1 /*
2 * NETLINK Kernel-user communication protocol.
3 *
4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk>
5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6 * Patrick McHardy <kaber@trash.net>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
12 *
13 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
14 * added netlink_proto_exit
15 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
16 * use nlk_sk, as sk->protinfo is on a diet 8)
17 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
18 * - inc module use count of module that owns
19 * the kernel socket in case userspace opens
20 * socket of same protocol
21 * - remove all module support, since netlink is
22 * mandatory if CONFIG_NET=y these days
23 */
24
25 #include <linux/module.h>
26
27 #include <linux/capability.h>
28 #include <linux/kernel.h>
29 #include <linux/init.h>
30 #include <linux/signal.h>
31 #include <linux/sched.h>
32 #include <linux/errno.h>
33 #include <linux/string.h>
34 #include <linux/stat.h>
35 #include <linux/socket.h>
36 #include <linux/un.h>
37 #include <linux/fcntl.h>
38 #include <linux/termios.h>
39 #include <linux/sockios.h>
40 #include <linux/net.h>
41 #include <linux/fs.h>
42 #include <linux/slab.h>
43 #include <asm/uaccess.h>
44 #include <linux/skbuff.h>
45 #include <linux/netdevice.h>
46 #include <linux/rtnetlink.h>
47 #include <linux/proc_fs.h>
48 #include <linux/seq_file.h>
49 #include <linux/notifier.h>
50 #include <linux/security.h>
51 #include <linux/jhash.h>
52 #include <linux/jiffies.h>
53 #include <linux/random.h>
54 #include <linux/bitops.h>
55 #include <linux/mm.h>
56 #include <linux/types.h>
57 #include <linux/audit.h>
58 #include <linux/mutex.h>
59 #include <linux/vmalloc.h>
60 #include <linux/if_arp.h>
61 #include <linux/rhashtable.h>
62 #include <asm/cacheflush.h>
63 #include <linux/hash.h>
64 #include <linux/genetlink.h>
65
66 #include <net/net_namespace.h>
67 #include <net/sock.h>
68 #include <net/scm.h>
69 #include <net/netlink.h>
70
71 #include "af_netlink.h"
72
73 struct listeners {
74 struct rcu_head rcu;
75 unsigned long masks[0];
76 };
77
78 /* state bits */
79 #define NETLINK_S_CONGESTED 0x0
80
81 /* flags */
82 #define NETLINK_F_KERNEL_SOCKET 0x1
83 #define NETLINK_F_RECV_PKTINFO 0x2
84 #define NETLINK_F_BROADCAST_SEND_ERROR 0x4
85 #define NETLINK_F_RECV_NO_ENOBUFS 0x8
86 #define NETLINK_F_LISTEN_ALL_NSID 0x10
87
88 static inline int netlink_is_kernel(struct sock *sk)
89 {
90 return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
91 }
92
93 struct netlink_table *nl_table __read_mostly;
94 EXPORT_SYMBOL_GPL(nl_table);
95
96 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
97
98 static int netlink_dump(struct sock *sk);
99 static void netlink_skb_destructor(struct sk_buff *skb);
100
101 /* nl_table locking explained:
102 * Lookup and traversal are protected with an RCU read-side lock. Insertion
103 * and removal are protected with per bucket lock while using RCU list
104 * modification primitives and may run in parallel to RCU protected lookups.
105 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
106 * been acquired * either during or after the socket has been removed from
107 * the list and after an RCU grace period.
108 */
109 DEFINE_RWLOCK(nl_table_lock);
110 EXPORT_SYMBOL_GPL(nl_table_lock);
111 static atomic_t nl_table_users = ATOMIC_INIT(0);
112
113 #define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
114
115 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
116
117 static DEFINE_SPINLOCK(netlink_tap_lock);
118 static struct list_head netlink_tap_all __read_mostly;
119
120 static const struct rhashtable_params netlink_rhashtable_params;
121
122 static inline u32 netlink_group_mask(u32 group)
123 {
124 return group ? 1 << (group - 1) : 0;
125 }
126
127 static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
128 gfp_t gfp_mask)
129 {
130 unsigned int len = skb_end_offset(skb);
131 struct sk_buff *new;
132
133 new = alloc_skb(len, gfp_mask);
134 if (new == NULL)
135 return NULL;
136
137 NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
138 NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
139 NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
140
141 memcpy(skb_put(new, len), skb->data, len);
142 return new;
143 }
144
145 int netlink_add_tap(struct netlink_tap *nt)
146 {
147 if (unlikely(nt->dev->type != ARPHRD_NETLINK))
148 return -EINVAL;
149
150 spin_lock(&netlink_tap_lock);
151 list_add_rcu(&nt->list, &netlink_tap_all);
152 spin_unlock(&netlink_tap_lock);
153
154 __module_get(nt->module);
155
156 return 0;
157 }
158 EXPORT_SYMBOL_GPL(netlink_add_tap);
159
160 static int __netlink_remove_tap(struct netlink_tap *nt)
161 {
162 bool found = false;
163 struct netlink_tap *tmp;
164
165 spin_lock(&netlink_tap_lock);
166
167 list_for_each_entry(tmp, &netlink_tap_all, list) {
168 if (nt == tmp) {
169 list_del_rcu(&nt->list);
170 found = true;
171 goto out;
172 }
173 }
174
175 pr_warn("__netlink_remove_tap: %p not found\n", nt);
176 out:
177 spin_unlock(&netlink_tap_lock);
178
179 if (found)
180 module_put(nt->module);
181
182 return found ? 0 : -ENODEV;
183 }
184
185 int netlink_remove_tap(struct netlink_tap *nt)
186 {
187 int ret;
188
189 ret = __netlink_remove_tap(nt);
190 synchronize_net();
191
192 return ret;
193 }
194 EXPORT_SYMBOL_GPL(netlink_remove_tap);
195
196 static bool netlink_filter_tap(const struct sk_buff *skb)
197 {
198 struct sock *sk = skb->sk;
199
200 /* We take the more conservative approach and
201 * whitelist socket protocols that may pass.
202 */
203 switch (sk->sk_protocol) {
204 case NETLINK_ROUTE:
205 case NETLINK_USERSOCK:
206 case NETLINK_SOCK_DIAG:
207 case NETLINK_NFLOG:
208 case NETLINK_XFRM:
209 case NETLINK_FIB_LOOKUP:
210 case NETLINK_NETFILTER:
211 case NETLINK_GENERIC:
212 return true;
213 }
214
215 return false;
216 }
217
218 static int __netlink_deliver_tap_skb(struct sk_buff *skb,
219 struct net_device *dev)
220 {
221 struct sk_buff *nskb;
222 struct sock *sk = skb->sk;
223 int ret = -ENOMEM;
224
225 dev_hold(dev);
226
227 if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
228 nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
229 else
230 nskb = skb_clone(skb, GFP_ATOMIC);
231 if (nskb) {
232 nskb->dev = dev;
233 nskb->protocol = htons((u16) sk->sk_protocol);
234 nskb->pkt_type = netlink_is_kernel(sk) ?
235 PACKET_KERNEL : PACKET_USER;
236 skb_reset_network_header(nskb);
237 ret = dev_queue_xmit(nskb);
238 if (unlikely(ret > 0))
239 ret = net_xmit_errno(ret);
240 }
241
242 dev_put(dev);
243 return ret;
244 }
245
246 static void __netlink_deliver_tap(struct sk_buff *skb)
247 {
248 int ret;
249 struct netlink_tap *tmp;
250
251 if (!netlink_filter_tap(skb))
252 return;
253
254 list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
255 ret = __netlink_deliver_tap_skb(skb, tmp->dev);
256 if (unlikely(ret))
257 break;
258 }
259 }
260
261 static void netlink_deliver_tap(struct sk_buff *skb)
262 {
263 rcu_read_lock();
264
265 if (unlikely(!list_empty(&netlink_tap_all)))
266 __netlink_deliver_tap(skb);
267
268 rcu_read_unlock();
269 }
270
271 static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
272 struct sk_buff *skb)
273 {
274 if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
275 netlink_deliver_tap(skb);
276 }
277
278 static void netlink_overrun(struct sock *sk)
279 {
280 struct netlink_sock *nlk = nlk_sk(sk);
281
282 if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
283 if (!test_and_set_bit(NETLINK_S_CONGESTED,
284 &nlk_sk(sk)->state)) {
285 sk->sk_err = ENOBUFS;
286 sk->sk_error_report(sk);
287 }
288 }
289 atomic_inc(&sk->sk_drops);
290 }
291
292 static void netlink_rcv_wake(struct sock *sk)
293 {
294 struct netlink_sock *nlk = nlk_sk(sk);
295
296 if (skb_queue_empty(&sk->sk_receive_queue))
297 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
298 if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
299 wake_up_interruptible(&nlk->wait);
300 }
301
302 #ifdef CONFIG_NETLINK_MMAP
303 static bool netlink_rx_is_mmaped(struct sock *sk)
304 {
305 return nlk_sk(sk)->rx_ring.pg_vec != NULL;
306 }
307
308 static bool netlink_tx_is_mmaped(struct sock *sk)
309 {
310 return nlk_sk(sk)->tx_ring.pg_vec != NULL;
311 }
312
313 static __pure struct page *pgvec_to_page(const void *addr)
314 {
315 if (is_vmalloc_addr(addr))
316 return vmalloc_to_page(addr);
317 else
318 return virt_to_page(addr);
319 }
320
321 static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
322 {
323 unsigned int i;
324
325 for (i = 0; i < len; i++) {
326 if (pg_vec[i] != NULL) {
327 if (is_vmalloc_addr(pg_vec[i]))
328 vfree(pg_vec[i]);
329 else
330 free_pages((unsigned long)pg_vec[i], order);
331 }
332 }
333 kfree(pg_vec);
334 }
335
336 static void *alloc_one_pg_vec_page(unsigned long order)
337 {
338 void *buffer;
339 gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
340 __GFP_NOWARN | __GFP_NORETRY;
341
342 buffer = (void *)__get_free_pages(gfp_flags, order);
343 if (buffer != NULL)
344 return buffer;
345
346 buffer = vzalloc((1 << order) * PAGE_SIZE);
347 if (buffer != NULL)
348 return buffer;
349
350 gfp_flags &= ~__GFP_NORETRY;
351 return (void *)__get_free_pages(gfp_flags, order);
352 }
353
354 static void **alloc_pg_vec(struct netlink_sock *nlk,
355 struct nl_mmap_req *req, unsigned int order)
356 {
357 unsigned int block_nr = req->nm_block_nr;
358 unsigned int i;
359 void **pg_vec;
360
361 pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
362 if (pg_vec == NULL)
363 return NULL;
364
365 for (i = 0; i < block_nr; i++) {
366 pg_vec[i] = alloc_one_pg_vec_page(order);
367 if (pg_vec[i] == NULL)
368 goto err1;
369 }
370
371 return pg_vec;
372 err1:
373 free_pg_vec(pg_vec, order, block_nr);
374 return NULL;
375 }
376
377
378 static void
379 __netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
380 unsigned int order)
381 {
382 struct netlink_sock *nlk = nlk_sk(sk);
383 struct sk_buff_head *queue;
384 struct netlink_ring *ring;
385
386 queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
387 ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
388
389 spin_lock_bh(&queue->lock);
390
391 ring->frame_max = req->nm_frame_nr - 1;
392 ring->head = 0;
393 ring->frame_size = req->nm_frame_size;
394 ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE;
395
396 swap(ring->pg_vec_len, req->nm_block_nr);
397 swap(ring->pg_vec_order, order);
398 swap(ring->pg_vec, pg_vec);
399
400 __skb_queue_purge(queue);
401 spin_unlock_bh(&queue->lock);
402
403 WARN_ON(atomic_read(&nlk->mapped));
404
405 if (pg_vec)
406 free_pg_vec(pg_vec, order, req->nm_block_nr);
407 }
408
409 static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
410 bool tx_ring)
411 {
412 struct netlink_sock *nlk = nlk_sk(sk);
413 struct netlink_ring *ring;
414 void **pg_vec = NULL;
415 unsigned int order = 0;
416
417 ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
418
419 if (atomic_read(&nlk->mapped))
420 return -EBUSY;
421 if (atomic_read(&ring->pending))
422 return -EBUSY;
423
424 if (req->nm_block_nr) {
425 if (ring->pg_vec != NULL)
426 return -EBUSY;
427
428 if ((int)req->nm_block_size <= 0)
429 return -EINVAL;
430 if (!PAGE_ALIGNED(req->nm_block_size))
431 return -EINVAL;
432 if (req->nm_frame_size < NL_MMAP_HDRLEN)
433 return -EINVAL;
434 if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
435 return -EINVAL;
436
437 ring->frames_per_block = req->nm_block_size /
438 req->nm_frame_size;
439 if (ring->frames_per_block == 0)
440 return -EINVAL;
441 if (ring->frames_per_block * req->nm_block_nr !=
