xref: /linux/net/rxrpc/recvmsg.c (revision fd639726bf15fca8ee1a00dce8e0096d0ad9bd18)
1 /* RxRPC recvmsg() implementation
2  *
3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version
9  * 2 of the License, or (at your option) any later version.
10  */
11 
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 
14 #include <linux/net.h>
15 #include <linux/skbuff.h>
16 #include <linux/export.h>
17 #include <linux/sched/signal.h>
18 
19 #include <net/sock.h>
20 #include <net/af_rxrpc.h>
21 #include "ar-internal.h"
22 
23 /*
24  * Post a call for attention by the socket or kernel service.  Further
25  * notifications are suppressed by putting recvmsg_link on a dummy queue.
26  */
27 void rxrpc_notify_socket(struct rxrpc_call *call)
28 {
29 	struct rxrpc_sock *rx;
30 	struct sock *sk;
31 
32 	_enter("%d", call->debug_id);
33 
34 	if (!list_empty(&call->recvmsg_link))
35 		return;
36 
37 	rcu_read_lock();
38 
39 	rx = rcu_dereference(call->socket);
40 	sk = &rx->sk;
41 	if (rx && sk->sk_state < RXRPC_CLOSE) {
42 		if (call->notify_rx) {
43 			spin_lock_bh(&call->notify_lock);
44 			call->notify_rx(sk, call, call->user_call_ID);
45 			spin_unlock_bh(&call->notify_lock);
46 		} else {
47 			write_lock_bh(&rx->recvmsg_lock);
48 			if (list_empty(&call->recvmsg_link)) {
49 				rxrpc_get_call(call, rxrpc_call_got);
50 				list_add_tail(&call->recvmsg_link, &rx->recvmsg_q);
51 			}
52 			write_unlock_bh(&rx->recvmsg_lock);
53 
54 			if (!sock_flag(sk, SOCK_DEAD)) {
55 				_debug("call %ps", sk->sk_data_ready);
56 				sk->sk_data_ready(sk);
57 			}
58 		}
59 	}
60 
61 	rcu_read_unlock();
62 	_leave("");
63 }
64 
65 /*
66  * Pass a call terminating message to userspace.
67  */
68 static int rxrpc_recvmsg_term(struct rxrpc_call *call, struct msghdr *msg)
69 {
70 	u32 tmp = 0;
71 	int ret;
72 
73 	switch (call->completion) {
74 	case RXRPC_CALL_SUCCEEDED:
75 		ret = 0;
76 		if (rxrpc_is_service_call(call))
77 			ret = put_cmsg(msg, SOL_RXRPC, RXRPC_ACK, 0, &tmp);
78 		break;
79 	case RXRPC_CALL_REMOTELY_ABORTED:
80 		tmp = call->abort_code;
81 		ret = put_cmsg(msg, SOL_RXRPC, RXRPC_ABORT, 4, &tmp);
82 		break;
83 	case RXRPC_CALL_LOCALLY_ABORTED:
84 		tmp = call->abort_code;
85 		ret = put_cmsg(msg, SOL_RXRPC, RXRPC_ABORT, 4, &tmp);
86 		break;
87 	case RXRPC_CALL_NETWORK_ERROR:
88 		tmp = -call->error;
89 		ret = put_cmsg(msg, SOL_RXRPC, RXRPC_NET_ERROR, 4, &tmp);
90 		break;
91 	case RXRPC_CALL_LOCAL_ERROR:
92 		tmp = -call->error;
93 		ret = put_cmsg(msg, SOL_RXRPC, RXRPC_LOCAL_ERROR, 4, &tmp);
94 		break;
95 	default:
96 		pr_err("Invalid terminal call state %u\n", call->state);
97 		BUG();
98 		break;
99 	}
100 
101 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_terminal, call->rx_hard_ack,
102 			    call->rx_pkt_offset, call->rx_pkt_len, ret);
103 	return ret;
104 }
105 
106 /*
107  * Pass back notification of a new call.  The call is added to the
108  * to-be-accepted list.  This means that the next call to be accepted might not
109  * be the last call seen awaiting acceptance, but unless we leave this on the
110  * front of the queue and block all other messages until someone gives us a
111  * user_ID for it, there's not a lot we can do.
