1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Kernel Connection Multiplexor 4 * 5 * Copyright (c) 2016 Tom Herbert <tom@herbertland.com> 6 */ 7 8 #include <linux/bpf.h> 9 #include <linux/errno.h> 10 #include <linux/errqueue.h> 11 #include <linux/file.h> 12 #include <linux/filter.h> 13 #include <linux/in.h> 14 #include <linux/kernel.h> 15 #include <linux/module.h> 16 #include <linux/net.h> 17 #include <linux/netdevice.h> 18 #include <linux/poll.h> 19 #include <linux/rculist.h> 20 #include <linux/skbuff.h> 21 #include <linux/socket.h> 22 #include <linux/uaccess.h> 23 #include <linux/workqueue.h> 24 #include <linux/syscalls.h> 25 #include <linux/sched/signal.h> 26 27 #include <net/kcm.h> 28 #include <net/netns/generic.h> 29 #include <net/sock.h> 30 #include <uapi/linux/kcm.h> 31 #include <trace/events/sock.h> 32 33 unsigned int kcm_net_id; 34 35 static struct kmem_cache *kcm_psockp __read_mostly; 36 static struct kmem_cache *kcm_muxp __read_mostly; 37 static struct workqueue_struct *kcm_wq; 38 39 static inline struct kcm_sock *kcm_sk(const struct sock *sk) 40 { 41 return (struct kcm_sock *)sk; 42 } 43 44 static inline struct kcm_tx_msg *kcm_tx_msg(struct sk_buff *skb) 45 { 46 return (struct kcm_tx_msg *)skb->cb; 47 } 48 49 static void report_csk_error(struct sock *csk, int err) 50 { 51 csk->sk_err = EPIPE; 52 sk_error_report(csk); 53 } 54 55 static void kcm_abort_tx_psock(struct kcm_psock *psock, int err, 56 bool wakeup_kcm) 57 { 58 struct sock *csk = psock->sk; 59 struct kcm_mux *mux = psock->mux; 60 61 /* Unrecoverable error in transmit */ 62 63 spin_lock_bh(&mux->lock); 64 65 if (psock->tx_stopped) { 66 spin_unlock_bh(&mux->lock); 67 return; 68 } 69 70 psock->tx_stopped = 1; 71 KCM_STATS_INCR(psock->stats.tx_aborts); 72 73 if (!psock->tx_kcm) { 74 /* Take off psocks_avail list */ 75 list_del(&psock->psock_avail_list); 76 } else if (wakeup_kcm) { 77 /* In this case psock is being aborted while outside of 78 * write_msgs and psock is reserved. Schedule tx_work 79 * to handle the failure there. Need to commit tx_stopped 80 * before queuing work. 81 */ 82 smp_mb(); 83 84 queue_work(kcm_wq, &psock->tx_kcm->tx_work); 85 } 86 87 spin_unlock_bh(&mux->lock); 88 89 /* Report error on lower socket */ 90 report_csk_error(csk, err); 91 } 92 93 /* RX mux lock held. */ 94 static void kcm_update_rx_mux_stats(struct kcm_mux *mux, 95 struct kcm_psock *psock) 96 { 97 STRP_STATS_ADD(mux->stats.rx_bytes, 98 psock->strp.stats.bytes - 99 psock->saved_rx_bytes); 100 mux->stats.rx_msgs += 101 psock->strp.stats.msgs - psock->saved_rx_msgs; 102 psock->saved_rx_msgs = psock->strp.stats.msgs; 103 psock->saved_rx_bytes = psock->strp.stats.bytes; 104 } 105 106 static void kcm_update_tx_mux_stats(struct kcm_mux *mux, 107 struct kcm_psock *psock) 108 { 109 KCM_STATS_ADD(mux->stats.tx_bytes, 110 psock->stats.tx_bytes - psock->saved_tx_bytes); 111 mux->stats.tx_msgs += 112 psock->stats.tx_msgs - psock->saved_tx_msgs; 113 psock->saved_tx_msgs = psock->stats.tx_msgs; 114 psock->saved_tx_bytes = psock->stats.tx_bytes; 115 } 116 117 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); 118 119 /* KCM is ready to receive messages on its queue-- either the KCM is new or 120 * has become unblocked after being blocked on full socket buffer. Queue any 121 * pending ready messages on a psock. RX mux lock held. 122 */ 123 static void kcm_rcv_ready(struct kcm_sock *kcm) 124 { 125 struct kcm_mux *mux = kcm->mux; 126 struct kcm_psock *psock; 127 struct sk_buff *skb; 128 129 if (unlikely(kcm->rx_wait || kcm->rx_psock || kcm->rx_disabled)) 130 return; 131 132 while (unlikely((skb = __skb_dequeue(&mux->rx_hold_queue)))) { 133 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 134 /* Assuming buffer limit has been reached */ 135 skb_queue_head(&mux->rx_hold_queue, skb); 136 WARN_ON(!sk_rmem_alloc_get(&kcm->sk)); 137 return; 138 } 139 } 140 141 while (!list_empty(&mux->psocks_ready)) { 142 psock = list_first_entry(&mux->psocks_ready, struct kcm_psock, 143 psock_ready_list); 144 145 if (kcm_queue_rcv_skb(&kcm->sk, psock->ready_rx_msg)) { 146 /* Assuming buffer limit has been reached */ 147 WARN_ON(!sk_rmem_alloc_get(&kcm->sk)); 148 return; 149 } 150 151 /* Consumed the ready message on the psock. Schedule rx_work to 152 * get more messages. 153 */ 154 list_del(&psock->psock_ready_list); 155 psock->ready_rx_msg = NULL; 156 /* Commit clearing of ready_rx_msg for queuing work */ 157 smp_mb(); 158 159 strp_unpause(&psock->strp); 160 strp_check_rcv(&psock->strp); 161 } 162 163 /* Buffer limit is okay now, add to ready list */ 164 list_add_tail(&kcm->wait_rx_list, 165 &kcm->mux->kcm_rx_waiters); 166 /* paired with lockless reads in kcm_rfree() */ 167 WRITE_ONCE(kcm->rx_wait, true); 168 } 169 170 static void kcm_rfree(struct sk_buff *skb) 171 { 172 struct sock *sk = skb->sk; 173 struct kcm_sock *kcm = kcm_sk(sk); 174 struct kcm_mux *mux = kcm->mux; 175 unsigned int len = skb->truesize; 176 177 sk_mem_uncharge(sk, len); 178 atomic_sub(len, &sk->sk_rmem_alloc); 179 180 /* For reading rx_wait and rx_psock without holding lock */ 181 smp_mb__after_atomic(); 182 183 if (!READ_ONCE(kcm->rx_wait) && !READ_ONCE(kcm->rx_psock) && 184 sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) { 185 spin_lock_bh(&mux->rx_lock); 186 kcm_rcv_ready(kcm); 187 spin_unlock_bh(&mux->rx_lock); 188 } 189 } 190 191 static int kcm_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 192 { 193 struct sk_buff_head *list = &sk->sk_receive_queue; 194 195 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 196 return -ENOMEM; 197 198 if (!sk_rmem_schedule(sk, skb, skb->truesize)) 199 return -ENOBUFS; 200 201 skb->dev = NULL; 202 203 skb_orphan(skb); 204 skb->sk = sk; 205 skb->destructor = kcm_rfree; 206 atomic_add(skb->truesize, &sk->sk_rmem_alloc); 207 sk_mem_charge(sk, skb->truesize); 208 209 skb_queue_tail(list, skb); 210 211 if (!sock_flag(sk, SOCK_DEAD)) 212 sk->sk_data_ready(sk); 213 214 return 0; 215 } 216 217 /* Requeue received messages for a kcm socket to other kcm sockets. This is 218 * called with a kcm socket is receive disabled. 