442 req->nm_frame_nr)
443 return -EINVAL;
444
445 order = get_order(req->nm_block_size);
446 pg_vec = alloc_pg_vec(nlk, req, order);
447 if (pg_vec == NULL)
448 return -ENOMEM;
449 } else {
450 if (req->nm_frame_nr)
451 return -EINVAL;
452 }
453
454 mutex_lock(&nlk->pg_vec_lock);
455 if (atomic_read(&nlk->mapped) == 0) {
456 __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
457 mutex_unlock(&nlk->pg_vec_lock);
458 return 0;
459 }
460
461 mutex_unlock(&nlk->pg_vec_lock);
462
463 if (pg_vec)
464 free_pg_vec(pg_vec, order, req->nm_block_nr);
465
466 return -EBUSY;
467 }
468
469 static void netlink_mm_open(struct vm_area_struct *vma)
470 {
471 struct file *file = vma->vm_file;
472 struct socket *sock = file->private_data;
473 struct sock *sk = sock->sk;
474
475 if (sk)
476 atomic_inc(&nlk_sk(sk)->mapped);
477 }
478
479 static void netlink_mm_close(struct vm_area_struct *vma)
480 {
481 struct file *file = vma->vm_file;
482 struct socket *sock = file->private_data;
483 struct sock *sk = sock->sk;
484
485 if (sk)
486 atomic_dec(&nlk_sk(sk)->mapped);
487 }
488
489 static const struct vm_operations_struct netlink_mmap_ops = {
490 .open = netlink_mm_open,
491 .close = netlink_mm_close,
492 };
493
494 static int netlink_mmap(struct file *file, struct socket *sock,
495 struct vm_area_struct *vma)
496 {
497 struct sock *sk = sock->sk;
498 struct netlink_sock *nlk = nlk_sk(sk);
499 struct netlink_ring *ring;
500 unsigned long start, size, expected;
501 unsigned int i;
502 int err = -EINVAL;
503
504 if (vma->vm_pgoff)
505 return -EINVAL;
506
507 mutex_lock(&nlk->pg_vec_lock);
508
509 expected = 0;
510 for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
511 if (ring->pg_vec == NULL)
512 continue;
513 expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
514 }
515
516 if (expected == 0)
517 goto out;
518
519 size = vma->vm_end - vma->vm_start;
520 if (size != expected)
521 goto out;
522
523 start = vma->vm_start;
524 for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
525 if (ring->pg_vec == NULL)
526 continue;
527
528 for (i = 0; i < ring->pg_vec_len; i++) {
529 struct page *page;
530 void *kaddr = ring->pg_vec[i];
531 unsigned int pg_num;
532
533 for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
534 page = pgvec_to_page(kaddr);
535 err = vm_insert_page(vma, start, page);
536 if (err < 0)
537 goto out;
538 start += PAGE_SIZE;
539 kaddr += PAGE_SIZE;
540 }
541 }
542 }
543
544 atomic_inc(&nlk->mapped);
545 vma->vm_ops = &netlink_mmap_ops;
546 err = 0;
547 out:
548 mutex_unlock(&nlk->pg_vec_lock);
549 return err;
550 }
551
552 static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
553 {
554 #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
555 struct page *p_start, *p_end;
556
557 /* First page is flushed through netlink_{get,set}_status */
558 p_start = pgvec_to_page(hdr + PAGE_SIZE);
559 p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
560 while (p_start <= p_end) {
561 flush_dcache_page(p_start);
562 p_start++;
563 }
564 #endif
565 }
566
567 static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
568 {
569 smp_rmb();
570 flush_dcache_page(pgvec_to_page(hdr));
571 return hdr->nm_status;
572 }
573
574 static void netlink_set_status(struct nl_mmap_hdr *hdr,
575 enum nl_mmap_status status)
576 {
577 smp_mb();
578 hdr->nm_status = status;
579 flush_dcache_page(pgvec_to_page(hdr));
580 }
581
582 static struct nl_mmap_hdr *
583 __netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
584 {
585 unsigned int pg_vec_pos, frame_off;
586
587 pg_vec_pos = pos / ring->frames_per_block;
588 frame_off = pos % ring->frames_per_block;
589
590 return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
591 }
592
593 static struct nl_mmap_hdr *
594 netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
595 enum nl_mmap_status status)
596 {
597 struct nl_mmap_hdr *hdr;
598
599 hdr = __netlink_lookup_frame(ring, pos);
600 if (netlink_get_status(hdr) != status)
601 return NULL;
602
603 return hdr;
604 }
605
606 static struct nl_mmap_hdr *
607 netlink_current_frame(const struct netlink_ring *ring,
608 enum nl_mmap_status status)
609 {
610 return netlink_lookup_frame(ring, ring->head, status);
611 }
612
613 static struct nl_mmap_hdr *
614 netlink_previous_frame(const struct netlink_ring *ring,
615 enum nl_mmap_status status)
616 {
617 unsigned int prev;
618
619 prev = ring->head ? ring->head - 1 : ring->frame_max;
620 return netlink_lookup_frame(ring, prev, status);
621 }
622
623 static void netlink_increment_head(struct netlink_ring *ring)
624 {
625 ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
626 }
627
628 static void netlink_forward_ring(struct netlink_ring *ring)
629 {
630 unsigned int head = ring->head, pos = head;
631 const struct nl_mmap_hdr *hdr;
632
633 do {
634 hdr = __netlink_lookup_frame(ring, pos);
635 if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
636 break;
637 if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
638 break;
639 netlink_increment_head(ring);
640 } while (ring->head != head);
641 }
642
643 static bool netlink_dump_space(struct netlink_sock *nlk)
644 {
645 struct netlink_ring *ring = &nlk->rx_ring;
646 struct nl_mmap_hdr *hdr;
647 unsigned int n;
648
649 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
650 if (hdr == NULL)
651 return false;
652
653 n = ring->head + ring->frame_max / 2;
654 if (n > ring->frame_max)
655 n -= ring->frame_max;
656
657 hdr = __netlink_lookup_frame(ring, n);
658
659 return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
660 }
661
662 static unsigned int netlink_poll(struct file *file, struct socket *sock,
663 poll_table *wait)
664 {
665 struct sock *sk = sock->sk;
666 struct netlink_sock *nlk = nlk_sk(sk);
667 unsigned int mask;
668 int err;
669
670 if (nlk->rx_ring.pg_vec != NULL) {
671 /* Memory mapped sockets don't call recvmsg(), so flow control
672 * for dumps is performed here. A dump is allowed to continue
673 * if at least half the ring is unused.
674 */
675 while (nlk->cb_running && netlink_dump_space(nlk)) {
676 err = netlink_dump(sk);
677 if (err < 0) {
678 sk->sk_err = -err;
679 sk->sk_error_report(sk);
680 break;
681 }
682 }
683 netlink_rcv_wake(sk);
684 }
685
686 mask = datagram_poll(file, sock, wait);
687
688 spin_lock_bh(&sk->sk_receive_queue.lock);
689 if (nlk->rx_ring.pg_vec) {
690 netlink_forward_ring(&nlk->rx_ring);
691 if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED))
692 mask |= POLLIN | POLLRDNORM;
693 }
694 spin_unlock_bh(&sk->sk_receive_queue.lock);
695
696 spin_lock_bh(&sk->sk_write_queue.lock);
697 if (nlk->tx_ring.pg_vec) {
698 if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
699 mask |= POLLOUT | POLLWRNORM;
700 }
701 spin_unlock_bh(&sk->sk_write_queue.lock);
702
703 return mask;
704 }
705
706 static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
707 {
708 return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
709 }
710
711 static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
712 struct netlink_ring *ring,
713 struct nl_mmap_hdr *hdr)
714 {
715 unsigned int size;
716 void *data;
717
718 size = ring->frame_size - NL_MMAP_HDRLEN;
719 data = (void *)hdr + NL_MMAP_HDRLEN;
720
721 skb->head = data;
722 skb->data = data;
723 skb_reset_tail_pointer(skb);
724 skb->end = skb->tail + size;
725 skb->len = 0;
726
727 skb->destructor = netlink_skb_destructor;
728 NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
729 NETLINK_CB(skb).sk = sk;
730 }
731
732 static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
733 u32 dst_portid, u32 dst_group,
734 struct scm_cookie *scm)
735 {
736 struct netlink_sock *nlk = nlk_sk(sk);
737 struct netlink_ring *ring;
738 struct nl_mmap_hdr *hdr;
739 struct sk_buff *skb;
740 unsigned int maxlen;
741 int err = 0, len = 0;
742
743 mutex_lock(&nlk->pg_vec_lock);
744
745 ring = &nlk->tx_ring;
746 maxlen = ring->frame_size - NL_MMAP_HDRLEN;
747
748 do {
749 unsigned int nm_len;
750
751 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
752 if (hdr == NULL) {
753 if (!(msg->msg_flags & MSG_DONTWAIT) &&
754 atomic_read(&nlk->tx_ring.pending))
755 schedule();
756 continue;
757 }
758
759 nm_len = ACCESS_ONCE(hdr->nm_len);
760 if (nm_len > maxlen) {
761 err = -EINVAL;
762 goto out;
763 }
764
765 netlink_frame_flush_dcache(hdr, nm_len);
766
767 skb = alloc_skb(nm_len, GFP_KERNEL);
768 if (skb == NULL) {
769 err = -ENOBUFS;
770 goto out;
771 }
772 __skb_put(skb, nm_len);
773 memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
774 netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
775
776 netlink_increment_head(ring);
777
778 NETLINK_CB(skb).portid = nlk->portid;
779 NETLINK_CB(skb).dst_group = dst_group;
780 NETLINK_CB(skb).creds = scm->creds;
781
782 err = security_netlink_send(sk, skb);
783 if (err) {
784 kfree_skb(skb);
785 goto out;
786 }
787
788 if (unlikely(dst_group)) {
789 atomic_inc(&skb->users);
790 netlink_broadcast(sk, skb, dst_portid, dst_group,
791 GFP_KERNEL);
792 }
793 err = netlink_unicast(sk, skb, dst_portid,
794 msg->msg_flags & MSG_DONTWAIT);
795 if (err < 0)
796 goto out;
797 len += err;
798
799 } while (hdr != NULL ||
800 (!(msg->msg_flags & MSG_DONTWAIT) &&
801 atomic_read(&nlk->tx_ring.pending)));
802
803 if (len > 0)
804 err = len;
805 out:
806 mutex_unlock(&nlk->pg_vec_lock);
807 return err;
808 }
809
810 static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
811 {
812 struct nl_mmap_hdr *hdr;
813
814 hdr = netlink_mmap_hdr(skb);
815 hdr->nm_len = skb->len;
816 hdr->nm_group = NETLINK_CB(skb).dst_group;
817 hdr->nm_pid = NETLINK_CB(skb).creds.pid;
818 hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
819 hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
820 netlink_frame_flush_dcache(hdr, hdr->nm_len);
821 netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
822
823 NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
824 kfree_skb(skb);
825 }
826
827 static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
828 {
829 struct netlink_sock *nlk = nlk_sk(sk);
830 struct netlink_ring *ring = &nlk->rx_ring;
831 struct nl_mmap_hdr *hdr;
832
833 spin_lock_bh(&sk->sk_receive_queue.lock);
834 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
835 if (hdr == NULL) {
836 spin_unlock_bh(&sk->sk_receive_queue.lock);
837 kfree_skb(skb);
838 netlink_overrun(sk);
839 return;
840 }
841 netlink_increment_head(ring);
842 __skb_queue_tail(&sk->sk_receive_queue, skb);
843 spin_unlock_bh(&sk->sk_receive_queue.lock);
844
845 hdr->nm_len = skb->len;
846 hdr->nm_group = NETLINK_CB(skb).dst_group;
847 hdr->nm_pid = NETLINK_CB(skb).creds.pid;
848 hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
849 hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
850 netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
851 }
852
853 #else /* CONFIG_NETLINK_MMAP */
854 #define netlink_rx_is_mmaped(sk) false
855 #define netlink_tx_is_mmaped(sk) false
856 #define netlink_mmap sock_no_mmap
857 #define netlink_poll datagram_poll
858 #define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm) 0
859 #endif /* CONFIG_NETLINK_MMAP */
860
861 static void netlink_skb_destructor(struct sk_buff *skb)
862 {
863 #ifdef CONFIG_NETLINK_MMAP
864 struct nl_mmap_hdr *hdr;
865 struct netlink_ring *ring;
866 struct sock *sk;
867
868 /* If a packet from the kernel to userspace was freed because of an
869 * error without being delivered to userspace, the kernel must reset
870 * the status. In the direction userspace to kernel, the status is
871 * always reset here after the packet was processed and freed.
