. We may as well bail out now. 2426 */ 2427 if (!len) { 2428 err = 0; 2429 goto out; 2430 } 2431 2432 if (sk->sk_type == SOCK_STREAM) 2433 err = __vsock_stream_recvmsg(sk, msg, len, flags); 2434 else 2435 err = __vsock_seqpacket_recvmsg(sk, msg, len, flags); 2436 2437 out: 2438 release_sock(sk); 2439 return err; 2440 } 2441 2442 int 2443 vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 2444 int flags) 2445 { 2446 #ifdef CONFIG_BPF_SYSCALL 2447 struct sock *sk = sock->sk; 2448 const struct proto *prot; 2449 2450 prot = READ_ONCE(sk->sk_prot); 2451 if (prot != &vsock_proto) 2452 return prot->recvmsg(sk, msg, len, flags, NULL); 2453 #endif 2454 2455 return __vsock_connectible_recvmsg(sock, msg, len, flags); 2456 } 2457 EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg); 2458 2459 static int vsock_set_rcvlowat(struct sock *sk, int val) 2460 { 2461 const struct vsock_transport *transport; 2462 struct vsock_sock *vsk; 2463 2464 vsk = vsock_sk(sk); 2465 2466 if (val > vsk->buffer_size) 2467 return -EINVAL; 2468 2469 transport = vsk->transport; 2470 2471 if (transport && transport->notify_set_rcvlowat) { 2472 int err; 2473 2474 err = transport->notify_set_rcvlowat(vsk, val); 2475 if (err) 2476 return err; 2477 } 2478 2479 WRITE_ONCE(sk->sk_rcvlowat, val ? : 1); 2480 return 0; 2481 } 2482 2483 static const struct proto_ops vsock_stream_ops = { 2484 .family = PF_VSOCK, 2485 .owner = THIS_MODULE, 2486 .release = vsock_release, 2487 .bind = vsock_bind, 2488 .connect = vsock_connect, 2489 .socketpair = sock_no_socketpair, 2490 .accept = vsock_accept, 2491 .getname = vsock_getname, 2492 .poll = vsock_poll, 2493 .ioctl = vsock_ioctl, 2494 .listen = vsock_listen, 2495 .shutdown = vsock_shutdown, 2496 .setsockopt = vsock_connectible_setsockopt, 2497 .getsockopt = vsock_connectible_getsockopt, 2498 .sendmsg = vsock_connectible_sendmsg, 2499 .recvmsg = vsock_connectible_recvmsg, 2500 .mmap = sock_no_mmap, 2501 .set_rcvlowat = vsock_set_rcvlowat, 2502 .read_skb = vsock_read_skb, 2503 }; 2504 2505 static const struct proto_ops vsock_seqpacket_ops = { 2506 .family = PF_VSOCK, 2507 .owner = THIS_MODULE, 2508 .release = vsock_release, 2509 .bind = vsock_bind, 2510 .connect = vsock_connect, 2511 .socketpair = sock_no_socketpair, 2512 .accept = vsock_accept, 2513 .getname = vsock_getname, 2514 .poll = vsock_poll, 2515 .ioctl = vsock_ioctl, 2516 .listen = vsock_listen, 2517 .shutdown = vsock_shutdown, 2518 .setsockopt = vsock_connectible_setsockopt, 2519 .getsockopt = vsock_connectible_getsockopt, 2520 .sendmsg = vsock_connectible_sendmsg, 2521 .recvmsg = vsock_connectible_recvmsg, 2522 .mmap = sock_no_mmap, 2523 .read_skb = vsock_read_skb, 2524 }; 2525 2526 static int vsock_create(struct net *net, struct socket *sock, 2527 int protocol, int kern) 2528 { 2529 struct vsock_sock *vsk; 2530 struct sock *sk; 2531 int ret; 2532 2533 if (!sock) 2534 return -EINVAL; 2535 2536 if (protocol && protocol != PF_VSOCK) 