112  */
113 static int rxrpc_recvmsg_new_call(struct rxrpc_sock *rx,
114 				  struct rxrpc_call *call,
115 				  struct msghdr *msg, int flags)
116 {
117 	int tmp = 0, ret;
118 
119 	ret = put_cmsg(msg, SOL_RXRPC, RXRPC_NEW_CALL, 0, &tmp);
120 
121 	if (ret == 0 && !(flags & MSG_PEEK)) {
122 		_debug("to be accepted");
123 		write_lock_bh(&rx->recvmsg_lock);
124 		list_del_init(&call->recvmsg_link);
125 		write_unlock_bh(&rx->recvmsg_lock);
126 
127 		rxrpc_get_call(call, rxrpc_call_got);
128 		write_lock(&rx->call_lock);
129 		list_add_tail(&call->accept_link, &rx->to_be_accepted);
130 		write_unlock(&rx->call_lock);
131 	}
132 
133 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_to_be_accepted, 1, 0, 0, ret);
134 	return ret;
135 }
136 
137 /*
138  * End the packet reception phase.
139  */
140 static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
141 {
142 	_enter("%d,%s", call->debug_id, rxrpc_call_states[call->state]);
143 
144 	trace_rxrpc_receive(call, rxrpc_receive_end, 0, call->rx_top);
145 	ASSERTCMP(call->rx_hard_ack, ==, call->rx_top);
146 
147 #if 0 // TODO: May want to transmit final ACK under some circumstances anyway
148 	if (call->state == RXRPC_CALL_CLIENT_RECV_REPLY) {
149 		rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, 0, serial, true, false,
150 				  rxrpc_propose_ack_terminal_ack);
151 		rxrpc_send_ack_packet(call, false, NULL);
152 	}
153 #endif
154 
155 	write_lock_bh(&call->state_lock);
156 
157 	switch (call->state) {
158 	case RXRPC_CALL_CLIENT_RECV_REPLY:
159 		__rxrpc_call_completed(call);
160 		write_unlock_bh(&call->state_lock);
161 		break;
162 
163 	case RXRPC_CALL_SERVER_RECV_REQUEST:
164 		call->tx_phase = true;
165 		call->state = RXRPC_CALL_SERVER_ACK_REQUEST;
166 		call->expect_req_by = jiffies + MAX_JIFFY_OFFSET;
167 		write_unlock_bh(&call->state_lock);
168 		rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial, false, true,
169 				  rxrpc_propose_ack_processing_op);
170 		break;
171 	default:
172 		write_unlock_bh(&call->state_lock);
173 		break;
174 	}
175 }
176 
177 /*
178  * Discard a packet we've used up and advance the Rx window by one.