872 */
873 if (netlink_skb_is_mmaped(skb)) {
874 hdr = netlink_mmap_hdr(skb);
875 sk = NETLINK_CB(skb).sk;
876
877 if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
878 netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
879 ring = &nlk_sk(sk)->tx_ring;
880 } else {
881 if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
882 hdr->nm_len = 0;
883 netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
884 }
885 ring = &nlk_sk(sk)->rx_ring;
886 }
887
888 WARN_ON(atomic_read(&ring->pending) == 0);
889 atomic_dec(&ring->pending);
890 sock_put(sk);
891
892 skb->head = NULL;
893 }
894 #endif
895 if (is_vmalloc_addr(skb->head)) {
896 if (!skb->cloned ||
897 !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
898 vfree(skb->head);
899
900 skb->head = NULL;
901 }
902 if (skb->sk != NULL)
903 sock_rfree(skb);
904 }
905
906 static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
907 {
908 WARN_ON(skb->sk != NULL);
909 skb->sk = sk;
910 skb->destructor = netlink_skb_destructor;
911 atomic_add(skb->truesize, &sk->sk_rmem_alloc);
912 sk_mem_charge(sk, skb->truesize);
913 }
914
915 static void netlink_sock_destruct(struct sock *sk)
916 {
917 struct netlink_sock *nlk = nlk_sk(sk);
918
919 if (nlk->cb_running) {
920 if (nlk->cb.done)
921 nlk->cb.done(&nlk->cb);
922
923 module_put(nlk->cb.module);
924 kfree_skb(nlk->cb.skb);
925 }
926
927 skb_queue_purge(&sk->sk_receive_queue);
928 #ifdef CONFIG_NETLINK_MMAP
929 if (1) {
930 struct nl_mmap_req req;
931
932 memset(&req, 0, sizeof(req));
933 if (nlk->rx_ring.pg_vec)
934 __netlink_set_ring(sk, &req, false, NULL, 0);
935 memset(&req, 0, sizeof(req));
936 if (nlk->tx_ring.pg_vec)
937 __netlink_set_ring(sk, &req, true, NULL, 0);
938 }
939 #endif /* CONFIG_NETLINK_MMAP */
940
941 if (!sock_flag(sk, SOCK_DEAD)) {
942 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
943 return;
944 }
945
946 WARN_ON(atomic_read(&sk->sk_rmem_alloc));
947 WARN_ON(atomic_read(&sk->sk_wmem_alloc));
948 WARN_ON(nlk_sk(sk)->groups);
949 }
950
951 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
952 * SMP. Look, when several writers sleep and reader wakes them up, all but one
953 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
954 * this, _but_ remember, it adds useless work on UP machines.
955 */
956
957 void netlink_table_grab(void)
958 __acquires(nl_table_lock)
959 {
960 might_sleep();
961
962 write_lock_irq(&nl_table_lock);
963
964 if (atomic_read(&nl_table_users)) {
965 DECLARE_WAITQUEUE(wait, current);
966
967 add_wait_queue_exclusive(&nl_table_wait, &wait);
968 for (;;) {
969 set_current_state(TASK_UNINTERRUPTIBLE);
970 if (atomic_read(&nl_table_users) == 0)
971 break;
972 write_unlock_irq(&nl_table_lock);
973 schedule();
974 write_lock_irq(&nl_table_lock);
975 }
976
977 __set_current_state(TASK_RUNNING);
978 remove_wait_queue(&nl_table_wait, &wait);
979 }
980 }
981
982 void netlink_table_ungrab(void)
983 __releases(nl_table_lock)
984 {
985 write_unlock_irq(&nl_table_lock);
986 wake_up(&nl_table_wait);
987 }
988
989 static inline void
990 netlink_lock_table(void)
991 {
992 /* read_lock() synchronizes us to netlink_table_grab */
993
994 read_lock(&nl_table_lock);
995 atomic_inc(&nl_table_users);
996 read_unlock(&nl_table_lock);
997 }
998
999 static inline void
1000 netlink_unlock_table(void)
1001 {
1002 if (atomic_dec_and_test(&nl_table_users))
1003 wake_up(&nl_table_wait);
1004 }
1005
1006 struct netlink_compare_arg
1007 {
1008 possible_net_t pnet;
1009 u32 portid;
1010 };
1011
1012 /* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
1013 #define netlink_compare_arg_len \
1014 (offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
1015
1016 static inline int netlink_compare(struct rhashtable_compare_arg *arg,
1017 const void *ptr)
1018 {
1019 const struct netlink_compare_arg *x = arg->key;
1020 const struct netlink_sock *nlk = ptr;
1021
1022 return nlk->portid != x->portid ||
1023 !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
1024 }
1025
1026 static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
1027 struct net *net, u32 portid)
1028 {
1029 memset(arg, 0, sizeof(*arg));
1030 write_pnet(&arg->pnet, net);
1031 arg->portid = portid;
1032 }
1033
1034 static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
1035 struct net *net)
1036 {
1037 struct netlink_compare_arg arg;
1038
1039 netlink_compare_arg_init(&arg, net, portid);
1040 return rhashtable_lookup_fast(&table->hash, &arg,
1041 netlink_rhashtable_params);
1042 }
1043
1044 static int __netlink_insert(struct netlink_table *table, struct sock *sk)
1045 {
1046 struct netlink_compare_arg arg;
1047
1048 netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
1049 return rhashtable_lookup_insert_key(&table->hash, &arg,
1050 &nlk_sk(sk)->node,
1051 netlink_rhashtable_params);
1052 }
1053
1054 static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
1055 {
1056 struct netlink_table *table = &nl_table[protocol];
1057 struct sock *sk;
1058
1059 rcu_read_lock();
1060 sk = __netlink_lookup(table, portid, net);
1061 if (sk)
1062 sock_hold(sk);
1063 rcu_read_unlock();
1064
1065 return sk;
1066 }
1067
1068 static const struct proto_ops netlink_ops;
1069
1070 static void
1071 netlink_update_listeners(struct sock *sk)
1072 {
1073 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
1074 unsigned long mask;
1075 unsigned int i;
1076 struct listeners *listeners;
1077
1078 listeners = nl_deref_protected(tbl->listeners);
1079 if (!listeners)
1080 return;
1081
1082 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
1083 mask = 0;
1084 sk_for_each_bound(sk, &tbl->mc_list) {
1085 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
1086 mask |= nlk_sk(sk)->groups[i];
1087 }
1088 listeners->masks[i] = mask;
1089 }
1090 /* this function is only called with the netlink table "grabbed", which
1091 * makes sure updates are visible before bind or setsockopt return. */
1092 }
1093
1094 static int netlink_insert(struct sock *sk, u32 portid)
1095 {
1096 struct netlink_table *table = &nl_table[sk->sk_protocol];
1097 int err;
1098
1099 lock_sock(sk);
1100
1101 err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
1102 if (nlk_sk(sk)->bound)
1103 goto err;
1104
1105 err = -ENOMEM;
1106 if (BITS_PER_LONG > 32 &&
1107 unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
1108 goto err;
1109
1110 nlk_sk(sk)->portid = portid;
1111 sock_hold(sk);
1112
1113 err = __netlink_insert(table, sk);
1114 if (err) {
1115 /* In case the hashtable backend returns with -EBUSY
1116 * from here, it must not escape to the caller.
1117 */
1118 if (unlikely(err == -EBUSY))
1119 err = -EOVERFLOW;
1120 if (err == -EEXIST)
1121 err = -EADDRINUSE;
1122 sock_put(sk);
1123 goto err;
1124 }
1125
1126 /* We need to ensure that the socket is hashed and visible. */
1127 smp_wmb();
1128 nlk_sk(sk)->bound = portid;
1129
1130 err:
1131 release_sock(sk);
1132 return err;
1133 }
1134
1135 static void netlink_remove(struct sock *sk)
1136 {
1137 struct netlink_table *table;
1138
1139 table = &nl_table[sk->sk_protocol];
1140 if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
1141 netlink_rhashtable_params)) {
1142 WARN_ON(atomic_read(&sk->sk_refcnt) == 1);
1143 __sock_put(sk);
1144 }
1145
1146 netlink_table_grab();
1147 if (nlk_sk(sk)->subscriptions) {
1148 __sk_del_bind_node(sk);
1149 netlink_update_listeners(sk);
1150 }
1151 if (sk->sk_protocol == NETLINK_GENERIC)
1152 atomic_inc(&genl_sk_destructing_cnt);
1153 netlink_table_ungrab();
1154 }
1155
1156 static struct proto netlink_proto = {
1157 .name = "NETLINK",
1158 .owner = THIS_MODULE,
1159 .obj_size = sizeof(struct netlink_sock),
1160 };
1161
1162 static int __netlink_create(struct net *net, struct socket *sock,
1163 struct mutex *cb_mutex, int protocol,
1164 int kern)
1165 {
1166 struct sock *sk;
1167 struct netlink_sock *nlk;
1168
1169 sock->ops = &netlink_ops;
1170
1171 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
1172 if (!sk)
1173 return -ENOMEM;
1174
1175 sock_init_data(sock, sk);
1176
1177 nlk = nlk_sk(sk);
1178 if (cb_mutex) {
1179 nlk->cb_mutex = cb_mutex;
1180 } else {
1181 nlk->cb_mutex = &nlk->cb_def_mutex;
1182 mutex_init(nlk->cb_mutex);
1183 }
1184 init_waitqueue_head(&nlk->wait);
1185 #ifdef CONFIG_NETLINK_MMAP
1186 mutex_init(&nlk->pg_vec_lock);
1187 #endif
1188
1189 sk->sk_destruct = netlink_sock_destruct;
1190 sk->sk_protocol = protocol;
1191 return 0;
1192 }
1193
1194 static int netlink_create(struct net *net, struct socket *sock, int protocol,
1195 int kern)
1196 {
1197 struct module *module = NULL;
1198 struct mutex *cb_mutex;
1199 struct netlink_sock *nlk;
1200 int (*bind)(struct net *net, int group);
1201 void (*unbind)(struct net *net, int group);
1202 int err = 0;
1203
1204 sock->state = SS_UNCONNECTED;
1205
1206 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
1207 return -ESOCKTNOSUPPORT;
1208
1209 if (protocol < 0 || protocol >= MAX_LINKS)
1210 return -EPROTONOSUPPORT;
1211
1212 netlink_lock_table();
1213 #ifdef CONFIG_MODULES
1214 if (!nl_table[protocol].registered) {
1215 netlink_unlock_table();
1216 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
1217 netlink_lock_table();
1218 }
1219 #endif
1220 if (nl_table[protocol].registered &&
1221 try_module_get(nl_table[protocol].module))
1222 module = nl_table[protocol].module;
1223 else
1224 err = -EPROTONOSUPPORT;
1225 cb_mutex = nl_table[protocol].cb_mutex;
1226 bind = nl_table[protocol].bind;
1227 unbind = nl_table[protocol].unbind;
1228 netlink_unlock_table();
1229
1230 if (err < 0)
1231 goto out;
1232
1233 err = __netlink_create(net, sock, cb_mutex, protocol, kern);
1234 if (err < 0)
1235 goto out_module;
1236
1237 local_bh_disable();
1238 sock_prot_inuse_add(net, &netlink_proto, 1);
1239 local_bh_enable();
1240
1241 nlk = nlk_sk(sock->sk);
1242 nlk->module = module;
1243 nlk->netlink_bind = bind;
1244 nlk->netlink_unbind = unbind;
1245 out:
1246 return err;
1247
1248 out_module:
1249 module_put(module);
1250 goto out;
1251 }
1252
1253 static void deferred_put_nlk_sk(struct rcu_head *head)
1254 {
1255 struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
1256
1257 sock_put(&nlk->sk);
1258 }
1259
1260 static int netlink_release(struct socket *sock)
1261 {
1262 struct sock *sk = sock->sk;
1263 struct netlink_sock *nlk;
1264
1265 if (!sk)
1266 return 0;
1267
1268 netlink_remove(sk);
1269 sock_orphan(sk);
1270 nlk = nlk_sk(sk);
1271
1272 /*
1273 * OK. Socket is unlinked, any packets that arrive now
1274 * will be purged.
