1 /* 2 * NETLINK Kernel-user communication protocol. 3 * 4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk> 5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 6 * Patrick McHardy <kaber@trash.net> 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License 10 * as published by the Free Software Foundation; either version 11 * 2 of the License, or (at your option) any later version. 12 * 13 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith 14 * added netlink_proto_exit 15 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br> 16 * use nlk_sk, as sk->protinfo is on a diet 8) 17 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org> 18 * - inc module use count of module that owns 19 * the kernel socket in case userspace opens 20 * socket of same protocol 21 * - remove all module support, since netlink is 22 * mandatory if CONFIG_NET=y these days 23 */ 24 25 #include <linux/module.h> 26 27 #include <linux/capability.h> 28 #include <linux/kernel.h> 29 #include <linux/init.h> 30 #include <linux/signal.h> 31 #include <linux/sched.h> 32 #include <linux/errno.h> 33 #include <linux/string.h> 34 #include <linux/stat.h> 35 #include <linux/socket.h> 36 #include <linux/un.h> 37 #include <linux/fcntl.h> 38 #include <linux/termios.h> 39 #include <linux/sockios.h> 40 #include <linux/net.h> 41 #include <linux/fs.h> 42 #include <linux/slab.h> 43 #include <linux/uaccess.h> 44 #include <linux/skbuff.h> 45 #include <linux/netdevice.h> 46 #include <linux/rtnetlink.h> 47 #include <linux/proc_fs.h> 48 #include <linux/seq_file.h> 49 #include <linux/notifier.h> 50 #include <linux/security.h> 51 #include <linux/jhash.h> 52 #include <linux/jiffies.h> 53 #include <linux/random.h> 54 #include <linux/bitops.h> 55 #include <linux/mm.h> 56 #include <linux/types.h> 57 #include <linux/audit.h> 58 #include <linux/mutex.h> 59 #include <linux/vmalloc.h> 60 #include <linux/if_arp.h> 61 #include <linux/rhashtable.h> 62 #include <asm/cacheflush.h> 63 #include <linux/hash.h> 64 #include <linux/genetlink.h> 65 66 #include <net/net_namespace.h> 67 #include <net/sock.h> 68 #include <net/scm.h> 69 #include <net/netlink.h> 70 71 #include "af_netlink.h" 72 73 struct listeners { 74 struct rcu_head rcu; 75 unsigned long masks[0]; 76 }; 77 78 /* state bits */ 79 #define NETLINK_S_CONGESTED 0x0 80 81 static inline int netlink_is_kernel(struct sock *sk) 82 { 83 return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET; 84 } 85 86 struct netlink_table *nl_table __read_mostly; 87 EXPORT_SYMBOL_GPL(nl_table); 88 89 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); 90 91 static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS]; 92 93 static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = { 94 "nlk_cb_mutex-ROUTE", 95 "nlk_cb_mutex-1", 96 "nlk_cb_mutex-USERSOCK", 97 "nlk_cb_mutex-FIREWALL", 98 "nlk_cb_mutex-SOCK_DIAG", 99 "nlk_cb_mutex-NFLOG", 100 "nlk_cb_mutex-XFRM", 101 "nlk_cb_mutex-SELINUX", 102 "nlk_cb_mutex-ISCSI", 103 "nlk_cb_mutex-AUDIT", 104 "nlk_cb_mutex-FIB_LOOKUP", 105 "nlk_cb_mutex-CONNECTOR", 106 "nlk_cb_mutex-NETFILTER", 107 "nlk_cb_mutex-IP6_FW", 108 "nlk_cb_mutex-DNRTMSG", 109 "nlk_cb_mutex-KOBJECT_UEVENT", 110 "nlk_cb_mutex-GENERIC", 111 "nlk_cb_mutex-17", 112 "nlk_cb_mutex-SCSITRANSPORT", 113 "nlk_cb_mutex-ECRYPTFS", 114 "nlk_cb_mutex-RDMA", 115 "nlk_cb_mutex-CRYPTO", 116 "nlk_cb_mutex-SMC", 117 "nlk_cb_mutex-23", 118 "nlk_cb_mutex-24", 119 "nlk_cb_mutex-25", 120 "nlk_cb_mutex-26", 121 "nlk_cb_mutex-27", 122 "nlk_cb_mutex-28", 123 "nlk_cb_mutex-29", 124 "nlk_cb_mutex-30", 125 "nlk_cb_mutex-31", 126 "nlk_cb_mutex-MAX_LINKS" 127 }; 128 129 static int netlink_dump(struct sock *sk); 130 static void netlink_skb_destructor(struct sk_buff *skb); 131 132 /* nl_table locking explained: 133 * Lookup and traversal are protected with an RCU read-side lock. Insertion 134 * and removal are protected with per bucket lock while using RCU list 135 * modification primitives and may run in parallel to RCU protected lookups. 136 * Destruction of the Netlink socket may only occur *after* nl_table_lock has 137 * been acquired * either during or after the socket has been removed from 138 * the list and after an RCU grace period. 139 */ 140 DEFINE_RWLOCK(nl_table_lock); 141 EXPORT_SYMBOL_GPL(nl_table_lock); 142 static atomic_t nl_table_users = ATOMIC_INIT(0); 143 144 #define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock)); 145 146 static BLOCKING_NOTIFIER_HEAD(netlink_chain); 147 148 static DEFINE_SPINLOCK(netlink_tap_lock); 149 static struct list_head netlink_tap_all __read_mostly; 150 151 static const struct rhashtable_params netlink_rhashtable_params; 152 153 static inline u32 netlink_group_mask(u32 group) 154 { 155 return group ? 1 << (group - 1) : 0; 156 } 157 158 static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, 159 gfp_t gfp_mask) 160 { 161 unsigned int len = skb_end_offset(skb); 162 struct sk_buff *new; 163 164 new = alloc_skb(len, gfp_mask); 165 if (new == NULL) 166 return NULL; 167 168 NETLINK_CB(new).portid = NETLINK_CB(skb).portid; 169 NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group; 170 NETLINK_CB(new).creds = NETLINK_CB(skb).creds; 171 172 memcpy(skb_put(new, len), skb->data, len); 173 return new; 174 } 175 176 int netlink_add_tap(struct netlink_tap *nt) 177 { 178 if (unlikely(nt->dev->type != ARPHRD_NETLINK)) 179 return -EINVAL; 180 181 spin_lock(&netlink_tap_lock); 182 list_add_rcu(&nt->list, &netlink_tap_all); 183 spin_unlock(&netlink_tap_lock); 184 185 __module_get(nt->module); 186 187 return 0; 188 } 189 EXPORT_SYMBOL_GPL(netlink_add_tap); 190 191 static int __netlink_remove_tap(struct netlink_tap *nt) 192 { 193 bool found = false; 194 struct netlink_tap *tmp; 195 196 spin_lock(&netlink_tap_lock); 197 198 list_for_each_entry(tmp, &netlink_tap_all, list) { 199 if (nt == tmp) { 200 list_del_rcu(&nt->list); 201 found = true; 202 goto out; 203 } 204 } 205 206 pr_warn("__netlink_remove_tap: %p not found\n", nt); 207 out: 208 spin_unlock(&netlink_tap_lock); 209 210 if (found) 211 module_put(nt->module); 212 213 return found ? 0 : -ENODEV; 214 } 215 216 int netlink_remove_tap(struct netlink_tap *nt) 217 { 218 int ret; 219 220 ret = __netlink_remove_tap(nt); 221 synchronize_net(); 222 223 return ret; 224 } 225 EXPORT_SYMBOL_GPL(netlink_remove_tap); 226 227 static bool netlink_filter_tap(const struct sk_buff *skb) 228 { 229 struct sock *sk = skb->sk; 230 231 /* We take the more conservative approach and 232 * whitelist socket protocols that may pass. 233 */ 234 switch (sk->sk_protocol) { 235 case NETLINK_ROUTE: 236 case NETLINK_USERSOCK: 237 case NETLINK_SOCK_DIAG: 238 case NETLINK_NFLOG: 239 case NETLINK_XFRM: 240 case NETLINK_FIB_LOOKUP: 241 case NETLINK_NETFILTER: 242 case NETLINK_GENERIC: 243 return true; 244 } 245 246 return false; 247 } 248 249 static int __netlink_deliver_tap_skb(struct sk_buff *skb, 250 struct net_device *dev) 251 { 252 struct sk_buff *nskb; 253 struct sock *sk = skb->sk; 254 int ret = -ENOMEM; 255 256 dev_hold(dev); 257 258 if (is_vmalloc_addr(skb->head)) 259 nskb = netlink_to_full_skb(skb, GFP_ATOMIC); 260 else 261 nskb = skb_clone(skb, GFP_ATOMIC); 262 if (nskb) { 263 nskb->dev = dev; 264 nskb->protocol = htons((u16) sk->sk_protocol); 265 nskb->pkt_type = netlink_is_kernel(sk) ? 266 PACKET_KERNEL : PACKET_USER; 267 skb_reset_network_header(nskb); 268 ret = dev_queue_xmit(nskb); 269 if (unlikely(ret > 0)) 270 ret = net_xmit_errno(ret); 271 } 272 273 dev_put(dev); 274 return ret; 275 } 276 277 static void __netlink_deliver_tap(struct sk_buff *skb) 278 { 279 int ret; 280 struct netlink_tap *tmp; 281 282 if (!netlink_filter_tap(skb)) 283 return; 284 285 list_for_each_entry_rcu(tmp, &netlink_tap_all, list) { 286 ret = __netlink_deliver_tap_skb(skb, tmp->dev); 287 if (unlikely(ret)) 288 break; 289 } 290 } 291 292 static void netlink_deliver_tap(struct sk_buff *skb) 293 { 294 rcu_read_lock(); 295 296 if (unlikely(!list_empty(&netlink_tap_all))) 297 __netlink_deliver_tap(skb); 298 299 rcu_read_unlock(); 300 } 301 302 static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src, 303 struct sk_buff *skb) 304 { 305 if (!