xref: /linux/net/mptcp/pm_netlink.c (revision 1553a1c48281243359a9529a10ddb551f3b967ab)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Multipath TCP
3  *
4  * Copyright (c) 2020, Red Hat, Inc.
5  */
6 
7 #define pr_fmt(fmt) "MPTCP: " fmt
8 
9 #include <linux/inet.h>
10 #include <linux/kernel.h>
11 #include <net/inet_common.h>
12 #include <net/netns/generic.h>
13 #include <net/mptcp.h>
14 
15 #include "protocol.h"
16 #include "mib.h"
17 
18 static int pm_nl_pernet_id;
19 
20 struct mptcp_pm_add_entry {
21 	struct list_head	list;
22 	struct mptcp_addr_info	addr;
23 	u8			retrans_times;
24 	struct timer_list	add_timer;
25 	struct mptcp_sock	*sock;
26 };
27 
28 struct pm_nl_pernet {
29 	/* protects pernet updates */
30 	spinlock_t		lock;
31 	struct list_head	local_addr_list;
32 	unsigned int		addrs;
33 	unsigned int		stale_loss_cnt;
34 	unsigned int		add_addr_signal_max;
35 	unsigned int		add_addr_accept_max;
36 	unsigned int		local_addr_max;
37 	unsigned int		subflows_max;
38 	unsigned int		next_id;
39 	DECLARE_BITMAP(id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
40 };
41 
42 #define MPTCP_PM_ADDR_MAX	8
43 #define ADD_ADDR_RETRANS_MAX	3
44 
45 static struct pm_nl_pernet *pm_nl_get_pernet(const struct net *net)
46 {
47 	return net_generic(net, pm_nl_pernet_id);
48 }
49 
50 static struct pm_nl_pernet *
51 pm_nl_get_pernet_from_msk(const struct mptcp_sock *msk)
52 {
53 	return pm_nl_get_pernet(sock_net((struct sock *)msk));
54 }
55 
56 bool mptcp_addresses_equal(const struct mptcp_addr_info *a,
57 			   const struct mptcp_addr_info *b, bool use_port)
58 {
59 	bool addr_equals = false;
60 
61 	if (a->family == b->family) {
62 		if (a->family == AF_INET)
63 			addr_equals = a->addr.s_addr == b->addr.s_addr;
64 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
65 		else
66 			addr_equals = !ipv6_addr_cmp(&a->addr6, &b->addr6);
67 	} else if (a->family == AF_INET) {
68 		if (ipv6_addr_v4mapped(&b->addr6))
69 			addr_equals = a->addr.s_addr == b->addr6.s6_addr32[3];
70 	} else if (b->family == AF_INET) {
71 		if (ipv6_addr_v4mapped(&a->addr6))
72 			addr_equals = a->addr6.s6_addr32[3] == b->addr.s_addr;
73 #endif
74 	}
75 
76 	if (!addr_equals)
77 		return false;
78 	if (!use_port)
79 		return true;
80 
81 	return a->port == b->port;
82 }
83 
84 void mptcp_local_address(const struct sock_common *skc, struct mptcp_addr_info *addr)
85 {
86 	addr->family = skc->skc_family;
87 	addr->port = htons(skc->skc_num);
88 	if (addr->family == AF_INET)
89 		addr->addr.s_addr = skc->skc_rcv_saddr;
90 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
91 	else if (addr->family == AF_INET6)
92 		addr->addr6 = skc->skc_v6_rcv_saddr;
93 #endif
94 }
95 
96 static void remote_address(const struct sock_common *skc,
97 			   struct mptcp_addr_info *addr)
98 {
99 	addr->family = skc->skc_family;
100 	addr->port = skc->skc_dport;
101 	if (addr->family == AF_INET)
102 		addr->addr.s_addr = skc->skc_daddr;
103 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
104 	else if (addr->family == AF_INET6)
105 		addr->addr6 = skc->skc_v6_daddr;
106 #endif
107 }
108 
109 static bool lookup_subflow_by_saddr(const struct list_head *list,
110 				    const struct mptcp_addr_info *saddr)
111 {
112 	struct mptcp_subflow_context *subflow;
113 	struct mptcp_addr_info cur;
114 	struct sock_common *skc;
115 
116 	list_for_each_entry(subflow, list, node) {
117 		skc = (struct sock_common *)mptcp_subflow_tcp_sock(subflow);
118 
119 		mptcp_local_address(skc, &cur);
120 		if (mptcp_addresses_equal(&cur, saddr, saddr->port))
121 			return true;
122 	}
123 
124 	return false;
125 }
126 
127 static bool lookup_subflow_by_daddr(const struct list_head *list,
128 				    const struct mptcp_addr_info *daddr)
129 {
130 	struct mptcp_subflow_context *subflow;
131 	struct mptcp_addr_info cur;
132 	struct sock_common *skc;
133 
134 	list_for_each_entry(subflow, list, node) {
135 		skc = (struct sock_common *)mptcp_subflow_tcp_sock(subflow);
136 
137 		remote_address(skc, &cur);
138 		if (mptcp_addresses_equal(&cur, daddr, daddr->port))
139 			return true;
140 	}
141 
142 	return false;
143 }
144 
145 static struct mptcp_pm_addr_entry *
146 select_local_address(const struct pm_nl_pernet *pernet,
147 		     const struct mptcp_sock *msk)
148 {
149 	struct mptcp_pm_addr_entry *entry, *ret = NULL;
150 
151 	msk_owned_by_me(msk);
152 
153 	rcu_read_lock();
154 	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
155 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW))
156 			continue;
157 
158 		if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
159 			continue;
160 
161 		ret = entry;
162 		break;
163 	}
164 	rcu_read_unlock();
165 	return ret;
166 }
167 
168 static struct mptcp_pm_addr_entry *
169 select_signal_address(struct pm_nl_pernet *pernet, const struct mptcp_sock *msk)
170 {
171 	struct mptcp_pm_addr_entry *entry, *ret = NULL;
172 
173 	rcu_read_lock();
174 	/* do not keep any additional per socket state, just signal
175 	 * the address list in order.
176 	 * Note: removal from the local address list during the msk life-cycle
177 	 * can lead to additional addresses not being announced.
178 	 */
179 	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
180 		if (!test_bit(entry->addr.id, msk->pm.id_avail_bitmap))
181 			continue;
182 
183 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL))
184 			continue;
185 
186 		ret = entry;
187 		break;
188 	}
189 	rcu_read_unlock();
190 	return ret;
191 }
192 
193 unsigned int mptcp_pm_get_add_addr_signal_max(const struct mptcp_sock *msk)
194 {
195 	const struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
196 
197 	return READ_ONCE(pernet->add_addr_signal_max);
198 }
199 EXPORT_SYMBOL_GPL(mptcp_pm_get_add_addr_signal_max);
200 
201 unsigned int mptcp_pm_get_add_addr_accept_max(const struct mptcp_sock *msk)
202 {
203 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
204 
205 	return READ_ONCE(pernet->add_addr_accept_max);
206 }
207 EXPORT_SYMBOL_GPL(mptcp_pm_get_add_addr_accept_max);
208 
209 unsigned int mptcp_pm_get_subflows_max(const struct mptcp_sock *msk)
210 {
211 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
212 
213 	return READ_ONCE(pernet->subflows_max);
214 }
215 EXPORT_SYMBOL_GPL(mptcp_pm_get_subflows_max);
216 
217 unsigned int mptcp_pm_get_local_addr_max(const struct mptcp_sock *msk)
218 {
219 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
220 
221 	return READ_ONCE(pernet->local_addr_max);
222 }
223 EXPORT_SYMBOL_GPL(mptcp_pm_get_local_addr_max);
224 
225 bool mptcp_pm_nl_check_work_pending(struct mptcp_sock *msk)
226 {
227 	struct pm_nl_pernet *pernet = pm_nl_get_pernet_from_msk(msk);
228 
229 	if (msk->pm.subflows == mptcp_pm_get_subflows_max(msk) ||
230 	    (find_next_and_bit(pernet->id_bitmap, msk->pm.id_avail_bitmap,
231 			       MPTCP_PM_MAX_ADDR_ID + 1, 0) == MPTCP_PM_MAX_ADDR_ID + 1)) {
232 		WRITE_ONCE(msk->pm.work_pending, false);
233 		return false;
234 	}
235 	return true;
236 }
237 
238 struct mptcp_pm_add_entry *
239 mptcp_lookup_anno_list_by_saddr(const struct mptcp_sock *msk,
240 				const struct mptcp_addr_info *addr)
241 {
242 	struct mptcp_pm_add_entry *entry;
243 
244 	lockdep_assert_held(&msk->pm.lock);
245 
246 	list_for_each_entry(entry, &msk->pm.anno_list, list) {
247 		if (mptcp_addresses_equal(&entry->addr, addr, true))
248 			return entry;
249 	}
250 
251 	return NULL;
252 }
253 
254 bool mptcp_pm_sport_in_anno_list(struct mptcp_sock *msk, const struct sock *sk)
255 {
256 	struct mptcp_pm_add_entry *entry;
257 	struct mptcp_addr_info saddr;
258 	bool ret = false;
259 
260 	mptcp_local_address((struct sock_common *)sk, &saddr);
261 
262 	spin_lock_bh(&msk->pm.lock);
263 	list_for_each_entry(entry, &msk->pm.anno_list, list) {
264 		if (mptcp_addresses_equal(&entry->addr, &saddr, true)) {
265 			ret = true;
266 			goto out;
267 		}
268 	}
269 
270 out:
271 	spin_unlock_bh(&msk->pm.lock);
272 	return ret;
273 }
274 
275 static void mptcp_pm_add_timer(struct timer_list *timer)
276 {
277 	struct mptcp_pm_add_entry *entry = from_timer(entry, timer, add_timer);
278 	struct mptcp_sock *msk = entry->sock;
279 	struct sock *sk = (struct sock *)msk;
280 
281 	pr_debug("msk=%p", msk);
282 
283 	if (!msk)
284 		return;
285 
286 	if (inet_sk_state_load(sk) == TCP_CLOSE)
287 		return;
288 
289 	if (!entry->addr.id)
290 		return;
291 
292 	if (mptcp_pm_should_add_signal_addr(msk)) {
293 		sk_reset_timer(sk, timer, jiffies + TCP_RTO_MAX / 8);
294 		goto out;
295 	}
296 
297 	spin_lock_bh(&msk->pm.lock);
298 
299 	if (!mptcp_pm_should_add_signal_addr(msk)) {
300 		pr_debug("retransmit ADD_ADDR id=%d", entry->addr.id);
301 		mptcp_pm_announce_addr(msk, &entry->addr, false);
302 		mptcp_pm_add_addr_send_ack(msk);
303 		entry->retrans_times++;
304 	}
305 
306 	if (entry->retrans_times < ADD_ADDR_RETRANS_MAX)
307 		sk_reset_timer(sk, timer,
308 			       jiffies + mptcp_get_add_addr_timeout(sock_net(sk)));
309 
310 	spin_unlock_bh(&msk->pm.lock);
311 
312 	if (entry->retrans_times == ADD_ADDR_RETRANS_MAX)
313 		mptcp_pm_subflow_established(msk);
314 
315 out:
316 	__sock_put(sk);
317 }
318 
319 struct mptcp_pm_add_entry *
320 mptcp_pm_del_add_timer(struct mptcp_sock *msk,
321 		       const struct mptcp_addr_info *addr, bool check_id)
322 {
323 	struct mptcp_pm_add_entry *entry;
324 	struct sock *sk = (struct sock *)msk;
325 
326 	spin_lock_bh(&msk->pm.lock);
327 	entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
328 	if (entry && (!check_id || entry->addr.id == addr->id))
329 		entry->retrans_times = ADD_ADDR_RETRANS_MAX;
330 	spin_unlock_bh(&msk->pm.lock);
331 
332 	if (entry && (!check_id || entry->addr.id == addr->id))
333 		sk_stop_timer_sync(sk, &entry->add_timer);
334 
335 	return entry;
336 }
337 
338 bool mptcp_pm_alloc_anno_list(struct mptcp_sock *msk,
339 			      const struct mptcp_addr_info *addr)
340 {
341 	struct mptcp_pm_add_entry *add_entry = NULL;
342 	struct sock *sk = (struct sock *)msk;
343 	struct net *net = sock_net(sk);
344 
345 	lockdep_assert_held(&msk->pm.lock);
346 
347 	add_entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
348 
349 	if (add_entry) {
350 		if (mptcp_pm_is_kernel(msk))
351 			return false;
352 
353 		sk_reset_timer(sk, &add_entry->add_timer,
354 			       jiffies + mptcp_get_add_addr_timeout(net));
355 		return true;
356 	}
357 
358 	add_entry = kmalloc(sizeof(*add_entry), GFP_ATOMIC);
359 	if (!add_entry)
360 		return false;
361 
362 	list_add(&add_entry->list, &msk->pm.anno_list);
363 
364 	add_entry->addr = *addr;
365 	add_entry->sock = msk;
366 	add_entry->retrans_times = 0;
367 
368 	timer_setup(&add_entry->add_timer, mptcp_pm_add_timer, 0);
369 	sk_reset_timer(sk, &add_entry->add_timer,
370 		       jiffies + mptcp_get_add_addr_timeout(net));
371 
372 	return true;
373 }
374 
375 void mptcp_pm_free_anno_list(struct mptcp_sock *msk)
376 {
377 	struct mptcp_pm_add_entry *entry, *tmp;
378 	struct sock *sk = (struct sock *)msk;
379 	LIST_HEAD(free_list);
380 
381 	pr_debug("msk=%p", msk);
382 
383 	spin_lock_bh(&msk->pm.lock);
384 	list_splice_init(&msk->pm.anno_list, &free_list);
385 	spin_unlock_bh(&msk->pm.lock);
386 
387 	list_for_each_entry_safe(entry, tmp, &free_list, list) {
388 		sk_stop_timer_sync(sk, &entry->add_timer);
389 		kfree(entry);
390 	}
391 }
392 
393 /* Fill all the remote addresses into the array addrs[],
394  * and return the array size.