1275 */
1276
1277 /* must not acquire netlink_table_lock in any way again before unbind
1278 * and notifying genetlink is done as otherwise it might deadlock
1279 */
1280 if (nlk->netlink_unbind) {
1281 int i;
1282
1283 for (i = 0; i < nlk->ngroups; i++)
1284 if (test_bit(i, nlk->groups))
1285 nlk->netlink_unbind(sock_net(sk), i + 1);
1286 }
1287 if (sk->sk_protocol == NETLINK_GENERIC &&
1288 atomic_dec_return(&genl_sk_destructing_cnt) == 0)
1289 wake_up(&genl_sk_destructing_waitq);
1290
1291 sock->sk = NULL;
1292 wake_up_interruptible_all(&nlk->wait);
1293
1294 skb_queue_purge(&sk->sk_write_queue);
1295
1296 if (nlk->portid) {
1297 struct netlink_notify n = {
1298 .net = sock_net(sk),
1299 .protocol = sk->sk_protocol,
1300 .portid = nlk->portid,
1301 };
1302 atomic_notifier_call_chain(&netlink_chain,
1303 NETLINK_URELEASE, &n);
1304 }
1305
1306 module_put(nlk->module);
1307
1308 if (netlink_is_kernel(sk)) {
1309 netlink_table_grab();
1310 BUG_ON(nl_table[sk->sk_protocol].registered == 0);
1311 if (--nl_table[sk->sk_protocol].registered == 0) {
1312 struct listeners *old;
1313
1314 old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
1315 RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
1316 kfree_rcu(old, rcu);
1317 nl_table[sk->sk_protocol].module = NULL;
1318 nl_table[sk->sk_protocol].bind = NULL;
1319 nl_table[sk->sk_protocol].unbind = NULL;
1320 nl_table[sk->sk_protocol].flags = 0;
1321 nl_table[sk->sk_protocol].registered = 0;
1322 }
1323 netlink_table_ungrab();
1324 }
1325
1326 kfree(nlk->groups);
1327 nlk->groups = NULL;
1328
1329 local_bh_disable();
1330 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
1331 local_bh_enable();
1332 call_rcu(&nlk->rcu, deferred_put_nlk_sk);
1333 return 0;
1334 }
1335
1336 static int netlink_autobind(struct socket *sock)
1337 {
1338 struct sock *sk = sock->sk;
1339 struct net *net = sock_net(sk);
1340 struct netlink_table *table = &nl_table[sk->sk_protocol];
1341 s32 portid = task_tgid_vnr(current);
1342 int err;
1343 s32 rover = -4096;
1344 bool ok;
1345
1346 retry:
1347 cond_resched();
1348 rcu_read_lock();
1349 ok = !__netlink_lookup(table, portid, net);
1350 rcu_read_unlock();
1351 if (!ok) {
1352 /* Bind collision, search negative portid values. */
1353 if (rover == -4096)
1354 /* rover will be in range [S32_MIN, -4097] */
1355 rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
1356 else if (rover >= -4096)
1357 rover = -4097;
1358 portid = rover--;
1359 goto retry;
1360 }
1361
1362 err = netlink_insert(sk, portid);
1363 if (err == -EADDRINUSE)
1364 goto retry;
1365
1366 /* If 2 threads race to autobind, that is fine. */
1367 if (err == -EBUSY)
1368 err = 0;
1369
1370 return err;
1371 }
1372
1373 /**
1374 * __netlink_ns_capable - General netlink message capability test
1375 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
1376 * @user_ns: The user namespace of the capability to use
1377 * @cap: The capability to use
1378 *
1379 * Test to see if the opener of the socket we received the message
1380 * from had when the netlink socket was created and the sender of the
1381 * message has has the capability @cap in the user namespace @user_ns.
1382 */
1383 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
1384 struct user_namespace *user_ns, int cap)
1385 {
1386 return ((nsp->flags & NETLINK_SKB_DST) ||
1387 file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
1388 ns_capable(user_ns, cap);
1389 }
1390 EXPORT_SYMBOL(__netlink_ns_capable);
1391
1392 /**
1393 * netlink_ns_capable - General netlink message capability test
1394 * @skb: socket buffer holding a netlink command from userspace
1395 * @user_ns: The user namespace of the capability to use
1396 * @cap: The capability to use
1397 *
1398 * Test to see if the opener of the socket we received the message
1399 * from had when the netlink socket was created and the sender of the
1400 * message has has the capability @cap in the user namespace @user_ns.
1401 */
1402 bool netlink_ns_capable(const struct sk_buff *skb,
1403 struct user_namespace *user_ns, int cap)
1404 {
1405 return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
1406 }
1407 EXPORT_SYMBOL(netlink_ns_capable);
1408
1409 /**
1410 * netlink_capable - Netlink global message capability test
1411 * @skb: socket buffer holding a netlink command from userspace
1412 * @cap: The capability to use
1413 *
1414 * Test to see if the opener of the socket we received the message
1415 * from had when the netlink socket was created and the sender of the
1416 * message has has the capability @cap in all user namespaces.
1417 */
1418 bool netlink_capable(const struct sk_buff *skb, int cap)
1419 {
1420 return netlink_ns_capable(skb, &init_user_ns, cap);
1421 }
1422 EXPORT_SYMBOL(netlink_capable);
1423
1424 /**
1425 * netlink_net_capable - Netlink network namespace message capability test
1426 * @skb: socket buffer holding a netlink command from userspace
1427 * @cap: The capability to use
1428 *
1429 * Test to see if the opener of the socket we received the message
1430 * from had when the netlink socket was created and the sender of the
1431 * message has has the capability @cap over the network namespace of
1432 * the socket we received the message from.
1433 */
1434 bool netlink_net_capable(const struct sk_buff *skb, int cap)
1435 {
1436 return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
1437 }
1438 EXPORT_SYMBOL(netlink_net_capable);
1439
1440 static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
1441 {
1442 return (nl_table[sock->sk->sk_protocol].flags & flag) ||
1443 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
1444 }
1445
1446 static void
1447 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
1448 {
1449 struct netlink_sock *nlk = nlk_sk(sk);
1450
1451 if (nlk->subscriptions && !subscriptions)
1452 __sk_del_bind_node(sk);
1453 else if (!nlk->subscriptions && subscriptions)
1454 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
1455 nlk->subscriptions = subscriptions;
1456 }
1457
1458 static int netlink_realloc_groups(struct sock *sk)
1459 {
1460 struct netlink_sock *nlk = nlk_sk(sk);
1461 unsigned int groups;
1462 unsigned long *new_groups;
1463 int err = 0;
1464
1465 netlink_table_grab();
1466
1467 groups = nl_table[sk->sk_protocol].groups;
1468 if (!nl_table[sk->sk_protocol].registered) {
1469 err = -ENOENT;
1470 goto out_unlock;
1471 }
1472
1473 if (nlk->ngroups >= groups)
1474 goto out_unlock;
1475
1476 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
1477 if (new_groups == NULL) {
1478 err = -ENOMEM;
1479 goto out_unlock;
1480 }
1481 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
1482 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));
1483
1484 nlk->groups = new_groups;
1485 nlk->ngroups = groups;
1486 out_unlock:
1487 netlink_table_ungrab();
1488 return err;
1489 }
1490
1491 static void netlink_undo_bind(int group, long unsigned int groups,
1492 struct sock *sk)
1493 {
1494 struct netlink_sock *nlk = nlk_sk(sk);
1495 int undo;
1496
1497 if (!nlk->netlink_unbind)
1498 return;
1499
1500 for (undo = 0; undo < group; undo++)
1501 if (test_bit(undo, &groups))
1502 nlk->netlink_unbind(sock_net(sk), undo + 1);
1503 }
1504
1505 static int netlink_bind(struct socket *sock, struct sockaddr *addr,
1506 int addr_len)
1507 {
1508 struct sock *sk = sock->sk;
1509 struct net *net = sock_net(sk);
1510 struct netlink_sock *nlk = nlk_sk(sk);
1511 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
1512 int err;
1513 long unsigned int groups = nladdr->nl_groups;
1514 bool bound;
1515
1516 if (addr_len < sizeof(struct sockaddr_nl))
1517 return -EINVAL;
1518
1519 if (nladdr->nl_family != AF_NETLINK)
1520 return -EINVAL;
1521
1522 /* Only superuser is allowed to listen multicasts */
1523 if (groups) {
1524 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1525 return -EPERM;
1526 err = netlink_realloc_groups(sk);
1527 if (err)
1528 return err;
1529 }
1530
1531 bound = nlk->bound;
1532 if (bound) {
1533 /* Ensure nlk->portid is up-to-date. */
1534 smp_rmb();
1535
1536 if (nladdr->nl_pid != nlk->portid)
1537 return -EINVAL;
1538 }
1539
1540 if (nlk->netlink_bind && groups) {
1541 int group;
1542
1543 for (group = 0; group < nlk->ngroups; group++) {
1544 if (!test_bit(group, &groups))
1545 continue;
1546 err = nlk->netlink_bind(net, group + 1);
1547 if (!err)
1548 continue;
1549 netlink_undo_bind(group, groups, sk);
1550 return err;
1551 }
1552 }
1553
1554 /* No need for barriers here as we return to user-space without
1555 * using any of the bound attributes.
1556 */
1557 if (!bound) {
1558 err = nladdr->nl_pid ?
1559 netlink_insert(sk, nladdr->nl_pid) :
1560 netlink_autobind(sock);
1561 if (err) {
1562 netlink_undo_bind(nlk->ngroups, groups, sk);
1563 return err;
1564 }
1565 }
1566
1567 if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
1568 return 0;
1569
1570 netlink_table_grab();
1571 netlink_update_subscriptions(sk, nlk->subscriptions +
1572 hweight32(groups) -
1573 hweight32(nlk->groups[0]));
1574 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
1575 netlink_update_listeners(sk);
1576 netlink_table_ungrab();
1577
1578 return 0;
1579 }
1580
1581 static int netlink_connect(struct socket *sock, struct sockaddr *addr,
1582 int alen, int flags)
1583 {
1584 int err = 0;
1585 struct sock *sk = sock->sk;
1586 struct netlink_sock *nlk = nlk_sk(sk);
1587 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
1588
1589 if (alen < sizeof(addr->sa_family))
1590 return -EINVAL;
1591
1592 if (addr->sa_family == AF_UNSPEC) {
1593 sk->sk_state = NETLINK_UNCONNECTED;
1594 nlk->dst_portid = 0;
1595 nlk->dst_group = 0;
1596 return 0;
1597 }
1598 if (addr->sa_family != AF_NETLINK)
1599 return -EINVAL;
1600
1601 if ((nladdr->nl_groups || nladdr->nl_pid) &&
1602 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1603 return -EPERM;
1604
1605 /* No need for barriers here as we return to user-space without
1606 * using any of the bound attributes.
