1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * PACKET - implements raw packet sockets. 7 * 8 * Version: $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $ 9 * 10 * Authors: Ross Biro 11 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG> 12 * Alan Cox, <gw4pts@gw4pts.ampr.org> 13 * 14 * Fixes: 15 * Alan Cox : verify_area() now used correctly 16 * Alan Cox : new skbuff lists, look ma no backlogs! 17 * Alan Cox : tidied skbuff lists. 18 * Alan Cox : Now uses generic datagram routines I 19 * added. Also fixed the peek/read crash 20 * from all old Linux datagram code. 21 * Alan Cox : Uses the improved datagram code. 22 * Alan Cox : Added NULL's for socket options. 23 * Alan Cox : Re-commented the code. 24 * Alan Cox : Use new kernel side addressing 25 * Rob Janssen : Correct MTU usage. 26 * Dave Platt : Counter leaks caused by incorrect 27 * interrupt locking and some slightly 28 * dubious gcc output. Can you read 29 * compiler: it said _VOLATILE_ 30 * Richard Kooijman : Timestamp fixes. 31 * Alan Cox : New buffers. Use sk->mac.raw. 32 * Alan Cox : sendmsg/recvmsg support. 33 * Alan Cox : Protocol setting support 34 * Alexey Kuznetsov : Untied from IPv4 stack. 35 * Cyrus Durgin : Fixed kerneld for kmod. 36 * Michal Ostrowski : Module initialization cleanup. 37 * Ulises Alonso : Frame number limit removal and 38 * packet_set_ring memory leak. 39 * Eric Biederman : Allow for > 8 byte hardware addresses. 40 * The convention is that longer addresses 41 * will simply extend the hardware address 42 * byte arrays at the end of sockaddr_ll 43 * and packet_mreq. 44 * 45 * This program is free software; you can redistribute it and/or 46 * modify it under the terms of the GNU General Public License 47 * as published by the Free Software Foundation; either version 48 * 2 of the License, or (at your option) any later version. 49 * 50 */ 51 52 #include <linux/types.h> 53 #include <linux/mm.h> 54 #include <linux/capability.h> 55 #include <linux/fcntl.h> 56 #include <linux/socket.h> 57 #include <linux/in.h> 58 #include <linux/inet.h> 59 #include <linux/netdevice.h> 60 #include <linux/if_packet.h> 61 #include <linux/wireless.h> 62 #include <linux/kernel.h> 63 #include <linux/kmod.h> 64 #include <net/ip.h> 65 #include <net/protocol.h> 66 #include <linux/skbuff.h> 67 #include <net/sock.h> 68 #include <linux/errno.h> 69 #include <linux/timer.h> 70 #include <asm/system.h> 71 #include <asm/uaccess.h> 72 #include <asm/ioctls.h> 73 #include <asm/page.h> 74 #include <asm/cacheflush.h> 75 #include <asm/io.h> 76 #include <linux/proc_fs.h> 77 #include <linux/seq_file.h> 78 #include <linux/poll.h> 79 #include <linux/module.h> 80 #include <linux/init.h> 81 82 #ifdef CONFIG_INET 83 #include <net/inet_common.h> 84 #endif 85 86 #define CONFIG_SOCK_PACKET 1 87 88 /* 89 Proposed replacement for SIOC{ADD,DEL}MULTI and 90 IFF_PROMISC, IFF_ALLMULTI flags. 91 92 It is more expensive, but I believe, 93 it is really correct solution: reentereble, safe and fault tolerant. 94 95 IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping 96 reference count and global flag, so that real status is 97 (gflag|(count != 0)), so that we can use obsolete faulty interface 98 not harming clever users. 99 */ 100 #define CONFIG_PACKET_MULTICAST 1 101 102 /* 103 Assumptions: 104 - if device has no dev->hard_header routine, it adds and removes ll header 105 inside itself. In this case ll header is invisible outside of device, 106 but higher levels still should reserve dev->hard_header_len. 107 Some devices are enough clever to reallocate skb, when header 108 will not fit to reserved space (tunnel), another ones are silly 109 (PPP). 110 - packet socket receives packets with pulled ll header, 111 so that SOCK_RAW should push it back. 112 113 On receive: 114 ----------- 115 116 Incoming, dev->hard_header!=NULL 117 mac.raw -> ll header 118 data -> data 119 120 Outgoing, dev->hard_header!=NULL 121 mac.raw -> ll header 122 data -> ll header 123 124 Incoming, dev->hard_header==NULL 125 mac.raw -> UNKNOWN position. It is very likely, that it points to ll header. 126 PPP makes it, that is wrong, because introduce assymetry 127 between rx and tx paths. 128 data -> data 129 130 Outgoing, dev->hard_header==NULL 131 mac.raw -> data. ll header is still not built! 132 data -> data 133 134 Resume 135 If dev->hard_header==NULL we are unlikely to restore sensible ll header. 136 137 138 On transmit: 139 ------------ 140 141 dev->hard_header != NULL 142 mac.raw -> ll header 143 data -> ll header 144 145 dev->hard_header == NULL (ll header is added by device, we cannot control it) 146 mac.raw -> data 147 data -> data 148 149 We should set nh.raw on output to correct posistion, 150 packet classifier depends on it. 151 */ 152 153 /* List of all packet sockets. */ 154 static HLIST_HEAD(packet_sklist); 155 static DEFINE_RWLOCK(packet_sklist_lock); 156 157 static atomic_t packet_socks_nr; 158 159 160 /* Private packet socket structures. */ 161 162 #ifdef CONFIG_PACKET_MULTICAST 163 struct packet_mclist 164 { 165 struct packet_mclist *next; 166 int ifindex; 167 int count; 168 unsigned short type; 169 unsigned short alen; 170 unsigned char addr[MAX_ADDR_LEN]; 171 }; 172 /* identical to struct packet_mreq except it has 173 * a longer address field. 