395  */
396 static unsigned int fill_remote_addresses_vec(struct mptcp_sock *msk,
397 					      struct mptcp_addr_info *local,
398 					      bool fullmesh,
399 					      struct mptcp_addr_info *addrs)
400 {
401 	bool deny_id0 = READ_ONCE(msk->pm.remote_deny_join_id0);
402 	struct sock *sk = (struct sock *)msk, *ssk;
403 	struct mptcp_subflow_context *subflow;
404 	struct mptcp_addr_info remote = { 0 };
405 	unsigned int subflows_max;
406 	int i = 0;
407 
408 	subflows_max = mptcp_pm_get_subflows_max(msk);
409 	remote_address((struct sock_common *)sk, &remote);
410 
411 	/* Non-fullmesh endpoint, fill in the single entry
412 	 * corresponding to the primary MPC subflow remote address
413 	 */
414 	if (!fullmesh) {
415 		if (deny_id0)
416 			return 0;
417 
418 		if (!mptcp_pm_addr_families_match(sk, local, &remote))
419 			return 0;
420 
421 		msk->pm.subflows++;
422 		addrs[i++] = remote;
423 	} else {
424 		DECLARE_BITMAP(unavail_id, MPTCP_PM_MAX_ADDR_ID + 1);
425 
426 		/* Forbid creation of new subflows matching existing
427 		 * ones, possibly already created by incoming ADD_ADDR
428 		 */
429 		bitmap_zero(unavail_id, MPTCP_PM_MAX_ADDR_ID + 1);
430 		mptcp_for_each_subflow(msk, subflow)
431 			if (READ_ONCE(subflow->local_id) == local->id)
432 				__set_bit(subflow->remote_id, unavail_id);
433 
434 		mptcp_for_each_subflow(msk, subflow) {
435 			ssk = mptcp_subflow_tcp_sock(subflow);
436 			remote_address((struct sock_common *)ssk, &addrs[i]);
437 			addrs[i].id = READ_ONCE(subflow->remote_id);
438 			if (deny_id0 && !addrs[i].id)
439 				continue;
440 
441 			if (test_bit(addrs[i].id, unavail_id))
442 				continue;
443 
444 			if (!mptcp_pm_addr_families_match(sk, local, &addrs[i]))
445 				continue;
446 
447 			if (msk->pm.subflows < subflows_max) {
448 				/* forbid creating multiple address towards
449 				 * this id
450 				 */
451 				__set_bit(addrs[i].id, unavail_id);
452 				msk->pm.subflows++;
453 				i++;
454 			}
455 		}
456 	}
457 
458 	return i;
459 }
460 
461 static void __mptcp_pm_send_ack(struct mptcp_sock *msk, struct mptcp_subflow_context *subflow,
462 				bool prio, bool backup)
463 {
464 	struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
465 	bool slow;
466 
467 	pr_debug("send ack for %s",
468 		 prio ? "mp_prio" : (mptcp_pm_should_add_signal(msk) ? "add_addr" : "rm_addr"));
469 
470 	slow = lock_sock_fast(ssk);
471 	if (prio) {
472 		subflow->send_mp_prio = 1;
473 		subflow->backup = backup;
474 		subflow->request_bkup = backup;
475 	}
476 
477 	__mptcp_subflow_send_ack(ssk);
478 	unlock_sock_fast(ssk, slow);
479 }
480 
481 static void mptcp_pm_send_ack(struct mptcp_sock *msk, struct mptcp_subflow_context *subflow,
482 			      bool prio, bool backup)
483 {
484 	spin_unlock_bh(&msk->pm.lock);
485 	__mptcp_pm_send_ack(msk, subflow, prio, backup);
486 	spin_lock_bh(&msk->pm.lock);
487 }
488 
489 static struct mptcp_pm_addr_entry *
490 __lookup_addr_by_id(struct pm_nl_pernet *pernet, unsigned int id)
491 {
492 	struct mptcp_pm_addr_entry *entry;
493 
494 	list_for_each_entry(entry, &pernet->local_addr_list, list) {
495 		if (entry->addr.id == id)
496 			return entry;
497 	}
498 	return NULL;
499 }
500 
501 static struct mptcp_pm_addr_entry *
502 __lookup_addr(struct pm_nl_pernet *pernet, const struct mptcp_addr_info *info)
503 {
504 	struct mptcp_pm_addr_entry *entry;
505 
506 	list_for_each_entry(entry, &pernet->local_addr_list, list) {
507 		if (mptcp_addresses_equal(&entry->addr, info, entry->addr.port))
508 			return entry;
509 	}
510 	return NULL;
511 }
512 
513 static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
514 {
515 	struct sock *sk = (struct sock *)msk;
516 	struct mptcp_pm_addr_entry *local;
517 	unsigned int add_addr_signal_max;
518 	unsigned int local_addr_max;
519 	struct pm_nl_pernet *pernet;
520 	unsigned int subflows_max;
521 
522 	pernet = pm_nl_get_pernet(sock_net(sk));
523 
524 	add_addr_signal_max = mptcp_pm_get_add_addr_signal_max(msk);
525 	local_addr_max = mptcp_pm_get_local_addr_max(msk);
526 	subflows_max = mptcp_pm_get_subflows_max(msk);
527 
528 	/* do lazy endpoint usage accounting for the MPC subflows */
529 	if (unlikely(!(msk->pm.status & BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED))) && msk->first) {
530 		struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(msk->first);
531 		struct mptcp_pm_addr_entry *entry;
532 		struct mptcp_addr_info mpc_addr;
533 		bool backup = false;
534 
535 		mptcp_local_address((struct sock_common *)msk->first, &mpc_addr);
536 		rcu_read_lock();
537 		entry = __lookup_addr(pernet, &mpc_addr);
538 		if (entry) {
539 			__clear_bit(entry->addr.id, msk->pm.id_avail_bitmap);
540 			msk->mpc_endpoint_id = entry->addr.id;
541 			backup = !!(entry->flags & MPTCP_PM_ADDR_FLAG_BACKUP);
542 		}
543 		rcu_read_unlock();
544 
545 		if (backup)
546 			mptcp_pm_send_ack(msk, subflow, true, backup);
547 
548 		msk->pm.status |= BIT(MPTCP_PM_MPC_ENDPOINT_ACCOUNTED);
549 	}
550 
551 	pr_debug("local %d:%d signal %d:%d subflows %d:%d\n",
552 		 msk->pm.local_addr_used, local_addr_max,
553 		 msk->pm.add_addr_signaled, add_addr_signal_max,
554 		 msk->pm.subflows, subflows_max);
555 
556 	/* check first for announce */
557 	if (msk->pm.add_addr_signaled < add_addr_signal_max) {
558 		local = select_signal_address(pernet, msk);
559 
560 		/* due to racing events on both ends we can reach here while
561 		 * previous add address is still running: if we invoke now
562 		 * mptcp_pm_announce_addr(), that will fail and the
563 		 * corresponding id will be marked as used.
564 		 * Instead let the PM machinery reschedule us when the
565 		 * current address announce will be completed.
566 		 */
567 		if (msk->pm.addr_signal & BIT(MPTCP_ADD_ADDR_SIGNAL))
568 			return;
569 
570 		if (local) {
571 			if (mptcp_pm_alloc_anno_list(msk, &local->addr)) {
572 				__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
573 				msk->pm.add_addr_signaled++;
574 				mptcp_pm_announce_addr(msk, &local->addr, false);
575 				mptcp_pm_nl_addr_send_ack(msk);
576 			}
577 		}
578 	}
579 
580 	/* check if should create a new subflow */
581 	while (msk->pm.local_addr_used < local_addr_max &&
582 	       msk->pm.subflows < subflows_max) {
583 		struct mptcp_addr_info addrs[MPTCP_PM_ADDR_MAX];
584 		bool fullmesh;
585 		int i, nr;
586 
587 		local = select_local_address(pernet, msk);
588 		if (!local)
589 			break;
590 
591 		fullmesh = !!(local->flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
592 
593 		msk->pm.local_addr_used++;
594 		__clear_bit(local->addr.id, msk->pm.id_avail_bitmap);
595 		nr = fill_remote_addresses_vec(msk, &local->addr, fullmesh, addrs);
596 		if (nr == 0)
597 			continue;
598 
599 		spin_unlock_bh(&msk->pm.lock);
600 		for (i = 0; i < nr; i++)
601 			__mptcp_subflow_connect(sk, &local->addr, &addrs[i]);
602 		spin_lock_bh(&msk->pm.lock);
603 	}
604 	mptcp_pm_nl_check_work_pending(msk);
605 }
606 
607 static void mptcp_pm_nl_fully_established(struct mptcp_sock *msk)
608 {
609 	mptcp_pm_create_subflow_or_signal_addr(msk);
610 }
611 
612 static void mptcp_pm_nl_subflow_established(struct mptcp_sock *msk)
613 {
614 	mptcp_pm_create_subflow_or_signal_addr(msk);
615 }
616 
617 /* Fill all the local addresses into the array addrs[],
618  * and return the array size.