1607 */
1608 if (!nlk->bound)
1609 err = netlink_autobind(sock);
1610
1611 if (err == 0) {
1612 sk->sk_state = NETLINK_CONNECTED;
1613 nlk->dst_portid = nladdr->nl_pid;
1614 nlk->dst_group = ffs(nladdr->nl_groups);
1615 }
1616
1617 return err;
1618 }
1619
1620 static int netlink_getname(struct socket *sock, struct sockaddr *addr,
1621 int *addr_len, int peer)
1622 {
1623 struct sock *sk = sock->sk;
1624 struct netlink_sock *nlk = nlk_sk(sk);
1625 DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1626
1627 nladdr->nl_family = AF_NETLINK;
1628 nladdr->nl_pad = 0;
1629 *addr_len = sizeof(*nladdr);
1630
1631 if (peer) {
1632 nladdr->nl_pid = nlk->dst_portid;
1633 nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
1634 } else {
1635 nladdr->nl_pid = nlk->portid;
1636 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
1637 }
1638 return 0;
1639 }
1640
1641 static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
1642 {
1643 struct sock *sock;
1644 struct netlink_sock *nlk;
1645
1646 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
1647 if (!sock)
1648 return ERR_PTR(-ECONNREFUSED);
1649
1650 /* Don't bother queuing skb if kernel socket has no input function */
1651 nlk = nlk_sk(sock);
1652 if (sock->sk_state == NETLINK_CONNECTED &&
1653 nlk->dst_portid != nlk_sk(ssk)->portid) {
1654 sock_put(sock);
1655 return ERR_PTR(-ECONNREFUSED);
1656 }
1657 return sock;
1658 }
1659
1660 struct sock *netlink_getsockbyfilp(struct file *filp)
1661 {
1662 struct inode *inode = file_inode(filp);
1663 struct sock *sock;
1664
1665 if (!S_ISSOCK(inode->i_mode))
1666 return ERR_PTR(-ENOTSOCK);
1667
1668 sock = SOCKET_I(inode)->sk;
1669 if (sock->sk_family != AF_NETLINK)
1670 return ERR_PTR(-EINVAL);
1671
1672 sock_hold(sock);
1673 return sock;
1674 }
1675
1676 static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
1677 int broadcast)
1678 {
1679 struct sk_buff *skb;
1680 void *data;
1681
1682 if (size <= NLMSG_GOODSIZE || broadcast)
1683 return alloc_skb(size, GFP_KERNEL);
1684
1685 size = SKB_DATA_ALIGN(size) +
1686 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1687
1688 data = vmalloc(size);
1689 if (data == NULL)
1690 return NULL;
1691
1692 skb = __build_skb(data, size);
1693 if (skb == NULL)
1694 vfree(data);
1695 else
1696 skb->destructor = netlink_skb_destructor;
1697
1698 return skb;
1699 }
1700
1701 /*
1702 * Attach a skb to a netlink socket.
1703 * The caller must hold a reference to the destination socket. On error, the
1704 * reference is dropped. The skb is not send to the destination, just all
1705 * all error checks are performed and memory in the queue is reserved.
1706 * Return values:
1707 * < 0: error. skb freed, reference to sock dropped.
1708 * 0: continue
1709 * 1: repeat lookup - reference dropped while waiting for socket memory.
1710 */
1711 int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
1712 long *timeo, struct sock *ssk)
1713 {
1714 struct netlink_sock *nlk;
1715
1716 nlk = nlk_sk(sk);
1717
1718 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1719 test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1720 !netlink_skb_is_mmaped(skb)) {
1721 DECLARE_WAITQUEUE(wait, current);
1722 if (!*timeo) {
1723 if (!ssk || netlink_is_kernel(ssk))
1724 netlink_overrun(sk);
1725 sock_put(sk);
1726 kfree_skb(skb);
1727 return -EAGAIN;
1728 }
1729
1730 __set_current_state(TASK_INTERRUPTIBLE);
1731 add_wait_queue(&nlk->wait, &wait);
1732
1733 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1734 test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1735 !sock_flag(sk, SOCK_DEAD))
1736 *timeo = schedule_timeout(*timeo);
1737
1738 __set_current_state(TASK_RUNNING);
1739 remove_wait_queue(&nlk->wait, &wait);
1740 sock_put(sk);
1741
1742 if (signal_pending(current)) {
1743 kfree_skb(skb);
1744 return sock_intr_errno(*timeo);
1745 }
1746 return 1;
1747 }
1748 netlink_skb_set_owner_r(skb, sk);
1749 return 0;
1750 }
1751
1752 static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1753 {
1754 int len = skb->len;
1755
1756 netlink_deliver_tap(skb);
1757
1758 #ifdef CONFIG_NETLINK_MMAP
1759 if (netlink_skb_is_mmaped(skb))
1760 netlink_queue_mmaped_skb(sk, skb);
1761 else if (netlink_rx_is_mmaped(sk))
1762 netlink_ring_set_copied(sk, skb);
1763 else
1764 #endif /* CONFIG_NETLINK_MMAP */
1765 skb_queue_tail(&sk->sk_receive_queue, skb);
1766 sk->sk_data_ready(sk);
1767 return len;
1768 }
1769
1770 int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1771 {
1772 int len = __netlink_sendskb(sk, skb);
1773
1774 sock_put(sk);
1775 return len;
1776 }
1777
1778 void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
1779 {
1780 kfree_skb(skb);
1781 sock_put(sk);
1782 }
1783
1784 static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
1785 {
1786 int delta;
1787
1788 WARN_ON(skb->sk != NULL);
1789 if (netlink_skb_is_mmaped(skb))
1790 return skb;
1791
1792 delta = skb->end - skb->tail;
1793 if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
1794 return skb;
1795
1796 if (skb_shared(skb)) {
1797 struct sk_buff *nskb = skb_clone(skb, allocation);
1798 if (!nskb)
1799 return skb;
1800 consume_skb(skb);
1801 skb = nskb;
1802 }
1803
1804 if (!pskb_expand_head(skb, 0, -delta, allocation))
1805 skb->truesize -= delta;
1806
1807 return skb;
1808 }
1809
1810 static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
1811 struct sock *ssk)
1812 {
1813 int ret;
1814 struct netlink_sock *nlk = nlk_sk(sk);
1815
1816 ret = -ECONNREFUSED;
1817 if (nlk->netlink_rcv != NULL) {
1818 ret = skb->len;
1819 netlink_skb_set_owner_r(skb, sk);
1820 NETLINK_CB(skb).sk = ssk;
1821 netlink_deliver_tap_kernel(sk, ssk, skb);
1822 nlk->netlink_rcv(skb);
1823 consume_skb(skb);
1824 } else {
1825 kfree_skb(skb);
1826 }
1827 sock_put(sk);
1828 return ret;
1829 }
1830
1831 int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1832 u32 portid, int nonblock)
1833 {
1834 struct sock *sk;
1835 int err;
1836 long timeo;
1837
1838 skb = netlink_trim(skb, gfp_any());
1839
1840 timeo = sock_sndtimeo(ssk, nonblock);
1841 retry:
1842 sk = netlink_getsockbyportid(ssk, portid);
1843 if (IS_ERR(sk)) {
1844 kfree_skb(skb);
1845 return PTR_ERR(sk);
1846 }
1847 if (netlink_is_kernel(sk))
1848 return netlink_unicast_kernel(sk, skb, ssk);
1849
1850 if (sk_filter(sk, skb)) {
1851 err = skb->len;
1852 kfree_skb(skb);
1853 sock_put(sk);
1854 return err;
1855 }
1856
1857 err = netlink_attachskb(sk, skb, &timeo, ssk);
1858 if (err == 1)
1859 goto retry;
1860 if (err)
1861 return err;
1862
1863 return netlink_sendskb(sk, skb);
1864 }
1865 EXPORT_SYMBOL(netlink_unicast);
1866
1867 struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
1868 u32 dst_portid, gfp_t gfp_mask)
1869 {
1870 #ifdef CONFIG_NETLINK_MMAP
1871 struct sock *sk = NULL;
1872 struct sk_buff *skb;
1873 struct netlink_ring *ring;
1874 struct nl_mmap_hdr *hdr;
1875 unsigned int maxlen;
1876
1877 sk = netlink_getsockbyportid(ssk, dst_portid);
1878 if (IS_ERR(sk))
1879 goto out;
1880
1881 ring = &nlk_sk(sk)->rx_ring;
1882 /* fast-path without atomic ops for common case: non-mmaped receiver */
1883 if (ring->pg_vec == NULL)
1884 goto out_put;
1885
1886 if (ring->frame_size - NL_MMAP_HDRLEN < size)
1887 goto out_put;
1888
1889 skb = alloc_skb_head(gfp_mask);
1890 if (skb == NULL)
1891 goto err1;
1892
1893 spin_lock_bh(&sk->sk_receive_queue.lock);
1894 /* check again under lock */
1895 if (ring->pg_vec == NULL)
1896 goto out_free;
1897
1898 /* check again under lock */
1899 maxlen = ring->frame_size - NL_MMAP_HDRLEN;
1900 if (maxlen < size)
1901 goto out_free;
1902
1903 netlink_forward_ring(ring);
1904 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
1905 if (hdr == NULL)
1906 goto err2;
1907 netlink_ring_setup_skb(skb, sk, ring, hdr);
1908 netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
1909 atomic_inc(&ring->pending);
1910 netlink_increment_head(ring);
1911
1912 spin_unlock_bh(&sk->sk_receive_queue.lock);
1913 return skb;
1914
1915 err2:
1916 kfree_skb(skb);
1917 spin_unlock_bh(&sk->sk_receive_queue.lock);
1918 netlink_overrun(sk);
1919 err1:
1920 sock_put(sk);
1921 return NULL;
1922
1923 out_free:
1924 kfree_skb(skb);
1925 spin_unlock_bh(&sk->sk_receive_queue.lock);
1926 out_put:
1927 sock_put(sk);
1928 out:
1929 #endif
1930 return alloc_skb(size, gfp_mask);
1931 }
1932 EXPORT_SYMBOL_GPL(netlink_alloc_skb);
1933
1934 int netlink_has_listeners(struct sock *sk, unsigned int group)
1935 {
1936 int res = 0;
1937 struct listeners *listeners;
1938
1939 BUG_ON(!netlink_is_kernel(sk));
1940
1941 rcu_read_lock();
1942 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
1943
1944 if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1945 res = test_bit(group - 1, listeners->masks);
1946
1947 rcu_read_unlock();
1948
1949 return res;
1950 }
1951 EXPORT_SYMBOL_GPL(netlink_has_listeners);
1952
1953 static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
1954 {
1955 struct netlink_sock *nlk = nlk_sk(sk);
1956
1957 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1958 !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1959 netlink_skb_set_owner_r(skb, sk);
1960 __netlink_sendskb(sk, skb);
1961 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
1962 }
1963 return -1;
1964 }
1965
1966 struct netlink_broadcast_data {
1967 struct sock *exclude_sk;
1968 struct net *net;
1969 u32 portid;
1970 u32 group;
1971 int failure;
1972 int delivery_failure;
1973 int congested;
1974 int delivered;
1975 gfp_t allocation;
1976 struct sk_buff *skb, *skb2;
1977 int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
1978 void *tx_data;
1979 };
1980
1981 static void do_one_broadcast(struct sock *sk,
1982 struct netlink_broadcast_data *p)
1983 {
1984 struct netlink_sock *nlk = nlk_sk(sk);
1985 int val;
1986
1987 if (p->exclude_sk == sk)
1988 return;
1989
1990 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1991 !test_bit(p->group - 1, nlk->groups))
1992 return;
1993
1994 if (!net_eq(sock_net(sk), p->net)) {
1995 if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
1996 return;
1997
1998 if (!peernet_has_id(sock_net(sk), p->net))
1999 return;
2000
2001 if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
2002 CAP_NET_BROADCAST))
2003 return;
2004 }
2005
2006 if (p->failure) {
2007 netlink_overrun(sk);
2008 return;
2009 }
2010
2011 sock_hold(sk);
2012 if (p->skb2 == NULL) {
2013 if (skb_shared(p->skb)) {
2014 p->skb2 = skb_clone(p->skb, p->allocation);
2015 } else {
2016 p->skb2 = skb_get(p->skb);
2017 /*
2018 * skb ownership may have been set when
2019 * delivered to a previous socket.