174 */ 175 struct packet_mreq_max 176 { 177 int mr_ifindex; 178 unsigned short mr_type; 179 unsigned short mr_alen; 180 unsigned char mr_address[MAX_ADDR_LEN]; 181 }; 182 #endif 183 #ifdef CONFIG_PACKET_MMAP 184 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing); 185 #endif 186 187 static void packet_flush_mclist(struct sock *sk); 188 189 struct packet_sock { 190 /* struct sock has to be the first member of packet_sock */ 191 struct sock sk; 192 struct tpacket_stats stats; 193 #ifdef CONFIG_PACKET_MMAP 194 char * *pg_vec; 195 unsigned int head; 196 unsigned int frames_per_block; 197 unsigned int frame_size; 198 unsigned int frame_max; 199 int copy_thresh; 200 #endif 201 struct packet_type prot_hook; 202 spinlock_t bind_lock; 203 unsigned int running:1, /* prot_hook is attached*/ 204 auxdata:1; 205 int ifindex; /* bound device */ 206 __be16 num; 207 #ifdef CONFIG_PACKET_MULTICAST 208 struct packet_mclist *mclist; 209 #endif 210 #ifdef CONFIG_PACKET_MMAP 211 atomic_t mapped; 212 unsigned int pg_vec_order; 213 unsigned int pg_vec_pages; 214 unsigned int pg_vec_len; 215 #endif 216 }; 217 218 struct packet_skb_cb { 219 unsigned int origlen; 220 union { 221 struct sockaddr_pkt pkt; 222 struct sockaddr_ll ll; 223 } sa; 224 }; 225 226 #define PACKET_SKB_CB(__skb) ((struct packet_skb_cb *)((__skb)->cb)) 227 228 #ifdef CONFIG_PACKET_MMAP 229 230 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position) 231 { 232 unsigned int pg_vec_pos, frame_offset; 233 234 pg_vec_pos = position / po->frames_per_block; 235 frame_offset = position % po->frames_per_block; 236 237 return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size)); 238 } 239 #endif 240 241 static inline struct packet_sock *pkt_sk(struct sock *sk) 242 { 243 return (struct packet_sock *)sk; 244 } 245 246 static void packet_sock_destruct(struct sock *sk) 247 { 248 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc)); 249 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 250 251 if (!sock_flag(sk, SOCK_DEAD)) { 252 printk("Attempt to release alive packet socket: %p\n", sk); 253 return; 254 } 255 256 atomic_dec(&packet_socks_nr); 257 #ifdef PACKET_REFCNT_DEBUG 258 printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr)); 259 #endif 260 } 261 262 263 static const struct proto_ops packet_ops; 264 265 #ifdef CONFIG_SOCK_PACKET 266 static const struct proto_ops packet_ops_spkt; 267 268 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 269 { 270 struct sock *sk; 271 struct sockaddr_pkt *spkt; 272 273 /* 274 * When we registered the protocol we saved the socket in the data 275 * field for just this event. 276 */ 277 278 sk = pt->af_packet_priv; 279 280 /* 281 * Yank back the headers [hope the device set this 282 * right or kerboom...] 283 * 284 * Incoming packets have ll header pulled, 285 * push it back. 286 * 287 * For outgoing ones skb->data == skb->mac.raw 288 * so that this procedure is noop. 289 */ 290 291 if (skb->pkt_type == PACKET_LOOPBACK) 292 goto out; 293 294 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) 295 goto oom; 296 297 /* drop any routing info */ 298 dst_release(skb->dst); 299 skb->dst = NULL; 300 301 /* drop conntrack reference */ 302 nf_reset(skb); 303 304 spkt = &PACKET_SKB_CB(skb)->sa.pkt; 305 306 skb_push(skb, skb->data-skb->mac.raw); 307 308 /* 309 * The SOCK_PACKET socket receives _all_ frames. 310 */ 311 312 spkt->spkt_family = dev->type; 313 strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); 314 spkt->spkt_protocol = skb->protocol; 315 316 /* 317 * Charge the memory to the socket. This is done specifically 318 * to prevent sockets using all the memory up. 319 */ 320 321 if (sock_queue_rcv_skb(sk,skb) == 0) 322 return 0; 323 324 out: 325 kfree_skb(skb); 326 oom: 327 return 0; 328 } 329 330 331 /* 332 * Output a raw packet to a device layer. This bypasses all the other 333 * protocol layers and you must therefore supply it with a complete frame 334 */ 335 336 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock, 337 struct msghdr *msg, size_t len) 338 { 339 struct sock *sk = sock->sk; 340 struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name; 341 struct sk_buff *skb; 342 struct net_device *dev; 343 __be16 proto=0; 344 int err; 345 346 /* 347 * Get and verify the address. 348 */ 349 350 if (saddr) 351 { 352 if (msg->msg_namelen < sizeof(struct sockaddr)) 353 return(-EINVAL); 354 if (msg->msg_namelen==sizeof(struct sockaddr_pkt)) 355 proto=saddr->spkt_protocol; 356 } 357 else 358 return(-ENOTCONN); /* SOCK_PACKET must be sent giving an address */ 359 360 /* 361 * Find the device first to size check it 362 */ 363 364 saddr->spkt_device[13] = 0; 365 dev = dev_get_by_name(saddr->spkt_device); 366 err = -ENODEV; 367 if (dev == NULL) 368 goto out_unlock; 369 370 err = -ENETDOWN; 371 if (!(dev->flags & IFF_UP)) 372 goto out_unlock; 373 374 /* 375 * You may not queue a frame bigger than the mtu. This is the lowest level 376 * raw protocol and you must do your own fragmentation at this level. 377 */ 378 379 err = -EMSGSIZE; 380 if (len > dev->mtu + dev->hard_header_len) 381 goto out_unlock; 382 383 err = -ENOBUFS; 384 skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL); 385 386 /* 387 * If the write buffer is full, then tough. At this level the user gets to 388 * deal with the problem - do your own algorithmic backoffs. That's far 389 * more flexible. 390 */ 391 392 if (skb == NULL) 393 goto out_unlock; 394 395 /* 396 * Fill it in 397 */ 398 399 /* FIXME: Save some space for broken drivers that write a 400 * hard header at transmission time by themselves. PPP is the 401 * notable one here. This should really be fixed at the driver level. 402 */ 403 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 404 skb->nh.raw = skb->data; 405 406 /* Try to align data part correctly */ 407 if (dev->hard_header) { 408 skb->data -= dev->hard_header_len; 409 skb->tail -= dev->hard_header_len; 410 if (len < dev->hard_header_len) 411 skb->nh.raw = skb->data; 412 } 413 414 /* Returns -EFAULT on error */ 415 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 416 skb->protocol = proto; 417 skb->dev = dev; 418 skb->priority = sk->sk_priority; 419 if (err) 420 goto out_free; 421 422 /* 423 * Now send it 424 */ 425 426 dev_queue_xmit(skb); 427 dev_put(dev); 428 return(len); 429 430 out_free: 431 kfree_skb(skb); 432 out_unlock: 433 if (dev) 434 dev_put(dev); 435 return err; 436 } 437 #endif 438 439 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk, 440 unsigned int res) 441 { 442 struct sk_filter *filter; 443 444 rcu_read_lock_bh(); 445 filter = rcu_dereference(sk->sk_filter); 446 if (filter != NULL) 447 res = sk_run_filter(skb, filter->insns, filter->len); 448 rcu_read_unlock_bh(); 449 450 return res; 451 } 452 453 /* 454 This function makes lazy skb cloning in hope that most of packets 455 are discarded by BPF. 456 457 Note tricky part: we DO mangle shared skb! skb->data, skb->len 458 and skb->cb are mangled. It works because (and until) packets 459 falling here are owned by current CPU. Output packets are cloned 460 by dev_queue_xmit_nit(), input packets are processed by net_bh 461 sequencially, so that if we return skb to original state on exit, 462 we will not harm anyone. 