1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * File: pep.c
4 *
5 * Phonet pipe protocol end point socket
6 *
7 * Copyright (C) 2008 Nokia Corporation.
8 *
9 * Author: Rémi Denis-Courmont
10 */
11
12 #include <linux/kernel.h>
13 #include <linux/sched/signal.h>
14 #include <linux/slab.h>
15 #include <linux/socket.h>
16 #include <net/sock.h>
17 #include <net/tcp_states.h>
18 #include <asm/ioctls.h>
19
20 #include <linux/phonet.h>
21 #include <linux/module.h>
22 #include <net/phonet/phonet.h>
23 #include <net/phonet/pep.h>
24 #include <net/phonet/gprs.h>
25
26 /* sk_state values:
27 * TCP_CLOSE sock not in use yet
28 * TCP_CLOSE_WAIT disconnected pipe
29 * TCP_LISTEN listening pipe endpoint
30 * TCP_SYN_RECV connected pipe in disabled state
31 * TCP_ESTABLISHED connected pipe in enabled state
32 *
33 * pep_sock locking:
34 * - sk_state, hlist: sock lock needed
35 * - listener: read only
36 * - pipe_handle: read only
37 */
38
39 #define CREDITS_MAX 10
40 #define CREDITS_THR 7
41
42 #define pep_sb_size(s) (((s) + 5) & ~3) /* 2-bytes head, 32-bits aligned */
43
44 /* Get the next TLV sub-block. */
pep_get_sb(struct sk_buff * skb,u8 * ptype,u8 * plen,void * buf)45 static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
46 void *buf)
47 {
48 void *data = NULL;
49 struct {
50 u8 sb_type;
51 u8 sb_len;
52 } *ph, h;
53 int buflen = *plen;
54
55 ph = skb_header_pointer(skb, 0, 2, &h);
56 if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len))
57 return NULL;
58 /* pskb_may_pull() may have reallocated the head; refetch ph. */
59 ph = skb_header_pointer(skb, 0, 2, &h);
60 ph->sb_len -= 2;
61 *ptype = ph->sb_type;
62 *plen = ph->sb_len;
63
64 if (buflen > ph->sb_len)
65 buflen = ph->sb_len;
66 data = skb_header_pointer(skb, 2, buflen, buf);
67 __skb_pull(skb, 2 + ph->sb_len);
68 return data;
69 }
70
pep_alloc_skb(struct sock * sk,const void * payload,int len,gfp_t priority)71 static struct sk_buff *pep_alloc_skb(struct sock *sk, const void *payload,
72 int len, gfp_t priority)
73 {
74 struct sk_buff *skb = alloc_skb(MAX_PNPIPE_HEADER + len, priority);
75 if (!skb)
76 return NULL;
77 skb_set_owner_w(skb, sk);
78
79 skb_reserve(skb, MAX_PNPIPE_HEADER);
80 __skb_put(skb, len);
81 skb_copy_to_linear_data(skb, payload, len);
82 __skb_push(skb, sizeof(struct pnpipehdr));
83 skb_reset_transport_header(skb);
84 return skb;
85 }
86
pep_reply(struct sock * sk,struct sk_buff * oskb,u8 code,const void * data,int len,gfp_t priority)87 static int pep_reply(struct sock *sk, struct sk_buff *oskb, u8 code,
88 const void *data, int len, gfp_t priority)
89 {
90 const struct pnpipehdr *oph = pnp_hdr(oskb);
91 struct pnpipehdr *ph;
92 struct sk_buff *skb;
93 struct sockaddr_pn peer;
94
95 skb = pep_alloc_skb(sk, data, len, priority);
96 if (!skb)
97 return -ENOMEM;
98
99 ph = pnp_hdr(skb);
100 ph->utid = oph->utid;
101 ph->message_id = oph->message_id + 1; /* REQ -> RESP */
102 ph->pipe_handle = oph->pipe_handle;
103 ph->error_code = code;
104
105 pn_skb_get_src_sockaddr(oskb, &peer);
106 return pn_skb_send(sk, skb, &peer);
107 }
108
pep_indicate(struct sock * sk,u8 id,u8 code,const void * data,int len,gfp_t priority)109 static int pep_indicate(struct sock *sk, u8 id, u8 code,
110 const void *data, int len, gfp_t priority)
111 {
112 struct pep_sock *pn = pep_sk(sk);
113 struct pnpipehdr *ph;
114 struct sk_buff *skb;
115
116 skb = pep_alloc_skb(sk, data, len, priority);
117 if (!skb)
118 return -ENOMEM;
119
120 ph = pnp_hdr(skb);
121 ph->utid = 0;
122 ph->message_id = id;
123 ph->pipe_handle = pn->pipe_handle;
124 ph->error_code = code;
125 return pn_skb_send(sk, skb, NULL);
126 }
127
128 #define PAD 0x00
129
pipe_handler_request(struct sock * sk,u8 id,u8 code,const void * data,int len)130 static int pipe_handler_request(struct sock *sk, u8 id, u8 code,
131 const void *data, int len)
132 {
133 struct pep_sock *pn = pep_sk(sk);
134 struct pnpipehdr *ph;
135 struct sk_buff *skb;
136
137 skb = pep_alloc_skb(sk, data, len, GFP_KERNEL);
138 if (!skb)
139 return -ENOMEM;
140
141 ph = pnp_hdr(skb);
142 ph->utid = id; /* whatever */
143 ph->message_id = id;
144 ph->pipe_handle = pn->pipe_handle;
145 ph->error_code = code;
146 return pn_skb_send(sk, skb, NULL);
147 }
148
pipe_handler_send_created_ind(struct sock * sk)149 static int pipe_handler_send_created_ind(struct sock *sk)
150 {
151 struct pep_sock *pn = pep_sk(sk);
152 u8 data[4] = {
153 PN_PIPE_SB_NEGOTIATED_FC, pep_sb_size(2),
154 pn->tx_fc, pn->rx_fc,
155 };
156
157 return pep_indicate(sk, PNS_PIPE_CREATED_IND, 1 /* sub-blocks */,
158 data, 4, GFP_ATOMIC);
159 }
160
pep_accept_conn(struct sock * sk,struct sk_buff * skb)161 static int pep_accept_conn(struct sock *sk, struct sk_buff *skb)
162 {
163 static const u8 data[20] = {
164 PAD, PAD, PAD, 2 /* sub-blocks */,
165 PN_PIPE_SB_REQUIRED_FC_TX, pep_sb_size(5), 3, PAD,
