1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Kernel Connection Multiplexor 4 * 5 * Copyright (c) 2016 Tom Herbert <tom@herbertland.com> 6 */ 7 8 #include <linux/bpf.h> 9 #include <linux/errno.h> 10 #include <linux/errqueue.h> 11 #include <linux/file.h> 12 #include <linux/filter.h> 13 #include <linux/in.h> 14 #include <linux/kernel.h> 15 #include <linux/module.h> 16 #include <linux/net.h> 17 #include <linux/netdevice.h> 18 #include <linux/poll.h> 19 #include <linux/rculist.h> 20 #include <linux/skbuff.h> 21 #include <linux/socket.h> 22 #include <linux/uaccess.h> 23 #include <linux/workqueue.h> 24 #include <linux/syscalls.h> 25 #include <linux/sched/signal.h> 26 27 #include <net/kcm.h> 28 #include <net/netns/generic.h> 29 #include <net/sock.h> 30 #include <uapi/linux/kcm.h> 31 32 unsigned int kcm_net_id; 33 34 static struct kmem_cache *kcm_psockp __read_mostly; 35 static struct kmem_cache *kcm_muxp __read_mostly; 36 static struct workqueue_struct *kcm_wq; 37 38 static inline struct kcm_sock *kcm_sk(const struct sock *sk) 39 { 40 return (struct kcm_sock *)sk; 41 } 42 43 static inline struct kcm_tx_msg *kcm_tx_msg(struct sk_buff *skb) 44 { 45 return (struct kcm_tx_msg *)skb->cb; 46 } 47 48 static void report_csk_error(struct sock *csk, int err) 49 { 50 csk->sk_err = EPIPE; 51 sk_error_report(csk); 52 } 53 54 static void kcm_abort_tx_psock(struct kcm_psock *psock, int err, 55 bool wakeup_kcm) 56 { 57 struct sock *csk = psock->sk; 58 struct kcm_mux *mux = psock->mux; 59 60 /* Unrecoverable error in transmit */ 61 62 spin_lock_bh(&mux->lock); 63 64 if (psock->tx_stopped) { 65 spin_unlock_bh(&mux->lock); 66 return; 67 } 68 69 psock->tx_stopped = 1; 70 KCM_STATS_INCR(psock->stats.tx_aborts); 71 72 if (!psock->tx_kcm) { 73 /* Take off psocks_avail list */ 74 list_del(&psock->psock_avail_list); 75 } else if (wakeup_kcm) { 76 /* In this case psock is being aborted while outside of 77 * write_msgs and psock is reserved. Schedule tx_work 78 * to handle the failure there. Need to commit tx_stopped 79 * before queuing work. 80 */ 81 smp_mb(); 82 83 queue_work(kcm_wq, &psock->tx_kcm->tx_work); 84 } 85 86 spin_unlock_bh(&mux->lock); 87 88 /* Report error on lower socket */ 89 report_csk_error(csk, err); 90 } 91 92 /* RX mux lock held. */ 93 static void kcm_update_rx_mux_stats(struct kcm_mux *mux, 94 struct kcm_psock *psock) 95 { 96 STRP_STATS_ADD(mux->stats.rx_bytes, 97 psock->strp.stats.bytes - 98 psock->saved_rx_bytes); 99 mux->stats.rx_msgs += 100 psock->strp.stats.msgs - psock->saved_rx_msgs; 101 psock->saved_rx_msgs = psock->strp.stats.msgs; 102 psock->saved_rx_bytes = psock->strp.stats.bytes; 103 } 104 105 static void kcm_update_tx_mux_stats(struct kcm_mux *mux, 106 struct kcm_psock *psock) 107 { 108 KCM_STATS_ADD(mux->stats.tx_bytes, 109 psock->stats.tx_bytes - psock->saved_tx_bytes); 110 mux->stats.tx_msgs += 111 psock->stats.tx_msgs - psock->saved_tx_msgs; 112 psock->saved_tx_msgs = psock->stats.tx_msgs; 113 psock->saved_tx_bytes = psock->stats.tx_bytes; 114 } 115 116 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); 117 118 /* KCM is ready to receive messages on its queue-- either the KCM is new or 119 * has become unblocked after being blocked on full socket buffer. Queue any 120 * pending ready messages on a psock. RX mux lock held. 121 */ 122 static void kcm_rcv_ready(struct kcm_sock *kcm) 123 { 124 struct kcm_mux *mux = kcm->mux; 125 struct kcm_psock *psock; 126 struct sk_buff *skb; 127 128 if (unlikely(kcm->rx_wait || kcm->rx_psock || kcm->rx_disabled)) 129 return; 130 131 while (unlikely((skb = __skb_dequeue(&mux->rx_hold_queue)))) { 132 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 133 /* Assuming buffer limit has been reached */ 134 skb_queue_head(&mux->rx_hold_queue, skb); 135 WARN_ON(!sk_rmem_alloc_get(&kcm->sk)); 136 return; 137 } 138 } 139 140 while (!list_empty(&mux->psocks_ready)) { 141 psock = list_first_entry(&mux->psocks_ready, struct kcm_psock, 142 psock_ready_list); 143 144 if (kcm_queue_rcv_skb(&kcm->sk, psock->ready_rx_msg)) { 145 /* Assuming buffer limit has been reached */ 146 WARN_ON(!sk_rmem_alloc_get(&kcm->sk)); 147 return; 148 } 149 150 /* Consumed the ready message on the psock. Schedule rx_work to 151 * get more messages. 152 */ 153 list_del(&psock->psock_ready_list); 154 psock->ready_rx_msg = NULL; 155 /* Commit clearing of ready_rx_msg for queuing work */ 156 smp_mb(); 157 158 strp_unpause(&psock->strp); 159 strp_check_rcv(&psock->strp); 160 } 161 162 /* Buffer limit is okay now, add to ready list */ 163 list_add_tail(&kcm->wait_rx_list, 164 &kcm->mux->kcm_rx_waiters); 165 /* paired with lockless reads in kcm_rfree() */ 166 WRITE_ONCE(kcm->rx_wait, true); 167 } 168 169 static void kcm_rfree(struct sk_buff *skb) 170 { 171 struct sock *sk = skb->sk; 172 struct kcm_sock *kcm = kcm_sk(sk); 173 struct kcm_mux *mux = kcm->mux; 174 unsigned int len = skb->truesize; 175 176 sk_mem_uncharge(sk, len); 177 atomic_sub(len, &sk->sk_rmem_alloc); 178 179 /* For reading rx_wait and rx_psock without holding lock */ 180 smp_mb__after_atomic(); 181 182 if (!READ_ONCE(kcm->rx_wait) && !READ_ONCE(kcm->rx_psock) && 183 sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) { 184 spin_lock_bh(&mux->rx_lock); 185 kcm_rcv_ready(kcm); 186 spin_unlock_bh(&mux->rx_lock); 187 } 188 } 189 190 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 191 { 192 struct sk_buff_head *list = &sk->sk_receive_queue; 193 194 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 195 return -ENOMEM; 196 197 if (!sk_rmem_schedule(sk, skb, skb->truesize)) 198 return -ENOBUFS; 199 200 skb->dev = NULL; 201 202 skb_orphan(skb); 203 skb->sk = sk; 204 skb->destructor = kcm_rfree; 205 atomic_add(skb->truesize, &sk->sk_rmem_alloc); 206 sk_mem_charge(sk, skb->truesize); 207 208 skb_queue_tail(list, skb); 209 210 if (!sock_flag(sk, SOCK_DEAD)) 211 sk->sk_data_ready(sk); 212 213 return 0; 214 } 215 216 /* Requeue received messages for a kcm socket to other kcm sockets. This is 217 * called with a kcm socket is receive disabled. 