1 /* 2 * NETLINK Kernel-user communication protocol. 3 * 4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk> 5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License 9 * as published by the Free Software Foundation; either version 10 * 2 of the License, or (at your option) any later version. 11 * 12 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith 13 * added netlink_proto_exit 14 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br> 15 * use nlk_sk, as sk->protinfo is on a diet 8) 16 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org> 17 * - inc module use count of module that owns 18 * the kernel socket in case userspace opens 19 * socket of same protocol 20 * - remove all module support, since netlink is 21 * mandatory if CONFIG_NET=y these days 22 */ 23 24 #include <linux/module.h> 25 26 #include <linux/capability.h> 27 #include <linux/kernel.h> 28 #include <linux/init.h> 29 #include <linux/signal.h> 30 #include <linux/sched.h> 31 #include <linux/errno.h> 32 #include <linux/string.h> 33 #include <linux/stat.h> 34 #include <linux/socket.h> 35 #include <linux/un.h> 36 #include <linux/fcntl.h> 37 #include <linux/termios.h> 38 #include <linux/sockios.h> 39 #include <linux/net.h> 40 #include <linux/fs.h> 41 #include <linux/slab.h> 42 #include <asm/uaccess.h> 43 #include <linux/skbuff.h> 44 #include <linux/netdevice.h> 45 #include <linux/rtnetlink.h> 46 #include <linux/proc_fs.h> 47 #include <linux/seq_file.h> 48 #include <linux/notifier.h> 49 #include <linux/security.h> 50 #include <linux/jhash.h> 51 #include <linux/jiffies.h> 52 #include <linux/random.h> 53 #include <linux/bitops.h> 54 #include <linux/mm.h> 55 #include <linux/types.h> 56 #include <linux/audit.h> 57 #include <linux/mutex.h> 58 59 #include <net/net_namespace.h> 60 #include <net/sock.h> 61 #include <net/scm.h> 62 #include <net/netlink.h> 63 64 #define NLGRPSZ(x) (ALIGN(x, sizeof(unsigned long) * 8) / 8) 65 #define NLGRPLONGS(x) (NLGRPSZ(x)/sizeof(unsigned long)) 66 67 struct netlink_sock { 68 /* struct sock has to be the first member of netlink_sock */ 69 struct sock sk; 70 u32 pid; 71 u32 dst_pid; 72 u32 dst_group; 73 u32 flags; 74 u32 subscriptions; 75 u32 ngroups; 76 unsigned long *groups; 77 unsigned long state; 78 wait_queue_head_t wait; 79 struct netlink_callback *cb; 80 struct mutex *cb_mutex; 81 struct mutex cb_def_mutex; 82 void (*netlink_rcv)(struct sk_buff *skb); 83 struct module *module; 84 }; 85 86 struct listeners_rcu_head { 87 struct rcu_head rcu_head; 88 void *ptr; 89 }; 90 91 #define NETLINK_KERNEL_SOCKET 0x1 92 #define NETLINK_RECV_PKTINFO 0x2 93 #define NETLINK_BROADCAST_SEND_ERROR 0x4 94 #define NETLINK_RECV_NO_ENOBUFS 0x8 95 96 static inline struct netlink_sock *nlk_sk(struct sock *sk) 97 { 98 return container_of(sk, struct netlink_sock, sk); 99 } 100 101 static inline int netlink_is_kernel(struct sock *sk) 102 { 103 return nlk_sk(sk)->flags & NETLINK_KERNEL_SOCKET; 104 } 105 106 struct nl_pid_hash { 107 struct hlist_head *table; 108 unsigned long rehash_time; 109 110 unsigned int mask; 111 unsigned int shift; 112 113 unsigned int entries; 114 unsigned int max_shift; 115 116 u32 rnd; 117 }; 118 119 struct netlink_table { 120 struct nl_pid_hash hash; 121 struct hlist_head mc_list; 122 unsigned long *listeners; 123 unsigned int nl_nonroot; 124 unsigned int groups; 125 struct mutex *cb_mutex; 126 struct module *module; 127 int registered; 128 }; 129 130 static struct netlink_table *nl_table; 131 132 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); 133 134 static int netlink_dump(struct sock *sk); 135 static void netlink_destroy_callback(struct netlink_callback *cb); 136 137 static DEFINE_RWLOCK(nl_table_lock); 138 static atomic_t nl_table_users = ATOMIC_INIT(0); 139 140 static ATOMIC_NOTIFIER_HEAD(netlink_chain); 141 142 static u32 netlink_group_mask(u32 group) 143 { 144 return group ? 1 << (group - 1) : 0; 145 } 146 147 static struct hlist_head *nl_pid_hashfn(struct nl_pid_hash *hash, u32 pid) 148 { 149 return &hash->table[jhash_1word(pid, hash->rnd) & hash->mask]; 150 } 151 152 static void netlink_sock_destruct(struct sock *sk) 153 { 154 struct netlink_sock *nlk = nlk_sk(sk); 155 156 if (nlk->cb) { 157 if (nlk->cb->done) 158 nlk->cb->done(nlk->cb); 159 netlink_destroy_callback(nlk->cb); 160 } 161 162 skb_queue_purge(&sk->sk_receive_queue); 163 164 if (!sock_flag(sk, SOCK_DEAD)) { 165 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); 166 return; 167 } 168 169 WARN_ON(atomic_read(&sk->sk_rmem_alloc)); 170 WARN_ON(atomic_read(&sk->sk_wmem_alloc)); 171 WARN_ON(nlk_sk(sk)->groups); 172 } 173 174 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on 175 * SMP. Look, when several writers sleep and reader wakes them up, all but one 176 * immediately hit write lock and grab all the cpus. Exclusive sleep solves 177 * this, _but_ remember, it adds useless work on UP machines. 178 */ 179 180 static void netlink_table_grab(void) 181 __acquires(nl_table_lock) 182 { 183 write_lock_irq(&nl_table_lock); 184 185 if (atomic_read(&nl_table_users)) { 186 DECLARE_WAITQUEUE(wait, current); 187 188 add_wait_queue_exclusive(&nl_table_wait, &wait); 189 for (;;) { 190 set_current_state(TASK_UNINTERRUPTIBLE); 191 if (atomic_read(&nl_table_users) == 0) 192 break; 193 write_unlock_irq(&nl_table_lock); 194 schedule(); 195 write_lock_irq(&nl_table_lock); 196 } 197 198 __set_current_state(TASK_RUNNING); 199 remove_wait_queue(&nl_table_wait, &wait); 200 } 201 } 202 203 static void netlink_table_ungrab(void) 204 __releases(nl_table_lock) 205 { 206 write_unlock_irq(&nl_table_lock); 207 wake_up(&nl_table_wait); 208 } 209 210 static inline void 211 netlink_lock_table(void) 212 { 213 /* read_lock() synchronizes us to netlink_table_grab */ 214 215 read_lock(&nl_table_lock); 216 atomic_inc(&nl_table_users); 217 read_unlock(&nl_table_lock); 218 } 219 220 static inline void 221 netlink_unlock_table(void) 222 { 223 if (atomic_dec_and_test(&nl_table_users)) 224 wake_up(&nl_table_wait); 225 } 226 227 static inline struct sock *netlink_lookup(struct net *net, int protocol, 228 u32 pid) 229 { 230 struct nl_pid_hash *hash = &nl_table[protocol].hash; 231 struct hlist_head *head; 232 struct sock *sk; 233 struct hlist_node *node; 234 235 read_lock(&nl_table_lock); 236 head = nl_pid_hashfn(hash, pid); 237 sk_for_each(sk, node, head) { 238 if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->pid == pid)) { 239 sock_hold(sk); 240 goto found; 241 } 242 } 243 sk = NULL; 244 found: 245 read_unlock(&nl_table_lock); 246 return sk; 247 } 248 249 static inline struct hlist_head *nl_pid_hash_zalloc(size_t size) 250 { 251 if (size <= PAGE_SIZE) 252 return kzalloc(size, GFP_ATOMIC); 253 else 254 return (struct hlist_head *) 255 __get_free_pages(GFP_ATOMIC | __GFP_ZERO, 256 get_order(size)); 257 } 258 259 static inline void nl_pid_hash_free(struct