xref: /linux/net/kcm/kcmsock.c (revision 264ba53fac79b03ff754bce62da5027ee3c57b8f)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Kernel Connection Multiplexor
4  *
5  * Copyright (c) 2016 Tom Herbert <tom@herbertland.com>
6  */
7 
8 #include <linux/bpf.h>
9 #include <linux/errno.h>
10 #include <linux/errqueue.h>
11 #include <linux/file.h>
12 #include <linux/filter.h>
13 #include <linux/in.h>
14 #include <linux/kernel.h>
15 #include <linux/module.h>
16 #include <linux/net.h>
17 #include <linux/netdevice.h>
18 #include <linux/poll.h>
19 #include <linux/rculist.h>
20 #include <linux/skbuff.h>
21 #include <linux/socket.h>
22 #include <linux/uaccess.h>
23 #include <linux/workqueue.h>
24 #include <linux/syscalls.h>
25 #include <linux/sched/signal.h>
26 
27 #include <net/kcm.h>
28 #include <net/netns/generic.h>
29 #include <net/sock.h>
30 #include <uapi/linux/kcm.h>
31 #include <trace/events/sock.h>
32 
33 unsigned int kcm_net_id;
34 
35 static struct kmem_cache *kcm_psockp __read_mostly;
36 static struct kmem_cache *kcm_muxp __read_mostly;
37 static struct workqueue_struct *kcm_wq;
38 
39 static inline struct kcm_sock *kcm_sk(const struct sock *sk)
40 {
41 	return (struct kcm_sock *)sk;
42 }
43 
44 static inline struct kcm_tx_msg *kcm_tx_msg(struct sk_buff *skb)
45 {
46 	return (struct kcm_tx_msg *)skb->cb;
47 }
48 
49 static void report_csk_error(struct sock *csk, int err)
50 {
51 	csk->sk_err = EPIPE;
52 	sk_error_report(csk);
53 }
54 
55 static void kcm_abort_tx_psock(struct kcm_psock *psock, int err,
56 			       bool wakeup_kcm)
57 {
58 	struct sock *csk = psock->sk;
59 	struct kcm_mux *mux = psock->mux;
60 
61 	/* Unrecoverable error in transmit */
62 
63 	spin_lock_bh(&mux->lock);
64 
65 	if (psock->tx_stopped) {
66 		spin_unlock_bh(&mux->lock);
67 		return;
68 	}
69 
70 	psock->tx_stopped = 1;
71 	KCM_STATS_INCR(psock->stats.tx_aborts);
72 
73 	if (!psock->tx_kcm) {
74 		/* Take off psocks_avail list */
75 		list_del(&psock->psock_avail_list);
76 	} else if (wakeup_kcm) {
77 		/* In this case psock is being aborted while outside of
78 		 * write_msgs and psock is reserved. Schedule tx_work
79 		 * to handle the failure there. Need to commit tx_stopped
80 		 * before queuing work.
81 		 */
82 		smp_mb();
83 
84 		queue_work(kcm_wq, &psock->tx_kcm->tx_work);
85 	}
86 
87 	spin_unlock_bh(&mux->lock);
88 
89 	/* Report error on lower socket */
90 	report_csk_error(csk, err);
91 }
92 
93 /* RX mux lock held. */
94 static void kcm_update_rx_mux_stats(struct kcm_mux *mux,
95 				    struct kcm_psock *psock)
96 {
97 	STRP_STATS_ADD(mux->stats.rx_bytes,
98 		       psock->strp.stats.bytes -
99 		       psock->saved_rx_bytes);
100 	mux->stats.rx_msgs +=
101 		psock->strp.stats.msgs - psock->saved_rx_msgs;
102 	psock->saved_rx_msgs = psock->strp.stats.msgs;
103 	psock->saved_rx_bytes = psock->strp.stats.bytes;
104 }
105 
106 static void kcm_update_tx_mux_stats(struct kcm_mux *mux,
107 				    struct kcm_psock *psock)
108 {
109 	KCM_STATS_ADD(mux->stats.tx_bytes,
110 		      psock->stats.tx_bytes - psock->saved_tx_bytes);
111 	mux->stats.tx_msgs +=
112 		psock->stats.tx_msgs - psock->saved_tx_msgs;
113 	psock->saved_tx_msgs = psock->stats.tx_msgs;
114 	psock->saved_tx_bytes = psock->stats.tx_bytes;
115 }
116 
117 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
118 
119 /* KCM is ready to receive messages on its queue-- either the KCM is new or
120  * has become unblocked after being blocked on full socket buffer. Queue any
121  * pending ready messages on a psock. RX mux lock held.
122  */
123 static void kcm_rcv_ready(struct kcm_sock *kcm)
124 {
125 	struct kcm_mux *mux = kcm->mux;
126 	struct kcm_psock *psock;
127 	struct sk_buff *skb;
128 
129 	if (unlikely(kcm->rx_wait || kcm->rx_psock || kcm->rx_disabled))
130 		return;
131 
132 	while (unlikely((skb = __skb_dequeue(&mux->rx_hold_queue)))) {
133 		if (kcm_queue_rcv_skb(&kcm->sk, skb)) {
134 			/* Assuming buffer limit has been reached */
135 			skb_queue_head(&mux->rx_hold_queue, skb);
136 			WARN_ON(!sk_rmem_alloc_get(&kcm->sk));
137 			return;
138 		}
139 	}
140 
141 	while (!list_empty(&mux->psocks_ready)) {
142 		psock = list_first_entry(&mux->psocks_ready, struct kcm_psock,
143 					 psock_ready_list);
144 
145 		if (kcm_queue_rcv_skb(&kcm->sk, psock->ready_rx_msg)) {
146 			/* Assuming buffer limit has been reached */
147 			WARN_ON(!sk_rmem_alloc_get(&kcm->sk));
148 			return;
149 		}
150 
151 		/* Consumed the ready message on the psock. Schedule rx_work to
152 		 * get more messages.
153 		 */
154 		list_del(&psock->psock_ready_list);
155 		psock->ready_rx_msg = NULL;
156 		/* Commit clearing of ready_rx_msg for queuing work */
157 		smp_mb();
158 
159 		strp_unpause(&psock->strp);
160 		strp_check_rcv(&psock->strp);
161 	}
162 
163 	/* Buffer limit is okay now, add to ready list */
164 	list_add_tail(&kcm->wait_rx_list,
165 		      &kcm->mux->kcm_rx_waiters);
166 	/* paired with lockless reads in kcm_rfree() */
167 	WRITE_ONCE(kcm->rx_wait, true);
168 }
169 
170 static void kcm_rfree(struct sk_buff *skb)
171 {
172 	struct sock *sk = skb->sk;
173 	struct kcm_sock *kcm = kcm_sk(sk);
174 	struct kcm_mux *mux = kcm->mux;
175 	unsigned int len = skb->truesize;
176 
177 	sk_mem_uncharge(sk, len);
178 	atomic_sub(len, &sk->sk_rmem_alloc);
179 
180 	/* For reading rx_wait and rx_psock without holding lock */
181 	smp_mb__after_atomic();
182 
183 	if (!READ_ONCE(kcm->rx_wait) && !READ_ONCE(kcm->rx_psock) &&
184 	    sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) {
185 		spin_lock_bh(&mux->rx_lock);
186 		kcm_rcv_ready(kcm);
187 		spin_unlock_bh(&mux->rx_lock);
188 	}
189 }
190 
191 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
192 {
193 	struct sk_buff_head *list = &sk->sk_receive_queue;
194 
195 	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
196 		return -ENOMEM;
197 
198 	if (!sk_rmem_schedule(sk, skb, skb->truesize))
199 		return -ENOBUFS;
200 
201 	skb->dev = NULL;
202 
203 	skb_orphan(skb);
204 	skb->sk = sk;
205 	skb->destructor = kcm_rfree;
206 	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
207 	sk_mem_charge(sk, skb->truesize);
208 
209 	skb_queue_tail(list, skb);
210 
211 	if (!sock_flag(sk, SOCK_DEAD))
212 		sk->sk_data_ready(sk);
213 
214 	return 0;
215 }
216 
217 /* Requeue received messages for a kcm socket to other kcm sockets. This is
218  * called with a kcm socket is receive disabled.
219  * RX mux lock held.
