~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netlink/af_netlink.c

Version: ~ [ linux-5.19-rc3 ] ~ [ linux-5.18.5 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.48 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.123 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.199 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.248 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.284 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.319 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * NETLINK      Kernel-user communication protocol.
  3  *
  4  *              Authors:        Alan Cox <alan@lxorguk.ukuu.org.uk>
  5  *                              Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
  6  *                              Patrick McHardy <kaber@trash.net>
  7  *
  8  *              This program is free software; you can redistribute it and/or
  9  *              modify it under the terms of the GNU General Public License
 10  *              as published by the Free Software Foundation; either version
 11  *              2 of the License, or (at your option) any later version.
 12  *
 13  * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
 14  *                               added netlink_proto_exit
 15  * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
 16  *                               use nlk_sk, as sk->protinfo is on a diet 8)
 17  * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
 18  *                               - inc module use count of module that owns
 19  *                                 the kernel socket in case userspace opens
 20  *                                 socket of same protocol
 21  *                               - remove all module support, since netlink is
 22  *                                 mandatory if CONFIG_NET=y these days
 23  */
 24 
 25 #include <linux/module.h>
 26 
 27 #include <linux/capability.h>
 28 #include <linux/kernel.h>
 29 #include <linux/init.h>
 30 #include <linux/signal.h>
 31 #include <linux/sched.h>
 32 #include <linux/errno.h>
 33 #include <linux/string.h>
 34 #include <linux/stat.h>
 35 #include <linux/socket.h>
 36 #include <linux/un.h>
 37 #include <linux/fcntl.h>
 38 #include <linux/termios.h>
 39 #include <linux/sockios.h>
 40 #include <linux/net.h>
 41 #include <linux/fs.h>
 42 #include <linux/slab.h>
 43 #include <asm/uaccess.h>
 44 #include <linux/skbuff.h>
 45 #include <linux/netdevice.h>
 46 #include <linux/rtnetlink.h>
 47 #include <linux/proc_fs.h>
 48 #include <linux/seq_file.h>
 49 #include <linux/notifier.h>
 50 #include <linux/security.h>
 51 #include <linux/jhash.h>
 52 #include <linux/jiffies.h>
 53 #include <linux/random.h>
 54 #include <linux/bitops.h>
 55 #include <linux/mm.h>
 56 #include <linux/types.h>
 57 #include <linux/audit.h>
 58 #include <linux/mutex.h>
 59 #include <linux/vmalloc.h>
 60 #include <linux/if_arp.h>
 61 #include <linux/rhashtable.h>
 62 #include <asm/cacheflush.h>
 63 #include <linux/hash.h>
 64 #include <linux/genetlink.h>
 65 
 66 #include <net/net_namespace.h>
 67 #include <net/sock.h>
 68 #include <net/scm.h>
 69 #include <net/netlink.h>
 70 
 71 #include "af_netlink.h"
 72 
 73 struct listeners {
 74         struct rcu_head         rcu;
 75         unsigned long           masks[0];
 76 };
 77 
 78 /* state bits */
 79 #define NETLINK_S_CONGESTED             0x0
 80 
 81 /* flags */
 82 #define NETLINK_F_KERNEL_SOCKET         0x1
 83 #define NETLINK_F_RECV_PKTINFO          0x2
 84 #define NETLINK_F_BROADCAST_SEND_ERROR  0x4
 85 #define NETLINK_F_RECV_NO_ENOBUFS       0x8
 86 #define NETLINK_F_LISTEN_ALL_NSID       0x10
 87 
 88 static inline int netlink_is_kernel(struct sock *sk)
 89 {
 90         return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
 91 }
 92 
 93 struct netlink_table *nl_table __read_mostly;
 94 EXPORT_SYMBOL_GPL(nl_table);
 95 
 96 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
 97 
 98 static int netlink_dump(struct sock *sk);
 99 static void netlink_skb_destructor(struct sk_buff *skb);
100 
101 /* nl_table locking explained:
102  * Lookup and traversal are protected with an RCU read-side lock. Insertion
103  * and removal are protected with per bucket lock while using RCU list
104  * modification primitives and may run in parallel to RCU protected lookups.
105  * Destruction of the Netlink socket may only occur *after* nl_table_lock has
106  * been acquired * either during or after the socket has been removed from
107  * the list and after an RCU grace period.
108  */
109 DEFINE_RWLOCK(nl_table_lock);
110 EXPORT_SYMBOL_GPL(nl_table_lock);
111 static atomic_t nl_table_users = ATOMIC_INIT(0);
112 
113 #define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
114 
115 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
116 
117 static DEFINE_SPINLOCK(netlink_tap_lock);
118 static struct list_head netlink_tap_all __read_mostly;
119 
120 static const struct rhashtable_params netlink_rhashtable_params;
121 
122 static inline u32 netlink_group_mask(u32 group)
123 {
124         return group ? 1 << (group - 1) : 0;
125 }
126 
127 static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
128                                            gfp_t gfp_mask)
129 {
130         unsigned int len = skb_end_offset(skb);
131         struct sk_buff *new;
132 
133         new = alloc_skb(len, gfp_mask);
134         if (new == NULL)
135                 return NULL;
136 
137         NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
138         NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
139         NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
140 
141         memcpy(skb_put(new, len), skb->data, len);
142         return new;
143 }
144 
145 int netlink_add_tap(struct netlink_tap *nt)
146 {
147         if (unlikely(nt->dev->type != ARPHRD_NETLINK))
148                 return -EINVAL;
149 
150         spin_lock(&netlink_tap_lock);
151         list_add_rcu(&nt->list, &netlink_tap_all);
152         spin_unlock(&netlink_tap_lock);
153 
154         __module_get(nt->module);
155 
156         return 0;
157 }
158 EXPORT_SYMBOL_GPL(netlink_add_tap);
159 
160 static int __netlink_remove_tap(struct netlink_tap *nt)
161 {
162         bool found = false;
163         struct netlink_tap *tmp;
164 
165         spin_lock(&netlink_tap_lock);
166 
167         list_for_each_entry(tmp, &netlink_tap_all, list) {
168                 if (nt == tmp) {
169                         list_del_rcu(&nt->list);
170                         found = true;
171                         goto out;
172                 }
173         }
174 
175         pr_warn("__netlink_remove_tap: %p not found\n", nt);
176 out:
177         spin_unlock(&netlink_tap_lock);
178 
179         if (found)
180                 module_put(nt->module);
181 
182         return found ? 0 : -ENODEV;
183 }
184 
185 int netlink_remove_tap(struct netlink_tap *nt)
186 {
187         int ret;
188 
189         ret = __netlink_remove_tap(nt);
190         synchronize_net();
191 
192         return ret;
193 }
194 EXPORT_SYMBOL_GPL(netlink_remove_tap);
195 
196 static bool netlink_filter_tap(const struct sk_buff *skb)
197 {
198         struct sock *sk = skb->sk;
199 
200         /* We take the more conservative approach and
201          * whitelist socket protocols that may pass.