166 PN_MULTI_CREDIT_FLOW_CONTROL,
167 PN_ONE_CREDIT_FLOW_CONTROL,
168 PN_LEGACY_FLOW_CONTROL,
169 PAD,
170 PN_PIPE_SB_PREFERRED_FC_RX, pep_sb_size(5), 3, PAD,
171 PN_MULTI_CREDIT_FLOW_CONTROL,
172 PN_ONE_CREDIT_FLOW_CONTROL,
173 PN_LEGACY_FLOW_CONTROL,
174 PAD,
175 };
176
177 might_sleep();
178 return pep_reply(sk, skb, PN_PIPE_NO_ERROR, data, sizeof(data),
179 GFP_KERNEL);
180 }
181
pep_reject_conn(struct sock * sk,struct sk_buff * skb,u8 code,gfp_t priority)182 static int pep_reject_conn(struct sock *sk, struct sk_buff *skb, u8 code,
183 gfp_t priority)
184 {
185 static const u8 data[4] = { PAD, PAD, PAD, 0 /* sub-blocks */ };
186 WARN_ON(code == PN_PIPE_NO_ERROR);
187 return pep_reply(sk, skb, code, data, sizeof(data), priority);
188 }
189
190 /* Control requests are not sent by the pipe service and have a specific
191 * message format. */
pep_ctrlreq_error(struct sock * sk,struct sk_buff * oskb,u8 code,gfp_t priority)192 static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
193 gfp_t priority)
194 {
195 const struct pnpipehdr *oph = pnp_hdr(oskb);
196 struct sk_buff *skb;
197 struct pnpipehdr *ph;
198 struct sockaddr_pn dst;
199 u8 data[4] = {
200 oph->pep_type, /* PEP type */
201 code, /* error code, at an unusual offset */
202 PAD, PAD,
203 };
204
205 skb = pep_alloc_skb(sk, data, 4, priority);
206 if (!skb)
207 return -ENOMEM;
208
209 ph = pnp_hdr(skb);
210 ph->utid = oph->utid;
211 ph->message_id = PNS_PEP_CTRL_RESP;
212 ph->pipe_handle = oph->pipe_handle;
213 ph->data0 = oph->data[0]; /* CTRL id */
214
215 pn_skb_get_src_sockaddr(oskb, &dst);
216 return pn_skb_send(sk, skb, &dst);
217 }
218
pipe_snd_status(struct sock * sk,u8 type,u8 status,gfp_t priority)219 static int pipe_snd_status(struct sock *sk, u8 type, u8 status, gfp_t priority)
220 {
221 u8 data[4] = { type, PAD, PAD, status };
222
223 return pep_indicate(sk, PNS_PEP_STATUS_IND, PN_PEP_TYPE_COMMON,
224 data, 4, priority);
225 }
226
227 /* Send our RX flow control information to the sender.
228 * Socket must be locked. */
pipe_grant_credits(struct sock * sk,gfp_t priority)229 static void pipe_grant_credits(struct sock *sk, gfp_t priority)
230 {
231 struct pep_sock *pn = pep_sk(sk);
232
233 BUG_ON(sk->sk_state != TCP_ESTABLISHED);
234
235 switch (pn->rx_fc) {
236 case PN_LEGACY_FLOW_CONTROL: /* TODO */
237 break;
238 case PN_ONE_CREDIT_FLOW_CONTROL:
239 if (pipe_snd_status(sk, PN_PEP_IND_FLOW_CONTROL,
240 PEP_IND_READY, priority) == 0)
241 pn->rx_credits = 1;
242 break;
243 case PN_MULTI_CREDIT_FLOW_CONTROL:
244 if ((pn->rx_credits + CREDITS_THR) > CREDITS_MAX)
245 break;
246 if (pipe_snd_status(sk, PN_PEP_IND_ID_MCFC_GRANT_CREDITS,
247 CREDITS_MAX - pn->rx_credits,
248 priority) == 0)
249 pn->rx_credits = CREDITS_MAX;
250 break;
251 }
252 }
253
pipe_rcv_status(struct sock * sk,struct sk_buff * skb)254 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
255 {
256 struct pep_sock *pn = pep_sk(sk);
257 struct pnpipehdr *hdr;
258 int wake = 0;
259
260 if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
261 return -EINVAL;
262
263 hdr = pnp_hdr(skb);
264 if (hdr->pep_type != PN_PEP_TYPE_COMMON) {
265 net_dbg_ratelimited("Phonet unknown PEP type: %u\n",
266 (unsigned int)hdr->pep_type);
267 return -EOPNOTSUPP;
268 }
269
270 switch (hdr->data[0]) {
271 case PN_PEP_IND_FLOW_CONTROL:
272 switch (pn->tx_fc) {
273 case PN_LEGACY_FLOW_CONTROL:
274 switch (hdr->data[3]) {
275 case PEP_IND_BUSY:
276 atomic_set(&pn->tx_credits, 0);
277 break;
278 case PEP_IND_READY:
279 atomic_set(&pn->tx_credits, wake = 1);
280 break;
281 }
282 break;
283 case PN_ONE_CREDIT_FLOW_CONTROL:
284 if (hdr->data[3] == PEP_IND_READY)
285 atomic_set(&pn->tx_credits, wake = 1);
286 break;
287 }
288 break;
289
290 case PN_PEP_IND_ID_MCFC_GRANT_CREDITS:
291 if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL)
292 break;
293 atomic_add(wake = hdr->data[3], &pn->tx_credits);
294 break;
295
296 default:
297 net_dbg_ratelimited("Phonet unknown PEP indication: %u\n",
298 (unsigned int)hdr->data[0]);
299 return -EOPNOTSUPP;
300 }
301 if (wake)
302 sk->sk_write_space(sk);
303 return 0;
304 }
305
pipe_rcv_created(struct sock * sk,struct sk_buff * skb)306 static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb)
307 {
308 struct pep_sock *pn = pep_sk(sk);
309 struct pnpipehdr *hdr = pnp_hdr(skb);
310 u8 n_sb = hdr->data0;
311
312 pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
313 __skb_pull(skb, sizeof(*hdr));
314 while (n_sb > 0) {
315 u8 type, buf[2], len = sizeof(buf);
316 u8 *data = pep_get_sb(skb, &type, &len, buf);
317
318 if (data == NULL)
319 return -EINVAL;
320 switch (type) {
321 case PN_PIPE_SB_NEGOTIATED_FC:
322 if (len < 2 || (data[0] | data[1]) > 3)
323 break;
324 pn->tx_fc = data[0] & 3;
325 pn->rx_fc = data[1] & 3;
326 break;
327 }
328 n_sb--;
329 }
330 return 0;
331 }
332
333 /* Queue an skb to a connected sock.