220  */
221 static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head)
222 {
223 	struct sk_buff *skb;
224 	struct kcm_sock *kcm;
225 
226 	while ((skb = skb_dequeue(head))) {
227 		/* Reset destructor to avoid calling kcm_rcv_ready */
228 		skb->destructor = sock_rfree;
229 		skb_orphan(skb);
230 try_again:
231 		if (list_empty(&mux->kcm_rx_waiters)) {
232 			skb_queue_tail(&mux->rx_hold_queue, skb);
233 			continue;
234 		}
235 
236 		kcm = list_first_entry(&mux->kcm_rx_waiters,
237 				       struct kcm_sock, wait_rx_list);
238 
239 		if (kcm_queue_rcv_skb(&kcm->sk, skb)) {
240 			/* Should mean socket buffer full */
241 			list_del(&kcm->wait_rx_list);
242 			/* paired with lockless reads in kcm_rfree() */
243 			WRITE_ONCE(kcm->rx_wait, false);
244 
245 			/* Commit rx_wait to read in kcm_free */
246 			smp_wmb();
247 
248 			goto try_again;
249 		}
250 	}
251 }
252 
253 /* Lower sock lock held */
254 static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock,
255 				       struct sk_buff *head)
256 {
257 	struct kcm_mux *mux = psock->mux;
258 	struct kcm_sock *kcm;
259 
260 	WARN_ON(psock->ready_rx_msg);
261 
262 	if (psock->rx_kcm)
263 		return psock->rx_kcm;
264 
265 	spin_lock_bh(&mux->rx_lock);
266 
267 	if (psock->rx_kcm) {
268 		spin_unlock_bh(&mux->rx_lock);
269 		return psock->rx_kcm;
270 	}
271 
272 	kcm_update_rx_mux_stats(mux, psock);
273 
274 	if (list_empty(&mux->kcm_rx_waiters)) {
275 		psock->ready_rx_msg = head;
276 		strp_pause(&psock->strp);
277 		list_add_tail(&psock->psock_ready_list,
278 			      &mux->psocks_ready);
279 		spin_unlock_bh(&mux->rx_lock);
280 		return NULL;
281 	}
282 
283 	kcm = list_first_entry(&mux->kcm_rx_waiters,
284 			       struct kcm_sock, wait_rx_list);
285 	list_del(&kcm->wait_rx_list);
286 	/* paired with lockless reads in kcm_rfree() */
287 	WRITE_ONCE(kcm->rx_wait, false);
288 
289 	psock->rx_kcm = kcm;
290 	/* paired with lockless reads in kcm_rfree() */
291 	WRITE_ONCE(kcm->rx_psock, psock);
292 
293 	spin_unlock_bh(&mux->rx_lock);
294 
295 	return kcm;
296 }
297 
298 static void kcm_done(struct kcm_sock *kcm);
299 
300 static void kcm_done_work(struct work_struct *w)
301 {
302 	kcm_done(container_of(w, struct kcm_sock, done_work));
303 }
304 
305 /* Lower sock held */
306 static void unreserve_rx_kcm(struct kcm_psock *psock,
307 			     bool rcv_ready)
308 {
309 	struct kcm_sock *kcm = psock->rx_kcm;
310 	struct kcm_mux *mux = psock->mux;
311 
312 	if (!kcm)
313 		return;
314 
315 	spin_lock_bh(&mux->rx_lock);
316 
317 	psock->rx_kcm = NULL;
318 	/* paired with lockless reads in kcm_rfree() */
319 	WRITE_ONCE(kcm->rx_psock, NULL);
320 
321 	/* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with
322 	 * kcm_rfree
323 	 */
324 	smp_mb();
325 
326 	if (unlikely(kcm->done)) {
327 		spin_unlock_bh(&mux->rx_lock);
328 
329 		/* Need to run kcm_done in a task since we need to qcquire
330 		 * callback locks which may already be held here.
331 		 */
332 		INIT_WORK(&kcm->done_work, kcm_done_work);
333 		schedule_work(&kcm->done_work);
334 		return;
335 	}
336 
337 	if (unlikely(kcm->rx_disabled)) {
338 		requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue);
339 	} else if (rcv_ready || unlikely(!sk_rmem_alloc_get(&kcm->sk))) {
340 		/* Check for degenerative race with rx_wait that all
341 		 * data was dequeued (accounted for in kcm_rfree).
342 		 */
343 		kcm_rcv_ready(kcm);
344 	}
345 	spin_unlock_bh(&mux->rx_lock);
346 }
347 
348 /* Lower sock lock held */
349 static void psock_data_ready(struct sock *sk)
350 {
351 	struct kcm_psock *psock;
352 
353 	trace_sk_data_ready(sk);
354 
355 	read_lock_bh(&sk->sk_callback_lock);
356 
357 	psock = (struct kcm_psock *)sk->sk_user_data;
358 	if (likely(psock))
359 		strp_data_ready(&psock->strp);
360 
361 	read_unlock_bh(&sk->sk_callback_lock);
362 }
363 
364 /* Called with lower sock held */
365 static void kcm_rcv_strparser(struct strparser *strp, struct sk_buff *skb)
366 {
367 	struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp);
368 	struct kcm_sock *kcm;
369 
370 try_queue:
371 	kcm = reserve_rx_kcm(psock, skb);
372 	if (!kcm) {
373 		 /* Unable to reserve a KCM, message is held in psock and strp
374 		  * is paused.
375 		  */
376 		return;
377 	}
378 
379 	if (kcm_queue_rcv_skb(&kcm->sk, skb)) {
380 		/* Should mean socket buffer full */
381 		unreserve_rx_kcm(psock, false);
382 		goto try_queue;
383 	}
384 }
385 
386 static int kcm_parse_func_strparser(struct strparser *strp, struct sk_buff *skb)
387 {
388 	struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp);
389 	struct bpf_prog *prog = psock->bpf_prog;
390 	int res;
391 
392 	res = bpf_prog_run_pin_on_cpu(prog, skb);
393 	return res;
394 }
395 
396 static int kcm_read_sock_done(struct strparser *strp, int err)
397 {
398 	struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp);
399 
400 	unreserve_rx_kcm(psock, true);
401 
402 	return err;
403 }
404 
405 static void psock_state_change(struct sock *sk)
406 {
407 	/* TCP only does a EPOLLIN for a half close. Do a EPOLLHUP here
408 	 * since application will normally not poll with EPOLLIN
409 	 * on the TCP sockets.
410 	 */
411 
412 	report_csk_error(sk, EPIPE);
413 }
414 
415 static void psock_write_space(struct sock *sk)
416 {
417 	struct kcm_psock *psock;
418 	struct kcm_mux *mux;
419 	struct kcm_sock *kcm;
420 
421 	read_lock_bh(&sk->sk_callback_lock);
422 
423 	psock = (struct kcm_psock *)sk->sk_user_data;
424 	if (unlikely(!psock))
425 		goto out;
426 	mux = psock->mux;
427 
428 	spin_lock_bh(&mux->lock);
429 
430 	/* Check if the socket is reserved so someone is waiting for sending. */
431 	kcm = psock->tx_kcm;
432 	if (kcm && !unlikely(kcm->tx_stopped))
433 		queue_work(kcm_wq, &kcm->tx_work);
434 
435 	spin_unlock_bh(&mux->lock);
436 out:
437 	read_unlock_bh(&sk->sk_callback_lock);
438 }
439 
440 static void unreserve_psock(struct kcm_sock *kcm);
441 
442 /* kcm sock is locked. */
443 static struct kcm_psock *reserve_psock(struct kcm_sock *kcm)
444 {
445 	struct kcm_mux *mux = kcm->mux;
446 	struct kcm_psock *psock;
447 
448 	psock = kcm->tx_psock;
449 
450 	smp_rmb(); /* Must read tx_psock before tx_wait */
451 
452 	if (psock) {
453 		WARN_ON(kcm->tx_wait);
454 		if (unlikely(psock->tx_stopped))
455 			unreserve_psock(kcm);
456 		else
457 			return kcm->tx_psock;
458 	}
459 
460 	spin_lock_bh(&mux->lock);
461 
462 	/* Check again under lock to see if psock was reserved for this
463 	 * psock via psock_unreserve.