219 * RX mux lock held. 220 */ 221 static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head) 222 { 223 struct sk_buff *skb; 224 struct kcm_sock *kcm; 225 226 while ((skb = skb_dequeue(head))) { 227 /* Reset destructor to avoid calling kcm_rcv_ready */ 228 skb->destructor = sock_rfree; 229 skb_orphan(skb); 230 try_again: 231 if (list_empty(&mux->kcm_rx_waiters)) { 232 skb_queue_tail(&mux->rx_hold_queue, skb); 233 continue; 234 } 235 236 kcm = list_first_entry(&mux->kcm_rx_waiters, 237 struct kcm_sock, wait_rx_list); 238 239 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 240 /* Should mean socket buffer full */ 241 list_del(&kcm->wait_rx_list); 242 /* paired with lockless reads in kcm_rfree() */ 243 WRITE_ONCE(kcm->rx_wait, false); 244 245 /* Commit rx_wait to read in kcm_free */ 246 smp_wmb(); 247 248 goto try_again; 249 } 250 } 251 } 252 253 /* Lower sock lock held */ 254 static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, 255 struct sk_buff *head) 256 { 257 struct kcm_mux *mux = psock->mux; 258 struct kcm_sock *kcm; 259 260 WARN_ON(psock->ready_rx_msg); 261 262 if (psock->rx_kcm) 263 return psock->rx_kcm; 264 265 spin_lock_bh(&mux->rx_lock); 266 267 if (psock->rx_kcm) { 268 spin_unlock_bh(&mux->rx_lock); 269 return psock->rx_kcm; 270 } 271 272 kcm_update_rx_mux_stats(mux, psock); 273 274 if (list_empty(&mux->kcm_rx_waiters)) { 275 psock->ready_rx_msg = head; 276 strp_pause(&psock->strp); 277 list_add_tail(&psock->psock_ready_list, 278 &mux->psocks_ready); 279 spin_unlock_bh(&mux->rx_lock); 280 return NULL; 281 } 282 283 kcm = list_first_entry(&mux->kcm_rx_waiters, 284 struct kcm_sock, wait_rx_list); 285 list_del(&kcm->wait_rx_list); 286 /* paired with lockless reads in kcm_rfree() */ 287 WRITE_ONCE(kcm->rx_wait, false); 288 289 psock->rx_kcm = kcm; 290 /* paired with lockless reads in kcm_rfree() */ 291 WRITE_ONCE(kcm->rx_psock, psock); 292 293 spin_unlock_bh(&mux->rx_lock); 294 295 return kcm; 296 } 297 298 static void kcm_done(struct kcm_sock *kcm); 299 300 static void kcm_done_work(struct work_struct *w) 301 { 302 kcm_done(container_of(w, struct kcm_sock, done_work)); 303 } 304 305 /* Lower sock held */ 306 static void unreserve_rx_kcm(struct kcm_psock *psock, 307 bool rcv_ready) 308 { 309 struct kcm_sock *kcm = psock->rx_kcm; 310 struct kcm_mux *mux = psock->mux; 311 312 if (!kcm) 313 return; 314 315 spin_lock_bh(&mux->rx_lock); 316 317 psock->rx_kcm = NULL; 318 /* paired with lockless reads in kcm_rfree() */ 319 WRITE_ONCE(kcm->rx_psock, NULL); 320 321 /* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with 322 * kcm_rfree 323 */ 324 smp_mb(); 325 326 if (unlikely(kcm->done)) { 327 spin_unlock_bh(&mux->rx_lock); 328 329 /* Need to run kcm_done in a task since we need to qcquire 330 * callback locks which may already be held here. 331 */ 332 INIT_WORK(&kcm->done_work, kcm_done_work); 333 schedule_work(&kcm->done_work); 334 return; 335 } 336 337 if (unlikely(kcm->rx_disabled)) { 338 requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); 339 } else if (rcv_ready || unlikely(!sk_rmem_alloc_get(&kcm->sk))) { 340 /* Check for degenerative race with rx_wait that all 341 * data was dequeued (accounted for in kcm_rfree). 342 */ 343 kcm_rcv_ready(kcm); 344 } 345 spin_unlock_bh(&mux->rx_lock); 346 } 347 348 /* Lower sock lock held */ 349 static void psock_data_ready(struct sock *sk) 350 { 351 struct kcm_psock *psock; 352 353 trace_sk_data_ready(sk); 354 355 read_lock_bh(&sk->sk_callback_lock); 356 357 psock = (struct kcm_psock *)sk->sk_user_data; 358 if (likely(psock)) 359 strp_data_ready(&psock->strp); 360 361 read_unlock_bh(&sk->sk_callback_lock); 362 } 363 364 /* Called with lower sock held */ 365 static void kcm_rcv_strparser(struct strparser *strp, struct sk_buff *skb) 366 { 367 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 368 struct kcm_sock *kcm; 369 370 try_queue: 371 kcm = reserve_rx_kcm(psock, skb); 372 if (!kcm) { 373 /* Unable to reserve a KCM, message is held in psock and strp 374 * is paused. 375 */ 376 return; 377 } 378 379 if (kcm_queue_rcv_skb(&kcm->sk, skb)) { 380 /* Should mean socket buffer full */ 381 unreserve_rx_kcm(psock, false); 382 goto try_queue; 383 } 384 } 385 386 static int kcm_parse_func_strparser(struct strparser *strp, struct sk_buff *skb) 387 { 388 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 389 struct bpf_prog *prog = psock->bpf_prog; 390 int res; 391 392 res = bpf_prog_run_pin_on_cpu(prog, skb); 393 return res; 394 } 395 396 static int kcm_read_sock_done(struct strparser *strp, int err) 397 { 398 struct kcm_psock *psock = container_of(strp, struct kcm_psock, strp); 399 400 unreserve_rx_kcm(psock, true); 401 402 return err; 403 } 404 405 static void psock_state_change(struct sock *sk) 406 { 407 /* TCP only does a EPOLLIN for a half close. Do a EPOLLHUP here 408 * since application will normally not poll with EPOLLIN 409 * on the TCP sockets. 410 */ 411 412 report_csk_error(sk, EPIPE); 413 } 414 415 static void psock_write_space(struct sock *sk) 416 { 417 struct kcm_psock *psock; 418 struct kcm_mux *mux; 419 struct kcm_sock *kcm; 420 421 read_lock_bh(&sk->sk_callback_lock); 422 423 psock = (struct kcm_psock *)sk->sk_user_data; 424 if (unlikely(!psock)) 425 goto out; 426 mux = psock->mux; 427 428 spin_lock_bh(&mux->lock); 429 430 /* Check if the socket is reserved so someone is waiting for sending. */ 431 kcm = psock->tx_kcm; 432 if (kcm && !unlikely(kcm->tx_stopped)) 433 queue_work(kcm_wq, &kcm->tx_work); 434 435 spin_unlock_bh(&mux->lock); 436 out: 437 read_unlock_bh(&sk->sk_callback_lock); 438 } 439 440 static void unreserve_psock(struct kcm_sock *kcm); 441 442 /* kcm sock is locked. */ 443 static struct kcm_psock *reserve_psock(struct kcm_sock *kcm) 444 { 445 struct kcm_mux *mux = kcm->mux; 446 struct kcm_psock *psock; 447 448 psock = kcm->tx_psock; 449 450 smp_rmb(); /* Must read tx_psock before tx_wait */ 451 452 if (psock) { 453 WARN_ON(kcm->tx_wait); 454 if (unlikely(psock->tx_stopped)) 455 unreserve_psock(kcm); 456 else 457 return kcm->tx_psock; 458 } 459 460 spin_lock_bh(&mux->lock); 461 462 /* Check again under lock to see if psock was reserved for this 463 * psock via psock_unreserve. 