202          */
203         switch (sk->sk_protocol) {
204         case NETLINK_ROUTE:
205         case NETLINK_USERSOCK:
206         case NETLINK_SOCK_DIAG:
207         case NETLINK_NFLOG:
208         case NETLINK_XFRM:
209         case NETLINK_FIB_LOOKUP:
210         case NETLINK_NETFILTER:
211         case NETLINK_GENERIC:
212                 return true;
213         }
214 
215         return false;
216 }
217 
218 static int __netlink_deliver_tap_skb(struct sk_buff *skb,
219                                      struct net_device *dev)
220 {
221         struct sk_buff *nskb;
222         struct sock *sk = skb->sk;
223         int ret = -ENOMEM;
224 
225         dev_hold(dev);
226 
227         if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
228                 nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
229         else
230                 nskb = skb_clone(skb, GFP_ATOMIC);
231         if (nskb) {
232                 nskb->dev = dev;
233                 nskb->protocol = htons((u16) sk->sk_protocol);
234                 nskb->pkt_type = netlink_is_kernel(sk) ?
235                                  PACKET_KERNEL : PACKET_USER;
236                 skb_reset_network_header(nskb);
237                 ret = dev_queue_xmit(nskb);
238                 if (unlikely(ret > 0))
239                         ret = net_xmit_errno(ret);
240         }
241 
242         dev_put(dev);
243         return ret;
244 }
245 
246 static void __netlink_deliver_tap(struct sk_buff *skb)
247 {
248         int ret;
249         struct netlink_tap *tmp;
250 
251         if (!netlink_filter_tap(skb))
252                 return;
253 
254         list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
255                 ret = __netlink_deliver_tap_skb(skb, tmp->dev);
256                 if (unlikely(ret))
257                         break;
258         }
259 }
260 
261 static void netlink_deliver_tap(struct sk_buff *skb)
262 {
263         rcu_read_lock();
264 
265         if (unlikely(!list_empty(&netlink_tap_all)))
266                 __netlink_deliver_tap(skb);
267 
268         rcu_read_unlock();
269 }
270 
271 static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
272                                        struct sk_buff *skb)
273 {
274         if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
275                 netlink_deliver_tap(skb);
276 }
277 
278 static void netlink_overrun(struct sock *sk)
279 {
280         struct netlink_sock *nlk = nlk_sk(sk);
281 
282         if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
283                 if (!test_and_set_bit(NETLINK_S_CONGESTED,
284                                       &nlk_sk(sk)->state)) {
285                         sk->sk_err = ENOBUFS;
286                         sk->sk_error_report(sk);
287                 }
288         }
289         atomic_inc(&sk->sk_drops);
290 }
291 
292 static void netlink_rcv_wake(struct sock *sk)
293 {
294         struct netlink_sock *nlk = nlk_sk(sk);
295 
296         if (skb_queue_empty(&sk->sk_receive_queue))
297                 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
298         if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
299                 wake_up_interruptible(&nlk->wait);
300 }
301 
302 #ifdef CONFIG_NETLINK_MMAP
303 static bool netlink_rx_is_mmaped(struct sock *sk)
304 {
305         return nlk_sk(sk)->rx_ring.pg_vec != NULL;
306 }
307 
308 static bool netlink_tx_is_mmaped(struct sock *sk)
309 {
310         return nlk_sk(sk)->tx_ring.pg_vec != NULL;
311 }
312 
313 static __pure struct page *pgvec_to_page(const void *addr)
314 {
315         if (is_vmalloc_addr(addr))
316                 return vmalloc_to_page(addr);
317         else
318                 return virt_to_page(addr);
319 }
320 
321 static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
322 {
323         unsigned int i;
324 
325         for (i = 0; i < len; i++) {
326                 if (pg_vec[i] != NULL) {
327                         if (is_vmalloc_addr(pg_vec[i]))
328                                 vfree(pg_vec[i]);
329                         else
330                                 free_pages((unsigned long)pg_vec[i], order);
331                 }
332         }
333         kfree(pg_vec);
334 }
335 
336 static void *alloc_one_pg_vec_page(unsigned long order)
337 {
338         void *buffer;
339         gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
340                           __GFP_NOWARN | __GFP_NORETRY;
341 
342         buffer = (void *)__get_free_pages(gfp_flags, order);
343         if (buffer != NULL)
344                 return buffer;
345 
346         buffer = vzalloc((1 << order) * PAGE_SIZE);
347         if (buffer != NULL)
348                 return buffer;
349 
350         gfp_flags &= ~__GFP_NORETRY;
351         return (void *)__get_free_pages(gfp_flags, order);
352 }
353 
354 static void **alloc_pg_vec(struct netlink_sock *nlk,
355                            struct nl_mmap_req *req, unsigned int order)
356 {
357         unsigned int block_nr = req->nm_block_nr;
358         unsigned int i;
359         void **pg_vec;
360 
361         pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
362         if (pg_vec == NULL)
363                 return NULL;
364 
365         for (i = 0; i < block_nr; i++) {
366                 pg_vec[i] = alloc_one_pg_vec_page(order);
367                 if (pg_vec[i] == NULL)
368                         goto err1;
369         }
370 
371         return pg_vec;
372 err1:
373         free_pg_vec(pg_vec, order, block_nr);
374         return NULL;
375 }
376 
377 
378 static void
379 __netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
380                    unsigned int order)
381 {
382         struct netlink_sock *nlk = nlk_sk(sk);
383         struct sk_buff_head *queue;
384         struct netlink_ring *ring;
385 
386         queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
387         ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
388 
389         spin_lock_bh(&queue->lock);
390 
391         ring->frame_max         = req->nm_frame_nr - 1;
392         ring->head              = 0;
393         ring->frame_size        = req->nm_frame_size;
394         ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
395 
396         swap(ring->pg_vec_len, req->nm_block_nr);
397         swap(ring->pg_vec_order, order);
398         swap(ring->pg_vec, pg_vec);
399 
400         __skb_queue_purge(queue);
401         spin_unlock_bh(&queue->lock);
402 
403         WARN_ON(atomic_read(&nlk->mapped));
404 
405         if (pg_vec)
406                 free_pg_vec(pg_vec, order, req->nm_block_nr);
407 }
408 
409 static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
410                             bool tx_ring)
411 {
412         struct netlink_sock *nlk = nlk_sk(sk);
413         struct netlink_ring *ring;
414         void **pg_vec = NULL;
415         unsigned int order = 0;
416 
417         ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
418 
419         if (atomic_read(&nlk->mapped))
420                 return -EBUSY;
421         if (atomic_read(&ring->pending))
422                 return -EBUSY;
423 
424         if (req->nm_block_nr) {
425                 if (ring->pg_vec != NULL)
426                         return -EBUSY;
427 
428                 if ((int)req->nm_block_size <= 0)
429                         return -EINVAL;
430                 if (!PAGE_ALIGNED(req->nm_block_size))
431                         return -EINVAL;
432                 if (req->nm_frame_size < NL_MMAP_HDRLEN)
433                         return -EINVAL;
434                 if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
435                         return -EINVAL;
436 
437                 ring->frames_per_block = req->nm_block_size /
438                                          req->nm_frame_size;
439                 if (ring->frames_per_block == 0)
