1 // SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) 2 /* raw.c - Raw sockets for protocol family CAN 3 * 4 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of Volkswagen nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * Alternatively, provided that this notice is retained in full, this 20 * software may be distributed under the terms of the GNU General 21 * Public License ("GPL") version 2, in which case the provisions of the 22 * GPL apply INSTEAD OF those given above. 23 * 24 * The provided data structures and external interfaces from this code 25 * are not restricted to be used by modules with a GPL compatible license. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 28 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 29 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 30 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 31 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 32 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 33 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 37 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 38 * DAMAGE. 39 * 40 */ 41 42 #include <linux/module.h> 43 #include <linux/init.h> 44 #include <linux/uio.h> 45 #include <linux/net.h> 46 #include <linux/slab.h> 47 #include <linux/netdevice.h> 48 #include <linux/socket.h> 49 #include <linux/if_arp.h> 50 #include <linux/skbuff.h> 51 #include <linux/can.h> 52 #include <linux/can/can-ml.h> 53 #include <linux/can/core.h> 54 #include <linux/can/skb.h> 55 #include <linux/can/raw.h> 56 #include <net/can.h> 57 #include <net/sock.h> 58 #include <net/net_namespace.h> 59 60 MODULE_DESCRIPTION("PF_CAN raw protocol"); 61 MODULE_LICENSE("Dual BSD/GPL"); 62 MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>"); 63 MODULE_ALIAS("can-proto-1"); 64 65 #define RAW_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex) 66 67 #define MASK_ALL 0 68 69 /* A raw socket has a list of can_filters attached to it, each receiving 70 * the CAN frames matching that filter. If the filter list is empty, 71 * no CAN frames will be received by the socket. The default after 72 * opening the socket, is to have one filter which receives all frames. 73 * The filter list is allocated dynamically with the exception of the 74 * list containing only one item. This common case is optimized by 75 * storing the single filter in dfilter, to avoid using dynamic memory. 76 */ 77 78 struct uniqframe { 79 const struct sk_buff *skb; 80 u32 can_skb_uid; 81 unsigned int join_rx_count; 82 }; 83 84 struct raw_sock { 85 struct sock sk; 86 struct net_device *dev; 87 netdevice_tracker dev_tracker; 88 struct net_device *bind_dev; /* hint for raw_notify(), no reference */ 89 struct list_head notifier; 90 int ifindex; 91 unsigned int bound:1; 92 unsigned int loopback:1; 93 unsigned int recv_own_msgs:1; 94 unsigned int fd_frames:1; 95 unsigned int xl_frames:1; 96 unsigned int join_filters:1; 97 struct can_raw_vcid_options raw_vcid_opts; 98 canid_t tx_vcid_shifted; 99 canid_t rx_vcid_shifted; 100 canid_t rx_vcid_mask_shifted; 101 can_err_mask_t err_mask; 102 int count; /* number of active filters */ 103 struct can_filter dfilter; /* default/single filter */ 104 struct can_filter *filter; /* pointer to filter(s) */ 105 struct uniqframe __percpu *uniq; 106 }; 107 108 static LIST_HEAD(raw_notifier_list); 109 static DEFINE_SPINLOCK(raw_notifier_lock); 110 static struct raw_sock *raw_busy_notifier; 111 112 /* Return pointer to store the extra msg flags for raw_recvmsg(). 