464 	 */
465 	psock = kcm->tx_psock;
466 	if (unlikely(psock)) {
467 		WARN_ON(kcm->tx_wait);
468 		spin_unlock_bh(&mux->lock);
469 		return kcm->tx_psock;
470 	}
471 
472 	if (!list_empty(&mux->psocks_avail)) {
473 		psock = list_first_entry(&mux->psocks_avail,
474 					 struct kcm_psock,
475 					 psock_avail_list);
476 		list_del(&psock->psock_avail_list);
477 		if (kcm->tx_wait) {
478 			list_del(&kcm->wait_psock_list);
479 			kcm->tx_wait = false;
480 		}
481 		kcm->tx_psock = psock;
482 		psock->tx_kcm = kcm;
483 		KCM_STATS_INCR(psock->stats.reserved);
484 	} else if (!kcm->tx_wait) {
485 		list_add_tail(&kcm->wait_psock_list,
486 			      &mux->kcm_tx_waiters);
487 		kcm->tx_wait = true;
488 	}
489 
490 	spin_unlock_bh(&mux->lock);
491 
492 	return psock;
493 }
494 
495 /* mux lock held */
496 static void psock_now_avail(struct kcm_psock *psock)
497 {
498 	struct kcm_mux *mux = psock->mux;
499 	struct kcm_sock *kcm;
500 
501 	if (list_empty(&mux->kcm_tx_waiters)) {
502 		list_add_tail(&psock->psock_avail_list,
503 			      &mux->psocks_avail);
504 	} else {
505 		kcm = list_first_entry(&mux->kcm_tx_waiters,
506 				       struct kcm_sock,
507 				       wait_psock_list);
508 		list_del(&kcm->wait_psock_list);
509 		kcm->tx_wait = false;
510 		psock->tx_kcm = kcm;
511 
512 		/* Commit before changing tx_psock since that is read in
513 		 * reserve_psock before queuing work.
514 		 */
515 		smp_mb();
516 
517 		kcm->tx_psock = psock;
518 		KCM_STATS_INCR(psock->stats.reserved);
519 		queue_work(kcm_wq, &kcm->tx_work);
520 	}
521 }
522 
523 /* kcm sock is locked. */
524 static void unreserve_psock(struct kcm_sock *kcm)
525 {
526 	struct kcm_psock *psock;
527 	struct kcm_mux *mux = kcm->mux;
528 
529 	spin_lock_bh(&mux->lock);
530 
531 	psock = kcm->tx_psock;
532 
533 	if (WARN_ON(!psock)) {
534 		spin_unlock_bh(&mux->lock);
535 		return;
536 	}
537 
538 	smp_rmb(); /* Read tx_psock before tx_wait */
539 
540 	kcm_update_tx_mux_stats(mux, psock);
541 
542 	WARN_ON(kcm->tx_wait);
543 
544 	kcm->tx_psock = NULL;
545 	psock->tx_kcm = NULL;
546 	KCM_STATS_INCR(psock->stats.unreserved);
547 
548 	if (unlikely(psock->tx_stopped)) {
549 		if (psock->done) {
550 			/* Deferred free */
551 			list_del(&psock->psock_list);
552 			mux->psocks_cnt--;
553 			sock_put(psock->sk);
554 			fput(psock->sk->sk_socket->file);
555 			kmem_cache_free(kcm_psockp, psock);
556 		}
557 
558 		/* Don't put back on available list */
559 
560 		spin_unlock_bh(&mux->lock);
561 
562 		return;
563 	}
564 
565 	psock_now_avail(psock);
566 
567 	spin_unlock_bh(&mux->lock);
568 }
569 
570 static void kcm_report_tx_retry(struct kcm_sock *kcm)
571 {
572 	struct kcm_mux *mux = kcm->mux;
573 
574 	spin_lock_bh(&mux->lock);
575 	KCM_STATS_INCR(mux->stats.tx_retries);
576 	spin_unlock_bh(&mux->lock);
577 }
578 
579 /* Write any messages ready on the kcm socket.  Called with kcm sock lock
580  * held.  Return bytes actually sent or error.
581  */
582 static int kcm_write_msgs(struct kcm_sock *kcm)
583 {
584 	struct sock *sk = &kcm->sk;
585 	struct kcm_psock *psock;
586 	struct sk_buff *skb, *head;
587 	struct kcm_tx_msg *txm;
588 	unsigned short fragidx, frag_offset;
589 	unsigned int sent, total_sent = 0;
590 	int ret = 0;
591 
592 	kcm->tx_wait_more = false;
593 	psock = kcm->tx_psock;
594 	if (unlikely(psock && psock->tx_stopped)) {
595 		/* A reserved psock was aborted asynchronously. Unreserve
596 		 * it and we'll retry the message.
597 		 */
598 		unreserve_psock(kcm);
599 		kcm_report_tx_retry(kcm);
600 		if (skb_queue_empty(&sk->sk_write_queue))
601 			return 0;
602 
603 		kcm_tx_msg(skb_peek(&sk->sk_write_queue))->sent = 0;
604 
605 	} else if (skb_queue_empty(&sk->sk_write_queue)) {
606 		return 0;
607 	}
608 
609 	head = skb_peek(&sk->sk_write_queue);
610 	txm = kcm_tx_msg(head);
611 
612 	if (txm->sent) {
613 		/* Send of first skbuff in queue already in progress */
614 		if (WARN_ON(!psock)) {
615 			ret = -EINVAL;
616 			goto out;
617 		}
618 		sent = txm->sent;
619 		frag_offset = txm->frag_offset;
620 		fragidx = txm->fragidx;
621 		skb = txm->frag_skb;
622 
623 		goto do_frag;
624 	}
625 
626 try_again:
627 	psock = reserve_psock(kcm);
628 	if (!psock)
629 		goto out;
630 
631 	do {
632 		skb = head;
633 		txm = kcm_tx_msg(head);
634 		sent = 0;
635 
636 do_frag_list:
637 		if (WARN_ON(!skb_shinfo(skb)->nr_frags)) {
638 			ret = -EINVAL;
639 			goto out;
640 		}
641 
642 		for (fragidx = 0; fragidx < skb_shinfo(skb)->nr_frags;
643 		     fragidx++) {
644 			struct bio_vec bvec;
645 			struct msghdr msg = {
646 				.msg_flags = MSG_DONTWAIT | MSG_SPLICE_PAGES,
647 			};
648 			skb_frag_t *frag;
649 
650 			frag_offset = 0;
651 do_frag:
652 			frag = &skb_shinfo(skb)->frags[fragidx];
653 			if (WARN_ON(!skb_frag_size(frag))) {
654 				ret = -EINVAL;
655 				goto out;
656 			}
657 
658 			bvec_set_page(&bvec,
659 				      skb_frag_page(frag),
660 				      skb_frag_size(frag) - frag_offset,
661 				      skb_frag_off(frag) + frag_offset);
662 			iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1,
663 				      bvec.bv_len);
664 			ret = sock_sendmsg(psock->sk->sk_socket, &msg);
665 			if (ret <= 0) {
666 				if (ret == -EAGAIN) {
667 					/* Save state to try again when there's
668 					 * write space on the socket
669 					 */
670 					txm->sent = sent;
671 					txm->frag_offset = frag_offset;
672 					txm->fragidx = fragidx;
673 					txm->frag_skb = skb;
674 
675 					ret = 0;
676 					goto out;
677 				}
678 
679 				/* Hard failure in sending message, abort this
680 				 * psock since it has lost framing
681 				 * synchronization and retry sending the
682 				 * message from the beginning.
683 				 */
684 				kcm_abort_tx_psock(psock, ret ? -ret : EPIPE,
685 						   true);
686 				unreserve_psock(kcm);
687 
688 				txm->sent = 0;
689 				kcm_report_tx_retry(kcm);
690 				ret = 0;
691 
692 				goto try_again;
693 			}
694 
695 			sent += ret;
696 			frag_offset += ret;
697 			KCM_STATS_ADD(psock->stats.tx_bytes, ret);
698 			if (frag_offset < skb_frag_size(frag)) {
699 				/* Not finished with this frag */
700 				goto do_frag;
701 			}
702 		}
703 
704 		if (skb == head) {
705 			if (skb_has_frag_list(skb)) {
706 				skb = skb_shinfo(skb)->frag_list;
707 				goto do_frag_list;
708 			}
709 		} else if (skb->next) {
710 			skb = skb->next;
711 			goto do_frag_list;
712 		}
713 
714 		/* Successfully sent the whole packet, account for it. */
715 		skb_dequeue(&sk->sk_write_queue);
716 		kfree_skb(head);
717 		sk->sk_wmem_queued -= sent;
718 		total_sent += sent;
719 		KCM_STATS_INCR(psock->stats.tx_msgs);
720 	} while ((head = skb_peek(&sk->sk_write_queue)));
721 out:
722 	if (!head) {
723 		/* Done with all queued messages. */
724 		WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
725 		unreserve_psock(kcm);
726 	}
727 
728 	/* Check if write space is available */
729 	sk->sk_write_space(sk);
730 
731 	return total_sent ? : ret;
732 }
733 
734 static void kcm_tx_work(struct work_struct *w)
735 {
736 	struct kcm_sock *kcm = container_of(w, struct kcm_sock, tx_work);
737 	struct sock *sk = &kcm->sk;
738 	int err;
739 
740 	lock_sock(sk);
741 
742 	/* Primarily for SOCK_DGRAM sockets, also handle asynchronous tx
743 	 * aborts
744 	 */
745 	err = kcm_write_msgs(kcm);
746 	if (err < 0) {
747 		/* Hard failure in write, report error on KCM socket */
748 		pr_warn("KCM: Hard failure on kcm_write_msgs %d\n", err);
749 		report_csk_error(&kcm->sk, -err);
750 		goto out;
751 	}
752 
753 	/* Primarily for SOCK_SEQPACKET sockets */
754 	if (likely(sk->sk_socket) &&
755 	    test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
756 		clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
757 		sk->sk_write_space(sk);
758 	}
759 
760 out:
761 	release_sock(sk);
762 }
763 
764 static void kcm_push(struct kcm_sock *kcm)
765 {
766 	if (kcm->tx_wait_more)
767 		kcm_write_msgs(kcm);
768 }
769 
770 static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
771 {
772 	struct sock *sk = sock->sk;
773 	struct kcm_sock *kcm = kcm_sk(sk);
774 	struct sk_buff *skb = NULL, *head = NULL;
775 	size_t copy, copied = 0;
776 	long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
777 	int eor = (sock->type == SOCK_DGRAM) ?