2020 */
2021 skb_orphan(p->skb2);
2022 }
2023 }
2024 if (p->skb2 == NULL) {
2025 netlink_overrun(sk);
2026 /* Clone failed. Notify ALL listeners. */
2027 p->failure = 1;
2028 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
2029 p->delivery_failure = 1;
2030 goto out;
2031 }
2032 if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
2033 kfree_skb(p->skb2);
2034 p->skb2 = NULL;
2035 goto out;
2036 }
2037 if (sk_filter(sk, p->skb2)) {
2038 kfree_skb(p->skb2);
2039 p->skb2 = NULL;
2040 goto out;
2041 }
2042 NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
2043 NETLINK_CB(p->skb2).nsid_is_set = true;
2044 val = netlink_broadcast_deliver(sk, p->skb2);
2045 if (val < 0) {
2046 netlink_overrun(sk);
2047 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
2048 p->delivery_failure = 1;
2049 } else {
2050 p->congested |= val;
2051 p->delivered = 1;
2052 p->skb2 = NULL;
2053 }
2054 out:
2055 sock_put(sk);
2056 }
2057
2058 int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
2059 u32 group, gfp_t allocation,
2060 int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
2061 void *filter_data)
2062 {
2063 struct net *net = sock_net(ssk);
2064 struct netlink_broadcast_data info;
2065 struct sock *sk;
2066
2067 skb = netlink_trim(skb, allocation);
2068
2069 info.exclude_sk = ssk;
2070 info.net = net;
2071 info.portid = portid;
2072 info.group = group;
2073 info.failure = 0;
2074 info.delivery_failure = 0;
2075 info.congested = 0;
2076 info.delivered = 0;
2077 info.allocation = allocation;
2078 info.skb = skb;
2079 info.skb2 = NULL;
2080 info.tx_filter = filter;
2081 info.tx_data = filter_data;
2082
2083 /* While we sleep in clone, do not allow to change socket list */
2084
2085 netlink_lock_table();
2086
2087 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
2088 do_one_broadcast(sk, &info);
2089
2090 consume_skb(skb);
2091
2092 netlink_unlock_table();
2093
2094 if (info.delivery_failure) {
2095 kfree_skb(info.skb2);
2096 return -ENOBUFS;
2097 }
2098 consume_skb(info.skb2);
2099
2100 if (info.delivered) {
2101 if (info.congested && (allocation & __GFP_WAIT))
2102 yield();
2103 return 0;
2104 }
2105 return -ESRCH;
2106 }
2107 EXPORT_SYMBOL(netlink_broadcast_filtered);
2108
2109 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
2110 u32 group, gfp_t allocation)
2111 {
2112 return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
2113 NULL, NULL);
2114 }
2115 EXPORT_SYMBOL(netlink_broadcast);
2116
2117 struct netlink_set_err_data {
2118 struct sock *exclude_sk;
2119 u32 portid;
2120 u32 group;
2121 int code;
2122 };
2123
2124 static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
2125 {
2126 struct netlink_sock *nlk = nlk_sk(sk);
2127 int ret = 0;
2128
2129 if (sk == p->exclude_sk)
2130 goto out;
2131
2132 if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
2133 goto out;
2134
2135 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
2136 !test_bit(p->group - 1, nlk->groups))
2137 goto out;
2138
2139 if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
2140 ret = 1;
2141 goto out;
2142 }
2143
2144 sk->sk_err = p->code;
2145 sk->sk_error_report(sk);
2146 out:
2147 return ret;
2148 }
2149
2150 /**
2151 * netlink_set_err - report error to broadcast listeners
2152 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
2153 * @portid: the PORTID of a process that we want to skip (if any)
2154 * @group: the broadcast group that will notice the error
2155 * @code: error code, must be negative (as usual in kernelspace)
2156 *
2157 * This function returns the number of broadcast listeners that have set the
2158 * NETLINK_NO_ENOBUFS socket option.
2159 */
2160 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
2161 {
2162 struct netlink_set_err_data info;
2163 struct sock *sk;
2164 int ret = 0;
2165
2166 info.exclude_sk = ssk;
2167 info.portid = portid;
2168 info.group = group;
2169 /* sk->sk_err wants a positive error value */
2170 info.code = -code;
2171
2172 read_lock(&nl_table_lock);
2173
2174 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
2175 ret += do_one_set_err(sk, &info);
2176
2177 read_unlock(&nl_table_lock);
2178 return ret;
2179 }
2180 EXPORT_SYMBOL(netlink_set_err);
2181
2182 /* must be called with netlink table grabbed */
2183 static void netlink_update_socket_mc(struct netlink_sock *nlk,
2184 unsigned int group,
2185 int is_new)
2186 {
2187 int old, new = !!is_new, subscriptions;
2188
2189 old = test_bit(group - 1, nlk->groups);
2190 subscriptions = nlk->subscriptions - old + new;
2191 if (new)
2192 __set_bit(group - 1, nlk->groups);
2193 else
2194 __clear_bit(group - 1, nlk->groups);
2195 netlink_update_subscriptions(&nlk->sk, subscriptions);
2196 netlink_update_listeners(&nlk->sk);
2197 }
2198
2199 static int netlink_setsockopt(struct socket *sock, int level, int optname,
2200 char __user *optval, unsigned int optlen)
2201 {
2202 struct sock *sk = sock->sk;
2203 struct netlink_sock *nlk = nlk_sk(sk);
2204 unsigned int val = 0;
2205 int err;
2206
2207 if (level != SOL_NETLINK)
2208 return -ENOPROTOOPT;
2209
2210 if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
2211 optlen >= sizeof(int) &&
2212 get_user(val, (unsigned int __user *)optval))
2213 return -EFAULT;
2214
2215 switch (optname) {
2216 case NETLINK_PKTINFO:
2217 if (val)
2218 nlk->flags |= NETLINK_F_RECV_PKTINFO;
2219 else
2220 nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
2221 err = 0;
2222 break;
2223 case NETLINK_ADD_MEMBERSHIP:
2224 case NETLINK_DROP_MEMBERSHIP: {
2225 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
2226 return -EPERM;
2227 err = netlink_realloc_groups(sk);
2228 if (err)
2229 return err;
2230 if (!val || val - 1 >= nlk->ngroups)
2231 return -EINVAL;
2232 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
2233 err = nlk->netlink_bind(sock_net(sk), val);
2234 if (err)
2235 return err;
2236 }
2237 netlink_table_grab();
2238 netlink_update_socket_mc(nlk, val,
2239 optname == NETLINK_ADD_MEMBERSHIP);
2240 netlink_table_ungrab();
2241 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
2242 nlk->netlink_unbind(sock_net(sk), val);
2243
2244 err = 0;
2245 break;
2246 }
2247 case NETLINK_BROADCAST_ERROR:
2248 if (val)
2249 nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
2250 else
2251 nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
2252 err = 0;
2253 break;
2254 case NETLINK_NO_ENOBUFS:
2255 if (val) {
2256 nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
2257 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
2258 wake_up_interruptible(&nlk->wait);
2259 } else {
2260 nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
2261 }
2262 err = 0;
2263 break;
2264 #ifdef CONFIG_NETLINK_MMAP
2265 case NETLINK_RX_RING:
2266 case NETLINK_TX_RING: {
2267 struct nl_mmap_req req;
2268
2269 /* Rings might consume more memory than queue limits, require
2270 * CAP_NET_ADMIN.
2271 */
2272 if (!capable(CAP_NET_ADMIN))
2273 return -EPERM;
2274 if (optlen < sizeof(req))
2275 return -EINVAL;
2276 if (copy_from_user(&req, optval, sizeof(req)))
2277 return -EFAULT;
2278 err = netlink_set_ring(sk, &req,
2279 optname == NETLINK_TX_RING);
2280 break;
2281 }
2282 #endif /* CONFIG_NETLINK_MMAP */
2283 case NETLINK_LISTEN_ALL_NSID:
2284 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
2285 return -EPERM;
2286
2287 if (val)
2288 nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
2289 else
2290 nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
2291 err = 0;
2292 break;
2293 default:
2294 err = -ENOPROTOOPT;
2295 }
2296 return err;
2297 }
2298
2299 static int netlink_getsockopt(struct socket *sock, int level, int optname,
2300 char __user *optval, int __user *optlen)
2301 {
2302 struct sock *sk = sock->sk;
2303 struct netlink_sock *nlk = nlk_sk(sk);
2304 int len, val, err;
2305
2306 if (level != SOL_NETLINK)
2307 return -ENOPROTOOPT;
2308
2309 if (get_user(len, optlen))
2310 return -EFAULT;
2311 if (len < 0)
2312 return -EINVAL;
2313
2314 switch (optname) {
2315 case NETLINK_PKTINFO:
2316 if (len < sizeof(int))
2317 return -EINVAL;
2318 len = sizeof(int);
2319 val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
2320 if (put_user(len, optlen) ||
2321 put_user(val, optval))
2322 return -EFAULT;
2323 err = 0;
2324 break;
2325 case NETLINK_BROADCAST_ERROR:
2326 if (len < sizeof(int))
2327 return -EINVAL;
2328 len = sizeof(int);
2329 val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
2330 if (put_user(len, optlen) ||
2331 put_user(val, optval))
2332 return -EFAULT;
2333 err = 0;
2334 break;
2335 case NETLINK_NO_ENOBUFS:
2336 if (len < sizeof(int))
2337 return -EINVAL;
2338 len = sizeof(int);
2339 val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
2340 if (put_user(len, optlen) ||
2341 put_user(val, optval))
2342 return -EFAULT;
2343 err = 0;
2344 break;
2345 case NETLINK_LIST_MEMBERSHIPS: {
2346 int pos, idx, shift;
2347
2348 err = 0;
2349 netlink_lock_table();
2350 for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
2351 if (len - pos < sizeof(u32))
2352 break;
2353
2354 idx = pos / sizeof(unsigned long);
2355 shift = (pos % sizeof(unsigned long)) * 8;
2356 if (put_user((u32)(nlk->groups[idx] >> shift),
2357 (u32 __user *)(optval + pos))) {
2358 err = -EFAULT;
2359 break;
2360 }
2361 }
2362 if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
2363 err = -EFAULT;
2364 netlink_unlock_table();
2365 break;
2366 }
2367 default:
2368 err = -ENOPROTOOPT;
2369 }
2370 return err;
2371 }
2372
2373 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
2374 {
2375 struct nl_pktinfo info;
2376
2377 info.group = NETLINK_CB(skb).dst_group;
2378 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
2379 }
2380
2381 static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
2382 struct sk_buff *skb)
2383 {
2384 if (!NETLINK_CB(skb).nsid_is_set)
2385 return;
2386
2387 put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
2388 &NETLINK_CB(skb).nsid);
2389 }
2390
2391 static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
2392 {
2393 struct sock *sk = sock->sk;
2394 struct netlink_sock *nlk = nlk_sk(sk);
2395 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
2396 u32 dst_portid;
2397 u32 dst_group;
2398 struct sk_buff *skb;
2399 int err;
2400 struct scm_cookie scm;
2401 u32 netlink_skb_flags = 0;
2402
2403 if (msg->msg_flags&MSG_OOB)
2404 return -EOPNOTSUPP;
2405
2406 err = scm_send(sock, msg, &scm, true);
2407 if (err < 0)
2408 return err;
2409
2410 if (msg->msg_namelen) {
2411 err = -EINVAL;
2412 if (addr->nl_family != AF_NETLINK)
2413 goto out;
2414 dst_portid = addr->nl_pid;
2415 dst_group = ffs(addr->nl_groups);
2416 err = -EPERM;
2417 if ((dst_group || dst_portid) &&
2418 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
2419 goto out;
2420 netlink_skb_flags |= NETLINK_SKB_DST;
2421 } else {
2422 dst_portid = nlk->dst_portid;
2423 dst_group = nlk->dst_group;
2424 }
2425
2426 if (!nlk->bound) {
2427 err = netlink_autobind(sock);
2428 if (err)
2429 goto out;
2430 } else {
2431 /* Ensure nlk is hashed and visible. */
2432 smp_rmb();
2433 }
2434
2435 /* It's a really convoluted way for userland to ask for mmaped
2436 * sendmsg(), but that's what we've got...
2437 */
2438 if (netlink_tx_is_mmaped(sk) &&
2439 iter_is_iovec(&msg->msg_iter) &&
2440 msg->msg_iter.nr_segs == 1 &&
2441 msg->msg_iter.iov->iov_base == NULL) {
2442 err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
2443 &scm);
2444 goto out;
2445 }
2446
2447 err = -EMSGSIZE;
2448 if (len > sk->sk_sndbuf - 32)
2449 goto out;
2450 err = -ENOBUFS;
2451 skb = netlink_alloc_large_skb(len, dst_group);
2452 if (skb == NULL)
2453 goto out;
2454
2455 NETLINK_CB(skb).portid = nlk->portid;
2456 NETLINK_CB(skb).dst_group = dst_group;
2457 NETLINK_CB(skb).creds = scm.creds;
2458 NETLINK_CB(skb).flags = netlink_skb_flags;
2459
2460 err = -EFAULT;
2461 if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
2462 kfree_skb(skb);
2463 goto out;
2464 }
2465
2466 err = security_netlink_send(sk, skb);
2467 if (err) {
2468 kfree_skb(skb);
2469 goto out;
2470 }
2471
2472 if (dst_group) {
2473 atomic_inc(&skb->users);
2474 netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
2475 }
2476 err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
2477
2478 out:
2479 scm_destroy(&scm);
2480 return err;
2481 }
2482
2483 static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
2484 int flags)
2485 {
2486 struct scm_cookie scm;
2487 struct sock *sk = sock->sk;
2488 struct netlink_sock *nlk = nlk_sk(sk);
2489 int noblock = flags&MSG_DONTWAIT;
2490 size_t copied;
2491 struct sk_buff *skb, *data_skb;
2492 int err, ret;
2493
2494 if (flags&MSG_OOB)
2495 return -EOPNOTSUPP;
2496
2497 copied = 0;
2498
2499 skb = skb_recv_datagram(sk, flags, noblock, &err);
2500 if (skb == NULL)
2501 goto out;
2502
2503 data_skb = skb;
2504
2505 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
2506 if (unlikely(skb_shinfo(skb)->frag_list)) {
2507 /*
2508 * If this skb has a frag_list, then here that means that we
2509 * will have to use the frag_list skb's data for compat tasks
2510 * and the regular skb's data for normal (non-compat) tasks.