334 * Socket lock must be held. */
pipe_do_rcv(struct sock * sk,struct sk_buff * skb)335 static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
336 {
337 struct pep_sock *pn = pep_sk(sk);
338 struct pnpipehdr *hdr = pnp_hdr(skb);
339 struct sk_buff_head *queue;
340 int err = 0;
341
342 BUG_ON(sk->sk_state == TCP_CLOSE_WAIT);
343
344 switch (hdr->message_id) {
345 case PNS_PEP_CONNECT_REQ:
346 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_ATOMIC);
347 break;
348
349 case PNS_PEP_DISCONNECT_REQ:
350 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
351 sk->sk_state = TCP_CLOSE_WAIT;
352 if (!sock_flag(sk, SOCK_DEAD))
353 sk->sk_state_change(sk);
354 break;
355
356 case PNS_PEP_ENABLE_REQ:
357 /* Wait for PNS_PIPE_(ENABLED|REDIRECTED)_IND */
358 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
359 break;
360
361 case PNS_PEP_RESET_REQ:
362 switch (hdr->state_after_reset) {
363 case PN_PIPE_DISABLE:
364 pn->init_enable = 0;
365 break;
366 case PN_PIPE_ENABLE:
367 pn->init_enable = 1;
368 break;
369 default: /* not allowed to send an error here!? */
370 err = -EINVAL;
371 goto out;
372 }
373 fallthrough;
374 case PNS_PEP_DISABLE_REQ:
375 atomic_set(&pn->tx_credits, 0);
376 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
377 break;
378
379 case PNS_PEP_CTRL_REQ:
380 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
381 sk_drops_inc(sk);
382 break;
383 }
384 __skb_pull(skb, 4);
385 queue = &pn->ctrlreq_queue;
386 goto queue;
387
388 case PNS_PIPE_ALIGNED_DATA:
389 __skb_pull(skb, 1);
390 fallthrough;
391 case PNS_PIPE_DATA:
392 __skb_pull(skb, 3); /* Pipe data header */
393 if (!pn_flow_safe(pn->rx_fc)) {
394 err = sock_queue_rcv_skb(sk, skb);
395 if (!err)
396 return NET_RX_SUCCESS;
397 err = -ENOBUFS;
398 break;
399 }
400
401 if (pn->rx_credits == 0) {
402 sk_drops_inc(sk);
403 err = -ENOBUFS;
404 break;
405 }
406 pn->rx_credits--;
407 queue = &sk->sk_receive_queue;
408 goto queue;
409
410 case PNS_PEP_STATUS_IND:
411 pipe_rcv_status(sk, skb);
412 break;
413
414 case PNS_PIPE_REDIRECTED_IND:
415 err = pipe_rcv_created(sk, skb);
416 break;
417
418 case PNS_PIPE_CREATED_IND:
419 err = pipe_rcv_created(sk, skb);
420 if (err)
421 break;
422 fallthrough;
423 case PNS_PIPE_RESET_IND:
424 if (!pn->init_enable)
425 break;
426 fallthrough;
427 case PNS_PIPE_ENABLED_IND:
428 if (!pn_flow_safe(pn->tx_fc)) {
429 atomic_set(&pn->tx_credits, 1);
430 sk->sk_write_space(sk);
431 }
432 if (sk->sk_state == TCP_ESTABLISHED)
433 break; /* Nothing to do */
434 sk->sk_state = TCP_ESTABLISHED;
435 pipe_grant_credits(sk, GFP_ATOMIC);
436 break;
437
438 case PNS_PIPE_DISABLED_IND:
439 sk->sk_state = TCP_SYN_RECV;
440 pn->rx_credits = 0;
441 break;
442
443 default:
444 net_dbg_ratelimited("Phonet unknown PEP message: %u\n",
445 hdr->message_id);
446 err = -EINVAL;
447 }
448 out:
449 kfree_skb(skb);
450 return (err == -ENOBUFS) ? NET_RX_DROP : NET_RX_SUCCESS;
451
452 queue:
453 skb->dev = NULL;
454 skb_set_owner_r(skb, sk);
455 skb_queue_tail(queue, skb);
456 if (!sock_flag(sk, SOCK_DEAD))
457 sk->sk_data_ready(sk);
458 return NET_RX_SUCCESS;
459 }
460
461 /* Destroy connected sock. */
pipe_destruct(struct sock * sk)462 static void pipe_destruct(struct sock *sk)
463 {
464 struct pep_sock *pn = pep_sk(sk);
465
466 skb_queue_purge(&sk->sk_receive_queue);
467 skb_queue_purge(&pn->ctrlreq_queue);
468 }
469
pipe_negotiate_fc(const u8 * fcs,unsigned int n)470 static u8 pipe_negotiate_fc(const u8 *fcs, unsigned int n)
471 {
472 unsigned int i;
473 u8 final_fc = PN_NO_FLOW_CONTROL;
474
475 for (i = 0; i < n; i++) {
476 u8 fc = fcs[i];
477
478 if (fc > final_fc && fc < PN_MAX_FLOW_CONTROL)
479 final_fc = fc;
480 }
481 return final_fc;
482 }
483
pep_connresp_rcv(struct sock * sk,struct sk_buff * skb)484 static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)
485 {
486 struct pep_sock *pn = pep_sk(sk);
487 struct pnpipehdr *hdr;
488 u8 n_sb;
489
490 if (!pskb_pull(skb, sizeof(*hdr) + 4))
491 return -EINVAL;
492
493 hdr = pnp_hdr(skb);
494 if (hdr->error_code != PN_PIPE_NO_ERROR)
495 return -ECONNREFUSED;
496
497 /* Parse sub-blocks */
498 n_sb = hdr->data[3];
499 while (n_sb > 0) {
500 u8 type, buf[6], len = sizeof(buf);
501 const u8 *data = pep_get_sb(skb, &type, &len, buf);
502
503 if (data == NULL)
504 return -EINVAL;
505
506 switch (type) {
507 case PN_PIPE_SB_REQUIRED_FC_TX:
508 if (len < 2 || len < data[0])
509 break;
510 pn->tx_fc = pipe_negotiate_fc(data + 2, len - 2);
511 break;
512
513 case PN_PIPE_SB_PREFERRED_FC_RX:
514 if (len < 2 || len < data[0])
515 break;
516 pn->rx_fc = pipe_negotiate_fc(data + 2, len - 2);
517 break;
518
519 }
520 n_sb--;
521 }
522
523 return pipe_handler_send_created_ind(sk);
524 }
525
pep_enableresp_rcv(struct sock * sk,struct sk_buff * skb)526 static int pep_enableresp_rcv(struct sock *sk, struct sk_buff *skb)
527 {
528 struct pnpipehdr *hdr = pnp_hdr(skb);
529
530 if (hdr->error_code != PN_PIPE_NO_ERROR)
531 return -ECONNREFUSED;
532
533 return pep_indicate(sk, PNS_PIPE_ENABLED_IND, 0 /* sub-blocks */,
534 NULL, 0, GFP_ATOMIC);
535
536 }
537
pipe_start_flow_control(struct sock * sk)538 static void pipe_start_flow_control(struct sock *sk)
539 {
540 struct pep_sock *pn = pep_sk(sk);
541
542 if (!pn_flow_safe(pn->tx_fc)) {
543 atomic_set(&pn->tx_credits, 1);
544 sk->sk_write_space(sk);
545 }
546 pipe_grant_credits(sk, GFP_ATOMIC);
547 }
548
549 /* Queue an skb to an actively connected sock.