hlist_head *table, size_t size) 260 { 261 if (size <= PAGE_SIZE) 262 kfree(table); 263 else 264 free_pages((unsigned long)table, get_order(size)); 265 } 266 267 static int nl_pid_hash_rehash(struct nl_pid_hash *hash, int grow) 268 { 269 unsigned int omask, mask, shift; 270 size_t osize, size; 271 struct hlist_head *otable, *table; 272 int i; 273 274 omask = mask = hash->mask; 275 osize = size = (mask + 1) * sizeof(*table); 276 shift = hash->shift; 277 278 if (grow) { 279 if (++shift > hash->max_shift) 280 return 0; 281 mask = mask * 2 + 1; 282 size *= 2; 283 } 284 285 table = nl_pid_hash_zalloc(size); 286 if (!table) 287 return 0; 288 289 otable = hash->table; 290 hash->table = table; 291 hash->mask = mask; 292 hash->shift = shift; 293 get_random_bytes(&hash->rnd, sizeof(hash->rnd)); 294 295 for (i = 0; i <= omask; i++) { 296 struct sock *sk; 297 struct hlist_node *node, *tmp; 298 299 sk_for_each_safe(sk, node, tmp, &otable[i]) 300 __sk_add_node(sk, nl_pid_hashfn(hash, nlk_sk(sk)->pid)); 301 } 302 303 nl_pid_hash_free(otable, osize); 304 hash->rehash_time = jiffies + 10 * 60 * HZ; 305 return 1; 306 } 307 308 static inline int nl_pid_hash_dilute(struct nl_pid_hash *hash, int len) 309 { 310 int avg = hash->entries >> hash->shift; 311 312 if (unlikely(avg > 1) && nl_pid_hash_rehash(hash, 1)) 313 return 1; 314 315 if (unlikely(len > avg) && time_after(jiffies, hash->rehash_time)) { 316 nl_pid_hash_rehash(hash, 0); 317 return 1; 318 } 319 320 return 0; 321 } 322 323 static const struct proto_ops netlink_ops; 324 325 static void 326 netlink_update_listeners(struct sock *sk) 327 { 328 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 329 struct hlist_node *node; 330 unsigned long mask; 331 unsigned int i; 332 333 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) { 334 mask = 0; 335 sk_for_each_bound(sk, node, &tbl->mc_list) { 336 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups)) 337 mask |= nlk_sk(sk)->groups[i]; 338 } 339 tbl->listeners[i] = mask; 340 } 341 /* this function is only called with the netlink table "grabbed", which 342 * makes sure updates are visible before bind or setsockopt return. */ 343 } 344 345 static int netlink_insert(struct sock *sk, struct net *net, u32 pid) 346 { 347 struct nl_pid_hash *hash = &nl_table[sk->sk_protocol].hash; 348 struct hlist_head *head; 349 int err = -EADDRINUSE; 350 struct sock *osk; 351 struct hlist_node *node; 352 int len; 353 354 netlink_table_grab(); 355 head = nl_pid_hashfn(hash, pid); 356 len = 0; 357 sk_for_each(osk, node, head) { 358 if (net_eq(sock_net(osk), net) && (nlk_sk(osk)->pid == pid)) 359 break; 360 len++; 361 } 362 if (node) 363 goto err; 364 365 err = -EBUSY; 366 if (nlk_sk(sk)->pid) 367 goto err; 368 369 err = -ENOMEM; 370 if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX)) 371 goto err; 372 373 if (len && nl_pid_hash_dilute(hash, len)) 374 head = nl_pid_hashfn(hash, pid); 375 hash->entries++; 376 nlk_sk(sk)->pid = pid; 377 sk_add_node(sk, head); 378 err = 0; 379 380 err: 381 netlink_table_ungrab(); 382 return err; 383 } 384 385 static void netlink_remove(struct sock *sk) 386 { 387 netlink_table_grab(); 388 if (sk_del_node_init(sk)) 389 nl_table[sk->sk_protocol].hash.entries--; 390 if (nlk_sk(sk)->subscriptions) 391 __sk_del_bind_node(sk); 392 netlink_table_ungrab(); 393 } 394 395 static struct proto netlink_proto = { 396 .name = "NETLINK", 397 .owner = THIS_MODULE, 398 .obj_size = sizeof(struct netlink_sock), 399 }; 400 401 static int __netlink_create(struct net *net, struct socket *sock, 402 struct mutex *cb_mutex, int protocol) 403 { 404 struct sock *sk; 405 struct netlink_sock *nlk; 406 407 sock->ops = &netlink_ops; 408 409 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto); 410 if (!sk) 411 return -ENOMEM; 412 413 sock_init_data(sock, sk); 414 415 nlk = nlk_sk(sk); 416 if (cb_mutex) 417 nlk->cb_mutex = cb_mutex; 418 else { 419 nlk->cb_mutex = &nlk->cb_def_mutex; 420 mutex_init(nlk->cb_mutex); 421 } 422 init_waitqueue_head(&nlk->wait); 423 424 sk->sk_destruct = netlink_sock_destruct; 425 sk->sk_protocol = protocol; 426 return 0; 427 } 428 429 static int netlink_create(struct net *net, struct socket *sock, int protocol) 430 { 431 struct module *module = NULL; 432 struct mutex *cb_mutex; 433 struct netlink_sock *nlk; 434 int err = 0; 435 436 sock->state = SS_UNCONNECTED; 437 438 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) 439 return -ESOCKTNOSUPPORT; 440 441 if (protocol < 0 || protocol >= MAX_LINKS) 442 return -EPROTONOSUPPORT; 443 444 netlink_lock_table(); 445 #ifdef CONFIG_MODULES 446 if (!nl_table[protocol].registered) { 447 netlink_unlock_table(); 448 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol); 449 netlink_lock_table(); 450 } 451 #endif 452 if (nl_table[protocol].registered && 453 try_module_get(nl_table[protocol].module)) 454 module = nl_table[protocol].module; 455 cb_mutex = nl_table[protocol].cb_mutex; 456 netlink_unlock_table(); 457 458 err = __netlink_create(net, sock, cb_mutex, protocol); 459 if (err < 0) 460 goto out_module; 461 462 local_bh_disable(); 463 sock_prot_inuse_add(net, &netlink_proto, 1); 464 local_bh_enable(); 465 466 nlk = nlk_sk(sock->sk); 467 nlk->module = module; 468 out: 469 return err; 470 471 out_module: 472 module_put(module); 473 goto out; 474 } 475 476 static int netlink_release(struct socket *sock) 477 { 478 struct sock *sk = sock->sk; 479 struct netlink_sock *nlk; 480 481 if (!sk) 482 return 0; 483 484 netlink_remove(sk); 485 sock_orphan(sk); 486 nlk = nlk_sk(sk); 487 488 /* 489 * OK. Socket is unlinked, any packets that arrive now 490 * will be purged. 491 */ 492 493 sock->sk = NULL; 494 wake_up_interruptible_all(&nlk->wait); 495 496 skb_queue_purge(&sk->sk_write_queue); 497 498 if (nlk->pid && !nlk->subscriptions) { 499 struct netlink_notify n = { 500 .net = sock_net(sk), 501 .protocol = sk->sk_protocol, 502 .pid = nlk->pid, 503 }; 504 atomic_notifier_call_chain(&netlink_chain, 505 NETLINK_URELEASE, &n); 506 } 507 508 module_put(nlk->module); 509 510 netlink_table_grab(); 511 if (netlink_is_kernel(sk)) { 512 BUG_ON(nl_table[sk->sk_protocol].registered == 0); 513 if (--nl_table[sk->sk_protocol].registered == 0) { 514 kfree(nl_table[sk->sk_protocol].listeners); 515 nl_table[sk->sk_protocol].module = NULL; 516 nl_table[sk->sk_protocol].registered = 0; 517 } 518 } else if (nlk->subscriptions) 519 netlink_update_listeners(sk); 520 netlink_table_ungrab(); 521 522 kfree(nlk->groups); 523 nlk->groups = NULL; 524 525 local_bh_disable(); 526 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1); 527 local_bh_enable(); 528 sock_put(sk); 529 return 0; 530 } 531 532 static int netlink_autobind(struct socket *sock) 533 { 534 struct sock *sk = sock->sk; 535 struct net *net = sock_net(sk); 536 struct nl_pid_hash *hash = &nl_table[sk->sk_protocol].hash; 