2511 *
2512 * If we need to send the compat skb, assign it to the
2513 * 'data_skb' variable so that it will be used below for data
2514 * copying. We keep 'skb' for everything else, including
2515 * freeing both later.
2516 */
2517 if (flags & MSG_CMSG_COMPAT)
2518 data_skb = skb_shinfo(skb)->frag_list;
2519 }
2520 #endif
2521
2522 /* Record the max length of recvmsg() calls for future allocations */
2523 nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
2524 nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
2525 16384);
2526
2527 copied = data_skb->len;
2528 if (len < copied) {
2529 msg->msg_flags |= MSG_TRUNC;
2530 copied = len;
2531 }
2532
2533 skb_reset_transport_header(data_skb);
2534 err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
2535
2536 if (msg->msg_name) {
2537 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
2538 addr->nl_family = AF_NETLINK;
2539 addr->nl_pad = 0;
2540 addr->nl_pid = NETLINK_CB(skb).portid;
2541 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group);
2542 msg->msg_namelen = sizeof(*addr);
2543 }
2544
2545 if (nlk->flags & NETLINK_F_RECV_PKTINFO)
2546 netlink_cmsg_recv_pktinfo(msg, skb);
2547 if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
2548 netlink_cmsg_listen_all_nsid(sk, msg, skb);
2549
2550 memset(&scm, 0, sizeof(scm));
2551 scm.creds = *NETLINK_CREDS(skb);
2552 if (flags & MSG_TRUNC)
2553 copied = data_skb->len;
2554
2555 skb_free_datagram(sk, skb);
2556
2557 if (nlk->cb_running &&
2558 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
2559 ret = netlink_dump(sk);
2560 if (ret) {
2561 sk->sk_err = -ret;
2562 sk->sk_error_report(sk);
2563 }
2564 }
2565
2566 scm_recv(sock, msg, &scm, flags);
2567 out:
2568 netlink_rcv_wake(sk);
2569 return err ? : copied;
2570 }
2571
2572 static void netlink_data_ready(struct sock *sk)
2573 {
2574 BUG();
2575 }
2576
2577 /*
2578 * We export these functions to other modules. They provide a
2579 * complete set of kernel non-blocking support for message
2580 * queueing.
2581 */
2582
2583 struct sock *
2584 __netlink_kernel_create(struct net *net, int unit, struct module *module,
2585 struct netlink_kernel_cfg *cfg)
2586 {
2587 struct socket *sock;
2588 struct sock *sk;
2589 struct netlink_sock *nlk;
2590 struct listeners *listeners = NULL;
2591 struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
2592 unsigned int groups;
2593
2594 BUG_ON(!nl_table);
2595
2596 if (unit < 0 || unit >= MAX_LINKS)
2597 return NULL;
2598
2599 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
2600 return NULL;
2601
2602 if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
2603 goto out_sock_release_nosk;
2604
2605 sk = sock->sk;
2606
2607 if (!cfg || cfg->groups < 32)
2608 groups = 32;
2609 else
2610 groups = cfg->groups;
2611
2612 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2613 if (!listeners)
2614 goto out_sock_release;
2615
2616 sk->sk_data_ready = netlink_data_ready;
2617 if (cfg && cfg->input)
2618 nlk_sk(sk)->netlink_rcv = cfg->input;
2619
2620 if (netlink_insert(sk, 0))
2621 goto out_sock_release;
2622
2623 nlk = nlk_sk(sk);
2624 nlk->flags |= NETLINK_F_KERNEL_SOCKET;
2625
2626 netlink_table_grab();
2627 if (!nl_table[unit].registered) {
2628 nl_table[unit].groups = groups;
2629 rcu_assign_pointer(nl_table[unit].listeners, listeners);
2630 nl_table[unit].cb_mutex = cb_mutex;
2631 nl_table[unit].module = module;
2632 if (cfg) {
2633 nl_table[unit].bind = cfg->bind;
2634 nl_table[unit].unbind = cfg->unbind;
2635 nl_table[unit].flags = cfg->flags;
2636 if (cfg->compare)
2637 nl_table[unit].compare = cfg->compare;
2638 }
2639 nl_table[unit].registered = 1;
2640 } else {
2641 kfree(listeners);
2642 nl_table[unit].registered++;
2643 }
2644 netlink_table_ungrab();
2645 return sk;
2646
2647 out_sock_release:
2648 kfree(listeners);
2649 netlink_kernel_release(sk);
2650 return NULL;
2651
2652 out_sock_release_nosk:
2653 sock_release(sock);
2654 return NULL;
2655 }
2656 EXPORT_SYMBOL(__netlink_kernel_create);
2657
2658 void
2659 netlink_kernel_release(struct sock *sk)
2660 {
2661 if (sk == NULL || sk->sk_socket == NULL)
2662 return;
2663
2664 sock_release(sk->sk_socket);
2665 }
2666 EXPORT_SYMBOL(netlink_kernel_release);
2667
2668 int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
2669 {
2670 struct listeners *new, *old;
2671 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
2672
2673 if (groups < 32)
2674 groups = 32;
2675
2676 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2677 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
2678 if (!new)
2679 return -ENOMEM;
2680 old = nl_deref_protected(tbl->listeners);
2681 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
2682 rcu_assign_pointer(tbl->listeners, new);
2683
2684 kfree_rcu(old, rcu);
2685 }
2686 tbl->groups = groups;
2687
2688 return 0;
2689 }
2690
2691 /**
2692 * netlink_change_ngroups - change number of multicast groups
2693 *
2694 * This changes the number of multicast groups that are available
2695 * on a certain netlink family. Note that it is not possible to
2696 * change the number of groups to below 32. Also note that it does
2697 * not implicitly call netlink_clear_multicast_users() when the
2698 * number of groups is reduced.
2699 *
2700 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
2701 * @groups: The new number of groups.
2702 */
2703 int netlink_change_ngroups(struct sock *sk, unsigned int groups)
2704 {
2705 int err;
2706
2707 netlink_table_grab();
2708 err = __netlink_change_ngroups(sk, groups);
2709 netlink_table_ungrab();
2710
2711 return err;
2712 }
2713
2714 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
2715 {
2716 struct sock *sk;
2717 struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
2718
2719 sk_for_each_bound(sk, &tbl->mc_list)
2720 netlink_update_socket_mc(nlk_sk(sk), group, 0);
2721 }
2722
2723 struct nlmsghdr *
2724 __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2725 {
2726 struct nlmsghdr *nlh;
2727 int size = nlmsg_msg_size(len);
2728
2729 nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2730 nlh->nlmsg_type = type;
2731 nlh->nlmsg_len = size;
2732 nlh->nlmsg_flags = flags;
2733 nlh->nlmsg_pid = portid;
2734 nlh->nlmsg_seq = seq;
2735 if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2736 memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2737 return nlh;
2738 }
2739 EXPORT_SYMBOL(__nlmsg_put);
2740
2741 /*
2742 * It looks a bit ugly.
2743 * It would be better to create kernel thread.
2744 */
2745
2746 static int netlink_dump(struct sock *sk)
2747 {
2748 struct netlink_sock *nlk = nlk_sk(sk);
2749 struct netlink_callback *cb;
2750 struct sk_buff *skb = NULL;
2751 struct nlmsghdr *nlh;
2752 int len, err = -ENOBUFS;
2753 int alloc_min_size;
2754 int alloc_size;
2755
2756 mutex_lock(nlk->cb_mutex);
2757 if (!nlk->cb_running) {
2758 err = -EINVAL;
2759 goto errout_skb;
2760 }
2761
2762 if (!netlink_rx_is_mmaped(sk) &&
2763 atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2764 goto errout_skb;
2765
2766 /* NLMSG_GOODSIZE is small to avoid high order allocations being
2767 * required, but it makes sense to _attempt_ a 16K bytes allocation
2768 * to reduce number of system calls on dump operations, if user
2769 * ever provided a big enough buffer.
2770 */
2771 cb = &nlk->cb;
2772 alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
2773
2774 if (alloc_min_size < nlk->max_recvmsg_len) {
2775 alloc_size = nlk->max_recvmsg_len;
2776 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
2777 GFP_KERNEL |
2778 __GFP_NOWARN |
2779 __GFP_NORETRY);
2780 }
2781 if (!skb) {
2782 alloc_size = alloc_min_size;
2783 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
2784 GFP_KERNEL);
2785 }
2786 if (!skb)
2787 goto errout_skb;
2788
2789 /* Trim skb to allocated size. User is expected to provide buffer as
2790 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
2791 * netlink_recvmsg())). dump will pack as many smaller messages as
2792 * could fit within the allocated skb. skb is typically allocated
2793 * with larger space than required (could be as much as near 2x the
2794 * requested size with align to next power of 2 approach). Allowing
2795 * dump to use the excess space makes it difficult for a user to have a
2796 * reasonable static buffer based on the expected largest dump of a
2797 * single netdev. The outcome is MSG_TRUNC error.
2798 */
2799 skb_reserve(skb, skb_tailroom(skb) - alloc_size);
2800 netlink_skb_set_owner_r(skb, sk);
2801
2802 len = cb->dump(skb, cb);
2803
2804 if (len > 0) {
2805 mutex_unlock(nlk->cb_mutex);
2806
2807 if (sk_filter(sk, skb))
2808 kfree_skb(skb);
2809 else
2810 __netlink_sendskb(sk, skb);
2811 return 0;
2812 }
2813
2814 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
2815 if (!nlh)
2816 goto errout_skb;
2817
2818 nl_dump_check_consistent(cb, nlh);
2819
2820 memcpy(nlmsg_data(nlh), &len, sizeof(len));
2821
2822 if (sk_filter(sk, skb))
2823 kfree_skb(skb);
2824 else
2825 __netlink_sendskb(sk, skb);
2826
2827 if (cb->done)
2828 cb->done(cb);
2829
2830 nlk->cb_running = false;
2831 mutex_unlock(nlk->cb_mutex);
2832 module_put(cb->module);
2833 consume_skb(cb->skb);
2834 return 0;
2835
2836 errout_skb:
2837 mutex_unlock(nlk->cb_mutex);
2838 kfree_skb(skb);
2839 return err;
2840 }
2841
2842 int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
2843 const struct nlmsghdr *nlh,
2844 struct netlink_dump_control *control)
2845 {
2846 struct netlink_callback *cb;
2847 struct sock *sk;
2848 struct netlink_sock *nlk;
2849 int ret;
2850
2851 /* Memory mapped dump requests need to be copied to avoid looping
2852 * on the pending state in netlink_mmap_sendmsg() while the CB hold
2853 * a reference to the skb.
2854 */
2855 if (netlink_skb_is_mmaped(skb)) {
2856 skb = skb_copy(skb, GFP_KERNEL);
2857 if (skb == NULL)
2858 return -ENOBUFS;
2859 } else
2860 atomic_inc(&skb->users);
2861
2862 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
2863 if (sk == NULL) {
2864 ret = -ECONNREFUSED;
2865 goto error_free;
2866 }
2867
2868 nlk = nlk_sk(sk);
2869 mutex_lock(nlk->cb_mutex);
2870 /* A dump is in progress... */
2871 if (nlk->cb_running) {
2872 ret = -EBUSY;
2873 goto error_unlock;
2874 }
2875 /* add reference of module which cb->dump belongs to */
2876 if (!try_module_get(control->module)) {
2877 ret = -EPROTONOSUPPORT;
2878 goto error_unlock;
2879 }
2880
2881 cb = &nlk->cb;
2882 memset(cb, 0, sizeof(*cb));
2883 cb->dump = control->dump;
2884 cb->done = control->done;
2885 cb->nlh = nlh;
2886 cb->data = control->data;
2887 cb->module = control->module;
2888 cb->min_dump_alloc = control->min_dump_alloc;
2889 cb->skb = skb;
2890
2891 nlk->cb_running = true;
2892
2893 mutex_unlock(nlk->cb_mutex);
2894
2895 ret = netlink_dump(sk);
2896 sock_put(sk);
2897
2898 if (ret)
2899 return ret;
2900
2901 /* We successfully started a dump, by returning -EINTR we
2902 * signal not to send ACK even if it was requested.