778 		  !(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR);
779 	int err = -EPIPE;
780 
781 	lock_sock(sk);
782 
783 	/* Per tcp_sendmsg this should be in poll */
784 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
785 
786 	if (sk->sk_err)
787 		goto out_error;
788 
789 	if (kcm->seq_skb) {
790 		/* Previously opened message */
791 		head = kcm->seq_skb;
792 		skb = kcm_tx_msg(head)->last_skb;
793 		goto start;
794 	}
795 
796 	/* Call the sk_stream functions to manage the sndbuf mem. */
797 	if (!sk_stream_memory_free(sk)) {
798 		kcm_push(kcm);
799 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
800 		err = sk_stream_wait_memory(sk, &timeo);
801 		if (err)
802 			goto out_error;
803 	}
804 
805 	if (msg_data_left(msg)) {
806 		/* New message, alloc head skb */
807 		head = alloc_skb(0, sk->sk_allocation);
808 		while (!head) {
809 			kcm_push(kcm);
810 			err = sk_stream_wait_memory(sk, &timeo);
811 			if (err)
812 				goto out_error;
813 
814 			head = alloc_skb(0, sk->sk_allocation);
815 		}
816 
817 		skb = head;
818 
819 		/* Set ip_summed to CHECKSUM_UNNECESSARY to avoid calling
820 		 * csum_and_copy_from_iter from skb_do_copy_data_nocache.
821 		 */
822 		skb->ip_summed = CHECKSUM_UNNECESSARY;
823 	}
824 
825 start:
826 	while (msg_data_left(msg)) {
827 		bool merge = true;
828 		int i = skb_shinfo(skb)->nr_frags;
829 		struct page_frag *pfrag = sk_page_frag(sk);
830 
831 		if (!sk_page_frag_refill(sk, pfrag))
832 			goto wait_for_memory;
833 
834 		if (!skb_can_coalesce(skb, i, pfrag->page,
835 				      pfrag->offset)) {
836 			if (i == MAX_SKB_FRAGS) {
837 				struct sk_buff *tskb;
838 
839 				tskb = alloc_skb(0, sk->sk_allocation);
840 				if (!tskb)
841 					goto wait_for_memory;
842 
843 				if (head == skb)
844 					skb_shinfo(head)->frag_list = tskb;
845 				else
846 					skb->next = tskb;
847 
848 				skb = tskb;
849 				skb->ip_summed = CHECKSUM_UNNECESSARY;
850 				continue;
851 			}
852 			merge = false;
853 		}
854 
855 		if (msg->msg_flags & MSG_SPLICE_PAGES) {
856 			copy = msg_data_left(msg);
857 			if (!sk_wmem_schedule(sk, copy))
858 				goto wait_for_memory;
859 
860 			err = skb_splice_from_iter(skb, &msg->msg_iter, copy,
861 						   sk->sk_allocation);
862 			if (err < 0) {
863 				if (err == -EMSGSIZE)
864 					goto wait_for_memory;
865 				goto out_error;
866 			}
867 
868 			copy = err;
869 			skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
870 			sk_wmem_queued_add(sk, copy);
871 			sk_mem_charge(sk, copy);
872 
873 			if (head != skb)
874 				head->truesize += copy;
875 		} else {
876 			copy = min_t(int, msg_data_left(msg),
877 				     pfrag->size - pfrag->offset);
878 			if (!sk_wmem_schedule(sk, copy))
879 				goto wait_for_memory;
880 
881 			err = skb_copy_to_page_nocache(sk, &msg->msg_iter, skb,
882 						       pfrag->page,
883 						       pfrag->offset,
884 						       copy);
885 			if (err)
886 				goto out_error;
887 
888 			/* Update the skb. */
889 			if (merge) {
890 				skb_frag_size_add(
891 					&skb_shinfo(skb)->frags[i - 1], copy);
892 			} else {
893 				skb_fill_page_desc(skb, i, pfrag->page,
894 						   pfrag->offset, copy);
895 				get_page(pfrag->page);
896 			}
897 
898 			pfrag->offset += copy;
899 		}
900 
901 		copied += copy;
902 		if (head != skb) {
903 			head->len += copy;
904 			head->data_len += copy;
905 		}
906 
907 		continue;
908 
909 wait_for_memory:
910 		kcm_push(kcm);
911 		err = sk_stream_wait_memory(sk, &timeo);
912 		if (err)
913 			goto out_error;
914 	}
915 
916 	if (eor) {
917 		bool not_busy = skb_queue_empty(&sk->sk_write_queue);
918 
919 		if (head) {
920 			/* Message complete, queue it on send buffer */
921 			__skb_queue_tail(&sk->sk_write_queue, head);
922 			kcm->seq_skb = NULL;
923 			KCM_STATS_INCR(kcm->stats.tx_msgs);
924 		}
925 
926 		if (msg->msg_flags & MSG_BATCH) {
927 			kcm->tx_wait_more = true;
928 		} else if (kcm->tx_wait_more || not_busy) {
929 			err = kcm_write_msgs(kcm);
930 			if (err < 0) {
931 				/* We got a hard error in write_msgs but have
932 				 * already queued this message. Report an error
933 				 * in the socket, but don't affect return value
934 				 * from sendmsg
935 				 */
936 				pr_warn("KCM: Hard failure on kcm_write_msgs\n");
937 				report_csk_error(&kcm->sk, -err);
938 			}
939 		}
940 	} else {
941 		/* Message not complete, save state */
942 partial_message:
943 		if (head) {
944 			kcm->seq_skb = head;
945 			kcm_tx_msg(head)->last_skb = skb;
946 		}
947 	}
948 
949 	KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
950 
951 	release_sock(sk);
952 	return copied;
953 
954 out_error:
955 	kcm_push(kcm);
956 
957 	if (copied && sock->type == SOCK_SEQPACKET) {
958 		/* Wrote some bytes before encountering an
959 		 * error, return partial success.