179  */
180 static void rxrpc_rotate_rx_window(struct rxrpc_call *call)
181 {
182 	struct rxrpc_skb_priv *sp;
183 	struct sk_buff *skb;
184 	rxrpc_serial_t serial;
185 	rxrpc_seq_t hard_ack, top;
186 	u8 flags;
187 	int ix;
188 
189 	_enter("%d", call->debug_id);
190 
191 	hard_ack = call->rx_hard_ack;
192 	top = smp_load_acquire(&call->rx_top);
193 	ASSERT(before(hard_ack, top));
194 
195 	hard_ack++;
196 	ix = hard_ack & RXRPC_RXTX_BUFF_MASK;
197 	skb = call->rxtx_buffer[ix];
198 	rxrpc_see_skb(skb, rxrpc_skb_rx_rotated);
199 	sp = rxrpc_skb(skb);
200 	flags = sp->hdr.flags;
201 	serial = sp->hdr.serial;
202 	if (call->rxtx_annotations[ix] & RXRPC_RX_ANNO_JUMBO)
203 		serial += (call->rxtx_annotations[ix] & RXRPC_RX_ANNO_JUMBO) - 1;
204 
205 	call->rxtx_buffer[ix] = NULL;
206 	call->rxtx_annotations[ix] = 0;
207 	/* Barrier against rxrpc_input_data(). */
208 	smp_store_release(&call->rx_hard_ack, hard_ack);
209 
210 	rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
211 
212 	_debug("%u,%u,%02x", hard_ack, top, flags);
213 	trace_rxrpc_receive(call, rxrpc_receive_rotate, serial, hard_ack);
214 	if (flags & RXRPC_LAST_PACKET) {
215 		rxrpc_end_rx_phase(call, serial);
216 	} else {
217 		/* Check to see if there's an ACK that needs sending. */
218 		if (after_eq(hard_ack, call->ackr_consumed + 2) ||
219 		    after_eq(top, call->ackr_seen + 2) ||
220 		    (hard_ack == top && after(hard_ack, call->ackr_consumed)))
221 			rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial,
222 					  true, true,
223 					  rxrpc_propose_ack_rotate_rx);
224 		if (call->ackr_reason && call->ackr_reason != RXRPC_ACK_DELAY)
225 			rxrpc_send_ack_packet(call, false, NULL);
226 	}
227 }
228 
229 /*
230  * Decrypt and verify a (sub)packet.  The packet's length may be changed due to
231  * padding, but if this is the case, the packet length will be resident in the
232  * socket buffer.  Note that we can't modify the master skb info as the skb may
233  * be the home to multiple subpackets.
234  */
235 static int rxrpc_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
236 			       u8 annotation,
237 			       unsigned int offset, unsigned int len)
238 {
239 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
240 	rxrpc_seq_t seq = sp->hdr.seq;
241 	u16 cksum = sp->hdr.cksum;
242 
243 	_enter("");
244 
245 	/* For all but the head jumbo subpacket, the security checksum is in a
246 	 * jumbo header immediately prior to the data.
247 	 */
248 	if ((annotation & RXRPC_RX_ANNO_JUMBO) > 1) {
249 		__be16 tmp;
250 		if (skb_copy_bits(skb, offset - 2, &tmp, 2) < 0)
251 			BUG();
252 		cksum = ntohs(tmp);
253 		seq += (annotation & RXRPC_RX_ANNO_JUMBO) - 1;
254 	}
255 
256 	return call->conn->security->verify_packet(call, skb, offset, len,
257 						   seq, cksum);
258 }
259 
260 /*
261  * Locate the data within a packet.  This is complicated by:
262  *
263  * (1) An skb may contain a jumbo packet - so we have to find the appropriate
264  *     subpacket.
265  *
266  * (2) The (sub)packets may be encrypted and, if so, the encrypted portion
267  *     contains an extra header which includes the true length of the data,
268  *     excluding any encrypted padding.
269  */
270 static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
271 			     u8 *_annotation,
272 			     unsigned int *_offset, unsigned int *_len)
273 {
274 	unsigned int offset = sizeof(struct rxrpc_wire_header);
275 	unsigned int len = *_len;
276 	int ret;
277 	u8 annotation = *_annotation;
278 
279 	/* Locate the subpacket */
280 	len = skb->len - offset;
281 	if ((annotation & RXRPC_RX_ANNO_JUMBO) > 0) {
282 		offset += (((annotation & RXRPC_RX_ANNO_JUMBO) - 1) *
283 			   RXRPC_JUMBO_SUBPKTLEN);
284 		len = (annotation & RXRPC_RX_ANNO_JLAST) ?
285 			skb->len - offset : RXRPC_JUMBO_SUBPKTLEN;
286 	}
287 
288 	if (!(annotation & RXRPC_RX_ANNO_VERIFIED)) {
289 		ret = rxrpc_verify_packet(call, skb, annotation, offset, len);
290 		if (ret < 0)
291 			return ret;
292 		*_annotation |= RXRPC_RX_ANNO_VERIFIED;
293 	}
294 
295 	*_offset = offset;
296 	*_len = len;
297 	call->conn->security->locate_data(call, skb, _offset, _len);
298 	return 0;
299 }
300 
301 /*
302  * Deliver messages to a call.  This keeps processing packets until the buffer
303  * is filled and we find either more DATA (returns 0) or the end of the DATA
304  * (returns 1).  If more packets are required, it returns -EAGAIN.