619  */
620 static unsigned int fill_local_addresses_vec(struct mptcp_sock *msk,
621 					     struct mptcp_addr_info *remote,
622 					     struct mptcp_addr_info *addrs)
623 {
624 	struct sock *sk = (struct sock *)msk;
625 	struct mptcp_pm_addr_entry *entry;
626 	struct pm_nl_pernet *pernet;
627 	unsigned int subflows_max;
628 	int i = 0;
629 
630 	pernet = pm_nl_get_pernet_from_msk(msk);
631 	subflows_max = mptcp_pm_get_subflows_max(msk);
632 
633 	rcu_read_lock();
634 	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
635 		if (!(entry->flags & MPTCP_PM_ADDR_FLAG_FULLMESH))
636 			continue;
637 
638 		if (!mptcp_pm_addr_families_match(sk, &entry->addr, remote))
639 			continue;
640 
641 		if (msk->pm.subflows < subflows_max) {
642 			msk->pm.subflows++;
643 			addrs[i++] = entry->addr;
644 		}
645 	}
646 	rcu_read_unlock();
647 
648 	/* If the array is empty, fill in the single
649 	 * 'IPADDRANY' local address
650 	 */
651 	if (!i) {
652 		struct mptcp_addr_info local;
653 
654 		memset(&local, 0, sizeof(local));
655 		local.family =
656 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
657 			       remote->family == AF_INET6 &&
658 			       ipv6_addr_v4mapped(&remote->addr6) ? AF_INET :
659 #endif
660 			       remote->family;
661 
662 		if (!mptcp_pm_addr_families_match(sk, &local, remote))
663 			return 0;
664 
665 		msk->pm.subflows++;
666 		addrs[i++] = local;
667 	}
668 
669 	return i;
670 }
671 
672 static void mptcp_pm_nl_add_addr_received(struct mptcp_sock *msk)
673 {
674 	struct mptcp_addr_info addrs[MPTCP_PM_ADDR_MAX];
675 	struct sock *sk = (struct sock *)msk;
676 	unsigned int add_addr_accept_max;
677 	struct mptcp_addr_info remote;
678 	unsigned int subflows_max;
679 	int i, nr;
680 
681 	add_addr_accept_max = mptcp_pm_get_add_addr_accept_max(msk);
682 	subflows_max = mptcp_pm_get_subflows_max(msk);
683 
684 	pr_debug("accepted %d:%d remote family %d",
685 		 msk->pm.add_addr_accepted, add_addr_accept_max,
686 		 msk->pm.remote.family);
687 
688 	remote = msk->pm.remote;
689 	mptcp_pm_announce_addr(msk, &remote, true);
690 	mptcp_pm_nl_addr_send_ack(msk);
691 
692 	if (lookup_subflow_by_daddr(&msk->conn_list, &remote))
693 		return;
694 
695 	/* pick id 0 port, if none is provided the remote address */
696 	if (!remote.port)
697 		remote.port = sk->sk_dport;
698 
699 	/* connect to the specified remote address, using whatever
700 	 * local address the routing configuration will pick.
701 	 */
702 	nr = fill_local_addresses_vec(msk, &remote, addrs);
703 	if (nr == 0)
704 		return;
705 
706 	msk->pm.add_addr_accepted++;
707 	if (msk->pm.add_addr_accepted >= add_addr_accept_max ||
708 	    msk->pm.subflows >= subflows_max)
709 		WRITE_ONCE(msk->pm.accept_addr, false);
710 
711 	spin_unlock_bh(&msk->pm.lock);
712 	for (i = 0; i < nr; i++)
713 		__mptcp_subflow_connect(sk, &addrs[i], &remote);
714 	spin_lock_bh(&msk->pm.lock);
715 }
716 
717 void mptcp_pm_nl_addr_send_ack(struct mptcp_sock *msk)
718 {
719 	struct mptcp_subflow_context *subflow;
720 
721 	msk_owned_by_me(msk);
722 	lockdep_assert_held(&msk->pm.lock);
723 
724 	if (!mptcp_pm_should_add_signal(msk) &&
725 	    !mptcp_pm_should_rm_signal(msk))
726 		return;
727 
728 	subflow = list_first_entry_or_null(&msk->conn_list, typeof(*subflow), node);
729 	if (subflow)
730 		mptcp_pm_send_ack(msk, subflow, false, false);
731 }
732 
733 int mptcp_pm_nl_mp_prio_send_ack(struct mptcp_sock *msk,
734 				 struct mptcp_addr_info *addr,
735 				 struct mptcp_addr_info *rem,
736 				 u8 bkup)
737 {
738 	struct mptcp_subflow_context *subflow;
739 
740 	pr_debug("bkup=%d", bkup);
741 
742 	mptcp_for_each_subflow(msk, subflow) {
743 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
744 		struct mptcp_addr_info local, remote;
745 
746 		mptcp_local_address((struct sock_common *)ssk, &local);
747 		if (!mptcp_addresses_equal(&local, addr, addr->port))
748 			continue;
749 
750 		if (rem && rem->family != AF_UNSPEC) {
751 			remote_address((struct sock_common *)ssk, &remote);
752 			if (!mptcp_addresses_equal(&remote, rem, rem->port))
753 				continue;
754 		}
755 
756 		__mptcp_pm_send_ack(msk, subflow, true, bkup);
757 		return 0;
758 	}
759 
760 	return -EINVAL;
761 }
762 
763 static bool mptcp_local_id_match(const struct mptcp_sock *msk, u8 local_id, u8 id)
764 {
765 	return local_id == id || (!local_id && msk->mpc_endpoint_id == id);
766 }
767 
768 static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
769 					   const struct mptcp_rm_list *rm_list,
770 					   enum linux_mptcp_mib_field rm_type)
771 {
772 	struct mptcp_subflow_context *subflow, *tmp;
773 	struct sock *sk = (struct sock *)msk;
774 	u8 i;
775 
776 	pr_debug("%s rm_list_nr %d",
777 		 rm_type == MPTCP_MIB_RMADDR ? "address" : "subflow", rm_list->nr);
778 
779 	msk_owned_by_me(msk);
780 
781 	if (sk->sk_state == TCP_LISTEN)
782 		return;
783 
784 	if (!rm_list->nr)
785 		return;
786 
787 	if (list_empty(&msk->conn_list))
788 		return;
789 
790 	for (i = 0; i < rm_list->nr; i++) {
791 		u8 rm_id = rm_list->ids[i];
792 		bool removed = false;
793 
794 		mptcp_for_each_subflow_safe(msk, subflow, tmp) {
795 			struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
796 			u8 remote_id = READ_ONCE(subflow->remote_id);
797 			int how = RCV_SHUTDOWN | SEND_SHUTDOWN;
798 			u8 id = subflow_get_local_id(subflow);
799 
800 			if (rm_type == MPTCP_MIB_RMADDR && remote_id != rm_id)
801 				continue;
802 			if (rm_type == MPTCP_MIB_RMSUBFLOW && !mptcp_local_id_match(msk, id, rm_id))
803 				continue;
804 
805 			pr_debug(" -> %s rm_list_ids[%d]=%u local_id=%u remote_id=%u mpc_id=%u",
806 				 rm_type == MPTCP_MIB_RMADDR ? "address" : "subflow",
807 				 i, rm_id, id, remote_id, msk->mpc_endpoint_id);
808 			spin_unlock_bh(&msk->pm.lock);
809 			mptcp_subflow_shutdown(sk, ssk, how);
810 
811 			/* the following takes care of updating the subflows counter */
812 			mptcp_close_ssk(sk, ssk, subflow);
813 			spin_lock_bh(&msk->pm.lock);
814 
815 			removed = true;
816 			__MPTCP_INC_STATS(sock_net(sk), rm_type);
817 		}
818 		if (rm_type == MPTCP_MIB_RMSUBFLOW)
819 			__set_bit(rm_id ? rm_id : msk->mpc_endpoint_id, msk->pm.id_avail_bitmap);
820 		if (!removed)
821 			continue;
822 
823 		if (!mptcp_pm_is_kernel(msk))
824 			continue;
825 
826 		if (rm_type == MPTCP_MIB_RMADDR) {
827 			msk->pm.add_addr_accepted--;
828 			WRITE_ONCE(msk->pm.accept_addr, true);
829 		} else if (rm_type == MPTCP_MIB_RMSUBFLOW) {
830 			msk->pm.local_addr_used--;
831 		}
832 	}
833 }
834 
835 static void mptcp_pm_nl_rm_addr_received(struct mptcp_sock *msk)
836 {
837 	mptcp_pm_nl_rm_addr_or_subflow(msk, &msk->pm.rm_list_rx, MPTCP_MIB_RMADDR);
838 }
839 
840 void mptcp_pm_nl_rm_subflow_received(struct mptcp_sock *msk,
841 				     const struct mptcp_rm_list *rm_list)
842 {
843 	mptcp_pm_nl_rm_addr_or_subflow(msk, rm_list, MPTCP_MIB_RMSUBFLOW);
844 }
845 
846 void mptcp_pm_nl_work(struct mptcp_sock *msk)
847 {
848 	struct mptcp_pm_data *pm = &msk->pm;
849 
850 	msk_owned_by_me(msk);
851 
852 	if (!(pm->status & MPTCP_PM_WORK_MASK))
853 		return;
854 
855 	spin_lock_bh(&msk->pm.lock);
856 
857 	pr_debug("msk=%p status=%x", msk, pm->status);
858 	if (pm->status & BIT(MPTCP_PM_ADD_ADDR_RECEIVED)) {
859 		pm->status &= ~BIT(MPTCP_PM_ADD_ADDR_RECEIVED);
860 		mptcp_pm_nl_add_addr_received(msk);
861 	}
862 	if (pm->status & BIT(MPTCP_PM_ADD_ADDR_SEND_ACK)) {
863 		pm->status &= ~BIT(MPTCP_PM_ADD_ADDR_SEND_ACK);
864 		mptcp_pm_nl_addr_send_ack(msk);
865 	}
866 	if (pm->status & BIT(MPTCP_PM_RM_ADDR_RECEIVED)) {
867 		pm->status &= ~BIT(MPTCP_PM_RM_ADDR_RECEIVED);
868 		mptcp_pm_nl_rm_addr_received(msk);
869 	}
870 	if (pm->status & BIT(MPTCP_PM_ESTABLISHED)) {
871 		pm->status &= ~BIT(MPTCP_PM_ESTABLISHED);
872 		mptcp_pm_nl_fully_established(msk);
873 	}
874 	if (pm->status & BIT(MPTCP_PM_SUBFLOW_ESTABLISHED)) {
875 		pm->status &= ~BIT(MPTCP_PM_SUBFLOW_ESTABLISHED);
876 		mptcp_pm_nl_subflow_established(msk);
877 	}
878 
879 	spin_unlock_bh(&msk->pm.lock);
880 }
881 
882 static bool address_use_port(struct mptcp_pm_addr_entry *entry)
883 {
884 	return (entry->flags &
885 		(MPTCP_PM_ADDR_FLAG_SIGNAL | MPTCP_PM_ADDR_FLAG_SUBFLOW)) ==
886 		MPTCP_PM_ADDR_FLAG_SIGNAL;
887 }
888 
889 /* caller must ensure the RCU grace period is already elapsed */
890 static void __mptcp_pm_release_addr_entry(struct mptcp_pm_addr_entry *entry)
891 {
892 	if (entry->lsk)
893 		sock_release(entry->lsk);
894 	kfree(entry);
895 }
896 
897 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
898 					     struct mptcp_pm_addr_entry *entry,
899 					     bool needs_id)
900 {
901 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
902 	unsigned int addr_max;
903 	int ret = -EINVAL;
904 
905 	spin_lock_bh(&pernet->lock);
906 	/* to keep the code simple, don't do IDR-like allocation for address ID,
907 	 * just bail when we exceed limits
908 	 */
909 	if (pernet->next_id == MPTCP_PM_MAX_ADDR_ID)
910 		pernet->next_id = 1;
911 	if (pernet->addrs >= MPTCP_PM_ADDR_MAX) {