(netlink_is_kernel(dst) && netlink_is_kernel(src))) 306 netlink_deliver_tap(skb); 307 } 308 309 static void netlink_overrun(struct sock *sk) 310 { 311 struct netlink_sock *nlk = nlk_sk(sk); 312 313 if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) { 314 if (!test_and_set_bit(NETLINK_S_CONGESTED, 315 &nlk_sk(sk)->state)) { 316 sk->sk_err = ENOBUFS; 317 sk->sk_error_report(sk); 318 } 319 } 320 atomic_inc(&sk->sk_drops); 321 } 322 323 static void netlink_rcv_wake(struct sock *sk) 324 { 325 struct netlink_sock *nlk = nlk_sk(sk); 326 327 if (skb_queue_empty(&sk->sk_receive_queue)) 328 clear_bit(NETLINK_S_CONGESTED, &nlk->state); 329 if (!test_bit(NETLINK_S_CONGESTED, &nlk->state)) 330 wake_up_interruptible(&nlk->wait); 331 } 332 333 static void netlink_skb_destructor(struct sk_buff *skb) 334 { 335 if (is_vmalloc_addr(skb->head)) { 336 if (!skb->cloned || 337 !atomic_dec_return(&(skb_shinfo(skb)->dataref))) 338 vfree(skb->head); 339 340 skb->head = NULL; 341 } 342 if (skb->sk != NULL) 343 sock_rfree(skb); 344 } 345 346 static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) 347 { 348 WARN_ON(skb->sk != NULL); 349 skb->sk = sk; 350 skb->destructor = netlink_skb_destructor; 351 atomic_add(skb->truesize, &sk->sk_rmem_alloc); 352 sk_mem_charge(sk, skb->truesize); 353 } 354 355 static void netlink_sock_destruct(struct sock *sk) 356 { 357 struct netlink_sock *nlk = nlk_sk(sk); 358 359 if (nlk->cb_running) { 360 if (nlk->cb.done) 361 nlk->cb.done(&nlk->cb); 362 module_put(nlk->cb.module); 363 kfree_skb(nlk->cb.skb); 364 } 365 366 skb_queue_purge(&sk->sk_receive_queue); 367 368 if (!sock_flag(sk, SOCK_DEAD)) { 369 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); 370 return; 371 } 372 373 WARN_ON(atomic_read(&sk->sk_rmem_alloc)); 374 WARN_ON(atomic_read(&sk->sk_wmem_alloc)); 375 WARN_ON(nlk_sk(sk)->groups); 376 } 377 378 static void netlink_sock_destruct_work(struct work_struct *work) 379 { 380 struct netlink_sock *nlk = container_of(work, struct netlink_sock, 381 work); 382 383 sk_free(&nlk->sk); 384 } 385 386 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on 387 * SMP. Look, when several writers sleep and reader wakes them up, all but one 388 * immediately hit write lock and grab all the cpus. Exclusive sleep solves 389 * this, _but_ remember, it adds useless work on UP machines. 390 */ 391 392 void netlink_table_grab(void) 393 __acquires(nl_table_lock) 394 { 395 might_sleep(); 396 397 write_lock_irq(&nl_table_lock); 398 399 if (atomic_read(&nl_table_users)) { 400 DECLARE_WAITQUEUE(wait, current); 401 402 add_wait_queue_exclusive(&nl_table_wait, &wait); 403 for (;;) { 404 set_current_state(TASK_UNINTERRUPTIBLE); 405 if (atomic_read(&nl_table_users) == 0) 406 break; 407 write_unlock_irq(&nl_table_lock); 408 schedule(); 409 write_lock_irq(&nl_table_lock); 410 } 411 412 __set_current_state(TASK_RUNNING); 413 remove_wait_queue(&nl_table_wait, &wait); 414 } 415 } 416 417 void netlink_table_ungrab(void) 418 __releases(nl_table_lock) 419 { 420 write_unlock_irq(&nl_table_lock); 421 wake_up(&nl_table_wait); 422 } 423 424 static inline void 425 netlink_lock_table(void) 426 { 427 /* read_lock() synchronizes us to netlink_table_grab */ 428 429 read_lock(&nl_table_lock); 430 atomic_inc(&nl_table_users); 431 read_unlock(&nl_table_lock); 432 } 433 434 static inline void 435 netlink_unlock_table(void) 436 { 437 if (atomic_dec_and_test(&nl_table_users)) 438 wake_up(&nl_table_wait); 439 } 440 441 struct netlink_compare_arg 442 { 443 possible_net_t pnet; 444 u32 portid; 445 }; 446 447 /* Doing sizeof directly may yield 4 extra bytes on 64-bit. */ 448 #define netlink_compare_arg_len \ 449 (offsetof(struct netlink_compare_arg, portid) + sizeof(u32)) 450 451 static inline int netlink_compare(struct rhashtable_compare_arg *arg, 452 const void *ptr) 453 { 454 const struct netlink_compare_arg *x = arg->key; 455 const struct netlink_sock *nlk = ptr; 456 457 return nlk->portid != x->portid || 458 !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet)); 459 } 460 461 static void netlink_compare_arg_init(struct netlink_compare_arg *arg, 462 struct net *net, u32 portid) 463 { 464 memset(arg, 0, sizeof(*arg)); 465 write_pnet(&arg->pnet, net); 466 arg->portid = portid; 467 } 468 469 static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid, 470 struct net *net) 471 { 472 struct netlink_compare_arg arg; 473 474 netlink_compare_arg_init(&arg, net, portid); 475 return rhashtable_lookup_fast(&table->hash, &arg, 476 netlink_rhashtable_params); 477 } 478 479 static int __netlink_insert(struct netlink_table *table, struct sock *sk) 480 { 481 struct netlink_compare_arg arg; 482 483 netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid); 484 return rhashtable_lookup_insert_key(&table->hash, &arg, 485 &nlk_sk(sk)->node, 486 netlink_rhashtable_params); 487 } 488 489 static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid) 490 { 491 struct netlink_table *table = &nl_table[protocol]; 492 struct sock *sk; 493 494 rcu_read_lock(); 495 sk = __netlink_lookup(table, portid, net); 496 if (sk) 497 sock_hold(sk); 498 rcu_read_unlock(); 499 500 return sk; 501 } 502 503 static const struct proto_ops netlink_ops; 504 505 static void 506 netlink_update_listeners(struct sock *sk) 507 { 508 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 509 unsigned long mask; 510 unsigned int i; 511 struct listeners *listeners; 512 513 listeners = nl_deref_protected(tbl->listeners); 514 if (!listeners) 515 return; 516 517 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) { 518 mask = 0; 519 sk_for_each_bound(sk, &tbl->mc_list) { 520 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups)) 521 mask |= nlk_sk(sk)->groups[i]; 522 } 523 listeners->masks[i] = mask; 524 } 525 /* this function is only called with the netlink table "grabbed", which 526 * makes sure updates are visible before bind or setsockopt return. */ 527 } 528 529 static int netlink_insert(struct sock *sk, u32 portid) 530 { 531 struct netlink_table *table = &nl_table[sk->sk_protocol]; 532 int err; 533 534 lock_sock(sk); 535 536 err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY; 537 if (nlk_sk(sk)->bound) 538 goto err; 539 540 err = -ENOMEM; 541 if (BITS_PER_LONG > 32 && 542 unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX)) 543 goto err; 544 545 nlk_sk(sk)->portid = portid; 546 sock_hold(sk); 547 548 err = __netlink_insert(table, sk); 549 if (err) { 550 /* In case the hashtable backend returns with -EBUSY 551 * from here, it must not escape to the caller. 552 */ 553 if (unlikely(err == -EBUSY)) 554 err = -EOVERFLOW; 555 if (err == -EEXIST) 556 err = -EADDRINUSE; 557 sock_put(sk); 558 goto err; 559 } 560 561 /* We need to ensure that the socket is hashed and visible. */ 562 smp_wmb(); 563 nlk_sk(sk)->bound = portid; 564 565 err: 566 release_sock(sk); 567 return err; 568 } 569 570 static void netlink_remove(struct sock *sk) 571 { 572 struct netlink_table *table; 573 574 table = &nl_table[sk->sk_protocol]; 575 if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node, 576 netlink_rhashtable_params)) { 577 WARN_ON(atomic_read(&sk->sk_refcnt) == 1); 578 __sock_put(sk); 579 } 580 581 netlink_table_grab(); 582 if (nlk_sk(sk)->subscriptions) { 583 __sk_del_bind_node(sk); 584 netlink_update_listeners(sk); 585 } 586 if (sk->sk_protocol == NETLINK_GENERIC) 587 atomic_inc(&genl_sk_destructing_cnt); 588 netlink_table_ungrab(); 589 } 590 591 static struct proto netlink_proto = { 592 .name = "NETLINK", 593 .owner = THIS_MODULE, 594 .obj_size = sizeof(struct netlink_sock), 595 }; 596 597 static int __netlink_create(struct net *net, struct socket *sock, 598 struct mutex *cb_mutex, int protocol, 599 int kern) 600 { 601 struct sock *sk; 602 struct netlink_sock *nlk; 603 604 sock->ops = &netlink_ops; 605 606 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern); 607 if (!sk) 608 return -ENOMEM; 609 610 sock_init_data(sock, sk); 611 612 nlk = nlk_sk(sk); 613 if (cb_mutex) { 614 nlk->cb_mutex = cb_mutex; 615 } else { 616 nlk->cb_mutex = &nlk->cb_def_mutex; 617 mutex_init(nlk->cb_mutex); 618 lockdep_set_class_and_name(nlk->cb_mutex, 619 nlk_cb_mutex_keys + protocol, 620 nlk_cb_mutex_key_strings[protocol]); 621 } 622 init_waitqueue_head(&nlk->wait); 623 624 sk->sk_destruct = netlink_sock_destruct; 625 sk->sk_protocol = protocol; 626 return 0; 627 } 628 629 static int netlink_create(struct net *net, struct socket *sock, int protocol, 630 int kern) 631 { 632 struct module *module = NULL; 633 struct mutex *cb_mutex; 634 struct netlink_sock *nlk; 635 int (*bind)(struct net *net, int group); 636 void (*unbind)(struct net *net, int group); 637 int err = 0; 638 639 sock->state = SS_UNCONNECTED; 640 641 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) 642 return -ESOCKTNOSUPPORT; 643 644 if (protocol < 0 || protocol >= MAX_LINKS) 645 return -EPROTONOSUPPORT; 646 647 netlink_lock_table(); 648 #ifdef CONFIG_MODULES 649 if (!nl_table[protocol].registered) { 650 netlink_unlock_table(); 651 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol); 652 netlink_lock_table(); 653 } 654 #endif 655 if (nl_table[protocol].registered && 656 try_module_get(nl_table[protocol].module)) 657 module = nl_table[protocol].module; 658 else 659 err = -EPROTONOSUPPORT; 660 cb_mutex = nl_table[protocol].cb_mutex; 661 bind = nl_table[protocol].bind; 662 unbind = nl_table[protocol].unbind; 663 netlink_unlock_table(); 664 665 if (err < 0) 666 goto out; 667 668 err = __netlink_create(net, sock, cb_mutex, protocol, kern); 669 if (err < 0) 670 goto out_module; 671 672 local_bh_disable(); 673 sock_prot_inuse_add(net, &netlink_proto, 1); 674 local_bh_enable(); 675 676 nlk = nlk_sk(sock->sk); 677 nlk->module = module; 678 nlk->netlink_bind = bind; 679 nlk->netlink_unbind = unbind; 680 out: 681 return err; 682 683 out_module: 684 module_put(module); 685 goto out; 686 } 687 688 static void deferred_put_nlk_sk(struct rcu_head *head) 689 { 690 struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu); 691 struct sock *sk = &nlk->sk; 692 693 if (!atomic_dec_and_test(&sk->sk_refcnt)) 694 return; 695 696 if (nlk->cb_running && nlk->cb.done) { 697 INIT_WORK(&nlk->work, netlink_sock_destruct_work); 698 schedule_work(&nlk->work); 699 return; 700 } 701 702 sk_free(sk); 703 } 704 705 static int netlink_release(struct socket *sock) 706 { 707 struct sock *sk = sock->sk; 708 struct netlink_sock *nlk; 709 710 if (!sk) 711 return 0; 712 713 netlink_remove(sk); 714 sock_orphan(sk); 715 nlk = nlk_sk(sk); 716 717 /* 718 * OK. Socket is unlinked, any packets that arrive now 719 * will be purged. 