463 */ 464 465 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 466 { 467 struct sock *sk; 468 struct sockaddr_ll *sll; 469 struct packet_sock *po; 470 u8 * skb_head = skb->data; 471 int skb_len = skb->len; 472 unsigned int snaplen, res; 473 474 if (skb->pkt_type == PACKET_LOOPBACK) 475 goto drop; 476 477 sk = pt->af_packet_priv; 478 po = pkt_sk(sk); 479 480 skb->dev = dev; 481 482 if (dev->hard_header) { 483 /* The device has an explicit notion of ll header, 484 exported to higher levels. 485 486 Otherwise, the device hides datails of it frame 487 structure, so that corresponding packet head 488 never delivered to user. 489 */ 490 if (sk->sk_type != SOCK_DGRAM) 491 skb_push(skb, skb->data - skb->mac.raw); 492 else if (skb->pkt_type == PACKET_OUTGOING) { 493 /* Special case: outgoing packets have ll header at head */ 494 skb_pull(skb, skb->nh.raw - skb->data); 495 } 496 } 497 498 snaplen = skb->len; 499 500 res = run_filter(skb, sk, snaplen); 501 if (!res) 502 goto drop_n_restore; 503 if (snaplen > res) 504 snaplen = res; 505 506 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >= 507 (unsigned)sk->sk_rcvbuf) 508 goto drop_n_acct; 509 510 if (skb_shared(skb)) { 511 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); 512 if (nskb == NULL) 513 goto drop_n_acct; 514 515 if (skb_head != skb->data) { 516 skb->data = skb_head; 517 skb->len = skb_len; 518 } 519 kfree_skb(skb); 520 skb = nskb; 521 } 522 523 BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 > 524 sizeof(skb->cb)); 525 526 sll = &PACKET_SKB_CB(skb)->sa.ll; 527 sll->sll_family = AF_PACKET; 528 sll->sll_hatype = dev->type; 529 sll->sll_protocol = skb->protocol; 530 sll->sll_pkttype = skb->pkt_type; 531 sll->sll_ifindex = dev->ifindex; 532 sll->sll_halen = 0; 533 534 if (dev->hard_header_parse) 535 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr); 536 537 PACKET_SKB_CB(skb)->origlen = skb->len; 538 539 if (pskb_trim(skb, snaplen)) 540 goto drop_n_acct; 541 542 skb_set_owner_r(skb, sk); 543 skb->dev = NULL; 544 dst_release(skb->dst); 545 skb->dst = NULL; 546 547 /* drop conntrack reference */ 548 nf_reset(skb); 549 550 spin_lock(&sk->sk_receive_queue.lock); 551 po->stats.tp_packets++; 552 __skb_queue_tail(&sk->sk_receive_queue, skb); 553 spin_unlock(&sk->sk_receive_queue.lock); 554 sk->sk_data_ready(sk, skb->len); 555 return 0; 556 557 drop_n_acct: 558 spin_lock(&sk->sk_receive_queue.lock); 559 po->stats.tp_drops++; 560 spin_unlock(&sk->sk_receive_queue.lock); 561 562 drop_n_restore: 563 if (skb_head != skb->data && skb_shared(skb)) { 564 skb->data = skb_head; 565 skb->len = skb_len; 566 } 567 drop: 568 kfree_skb(skb); 569 return 0; 570 } 571 572 #ifdef CONFIG_PACKET_MMAP 573 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 574 { 575 struct sock *sk; 576 struct packet_sock *po; 577 struct sockaddr_ll *sll; 578 struct tpacket_hdr *h; 579 u8 * skb_head = skb->data; 580 int skb_len = skb->len; 581 unsigned int snaplen, res; 582 unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER; 583 unsigned short macoff, netoff; 584 struct sk_buff *copy_skb = NULL; 585 586 if (skb->pkt_type == PACKET_LOOPBACK) 587 goto drop; 588 589 sk = pt->af_packet_priv; 590 po = pkt_sk(sk); 591 592 if (dev->hard_header) { 593 if (sk->sk_type != SOCK_DGRAM) 594 skb_push(skb, skb->data - skb->mac.raw); 595 else if (skb->pkt_type == PACKET_OUTGOING) { 596 /* Special case: outgoing packets have ll header at head */ 597 skb_pull(skb, skb->nh.raw - skb->data); 598 } 599 } 600 601 if (skb->ip_summed == CHECKSUM_PARTIAL) 602 status |= TP_STATUS_CSUMNOTREADY; 603 604 snaplen = skb->len; 605 606 res = run_filter(skb, sk, snaplen); 607 if (!res) 608 goto drop_n_restore; 609 if (snaplen > res) 610 snaplen = res; 611 612 if (sk->sk_type == SOCK_DGRAM) { 613 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16; 614 } else { 615 unsigned maclen = skb->nh.raw - skb->data; 616 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen)); 617 macoff = netoff - maclen; 618 } 619 620 if (macoff + snaplen > po->frame_size) { 621 if (po->copy_thresh && 622 atomic_read(&sk->sk_rmem_alloc) + skb->truesize < 623 (unsigned)sk->sk_rcvbuf) { 624 if (skb_shared(skb)) { 625 copy_skb = skb_clone(skb, GFP_ATOMIC); 626 } else { 627 copy_skb = skb_get(skb); 628 skb_head = skb->data; 629 } 630 if (copy_skb) 631 skb_set_owner_r(copy_skb, sk); 632 } 633 snaplen = po->frame_size - macoff; 634 if ((int)snaplen < 0) 635 snaplen = 0; 636 } 637 638 spin_lock(&sk->sk_receive_queue.lock); 639 h = packet_lookup_frame(po, po->head); 640 641 if (h->tp_status) 642 goto ring_is_full; 643 po->head = po->head != po->frame_max ? po->head+1 : 0; 644 po->stats.tp_packets++; 645 if (copy_skb) { 646 status |= TP_STATUS_COPY; 647 __skb_queue_tail(&sk->sk_receive_queue, copy_skb); 648 } 649 if (!po->stats.tp_drops) 650 status &= ~TP_STATUS_LOSING; 651 spin_unlock(&sk->sk_receive_queue.lock); 652 653 skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen); 654 655 h->tp_len = skb->len; 656 h->tp_snaplen = snaplen; 657 h->tp_mac = macoff; 658 h->tp_net = netoff; 659 if (skb->tstamp.off_sec == 0) { 660 __net_timestamp(skb); 661 sock_enable_timestamp(sk); 662 } 663 h->tp_sec = skb->tstamp.off_sec; 664 h->tp_usec = skb->tstamp.off_usec; 665 666 sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h))); 667 sll->sll_halen = 0; 668 if (dev->hard_header_parse) 669 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr); 670 sll->sll_family = AF_PACKET; 671 sll->sll_hatype = dev->type; 672 sll->sll_protocol = skb->protocol; 673 sll->sll_pkttype = skb->pkt_type; 674 sll->sll_ifindex = dev->ifindex; 675 676 h->tp_status = status; 677 smp_mb(); 678 679 { 680 struct page *p_start, *p_end; 681 u8 *h_end = (u8 *)h + macoff + snaplen - 1; 682 683 p_start = virt_to_page(h); 684 p_end = virt_to_page(h_end); 685 while (p_start <= p_end) { 686 flush_dcache_page(p_start); 687 p_start++; 688 } 689 } 690 691 sk->sk_data_ready(sk, 0); 692 693 drop_n_restore: 694 if (skb_head != skb->data && skb_shared(skb)) { 695 skb->data = skb_head; 696 skb->len = skb_len; 697 } 698 drop: 699 kfree_skb(skb); 700 return 0; 701 702 ring_is_full: 703 po->stats.tp_drops++; 704 spin_unlock(&sk->sk_receive_queue.lock); 705 706 sk->sk_data_ready(sk, 0); 707 if (copy_skb) 708 kfree_skb(copy_skb); 709 goto drop_n_restore; 710 } 711 712 #endif 713 714 715 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock, 716 struct msghdr *msg, size_t len) 717 { 718 struct sock *sk = sock->sk; 719 struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name; 720 struct sk_buff *skb; 721 struct net_device *dev; 722 __be16 proto; 723 unsigned char *addr; 724 int ifindex, err, reserve = 0; 725 726 /* 727 * Get and verify the address. 