1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Kernel Connection Multiplexor 4 * 5 * Copyright (c) 2016 Tom Herbert <tom@herbertland.com> 6 */ 7 8 #include <linux/bpf.h> 9 #include <linux/errno.h> 10 #include <linux/errqueue.h> 11 #include <linux/file.h> 12 #include <linux/filter.h> 13 #include <linux/in.h> 14 #include <linux/kernel.h> 15 #include <linux/module.h> 16 #include <linux/net.h> 17 #include <linux/netdevice.h> 18 #include <linux/poll.h> 19 #include <linux/rculist.h> 20 #include <linux/skbuff.h> 21 #include <linux/socket.h> 22 #include <linux/uaccess.h> 23 #include <linux/workqueue.h> 24 #include <linux/syscalls.h> 25 #include <linux/sched/signal.h> 26 27 #include <net/kcm.h> 28 #include <net/netns/generic.h> 29 #include <net/sock.h> 30 #include <uapi/linux/kcm.h> 31 #include <trace/events/sock.h> 32 33 unsigned int kcm_net_id; 34 35 static struct kmem_cache *kcm_psockp __read_mostly; 36 static struct kmem_cache *kcm_muxp __read_mostly; 37 static struct workqueue_struct *kcm_wq; 38 39 static inline struct kcm_sock *kcm_sk(const struct sock *sk) 40 { 41 return (struct kcm_sock *)sk; 42 } 43 44 static inline struct kcm_tx_msg *kcm_tx_msg(struct sk_buff *skb) 45 { 46 return (struct kcm_tx_msg *)skb->cb; 47 } 48 49 static void report_csk_error(struct sock *csk, int err) 50 { 51 csk->sk_err = EPIPE; 52 sk_error_report(csk); 53 } 54 55 static void kcm_abort_tx_psock(struct kcm_psock *psock, int err, 56 bool wakeup_kcm) 57 { 58 struct sock *csk = psock->sk; 59 struct kcm_mux *mux = psock->mux; 60 61 /* Unrecoverable error in transmit */ 62 63 spin_lock_bh(&mux->lock); 64 65 if (psock->tx_stopped) { 66 spin_unlock_bh(&mux->lock); 67 return; 68 } 69 70 psock->tx_stopped = 1; 71 KCM_STATS_INCR(psock->stats.tx_aborts); 72 73 if (!psock->tx_kcm) { 74 /* Take off psocks_avail list */ 75 list_del(&psock->psock_avail_list); 76 } else if (wakeup_kcm) { 77 /* In this case psock is being aborted while outside of 78 * write_msgs and psock is reserved. Schedule tx_work 79 * to handle the failure there. Need to commit tx_stopped 80 * before queuing work. 81 */ 82 smp_mb(); 83 84 queue_work(kcm_wq, &psock->tx_kcm->tx_work); 85 } 86 87 spin_unlock_bh(&mux->lock); 88 89 /* Report error on lower socket */ 90 report_csk_error(csk, err); 91 } 92 93 /* RX mux lock held. */ 94 static void kcm_update_rx_mux_stats(struct kcm_mux *mux, 95 struct kcm_psock *psock) 96 { 97 STRP_STATS_ADD(mux->stats.rx_bytes, 98 psock->strp.stats.bytes - 99 psock->saved_rx_bytes); 100 mux->stats.rx_msgs += 101 psock->strp.stats.msgs - psock->saved_rx_msgs; 102 psock->saved_rx_msgs = psock->strp.stats.msgs; 103 psock->saved_rx_bytes = psock->strp.stats.bytes; 104 } 105 106 static void kcm_update_tx_mux_stats(struct kcm_mux *mux, 107 struct kcm_psock *psock) 108 { 109 KCM_STATS_ADD(mux->stats.tx_bytes, 110 psock->stats.tx_bytes - psock->saved_tx_bytes); 111 mux->stats.tx_msgs += 112 psock->stats.tx_msgs - psock->saved_tx_msgs; 113 psock->saved_tx_msgs = psock->stats.tx_msgs; 114 psock->saved_tx_bytes = psock->stats.tx_bytes; 115 } 116 117 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); 118 119 /* KCM is ready to receive messages on its queue-- either the KCM is new or 120 * has become unblocked after being blocked on full socket buffer. Queue any 121 * pending ready messages on a psock. RX mux lock held. 122 */ 123 static void kcm_rcv_ready(struct kcm_sock *kcm) 124 { 125 struct kcm_mux *mux = kcm->mux; 126 struct kcm_psock *psock; 127 struct sk_buff *skb; 128 129 if (unlikely(kcm->rx_wait || kcm->rx_psock || kcm->rx_disabled)) 130 return; 131 132 while (unlikely((skb = __skb_dequeue(&mux->rx_hold_queue)))) { 133 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 134 /* Assuming buffer limit has been reached */ 135 skb_queue_head(&mux->rx_hold_queue, skb); 136 WARN_ON(!sk_rmem_alloc_get(&kcm->sk)); 137 return; 138 } 139 } 140 141 while (!list_empty(&mux->psocks_ready)) { 142 psock = list_first_entry(&mux->psocks_ready, struct kcm_psock, 143 psock_ready_list); 144 145 if (kcm_queue_rcv_skb(&kcm->sk, psock->ready_rx_msg)) { 146 /* Assuming buffer limit has been reached */ 147 WARN_ON(!sk_rmem_alloc_get(&kcm->sk)); 148 return; 149 } 150 151 /* Consumed the ready message on the psock. Schedule rx_work to 152 * get more messages. 153 */ 154 list_del(&psock->psock_ready_list); 155 psock->ready_rx_msg = NULL; 156 /* Commit clearing of ready_rx_msg for queuing work */ 157 smp_mb(); 158 159 strp_unpause(&psock->strp); 160 strp_check_rcv(&psock->strp); 161 } 162 163 /* Buffer limit is okay now, add to ready list */ 164 list_add_tail(&kcm->wait_rx_list, 165 &kcm->mux->kcm_rx_waiters); 166 /* paired with lockless reads in kcm_rfree() */ 167 WRITE_ONCE(kcm->rx_wait, true); 168 } 169 170 static void kcm_rfree(struct sk_buff *skb) 171 { 172 struct sock *sk = skb->sk; 173 struct kcm_sock *kcm = kcm_sk(sk); 174 struct kcm_mux *mux = kcm->mux; 175 unsigned int len = skb->truesize; 176 177 sk_mem_uncharge(sk, len); 178 atomic_sub(len, &sk->sk_rmem_alloc); 179 180 /* For reading rx_wait and rx_psock without holding lock */ 181 smp_mb__after_atomic(); 182 183 if (!READ_ONCE(kcm->rx_wait) && !READ_ONCE(kcm->rx_psock) && 184 sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) { 185 spin_lock_bh(&mux->rx_lock); 186 kcm_rcv_ready(kcm); 187 spin_unlock_bh(&mux->rx_lock); 188 } 189 } 190 191 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 192 { 193 struct sk_buff_head *list = &sk->sk_receive_queue; 194 195 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 196 return -ENOMEM; 197 198 if (!sk_rmem_schedule(sk, skb, skb->truesize)) 199 return -ENOBUFS; 200 201 skb->dev = NULL; 202 203 skb_orphan(skb); 204 skb->sk = sk; 205 skb->destructor = kcm_rfree; 206 atomic_add(skb->truesize, &sk->sk_rmem_alloc); 207 sk_mem_charge(sk, skb->truesize); 208 209 skb_queue_tail(list, skb); 210 211 if (!sock_flag(sk, SOCK_DEAD)) 212 sk->sk_data_ready(sk); 213 214 return 0; 215 } 216 217 /* Requeue received messages for a kcm socket to other kcm sockets. This is 218 * called with a kcm socket is receive disabled. 