218 * RX mux lock held. 219 */ 220 static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head) 221 { 222 struct sk_buff *skb; 223 struct kcm_sock *kcm; 224 225 while ((skb = __skb_dequeue(head))) { 226 /* Reset destructor to avoid calling kcm_rcv_ready */ 227 skb->destructor = sock_rfree; 228 skb_orphan(skb); 229 try_again: 230 if (list_empty(&mux->kcm_rx_waiters)) { 231 skb_queue_tail(&mux->rx_hold_queue, skb); 232 continue; 233 } 234 235 kcm = list_first_entry(&mux->kcm_rx_waiters, 236 struct kcm_sock, wait_rx_list); 237 238 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 239 /* Should mean socket buffer full */ 240 list_del(&kcm->wait_rx_list); 241 /* paired with lockless reads in kcm_rfree() */ 242 WRITE_ONCE(kcm->rx_wait, false); 243 244 /* Commit rx_wait to read in kcm_free */ 245 smp_wmb(); 246 247 goto try_again; 248 } 249 } 250 } 251 252 /* Lower sock lock held */ 253 static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, 254 struct sk_buff *head) 255 { 256 struct kcm_mux *mux = psock->mux; 257 struct kcm_sock *kcm; 258 259 WARN_ON(psock->ready_rx_msg); 260 261 if (psock->rx_kcm) 262 return psock->rx_kcm; 263 264 spin_lock_bh(&mux->rx_lock); 265 266 if (psock->rx_kcm) { 267 spin_unlock_bh(&mux->rx_lock); 268 return psock->rx_kcm; 269 } 270 271 kcm_update_rx_mux_stats(mux, psock); 272 273 if (list_empty(&mux->kcm_rx_waiters)) { 274 psock->ready_rx_msg = head; 275 strp_pause(&psock->strp); 276 list_add_tail(&psock->psock_ready_list, 277 &mux->psocks_ready); 278 spin_unlock_bh(&mux->rx_lock); 279 return NULL; 280 } 281 282 kcm = list_first_entry(&mux->kcm_rx_waiters, 283 struct kcm_sock, wait_rx_list); 284 list_del(&kcm->wait_rx_list); 285 /* paired with lockless reads in kcm_rfree() */ 286 WRITE_ONCE(kcm->rx_wait, false); 287 288 psock->rx_kcm = kcm; 289 /* paired with lockless reads in kcm_rfree() */ 290 WRITE_ONCE(kcm->rx_psock, psock); 291 292 spin_unlock_bh(&mux->rx_lock); 293 294 return kcm; 295 } 296 297 static void kcm_done(struct kcm_sock *kcm); 298 299 static void kcm_done_work(struct work_struct *w) 300 { 301 kcm_done(container_of(w, struct kcm_sock, done_work)); 302 } 303 304 /* Lower sock held */ 305 static void unreserve_rx_kcm(struct kcm_psock *psock, 306 bool rcv_ready) 307 { 308 struct kcm_sock *kcm = psock->rx_kcm; 309 struct kcm_mux *mux = psock->mux; 310 311 if (!kcm) 312 return; 313 314 spin_lock_bh(&mux->rx_lock); 315 316 psock->rx_kcm = NULL; 317 /* paired with lockless reads in kcm_rfree() */ 318 WRITE_ONCE(kcm->rx_psock, NULL); 319 320 /* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with 321 * kcm_rfree 322 */ 323 smp_mb(); 324 325 if (unlikely(kcm->done)) { 326 spin_unlock_bh(&mux->rx_lock); 327 328 /* Need to run kcm_done in a task since we need to qcquire 329 * callback locks which may already be held here. 330 */ 331 INIT_WORK(&kcm->done_work, kcm_done_work); 332 schedule_work(&kcm->done_work); 333 return; 334 } 335 336 if (unlikely(kcm->rx_disabled)) { 337 requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); 338 } else if (rcv_ready || unlikely(!sk_rmem_alloc_get(&kcm->sk))) { 339 /* Check for degenerative race with rx_wait that all 340 * data was dequeued (accounted for in kcm_rfree). 341 */ 342 kcm_rcv_ready(kcm); 343 } 344 spin_unlock_bh(&mux->rx_lock); 345 } 346 347 /* Lower sock lock held */ 348 static void psock_data_ready(struct sock *sk) 349 { 350 struct kcm_psock *psock; 351 352 read_lock_bh(&sk->sk_callback_lock); 353 354 psock = (struct kcm_psock *)sk->sk_user_data; 355 if (likely(psock)) 356 strp_data_ready(&psock->strp); 357 358 read_unlock_bh(&sk->sk_callback_lock); 359 } 360 361 /* Called with lower sock held */ 362 static void kcm_rcv_strparser(struct strparser *strp, struct sk_buff *skb) 363 { 364 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 365 struct kcm_sock *kcm; 366 367 try_queue: 368 kcm = reserve_rx_kcm(psock, skb); 369 if (!kcm) { 370 /* Unable to reserve a KCM, message is held in psock and strp 371 * is paused. 372 */ 373 return; 374 } 375 376 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 377 /* Should mean socket buffer full */ 378 unreserve_rx_kcm(psock, false); 379 goto try_queue; 380 } 381 } 382 383 static int kcm_parse_func_strparser(struct strparser *strp, struct sk_buff *skb) 384 { 385 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 386 struct bpf_prog *prog = psock->bpf_prog; 387 int res; 388 389 res = bpf_prog_run_pin_on_cpu(prog, skb); 390 return res; 391 } 392 393 static int kcm_read_sock_done(struct strparser *strp, int err) 394 { 395 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 396 397 unreserve_rx_kcm(psock, true); 398 399 return err; 400 } 401 402 static void psock_state_change(struct sock *sk) 403 { 404 /* TCP only does a EPOLLIN for a half close. Do a EPOLLHUP here 405 * since application will normally not poll with EPOLLIN 406 * on the TCP sockets. 407 */ 408 409 report_csk_error(sk, EPIPE); 410 } 411 412 static void psock_write_space(struct sock *sk) 413 { 414 struct kcm_psock *psock; 415 struct kcm_mux *mux; 416 struct kcm_sock *kcm; 417 418 read_lock_bh(&sk->sk_callback_lock); 419 420 psock = (struct kcm_psock *)sk->sk_user_data; 421 if (unlikely(!psock)) 422 goto out; 423 mux = psock->mux; 424 425 spin_lock_bh(&mux->lock); 426 427 /* Check if the socket is reserved so someone is waiting for sending. */ 428 kcm = psock->tx_kcm; 429 if (kcm && !unlikely(kcm->tx_stopped)) 430 queue_work(kcm_wq, &kcm->tx_work); 431 432 spin_unlock_bh(&mux->lock); 433 out: 434 read_unlock_bh(&sk->sk_callback_lock); 435 } 436 437 static void unreserve_psock(struct kcm_sock *kcm); 438 439 /* kcm sock is locked. */ 440 static struct kcm_psock *reserve_psock(struct kcm_sock *kcm) 441 { 442 struct kcm_mux *mux = kcm->mux; 443 struct kcm_psock *psock; 444 445 psock = kcm->tx_psock; 446 447 smp_rmb(); /* Must read tx_psock before tx_wait */ 448 449 if (psock) { 450 WARN_ON(kcm->tx_wait); 451 if (unlikely(psock->tx_stopped)) 452 unreserve_psock(kcm); 453 else 454 return kcm->tx_psock; 455 } 456 457 spin_lock_bh(&mux->lock); 458 459 /* Check again under lock to see if psock was reserved for this 460 * psock via psock_unreserve. 461 */ 462 psock = kcm->tx_psock; 463 if (unlikely(psock)) { 464 WARN_ON(kcm->tx_wait); 465 spin_unlock_bh(&mux->lock); 466 return kcm->tx_psock; 467 } 468 469 if (!list_empty(&mux->psocks_avail)) { 470 psock = list_first_entry(&mux->psocks_avail, 471 struct kcm_psock, 472 psock_avail_list); 473 list_del(&psock->psock_avail_list); 474 if (kcm->tx_wait) { 475 list_del(&kcm->wait_psock_list); 476 kcm->tx_wait = false; 477 } 478 kcm->tx_psock = psock; 479 psock->tx_kcm = kcm; 480 KCM_STATS_INCR(psock->stats.reserved); 481 } else if (!kcm->tx_wait) { 482 list_add_tail(&kcm->wait_psock_list, 483 &mux->kcm_tx_waiters); 484 kcm->tx_wait = true; 485 } 486 487 spin_unlock_bh(&mux->lock); 488 489 return psock; 490 } 491 492 /* mux lock held */ 493 static void psock_now_avail(struct kcm_psock *psock) 494 { 495 struct kcm_mux *mux = psock->mux; 496 struct kcm_sock *kcm; 497 498 if (list_empty(&mux->kcm_tx_waiters)) { 499 list_add_tail(&psock->psock_avail_list, 500 &mux->psocks_avail); 501 } else { 502 kcm = list_first_entry(&mux->kcm_tx_waiters, 503 struct kcm_sock, 504 wait_psock_list); 505 list_del(&kcm->wait_psock_list); 506 kcm->tx_wait = false; 507 psock->tx_kcm = kcm; 508 509 /* Commit before changing tx_psock since that is read in 510 * reserve_psock before queuing work. 511 */ 512 smp_mb(); 513 514 kcm->tx_psock = psock; 515 KCM_STATS_INCR(psock->stats.reserved); 516 queue_work(kcm_wq, &kcm->tx_work); 517 } 518 } 519 520 /* kcm sock is locked. */ 521 static void unreserve_psock(struct kcm_sock *kcm) 522 { 523 struct kcm_psock *psock; 524 struct kcm_mux *mux = kcm->mux; 525 526 spin_lock_bh(&mux->lock); 527 528 psock = kcm->tx_psock; 529 530 if (WARN_ON(!psock)) { 531 spin_unlock_bh(&mux->lock); 532 return; 533 } 534 535 smp_rmb(); /* Read tx_psock before tx_wait */ 536 537 kcm_update_tx_mux_stats(mux, psock); 538 539 WARN_ON(kcm->tx_wait); 540 541 kcm->tx_psock = NULL; 542 psock->tx_kcm = NULL; 543 KCM_STATS_INCR(psock->stats.unreserved); 544 545 if (unlikely(psock->tx_stopped)) { 546 if (psock->done) { 547 /* Deferred free */ 548 list_del(&psock->psock_list); 549 mux->psocks_cnt--; 550 sock_put(psock->sk); 551 fput(psock->sk->sk_socket->file); 552 kmem_cache_free(kcm_psockp, psock); 553 } 554 555 /* Don't put back on available list */ 556 557 spin_unlock_bh(&mux->lock); 558 559 return; 560 } 561 562 psock_now_avail(psock); 563 564 spin_unlock_bh(&mux->lock); 565 } 566 567 static void kcm_report_tx_retry(struct kcm_sock *kcm) 568 { 569 struct kcm_mux *mux = kcm->mux; 570 571 spin_lock_bh(&mux->lock); 572 KCM_STATS_INCR(mux->stats.tx_retries); 573 spin_unlock_bh(&mux->lock); 574 } 575 576 /* Write any messages ready on the kcm socket. Called with kcm sock lock 577 * held. Return bytes actually sent or error. 578 */ 579 static int kcm_write_msgs(struct kcm_sock *kcm) 580 { 581 struct sock *sk = &kcm->sk; 582 struct kcm_psock *psock; 583 struct sk_buff *skb, *head; 584 struct kcm_tx_msg *txm; 585 unsigned short fragidx, frag_offset; 586 unsigned int sent, total_sent = 0; 587 int ret = 0; 588 589 kcm->tx_wait_more = false; 590 psock = kcm->tx_psock; 591 if (unlikely(psock && psock->tx_stopped)) { 592 /* A reserved psock was aborted asynchronously. Unreserve 593 * it and we'll retry the message. 594 */ 595 unreserve_psock(kcm); 596 kcm_report_tx_retry(kcm); 597 if (skb_queue_empty(&sk->sk_write_queue)) 598 return 0; 599 600 kcm_tx_msg(skb_peek(&sk->sk_write_queue))->sent = 0; 601 602 } else if (skb_queue_empty(&sk->sk_write_queue)) { 603 return 0; 604 } 605 606 head = skb_peek(&sk->sk_write_queue); 607 txm = kcm_tx_msg(head); 608 609 if (txm->sent) { 610 /* Send of first skbuff in queue already in progress */ 611 if (WARN_ON(!psock)) { 612 ret = -EINVAL; 613 goto out; 614 } 615 sent = txm->sent; 616 frag_offset = txm->frag_offset; 617 fragidx = txm->fragidx; 618 skb = txm->frag_skb; 619 620 goto do_frag; 621 } 622 623 try_again: 624 psock = reserve_psock(kcm); 625 if (!psock) 626 goto out; 627 628 do { 629 skb = head; 630 txm = kcm_tx_msg(head); 631 sent = 0; 632 633 do_frag_list: 634 if (WARN_ON(!skb_shinfo(skb)->nr_frags)) { 635 ret = -EINVAL; 636 goto out; 637 } 638 639 for (fragidx = 0; fragidx < skb_shinfo(skb)->nr_frags; 640 fragidx++) { 641 skb_frag_t *frag; 642 643 frag_offset = 0; 644 do_frag: 645 frag = &skb_shinfo(skb)->frags[fragidx]; 646 if (WARN_ON(!skb_frag_size(frag))) { 647 ret = -EINVAL; 648 goto out; 649 } 650 651 ret = kernel_sendpage(psock->sk->sk_socket, 652 skb_frag_page(frag), 653 skb_frag_off(frag) + frag_offset, 654 skb_frag_size(frag) - frag_offset, 655 MSG_DONTWAIT); 656 if (ret <= 0) { 657 if (ret == -EAGAIN) { 658 /* Save state to try again when there's 659 * write space on the socket 660 */ 661 txm->sent = sent; 662 txm->frag_offset = frag_offset; 663 txm->fragidx = fragidx; 664 txm->frag_skb = skb; 665 666 ret = 0; 667 goto out; 668 } 669 670 /* Hard failure in sending message, abort this 671 * psock since it has lost framing 672 * synchronization and retry sending the 673 * message from the beginning. 674 */ 675 kcm_abort_tx_psock(psock, ret ? -ret : EPIPE, 676 true); 677 unreserve_psock(kcm); 678 679 txm->sent = 0; 680 kcm_report_tx_retry(kcm); 681 ret = 0; 682 683 goto try_again; 684 } 685 686 sent += ret; 687 frag_offset += ret; 688 KCM_STATS_ADD(psock->stats.tx_bytes, ret); 689 if (frag_offset < skb_frag_size(frag)) { 690 /* Not finished with this frag */ 691 goto do_frag; 692 } 693 } 694 695 if (skb == head) { 696 if (skb_has_frag_list(skb)) { 697 skb = skb_shinfo(skb)->frag_list; 698 goto do_frag_list; 699 } 700 } else if (skb->next) { 701 skb = skb->next; 702 goto do_frag_list; 703 } 704 705 /* Successfully sent the whole packet, account for it. */ 706 skb_dequeue(&sk->sk_write_queue); 707 kfree_skb(head); 708 sk->sk_wmem_queued -= sent; 709 total_sent += sent; 710 KCM_STATS_INCR(psock->stats.tx_msgs); 711 } while ((head = skb_peek(&sk->sk_write_queue))); 712 out: 713 if (!head) { 714 /* Done with all queued messages. */ 715 WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); 716 unreserve_psock(kcm); 717 } 718 719 /* Check if write space is available */ 720 sk->sk_write_space(sk); 721 722 return total_sent ? : ret; 723 } 724 725 static void kcm_tx_work(struct work_struct *w) 726 { 727 struct kcm_sock *kcm = container_of(w, struct kcm_sock, tx_work); 728 struct sock *sk = &kcm->sk; 729 int err; 730 731 lock_sock(sk); 732 733 /* Primarily for SOCK_DGRAM sockets, also handle asynchronous tx 734 * aborts 735 */ 736 err = kcm_write_msgs(kcm); 737 if (err < 0) { 738 /* Hard failure in write, report error on KCM socket */ 739 pr_warn("KCM: Hard failure on kcm_write_msgs %d\n", err); 740 report_csk_error(&kcm->sk, -err); 741 goto out; 742 } 743 744 /* Primarily for SOCK_SEQPACKET sockets */ 745 if (likely(sk->sk_socket) && 746 test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { 747 clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 748 sk->sk_write_space(sk); 749 } 750 751 out: 752 release_sock(sk); 753 } 754 755 static void kcm_push(struct kcm_sock *kcm) 756 { 757 if (kcm->tx_wait_more) 758 kcm_write_msgs(kcm); 759 } 760 761 static ssize_t kcm_sendpage(struct socket *sock, struct page *page, 762 int offset, size_t size, int flags) 763 764 { 765 struct sock *sk = sock->sk; 766 struct kcm_sock *kcm = kcm_sk(sk); 767 struct sk_buff *skb = NULL, *head = NULL; 768 long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT); 769 bool eor; 770 int err = 0; 771 int i; 772 773 if (flags & MSG_SENDPAGE_NOTLAST) 774 flags |= MSG_MORE; 775 776 /* No MSG_EOR from splice, only look at MSG_MORE */ 777 eor = !