550 * Socket lock must be held. */
pipe_handler_do_rcv(struct sock * sk,struct sk_buff * skb)551 static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
552 {
553 struct pep_sock *pn = pep_sk(sk);
554 struct pnpipehdr *hdr = pnp_hdr(skb);
555 int err = NET_RX_SUCCESS;
556
557 switch (hdr->message_id) {
558 case PNS_PIPE_ALIGNED_DATA:
559 __skb_pull(skb, 1);
560 fallthrough;
561 case PNS_PIPE_DATA:
562 __skb_pull(skb, 3); /* Pipe data header */
563 if (!pn_flow_safe(pn->rx_fc)) {
564 err = sock_queue_rcv_skb(sk, skb);
565 if (!err)
566 return NET_RX_SUCCESS;
567 err = NET_RX_DROP;
568 break;
569 }
570
571 if (pn->rx_credits == 0) {
572 sk_drops_inc(sk);
573 err = NET_RX_DROP;
574 break;
575 }
576 pn->rx_credits--;
577 skb->dev = NULL;
578 skb_set_owner_r(skb, sk);
579 skb_queue_tail(&sk->sk_receive_queue, skb);
580 if (!sock_flag(sk, SOCK_DEAD))
581 sk->sk_data_ready(sk);
582 return NET_RX_SUCCESS;
583
584 case PNS_PEP_CONNECT_RESP:
585 if (sk->sk_state != TCP_SYN_SENT)
586 break;
587 if (!sock_flag(sk, SOCK_DEAD))
588 sk->sk_state_change(sk);
589 if (pep_connresp_rcv(sk, skb)) {
590 sk->sk_state = TCP_CLOSE_WAIT;
591 break;
592 }
593 if (pn->init_enable == PN_PIPE_DISABLE)
594 sk->sk_state = TCP_SYN_RECV;
595 else {
596 sk->sk_state = TCP_ESTABLISHED;
597 pipe_start_flow_control(sk);
598 }
599 break;
600
601 case PNS_PEP_ENABLE_RESP:
602 if (sk->sk_state != TCP_SYN_SENT)
603 break;
604
605 if (pep_enableresp_rcv(sk, skb)) {
606 sk->sk_state = TCP_CLOSE_WAIT;
607 break;
608 }
609
610 sk->sk_state = TCP_ESTABLISHED;
611 pipe_start_flow_control(sk);
612 break;
613
614 case PNS_PEP_DISCONNECT_RESP:
615 /* sock should already be dead, nothing to do */
616 break;
617
618 case PNS_PEP_STATUS_IND:
619 pipe_rcv_status(sk, skb);
620 break;
621 }
622 kfree_skb(skb);
623 return err;
624 }
625
626 /* Listening sock must be locked */
pep_find_pipe(const struct hlist_head * hlist,const struct sockaddr_pn * dst,u8 pipe_handle)627 static struct sock *pep_find_pipe(const struct hlist_head *hlist,
628 const struct sockaddr_pn *dst,
629 u8 pipe_handle)
630 {
631 struct sock *sknode;
632 u16 dobj = pn_sockaddr_get_object(dst);
633
634 sk_for_each(sknode, hlist) {
635 struct pep_sock *pnnode = pep_sk(sknode);
636
637 /* Ports match, but addresses might not: */
638 if (pnnode->pn_sk.sobject != dobj)
639 continue;
640 if (pnnode->pipe_handle != pipe_handle)
641 continue;
642 if (sknode->sk_state == TCP_CLOSE_WAIT)
643 continue;
644
645 sock_hold(sknode);
646 return sknode;
647 }
648 return NULL;
649 }
650
651 /*
652 * Deliver an skb to a listening sock.
653 * Socket lock must be held.
654 * We then queue the skb to the right connected sock (if any).
655 */
pep_do_rcv(struct sock * sk,struct sk_buff * skb)656 static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
657 {
658 struct pep_sock *pn = pep_sk(sk);
659 struct sock *sknode;
660 struct pnpipehdr *hdr;
661 struct sockaddr_pn dst;
662 u8 pipe_handle;
663
664 if (!pskb_may_pull(skb, sizeof(*hdr)))
665 goto drop;
666
667 hdr = pnp_hdr(skb);
668 pipe_handle = hdr->pipe_handle;
669 if (pipe_handle == PN_PIPE_INVALID_HANDLE)
670 goto drop;
671
672 pn_skb_get_dst_sockaddr(skb, &dst);
673
674 /* Look for an existing pipe handle */
675 sknode = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
676 if (sknode) {
677 int rc;
678
679 /* pep_do_rcv() runs from two contexts: from softirq via
680 * phonet_rcv() -> __sk_receive_skb() with BH disabled,
681 * and from process context via
682 * release_sock() -> __release_sock(), which drops
683 * the listener slock with spin_unlock_bh() before draining
684 * the backlog. The child pipe slock is taken below via
685 * bh_lock_sock_nested(), which does not itself disable BH, so
686 * disable BH here to keep both acquire contexts consistent.