720 */ 721 722 /* must not acquire netlink_table_lock in any way again before unbind 723 * and notifying genetlink is done as otherwise it might deadlock 724 */ 725 if (nlk->netlink_unbind) { 726 int i; 727 728 for (i = 0; i < nlk->ngroups; i++) 729 if (test_bit(i, nlk->groups)) 730 nlk->netlink_unbind(sock_net(sk), i + 1); 731 } 732 if (sk->sk_protocol == NETLINK_GENERIC && 733 atomic_dec_return(&genl_sk_destructing_cnt) == 0) 734 wake_up(&genl_sk_destructing_waitq); 735 736 sock->sk = NULL; 737 wake_up_interruptible_all(&nlk->wait); 738 739 skb_queue_purge(&sk->sk_write_queue); 740 741 if (nlk->portid && nlk->bound) { 742 struct netlink_notify n = { 743 .net = sock_net(sk), 744 .protocol = sk->sk_protocol, 745 .portid = nlk->portid, 746 }; 747 blocking_notifier_call_chain(&netlink_chain, 748 NETLINK_URELEASE, &n); 749 } 750 751 module_put(nlk->module); 752 753 if (netlink_is_kernel(sk)) { 754 netlink_table_grab(); 755 BUG_ON(nl_table[sk->sk_protocol].registered == 0); 756 if (--nl_table[sk->sk_protocol].registered == 0) { 757 struct listeners *old; 758 759 old = nl_deref_protected(nl_table[sk->sk_protocol].listeners); 760 RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL); 761 kfree_rcu(old, rcu); 762 nl_table[sk->sk_protocol].module = NULL; 763 nl_table[sk->sk_protocol].bind = NULL; 764 nl_table[sk->sk_protocol].unbind = NULL; 765 nl_table[sk->sk_protocol].flags = 0; 766 nl_table[sk->sk_protocol].registered = 0; 767 } 768 netlink_table_ungrab(); 769 } 770 771 kfree(nlk->groups); 772 nlk->groups = NULL; 773 774 local_bh_disable(); 775 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1); 776 local_bh_enable(); 777 call_rcu(&nlk->rcu, deferred_put_nlk_sk); 778 return 0; 779 } 780 781 static int netlink_autobind(struct socket *sock) 782 { 783 struct sock *sk = sock->sk; 784 struct net *net = sock_net(sk); 785 struct netlink_table *table = &nl_table[sk->sk_protocol]; 786 s32 portid = task_tgid_vnr(current); 787 int err; 788 s32 rover = -4096; 789 bool ok; 790 791 retry: 792 cond_resched(); 793 rcu_read_lock(); 794 ok = !__netlink_lookup(table, portid, net); 795 rcu_read_unlock(); 796 if (!ok) { 797 /* Bind collision, search negative portid values. */ 798 if (rover == -4096) 799 /* rover will be in range [S32_MIN, -4097] */ 800 rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN); 801 else if (rover >= -4096) 802 rover = -4097; 803 portid = rover--; 804 goto retry; 805 } 806 807 err = netlink_insert(sk, portid); 808 if (err == -EADDRINUSE) 809 goto retry; 810 811 /* If 2 threads race to autobind, that is fine. */ 812 if (err == -EBUSY) 813 err = 0; 814 815 return err; 816 } 817 818 /** 819 * __netlink_ns_capable - General netlink message capability test 820 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. 821 * @user_ns: The user namespace of the capability to use 822 * @cap: The capability to use 823 * 824 * Test to see if the opener of the socket we received the message 825 * from had when the netlink socket was created and the sender of the 826 * message has has the capability @cap in the user namespace @user_ns. 827 */ 828 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, 829 struct user_namespace *user_ns, int cap) 830 { 831 return ((nsp->flags & NETLINK_SKB_DST) || 832 file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && 833 ns_capable(user_ns, cap); 834 } 835 EXPORT_SYMBOL(__netlink_ns_capable); 836 837 /** 838 * netlink_ns_capable - General netlink message capability test 839 * @skb: socket buffer holding a netlink command from userspace 840 * @user_ns: The user namespace of the capability to use 841 * @cap: The capability to use 842 * 843 * Test to see if the opener of the socket we received the message 844 * from had when the netlink socket was created and the sender of the 845 * message has has the capability @cap in the user namespace @user_ns. 846 */ 847 bool netlink_ns_capable(const struct sk_buff *skb, 848 struct user_namespace *user_ns, int cap) 849 { 850 return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); 851 } 852 EXPORT_SYMBOL(netlink_ns_capable); 853 854 /** 855 * netlink_capable - Netlink global message capability test 856 * @skb: socket buffer holding a netlink command from userspace 857 * @cap: The capability to use 858 * 859 * Test to see if the opener of the socket we received the message 860 * from had when the netlink socket was created and the sender of the 861 * message has has the capability @cap in all user namespaces. 862 */ 863 bool netlink_capable(const struct sk_buff *skb, int cap) 864 { 865 return netlink_ns_capable(skb, &init_user_ns, cap); 866 } 867 EXPORT_SYMBOL(netlink_capable); 868 869 /** 870 * netlink_net_capable - Netlink network namespace message capability test 871 * @skb: socket buffer holding a netlink command from userspace 872 * @cap: The capability to use 873 * 874 * Test to see if the opener of the socket we received the message 875 * from had when the netlink socket was created and the sender of the 876 * message has has the capability @cap over the network namespace of 877 * the socket we received the message from. 878 */ 879 bool netlink_net_capable(const struct sk_buff *skb, int cap) 880 { 881 return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); 882 } 883 EXPORT_SYMBOL(netlink_net_capable); 884 885 static inline int netlink_allowed(const struct socket *sock, unsigned int flag) 886 { 887 return (nl_table[sock->sk->sk_protocol].flags & flag) || 888 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); 889 } 890 891 static void 892 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions) 893 { 894 struct netlink_sock *nlk = nlk_sk(sk); 895 896 if (nlk->subscriptions && !subscriptions) 897 __sk_del_bind_node(sk); 898 else if (!nlk->subscriptions && subscriptions) 899 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list); 900 nlk->subscriptions = subscriptions; 901 } 902 903 static int netlink_realloc_groups(struct sock *sk) 904 { 905 struct netlink_sock *nlk = nlk_sk(sk); 906 unsigned int groups; 907 unsigned long *new_groups; 908 int err = 0; 909 910 netlink_table_grab(); 911 912 groups = nl_table[sk->sk_protocol].groups; 913 if (!nl_table[sk->sk_protocol].registered) { 914 err = -ENOENT; 915 goto out_unlock; 916 } 917 918 if (nlk->ngroups >= groups) 919 goto out_unlock; 920 921 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC); 922 if (new_groups == NULL) { 923 err = -ENOMEM; 924 goto out_unlock; 925 } 926 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0, 927 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups)); 928 929 nlk->groups = new_groups; 930 nlk->ngroups = groups; 931 out_unlock: 932 netlink_table_ungrab(); 933 return err; 934 } 935 936 static void netlink_undo_bind(int group, long unsigned int groups, 937 struct sock *sk) 938 { 939 struct netlink_sock *nlk = nlk_sk(sk); 940 int undo; 941 942 if (!nlk->netlink_unbind) 943 return; 944 945 for (undo = 0; undo < group; undo++) 946 if (test_bit(undo, &groups)) 947 nlk->netlink_unbind(sock_net(sk), undo + 1); 948 } 949 950 static int netlink_bind(struct socket *sock, struct sockaddr *addr, 951 int addr_len) 952 { 953 struct sock *sk = sock->sk; 954 struct net *net = sock_net(sk); 955 struct netlink_sock *nlk = nlk_sk(sk); 956 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 957 int err; 958 long unsigned int groups = nladdr->nl_groups; 959 bool bound; 960 961 if (addr_len < sizeof(struct sockaddr_nl)) 962 return -EINVAL; 963 964 if (nladdr->nl_family != AF_NETLINK) 965 return -EINVAL; 966 967 /* Only superuser is allowed to listen multicasts */ 968 if (groups) { 969 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) 970 return -EPERM; 971 err = netlink_realloc_groups(sk); 972 if (err) 973 return err; 974 } 975 976 bound = nlk->bound; 977 if (bound) { 978 /* Ensure nlk->portid is up-to-date. */ 979 smp_rmb(); 980 981 if (nladdr->nl_pid != nlk->portid) 982 return -EINVAL; 983 } 984 985 if (nlk->netlink_bind && groups) { 986 int group; 987 988 for (group = 0; group < nlk->ngroups; group++) { 989 if (!test_bit(group, &groups)) 990 continue; 991 err = nlk->netlink_bind(net, group + 1); 992 if (!err) 993 continue; 994 netlink_undo_bind(group, groups, sk); 995 return err; 996 } 997 } 998 999 /* No need for barriers here as we return to user-space without 1000 * using any of the bound attributes. 1001 */ 1002 if (!bound) { 1003 err = nladdr->nl_pid ? 