113 * We use the space of one unsigned int beyond the 'struct sockaddr_can' 114 * in skb->cb. 115 */ 116 static inline unsigned int *raw_flags(struct sk_buff *skb) 117 { 118 sock_skb_cb_check_size(sizeof(struct sockaddr_can) + 119 sizeof(unsigned int)); 120 121 /* return pointer after struct sockaddr_can */ 122 return (unsigned int *)(&((struct sockaddr_can *)skb->cb)[1]); 123 } 124 125 static inline struct raw_sock *raw_sk(const struct sock *sk) 126 { 127 return (struct raw_sock *)sk; 128 } 129 130 static void raw_rcv(struct sk_buff *oskb, void *data) 131 { 132 struct sock *sk = (struct sock *)data; 133 struct raw_sock *ro = raw_sk(sk); 134 enum skb_drop_reason reason; 135 struct sockaddr_can *addr; 136 struct sk_buff *skb; 137 struct can_skb_ext *csx = can_skb_ext_find(oskb); 138 unsigned int *pflags; 139 140 /* check the received tx sock reference */ 141 if (!ro->recv_own_msgs && oskb->sk == sk) 142 return; 143 144 if (WARN_ON_ONCE(!csx)) 145 return; 146 147 /* make sure to not pass oversized frames to the socket */ 148 if (!ro->fd_frames && can_is_canfd_skb(oskb)) 149 return; 150 151 if (can_is_canxl_skb(oskb)) { 152 struct canxl_frame *cxl = (struct canxl_frame *)oskb->data; 153 154 /* make sure to not pass oversized frames to the socket */ 155 if (!ro->xl_frames) 156 return; 157 158 /* filter CAN XL VCID content */ 159 if (ro->raw_vcid_opts.flags & CAN_RAW_XL_VCID_RX_FILTER) { 160 /* apply VCID filter if user enabled the filter */ 161 if ((cxl->prio & ro->rx_vcid_mask_shifted) != 162 (ro->rx_vcid_shifted & ro->rx_vcid_mask_shifted)) 163 return; 164 } else { 165 /* no filter => do not forward VCID tagged frames */ 166 if (cxl->prio & CANXL_VCID_MASK) 167 return; 168 } 169 } 170 171 /* eliminate multiple filter matches for the same skb */ 172 if (this_cpu_ptr(ro->uniq)->skb == oskb && 173 this_cpu_ptr(ro->uniq)->can_skb_uid == csx->can_skb_uid) { 174 if (!ro->join_filters) 175 return; 176 177 this_cpu_inc(ro->uniq->join_rx_count); 178 /* drop frame until all enabled filters matched */ 179 if (this_cpu_ptr(ro->uniq)->join_rx_count < ro->count) 180 return; 181 } else { 182 this_cpu_ptr(ro->uniq)->skb = oskb; 183 this_cpu_ptr(ro->uniq)->can_skb_uid = csx->can_skb_uid; 184 this_cpu_ptr(ro->uniq)->join_rx_count = 1; 185 /* drop first frame to check all enabled filters? */ 186 if (ro->join_filters && ro->count > 1) 187 return; 188 } 189 190 /* clone the given skb to be able to enqueue it into the rcv queue */ 191 skb = skb_clone(oskb, GFP_ATOMIC); 192 if (!skb) 193 return; 194 195 /* Put the datagram to the queue so that raw_recvmsg() can get 196 * it from there. We need to pass the interface index to 197 * raw_recvmsg(). We pass a whole struct sockaddr_can in 198 * skb->cb containing the interface index. 199 */ 200 201 sock_skb_cb_check_size(sizeof(struct sockaddr_can)); 202 addr = (struct sockaddr_can *)skb->cb; 203 memset(addr, 0, sizeof(*addr)); 204 addr->can_family = AF_CAN; 205 addr->can_ifindex = skb->dev->ifindex; 206 207 /* add CAN specific message flags for raw_recvmsg() */ 208 pflags = raw_flags(skb); 209 *pflags = 0; 210 if (oskb->sk) 211 *pflags |= MSG_DONTROUTE; 212 if (oskb->sk == sk) 213 *pflags |= MSG_CONFIRM; 214 215 reason = sock_queue_rcv_skb_reason(sk, skb); 216 if (reason) 217 sk_skb_reason_drop(sk, skb, reason); 218 } 219 220 static int raw_enable_filters(struct net *net, struct net_device *dev, 221 struct sock *sk, struct can_filter *filter, 222 int count) 223 { 224 int err = 0; 225 int i; 226 227 for (i = 0; i < count; i++) { 228 cond_resched(); 229 err = can_rx_register(net, dev, filter[i].can_id, 230 filter[i].can_mask, 231 raw_rcv, sk, sock_i_ino(sk), sk); 232 if (err) { 233 /* clean up successfully registered filters */ 234 while (--i >= 0) 235 can_rx_unregister(net, dev, filter[i].can_id, 236 filter[i].can_mask, 237 raw_rcv, sk); 238 break; 239 } 240 } 241 242 return err; 243 } 244 245 static int raw_enable_errfilter(struct net *net, struct net_device *dev, 246 struct sock *sk, can_err_mask_t err_mask) 247 { 248 int err = 0; 249 250 if (err_mask) 251 err = can_rx_register(net, dev, 0, err_mask | CAN_ERR_FLAG, 252 raw_rcv, sk, sock_i_ino(sk), sk); 253 254 