960 		 */
961 		goto partial_message;
962 	}
963 
964 	if (head != kcm->seq_skb)
965 		kfree_skb(head);
966 
967 	err = sk_stream_error(sk, msg->msg_flags, err);
968 
969 	/* make sure we wake any epoll edge trigger waiter */
970 	if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 && err == -EAGAIN))
971 		sk->sk_write_space(sk);
972 
973 	release_sock(sk);
974 	return err;
975 }
976 
977 static void kcm_splice_eof(struct socket *sock)
978 {
979 	struct sock *sk = sock->sk;
980 	struct kcm_sock *kcm = kcm_sk(sk);
981 
982 	if (skb_queue_empty_lockless(&sk->sk_write_queue))
983 		return;
984 
985 	lock_sock(sk);
986 	kcm_write_msgs(kcm);
987 	release_sock(sk);
988 }
989 
990 static ssize_t kcm_sendpage(struct socket *sock, struct page *page,
991 			    int offset, size_t size, int flags)
992 
993 {
994 	struct bio_vec bvec;
995 	struct msghdr msg = { .msg_flags = flags | MSG_SPLICE_PAGES, };
996 
997 	if (flags & MSG_SENDPAGE_NOTLAST)
998 		msg.msg_flags |= MSG_MORE;
999 
1000 	if (flags & MSG_OOB)
1001 		return -EOPNOTSUPP;
1002 
1003 	bvec_set_page(&bvec, page, size, offset);
1004 	iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);
1005 	return kcm_sendmsg(sock, &msg, size);
1006 }
1007 
1008 static int kcm_recvmsg(struct socket *sock, struct msghdr *msg,
1009 		       size_t len, int flags)
1010 {
1011 	struct sock *sk = sock->sk;
1012 	struct kcm_sock *kcm = kcm_sk(sk);
1013 	int err = 0;
1014 	struct strp_msg *stm;
1015 	int copied = 0;
1016 	struct sk_buff *skb;
1017 
1018 	skb = skb_recv_datagram(sk, flags, &err);
1019 	if (!skb)
1020 		goto out;
1021 
1022 	/* Okay, have a message on the receive queue */
1023 
1024 	stm = strp_msg(skb);
1025 
1026 	if (len > stm->full_len)
1027 		len = stm->full_len;
1028 
1029 	err = skb_copy_datagram_msg(skb, stm->offset, msg, len);
1030 	if (err < 0)
1031 		goto out;
1032 
1033 	copied = len;
1034 	if (likely(!(flags & MSG_PEEK))) {
1035 		KCM_STATS_ADD(kcm->stats.rx_bytes, copied);
1036 		if (copied < stm->full_len) {
1037 			if (sock->type == SOCK_DGRAM) {
1038 				/* Truncated message */
1039 				msg->msg_flags |= MSG_TRUNC;
1040 				goto msg_finished;
1041 			}
1042 			stm->offset += copied;
1043 			stm->full_len -= copied;
1044 		} else {
1045 msg_finished:
1046 			/* Finished with message */
1047 			msg->msg_flags |= MSG_EOR;
1048 			KCM_STATS_INCR(kcm->stats.rx_msgs);
1049 		}
1050 	}
1051 
1052 out:
1053 	skb_free_datagram(sk, skb);
1054 	return copied ? : err;
1055 }
1056 
1057 static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
1058 			       struct pipe_inode_info *pipe, size_t len,
1059 			       unsigned int flags)
1060 {
1061 	struct sock *sk = sock->sk;
1062 	struct kcm_sock *kcm = kcm_sk(sk);
1063 	struct strp_msg *stm;
1064 	int err = 0;
1065 	ssize_t copied;
1066 	struct sk_buff *skb;
1067 
1068 	/* Only support splice for SOCKSEQPACKET */
1069 
1070 	skb = skb_recv_datagram(sk, flags, &err);
1071 	if (!skb)
1072 		goto err_out;
1073 
1074 	/* Okay, have a message on the receive queue */
1075 
1076 	stm = strp_msg(skb);
1077 
1078 	if (len > stm->full_len)
1079 		len = stm->full_len;
1080 
1081 	copied = skb_splice_bits(skb, sk, stm->offset, pipe, len, flags);
1082 	if (copied < 0) {
1083 		err = copied;
1084 		goto err_out;
1085 	}
1086 
1087 	KCM_STATS_ADD(kcm->stats.rx_bytes, copied);
1088 
1089 	stm->offset += copied;
1090 	stm->full_len -= copied;
1091 
1092 	/* We have no way to return MSG_EOR. If all the bytes have been
1093 	 * read we still leave the message in the receive socket buffer.
1094 	 * A subsequent recvmsg needs to be done to return MSG_EOR and
1095 	 * finish reading the message.
1096 	 */
1097 
1098 	skb_free_datagram(sk, skb);
1099 	return copied;
1100 
1101 err_out:
1102 	skb_free_datagram(sk, skb);
1103 	return err;
1104 }
1105 
1106 /* kcm sock lock held */
1107 static void kcm_recv_disable(struct kcm_sock *kcm)
1108 {
1109 	struct kcm_mux *mux = kcm->mux;
1110 
1111 	if (kcm->rx_disabled)
1112 		return;
1113 
1114 	spin_lock_bh(&mux->rx_lock);
1115 
1116 	kcm->rx_disabled = 1;
1117 
1118 	/* If a psock is reserved we'll do cleanup in unreserve */
1119 	if (!kcm->rx_psock) {
1120 		if (kcm->rx_wait) {
1121 			list_del(&kcm->wait_rx_list);
1122 			/* paired with lockless reads in kcm_rfree() */
1123 			WRITE_ONCE(kcm->rx_wait, false);
1124 		}
1125 
1126 		requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue);
1127 	}
1128 
1129 	spin_unlock_bh(&mux->rx_lock);
1130 }
1131 
1132 /* kcm sock lock held */
1133 static void kcm_recv_enable(struct kcm_sock *kcm)
1134 {
1135 	struct kcm_mux *mux = kcm->mux;
1136 
1137 	if (!kcm->rx_disabled)
1138 		return;
1139 
1140 	spin_lock_bh(&mux->rx_lock);
1141 
1142 	kcm->rx_disabled = 0;
1143 	kcm_rcv_ready(kcm);
1144 
1145 	spin_unlock_bh(&mux->rx_lock);
1146 }
1147 
1148 static int kcm_setsockopt(struct socket *sock, int level, int optname,
1149 			  sockptr_t optval, unsigned int optlen)
1150 {
1151 	struct kcm_sock *kcm = kcm_sk(sock->sk);
1152 	int val, valbool;
1153 	int err = 0;
1154 
1155 	if (level != SOL_KCM)
1156 		return -ENOPROTOOPT;
1157 
1158 	if (optlen < sizeof(int))
1159 		return -EINVAL;
1160 
1161 	if (copy_from_sockptr(&val, optval, sizeof(int)))
1162 		return -EFAULT;
1163 
1164 	valbool = val ? 1 : 0;
1165 
1166 	switch (optname) {
1167 	case KCM_RECV_DISABLE:
1168 		lock_sock(&kcm->sk);
1169 		if (valbool)
1170 			kcm_recv_disable(kcm);
1171 		else
1172 			kcm_recv_enable(kcm);
1173 		release_sock(&kcm->sk);
1174 		break;
1175 	default:
1176 		err = -ENOPROTOOPT;
1177 	}
1178 
1179 	return err;
1180 }
1181 
1182 static int kcm_getsockopt(struct socket *sock, int level, int optname,
1183 			  char __user *optval, int __user *optlen)
1184 {
1185 	struct kcm_sock *kcm = kcm_sk(sock->sk);
1186 	int val, len;
1187 
1188 	if (level != SOL_KCM)
1189 		return -ENOPROTOOPT;
1190 
1191 	if (get_user(len, optlen))
1192 		return -EFAULT;
1193 
1194 	len = min_t(unsigned int, len, sizeof(int));
1195 	if (len < 0)
1196 		return -EINVAL;
1197 
1198 	switch (optname) {
1199 	case KCM_RECV_DISABLE:
1200 		val = kcm->rx_disabled;
1201 		break;
1202 	default:
1203 		return -ENOPROTOOPT;
1204 	}
1205 
1206 	if (put_user(len, optlen))
1207 		return -EFAULT;
1208 	if (copy_to_user(optval, &val, len))
1209 		return -EFAULT;
1210 	return 0;
1211 }
1212 
1213 static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux)
1214 {
1215 	struct kcm_sock *tkcm;
1216 	struct list_head *head;
1217 	int index = 0;
1218 
1219 	/* For SOCK_SEQPACKET sock type, datagram_poll checks the sk_state, so
1220 	 * we set sk_state, otherwise epoll_wait always returns right away with
1221 	 * EPOLLHUP
1222 	 */
1223 	kcm->sk.sk_state = TCP_ESTABLISHED;
1224 
1225 	/* Add to mux's kcm sockets list */
1226 	kcm->mux = mux;
1227 	spin_lock_bh(&mux->lock);
1228 
1229 	head = &mux->kcm_socks;
1230 	list_for_each_entry(tkcm, &mux->kcm_socks, kcm_sock_list) {
1231 		if (tkcm->index != index)
1232 			break;
1233 		head = &tkcm->kcm_sock_list;
1234 		index++;
1235 	}
1236 
1237 	list_add(&kcm->kcm_sock_list, head);
1238 	kcm->index = index;
1239 
1240 	mux->kcm_socks_cnt++;
1241 	spin_unlock_bh(&mux->lock);
1242 
1243 	INIT_WORK(&kcm->tx_work, kcm_tx_work);
1244 
1245 	spin_lock_bh(&mux->rx_lock);
1246 	kcm_rcv_ready(kcm);
1247 	spin_unlock_bh(&mux->rx_lock);
1248 }
1249 
1250 static int kcm_attach(struct socket *sock, struct socket *csock,
1251 		      struct bpf_prog *prog)
1252 {
1253 	struct kcm_sock *kcm = kcm_sk(sock->sk);
1254 	struct kcm_mux *mux = kcm->mux;
1255 	struct sock *csk;
1256 	struct kcm_psock *psock = NULL, *tpsock;
1257 	struct list_head *head;
1258 	int index = 0;
1259 	static const struct strp_callbacks cb = {
1260 		.rcv_msg = kcm_rcv_strparser,
1261 		.parse_msg = kcm_parse_func_strparser,
1262 		.read_sock_done = kcm_read_sock_done,
1263 	};
1264 	int err = 0;
1265 
1266 	csk = csock->sk;
1267 	if (!csk)
1268 		return -EINVAL;
1269 
1270 	lock_sock(csk);
1271 
1272 	/* Only allow TCP sockets to be attached for now */
1273 	if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
1274 	    csk->sk_protocol != IPPROTO_TCP) {
1275 		err = -EOPNOTSUPP;
1276 		goto out;
1277 	}
1278 
1279 	/* Don't allow listeners or closed sockets */
1280 	if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
1281 		err = -EOPNOTSUPP;
1282 		goto out;
1283 	}
1284 
1285 	psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
1286 	if (!psock) {
1287 		err = -ENOMEM;
1288 		goto out;
1289 	}
1290 
1291 	psock->mux = mux;
1292 	psock->sk = csk;
1293 	psock->bpf_prog = prog;
1294 
1295 	write_lock_bh(&csk->sk_callback_lock);
1296 
1297 	/* Check if sk_user_data is already by KCM or someone else.