537 struct hlist_head *head; 538 struct sock *osk; 539 struct hlist_node *node; 540 s32 pid = current->tgid; 541 int err; 542 static s32 rover = -4097; 543 544 retry: 545 cond_resched(); 546 netlink_table_grab(); 547 head = nl_pid_hashfn(hash, pid); 548 sk_for_each(osk, node, head) { 549 if (!net_eq(sock_net(osk), net)) 550 continue; 551 if (nlk_sk(osk)->pid == pid) { 552 /* Bind collision, search negative pid values. */ 553 pid = rover--; 554 if (rover > -4097) 555 rover = -4097; 556 netlink_table_ungrab(); 557 goto retry; 558 } 559 } 560 netlink_table_ungrab(); 561 562 err = netlink_insert(sk, net, pid); 563 if (err == -EADDRINUSE) 564 goto retry; 565 566 /* If 2 threads race to autobind, that is fine. */ 567 if (err == -EBUSY) 568 err = 0; 569 570 return err; 571 } 572 573 static inline int netlink_capable(struct socket *sock, unsigned int flag) 574 { 575 return (nl_table[sock->sk->sk_protocol].nl_nonroot & flag) || 576 capable(CAP_NET_ADMIN); 577 } 578 579 static void 580 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions) 581 { 582 struct netlink_sock *nlk = nlk_sk(sk); 583 584 if (nlk->subscriptions && !subscriptions) 585 __sk_del_bind_node(sk); 586 else if (!nlk->subscriptions && subscriptions) 587 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list); 588 nlk->subscriptions = subscriptions; 589 } 590 591 static int netlink_realloc_groups(struct sock *sk) 592 { 593 struct netlink_sock *nlk = nlk_sk(sk); 594 unsigned int groups; 595 unsigned long *new_groups; 596 int err = 0; 597 598 netlink_table_grab(); 599 600 groups = nl_table[sk->sk_protocol].groups; 601 if (!nl_table[sk->sk_protocol].registered) { 602 err = -ENOENT; 603 goto out_unlock; 604 } 605 606 if (nlk->ngroups >= groups) 607 goto out_unlock; 608 609 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC); 610 if (new_groups == NULL) { 611 err = -ENOMEM; 612 goto out_unlock; 613 } 614 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0, 615 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups)); 616 617 nlk->groups = new_groups; 618 nlk->ngroups = groups; 619 out_unlock: 620 netlink_table_ungrab(); 621 return err; 622 } 623 624 static int netlink_bind(struct socket *sock, struct sockaddr *addr, 625 int addr_len) 626 { 627 struct sock *sk = sock->sk; 628 struct net *net = sock_net(sk); 629 struct netlink_sock *nlk = nlk_sk(sk); 630 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 631 int err; 632 633 if (nladdr->nl_family != AF_NETLINK) 634 return -EINVAL; 635 636 /* Only superuser is allowed to listen multicasts */ 637 if (nladdr->nl_groups) { 638 if (!netlink_capable(sock, NL_NONROOT_RECV)) 639 return -EPERM; 640 err = netlink_realloc_groups(sk); 641 if (err) 642 return err; 643 } 644 645 if (nlk->pid) { 646 if (nladdr->nl_pid != nlk->pid) 647 return -EINVAL; 648 } else { 649 err = nladdr->nl_pid ? 650 netlink_insert(sk, net, nladdr->nl_pid) : 651 netlink_autobind(sock); 652 if (err) 653 return err; 654 } 655 656 if (!nladdr->nl_groups && (nlk->groups == NULL || !(u32)nlk->groups[0])) 657 return 0; 658 659 netlink_table_grab(); 660 netlink_update_subscriptions(sk, nlk->subscriptions + 661 hweight32(nladdr->nl_groups) - 662 hweight32(nlk->groups[0])); 663 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | nladdr->nl_groups; 664 netlink_update_listeners(sk); 665 netlink_table_ungrab(); 666 667 return 0; 668 } 669 670 static int netlink_connect(struct socket *sock, struct sockaddr *addr, 671 int alen, int flags) 672 { 673 int err = 0; 674 struct sock *sk = sock->sk; 675 struct netlink_sock *nlk = nlk_sk(sk); 676 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 677 678 if (addr->sa_family == AF_UNSPEC) { 679 sk->sk_state = NETLINK_UNCONNECTED; 680 nlk->dst_pid = 0; 681 nlk->dst_group = 0; 682 return 0; 683 } 684 if (addr->sa_family != AF_NETLINK) 685 return -EINVAL; 686 687 /* Only superuser is allowed to send multicasts */ 688 if (nladdr->nl_groups && !netlink_capable(sock, NL_NONROOT_SEND)) 689 return -EPERM; 690 691 if (!nlk->pid) 692 err = netlink_autobind(sock); 693 694 if (err == 0) { 695 sk->sk_state = NETLINK_CONNECTED; 696 nlk->dst_pid = nladdr->nl_pid; 697 nlk->dst_group = ffs(nladdr->nl_groups); 698 } 699 700 return err; 701 } 702 703 static int netlink_getname(struct socket *sock, struct sockaddr *addr, 704 int *addr_len, int peer) 705 { 706 struct sock *sk = sock->sk; 707 struct netlink_sock *nlk = nlk_sk(sk); 708 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 709 710 nladdr->nl_family = AF_NETLINK; 711 nladdr->nl_pad = 0; 712 *addr_len = sizeof(*nladdr); 713 714 if (peer) { 715 nladdr->nl_pid = nlk->dst_pid; 716 nladdr->nl_groups = netlink_group_mask(nlk->dst_group); 717 } else { 718 nladdr->nl_pid = nlk->pid; 719 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0; 720 } 721 return 0; 722 } 723 724 static void netlink_overrun(struct sock *sk) 725 { 726 struct netlink_sock *nlk = nlk_sk(sk); 727 728 if (!(nlk->flags & NETLINK_RECV_NO_ENOBUFS)) { 729 if (!test_and_set_bit(0, &nlk_sk(sk)->state)) { 730 sk->sk_err = ENOBUFS; 731 sk->sk_error_report(sk); 732 } 733 } 734 atomic_inc(&sk->sk_drops); 735 } 736 737 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid) 738 { 739 struct sock *sock; 740 struct netlink_sock *nlk; 741 742 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, pid); 743 if (!sock) 744 return ERR_PTR(-ECONNREFUSED); 745 746 /* Don't bother queuing skb if kernel socket has no input function */ 747 nlk = nlk_sk(sock); 748 if (sock->sk_state == NETLINK_CONNECTED && 749 nlk->dst_pid != nlk_sk(ssk)->pid) { 750 sock_put(sock); 751 return ERR_PTR(-ECONNREFUSED); 752 } 753 return sock; 754 } 755 756 struct sock *netlink_getsockbyfilp(struct file *filp) 757 { 758 struct inode *inode = filp->f_path.dentry->d_inode; 759 struct sock *sock; 760 761 if (!S_ISSOCK(inode->i_mode)) 762 return ERR_PTR(-ENOTSOCK); 763 764 sock = SOCKET_I(inode)->sk; 765 if (sock->sk_family != AF_NETLINK) 766 return ERR_PTR(-EINVAL); 767 768 sock_hold(sock); 769 return sock; 770 } 771 772 /* 773 * Attach a skb to a netlink socket. 774 * The caller must hold a reference to the destination socket. On error, the 775 * reference is dropped. The skb is not send to the destination, just all 776 * all error checks are performed and memory in the queue is reserved. 777 * Return values: 778 * < 0: error. skb freed, reference to sock dropped. 779 * 0: continue 780 * 1: repeat lookup - reference dropped while waiting for socket memory. 781 */ 782 int netlink_attachskb(struct sock *sk, struct sk_buff *skb, 783 long *timeo, struct sock *ssk) 784 { 785 struct netlink_sock *nlk; 786 787 nlk = nlk_sk(sk); 788 789 if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 790 test_bit(0, &nlk->state)) { 791 DECLARE_WAITQUEUE(wait, current); 792 if (!