219 * RX mux lock held. 220 */ 221 static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head) 222 { 223 struct sk_buff *skb; 224 struct kcm_sock *kcm; 225 226 while ((skb = skb_dequeue(head))) { 227 /* Reset destructor to avoid calling kcm_rcv_ready */ 228 skb->destructor = sock_rfree; 229 skb_orphan(skb); 230 try_again: 231 if (list_empty(&mux->kcm_rx_waiters)) { 232 skb_queue_tail(&mux->rx_hold_queue, skb); 233 continue; 234 } 235 236 kcm = list_first_entry(&mux->kcm_rx_waiters, 237 struct kcm_sock, wait_rx_list); 238 239 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 240 /* Should mean socket buffer full */ 241 list_del(&kcm->wait_rx_list); 242 /* paired with lockless reads in kcm_rfree() */ 243 WRITE_ONCE(kcm->rx_wait, false); 244 245 /* Commit rx_wait to read in kcm_free */ 246 smp_wmb(); 247 248 goto try_again; 249 } 250 } 251 } 252 253 /* Lower sock lock held */ 254 static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, 255 struct sk_buff *head) 256 { 257 struct kcm_mux *mux = psock->mux; 258 struct kcm_sock *kcm; 259 260 WARN_ON(psock->ready_rx_msg); 261 262 if (psock->rx_kcm) 263 return psock->rx_kcm; 264 265 spin_lock_bh(&mux->rx_lock); 266 267 if (psock->rx_kcm) { 268 spin_unlock_bh(&mux->rx_lock); 269 return psock->rx_kcm; 270 } 271 272 kcm_update_rx_mux_stats(mux, psock); 273 274 if (list_empty(&mux->kcm_rx_waiters)) { 275 psock->ready_rx_msg = head; 276 strp_pause(&psock->strp); 277 list_add_tail(&psock->psock_ready_list, 278 &mux->psocks_ready); 279 spin_unlock_bh(&mux->rx_lock); 280 return NULL; 281 } 282 283 kcm = list_first_entry(&mux->kcm_rx_waiters, 284 struct kcm_sock, wait_rx_list); 285 list_del(&kcm->wait_rx_list); 286 /* paired with lockless reads in kcm_rfree() */ 287 WRITE_ONCE(kcm->rx_wait, false); 288 289 psock->rx_kcm = kcm; 290 /* paired with lockless reads in kcm_rfree() */ 291 WRITE_ONCE(kcm->rx_psock, psock); 292 293 spin_unlock_bh(&mux->rx_lock); 294 295 return kcm; 296 } 297 298 static void kcm_done(struct kcm_sock *kcm); 299 300 static void kcm_done_work(struct work_struct *w) 301 { 302 kcm_done(container_of(w, struct kcm_sock, done_work)); 303 } 304 305 /* Lower sock held */ 306 static void unreserve_rx_kcm(struct kcm_psock *psock, 307 bool rcv_ready) 308 { 309 struct kcm_sock *kcm = psock->rx_kcm; 310 struct kcm_mux *mux = psock->mux; 311 312 if (!kcm) 313 return; 314 315 spin_lock_bh(&mux->rx_lock); 316 317 psock->rx_kcm = NULL; 318 /* paired with lockless reads in kcm_rfree() */ 319 WRITE_ONCE(kcm->rx_psock, NULL); 320 321 /* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with 322 * kcm_rfree 323 */ 324 smp_mb(); 325 326 if (unlikely(kcm->done)) { 327 spin_unlock_bh(&mux->rx_lock); 328 329 /* Need to run kcm_done in a task since we need to qcquire 330 * callback locks which may already be held here. 331 */ 332 INIT_WORK(&kcm->done_work, kcm_done_work); 333 schedule_work(&kcm->done_work); 334 return; 335 } 336 337 if (unlikely(kcm->rx_disabled)) { 338 requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); 339 } else if (rcv_ready || unlikely(!sk_rmem_alloc_get(&kcm->sk))) { 340 /* Check for degenerative race with rx_wait that all 341 * data was dequeued (accounted for in kcm_rfree). 342 */ 343 kcm_rcv_ready(kcm); 344 } 345 spin_unlock_bh(&mux->rx_lock); 346 } 347 348 /* Lower sock lock held */ 349 static void psock_data_ready(struct sock *sk) 350 { 351 struct kcm_psock *psock; 352 353 trace_sk_data_ready(sk); 354 355 read_lock_bh(&sk->sk_callback_lock); 356 357 psock = (struct kcm_psock *)sk->sk_user_data; 358 if (likely(psock)) 359 strp_data_ready(&psock->strp); 360 361 read_unlock_bh(&sk->sk_callback_lock); 362 } 363 364 /* Called with lower sock held */ 365 static void kcm_rcv_strparser(struct strparser *strp, struct sk_buff *skb) 366 { 367 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 368 struct kcm_sock *kcm; 369 370 try_queue: 371 kcm = reserve_rx_kcm(psock, skb); 372 if (!kcm) { 373 /* Unable to reserve a KCM, message is held in psock and strp 374 * is paused. 375 */ 376 return; 377 } 378 379 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 380 /* Should mean socket buffer full */ 381 unreserve_rx_kcm(psock, false); 382 goto try_queue; 383 } 384 } 385 386 static int kcm_parse_func_strparser(struct strparser *strp, struct sk_buff *skb) 387 { 388 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 389 struct bpf_prog *prog = psock->bpf_prog; 390 int res; 391 392 res = bpf_prog_run_pin_on_cpu(prog, skb); 393 return res; 394 } 395 396 static int kcm_read_sock_done(struct strparser *strp, int err) 397 { 398 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 399 400 unreserve_rx_kcm(psock, true); 401 402 return err; 403 } 404 405 static void psock_state_change(struct sock *sk) 406 { 407 /* TCP only does a EPOLLIN for a half close. Do a EPOLLHUP here 408 * since application will normally not poll with EPOLLIN 409 * on the TCP sockets. 410 */ 411 412 report_csk_error(sk, EPIPE); 413 } 414 415 static void psock_write_space(struct sock *sk) 416 { 417 struct kcm_psock *psock; 418 struct kcm_mux *mux; 419 struct kcm_sock *kcm; 420 421 read_lock_bh(&sk->sk_callback_lock); 422 423 psock = (struct kcm_psock *)sk->sk_user_data; 424 if (unlikely(!psock)) 425 goto out; 426 mux = psock->mux; 427 428 spin_lock_bh(&mux->lock); 429 430 /* Check if the socket is reserved so someone is waiting for sending. */ 431 kcm = psock->tx_kcm; 432 if (kcm && !unlikely(kcm->tx_stopped)) 433 queue_work(kcm_wq, &kcm->tx_work); 434 435 spin_unlock_bh(&mux->lock); 436 out: 437 read_unlock_bh(&sk->sk_callback_lock); 438 } 439 440 static void unreserve_psock(struct kcm_sock *kcm); 441 442 /* kcm sock is locked. */ 443 static struct kcm_psock *reserve_psock(struct kcm_sock *kcm) 444 { 445 struct kcm_mux *mux = kcm->mux; 446 struct kcm_psock *psock; 447 448 psock = kcm->tx_psock; 449 450 smp_rmb(); /* Must read tx_psock before tx_wait */ 451 452 if (psock) { 453 WARN_ON(kcm->tx_wait); 454 if (unlikely(psock->tx_stopped)) 455 unreserve_psock(kcm); 456 else 457 return kcm->tx_psock; 458 } 459 460 spin_lock_bh(&mux->lock); 461 462 /* Check again under lock to see if psock was reserved for this 463 * psock via psock_unreserve. 