728 */ 729 730 if (saddr == NULL) { 731 struct packet_sock *po = pkt_sk(sk); 732 733 ifindex = po->ifindex; 734 proto = po->num; 735 addr = NULL; 736 } else { 737 err = -EINVAL; 738 if (msg->msg_namelen < sizeof(struct sockaddr_ll)) 739 goto out; 740 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) 741 goto out; 742 ifindex = saddr->sll_ifindex; 743 proto = saddr->sll_protocol; 744 addr = saddr->sll_addr; 745 } 746 747 748 dev = dev_get_by_index(ifindex); 749 err = -ENXIO; 750 if (dev == NULL) 751 goto out_unlock; 752 if (sock->type == SOCK_RAW) 753 reserve = dev->hard_header_len; 754 755 err = -ENETDOWN; 756 if (!(dev->flags & IFF_UP)) 757 goto out_unlock; 758 759 err = -EMSGSIZE; 760 if (len > dev->mtu+reserve) 761 goto out_unlock; 762 763 skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev), 764 msg->msg_flags & MSG_DONTWAIT, &err); 765 if (skb==NULL) 766 goto out_unlock; 767 768 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 769 skb->nh.raw = skb->data; 770 771 if (dev->hard_header) { 772 int res; 773 err = -EINVAL; 774 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len); 775 if (sock->type != SOCK_DGRAM) { 776 skb->tail = skb->data; 777 skb->len = 0; 778 } else if (res < 0) 779 goto out_free; 780 } 781 782 /* Returns -EFAULT on error */ 783 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 784 if (err) 785 goto out_free; 786 787 skb->protocol = proto; 788 skb->dev = dev; 789 skb->priority = sk->sk_priority; 790 791 /* 792 * Now send it 793 */ 794 795 err = dev_queue_xmit(skb); 796 if (err > 0 && (err = net_xmit_errno(err)) != 0) 797 goto out_unlock; 798 799 dev_put(dev); 800 801 return(len); 802 803 out_free: 804 kfree_skb(skb); 805 out_unlock: 806 if (dev) 807 dev_put(dev); 808 out: 809 return err; 810 } 811 812 /* 813 * Close a PACKET socket. This is fairly simple. We immediately go 814 * to 'closed' state and remove our protocol entry in the device list. 815 */ 816 817 static int packet_release(struct socket *sock) 818 { 819 struct sock *sk = sock->sk; 820 struct packet_sock *po; 821 822 if (!sk) 823 return 0; 824 825 po = pkt_sk(sk); 826 827 write_lock_bh(&packet_sklist_lock); 828 sk_del_node_init(sk); 829 write_unlock_bh(&packet_sklist_lock); 830 831 /* 832 * Unhook packet receive handler. 833 */ 834 835 if (po->running) { 836 /* 837 * Remove the protocol hook 838 */ 839 dev_remove_pack(&po->prot_hook); 840 po->running = 0; 841 po->num = 0; 842 __sock_put(sk); 843 } 844 845 #ifdef CONFIG_PACKET_MULTICAST 846 packet_flush_mclist(sk); 847 #endif 848 849 #ifdef CONFIG_PACKET_MMAP 850 if (po->pg_vec) { 851 struct tpacket_req req; 852 memset(&req, 0, sizeof(req)); 853 packet_set_ring(sk, &req, 1); 854 } 855 #endif 856 857 /* 858 * Now the socket is dead. No more input will appear. 859 */ 860 861 sock_orphan(sk); 862 sock->sk = NULL; 863 864 /* Purge queues */ 865 866 skb_queue_purge(&sk->sk_receive_queue); 867 868 sock_put(sk); 869 return 0; 870 } 871 872 /* 873 * Attach a packet hook. 874 */ 875 876 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol) 877 { 878 struct packet_sock *po = pkt_sk(sk); 879 /* 880 * Detach an existing hook if present. 881 */ 882 883 lock_sock(sk); 884 885 spin_lock(&po->bind_lock); 886 if (po->running) { 887 __sock_put(sk); 888 po->running = 0; 889 po->num = 0; 890 spin_unlock(&po->bind_lock); 891 dev_remove_pack(&po->prot_hook); 892 spin_lock(&po->bind_lock); 893 } 894 895 po->num = protocol; 896 po->prot_hook.type = protocol; 897 po->prot_hook.dev = dev; 898 899 po->ifindex = dev ? dev->ifindex : 0; 900 901 if (protocol == 0) 902 goto out_unlock; 903 904 if (dev) { 905 if (dev->flags&IFF_UP) { 906 dev_add_pack(&po->prot_hook); 907 sock_hold(sk); 908 po->running = 1; 909 } else { 910 sk->sk_err = ENETDOWN; 911 if (!sock_flag(sk, SOCK_DEAD)) 912 sk->sk_error_report(sk); 913 } 914 } else { 915 dev_add_pack(&po->prot_hook); 916 sock_hold(sk); 917 po->running = 1; 918 } 919 920 out_unlock: 921 spin_unlock(&po->bind_lock); 922 release_sock(sk); 923 return 0; 924 } 925 926 /* 927 * Bind a packet socket to a device 928 */ 929 930 #ifdef CONFIG_SOCK_PACKET 931 932 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len) 933 { 934 struct sock *sk=sock->sk; 935 char name[15]; 936 struct net_device *dev; 937 int err = -ENODEV; 938 939 /* 940 * Check legality 941 */ 942 943 if (addr_len != sizeof(struct sockaddr)) 944 return -EINVAL; 945 strlcpy(name,uaddr->sa_data,sizeof(name)); 946 947 dev = dev_get_by_name(name); 948 if (dev) { 949 err = packet_do_bind(sk, dev, pkt_sk(sk)->num); 950 dev_put(dev); 951 } 952 return err; 953 } 954 #endif 955 956 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) 957 { 958 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr; 959 struct sock *sk=sock->sk; 960 struct net_device *dev = NULL; 961 int err; 962 963 964 /* 965 * Check legality 966 */ 967 968 if (addr_len < sizeof(struct sockaddr_ll)) 969 return -EINVAL; 970 if (sll->sll_family != AF_PACKET) 971 return -EINVAL; 972 973 if (sll->sll_ifindex) { 974 err = -ENODEV; 975 dev = dev_get_by_index(sll->sll_ifindex); 976 if (dev == NULL) 977 goto out; 978 } 979 err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); 980 if (dev) 981 dev_put(dev); 982 983 out: 984 return err; 985 } 986 987 static struct proto packet_proto = { 988 .name = "PACKET", 989 .owner = THIS_MODULE, 990 .obj_size = sizeof(struct packet_sock), 991 }; 992 993 /* 994 * Create a packet of type SOCK_PACKET. 