*timeo) { 793 if (!ssk || netlink_is_kernel(ssk)) 794 netlink_overrun(sk); 795 sock_put(sk); 796 kfree_skb(skb); 797 return -EAGAIN; 798 } 799 800 __set_current_state(TASK_INTERRUPTIBLE); 801 add_wait_queue(&nlk->wait, &wait); 802 803 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 804 test_bit(0, &nlk->state)) && 805 !sock_flag(sk, SOCK_DEAD)) 806 *timeo = schedule_timeout(*timeo); 807 808 __set_current_state(TASK_RUNNING); 809 remove_wait_queue(&nlk->wait, &wait); 810 sock_put(sk); 811 812 if (signal_pending(current)) { 813 kfree_skb(skb); 814 return sock_intr_errno(*timeo); 815 } 816 return 1; 817 } 818 skb_set_owner_r(skb, sk); 819 return 0; 820 } 821 822 int netlink_sendskb(struct sock *sk, struct sk_buff *skb) 823 { 824 int len = skb->len; 825 826 skb_queue_tail(&sk->sk_receive_queue, skb); 827 sk->sk_data_ready(sk, len); 828 sock_put(sk); 829 return len; 830 } 831 832 void netlink_detachskb(struct sock *sk, struct sk_buff *skb) 833 { 834 kfree_skb(skb); 835 sock_put(sk); 836 } 837 838 static inline struct sk_buff *netlink_trim(struct sk_buff *skb, 839 gfp_t allocation) 840 { 841 int delta; 842 843 skb_orphan(skb); 844 845 delta = skb->end - skb->tail; 846 if (delta * 2 < skb->truesize) 847 return skb; 848 849 if (skb_shared(skb)) { 850 struct sk_buff *nskb = skb_clone(skb, allocation); 851 if (!nskb) 852 return skb; 853 kfree_skb(skb); 854 skb = nskb; 855 } 856 857 if (!pskb_expand_head(skb, 0, -delta, allocation)) 858 skb->truesize -= delta; 859 860 return skb; 861 } 862 863 static inline void netlink_rcv_wake(struct sock *sk) 864 { 865 struct netlink_sock *nlk = nlk_sk(sk); 866 867 if (skb_queue_empty(&sk->sk_receive_queue)) 868 clear_bit(0, &nlk->state); 869 if (!test_bit(0, &nlk->state)) 870 wake_up_interruptible(&nlk->wait); 871 } 872 873 static inline int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb) 874 { 875 int ret; 876 struct netlink_sock *nlk = nlk_sk(sk); 877 878 ret = -ECONNREFUSED; 879 if (nlk->netlink_rcv != NULL) { 880 ret = skb->len; 881 skb_set_owner_r(skb, sk); 882 nlk->netlink_rcv(skb); 883 } 884 kfree_skb(skb); 885 sock_put(sk); 886 return ret; 887 } 888 889 int netlink_unicast(struct sock *ssk, struct sk_buff *skb, 890 u32 pid, int nonblock) 891 { 892 struct sock *sk; 893 int err; 894 long timeo; 895 896 skb = netlink_trim(skb, gfp_any()); 897 898 timeo = sock_sndtimeo(ssk, nonblock); 899 retry: 900 sk = netlink_getsockbypid(ssk, pid); 901 if (IS_ERR(sk)) { 902 kfree_skb(skb); 903 return PTR_ERR(sk); 904 } 905 if (netlink_is_kernel(sk)) 906 return netlink_unicast_kernel(sk, skb); 907 908 if (sk_filter(sk, skb)) { 909 err = skb->len; 910 kfree_skb(skb); 911 sock_put(sk); 912 return err; 913 } 914 915 err = netlink_attachskb(sk, skb, &timeo, ssk); 916 if (err == 1) 917 goto retry; 918 if (err) 919 return err; 920 921 return netlink_sendskb(sk, skb); 922 } 923 EXPORT_SYMBOL(netlink_unicast); 924 925 int netlink_has_listeners(struct sock *sk, unsigned int group) 926 { 927 int res = 0; 928 unsigned long *listeners; 929 930 BUG_ON(!netlink_is_kernel(sk)); 931 932 rcu_read_lock(); 933 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners); 934 935 if (group - 1 < nl_table[sk->sk_protocol].groups) 936 res = test_bit(group - 1, listeners); 937 938 rcu_read_unlock(); 939 940 return res; 941 } 942 EXPORT_SYMBOL_GPL(netlink_has_listeners); 943 944 static inline int netlink_broadcast_deliver(struct sock *sk, 945 struct sk_buff *skb) 946 { 947 struct netlink_sock *nlk = nlk_sk(sk); 948 949 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && 950 !test_bit(0, &nlk->state)) { 951 skb_set_owner_r(skb, sk); 952 skb_queue_tail(&sk->sk_receive_queue, skb); 953 sk->sk_data_ready(sk, skb->len); 954 return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf; 955 } 956 return -1; 957 } 958 959 struct netlink_broadcast_data { 960 struct sock *exclude_sk; 961 struct net *net; 962 u32 pid; 963 u32 group; 964 int failure; 965 int delivery_failure; 966 int congested; 967 int delivered; 968 gfp_t allocation; 969 struct sk_buff *skb, *skb2; 970 }; 971 972 static inline int do_one_broadcast(struct sock *sk, 973 struct netlink_broadcast_data *p) 974 { 975 struct netlink_sock *nlk = nlk_sk(sk); 976 int val; 977 978 if (p->exclude_sk == sk) 979 goto out; 980 981 if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups || 982 !test_bit(p->group - 1, nlk->groups)) 983 goto out; 984 985 if (!net_eq(sock_net(sk), p->net)) 986 goto out; 987 988 if (p->failure) { 989 netlink_overrun(sk); 990 goto out; 991 } 992 993 sock_hold(sk); 994 if (p->skb2 == NULL) { 995 if (skb_shared(p->skb)) { 996 p->skb2 = skb_clone(p->skb, p->allocation); 997 } else { 998 p->skb2 = skb_get(p->skb); 999 /* 1000 * skb ownership may have been set when 1001 * delivered to a previous socket. 1002 */ 1003 skb_orphan(p->skb2); 1004 } 1005 } 1006 if (p->skb2 == NULL) { 1007 netlink_overrun(sk); 1008 /* Clone failed. Notify ALL listeners. */ 1009 p->failure = 1; 1010 if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) 1011 p->delivery_failure = 1; 1012 } else if (sk_filter(sk, p->skb2)) { 1013 kfree_skb(p->skb2); 1014 p->skb2 = NULL; 1015 } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) { 1016 netlink_overrun(sk); 1017 if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) 1018 p->delivery_failure = 1; 1019 } else { 1020 p->congested |= val; 1021 p->delivered = 1; 1022 p->skb2 = NULL; 1023 } 1024 sock_put(sk); 1025 1026 out: 1027 return 0; 1028 } 1029 1030 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid, 1031 u32 group, gfp_t allocation) 1032 { 1033 struct net *net = sock_net(ssk); 1034 struct netlink_broadcast_data info; 1035 struct hlist_node *node; 1036 struct sock *sk; 1037 1038 skb = netlink_trim(skb, allocation); 1039 1040 info.exclude_sk = ssk; 1041 info.net = net; 1042 info.pid = pid; 1043 info.group = group; 1044 info.failure = 0; 1045 info.delivery_failure = 0; 1046 info.congested = 0; 1047 info.delivered = 0; 1048 info.allocation = allocation; 1049 info.skb = skb; 1050 info.skb2 = NULL; 1051 1052 /* While we sleep in clone, do not allow to change socket list */ 1053 1054 netlink_lock_table(); 1055 1056 sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list) 1057 do_one_broadcast(sk, &info); 1058 1059 kfree_skb(skb); 1060 1061 netlink_unlock_table(); 1062 1063 kfree_skb(info.skb2); 1064 1065 if (info.delivery_failure) 1066 return -ENOBUFS; 1067 1068 if (info.delivered) { 1069 if (info.congested && (allocation & __GFP_WAIT)) 1070 yield(); 1071 return 0; 1072 } 1073 return -ESRCH; 1074 } 1075 EXPORT_SYMBOL(netlink_broadcast); 1076 1077 struct netlink_set_err_data { 1078 struct sock *exclude_sk; 1079 u32 pid; 1080 u32 group; 1081 int code; 1082 }; 1083 1084 static inline int do_one_set_err(struct sock *sk, 1085 struct netlink_set_err_data *p) 1086 { 1087 struct netlink_sock *nlk = nlk_sk(sk); 1088 1089 if (sk == p->exclude_sk) 1090 goto out; 1091 