687 */
688 local_bh_disable();
689 rc = sk_receive_skb(sknode, skb, 1);
690 local_bh_enable();
691 return rc;
692 }
693
694 switch (hdr->message_id) {
695 case PNS_PEP_CONNECT_REQ:
696 if (sk->sk_state != TCP_LISTEN || sk_acceptq_is_full(sk)) {
697 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE,
698 GFP_ATOMIC);
699 break;
700 }
701 skb_queue_head(&sk->sk_receive_queue, skb);
702 sk_acceptq_added(sk);
703 if (!sock_flag(sk, SOCK_DEAD))
704 sk->sk_data_ready(sk);
705 return NET_RX_SUCCESS;
706
707 case PNS_PEP_DISCONNECT_REQ:
708 pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
709 break;
710
711 case PNS_PEP_CTRL_REQ:
712 pep_ctrlreq_error(sk, skb, PN_PIPE_INVALID_HANDLE, GFP_ATOMIC);
713 break;
714
715 case PNS_PEP_RESET_REQ:
716 case PNS_PEP_ENABLE_REQ:
717 case PNS_PEP_DISABLE_REQ:
718 /* invalid handle is not even allowed here! */
719 break;
720
721 default:
722 if ((1 << sk->sk_state)
723 & ~(TCPF_CLOSE|TCPF_LISTEN|TCPF_CLOSE_WAIT))
724 /* actively connected socket */
725 return pipe_handler_do_rcv(sk, skb);
726 }
727 drop:
728 kfree_skb(skb);
729 return NET_RX_SUCCESS;
730 }
731
pipe_do_remove(struct sock * sk)732 static int pipe_do_remove(struct sock *sk)
733 {
734 struct pep_sock *pn = pep_sk(sk);
735 struct pnpipehdr *ph;
736 struct sk_buff *skb;
737
738 skb = pep_alloc_skb(sk, NULL, 0, GFP_KERNEL);
739 if (!skb)
740 return -ENOMEM;
741
742 ph = pnp_hdr(skb);
743 ph->utid = 0;
744 ph->message_id = PNS_PIPE_REMOVE_REQ;
745 ph->pipe_handle = pn->pipe_handle;
746 ph->data0 = PAD;
747 return pn_skb_send(sk, skb, NULL);
748 }
749
750 /* associated socket ceases to exist */
pep_sock_close(struct sock * sk,long timeout)751 static void pep_sock_close(struct sock *sk, long timeout)
752 {
753 struct pep_sock *pn = pep_sk(sk);
754 int ifindex = 0;
755
756 sock_hold(sk); /* keep a reference after sk_common_release() */
757 sk_common_release(sk);
758
759 lock_sock(sk);
760 if ((1 << sk->sk_state) & (TCPF_SYN_RECV|TCPF_ESTABLISHED)) {
761 if (sk->sk_backlog_rcv == pipe_do_rcv)
762 /* Forcefully remove dangling Phonet pipe */
763 pipe_do_remove(sk);
764 else
765 pipe_handler_request(sk, PNS_PEP_DISCONNECT_REQ, PAD,
766 NULL, 0);
767 }
768 sk->sk_state = TCP_CLOSE;
769
770 ifindex = pn->ifindex;
771 pn->ifindex = 0;
772 release_sock(sk);
773
774 if (ifindex)
775 gprs_detach(sk);
776 sock_put(sk);
777 }
778
pep_sock_accept(struct sock * sk,struct proto_accept_arg * arg)779 static struct sock *pep_sock_accept(struct sock *sk,
780 struct proto_accept_arg *arg)
781 {
782 struct pep_sock *pn = pep_sk(sk), *newpn;
783 struct sock *newsk = NULL;
784 struct sk_buff *skb;
785 struct pnpipehdr *hdr;
786 struct sockaddr_pn dst, src;
787 int err;
788 u16 peer_type;
789 u8 pipe_handle, enabled, n_sb;
790 u8 aligned = 0;
791
792 skb = skb_recv_datagram(sk, (arg->flags & O_NONBLOCK) ? MSG_DONTWAIT : 0,
793 &arg->err);
794 if (!skb)
795 return NULL;
796
797 lock_sock(sk);
798 if (sk->sk_state != TCP_LISTEN) {
799 err = -EINVAL;
800 goto drop;
801 }
802 sk_acceptq_removed(sk);
803
804 err = -EPROTO;
805 if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
806 goto drop;
807
808 hdr = pnp_hdr(skb);
809 pipe_handle = hdr->pipe_handle;
810 switch (hdr->state_after_connect) {
811 case PN_PIPE_DISABLE:
812 enabled = 0;
813 break;
814 case PN_PIPE_ENABLE:
815 enabled = 1;
816 break;
817 default:
818 pep_reject_conn(sk, skb, PN_PIPE_ERR_INVALID_PARAM,
819 GFP_KERNEL);
820 goto drop;
821 }
822 peer_type = hdr->other_pep_type << 8;
823
824 /* Parse sub-blocks (options) */
825 n_sb = hdr->data[3];
826 while (n_sb > 0) {
827 u8 type, buf[1], len = sizeof(buf);
828 const u8 *data = pep_get_sb(skb, &type, &len, buf);
829
830 if (data == NULL)
831 goto drop;
832 switch (type) {
833 case PN_PIPE_SB_CONNECT_REQ_PEP_SUB_TYPE:
834 if (len < 1)
835 goto drop;
836 peer_type = (peer_type & 0xff00) | data[0];
837 break;
838 case PN_PIPE_SB_ALIGNED_DATA:
839 aligned = data[0] != 0;
840 break;
841 }
842 n_sb--;
843 }
844
845 /* Check for duplicate pipe handle */
846 pn_skb_get_dst_sockaddr(skb, &dst);
847 newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
848 if (unlikely(newsk)) {
849 __sock_put(newsk);
850 newsk = NULL;
851 pep_reject_conn(sk, skb, PN_PIPE_ERR_PEP_IN_USE, GFP_KERNEL);
852 goto drop;
853 }
854
855 /* Create a new to-be-accepted sock */
856 newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot,
857 arg->kern);
858 if (!newsk) {
859 pep_reject_conn(sk, skb, PN_PIPE_ERR_OVERLOAD, GFP_KERNEL);
860 err = -ENOBUFS;
861 goto drop;
862 }
863
864 sock_init_data(NULL, newsk);
865 newsk->sk_state = TCP_SYN_RECV;
866 newsk->sk_backlog_rcv = pipe_do_rcv;
867 newsk->sk_protocol = sk->sk_protocol;
868 newsk->sk_destruct = pipe_destruct;
869
870 newpn = pep_sk(newsk);
871 pn_skb_get_src_sockaddr(skb, &src);