464 */ 465 psock = kcm->tx_psock; 466 if (unlikely(psock)) { 467 WARN_ON(kcm->tx_wait); 468 spin_unlock_bh(&mux->lock); 469 return kcm->tx_psock; 470 } 471 472 if (!list_empty(&mux->psocks_avail)) { 473 psock = list_first_entry(&mux->psocks_avail, 474 struct kcm_psock, 475 psock_avail_list); 476 list_del(&psock->psock_avail_list); 477 if (kcm->tx_wait) { 478 list_del(&kcm->wait_psock_list); 479 kcm->tx_wait = false; 480 } 481 kcm->tx_psock = psock; 482 psock->tx_kcm = kcm; 483 KCM_STATS_INCR(psock->stats.reserved); 484 } else if (!kcm->tx_wait) { 485 list_add_tail(&kcm->wait_psock_list, 486 &mux->kcm_tx_waiters); 487 kcm->tx_wait = true; 488 } 489 490 spin_unlock_bh(&mux->lock); 491 492 return psock; 493 } 494 495 /* mux lock held */ 496 static void psock_now_avail(struct kcm_psock *psock) 497 { 498 struct kcm_mux *mux = psock->mux; 499 struct kcm_sock *kcm; 500 501 if (list_empty(&mux->kcm_tx_waiters)) { 502 list_add_tail(&psock->psock_avail_list, 503 &mux->psocks_avail); 504 } else { 505 kcm = list_first_entry(&mux->kcm_tx_waiters, 506 struct kcm_sock, 507 wait_psock_list); 508 list_del(&kcm->wait_psock_list); 509 kcm->tx_wait = false; 510 psock->tx_kcm = kcm; 511 512 /* Commit before changing tx_psock since that is read in 513 * reserve_psock before queuing work. 514 */ 515 smp_mb(); 516 517 kcm->tx_psock = psock; 518 KCM_STATS_INCR(psock->stats.reserved); 519 queue_work(kcm_wq, &kcm->tx_work); 520 } 521 } 522 523 /* kcm sock is locked. */ 524 static void unreserve_psock(struct kcm_sock *kcm) 525 { 526 struct kcm_psock *psock; 527 struct kcm_mux *mux = kcm->mux; 528 529 spin_lock_bh(&mux->lock); 530 531 psock = kcm->tx_psock; 532 533 if (WARN_ON(!psock)) { 534 spin_unlock_bh(&mux->lock); 535 return; 536 } 537 538 smp_rmb(); /* Read tx_psock before tx_wait */ 539 540 kcm_update_tx_mux_stats(mux, psock); 541 542 WARN_ON(kcm->tx_wait); 543 544 kcm->tx_psock = NULL; 545 psock->tx_kcm = NULL; 546 KCM_STATS_INCR(psock->stats.unreserved); 547 548 if (unlikely(psock->tx_stopped)) { 549 if (psock->done) { 550 /* Deferred free */ 551 list_del(&psock->psock_list); 552 mux->psocks_cnt--; 553 sock_put(psock->sk); 554 fput(psock->sk->sk_socket->file); 555 kmem_cache_free(kcm_psockp, psock); 556 } 557 558 /* Don't put back on available list */ 559 560 spin_unlock_bh(&mux->lock); 561 562 return; 563 } 564 565 psock_now_avail(psock); 566 567 spin_unlock_bh(&mux->lock); 568 } 569 570 static void kcm_report_tx_retry(struct kcm_sock *kcm) 571 { 572 struct kcm_mux *mux = kcm->mux; 573 574 spin_lock_bh(&mux->lock); 575 KCM_STATS_INCR(mux->stats.tx_retries); 576 spin_unlock_bh(&mux->lock); 577 } 578 579 /* Write any messages ready on the kcm socket. Called with kcm sock lock 580 * held. Return bytes actually sent or error. 581 */ 582 static int kcm_write_msgs(struct kcm_sock *kcm) 583 { 584 struct sock *sk = &kcm->sk; 585 struct kcm_psock *psock; 586 struct sk_buff *skb, *head; 587 struct kcm_tx_msg *txm; 588 unsigned short fragidx, frag_offset; 589 unsigned int sent, total_sent = 0; 590 int ret = 0; 591 592 kcm->tx_wait_more = false; 593 psock = kcm->tx_psock; 594 if (unlikely(psock && psock->tx_stopped)) { 595 /* A reserved psock was aborted asynchronously. Unreserve 596 * it and we'll retry the message. 597 */ 598 unreserve_psock(kcm); 599 kcm_report_tx_retry(kcm); 600 if (skb_queue_empty(&sk->sk_write_queue)) 601 return 0; 602 603 kcm_tx_msg(skb_peek(&sk->sk_write_queue))->sent = 0; 604 605 } else if (skb_queue_empty(&sk->sk_write_queue)) { 606 return 0; 607 } 608 609 head = skb_peek(&sk->sk_write_queue); 610 txm = kcm_tx_msg(head); 611 612 if (txm->sent) { 613 /* Send of first skbuff in queue already in progress */ 614 if (WARN_ON(!psock)) { 615 ret = -EINVAL; 616 goto out; 617 } 618 sent = txm->sent; 619 frag_offset = txm->frag_offset; 620 fragidx = txm->fragidx; 621 skb = txm->frag_skb; 622 623 goto do_frag; 624 } 625 626 try_again: 627 psock = reserve_psock(kcm); 628 if (!psock) 629 goto out; 630 631 do { 632 skb = head; 633 txm = kcm_tx_msg(head); 634 sent = 0; 635 636 do_frag_list: 637 if (WARN_ON(!skb_shinfo(skb)->nr_frags)) { 638 ret = -EINVAL; 639 goto out; 640 } 641 642 for (fragidx = 0; fragidx < skb_shinfo(skb)->nr_frags; 643 fragidx++) { 644 skb_frag_t *frag; 645 646 frag_offset = 0; 647 do_frag: 648 frag = &skb_shinfo(skb)->frags[fragidx]; 649 if (WARN_ON(!skb_frag_size(frag))) { 650 ret = -EINVAL; 651 goto out; 652 } 653 654 ret = kernel_sendpage(psock->sk->sk_socket, 655 skb_frag_page(frag), 656 skb_frag_off(frag) + frag_offset, 657 skb_frag_size(frag) - frag_offset, 658 MSG_DONTWAIT); 659 if (ret <= 0) { 660 if (ret == -EAGAIN) { 661 /* Save state to try again when there's 662 * write space on the socket 663 */ 664 txm->sent = sent; 665 txm->frag_offset = frag_offset; 666 txm->fragidx = fragidx; 667 txm->frag_skb = skb; 668 669 ret = 0; 670 goto out; 671 } 672 673 /* Hard failure in sending message, abort this 674 * psock since it has lost framing 675 * synchronization and retry sending the 676 * message from the beginning. 677 */ 678 kcm_abort_tx_psock(psock, ret ? -ret : EPIPE, 679 true); 680 unreserve_psock(kcm); 681 682 txm->sent = 0; 683 kcm_report_tx_retry(kcm); 684 ret = 0; 685 686 goto try_again; 687 } 688 689 sent += ret; 690 frag_offset += ret; 691 KCM_STATS_ADD(psock->stats.tx_bytes, ret); 692 if (frag_offset < skb_frag_size(frag)) { 693 /* Not finished with this frag */ 694 goto do_frag; 695 } 696 } 697 698 if (skb == head) { 699 if (skb_has_frag_list(skb)) { 700 skb = skb_shinfo(skb)->frag_list; 701 goto do_frag_list; 702 } 703 } else if (skb->next) { 704 skb = skb->next; 705 goto do_frag_list; 706 } 707 708 /* Successfully sent the whole packet, account for it. */ 709 skb_dequeue(&sk->sk_write_queue); 710 kfree_skb(head); 711 sk->sk_wmem_queued -= sent; 712 total_sent += sent; 713 KCM_STATS_INCR(psock->stats.tx_msgs); 714 } while ((head = skb_peek(&sk->sk_write_queue))); 715 out: 716 if (!head) { 717 /* Done with all queued messages. */ 718 WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); 719 unreserve_psock(kcm); 720 } 721 722 /* Check if write space is available */ 723 sk->sk_write_space(sk); 724 725 return total_sent ? : ret; 726 } 727 728 static void kcm_tx_work(struct work_struct *w) 729 { 730 struct kcm_sock *kcm = container_of(w, struct kcm_sock, tx_work); 731 struct sock *sk = &kcm->sk; 732 int err; 733 734 lock_sock(sk); 735 736 /* Primarily for SOCK_DGRAM sockets, also handle asynchronous tx 737 * aborts 738 */ 739 err = kcm_write_msgs(kcm); 740 if (err < 0) { 741 /* Hard failure in write, report error on KCM socket */ 742 pr_warn("KCM: Hard failure on kcm_write_msgs %d\n", err); 743 report_csk_error(&kcm->sk, -err); 744 goto out; 745 } 746 747 /* Primarily for SOCK_SEQPACKET sockets */ 748 if (likely(sk->sk_socket) && 749 test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { 750 clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 751 sk->sk_write_space(sk); 752 } 753 754 out: 755 release_sock(sk); 756 } 757 758 static void kcm_push(struct kcm_sock *kcm) 759 { 760 if (kcm->tx_wait_more) 761 kcm_write_msgs(kcm); 762 } 763 764 static ssize_t kcm_sendpage(struct socket *sock, struct page *page, 765 int offset, size_t size, int flags) 766 767 { 768 struct sock *sk = sock->sk; 769 struct kcm_sock *kcm = kcm_sk(sk); 770 struct sk_buff *skb = NULL, *head = NULL; 771 long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT); 772 bool eor; 773 int err = 0; 774 int i; 775 776 if (flags & MSG_SENDPAGE_NOTLAST) 777 flags |= MSG_MORE; 778 779 /* No MSG_EOR from splice, only look at MSG_MORE */ 780 eor = !