1298 	 * Must be done under lock to prevent race conditions.
1299 	 */
1300 	if (csk->sk_user_data) {
1301 		write_unlock_bh(&csk->sk_callback_lock);
1302 		kmem_cache_free(kcm_psockp, psock);
1303 		err = -EALREADY;
1304 		goto out;
1305 	}
1306 
1307 	err = strp_init(&psock->strp, csk, &cb);
1308 	if (err) {
1309 		write_unlock_bh(&csk->sk_callback_lock);
1310 		kmem_cache_free(kcm_psockp, psock);
1311 		goto out;
1312 	}
1313 
1314 	psock->save_data_ready = csk->sk_data_ready;
1315 	psock->save_write_space = csk->sk_write_space;
1316 	psock->save_state_change = csk->sk_state_change;
1317 	csk->sk_user_data = psock;
1318 	csk->sk_data_ready = psock_data_ready;
1319 	csk->sk_write_space = psock_write_space;
1320 	csk->sk_state_change = psock_state_change;
1321 
1322 	write_unlock_bh(&csk->sk_callback_lock);
1323 
1324 	sock_hold(csk);
1325 
1326 	/* Finished initialization, now add the psock to the MUX. */
1327 	spin_lock_bh(&mux->lock);
1328 	head = &mux->psocks;
1329 	list_for_each_entry(tpsock, &mux->psocks, psock_list) {
1330 		if (tpsock->index != index)
1331 			break;
1332 		head = &tpsock->psock_list;
1333 		index++;
1334 	}
1335 
1336 	list_add(&psock->psock_list, head);
1337 	psock->index = index;
1338 
1339 	KCM_STATS_INCR(mux->stats.psock_attach);
1340 	mux->psocks_cnt++;
1341 	psock_now_avail(psock);
1342 	spin_unlock_bh(&mux->lock);
1343 
1344 	/* Schedule RX work in case there are already bytes queued */
1345 	strp_check_rcv(&psock->strp);
1346 
1347 out:
1348 	release_sock(csk);
1349 
1350 	return err;
1351 }
1352 
1353 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
1354 {
1355 	struct socket *csock;
1356 	struct bpf_prog *prog;
1357 	int err;
1358 
1359 	csock = sockfd_lookup(info->fd, &err);
1360 	if (!csock)
1361 		return -ENOENT;
1362 
1363 	prog = bpf_prog_get_type(info->bpf_fd, BPF_PROG_TYPE_SOCKET_FILTER);
1364 	if (IS_ERR(prog)) {
1365 		err = PTR_ERR(prog);
1366 		goto out;
1367 	}
1368 
1369 	err = kcm_attach(sock, csock, prog);
1370 	if (err) {
1371 		bpf_prog_put(prog);
1372 		goto out;
1373 	}
1374 
1375 	/* Keep reference on file also */
1376 
1377 	return 0;
1378 out:
1379 	sockfd_put(csock);
1380 	return err;
1381 }
1382 
1383 static void kcm_unattach(struct kcm_psock *psock)
1384 {
1385 	struct sock *csk = psock->sk;
1386 	struct kcm_mux *mux = psock->mux;
1387 
1388 	lock_sock(csk);
1389 
1390 	/* Stop getting callbacks from TCP socket. After this there should
1391 	 * be no way to reserve a kcm for this psock.
1392 	 */
1393 	write_lock_bh(&csk->sk_callback_lock);
1394 	csk->sk_user_data = NULL;
1395 	csk->sk_data_ready = psock->save_data_ready;
1396 	csk->sk_write_space = psock->save_write_space;
1397 	csk->sk_state_change = psock->save_state_change;
1398 	strp_stop(&psock->strp);
1399 
1400 	if (WARN_ON(psock->rx_kcm)) {
1401 		write_unlock_bh(&csk->sk_callback_lock);
1402 		release_sock(csk);
1403 		return;
1404 	}
1405 
1406 	spin_lock_bh(&mux->rx_lock);
1407 
1408 	/* Stop receiver activities. After this point psock should not be
1409 	 * able to get onto ready list either through callbacks or work.
1410 	 */
1411 	if (psock->ready_rx_msg) {
1412 		list_del(&psock->psock_ready_list);
1413 		kfree_skb(psock->ready_rx_msg);
1414 		psock->ready_rx_msg = NULL;
1415 		KCM_STATS_INCR(mux->stats.rx_ready_drops);
1416 	}
1417 
1418 	spin_unlock_bh(&mux->rx_lock);
1419 
1420 	write_unlock_bh(&csk->sk_callback_lock);
1421 
1422 	/* Call strp_done without sock lock */
1423 	release_sock(csk);
1424 	strp_done(&psock->strp);
1425 	lock_sock(csk);
1426 
1427 	bpf_prog_put(psock->bpf_prog);
1428 
1429 	spin_lock_bh(&mux->lock);
1430 
1431 	aggregate_psock_stats(&psock->stats, &mux->aggregate_psock_stats);
1432 	save_strp_stats(&psock->strp, &mux->aggregate_strp_stats);
1433 
1434 	KCM_STATS_INCR(mux->stats.psock_unattach);
1435 
1436 	if (psock->tx_kcm) {
1437 		/* psock was reserved.  Just mark it finished and we will clean
1438 		 * up in the kcm paths, we need kcm lock which can not be
1439 		 * acquired here.
1440 		 */
1441 		KCM_STATS_INCR(mux->stats.psock_unattach_rsvd);
1442 		spin_unlock_bh(&mux->lock);
1443 
1444 		/* We are unattaching a socket that is reserved. Abort the
1445 		 * socket since we may be out of sync in sending on it. We need
1446 		 * to do this without the mux lock.