872 newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst);
873 newpn->pn_sk.dobject = pn_sockaddr_get_object(&src);
874 newpn->pn_sk.resource = pn_sockaddr_get_resource(&dst);
875 sock_hold(sk);
876 newpn->listener = sk;
877 skb_queue_head_init(&newpn->ctrlreq_queue);
878 newpn->pipe_handle = pipe_handle;
879 atomic_set(&newpn->tx_credits, 0);
880 newpn->ifindex = 0;
881 newpn->peer_type = peer_type;
882 newpn->rx_credits = 0;
883 newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL;
884 newpn->init_enable = enabled;
885 newpn->aligned = aligned;
886
887 err = pep_accept_conn(newsk, skb);
888 if (err) {
889 __sock_put(sk);
890 sock_put(newsk);
891 newsk = NULL;
892 goto drop;
893 }
894 sk_add_node(newsk, &pn->hlist);
895 drop:
896 release_sock(sk);
897 kfree_skb(skb);
898 arg->err = err;
899 return newsk;
900 }
901
pep_sock_connect(struct sock * sk,struct sockaddr_unsized * addr,int len)902 static int pep_sock_connect(struct sock *sk, struct sockaddr_unsized *addr,
903 int len)
904 {
905 struct pep_sock *pn = pep_sk(sk);
906 int err;
907 u8 data[4] = { 0 /* sub-blocks */, PAD, PAD, PAD };
908
909 if (pn->pipe_handle == PN_PIPE_INVALID_HANDLE)
910 pn->pipe_handle = 1; /* anything but INVALID_HANDLE */
911
912 err = pipe_handler_request(sk, PNS_PEP_CONNECT_REQ,
913 pn->init_enable, data, 4);
914 if (err) {
915 pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
916 return err;
917 }
918
919 sk->sk_state = TCP_SYN_SENT;
920
921 return 0;
922 }
923
pep_sock_enable(struct sock * sk,struct sockaddr * addr,int len)924 static int pep_sock_enable(struct sock *sk, struct sockaddr *addr, int len)
925 {
926 int err;
927
928 err = pipe_handler_request(sk, PNS_PEP_ENABLE_REQ, PAD,
929 NULL, 0);
930 if (err)
931 return err;
932
933 sk->sk_state = TCP_SYN_SENT;
934
935 return 0;
936 }
937
pep_first_packet_length(struct sock * sk)938 static unsigned int pep_first_packet_length(struct sock *sk)
939 {
940 struct pep_sock *pn = pep_sk(sk);
941 struct sk_buff_head *q;
942 struct sk_buff *skb;
943 unsigned int len = 0;
944 bool found = false;
945
946 if (sock_flag(sk, SOCK_URGINLINE)) {
947 q = &pn->ctrlreq_queue;
948 spin_lock_bh(&q->lock);
949 skb = skb_peek(q);
950 if (skb) {
951 len = skb->len;
952 found = true;
953 }
954 spin_unlock_bh(&q->lock);
955 }
956
957 if (likely(!found)) {
958 q = &sk->sk_receive_queue;
959 spin_lock_bh(&q->lock);
960 skb = skb_peek(q);
961 if (skb)
962 len = skb->len;
963 spin_unlock_bh(&q->lock);
964 }
965
966 return len;
967 }
968
pep_ioctl(struct sock * sk,int cmd,int * karg)969 static int pep_ioctl(struct sock *sk, int cmd, int *karg)
970 {
971 struct pep_sock *pn = pep_sk(sk);
972 int ret = -ENOIOCTLCMD;
973
974 switch (cmd) {
975 case SIOCINQ:
976 if (sk->sk_state == TCP_LISTEN) {
977 ret = -EINVAL;
978 break;
979 }
980
981 *karg = pep_first_packet_length(sk);
982 ret = 0;
983 break;
984
985 case SIOCPNENABLEPIPE:
986 lock_sock(sk);
987 if (sk->sk_state == TCP_SYN_SENT)
988 ret = -EBUSY;
989 else if (sk->sk_state == TCP_ESTABLISHED)
990 ret = -EISCONN;
991 else if (!pn->pn_sk.sobject)
992 ret = -EADDRNOTAVAIL;
993 else
994 ret = pep_sock_enable(sk, NULL, 0);
995 release_sock(sk);
996 break;
997 }
998
999 return ret;
1000 }
1001
pep_init(struct sock * sk)1002 static int pep_init(struct sock *sk)
1003 {
1004 struct pep_sock *pn = pep_sk(sk);
1005
1006 sk->sk_destruct = pipe_destruct;
1007 INIT_HLIST_HEAD(&pn->hlist);
1008 pn->listener = NULL;
1009 skb_queue_head_init(&pn->ctrlreq_queue);
1010 atomic_set(&pn->tx_credits, 0);
1011 pn->ifindex = 0;
1012 pn->peer_type = 0;
1013 pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
1014 pn->rx_credits = 0;
1015 pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
1016 pn->init_enable = 1;
1017 pn->aligned = 0;
1018 return 0;
1019 }
1020
pep_setsockopt(struct sock * sk,int level,int optname,sockptr_t optval,unsigned int optlen)1021 static int pep_setsockopt(struct sock *sk, int level, int optname,
1022 sockptr_t optval, unsigned int optlen)
1023 {
1024 struct pep_sock *pn = pep_sk(sk);
1025 int val = 0, err = 0;
1026
1027 if (level != SOL_PNPIPE)
1028 return -ENOPROTOOPT;
1029 if (optlen >= sizeof(int)) {
1030 if (copy_from_sockptr(&val, optval, sizeof(int)))
1031 return -EFAULT;
1032 }
1033
1034 lock_sock(sk);
1035 switch (optname) {
1036 case PNPIPE_ENCAP:
1037 if (val && val != PNPIPE_ENCAP_IP) {
1038 err = -EINVAL;
1039 break;
1040 }
1041 if (!pn->ifindex == !val)
1042 break; /* Nothing to do! */
1043 if (!capable(CAP_NET_ADMIN)) {
1044 err = -EPERM;
1045 break;
1046 }
1047 if (val) {
1048 release_sock(sk);
1049 err = gprs_attach(sk);
1050 if (err > 0) {
1051 pn->ifindex = err;
1052 err = 0;
1053 }
1054 } else {
1055 pn->ifindex = 0;
1056 release_sock(sk);
1057 gprs_detach(sk);