912 		ret = -ERANGE;
913 		goto out;
914 	}
915 	if (test_bit(entry->addr.id, pernet->id_bitmap)) {
916 		ret = -EBUSY;
917 		goto out;
918 	}
919 
920 	/* do not insert duplicate address, differentiate on port only
921 	 * singled addresses
922 	 */
923 	if (!address_use_port(entry))
924 		entry->addr.port = 0;
925 	list_for_each_entry(cur, &pernet->local_addr_list, list) {
926 		if (mptcp_addresses_equal(&cur->addr, &entry->addr,
927 					  cur->addr.port || entry->addr.port)) {
928 			/* allow replacing the exiting endpoint only if such
929 			 * endpoint is an implicit one and the user-space
930 			 * did not provide an endpoint id
931 			 */
932 			if (!(cur->flags & MPTCP_PM_ADDR_FLAG_IMPLICIT)) {
933 				ret = -EEXIST;
934 				goto out;
935 			}
936 			if (entry->addr.id)
937 				goto out;
938 
939 			pernet->addrs--;
940 			entry->addr.id = cur->addr.id;
941 			list_del_rcu(&cur->list);
942 			del_entry = cur;
943 			break;
944 		}
945 	}
946 
947 	if (!entry->addr.id && needs_id) {
948 find_next:
949 		entry->addr.id = find_next_zero_bit(pernet->id_bitmap,
950 						    MPTCP_PM_MAX_ADDR_ID + 1,
951 						    pernet->next_id);
952 		if (!entry->addr.id && pernet->next_id != 1) {
953 			pernet->next_id = 1;
954 			goto find_next;
955 		}
956 	}
957 
958 	if (!entry->addr.id && needs_id)
959 		goto out;
960 
961 	__set_bit(entry->addr.id, pernet->id_bitmap);
962 	if (entry->addr.id > pernet->next_id)
963 		pernet->next_id = entry->addr.id;
964 
965 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL) {
966 		addr_max = pernet->add_addr_signal_max;
967 		WRITE_ONCE(pernet->add_addr_signal_max, addr_max + 1);
968 	}
969 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
970 		addr_max = pernet->local_addr_max;
971 		WRITE_ONCE(pernet->local_addr_max, addr_max + 1);
972 	}
973 
974 	pernet->addrs++;
975 	if (!entry->addr.port)
976 		list_add_tail_rcu(&entry->list, &pernet->local_addr_list);
977 	else
978 		list_add_rcu(&entry->list, &pernet->local_addr_list);
979 	ret = entry->addr.id;
980 
981 out:
982 	spin_unlock_bh(&pernet->lock);
983 
984 	/* just replaced an existing entry, free it */
985 	if (del_entry) {
986 		synchronize_rcu();
987 		__mptcp_pm_release_addr_entry(del_entry);
988 	}
989 	return ret;
990 }
991 
992 static struct lock_class_key mptcp_slock_keys[2];
993 static struct lock_class_key mptcp_keys[2];
994 
995 static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
996 					    struct mptcp_pm_addr_entry *entry)
997 {
998 	bool is_ipv6 = sk->sk_family == AF_INET6;
999 	int addrlen = sizeof(struct sockaddr_in);
1000 	struct sockaddr_storage addr;
1001 	struct sock *newsk, *ssk;
1002 	int backlog = 1024;
1003 	int err;
1004 
1005 	err = sock_create_kern(sock_net(sk), entry->addr.family,
1006 			       SOCK_STREAM, IPPROTO_MPTCP, &entry->lsk);
1007 	if (err)
1008 		return err;
1009 
1010 	newsk = entry->lsk->sk;
1011 	if (!newsk)
1012 		return -EINVAL;
1013 
1014 	/* The subflow socket lock is acquired in a nested to the msk one
1015 	 * in several places, even by the TCP stack, and this msk is a kernel
1016 	 * socket: lockdep complains. Instead of propagating the _nested
1017 	 * modifiers in several places, re-init the lock class for the msk
1018 	 * socket to an mptcp specific one.
1019 	 */
1020 	sock_lock_init_class_and_name(newsk,
1021 				      is_ipv6 ? "mlock-AF_INET6" : "mlock-AF_INET",
1022 				      &mptcp_slock_keys[is_ipv6],
1023 				      is_ipv6 ? "msk_lock-AF_INET6" : "msk_lock-AF_INET",
1024 				      &mptcp_keys[is_ipv6]);
1025 
1026 	lock_sock(newsk);
1027 	ssk = __mptcp_nmpc_sk(mptcp_sk(newsk));
1028 	release_sock(newsk);
1029 	if (IS_ERR(ssk))
1030 		return PTR_ERR(ssk);
1031 
1032 	mptcp_info2sockaddr(&entry->addr, &addr, entry->addr.family);
1033 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1034 	if (entry->addr.family == AF_INET6)
1035 		addrlen = sizeof(struct sockaddr_in6);
1036 #endif
1037 	if (ssk->sk_family == AF_INET)
1038 		err = inet_bind_sk(ssk, (struct sockaddr *)&addr, addrlen);
1039 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1040 	else if (ssk->sk_family == AF_INET6)
1041 		err = inet6_bind_sk(ssk, (struct sockaddr *)&addr, addrlen);
1042 #endif
1043 	if (err)
1044 		return err;
1045 
1046 	/* We don't use mptcp_set_state() here because it needs to be called
1047 	 * under the msk socket lock. For the moment, that will not bring
1048 	 * anything more than only calling inet_sk_state_store(), because the
1049 	 * old status is known (TCP_CLOSE).
1050 	 */
1051 	inet_sk_state_store(newsk, TCP_LISTEN);
1052 	lock_sock(ssk);
1053 	err = __inet_listen_sk(ssk, backlog);
1054 	if (!err)
1055 		mptcp_event_pm_listener(ssk, MPTCP_EVENT_LISTENER_CREATED);
1056 	release_sock(ssk);
1057 	return err;
1058 }
1059 
1060 int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct mptcp_addr_info *skc)
1061 {
1062 	struct mptcp_pm_addr_entry *entry;
1063 	struct pm_nl_pernet *pernet;
1064 	int ret = -1;
1065 
1066 	pernet = pm_nl_get_pernet_from_msk(msk);
1067 
1068 	rcu_read_lock();
1069 	list_for_each_entry_rcu(entry, &pernet->local_addr_list, list) {
1070 		if (mptcp_addresses_equal(&entry->addr, skc, entry->addr.port)) {
1071 			ret = entry->addr.id;
1072 			break;
1073 		}
1074 	}
1075 	rcu_read_unlock();
1076 	if (ret >= 0)
1077 		return ret;
1078 
1079 	/* address not found, add to local list */
1080 	entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
1081 	if (!entry)
1082 		return -ENOMEM;
1083 
1084 	entry->addr = *skc;
1085 	entry->addr.id = 0;
1086 	entry->addr.port = 0;
1087 	entry->ifindex = 0;
1088 	entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT;
1089 	entry->lsk = NULL;
1090 	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
1091 	if (ret < 0)
1092 		kfree(entry);
1093 
1094 	return ret;
1095 }
1096 
1097 #define MPTCP_PM_CMD_GRP_OFFSET       0
1098 #define MPTCP_PM_EV_GRP_OFFSET        1
1099 
1100 static const struct genl_multicast_group mptcp_pm_mcgrps[] = {
1101 	[MPTCP_PM_CMD_GRP_OFFSET]	= { .name = MPTCP_PM_CMD_GRP_NAME, },
1102 	[MPTCP_PM_EV_GRP_OFFSET]        = { .name = MPTCP_PM_EV_GRP_NAME,
1103 					    .flags = GENL_MCAST_CAP_NET_ADMIN,
1104 					  },
1105 };
1106 
1107 void mptcp_pm_nl_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk)
1108 {
1109 	struct mptcp_subflow_context *iter, *subflow = mptcp_subflow_ctx(ssk);
1110 	struct sock *sk = (struct sock *)msk;
1111 	unsigned int active_max_loss_cnt;
1112 	struct net *net = sock_net(sk);
1113 	unsigned int stale_loss_cnt;
1114 	bool slow;
1115 
1116 	stale_loss_cnt = mptcp_stale_loss_cnt(net);
1117 	if (subflow->stale || !stale_loss_cnt || subflow->stale_count <= stale_loss_cnt)
1118 		return;
1119 
1120 	/* look for another available subflow not in loss state */
1121 	active_max_loss_cnt = max_t(int, stale_loss_cnt - 1, 1);
1122 	mptcp_for_each_subflow(msk, iter) {
1123 		if (iter != subflow && mptcp_subflow_active(iter) &&
1124 		    iter->stale_count < active_max_loss_cnt) {
1125 			/* we have some alternatives, try to mark this subflow as idle ...*/
1126 			slow = lock_sock_fast(ssk);
1127 			if (!tcp_rtx_and_write_queues_empty(ssk)) {
1128 				subflow->stale = 1;
1129 				__mptcp_retransmit_pending_data(sk);
1130 				MPTCP_INC_STATS(net, MPTCP_MIB_SUBFLOWSTALE);
1131 			}
1132 			unlock_sock_fast(ssk, slow);
1133 
1134 			/* always try to push the pending data regardless of re-injections:
1135 			 * we can possibly use backup subflows now, and subflow selection
1136 			 * is cheap under the msk socket lock
1137 			 */
1138 			__mptcp_push_pending(sk, 0);
1139 			return;
1140 		}
1141 	}
1142 }
1143 
1144 static int mptcp_pm_family_to_addr(int family)
1145 {
1146 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1147 	if (family == AF_INET6)
1148 		return MPTCP_PM_ADDR_ATTR_ADDR6;
1149 #endif
1150 	return MPTCP_PM_ADDR_ATTR_ADDR4;
1151 }
1152 
1153 static int mptcp_pm_parse_pm_addr_attr(struct nlattr *tb[],
1154 				       const struct nlattr *attr,
1155 				       struct genl_info *info,
1156 				       struct mptcp_addr_info *addr,
1157 				       bool require_family)
1158 {
1159 	int err, addr_addr;
1160 
1161 	if (!attr) {
1162 		GENL_SET_ERR_MSG(info, "missing address info");
1163 		return -EINVAL;
1164 	}
1165 
1166 	/* no validation needed - was already done via nested policy */
1167 	err = nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
1168 					  mptcp_pm_address_nl_policy, info->extack);
1169 	if (err)
1170 		return err;
1171 
1172 	if (tb[MPTCP_PM_ADDR_ATTR_ID])
1173 		addr->id = nla_get_u8(tb[MPTCP_PM_ADDR_ATTR_ID]);
1174 
1175 	if (!tb[MPTCP_PM_ADDR_ATTR_FAMILY]) {
1176 		if (!require_family)
1177 			return 0;
1178 
1179 		NL_SET_ERR_MSG_ATTR(info->extack, attr,
1180 				    "missing family");
1181 		return -EINVAL;
1182 	}
1183 
1184 	addr->family = nla_get_u16(tb[MPTCP_PM_ADDR_ATTR_FAMILY]);
1185 	if (addr->family != AF_INET
1186 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1187 	    && addr->family != AF_INET6
1188 #endif
1189 	    ) {