440                         return -EINVAL;
441                 if (ring->frames_per_block * req->nm_block_nr !=
442                     req->nm_frame_nr)
443                         return -EINVAL;
444 
445                 order = get_order(req->nm_block_size);
446                 pg_vec = alloc_pg_vec(nlk, req, order);
447                 if (pg_vec == NULL)
448                         return -ENOMEM;
449         } else {
450                 if (req->nm_frame_nr)
451                         return -EINVAL;
452         }
453 
454         mutex_lock(&nlk->pg_vec_lock);
455         if (atomic_read(&nlk->mapped) == 0) {
456                 __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
457                 mutex_unlock(&nlk->pg_vec_lock);
458                 return 0;
459         }
460 
461         mutex_unlock(&nlk->pg_vec_lock);
462 
463         if (pg_vec)
464                 free_pg_vec(pg_vec, order, req->nm_block_nr);
465 
466         return -EBUSY;
467 }
468 
469 static void netlink_mm_open(struct vm_area_struct *vma)
470 {
471         struct file *file = vma->vm_file;
472         struct socket *sock = file->private_data;
473         struct sock *sk = sock->sk;
474 
475         if (sk)
476                 atomic_inc(&nlk_sk(sk)->mapped);
477 }
478 
479 static void netlink_mm_close(struct vm_area_struct *vma)
480 {
481         struct file *file = vma->vm_file;
482         struct socket *sock = file->private_data;
483         struct sock *sk = sock->sk;
484 
485         if (sk)
486                 atomic_dec(&nlk_sk(sk)->mapped);
487 }
488 
489 static const struct vm_operations_struct netlink_mmap_ops = {
490         .open   = netlink_mm_open,
491         .close  = netlink_mm_close,
492 };
493 
494 static int netlink_mmap(struct file *file, struct socket *sock,
495                         struct vm_area_struct *vma)
496 {
497         struct sock *sk = sock->sk;
498         struct netlink_sock *nlk = nlk_sk(sk);
499         struct netlink_ring *ring;
500         unsigned long start, size, expected;
501         unsigned int i;
502         int err = -EINVAL;
503 
504         if (vma->vm_pgoff)
505                 return -EINVAL;
506 
507         mutex_lock(&nlk->pg_vec_lock);
508 
509         expected = 0;
510         for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
511                 if (ring->pg_vec == NULL)
512                         continue;
513                 expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
514         }
515 
516         if (expected == 0)
517                 goto out;
518 
519         size = vma->vm_end - vma->vm_start;
520         if (size != expected)
521                 goto out;
522 
523         start = vma->vm_start;
524         for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
525                 if (ring->pg_vec == NULL)
526                         continue;
527 
528                 for (i = 0; i < ring->pg_vec_len; i++) {
529                         struct page *page;
530                         void *kaddr = ring->pg_vec[i];
531                         unsigned int pg_num;
532 
533                         for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
534                                 page = pgvec_to_page(kaddr);
535                                 err = vm_insert_page(vma, start, page);
536                                 if (err < 0)
537                                         goto out;
538                                 start += PAGE_SIZE;
539                                 kaddr += PAGE_SIZE;
540                         }
541                 }
542         }
543 
544         atomic_inc(&nlk->mapped);
545         vma->vm_ops = &netlink_mmap_ops;
546         err = 0;
547 out:
548         mutex_unlock(&nlk->pg_vec_lock);
549         return err;
550 }
551 
552 static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
553 {
554 #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
555         struct page *p_start, *p_end;
556 
557         /* First page is flushed through netlink_{get,set}_status */
558         p_start = pgvec_to_page(hdr + PAGE_SIZE);
559         p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
560         while (p_start <= p_end) {
561                 flush_dcache_page(p_start);
562                 p_start++;
563         }
564 #endif
565 }
566 
567 static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
568 {
569         smp_rmb();
570         flush_dcache_page(pgvec_to_page(hdr));
571         return hdr->nm_status;
572 }
573 
574 static void netlink_set_status(struct nl_mmap_hdr *hdr,
575                                enum nl_mmap_status status)
576 {
577         smp_mb();
578         hdr->nm_status = status;
579         flush_dcache_page(pgvec_to_page(hdr));
580 }
581 
582 static struct nl_mmap_hdr *
583 __netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
584 {
585         unsigned int pg_vec_pos, frame_off;
586 
587         pg_vec_pos = pos / ring->frames_per_block;
588         frame_off  = pos % ring->frames_per_block;
589 
590         return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
591 }
592 
593 static struct nl_mmap_hdr *
594 netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
595                      enum nl_mmap_status status)
596 {
597         struct nl_mmap_hdr *hdr;
598 
599         hdr = __netlink_lookup_frame(ring, pos);
600         if (netlink_get_status(hdr) != status)
601                 return NULL;
602 
603         return hdr;
604 }
605 
606 static struct nl_mmap_hdr *
607 netlink_current_frame(const struct netlink_ring *ring,
608                       enum nl_mmap_status status)
609 {
610         return netlink_lookup_frame(ring, ring->head, status);
611 }
612 
613 static struct nl_mmap_hdr *
614 netlink_previous_frame(const struct netlink_ring *ring,
615                        enum nl_mmap_status status)
616 {
617         unsigned int prev;
618 
619         prev = ring->head ? ring->head - 1 : ring->frame_max;
620         return netlink_lookup_frame(ring, prev, status);
621 }
622 
623 static void netlink_increment_head(struct netlink_ring *ring)
624 {
625         ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
626 }
627 
628 static void netlink_forward_ring(struct netlink_ring *ring)
629 {
630         unsigned int head = ring->head, pos = head;
631         const struct nl_mmap_hdr *hdr;
632 
633         do {
634                 hdr = __netlink_lookup_frame(ring, pos);
635                 if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
636                         break;
637                 if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
638                         break;
639                 netlink_increment_head(ring);
640         } while (ring->head != head);
641 }
642 
643 static bool netlink_dump_space(struct netlink_sock *nlk)
644 {
645         struct netlink_ring *ring = &nlk->rx_ring;
646         struct nl_mmap_hdr *hdr;
647         unsigned int n;
648 
649         hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
650         if (hdr == NULL)
651                 return false;
652 
653         n = ring->head + ring->frame_max / 2;
654         if (n > ring->frame_max)
655                 n -= ring->frame_max;
656 
657         hdr = __netlink_lookup_frame(ring, n);
658 
659         return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
660 }
661 
662 static unsigned int netlink_poll(struct file *file, struct socket *sock,
663                                  poll_table *wait)
664 {
665         struct sock *sk = sock->sk;
666         struct netlink_sock *nlk = nlk_sk(sk);
667         unsigned int mask;
668         int err;
669 
670         if (nlk->rx_ring.pg_vec != NULL) {
671                 /* Memory mapped sockets don't call recvmsg(), so flow control
672                  * for dumps is performed here. A dump is allowed to continue
673                  * if at least half the ring is unused.