(flags & MSG_MORE); 781 782 lock_sock(sk); 783 784 sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); 785 786 err = -EPIPE; 787 if (sk->sk_err) 788 goto out_error; 789 790 if (kcm->seq_skb) { 791 /* Previously opened message */ 792 head = kcm->seq_skb; 793 skb = kcm_tx_msg(head)->last_skb; 794 i = skb_shinfo(skb)->nr_frags; 795 796 if (skb_can_coalesce(skb, i, page, offset)) { 797 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], size); 798 skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; 799 goto coalesced; 800 } 801 802 if (i >= MAX_SKB_FRAGS) { 803 struct sk_buff *tskb; 804 805 tskb = alloc_skb(0, sk->sk_allocation); 806 while (!tskb) { 807 kcm_push(kcm); 808 err = sk_stream_wait_memory(sk, &timeo); 809 if (err) 810 goto out_error; 811 } 812 813 if (head == skb) 814 skb_shinfo(head)->frag_list = tskb; 815 else 816 skb->next = tskb; 817 818 skb = tskb; 819 skb->ip_summed = CHECKSUM_UNNECESSARY; 820 i = 0; 821 } 822 } else { 823 /* Call the sk_stream functions to manage the sndbuf mem. */ 824 if (!sk_stream_memory_free(sk)) { 825 kcm_push(kcm); 826 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 827 err = sk_stream_wait_memory(sk, &timeo); 828 if (err) 829 goto out_error; 830 } 831 832 head = alloc_skb(0, sk->sk_allocation); 833 while (!head) { 834 kcm_push(kcm); 835 err = sk_stream_wait_memory(sk, &timeo); 836 if (err) 837 goto out_error; 838 } 839 840 skb = head; 841 i = 0; 842 } 843 844 get_page(page); 845 skb_fill_page_desc_noacc(skb, i, page, offset, size); 846 skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; 847 848 coalesced: 849 skb->len += size; 850 skb->data_len += size; 851 skb->truesize += size; 852 sk->sk_wmem_queued += size; 853 sk_mem_charge(sk, size); 854 855 if (head != skb) { 856 head->len += size; 857 head->data_len += size; 858 head->truesize += size; 859 } 860 861 if (eor) { 862 bool not_busy = skb_queue_empty(&sk->sk_write_queue); 863 864 /* Message complete, queue it on send buffer */ 865 __skb_queue_tail(&sk->sk_write_queue, head); 866 kcm->seq_skb = NULL; 867 KCM_STATS_INCR(kcm->stats.tx_msgs); 868 869 if (flags & MSG_BATCH) { 870 kcm->tx_wait_more = true; 871 } else if (kcm->tx_wait_more || not_busy) { 872 err = kcm_write_msgs(kcm); 873 if (err < 0) { 874 /* We got a hard error in write_msgs but have 875 * already queued this message. Report an error 876 * in the socket, but don't affect return value 877 * from sendmsg 878 */ 879 pr_warn("KCM: Hard failure on kcm_write_msgs\n"); 880 report_csk_error(&kcm->sk, -err); 881 } 882 } 883 } else { 884 /* Message not complete, save state */ 885 kcm->seq_skb = head; 886 kcm_tx_msg(head)->last_skb = skb; 887 } 888 889 KCM_STATS_ADD(kcm->stats.tx_bytes, size); 890 891 release_sock(sk); 892 return size; 893 894 out_error: 895 kcm_push(kcm); 896 897 err = sk_stream_error(sk, flags, err); 898 899 /* make sure we wake any epoll edge trigger waiter */ 900 if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 && err == -EAGAIN)) 901 sk->sk_write_space(sk); 902 903 release_sock(sk); 904 return err; 905 } 906 907 static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 908 { 909 struct sock *sk = sock->sk; 910 struct kcm_sock *kcm = kcm_sk(sk); 911 struct sk_buff *skb = NULL, *head = NULL; 912 size_t copy, copied = 0; 913 long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 914 int eor = (sock->type == SOCK_DGRAM) ? 915 !(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR); 916 int err = -EPIPE; 917 918 lock_sock(sk); 919 920 /* Per tcp_sendmsg this should be in poll */ 921 sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); 922 923 if (sk->sk_err) 924 goto out_error; 925 926 if (kcm->seq_skb) { 927 /* Previously opened message */ 928 head = kcm->seq_skb; 929 skb = kcm_tx_msg(head)->last_skb; 930 goto start; 931 } 932 933 /* Call the sk_stream functions to manage the sndbuf mem. */ 934 if (!sk_stream_memory_free(sk)) { 935 kcm_push(kcm); 936 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 937 err = sk_stream_wait_memory(sk, &timeo); 938 if (err) 939 goto out_error; 940 } 941 942 if (msg_data_left(msg)) { 943 /* New message, alloc head skb */ 944 head = alloc_skb(0, sk->sk_allocation); 945 while (!head) { 946 kcm_push(kcm); 947 err = sk_stream_wait_memory(sk, &timeo); 948 if (err) 949 goto out_error; 950 951 head = alloc_skb(0, sk->sk_allocation); 952 } 953 954 skb = head; 955 956 /* Set ip_summed to CHECKSUM_UNNECESSARY to avoid calling 957 * csum_and_copy_from_iter from skb_do_copy_data_nocache. 958 */ 959 skb->ip_summed = CHECKSUM_UNNECESSARY; 960 } 961 962 start: 963 while (msg_data_left(msg)) { 964 bool merge = true; 965 int i = skb_shinfo(skb)->nr_frags; 966 struct page_frag *pfrag = sk_page_frag(sk); 967 968 if (!sk_page_frag_refill(sk, pfrag)) 969 goto wait_for_memory; 970 971 if (!skb_can_coalesce(skb, i, pfrag->page, 972 pfrag->offset)) { 973 if (i == MAX_SKB_FRAGS) { 974 struct sk_buff *tskb; 975 976 tskb = alloc_skb(0, sk->sk_allocation); 977 if (!tskb) 978 goto wait_for_memory; 979 980 if (head == skb) 981 skb_shinfo(head)->frag_list = tskb; 982 else 983 skb->next = tskb; 984 985 skb = tskb; 986 skb->ip_summed = CHECKSUM_UNNECESSARY; 987 continue; 988 } 989 merge = false; 990 } 991 992 copy = min_t(int, msg_data_left(msg), 993 pfrag->size - pfrag->offset); 994 995 if (!sk_wmem_schedule(sk, copy)) 996 goto wait_for_memory; 997 998 err = skb_copy_to_page_nocache(sk, &msg->msg_iter, skb, 999 pfrag->page, 1000 pfrag->offset, 1001 copy); 1002 if (err) 1003 goto out_error; 1004 1005 /* Update the skb. */ 1006 if (merge) { 1007 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy); 1008 } else { 1009 skb_fill_page_desc(skb, i, pfrag->page, 1010 pfrag->offset, copy); 1011 get_page(pfrag->page); 1012 } 1013 1014 pfrag->offset += copy; 1015 copied += copy; 1016 if (head != skb) { 1017 head->len += copy; 1018 head->data_len += copy; 1019 } 1020 1021 continue; 1022 1023 wait_for_memory: 1024 kcm_push(kcm); 1025 err = sk_stream_wait_memory(sk, &timeo); 1026 if (err) 1027 goto out_error; 1028 } 1029 1030 if (eor) { 1031 bool not_busy = skb_queue_empty(&sk->sk_write_queue); 1032 1033 if (head) { 1034 /* Message