1092 if (sock_net(sk) != sock_net(p->exclude_sk)) 1093 goto out; 1094 1095 if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups || 1096 !test_bit(p->group - 1, nlk->groups)) 1097 goto out; 1098 1099 sk->sk_err = p->code; 1100 sk->sk_error_report(sk); 1101 out: 1102 return 0; 1103 } 1104 1105 /** 1106 * netlink_set_err - report error to broadcast listeners 1107 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create() 1108 * @pid: the PID of a process that we want to skip (if any) 1109 * @groups: the broadcast group that will notice the error 1110 * @code: error code, must be negative (as usual in kernelspace) 1111 */ 1112 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code) 1113 { 1114 struct netlink_set_err_data info; 1115 struct hlist_node *node; 1116 struct sock *sk; 1117 1118 info.exclude_sk = ssk; 1119 info.pid = pid; 1120 info.group = group; 1121 /* sk->sk_err wants a positive error value */ 1122 info.code = -code; 1123 1124 read_lock(&nl_table_lock); 1125 1126 sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list) 1127 do_one_set_err(sk, &info); 1128 1129 read_unlock(&nl_table_lock); 1130 } 1131 EXPORT_SYMBOL(netlink_set_err); 1132 1133 /* must be called with netlink table grabbed */ 1134 static void netlink_update_socket_mc(struct netlink_sock *nlk, 1135 unsigned int group, 1136 int is_new) 1137 { 1138 int old, new = !!is_new, subscriptions; 1139 1140 old = test_bit(group - 1, nlk->groups); 1141 subscriptions = nlk->subscriptions - old + new; 1142 if (new) 1143 __set_bit(group - 1, nlk->groups); 1144 else 1145 __clear_bit(group - 1, nlk->groups); 1146 netlink_update_subscriptions(&nlk->sk, subscriptions); 1147 netlink_update_listeners(&nlk->sk); 1148 } 1149 1150 static int netlink_setsockopt(struct socket *sock, int level, int optname, 1151 char __user *optval, int optlen) 1152 { 1153 struct sock *sk = sock->sk; 1154 struct netlink_sock *nlk = nlk_sk(sk); 1155 unsigned int val = 0; 1156 int err; 1157 1158 if (level != SOL_NETLINK) 1159 return -ENOPROTOOPT; 1160 1161 if (optlen >= sizeof(int) && 1162 get_user(val, (unsigned int __user *)optval)) 1163 return -EFAULT; 1164 1165 switch (optname) { 1166 case NETLINK_PKTINFO: 1167 if (val) 1168 nlk->flags |= NETLINK_RECV_PKTINFO; 1169 else 1170 nlk->flags &= ~NETLINK_RECV_PKTINFO; 1171 err = 0; 1172 break; 1173 case NETLINK_ADD_MEMBERSHIP: 1174 case NETLINK_DROP_MEMBERSHIP: { 1175 if (!netlink_capable(sock, NL_NONROOT_RECV)) 1176 return -EPERM; 1177 err = netlink_realloc_groups(sk); 1178 if (err) 1179 return err; 1180 if (!val || val - 1 >= nlk->ngroups) 1181 return -EINVAL; 1182 netlink_table_grab(); 1183 netlink_update_socket_mc(nlk, val, 1184 optname == NETLINK_ADD_MEMBERSHIP); 1185 netlink_table_ungrab(); 1186 err = 0; 1187 break; 1188 } 1189 case NETLINK_BROADCAST_ERROR: 1190 if (val) 1191 nlk->flags |= NETLINK_BROADCAST_SEND_ERROR; 1192 else 1193 nlk->flags &= ~NETLINK_BROADCAST_SEND_ERROR; 1194 err = 0; 1195 break; 1196 case NETLINK_NO_ENOBUFS: 1197 if (val) { 1198 nlk->flags |= NETLINK_RECV_NO_ENOBUFS; 1199 clear_bit(0, &nlk->state); 1200 wake_up_interruptible(&nlk->wait); 1201 } else 1202 nlk->flags &= ~NETLINK_RECV_NO_ENOBUFS; 1203 err = 0; 1204 break; 1205 default: 1206 err = -ENOPROTOOPT; 1207 } 1208 return err; 1209 } 1210 1211 static int netlink_getsockopt(struct socket *sock, int level, int optname, 1212 char __user *optval, int __user *optlen) 1213 { 1214 struct sock *sk = sock->sk; 1215 struct netlink_sock *nlk = nlk_sk(sk); 1216 int len, val, err; 1217 1218 if (level != SOL_NETLINK) 1219 return -ENOPROTOOPT; 1220 1221 if (get_user(len, optlen)) 1222 return -EFAULT; 1223 if (len < 0) 1224 return -EINVAL; 1225 1226 switch (optname) { 1227 case NETLINK_PKTINFO: 1228 if (len < sizeof(int)) 1229 return -EINVAL; 1230 len = sizeof(int); 1231 val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0; 1232 if (put_user(len, optlen) || 1233 put_user(val, optval)) 1234 return -EFAULT; 1235 err = 0; 1236 break; 1237 case NETLINK_BROADCAST_ERROR: 1238 if (len < sizeof(int)) 1239 return -EINVAL; 1240 len = sizeof(int); 1241 val = nlk->flags & NETLINK_BROADCAST_SEND_ERROR ? 1 : 0; 1242 if (put_user(len, optlen) || 1243 put_user(val, optval)) 1244 return -EFAULT; 1245 err = 0; 1246 break; 1247 case NETLINK_NO_ENOBUFS: 1248 if (len < sizeof(int)) 1249 return -EINVAL; 1250 len = sizeof(int); 1251 val = nlk->flags & NETLINK_RECV_NO_ENOBUFS ? 1 : 0; 1252 if (put_user(len, optlen) || 1253 put_user(val, optval)) 1254 return -EFAULT; 1255 err = 0; 1256 break; 1257 default: 1258 err = -ENOPROTOOPT; 1259 } 1260 return err; 1261 } 1262 1263 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) 1264 { 1265 struct nl_pktinfo info; 1266 1267 info.group = NETLINK_CB(skb).dst_group; 1268 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info); 1269 } 1270 1271 static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, 1272 struct msghdr *msg, size_t len) 1273 { 1274 struct sock_iocb *siocb = kiocb_to_siocb(kiocb); 1275 struct sock *sk = sock->sk; 1276 struct netlink_sock *nlk = nlk_sk(sk); 1277 struct sockaddr_nl *addr = msg->msg_name; 1278 u32 dst_pid; 1279 u32 dst_group; 1280 struct sk_buff *skb; 1281 int err; 1282 struct scm_cookie scm; 1283 1284 if (msg->msg_flags&MSG_OOB) 1285 return -EOPNOTSUPP; 1286 1287 if (NULL == siocb->scm) 1288 siocb->scm = &scm; 1289 err = scm_send(sock, msg, siocb->scm); 1290 if (err < 0) 1291 return err; 1292 1293 if (msg->msg_namelen) { 1294 if (addr->nl_family != AF_NETLINK) 1295 return -EINVAL; 1296 dst_pid = addr->nl_pid; 1297 dst_group = ffs(addr->nl_groups); 1298 if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND)) 1299 return -EPERM; 1300 } else { 1301 dst_pid = nlk->dst_pid; 1302 dst_group = nlk->dst_group; 1303 } 1304 1305 if (!nlk->pid) { 1306 err = netlink_autobind(sock); 1307 if (err) 1308 goto out; 1309 } 1310 1311 err = -EMSGSIZE; 1312 if (len > sk->sk_sndbuf - 32) 1313 goto out; 1314 err = -ENOBUFS; 1315 skb = alloc_skb(len, GFP_KERNEL); 1316 if (skb == NULL) 1317 goto out; 1318 1319 NETLINK_CB(skb).pid = nlk->pid; 1320 NETLINK_CB(skb).dst_group = dst_group; 1321 NETLINK_CB(skb).loginuid = audit_get_loginuid(current); 1322 NETLINK_CB(skb).sessionid = audit_get_sessionid(current); 1323 security_task_getsecid(current, &(NETLINK_CB(skb).sid)); 1324 memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); 1325 1326 /* What can I do? Netlink is asynchronous, so that 1327 we will have to save current capabilities to 1328 check them, when this message will be delivered 1329 to corresponding kernel module. --ANK (980802) 1330 */ 1331 1332 err = -EFAULT; 1333 if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { 1334 kfree_skb(skb); 1335 goto out; 1336 } 1337 1338 err = security_netlink_send(sk, skb); 1339 if (err) { 1340 kfree_skb(skb); 1341 goto out; 1342 } 1343 1344 if (dst_group) { 1345 atomic_inc(&skb->users); 1346 netlink_broadcast(sk, skb, dst_pid, dst_group, GFP_KERNEL); 1347 } 1348 err = netlink_unicast(sk, skb, dst_pid, msg->msg_flags&MSG_DONTWAIT); 1349 1350 out: 1351 return err; 1352 } 1353 1354 static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, 1355 struct msghdr *msg, size_t len, 1356 int flags) 1357 { 1358 struct sock_iocb *siocb = kiocb_to_siocb(kiocb); 1359 struct scm_cookie scm; 1360 struct sock *sk = sock->sk; 1361 struct netlink_sock *nlk = nlk_sk(sk); 1362 int noblock = flags&MSG_DONTWAIT; 1363 size_t copied; 1364 struct sk_buff *skb, *frag __maybe_unused = NULL; 1365 int err; 1366 1367 if (flags&MSG_OOB) 1368 return -EOPNOTSUPP; 1369 1370 copied = 0; 1371 1372 skb = skb_recv_datagram(sk, flags, noblock, &err); 1373 if (skb == NULL) 1374 goto out; 1375 1376 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES 1377 if (unlikely(skb_shinfo(skb)->frag_list)) { 1378 bool need_compat = !!