674                  */
675                 while (nlk->cb_running && netlink_dump_space(nlk)) {
676                         err = netlink_dump(sk);
677                         if (err < 0) {
678                                 sk->sk_err = -err;
679                                 sk->sk_error_report(sk);
680                                 break;
681                         }
682                 }
683                 netlink_rcv_wake(sk);
684         }
685 
686         mask = datagram_poll(file, sock, wait);
687 
688         spin_lock_bh(&sk->sk_receive_queue.lock);
689         if (nlk->rx_ring.pg_vec) {
690                 netlink_forward_ring(&nlk->rx_ring);
691                 if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED))
692                         mask |= POLLIN | POLLRDNORM;
693         }
694         spin_unlock_bh(&sk->sk_receive_queue.lock);
695 
696         spin_lock_bh(&sk->sk_write_queue.lock);
697         if (nlk->tx_ring.pg_vec) {
698                 if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
699                         mask |= POLLOUT | POLLWRNORM;
700         }
701         spin_unlock_bh(&sk->sk_write_queue.lock);
702 
703         return mask;
704 }
705 
706 static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
707 {
708         return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
709 }
710 
711 static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
712                                    struct netlink_ring *ring,
713                                    struct nl_mmap_hdr *hdr)
714 {
715         unsigned int size;
716         void *data;
717 
718         size = ring->frame_size - NL_MMAP_HDRLEN;
719         data = (void *)hdr + NL_MMAP_HDRLEN;
720 
721         skb->head       = data;
722         skb->data       = data;
723         skb_reset_tail_pointer(skb);
724         skb->end        = skb->tail + size;
725         skb->len        = 0;
726 
727         skb->destructor = netlink_skb_destructor;
728         NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
729         NETLINK_CB(skb).sk = sk;
730 }
731 
732 static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
733                                 u32 dst_portid, u32 dst_group,
734                                 struct scm_cookie *scm)
735 {
736         struct netlink_sock *nlk = nlk_sk(sk);
737         struct netlink_ring *ring;
738         struct nl_mmap_hdr *hdr;
739         struct sk_buff *skb;
740         unsigned int maxlen;
741         int err = 0, len = 0;
742 
743         mutex_lock(&nlk->pg_vec_lock);
744 
745         ring   = &nlk->tx_ring;
746         maxlen = ring->frame_size - NL_MMAP_HDRLEN;
747 
748         do {
749                 unsigned int nm_len;
750 
751                 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
752                 if (hdr == NULL) {
753                         if (!(msg->msg_flags & MSG_DONTWAIT) &&
754                             atomic_read(&nlk->tx_ring.pending))
755                                 schedule();
756                         continue;
757                 }
758 
759                 nm_len = ACCESS_ONCE(hdr->nm_len);
760                 if (nm_len > maxlen) {
761                         err = -EINVAL;
762                         goto out;
763                 }
764 
765                 netlink_frame_flush_dcache(hdr, nm_len);
766 
767                 skb = alloc_skb(nm_len, GFP_KERNEL);
768                 if (skb == NULL) {
769                         err = -ENOBUFS;
770                         goto out;
771                 }
772                 __skb_put(skb, nm_len);
773                 memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
774                 netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
775 
776                 netlink_increment_head(ring);
777 
778                 NETLINK_CB(skb).portid    = nlk->portid;
779                 NETLINK_CB(skb).dst_group = dst_group;
780                 NETLINK_CB(skb).creds     = scm->creds;
781 
782                 err = security_netlink_send(sk, skb);
783                 if (err) {
784                         kfree_skb(skb);
785                         goto out;
786                 }
787 
788                 if (unlikely(dst_group)) {
789                         atomic_inc(&skb->users);
790                         netlink_broadcast(sk, skb, dst_portid, dst_group,
791                                           GFP_KERNEL);
792                 }
793                 err = netlink_unicast(sk, skb, dst_portid,
794                                       msg->msg_flags & MSG_DONTWAIT);
795                 if (err < 0)
796                         goto out;
797                 len += err;
798 
799         } while (hdr != NULL ||
800                  (!(msg->msg_flags & MSG_DONTWAIT) &&
801                   atomic_read(&nlk->tx_ring.pending)));
802 
803         if (len > 0)
804                 err = len;
805 out:
806         mutex_unlock(&nlk->pg_vec_lock);
807         return err;
808 }
809 
810 static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
811 {
812         struct nl_mmap_hdr *hdr;
813 
814         hdr = netlink_mmap_hdr(skb);
815         hdr->nm_len     = skb->len;
816         hdr->nm_group   = NETLINK_CB(skb).dst_group;
817         hdr->nm_pid     = NETLINK_CB(skb).creds.pid;
818         hdr->nm_uid     = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
819         hdr->nm_gid     = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
820         netlink_frame_flush_dcache(hdr, hdr->nm_len);
821         netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
822 
823         NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
824         kfree_skb(skb);
825 }
826 
827 static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
828 {
829         struct netlink_sock *nlk = nlk_sk(sk);
830         struct netlink_ring *ring = &nlk->rx_ring;
831         struct nl_mmap_hdr *hdr;
832 
833         spin_lock_bh(&sk->sk_receive_queue.lock);
834         hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
835         if (hdr == NULL) {
836                 spin_unlock_bh(&sk->sk_receive_queue.lock);
837                 kfree_skb(skb);
838                 netlink_overrun(sk);
839                 return;
840         }
841         netlink_increment_head(ring);
842         __skb_queue_tail(&sk->sk_receive_queue, skb);
843         spin_unlock_bh(&sk->sk_receive_queue.lock);
844 
845         hdr->nm_len     = skb->len;
846         hdr->nm_group   = NETLINK_CB(skb).dst_group;
847         hdr->nm_pid     = NETLINK_CB(skb).creds.pid;
848         hdr->nm_uid     = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
849         hdr->nm_gid     = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
850         netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
851 }
852 
853 #else /* CONFIG_NETLINK_MMAP */
854 #define netlink_rx_is_mmaped(sk)        false
855 #define netlink_tx_is_mmaped(sk)        false
856 #define netlink_mmap                    sock_no_mmap
857 #define netlink_poll                    datagram_poll
858 #define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm)       0
859 #endif /* CONFIG_NETLINK_MMAP */
860 
861 static void netlink_skb_destructor(struct sk_buff *skb)
862 {
863 #ifdef CONFIG_NETLINK_MMAP
864         struct nl_mmap_hdr *hdr;
865         struct netlink_ring *ring;
866         struct sock *sk;
867 
868         /* If a packet from the kernel to userspace was freed because of an
869          * error without being delivered to userspace, the kernel must reset
870          * the status. In the direction userspace to kernel, the status is
871          * always reset here after the packet was processed and freed.
872          */
873         if (netlink_skb_is_mmaped(skb)) {
874                 hdr = netlink_mmap_hdr(skb);
875                 sk = NETLINK_CB(skb).sk;
876 
877                 if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
878                         netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
879                         ring = &nlk_sk(sk)->tx_ring;
880                 } else {
881                         if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
882                                 hdr->nm_len = 0;
883                                 netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
884                         }
885                         ring = &nlk_sk(sk)->rx_ring;
886                 }
887 
888                 WARN_ON(atomic_read(&ring->pending) == 0);
889                 atomic_dec(&ring->pending);
890                 sock_put(sk);
891 
892                 skb->head = NULL;
893         }
894 #endif
895         if (is_vmalloc_addr(skb->head)) {
896                 if (!skb->cloned ||
897                     !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
898                         vfree(skb->head);
899 
900                 skb->head = NULL;
901         }
902         if (skb->sk != NULL)
903                 sock_rfree(skb);
904 }
905 
906 static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
907 {
908         WARN_ON(skb->sk != NULL);
909         skb->sk = sk;
910         skb->destructor = netlink_skb_destructor;
911         atomic_add(skb->truesize, &sk->sk_rmem_alloc);
912         sk_mem_charge(sk, skb->truesize);
913 }
914 
915 static void netlink_sock_destruct(struct sock *sk)
916 {
917         struct netlink_sock *nlk = nlk_sk(sk);
918 
919         if (nlk->cb_running) {
920                 if (nlk->cb.done)
921                         nlk->cb.done(&nlk->cb);
922 
923                 module_put(nlk->cb.module);
924                 kfree_skb(nlk->cb.skb);
925         }
926 
927         skb_queue_purge(&sk->sk_receive_queue);
928 #ifdef CONFIG_NETLINK_MMAP
929         if (1) {
930                 struct nl_mmap_req req;
931 
932                 memset(&req, 0, sizeof(req));
933                 if (nlk->rx_ring.pg_vec)
934                         __netlink_set_ring(sk, &req, false, NULL, 0);
935                 memset(&req, 0, sizeof(req));
936                 if (nlk->tx_ring.pg_vec)
937                         __netlink_set_ring(sk, &req, true, NULL, 0);
938         }
939 #endif /* CONFIG_NETLINK_MMAP */
940 
941         if (!sock_flag(sk, SOCK_DEAD)) {
942                 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
943                 return;
944         }
945 
946         WARN_ON(atomic_read(&sk->sk_rmem_alloc));
947         WARN_ON(atomic_read(&sk->sk_wmem_alloc));
948         WARN_ON(nlk_sk(sk)->groups);
949 }
950 
951 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
952  * SMP. Look, when several writers sleep and reader wakes them up, all but one
953  * immediately hit write lock and grab all the cpus. Exclusive sleep solves
954  * this, _but_ remember, it adds useless work on UP machines.