return err; 255 } 256 257 static void raw_disable_filters(struct net *net, struct net_device *dev, 258 struct sock *sk, struct can_filter *filter, 259 int count) 260 { 261 int i; 262 263 for (i = 0; i < count; i++) { 264 can_rx_unregister(net, dev, filter[i].can_id, 265 filter[i].can_mask, raw_rcv, sk); 266 cond_resched(); 267 } 268 } 269 270 static inline void raw_disable_errfilter(struct net *net, 271 struct net_device *dev, 272 struct sock *sk, 273 can_err_mask_t err_mask) 274 275 { 276 if (err_mask) 277 can_rx_unregister(net, dev, 0, err_mask | CAN_ERR_FLAG, 278 raw_rcv, sk); 279 } 280 281 static inline void raw_disable_allfilters(struct net *net, 282 struct net_device *dev, 283 struct sock *sk) 284 { 285 struct raw_sock *ro = raw_sk(sk); 286 287 raw_disable_filters(net, dev, sk, ro->filter, ro->count); 288 raw_disable_errfilter(net, dev, sk, ro->err_mask); 289 } 290 291 static int raw_enable_allfilters(struct net *net, struct net_device *dev, 292 struct sock *sk) 293 { 294 struct raw_sock *ro = raw_sk(sk); 295 int err; 296 297 err = raw_enable_filters(net, dev, sk, ro->filter, ro->count); 298 if (!err) { 299 err = raw_enable_errfilter(net, dev, sk, ro->err_mask); 300 if (err) 301 raw_disable_filters(net, dev, sk, ro->filter, 302 ro->count); 303 } 304 305 return err; 306 } 307 308 static void raw_notify(struct raw_sock *ro, unsigned long msg, 309 struct net_device *dev) 310 { 311 struct sock *sk = &ro->sk; 312 struct net_device *bind_dev; 313 314 if (!net_eq(dev_net(dev), sock_net(sk))) 315 return; 316 317 if (msg == NETDEV_DOWN) 318 smp_mb(); /* IFF_UP is cleared before, pairs with raw_bind() */ 319 320 /* Lockless fast path, ro->bind_dev covers a concurrent bind(). 321 * Read it before ro->dev, pairs with smp_store_release() in 322 * raw_bind(). A stale ro->bind_dev only costs a lock_sock(). 323 */ 324 bind_dev = smp_load_acquire(&ro->bind_dev); 325 if (READ_ONCE(ro->dev) != dev && 326 (msg != NETDEV_UNREGISTER || bind_dev != dev)) 327 return; 328 329 switch (msg) { 330 case NETDEV_UNREGISTER: 331 lock_sock(sk); 332 if (ro->dev != dev) { 333 release_sock(sk); 334 break; 335 } 336 337 /* remove current filters & unregister */ 338 if (ro->bound) { 339 raw_disable_allfilters(dev_net(dev), dev, sk); 340 netdev_put(dev, &ro->dev_tracker); 341 } 342 343 if (ro->count > 1) 344 kfree(ro->filter); 345 346 ro->ifindex = 0; 347 ro->bound = 0; 348 WRITE_ONCE(ro->dev, NULL); 349 ro->count = 0; 350 351 sk->sk_err = ENODEV; 352 if (!sock_flag(sk, SOCK_DEAD)) 353 sk_error_report(sk); 354 release_sock(sk); 355 break; 356 357 case NETDEV_DOWN: 358 sk->sk_err = ENETDOWN; 359 if (!sock_flag(sk, SOCK_DEAD)) 360 sk_error_report(sk); 361 break; 362 } 363 } 364 365 static int raw_notifier(struct notifier_block *nb, unsigned long msg, 366 void *ptr) 367 { 368 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 369 370 if (!can_get_ml_priv(dev)) 371 return NOTIFY_DONE; 372 if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) 373 return NOTIFY_DONE; 374 if (unlikely(raw_busy_notifier)) /* Check for reentrant bug. */ 375 return NOTIFY_DONE; 376 377 spin_lock(&raw_notifier_lock); 378 list_for_each_entry(raw_busy_notifier, &raw_notifier_list, notifier) { 379 spin_unlock(&raw_notifier_lock); 380 raw_notify(raw_busy_notifier, msg, dev); 381 spin_lock(&raw_notifier_lock); 382 } 383 raw_busy_notifier = NULL; 384 spin_unlock(&raw_notifier_lock); 385 return NOTIFY_DONE; 386 } 387 388 static void raw_sock_destruct(struct sock *sk) 389 { 390 struct raw_sock *ro = raw_sk(sk); 391 392 free_percpu(ro->uniq); 393 can_sock_destruct(sk); 394 } 395 396 static int raw_init(struct sock *sk) 397 { 398 struct raw_sock *ro = raw_sk(sk); 399 400 ro->bound = 0; 401 ro->ifindex = 0; 402 ro->dev = NULL; 403 ro->bind_dev = NULL; 404 405 /* set default filter to single entry dfilter */ 406 ro->dfilter.can_id = 0; 407 ro->dfilter.can_mask = MASK_ALL; 408 ro->filter = &ro->dfilter; 409 ro->count = 1; 410 411 /* set default loopback behaviour */ 412 ro->loopback = 1; 413 ro->recv_own_msgs = 0; 414 ro->fd_frames = 0; 415 ro->xl_frames = 0; 416 ro->join_filters = 0; 417 418 /* alloc_percpu provides zero'ed memory */ 419 ro->uniq = alloc_percpu(struct uniqframe); 420 if (unlikely(!ro->uniq)) 421 return -ENOMEM; 422 423 sk->sk_destruct = raw_sock_destruct; 424 425 /* set notifier */ 426 spin_lock(&raw_notifier_lock); 427 list_add_tail(&ro->notifier, &raw_notifier_list); 428 spin_unlock(&raw_notifier_lock); 429 430 return 0; 431 } 432 433 static int raw_release(struct socket *sock) 434 { 435 struct sock *sk = sock->sk; 436 struct raw_sock *ro; 437 struct net *net; 438 439 if (!sk) 440 return 0; 441 442 ro = raw_sk(sk); 443 net = sock_net(sk); 444 445 spin_lock(&raw_notifier_lock); 446 while (raw_busy_notifier == ro) { 447 spin_unlock(&raw_notifier_lock); 448 schedule_timeout_uninterruptible(1); 449 spin_lock(&raw_notifier_lock); 450 } 451 list_del(&ro->notifier); 452 spin_unlock(&raw_notifier_lock); 453 454 lock_sock(sk); 455 456 /* remove current filters & unregister 457 * the tracked reference ro->dev keeps the device's receive lists 458 * accessible, even after a namespace change 459 */ 460 if (ro->bound) { 461 if (ro->dev) { 462 raw_disable_allfilters(net, ro->dev, sk); 463 netdev_put(ro->dev, &ro->dev_tracker); 464 } else { 465 raw_disable_allfilters(net, NULL, sk); 466 } 467 } 468 469 if (ro->count > 1) 470 kfree(ro->filter); 471 472 ro->ifindex = 0; 473 ro->bound = 0; 474 ro->dev = NULL; 475 ro->count = 0; 476 477 sock_orphan(sk); 478 sock->sk = NULL; 479 480 release_sock(sk); 481 482 sock_prot_inuse_add(net, sk->sk_prot, -1); 483 sock_put(sk); 484 485 return 0; 486 } 487 488 static int raw_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int len) 489 { 490 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 491 struct sock *sk = sock->sk; 492 struct raw_sock *ro = raw_sk(sk); 493 struct net_device *dev = NULL; 494 int ifindex; 495 int err = 0; 496 int notify_enetdown = 0; 497 498 if (len < RAW_MIN_NAMELEN) 499 return -EINVAL; 500 if (addr->can_family != AF_CAN) 501 return -EINVAL; 502 503 /* lock_sock() serializes the binding with raw_notify() */ 504 lock_sock(sk); 505 506 if (ro->bound && addr->can_ifindex == ro->ifindex) 507 goto out; 508 509 if (addr->can_ifindex) { 510 /* Publish the device inside the RCU section of the lookup: 511 * When it is unlisted concurrently, either raw_notify() sees 512 * ro->bind_dev after synchronize_net() or the lookup fails. 513 */ 514 rcu_read_lock(); 515 dev = dev_get_by_index_rcu(sock_net(sk), addr->can_ifindex); 516 if (dev) { 517 dev_hold(dev); 518 /* pairs with smp_load_acquire() in raw_notify() */ 519 smp_store_release(&ro->bind_dev, dev); 520 } 521 rcu_read_unlock(); 522 if (!dev) { 523 err = -ENODEV; 524 goto out; 525 } 526 if (!can_get_ml_priv(dev)) { 527 err = -ENODEV; 528 goto out_put_dev; 529 } 530 531 ifindex = dev->ifindex; 532 533 /* filters set by default/setsockopt */ 534 err = raw_enable_allfilters(sock_net(sk), dev, sk); 535 if (err) 536 goto out_put_dev; 537 538 } else { 539 ifindex = 0; 540 541 /* filters set by default/setsockopt */ 542 err = raw_enable_allfilters(sock_net(sk), NULL, sk); 543 } 544 545 if (!err) { 546 if (ro->bound) { 547 /* unregister old filters */ 548 if (ro->dev) { 549 raw_disable_allfilters(sock_net(sk), 550 ro->dev, sk); 551 /* drop reference to old ro->dev */ 552 netdev_put(ro->dev, &ro->dev_tracker); 553 } else { 554 raw_disable_allfilters(sock_net(sk), NULL, sk); 555 } 556 } 557 ro->ifindex = ifindex; 558 ro->bound = 1; 559 /* bind() ok -> hold a reference for new ro->dev */ 560 WRITE_ONCE(ro->dev, dev); 561 if (ro->dev) 562 netdev_hold(ro->dev, &ro->dev_tracker, GFP_KERNEL); 563 564 if (dev) { 565 /* Either raw_notify() sees ro->dev on NETDEV_DOWN or 566 * we see the cleared IFF_UP, pairs with raw_notify() 567 */ 568 smp_mb(); 569 if (!