1004 netlink_insert(sk, nladdr->nl_pid) : 1005 netlink_autobind(sock); 1006 if (err) { 1007 netlink_undo_bind(nlk->ngroups, groups, sk); 1008 return err; 1009 } 1010 } 1011 1012 if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0])) 1013 return 0; 1014 1015 netlink_table_grab(); 1016 netlink_update_subscriptions(sk, nlk->subscriptions + 1017 hweight32(groups) - 1018 hweight32(nlk->groups[0])); 1019 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups; 1020 netlink_update_listeners(sk); 1021 netlink_table_ungrab(); 1022 1023 return 0; 1024 } 1025 1026 static int netlink_connect(struct socket *sock, struct sockaddr *addr, 1027 int alen, int flags) 1028 { 1029 int err = 0; 1030 struct sock *sk = sock->sk; 1031 struct netlink_sock *nlk = nlk_sk(sk); 1032 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 1033 1034 if (alen < sizeof(addr->sa_family)) 1035 return -EINVAL; 1036 1037 if (addr->sa_family == AF_UNSPEC) { 1038 sk->sk_state = NETLINK_UNCONNECTED; 1039 nlk->dst_portid = 0; 1040 nlk->dst_group = 0; 1041 return 0; 1042 } 1043 if (addr->sa_family != AF_NETLINK) 1044 return -EINVAL; 1045 1046 if ((nladdr->nl_groups || nladdr->nl_pid) && 1047 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) 1048 return -EPERM; 1049 1050 /* No need for barriers here as we return to user-space without 1051 * using any of the bound attributes. 1052 */ 1053 if (!nlk->bound) 1054 err = netlink_autobind(sock); 1055 1056 if (err == 0) { 1057 sk->sk_state = NETLINK_CONNECTED; 1058 nlk->dst_portid = nladdr->nl_pid; 1059 nlk->dst_group = ffs(nladdr->nl_groups); 1060 } 1061 1062 return err; 1063 } 1064 1065 static int netlink_getname(struct socket *sock, struct sockaddr *addr, 1066 int *addr_len, int peer) 1067 { 1068 struct sock *sk = sock->sk; 1069 struct netlink_sock *nlk = nlk_sk(sk); 1070 DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr); 1071 1072 nladdr->nl_family = AF_NETLINK; 1073 nladdr->nl_pad = 0; 1074 *addr_len = sizeof(*nladdr); 1075 1076 if (peer) { 1077 nladdr->nl_pid = nlk->dst_portid; 1078 nladdr->nl_groups = netlink_group_mask(nlk->dst_group); 1079 } else { 1080 nladdr->nl_pid = nlk->portid; 1081 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0; 1082 } 1083 return 0; 1084 } 1085 1086 static int netlink_ioctl(struct socket *sock, unsigned int cmd, 1087 unsigned long arg) 1088 { 1089 /* try to hand this ioctl down to the NIC drivers. 1090 */ 1091 return -ENOIOCTLCMD; 1092 } 1093 1094 static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid) 1095 { 1096 struct sock *sock; 1097 struct netlink_sock *nlk; 1098 1099 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid); 1100 if (!sock) 1101 return ERR_PTR(-ECONNREFUSED); 1102 1103 /* Don't bother queuing skb if kernel socket has no input function */ 1104 nlk = nlk_sk(sock); 1105 if (sock->sk_state == NETLINK_CONNECTED && 1106 nlk->dst_portid != nlk_sk(ssk)->portid) { 1107 sock_put(sock); 1108 return ERR_PTR(-ECONNREFUSED); 1109 } 1110 return sock; 1111 } 1112 1113 struct sock *netlink_getsockbyfilp(struct file *filp) 1114 { 1115 struct inode *inode = file_inode(filp); 1116 struct sock *sock; 1117 1118 if (!S_ISSOCK(inode->i_mode)) 1119 return ERR_PTR(-ENOTSOCK); 1120 1121 sock = SOCKET_I(inode)->sk; 1122 if (sock->sk_family != AF_NETLINK) 1123 return ERR_PTR(-EINVAL); 1124 1125 sock_hold(sock); 1126 return sock; 1127 } 1128 1129 static struct sk_buff *netlink_alloc_large_skb(unsigned int size, 1130 int broadcast) 1131 { 1132 struct sk_buff *skb; 1133 void *data; 1134 1135 if (size <= NLMSG_GOODSIZE || broadcast) 1136 return alloc_skb(size, GFP_KERNEL); 1137 1138 size = SKB_DATA_ALIGN(size) + 1139 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); 1140 1141 data = vmalloc(size); 1142 if (data == NULL) 1143 return NULL; 1144 1145 skb = __build_skb(data, size); 1146 if (skb == NULL) 1147 vfree(data); 1148 else 1149 skb->destructor = netlink_skb_destructor; 1150 1151 return skb; 1152 } 1153 1154 /* 1155 * Attach a skb to a netlink socket. 1156 * The caller must hold a reference to the destination socket. On error, the 1157 * reference is dropped. The skb is not send to the destination, just all 1158 * all error checks are performed and memory in the queue is reserved. 1159 * Return values: 1160 * < 0: error. skb freed, reference to sock dropped. 1161 * 0: continue 1162 * 1: repeat lookup - reference dropped while waiting for socket memory. 1163 */ 1164 int netlink_attachskb(struct sock *sk, struct sk_buff *skb, 1165 long *timeo, struct sock *ssk) 1166 { 1167 struct netlink_sock *nlk; 1168 1169 nlk = nlk_sk(sk); 1170 1171 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 1172 test_bit(NETLINK_S_CONGESTED, &nlk->state))) { 1173 DECLARE_WAITQUEUE(wait, current); 1174 if (!*timeo) { 1175 if (!ssk || netlink_is_kernel(ssk)) 1176 netlink_overrun(sk); 1177 sock_put(sk); 1178 kfree_skb(skb); 1179 return -EAGAIN; 1180 } 1181 1182 __set_current_state(TASK_INTERRUPTIBLE); 1183 add_wait_queue(&nlk->wait, &wait); 1184 1185 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 1186 test_bit(NETLINK_S_CONGESTED, &nlk->state)) && 1187 !sock_flag(sk, SOCK_DEAD)) 1188 *timeo = schedule_timeout(*timeo); 1189 1190 __set_current_state(TASK_RUNNING); 1191 remove_wait_queue(&nlk->wait, &wait); 1192 sock_put(sk); 1193 1194 if (signal_pending(current)) { 1195 kfree_skb(skb); 1196 return sock_intr_errno(*timeo); 1197 } 1198 return 1; 1199 } 1200 netlink_skb_set_owner_r(skb, sk); 1201 return 0; 1202 } 1203 1204 static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) 1205 { 1206 int len = skb->len; 1207 1208 netlink_deliver_tap(skb); 1209 1210 skb_queue_tail(&sk->sk_receive_queue, skb); 1211 sk->sk_data_ready(sk); 1212 return len; 1213 } 1214 1215 int netlink_sendskb(struct sock *sk, struct sk_buff *skb) 1216 { 1217 int len = __netlink_sendskb(sk, skb); 1218 1219 sock_put(sk); 1220 return len; 1221 } 1222 1223 void netlink_detachskb(struct sock *sk, struct sk_buff *skb) 1224 { 1225 kfree_skb(skb); 1226 sock_put(sk); 1227 } 1228 1229 static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation) 1230 { 1231 int delta; 1232 1233 WARN_ON(skb->sk != NULL); 1234 delta = skb->end - skb->tail; 1235 if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize) 1236 return skb; 1237 1238 if (skb_shared(skb)) { 1239 struct sk_buff *nskb = skb_clone(skb, allocation); 1240 if (!nskb) 1241 return skb; 1242 consume_skb(skb); 1243 skb = nskb; 1244 } 1245 1246 pskb_expand_head(skb, 0, -delta, 1247 (allocation & ~__GFP_DIRECT_RECLAIM) | 1248 __GFP_NOWARN | __GFP_NORETRY); 1249 return skb; 1250 } 1251 1252 static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb, 1253 struct sock *ssk) 1254 { 1255 int ret; 1256 struct netlink_sock *nlk = nlk_sk(sk); 1257 1258 ret = -ECONNREFUSED; 1259 if (nlk->netlink_rcv != NULL) { 1260 ret = skb->len; 1261 netlink_skb_set_owner_r(skb, sk); 1262 NETLINK_CB(skb).sk = ssk; 1263 netlink_deliver_tap_kernel(sk, ssk, skb); 1264 nlk->netlink_rcv(skb); 1265 consume_skb(skb); 1266 } else { 1267 kfree_skb(skb); 1268 } 1269 sock_put(sk); 1270 return ret; 1271 } 1272 1273 int netlink_unicast(struct sock *ssk, struct sk_buff *skb, 1274 u32 portid, int nonblock) 1275 { 1276 struct sock *sk; 1277 int err; 1278 long timeo; 1279 1280 skb = netlink_trim(skb, gfp_any()); 1281 1282 timeo = sock_sndtimeo(ssk, nonblock); 1283 retry: 1284 sk = netlink_getsockbyportid(ssk, portid); 1285 if (IS_ERR(sk)) { 1286 kfree_skb(skb); 1287 return PTR_ERR(sk); 1288 } 1289 if (netlink_is_kernel(sk)) 1290 return netlink_unicast_kernel(sk, skb, ssk); 1291 1292 if (sk_filter(sk, skb)) { 1293 err = skb->len; 1294 kfree_skb(skb); 1295 sock_put(sk); 1296 return err; 1297 } 1298 1299 err = netlink_attachskb(sk, skb, &timeo, ssk); 1300 if (err == 1) 1301 goto retry; 1302 if (err) 1303 return err; 1304 1305 return netlink_sendskb(sk, skb); 1306 } 1307 EXPORT_SYMBOL(netlink_unicast); 1308 1309 int netlink_has_listeners(struct sock *sk, unsigned int group) 1310 { 1311 int res = 0; 1312 struct listeners *listeners; 1313 1314 BUG_ON(!netlink_is_kernel(sk)); 1315 1316 rcu_read_lock(); 1317 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners); 1318 1319 if (listeners && group - 1 < nl_table[sk->sk_protocol].groups) 1320 res = test_bit(group - 1, listeners->masks); 1321 1322 rcu_read_unlock(); 1323 1324 return res; 1325 } 1326 EXPORT_SYMBOL_GPL(netlink_has_listeners); 1327 1328 static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb) 1329 { 1330 struct netlink_sock *nlk = nlk_sk(sk); 1331 1332 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && 1333 !test_bit(NETLINK_S_CONGESTED, &nlk->state)) { 1334 netlink_skb_set_owner_r(skb, sk); 1335 __netlink_sendskb(sk, skb); 1336 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1); 1337 } 1338 return -1; 1339 } 1340 1341 struct netlink_broadcast_data { 1342 struct sock *exclude_sk; 1343 struct net *net; 1344 u32 portid; 1345 u32 group; 1346 int failure; 1347 int delivery_failure; 1348 int congested; 1349 int delivered; 1350 gfp_t allocation; 1351 struct sk_buff *skb, *skb2; 1352 int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data); 1353 void *tx_data; 1354 }; 1355 1356 static void do_one_broadcast(struct sock *sk, 1357 struct netlink_broadcast_data *p) 1358 { 1359 struct netlink_sock *nlk = nlk_sk(sk); 1360 int val; 1361 1362 if (p->exclude_sk == sk) 1363 return; 1364 1365 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups || 1366 !test_bit(p->group - 1, nlk->groups)) 1367 return; 1368 1369 if (!net_eq(sock_net(sk), p->net)) { 1370 if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID)) 1371 return; 1372 1373 if (!peernet_has_id(sock_net(sk), p->net)) 1374 return; 1375 1376 if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns, 1377 CAP_NET_BROADCAST)) 1378 return; 1379 } 1380 1381 if (p->failure) { 1382 netlink_overrun(sk); 1383 return; 1384 } 1385 1386 sock_hold(sk); 1387 if (p->skb2 == NULL) { 1388 if (skb_shared(p->skb)) { 1389 p->skb2 = skb_clone(p->skb, p->allocation); 1390 } else { 1391 p->skb2 = skb_get(p->skb); 1392 /* 1393 * skb ownership may have been set when 1394 * delivered to a previous socket. 