464 */ 465 psock = kcm->tx_psock; 466 if (unlikely(psock)) { 467 WARN_ON(kcm->tx_wait); 468 spin_unlock_bh(&mux->lock); 469 return kcm->tx_psock; 470 } 471 472 if (!list_empty(&mux->psocks_avail)) { 473 psock = list_first_entry(&mux->psocks_avail, 474 struct kcm_psock, 475 psock_avail_list); 476 list_del(&psock->psock_avail_list); 477 if (kcm->tx_wait) { 478 list_del(&kcm->wait_psock_list); 479 kcm->tx_wait = false; 480 } 481 kcm->tx_psock = psock; 482 psock->tx_kcm = kcm; 483 KCM_STATS_INCR(psock->stats.reserved); 484 } else if (!kcm->tx_wait) { 485 list_add_tail(&kcm->wait_psock_list, 486 &mux->kcm_tx_waiters); 487 kcm->tx_wait = true; 488 } 489 490 spin_unlock_bh(&mux->lock); 491 492 return psock; 493 } 494 495 /* mux lock held */ 496 static void psock_now_avail(struct kcm_psock *psock) 497 { 498 struct kcm_mux *mux = psock->mux; 499 struct kcm_sock *kcm; 500 501 if (list_empty(&mux->kcm_tx_waiters)) { 502 list_add_tail(&psock->psock_avail_list, 503 &mux->psocks_avail); 504 } else { 505 kcm = list_first_entry(&mux->kcm_tx_waiters, 506 struct kcm_sock, 507 wait_psock_list); 508 list_del(&kcm->wait_psock_list); 509 kcm->tx_wait = false; 510 psock->tx_kcm = kcm; 511 512 /* Commit before changing tx_psock since that is read in 513 * reserve_psock before queuing work. 514 */ 515 smp_mb(); 516 517 kcm->tx_psock = psock; 518 KCM_STATS_INCR(psock->stats.reserved); 519 queue_work(kcm_wq, &kcm->tx_work); 520 } 521 } 522 523 /* kcm sock is locked. */ 524 static void unreserve_psock(struct kcm_sock *kcm) 525 { 526 struct kcm_psock *psock; 527 struct kcm_mux *mux = kcm->mux; 528 529 spin_lock_bh(&mux->lock); 530 531 psock = kcm->tx_psock; 532 533 if (WARN_ON(!psock)) { 534 spin_unlock_bh(&mux->lock); 535 return; 536 } 537 538 smp_rmb(); /* Read tx_psock before tx_wait */ 539 540 kcm_update_tx_mux_stats(mux, psock); 541 542 WARN_ON(kcm->tx_wait); 543 544 kcm->tx_psock = NULL; 545 psock->tx_kcm = NULL; 546 KCM_STATS_INCR(psock->stats.unreserved); 547 548 if (unlikely(psock->tx_stopped)) { 549 if (psock->done) { 550 /* Deferred free */ 551 list_del(&psock->psock_list); 552 mux->psocks_cnt--; 553 sock_put(psock->sk); 554 fput(psock->sk->sk_socket->file); 555 kmem_cache_free(kcm_psockp, psock); 556 } 557 558 /* Don't put back on available list */ 559 560 spin_unlock_bh(&mux->lock); 561 562 return; 563 } 564 565 psock_now_avail(psock); 566 567 spin_unlock_bh(&mux->lock); 568 } 569 570 static void kcm_report_tx_retry(struct kcm_sock *kcm) 571 { 572 struct kcm_mux *mux = kcm->mux; 573 574 spin_lock_bh(&mux->lock); 575 KCM_STATS_INCR(mux->stats.tx_retries); 576 spin_unlock_bh(&mux->lock); 577 } 578 579 /* Write any messages ready on the kcm socket. Called with kcm sock lock 580 * held. Return bytes actually sent or error. 581 */ 582 static int kcm_write_msgs(struct kcm_sock *kcm) 583 { 584 unsigned int total_sent = 0; 585 struct sock *sk = &kcm->sk; 586 struct kcm_psock *psock; 587 struct sk_buff *head; 588 int ret = 0; 589 590 kcm->tx_wait_more = false; 591 psock = kcm->tx_psock; 592 if (unlikely(psock && psock->tx_stopped)) { 593 /* A reserved psock was aborted asynchronously. Unreserve 594 * it and we'll retry the message. 595 */ 596 unreserve_psock(kcm); 597 kcm_report_tx_retry(kcm); 598 if (skb_queue_empty(&sk->sk_write_queue)) 599 return 0; 600 601 kcm_tx_msg(skb_peek(&sk->sk_write_queue))->started_tx = false; 602 } 603 604 retry: 605 while ((head = skb_peek(&sk->sk_write_queue))) { 606 struct msghdr msg = { 607 .msg_flags = MSG_DONTWAIT | MSG_SPLICE_PAGES, 608 }; 609 struct kcm_tx_msg *txm = kcm_tx_msg(head); 610 struct sk_buff *skb; 611 unsigned int msize; 612 int i; 613 614 if (!txm->started_tx) { 615 psock = reserve_psock(kcm); 616 if (!psock) 617 goto out; 618 skb = head; 619 txm->frag_offset = 0; 620 txm->sent = 0; 621 txm->started_tx = true; 622 } else { 623 if (WARN_ON(!psock)) { 624 ret = -EINVAL; 625 goto out; 626 } 627 skb = txm->frag_skb; 628 } 629 630 if (WARN_ON(!skb_shinfo(skb)->nr_frags) || 631 WARN_ON_ONCE(!skb_frag_page(&skb_shinfo(skb)->frags[0]))) { 632 ret = -EINVAL; 633 goto out; 634 } 635 636 msize = 0; 637 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) 638 msize += skb_frag_size(&skb_shinfo(skb)->frags[i]); 639 640 iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, 641 (const struct bio_vec *)skb_shinfo(skb)->frags, 642 skb_shinfo(skb)->nr_frags, msize); 643 iov_iter_advance(&msg.msg_iter, txm->frag_offset); 644 645 do { 646 ret = sock_sendmsg(psock->sk->sk_socket, &msg); 647 if (ret <= 0) { 648 if (ret == -EAGAIN) { 649 /* Save state to try again when there's 650 * write space on the socket 651 */ 652 txm->frag_skb = skb; 653 ret = 0; 654 goto out; 655 } 656 657 /* Hard failure in sending message, abort this 658 * psock since it has lost framing 659 * synchronization and retry sending the 660 * message from the beginning. 661 */ 662 kcm_abort_tx_psock(psock, ret ? -ret : EPIPE, 663 true); 664 unreserve_psock(kcm); 665 psock = NULL; 666 667 txm->started_tx = false; 668 kcm_report_tx_retry(kcm); 669 ret = 0; 670 goto retry; 671 } 672 673 txm->sent += ret; 674 txm->frag_offset += ret; 675 KCM_STATS_ADD(psock->stats.tx_bytes, ret); 676 } while (msg.msg_iter.count > 0); 677 678 if (skb == head) { 679 if (skb_has_frag_list(skb)) { 680 txm->frag_skb = skb_shinfo(skb)->frag_list; 681 txm->frag_offset = 0; 682 continue; 683 } 684 } else if (skb->next) { 685 txm->frag_skb = skb->next; 686 txm->frag_offset = 0; 687 continue; 688 } 689 690 /* Successfully sent the whole packet, account for it. */ 691 sk->sk_wmem_queued -= txm->sent; 692 total_sent += txm->sent; 693 skb_dequeue(&sk->sk_write_queue); 694 kfree_skb(head); 695 KCM_STATS_INCR(psock->stats.tx_msgs); 696 } 697 out: 698 if (!head) { 699 /* Done with all queued messages. */ 700 WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); 701 if (psock) 702 unreserve_psock(kcm); 703 } 704 705 /* Check if write space is available */ 706 sk->sk_write_space(sk); 707 708 return total_sent ? : ret; 709 } 710 711 static void kcm_tx_work(struct work_struct *w) 712 { 713 struct kcm_sock *kcm = container_of(w, struct kcm_sock, tx_work); 714 struct sock *sk = &kcm->sk; 715 int err; 716 