955  */
956 
957 void netlink_table_grab(void)
958         __acquires(nl_table_lock)
959 {
960         might_sleep();
961 
962         write_lock_irq(&nl_table_lock);
963 
964         if (atomic_read(&nl_table_users)) {
965                 DECLARE_WAITQUEUE(wait, current);
966 
967                 add_wait_queue_exclusive(&nl_table_wait, &wait);
968                 for (;;) {
969                         set_current_state(TASK_UNINTERRUPTIBLE);
970                         if (atomic_read(&nl_table_users) == 0)
971                                 break;
972                         write_unlock_irq(&nl_table_lock);
973                         schedule();
974                         write_lock_irq(&nl_table_lock);
975                 }
976 
977                 __set_current_state(TASK_RUNNING);
978                 remove_wait_queue(&nl_table_wait, &wait);
979         }
980 }
981 
982 void netlink_table_ungrab(void)
983         __releases(nl_table_lock)
984 {
985         write_unlock_irq(&nl_table_lock);
986         wake_up(&nl_table_wait);
987 }
988 
989 static inline void
990 netlink_lock_table(void)
991 {
992         /* read_lock() synchronizes us to netlink_table_grab */
993 
994         read_lock(&nl_table_lock);
995         atomic_inc(&nl_table_users);
996         read_unlock(&nl_table_lock);
997 }
998 
999 static inline void
1000 netlink_unlock_table(void)
1001 {
1002         if (atomic_dec_and_test(&nl_table_users))
1003                 wake_up(&nl_table_wait);
1004 }
1005 
1006 struct netlink_compare_arg
1007 {
1008         possible_net_t pnet;
1009         u32 portid;
1010 };
1011 
1012 /* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
1013 #define netlink_compare_arg_len \
1014         (offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
1015 
1016 static inline int netlink_compare(struct rhashtable_compare_arg *arg,
1017                                   const void *ptr)
1018 {
1019         const struct netlink_compare_arg *x = arg->key;
1020         const struct netlink_sock *nlk = ptr;
1021 
1022         return nlk->portid != x->portid ||
1023                !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
1024 }
1025 
1026 static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
1027                                      struct net *net, u32 portid)
1028 {
1029         memset(arg, 0, sizeof(*arg));
1030         write_pnet(&arg->pnet, net);
1031         arg->portid = portid;
1032 }
1033 
1034 static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
1035                                      struct net *net)
1036 {
1037         struct netlink_compare_arg arg;
1038 
1039         netlink_compare_arg_init(&arg, net, portid);
1040         return rhashtable_lookup_fast(&table->hash, &arg,
1041                                       netlink_rhashtable_params);
1042 }
1043 
1044 static int __netlink_insert(struct netlink_table *table, struct sock *sk)
1045 {
1046         struct netlink_compare_arg arg;
1047 
1048         netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
1049         return rhashtable_lookup_insert_key(&table->hash, &arg,
1050                                             &nlk_sk(sk)->node,
1051                                             netlink_rhashtable_params);
1052 }
1053 
1054 static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
1055 {
1056         struct netlink_table *table = &nl_table[protocol];
1057         struct sock *sk;
1058 
1059         rcu_read_lock();
1060         sk = __netlink_lookup(table, portid, net);
1061         if (sk)
1062                 sock_hold(sk);
1063         rcu_read_unlock();
1064 
1065         return sk;
1066 }
1067 
1068 static const struct proto_ops netlink_ops;
1069 
1070 static void
1071 netlink_update_listeners(struct sock *sk)
1072 {
1073         struct netlink_table *tbl = &nl_table[sk->sk_protocol];
1074         unsigned long mask;
1075         unsigned int i;
1076         struct listeners *listeners;
1077 
1078         listeners = nl_deref_protected(tbl->listeners);
1079         if (!listeners)
1080                 return;
1081 
1082         for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
1083                 mask = 0;
1084                 sk_for_each_bound(sk, &tbl->mc_list) {
1085                         if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
1086                                 mask |= nlk_sk(sk)->groups[i];
1087                 }
1088                 listeners->masks[i] = mask;
1089         }
1090         /* this function is only called with the netlink table "grabbed", which
1091          * makes sure updates are visible before bind or setsockopt return. */
1092 }
1093 
1094 static int netlink_insert(struct sock *sk, u32 portid)
1095 {
1096         struct netlink_table *table = &nl_table[sk->sk_protocol];
1097         int err;
1098 
1099         lock_sock(sk);
1100 
1101         err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
1102         if (nlk_sk(sk)->bound)
1103                 goto err;
1104 
1105         err = -ENOMEM;
1106         if (BITS_PER_LONG > 32 &&
1107             unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
1108                 goto err;
1109 
1110         nlk_sk(sk)->portid = portid;
1111         sock_hold(sk);
1112 
1113         err = __netlink_insert(table, sk);
1114         if (err) {
1115                 /* In case the hashtable backend returns with -EBUSY
1116                  * from here, it must not escape to the caller.