1190 		NL_SET_ERR_MSG_ATTR(info->extack, attr,
1191 				    "unknown address family");
1192 		return -EINVAL;
1193 	}
1194 	addr_addr = mptcp_pm_family_to_addr(addr->family);
1195 	if (!tb[addr_addr]) {
1196 		NL_SET_ERR_MSG_ATTR(info->extack, attr,
1197 				    "missing address data");
1198 		return -EINVAL;
1199 	}
1200 
1201 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1202 	if (addr->family == AF_INET6)
1203 		addr->addr6 = nla_get_in6_addr(tb[addr_addr]);
1204 	else
1205 #endif
1206 		addr->addr.s_addr = nla_get_in_addr(tb[addr_addr]);
1207 
1208 	if (tb[MPTCP_PM_ADDR_ATTR_PORT])
1209 		addr->port = htons(nla_get_u16(tb[MPTCP_PM_ADDR_ATTR_PORT]));
1210 
1211 	return 0;
1212 }
1213 
1214 int mptcp_pm_parse_addr(struct nlattr *attr, struct genl_info *info,
1215 			struct mptcp_addr_info *addr)
1216 {
1217 	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
1218 
1219 	memset(addr, 0, sizeof(*addr));
1220 
1221 	return mptcp_pm_parse_pm_addr_attr(tb, attr, info, addr, true);
1222 }
1223 
1224 int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info,
1225 			 bool require_family,
1226 			 struct mptcp_pm_addr_entry *entry)
1227 {
1228 	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
1229 	int err;
1230 
1231 	memset(entry, 0, sizeof(*entry));
1232 
1233 	err = mptcp_pm_parse_pm_addr_attr(tb, attr, info, &entry->addr, require_family);
1234 	if (err)
1235 		return err;
1236 
1237 	if (tb[MPTCP_PM_ADDR_ATTR_IF_IDX]) {
1238 		u32 val = nla_get_s32(tb[MPTCP_PM_ADDR_ATTR_IF_IDX]);
1239 
1240 		entry->ifindex = val;
1241 	}
1242 
1243 	if (tb[MPTCP_PM_ADDR_ATTR_FLAGS])
1244 		entry->flags = nla_get_u32(tb[MPTCP_PM_ADDR_ATTR_FLAGS]);
1245 
1246 	if (tb[MPTCP_PM_ADDR_ATTR_PORT])
1247 		entry->addr.port = htons(nla_get_u16(tb[MPTCP_PM_ADDR_ATTR_PORT]));
1248 
1249 	return 0;
1250 }
1251 
1252 static struct pm_nl_pernet *genl_info_pm_nl(struct genl_info *info)
1253 {
1254 	return pm_nl_get_pernet(genl_info_net(info));
1255 }
1256 
1257 static int mptcp_nl_add_subflow_or_signal_addr(struct net *net)
1258 {
1259 	struct mptcp_sock *msk;
1260 	long s_slot = 0, s_num = 0;
1261 
1262 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1263 		struct sock *sk = (struct sock *)msk;
1264 
1265 		if (!READ_ONCE(msk->fully_established) ||
1266 		    mptcp_pm_is_userspace(msk))
1267 			goto next;
1268 
1269 		lock_sock(sk);
1270 		spin_lock_bh(&msk->pm.lock);
1271 		mptcp_pm_create_subflow_or_signal_addr(msk);
1272 		spin_unlock_bh(&msk->pm.lock);
1273 		release_sock(sk);
1274 
1275 next:
1276 		sock_put(sk);
1277 		cond_resched();
1278 	}
1279 
1280 	return 0;
1281 }
1282 
1283 static bool mptcp_pm_has_addr_attr_id(const struct nlattr *attr,
1284 				      struct genl_info *info)
1285 {
1286 	struct nlattr *tb[MPTCP_PM_ADDR_ATTR_MAX + 1];
1287 
1288 	if (!nla_parse_nested_deprecated(tb, MPTCP_PM_ADDR_ATTR_MAX, attr,
1289 					 mptcp_pm_address_nl_policy, info->extack) &&
1290 	    tb[MPTCP_PM_ADDR_ATTR_ID])
1291 		return true;
1292 	return false;
1293 }
1294 
1295 int mptcp_pm_nl_add_addr_doit(struct sk_buff *skb, struct genl_info *info)
1296 {
1297 	struct nlattr *attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
1298 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1299 	struct mptcp_pm_addr_entry addr, *entry;
1300 	int ret;
1301 
1302 	ret = mptcp_pm_parse_entry(attr, info, true, &addr);
1303 	if (ret < 0)
1304 		return ret;
1305 
1306 	if (addr.addr.port && !(addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) {
1307 		GENL_SET_ERR_MSG(info, "flags must have signal when using port");
1308 		return -EINVAL;
1309 	}
1310 
1311 	if (addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL &&
1312 	    addr.flags & MPTCP_PM_ADDR_FLAG_FULLMESH) {
1313 		GENL_SET_ERR_MSG(info, "flags mustn't have both signal and fullmesh");
1314 		return -EINVAL;
1315 	}
1316 
1317 	if (addr.flags & MPTCP_PM_ADDR_FLAG_IMPLICIT) {
1318 		GENL_SET_ERR_MSG(info, "can't create IMPLICIT endpoint");
1319 		return -EINVAL;
1320 	}
1321 
1322 	entry = kzalloc(sizeof(*entry), GFP_KERNEL_ACCOUNT);
1323 	if (!entry) {
1324 		GENL_SET_ERR_MSG(info, "can't allocate addr");
1325 		return -ENOMEM;
1326 	}
1327 
1328 	*entry = addr;
1329 	if (entry->addr.port) {
1330 		ret = mptcp_pm_nl_create_listen_socket(skb->sk, entry);
1331 		if (ret) {
1332 			GENL_SET_ERR_MSG_FMT(info, "create listen socket error: %d", ret);
1333 			goto out_free;
1334 		}
1335 	}
1336 	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
1337 						!mptcp_pm_has_addr_attr_id(attr, info));
1338 	if (ret < 0) {
1339 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
1340 		goto out_free;
1341 	}
1342 
1343 	mptcp_nl_add_subflow_or_signal_addr(sock_net(skb->sk));
1344 	return 0;
1345 
1346 out_free:
1347 	__mptcp_pm_release_addr_entry(entry);
1348 	return ret;
1349 }
1350 
1351 int mptcp_pm_nl_get_flags_and_ifindex_by_id(struct mptcp_sock *msk, unsigned int id,
1352 					    u8 *flags, int *ifindex)
1353 {
1354 	struct mptcp_pm_addr_entry *entry;
1355 	struct sock *sk = (struct sock *)msk;
1356 	struct net *net = sock_net(sk);
1357 
1358 	rcu_read_lock();
1359 	entry = __lookup_addr_by_id(pm_nl_get_pernet(net), id);
1360 	if (entry) {
1361 		*flags = entry->flags;
1362 		*ifindex = entry->ifindex;
1363 	}
1364 	rcu_read_unlock();
1365 
1366 	return 0;
1367 }
1368 
1369 static bool remove_anno_list_by_saddr(struct mptcp_sock *msk,
1370 				      const struct mptcp_addr_info *addr)
1371 {
1372 	struct mptcp_pm_add_entry *entry;
1373 
1374 	entry = mptcp_pm_del_add_timer(msk, addr, false);
1375 	if (entry) {
1376 		list_del(&entry->list);
1377 		kfree(entry);
1378 		return true;
1379 	}
1380 
1381 	return false;
1382 }
1383 
1384 static bool mptcp_pm_remove_anno_addr(struct mptcp_sock *msk,
1385 				      const struct mptcp_addr_info *addr,
1386 				      bool force)
1387 {
1388 	struct mptcp_rm_list list = { .nr = 0 };
1389 	bool ret;
1390 
1391 	list.ids[list.nr++] = addr->id;
1392 
1393 	ret = remove_anno_list_by_saddr(msk, addr);
1394 	if (ret || force) {
1395 		spin_lock_bh(&msk->pm.lock);
1396 		mptcp_pm_remove_addr(msk, &list);
1397 		spin_unlock_bh(&msk->pm.lock);
1398 	}
1399 	return ret;
1400 }
1401 
1402 static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,
1403 						   const struct mptcp_pm_addr_entry *entry)
1404 {
1405 	const struct mptcp_addr_info *addr = &entry->addr;
1406 	struct mptcp_rm_list list = { .nr = 0 };
1407 	long s_slot = 0, s_num = 0;
1408 	struct mptcp_sock *msk;
1409 
1410 	pr_debug("remove_id=%d", addr->id);
1411 
1412 	list.ids[list.nr++] = addr->id;
1413 
1414 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1415 		struct sock *sk = (struct sock *)msk;
1416 		bool remove_subflow;
1417 
1418 		if (mptcp_pm_is_userspace(msk))
1419 			goto next;
1420 
1421 		if (list_empty(&msk->conn_list)) {
1422 			mptcp_pm_remove_anno_addr(msk, addr, false);
1423 			goto next;
1424 		}
1425 
1426 		lock_sock(sk);
1427 		remove_subflow = lookup_subflow_by_saddr(&msk->conn_list, addr);
1428 		mptcp_pm_remove_anno_addr(msk, addr, remove_subflow &&
1429 					  !(entry->flags & MPTCP_PM_ADDR_FLAG_IMPLICIT));
1430 		if (remove_subflow)
1431 			mptcp_pm_remove_subflow(msk, &list);
1432 		release_sock(sk);
1433 
1434 next:
1435 		sock_put(sk);
1436 		cond_resched();
1437 	}
1438 
1439 	return 0;
1440 }
1441 
1442 static int mptcp_nl_remove_id_zero_address(struct net *net,
1443 					   struct mptcp_addr_info *addr)
1444 {
1445 	struct mptcp_rm_list list = { .nr = 0 };
1446 	long s_slot = 0, s_num = 0;
1447 	struct mptcp_sock *msk;
1448 
1449 	list.ids[list.nr++] = 0;
1450 
1451 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1452 		struct sock *sk = (struct sock *)msk;
1453 		struct mptcp_addr_info msk_local;
1454 
1455 		if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk))
1456 			goto next;
1457 
1458 		mptcp_local_address((struct sock_common *)msk, &msk_local);
1459 		if (!mptcp_addresses_equal(&msk_local, addr, addr->port))
1460 			goto next;
1461 
1462 		lock_sock(sk);
1463 		spin_lock_bh(&msk->pm.lock);
1464 		mptcp_pm_remove_addr(msk, &list);
1465 		mptcp_pm_nl_rm_subflow_received(msk, &list);
1466 		spin_unlock_bh(&msk->pm.lock);
1467 		release_sock(sk);
1468 
1469 next:
1470 		sock_put(sk);
1471 		cond_resched();
1472 	}
1473 
1474 	return 0;
1475 }
1476 
1477 int mptcp_pm_nl_del_addr_doit(struct sk_buff *skb, struct genl_info *info)
1478 {
1479 	struct nlattr *attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
1480 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1481 	struct mptcp_pm_addr_entry addr, *entry;
1482 	unsigned int addr_max;
1483 	int ret;
1484 
1485 	ret = mptcp_pm_parse_entry(attr, info, false, &addr);
1486 	if (ret < 0)
1487 		return ret;
1488 
1489 	/* the zero id address is special: the first address used by the msk
1490 	 * always gets such an id, so different subflows can have different zero
1491 	 * id addresses. Additionally zero id is not accounted for in id_bitmap.
1492 	 * Let's use an 'mptcp_rm_list' instead of the common remove code.