995 */ 996 997 static int packet_create(struct socket *sock, int protocol) 998 { 999 struct sock *sk; 1000 struct packet_sock *po; 1001 __be16 proto = (__force __be16)protocol; /* weird, but documented */ 1002 int err; 1003 1004 if (!capable(CAP_NET_RAW)) 1005 return -EPERM; 1006 if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW 1007 #ifdef CONFIG_SOCK_PACKET 1008 && sock->type != SOCK_PACKET 1009 #endif 1010 ) 1011 return -ESOCKTNOSUPPORT; 1012 1013 sock->state = SS_UNCONNECTED; 1014 1015 err = -ENOBUFS; 1016 sk = sk_alloc(PF_PACKET, GFP_KERNEL, &packet_proto, 1); 1017 if (sk == NULL) 1018 goto out; 1019 1020 sock->ops = &packet_ops; 1021 #ifdef CONFIG_SOCK_PACKET 1022 if (sock->type == SOCK_PACKET) 1023 sock->ops = &packet_ops_spkt; 1024 #endif 1025 sock_init_data(sock, sk); 1026 1027 po = pkt_sk(sk); 1028 sk->sk_family = PF_PACKET; 1029 po->num = proto; 1030 1031 sk->sk_destruct = packet_sock_destruct; 1032 atomic_inc(&packet_socks_nr); 1033 1034 /* 1035 * Attach a protocol block 1036 */ 1037 1038 spin_lock_init(&po->bind_lock); 1039 po->prot_hook.func = packet_rcv; 1040 #ifdef CONFIG_SOCK_PACKET 1041 if (sock->type == SOCK_PACKET) 1042 po->prot_hook.func = packet_rcv_spkt; 1043 #endif 1044 po->prot_hook.af_packet_priv = sk; 1045 1046 if (proto) { 1047 po->prot_hook.type = proto; 1048 dev_add_pack(&po->prot_hook); 1049 sock_hold(sk); 1050 po->running = 1; 1051 } 1052 1053 write_lock_bh(&packet_sklist_lock); 1054 sk_add_node(sk, &packet_sklist); 1055 write_unlock_bh(&packet_sklist_lock); 1056 return(0); 1057 out: 1058 return err; 1059 } 1060 1061 /* 1062 * Pull a packet from our receive queue and hand it to the user. 1063 * If necessary we block. 1064 */ 1065 1066 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock, 1067 struct msghdr *msg, size_t len, int flags) 1068 { 1069 struct sock *sk = sock->sk; 1070 struct sk_buff *skb; 1071 int copied, err; 1072 struct sockaddr_ll *sll; 1073 1074 err = -EINVAL; 1075 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) 1076 goto out; 1077 1078 #if 0 1079 /* What error should we return now? EUNATTACH? */ 1080 if (pkt_sk(sk)->ifindex < 0) 1081 return -ENODEV; 1082 #endif 1083 1084 /* 1085 * Call the generic datagram receiver. This handles all sorts 1086 * of horrible races and re-entrancy so we can forget about it 1087 * in the protocol layers. 1088 * 1089 * Now it will return ENETDOWN, if device have just gone down, 1090 * but then it will block. 1091 */ 1092 1093 skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err); 1094 1095 /* 1096 * An error occurred so return it. Because skb_recv_datagram() 1097 * handles the blocking we don't see and worry about blocking 1098 * retries. 1099 */ 1100 1101 if (skb == NULL) 1102 goto out; 1103 1104 /* 1105 * If the address length field is there to be filled in, we fill 1106 * it in now. 1107 */ 1108 1109 sll = &PACKET_SKB_CB(skb)->sa.ll; 1110 if (sock->type == SOCK_PACKET) 1111 msg->msg_namelen = sizeof(struct sockaddr_pkt); 1112 else 1113 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr); 1114 1115 /* 1116 * You lose any data beyond the buffer you gave. If it worries a 1117 * user program they can ask the device for its MTU anyway. 1118 */ 1119 1120 copied = skb->len; 1121 if (copied > len) 1122 { 1123 copied=len; 1124 msg->msg_flags|=MSG_TRUNC; 1125 } 1126 1127 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 1128 if (err) 1129 goto out_free; 1130 1131 sock_recv_timestamp(msg, sk, skb); 1132 1133 if (msg->msg_name) 1134 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, 1135 msg->msg_namelen); 1136 1137 if (pkt_sk(sk)->auxdata) { 1138 struct tpacket_auxdata aux; 1139 1140 aux.tp_status = TP_STATUS_USER; 1141 if (skb->ip_summed == CHECKSUM_PARTIAL) 1142 aux.tp_status |= TP_STATUS_CSUMNOTREADY; 1143 aux.tp_len = PACKET_SKB_CB(skb)->origlen; 1144 aux.tp_snaplen = skb->len; 1145 aux.tp_mac = 0; 1146 aux.tp_net = skb->nh.raw - skb->data; 1147 1148 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux); 1149 } 1150 1151 /* 1152 * Free or return the buffer as appropriate. Again this 1153 * hides all the races and re-entrancy issues from us. 1154 */ 1155 err = (flags&MSG_TRUNC) ? skb->len : copied; 1156 1157 out_free: 1158 skb_free_datagram(sk, skb); 1159 out: 1160 return err; 1161 } 1162 1163 #ifdef CONFIG_SOCK_PACKET 1164 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, 1165 int *uaddr_len, int peer) 1166 { 1167 struct net_device *dev; 1168 struct sock *sk = sock->sk; 1169 1170 if (peer) 1171 return -EOPNOTSUPP; 1172 1173 uaddr->sa_family = AF_PACKET; 1174 dev = dev_get_by_index(pkt_sk(sk)->ifindex); 1175 if (dev) { 1176 strlcpy(uaddr->sa_data, dev->name, 15); 1177 dev_put(dev); 1178 } else 1179 memset(uaddr->sa_data, 0, 14); 1180 *uaddr_len = sizeof(*uaddr); 1181 1182 return 0; 1183 } 1184 #endif 1185 1186 static int packet_getname(struct socket *sock, struct sockaddr *uaddr, 1187 int *uaddr_len, int peer) 1188 { 1189 struct net_device *dev; 1190 struct sock *sk = sock->sk; 1191 struct packet_sock *po = pkt_sk(sk); 1192 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr; 1193 1194 if (peer) 1195 return -EOPNOTSUPP; 1196 1197 sll->sll_family = AF_PACKET; 1198 sll->sll_ifindex = po->ifindex; 1199 sll->sll_protocol = po->num; 1200 dev = dev_get_by_index(po->ifindex); 1201 if (dev) { 1202 sll->sll_hatype = dev->type; 1203 sll->sll_halen = dev->addr_len; 1204 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len); 1205 dev_put(dev); 1206 } else { 1207 sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */ 1208 sll->sll_halen = 0; 1209 } 1210 *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen; 1211 1212 return 0; 1213 } 1214 1215 #ifdef CONFIG_PACKET_MULTICAST 1216 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what) 1217 { 1218 switch (i->type) { 1219 case PACKET_MR_MULTICAST: 1220 if (what > 0) 1221 dev_mc_add(dev, i->addr, i->alen, 0); 1222 else 1223 dev_mc_delete(dev, i->addr, i->alen, 0); 1224 break; 1225 case PACKET_MR_PROMISC: 1226 dev_set_promiscuity(dev, what); 1227 break; 1228 case PACKET_MR_ALLMULTI: 1229 dev_set_allmulti(dev, what); 1230 break; 1231 default:; 1232 } 1233 } 1234 1235 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what) 1236 { 1237 for ( ; i; i=i->next) { 1238 