305  */
306 static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
307 			      struct msghdr *msg, struct iov_iter *iter,
308 			      size_t len, int flags, size_t *_offset)
309 {
310 	struct rxrpc_skb_priv *sp;
311 	struct sk_buff *skb;
312 	rxrpc_seq_t hard_ack, top, seq;
313 	size_t remain;
314 	bool last;
315 	unsigned int rx_pkt_offset, rx_pkt_len;
316 	int ix, copy, ret = -EAGAIN, ret2;
317 
318 	rx_pkt_offset = call->rx_pkt_offset;
319 	rx_pkt_len = call->rx_pkt_len;
320 
321 	if (call->state >= RXRPC_CALL_SERVER_ACK_REQUEST) {
322 		seq = call->rx_hard_ack;
323 		ret = 1;
324 		goto done;
325 	}
326 
327 	/* Barriers against rxrpc_input_data(). */
328 	hard_ack = call->rx_hard_ack;
329 	seq = hard_ack + 1;
330 	while (top = smp_load_acquire(&call->rx_top),
331 	       before_eq(seq, top)
332 	       ) {
333 		ix = seq & RXRPC_RXTX_BUFF_MASK;
334 		skb = call->rxtx_buffer[ix];
335 		if (!skb) {
336 			trace_rxrpc_recvmsg(call, rxrpc_recvmsg_hole, seq,
337 					    rx_pkt_offset, rx_pkt_len, 0);
338 			break;
339 		}
340 		smp_rmb();
341 		rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
342 		sp = rxrpc_skb(skb);
343 
344 		if (!(flags & MSG_PEEK))
345 			trace_rxrpc_receive(call, rxrpc_receive_front,
346 					    sp->hdr.serial, seq);
347 
348 		if (msg)
349 			sock_recv_timestamp(msg, sock->sk, skb);
350 
351 		if (rx_pkt_offset == 0) {
352 			ret2 = rxrpc_locate_data(call, skb,
353 						 &call->rxtx_annotations[ix],
354 						 &rx_pkt_offset, &rx_pkt_len);
355 			trace_rxrpc_recvmsg(call, rxrpc_recvmsg_next, seq,
356 					    rx_pkt_offset, rx_pkt_len, ret2);
357 			if (ret2 < 0) {
358 				ret = ret2;
359 				goto out;
360 			}
361 		} else {
362 			trace_rxrpc_recvmsg(call, rxrpc_recvmsg_cont, seq,
363 					    rx_pkt_offset, rx_pkt_len, 0);
364 		}
365 
366 		/* We have to handle short, empty and used-up DATA packets. */
367 		remain = len - *_offset;
368 		copy = rx_pkt_len;
369 		if (copy > remain)
370 			copy = remain;
371 		if (copy > 0) {
372 			ret2 = skb_copy_datagram_iter(skb, rx_pkt_offset, iter,
373 						      copy);
374 			if (ret2 < 0) {
375 				ret = ret2;
376 				goto out;
377 			}
378 
379 			/* handle piecemeal consumption of data packets */
380 			rx_pkt_offset += copy;
381 			rx_pkt_len -= copy;
382 			*_offset += copy;
383 		}
384 
385 		if (rx_pkt_len > 0) {
386 			trace_rxrpc_recvmsg(call, rxrpc_recvmsg_full, seq,
387 					    rx_pkt_offset, rx_pkt_len, 0);
388 			ASSERTCMP(*_offset, ==, len);
389 			ret = 0;
390 			break;
391 		}
392 
393 		/* The whole packet has been transferred. */
394 		last = sp->hdr.flags & RXRPC_LAST_PACKET;
395 		if (!(flags & MSG_PEEK))
396 			rxrpc_rotate_rx_window(call);
397 		rx_pkt_offset = 0;
398 		rx_pkt_len = 0;
399 