1493 	 */
1494 	if (addr.addr.id == 0)
1495 		return mptcp_nl_remove_id_zero_address(sock_net(skb->sk), &addr.addr);
1496 
1497 	spin_lock_bh(&pernet->lock);
1498 	entry = __lookup_addr_by_id(pernet, addr.addr.id);
1499 	if (!entry) {
1500 		GENL_SET_ERR_MSG(info, "address not found");
1501 		spin_unlock_bh(&pernet->lock);
1502 		return -EINVAL;
1503 	}
1504 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL) {
1505 		addr_max = pernet->add_addr_signal_max;
1506 		WRITE_ONCE(pernet->add_addr_signal_max, addr_max - 1);
1507 	}
1508 	if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
1509 		addr_max = pernet->local_addr_max;
1510 		WRITE_ONCE(pernet->local_addr_max, addr_max - 1);
1511 	}
1512 
1513 	pernet->addrs--;
1514 	list_del_rcu(&entry->list);
1515 	__clear_bit(entry->addr.id, pernet->id_bitmap);
1516 	spin_unlock_bh(&pernet->lock);
1517 
1518 	mptcp_nl_remove_subflow_and_signal_addr(sock_net(skb->sk), entry);
1519 	synchronize_rcu();
1520 	__mptcp_pm_release_addr_entry(entry);
1521 
1522 	return ret;
1523 }
1524 
1525 void mptcp_pm_remove_addrs(struct mptcp_sock *msk, struct list_head *rm_list)
1526 {
1527 	struct mptcp_rm_list alist = { .nr = 0 };
1528 	struct mptcp_pm_addr_entry *entry;
1529 
1530 	list_for_each_entry(entry, rm_list, list) {
1531 		if ((remove_anno_list_by_saddr(msk, &entry->addr) ||
1532 		     lookup_subflow_by_saddr(&msk->conn_list, &entry->addr)) &&
1533 		    alist.nr < MPTCP_RM_IDS_MAX)
1534 			alist.ids[alist.nr++] = entry->addr.id;
1535 	}
1536 
1537 	if (alist.nr) {
1538 		spin_lock_bh(&msk->pm.lock);
1539 		mptcp_pm_remove_addr(msk, &alist);
1540 		spin_unlock_bh(&msk->pm.lock);
1541 	}
1542 }
1543 
1544 static void mptcp_pm_remove_addrs_and_subflows(struct mptcp_sock *msk,
1545 					       struct list_head *rm_list)
1546 {
1547 	struct mptcp_rm_list alist = { .nr = 0 }, slist = { .nr = 0 };
1548 	struct mptcp_pm_addr_entry *entry;
1549 
1550 	list_for_each_entry(entry, rm_list, list) {
1551 		if (lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) &&
1552 		    slist.nr < MPTCP_RM_IDS_MAX)
1553 			slist.ids[slist.nr++] = entry->addr.id;
1554 
1555 		if (remove_anno_list_by_saddr(msk, &entry->addr) &&
1556 		    alist.nr < MPTCP_RM_IDS_MAX)
1557 			alist.ids[alist.nr++] = entry->addr.id;
1558 	}
1559 
1560 	if (alist.nr) {
1561 		spin_lock_bh(&msk->pm.lock);
1562 		mptcp_pm_remove_addr(msk, &alist);
1563 		spin_unlock_bh(&msk->pm.lock);
1564 	}
1565 	if (slist.nr)
1566 		mptcp_pm_remove_subflow(msk, &slist);
1567 }
1568 
1569 static void mptcp_nl_remove_addrs_list(struct net *net,
1570 				       struct list_head *rm_list)
1571 {
1572 	long s_slot = 0, s_num = 0;
1573 	struct mptcp_sock *msk;
1574 
1575 	if (list_empty(rm_list))
1576 		return;
1577 
1578 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1579 		struct sock *sk = (struct sock *)msk;
1580 
1581 		if (!mptcp_pm_is_userspace(msk)) {
1582 			lock_sock(sk);
1583 			mptcp_pm_remove_addrs_and_subflows(msk, rm_list);
1584 			release_sock(sk);
1585 		}
1586 
1587 		sock_put(sk);
1588 		cond_resched();
1589 	}
1590 }
1591 
1592 /* caller must ensure the RCU grace period is already elapsed */
1593 static void __flush_addrs(struct list_head *list)
1594 {
1595 	while (!list_empty(list)) {
1596 		struct mptcp_pm_addr_entry *cur;
1597 
1598 		cur = list_entry(list->next,
1599 				 struct mptcp_pm_addr_entry, list);
1600 		list_del_rcu(&cur->list);
1601 		__mptcp_pm_release_addr_entry(cur);
1602 	}
1603 }
1604 
1605 static void __reset_counters(struct pm_nl_pernet *pernet)
1606 {
1607 	WRITE_ONCE(pernet->add_addr_signal_max, 0);
1608 	WRITE_ONCE(pernet->add_addr_accept_max, 0);
1609 	WRITE_ONCE(pernet->local_addr_max, 0);
1610 	pernet->addrs = 0;
1611 }
1612 
1613 int mptcp_pm_nl_flush_addrs_doit(struct sk_buff *skb, struct genl_info *info)
1614 {
1615 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1616 	LIST_HEAD(free_list);
1617 
1618 	spin_lock_bh(&pernet->lock);
1619 	list_splice_init(&pernet->local_addr_list, &free_list);
1620 	__reset_counters(pernet);
1621 	pernet->next_id = 1;
1622 	bitmap_zero(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
1623 	spin_unlock_bh(&pernet->lock);
1624 	mptcp_nl_remove_addrs_list(sock_net(skb->sk), &free_list);
1625 	synchronize_rcu();
1626 	__flush_addrs(&free_list);
1627 	return 0;
1628 }
1629 
1630 int mptcp_nl_fill_addr(struct sk_buff *skb,
1631 		       struct mptcp_pm_addr_entry *entry)
1632 {
1633 	struct mptcp_addr_info *addr = &entry->addr;
1634 	struct nlattr *attr;
1635 
1636 	attr = nla_nest_start(skb, MPTCP_PM_ATTR_ADDR);
1637 	if (!attr)
1638 		return -EMSGSIZE;
1639 
1640 	if (nla_put_u16(skb, MPTCP_PM_ADDR_ATTR_FAMILY, addr->family))
1641 		goto nla_put_failure;
1642 	if (nla_put_u16(skb, MPTCP_PM_ADDR_ATTR_PORT, ntohs(addr->port)))
1643 		goto nla_put_failure;
1644 	if (nla_put_u8(skb, MPTCP_PM_ADDR_ATTR_ID, addr->id))
1645 		goto nla_put_failure;
1646 	if (nla_put_u32(skb, MPTCP_PM_ADDR_ATTR_FLAGS, entry->flags))
1647 		goto nla_put_failure;
1648 	if (entry->ifindex &&
1649 	    nla_put_s32(skb, MPTCP_PM_ADDR_ATTR_IF_IDX, entry->ifindex))
1650 		goto nla_put_failure;
1651 
1652 	if (addr->family == AF_INET &&
1653 	    nla_put_in_addr(skb, MPTCP_PM_ADDR_ATTR_ADDR4,
1654 			    addr->addr.s_addr))
1655 		goto nla_put_failure;
1656 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1657 	else if (addr->family == AF_INET6 &&
1658 		 nla_put_in6_addr(skb, MPTCP_PM_ADDR_ATTR_ADDR6, &addr->addr6))
1659 		goto nla_put_failure;
1660 #endif
1661 	nla_nest_end(skb, attr);
1662 	return 0;
1663 
1664 nla_put_failure:
1665 	nla_nest_cancel(skb, attr);
1666 	return -EMSGSIZE;
1667 }
1668 
1669 int mptcp_pm_nl_get_addr(struct sk_buff *skb, struct genl_info *info)
1670 {
1671 	struct nlattr *attr = info->attrs[MPTCP_PM_ENDPOINT_ADDR];
1672 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1673 	struct mptcp_pm_addr_entry addr, *entry;
1674 	struct sk_buff *msg;
1675 	void *reply;
1676 	int ret;
1677 
1678 	ret = mptcp_pm_parse_entry(attr, info, false, &addr);
1679 	if (ret < 0)
1680 		return ret;
1681 
1682 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1683 	if (!msg)
1684 		return -ENOMEM;
1685 
1686 	reply = genlmsg_put_reply(msg, info, &mptcp_genl_family, 0,
1687 				  info->genlhdr->cmd);
1688 	if (!reply) {
1689 		GENL_SET_ERR_MSG(info, "not enough space in Netlink message");
1690 		ret = -EMSGSIZE;
1691 		goto fail;
1692 	}
1693 
1694 	spin_lock_bh(&pernet->lock);
1695 	entry = __lookup_addr_by_id(pernet, addr.addr.id);
1696 	if (!entry) {
1697 		GENL_SET_ERR_MSG(info, "address not found");
1698 		ret = -EINVAL;
1699 		goto unlock_fail;
1700 	}
1701 
1702 	ret = mptcp_nl_fill_addr(msg, entry);
1703 	if (ret)
1704 		goto unlock_fail;
1705 
1706 	genlmsg_end(msg, reply);
1707 	ret = genlmsg_reply(msg, info);
1708 	spin_unlock_bh(&pernet->lock);
1709 	return ret;
1710 
1711 unlock_fail:
1712 	spin_unlock_bh(&pernet->lock);
1713 
1714 fail:
1715 	nlmsg_free(msg);
1716 	return ret;
1717 }
1718 
1719 int mptcp_pm_nl_get_addr_doit(struct sk_buff *skb, struct genl_info *info)
1720 {
1721 	return mptcp_pm_get_addr(skb, info);
1722 }
1723 
1724 int mptcp_pm_nl_dump_addr(struct sk_buff *msg,
1725 			  struct netlink_callback *cb)
1726 {
1727 	struct net *net = sock_net(msg->sk);
1728 	struct mptcp_pm_addr_entry *entry;
1729 	struct pm_nl_pernet *pernet;
1730 	int id = cb->args[0];
1731 	void *hdr;
1732 	int i;
1733 
1734 	pernet = pm_nl_get_pernet(net);
1735 
1736 	spin_lock_bh(&pernet->lock);
1737 	for (i = id; i < MPTCP_PM_MAX_ADDR_ID + 1; i++) {
1738 		if (test_bit(i, pernet->id_bitmap)) {
1739 			entry = __lookup_addr_by_id(pernet, i);
1740 			if (!entry)
1741 				break;
1742 
1743 			if (entry->addr.id <= id)
1744 				continue;
1745 
1746 			hdr = genlmsg_put(msg, NETLINK_CB(cb->skb).portid,
1747 					  cb->nlh->nlmsg_seq, &mptcp_genl_family,
1748 					  NLM_F_MULTI, MPTCP_PM_CMD_GET_ADDR);
1749 			if (!hdr)
1750 				break;
1751 
1752 			if (mptcp_nl_fill_addr(msg, entry) < 0) {
1753 				genlmsg_cancel(msg, hdr);
1754 				break;
1755 			}
1756 
1757 			id = entry->addr.id;
1758 			genlmsg_end(msg, hdr);
1759 		}
1760 	}
1761 	spin_unlock_bh(&pernet->lock);
1762 
1763 	cb->args[0] = id;
1764 	return msg->len;
1765 }
1766 
1767 int mptcp_pm_nl_get_addr_dumpit(struct sk_buff *msg,
1768 				struct netlink_callback *cb)
1769 {
1770 	return mptcp_pm_dump_addr(msg, cb);
1771 }
1772 