(READ_ONCE(dev->flags) & IFF_UP)) 570 notify_enetdown = 1; 571 } 572 } 573 574 out_put_dev: 575 /* remove reference from the device lookup */ 576 dev_put(dev); 577 out: 578 if (notify_enetdown) { 579 sk->sk_err = ENETDOWN; 580 if (!sock_flag(sk, SOCK_DEAD)) 581 sk_error_report(sk); 582 } 583 584 release_sock(sk); 585 586 return err; 587 } 588 589 static int raw_getname(struct socket *sock, struct sockaddr *uaddr, 590 int peer) 591 { 592 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 593 struct sock *sk = sock->sk; 594 struct raw_sock *ro = raw_sk(sk); 595 596 if (peer) 597 return -EOPNOTSUPP; 598 599 memset(addr, 0, RAW_MIN_NAMELEN); 600 addr->can_family = AF_CAN; 601 addr->can_ifindex = ro->ifindex; 602 603 return RAW_MIN_NAMELEN; 604 } 605 606 static int raw_setsockopt_locked(struct socket *sock, int optname, 607 const void *val, struct can_filter *filter, 608 int count) 609 { 610 struct sock *sk = sock->sk; 611 struct raw_sock *ro = raw_sk(sk); 612 struct net_device *dev = NULL; 613 can_err_mask_t err_mask; 614 int flag; 615 int err = 0; 616 617 switch (optname) { 618 case CAN_RAW_FILTER: 619 /* @filter has been copied by raw_setsockopt(). It is linked 620 * to the socket on success and freed by the caller on error. 621 * 622 * The reg_state check is only a shortcut: On a concurrent 623 * unregistration or namespace change raw_notify() waits for 624 * lock_sock() and removes the filters set here. 625 */ 626 dev = ro->dev; 627 if (ro->bound && dev && 628 READ_ONCE(dev->reg_state) != NETREG_REGISTERED) 629 return -ENODEV; 630 631 if (ro->bound) { 632 /* (try to) register the new filters */ 633 err = raw_enable_filters(sock_net(sk), dev, sk, filter, 634 count); 635 if (err) 636 return err; 637 638 /* remove old filter registrations */ 639 raw_disable_filters(sock_net(sk), dev, sk, ro->filter, 640 ro->count); 641 } 642 643 /* remove old filter space */ 644 if (ro->count > 1) 645 kfree(ro->filter); 646 647 /* link new filters to the socket */ 648 if (count == 1) { 649 /* copy filter data for single filter */ 650 ro->dfilter = *filter; 651 filter = &ro->dfilter; 652 } 653 ro->filter = filter; 654 ro->count = count; 655 break; 656 657 case CAN_RAW_ERR_FILTER: 658 err_mask = *(const can_err_mask_t *)val & CAN_ERR_MASK; 659 660 /* lockless shortcut, see CAN_RAW_FILTER */ 661 dev = ro->dev; 662 if (ro->bound && dev && 663 READ_ONCE(dev->reg_state) != NETREG_REGISTERED) 664 return -ENODEV; 665 666 /* remove current error mask */ 667 if (ro->bound) { 668 /* (try to) register the new err_mask */ 669 err = raw_enable_errfilter(sock_net(sk), dev, sk, 670 err_mask); 671 672 if (err) 673 return err; 674 675 /* remove old err_mask registration */ 676 raw_disable_errfilter(sock_net(sk), dev, sk, 677 ro->err_mask); 678 } 679 680 /* link new err_mask to the socket */ 681 ro->err_mask = err_mask; 682 break; 683 684 case CAN_RAW_LOOPBACK: 685 ro->loopback = !!*(const int *)val; 686 break; 687 688 case CAN_RAW_RECV_OWN_MSGS: 689 ro->recv_own_msgs = !!*(const int *)val; 690 break; 691 692 case CAN_RAW_FD_FRAMES: 693 flag = *(const int *)val; 694 695 /* Enabling CAN XL includes CAN FD */ 696 if (ro->xl_frames && !flag) 697 return -EINVAL; 698 699 ro->fd_frames = !!flag; 700 break; 701 702 case CAN_RAW_XL_FRAMES: 703 ro->xl_frames = !!*(const int *)val; 704 705 /* Enabling CAN XL includes CAN FD */ 706 if (ro->xl_frames) 707 ro->fd_frames = ro->xl_frames; 708 break; 709 710 case CAN_RAW_XL_VCID_OPTS: 711 memcpy(&ro->raw_vcid_opts, val, sizeof(ro->raw_vcid_opts)); 712 713 /* prepare 32 bit values for handling in hot path */ 714 ro->tx_vcid_shifted = ro->raw_vcid_opts.tx_vcid << CANXL_VCID_OFFSET; 715 ro->rx_vcid_shifted = ro->raw_vcid_opts.rx_vcid << CANXL_VCID_OFFSET; 716 ro->rx_vcid_mask_shifted = ro->raw_vcid_opts.rx_vcid_mask << CANXL_VCID_OFFSET; 717 break; 718 719 case CAN_RAW_JOIN_FILTERS: 720 ro->join_filters = !!