400 		if (last) {
401 			ASSERTCMP(seq, ==, READ_ONCE(call->rx_top));
402 			ret = 1;
403 			goto out;
404 		}
405 
406 		seq++;
407 	}
408 
409 out:
410 	if (!(flags & MSG_PEEK)) {
411 		call->rx_pkt_offset = rx_pkt_offset;
412 		call->rx_pkt_len = rx_pkt_len;
413 	}
414 done:
415 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_data_return, seq,
416 			    rx_pkt_offset, rx_pkt_len, ret);
417 	return ret;
418 }
419 
420 /*
421  * Receive a message from an RxRPC socket
422  * - we need to be careful about two or more threads calling recvmsg
423  *   simultaneously
424  */
425 int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
426 		  int flags)
427 {
428 	struct rxrpc_call *call;
429 	struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
430 	struct list_head *l;
431 	size_t copied = 0;
432 	long timeo;
433 	int ret;
434 
435 	DEFINE_WAIT(wait);
436 
437 	trace_rxrpc_recvmsg(NULL, rxrpc_recvmsg_enter, 0, 0, 0, 0);
438 
439 	if (flags & (MSG_OOB | MSG_TRUNC))
440 		return -EOPNOTSUPP;
441 
442 	timeo = sock_rcvtimeo(&rx->sk, flags & MSG_DONTWAIT);
443 
444 try_again:
445 	lock_sock(&rx->sk);
446 
447 	/* Return immediately if a client socket has no outstanding calls */
448 	if (RB_EMPTY_ROOT(&rx->calls) &&
449 	    list_empty(&rx->recvmsg_q) &&
450 	    rx->sk.sk_state != RXRPC_SERVER_LISTENING) {
451 		release_sock(&rx->sk);
452 		return -ENODATA;
453 	}
454 
455 	if (list_empty(&rx->recvmsg_q)) {
456 		ret = -EWOULDBLOCK;
457 		if (timeo == 0) {
458 			call = NULL;
459 			goto error_no_call;
460 		}
461 
462 		release_sock(&rx->sk);
463 
464 		/* Wait for something to happen */
465 		prepare_to_wait_exclusive(sk_sleep(&rx->sk), &wait,
466 					  TASK_INTERRUPTIBLE);
467 		ret = sock_error(&rx->sk);
468 		if (ret)
469 			goto wait_error;
470 
471 		if (list_empty(&rx->recvmsg_q)) {
472 			if (signal_pending(current))
473 				goto wait_interrupted;
474 			trace_rxrpc_recvmsg(NULL, rxrpc_recvmsg_wait,
475 					    0, 0, 0, 0);
476 			timeo = schedule_timeout(timeo);
477 		}
478 		finish_wait(sk_sleep(&rx->sk), &wait);
479 		goto try_again;
480 	}
481 
482 	/* Find the next call and dequeue it if we're not just peeking.  If we
483 	 * do dequeue it, that comes with a ref that we will need to release.
484 	 */
485 	write_lock_bh(&rx->recvmsg_lock);
486 	l = rx->recvmsg_q.next;
487 	call = list_entry(l, struct rxrpc_call, recvmsg_link);
488 	if (!(flags & MSG_PEEK))
489 		list_del_init(&call->recvmsg_link);
490 	else
491 		rxrpc_get_call(call, rxrpc_call_got);
492 	write_unlock_bh(&rx->recvmsg_lock);
493 
494 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_dequeue, 0, 0, 0, 0);
495 
496 	/* We're going to drop the socket lock, so we need to lock the call
497 	 * against interference by sendmsg.