1773 static int parse_limit(struct genl_info *info, int id, unsigned int *limit)
1774 {
1775 	struct nlattr *attr = info->attrs[id];
1776 
1777 	if (!attr)
1778 		return 0;
1779 
1780 	*limit = nla_get_u32(attr);
1781 	if (*limit > MPTCP_PM_ADDR_MAX) {
1782 		GENL_SET_ERR_MSG(info, "limit greater than maximum");
1783 		return -EINVAL;
1784 	}
1785 	return 0;
1786 }
1787 
1788 int mptcp_pm_nl_set_limits_doit(struct sk_buff *skb, struct genl_info *info)
1789 {
1790 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1791 	unsigned int rcv_addrs, subflows;
1792 	int ret;
1793 
1794 	spin_lock_bh(&pernet->lock);
1795 	rcv_addrs = pernet->add_addr_accept_max;
1796 	ret = parse_limit(info, MPTCP_PM_ATTR_RCV_ADD_ADDRS, &rcv_addrs);
1797 	if (ret)
1798 		goto unlock;
1799 
1800 	subflows = pernet->subflows_max;
1801 	ret = parse_limit(info, MPTCP_PM_ATTR_SUBFLOWS, &subflows);
1802 	if (ret)
1803 		goto unlock;
1804 
1805 	WRITE_ONCE(pernet->add_addr_accept_max, rcv_addrs);
1806 	WRITE_ONCE(pernet->subflows_max, subflows);
1807 
1808 unlock:
1809 	spin_unlock_bh(&pernet->lock);
1810 	return ret;
1811 }
1812 
1813 int mptcp_pm_nl_get_limits_doit(struct sk_buff *skb, struct genl_info *info)
1814 {
1815 	struct pm_nl_pernet *pernet = genl_info_pm_nl(info);
1816 	struct sk_buff *msg;
1817 	void *reply;
1818 
1819 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1820 	if (!msg)
1821 		return -ENOMEM;
1822 
1823 	reply = genlmsg_put_reply(msg, info, &mptcp_genl_family, 0,
1824 				  MPTCP_PM_CMD_GET_LIMITS);
1825 	if (!reply)
1826 		goto fail;
1827 
1828 	if (nla_put_u32(msg, MPTCP_PM_ATTR_RCV_ADD_ADDRS,
1829 			READ_ONCE(pernet->add_addr_accept_max)))
1830 		goto fail;
1831 
1832 	if (nla_put_u32(msg, MPTCP_PM_ATTR_SUBFLOWS,
1833 			READ_ONCE(pernet->subflows_max)))
1834 		goto fail;
1835 
1836 	genlmsg_end(msg, reply);
1837 	return genlmsg_reply(msg, info);
1838 
1839 fail:
1840 	GENL_SET_ERR_MSG(info, "not enough space in Netlink message");
1841 	nlmsg_free(msg);
1842 	return -EMSGSIZE;
1843 }
1844 
1845 static void mptcp_pm_nl_fullmesh(struct mptcp_sock *msk,
1846 				 struct mptcp_addr_info *addr)
1847 {
1848 	struct mptcp_rm_list list = { .nr = 0 };
1849 
1850 	list.ids[list.nr++] = addr->id;
1851 
1852 	spin_lock_bh(&msk->pm.lock);
1853 	mptcp_pm_nl_rm_subflow_received(msk, &list);
1854 	mptcp_pm_create_subflow_or_signal_addr(msk);
1855 	spin_unlock_bh(&msk->pm.lock);
1856 }
1857 
1858 static int mptcp_nl_set_flags(struct net *net,
1859 			      struct mptcp_addr_info *addr,
1860 			      u8 bkup, u8 changed)
1861 {
1862 	long s_slot = 0, s_num = 0;
1863 	struct mptcp_sock *msk;
1864 	int ret = -EINVAL;
1865 
1866 	while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
1867 		struct sock *sk = (struct sock *)msk;
1868 
1869 		if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk))
1870 			goto next;
1871 
1872 		lock_sock(sk);
1873 		if (changed & MPTCP_PM_ADDR_FLAG_BACKUP)
1874 			ret = mptcp_pm_nl_mp_prio_send_ack(msk, addr, NULL, bkup);
1875 		if (changed & MPTCP_PM_ADDR_FLAG_FULLMESH)
1876 			mptcp_pm_nl_fullmesh(msk, addr);
1877 		release_sock(sk);
1878 
1879 next:
1880 		sock_put(sk);
1881 		cond_resched();
1882 	}
1883 
1884 	return ret;
1885 }
1886 
1887 int mptcp_pm_nl_set_flags(struct sk_buff *skb, struct genl_info *info)
1888 {
1889 	struct mptcp_pm_addr_entry addr = { .addr = { .family = AF_UNSPEC }, };
1890 	struct nlattr *attr = info->attrs[MPTCP_PM_ATTR_ADDR];
1891 	u8 changed, mask = MPTCP_PM_ADDR_FLAG_BACKUP |
1892 			   MPTCP_PM_ADDR_FLAG_FULLMESH;
1893 	struct net *net = sock_net(skb->sk);
1894 	struct mptcp_pm_addr_entry *entry;
1895 	struct pm_nl_pernet *pernet;
1896 	u8 lookup_by_id = 0;
1897 	u8 bkup = 0;
1898 	int ret;
1899 
1900 	pernet = pm_nl_get_pernet(net);
1901 
1902 	ret = mptcp_pm_parse_entry(attr, info, false, &addr);
1903 	if (ret < 0)
1904 		return ret;
1905 
1906 	if (addr.addr.family == AF_UNSPEC) {
1907 		lookup_by_id = 1;
1908 		if (!addr.addr.id) {
1909 			GENL_SET_ERR_MSG(info, "missing required inputs");
1910 			return -EOPNOTSUPP;
1911 		}
1912 	}
1913 
1914 	if (addr.flags & MPTCP_PM_ADDR_FLAG_BACKUP)
1915 		bkup = 1;
1916 
1917 	spin_lock_bh(&pernet->lock);
1918 	entry = lookup_by_id ? __lookup_addr_by_id(pernet, addr.addr.id) :
1919 			       __lookup_addr(pernet, &addr.addr);
1920 	if (!entry) {
1921 		spin_unlock_bh(&pernet->lock);
1922 		GENL_SET_ERR_MSG(info, "address not found");
1923 		return -EINVAL;
1924 	}
1925 	if ((addr.flags & MPTCP_PM_ADDR_FLAG_FULLMESH) &&
1926 	    (entry->flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) {
1927 		spin_unlock_bh(&pernet->lock);
1928 		GENL_SET_ERR_MSG(info, "invalid addr flags");
1929 		return -EINVAL;
1930 	}
1931 
1932 	changed = (addr.flags ^ entry->flags) & mask;
1933 	entry->flags = (entry->flags & ~mask) | (addr.flags & mask);
1934 	addr = *entry;
1935 	spin_unlock_bh(&pernet->lock);
1936 
1937 	mptcp_nl_set_flags(net, &addr.addr, bkup, changed);
1938 	return 0;
1939 }
1940 
1941 int mptcp_pm_nl_set_flags_doit(struct sk_buff *skb, struct genl_info *info)
1942 {
1943 	return mptcp_pm_set_flags(skb, info);
1944 }
1945 
1946 static void mptcp_nl_mcast_send(struct net *net, struct sk_buff *nlskb, gfp_t gfp)
1947 {
1948 	genlmsg_multicast_netns(&mptcp_genl_family, net,
1949 				nlskb, 0, MPTCP_PM_EV_GRP_OFFSET, gfp);
1950 }
1951 
1952 bool mptcp_userspace_pm_active(const struct mptcp_sock *msk)
1953 {
1954 	return genl_has_listeners(&mptcp_genl_family,
1955 				  sock_net((const struct sock *)msk),
1956 				  MPTCP_PM_EV_GRP_OFFSET);
1957 }
1958 
1959 static int mptcp_event_add_subflow(struct sk_buff *skb, const struct sock *ssk)
1960 {
1961 	const struct inet_sock *issk = inet_sk(ssk);
1962 	const struct mptcp_subflow_context *sf;
1963 
1964 	if (nla_put_u16(skb, MPTCP_ATTR_FAMILY, ssk->sk_family))
1965 		return -EMSGSIZE;
1966 
1967 	switch (ssk->sk_family) {
1968 	case AF_INET:
1969 		if (nla_put_in_addr(skb, MPTCP_ATTR_SADDR4, issk->inet_saddr))
1970 			return -EMSGSIZE;
1971 		if (nla_put_in_addr(skb, MPTCP_ATTR_DADDR4, issk->inet_daddr))
1972 			return -EMSGSIZE;
1973 		break;
1974 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1975 	case AF_INET6: {
1976 		const struct ipv6_pinfo *np = inet6_sk(ssk);
1977 
1978 		if (nla_put_in6_addr(skb, MPTCP_ATTR_SADDR6, &np->saddr))
1979 			return -EMSGSIZE;
1980 		if (nla_put_in6_addr(skb, MPTCP_ATTR_DADDR6, &ssk->sk_v6_daddr))
1981 			return -EMSGSIZE;
1982 		break;
1983 	}
1984 #endif
1985 	default:
1986 		WARN_ON_ONCE(1);
1987 		return -EMSGSIZE;
1988 	}
1989 
1990 	if (nla_put_be16(skb, MPTCP_ATTR_SPORT, issk->inet_sport))
1991 		return -EMSGSIZE;
1992 	if (nla_put_be16(skb, MPTCP_ATTR_DPORT, issk->inet_dport))
1993 		return -EMSGSIZE;
1994 
1995 	sf = mptcp_subflow_ctx(ssk);
1996 	if (WARN_ON_ONCE(!sf))
1997 		return -EINVAL;
1998 
1999 	if (nla_put_u8(skb, MPTCP_ATTR_LOC_ID, subflow_get_local_id(sf)))
2000 		return -EMSGSIZE;
2001 
2002 	if (nla_put_u8(skb, MPTCP_ATTR_REM_ID, sf->remote_id))
2003 		return -EMSGSIZE;
2004 
2005 	return 0;
2006 }
2007 
2008 static int mptcp_event_put_token_and_ssk(struct sk_buff *skb,
2009 					 const struct mptcp_sock *msk,
2010 					 const struct sock *ssk)
2011 {
2012 	const struct sock *sk = (const struct sock *)msk;
2013 	const struct mptcp_subflow_context *sf;
2014 	u8 sk_err;
2015 
2016 	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)))
2017 		return -EMSGSIZE;
2018 
2019 	if (mptcp_event_add_subflow(skb, ssk))
2020 		return -EMSGSIZE;
2021 
2022 	sf = mptcp_subflow_ctx(ssk);
2023 	if (WARN_ON_ONCE(!sf))
2024 		return -EINVAL;
2025 
2026 	if (nla_put_u8(skb, MPTCP_ATTR_BACKUP, sf->backup))
2027 		return -EMSGSIZE;
2028 
2029 	if (ssk->sk_bound_dev_if &&
2030 	    nla_put_s32(skb, MPTCP_ATTR_IF_IDX, ssk->sk_bound_dev_if))
2031 		return -EMSGSIZE;
2032 
2033 	sk_err = READ_ONCE(ssk->sk_err);
2034 	if (sk_err && sk->sk_state == TCP_ESTABLISHED &&
2035 	    nla_put_u8(skb, MPTCP_ATTR_ERROR, sk_err))
2036 		return -EMSGSIZE;
2037 
2038 	return 0;
2039 }
2040 
2041 static int mptcp_event_sub_established(struct sk_buff *skb,
2042 				       const struct mptcp_sock *msk,
2043 				       const struct sock *ssk)
2044 {
2045 	return mptcp_event_put_token_and_ssk(skb, msk, ssk);
2046 }
2047 
2048 static int mptcp_event_sub_closed(struct sk_buff *skb,
2049 				  const struct mptcp_sock *msk,
2050 				  const struct sock *ssk)
2051 {
2052 	const struct mptcp_subflow_context *sf;
2053 