1395 */ 1396 skb_orphan(p->skb2); 1397 } 1398 } 1399 if (p->skb2 == NULL) { 1400 netlink_overrun(sk); 1401 /* Clone failed. Notify ALL listeners. */ 1402 p->failure = 1; 1403 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR) 1404 p->delivery_failure = 1; 1405 goto out; 1406 } 1407 if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) { 1408 kfree_skb(p->skb2); 1409 p->skb2 = NULL; 1410 goto out; 1411 } 1412 if (sk_filter(sk, p->skb2)) { 1413 kfree_skb(p->skb2); 1414 p->skb2 = NULL; 1415 goto out; 1416 } 1417 NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net); 1418 NETLINK_CB(p->skb2).nsid_is_set = true; 1419 val = netlink_broadcast_deliver(sk, p->skb2); 1420 if (val < 0) { 1421 netlink_overrun(sk); 1422 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR) 1423 p->delivery_failure = 1; 1424 } else { 1425 p->congested |= val; 1426 p->delivered = 1; 1427 p->skb2 = NULL; 1428 } 1429 out: 1430 sock_put(sk); 1431 } 1432 1433 int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid, 1434 u32 group, gfp_t allocation, 1435 int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data), 1436 void *filter_data) 1437 { 1438 struct net *net = sock_net(ssk); 1439 struct netlink_broadcast_data info; 1440 struct sock *sk; 1441 1442 skb = netlink_trim(skb, allocation); 1443 1444 info.exclude_sk = ssk; 1445 info.net = net; 1446 info.portid = portid; 1447 info.group = group; 1448 info.failure = 0; 1449 info.delivery_failure = 0; 1450 info.congested = 0; 1451 info.delivered = 0; 1452 info.allocation = allocation; 1453 info.skb = skb; 1454 info.skb2 = NULL; 1455 info.tx_filter = filter; 1456 info.tx_data = filter_data; 1457 1458 /* While we sleep in clone, do not allow to change socket list */ 1459 1460 netlink_lock_table(); 1461 1462 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) 1463 do_one_broadcast(sk, &info); 1464 1465 consume_skb(skb); 1466 1467 netlink_unlock_table(); 1468 1469 if (info.delivery_failure) { 1470 kfree_skb(info.skb2); 1471 return -ENOBUFS; 1472 } 1473 consume_skb(info.skb2); 1474 1475 if (info.delivered) { 1476 if (info.congested && gfpflags_allow_blocking(allocation)) 1477 yield(); 1478 return 0; 1479 } 1480 return -ESRCH; 1481 } 1482 EXPORT_SYMBOL(netlink_broadcast_filtered); 1483 1484 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid, 1485 u32 group, gfp_t allocation) 1486 { 1487 return netlink_broadcast_filtered(ssk, skb, portid, group, allocation, 1488 NULL, NULL); 1489 } 1490 EXPORT_SYMBOL(netlink_broadcast); 1491 1492 struct netlink_set_err_data { 1493 struct sock *exclude_sk; 1494 u32 portid; 1495 u32 group; 1496 int code; 1497 }; 1498 1499 static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p) 1500 { 1501 struct netlink_sock *nlk = nlk_sk(sk); 1502 int ret = 0; 1503 1504 if (sk == p->exclude_sk) 1505 goto out; 1506 1507 if (!net_eq(sock_net(sk), sock_net(p->exclude_sk))) 1508 goto out; 1509 1510 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups || 1511 !test_bit(p->group - 1, nlk->groups)) 1512 goto out; 1513 1514 if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) { 1515 ret = 1; 1516 goto out; 1517 } 1518 1519 sk->sk_err = p->code; 1520 sk->sk_error_report(sk); 1521 out: 1522 return ret; 1523 } 1524 1525 /** 1526 * netlink_set_err - report error to broadcast listeners 1527 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create() 1528 * @portid: the PORTID of a process that we want to skip (if any) 1529 * @group: the broadcast group that will notice the error 1530 * @code: error code, must be negative (as usual in kernelspace) 1531 * 1532 * This function returns the number of broadcast listeners that have set the 1533 * NETLINK_NO_ENOBUFS socket option. 1534 */ 1535 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) 1536 { 1537 struct netlink_set_err_data info; 1538 struct sock *sk; 1539 int ret = 0; 1540 1541 info.exclude_sk = ssk; 1542 info.portid = portid; 1543 info.group = group; 1544 /* sk->sk_err wants a positive error value */ 1545 info.code = -code; 1546 1547 read_lock(&nl_table_lock); 1548 1549 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) 1550 ret += do_one_set_err(sk, &info); 1551 1552 read_unlock(&nl_table_lock); 1553 return ret; 1554 } 1555 EXPORT_SYMBOL(netlink_set_err); 1556 1557 /* must be called with netlink table grabbed */ 1558 static void netlink_update_socket_mc(struct netlink_sock *nlk, 1559 unsigned int group, 1560 int is_new) 1561 { 1562 int old, new = !!is_new, subscriptions; 1563 1564 old = test_bit(group - 1, nlk->groups); 1565 subscriptions = nlk->subscriptions - old + new; 1566 if (new) 1567 __set_bit(group - 1, nlk->groups); 1568 else 1569 __clear_bit(group - 1, nlk->groups); 1570 netlink_update_subscriptions(&nlk->sk, subscriptions); 1571 netlink_update_listeners(&nlk->sk); 1572 } 1573 1574 static int netlink_setsockopt(struct socket *sock, int level, int optname, 1575 char __user *optval, unsigned int optlen) 1576 { 1577 struct sock *sk = sock->sk; 1578 struct netlink_sock *nlk = nlk_sk(sk); 1579 unsigned int val = 0; 1580 int err; 1581 1582 if (level != SOL_NETLINK) 1583 return -ENOPROTOOPT; 1584 1585 if (optlen >= sizeof(int) && 1586 get_user(val, (unsigned int __user *)optval)) 1587 return -EFAULT; 1588 1589 switch (optname) { 1590 case NETLINK_PKTINFO: 1591 if (val) 1592 nlk->flags |= NETLINK_F_RECV_PKTINFO; 1593 else 1594 nlk->flags &= ~NETLINK_F_RECV_PKTINFO; 1595 err = 0; 1596 break; 1597 case NETLINK_ADD_MEMBERSHIP: 1598 case NETLINK_DROP_MEMBERSHIP: { 1599 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) 1600 return -EPERM; 1601 err = netlink_realloc_groups(sk); 1602 if (err) 1603 return err; 1604 if (!val || val - 1 >= nlk->ngroups) 1605 return -EINVAL; 1606 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) { 1607 err = nlk->netlink_bind(sock_net(sk), val); 1608 if (err) 1609 return err; 1610 } 1611 netlink_table_grab(); 1612 netlink_update_socket_mc(nlk, val, 1613 optname == NETLINK_ADD_MEMBERSHIP); 1614 netlink_table_ungrab(); 1615 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind) 1616 nlk->netlink_unbind(sock_net(sk), val); 1617 1618 err = 0; 1619 break; 1620 } 1621 case NETLINK_BROADCAST_ERROR: 1622 if (val) 1623 nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR; 1624 else 1625 nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR; 1626 err = 0; 1627 break; 1628 case NETLINK_NO_ENOBUFS: 1629 if (val) { 1630 nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS; 1631 clear_bit(NETLINK_S_CONGESTED, &nlk->state); 1632 wake_up_interruptible(&nlk->wait); 1633 } else { 1634 nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS; 1635 } 1636 err = 0; 1637 break; 1638 case NETLINK_LISTEN_ALL_NSID: 1639 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST)) 1640 return -EPERM; 1641 1642 if (val) 1643 nlk->flags |= NETLINK_F_LISTEN_ALL_NSID; 1644 else 1645 nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID; 1646 err = 0; 1647 break; 1648 case NETLINK_CAP_ACK: 1649 if (val) 1650 nlk->flags |= NETLINK_F_CAP_ACK; 1651 else 1652 nlk->flags &= ~NETLINK_F_CAP_ACK; 1653 err = 0; 1654 break; 1655 case NETLINK_EXT_ACK: 1656 if (val) 1657 nlk->flags |= NETLINK_F_EXT_ACK; 1658 else 1659 nlk->flags &= ~NETLINK_F_EXT_ACK; 1660 err = 0; 1661 break; 1662 default: 1663 err = -ENOPROTOOPT; 1664 } 1665 return err; 1666 } 1667 1668 static int netlink_getsockopt(struct socket *sock, int level, int optname, 1669 char __user *optval, int __user *optlen) 1670 { 1671 struct sock *sk = sock->sk; 1672 struct netlink_sock *nlk = nlk_sk(sk); 1673 int len, val, err; 1674 1675 if (level != SOL_NETLINK) 1676 return -ENOPROTOOPT; 1677 1678 if (get_user(len, optlen)) 1679 return -EFAULT; 1680 if (len < 0) 1681 return -EINVAL; 1682 1683 switch (optname) { 1684 case NETLINK_PKTINFO: 1685 if (len < sizeof(int)) 1686 return -EINVAL; 1687 len = sizeof(int); 1688 val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0; 1689 if (put_user(len, optlen) || 1690 put_user(val, optval)) 1691 return -EFAULT; 1692 err = 0; 1693 break; 1694 case NETLINK_BROADCAST_ERROR: 1695 if (len < sizeof(int)) 1696 return -EINVAL; 1697 len = sizeof(int); 1698 val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0; 1699 if (put_user(len, optlen) || 1700 put_user(val, optval)) 1701 return -EFAULT; 1702 err = 0; 1703 break; 1704 case NETLINK_NO_ENOBUFS: 1705 if (len < sizeof(int)) 1706 return -EINVAL; 1707 len = sizeof(int); 1708 val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0; 