717 lock_sock(sk); 718 719 /* Primarily for SOCK_DGRAM sockets, also handle asynchronous tx 720 * aborts 721 */ 722 err = kcm_write_msgs(kcm); 723 if (err < 0) { 724 /* Hard failure in write, report error on KCM socket */ 725 pr_warn("KCM: Hard failure on kcm_write_msgs %d\n", err); 726 report_csk_error(&kcm->sk, -err); 727 goto out; 728 } 729 730 /* Primarily for SOCK_SEQPACKET sockets */ 731 if (likely(sk->sk_socket) && 732 test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { 733 clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 734 sk->sk_write_space(sk); 735 } 736 737 out: 738 release_sock(sk); 739 } 740 741 static void kcm_push(struct kcm_sock *kcm) 742 { 743 if (kcm->tx_wait_more) 744 kcm_write_msgs(kcm); 745 } 746 747 static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 748 { 749 struct sock *sk = sock->sk; 750 struct kcm_sock *kcm = kcm_sk(sk); 751 struct sk_buff *skb = NULL, *head = NULL; 752 size_t copy, copied = 0; 753 long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 754 int eor = (sock->type == SOCK_DGRAM) ? 755 !(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR); 756 int err = -EPIPE; 757 758 mutex_lock(&kcm->tx_mutex); 759 lock_sock(sk); 760 761 /* Per tcp_sendmsg this should be in poll */ 762 sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); 763 764 if (sk->sk_err) 765 goto out_error; 766 767 if (kcm->seq_skb) { 768 /* Previously opened message */ 769 head = kcm->seq_skb; 770 skb = kcm_tx_msg(head)->last_skb; 771 goto start; 772 } 773 774 /* Call the sk_stream functions to manage the sndbuf mem. */ 775 if (!sk_stream_memory_free(sk)) { 776 kcm_push(kcm); 777 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); 778 err = sk_stream_wait_memory(sk, &timeo); 779 if (err) 780 goto out_error; 781 } 782 783 if (msg_data_left(msg)) { 784 /* New message, alloc head skb */ 785 head = alloc_skb(0, sk->sk_allocation); 786 while (!head) { 787 kcm_push(kcm); 788 err = sk_stream_wait_memory(sk, &timeo); 789 if (err) 790 goto out_error; 791 792 head = alloc_skb(0, sk->sk_allocation); 793 } 794 795 skb = head; 796 797 /* Set ip_summed to CHECKSUM_UNNECESSARY to avoid calling 798 * csum_and_copy_from_iter from skb_do_copy_data_nocache. 799 */ 800 skb->ip_summed = CHECKSUM_UNNECESSARY; 801 } 802 803 start: 804 while (msg_data_left(msg)) { 805 bool merge = true; 806 int i = skb_shinfo(skb)->nr_frags; 807 struct page_frag *pfrag = sk_page_frag(sk); 808 809 if (!sk_page_frag_refill(sk, pfrag)) 810 goto wait_for_memory; 811 812 if (!skb_can_coalesce(skb, i, pfrag->page, 813 pfrag->offset)) { 814 if (i == MAX_SKB_FRAGS) { 815 struct sk_buff *tskb; 816 817 tskb = alloc_skb(0, sk->sk_allocation); 818 if (!tskb) 819 goto wait_for_memory; 820 821 if (head == skb) 822 skb_shinfo(head)->frag_list = tskb; 823 else 824 skb->next = tskb; 825 826 skb = tskb; 827 skb->ip_summed = CHECKSUM_UNNECESSARY; 828 continue; 829 } 830 merge = false; 831 } 832 833 if (msg->msg_flags & MSG_SPLICE_PAGES) { 834 copy = msg_data_left(msg); 835 if (!sk_wmem_schedule(sk, copy)) 836 goto wait_for_memory; 837 838 err = skb_splice_from_iter(skb, &msg->msg_iter, copy, 839 sk->sk_allocation); 840 if (err < 0) { 841 if (err == -EMSGSIZE) 842 goto wait_for_memory; 843 goto out_error; 844 } 845 846 copy = err; 847 skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; 848 sk_wmem_queued_add(sk, copy); 849 sk_mem_charge(sk, copy); 850 851 if (head != skb) 852 head->truesize += copy; 853 } else { 854 copy = min_t(int, msg_data_left(msg), 855 pfrag->size - pfrag->offset); 856 if (!sk_wmem_schedule(sk, copy)) 857 goto wait_for_memory; 858 859 err = skb_copy_to_page_nocache(sk, &msg->msg_iter, skb, 860 pfrag->page, 861 pfrag->offset, 862 copy); 863 if (err) 864 goto out_error; 865 866 /* Update the skb. */ 867 if (merge) { 868 skb_frag_size_add( 869 &skb_shinfo(skb)->frags[i - 1], copy); 870 } else { 871 skb_fill_page_desc(skb, i, pfrag->page, 872 pfrag->offset, copy); 873 get_page(pfrag->page); 874 } 875 876 pfrag->offset += copy; 877 } 878 879 copied += copy; 880 if (head != skb) { 881 head->len += copy; 882 head->data_len += copy; 883 } 884 885 continue; 886 887 wait_for_memory: 888 kcm_push(kcm); 889 err = sk_stream_wait_memory(sk, &timeo); 890 if (err) 891 goto out_error; 892 } 893 894 if (eor) { 895 bool not_busy = skb_queue_empty(&sk->sk_write_queue); 896 897 if (head) { 898 /* Message complete, queue it on send buffer */ 899 __skb_queue_tail(&sk->sk_write_queue, head); 900 kcm->seq_skb = NULL; 901 KCM_STATS_INCR(kcm->stats.tx_msgs); 902 } 903 904 if (msg->msg_flags & MSG_BATCH) { 905 kcm->tx_wait_more = true; 906 } else if (kcm->tx_wait_more || not_busy) { 907 err = kcm_write_msgs(kcm); 908 if (err < 0) { 909 /* We got a hard error in write_msgs but have 910 * already queued this message. Report an error 911 * in the socket, but don't affect return value 912 * from sendmsg 913 */ 914 pr_warn("KCM: Hard failure on kcm_write_msgs\n"); 915 report_csk_error(&kcm->sk, -err); 916 } 917 } 918 } else { 919 /* Message not complete, save state */ 920 partial_message: 921 if (head) { 922 kcm->seq_skb = head; 923 kcm_tx_msg(head)->last_skb = skb; 924 } 925 } 926 927 KCM_STATS_ADD(kcm->stats.tx_bytes, copied); 928 929 release_sock(sk); 930 mutex_unlock(&kcm->tx_mutex); 931 return copied; 932 933 out_error: 934 kcm_push(kcm); 935 936 if (sock->type == SOCK_SEQPACKET) { 937 /* Wrote some bytes before encountering an 938 * error, return partial success. 939 */ 940 if (copied) 941 goto partial_message; 942 if (head != kcm->seq_skb) 943 kfree_skb(head); 944 } else { 945 kfree_skb(head); 946 kcm->seq_skb = NULL; 947 } 948 949 err = sk_stream_error(sk, msg->msg_flags, err); 950 951 /* make sure we wake any epoll edge trigger waiter */ 952 if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 && err == -EAGAIN)) 953 sk->sk_write_space(sk); 954 955 release_sock(sk); 956 mutex_unlock(&kcm->tx_mutex); 957 return err; 958 } 959 960 static void kcm_splice_eof(struct socket *sock) 961 { 962 struct sock *sk = sock->sk; 963 struct kcm_sock *kcm = kcm_sk(sk); 964 965 if (skb_queue_empty_lockless(&sk->sk_write_queue)) 966 return; 967 968 lock_sock(sk); 969 kcm_write_msgs(kcm); 970 release_sock(sk); 971 } 972 973 static int kcm_recvmsg(struct socket *sock, struct msghdr *msg, 974 size_t len, int flags) 975 { 976 struct sock *sk = sock->sk; 977 struct kcm_sock *kcm = kcm_sk(sk); 978 int err = 0; 979 struct strp_msg *stm; 980 int copied = 0; 981 struct sk_buff *skb; 982 983 skb = skb_recv_datagram(sk, flags, &err); 984 if (!skb) 985 goto out; 986 987 /* Okay, have a message on the receive queue */ 988 989 stm = strp_msg(skb); 990 991 if (len > stm->full_len) 992 len = stm->full_len; 993 994 err = skb_copy_datagram_msg(skb, stm->offset, msg, len); 995 if (err < 0) 996 goto out; 997 998 copied = len; 999 if (likely(!