complete, queue it on send buffer */ 1035 __skb_queue_tail(&sk->sk_write_queue, head); 1036 kcm->seq_skb = NULL; 1037 KCM_STATS_INCR(kcm->stats.tx_msgs); 1038 } 1039 1040 if (msg->msg_flags & MSG_BATCH) { 1041 kcm->tx_wait_more = true; 1042 } else if (kcm->tx_wait_more || not_busy) { 1043 err = kcm_write_msgs(kcm); 1044 if (err < 0) { 1045 /* We got a hard error in write_msgs but have 1046 * already queued this message. Report an error 1047 * in the socket, but don't affect return value 1048 * from sendmsg 1049 */ 1050 pr_warn("KCM: Hard failure on kcm_write_msgs\n"); 1051 report_csk_error(&kcm->sk, -err); 1052 } 1053 } 1054 } else { 1055 /* Message not complete, save state */ 1056 partial_message: 1057 if (head) { 1058 kcm->seq_skb = head; 1059 kcm_tx_msg(head)->last_skb = skb; 1060 } 1061 } 1062 1063 KCM_STATS_ADD(kcm->stats.tx_bytes, copied); 1064 1065 release_sock(sk); 1066 return copied; 1067 1068 out_error: 1069 kcm_push(kcm); 1070 1071 if (copied && sock->type == SOCK_SEQPACKET) { 1072 /* Wrote some bytes before encountering an 1073 * error, return partial success. 1074 */ 1075 goto partial_message; 1076 } 1077 1078 if (head != kcm->seq_skb) 1079 kfree_skb(head); 1080 1081 err = sk_stream_error(sk, msg->msg_flags, err); 1082 1083 /* make sure we wake any epoll edge trigger waiter */ 1084 if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 && err == -EAGAIN)) 1085 sk->sk_write_space(sk); 1086 1087 release_sock(sk); 1088 return err; 1089 } 1090 1091 static int kcm_recvmsg(struct socket *sock, struct msghdr *msg, 1092 size_t len, int flags) 1093 { 1094 struct sock *sk = sock->sk; 1095 struct kcm_sock *kcm = kcm_sk(sk); 1096 int err = 0; 1097 struct strp_msg *stm; 1098 int copied = 0; 1099 struct sk_buff *skb; 1100 1101 skb = skb_recv_datagram(sk, flags, &err); 1102 if (!skb) 1103 goto out; 1104 1105 /* Okay, have a message on the receive queue */ 1106 1107 stm = strp_msg(skb); 1108 1109 if (len > stm->full_len) 1110 len = stm->full_len; 1111 1112 err = skb_copy_datagram_msg(skb, stm->offset, msg, len); 1113 if (err < 0) 1114 goto out; 1115 1116 copied = len; 1117 if (likely(!(flags & MSG_PEEK))) { 1118 KCM_STATS_ADD(kcm->stats.rx_bytes, copied); 1119 if (copied < stm->full_len) { 1120 if (sock->type == SOCK_DGRAM) { 1121 /* Truncated message */ 1122 msg->msg_flags |= MSG_TRUNC; 1123 goto msg_finished; 1124 } 1125 stm->offset += copied; 1126 stm->full_len -= copied; 1127 } else { 1128 msg_finished: 1129 /* Finished with message */ 1130 msg->msg_flags |= MSG_EOR; 1131 KCM_STATS_INCR(kcm->stats.rx_msgs); 1132 } 1133 } 1134 1135 out: 1136 skb_free_datagram(sk, skb); 1137 return copied ? : err; 1138 } 1139 1140 static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos, 1141 struct pipe_inode_info *pipe, size_t len, 1142 unsigned int flags) 1143 { 1144 struct sock *sk = sock->sk; 1145 struct kcm_sock *kcm = kcm_sk(sk); 1146 struct strp_msg *stm; 1147 int err = 0; 1148 ssize_t copied; 1149 struct sk_buff *skb; 1150 1151 /* Only support splice for SOCKSEQPACKET */ 1152 1153 skb = skb_recv_datagram(sk, flags, &err); 1154 if (!skb) 1155 goto err_out; 1156 1157 /* Okay, have a message on the receive queue */ 1158 1159 stm = strp_msg(skb); 1160 1161 if (len > stm->full_len) 1162 len = stm->full_len; 1163 1164 copied = skb_splice_bits(skb, sk, stm->offset, pipe, len, flags); 1165 if (copied < 0) { 1166 err = copied; 1167 goto err_out; 1168 } 1169 1170 KCM_STATS_ADD(kcm->stats.rx_bytes, copied); 1171 1172 stm->offset += copied; 1173 stm->full_len -= copied; 1174 1175 /* We have no way to return MSG_EOR. If all the bytes have been 1176 * read we still leave the message in the receive socket buffer. 1177 * A subsequent recvmsg needs to be done to return MSG_EOR and 1178 * finish reading the message. 1179 */ 1180 1181 skb_free_datagram(sk, skb); 1182 return copied; 1183 1184 err_out: 1185 skb_free_datagram(sk, skb); 1186 return err; 1187 } 1188 1189 /* kcm sock lock held */ 1190 static void kcm_recv_disable(struct kcm_sock *kcm) 1191 { 1192 struct kcm_mux *mux = kcm->mux; 1193 1194 if (kcm->rx_disabled) 1195 return; 1196 1197 spin_lock_bh(&mux->rx_lock); 1198 1199 kcm->rx_disabled = 1; 1200 1201 /* If a psock is reserved we'll do cleanup in unreserve */ 1202 if (!kcm->rx_psock) { 1203 if (kcm->rx_wait) { 1204 list_del(&kcm->wait_rx_list); 1205 /* paired with lockless reads in kcm_rfree() */ 1206 WRITE_ONCE(kcm->rx_wait, false); 1207 } 1208 1209 requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); 1210 } 1211 1212 spin_unlock_bh(&mux->rx_lock); 1213 } 1214 1215 /* kcm sock lock held */ 1216 static void kcm_recv_enable(struct kcm_sock *kcm) 1217 { 1218 struct kcm_mux *mux = kcm->mux; 1219 1220 if (!kcm->rx_disabled) 1221 return; 1222 1223 spin_lock_bh(&mux->rx_lock); 1224 1225 kcm->rx_disabled = 0; 1226 kcm_rcv_ready(kcm); 1227 1228 spin_unlock_bh(&mux->rx_lock); 1229 } 1230 1231 static int kcm_setsockopt(struct socket *sock, int level, int optname, 1232 sockptr_t optval, unsigned int optlen) 1233 { 1234 struct kcm_sock *kcm = kcm_sk(sock->sk); 1235 int val, valbool; 1236 int err = 0; 1237 1238 if (level != SOL_KCM) 1239 return -ENOPROTOOPT; 1240 1241 if (optlen < sizeof(int)) 1242 return -EINVAL; 1243 1244 if (copy_from_sockptr(&val, optval, sizeof(int))) 1245 return -EFAULT; 1246 1247 valbool = val ? 1 : 0; 1248 1249 switch (optname) { 1250 case KCM_RECV_DISABLE: 1251 lock_sock(&kcm->sk); 1252 if (valbool) 1253 kcm_recv_disable(kcm); 1254 else 1255 kcm_recv_enable(kcm); 1256 release_sock(&kcm->sk); 1257 break; 1258 default: 1259 err = -ENOPROTOOPT; 1260 } 1261 1262 return err; 1263 } 1264 1265 static int kcm_getsockopt(struct socket *sock, int level, int optname, 1266 char __user *optval, int __user *optlen) 1267 { 1268 struct kcm_sock *kcm = kcm_sk(sock->sk); 1269 int val, len; 1270 1271 if (level != SOL_KCM) 1272 return -ENOPROTOOPT; 1273 1274 if (get_user(len, optlen)) 1275 return -EFAULT; 1276 1277 len = min_t(unsigned int, len, sizeof(int)); 1278 if (len < 0) 1279 return -EINVAL; 1280 1281 switch (optname) { 1282 case KCM_RECV_DISABLE: 1283 val = kcm->rx_disabled; 1284 break; 1285 default: 1286 return -ENOPROTOOPT; 1287 } 1288 1289 if (put_user(len, optlen)) 1290 return -EFAULT; 1291 if (copy_to_user(optval, &val, len)) 1292 return -EFAULT; 1293 return 0; 1294 } 1295 1296 static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux) 1297 { 1298 struct kcm_sock *tkcm; 1299 struct list_head *head; 1300 int index = 0; 1301 1302 /* For SOCK_SEQPACKET sock type, datagram_poll