(flags & MSG_MORE); 778 779 lock_sock(sk); 780 781 sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); 782 783 err = -EPIPE; 784 if (sk->sk_err) 785 goto out_error; 786 787 if (kcm->seq_skb) { 788 /* Previously opened message */ 789 head = kcm->seq_skb; 790 skb = kcm_tx_msg(head)->last_skb; 791 i = skb_shinfo(skb)->nr_frags; 792 793 if (skb_can_coalesce(skb, i, page, offset)) { 794 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], size); 795 skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; 796 goto coalesced; 797 } 798 799 if (i >= MAX_SKB_FRAGS) { 800 struct sk_buff *tskb; 801 802 tskb = alloc_skb(0, sk->sk_allocation); 803 while (!tskb) { 804 kcm_push(kcm); 805 err = sk_stream_wait_memory(sk, &timeo); 806 if (err) 807 goto out_error; 808 } 809 810 if (head == skb) 811 skb_shinfo(head)->frag_list = tskb; 812 else 813 skb->next = tskb; 814 815 skb = tskb; 816 skb->ip_summed = CHECKSUM_UNNECESSARY; 817 i = 0; 818 } 819 } else { 820 /* Call the sk_stream functions to manage the sndbuf mem. */ 821 if (!sk_stream_memory_free(sk)) { 822 kcm_push(kcm); 823 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 824 err = sk_stream_wait_memory(sk, &timeo); 825 if (err) 826 goto out_error; 827 } 828 829 head = alloc_skb(0, sk->sk_allocation); 830 while (!head) { 831 kcm_push(kcm); 832 err = sk_stream_wait_memory(sk, &timeo); 833 if (err) 834 goto out_error; 835 } 836 837 skb = head; 838 i = 0; 839 } 840 841 get_page(page); 842 skb_fill_page_desc_noacc(skb, i, page, offset, size); 843 skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; 844 845 coalesced: 846 skb->len += size; 847 skb->data_len += size; 848 skb->truesize += size; 849 sk->sk_wmem_queued += size; 850 sk_mem_charge(sk, size); 851 852 if (head != skb) { 853 head->len += size; 854 head->data_len += size; 855 head->truesize += size; 856 } 857 858 if (eor) { 859 bool not_busy = skb_queue_empty(&sk->sk_write_queue); 860 861 /* Message complete, queue it on send buffer */ 862 __skb_queue_tail(&sk->sk_write_queue, head); 863 kcm->seq_skb = NULL; 864 KCM_STATS_INCR(kcm->stats.tx_msgs); 865 866 if (flags & MSG_BATCH) { 867 kcm->tx_wait_more = true; 868 } else if (kcm->tx_wait_more || not_busy) { 869 err = kcm_write_msgs(kcm); 870 if (err < 0) { 871 /* We got a hard error in write_msgs but have 872 * already queued this message. Report an error 873 * in the socket, but don't affect return value 874 * from sendmsg 875 */ 876 pr_warn("KCM: Hard failure on kcm_write_msgs\n"); 877 report_csk_error(&kcm->sk, -err); 878 } 879 } 880 } else { 881 /* Message not complete, save state */ 882 kcm->seq_skb = head; 883 kcm_tx_msg(head)->last_skb = skb; 884 } 885 886 KCM_STATS_ADD(kcm->stats.tx_bytes, size); 887 888 release_sock(sk); 889 return size; 890 891 out_error: 892 kcm_push(kcm); 893 894 err = sk_stream_error(sk, flags, err); 895 896 /* make sure we wake any epoll edge trigger waiter */ 897 if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 && err == -EAGAIN)) 898 sk->sk_write_space(sk); 899 900 release_sock(sk); 901 return err; 902 } 903 904 static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 905 { 906 struct sock *sk = sock->sk; 907 struct kcm_sock *kcm = kcm_sk(sk); 908 struct sk_buff *skb = NULL, *head = NULL; 909 size_t copy, copied = 0; 910 long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 911 int eor = (sock->type == SOCK_DGRAM) ? 912 !(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR); 913 int err = -EPIPE; 914 915 lock_sock(sk); 916 917 /* Per tcp_sendmsg this should be in poll */ 918 sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); 919 920 if (sk->sk_err) 921 goto out_error; 922 923 if (kcm->seq_skb) { 924 /* Previously opened message */ 925 head = kcm->seq_skb; 926 skb = kcm_tx_msg(head)->last_skb; 927 goto start; 928 } 929 930 /* Call the sk_stream functions to manage the sndbuf mem. */ 931 if (!sk_stream_memory_free(sk)) { 932 kcm_push(kcm); 933 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 934 err = sk_stream_wait_memory(sk, &timeo); 935 if (err) 936 goto out_error; 937 } 938 939 if (msg_data_left(msg)) { 940 /* New message, alloc head skb */ 941 head = alloc_skb(0, sk->sk_allocation); 942 while (!head) { 943 kcm_push(kcm); 944 err = sk_stream_wait_memory(sk, &timeo); 945 if (err) 946 goto out_error; 947 948 head = alloc_skb(0, sk->sk_allocation); 949 } 950 951 skb = head; 952 953 /* Set ip_summed to CHECKSUM_UNNECESSARY to avoid calling 954 * csum_and_copy_from_iter from skb_do_copy_data_nocache. 955 */ 956 skb->ip_summed = CHECKSUM_UNNECESSARY; 957 } 958 959 start: 960 while (msg_data_left(msg)) { 961 bool merge = true; 962 int i = skb_shinfo(skb)->nr_frags; 963 struct page_frag *pfrag = sk_page_frag(sk); 964 965 if (!sk_page_frag_refill(sk, pfrag)) 966 goto wait_for_memory; 967 968 if (!skb_can_coalesce(skb, i, pfrag->page, 969 pfrag->offset)) { 970 if (i == MAX_SKB_FRAGS) { 971 struct sk_buff *tskb; 972 973 tskb = alloc_skb(0, sk->sk_allocation); 974 if (!tskb) 975 goto wait_for_memory; 976 977 if (head == skb) 978 skb_shinfo(head)->frag_list = tskb; 979 else 980 skb->next = tskb; 981 982 skb = tskb; 983 skb->ip_summed = CHECKSUM_UNNECESSARY; 984 continue; 985 } 986 merge = false; 987 } 988 989 copy = min_t(int, msg_data_left(msg), 990 pfrag->size - pfrag->offset); 991 992 if (!sk_wmem_schedule(sk, copy)) 993 goto wait_for_memory; 994 995 err = skb_copy_to_page_nocache(sk, &msg->msg_iter, skb, 996 pfrag->page, 997 pfrag->offset, 998 copy); 999 if (err) 1000 goto out_error; 1001 1002 /* Update the skb. */ 1003 if (merge) { 1004 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy); 1005 } else { 1006 skb_fill_page_desc(skb, i, pfrag->page, 1007 pfrag->offset, copy); 1008 get_page(pfrag->page); 1009 } 1010 1011 pfrag->offset += copy; 1012 copied += copy; 1013 if (head != skb) { 1014 head->len += copy; 1015 head->data_len += copy; 1016 } 1017 1018 continue; 1019 1020 wait_for_memory: 1021 kcm_push(kcm); 1022 err = sk_stream_wait_memory(sk, &timeo); 1023 if (err) 1024 goto out_error; 1025 } 1026 1027 if (eor) { 1028 bool not_busy = skb_queue_empty(&sk->sk_write_queue); 1029 1030 if (head) { 1031 /* Message complete, queue it on send buffer */ 1032 __skb_queue_tail(&sk->sk_write_queue, head); 1033 kcm->seq_skb = NULL; 1034 KCM_STATS_INCR(kcm->stats.tx_msgs); 1035 } 1036 1037 if (msg->msg_flags & MSG_BATCH) { 1038 kcm->tx_wait_more = true; 1039 } else if (kcm->tx_wait_more || not_busy) { 1040 err = kcm_write_msgs(kcm); 1041 if (err < 0) { 1042 /* We got a hard error in write_msgs but have 1043 * already queued this message. Report an error 1044 * in the socket, but don't affect return value 1045 * from sendmsg 1046 */ 1047 pr_warn("KCM: Hard failure on kcm_write_msgs\n"); 1048 report_csk_error(&kcm->sk, -err); 1049 } 1050 } 1051 } else { 1052 /* Message not complete, save state */ 1053 partial_message: 1054 if (head) { 1055 kcm->seq_skb = head; 1056 kcm_tx_msg(head)->last_skb = skb; 1057 } 1058 } 1059 1060 KCM_STATS_ADD(kcm->stats.tx_bytes, copied); 1061 1062 release_sock(sk); 1063 return copied; 1064 1065 out_error: 1066 kcm_push(kcm); 1067 1068 if (copied && sock->type == SOCK_SEQPACKET) { 1069 /* Wrote some bytes before encountering an 1070 * error, return partial success. 