2054 	if (mptcp_event_put_token_and_ssk(skb, msk, ssk))
2055 		return -EMSGSIZE;
2056 
2057 	sf = mptcp_subflow_ctx(ssk);
2058 	if (!sf->reset_seen)
2059 		return 0;
2060 
2061 	if (nla_put_u32(skb, MPTCP_ATTR_RESET_REASON, sf->reset_reason))
2062 		return -EMSGSIZE;
2063 
2064 	if (nla_put_u32(skb, MPTCP_ATTR_RESET_FLAGS, sf->reset_transient))
2065 		return -EMSGSIZE;
2066 
2067 	return 0;
2068 }
2069 
2070 static int mptcp_event_created(struct sk_buff *skb,
2071 			       const struct mptcp_sock *msk,
2072 			       const struct sock *ssk)
2073 {
2074 	int err = nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token));
2075 
2076 	if (err)
2077 		return err;
2078 
2079 	if (nla_put_u8(skb, MPTCP_ATTR_SERVER_SIDE, READ_ONCE(msk->pm.server_side)))
2080 		return -EMSGSIZE;
2081 
2082 	return mptcp_event_add_subflow(skb, ssk);
2083 }
2084 
2085 void mptcp_event_addr_removed(const struct mptcp_sock *msk, uint8_t id)
2086 {
2087 	struct net *net = sock_net((const struct sock *)msk);
2088 	struct nlmsghdr *nlh;
2089 	struct sk_buff *skb;
2090 
2091 	if (!genl_has_listeners(&mptcp_genl_family, net, MPTCP_PM_EV_GRP_OFFSET))
2092 		return;
2093 
2094 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
2095 	if (!skb)
2096 		return;
2097 
2098 	nlh = genlmsg_put(skb, 0, 0, &mptcp_genl_family, 0, MPTCP_EVENT_REMOVED);
2099 	if (!nlh)
2100 		goto nla_put_failure;
2101 
2102 	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)))
2103 		goto nla_put_failure;
2104 
2105 	if (nla_put_u8(skb, MPTCP_ATTR_REM_ID, id))
2106 		goto nla_put_failure;
2107 
2108 	genlmsg_end(skb, nlh);
2109 	mptcp_nl_mcast_send(net, skb, GFP_ATOMIC);
2110 	return;
2111 
2112 nla_put_failure:
2113 	nlmsg_free(skb);
2114 }
2115 
2116 void mptcp_event_addr_announced(const struct sock *ssk,
2117 				const struct mptcp_addr_info *info)
2118 {
2119 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
2120 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
2121 	struct net *net = sock_net(ssk);
2122 	struct nlmsghdr *nlh;
2123 	struct sk_buff *skb;
2124 
2125 	if (!genl_has_listeners(&mptcp_genl_family, net, MPTCP_PM_EV_GRP_OFFSET))
2126 		return;
2127 
2128 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
2129 	if (!skb)
2130 		return;
2131 
2132 	nlh = genlmsg_put(skb, 0, 0, &mptcp_genl_family, 0,
2133 			  MPTCP_EVENT_ANNOUNCED);
2134 	if (!nlh)
2135 		goto nla_put_failure;
2136 
2137 	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)))
2138 		goto nla_put_failure;
2139 
2140 	if (nla_put_u8(skb, MPTCP_ATTR_REM_ID, info->id))
2141 		goto nla_put_failure;
2142 
2143 	if (nla_put_be16(skb, MPTCP_ATTR_DPORT,
2144 			 info->port == 0 ?
2145 			 inet_sk(ssk)->inet_dport :
2146 			 info->port))
2147 		goto nla_put_failure;
2148 
2149 	switch (info->family) {
2150 	case AF_INET:
2151 		if (nla_put_in_addr(skb, MPTCP_ATTR_DADDR4, info->addr.s_addr))
2152 			goto nla_put_failure;
2153 		break;
2154 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
2155 	case AF_INET6:
2156 		if (nla_put_in6_addr(skb, MPTCP_ATTR_DADDR6, &info->addr6))
2157 			goto nla_put_failure;
2158 		break;
2159 #endif
2160 	default:
2161 		WARN_ON_ONCE(1);
2162 		goto nla_put_failure;
2163 	}
2164 
2165 	genlmsg_end(skb, nlh);
2166 	mptcp_nl_mcast_send(net, skb, GFP_ATOMIC);
2167 	return;
2168 
2169 nla_put_failure:
2170 	nlmsg_free(skb);
2171 }
2172 
2173 void mptcp_event_pm_listener(const struct sock *ssk,
2174 			     enum mptcp_event_type event)
2175 {
2176 	const struct inet_sock *issk = inet_sk(ssk);
2177 	struct net *net = sock_net(ssk);
2178 	struct nlmsghdr *nlh;
2179 	struct sk_buff *skb;
2180 
2181 	if (!genl_has_listeners(&mptcp_genl_family, net, MPTCP_PM_EV_GRP_OFFSET))
2182 		return;
2183 
2184 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2185 	if (!skb)
2186 		return;
2187 
2188 	nlh = genlmsg_put(skb, 0, 0, &mptcp_genl_family, 0, event);
2189 	if (!nlh)
2190 		goto nla_put_failure;
2191 
2192 	if (nla_put_u16(skb, MPTCP_ATTR_FAMILY, ssk->sk_family))
2193 		goto nla_put_failure;
2194 
2195 	if (nla_put_be16(skb, MPTCP_ATTR_SPORT, issk->inet_sport))
2196 		goto nla_put_failure;
2197 
2198 	switch (ssk->sk_family) {
2199 	case AF_INET:
2200 		if (nla_put_in_addr(skb, MPTCP_ATTR_SADDR4, issk->inet_saddr))
2201 			goto nla_put_failure;
2202 		break;
2203 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
2204 	case AF_INET6: {
2205 		const struct ipv6_pinfo *np = inet6_sk(ssk);
2206 
2207 		if (nla_put_in6_addr(skb, MPTCP_ATTR_SADDR6, &np->saddr))
2208 			goto nla_put_failure;
2209 		break;
2210 	}
2211 #endif
2212 	default:
2213 		WARN_ON_ONCE(1);
2214 		goto nla_put_failure;
2215 	}
2216 
2217 	genlmsg_end(skb, nlh);
2218 	mptcp_nl_mcast_send(net, skb, GFP_KERNEL);
2219 	return;
2220 
2221 nla_put_failure:
2222 	nlmsg_free(skb);
2223 }
2224 
2225 void mptcp_event(enum mptcp_event_type type, const struct mptcp_sock *msk,
2226 		 const struct sock *ssk, gfp_t gfp)
2227 {
2228 	struct net *net = sock_net((const struct sock *)msk);
2229 	struct nlmsghdr *nlh;
2230 	struct sk_buff *skb;
2231 
2232 	if (!genl_has_listeners(&mptcp_genl_family, net, MPTCP_PM_EV_GRP_OFFSET))
2233 		return;
2234 
2235 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
2236 	if (!skb)
2237 		return;
2238 
2239 	nlh = genlmsg_put(skb, 0, 0, &mptcp_genl_family, 0, type);
2240 	if (!nlh)
2241 		goto nla_put_failure;
2242 
2243 	switch (type) {
2244 	case MPTCP_EVENT_UNSPEC:
2245 		WARN_ON_ONCE(1);
2246 		break;
2247 	case MPTCP_EVENT_CREATED:
2248 	case MPTCP_EVENT_ESTABLISHED:
2249 		if (mptcp_event_created(skb, msk, ssk) < 0)
2250 			goto nla_put_failure;
2251 		break;
2252 	case MPTCP_EVENT_CLOSED:
2253 		if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)) < 0)
2254 			goto nla_put_failure;
2255 		break;
2256 	case MPTCP_EVENT_ANNOUNCED:
2257 	case MPTCP_EVENT_REMOVED:
2258 		/* call mptcp_event_addr_announced()/removed instead */
2259 		WARN_ON_ONCE(1);
2260 		break;
2261 	case MPTCP_EVENT_SUB_ESTABLISHED:
2262 	case MPTCP_EVENT_SUB_PRIORITY:
2263 		if (mptcp_event_sub_established(skb, msk, ssk) < 0)
2264 			goto nla_put_failure;
2265 		break;
2266 	case MPTCP_EVENT_SUB_CLOSED:
2267 		if (mptcp_event_sub_closed(skb, msk, ssk) < 0)
2268 			goto nla_put_failure;
2269 		break;
2270 	case MPTCP_EVENT_LISTENER_CREATED:
2271 	case MPTCP_EVENT_LISTENER_CLOSED:
2272 		break;
2273 	}
2274 
2275 	genlmsg_end(skb, nlh);
2276 	mptcp_nl_mcast_send(net, skb, gfp);
2277 	return;
2278 
2279 nla_put_failure:
2280 	nlmsg_free(skb);
2281 }
2282 
2283 struct genl_family mptcp_genl_family __ro_after_init = {
2284 	.name		= MPTCP_PM_NAME,
2285 	.version	= MPTCP_PM_VER,
2286 	.netnsok	= true,
2287 	.module		= THIS_MODULE,
2288 	.ops		= mptcp_pm_nl_ops,
2289 	.n_ops		= ARRAY_SIZE(mptcp_pm_nl_ops),
2290 	.resv_start_op	= MPTCP_PM_CMD_SUBFLOW_DESTROY + 1,
2291 	.mcgrps		= mptcp_pm_mcgrps,
2292 	.n_mcgrps	= ARRAY_SIZE(mptcp_pm_mcgrps),
2293 };
2294 
2295 static int __net_init pm_nl_init_net(struct net *net)
2296 {
2297 	struct pm_nl_pernet *pernet = pm_nl_get_pernet(net);
2298 
2299 	INIT_LIST_HEAD_RCU(&pernet->local_addr_list);
2300 
2301 	/* Cit. 2 subflows ought to be enough for anybody. */
2302 	pernet->subflows_max = 2;
2303 	pernet->next_id = 1;
2304 	pernet->stale_loss_cnt = 4;
2305 	spin_lock_init(&pernet->lock);
2306 
2307 	/* No need to initialize other pernet fields, the struct is zeroed at
2308 	 * allocation time.
2309 	 */
2310 
2311 	return 0;
2312 }
2313 
2314 static void __net_exit pm_nl_exit_net(struct list_head *net_list)
2315 {
2316 	struct net *net;
2317 
2318 	list_for_each_entry(net, net_list, exit_list) {
2319 		struct pm_nl_pernet *pernet = pm_nl_get_pernet(net);
2320 
2321 		/* net is removed from namespace list, can't race with
2322 		 * other modifiers, also netns core already waited for a
2323 		 * RCU grace period.
2324 		 */
2325 		__flush_addrs(&pernet->local_addr_list);
2326 	}
2327 }
2328 
2329 static struct pernet_operations mptcp_pm_pernet_ops = {
2330 	.init = pm_nl_init_net,
2331 	.exit_batch = pm_nl_exit_net,
2332 	.id = &pm_nl_pernet_id,
2333 	.size = sizeof(struct pm_nl_pernet),
2334 };
2335 
2336 void __init mptcp_pm_nl_init(void)
2337 {
2338 	if (register_pernet_subsys(&mptcp_pm_pernet_ops) < 0)
2339 		panic("Failed to register MPTCP PM pernet subsystem.\n");
2340 
2341 	if (genl_register_family(&mptcp_genl_family))
2342 		panic("Failed to register MPTCP PM netlink family\n");
2343 }
2344