checks the sk_state, so 1303 * we set sk_state, otherwise epoll_wait always returns right away with 1304 * EPOLLHUP 1305 */ 1306 kcm->sk.sk_state = TCP_ESTABLISHED; 1307 1308 /* Add to mux's kcm sockets list */ 1309 kcm->mux = mux; 1310 spin_lock_bh(&mux->lock); 1311 1312 head = &mux->kcm_socks; 1313 list_for_each_entry(tkcm, &mux->kcm_socks, kcm_sock_list) { 1314 if (tkcm->index != index) 1315 break; 1316 head = &tkcm->kcm_sock_list; 1317 index++; 1318 } 1319 1320 list_add(&kcm->kcm_sock_list, head); 1321 kcm->index = index; 1322 1323 mux->kcm_socks_cnt++; 1324 spin_unlock_bh(&mux->lock); 1325 1326 INIT_WORK(&kcm->tx_work, kcm_tx_work); 1327 1328 spin_lock_bh(&mux->rx_lock); 1329 kcm_rcv_ready(kcm); 1330 spin_unlock_bh(&mux->rx_lock); 1331 } 1332 1333 static int kcm_attach(struct socket *sock, struct socket *csock, 1334 struct bpf_prog *prog) 1335 { 1336 struct kcm_sock *kcm = kcm_sk(sock->sk); 1337 struct kcm_mux *mux = kcm->mux; 1338 struct sock *csk; 1339 struct kcm_psock *psock = NULL, *tpsock; 1340 struct list_head *head; 1341 int index = 0; 1342 static const struct strp_callbacks cb = { 1343 .rcv_msg = kcm_rcv_strparser, 1344 .parse_msg = kcm_parse_func_strparser, 1345 .read_sock_done = kcm_read_sock_done, 1346 }; 1347 int err = 0; 1348 1349 csk = csock->sk; 1350 if (!csk) 1351 return -EINVAL; 1352 1353 lock_sock(csk); 1354 1355 /* Only allow TCP sockets to be attached for now */ 1356 if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) || 1357 csk->sk_protocol != IPPROTO_TCP) { 1358 err = -EOPNOTSUPP; 1359 goto out; 1360 } 1361 1362 /* Don't allow listeners or closed sockets */ 1363 if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) { 1364 err = -EOPNOTSUPP; 1365 goto out; 1366 } 1367 1368 psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); 1369 if (!psock) { 1370 err = -ENOMEM; 1371 goto out; 1372 } 1373 1374 psock->mux = mux; 1375 psock->sk = csk; 1376 psock->bpf_prog = prog; 1377 1378 write_lock_bh(&csk->sk_callback_lock); 1379 1380 /* Check if sk_user_data is already by KCM or someone else. 1381 * Must be done under lock to prevent race conditions. 1382 */ 1383 if (csk->sk_user_data) { 1384 write_unlock_bh(&csk->sk_callback_lock); 1385 kmem_cache_free(kcm_psockp, psock); 1386 err = -EALREADY; 1387 goto out; 1388 } 1389 1390 err = strp_init(&psock->strp, csk, &cb); 1391 if (err) { 1392 write_unlock_bh(&csk->sk_callback_lock); 1393 kmem_cache_free(kcm_psockp, psock); 1394 goto out; 1395 } 1396 1397 psock->save_data_ready = csk->sk_data_ready; 1398 psock->save_write_space = csk->sk_write_space; 1399 psock->save_state_change = csk->sk_state_change; 1400 csk->sk_user_data = psock; 1401 csk->sk_data_ready = psock_data_ready; 1402 csk->sk_write_space = psock_write_space; 1403 csk->sk_state_change = psock_state_change; 1404 1405 write_unlock_bh(&csk->sk_callback_lock); 1406 1407 sock_hold(csk); 1408 1409 /* Finished initialization, now add the psock to the MUX. */ 1410 spin_lock_bh(&mux->lock); 1411 head = &mux->psocks; 1412 list_for_each_entry(tpsock, &mux->psocks, psock_list) { 1413 if (tpsock->index != index) 1414 break; 1415 head = &tpsock->psock_list; 1416 index++; 1417 } 1418 1419 list_add(&psock->psock_list, head); 1420 psock->index = index; 1421 1422 KCM_STATS_INCR(mux->stats.psock_attach); 1423 mux->psocks_cnt++; 1424 psock_now_avail(psock); 1425 spin_unlock_bh(&mux->lock); 1426 1427 /* Schedule RX work in case there are already bytes queued */ 1428 strp_check_rcv(&psock->strp); 1429 1430 out: 1431 release_sock(csk); 1432 1433 return err; 1434 } 1435 1436 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info) 1437 { 1438 struct socket *csock; 1439 struct bpf_prog *prog; 1440 int err; 1441 1442 csock = sockfd_lookup(info->fd, &err); 1443 if (!csock) 1444 return -ENOENT; 1445 1446 prog = bpf_prog_get_type(info->bpf_fd, BPF_PROG_TYPE_SOCKET_FILTER); 1447 if (IS_ERR(prog)) { 1448 err = PTR_ERR(prog); 1449 goto out; 1450 } 1451 1452 err = kcm_attach(sock, csock, prog); 1453 if (err) { 1454 bpf_prog_put(prog); 1455 goto out; 1456 } 1457 1458 /* Keep reference on file also */ 1459 1460 return 0; 1461 out: 1462 sockfd_put(csock); 1463 return err; 1464 } 1465 1466 static void kcm_unattach(struct kcm_psock *psock) 1467 { 1468 struct sock *csk = psock->sk; 1469 struct kcm_mux *mux = psock->mux; 1470 1471 lock_sock(csk); 1472 1473 /* Stop getting callbacks from TCP socket. After this there should 1474 * be no way to reserve a kcm for this psock. 1475 */ 1476 write_lock_bh(&csk->sk_callback_lock); 1477 csk->sk_user_data = NULL; 1478 csk->sk_data_ready = psock->save_data_ready; 1479 csk->sk_write_space = psock->save_write_space; 1480 csk->sk_state_change = psock->save_state_change; 1481 strp_stop(&psock->strp); 1482 1483 if (WARN_ON(psock->rx_kcm)) { 1484 write_unlock_bh(&csk->sk_callback_lock); 1485 release_sock(csk); 1486 return; 1487 } 1488 1489 spin_lock_bh(&mux->rx_lock); 1490 1491 /* Stop receiver activities. After this point psock should not be 1492 * able to get onto ready list either through callbacks or work. 1493 */ 1494 if (psock->ready_rx_msg) { 1495 list_del(&psock->psock_ready_list); 1496 kfree_skb(psock->ready_rx_msg); 1497 psock->ready_rx_msg = NULL; 1498 KCM_STATS_INCR(mux->stats.rx_ready_drops); 1499 } 1500 1501 spin_unlock_bh(&mux->rx_lock); 1502 1503 write_unlock_bh(&csk->sk_callback_lock); 1504 1505 /* Call strp_done without sock lock */ 1506 release_sock(csk); 1507 strp_done(&psock->strp); 1508 lock_sock(csk); 1509 1510 bpf_prog_put(psock->bpf_prog); 1511 1512 spin_lock_bh(&mux->lock); 1513 1514 aggregate_psock_stats(&psock->stats, &mux->aggregate_psock_stats); 1515 save_strp_stats(&psock->strp, &mux->aggregate_strp_stats); 1516 1517 KCM_STATS_INCR(mux->stats.psock_unattach); 1518 1519 if (psock->tx_kcm) { 1520 /* psock was reserved. Just mark it finished and we will clean 1521 * up in the kcm paths, we need kcm lock which can not be 1522 * acquired here. 1523 */ 1524 KCM_STATS_INCR(mux->stats.psock_unattach_rsvd); 1525 spin_unlock_bh(&mux->lock); 1526 1527 /* We are unattaching a socket that is reserved. Abort the 1528 * socket since we may be out of sync in sending on it. We need 1529 * to do this without the mux lock. 1530 */ 1531 kcm_abort_tx_psock(psock, EPIPE, false); 1532 1533 spin_lock_bh(&mux->lock); 1534 if (!psock->tx_kcm) { 1535 /* psock now unreserved in window mux was unlocked */ 1536 goto no_reserved; 1537 } 1538 psock->done = 1; 1539 1540 /* Commit done before queuing work to process it */ 1541 smp_mb(); 1542 