(flags & MSG_PEEK))) { 1000 KCM_STATS_ADD(kcm->stats.rx_bytes, copied); 1001 if (copied < stm->full_len) { 1002 if (sock->type == SOCK_DGRAM) { 1003 /* Truncated message */ 1004 msg->msg_flags |= MSG_TRUNC; 1005 goto msg_finished; 1006 } 1007 stm->offset += copied; 1008 stm->full_len -= copied; 1009 } else { 1010 msg_finished: 1011 /* Finished with message */ 1012 msg->msg_flags |= MSG_EOR; 1013 KCM_STATS_INCR(kcm->stats.rx_msgs); 1014 } 1015 } 1016 1017 out: 1018 skb_free_datagram(sk, skb); 1019 return copied ? : err; 1020 } 1021 1022 static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos, 1023 struct pipe_inode_info *pipe, size_t len, 1024 unsigned int flags) 1025 { 1026 struct sock *sk = sock->sk; 1027 struct kcm_sock *kcm = kcm_sk(sk); 1028 struct strp_msg *stm; 1029 int err = 0; 1030 ssize_t copied; 1031 struct sk_buff *skb; 1032 1033 /* Only support splice for SOCKSEQPACKET */ 1034 1035 skb = skb_recv_datagram(sk, flags, &err); 1036 if (!skb) 1037 goto err_out; 1038 1039 /* Okay, have a message on the receive queue */ 1040 1041 stm = strp_msg(skb); 1042 1043 if (len > stm->full_len) 1044 len = stm->full_len; 1045 1046 copied = skb_splice_bits(skb, sk, stm->offset, pipe, len, flags); 1047 if (copied < 0) { 1048 err = copied; 1049 goto err_out; 1050 } 1051 1052 KCM_STATS_ADD(kcm->stats.rx_bytes, copied); 1053 1054 stm->offset += copied; 1055 stm->full_len -= copied; 1056 1057 /* We have no way to return MSG_EOR. If all the bytes have been 1058 * read we still leave the message in the receive socket buffer. 1059 * A subsequent recvmsg needs to be done to return MSG_EOR and 1060 * finish reading the message. 1061 */ 1062 1063 skb_free_datagram(sk, skb); 1064 return copied; 1065 1066 err_out: 1067 skb_free_datagram(sk, skb); 1068 return err; 1069 } 1070 1071 /* kcm sock lock held */ 1072 static void kcm_recv_disable(struct kcm_sock *kcm) 1073 { 1074 struct kcm_mux *mux = kcm->mux; 1075 1076 if (kcm->rx_disabled) 1077 return; 1078 1079 spin_lock_bh(&mux->rx_lock); 1080 1081 kcm->rx_disabled = 1; 1082 1083 /* If a psock is reserved we'll do cleanup in unreserve */ 1084 if (!kcm->rx_psock) { 1085 if (kcm->rx_wait) { 1086 list_del(&kcm->wait_rx_list); 1087 /* paired with lockless reads in kcm_rfree() */ 1088 WRITE_ONCE(kcm->rx_wait, false); 1089 } 1090 1091 requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue); 1092 } 1093 1094 spin_unlock_bh(&mux->rx_lock); 1095 } 1096 1097 /* kcm sock lock held */ 1098 static void kcm_recv_enable(struct kcm_sock *kcm) 1099 { 1100 struct kcm_mux *mux = kcm->mux; 1101 1102 if (!kcm->rx_disabled) 1103 return; 1104 1105 spin_lock_bh(&mux->rx_lock); 1106 1107 kcm->rx_disabled = 0; 1108 kcm_rcv_ready(kcm); 1109 1110 spin_unlock_bh(&mux->rx_lock); 1111 } 1112 1113 static int kcm_setsockopt(struct socket *sock, int level, int optname, 1114 sockptr_t optval, unsigned int optlen) 1115 { 1116 struct kcm_sock *kcm = kcm_sk(sock->sk); 1117 int val, valbool; 1118 int err = 0; 1119 1120 if (level != SOL_KCM) 1121 return -ENOPROTOOPT; 1122 1123 if (optlen < sizeof(int)) 1124 return -EINVAL; 1125 1126 if (copy_from_sockptr(&val, optval, sizeof(int))) 1127 return -EFAULT; 1128 1129 valbool = val ? 1 : 0; 1130 1131 switch (optname) { 1132 case KCM_RECV_DISABLE: 1133 lock_sock(&kcm->sk); 1134 if (valbool) 1135 kcm_recv_disable(kcm); 1136 else 1137 kcm_recv_enable(kcm); 1138 release_sock(&kcm->sk); 1139 break; 1140 default: 1141 err = -ENOPROTOOPT; 1142 } 1143 1144 return err; 1145 } 1146 1147 static int kcm_getsockopt(struct socket *sock, int level, int optname, 1148 char __user *optval, int __user *optlen) 1149 { 1150 struct kcm_sock *kcm = kcm_sk(sock->sk); 1151 int val, len; 1152 1153 if (level != SOL_KCM) 1154 return -ENOPROTOOPT; 1155 1156 if (get_user(len, optlen)) 1157 return -EFAULT; 1158 1159 if (len < 0) 1160 return -EINVAL; 1161 1162 len = min_t(unsigned int, len, sizeof(int)); 1163 1164 switch (optname) { 1165 case KCM_RECV_DISABLE: 1166 val = kcm->rx_disabled; 1167 break; 1168 default: 1169 return -ENOPROTOOPT; 1170 } 1171 1172 if (put_user(len, optlen)) 1173 return -EFAULT; 1174 if (copy_to_user(optval, &val, len)) 1175 return -EFAULT; 1176 return 0; 1177 } 1178 1179 static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux) 1180 { 1181 struct kcm_sock *tkcm; 1182 struct list_head *head; 1183 int index = 0; 1184 1185 /* For SOCK_SEQPACKET sock type, datagram_poll checks the sk_state, so 1186 * we set sk_state, otherwise epoll_wait always returns right away with 1187 * EPOLLHUP 1188 */ 1189 kcm->sk.sk_state = TCP_ESTABLISHED; 1190 1191 /* Add to mux's kcm sockets list */ 1192 kcm->mux = mux; 1193 spin_lock_bh(&mux->lock); 1194 1195 head = &mux->kcm_socks; 1196 list_for_each_entry(tkcm, &mux->kcm_socks, kcm_sock_list) { 1197 if (tkcm->index != index) 1198 break; 1199 head = &tkcm->kcm_sock_list; 1200 index++; 1201 } 1202 1203 list_add(&kcm->kcm_sock_list, head); 1204 kcm->index = index; 1205 1206 mux->kcm_socks_cnt++; 1207 spin_unlock_bh(&mux->lock); 1208 1209 INIT_WORK(&kcm->tx_work, kcm_tx_work); 1210 mutex_init(&kcm->tx_mutex); 1211 1212 spin_lock_bh(&mux->rx_lock); 1213 kcm_rcv_ready(kcm); 1214 spin_unlock_bh(&mux->rx_lock); 1215 } 1216 1217 static int kcm_attach(struct socket *sock, struct socket *csock, 1218 struct bpf_prog *prog) 1219 { 1220 struct kcm_sock *kcm = kcm_sk(sock->sk); 1221 struct kcm_mux *mux = kcm->mux; 1222 struct sock *csk; 1223 struct kcm_psock *psock = NULL, *tpsock; 1224 struct list_head *head; 1225 