1058 err = 0;
1059 }
1060 goto out_norel;
1061
1062 case PNPIPE_HANDLE:
1063 if ((sk->sk_state == TCP_CLOSE) &&
1064 (val >= 0) && (val < PN_PIPE_INVALID_HANDLE))
1065 pn->pipe_handle = val;
1066 else
1067 err = -EINVAL;
1068 break;
1069
1070 case PNPIPE_INITSTATE:
1071 pn->init_enable = !!val;
1072 break;
1073
1074 default:
1075 err = -ENOPROTOOPT;
1076 }
1077 release_sock(sk);
1078
1079 out_norel:
1080 return err;
1081 }
1082
do_pep_getsockopt(struct sock * sk,int optname,sockopt_t * opt)1083 static int do_pep_getsockopt(struct sock *sk, int optname, sockopt_t *opt)
1084 {
1085 struct pep_sock *pn = pep_sk(sk);
1086 int len, val;
1087
1088 switch (optname) {
1089 case PNPIPE_ENCAP:
1090 val = pn->ifindex ? PNPIPE_ENCAP_IP : PNPIPE_ENCAP_NONE;
1091 break;
1092
1093 case PNPIPE_IFINDEX:
1094 val = pn->ifindex;
1095 break;
1096
1097 case PNPIPE_HANDLE:
1098 val = pn->pipe_handle;
1099 if (val == PN_PIPE_INVALID_HANDLE)
1100 return -EINVAL;
1101 break;
1102
1103 case PNPIPE_INITSTATE:
1104 val = pn->init_enable;
1105 break;
1106
1107 default:
1108 return -ENOPROTOOPT;
1109 }
1110
1111 len = umin(sizeof(int), opt->optlen);
1112 opt->optlen = len;
1113 if (copy_to_iter(&val, len, &opt->iter_out) != len)
1114 return -EFAULT;
1115 return 0;
1116 }
1117
pep_getsockopt(struct sock * sk,int level,int optname,char __user * optval,int __user * optlen)1118 static int pep_getsockopt(struct sock *sk, int level, int optname,
1119 char __user *optval, int __user *optlen)
1120 {
1121 sockopt_t opt;
1122 int err;
1123
1124 if (level != SOL_PNPIPE)
1125 return -ENOPROTOOPT;
1126
1127 err = sockopt_init_user(&opt, optval, optlen);
1128 if (err)
1129 return err;
1130
1131 err = do_pep_getsockopt(sk, optname, &opt);
1132 if (err)
1133 return err;
1134
1135 if (put_user(opt.optlen, optlen))
1136 return -EFAULT;
1137
1138 return 0;
1139 }
1140
pipe_skb_send(struct sock * sk,struct sk_buff * skb)1141 static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
1142 {
1143 struct pep_sock *pn = pep_sk(sk);
1144 struct pnpipehdr *ph;
1145 int err;
1146
1147 if (pn_flow_safe(pn->tx_fc) &&
1148 !atomic_add_unless(&pn->tx_credits, -1, 0)) {
1149 kfree_skb(skb);
1150 return -ENOBUFS;
1151 }
1152
1153 skb_push(skb, 3 + pn->aligned);
1154 skb_reset_transport_header(skb);
1155 ph = pnp_hdr(skb);
1156 ph->utid = 0;
1157 if (pn->aligned) {
1158 ph->message_id = PNS_PIPE_ALIGNED_DATA;
1159 ph->data0 = 0; /* padding */
1160 } else
1161 ph->message_id = PNS_PIPE_DATA;
1162 ph->pipe_handle = pn->pipe_handle;
1163 err = pn_skb_send(sk, skb, NULL);
1164
1165 if (err && pn_flow_safe(pn->tx_fc))
1166 atomic_inc(&pn->tx_credits);
1167 return err;
1168
1169 }
1170
pep_sendmsg(struct sock * sk,struct msghdr * msg,size_t len)1171 static int pep_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
1172 {
1173 struct pep_sock *pn = pep_sk(sk);
1174 struct sk_buff *skb;
1175 long timeo;
1176 int flags = msg->msg_flags;
1177 int err, done;
1178
1179 if (len > USHRT_MAX)
1180 return -EMSGSIZE;
1181
1182 if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
1183 MSG_CMSG_COMPAT)) ||
1184 !(msg->msg_flags & MSG_EOR))
1185 return -EOPNOTSUPP;
1186
1187 skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
1188 flags & MSG_DONTWAIT, &err);
1189 if (!skb)
1190 return err;
1191
1192 skb_reserve(skb, MAX_PHONET_HEADER + 3 + pn->aligned);
1193 err = memcpy_from_msg(skb_put(skb, len), msg, len);
1194 if (err < 0)
1195 goto outfree;
1196
1197 lock_sock(sk);
1198 timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
1199 if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) {
1200 err = -ENOTCONN;
1201 goto out;
1202 }
1203 if (sk->sk_state != TCP_ESTABLISHED) {
1204 /* Wait until the pipe gets to enabled state */
1205 disabled:
1206 err = sk_stream_wait_connect(sk, &timeo);
1207 if (err)
1208 goto out;
1209
1210 if (sk->sk_state == TCP_CLOSE_WAIT) {
1211 err = -ECONNRESET;
1212 goto out;
1213 }
1214 }
1215 BUG_ON(sk->sk_state != TCP_ESTABLISHED);
1216
1217 /* Wait until flow control allows TX */
1218 done = atomic_read(&pn->tx_credits);
1219 while (!done) {
1220 DEFINE_WAIT_FUNC(wait, woken_wake_function);
1221
1222 if (!timeo) {
1223 err = -EAGAIN;
1224 goto out;
1225 }
1226 if (signal_pending(current)) {
1227 err = sock_intr_errno(timeo);
1228 goto out;
1229 }
1230
1231 add_wait_queue(sk_sleep(sk), &wait);
1232 done = sk_wait_event(sk, &timeo, atomic_read(&pn->tx_credits), &wait);
1233 remove_wait_queue(sk_sleep(sk), &wait);
1234
1235 if (sk->sk_state != TCP_ESTABLISHED)
1236 goto disabled;
1237 }
1238
1239 err = pipe_skb_send(sk, skb);
1240 if (err >= 0)
1241 err = len; /* success! */
1242 skb = NULL;
1243 out:
1244 release_sock(sk);
1245 outfree:
1246 kfree_skb(skb);
1247 return err;
1248 }
1249