2537 return -EPROTONOSUPPORT; 2538 2539 switch (sock->type) { 2540 case SOCK_DGRAM: 2541 sock->ops = &vsock_dgram_ops; 2542 break; 2543 case SOCK_STREAM: 2544 sock->ops = &vsock_stream_ops; 2545 break; 2546 case SOCK_SEQPACKET: 2547 sock->ops = &vsock_seqpacket_ops; 2548 break; 2549 default: 2550 return -ESOCKTNOSUPPORT; 2551 } 2552 2553 sock->state = SS_UNCONNECTED; 2554 2555 sk = __vsock_create(net, sock, NULL, GFP_KERNEL, 0, kern); 2556 if (!sk) 2557 return -ENOMEM; 2558 2559 vsk = vsock_sk(sk); 2560 2561 if (sock->type == SOCK_DGRAM) { 2562 ret = vsock_assign_transport(vsk, NULL); 2563 if (ret < 0) { 2564 sock->sk = NULL; 2565 sock_put(sk); 2566 return ret; 2567 } 2568 } 2569 2570 /* SOCK_DGRAM doesn't have 'setsockopt' callback set in its 2571 * proto_ops, so there is no handler for custom logic. 2572 */ 2573 if (sock_type_connectible(sock->type)) 2574 set_bit(SOCK_CUSTOM_SOCKOPT, &sk->sk_socket->flags); 2575 2576 vsock_insert_unbound(vsk); 2577 2578 return 0; 2579 } 2580 2581 static const struct net_proto_family vsock_family_ops = { 2582 .family = AF_VSOCK, 2583 .create = vsock_create, 2584 .owner = THIS_MODULE, 2585 }; 2586 2587 static long vsock_dev_do_ioctl(struct file *filp, 2588 unsigned int cmd, void __user *ptr) 2589 { 2590 u32 __user *p = ptr; 2591 int retval = 0; 2592 u32 cid; 2593 2594 switch (cmd) { 2595 case IOCTL_VM_SOCKETS_GET_LOCAL_CID: 2596 /* To be compatible with the VMCI behavior, we prioritize the 2597 * guest CID instead of well-know host CID (VMADDR_CID_HOST). 2598 */ 2599 cid = vsock_registered_transport_cid(&transport_g2h); 2600 if (cid == VMADDR_CID_ANY) 2601 cid = vsock_registered_transport_cid(&transport_h2g); 2602 if (cid == VMADDR_CID_ANY) 2603 cid = vsock_registered_transport_cid(&transport_local); 2604 2605 if (put_user(cid, p) != 0) 2606 retval = -EFAULT; 2607 break; 2608 2609 default: 2610 retval = -ENOIOCTLCMD; 2611 } 2612 2613 return retval; 2614 } 2615 2616 static long vsock_dev_ioctl(struct file *filp, 2617 unsigned int cmd, unsigned long arg) 2618 { 2619 return vsock_dev_do_ioctl(filp, cmd, (void __user *)arg); 2620 } 2621 2622 #ifdef CONFIG_COMPAT 2623 static long vsock_dev_compat_ioctl(struct file *filp, 2624 unsigned int cmd, unsigned long arg) 2625 { 2626 return vsock_dev_do_ioctl(filp, cmd, compat_ptr(arg)); 2627 } 2628 #endif 2629 2630 static const struct file_operations vsock_device_ops = { 2631 .owner = THIS_MODULE, 2632 .unlocked_ioctl = vsock_dev_ioctl, 2633 #ifdef CONFIG_COMPAT 2634 .compat_ioctl = vsock_dev_compat_ioctl, 2635 #endif 2636 .open = nonseekable_open, 2637 }; 2638 2639 static struct miscdevice vsock_device = { 2640 .name = "vsock", 2641 .fops = &vsock_device_ops, 2642 }; 2643 2644 static int __init vsock_init(void) 2645 { 2646 int err = 0; 2647 2648 vsock_init_tables(); 2649 2650 vsock_proto.owner = THIS_MODULE; 2651 vsock_device.minor = MISC_DYNAMIC_MINOR; 2652 err = misc_register(&vsock_device); 2653 if (err) { 