(flags & MSG_CMSG_COMPAT); 1379 1380 /* 1381 * If this skb has a frag_list, then here that means that 1382 * we will have to use the frag_list skb for compat tasks 1383 * and the regular skb for non-compat tasks. 1384 * 1385 * The skb might (and likely will) be cloned, so we can't 1386 * just reset frag_list and go on with things -- we need to 1387 * keep that. For the compat case that's easy -- simply get 1388 * a reference to the compat skb and free the regular one 1389 * including the frag. For the non-compat case, we need to 1390 * avoid sending the frag to the user -- so assign NULL but 1391 * restore it below before freeing the skb. 1392 */ 1393 if (need_compat) { 1394 struct sk_buff *compskb = skb_shinfo(skb)->frag_list; 1395 skb_get(compskb); 1396 kfree_skb(skb); 1397 skb = compskb; 1398 } else { 1399 frag = skb_shinfo(skb)->frag_list; 1400 skb_shinfo(skb)->frag_list = NULL; 1401 } 1402 } 1403 #endif 1404 1405 msg->msg_namelen = 0; 1406 1407 copied = skb->len; 1408 if (len < copied) { 1409 msg->msg_flags |= MSG_TRUNC; 1410 copied = len; 1411 } 1412 1413 skb_reset_transport_header(skb); 1414 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 1415 1416 if (msg->msg_name) { 1417 struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name; 1418 addr->nl_family = AF_NETLINK; 1419 addr->nl_pad = 0; 1420 addr->nl_pid = NETLINK_CB(skb).pid; 1421 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group); 1422 msg->msg_namelen = sizeof(*addr); 1423 } 1424 1425 if (nlk->flags & NETLINK_RECV_PKTINFO) 1426 netlink_cmsg_recv_pktinfo(msg, skb); 1427 1428 if (NULL == siocb->scm) { 1429 memset(&scm, 0, sizeof(scm)); 1430 siocb->scm = &scm; 1431 } 1432 siocb->scm->creds = *NETLINK_CREDS(skb); 1433 if (flags & MSG_TRUNC) 1434 copied = skb->len; 1435 1436 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES 1437 skb_shinfo(skb)->frag_list = frag; 1438 #endif 1439 1440 skb_free_datagram(sk, skb); 1441 1442 if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) 1443 netlink_dump(sk); 1444 1445 scm_recv(sock, msg, siocb->scm, flags); 1446 out: 1447 netlink_rcv_wake(sk); 1448 return err ? : copied; 1449 } 1450 1451 static void netlink_data_ready(struct sock *sk, int len) 1452 { 1453 BUG(); 1454 } 1455 1456 /* 1457 * We export these functions to other modules. They provide a 1458 * complete set of kernel non-blocking support for message 1459 * queueing. 1460 */ 1461 1462 struct sock * 1463 netlink_kernel_create(struct net *net, int unit, unsigned int groups, 1464 void (*input)(struct sk_buff *skb), 1465 struct mutex *cb_mutex, struct module *module) 1466 { 1467 struct socket *sock; 1468 struct sock *sk; 1469 struct netlink_sock *nlk; 1470 unsigned long *listeners = NULL; 1471 1472 BUG_ON(!nl_table); 1473 1474 if (unit < 0 || unit >= MAX_LINKS) 1475 return NULL; 1476 1477 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock)) 1478 return NULL; 1479 1480 /* 1481 * We have to just have a reference on the net from sk, but don't 1482 * get_net it. Besides, we cannot get and then put the net here. 1483 * So we create one inside init_net and the move it to net. 1484 */ 1485 1486 if (__netlink_create(&init_net, sock, cb_mutex, unit) < 0) 1487 goto out_sock_release_nosk; 1488 1489 sk = sock->sk; 1490 sk_change_net(sk, net); 1491 1492 if (groups < 32) 1493 groups = 32; 1494 1495 listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head), 1496 GFP_KERNEL); 1497 if (!listeners) 1498 goto out_sock_release; 1499 1500 sk->sk_data_ready = netlink_data_ready; 1501 if (input) 1502 nlk_sk(sk)->netlink_rcv = input; 1503 1504 if (netlink_insert(sk, net, 0)) 1505 goto out_sock_release; 1506 1507 nlk = nlk_sk(sk); 1508 nlk->flags |= NETLINK_KERNEL_SOCKET; 1509 1510 netlink_table_grab(); 1511 if (!nl_table[unit].registered) { 1512 nl_table[unit].groups = groups; 1513 nl_table[unit].listeners = listeners; 1514 nl_table[unit].cb_mutex = cb_mutex; 1515 nl_table[unit].module = module; 1516 nl_table[unit].registered = 1; 1517 } else { 1518 kfree(listeners); 1519 nl_table[unit].registered++; 1520 } 1521 netlink_table_ungrab(); 1522 return sk; 1523 1524 out_sock_release: 1525 kfree(listeners); 1526 netlink_kernel_release(sk); 1527 return NULL; 1528 1529 out_sock_release_nosk: 1530 sock_release(sock); 1531 return NULL; 1532 } 1533 EXPORT_SYMBOL(netlink_kernel_create); 1534 1535 1536 void 1537 netlink_kernel_release(struct sock *sk) 1538 { 1539 sk_release_kernel(sk); 1540 } 1541 EXPORT_SYMBOL(netlink_kernel_release); 1542 1543 1544 static void netlink_free_old_listeners(struct rcu_head *rcu_head) 1545 { 1546 struct listeners_rcu_head *lrh; 1547 1548 lrh = container_of(rcu_head, struct listeners_rcu_head, rcu_head); 1549 kfree(lrh->ptr); 1550 } 1551 1552 /** 1553 * netlink_change_ngroups - change number of multicast groups 1554 * 1555 * This changes the number of multicast groups that are available 1556 * on a certain netlink family. Note that it is not possible to 1557 * change the number of groups to below 32. Also note that it does 1558 * not implicitly call netlink_clear_multicast_users() when the 1559 * number of groups is reduced. 1560 * 1561 * @sk: The kernel netlink socket, as returned by netlink_kernel_create(). 1562 * @groups: The new number of groups. 