1117                  */
1118                 if (unlikely(err == -EBUSY))
1119                         err = -EOVERFLOW;
1120                 if (err == -EEXIST)
1121                         err = -EADDRINUSE;
1122                 sock_put(sk);
1123                 goto err;
1124         }
1125 
1126         /* We need to ensure that the socket is hashed and visible. */
1127         smp_wmb();
1128         nlk_sk(sk)->bound = portid;
1129 
1130 err:
1131         release_sock(sk);
1132         return err;
1133 }
1134 
1135 static void netlink_remove(struct sock *sk)
1136 {
1137         struct netlink_table *table;
1138 
1139         table = &nl_table[sk->sk_protocol];
1140         if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
1141                                     netlink_rhashtable_params)) {
1142                 WARN_ON(atomic_read(&sk->sk_refcnt) == 1);
1143                 __sock_put(sk);
1144         }
1145 
1146         netlink_table_grab();
1147         if (nlk_sk(sk)->subscriptions) {
1148                 __sk_del_bind_node(sk);
1149                 netlink_update_listeners(sk);
1150         }
1151         if (sk->sk_protocol == NETLINK_GENERIC)
1152                 atomic_inc(&genl_sk_destructing_cnt);
1153         netlink_table_ungrab();
1154 }
1155 
1156 static struct proto netlink_proto = {
1157         .name     = "NETLINK",
1158         .owner    = THIS_MODULE,
1159         .obj_size = sizeof(struct netlink_sock),
1160 };
1161 
1162 static int __netlink_create(struct net *net, struct socket *sock,
1163                             struct mutex *cb_mutex, int protocol,
1164                             int kern)
1165 {
1166         struct sock *sk;
1167         struct netlink_sock *nlk;
1168 
1169         sock->ops = &netlink_ops;
1170 
1171         sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
1172         if (!sk)
1173                 return -ENOMEM;
1174 
1175         sock_init_data(sock, sk);
1176 
1177         nlk = nlk_sk(sk);
1178         if (cb_mutex) {
1179                 nlk->cb_mutex = cb_mutex;
1180         } else {
1181                 nlk->cb_mutex = &nlk->cb_def_mutex;
1182                 mutex_init(nlk->cb_mutex);
1183         }
1184         init_waitqueue_head(&nlk->wait);
1185 #ifdef CONFIG_NETLINK_MMAP
1186         mutex_init(&nlk->pg_vec_lock);
1187 #endif
1188 
1189         sk->sk_destruct = netlink_sock_destruct;
1190         sk->sk_protocol = protocol;
1191         return 0;
1192 }
1193 
1194 static int netlink_create(struct net *net, struct socket *sock, int protocol,
1195                           int kern)
1196 {
1197         struct module *module = NULL;
1198         struct mutex *cb_mutex;
1199         struct netlink_sock *nlk;
1200         int (*bind)(struct net *net, int group);
1201         void (*unbind)(struct net *net, int group);
1202         int err = 0;
1203 
1204         sock->state = SS_UNCONNECTED;
1205 
1206         if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
1207                 return -ESOCKTNOSUPPORT;
1208 
1209         if (protocol < 0 || protocol >= MAX_LINKS)
1210                 return -EPROTONOSUPPORT;
1211 
1212         netlink_lock_table();
1213 #ifdef CONFIG_MODULES
1214         if (!nl_table[protocol].registered) {
1215                 netlink_unlock_table();
1216                 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
1217                 netlink_lock_table();
1218         }
1219 #endif
1220         if (nl_table[protocol].registered &&
1221             try_module_get(nl_table[protocol].module))
1222                 module = nl_table[protocol].module;
1223         else
1224                 err = -EPROTONOSUPPORT;
1225         cb_mutex = nl_table[protocol].cb_mutex;
1226         bind = nl_table[protocol].bind;
1227         unbind = nl_table[protocol].unbind;
1228         netlink_unlock_table();
1229 
1230         if (err < 0)
1231                 goto out;
1232 
1233         err = __netlink_create(net, sock, cb_mutex, protocol, kern);
1234         if (err < 0)
1235                 goto out_module;
1236 
1237         local_bh_disable();
1238         sock_prot_inuse_add(net, &netlink_proto, 1);
1239         local_bh_enable();
1240 
1241         nlk = nlk_sk(sock->sk);
1242         nlk->module = module;
1243         nlk->netlink_bind = bind;
1244         nlk->netlink_unbind = unbind;
1245 out:
1246         return err;
1247 
1248 out_module:
1249         module_put(module);
1250         goto out;
1251 }
1252 
1253 static void deferred_put_nlk_sk(struct rcu_head *head)
1254 {
1255         struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
1256 
1257         sock_put(&nlk->sk);
1258 }
1259 
1260 static int netlink_release(struct socket *sock)
1261 {
1262         struct sock *sk = sock->sk;
1263         struct netlink_sock *nlk;
1264 
1265         if (!sk)
1266                 return 0;
1267 
1268         netlink_remove(sk);
1269         sock_orphan(sk);
1270         nlk = nlk_sk(sk);
1271 
1272         /*
1273          * OK. Socket is unlinked, any packets that arrive now
1274          * will be purged.
1275          */
1276 
1277         /* must not acquire netlink_table_lock in any way again before unbind
1278          * and notifying genetlink is done as otherwise it might deadlock
1279          */
1280         if (nlk->netlink_unbind) {
1281                 int i;
1282 
1283                 for (i = 0; i < nlk->ngroups; i++)
1284                         if (test_bit(i, nlk->groups))
1285                                 nlk->netlink_unbind(sock_net(sk), i + 1);
1286         }
1287         if (sk->sk_protocol == NETLINK_GENERIC &&
1288             atomic_dec_return(&genl_sk_destructing_cnt) == 0)
1289                 wake_up(&genl_sk_destructing_waitq);
1290 
1291         sock->sk = NULL;
1292         wake_up_interruptible_all(&nlk->wait);
1293 
1294         skb_queue_purge(&sk->sk_write_queue);
1295 
1296         if (nlk->portid) {
1297                 struct netlink_notify n = {
1298                                                 .net = sock_net(sk),
1299                                                 .protocol = sk->sk_protocol,
1300                                                 .portid = nlk->portid,
1301                                           };
1302                 atomic_notifier_call_chain(&netlink_chain,
1303                                 NETLINK_URELEASE, &n);
1304         }
1305 
1306         module_put(nlk->module);
1307 
1308         if (netlink_is_kernel(sk)) {
1309                 netlink_table_grab();
1310                 BUG_ON(nl_table[sk->sk_protocol].registered == 0);
1311                 if (--nl_table[sk->sk_protocol].registered == 0) {
1312                         struct listeners *old;
1313 
1314                         old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
1315                         RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
1316                         kfree_rcu(old, rcu);
1317                         nl_table[sk->sk_protocol].module = NULL;
1318                         nl_table[sk->sk_protocol].bind = NULL;
1319                         nl_table[sk->sk_protocol].unbind = NULL;
1320                         nl_table[sk->sk_protocol].flags = 0;
1321                         nl_table[sk->sk_protocol].registered = 0;
1322                 }
1323                 netlink_table_ungrab();
1324         }
1325 
1326         kfree(nlk->groups);
1327         nlk->groups = NULL;
1328 
1329         local_bh_disable();
1330         sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
1331         local_bh_enable();
1332         call_rcu(&nlk->rcu, deferred_put_nlk_sk);
1333         return 0;
1334 }
1335 
1336 static int netlink_autobind(struct socket *sock)
1337 {
1338         struct sock *sk = sock->sk;
1339         struct net *net = sock_net(sk);
1340         struct netlink_table *table = &nl_table[sk->sk_protocol];
1341         s32 portid = task_tgid_vnr(current);
1342         int err;
1343         s32 rover = -4096;
1344         bool ok;
1345 
1346 retry:
1347         cond_resched();
1348         rcu_read_lock();
1349         ok = !__netlink_lookup(table, portid, net);
1350         rcu_read_unlock();
1351         if (!ok) {
1352                 /* Bind collision, search negative portid values. */
1353                 if (rover == -4096)
1354                         /* rover will be in range [S32_MIN, -4097] */
1355                         rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
1356                 else if (rover >= -4096)
1357                         rover = -4097;
1358                 portid = rover--;
1359                 goto retry;
1360         }
1361 
1362         err = netlink_insert(sk, portid);
1363         if (err == -EADDRINUSE)
1364                 goto retry;
1365 
1366         /* If 2 threads race to autobind, that is fine.  */
1367         if (err == -EBUSY)
1368                 err = 0;
1369 
1370         return err;
1371 }
1372 
1373 /**
1374  * __netlink_ns_capable - General netlink message capability test
1375  * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
1376  * @user_ns: The user namespace of the capability to use
1377  * @cap: The capability to use
1378  *
1379  * Test to see if the opener of the socket we received the message
1380  * from had when the netlink socket was created and the sender of the
1381  * message has has the capability @cap in the user namespace @user_ns.