1447 		 */
1448 		kcm_abort_tx_psock(psock, EPIPE, false);
1449 
1450 		spin_lock_bh(&mux->lock);
1451 		if (!psock->tx_kcm) {
1452 			/* psock now unreserved in window mux was unlocked */
1453 			goto no_reserved;
1454 		}
1455 		psock->done = 1;
1456 
1457 		/* Commit done before queuing work to process it */
1458 		smp_mb();
1459 
1460 		/* Queue tx work to make sure psock->done is handled */
1461 		queue_work(kcm_wq, &psock->tx_kcm->tx_work);
1462 		spin_unlock_bh(&mux->lock);
1463 	} else {
1464 no_reserved:
1465 		if (!psock->tx_stopped)
1466 			list_del(&psock->psock_avail_list);
1467 		list_del(&psock->psock_list);
1468 		mux->psocks_cnt--;
1469 		spin_unlock_bh(&mux->lock);
1470 
1471 		sock_put(csk);
1472 		fput(csk->sk_socket->file);
1473 		kmem_cache_free(kcm_psockp, psock);
1474 	}
1475 
1476 	release_sock(csk);
1477 }
1478 
1479 static int kcm_unattach_ioctl(struct socket *sock, struct kcm_unattach *info)
1480 {
1481 	struct kcm_sock *kcm = kcm_sk(sock->sk);
1482 	struct kcm_mux *mux = kcm->mux;
1483 	struct kcm_psock *psock;
1484 	struct socket *csock;
1485 	struct sock *csk;
1486 	int err;
1487 
1488 	csock = sockfd_lookup(info->fd, &err);
1489 	if (!csock)
1490 		return -ENOENT;
1491 
1492 	csk = csock->sk;
1493 	if (!csk) {
1494 		err = -EINVAL;
1495 		goto out;
1496 	}
1497 
1498 	err = -ENOENT;
1499 
1500 	spin_lock_bh(&mux->lock);
1501 
1502 	list_for_each_entry(psock, &mux->psocks, psock_list) {
1503 		if (psock->sk != csk)
1504 			continue;
1505 
1506 		/* Found the matching psock */
1507 
1508 		if (psock->unattaching || WARN_ON(psock->done)) {
1509 			err = -EALREADY;
1510 			break;
1511 		}
1512 
1513 		psock->unattaching = 1;
1514 
1515 		spin_unlock_bh(&mux->lock);
1516 
1517 		/* Lower socket lock should already be held */
1518 		kcm_unattach(psock);
1519 
1520 		err = 0;
1521 		goto out;
1522 	}
1523 
1524 	spin_unlock_bh(&mux->lock);
1525 
1526 out:
1527 	sockfd_put(csock);
1528 	return err;
1529 }
1530 
1531 static struct proto kcm_proto = {
1532 	.name	= "KCM",
1533 	.owner	= THIS_MODULE,
1534 	.obj_size = sizeof(struct kcm_sock),
1535 };
1536 
1537 /* Clone a kcm socket. */
1538 static struct file *kcm_clone(struct socket *osock)
1539 {
1540 	struct socket *newsock;
1541 	struct sock *newsk;
1542 
1543 	newsock = sock_alloc();
1544 	if (!newsock)
1545 		return ERR_PTR(-ENFILE);
1546 
1547 	newsock->type = osock->type;
1548 	newsock->ops = osock->ops;
1549 
1550 	__module_get(newsock->ops->owner);
1551 
1552 	newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
1553 			 &kcm_proto, false);
1554 	if (!newsk) {
1555 		sock_release(newsock);
1556 		return ERR_PTR(-ENOMEM);
1557 	}
1558 	sock_init_data(newsock, newsk);
1559 	init_kcm_sock(kcm_sk(newsk), kcm_sk(osock->sk)->mux);
1560 
1561 	return sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name);
1562 }
1563 
1564 static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1565 {
1566 	int err;
1567 
1568 	switch (cmd) {
1569 	case SIOCKCMATTACH: {
1570 		struct kcm_attach info;
1571 
1572 		if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
1573 			return -EFAULT;
1574 
1575 		err = kcm_attach_ioctl(sock, &info);
1576 
1577 		break;
1578 	}
1579 	case SIOCKCMUNATTACH: {
1580 		struct kcm_unattach info;
1581 
1582 		if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
1583 			return -EFAULT;
1584 
1585 		err = kcm_unattach_ioctl(sock, &info);
1586 
1587 		break;
1588 	}
1589 	case SIOCKCMCLONE: {
1590 		struct kcm_clone info;
1591 		struct file *file;
1592 
1593 		info.fd = get_unused_fd_flags(0);
1594 		if (unlikely(info.fd < 0))
1595 			return info.fd;
1596 
1597 		file = kcm_clone(sock);
1598 		if (IS_ERR(file)) {
1599 			put_unused_fd(info.fd);
1600 			return PTR_ERR(file);
1601 		}
1602 		if (copy_to_user((void __user *)arg, &info,
1603 				 sizeof(info))) {
1604 			put_unused_fd(info.fd);
1605 			fput(file);
1606 			return -EFAULT;
1607 		}
1608 		fd_install(info.fd, file);
1609 		err = 0;
1610 		break;
1611 	}
1612 	default:
1613 		err = -ENOIOCTLCMD;
1614 		break;
1615 	}
1616 
1617 	return err;
1618 }
1619 
1620 static void free_mux(struct rcu_head *rcu)
1621 {
1622 	struct kcm_mux *mux = container_of(rcu,
1623 	    struct kcm_mux, rcu);
1624 
1625 	kmem_cache_free(kcm_muxp, mux);
1626 }
1627 
1628 static void release_mux(struct kcm_mux *mux)
1629 {
1630 	struct kcm_net *knet = mux->knet;
1631 	struct kcm_psock *psock, *tmp_psock;
1632 
1633 	/* Release psocks */
1634 	list_for_each_entry_safe(psock, tmp_psock,
1635 				 &mux->psocks, psock_list) {
1636 		if (!WARN_ON(psock->unattaching))
1637 			kcm_unattach(psock);
1638 	}
1639 
1640 	if (WARN_ON(mux->psocks_cnt))
1641 		return;
1642 
1643 	__skb_queue_purge(&mux->rx_hold_queue);
1644 
1645 	mutex_lock(&knet->mutex);
1646 	aggregate_mux_stats(&mux->stats, &knet->aggregate_mux_stats);
1647 	aggregate_psock_stats(&mux->aggregate_psock_stats,
1648 			      &knet->aggregate_psock_stats);
1649 	aggregate_strp_stats(&mux->aggregate_strp_stats,
1650 			     &knet->aggregate_strp_stats);
1651 	list_del_rcu(&mux->kcm_mux_list);
1652 	knet->count--;
1653 	mutex_unlock(&knet->mutex);
1654 
1655 	call_rcu(&mux->rcu, free_mux);
1656 }
1657 
1658 static void kcm_done(struct kcm_sock *kcm)
1659 {
1660 	struct kcm_mux *mux = kcm->mux;
1661 	struct sock *sk = &kcm->sk;
1662 	int socks_cnt;
1663 
1664 	spin_lock_bh(&mux->rx_lock);
1665 	if (kcm->rx_psock) {
1666 		/* Cleanup in unreserve_rx_kcm */
1667 		WARN_ON(kcm->done);
1668 		kcm->rx_disabled = 1;
1669 		kcm->done = 1;
1670 		spin_unlock_bh(&mux->rx_lock);
1671 		return;
1672 	}
1673 
1674 	if (kcm->rx_wait) {
1675 		list_del(&kcm->wait_rx_list);
1676 		/* paired with lockless reads in kcm_rfree() */
1677 		WRITE_ONCE(kcm->rx_wait, false);
1678 	}
1679 	/* Move any pending receive messages to other kcm sockets */
1680 	requeue_rx_msgs(mux, &sk->sk_receive_queue);
1681 
1682 	spin_unlock_bh(&mux->rx_lock);
1683 
1684 	if (WARN_ON(sk_rmem_alloc_get(sk)))
1685 		return;
1686 
1687 	/* Detach from MUX */
1688 	spin_lock_bh(&mux->lock);
1689 
1690 	list_del(&kcm->kcm_sock_list);
1691 	mux->kcm_socks_cnt--;
1692 	socks_cnt = mux->kcm_socks_cnt;
1693 
1694 	spin_unlock_bh(&mux->lock);
1695 
1696 	if (!socks_cnt) {
1697 		/* We are done with the mux now. */
1698 		release_mux(mux);
1699 	}
1700 
1701 	WARN_ON(kcm->rx_wait);
1702 
1703 	sock_put(&kcm->sk);
1704 }
1705 
1706 /* Called by kcm_release to close a KCM socket.
1707  * If this is the last KCM socket on the MUX, destroy the MUX.
1708  */
1709 static int kcm_release(struct socket *sock)
1710 {
1711 	struct sock *sk = sock->sk;
1712 	struct kcm_sock *kcm;
1713 	struct kcm_mux *mux;
1714 	struct kcm_psock *psock;
1715 
1716 	if (!sk)
1717 		return 0;
1718 
1719 	kcm = kcm_sk(sk);
1720 	mux = kcm->mux;
1721 
1722 	lock_sock(sk);
1723 	sock_orphan(sk);
1724 	kfree_skb(kcm->seq_skb);
1725 
1726 	/* Purge queue under lock to avoid race condition with tx_work trying
1727 	 * to act when queue is nonempty. If tx_work runs after this point
1728 	 * it will just return.
1729 	 */
1730 	__skb_queue_purge(&sk->sk_write_queue);
1731 
1732 	/* Set tx_stopped. This is checked when psock is bound to a kcm and we
1733 	 * get a writespace callback. This prevents further work being queued
1734 	 * from the callback (unbinding the psock occurs after canceling work.
1735 	 */
1736 	kcm->tx_stopped = 1;
1737 
1738 	release_sock(sk);
1739 
1740 	spin_lock_bh(&mux->lock);
1741 	if (kcm->tx_wait) {
1742 		/* Take of tx_wait list, after this point there should be no way
1743 		 * that a psock will be assigned to this kcm.
1744 		 */
1745 		list_del(&kcm->wait_psock_list);
1746 		kcm->tx_wait = false;
1747 	}
1748 	spin_unlock_bh(&mux->lock);
1749 
1750 	/* Cancel work. After this point there should be no outside references
1751 	 * to the kcm socket.
1752 	 */
1753 	cancel_work_sync(&kcm->tx_work);
1754 
1755 	lock_sock(sk);
1756 	psock = kcm->tx_psock;
1757 	if (psock) {
1758 		/* A psock was reserved, so we need to kill it since it
1759 		 * may already have some bytes queued from a message. We
1760 		 * need to do this after removing kcm from tx_wait list.