*(const int *)val; 721 break; 722 723 default: 724 return -ENOPROTOOPT; 725 } 726 return err; 727 } 728 729 static int raw_setsockopt(struct socket *sock, int level, int optname, 730 sockptr_t optval, unsigned int optlen) 731 { 732 struct sock *sk = sock->sk; 733 struct can_filter *filter = NULL; /* dyn. alloc'ed filters */ 734 struct can_filter sfilter; /* single filter */ 735 union { 736 can_err_mask_t err_mask; 737 int flag; 738 struct can_raw_vcid_options vcid_opts; 739 } val; 740 unsigned int size = 0; 741 int count = 0; 742 int err; 743 744 if (level != SOL_CAN_RAW) 745 return -EINVAL; 746 747 /* Copy the option values from user space before lock_sock(), so a 748 * stalled copy can not block raw_notify() waiting for lock_sock() 749 * under RTNL. 750 */ 751 switch (optname) { 752 case CAN_RAW_FILTER: 753 if (optlen % sizeof(struct can_filter) != 0) 754 return -EINVAL; 755 756 if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter)) 757 return -EINVAL; 758 759 count = optlen / sizeof(struct can_filter); 760 761 if (count > 1) { 762 /* filter does not fit into dfilter => alloc space */ 763 filter = memdup_sockptr(optval, optlen); 764 if (IS_ERR(filter)) 765 return PTR_ERR(filter); 766 } else if (count == 1) { 767 if (copy_from_sockptr(&sfilter, optval, sizeof(sfilter))) 768 return -EFAULT; 769 filter = &sfilter; 770 } 771 break; 772 773 case CAN_RAW_ERR_FILTER: 774 size = sizeof(val.err_mask); 775 break; 776 777 case CAN_RAW_XL_VCID_OPTS: 778 size = sizeof(val.vcid_opts); 779 break; 780 781 case CAN_RAW_LOOPBACK: 782 case CAN_RAW_RECV_OWN_MSGS: 783 case CAN_RAW_FD_FRAMES: 784 case CAN_RAW_XL_FRAMES: 785 case CAN_RAW_JOIN_FILTERS: 786 size = sizeof(val.flag); 787 break; 788 789 default: 790 return -ENOPROTOOPT; 791 } 792 793 if (size) { 794 if (optlen != size) 795 return -EINVAL; 796 797 if (copy_from_sockptr(&val, optval, size)) 798 return -EFAULT; 799 } 800 801 lock_sock(sk); 802 803 err = raw_setsockopt_locked(sock, optname, &val, filter, count); 804 805 release_sock(sk); 806 807 /* on error free the filters allocated for CAN_RAW_FILTER above */ 808 if (err && count > 1) 809 kfree(filter); 810 811 return err; 812 } 813 814 static int raw_getsockopt(struct socket *sock, int level, int optname, 815 sockopt_t *opt) 816 { 817 struct sock *sk = sock->sk; 818 struct raw_sock *ro = raw_sk(sk); 819 int flag; 820 int len; 821 void *val; 822 823 if (level != SOL_CAN_RAW) 824 return -EINVAL; 825 len = opt->optlen; 826 if (len < 0) 827 return -EINVAL; 828 829 switch (optname) { 830 case CAN_RAW_FILTER: { 831 struct can_filter *filter = NULL; 832 int err = 0; 833 834 lock_sock(sk); 835 if (ro->count > 0) { 836 int fsize = ro->count * sizeof(struct can_filter); 837 838 /* user space buffer to small for filter list? */ 839 if (len < fsize) { 840 /* return -ERANGE and needed space in optlen */ 841 err = -ERANGE; 842 opt->optlen = fsize; 843 } else { 844 if (len > fsize) 845 len = fsize; 846 /* copy to user space after release_sock() */ 847 filter = kmemdup(ro->filter, len, GFP_KERNEL); 848 if (!filter) 849 err = -ENOMEM; 850 } 851 } else { 852 len = 0; 853 } 854 release_sock(sk); 855 856 if (filter) { 857 if (copy_to_iter(filter, len, &opt->iter_out) != len) 858 err = -EFAULT; 859 kfree(filter); 860 } 861 862 if (!err) 863 opt->optlen = len; 864 return err; 865 } 866 case CAN_RAW_ERR_FILTER: 867 if (len > sizeof(can_err_mask_t)) 868 len = sizeof(can_err_mask_t); 869 val = &ro->err_mask; 870 break; 871 872 case CAN_RAW_LOOPBACK: 873 if (len > sizeof(int)) 874 len = sizeof(int); 875 flag = ro->loopback; 876 val = &flag; 877 break; 878 879 case CAN_RAW_RECV_OWN_MSGS: 