if (i->ifindex == dev->ifindex) 1239 packet_dev_mc(dev, i, what); 1240 } 1241 } 1242 1243 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) 1244 { 1245 struct packet_sock *po = pkt_sk(sk); 1246 struct packet_mclist *ml, *i; 1247 struct net_device *dev; 1248 int err; 1249 1250 rtnl_lock(); 1251 1252 err = -ENODEV; 1253 dev = __dev_get_by_index(mreq->mr_ifindex); 1254 if (!dev) 1255 goto done; 1256 1257 err = -EINVAL; 1258 if (mreq->mr_alen > dev->addr_len) 1259 goto done; 1260 1261 err = -ENOBUFS; 1262 i = kmalloc(sizeof(*i), GFP_KERNEL); 1263 if (i == NULL) 1264 goto done; 1265 1266 err = 0; 1267 for (ml = po->mclist; ml; ml = ml->next) { 1268 if (ml->ifindex == mreq->mr_ifindex && 1269 ml->type == mreq->mr_type && 1270 ml->alen == mreq->mr_alen && 1271 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) { 1272 ml->count++; 1273 /* Free the new element ... */ 1274 kfree(i); 1275 goto done; 1276 } 1277 } 1278 1279 i->type = mreq->mr_type; 1280 i->ifindex = mreq->mr_ifindex; 1281 i->alen = mreq->mr_alen; 1282 memcpy(i->addr, mreq->mr_address, i->alen); 1283 i->count = 1; 1284 i->next = po->mclist; 1285 po->mclist = i; 1286 packet_dev_mc(dev, i, +1); 1287 1288 done: 1289 rtnl_unlock(); 1290 return err; 1291 } 1292 1293 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq) 1294 { 1295 struct packet_mclist *ml, **mlp; 1296 1297 rtnl_lock(); 1298 1299 for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) { 1300 if (ml->ifindex == mreq->mr_ifindex && 1301 ml->type == mreq->mr_type && 1302 ml->alen == mreq->mr_alen && 1303 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) { 1304 if (--ml->count == 0) { 1305 struct net_device *dev; 1306 *mlp = ml->next; 1307 dev = dev_get_by_index(ml->ifindex); 1308 if (dev) { 1309 packet_dev_mc(dev, ml, -1); 1310 dev_put(dev); 1311 } 1312 kfree(ml); 1313 } 1314 rtnl_unlock(); 1315 return 0; 1316 } 1317 } 1318 rtnl_unlock(); 1319 return -EADDRNOTAVAIL; 1320 } 1321 1322 static void packet_flush_mclist(struct sock *sk) 1323 { 1324 struct packet_sock *po = pkt_sk(sk); 1325 struct packet_mclist *ml; 1326 1327 if (!po->mclist) 1328 return; 1329 1330 rtnl_lock(); 1331 while ((ml = po->mclist) != NULL) { 1332 struct net_device *dev; 1333 1334 po->mclist = ml->next; 1335 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) { 1336 packet_dev_mc(dev, ml, -1); 1337 dev_put(dev); 1338 } 1339 kfree(ml); 1340 } 1341 rtnl_unlock(); 1342 } 1343 #endif 1344 1345 static int 1346 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen) 1347 { 1348 struct sock *sk = sock->sk; 1349 struct packet_sock *po = pkt_sk(sk); 1350 int ret; 1351 1352 if (level != SOL_PACKET) 1353 return -ENOPROTOOPT; 1354 1355 switch(optname) { 1356 #ifdef CONFIG_PACKET_MULTICAST 1357 case PACKET_ADD_MEMBERSHIP: 1358 case PACKET_DROP_MEMBERSHIP: 1359 { 1360 struct packet_mreq_max mreq; 1361 int len = optlen; 1362 memset(&mreq, 0, sizeof(mreq)); 1363 if (len < sizeof(struct packet_mreq)) 1364 return -EINVAL; 1365 if (len > sizeof(mreq)) 1366 len = sizeof(mreq); 1367 if (copy_from_user(&mreq,optval,len)) 1368 return -EFAULT; 1369 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address))) 1370 return -EINVAL; 1371 if (optname == PACKET_ADD_MEMBERSHIP) 1372 ret = packet_mc_add(sk, &mreq); 1373 else 1374 ret = packet_mc_drop(sk, &mreq); 1375 return ret; 1376 } 1377 #endif 1378 #ifdef CONFIG_PACKET_MMAP 1379 case PACKET_RX_RING: 1380 { 1381 struct tpacket_req req; 1382 1383 if (optlen<sizeof(req)) 1384 return -EINVAL; 1385 if (copy_from_user(&req,optval,sizeof(req))) 1386 return -EFAULT; 1387 return packet_set_ring(sk, &req, 0); 1388 } 1389 case PACKET_COPY_THRESH: 1390 { 1391 int val; 1392 1393 if (optlen!=sizeof(val)) 1394 return -EINVAL; 1395 if (copy_from_user(&val,optval,sizeof(val))) 1396 return -EFAULT; 1397 1398 pkt_sk(sk)->copy_thresh = val; 1399 return 0; 1400 } 1401 #endif 1402 case PACKET_AUXDATA: 1403 { 1404 int val; 1405 1406 if (optlen < sizeof(val)) 1407 return -EINVAL; 1408 if (copy_from_user(&val, optval, sizeof(val))) 1409 return -EFAULT; 1410 1411 po->auxdata = !!val; 1412 return 0; 1413 } 1414 default: 1415 return -ENOPROTOOPT; 1416 } 1417 } 1418 1419 static int packet_getsockopt(struct socket *sock, int level, int optname, 1420 char __user *optval, int __user *optlen) 1421 { 1422 int len; 1423 int val; 1424 struct sock *sk = sock->sk; 1425 struct packet_sock *po = pkt_sk(sk); 1426 void *data; 1427 struct tpacket_stats st; 1428 1429 if (level != SOL_PACKET) 1430 return -ENOPROTOOPT; 1431 1432 if (get_user(len, optlen)) 1433 return -EFAULT; 1434 1435 if (len < 0) 1436 return -EINVAL; 1437 1438 switch(optname) { 1439 case PACKET_STATISTICS: 1440 if (len > sizeof(struct tpacket_stats)) 1441 len = sizeof(struct tpacket_stats); 1442 spin_lock_bh(&sk->sk_receive_queue.lock); 1443 st = po->stats; 1444 memset(&po->stats, 0, sizeof(st)); 1445 spin_unlock_bh(&sk->sk_receive_queue.lock); 1446 st.tp_packets += st.tp_drops; 1447 1448 data = &st; 1449 break; 1450 case PACKET_AUXDATA: 1451 if (len > sizeof(int)) 1452 len = sizeof(int); 1453 val = po->auxdata; 1454 1455 data = &val; 1456 break; 1457 default: 1458 return -ENOPROTOOPT; 1459 } 1460 1461 if (put_user(len, optlen)) 1462 return -EFAULT; 1463 if (copy_to_user(optval, data, len)) 1464 return -EFAULT; 1465 return 0; 1466 } 1467 1468 1469 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data) 1470 { 1471 struct sock *sk; 1472 struct hlist_node *node; 1473 struct net_device *dev = data; 1474 1475 read_lock(&packet_sklist_lock); 1476 sk_for_each(sk, node, &packet_sklist) { 1477 struct packet_sock *po = pkt_sk(sk); 1478 1479 switch (msg) { 1480 case NETDEV_UNREGISTER: 1481 #ifdef CONFIG_PACKET_MULTICAST 1482 if (po->mclist) 1483 packet_dev_mclist(dev, po->mclist, -1); 1484 // fallthrough 1485 #endif 1486 case NETDEV_DOWN: 1487 if (dev->ifindex == po->ifindex) { 1488 spin_lock(&po->bind_lock); 1489 if (po->running) { 1490 __dev_remove_pack(&po->prot_hook); 1491 __sock_put(sk); 1492 po->running = 0; 1493 sk->sk_err = ENETDOWN; 1494 if (!sock_flag(sk, SOCK_DEAD)) 1495 sk->sk_error_report(sk); 1496 } 1497 if (msg == NETDEV_UNREGISTER) { 1498 po->ifindex = -1; 1499 po->prot_hook.dev = NULL; 1500 } 1501 