pep_writeable(struct sock * sk)1250 int pep_writeable(struct sock *sk)
1251 {
1252 struct pep_sock *pn = pep_sk(sk);
1253
1254 return atomic_read(&pn->tx_credits);
1255 }
1256
pep_write(struct sock * sk,struct sk_buff * skb)1257 int pep_write(struct sock *sk, struct sk_buff *skb)
1258 {
1259 struct sk_buff *rskb, *fs;
1260 int flen = 0;
1261
1262 if (pep_sk(sk)->aligned)
1263 return pipe_skb_send(sk, skb);
1264
1265 rskb = alloc_skb(MAX_PNPIPE_HEADER, GFP_ATOMIC);
1266 if (!rskb) {
1267 kfree_skb(skb);
1268 return -ENOMEM;
1269 }
1270 skb_shinfo(rskb)->frag_list = skb;
1271 rskb->len += skb->len;
1272 rskb->data_len += rskb->len;
1273 rskb->truesize += rskb->len;
1274
1275 /* Avoid nested fragments */
1276 skb_walk_frags(skb, fs)
1277 flen += fs->len;
1278 skb->next = skb_shinfo(skb)->frag_list;
1279 skb_frag_list_init(skb);
1280 skb->len -= flen;
1281 skb->data_len -= flen;
1282 skb->truesize -= flen;
1283
1284 skb_reserve(rskb, MAX_PHONET_HEADER + 3);
1285 return pipe_skb_send(sk, rskb);
1286 }
1287
pep_read(struct sock * sk)1288 struct sk_buff *pep_read(struct sock *sk)
1289 {
1290 struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue);
1291
1292 if (sk->sk_state == TCP_ESTABLISHED)
1293 pipe_grant_credits(sk, GFP_ATOMIC);
1294 return skb;
1295 }
1296
pep_recvmsg(struct sock * sk,struct msghdr * msg,size_t len,int flags)1297 static int pep_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
1298 int flags)
1299 {
1300 struct sk_buff *skb;
1301 int err;
1302
1303 if (flags & ~(MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_WAITALL|
1304 MSG_NOSIGNAL|MSG_CMSG_COMPAT))
1305 return -EOPNOTSUPP;
1306
1307 if (unlikely(1 << sk->sk_state & (TCPF_LISTEN | TCPF_CLOSE)))
1308 return -ENOTCONN;
1309
1310 if ((flags & MSG_OOB) || sock_flag(sk, SOCK_URGINLINE)) {
1311 /* Dequeue and acknowledge control request */
1312 struct pep_sock *pn = pep_sk(sk);
1313
1314 if (flags & MSG_PEEK)
1315 return -EOPNOTSUPP;
1316 skb = skb_dequeue(&pn->ctrlreq_queue);
1317 if (skb) {
1318 pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR,
1319 GFP_KERNEL);
1320 msg->msg_flags |= MSG_OOB;
1321 goto copy;
1322 }
1323 if (flags & MSG_OOB)
1324 return -EINVAL;
1325 }
1326
1327 skb = skb_recv_datagram(sk, flags, &err);
1328 lock_sock(sk);
1329 if (skb == NULL) {
1330 if (err == -ENOTCONN && sk->sk_state == TCP_CLOSE_WAIT)
1331 err = -ECONNRESET;
1332 release_sock(sk);
1333 return err;
1334 }
1335
1336 if (sk->sk_state == TCP_ESTABLISHED)
1337 pipe_grant_credits(sk, GFP_KERNEL);
1338 release_sock(sk);
1339 copy:
1340 msg->msg_flags |= MSG_EOR;
1341 if (skb->len > len)
1342 msg->msg_flags |= MSG_TRUNC;
1343 else
1344 len = skb->len;
1345
1346 err = skb_copy_datagram_msg(skb, 0, msg, len);
1347 if (!err)
1348 err = (flags & MSG_TRUNC) ? skb->len : len;
1349
1350 skb_free_datagram(sk, skb);
1351 return err;
1352 }
1353
pep_sock_unhash(struct sock * sk)1354 static void pep_sock_unhash(struct sock *sk)
1355 {
1356 struct pep_sock *pn = pep_sk(sk);
1357 struct sock *skparent = NULL;
1358
1359 lock_sock(sk);
1360
1361 if (pn->listener != NULL) {
1362 skparent = pn->listener;
1363 pn->listener = NULL;
1364 release_sock(sk);
1365
1366 pn = pep_sk(skparent);
1367 lock_sock(skparent);
1368 sk_del_node_init(sk);
1369 sk = skparent;
1370 }
1371
1372 /* Unhash a listening sock only when it is closed
1373 * and all of its active connected pipes are closed. */
1374 if (hlist_empty(&pn->hlist))
1375 pn_sock_unhash(&pn->pn_sk.sk);
1376 release_sock(sk);
1377
1378 if (skparent)
1379 sock_put(skparent);
1380 }
1381
1382 static struct proto pep_proto = {
1383 .close = pep_sock_close,
1384 .accept = pep_sock_accept,
1385 .connect = pep_sock_connect,
1386 .ioctl = pep_ioctl,
1387 .init = pep_init,
1388 .setsockopt = pep_setsockopt,
1389 .getsockopt = pep_getsockopt,
1390 .sendmsg = pep_sendmsg,
1391 .recvmsg = pep_recvmsg,
1392 .backlog_rcv = pep_do_rcv,
1393 .hash = pn_sock_hash,
1394 .unhash = pep_sock_unhash,
1395 .get_port = pn_sock_get_port,
1396 .obj_size = sizeof(struct pep_sock),
1397 .owner = THIS_MODULE,
1398 .name = "PNPIPE",
1399 };
1400
1401 static const struct phonet_protocol pep_pn_proto = {
1402 .ops = &phonet_stream_ops,
1403 .prot = &pep_proto,
1404 .sock_type = SOCK_SEQPACKET,
1405 };
1406
pep_register(void)1407 static int __init pep_register(void)
1408 {
1409 return phonet_proto_register(PN_PROTO_PIPE, &pep_pn_proto);
1410 }
1411
pep_unregister(void)1412 static void __exit pep_unregister(void)
1413 {
1414 phonet_proto_unregister(PN_PROTO_PIPE, &pep_pn_proto);
1415 }
1416
1417 module_init(pep_register);
1418 module_exit(pep_unregister);
1419 MODULE_AUTHOR("Remi Denis-Courmont, Nokia");
1420 MODULE_DESCRIPTION("Phonet pipe protocol");
1421 MODULE_LICENSE("GPL");
1422 MODULE_ALIAS_NET_PF_PROTO(PF_PHONET, PN_PROTO_PIPE);
1423