880 if (len > sizeof(int)) 881 len = sizeof(int); 882 flag = ro->recv_own_msgs; 883 val = &flag; 884 break; 885 886 case CAN_RAW_FD_FRAMES: 887 if (len > sizeof(int)) 888 len = sizeof(int); 889 flag = ro->fd_frames; 890 val = &flag; 891 break; 892 893 case CAN_RAW_XL_FRAMES: 894 if (len > sizeof(int)) 895 len = sizeof(int); 896 flag = ro->xl_frames; 897 val = &flag; 898 break; 899 900 case CAN_RAW_XL_VCID_OPTS: { 901 int err = 0; 902 903 /* user space buffer to small for VCID opts? */ 904 if (len < sizeof(ro->raw_vcid_opts)) { 905 /* return -ERANGE and needed space in optlen */ 906 err = -ERANGE; 907 opt->optlen = sizeof(ro->raw_vcid_opts); 908 } else { 909 if (len > sizeof(ro->raw_vcid_opts)) 910 len = sizeof(ro->raw_vcid_opts); 911 if (copy_to_iter(&ro->raw_vcid_opts, len, 912 &opt->iter_out) != len) 913 err = -EFAULT; 914 } 915 if (!err) 916 opt->optlen = len; 917 return err; 918 } 919 case CAN_RAW_JOIN_FILTERS: 920 if (len > sizeof(int)) 921 len = sizeof(int); 922 flag = ro->join_filters; 923 val = &flag; 924 break; 925 926 default: 927 return -ENOPROTOOPT; 928 } 929 930 opt->optlen = len; 931 if (copy_to_iter(val, len, &opt->iter_out) != len) 932 return -EFAULT; 933 return 0; 934 } 935 936 static void raw_put_canxl_vcid(struct raw_sock *ro, struct sk_buff *skb) 937 { 938 struct canxl_frame *cxl = (struct canxl_frame *)skb->data; 939 940 /* sanitize non CAN XL bits */ 941 cxl->prio &= (CANXL_PRIO_MASK | CANXL_VCID_MASK); 942 943 /* clear VCID in CAN XL frame if pass through is disabled */ 944 if (!(ro->raw_vcid_opts.flags & CAN_RAW_XL_VCID_TX_PASS)) 945 cxl->prio &= CANXL_PRIO_MASK; 946 947 /* set VCID in CAN XL frame if enabled */ 948 if (ro->raw_vcid_opts.flags & CAN_RAW_XL_VCID_TX_SET) { 949 cxl->prio &= CANXL_PRIO_MASK; 950 cxl->prio |= ro->tx_vcid_shifted; 951 } 952 } 953 954 static unsigned int raw_check_txframe(struct raw_sock *ro, struct sk_buff *skb, 955 struct net_device *dev) 956 { 957 /* Classical CAN */ 958 if (can_is_can_skb(skb) && can_cap_enabled(dev, CAN_CAP_CC)) 959 return CAN_MTU; 960 961 /* CAN FD */ 962 if (ro->fd_frames && can_is_canfd_skb(skb) && 963 can_cap_enabled(dev, CAN_CAP_FD)) 964 return CANFD_MTU; 965 966 /* CAN XL */ 967 if (ro->xl_frames && can_is_canxl_skb(skb) && 968 can_cap_enabled(dev, CAN_CAP_XL)) 969 return CANXL_MTU; 970 971 return 0; 972 } 973 974 static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 975 { 976 struct sock *sk = sock->sk; 977 struct raw_sock *ro = raw_sk(sk); 978 struct sockcm_cookie sockc; 979 struct sk_buff *skb; 980 struct can_skb_ext *csx; 981 struct net_device *dev; 982 unsigned int txmtu; 983 int ifindex; 984 int err = -EINVAL; 985 986 /* check for valid CAN frame sizes */ 987 if (size < CANXL_HDR_SIZE + CANXL_MIN_DLEN || size > CANXL_MTU) 988 return -EINVAL; 989 990 if (msg->msg_name) { 991 DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name); 992 993 if (msg->msg_namelen < RAW_MIN_NAMELEN) 994 return -EINVAL; 995 996 if (addr->can_family != AF_CAN) 997 return -EINVAL; 998 999 ifindex = addr->can_ifindex; 1000 } else { 1001 ifindex = ro->ifindex; 1002 } 1003 1004 dev = dev_get_by_index(sock_net(sk), ifindex); 1005 if (!dev) 1006 return -ENXIO; 1007 1008 /* no sending on a CAN device in read-only mode */ 1009 if (can_cap_enabled(dev, CAN_CAP_RO)) { 1010 err = -EACCES; 1011 goto put_dev; 1012 } 1013 1014 skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, 1015 &err); 1016 if (!skb) 1017 goto put_dev; 1018 1019 csx = can_skb_ext_add(skb); 1020 if (!csx) { 1021 kfree_skb(skb); 1022 err = -ENOMEM; 1023 goto put_dev; 1024 } 1025 1026 csx->can_iif = dev->ifindex; 1027 1028 /* fill the skb before testing for valid CAN frames */ 1029 err = memcpy_from_msg(skb_put(skb, size), msg, size); 1030 if (err < 0) 1031 goto free_skb; 1032 1033 err = -EINVAL; 1034 1035 /* check for valid CAN (CC/FD/XL) frame content */ 1036 txmtu = raw_check_txframe(ro, skb, dev); 1037 if (!txmtu) 1038 goto free_skb; 1039 1040 /* only CANXL: clear/forward/set VCID value */ 1041 if (txmtu == CANXL_MTU) 1042 raw_put_canxl_vcid(ro, skb); 1043 1044 sockcm_init(&sockc, sk); 1045 if (msg->msg_controllen) { 1046 err = sock_cmsg_send(sk, msg, &sockc); 1047 if (unlikely(err)) 1048 goto free_skb; 1049 } 1050 1051 skb->dev = dev; 1052 skb->priority = sockc.priority; 1053 skb->mark = sockc.mark; 1054 skb->tstamp = sockc.transmit_time; 1055 1056 skb_setup_tx_timestamp(skb, &sockc); 1057 1058 err = can_send(skb, ro->loopback); 1059 1060 dev_put(dev); 1061 1062 if (err) 1063 goto send_failed; 1064 1065 return size; 1066 1067 free_skb: 1068 kfree_skb(skb); 1069 put_dev: 1070 dev_put(dev); 1071 send_failed: 1072 return err; 1073 } 1074 1075 static int raw_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 1076 int flags) 1077 { 1078 struct sock *sk = sock->sk; 1079 struct sk_buff *skb; 1080 int err = 0; 1081 1082 if (flags & MSG_ERRQUEUE) 1083 return sock_recv_errqueue(sk, msg, size, 1084 SOL_CAN_RAW, SCM_CAN_RAW_ERRQUEUE); 1085 1086 skb = skb_recv_datagram(sk, flags, &err); 1087 if (!skb) 1088 return err; 1089 1090 if (size < skb->len) 1091 msg->msg_flags |= MSG_TRUNC; 1092 else 1093 size = skb->len; 1094 1095 err = memcpy_to_msg(msg, skb->data, size); 1096 if (err < 0) { 1097 skb_free_datagram(sk, skb); 1098 return err; 1099 } 1100 1101 sock_recv_cmsgs(msg, sk, skb); 1102 1103 if (msg->msg_name) { 1104 __sockaddr_check_size(RAW_MIN_NAMELEN); 1105 msg->msg_namelen = RAW_MIN_NAMELEN; 1106 memcpy(msg->msg_name, skb->cb, msg->msg_namelen); 1107 } 1108 1109 /* assign the flags that have been recorded in raw_rcv() */ 1110 msg->msg_flags |= *(raw_flags(skb)); 1111 1112 skb_free_datagram(sk, skb); 1113 1114 return size; 1115 } 1116 1117 static int raw_sock_no_ioctlcmd(struct socket *sock, unsigned int cmd, 1118 unsigned long arg) 1119 { 1120 /* no ioctls for socket layer -> hand it down to NIC layer */ 1121 return -ENOIOCTLCMD; 1122 } 1123 1124 static const struct proto_ops raw_ops = { 1125 .family = PF_CAN, 1126 .release = raw_release, 1127 .bind = raw_bind, 1128 .connect = sock_no_connect, 1129 .socketpair = sock_no_socketpair, 1130 .accept = sock_no_accept, 1131 .getname = raw_getname, 1132 .poll = datagram_poll, 1133 .ioctl = raw_sock_no_ioctlcmd, 1134 .gettstamp = sock_gettstamp, 1135 .listen = sock_no_listen, 1136 .shutdown = sock_no_shutdown, 1137 .setsockopt = raw_setsockopt, 1138 .getsockopt_iter = raw_getsockopt, 1139 .sendmsg = raw_sendmsg, 1140 .recvmsg = raw_recvmsg, 1141 .mmap = sock_no_mmap, 1142 }; 1143 1144 static struct proto raw_proto __read_mostly = { 1145 .name = "CAN_RAW", 1146 .owner = THIS_MODULE, 1147 .obj_size = sizeof(struct raw_sock), 1148 .init = raw_init, 1149 }; 1150 1151 static const struct can_proto raw_can_proto = { 1152 .type = SOCK_RAW, 1153 .protocol = CAN_RAW, 1154 .ops = &raw_ops, 1155 .prot = &raw_proto, 1156 }; 1157 1158 static struct notifier_block canraw_notifier = { 1159 .notifier_call = raw_notifier 1160 }; 1161 1162 static __init int raw_module_init(void) 1163 { 1164 int err; 1165 1166 pr_info("can: raw protocol\n"); 1167 1168 err = register_netdevice_notifier(&canraw_notifier); 1169 if (err) 1170 return err; 1171 1172 err = can_proto_register(&raw_can_proto); 1173 if (err < 0) { 1174 pr_err("can: registration of raw protocol failed\n"); 1175 goto register_proto_failed; 1176 } 1177 1178 return 0; 1179 1180 register_proto_failed: 1181 unregister_netdevice_notifier(&canraw_notifier); 1182 return err; 1183 } 1184 1185 static __exit void raw_module_exit(void) 1186 { 1187 can_proto_unregister(&raw_can_proto); 1188 unregister_netdevice_notifier(&canraw_notifier); 1189 } 1190 1191 module_init(raw_module_init); 1192 module_exit(raw_module_exit); 1193