1071 */ 1072 goto partial_message; 1073 } 1074 1075 if (head != kcm->seq_skb) 1076 kfree_skb(head); 1077 1078 err = sk_stream_error(sk, msg->msg_flags, err); 1079 1080 /* make sure we wake any epoll edge trigger waiter */ 1081 if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 && err == -EAGAIN)) 1082 sk->sk_write_space(sk); 1083 1084 release_sock(sk); 1085 return err; 1086 } 1087 1088 static struct sk_buff *kcm_wait_data(struct sock *sk, int flags, 1089 long timeo, int *err) 1090 { 1091 struct sk_buff *skb; 1092 1093 while (!(skb = skb_peek(&sk->sk_receive_queue))) { 1094 if (sk->sk_err) { 1095 *err = sock_error(sk); 1096 return NULL; 1097 } 1098 1099 if (sock_flag(sk, SOCK_DONE)) 1100 return NULL; 1101 1102 if ((flags & MSG_DONTWAIT) || !timeo) { 1103 *err = -EAGAIN; 1104 return NULL; 1105 } 1106 1107 sk_wait_data(sk, &timeo, NULL); 1108 1109 /* Handle signals */ 1110 if (signal_pending(current)) { 1111 *err = sock_intr_errno(timeo); 1112 return NULL; 1113 } 1114 } 1115 1116 return skb; 1117 } 1118 1119 static int kcm_recvmsg(struct socket *sock, struct msghdr *msg, 1120 size_t len, int flags) 1121 { 1122 struct sock *sk = sock->sk; 1123 struct kcm_sock *kcm = kcm_sk(sk); 1124 int err = 0; 1125 long timeo; 1126 struct strp_msg *stm; 1127 int copied = 0; 1128 struct sk_buff *skb; 1129 1130 timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 1131 1132 lock_sock(sk); 1133 1134 skb = kcm_wait_data(sk, flags, timeo, &err); 1135 if (!skb) 1136 goto out; 1137 1138 /* Okay, have a message on the receive queue */ 1139 1140 stm = strp_msg(skb); 1141 1142 if (len > stm->full_len) 1143 len = stm->full_len; 1144 1145 err = skb_copy_datagram_msg(skb, stm->offset, msg, len); 1146 if (err < 0) 1147 goto out; 1148 1149 copied = len; 1150 if (likely(!(flags & MSG_PEEK))) { 1151 KCM_STATS_ADD(kcm->stats.rx_bytes, copied); 1152 if (copied < stm->full_len) { 1153 if (sock->type == SOCK_DGRAM) { 1154 /* Truncated message */ 1155 msg->msg_flags |= MSG_TRUNC; 1156 goto msg_finished; 1157 } 1158 stm->offset += copied; 1159 stm->full_len -= copied; 1160 } else { 1161 msg_finished: 1162 /* Finished with message */ 1163 msg->msg_flags |= MSG_EOR; 1164 KCM_STATS_INCR(kcm->stats.rx_msgs); 1165 skb_unlink(skb, &sk->sk_receive_queue); 1166 kfree_skb(skb); 1167 } 1168 } 1169 1170 out: 1171 release_sock(sk); 1172 1173 return copied ? : err; 1174 } 1175 1176 static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos, 1177 struct pipe_inode_info *pipe, size_t len, 1178 unsigned int flags) 1179 { 1180 struct sock *sk = sock->sk; 1181 struct kcm_sock *kcm = kcm_sk(sk); 1182 long timeo; 1183 struct strp_msg *stm; 1184 int err = 0; 1185 ssize_t copied; 1186 struct sk_buff *skb; 1187 1188 /* Only support splice for SOCKSEQPACKET */ 1189 1190 timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 1191 1192 lock_sock(sk); 1193 1194 skb = kcm_wait_data(sk, flags, timeo, &err); 1195 if (!skb) 1196 goto err_out; 1197 1198 /* Okay, have a message on the receive queue */ 1199 1200 stm = strp_msg(skb); 1201 1202 if (len > stm->full_len) 1203 len = stm->full_len; 1204 1205 copied = skb_splice_bits(skb, sk, stm->offset, pipe, len, flags); 1206 if (copied < 0) { 1207 err = copied; 1208 goto err_out; 1209 } 1210 1211 KCM_STATS_ADD(kcm->stats.rx_bytes, copied); 1212 1213 stm->offset += copied; 1214 stm->full_len -= copied; 1215 1216 /* We have no way to return MSG_EOR. If all the bytes have been 1217 * read we still leave the message in the receive socket buffer. 1218 * A subsequent recvmsg needs to be done to return MSG_EOR and 1219 * finish reading the message. 1220 */ 1221 1222 release_sock(sk); 1223 1224 return copied; 1225 1226 err_out: 1227 release_sock(sk); 1228 1229 return err; 1230 } 1231 1232 /* kcm sock lock held */ 1233 static void kcm_recv_disable(struct kcm_sock *kcm) 1234 { 1235 struct kcm_mux *mux = kcm->mux; 1236 1237 if (kcm->rx_disabled) 1238 return; 1239 1240 spin_lock_bh(&mux->rx_lock); 1241 1242 kcm->rx_disabled = 1; 1243 1244 /* If a psock is reserved we'll do cleanup in unreserve */ 1245 if (!kcm->rx_psock) { 1246 if (kcm->rx_wait) { 1247 list_del(&kcm->wait_rx_list); 1248 /* paired with lockless reads in kcm_rfree() */ 1249 WRITE_ONCE(kcm->rx_wait, false); 1250 } 1251 1252 requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); 1253 } 1254 1255 spin_unlock_bh(&mux->rx_lock); 1256 } 1257 1258 /* kcm sock lock held */ 1259 static void kcm_recv_enable(struct kcm_sock *kcm) 1260 { 1261 struct kcm_mux *mux = kcm->mux; 1262 1263 if (!kcm->rx_disabled) 1264 return; 1265 1266 spin_lock_bh(&mux->rx_lock); 1267 1268 kcm->rx_disabled = 0; 1269 kcm_rcv_ready(kcm); 1270 1271 spin_unlock_bh(&mux->rx_lock); 1272 } 1273 1274 static int kcm_setsockopt(struct socket *sock, int level, int optname, 1275 sockptr_t optval, unsigned int optlen) 1276 { 1277 struct kcm_sock *kcm = kcm_sk(sock->sk); 1278 int val, valbool; 1279 int err = 0; 1280 1281 if (level != SOL_KCM) 1282 return -ENOPROTOOPT; 1283 1284 if (optlen < sizeof(int)) 1285 return -EINVAL; 1286 1287 if (copy_from_sockptr(&val, optval, sizeof(int))) 1288 return -EFAULT; 1289 1290 valbool = val ? 