1543 /* Queue tx work to make sure psock->done is handled */ 1544 queue_work(kcm_wq, &psock->tx_kcm->tx_work); 1545 spin_unlock_bh(&mux->lock); 1546 } else { 1547 no_reserved: 1548 if (!psock->tx_stopped) 1549 list_del(&psock->psock_avail_list); 1550 list_del(&psock->psock_list); 1551 mux->psocks_cnt--; 1552 spin_unlock_bh(&mux->lock); 1553 1554 sock_put(csk); 1555 fput(csk->sk_socket->file); 1556 kmem_cache_free(kcm_psockp, psock); 1557 } 1558 1559 release_sock(csk); 1560 } 1561 1562 static int kcm_unattach_ioctl(struct socket *sock, struct kcm_unattach *info) 1563 { 1564 struct kcm_sock *kcm = kcm_sk(sock->sk); 1565 struct kcm_mux *mux = kcm->mux; 1566 struct kcm_psock *psock; 1567 struct socket *csock; 1568 struct sock *csk; 1569 int err; 1570 1571 csock = sockfd_lookup(info->fd, &err); 1572 if (!csock) 1573 return -ENOENT; 1574 1575 csk = csock->sk; 1576 if (!csk) { 1577 err = -EINVAL; 1578 goto out; 1579 } 1580 1581 err = -ENOENT; 1582 1583 spin_lock_bh(&mux->lock); 1584 1585 list_for_each_entry(psock, &mux->psocks, psock_list) { 1586 if (psock->sk != csk) 1587 continue; 1588 1589 /* Found the matching psock */ 1590 1591 if (psock->unattaching || WARN_ON(psock->done)) { 1592 err = -EALREADY; 1593 break; 1594 } 1595 1596 psock->unattaching = 1; 1597 1598 spin_unlock_bh(&mux->lock); 1599 1600 /* Lower socket lock should already be held */ 1601 kcm_unattach(psock); 1602 1603 err = 0; 1604 goto out; 1605 } 1606 1607 spin_unlock_bh(&mux->lock); 1608 1609 out: 1610 sockfd_put(csock); 1611 return err; 1612 } 1613 1614 static struct proto kcm_proto = { 1615 .name = "KCM", 1616 .owner = THIS_MODULE, 1617 .obj_size = sizeof(struct kcm_sock), 1618 }; 1619 1620 /* Clone a kcm socket. */ 1621 static struct file *kcm_clone(struct socket *osock) 1622 { 1623 struct socket *newsock; 1624 struct sock *newsk; 1625 1626 newsock = sock_alloc(); 1627 if (!newsock) 1628 return ERR_PTR(-ENFILE); 1629 1630 newsock->type = osock->type; 1631 newsock->ops = osock->ops; 1632 1633 __module_get(newsock->ops->owner); 1634 1635 newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL, 1636 &kcm_proto, false); 1637 if (!newsk) { 1638 sock_release(newsock); 1639 return ERR_PTR(-ENOMEM); 1640 } 1641 sock_init_data(newsock, newsk); 1642 init_kcm_sock(kcm_sk(newsk), kcm_sk(osock->sk)->mux); 1643 1644 return sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name); 1645 } 1646 1647 static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 1648 { 1649 int err; 1650 1651 switch (cmd) { 1652 case SIOCKCMATTACH: { 1653 struct kcm_attach info; 1654 1655 if (copy_from_user(&info, (void __user *)arg, sizeof(info))) 1656 return -EFAULT; 1657 1658 err = kcm_attach_ioctl(sock, &info); 1659 1660 break; 1661 } 1662 case SIOCKCMUNATTACH: { 1663 struct kcm_unattach info; 1664 1665 if (copy_from_user(&info, (void __user *)arg, sizeof(info))) 1666 return -EFAULT; 1667 1668 err = kcm_unattach_ioctl(sock, &info); 1669 1670 break; 1671 } 1672 case SIOCKCMCLONE: { 1673 struct kcm_clone info; 1674 struct file *file; 1675 1676 info.fd = get_unused_fd_flags(0); 1677 if (unlikely(info.fd < 0)) 1678 return info.fd; 1679 1680 file = kcm_clone(sock); 1681 if (IS_ERR(file)) { 1682 put_unused_fd(info.fd); 1683 return PTR_ERR(file); 1684 } 1685 if (copy_to_user((void __user *)arg, &info, 1686 sizeof(info))) { 1687 put_unused_fd(info.fd); 1688 fput(file); 1689 return -EFAULT; 1690 } 1691 fd_install(info.fd, file); 1692 err = 0; 1693 break; 1694 } 1695 default: 1696 err = -ENOIOCTLCMD; 1697 break; 1698 } 1699 1700 return err; 1701 } 1702 1703 static void free_mux(struct rcu_head *rcu) 1704 { 1705 struct kcm_mux *mux = container_of(rcu, 1706 struct kcm_mux, rcu); 1707 1708 kmem_cache_free(kcm_muxp, mux); 1709 } 1710 1711 static void release_mux(struct kcm_mux *mux) 1712 { 1713 struct kcm_net *knet = mux->knet; 1714 struct kcm_psock *psock, *tmp_psock; 1715 1716 /* Release psocks */ 1717 list_for_each_entry_safe(psock, tmp_psock, 1718 &mux->psocks, psock_list) { 1719 if (!WARN_ON(psock->unattaching)) 1720 kcm_unattach(psock); 1721 } 1722 1723 if (WARN_ON(mux->psocks_cnt)) 1724 return; 1725 1726 __skb_queue_purge(&mux->rx_hold_queue); 1727 1728 mutex_lock(&knet->mutex); 1729 aggregate_mux_stats(&mux->stats, &knet->aggregate_mux_stats); 1730 aggregate_psock_stats(&mux->aggregate_psock_stats, 1731 &knet->aggregate_psock_stats); 1732 aggregate_strp_stats(&mux->aggregate_strp_stats, 1733 &knet->aggregate_strp_stats); 1734 list_del_rcu(&mux->kcm_mux_list); 1735 knet->count--; 1736 mutex_unlock(&knet->mutex); 1737 1738 call_rcu(&mux->rcu, free_mux); 1739 } 1740 1741 static void kcm_done(struct kcm_sock *kcm) 1742 { 1743 struct kcm_mux *mux = kcm->mux; 1744 struct sock *sk = &kcm->sk; 1745 int socks_cnt; 1746 1747 spin_lock_bh(&mux->rx_lock); 1748 if (kcm->rx_psock) { 1749 /* Cleanup in unreserve_rx_kcm */ 1750 WARN_ON(kcm->done); 1751 kcm->rx_disabled = 1; 1752 kcm->done = 1; 1753 spin_unlock_bh(&mux->rx_lock); 1754 return; 1755 } 1756 1757 if (kcm->rx_wait) { 1758 list_del(&kcm->wait_rx_list); 1759 /* paired with lockless reads in kcm_rfree() */ 1760 WRITE_ONCE(kcm->rx_wait, false); 1761 } 1762 /* Move any pending receive messages to other kcm sockets */ 1763 requeue_rx_msgs(mux, &sk->sk_receive_queue); 1764 1765 spin_unlock_bh(&mux->rx_lock); 1766 1767 if (WARN_ON(sk_rmem_alloc_get(sk))) 1768 return; 1769 1770 /* Detach from MUX */ 1771 spin_lock_bh(&mux->lock); 1772 1773 list_del(&kcm->kcm_sock_list); 1774 mux->kcm_socks_cnt--; 1775 socks_cnt = mux->kcm_socks_cnt; 1776 1777 spin_unlock_bh(&mux->lock); 1778 1779 if (!socks_cnt) { 1780 /* We are done with the mux now. */ 1781 release_mux(mux); 1782 } 1783 1784 WARN_ON(kcm->rx_wait); 1785 1786 sock_put(&kcm->sk); 1787 } 1788 1789 /* Called by kcm_release to close a KCM socket. 1790 * If this is the last KCM socket on the MUX, destroy the MUX. 1791 */ 1792 static int kcm_release(struct socket *sock) 1793 { 1794 struct sock *sk = sock->sk; 1795 struct kcm_sock *kcm; 1796 struct kcm_mux *mux; 1797 struct kcm_psock *psock; 1798 1799 if (!sk) 1800 return 0; 1801 1802 kcm = kcm_sk(sk); 1803 mux = kcm->mux; 1804 1805 lock_sock(sk); 1806 sock_orphan(sk); 1807 kfree_skb(kcm->seq_skb); 1808 1809 /* Purge queue under lock to avoid race condition with tx_work trying 1810 * to act when queue is nonempty. If tx_work runs after this point 1811 * it will just return. 