int index = 0; 1226 static const struct strp_callbacks cb = { 1227 .rcv_msg = kcm_rcv_strparser, 1228 .parse_msg = kcm_parse_func_strparser, 1229 .read_sock_done = kcm_read_sock_done, 1230 }; 1231 int err = 0; 1232 1233 csk = csock->sk; 1234 if (!csk) 1235 return -EINVAL; 1236 1237 lock_sock(csk); 1238 1239 /* Only allow TCP sockets to be attached for now */ 1240 if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) || 1241 csk->sk_protocol != IPPROTO_TCP) { 1242 err = -EOPNOTSUPP; 1243 goto out; 1244 } 1245 1246 /* Don't allow listeners or closed sockets */ 1247 if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) { 1248 err = -EOPNOTSUPP; 1249 goto out; 1250 } 1251 1252 psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); 1253 if (!psock) { 1254 err = -ENOMEM; 1255 goto out; 1256 } 1257 1258 psock->mux = mux; 1259 psock->sk = csk; 1260 psock->bpf_prog = prog; 1261 1262 write_lock_bh(&csk->sk_callback_lock); 1263 1264 /* Check if sk_user_data is already by KCM or someone else. 1265 * Must be done under lock to prevent race conditions. 1266 */ 1267 if (csk->sk_user_data) { 1268 write_unlock_bh(&csk->sk_callback_lock); 1269 kmem_cache_free(kcm_psockp, psock); 1270 err = -EALREADY; 1271 goto out; 1272 } 1273 1274 err = strp_init(&psock->strp, csk, &cb); 1275 if (err) { 1276 write_unlock_bh(&csk->sk_callback_lock); 1277 kmem_cache_free(kcm_psockp, psock); 1278 goto out; 1279 } 1280 1281 psock->save_data_ready = csk->sk_data_ready; 1282 psock->save_write_space = csk->sk_write_space; 1283 psock->save_state_change = csk->sk_state_change; 1284 csk->sk_user_data = psock; 1285 csk->sk_data_ready = psock_data_ready; 1286 csk->sk_write_space = psock_write_space; 1287 csk->sk_state_change = psock_state_change; 1288 1289 write_unlock_bh(&csk->sk_callback_lock); 1290 1291 sock_hold(csk); 1292 1293 /* Finished initialization, now add the psock to the MUX. */ 1294 spin_lock_bh(&mux->lock); 1295 head = &mux->psocks; 1296 list_for_each_entry(tpsock, &mux->psocks, psock_list) { 1297 if (tpsock->index != index) 1298 break; 1299 head = &tpsock->psock_list; 1300 index++; 1301 } 1302 1303 list_add(&psock->psock_list, head); 1304 psock->index = index; 1305 1306 KCM_STATS_INCR(mux->stats.psock_attach); 1307 mux->psocks_cnt++; 1308 psock_now_avail(psock); 1309 spin_unlock_bh(&mux->lock); 1310 1311 /* Schedule RX work in case there are already bytes queued */ 1312 strp_check_rcv(&psock->strp); 1313 1314 out: 1315 release_sock(csk); 1316 1317 return err; 1318 } 1319 1320 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info) 1321 { 1322 struct socket *csock; 1323 struct bpf_prog *prog; 1324 int err; 1325 1326 csock = sockfd_lookup(info->fd, &err); 1327 if (!csock) 1328 return -ENOENT; 1329 1330 prog = bpf_prog_get_type(info->bpf_fd, BPF_PROG_TYPE_SOCKET_FILTER); 1331 if (IS_ERR(prog)) { 1332 err = PTR_ERR(prog); 1333 goto out; 1334 } 1335 1336 err = kcm_attach(sock, csock, prog); 1337 if (err) { 1338 bpf_prog_put(prog); 1339 goto out; 1340 } 1341 1342 /* Keep reference on file also */ 1343 1344 return 0; 1345 out: 1346 sockfd_put(csock); 1347 return err; 1348 } 1349 1350 static void kcm_unattach(struct kcm_psock *psock) 1351 { 1352 struct sock *csk = psock->sk; 1353 struct kcm_mux *mux = psock->mux; 1354 1355 lock_sock(csk); 1356 1357 /* Stop getting callbacks from TCP socket. After this there should 1358 * be no way to reserve a kcm for this psock. 1359 */ 1360 write_lock_bh(&csk->sk_callback_lock); 1361 csk->sk_user_data = NULL; 1362 csk->sk_data_ready = psock->save_data_ready; 1363 csk->sk_write_space = psock->save_write_space; 1364 csk->sk_state_change = psock->save_state_change; 1365 strp_stop(&psock->strp); 1366 1367 if (WARN_ON(psock->rx_kcm)) { 1368 write_unlock_bh(&csk->sk_callback_lock); 1369 release_sock(csk); 1370 return; 1371 } 1372 1373 spin_lock_bh(&mux->rx_lock); 1374 1375 /* Stop receiver activities. After this point psock should not be 1376 * able to get onto ready list either through callbacks or work. 1377 */ 1378 if (psock->ready_rx_msg) { 1379 list_del(&psock->psock_ready_list); 1380 kfree_skb(psock->ready_rx_msg); 1381 psock->ready_rx_msg = NULL; 1382 KCM_STATS_INCR(mux->stats.rx_ready_drops); 1383 } 1384 1385 spin_unlock_bh(&mux->rx_lock); 1386 1387 write_unlock_bh(&csk->sk_callback_lock); 1388 1389 /* Call strp_done without sock lock */ 1390 release_sock(csk); 1391 strp_done(&psock->strp); 1392 lock_sock(csk); 1393 1394 bpf_prog_put(psock->bpf_prog); 1395 1396 spin_lock_bh(&mux->lock); 1397 1398 aggregate_psock_stats(&psock->stats, &mux->aggregate_psock_stats); 1399 save_strp_stats(&psock->strp, &mux->aggregate_strp_stats); 1400 1401 KCM_STATS_INCR(mux->stats.psock_unattach); 1402 1403 if (psock->tx_kcm) { 1404 /* psock was reserved. Just mark it finished and we will clean 1405 * up in the kcm paths, we need kcm lock which can not be 1406 * acquired here. 1407 */ 1408 KCM_STATS_INCR(mux->stats.psock_unattach_rsvd); 1409 spin_unlock_bh(&mux->lock); 1410 1411 /* We are unattaching a socket that is reserved. Abort the 1412 * socket since we may be out of sync in sending on it. We need 1413 * to do this without the mux lock. 1414 */ 1415 kcm_abort_tx_psock(psock, EPIPE, false); 1416 1417 spin_lock_bh(&mux->lock); 1418 if (!psock->tx_kcm) { 1419 /* psock now unreserved in window mux was unlocked */ 1420 goto no_reserved; 1421 } 1422 psock->done = 1; 1423 1424 /* Commit done before queuing work to process it */ 1425 smp_mb(); 1426 1427 /* Queue tx work to make sure psock->done is handled */ 1428 queue_work(kcm_wq, &psock->tx_kcm->tx_work); 1429 spin_unlock_bh(&mux->lock); 1430 } else { 1431 no_reserved: 1432 if (!psock->tx_stopped) 1433 list_del(&psock->psock_avail_list); 1434 list_del(&psock->psock_list); 1435 mux->psocks_cnt--; 1436 spin_unlock_bh(&mux->lock); 1437 1438 sock_put(csk); 1439 fput(csk->sk_socket->file); 1440 kmem_cache_free(kcm_psockp, psock); 1441 } 1442 1443 release_sock(csk); 1444 } 1445 1446 static int kcm_unattach_ioctl(struct socket *sock, struct kcm_unattach *info) 1447 { 1448 struct kcm_sock *kcm = kcm_sk(sock->sk); 1449 struct kcm_mux *mux = kcm->mux; 1450 struct kcm_psock *psock; 1451 struct socket *csock; 1452 struct sock *csk; 1453 int err; 1454 1455 csock = sockfd_lookup(info->fd, &err); 1456 if (!csock) 1457 return -ENOENT; 1458 1459 csk = csock->sk; 1460 if (!csk) { 1461 err = -EINVAL; 1462 goto out; 1463 } 1464 1465 err = -ENOENT; 1466 1467 spin_lock_bh(&mux->lock); 1468 1469 list_for_each_entry(psock, &mux->psocks, psock_list) { 1470 if (psock->sk != csk) 1471 continue; 1472 1473 /* Found the matching psock */ 1474 1475 if (psock->unattaching || WARN_ON(psock->done)) { 1476 err = -EALREADY; 1477 break; 1478 } 1479 1480 psock->unattaching = 1; 1481 1482 spin_unlock_bh(&mux->lock); 1483 1484 /* Lower socket lock should already be held */ 1485 kcm_unattach(psock); 1486 1487 err = 0; 1488 goto out; 1489 } 1490 1491 spin_unlock_bh(&mux->lock); 1492 1493 out: 1494 sockfd_put(csock); 1495 return err; 1496 } 1497 1498 static struct proto kcm_proto = { 1499 .name = "KCM", 1500 .owner = THIS_MODULE, 1501 .obj_size = sizeof(struct kcm_sock), 1502 }; 1503 1504 /* Clone a kcm socket. */ 1505 static struct file *kcm_clone(struct socket *osock) 1506 { 1507 struct socket *newsock; 1508 struct sock *newsk; 1509 1510 newsock = sock_alloc(); 1511 if (!newsock) 1512 return ERR_PTR(-ENFILE); 1513 1514 newsock->type = osock->type; 1515 newsock->ops = osock->ops; 1516 1517 __module_get(newsock->ops->owner); 1518 1519 newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL, 1520 &kcm_proto, false); 1521 if (!newsk) { 1522 sock_release(newsock); 1523 return ERR_PTR(-ENOMEM); 1524 } 1525 sock_init_data(newsock, newsk); 1526 init_kcm_sock(kcm_sk(newsk), kcm_sk(osock->sk)->mux); 1527 1528 return sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name); 1529 } 1530 1531 static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 1532 { 1533 int err; 1534 1535 switch (cmd) { 1536 case SIOCKCMATTACH: { 1537 struct kcm_attach info; 1538 1539 if (copy_from_user(&info, (void __user *)arg, sizeof(info))) 1540 return -EFAULT; 1541 1542 err = kcm_attach_ioctl(sock, &info); 1543 1544 break; 1545 } 1546 case SIOCKCMUNATTACH: { 1547 struct kcm_unattach info; 1548 1549 if (copy_from_user(&info, (void __user *)arg, sizeof(info))) 1550 return -EFAULT; 1551 1552 err = kcm_unattach_ioctl(sock, &info); 1553 1554 break; 1555 } 1556 case SIOCKCMCLONE: { 1557 struct kcm_clone info; 1558 struct file *file; 1559 1560 info.fd = get_unused_fd_flags(0); 1561 if (unlikely(info.fd < 0)) 1562 return info.fd; 1563 1564 file = kcm_clone(sock); 1565 if (IS_ERR(file)) { 1566 put_unused_fd(info.fd); 1567 return PTR_ERR(file); 1568 } 1569 if (copy_to_user((void __user *)arg, &info, 1570 sizeof(info))) { 1571 put_unused_fd(info.fd); 1572 fput(file); 1573 return -EFAULT; 1574 } 1575 fd_install(info.fd, file); 1576 err = 0; 1577 break; 1578 } 1579 default: 1580 err = -ENOIOCTLCMD; 1581 break; 1582 } 1583 1584 return err; 1585 } 1586 1587 static void free_mux(struct rcu_head *rcu) 1588 { 1589 struct kcm_mux *mux = container_of(rcu, 1590 struct kcm_mux, rcu); 1591 1592 kmem_cache_free(kcm_muxp, mux); 1593 } 1594 1595 static void release_mux(struct kcm_mux *mux) 1596 { 1597 struct kcm_net *knet = mux->knet; 1598 struct kcm_psock *psock, *tmp_psock; 1599 1600 /* Release psocks */ 1601 list_for_each_entry_safe(psock, tmp_psock, 1602 &mux->psocks, psock_list) { 1603 if (!WARN_ON(psock->unattaching)) 1604 kcm_unattach(psock); 1605 } 1606 1607 if (WARN_ON(mux->psocks_cnt)) 1608 return; 1609 1610 __skb_queue_purge(&mux->rx_hold_queue); 1611 1612 mutex_lock(&knet->mutex); 1613 aggregate_mux_stats(&mux->stats, &knet->aggregate_mux_stats); 1614 aggregate_psock_stats(&mux->aggregate_psock_stats, 1615 &knet->aggregate_psock_stats); 1616 aggregate_strp_stats(&mux->aggregate_strp_stats, 1617 &knet->aggregate_strp_stats); 1618 list_del_rcu(&mux->kcm_mux_list); 1619 knet->count--; 1620 mutex_unlock(&knet->mutex); 1621 1622 call_rcu(&mux->rcu, free_mux); 1623 } 1624 1625 static void kcm_done(struct kcm_sock *kcm) 1626 { 1627 struct kcm_mux *mux = kcm->mux; 1628 struct sock *sk = &kcm->sk; 1629 int socks_cnt; 1630 1631 spin_lock_bh(&mux->rx_lock); 1632 if (kcm->rx_psock) { 1633 /* Cleanup in unreserve_rx_kcm */ 1634 WARN_ON(kcm->done); 1635 kcm->rx_disabled = 1; 1636 kcm->done = 1; 1637 spin_unlock_bh(&mux->rx_lock); 1638 return; 1639 } 1640 1641 if (kcm->rx_wait) { 1642 list_del(&kcm->wait_rx_list); 1643 /* paired with lockless reads in kcm_rfree() */ 1644 WRITE_ONCE(kcm->rx_wait, false); 1645 } 1646 /* Move any pending receive messages to other kcm sockets */ 1647 requeue_rx_msgs(mux, &sk->sk_receive_queue); 1648 1649 spin_unlock_bh(&mux->rx_lock); 1650 1651 if (WARN_ON(sk_rmem_alloc_get(sk))) 1652 return; 1653 1654 /* Detach from MUX */ 1655 spin_lock_bh(&mux->lock); 1656 1657 list_del(&kcm->kcm_sock_list); 1658 mux->kcm_socks_cnt--; 1659 socks_cnt = mux->kcm_socks_cnt; 1660 1661 spin_unlock_bh(&mux->lock); 1662 1663 if (!socks_cnt) { 1664 /* We are done with the mux now. */ 1665 release_mux(mux); 1666 } 1667 1668 WARN_ON(kcm->rx_wait); 1669 1670 sock_put(&kcm->sk); 1671 } 1672 1673 /* Called by kcm_release to close a KCM socket. 1674 * If this is the last KCM socket on the MUX, destroy the MUX. 1675 */ 1676 static int kcm_release(struct socket *sock) 1677 { 1678 struct sock *sk = sock->sk; 1679 struct kcm_sock *kcm; 1680 struct kcm_mux *mux; 1681 struct kcm_psock *psock; 1682 1683 if (!sk) 1684 return 0; 1685 1686 kcm = kcm_sk(sk); 1687 mux = kcm->mux; 1688 1689 lock_sock(sk); 1690 sock_orphan(sk); 1691 kfree_skb(kcm->seq_skb); 1692 1693 /* Purge queue under lock to avoid race condition with tx_work trying 1694 * to act when queue is nonempty. If tx_work runs after this point 1695 * it will just return. 1696 */ 1697 __skb_queue_purge(&sk->sk_write_queue); 1698 1699 /* Set tx_stopped. This is checked when psock is bound to a kcm and we 1700 * get a writespace callback. This prevents further work being queued 1701 * from the callback (unbinding the psock occurs after canceling work. 1702 */ 1703 kcm->tx_stopped = 1; 1704 1705 release_sock(sk); 1706 1707 spin_lock_bh(&mux->lock); 1708 if (kcm->tx_wait) { 1709 /* Take of tx_wait list, after this point there should be no way 1710 * that a psock will be assigned to this kcm. 1711 */ 1712 list_del(&kcm->wait_psock_list); 1713 kcm->tx_wait = false; 1714 } 1715 spin_unlock_bh(&mux->lock); 1716 1717 /* Cancel work. After this point there should be no outside references 1718 * to the kcm socket. 