1382  */
1383 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
1384                         struct user_namespace *user_ns, int cap)
1385 {
1386         return ((nsp->flags & NETLINK_SKB_DST) ||
1387                 file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
1388                 ns_capable(user_ns, cap);
1389 }
1390 EXPORT_SYMBOL(__netlink_ns_capable);
1391 
1392 /**
1393  * netlink_ns_capable - General netlink message capability test
1394  * @skb: socket buffer holding a netlink command from userspace
1395  * @user_ns: The user namespace of the capability to use
1396  * @cap: The capability to use
1397  *
1398  * Test to see if the opener of the socket we received the message
1399  * from had when the netlink socket was created and the sender of the
1400  * message has has the capability @cap in the user namespace @user_ns.
1401  */
1402 bool netlink_ns_capable(const struct sk_buff *skb,
1403                         struct user_namespace *user_ns, int cap)
1404 {
1405         return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
1406 }
1407 EXPORT_SYMBOL(netlink_ns_capable);
1408 
1409 /**
1410  * netlink_capable - Netlink global message capability test
1411  * @skb: socket buffer holding a netlink command from userspace
1412  * @cap: The capability to use
1413  *
1414  * Test to see if the opener of the socket we received the message
1415  * from had when the netlink socket was created and the sender of the
1416  * message has has the capability @cap in all user namespaces.
1417  */
1418 bool netlink_capable(const struct sk_buff *skb, int cap)
1419 {
1420         return netlink_ns_capable(skb, &init_user_ns, cap);
1421 }
1422 EXPORT_SYMBOL(netlink_capable);
1423 
1424 /**
1425  * netlink_net_capable - Netlink network namespace message capability test
1426  * @skb: socket buffer holding a netlink command from userspace
1427  * @cap: The capability to use
1428  *
1429  * Test to see if the opener of the socket we received the message
1430  * from had when the netlink socket was created and the sender of the
1431  * message has has the capability @cap over the network namespace of
1432  * the socket we received the message from.
1433  */
1434 bool netlink_net_capable(const struct sk_buff *skb, int cap)
1435 {
1436         return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
1437 }
1438 EXPORT_SYMBOL(netlink_net_capable);
1439 
1440 static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
1441 {
1442         return (nl_table[sock->sk->sk_protocol].flags & flag) ||
1443                 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
1444 }
1445 
1446 static void
1447 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
1448 {
1449         struct netlink_sock *nlk = nlk_sk(sk);
1450 
1451         if (nlk->subscriptions && !subscriptions)
1452                 __sk_del_bind_node(sk);
1453         else if (!nlk->subscriptions && subscriptions)
1454                 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
1455         nlk->subscriptions = subscriptions;
1456 }
1457 
1458 static int netlink_realloc_groups(struct sock *sk)
1459 {
1460         struct netlink_sock *nlk = nlk_sk(sk);
1461         unsigned int groups;
1462         unsigned long *new_groups;
1463         int err = 0;
1464 
1465         netlink_table_grab();
1466 
1467         groups = nl_table[sk->sk_protocol].groups;
1468         if (!nl_table[sk->sk_protocol].registered) {
1469                 err = -ENOENT;
1470                 goto out_unlock;
1471         }
1472 
1473         if (nlk->ngroups >= groups)
1474                 goto out_unlock;
1475 
1476         new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
1477         if (new_groups == NULL) {
1478                 err = -ENOMEM;
1479                 goto out_unlock;
1480         }
1481         memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
1482                NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));
1483 
1484         nlk->groups = new_groups;
1485         nlk->ngroups = groups;
1486  out_unlock:
1487         netlink_table_ungrab();
1488         return err;
1489 }
1490 
1491 static void netlink_undo_bind(int group, long unsigned int groups,
1492                               struct sock *sk)
1493 {
1494         struct netlink_sock *nlk = nlk_sk(sk);
1495         int undo;
1496 
1497         if (!nlk->netlink_unbind)
1498                 return;
1499 
1500         for (undo = 0; undo < group; undo++)
1501                 if (test_bit(undo, &groups))
1502                         nlk->netlink_unbind(sock_net(sk), undo + 1);
1503 }
1504 
1505 static int netlink_bind(struct socket *sock, struct sockaddr *addr,
1506                         int addr_len)
1507 {
1508         struct sock *sk = sock->sk;
1509         struct net *net = sock_net(sk);
1510         struct netlink_sock *nlk = nlk_sk(sk);
1511         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
1512         int err;
1513         long unsigned int groups = nladdr->nl_groups;
1514         bool bound;
1515 
1516         if (addr_len < sizeof(struct sockaddr_nl))
1517                 return -EINVAL;
1518 
1519         if (nladdr->nl_family != AF_NETLINK)
1520                 return -EINVAL;
1521 
1522         /* Only superuser is allowed to listen multicasts */
1523         if (groups) {
1524                 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1525                         return -EPERM;
1526                 err = netlink_realloc_groups(sk);
1527                 if (err)
1528                         return err;
1529         }
1530 
1531         bound = nlk->bound;
1532         if (bound) {
1533                 /* Ensure nlk->portid is up-to-date. */
1534                 smp_rmb();
1535 
1536                 if (nladdr->nl_pid != nlk->portid)
1537                         return -EINVAL;
1538         }
1539 
1540         if (nlk->netlink_bind && groups) {
1541                 int group;
1542 
1543                 for (group = 0; group < nlk->ngroups; group++) {
1544                         if (!test_bit(group, &groups))
1545                                 continue;
1546                         err = nlk->netlink_bind(net, group + 1);
1547                         if (!err)
1548                                 continue;
1549                         netlink_undo_bind(group, groups, sk);
1550                         return err;
1551                 }
1552         }
1553 
1554         /* No need for barriers here as we return to user-space without
1555          * using any of the bound attributes.
1556          */
1557         if (!bound) {
1558                 err = nladdr->nl_pid ?
1559                         netlink_insert(sk, nladdr->nl_pid) :
1560                         netlink_autobind(sock);
1561                 if (err) {
1562                         netlink_undo_bind(nlk->ngroups, groups, sk);
1563                         return err;
1564                 }
1565         }
1566 
1567         if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
1568                 return 0;
1569 
1570         netlink_table_grab();
1571         netlink_update_subscriptions(sk, nlk->subscriptions +
1572                                          hweight32(groups) -
1573                                          hweight32(nlk->groups[0]));
1574         nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
1575         netlink_update_listeners(sk);
1576         netlink_table_ungrab();
1577 
1578         return 0;
1579 }
1580 
1581 static int netlink_connect(struct socket *sock, struct sockaddr *addr,
1582                            int alen, int flags)
1583 {
1584         int err = 0;
1585         struct sock *sk = sock->sk;
1586         struct netlink_sock *nlk = nlk_sk(sk);
1587         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
1588 
1589         if (alen < sizeof(addr->sa_family))
1590                 return -EINVAL;
1591 
1592         if (addr->sa_family == AF_UNSPEC) {
1593                 sk->sk_state    = NETLINK_UNCONNECTED;
1594                 nlk->dst_portid = 0;
1595                 nlk->dst_group  = 0;
1596                 return 0;
1597         }
1598         if (addr->sa_family != AF_NETLINK)
1599                 return -EINVAL;
1600 
1601         if ((nladdr->nl_groups || nladdr->nl_pid) &&
1602             !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1603                 return -EPERM;
1604 
1605         /* No need for barriers here as we return to user-space without
1606          * using any of the bound attributes.