1709 if (put_user(len, optlen) || 1710 put_user(val, optval)) 1711 return -EFAULT; 1712 err = 0; 1713 break; 1714 case NETLINK_LIST_MEMBERSHIPS: { 1715 int pos, idx, shift; 1716 1717 err = 0; 1718 netlink_lock_table(); 1719 for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) { 1720 if (len - pos < sizeof(u32)) 1721 break; 1722 1723 idx = pos / sizeof(unsigned long); 1724 shift = (pos % sizeof(unsigned long)) * 8; 1725 if (put_user((u32)(nlk->groups[idx] >> shift), 1726 (u32 __user *)(optval + pos))) { 1727 err = -EFAULT; 1728 break; 1729 } 1730 } 1731 if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen)) 1732 err = -EFAULT; 1733 netlink_unlock_table(); 1734 break; 1735 } 1736 case NETLINK_CAP_ACK: 1737 if (len < sizeof(int)) 1738 return -EINVAL; 1739 len = sizeof(int); 1740 val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0; 1741 if (put_user(len, optlen) || 1742 put_user(val, optval)) 1743 return -EFAULT; 1744 err = 0; 1745 break; 1746 case NETLINK_EXT_ACK: 1747 if (len < sizeof(int)) 1748 return -EINVAL; 1749 len = sizeof(int); 1750 val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0; 1751 if (put_user(len, optlen) || put_user(val, optval)) 1752 return -EFAULT; 1753 err = 0; 1754 break; 1755 default: 1756 err = -ENOPROTOOPT; 1757 } 1758 return err; 1759 } 1760 1761 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) 1762 { 1763 struct nl_pktinfo info; 1764 1765 info.group = NETLINK_CB(skb).dst_group; 1766 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info); 1767 } 1768 1769 static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg, 1770 struct sk_buff *skb) 1771 { 1772 if (!NETLINK_CB(skb).nsid_is_set) 1773 return; 1774 1775 put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int), 1776 &NETLINK_CB(skb).nsid); 1777 } 1778 1779 static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 1780 { 1781 struct sock *sk = sock->sk; 1782 struct netlink_sock *nlk = nlk_sk(sk); 1783 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name); 1784 u32 dst_portid; 1785 u32 dst_group; 1786 struct sk_buff *skb; 1787 int err; 1788 struct scm_cookie scm; 1789 u32 netlink_skb_flags = 0; 1790 1791 if (msg->msg_flags&MSG_OOB) 1792 return -EOPNOTSUPP; 1793 1794 err = scm_send(sock, msg, &scm, true); 1795 if (err < 0) 1796 return err; 1797 1798 if (msg->msg_namelen) { 1799 err = -EINVAL; 1800 if (addr->nl_family != AF_NETLINK) 1801 goto out; 1802 dst_portid = addr->nl_pid; 1803 dst_group = ffs(addr->nl_groups); 1804 err = -EPERM; 1805 if ((dst_group || dst_portid) && 1806 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) 1807 goto out; 1808 netlink_skb_flags |= NETLINK_SKB_DST; 1809 } else { 1810 dst_portid = nlk->dst_portid; 1811 dst_group = nlk->dst_group; 1812 } 1813 1814 if (!nlk->bound) { 1815 err = netlink_autobind(sock); 1816 if (err) 1817 goto out; 1818 } else { 1819 /* Ensure nlk is hashed and visible. */ 1820 smp_rmb(); 1821 } 1822 1823 err = -EMSGSIZE; 1824 if (len > sk->sk_sndbuf - 32) 1825 goto out; 1826 err = -ENOBUFS; 1827 skb = netlink_alloc_large_skb(len, dst_group); 1828 if (skb == NULL) 1829 goto out; 1830 1831 NETLINK_CB(skb).portid = nlk->portid; 1832 NETLINK_CB(skb).dst_group = dst_group; 1833 NETLINK_CB(skb).creds = scm.creds; 1834 NETLINK_CB(skb).flags = netlink_skb_flags; 1835 1836 err = -EFAULT; 1837 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 1838 kfree_skb(skb); 1839 goto out; 1840 } 1841 1842 err = security_netlink_send(sk, skb); 1843 if (err) { 1844 kfree_skb(skb); 1845 goto out; 1846 } 1847 1848 if (dst_group) { 1849 atomic_inc(&skb->users); 1850 netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL); 1851 } 1852 err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT); 1853 1854 out: 1855 scm_destroy(&scm); 1856 return err; 1857 } 1858 1859 static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 1860 int flags) 1861 { 1862 struct scm_cookie scm; 1863 struct sock *sk = sock->sk; 1864 struct netlink_sock *nlk = nlk_sk(sk); 1865 int noblock = flags&MSG_DONTWAIT; 1866 size_t copied; 1867 struct sk_buff *skb, *data_skb; 1868 int err, ret; 1869 1870 if (flags&MSG_OOB) 1871 return -EOPNOTSUPP; 1872 1873 copied = 0; 1874 1875 skb = skb_recv_datagram(sk, flags, noblock, &err); 1876 if (skb == NULL) 1877 goto out; 1878 1879 data_skb = skb; 1880 1881 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES 1882 if (unlikely(skb_shinfo(skb)->frag_list)) { 1883 /* 1884 * If this skb has a frag_list, then here that means that we 1885 * will have to use the frag_list skb's data for compat tasks 1886 * and the regular skb's data for normal (non-compat) tasks. 1887 * 1888 * If we need to send the compat skb, assign it to the 1889 * 'data_skb' variable so that it will be used below for data 1890 * copying. We keep 'skb' for everything else, including 1891 * freeing both later. 1892 */ 1893 if (flags & MSG_CMSG_COMPAT) 1894 data_skb = skb_shinfo(skb)->frag_list; 1895 } 1896 #endif 1897 1898 /* Record the max length of recvmsg() calls for future allocations */ 1899 nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); 1900 nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, 1901 SKB_WITH_OVERHEAD(32768)); 1902 1903 copied = data_skb->len; 1904 if (len < copied) { 1905 msg->msg_flags |= MSG_TRUNC; 1906 copied = len; 1907 } 1908 1909 skb_reset_transport_header(data_skb); 1910 err = skb_copy_datagram_msg(data_skb, 0, msg, copied); 1911 1912 if (msg->msg_name) { 1913 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name); 1914 addr->nl_family = AF_NETLINK; 1915 addr->nl_pad = 0; 1916 addr->nl_pid = NETLINK_CB(skb).portid; 1917 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group); 1918 msg->msg_namelen = sizeof(*addr); 1919 } 1920 1921 if (nlk->flags & NETLINK_F_RECV_PKTINFO) 1922 netlink_cmsg_recv_pktinfo(msg, skb); 1923 if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID) 1924 netlink_cmsg_listen_all_nsid(sk, msg, skb); 1925 1926 memset(&scm, 0, sizeof(scm)); 1927 scm.creds = *NETLINK_CREDS(skb); 1928 if (flags & MSG_TRUNC) 1929 copied = data_skb->len; 1930 1931 skb_free_datagram(sk, skb); 1932 1933 if (nlk->cb_running && 1934 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) { 1935 ret = netlink_dump(sk); 1936 if (ret) { 1937 sk->sk_err = -ret; 1938 sk->sk_error_report(sk); 1939 } 1940 } 1941 1942 scm_recv(sock, msg, &scm, flags); 1943 out: 1944 netlink_rcv_wake(sk); 1945 return err ? : copied; 1946 } 1947 1948 static void netlink_data_ready(struct sock *sk) 1949 { 1950 BUG(); 1951 } 1952 1953 /* 1954 * We export these functions to other modules. They provide a 1955 * complete set of kernel non-blocking support for message 1956 * queueing. 1957 */ 1958 1959 struct sock * 1960 __netlink_kernel_create(struct net *net, int unit, struct module *module, 1961 struct netlink_kernel_cfg *cfg) 1962 { 1963 struct socket *sock; 1964 struct sock *sk; 1965 struct netlink_sock *nlk; 1966 struct listeners *listeners = NULL; 1967 struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL; 1968 unsigned int groups; 1969 1970 BUG_ON(!nl_table); 1971 1972 if (unit < 0 || unit >= MAX_LINKS) 1973 return NULL; 1974 1975 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock)) 1976 return NULL; 1977 1978 if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0) 1979 goto out_sock_release_nosk; 1980 1981 sk = sock->sk; 1982 1983 if (!cfg || cfg->groups < 32) 1984 groups = 32; 1985 else 1986 groups = cfg->groups; 1987 1988 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL); 1989 if (!listeners) 1990 goto out_sock_release; 1991 1992 sk->sk_data_ready = netlink_data_ready; 1993 if (cfg && cfg->input) 1994 nlk_sk(sk)->netlink_rcv = cfg->input; 1995 1996 if (netlink_insert(sk, 0)) 1997 goto out_sock_release; 1998 1999 nlk = nlk_sk(sk); 2000 nlk->flags |= NETLINK_F_KERNEL_SOCKET; 2001 2002 netlink_table_grab(); 2003 if (!nl_table[unit].registered) { 2004 nl_table[unit].groups = groups; 2005 rcu_assign_pointer(nl_table[unit].listeners, listeners); 2006 nl_table[unit].cb_mutex = cb_mutex; 2007 nl_table[unit].module = module; 2008 if (cfg) { 2009 nl_table[unit].bind = cfg->bind; 2010 nl_table[unit].unbind = cfg->unbind; 2011 nl_table[unit].flags = cfg->flags; 2012 if (cfg->compare) 2013 nl_table[unit].compare = cfg->compare; 2014 } 2015 nl_table[unit].registered = 1; 2016 } else { 2017 kfree(listeners); 2018 nl_table[unit].registered++; 2019 } 2020 netlink_table_ungrab(); 2021 return sk; 2022 2023 out_sock_release: 2024 kfree(listeners); 2025 netlink_kernel_release(sk); 2026 return NULL; 2027 2028 out_sock_release_nosk: 2029 sock_release(sock); 2030 return NULL; 2031 } 2032 EXPORT_SYMBOL(__netlink_kernel_create); 2033 2034 void 2035 netlink_kernel_release(struct sock *sk) 2036 { 2037 if (sk == NULL || sk->sk_socket == NULL) 2038 return; 2039 2040 sock_release(sk->sk_socket); 2041 } 2042 EXPORT_SYMBOL(netlink_kernel_release); 2043 2044 int __netlink_change_ngroups(struct sock *sk, unsigned int groups) 2045 { 2046 struct listeners *new, *old; 2047 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 2048 2049 if (groups < 32) 2050 groups = 32; 2051 2052 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) { 2053 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC); 2054 if (!new) 2055 return -ENOMEM; 2056 old = nl_deref_protected(tbl->listeners); 2057 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups)); 2058 rcu_assign_pointer(tbl->listeners, new); 2059 2060 kfree_rcu(old, rcu); 2061 } 2062 tbl->groups = groups; 2063 2064 return 0; 2065 } 2066 2067 /** 2068 * netlink_change_ngroups - change number of multicast groups 2069 * 2070 * This changes the number of multicast groups that are available 2071 * on a certain netlink family. Note that it is not possible to 2072 * change the number of groups to below 32. Also note that it does 2073 * not implicitly call netlink_clear_multicast_users() when the 2074 * number of groups is reduced. 