2903 */
2904 return -EINTR;
2905
2906 error_unlock:
2907 sock_put(sk);
2908 mutex_unlock(nlk->cb_mutex);
2909 error_free:
2910 kfree_skb(skb);
2911 return ret;
2912 }
2913 EXPORT_SYMBOL(__netlink_dump_start);
2914
2915 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
2916 {
2917 struct sk_buff *skb;
2918 struct nlmsghdr *rep;
2919 struct nlmsgerr *errmsg;
2920 size_t payload = sizeof(*errmsg);
2921
2922 /* error messages get the original request appened */
2923 if (err)
2924 payload += nlmsg_len(nlh);
2925
2926 skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload),
2927 NETLINK_CB(in_skb).portid, GFP_KERNEL);
2928 if (!skb) {
2929 struct sock *sk;
2930
2931 sk = netlink_lookup(sock_net(in_skb->sk),
2932 in_skb->sk->sk_protocol,
2933 NETLINK_CB(in_skb).portid);
2934 if (sk) {
2935 sk->sk_err = ENOBUFS;
2936 sk->sk_error_report(sk);
2937 sock_put(sk);
2938 }
2939 return;
2940 }
2941
2942 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2943 NLMSG_ERROR, payload, 0);
2944 errmsg = nlmsg_data(rep);
2945 errmsg->error = err;
2946 memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
2947 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
2948 }
2949 EXPORT_SYMBOL(netlink_ack);
2950
2951 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2952 struct nlmsghdr *))
2953 {
2954 struct nlmsghdr *nlh;
2955 int err;
2956
2957 while (skb->len >= nlmsg_total_size(0)) {
2958 int msglen;
2959
2960 nlh = nlmsg_hdr(skb);
2961 err = 0;
2962
2963 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2964 return 0;
2965
2966 /* Only requests are handled by the kernel */
2967 if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2968 goto ack;
2969
2970 /* Skip control messages */
2971 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2972 goto ack;
2973
2974 err = cb(skb, nlh);
2975 if (err == -EINTR)
2976 goto skip;
2977
2978 ack:
2979 if (nlh->nlmsg_flags & NLM_F_ACK || err)
2980 netlink_ack(skb, nlh, err);
2981
2982 skip:
2983 msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2984 if (msglen > skb->len)
2985 msglen = skb->len;
2986 skb_pull(skb, msglen);
2987 }
2988
2989 return 0;
2990 }
2991 EXPORT_SYMBOL(netlink_rcv_skb);
2992
2993 /**
2994 * nlmsg_notify - send a notification netlink message
2995 * @sk: netlink socket to use
2996 * @skb: notification message
2997 * @portid: destination netlink portid for reports or 0
2998 * @group: destination multicast group or 0
2999 * @report: 1 to report back, 0 to disable
3000 * @flags: allocation flags
3001 */
3002 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
3003 unsigned int group, int report, gfp_t flags)
3004 {
3005 int err = 0;
3006
3007 if (group) {
3008 int exclude_portid = 0;
3009
3010 if (report) {
3011 atomic_inc(&skb->users);
3012 exclude_portid = portid;
3013 }
3014
3015 /* errors reported via destination sk->sk_err, but propagate
3016 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
3017 err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
3018 }
3019
3020 if (report) {
3021 int err2;
3022
3023 err2 = nlmsg_unicast(sk, skb, portid);
3024 if (!err || err == -ESRCH)
3025 err = err2;
3026 }
3027
3028 return err;
3029 }
3030 EXPORT_SYMBOL(nlmsg_notify);
3031
3032 #ifdef CONFIG_PROC_FS
3033 struct nl_seq_iter {
3034 struct seq_net_private p;
3035 struct rhashtable_iter hti;
3036 int link;
3037 };
3038
3039 static int netlink_walk_start(struct nl_seq_iter *iter)
3040 {
3041 int err;
3042
3043 err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti);
3044 if (err) {
3045 iter->link = MAX_LINKS;
3046 return err;
3047 }
3048
3049 err = rhashtable_walk_start(&iter->hti);
3050 return err == -EAGAIN ? 0 : err;
3051 }
3052
3053 static void netlink_walk_stop(struct nl_seq_iter *iter)
3054 {
3055 rhashtable_walk_stop(&iter->hti);
3056 rhashtable_walk_exit(&iter->hti);
3057 }
3058
3059 static void *__netlink_seq_next(struct seq_file *seq)
3060 {
3061 struct nl_seq_iter *iter = seq->private;
3062 struct netlink_sock *nlk;
3063
3064 do {
3065 for (;;) {
3066 int err;
3067
3068 nlk = rhashtable_walk_next(&iter->hti);
3069
3070 if (IS_ERR(nlk)) {
3071 if (PTR_ERR(nlk) == -EAGAIN)
3072 continue;
3073
3074 return nlk;
3075 }
3076
3077 if (nlk)
3078 break;
3079
3080 netlink_walk_stop(iter);
3081 if (++iter->link >= MAX_LINKS)
3082 return NULL;
3083
3084 err = netlink_walk_start(iter);
3085 if (err)
3086 return ERR_PTR(err);
3087 }
3088 } while (sock_net(&nlk->sk) != seq_file_net(seq));
3089
3090 return nlk;
3091 }
3092
3093 static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
3094 {
3095 struct nl_seq_iter *iter = seq->private;
3096 void *obj = SEQ_START_TOKEN;
3097 loff_t pos;
3098 int err;
3099
3100 iter->link = 0;
3101
3102 err = netlink_walk_start(iter);
3103 if (err)
3104 return ERR_PTR(err);
3105
3106 for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
3107 obj = __netlink_seq_next(seq);
3108
3109 return obj;
3110 }
3111
3112 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3113 {
3114 ++*pos;
3115 return __netlink_seq_next(seq);
3116 }
3117
3118 static void netlink_seq_stop(struct seq_file *seq, void *v)
3119 {
3120 struct nl_seq_iter *iter = seq->private;
3121
3122 if (iter->link >= MAX_LINKS)
3123 return;
3124
3125 netlink_walk_stop(iter);
3126 }
3127
3128
3129 static int netlink_seq_show(struct seq_file *seq, void *v)
3130 {
3131 if (v == SEQ_START_TOKEN) {
3132 seq_puts(seq,
3133 "sk Eth Pid Groups "
3134 "Rmem Wmem Dump Locks Drops Inode\n");
3135 } else {
3136 struct sock *s = v;
3137 struct netlink_sock *nlk = nlk_sk(s);
3138
3139 seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
3140 s,
3141 s->sk_protocol,
3142 nlk->portid,
3143 nlk->groups ? (u32)nlk->groups[0] : 0,
3144 sk_rmem_alloc_get(s),
3145 sk_wmem_alloc_get(s),
3146 nlk->cb_running,
3147 atomic_read(&s->sk_refcnt),
3148 atomic_read(&s->sk_drops),
3149 sock_i_ino(s)
3150 );
3151
3152 }
3153 return 0;
3154 }
3155
3156 static const struct seq_operations netlink_seq_ops = {
3157 .start = netlink_seq_start,
3158 .next = netlink_seq_next,
3159 .stop = netlink_seq_stop,
3160 .show = netlink_seq_show,
3161 };
3162
3163
3164 static int netlink_seq_open(struct inode *inode, struct file *file)
3165 {
3166 return seq_open_net(inode, file, &netlink_seq_ops,
3167 sizeof(struct nl_seq_iter));
3168 }
3169
3170 static const struct file_operations netlink_seq_fops = {
3171 .owner = THIS_MODULE,
3172 .open = netlink_seq_open,
3173 .read = seq_read,
3174 .llseek = seq_lseek,
3175 .release = seq_release_net,
3176 };
3177
3178 #endif
3179
3180 int netlink_register_notifier(struct notifier_block *nb)
3181 {
3182 return atomic_notifier_chain_register(&netlink_chain, nb);
3183 }
3184 EXPORT_SYMBOL(netlink_register_notifier);
3185
3186 int netlink_unregister_notifier(struct notifier_block *nb)
3187 {
3188 return atomic_notifier_chain_unregister(&netlink_chain, nb);
3189 }
3190 EXPORT_SYMBOL(netlink_unregister_notifier);
3191
3192 static const struct proto_ops netlink_ops = {
3193 .family = PF_NETLINK,
3194 .owner = THIS_MODULE,
3195 .release = netlink_release,
3196 .bind = netlink_bind,
3197 .connect = netlink_connect,
3198 .socketpair = sock_no_socketpair,
3199 .accept = sock_no_accept,
3200 .getname = netlink_getname,
3201 .poll = netlink_poll,
3202 .ioctl = sock_no_ioctl,
3203 .listen = sock_no_listen,
3204 .shutdown = sock_no_shutdown,
3205 .setsockopt = netlink_setsockopt,
3206 .getsockopt = netlink_getsockopt,
3207 .sendmsg = netlink_sendmsg,
3208 .recvmsg = netlink_recvmsg,
3209 .mmap = netlink_mmap,
3210 .sendpage = sock_no_sendpage,
3211 };
3212
3213 static const struct net_proto_family netlink_family_ops = {
3214 .family = PF_NETLINK,
3215 .create = netlink_create,
3216 .owner = THIS_MODULE, /* for consistency 8) */
3217 };
3218
3219 static int __net_init netlink_net_init(struct net *net)
3220 {
3221 #ifdef CONFIG_PROC_FS
3222 if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
3223 return -ENOMEM;
3224 #endif
3225 return 0;
3226 }
3227
3228 static void __net_exit netlink_net_exit(struct net *net)
3229 {
3230 #ifdef CONFIG_PROC_FS
3231 remove_proc_entry("netlink", net->proc_net);
3232 #endif
3233 }
3234
3235 static void __init netlink_add_usersock_entry(void)
3236 {
3237 struct listeners *listeners;
3238 int groups = 32;
3239
3240 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
3241 if (!listeners)
3242 panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
3243
3244 netlink_table_grab();
3245
3246 nl_table[NETLINK_USERSOCK].groups = groups;
3247 rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
3248 nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
3249 nl_table[NETLINK_USERSOCK].registered = 1;
3250 nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
3251
3252 netlink_table_ungrab();
3253 }
3254
3255 static struct pernet_operations __net_initdata netlink_net_ops = {
3256 .init = netlink_net_init,
3257 .exit = netlink_net_exit,
3258 };
3259
3260 static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
3261 {
3262 const struct netlink_sock *nlk = data;
3263 struct netlink_compare_arg arg;
3264
3265 netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
3266 return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
3267 }
3268
3269 static const struct rhashtable_params netlink_rhashtable_params = {
3270 .head_offset = offsetof(struct netlink_sock, node),
3271 .key_len = netlink_compare_arg_len,
3272 .obj_hashfn = netlink_hash,
3273 .obj_cmpfn = netlink_compare,
3274 .automatic_shrinking = true,
3275 };
3276
3277 static int __init netlink_proto_init(void)
3278 {
3279 int i;
3280 int err = proto_register(&netlink_proto, 0);
3281
3282 if (err != 0)
3283 goto out;
3284
3285 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
3286
3287 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
3288 if (!nl_table)
3289 goto panic;
3290
3291 for (i = 0; i < MAX_LINKS; i++) {
3292 if (rhashtable_init(&nl_table[i].hash,
3293 &netlink_rhashtable_params) < 0) {
3294 while (--i > 0)
3295 rhashtable_destroy(&nl_table[i].hash);
3296 kfree(nl_table);
3297 goto panic;
3298 }
3299 }
3300
3301 INIT_LIST_HEAD(&netlink_tap_all);
3302
3303 netlink_add_usersock_entry();
3304
3305 sock_register(&netlink_family_ops);
3306 register_pernet_subsys(&netlink_net_ops);
3307 /* The netlink device handler may be needed early. */
3308 rtnetlink_init();
3309 out:
3310 return err;
3311 panic:
3312 panic("netlink_init: Cannot allocate nl_table\n");
3313 }
3314
3315 core_initcall(netlink_proto_init);
3316
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.