1 : 0; 1291 1292 switch (optname) { 1293 case KCM_RECV_DISABLE: 1294 lock_sock(&kcm->sk); 1295 if (valbool) 1296 kcm_recv_disable(kcm); 1297 else 1298 kcm_recv_enable(kcm); 1299 release_sock(&kcm->sk); 1300 break; 1301 default: 1302 err = -ENOPROTOOPT; 1303 } 1304 1305 return err; 1306 } 1307 1308 static int kcm_getsockopt(struct socket *sock, int level, int optname, 1309 char __user *optval, int __user *optlen) 1310 { 1311 struct kcm_sock *kcm = kcm_sk(sock->sk); 1312 int val, len; 1313 1314 if (level != SOL_KCM) 1315 return -ENOPROTOOPT; 1316 1317 if (get_user(len, optlen)) 1318 return -EFAULT; 1319 1320 len = min_t(unsigned int, len, sizeof(int)); 1321 if (len < 0) 1322 return -EINVAL; 1323 1324 switch (optname) { 1325 case KCM_RECV_DISABLE: 1326 val = kcm->rx_disabled; 1327 break; 1328 default: 1329 return -ENOPROTOOPT; 1330 } 1331 1332 if (put_user(len, optlen)) 1333 return -EFAULT; 1334 if (copy_to_user(optval, &val, len)) 1335 return -EFAULT; 1336 return 0; 1337 } 1338 1339 static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux) 1340 { 1341 struct kcm_sock *tkcm; 1342 struct list_head *head; 1343 int index = 0; 1344 1345 /* For SOCK_SEQPACKET sock type, datagram_poll checks the sk_state, so 1346 * we set sk_state, otherwise epoll_wait always returns right away with 1347 * EPOLLHUP 1348 */ 1349 kcm->sk.sk_state = TCP_ESTABLISHED; 1350 1351 /* Add to mux's kcm sockets list */ 1352 kcm->mux = mux; 1353 spin_lock_bh(&mux->lock); 1354 1355 head = &mux->kcm_socks; 1356 list_for_each_entry(tkcm, &mux->kcm_socks, kcm_sock_list) { 1357 if (tkcm->index != index) 1358 break; 1359 head = &tkcm->kcm_sock_list; 1360 index++; 1361 } 1362 1363 list_add(&kcm->kcm_sock_list, head); 1364 kcm->index = index; 1365 1366 mux->kcm_socks_cnt++; 1367 spin_unlock_bh(&mux->lock); 1368 1369 INIT_WORK(&kcm->tx_work, kcm_tx_work); 1370 1371 spin_lock_bh(&mux->rx_lock); 1372 kcm_rcv_ready(kcm); 1373 spin_unlock_bh(&mux->rx_lock); 1374 } 1375 1376 static int kcm_attach(struct socket *sock, struct socket *csock, 1377 struct bpf_prog *prog) 1378 { 1379 struct kcm_sock *kcm = kcm_sk(sock->sk); 1380 struct kcm_mux *mux = kcm->mux; 1381 struct sock *csk; 1382 struct kcm_psock *psock = NULL, *tpsock; 1383 struct list_head *head; 1384 int index = 0; 1385 static const struct strp_callbacks cb = { 1386 .rcv_msg = kcm_rcv_strparser, 1387 .parse_msg = kcm_parse_func_strparser, 1388 .read_sock_done = kcm_read_sock_done, 1389 }; 1390 int err = 0; 1391 1392 csk = csock->sk; 1393 if (!csk) 1394 return -EINVAL; 1395 1396 lock_sock(csk); 1397 1398 /* Only allow TCP sockets to be attached for now */ 1399 if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) || 1400 csk->sk_protocol != IPPROTO_TCP) { 1401 err = -EOPNOTSUPP; 1402 goto out; 1403 } 1404 1405 /* Don't allow listeners or closed sockets */ 1406 if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) { 1407 err = -EOPNOTSUPP; 1408 goto out; 1409 } 1410 1411 psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); 1412 if (!psock) { 1413 err = -ENOMEM; 1414 goto out; 1415 } 1416 1417 psock->mux = mux; 1418 psock->sk = csk; 1419 psock->bpf_prog = prog; 1420 1421 write_lock_bh(&csk->sk_callback_lock); 1422 1423 /* Check if sk_user_data is already by KCM or someone else. 1424 * Must be done under lock to prevent race conditions. 1425 */ 1426 if (csk->sk_user_data) { 1427 write_unlock_bh(&csk->sk_callback_lock); 1428 kmem_cache_free(kcm_psockp, psock); 1429 err = -EALREADY; 1430 goto out; 1431 } 1432 1433 err = strp_init(&psock->strp, csk, &cb); 1434 if (err) { 1435 write_unlock_bh(&csk->sk_callback_lock); 1436 kmem_cache_free(kcm_psockp, psock); 1437 goto out; 1438 } 1439 1440 psock->save_data_ready = csk->sk_data_ready; 1441 psock->save_write_space = csk->sk_write_space; 1442 psock->save_state_change = csk->sk_state_change; 1443 csk->sk_user_data = psock; 1444 csk->sk_data_ready = psock_data_ready; 1445 csk->sk_write_space = psock_write_space; 1446 csk->sk_state_change = psock_state_change; 1447 1448 write_unlock_bh(&csk->sk_callback_lock); 1449 1450 sock_hold(csk); 1451 1452 /* Finished initialization, now add the psock to the MUX. */ 1453 spin_lock_bh(&mux->lock); 1454 head = &mux->psocks; 1455 list_for_each_entry(tpsock, &mux->psocks, psock_list) { 1456 if (tpsock->index != index) 1457 break; 1458 head = &tpsock->psock_list; 1459 index++; 1460 } 1461 1462 list_add(&psock->psock_list, head); 1463 psock->index = index; 1464 1465 KCM_STATS_INCR(mux->stats.psock_attach); 1466 mux->psocks_cnt++; 1467 psock_now_avail(psock); 1468 spin_unlock_bh(&mux->lock); 1469 1470 /* Schedule RX work in case there are already bytes queued */ 1471 strp_check_rcv(&psock->strp); 1472 1473 out: 1474 release_sock(csk); 1475 1476 return err; 1477 } 1478 1479 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info) 1480 { 1481 struct socket *csock; 1482 struct bpf_prog *prog; 1483 int err; 1484 1485 csock = sockfd_lookup(info->fd, &err); 1486 if (!csock) 1487 return -ENOENT; 1488 1489 prog = bpf_prog_get_type(info->bpf_fd, BPF_PROG_TYPE_SOCKET_FILTER); 1490 if (IS_ERR(prog)) { 1491 err = PTR_ERR(prog); 1492 goto out; 1493 } 1494 1495 err = kcm_attach(sock, csock, prog); 1496 if (err) { 1497 bpf_prog_put(prog); 1498 goto out; 1499 } 1500 1501 /* Keep reference on file also */ 1502 1503 return 0; 1504 out: 1505 sockfd_put(csock); 1506 return err; 1507 } 1508 1509 static void kcm_unattach(struct kcm_psock *psock) 1510 { 1511 struct sock *csk = psock->sk; 1512 struct kcm_mux *mux = psock->mux; 1513 1514 lock_sock(csk); 1515 1516 /* Stop getting callbacks from TCP socket. After this there should 1517 * be no way to reserve a kcm for this psock. 1518 */ 1519 write_lock_bh(&csk->sk_callback_lock); 1520 csk->sk_user_data = NULL; 1521 csk->sk_data_ready = psock->save_data_ready; 1522 csk->sk_write_space = psock->save_write_space; 1523 csk->sk_state_change = psock->save_state_change; 1524 strp_stop(&psock->strp); 1525 1526 if (WARN_ON(psock->rx_kcm)) { 1527 write_unlock_bh(&csk->sk_callback_lock); 1528 release_sock(csk); 1529 return; 1530 } 1531 1532 spin_lock_bh(&mux->rx_lock); 1533 1534 /* Stop receiver activities. After this point psock should not be 1535 * able to get onto ready list either through callbacks or work. 1536 */ 1537 if (psock->ready_rx_msg) { 1538 list_del(&psock->psock_ready_list); 1539 kfree_skb(psock->ready_rx_msg); 1540 psock->ready_rx_msg = NULL; 1541 KCM_STATS_INCR(mux->stats.rx_ready_drops); 1542 } 1543 1544 spin_unlock_bh(&mux->rx_lock); 1545 1546 write_unlock_bh(&csk->sk_callback_lock); 1547 1548 /* Call strp_done without sock lock */ 1549 release_sock(csk); 1550 strp_done(&psock->strp); 1551 lock_sock(csk); 1552 1553 bpf_prog_put(psock->bpf_prog); 1554 1555 spin_lock_bh(&mux->lock); 1556 1557 aggregate_psock_stats(&psock->stats, &mux->aggregate_psock_stats); 1558 save_strp_stats(&psock->strp, &mux->aggregate_strp_stats); 1559 1560 KCM_STATS_INCR(mux->stats.psock_unattach); 1561 1562 if (psock->tx_kcm) { 1563 /* psock was reserved. Just mark it finished and we will clean 1564 * up in the kcm paths, we need kcm lock which can not be 1565 * acquired here. 1566 */ 1567 KCM_STATS_INCR(mux->stats.psock_unattach_rsvd); 1568 spin_unlock_bh(&mux->lock); 1569 1570 /* We are unattaching a socket that is reserved. Abort the 1571 * socket since we may be out of sync in sending on it. We need 1572 * to do this without the mux lock. 1573 */ 1574 kcm_abort_tx_psock(psock, EPIPE, false); 1575 1576 spin_lock_bh(&mux->lock); 1577 if (!psock->tx_kcm) { 1578 /* psock now unreserved in window mux was unlocked */ 1579 goto no_reserved; 1580 } 1581 psock->done = 1; 1582 1583 /* Commit done before queuing work to process it */ 1584 smp_mb(); 1585 1586 /* Queue tx work to make sure psock->done is handled */ 1587 queue_work(kcm_wq, &psock->tx_kcm->tx_work); 1588 spin_unlock_bh(&mux->lock); 1589 } else { 1590 no_reserved: 1591 if (!psock->tx_stopped) 1592 list_del(&psock->psock_avail_list); 1593 list_del(&psock->psock_list); 1594 mux->psocks_cnt--; 1595 spin_unlock_bh(&mux->lock); 1596 1597 sock_put(csk); 1598 fput(csk->sk_socket->file); 1599 kmem_cache_free(kcm_psockp, psock); 1600 } 1601 1602 release_sock(csk); 1603 } 1604 1605 static int kcm_unattach_ioctl(struct socket *sock, struct kcm_unattach *info) 1606 { 1607 struct kcm_sock *kcm = kcm_sk(sock->sk); 1608 struct kcm_mux *mux = kcm->mux; 1609 struct kcm_psock *psock; 1610 struct socket *csock; 1611 struct sock *csk; 1612 int err; 1613 1614 csock = sockfd_lookup(info->fd, &err); 1615 if (!csock) 1616 return -ENOENT; 1617 1618 csk = csock->sk; 1619 if (!csk) { 1620 err = -EINVAL; 1621 goto out; 1622 } 1623 1624 err = -ENOENT; 1625 1626 spin_lock_bh(&mux->lock); 1627 1628 list_for_each_entry(psock, &mux->psocks, psock_list) { 1629 if (psock->sk != csk) 1630 continue; 1631 1632 /* Found the matching psock */ 1633 1634 if (psock->unattaching || WARN_ON(psock->done)) { 1635 err = -EALREADY; 1636 break; 1637 } 1638 1639 psock->unattaching = 1; 1640 1641 spin_unlock_bh(&mux->lock); 1642 1643 /* Lower socket lock should already be held */ 1644 kcm_unattach(psock); 1645 1646 err = 0; 1647 goto out; 1648 } 1649 1650 spin_unlock_bh(&mux->lock); 1651 1652 out: 1653 sockfd_put(csock); 1654 return err; 1655 } 1656 1657 static struct proto kcm_proto = { 1658 .name = "KCM", 1659 .owner = THIS_MODULE, 1660 .obj_size = sizeof(struct kcm_sock), 1661 }; 1662 1663 /* Clone a kcm socket. */ 1664 static struct file *kcm_clone(struct socket *osock) 1665 { 1666 struct socket *newsock; 1667 struct sock *newsk; 1668 1669 newsock = sock_alloc(); 1670 if (!newsock) 1671 return ERR_PTR(-ENFILE); 1672 1673 newsock->type = osock->type; 1674 newsock->ops = osock->ops; 1675 1676 __module_get(newsock->ops->owner); 1677 1678 newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL, 1679 &kcm_proto, false); 1680 if (!newsk) { 1681 sock_release(newsock); 1682 return ERR_PTR(-ENOMEM); 1683 } 1684 sock_init_data(newsock, newsk); 1685 init_kcm_sock(kcm_sk(newsk), kcm_sk(osock->sk)->mux); 1686 1687 return sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name); 1688 } 1689 1690 static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 1691 { 1692 int err; 1693 1694 switch (cmd) { 1695 case SIOCKCMATTACH: { 1696 struct kcm_attach info; 1697 1698 if (copy_from_user(&info, (void __user *)arg, sizeof(info))) 1699 return -EFAULT; 1700 1701 err = kcm_attach_ioctl(sock, &info); 1702 1703 break; 1704 } 1705 case SIOCKCMUNATTACH: { 1706 struct kcm_unattach info; 1707 1708 if (copy_from_user(&info, (void __user *)arg, sizeof(info))) 1709 return -EFAULT; 1710 1711 err = kcm_unattach_ioctl(sock, &info); 1712 1713 break; 1714 } 1715 case SIOCKCMCLONE: { 1716 struct kcm_clone info; 1717 struct file *file; 1718 1719 info.fd = get_unused_fd_flags(0); 1720 if (unlikely(info.fd < 0)) 1721 return info.fd; 1722 1723 file = kcm_clone(sock); 1724 if (IS_ERR(file)) { 1725 put_unused_fd(info.fd); 1726 return PTR_ERR(file); 1727 } 1728 if (copy_to_user((void __user *)arg, &info, 1729 sizeof(info))) { 1730 put_unused_fd(info.fd); 1731 fput(file); 1732 return -EFAULT; 1733 } 1734 fd_install(info.fd, file); 1735 err = 0; 1736 break; 1737 } 1738 default: 1739 err = -ENOIOCTLCMD; 1740 break; 1741 } 1742 1743 return err; 1744 } 1745 1746 static void free_mux(struct rcu_head *rcu) 1747 { 1748 struct kcm_mux *mux = container_of(rcu, 1749 struct kcm_mux, rcu); 1750 1751 kmem_cache_free(kcm_muxp, mux); 1752 } 1753 1754 static void release_mux(struct kcm_mux *mux) 1755 { 1756 struct kcm_net *knet = mux->knet; 1757 struct kcm_psock *psock, *tmp_psock; 1758 1759 /* Release psocks */ 1760 list_for_each_entry_safe(psock, tmp_psock, 1761 &mux->psocks, psock_list) { 1762 if (!WARN_ON(psock->unattaching)) 1763 kcm_unattach(psock); 1764 } 1765 1766 if (WARN_ON(mux->psocks_cnt)) 1767 return; 1768 1769 __skb_queue_purge(&mux->rx_hold_queue); 1770 1771 mutex_lock(&knet->mutex); 1772 aggregate_mux_stats(&mux->stats, &knet->aggregate_mux_stats); 1773 aggregate_psock_stats(&mux->aggregate_psock_stats, 1774 &knet->aggregate_psock_stats); 1775 aggregate_strp_stats(&mux->aggregate_strp_stats, 1776 &knet->aggregate_strp_stats); 1777 list_del_rcu(&mux->kcm_mux_list); 1778 knet->count--; 1779 mutex_unlock(&knet->mutex); 1780 1781 call_rcu(&mux->rcu, free_mux); 1782 } 1783 1784 static void kcm_done(struct kcm_sock *kcm) 1785 { 1786 struct kcm_mux *mux = kcm->mux; 1787 struct sock *sk = &kcm->sk; 1788 int socks_cnt; 1789 1790 spin_lock_bh(&mux->rx_lock); 1791 if (kcm->rx_psock) { 1792 /* Cleanup in unreserve_rx_kcm */ 1793 WARN_ON(kcm->done); 1794 kcm->rx_disabled = 1; 1795 kcm->done = 1; 1796 spin_unlock_bh(&mux->rx_lock); 1797 return; 1798 } 1799 1800 if (kcm->rx_wait) { 1801 list_del(&kcm->wait_rx_list); 1802 /* paired with lockless reads in kcm_rfree() */ 1803 WRITE_ONCE(kcm->rx_wait, false); 1804 } 1805 /* Move any pending receive messages to other kcm sockets */ 1806 requeue_rx_msgs(mux, &sk->sk_receive_queue); 1807 1808 spin_unlock_bh(&mux->rx_lock); 1809 1810 if (WARN_ON(sk_rmem_alloc_get(sk))) 1811 return; 1812 1813 /* Detach from MUX */ 1814 spin_lock_bh(&mux->lock); 1815 1816 list_del(&kcm->kcm_sock_list); 1817 mux->kcm_socks_cnt--; 1818 socks_cnt = mux->kcm_socks_cnt; 1819 1820 spin_unlock_bh(&mux->lock); 1821 1822 if (!socks_cnt) { 1823 /* We are done with the mux now. */ 1824 release_mux(mux); 1825 } 1826 1827 WARN_ON(kcm->rx_wait); 1828 1829 sock_put(&kcm->sk); 1830 } 1831 1832 /* Called by kcm_release to close a KCM socket. 1833 * If this is the last KCM socket on the MUX, destroy the MUX. 1834 */ 1835 static int kcm_release(struct socket *sock) 1836 { 1837 struct sock *sk = sock->sk; 1838 struct kcm_sock *kcm; 1839 struct kcm_mux *mux; 1840 struct kcm_psock *psock; 1841 1842 if (!sk) 1843 return 0; 1844 1845 kcm = kcm_sk(sk); 1846 mux = kcm->mux; 1847 1848 lock_sock(sk); 1849 sock_orphan(sk); 1850 kfree_skb(kcm->seq_skb); 1851 1852 /* Purge queue under lock to avoid race condition with tx_work trying 1853 * to act when queue is nonempty. If tx_work runs after this point 1854 * it will just return. 