498 	 */
499 	if (!mutex_trylock(&call->user_mutex)) {
500 		ret = -EWOULDBLOCK;
501 		if (flags & MSG_DONTWAIT)
502 			goto error_requeue_call;
503 		ret = -ERESTARTSYS;
504 		if (mutex_lock_interruptible(&call->user_mutex) < 0)
505 			goto error_requeue_call;
506 	}
507 
508 	release_sock(&rx->sk);
509 
510 	if (test_bit(RXRPC_CALL_RELEASED, &call->flags))
511 		BUG();
512 
513 	if (test_bit(RXRPC_CALL_HAS_USERID, &call->flags)) {
514 		if (flags & MSG_CMSG_COMPAT) {
515 			unsigned int id32 = call->user_call_ID;
516 
517 			ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
518 				       sizeof(unsigned int), &id32);
519 		} else {
520 			ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
521 				       sizeof(unsigned long),
522 				       &call->user_call_ID);
523 		}
524 		if (ret < 0)
525 			goto error_unlock_call;
526 	}
527 
528 	if (msg->msg_name) {
529 		struct sockaddr_rxrpc *srx = msg->msg_name;
530 		size_t len = sizeof(call->peer->srx);
531 
532 		memcpy(msg->msg_name, &call->peer->srx, len);
533 		srx->srx_service = call->service_id;
534 		msg->msg_namelen = len;
535 	}
536 
537 	switch (READ_ONCE(call->state)) {
538 	case RXRPC_CALL_SERVER_ACCEPTING:
539 		ret = rxrpc_recvmsg_new_call(rx, call, msg, flags);
540 		break;
541 	case RXRPC_CALL_CLIENT_RECV_REPLY:
542 	case RXRPC_CALL_SERVER_RECV_REQUEST:
543 	case RXRPC_CALL_SERVER_ACK_REQUEST:
544 		ret = rxrpc_recvmsg_data(sock, call, msg, &msg->msg_iter, len,
545 					 flags, &copied);
546 		if (ret == -EAGAIN)
547 			ret = 0;
548 
549 		if (after(call->rx_top, call->rx_hard_ack) &&
550 		    call->rxtx_buffer[(call->rx_hard_ack + 1) & RXRPC_RXTX_BUFF_MASK])
551 			rxrpc_notify_socket(call);
552 		break;
553 	default:
554 		ret = 0;
555 		break;
556 	}
557 
558 	if (ret < 0)
559 		goto error_unlock_call;
560 
561 	if (call->state == RXRPC_CALL_COMPLETE) {
562 		ret = rxrpc_recvmsg_term(call, msg);
563 		if (ret < 0)
564 			goto error_unlock_call;
565 		if (!(flags & MSG_PEEK))
566 			rxrpc_release_call(rx, call);
567 		msg->msg_flags |= MSG_EOR;
568 		ret = 1;
569 	}
570 
571 	if (ret == 0)
572 		msg->msg_flags |= MSG_MORE;
573 	else
574 		msg->msg_flags &= ~MSG_MORE;
575 	ret = copied;
576 
577 error_unlock_call:
578 	mutex_unlock(&call->user_mutex);
579 	rxrpc_put_call(call, rxrpc_call_put);
580 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_return, 0, 0, 0, ret);
581 	return ret;
582 
583 error_requeue_call:
584 	if (!(flags & MSG_PEEK)) {
585 		write_lock_bh(&rx->recvmsg_lock);
586 		list_add(&call->recvmsg_link, &rx->recvmsg_q);
587 		write_unlock_bh(&rx->recvmsg_lock);
588 		trace_rxrpc_recvmsg(call, rxrpc_recvmsg_requeue, 0, 0, 0, 0);
589 	} else {
590 		rxrpc_put_call(call, rxrpc_call_put);
591 	}
592 error_no_call:
593 	release_sock(&rx->sk);
594 	trace_rxrpc_recvmsg(call, rxrpc_recvmsg_return, 0, 0, 0, ret);
595 	return ret;
596 
597 wait_interrupted:
598 	ret = sock_intr_errno(timeo);
599 wait_error:
600 	finish_wait(sk_sleep(&rx->sk), &wait);
601 	call = NULL;
602 	goto error_no_call;
603 }
604 
605 /**
606  * rxrpc_kernel_recv_data - Allow a kernel service to receive data/info
607  * @sock: The socket that the call exists on
608  * @call: The call to send data through
609  * @buf: The buffer to receive into
610  * @size: The size of the buffer, including data already read
611  * @_offset: The running offset into the buffer.