spin_unlock(&po->bind_lock); 1502 } 1503 break; 1504 case NETDEV_UP: 1505 spin_lock(&po->bind_lock); 1506 if (dev->ifindex == po->ifindex && po->num && 1507 !po->running) { 1508 dev_add_pack(&po->prot_hook); 1509 sock_hold(sk); 1510 po->running = 1; 1511 } 1512 spin_unlock(&po->bind_lock); 1513 break; 1514 } 1515 } 1516 read_unlock(&packet_sklist_lock); 1517 return NOTIFY_DONE; 1518 } 1519 1520 1521 static int packet_ioctl(struct socket *sock, unsigned int cmd, 1522 unsigned long arg) 1523 { 1524 struct sock *sk = sock->sk; 1525 1526 switch(cmd) { 1527 case SIOCOUTQ: 1528 { 1529 int amount = atomic_read(&sk->sk_wmem_alloc); 1530 return put_user(amount, (int __user *)arg); 1531 } 1532 case SIOCINQ: 1533 { 1534 struct sk_buff *skb; 1535 int amount = 0; 1536 1537 spin_lock_bh(&sk->sk_receive_queue.lock); 1538 skb = skb_peek(&sk->sk_receive_queue); 1539 if (skb) 1540 amount = skb->len; 1541 spin_unlock_bh(&sk->sk_receive_queue.lock); 1542 return put_user(amount, (int __user *)arg); 1543 } 1544 case SIOCGSTAMP: 1545 return sock_get_timestamp(sk, (struct timeval __user *)arg); 1546 1547 #ifdef CONFIG_INET 1548 case SIOCADDRT: 1549 case SIOCDELRT: 1550 case SIOCDARP: 1551 case SIOCGARP: 1552 case SIOCSARP: 1553 case SIOCGIFADDR: 1554 case SIOCSIFADDR: 1555 case SIOCGIFBRDADDR: 1556 case SIOCSIFBRDADDR: 1557 case SIOCGIFNETMASK: 1558 case SIOCSIFNETMASK: 1559 case SIOCGIFDSTADDR: 1560 case SIOCSIFDSTADDR: 1561 case SIOCSIFFLAGS: 1562 return inet_dgram_ops.ioctl(sock, cmd, arg); 1563 #endif 1564 1565 default: 1566 return -ENOIOCTLCMD; 1567 } 1568 return 0; 1569 } 1570 1571 #ifndef CONFIG_PACKET_MMAP 1572 #define packet_mmap sock_no_mmap 1573 #define packet_poll datagram_poll 1574 #else 1575 1576 static unsigned int packet_poll(struct file * file, struct socket *sock, 1577 poll_table *wait) 1578 { 1579 struct sock *sk = sock->sk; 1580 struct packet_sock *po = pkt_sk(sk); 1581 unsigned int mask = datagram_poll(file, sock, wait); 1582 1583 spin_lock_bh(&sk->sk_receive_queue.lock); 1584 if (po->pg_vec) { 1585 unsigned last = po->head ? po->head-1 : po->frame_max; 1586 struct tpacket_hdr *h; 1587 1588 h = packet_lookup_frame(po, last); 1589 1590 if (h->tp_status) 1591 mask |= POLLIN | POLLRDNORM; 1592 } 1593 spin_unlock_bh(&sk->sk_receive_queue.lock); 1594 return mask; 1595 } 1596 1597 1598 /* Dirty? Well, I still did not learn better way to account 1599 * for user mmaps. 1600 */ 1601 1602 static void packet_mm_open(struct vm_area_struct *vma) 1603 { 1604 struct file *file = vma->vm_file; 1605 struct socket * sock = file->private_data; 1606 struct sock *sk = sock->sk; 1607 1608 if (sk) 1609 atomic_inc(&pkt_sk(sk)->mapped); 1610 } 1611 1612 static void packet_mm_close(struct vm_area_struct *vma) 1613 { 1614 struct file *file = vma->vm_file; 1615 struct socket * sock = file->private_data; 1616 struct sock *sk = sock->sk; 1617 1618 if (sk) 1619 atomic_dec(&pkt_sk(sk)->mapped); 1620 } 1621 1622 static struct vm_operations_struct packet_mmap_ops = { 1623 .open = packet_mm_open, 1624 .close =packet_mm_close, 1625 }; 1626 1627 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order) 1628 { 1629 return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1); 1630 } 1631 1632 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len) 1633 { 1634 int i; 1635 1636 for (i = 0; i < len; i++) { 1637 if (likely(pg_vec[i])) 1638 free_pages((unsigned long) pg_vec[i], order); 1639 } 1640 kfree(pg_vec); 1641 } 1642 1643 static inline char *alloc_one_pg_vec_page(unsigned long order) 1644 { 1645 return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO, 1646 order); 1647 } 1648 1649 static char **alloc_pg_vec(struct tpacket_req *req, int order) 1650 { 1651 unsigned int block_nr = req->tp_block_nr; 1652 char **pg_vec; 1653 int i; 1654 1655 pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL); 1656 if (unlikely(!pg_vec)) 1657 goto out; 1658 1659 for (i = 0; i < block_nr; i++) { 1660 pg_vec[i] = alloc_one_pg_vec_page(order); 1661 if (unlikely(!pg_vec[i])) 1662 goto out_free_pgvec; 1663 } 1664 1665 out: 1666 return pg_vec; 1667 1668 out_free_pgvec: 1669 free_pg_vec(pg_vec, order, block_nr); 1670 pg_vec = NULL; 1671 goto out; 1672 } 1673 1674 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing) 1675 { 1676 char **pg_vec = NULL; 1677 struct packet_sock *po = pkt_sk(sk); 1678 int was_running, order = 0; 1679 __be16 num; 1680 int err = 0; 1681 1682 if (req->tp_block_nr) { 1683 int i, l; 1684 1685 /* Sanity tests and some calculations */ 1686 1687 if (unlikely(po->pg_vec)) 1688 return -EBUSY; 1689 1690 if (unlikely((int)req->tp_block_size <= 0)) 1691 return -EINVAL; 1692 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) 1693 return -EINVAL; 1694 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN)) 1695 return -EINVAL; 1696 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) 1697 return -EINVAL; 1698 1699 po->frames_per_block = req->tp_block_size/req->tp_frame_size; 1700 if (unlikely(po->frames_per_block <= 0)) 1701 return -EINVAL; 1702 if (unlikely((po->frames_per_block * req->tp_block_nr) != 1703 req->tp_frame_nr)) 1704 return -EINVAL; 1705 1706 err = -ENOMEM; 1707 order = get_order(req->tp_block_size); 1708 pg_vec = alloc_pg_vec(req, order); 1709 if (unlikely(!pg_vec)) 1710 goto out; 1711 1712 l = 0; 1713 for (i = 0; i < req->tp_block_nr; i++) { 1714 char *ptr = pg_vec[i]; 1715 struct tpacket_hdr *header; 1716 int k; 1717 1718 for (k = 0; k < po->frames_per_block; k++) { 1719 header = (struct tpacket_hdr *) ptr; 1720 header->tp_status = TP_STATUS_KERNEL; 1721 ptr += req->tp_frame_size; 1722 } 1723 } 1724 /* Done */ 1725 } else { 1726 if (unlikely(req->tp_frame_nr)) 1727 return -EINVAL; 1728 } 1729 1730 lock_sock(sk); 1731 1732 /* Detach socket from network */ 1733 spin_lock(&po->bind_lock); 1734 was_running = po->running; 1735 num = po->num; 1736 if (was_running) { 1737 __dev_remove_pack(&po->prot_hook); 1738 po->num = 0; 1739 po->running = 0; 1740 __sock_put(sk); 1741 } 1742 spin_unlock(&po->bind_lock); 1743 1744 synchronize_net(); 1745 1746 err = -EBUSY; 1747 if (closing || atomic_read(&po->mapped) == 0) { 1748 err = 0; 1749 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; }) 