2075 * 2076 * @sk: The kernel netlink socket, as returned by netlink_kernel_create(). 2077 * @groups: The new number of groups. 2078 */ 2079 int netlink_change_ngroups(struct sock *sk, unsigned int groups) 2080 { 2081 int err; 2082 2083 netlink_table_grab(); 2084 err = __netlink_change_ngroups(sk, groups); 2085 netlink_table_ungrab(); 2086 2087 return err; 2088 } 2089 2090 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) 2091 { 2092 struct sock *sk; 2093 struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; 2094 2095 sk_for_each_bound(sk, &tbl->mc_list) 2096 netlink_update_socket_mc(nlk_sk(sk), group, 0); 2097 } 2098 2099 struct nlmsghdr * 2100 __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags) 2101 { 2102 struct nlmsghdr *nlh; 2103 int size = nlmsg_msg_size(len); 2104 2105 nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size)); 2106 nlh->nlmsg_type = type; 2107 nlh->nlmsg_len = size; 2108 nlh->nlmsg_flags = flags; 2109 nlh->nlmsg_pid = portid; 2110 nlh->nlmsg_seq = seq; 2111 if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0) 2112 memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size); 2113 return nlh; 2114 } 2115 EXPORT_SYMBOL(__nlmsg_put); 2116 2117 /* 2118 * It looks a bit ugly. 2119 * It would be better to create kernel thread. 2120 */ 2121 2122 static int netlink_dump(struct sock *sk) 2123 { 2124 struct netlink_sock *nlk = nlk_sk(sk); 2125 struct netlink_callback *cb; 2126 struct sk_buff *skb = NULL; 2127 struct nlmsghdr *nlh; 2128 struct module *module; 2129 int len, err = -ENOBUFS; 2130 int alloc_min_size; 2131 int alloc_size; 2132 2133 mutex_lock(nlk->cb_mutex); 2134 if (!nlk->cb_running) { 2135 err = -EINVAL; 2136 goto errout_skb; 2137 } 2138 2139 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 2140 goto errout_skb; 2141 2142 /* NLMSG_GOODSIZE is small to avoid high order allocations being 2143 * required, but it makes sense to _attempt_ a 16K bytes allocation 2144 * to reduce number of system calls on dump operations, if user 2145 * ever provided a big enough buffer. 2146 */ 2147 cb = &nlk->cb; 2148 alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); 2149 2150 if (alloc_min_size < nlk->max_recvmsg_len) { 2151 alloc_size = nlk->max_recvmsg_len; 2152 skb = alloc_skb(alloc_size, 2153 (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) | 2154 __GFP_NOWARN | __GFP_NORETRY); 2155 } 2156 if (!skb) { 2157 alloc_size = alloc_min_size; 2158 skb = alloc_skb(alloc_size, GFP_KERNEL); 2159 } 2160 if (!skb) 2161 goto errout_skb; 2162 2163 /* Trim skb to allocated size. User is expected to provide buffer as 2164 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at 2165 * netlink_recvmsg())). dump will pack as many smaller messages as 2166 * could fit within the allocated skb. skb is typically allocated 2167 * with larger space than required (could be as much as near 2x the 2168 * requested size with align to next power of 2 approach). Allowing 2169 * dump to use the excess space makes it difficult for a user to have a 2170 * reasonable static buffer based on the expected largest dump of a 2171 * single netdev. The outcome is MSG_TRUNC error. 2172 */ 2173 skb_reserve(skb, skb_tailroom(skb) - alloc_size); 2174 netlink_skb_set_owner_r(skb, sk); 2175 2176 len = cb->dump(skb, cb); 2177 2178 if (len > 0) { 2179 mutex_unlock(nlk->cb_mutex); 2180 2181 if (sk_filter(sk, skb)) 2182 kfree_skb(skb); 2183 else 2184 __netlink_sendskb(sk, skb); 2185 return 0; 2186 } 2187 2188 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI); 2189 if (!nlh) 2190 goto errout_skb; 2191 2192 nl_dump_check_consistent(cb, nlh); 2193 2194 memcpy(nlmsg_data(nlh), &len, sizeof(len)); 2195 2196 if (sk_filter(sk, skb)) 2197 kfree_skb(skb); 2198 else 2199 __netlink_sendskb(sk, skb); 2200 2201 if (cb->done) 2202 cb->done(cb); 2203 2204 nlk->cb_running = false; 2205 module = cb->module; 2206 skb = cb->skb; 2207 mutex_unlock(nlk->cb_mutex); 2208 module_put(module); 2209 consume_skb(skb); 2210 return 0; 2211 2212 errout_skb: 2213 mutex_unlock(nlk->cb_mutex); 2214 kfree_skb(skb); 2215 return err; 2216 } 2217 2218 int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, 2219 const struct nlmsghdr *nlh, 2220 struct netlink_dump_control *control) 2221 { 2222 struct netlink_callback *cb; 2223 struct sock *sk; 2224 struct netlink_sock *nlk; 2225 int ret; 2226 2227 atomic_inc(&skb->users); 2228 2229 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid); 2230 if (sk == NULL) { 2231 ret = -ECONNREFUSED; 2232 goto error_free; 2233 } 2234 2235 nlk = nlk_sk(sk); 2236 mutex_lock(nlk->cb_mutex); 2237 /* A dump is in progress... */ 2238 if (nlk->cb_running) { 2239 ret = -EBUSY; 2240 goto error_unlock; 2241 } 2242 /* add reference of module which cb->dump belongs to */ 2243 if (!try_module_get(control->module)) { 2244 ret = -EPROTONOSUPPORT; 2245 goto error_unlock; 2246 } 2247 2248 cb = &nlk->cb; 2249 memset(cb, 0, sizeof(*cb)); 2250 cb->start = control->start; 2251 cb->dump = control->dump; 2252 cb->done = control->done; 2253 cb->nlh = nlh; 2254 cb->data = control->data; 2255 cb->module = control->module; 2256 cb->min_dump_alloc = control->min_dump_alloc; 2257 cb->skb = skb; 2258 2259 nlk->cb_running = true; 2260 2261 mutex_unlock(nlk->cb_mutex); 2262 2263 if (cb->start) 2264 cb->start(cb); 2265 2266 ret = netlink_dump(sk); 2267 sock_put(sk); 2268 2269 if (ret) 2270 return ret; 2271 2272 /* We successfully started a dump, by returning -EINTR we 2273 * signal not to send ACK even if it was requested. 2274 */ 2275 return -EINTR; 2276 2277 error_unlock: 2278 sock_put(sk); 2279 mutex_unlock(nlk->cb_mutex); 2280 error_free: 2281 kfree_skb(skb); 2282 return ret; 2283 } 2284 EXPORT_SYMBOL(__netlink_dump_start); 2285 2286 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, 2287 const struct netlink_ext_ack *extack) 2288 { 2289 struct sk_buff *skb; 2290 struct nlmsghdr *rep; 2291 struct nlmsgerr *errmsg; 2292 size_t payload = sizeof(*errmsg); 2293 size_t tlvlen = 0; 2294 struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk); 2295 unsigned int flags = 0; 2296 2297 /* Error messages get the original request appened, unless the user 2298 * requests to cap the error message, and get extra error data if 2299 * requested. 2300 */ 2301 if (err) { 2302 if (!(nlk->flags & NETLINK_F_CAP_ACK)) 2303 payload += nlmsg_len(nlh); 2304 else 2305 flags |= NLM_F_CAPPED; 2306 if (nlk->flags & NETLINK_F_EXT_ACK && extack) { 2307 if (extack->_msg) 2308 tlvlen += nla_total_size(strlen(extack->_msg) + 1); 2309 if (extack->bad_attr) 2310 tlvlen += nla_total_size(sizeof(u32)); 2311 } 2312 } else { 2313 flags |= NLM_F_CAPPED; 2314 2315 if (nlk->flags & NETLINK_F_EXT_ACK && 2316 extack && extack->cookie_len) 2317 tlvlen += nla_total_size(extack->cookie_len); 2318 } 2319 2320 if (tlvlen) 2321 flags |= NLM_F_ACK_TLVS; 2322 2323 skb = nlmsg_new(payload + tlvlen, GFP_KERNEL); 2324 if (!skb) { 2325 struct sock *sk; 2326 2327 sk = netlink_lookup(sock_net(in_skb->sk), 2328 in_skb->sk->sk_protocol, 2329 NETLINK_CB(in_skb).portid); 2330 if (sk) { 2331 sk->sk_err = ENOBUFS; 2332 sk->sk_error_report(sk); 2333 sock_put(sk); 2334 } 2335 return; 2336 } 2337 2338 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, 2339 NLMSG_ERROR, payload, flags); 2340 errmsg = nlmsg_data(rep); 2341 errmsg->error = err; 2342 memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh)); 2343 2344 if (nlk->flags & NETLINK_F_EXT_ACK && extack) { 2345 if (err) { 2346 if (extack->_msg) 2347 WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG, 2348 extack->_msg)); 2349 if (extack->bad_attr && 2350 !WARN_ON((u8 *)extack->bad_attr < in_skb->data || 2351 (u8 *)extack->bad_attr >= in_skb->data + 2352 in_skb->len)) 2353 WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS, 2354 (u8 *)extack->bad_attr - 2355 in_skb->data)); 2356 } else { 2357 if (extack->cookie_len) 2358 WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE, 2359 extack->cookie_len, 2360 extack->cookie)); 2361 } 2362 } 2363 2364 nlmsg_end(skb, rep); 2365 2366 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT); 2367 } 2368 EXPORT_SYMBOL(netlink_ack); 2369 2370 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *, 2371 struct nlmsghdr *, 2372 struct netlink_ext_ack *)) 2373 { 2374 struct netlink_ext_ack extack = {}; 2375 struct nlmsghdr *nlh; 2376 int err; 2377 2378 while (skb->len >= nlmsg_total_size(0)) { 2379 int msglen; 2380 2381 nlh = nlmsg_hdr(skb); 2382 err = 0; 2383 2384 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len) 2385 return 0; 2386 2387 /* Only requests are handled by the kernel */ 2388 if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) 2389 goto ack; 2390 2391 /* Skip control messages */ 2392 if (nlh->nlmsg_type < NLMSG_MIN_TYPE) 2393 goto ack; 2394 2395 err = cb(skb, nlh, &extack); 2396 if (err == -EINTR) 2397 goto skip; 2398 2399 ack: 2400 if (nlh->nlmsg_flags & NLM_F_ACK || err) 2401 netlink_ack(skb, nlh, err, &extack); 2402 2403 skip: 2404 msglen = NLMSG_ALIGN(nlh->nlmsg_len); 2405 if (msglen > skb->len) 2406 msglen = skb->len; 2407 skb_pull(skb, msglen); 2408 } 2409 2410 return 0; 2411 } 2412 EXPORT_SYMBOL(netlink_rcv_skb); 2413 2414 /** 2415 * nlmsg_notify - send a notification netlink message 2416 * @sk: netlink socket to use 2417 * @skb: notification message 2418 * @portid: destination netlink portid for reports or 0 2419 * @group: destination multicast group or 0 2420 * @report: 1 to report back, 0 to disable 2421 * @flags: allocation flags 2422 */ 2423 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid, 2424 unsigned int group, int report, gfp_t flags) 2425 { 2426 int err = 0; 2427 2428 if (group) { 2429 int exclude_portid = 0; 2430 2431 if (report) { 2432 atomic_inc(&skb->users); 2433 exclude_portid = portid; 2434 } 2435 2436 /* errors reported via destination sk->sk_err, but propagate 2437 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ 2438 err = nlmsg_multicast(sk, skb, exclude_portid, group, flags); 2439 } 2440 2441 if (report) { 2442 int err2; 2443 2444 err2 = nlmsg_unicast(sk, skb, portid); 2445 if (!err || err == -ESRCH) 2446 err = err2; 2447 } 2448 2449 return err; 2450 } 2451 EXPORT_SYMBOL(nlmsg_notify); 2452 2453 #ifdef CONFIG_PROC_FS 2454 struct nl_seq_iter { 2455 struct seq_net_private p; 2456 struct rhashtable_iter hti; 2457 int link; 2458 }; 2459 2460 static int netlink_walk_start(struct nl_seq_iter *iter) 2461 { 2462 int err; 2463 2464 err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti, 2465 GFP_KERNEL); 2466 if (err) { 2467 iter->link = MAX_LINKS; 2468 return err; 2469 } 2470 2471 err = rhashtable_walk_start(&iter->hti); 2472 return err == -EAGAIN ? 0 : err; 2473 } 2474 2475 static void netlink_walk_stop(struct nl_seq_iter *iter) 2476 { 2477 rhashtable_walk_stop(&iter->hti); 2478 rhashtable_walk_exit(&iter->hti); 2479 } 2480 2481 static void *__netlink_seq_next(struct seq_file *seq) 2482 { 2483 struct nl_seq_iter *iter = seq->private; 2484 struct netlink_sock *nlk; 2485 2486 do { 2487 for (;;) { 2488 int err; 2489 2490 nlk = rhashtable_walk_next(&iter->hti); 2491 2492 if (IS_ERR(nlk)) { 2493 if (PTR_ERR(nlk) == -EAGAIN) 2494 continue; 2495 2496 return nlk; 2497 } 2498 2499 if (nlk) 2500 break; 2501 2502 netlink_walk_stop(iter); 2503 if (++iter->link >= MAX_LINKS) 2504 return NULL; 2505 2506 err = netlink_walk_start(iter); 2507 if (err) 2508 return ERR_PTR(err); 2509 } 2510 } while (sock_net(&nlk->sk) != seq_file_net(seq)); 2511 2512 return nlk; 2513 } 2514 2515 static void *netlink_seq_start(struct seq_file *seq, loff_t *posp) 2516 { 2517 struct nl_seq_iter *iter = seq->private; 2518 void *obj = SEQ_START_TOKEN; 2519 loff_t pos; 2520 int err; 2521 2522 iter->link = 0; 2523 2524 err = netlink_walk_start(iter); 2525 if (err) 2526 return ERR_PTR(err); 2527 2528 for (pos = *posp; pos && obj && !IS_ERR(obj); pos--) 2529 obj = __netlink_seq_next(seq); 2530 2531 return obj; 2532 } 2533 2534 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) 2535 { 2536 ++*pos; 2537 return __netlink_seq_next(seq); 2538 } 2539 2540 static void netlink_seq_stop(struct seq_file *seq, void *v) 2541 { 2542 struct nl_seq_iter *iter = seq->private; 2543 2544 if (iter->link >= MAX_LINKS) 2545 return; 2546 2547 netlink_walk_stop(iter); 2548 } 2549 2550 2551 static int netlink_seq_show(struct seq_file *seq, void *v) 2552 { 2553 if (v == SEQ_START_TOKEN) { 2554 seq_puts(seq, 2555 "sk Eth Pid Groups " 2556 "Rmem Wmem Dump Locks Drops Inode\n"); 2557 } else { 2558 struct sock *s = v; 2559 struct netlink_sock *nlk = nlk_sk(s); 2560 2561 seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n", 2562 s, 2563 s->sk_protocol, 2564 nlk->portid, 2565 nlk->groups ? (u32)nlk->groups[0] : 0, 2566 sk_rmem_alloc_get(s), 2567 sk_wmem_alloc_get(s), 2568 nlk->cb_running, 2569 atomic_read(&s->sk_refcnt), 2570 atomic_read(&s->sk_drops), 2571 sock_i_ino(s) 2572 ); 2573 2574 } 2575 return 0; 2576 } 2577 2578 static const struct seq_operations netlink_seq_ops = { 2579 .start = netlink_seq_start, 2580 .next = netlink_seq_next, 2581 .stop = netlink_seq_stop, 2582 .show = netlink_seq_show, 2583 }; 2584 2585 2586 static int netlink_seq_open(struct inode *inode, struct file *file) 2587 { 2588 return seq_open_net(inode, file, &netlink_seq_ops, 2589 sizeof(struct nl_seq_iter)); 2590 } 2591 2592 static const struct file_operations netlink_seq_fops = { 2593 .owner = THIS_MODULE, 2594 .open = netlink_seq_open, 2595 .read = seq_read, 2596 .llseek = seq_lseek, 2597 .release = seq_release_net, 2598 }; 2599 2600 #endif 2601 2602 int netlink_register_notifier(struct notifier_block *nb) 2603 { 2604 return blocking_notifier_chain_register(&netlink_chain, nb); 2605 } 2606 EXPORT_SYMBOL(netlink_register_notifier); 2607 2608 int netlink_unregister_notifier(struct notifier_block *nb) 2609 { 2610 return blocking_notifier_chain_unregister(&netlink_chain, nb); 2611 } 2612 EXPORT_SYMBOL(netlink_unregister_notifier); 2613 2614 static const struct proto_ops netlink_ops = { 2615 .family = PF_NETLINK, 2616 .owner = THIS_MODULE, 2617 .release = netlink_release, 2618 .bind = netlink_bind, 2619 .connect = netlink_connect, 2620 .socketpair = sock_no_socketpair, 2621 .accept = sock_no_accept, 2622 .getname = netlink_getname, 2623 .poll = datagram_poll, 2624 .ioctl = netlink_ioctl, 2625 .listen = sock_no_listen, 2626 .shutdown = sock_no_shutdown, 2627 .setsockopt = netlink_setsockopt, 2628 .getsockopt = netlink_getsockopt, 2629 .sendmsg = netlink_sendmsg, 2630 .recvmsg = netlink_recvmsg, 2631 .mmap = sock_no_mmap, 2632 .sendpage = sock_no_sendpage, 2633 }; 2634 2635 static const struct net_proto_family netlink_family_ops = { 2636 .family = PF_NETLINK, 2637 .create = netlink_create, 2638 .owner = THIS_MODULE, /* for consistency 8) */ 2639 }; 2640 2641 static int __net_init netlink_net_init(struct net *net) 2642 { 2643 #ifdef CONFIG_PROC_FS 2644 if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops)) 2645 return -ENOMEM; 2646 #endif 2647 return 0; 2648 } 2649 2650 static void __net_exit netlink_net_exit(struct net *net) 2651 { 2652 #ifdef CONFIG_PROC_FS 2653 remove_proc_entry("netlink", net->proc_net); 2654 #endif 2655 } 2656 2657 static void __init netlink_add_usersock_entry(void) 2658 { 2659 struct listeners *listeners; 2660 int groups = 32; 2661 2662 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL); 2663 if (!listeners) 2664 panic("netlink_add_usersock_entry: Cannot allocate listeners\n"); 2665 2666 netlink_table_grab(); 2667 2668 nl_table[NETLINK_USERSOCK].groups = groups; 2669 rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners); 2670 nl_table[NETLINK_USERSOCK].module = THIS_MODULE; 2671 nl_table[NETLINK_USERSOCK].registered = 1; 2672 nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND; 2673 2674 netlink_table_ungrab(); 2675 } 2676 2677 static struct pernet_operations __net_initdata netlink_net_ops = { 2678 .init = netlink_net_init, 2679 .exit = netlink_net_exit, 2680 }; 2681 2682 static inline u32 netlink_hash(const void *data, u32 len, u32 seed) 2683 { 2684 const struct netlink_sock *nlk = data; 2685 struct netlink_compare_arg arg; 2686 2687 netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid); 2688 return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed); 2689 } 2690 2691 static const struct rhashtable_params netlink_rhashtable_params = { 2692 .head_offset = offsetof(struct netlink_sock, node), 2693 .key_len = netlink_compare_arg_len, 2694 .obj_hashfn = netlink_hash, 2695 .obj_cmpfn = netlink_compare, 2696 .automatic_shrinking = true, 2697 }; 2698 2699 static int __init netlink_proto_init(void) 2700 { 2701 int i; 2702 int err = proto_register(&netlink_proto, 0); 2703 2704 if (err != 0) 2705 goto out; 2706 2707 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb)); 2708 2709 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL); 2710 if (!nl_table) 2711 goto panic; 2712 2713 for (i = 0; i < MAX_LINKS; i++) { 2714 if (rhashtable_init(&nl_table[i].hash, 2715 &netlink_rhashtable_params) < 0) { 2716 while (--i > 0) 2717 rhashtable_destroy(&nl_table[i].hash); 2718 kfree(nl_table); 2719 goto panic; 2720 } 2721 } 2722 2723 INIT_LIST_HEAD(&netlink_tap_all); 2724 2725 netlink_add_usersock_entry(); 2726 2727 sock_register(&netlink_family_ops); 2728 register_pernet_subsys(&netlink_net_ops); 2729 /* The netlink device handler may be needed early. */ 2730 rtnetlink_init(); 2731 out: 2732 return err; 2733 panic: 2734 panic("netlink_init: Cannot allocate nl_table\n"); 2735 } 2736 2737 core_initcall(netlink_proto_init); 2738