1563 */ 1564 int netlink_change_ngroups(struct sock *sk, unsigned int groups) 1565 { 1566 unsigned long *listeners, *old = NULL; 1567 struct listeners_rcu_head *old_rcu_head; 1568 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 1569 int err = 0; 1570 1571 if (groups < 32) 1572 groups = 32; 1573 1574 netlink_table_grab(); 1575 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) { 1576 listeners = kzalloc(NLGRPSZ(groups) + 1577 sizeof(struct listeners_rcu_head), 1578 GFP_ATOMIC); 1579 if (!listeners) { 1580 err = -ENOMEM; 1581 goto out_ungrab; 1582 } 1583 old = tbl->listeners; 1584 memcpy(listeners, old, NLGRPSZ(tbl->groups)); 1585 rcu_assign_pointer(tbl->listeners, listeners); 1586 /* 1587 * Free the old memory after an RCU grace period so we 1588 * don't leak it. We use call_rcu() here in order to be 1589 * able to call this function from atomic contexts. The 1590 * allocation of this memory will have reserved enough 1591 * space for struct listeners_rcu_head at the end. 1592 */ 1593 old_rcu_head = (void *)(tbl->listeners + 1594 NLGRPLONGS(tbl->groups)); 1595 old_rcu_head->ptr = old; 1596 call_rcu(&old_rcu_head->rcu_head, netlink_free_old_listeners); 1597 } 1598 tbl->groups = groups; 1599 1600 out_ungrab: 1601 netlink_table_ungrab(); 1602 return err; 1603 } 1604 1605 /** 1606 * netlink_clear_multicast_users - kick off multicast listeners 1607 * 1608 * This function removes all listeners from the given group. 1609 * @ksk: The kernel netlink socket, as returned by 1610 * netlink_kernel_create(). 1611 * @group: The multicast group to clear. 1612 */ 1613 void netlink_clear_multicast_users(struct sock *ksk, unsigned int group) 1614 { 1615 struct sock *sk; 1616 struct hlist_node *node; 1617 struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; 1618 1619 netlink_table_grab(); 1620 1621 sk_for_each_bound(sk, node, &tbl->mc_list) 1622 netlink_update_socket_mc(nlk_sk(sk), group, 0); 1623 1624 netlink_table_ungrab(); 1625 } 1626 1627 void netlink_set_nonroot(int protocol, unsigned int flags) 1628 { 1629 if ((unsigned int)protocol < MAX_LINKS) 1630 nl_table[protocol].nl_nonroot = flags; 1631 } 1632 EXPORT_SYMBOL(netlink_set_nonroot); 1633 1634 static void netlink_destroy_callback(struct netlink_callback *cb) 1635 { 1636 kfree_skb(cb->skb); 1637 kfree(cb); 1638 } 1639 1640 /* 1641 * It looks a bit ugly. 1642 * It would be better to create kernel thread. 1643 */ 1644 1645 static int netlink_dump(struct sock *sk) 1646 { 1647 struct netlink_sock *nlk = nlk_sk(sk); 1648 struct netlink_callback *cb; 1649 struct sk_buff *skb; 1650 struct nlmsghdr *nlh; 1651 int len, err = -ENOBUFS; 1652 1653 skb = sock_rmalloc(sk, NLMSG_GOODSIZE, 0, GFP_KERNEL); 1654 if (!skb) 1655 goto errout; 1656 1657 mutex_lock(nlk->cb_mutex); 1658 1659 cb = nlk->cb; 1660 if (cb == NULL) { 1661 err = -EINVAL; 1662 goto errout_skb; 1663 } 1664 1665 len = cb->dump(skb, cb); 1666 1667 if (len > 0) { 1668 mutex_unlock(nlk->cb_mutex); 1669 1670 if (sk_filter(sk, skb)) 1671 kfree_skb(skb); 1672 else { 1673 skb_queue_tail(&sk->sk_receive_queue, skb); 1674 sk->sk_data_ready(sk, skb->len); 1675 } 1676 return 0; 1677 } 1678 1679 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI); 1680 if (!nlh) 1681 goto errout_skb; 1682 1683 memcpy(nlmsg_data(nlh), &len, sizeof(len)); 1684 1685 if (sk_filter(sk, skb)) 1686 kfree_skb(skb); 1687 else { 1688 skb_queue_tail(&sk->sk_receive_queue, skb); 1689 sk->sk_data_ready(sk, skb->len); 1690 } 1691 1692 if (cb->done) 1693 cb->done(cb); 1694 nlk->cb = NULL; 1695 mutex_unlock(nlk->cb_mutex); 1696 1697 netlink_destroy_callback(cb); 1698 return 0; 1699 1700 errout_skb: 1701 mutex_unlock(nlk->cb_mutex); 1702 kfree_skb(skb); 1703 errout: 1704 return err; 1705 } 1706 1707 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb, 1708 const struct nlmsghdr *nlh, 1709 int (*dump)(struct sk_buff *skb, 1710 struct netlink_callback *), 1711 int (*done)(struct netlink_callback *)) 1712 { 1713 struct netlink_callback *cb; 1714 struct sock *sk; 1715 struct netlink_sock *nlk; 1716 1717 cb = kzalloc(sizeof(*cb), GFP_KERNEL); 1718 if (cb == NULL) 1719 return -ENOBUFS; 1720 1721 cb->dump = dump; 1722 cb->done = done; 1723 cb->nlh = nlh; 1724 atomic_inc(&skb->users); 1725 cb->skb = skb; 1726 1727 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).pid); 1728 if (sk == NULL) { 1729 netlink_destroy_callback(cb); 1730 return -ECONNREFUSED; 1731 } 1732 nlk = nlk_sk(sk); 1733 /* A dump is in progress... */ 1734 mutex_lock(nlk->cb_mutex); 1735 if (nlk->cb) { 1736 mutex_unlock(nlk->cb_mutex); 1737 netlink_destroy_callback(cb); 1738 sock_put(sk); 1739 return -EBUSY; 1740 } 1741 nlk->cb = cb; 1742 mutex_unlock(nlk->cb_mutex); 1743 1744 netlink_dump(sk); 1745 sock_put(sk); 1746 1747 /* We successfully started a dump, by returning -EINTR we 1748 * signal not to send ACK even if it was requested. 1749 */ 1750 return -EINTR; 1751 } 1752 EXPORT_SYMBOL(netlink_dump_start); 1753 1754 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err) 1755 { 1756 struct sk_buff *skb; 1757 struct nlmsghdr *rep; 1758 struct nlmsgerr *errmsg; 1759 size_t payload = sizeof(*errmsg); 1760 1761 /* error messages get the original request appened */ 1762 if (err) 1763 payload += nlmsg_len(nlh); 1764 1765 skb = nlmsg_new(payload, GFP_KERNEL); 1766 if (!skb) { 1767 struct sock *sk; 1768 1769 sk = netlink_lookup(sock_net(in_skb->sk), 1770 in_skb->sk->sk_protocol, 1771 NETLINK_CB(in_skb).pid); 1772 if (sk) { 1773 sk->sk_err = ENOBUFS; 1774 sk->sk_error_report(sk); 1775 sock_put(sk); 1776 } 1777 return; 1778 } 1779 1780 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, 1781 NLMSG_ERROR, sizeof(struct nlmsgerr), 0); 1782 errmsg = nlmsg_data(rep); 1783 errmsg->error = err; 1784 memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh)); 1785 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).pid, MSG_DONTWAIT); 1786 } 1787 EXPORT_SYMBOL(netlink_ack); 1788 1789 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *, 1790 struct nlmsghdr *)) 1791 { 1792 struct nlmsghdr *nlh; 1793 int err; 1794 1795 while (skb->len >= nlmsg_total_size(0)) { 1796 int msglen; 1797 1798 nlh = nlmsg_hdr(skb); 1799 err = 0; 1800 1801 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len) 1802 return 0; 1803 1804 /* Only requests are handled by the kernel */ 1805 if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) 1806 goto ack; 1807 1808 /* Skip control messages */ 1809 if (nlh->nlmsg_type < NLMSG_MIN_TYPE) 1810 goto ack; 1811 1812 err = cb(skb, nlh); 1813 if (err == -EINTR) 1814 goto skip; 1815 1816 ack: 1817 if (nlh->nlmsg_flags & NLM_F_ACK || err) 1818 netlink_ack(skb, nlh, err); 1819 1820 skip: 1821 msglen = NLMSG_ALIGN(nlh->nlmsg_len); 1822 if (msglen > skb->len) 1823 msglen = skb->len; 1824 skb_pull(skb, msglen); 1825 } 1826 1827 return 0; 1828 } 1829 EXPORT_SYMBOL(netlink_rcv_skb); 1830 1831 /** 1832 * nlmsg_notify - send a notification netlink message 1833 * @sk: netlink socket to use 1834 * @skb: notification message 1835 * @pid: destination netlink pid for reports or 0 1836 * @group: destination multicast group or 0 1837 * @report: 1 to report back, 0 to disable 1838 * @flags: allocation flags 1839 */ 1840 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 pid, 1841 unsigned int group, int report, gfp_t flags) 1842 { 1843 int err = 0; 1844 1845 if (group) { 1846 int exclude_pid = 0; 1847 1848 if (report) { 1849 atomic_inc(&skb->users); 1850 exclude_pid = pid; 1851 } 1852 1853 /* errors reported via