2654 pr_err("Failed to register misc device\n"); 2655 goto err_reset_transport; 2656 } 2657 2658 err = proto_register(&vsock_proto, 1); /* we want our slab */ 2659 if (err) { 2660 pr_err("Cannot register vsock protocol\n"); 2661 goto err_deregister_misc; 2662 } 2663 2664 err = sock_register(&vsock_family_ops); 2665 if (err) { 2666 pr_err("could not register af_vsock (%d) address family: %d\n", 2667 AF_VSOCK, err); 2668 goto err_unregister_proto; 2669 } 2670 2671 vsock_bpf_build_proto(); 2672 2673 return 0; 2674 2675 err_unregister_proto: 2676 proto_unregister(&vsock_proto); 2677 err_deregister_misc: 2678 misc_deregister(&vsock_device); 2679 err_reset_transport: 2680 return err; 2681 } 2682 2683 static void __exit vsock_exit(void) 2684 { 2685 misc_deregister(&vsock_device); 2686 sock_unregister(AF_VSOCK); 2687 proto_unregister(&vsock_proto); 2688 } 2689 2690 const struct vsock_transport *vsock_core_get_transport(struct vsock_sock *vsk) 2691 { 2692 return vsk->transport; 2693 } 2694 EXPORT_SYMBOL_GPL(vsock_core_get_transport); 2695 2696 int vsock_core_register(const struct vsock_transport *t, int features) 2697 { 2698 const struct vsock_transport *t_h2g, *t_g2h, *t_dgram, *t_local; 2699 int err = mutex_lock_interruptible(&vsock_register_mutex); 2700 2701 if (err) 2702 return err; 2703 2704 t_h2g = transport_h2g; 2705 t_g2h = transport_g2h; 2706 t_dgram = transport_dgram; 2707 t_local = transport_local; 2708 2709 if (features & VSOCK_TRANSPORT_F_H2G) { 2710 if (t_h2g) { 2711 err = -EBUSY; 2712 goto err_busy; 2713 } 2714 t_h2g = t; 2715 } 2716 2717 if (features & VSOCK_TRANSPORT_F_G2H) { 2718 if (t_g2h) { 2719 err = -EBUSY; 2720 goto err_busy; 2721 } 2722 t_g2h = t; 2723 } 2724 2725 if (features & VSOCK_TRANSPORT_F_DGRAM) { 2726 if (t_dgram) { 2727 err = -EBUSY; 2728 goto err_busy; 2729 } 2730 t_dgram = t; 2731 } 2732 2733 if (features & VSOCK_TRANSPORT_F_LOCAL) { 2734 if (t_local) { 2735 err = -EBUSY; 2736 goto err_busy; 2737 } 2738 t_local = t; 2739 } 2740 2741 transport_h2g = t_h2g; 2742 transport_g2h = t_g2h; 2743 transport_dgram = t_dgram; 2744 transport_local = t_local; 2745 2746 err_busy: 2747 mutex_unlock(&vsock_register_mutex); 2748 return err; 2749 } 2750 EXPORT_SYMBOL_GPL(vsock_core_register); 2751 2752 void vsock_core_unregister(const struct vsock_transport *t) 2753 { 2754 mutex_lock(&vsock_register_mutex); 2755 2756 if (transport_h2g == t) 2757 transport_h2g = NULL; 2758 2759 if (transport_g2h == t) 2760 transport_g2h = NULL; 2761 2762 if (transport_dgram == t) 2763 transport_dgram = NULL; 2764 2765 if (transport_local == t) 2766 transport_local = NULL; 2767 2768 mutex_unlock(&vsock_register_mutex); 2769 } 2770 EXPORT_SYMBOL_GPL(vsock_core_unregister); 2771 2772 module_init(vsock_init); 2773 module_exit(vsock_exit); 2774 2775 MODULE_AUTHOR("VMware, Inc."); 2776 MODULE_DESCRIPTION("VMware Virtual Socket Family"); 2777 MODULE_VERSION("1.0.2.0-k"); 2778 MODULE_LICENSE("GPL v2"); 2779