1719 */ 1720 cancel_work_sync(&kcm->tx_work); 1721 1722 lock_sock(sk); 1723 psock = kcm->tx_psock; 1724 if (psock) { 1725 /* A psock was reserved, so we need to kill it since it 1726 * may already have some bytes queued from a message. We 1727 * need to do this after removing kcm from tx_wait list. 1728 */ 1729 kcm_abort_tx_psock(psock, EPIPE, false); 1730 unreserve_psock(kcm); 1731 } 1732 release_sock(sk); 1733 1734 WARN_ON(kcm->tx_wait); 1735 WARN_ON(kcm->tx_psock); 1736 1737 sock->sk = NULL; 1738 1739 kcm_done(kcm); 1740 1741 return 0; 1742 } 1743 1744 static const struct proto_ops kcm_dgram_ops = { 1745 .family = PF_KCM, 1746 .owner = THIS_MODULE, 1747 .release = kcm_release, 1748 .bind = sock_no_bind, 1749 .connect = sock_no_connect, 1750 .socketpair = sock_no_socketpair, 1751 .accept = sock_no_accept, 1752 .getname = sock_no_getname, 1753 .poll = datagram_poll, 1754 .ioctl = kcm_ioctl, 1755 .listen = sock_no_listen, 1756 .shutdown = sock_no_shutdown, 1757 .setsockopt = kcm_setsockopt, 1758 .getsockopt = kcm_getsockopt, 1759 .sendmsg = kcm_sendmsg, 1760 .recvmsg = kcm_recvmsg, 1761 .mmap = sock_no_mmap, 1762 .splice_eof = kcm_splice_eof, 1763 }; 1764 1765 static const struct proto_ops kcm_seqpacket_ops = { 1766 .family = PF_KCM, 1767 .owner = THIS_MODULE, 1768 .release = kcm_release, 1769 .bind = sock_no_bind, 1770 .connect = sock_no_connect, 1771 .socketpair = sock_no_socketpair, 1772 .accept = sock_no_accept, 1773 .getname = sock_no_getname, 1774 .poll = datagram_poll, 1775 .ioctl = kcm_ioctl, 1776 .listen = sock_no_listen, 1777 .shutdown = sock_no_shutdown, 1778 .setsockopt = kcm_setsockopt, 1779 .getsockopt = kcm_getsockopt, 1780 .sendmsg = kcm_sendmsg, 1781 .recvmsg = kcm_recvmsg, 1782 .mmap = sock_no_mmap, 1783 .splice_eof = kcm_splice_eof, 1784 .splice_read = kcm_splice_read, 1785 }; 1786 1787 /* Create proto operation for kcm sockets */ 1788 static int kcm_create(struct net *net, struct socket *sock, 1789 int protocol, int kern) 1790 { 1791 struct kcm_net *knet = net_generic(net, kcm_net_id); 1792 struct sock *sk; 1793 struct kcm_mux *mux; 1794 1795 switch (sock->type) { 1796 case SOCK_DGRAM: 1797 sock->ops = &kcm_dgram_ops; 1798 break; 1799 case SOCK_SEQPACKET: 1800 sock->ops = &kcm_seqpacket_ops; 1801 break; 1802 default: 1803 return -ESOCKTNOSUPPORT; 1804 } 1805 1806 if (protocol != KCMPROTO_CONNECTED) 1807 return -EPROTONOSUPPORT; 1808 1809 sk = sk_alloc(net, PF_KCM, GFP_KERNEL, &kcm_proto, kern); 1810 if (!sk) 1811 return -ENOMEM; 1812 1813 /* Allocate a kcm mux, shared between KCM sockets */ 1814 mux = kmem_cache_zalloc(kcm_muxp, GFP_KERNEL); 1815 if (!mux) { 1816 sk_free(sk); 1817 return -ENOMEM; 1818 } 1819 1820 spin_lock_init(&mux->lock); 1821 spin_lock_init(&mux->rx_lock); 1822 INIT_LIST_HEAD(&mux->kcm_socks); 1823 INIT_LIST_HEAD(&mux->kcm_rx_waiters); 1824 INIT_LIST_HEAD(&mux->kcm_tx_waiters); 1825 1826 INIT_LIST_HEAD(&mux->psocks); 1827 INIT_LIST_HEAD(&mux->psocks_ready); 1828 INIT_LIST_HEAD(&mux->psocks_avail); 1829 1830 mux->knet = knet; 1831 1832 /* Add new MUX to list */ 1833 mutex_lock(&knet->mutex); 1834 list_add_rcu(&mux->kcm_mux_list, &knet->mux_list); 1835 knet->count++; 1836 mutex_unlock(&knet->mutex); 1837 1838 skb_queue_head_init(&mux->rx_hold_queue); 1839 1840 /* Init KCM socket */ 1841 sock_init_data(sock, sk); 1842 init_kcm_sock(kcm_sk(sk), mux); 1843 1844 return 0; 1845 } 1846 1847 static const struct net_proto_family kcm_family_ops = { 1848 .family = PF_KCM, 1849 .create = kcm_create, 1850 .owner = THIS_MODULE, 1851 }; 1852 1853 static __net_init int kcm_init_net(struct net *net) 1854 { 1855 struct kcm_net *knet = net_generic(net, kcm_net_id); 1856 1857 INIT_LIST_HEAD_RCU(&knet->mux_list); 1858 mutex_init(&knet->mutex); 1859 1860 return 0; 1861 } 1862 1863 static __net_exit void kcm_exit_net(struct net *net) 1864 { 1865 struct kcm_net *knet = net_generic(net, kcm_net_id); 1866 1867 /* All KCM sockets should be closed at this point, which should mean 1868 * that all multiplexors and psocks have been destroyed. 1869 */ 1870 WARN_ON(!list_empty(&knet->mux_list)); 1871 1872 mutex_destroy(&knet->mutex); 1873 } 1874 1875 static struct pernet_operations kcm_net_ops = { 1876 .init = kcm_init_net, 1877 .exit = kcm_exit_net, 1878 .id = &kcm_net_id, 1879 .size = sizeof(struct kcm_net), 1880 }; 1881 1882 static int __init kcm_init(void) 1883 { 1884 int err = -ENOMEM; 1885 1886 kcm_muxp = KMEM_CACHE(kcm_mux, SLAB_HWCACHE_ALIGN); 1887 if (!kcm_muxp) 1888 goto fail; 1889 1890 kcm_psockp = KMEM_CACHE(kcm_psock, SLAB_HWCACHE_ALIGN); 1891 if (!kcm_psockp) 1892 goto fail; 1893 1894 kcm_wq = create_singlethread_workqueue("kkcmd"); 1895 if (!kcm_wq) 1896 goto fail; 1897 1898 err = proto_register(&kcm_proto, 1); 1899 if (err) 1900 goto fail; 1901 1902 err = register_pernet_device(&kcm_net_ops); 1903 if (err) 1904 goto net_ops_fail; 1905 1906 err = sock_register(&kcm_family_ops); 1907 if (err) 1908 goto sock_register_fail; 1909 1910 err = kcm_proc_init(); 1911 if (err) 1912 goto proc_init_fail; 1913 1914 return 0; 1915 1916 proc_init_fail: 1917 sock_unregister(PF_KCM); 1918 1919 sock_register_fail: 1920 unregister_pernet_device(&kcm_net_ops); 1921 1922 net_ops_fail: 1923 proto_unregister(&kcm_proto); 1924 1925 fail: 1926 kmem_cache_destroy(kcm_muxp); 1927 kmem_cache_destroy(kcm_psockp); 1928 1929 if (kcm_wq) 1930 destroy_workqueue(kcm_wq); 1931 1932 return err; 1933 } 1934 1935 static void __exit kcm_exit(void) 1936 { 1937 kcm_proc_exit(); 1938 sock_unregister(PF_KCM); 1939 unregister_pernet_device(&kcm_net_ops); 1940 proto_unregister(&kcm_proto); 1941 destroy_workqueue(kcm_wq); 1942 1943 kmem_cache_destroy(kcm_muxp); 1944 kmem_cache_destroy(kcm_psockp); 1945 } 1946 1947 module_init(kcm_init); 1948 module_exit(kcm_exit); 1949 1950 MODULE_LICENSE("GPL"); 1951 MODULE_DESCRIPTION("KCM (Kernel Connection Multiplexor) sockets"); 1952 MODULE_ALIAS_NETPROTO(PF_KCM); 1953