1855 */ 1856 __skb_queue_purge(&sk->sk_write_queue); 1857 1858 /* Set tx_stopped. This is checked when psock is bound to a kcm and we 1859 * get a writespace callback. This prevents further work being queued 1860 * from the callback (unbinding the psock occurs after canceling work. 1861 */ 1862 kcm->tx_stopped = 1; 1863 1864 release_sock(sk); 1865 1866 spin_lock_bh(&mux->lock); 1867 if (kcm->tx_wait) { 1868 /* Take of tx_wait list, after this point there should be no way 1869 * that a psock will be assigned to this kcm. 1870 */ 1871 list_del(&kcm->wait_psock_list); 1872 kcm->tx_wait = false; 1873 } 1874 spin_unlock_bh(&mux->lock); 1875 1876 /* Cancel work. After this point there should be no outside references 1877 * to the kcm socket. 1878 */ 1879 cancel_work_sync(&kcm->tx_work); 1880 1881 lock_sock(sk); 1882 psock = kcm->tx_psock; 1883 if (psock) { 1884 /* A psock was reserved, so we need to kill it since it 1885 * may already have some bytes queued from a message. We 1886 * need to do this after removing kcm from tx_wait list. 1887 */ 1888 kcm_abort_tx_psock(psock, EPIPE, false); 1889 unreserve_psock(kcm); 1890 } 1891 release_sock(sk); 1892 1893 WARN_ON(kcm->tx_wait); 1894 WARN_ON(kcm->tx_psock); 1895 1896 sock->sk = NULL; 1897 1898 kcm_done(kcm); 1899 1900 return 0; 1901 } 1902 1903 static const struct proto_ops kcm_dgram_ops = { 1904 .family = PF_KCM, 1905 .owner = THIS_MODULE, 1906 .release = kcm_release, 1907 .bind = sock_no_bind, 1908 .connect = sock_no_connect, 1909 .socketpair = sock_no_socketpair, 1910 .accept = sock_no_accept, 1911 .getname = sock_no_getname, 1912 .poll = datagram_poll, 1913 .ioctl = kcm_ioctl, 1914 .listen = sock_no_listen, 1915 .shutdown = sock_no_shutdown, 1916 .setsockopt = kcm_setsockopt, 1917 .getsockopt = kcm_getsockopt, 1918 .sendmsg = kcm_sendmsg, 1919 .recvmsg = kcm_recvmsg, 1920 .mmap = sock_no_mmap, 1921 .sendpage = kcm_sendpage, 1922 }; 1923 1924 static const struct proto_ops kcm_seqpacket_ops = { 1925 .family = PF_KCM, 1926 .owner = THIS_MODULE, 1927 .release = kcm_release, 1928 .bind = sock_no_bind, 1929 .connect = sock_no_connect, 1930 .socketpair = sock_no_socketpair, 1931 .accept = sock_no_accept, 1932 .getname = sock_no_getname, 1933 .poll = datagram_poll, 1934 .ioctl = kcm_ioctl, 1935 .listen = sock_no_listen, 1936 .shutdown = sock_no_shutdown, 1937 .setsockopt = kcm_setsockopt, 1938 .getsockopt = kcm_getsockopt, 1939 .sendmsg = kcm_sendmsg, 1940 .recvmsg = kcm_recvmsg, 1941 .mmap = sock_no_mmap, 1942 .sendpage = kcm_sendpage, 1943 .splice_read = kcm_splice_read, 1944 }; 1945 1946 /* Create proto operation for kcm sockets */ 1947 static int kcm_create(struct net *net, struct socket *sock, 1948 int protocol, int kern) 1949 { 1950 struct kcm_net *knet = net_generic(net, kcm_net_id); 1951 struct sock *sk; 1952 struct kcm_mux *mux; 1953 1954 switch (sock->type) { 1955 case SOCK_DGRAM: 1956 sock->ops = &kcm_dgram_ops; 1957 break; 1958 case SOCK_SEQPACKET: 1959 sock->ops = &kcm_seqpacket_ops; 1960 break; 1961 default: 1962 return -ESOCKTNOSUPPORT; 1963 } 1964 1965 if (protocol != KCMPROTO_CONNECTED) 1966 return -EPROTONOSUPPORT; 1967 1968 sk = sk_alloc(net, PF_KCM, GFP_KERNEL, &kcm_proto, kern); 1969 if (!sk) 1970 return -ENOMEM; 1971 1972 /* Allocate a kcm mux, shared between KCM sockets */ 1973 mux = kmem_cache_zalloc(kcm_muxp, GFP_KERNEL); 1974 if (!mux) { 1975 sk_free(sk); 1976 return -ENOMEM; 1977 } 1978 1979 spin_lock_init(&mux->lock); 1980 spin_lock_init(&mux->rx_lock); 1981 INIT_LIST_HEAD(&mux->kcm_socks); 1982 INIT_LIST_HEAD(&mux->kcm_rx_waiters); 1983 INIT_LIST_HEAD(&mux->kcm_tx_waiters); 1984 1985 INIT_LIST_HEAD(&mux->psocks); 1986 INIT_LIST_HEAD(&mux->psocks_ready); 1987 INIT_LIST_HEAD(&mux->psocks_avail); 1988 1989 mux->knet = knet; 1990 1991 /* Add new MUX to list */ 1992 mutex_lock(&knet->mutex); 1993 list_add_rcu(&mux->kcm_mux_list, &knet->mux_list); 1994 knet->count++; 1995 mutex_unlock(&knet->mutex); 1996 1997 skb_queue_head_init(&mux->rx_hold_queue); 1998 1999 /* Init KCM socket */ 2000 sock_init_data(sock, sk); 2001 init_kcm_sock(kcm_sk(sk), mux); 2002 2003 return 0; 2004 } 2005 2006 static const struct net_proto_family kcm_family_ops = { 2007 .family = PF_KCM, 2008 .create = kcm_create, 2009 .owner = THIS_MODULE, 2010 }; 2011 2012 static __net_init int kcm_init_net(struct net *net) 2013 { 2014 struct kcm_net *knet = net_generic(net, kcm_net_id); 2015 2016 INIT_LIST_HEAD_RCU(&knet->mux_list); 2017 mutex_init(&knet->mutex); 2018 2019 return 0; 2020 } 2021 2022 static __net_exit void kcm_exit_net(struct net *net) 2023 { 2024 struct kcm_net *knet = net_generic(net, kcm_net_id); 2025 2026 /* All KCM sockets should be closed at this point, which should mean 2027 * that all multiplexors and psocks have been destroyed. 2028 */ 2029 WARN_ON(!list_empty(&knet->mux_list)); 2030 } 2031 2032 static struct pernet_operations kcm_net_ops = { 2033 .init = kcm_init_net, 2034 .exit = kcm_exit_net, 2035 .id = &kcm_net_id, 2036 .size = sizeof(struct kcm_net), 2037 }; 2038 2039 static int __init kcm_init(void) 2040 { 2041 int err = -ENOMEM; 2042 2043 kcm_muxp = kmem_cache_create("kcm_mux_cache", 2044 sizeof(struct kcm_mux), 0, 2045 SLAB_HWCACHE_ALIGN, NULL); 2046 if (!kcm_muxp) 2047 goto fail; 2048 2049 kcm_psockp = kmem_cache_create("kcm_psock_cache", 2050 sizeof(struct kcm_psock), 0, 2051 SLAB_HWCACHE_ALIGN, NULL); 2052 if (!kcm_psockp) 2053 goto fail; 2054 2055 kcm_wq = create_singlethread_workqueue("kkcmd"); 2056 if (!kcm_wq) 2057 goto fail; 2058 2059 err = proto_register(&kcm_proto, 1); 2060 if (err) 2061 goto fail; 2062 2063 err = register_pernet_device(&kcm_net_ops); 2064 if (err) 2065 goto net_ops_fail; 2066 2067 err = sock_register(&kcm_family_ops); 2068 if (err) 2069 goto sock_register_fail; 2070 2071 err = kcm_proc_init(); 2072 if (err) 2073 goto proc_init_fail; 2074 2075 return 0; 2076 2077 proc_init_fail: 2078 sock_unregister(PF_KCM); 2079 2080 sock_register_fail: 2081 unregister_pernet_device(&kcm_net_ops); 2082 2083 net_ops_fail: 2084 proto_unregister(&kcm_proto); 2085 2086 fail: 2087 kmem_cache_destroy(kcm_muxp); 2088 kmem_cache_destroy(kcm_psockp); 2089 2090 if (kcm_wq) 2091 destroy_workqueue(kcm_wq); 2092 2093 return err; 2094 } 2095 2096 static void __exit kcm_exit(void) 2097 { 2098 kcm_proc_exit(); 2099 sock_unregister(PF_KCM); 2100 unregister_pernet_device(&kcm_net_ops); 2101 proto_unregister(&kcm_proto); 2102 destroy_workqueue(kcm_wq); 2103 2104 kmem_cache_destroy(kcm_muxp); 2105 kmem_cache_destroy(kcm_psockp); 2106 } 2107 2108 module_init(kcm_init); 2109 module_exit(kcm_exit); 2110 2111 MODULE_LICENSE("GPL"); 2112 MODULE_ALIAS_NETPROTO(PF_KCM); 2113