1750 1751 spin_lock_bh(&sk->sk_receive_queue.lock); 1752 pg_vec = XC(po->pg_vec, pg_vec); 1753 po->frame_max = (req->tp_frame_nr - 1); 1754 po->head = 0; 1755 po->frame_size = req->tp_frame_size; 1756 spin_unlock_bh(&sk->sk_receive_queue.lock); 1757 1758 order = XC(po->pg_vec_order, order); 1759 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr); 1760 1761 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE; 1762 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv; 1763 skb_queue_purge(&sk->sk_receive_queue); 1764 #undef XC 1765 if (atomic_read(&po->mapped)) 1766 printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped)); 1767 } 1768 1769 spin_lock(&po->bind_lock); 1770 if (was_running && !po->running) { 1771 sock_hold(sk); 1772 po->running = 1; 1773 po->num = num; 1774 dev_add_pack(&po->prot_hook); 1775 } 1776 spin_unlock(&po->bind_lock); 1777 1778 release_sock(sk); 1779 1780 if (pg_vec) 1781 free_pg_vec(pg_vec, order, req->tp_block_nr); 1782 out: 1783 return err; 1784 } 1785 1786 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma) 1787 { 1788 struct sock *sk = sock->sk; 1789 struct packet_sock *po = pkt_sk(sk); 1790 unsigned long size; 1791 unsigned long start; 1792 int err = -EINVAL; 1793 int i; 1794 1795 if (vma->vm_pgoff) 1796 return -EINVAL; 1797 1798 size = vma->vm_end - vma->vm_start; 1799 1800 lock_sock(sk); 1801 if (po->pg_vec == NULL) 1802 goto out; 1803 if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE) 1804 goto out; 1805 1806 start = vma->vm_start; 1807 for (i = 0; i < po->pg_vec_len; i++) { 1808 struct page *page = virt_to_page(po->pg_vec[i]); 1809 int pg_num; 1810 1811 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) { 1812 err = vm_insert_page(vma, start, page); 1813 if (unlikely(err)) 1814 goto out; 1815 start += PAGE_SIZE; 1816 } 1817 } 1818 atomic_inc(&po->mapped); 1819 vma->vm_ops = &packet_mmap_ops; 1820 err = 0; 1821 1822 out: 1823 release_sock(sk); 1824 return err; 1825 } 1826 #endif 1827 1828 1829 #ifdef CONFIG_SOCK_PACKET 1830 static const struct proto_ops packet_ops_spkt = { 1831 .family = PF_PACKET, 1832 .owner = THIS_MODULE, 1833 .release = packet_release, 1834 .bind = packet_bind_spkt, 1835 .connect = sock_no_connect, 1836 .socketpair = sock_no_socketpair, 1837 .accept = sock_no_accept, 1838 .getname = packet_getname_spkt, 1839 .poll = datagram_poll, 1840 .ioctl = packet_ioctl, 1841 .listen = sock_no_listen, 1842 .shutdown = sock_no_shutdown, 1843 .setsockopt = sock_no_setsockopt, 1844 .getsockopt = sock_no_getsockopt, 1845 .sendmsg = packet_sendmsg_spkt, 1846 .recvmsg = packet_recvmsg, 1847 .mmap = sock_no_mmap, 1848 .sendpage = sock_no_sendpage, 1849 }; 1850 #endif 1851 1852 static const struct proto_ops packet_ops = { 1853 .family = PF_PACKET, 1854 .owner = THIS_MODULE, 1855 .release = packet_release, 1856 .bind = packet_bind, 1857 .connect = sock_no_connect, 1858 .socketpair = sock_no_socketpair, 1859 .accept = sock_no_accept, 1860 .getname = packet_getname, 1861 .poll = packet_poll, 1862 .ioctl = packet_ioctl, 1863 .listen = sock_no_listen, 1864 .shutdown = sock_no_shutdown, 1865 .setsockopt = packet_setsockopt, 1866 .getsockopt = packet_getsockopt, 1867 .sendmsg = packet_sendmsg, 1868 .recvmsg = packet_recvmsg, 1869 .mmap = packet_mmap, 1870 .sendpage = sock_no_sendpage, 1871 }; 1872 1873 static struct net_proto_family packet_family_ops = { 1874 .family = PF_PACKET, 1875 .create = packet_create, 1876 .owner = THIS_MODULE, 1877 }; 1878 1879 static struct notifier_block packet_netdev_notifier = { 1880 .notifier_call =packet_notifier, 1881 }; 1882 1883 #ifdef CONFIG_PROC_FS 1884 static inline struct sock *packet_seq_idx(loff_t off) 1885 { 1886 struct sock *s; 1887 struct hlist_node *node; 1888 1889 sk_for_each(s, node, &packet_sklist) { 1890 if (!off--) 1891 return s; 1892 } 1893 return NULL; 1894 } 1895 1896 static void *packet_seq_start(struct seq_file *seq, loff_t *pos) 1897 { 1898 read_lock(&packet_sklist_lock); 1899 return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN; 1900 } 1901 1902 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1903 { 1904 ++*pos; 1905 return (v == SEQ_START_TOKEN) 1906 ? sk_head(&packet_sklist) 1907 : sk_next((struct sock*)v) ; 1908 } 1909 1910 static void packet_seq_stop(struct seq_file *seq, void *v) 1911 { 1912 read_unlock(&packet_sklist_lock); 1913 } 1914 1915 static int packet_seq_show(struct seq_file *seq, void *v) 1916 { 1917 if (v == SEQ_START_TOKEN) 1918 seq_puts(seq, "sk RefCnt Type Proto Iface R Rmem User Inode\n"); 1919 else { 1920 struct sock *s = v; 1921 const struct packet_sock *po = pkt_sk(s); 1922 1923 seq_printf(seq, 1924 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n", 1925 s, 1926 atomic_read(&s->sk_refcnt), 1927 s->sk_type, 1928 ntohs(po->num), 1929 po->ifindex, 1930 po->running, 1931 atomic_read(&s->sk_rmem_alloc), 1932 sock_i_uid(s), 1933 sock_i_ino(s) ); 1934 } 1935 1936 return 0; 1937 } 1938 1939 static struct seq_operations packet_seq_ops = { 1940 .start = packet_seq_start, 1941 .next = packet_seq_next, 1942 .stop = packet_seq_stop, 1943 .show = packet_seq_show, 1944 }; 1945 1946 static int packet_seq_open(struct inode *inode, struct file *file) 1947 { 1948 return seq_open(file, &packet_seq_ops); 1949 } 1950 1951 static const struct file_operations packet_seq_fops = { 1952 .owner = THIS_MODULE, 1953 .open = packet_seq_open, 1954 .read = seq_read, 1955 .llseek = seq_lseek, 1956 .release = seq_release, 1957 }; 1958 1959 #endif 1960 1961 static void __exit packet_exit(void) 1962 { 1963 proc_net_remove("packet"); 1964 unregister_netdevice_notifier(&packet_netdev_notifier); 1965 sock_unregister(PF_PACKET); 1966 proto_unregister(&packet_proto); 1967 } 1968 1969 static int __init packet_init(void) 1970 { 1971 int rc = proto_register(&packet_proto, 0); 1972 1973 if (rc != 0) 1974 goto out; 1975 1976 sock_register(&packet_family_ops); 1977 register_netdevice_notifier(&packet_netdev_notifier); 1978 proc_net_fops_create("packet", 0, &packet_seq_fops); 1979 out: 1980 return rc; 1981 } 1982 1983 module_init(packet_init); 1984 module_exit(packet_exit); 1985 MODULE_LICENSE("GPL"); 1986 MODULE_ALIAS_NETPROTO(PF_PACKET); 1987