1761 		 */
1762 		kcm_abort_tx_psock(psock, EPIPE, false);
1763 		unreserve_psock(kcm);
1764 	}
1765 	release_sock(sk);
1766 
1767 	WARN_ON(kcm->tx_wait);
1768 	WARN_ON(kcm->tx_psock);
1769 
1770 	sock->sk = NULL;
1771 
1772 	kcm_done(kcm);
1773 
1774 	return 0;
1775 }
1776 
1777 static const struct proto_ops kcm_dgram_ops = {
1778 	.family =	PF_KCM,
1779 	.owner =	THIS_MODULE,
1780 	.release =	kcm_release,
1781 	.bind =		sock_no_bind,
1782 	.connect =	sock_no_connect,
1783 	.socketpair =	sock_no_socketpair,
1784 	.accept =	sock_no_accept,
1785 	.getname =	sock_no_getname,
1786 	.poll =		datagram_poll,
1787 	.ioctl =	kcm_ioctl,
1788 	.listen =	sock_no_listen,
1789 	.shutdown =	sock_no_shutdown,
1790 	.setsockopt =	kcm_setsockopt,
1791 	.getsockopt =	kcm_getsockopt,
1792 	.sendmsg =	kcm_sendmsg,
1793 	.recvmsg =	kcm_recvmsg,
1794 	.mmap =		sock_no_mmap,
1795 	.splice_eof =	kcm_splice_eof,
1796 	.sendpage =	kcm_sendpage,
1797 };
1798 
1799 static const struct proto_ops kcm_seqpacket_ops = {
1800 	.family =	PF_KCM,
1801 	.owner =	THIS_MODULE,
1802 	.release =	kcm_release,
1803 	.bind =		sock_no_bind,
1804 	.connect =	sock_no_connect,
1805 	.socketpair =	sock_no_socketpair,
1806 	.accept =	sock_no_accept,
1807 	.getname =	sock_no_getname,
1808 	.poll =		datagram_poll,
1809 	.ioctl =	kcm_ioctl,
1810 	.listen =	sock_no_listen,
1811 	.shutdown =	sock_no_shutdown,
1812 	.setsockopt =	kcm_setsockopt,
1813 	.getsockopt =	kcm_getsockopt,
1814 	.sendmsg =	kcm_sendmsg,
1815 	.recvmsg =	kcm_recvmsg,
1816 	.mmap =		sock_no_mmap,
1817 	.splice_eof =	kcm_splice_eof,
1818 	.sendpage =	kcm_sendpage,
1819 	.splice_read =	kcm_splice_read,
1820 };
1821 
1822 /* Create proto operation for kcm sockets */
1823 static int kcm_create(struct net *net, struct socket *sock,
1824 		      int protocol, int kern)
1825 {
1826 	struct kcm_net *knet = net_generic(net, kcm_net_id);
1827 	struct sock *sk;
1828 	struct kcm_mux *mux;
1829 
1830 	switch (sock->type) {
1831 	case SOCK_DGRAM:
1832 		sock->ops = &kcm_dgram_ops;
1833 		break;
1834 	case SOCK_SEQPACKET:
1835 		sock->ops = &kcm_seqpacket_ops;
1836 		break;
1837 	default:
1838 		return -ESOCKTNOSUPPORT;
1839 	}
1840 
1841 	if (protocol != KCMPROTO_CONNECTED)
1842 		return -EPROTONOSUPPORT;
1843 
1844 	sk = sk_alloc(net, PF_KCM, GFP_KERNEL, &kcm_proto, kern);
1845 	if (!sk)
1846 		return -ENOMEM;
1847 
1848 	/* Allocate a kcm mux, shared between KCM sockets */
1849 	mux = kmem_cache_zalloc(kcm_muxp, GFP_KERNEL);
1850 	if (!mux) {
1851 		sk_free(sk);
1852 		return -ENOMEM;
1853 	}
1854 
1855 	spin_lock_init(&mux->lock);
1856 	spin_lock_init(&mux->rx_lock);
1857 	INIT_LIST_HEAD(&mux->kcm_socks);
1858 	INIT_LIST_HEAD(&mux->kcm_rx_waiters);
1859 	INIT_LIST_HEAD(&mux->kcm_tx_waiters);
1860 
1861 	INIT_LIST_HEAD(&mux->psocks);
1862 	INIT_LIST_HEAD(&mux->psocks_ready);
1863 	INIT_LIST_HEAD(&mux->psocks_avail);
1864 
1865 	mux->knet = knet;
1866 
1867 	/* Add new MUX to list */
1868 	mutex_lock(&knet->mutex);
1869 	list_add_rcu(&mux->kcm_mux_list, &knet->mux_list);
1870 	knet->count++;
1871 	mutex_unlock(&knet->mutex);
1872 
1873 	skb_queue_head_init(&mux->rx_hold_queue);
1874 
1875 	/* Init KCM socket */
1876 	sock_init_data(sock, sk);
1877 	init_kcm_sock(kcm_sk(sk), mux);
1878 
1879 	return 0;
1880 }
1881 
1882 static const struct net_proto_family kcm_family_ops = {
1883 	.family = PF_KCM,
1884 	.create = kcm_create,
1885 	.owner  = THIS_MODULE,
1886 };
1887 
1888 static __net_init int kcm_init_net(struct net *net)
1889 {
1890 	struct kcm_net *knet = net_generic(net, kcm_net_id);
1891 
1892 	INIT_LIST_HEAD_RCU(&knet->mux_list);
1893 	mutex_init(&knet->mutex);
1894 
1895 	return 0;
1896 }
1897 
1898 static __net_exit void kcm_exit_net(struct net *net)
1899 {
1900 	struct kcm_net *knet = net_generic(net, kcm_net_id);
1901 
1902 	/* All KCM sockets should be closed at this point, which should mean
1903 	 * that all multiplexors and psocks have been destroyed.
1904 	 */
1905 	WARN_ON(!list_empty(&knet->mux_list));
1906 }
1907 
1908 static struct pernet_operations kcm_net_ops = {
1909 	.init = kcm_init_net,
1910 	.exit = kcm_exit_net,
1911 	.id   = &kcm_net_id,
1912 	.size = sizeof(struct kcm_net),
1913 };
1914 
1915 static int __init kcm_init(void)
1916 {
1917 	int err = -ENOMEM;
1918 
1919 	kcm_muxp = kmem_cache_create("kcm_mux_cache",
1920 				     sizeof(struct kcm_mux), 0,
1921 				     SLAB_HWCACHE_ALIGN, NULL);
1922 	if (!kcm_muxp)
1923 		goto fail;
1924 
1925 	kcm_psockp = kmem_cache_create("kcm_psock_cache",
1926 				       sizeof(struct kcm_psock), 0,
1927 					SLAB_HWCACHE_ALIGN, NULL);
1928 	if (!kcm_psockp)
1929 		goto fail;
1930 
1931 	kcm_wq = create_singlethread_workqueue("kkcmd");
1932 	if (!kcm_wq)
1933 		goto fail;
1934 
1935 	err = proto_register(&kcm_proto, 1);
1936 	if (err)
1937 		goto fail;
1938 
1939 	err = register_pernet_device(&kcm_net_ops);
1940 	if (err)
1941 		goto net_ops_fail;
1942 
1943 	err = sock_register(&kcm_family_ops);
1944 	if (err)
1945 		goto sock_register_fail;
1946 
1947 	err = kcm_proc_init();
1948 	if (err)
1949 		goto proc_init_fail;
1950 
1951 	return 0;
1952 
1953 proc_init_fail:
1954 	sock_unregister(PF_KCM);
1955 
1956 sock_register_fail:
1957 	unregister_pernet_device(&kcm_net_ops);
1958 
1959 net_ops_fail:
1960 	proto_unregister(&kcm_proto);
1961 
1962 fail:
1963 	kmem_cache_destroy(kcm_muxp);
1964 	kmem_cache_destroy(kcm_psockp);
1965 
1966 	if (kcm_wq)
1967 		destroy_workqueue(kcm_wq);
1968 
1969 	return err;
1970 }
1971 
1972 static void __exit kcm_exit(void)
1973 {
1974 	kcm_proc_exit();
1975 	sock_unregister(PF_KCM);
1976 	unregister_pernet_device(&kcm_net_ops);
1977 	proto_unregister(&kcm_proto);
1978 	destroy_workqueue(kcm_wq);
1979 
1980 	kmem_cache_destroy(kcm_muxp);
1981 	kmem_cache_destroy(kcm_psockp);
1982 }
1983 
1984 module_init(kcm_init);
1985 module_exit(kcm_exit);
1986 
1987 MODULE_LICENSE("GPL");
1988 MODULE_ALIAS_NETPROTO(PF_KCM);
1989