1812 */ 1813 __skb_queue_purge(&sk->sk_write_queue); 1814 1815 /* Set tx_stopped. This is checked when psock is bound to a kcm and we 1816 * get a writespace callback. This prevents further work being queued 1817 * from the callback (unbinding the psock occurs after canceling work. 1818 */ 1819 kcm->tx_stopped = 1; 1820 1821 release_sock(sk); 1822 1823 spin_lock_bh(&mux->lock); 1824 if (kcm->tx_wait) { 1825 /* Take of tx_wait list, after this point there should be no way 1826 * that a psock will be assigned to this kcm. 1827 */ 1828 list_del(&kcm->wait_psock_list); 1829 kcm->tx_wait = false; 1830 } 1831 spin_unlock_bh(&mux->lock); 1832 1833 /* Cancel work. After this point there should be no outside references 1834 * to the kcm socket. 1835 */ 1836 cancel_work_sync(&kcm->tx_work); 1837 1838 lock_sock(sk); 1839 psock = kcm->tx_psock; 1840 if (psock) { 1841 /* A psock was reserved, so we need to kill it since it 1842 * may already have some bytes queued from a message. We 1843 * need to do this after removing kcm from tx_wait list. 1844 */ 1845 kcm_abort_tx_psock(psock, EPIPE, false); 1846 unreserve_psock(kcm); 1847 } 1848 release_sock(sk); 1849 1850 WARN_ON(kcm->tx_wait); 1851 WARN_ON(kcm->tx_psock); 1852 1853 sock->sk = NULL; 1854 1855 kcm_done(kcm); 1856 1857 return 0; 1858 } 1859 1860 static const struct proto_ops kcm_dgram_ops = { 1861 .family = PF_KCM, 1862 .owner = THIS_MODULE, 1863 .release = kcm_release, 1864 .bind = sock_no_bind, 1865 .connect = sock_no_connect, 1866 .socketpair = sock_no_socketpair, 1867 .accept = sock_no_accept, 1868 .getname = sock_no_getname, 1869 .poll = datagram_poll, 1870 .ioctl = kcm_ioctl, 1871 .listen = sock_no_listen, 1872 .shutdown = sock_no_shutdown, 1873 .setsockopt = kcm_setsockopt, 1874 .getsockopt = kcm_getsockopt, 1875 .sendmsg = kcm_sendmsg, 1876 .recvmsg = kcm_recvmsg, 1877 .mmap = sock_no_mmap, 1878 .sendpage = kcm_sendpage, 1879 }; 1880 1881 static const struct proto_ops kcm_seqpacket_ops = { 1882 .family = PF_KCM, 1883 .owner = THIS_MODULE, 1884 .release = kcm_release, 1885 .bind = sock_no_bind, 1886 .connect = sock_no_connect, 1887 .socketpair = sock_no_socketpair, 1888 .accept = sock_no_accept, 1889 .getname = sock_no_getname, 1890 .poll = datagram_poll, 1891 .ioctl = kcm_ioctl, 1892 .listen = sock_no_listen, 1893 .shutdown = sock_no_shutdown, 1894 .setsockopt = kcm_setsockopt, 1895 .getsockopt = kcm_getsockopt, 1896 .sendmsg = kcm_sendmsg, 1897 .recvmsg = kcm_recvmsg, 1898 .mmap = sock_no_mmap, 1899 .sendpage = kcm_sendpage, 1900 .splice_read = kcm_splice_read, 1901 }; 1902 1903 /* Create proto operation for kcm sockets */ 1904 static int kcm_create(struct net *net, struct socket *sock, 1905 int protocol, int kern) 1906 { 1907 struct kcm_net *knet = net_generic(net, kcm_net_id); 1908 struct sock *sk; 1909 struct kcm_mux *mux; 1910 1911 switch (sock->type) { 1912 case SOCK_DGRAM: 1913 sock->ops = &kcm_dgram_ops; 1914 break; 1915 case SOCK_SEQPACKET: 1916 sock->ops = &kcm_seqpacket_ops; 1917 break; 1918 default: 1919 return -ESOCKTNOSUPPORT; 1920 } 1921 1922 if (protocol != KCMPROTO_CONNECTED) 1923 return -EPROTONOSUPPORT; 1924 1925 sk = sk_alloc(net, PF_KCM, GFP_KERNEL, &kcm_proto, kern); 1926 if (!sk) 1927 return -ENOMEM; 1928 1929 /* Allocate a kcm mux, shared between KCM sockets */ 1930 mux = kmem_cache_zalloc(kcm_muxp, GFP_KERNEL); 1931 if (!mux) { 1932 sk_free(sk); 1933 return -ENOMEM; 1934 } 1935 1936 spin_lock_init(&mux->lock); 1937 spin_lock_init(&mux->rx_lock); 1938 INIT_LIST_HEAD(&mux->kcm_socks); 1939 INIT_LIST_HEAD(&mux->kcm_rx_waiters); 1940 INIT_LIST_HEAD(&mux->kcm_tx_waiters); 1941 1942 INIT_LIST_HEAD(&mux->psocks); 1943 INIT_LIST_HEAD(&mux->psocks_ready); 1944 INIT_LIST_HEAD(&mux->psocks_avail); 1945 1946 mux->knet = knet; 1947 1948 /* Add new MUX to list */ 1949 mutex_lock(&knet->mutex); 1950 list_add_rcu(&mux->kcm_mux_list, &knet->mux_list); 1951 knet->count++; 1952 mutex_unlock(&knet->mutex); 1953 1954 skb_queue_head_init(&mux->rx_hold_queue); 1955 1956 /* Init KCM socket */ 1957 sock_init_data(sock, sk); 1958 init_kcm_sock(kcm_sk(sk), mux); 1959 1960 return 0; 1961 } 1962 1963 static const struct net_proto_family kcm_family_ops = { 1964 .family = PF_KCM, 1965 .create = kcm_create, 1966 .owner = THIS_MODULE, 1967 }; 1968 1969 static __net_init int kcm_init_net(struct net *net) 1970 { 1971 struct kcm_net *knet = net_generic(net, kcm_net_id); 1972 1973 INIT_LIST_HEAD_RCU(&knet->mux_list); 1974 mutex_init(&knet->mutex); 1975 1976 return 0; 1977 } 1978 1979 static __net_exit void kcm_exit_net(struct net *net) 1980 { 1981 struct kcm_net *knet = net_generic(net, kcm_net_id); 1982 1983 /* All KCM sockets should be closed at this point, which should mean 1984 * that all multiplexors and psocks have been destroyed. 1985 */ 1986 WARN_ON(!list_empty(&knet->mux_list)); 1987 } 1988 1989 static struct pernet_operations kcm_net_ops = { 1990 .init = kcm_init_net, 1991 .exit = kcm_exit_net, 1992 .id = &kcm_net_id, 1993 .size = sizeof(struct kcm_net), 1994 }; 1995 1996 static int __init kcm_init(void) 1997 { 1998 int err = -ENOMEM; 1999 2000 kcm_muxp = kmem_cache_create("kcm_mux_cache", 2001 sizeof(struct kcm_mux), 0, 2002 SLAB_HWCACHE_ALIGN, NULL); 2003 if (!kcm_muxp) 2004 goto fail; 2005 2006 kcm_psockp = kmem_cache_create("kcm_psock_cache", 2007 sizeof(struct kcm_psock), 0, 2008 SLAB_HWCACHE_ALIGN, NULL); 2009 if (!kcm_psockp) 2010 goto fail; 2011 2012 kcm_wq = create_singlethread_workqueue("kkcmd"); 2013 if (!kcm_wq) 2014 goto fail; 2015 2016 err = proto_register(&kcm_proto, 1); 2017 if (err) 2018 goto fail; 2019 2020 err = register_pernet_device(&kcm_net_ops); 2021 if (err) 2022 goto net_ops_fail; 2023 2024 err = sock_register(&kcm_family_ops); 2025 if (err) 2026 goto sock_register_fail; 2027 2028 err = kcm_proc_init(); 2029 if (err) 2030 goto proc_init_fail; 2031 2032 return 0; 2033 2034 proc_init_fail: 2035 sock_unregister(PF_KCM); 2036 2037 sock_register_fail: 2038 unregister_pernet_device(&kcm_net_ops); 2039 2040 net_ops_fail: 2041 proto_unregister(&kcm_proto); 2042 2043 fail: 2044 kmem_cache_destroy(kcm_muxp); 2045 kmem_cache_destroy(kcm_psockp); 2046 2047 if (kcm_wq) 2048 destroy_workqueue(kcm_wq); 2049 2050 return err; 2051 } 2052 2053 static void __exit kcm_exit(void) 2054 { 2055 kcm_proc_exit(); 2056 sock_unregister(PF_KCM); 2057 unregister_pernet_device(&kcm_net_ops); 2058 proto_unregister(&kcm_proto); 2059 destroy_workqueue(kcm_wq); 2060 2061 kmem_cache_destroy(kcm_muxp); 2062 kmem_cache_destroy(kcm_psockp); 2063 } 2064 2065 module_init(kcm_init); 2066 module_exit(kcm_exit); 2067 2068 MODULE_LICENSE("GPL"); 2069 MODULE_ALIAS_NETPROTO(PF_KCM); 2070