612  * @want_more: True if more data is expected to be read
613  * @_abort: Where the abort code is stored if -ECONNABORTED is returned
614  * @_service: Where to store the actual service ID (may be upgraded)
615  *
616  * Allow a kernel service to receive data and pick up information about the
617  * state of a call.  Returns 0 if got what was asked for and there's more
618  * available, 1 if we got what was asked for and we're at the end of the data
619  * and -EAGAIN if we need more data.
620  *
621  * Note that we may return -EAGAIN to drain empty packets at the end of the
622  * data, even if we've already copied over the requested data.
623  *
624  * This function adds the amount it transfers to *_offset, so this should be
625  * precleared as appropriate.  Note that the amount remaining in the buffer is
626  * taken to be size - *_offset.
627  *
628  * *_abort should also be initialised to 0.
629  */
630 int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
631 			   void *buf, size_t size, size_t *_offset,
632 			   bool want_more, u32 *_abort, u16 *_service)
633 {
634 	struct iov_iter iter;
635 	struct kvec iov;
636 	int ret;
637 
638 	_enter("{%d,%s},%zu/%zu,%d",
639 	       call->debug_id, rxrpc_call_states[call->state],
640 	       *_offset, size, want_more);
641 
642 	ASSERTCMP(*_offset, <=, size);
643 	ASSERTCMP(call->state, !=, RXRPC_CALL_SERVER_ACCEPTING);
644 
645 	iov.iov_base = buf + *_offset;
646 	iov.iov_len = size - *_offset;
647 	iov_iter_kvec(&iter, ITER_KVEC | READ, &iov, 1, size - *_offset);
648 
649 	mutex_lock(&call->user_mutex);
650 
651 	switch (READ_ONCE(call->state)) {
652 	case RXRPC_CALL_CLIENT_RECV_REPLY:
653 	case RXRPC_CALL_SERVER_RECV_REQUEST:
654 	case RXRPC_CALL_SERVER_ACK_REQUEST:
655 		ret = rxrpc_recvmsg_data(sock, call, NULL, &iter, size, 0,
656 					 _offset);
657 		if (ret < 0)
658 			goto out;
659 
660 		/* We can only reach here with a partially full buffer if we
661 		 * have reached the end of the data.  We must otherwise have a
662 		 * full buffer or have been given -EAGAIN.
663 		 */
664 		if (ret == 1) {
665 			if (*_offset < size)
666 				goto short_data;
667 			if (!want_more)
668 				goto read_phase_complete;
669 			ret = 0;
670 			goto out;
671 		}
672 
673 		if (!want_more)
674 			goto excess_data;
675 		goto out;
676 
677 	case RXRPC_CALL_COMPLETE:
678 		goto call_complete;
679 
680 	default:
681 		ret = -EINPROGRESS;
682 		goto out;
683 	}
684 
685 read_phase_complete:
686 	ret = 1;
687 out:
688 	if (_service)
689 		*_service = call->service_id;
690 	mutex_unlock(&call->user_mutex);
691 	_leave(" = %d [%zu,%d]", ret, *_offset, *_abort);
692 	return ret;
693 
694 short_data:
695 	trace_rxrpc_rx_eproto(call, 0, tracepoint_string("short_data"));
696 	ret = -EBADMSG;
697 	goto out;
698 excess_data:
699 	trace_rxrpc_rx_eproto(call, 0, tracepoint_string("excess_data"));
700 	ret = -EMSGSIZE;
701 	goto out;
702 call_complete:
703 	*_abort = call->abort_code;
704 	ret = call->error;
705 	if (call->completion == RXRPC_CALL_SUCCEEDED) {
706 		ret = 1;
707 		if (size > 0)
708 			ret = -ECONNRESET;
709 	}
710 	goto out;
711 }
712 EXPORT_SYMBOL(rxrpc_kernel_recv_data);
713