destination sk->sk_err, but propagate 1854 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ 1855 err = nlmsg_multicast(sk, skb, exclude_pid, group, flags); 1856 } 1857 1858 if (report) { 1859 int err2; 1860 1861 err2 = nlmsg_unicast(sk, skb, pid); 1862 if (!err || err == -ESRCH) 1863 err = err2; 1864 } 1865 1866 return err; 1867 } 1868 EXPORT_SYMBOL(nlmsg_notify); 1869 1870 #ifdef CONFIG_PROC_FS 1871 struct nl_seq_iter { 1872 struct seq_net_private p; 1873 int link; 1874 int hash_idx; 1875 }; 1876 1877 static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos) 1878 { 1879 struct nl_seq_iter *iter = seq->private; 1880 int i, j; 1881 struct sock *s; 1882 struct hlist_node *node; 1883 loff_t off = 0; 1884 1885 for (i = 0; i < MAX_LINKS; i++) { 1886 struct nl_pid_hash *hash = &nl_table[i].hash; 1887 1888 for (j = 0; j <= hash->mask; j++) { 1889 sk_for_each(s, node, &hash->table[j]) { 1890 if (sock_net(s) != seq_file_net(seq)) 1891 continue; 1892 if (off == pos) { 1893 iter->link = i; 1894 iter->hash_idx = j; 1895 return s; 1896 } 1897 ++off; 1898 } 1899 } 1900 } 1901 return NULL; 1902 } 1903 1904 static void *netlink_seq_start(struct seq_file *seq, loff_t *pos) 1905 __acquires(nl_table_lock) 1906 { 1907 read_lock(&nl_table_lock); 1908 return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN; 1909 } 1910 1911 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1912 { 1913 struct sock *s; 1914 struct nl_seq_iter *iter; 1915 int i, j; 1916 1917 ++*pos; 1918 1919 if (v == SEQ_START_TOKEN) 1920 return netlink_seq_socket_idx(seq, 0); 1921 1922 iter = seq->private; 1923 s = v; 1924 do { 1925 s = sk_next(s); 1926 } while (s && sock_net(s) != seq_file_net(seq)); 1927 if (s) 1928 return s; 1929 1930 i = iter->link; 1931 j = iter->hash_idx + 1; 1932 1933 do { 1934 struct nl_pid_hash *hash = &nl_table[i].hash; 1935 1936 for (; j <= hash->mask; j++) { 1937 s = sk_head(&hash->table[j]); 1938 while (s && sock_net(s) != seq_file_net(seq)) 1939 s = sk_next(s); 1940 if (s) { 1941 iter->link = i; 1942 iter->hash_idx = j; 1943 return s; 1944 } 1945 } 1946 1947 j = 0; 1948 } while (++i < MAX_LINKS); 1949 1950 return NULL; 1951 } 1952 1953 static void netlink_seq_stop(struct seq_file *seq, void *v) 1954 __releases(nl_table_lock) 1955 { 1956 read_unlock(&nl_table_lock); 1957 } 1958 1959 1960 static int netlink_seq_show(struct seq_file *seq, void *v) 1961 { 1962 if (v == SEQ_START_TOKEN) 1963 seq_puts(seq, 1964 "sk Eth Pid Groups " 1965 "Rmem Wmem Dump Locks Drops\n"); 1966 else { 1967 struct sock *s = v; 1968 struct netlink_sock *nlk = nlk_sk(s); 1969 1970 seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n", 1971 s, 1972 s->sk_protocol, 1973 nlk->pid, 1974 nlk->groups ? (u32)nlk->groups[0] : 0, 1975 sk_rmem_alloc_get(s), 1976 sk_wmem_alloc_get(s), 1977 nlk->cb, 1978 atomic_read(&s->sk_refcnt), 1979 atomic_read(&s->sk_drops) 1980 ); 1981 1982 } 1983 return 0; 1984 } 1985 1986 static const struct seq_operations netlink_seq_ops = { 1987 .start = netlink_seq_start, 1988 .next = netlink_seq_next, 1989 .stop = netlink_seq_stop, 1990 .show = netlink_seq_show, 1991 }; 1992 1993 1994 static int netlink_seq_open(struct inode *inode, struct file *file) 1995 { 1996 return seq_open_net(inode, file, &netlink_seq_ops, 1997 sizeof(struct nl_seq_iter)); 1998 } 1999 2000 static const struct file_operations netlink_seq_fops = { 2001 .owner = THIS_MODULE, 2002 .open = netlink_seq_open, 2003 .read = seq_read, 2004 .llseek = seq_lseek, 2005 .release = seq_release_net, 2006 }; 2007 2008 #endif 2009 2010 int netlink_register_notifier(struct notifier_block *nb) 2011 { 2012 return atomic_notifier_chain_register(&netlink_chain, nb); 2013 } 2014 EXPORT_SYMBOL(netlink_register_notifier); 2015 2016 int netlink_unregister_notifier(struct notifier_block *nb) 2017 { 2018 return atomic_notifier_chain_unregister(&netlink_chain, nb); 2019 } 2020 EXPORT_SYMBOL(netlink_unregister_notifier); 2021 2022 static const struct proto_ops netlink_ops = { 2023 .family = PF_NETLINK, 2024 .owner = THIS_MODULE, 2025 .release = netlink_release, 2026 .bind = netlink_bind, 2027 .connect = netlink_connect, 2028 .socketpair = sock_no_socketpair, 2029 .accept = sock_no_accept, 2030 .getname = netlink_getname, 2031 .poll = datagram_poll, 2032 .ioctl = sock_no_ioctl, 2033 .listen = sock_no_listen, 2034 .shutdown = sock_no_shutdown, 2035 .setsockopt = netlink_setsockopt, 2036 .getsockopt = netlink_getsockopt, 2037 .sendmsg = netlink_sendmsg, 2038 .recvmsg = netlink_recvmsg, 2039 .mmap = sock_no_mmap, 2040 .sendpage = sock_no_sendpage, 2041 }; 2042 2043 static struct net_proto_family netlink_family_ops = { 2044 .family = PF_NETLINK, 2045 .create = netlink_create, 2046 .owner = THIS_MODULE, /* for consistency 8) */ 2047 }; 2048 2049 static int __net_init netlink_net_init(struct net *net) 2050 { 2051 #ifdef CONFIG_PROC_FS 2052 if (!proc_net_fops_create(net, "netlink", 0, &netlink_seq_fops)) 2053 return -ENOMEM; 2054 #endif 2055 return 0; 2056 } 2057 2058 static void __net_exit netlink_net_exit(struct net *net) 2059 { 2060 #ifdef CONFIG_PROC_FS 2061 proc_net_remove(net, "netlink"); 2062 #endif 2063 } 2064 2065 static struct pernet_operations __net_initdata netlink_net_ops = { 2066 .init = netlink_net_init, 2067 .exit = netlink_net_exit, 2068 }; 2069 2070 static int __init netlink_proto_init(void) 2071 { 2072 struct sk_buff *dummy_skb; 2073 int i; 2074 unsigned long limit; 2075 unsigned int order; 2076 int err = proto_register(&netlink_proto, 0); 2077 2078 if (err != 0) 2079 goto out; 2080 2081 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > sizeof(dummy_skb->cb)); 2082 2083 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL); 2084 if (!nl_table) 2085 goto panic; 2086 2087 if (num_physpages >= (128 * 1024)) 2088 limit = num_physpages >> (21 - PAGE_SHIFT); 2089 else 2090 limit = num_physpages >> (23 - PAGE_SHIFT); 2091 2092 order = get_bitmask_order(limit) - 1 + PAGE_SHIFT; 2093 limit = (1UL << order) / sizeof(struct hlist_head); 2094 order = get_bitmask_order(min(limit, (unsigned long)UINT_MAX)) - 1; 2095 2096 for (i = 0; i < MAX_LINKS; i++) { 2097 struct nl_pid_hash *hash = &nl_table[i].hash; 2098 2099 hash->table = nl_pid_hash_zalloc(1 * sizeof(*hash->table)); 2100 if (!hash->table) { 2101 while (i-- > 0) 2102 nl_pid_hash_free(nl_table[i].hash.table, 2103 1 * sizeof(*hash->table)); 2104 kfree(nl_table); 2105 goto panic; 2106 } 2107 hash->max_shift = order; 2108 hash->shift = 0; 2109 hash->mask = 0; 2110 hash->rehash_time = jiffies; 2111 } 2112 2113 sock_register(&netlink_family_ops); 2114 register_pernet_subsys(&netlink_net_ops); 2115 /* The netlink device handler may be needed early. */ 2116 rtnetlink_init(); 2117 out: 2118 return err; 2119 panic: 2120 panic("netlink_init: Cannot allocate nl_table\n"); 2121 } 2122 2123 core_initcall(netlink_proto_init); 2124