1607          */
1608         if (!nlk->bound)
1609                 err = netlink_autobind(sock);
1610 
1611         if (err == 0) {
1612                 sk->sk_state    = NETLINK_CONNECTED;
1613                 nlk->dst_portid = nladdr->nl_pid;
1614                 nlk->dst_group  = ffs(nladdr->nl_groups);
1615         }
1616 
1617         return err;
1618 }
1619 
1620 static int netlink_getname(struct socket *sock, struct sockaddr *addr,
1621                            int *addr_len, int peer)
1622 {
1623         struct sock *sk = sock->sk;
1624         struct netlink_sock *nlk = nlk_sk(sk);
1625         DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1626 
1627         nladdr->nl_family = AF_NETLINK;
1628         nladdr->nl_pad = 0;
1629         *addr_len = sizeof(*nladdr);
1630 
1631         if (peer) {
1632                 nladdr->nl_pid = nlk->dst_portid;
1633                 nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
1634         } else {
1635                 nladdr->nl_pid = nlk->portid;
1636                 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
1637         }
1638         return 0;
1639 }
1640 
1641 static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
1642 {
1643         struct sock *sock;
1644         struct netlink_sock *nlk;
1645 
1646         sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
1647         if (!sock)
1648                 return ERR_PTR(-ECONNREFUSED);
1649 
1650         /* Don't bother queuing skb if kernel socket has no input function */
1651         nlk = nlk_sk(sock);
1652         if (sock->sk_state == NETLINK_CONNECTED &&
1653             nlk->dst_portid != nlk_sk(ssk)->portid) {
1654                 sock_put(sock);
1655                 return ERR_PTR(-ECONNREFUSED);
1656         }
1657         return sock;
1658 }
1659 
1660 struct sock *netlink_getsockbyfilp(struct file *filp)
1661 {
1662         struct inode *inode = file_inode(filp);
1663         struct sock *sock;
1664 
1665         if (!S_ISSOCK(inode->i_mode))
1666                 return ERR_PTR(-ENOTSOCK);
1667 
1668         sock = SOCKET_I(inode)->sk;
1669         if (sock->sk_family != AF_NETLINK)
1670                 return ERR_PTR(-EINVAL);
1671 
1672         sock_hold(sock);
1673         return sock;
1674 }
1675 
1676 static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
1677                                                int broadcast)
1678 {
1679         struct sk_buff *skb;
1680         void *data;
1681 
1682         if (size <= NLMSG_GOODSIZE || broadcast)
1683                 return alloc_skb(size, GFP_KERNEL);
1684 
1685         size = SKB_DATA_ALIGN(size) +
1686                SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1687 
1688         data = vmalloc(size);
1689         if (data == NULL)
1690                 return NULL;
1691 
1692         skb = __build_skb(data, size);
1693         if (skb == NULL)
1694                 vfree(data);
1695         else
1696                 skb->destructor = netlink_skb_destructor;
1697 
1698         return skb;
1699 }
1700 
1701 /*
1702  * Attach a skb to a netlink socket.
1703  * The caller must hold a reference to the destination socket. On error, the
1704  * reference is dropped. The skb is not send to the destination, just all
1705  * all error checks are performed and memory in the queue is reserved.
1706  * Return values:
1707  * < 0: error. skb freed, reference to sock dropped.
1708  * 0: continue
1709  * 1: repeat lookup - reference dropped while waiting for socket memory.
1710  */
1711 int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
1712                       long *timeo, struct sock *ssk)
1713 {
1714         struct netlink_sock *nlk;
1715 
1716         nlk = nlk_sk(sk);
1717 
1718         if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1719              test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1720             !netlink_skb_is_mmaped(skb)) {
1721                 DECLARE_WAITQUEUE(wait, current);
1722                 if (!*timeo) {
1723                         if (!ssk || netlink_is_kernel(ssk))
1724                                 netlink_overrun(sk);
1725                         sock_put(sk);
1726                         kfree_skb(skb);
1727                         return -EAGAIN;
1728                 }
1729 
1730                 __set_current_state(TASK_INTERRUPTIBLE);
1731                 add_wait_queue(&nlk->wait, &wait);
1732 
1733                 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1734                      test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1735                     !sock_flag(sk, SOCK_DEAD))
1736                         *timeo = schedule_timeout(*timeo);
1737 
1738                 __set_current_state(TASK_RUNNING);
1739                 remove_wait_queue(&nlk->wait, &wait);
1740                 sock_put(sk);
1741 
1742                 if (signal_pending(current)) {
1743                         kfree_skb(skb);
1744                         return sock_intr_errno(*timeo);
1745                 }
1746                 return 1;
1747         }
1748         netlink_skb_set_owner_r(skb, sk);
1749         return 0;
1750 }
1751 
1752 static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1753 {
1754         int len = skb->len;
1755 
1756         netlink_deliver_tap(skb);
1757 
1758 #ifdef CONFIG_NETLINK_MMAP
1759         if (netlink_skb_is_mmaped(skb))
1760                 netlink_queue_mmaped_skb(sk, skb);
1761         else if (netlink_rx_is_mmaped(sk))
1762                 netlink_ring_set_copied(sk, skb);
1763         else
1764 #endif /* CONFIG_NETLINK_MMAP */
1765                 skb_queue_tail(&sk->sk_receive_queue, skb);
1766         sk->sk_data_ready(sk);
1767         return len;
1768 }
1769 
1770 int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1771 {
1772         int len = __netlink_sendskb(sk, skb);
1773 
1774         sock_put(sk);
1775         return len;
1776 }
1777 
1778 void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
1779 {
1780         kfree_skb(skb);
1781         sock_put(sk);
1782 }
1783 
1784 static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
1785 {
1786         int delta;
1787 
1788         WARN_ON(skb->sk != NULL);
1789         if (netlink_skb_is_mmaped(skb))
1790                 return skb;
1791 
1792         delta = skb->end - skb->tail;
1793         if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
1794                 return skb;
1795 
1796         if (skb_shared(skb)) {
1797                 struct sk_buff *nskb = skb_clone(skb, allocation);
1798                 if (!nskb)
1799                         return skb;
1800                 consume_skb(skb);
1801                 skb = nskb;
1802         }
1803 
1804         if (!pskb_expand_head(skb, 0, -delta, allocation))
1805                 skb->truesize -= delta;
1806 
1807         return skb;
1808 }
1809 
1810 static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
1811                                   struct sock *ssk)
1812 {
1813         int ret;
1814         struct netlink_sock *nlk = nlk_sk(sk);
1815 
1816         ret = -ECONNREFUSED;
1817         if (nlk->netlink_rcv != NULL) {
1818                 ret = skb->len;
1819                 netlink_skb_set_owner_r(skb, sk);
1820                 NETLINK_CB(skb).sk = ssk;
1821                 netlink_deliver_tap_kernel(sk, ssk, skb);
1822                 nlk->netlink_rcv(skb);
1823                 consume_skb(skb);
1824         } else {
1825                 kfree_skb(skb);
1826         }
1827         sock_put(sk);
1828         return ret;
1829 }
1830 
1831 int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1832                     u32 portid, int nonblock)
1833 {
1834         struct sock *sk;
1835         int err;
1836         long timeo;
1837 
1838         skb = netlink_trim(skb, gfp_any());
1839 
1840         timeo = sock_sndtimeo(ssk, nonblock);
1841 retry:
1842         sk = netlink_getsockbyportid(ssk, portid);
1843         if (IS_ERR(sk)) {
1844                 kfree_skb(skb);
1845                 return PTR_ERR(sk);
1846         }
1847         if (netlink_is_kernel(sk))
1848                 return netlink_unicast_kernel(sk, skb, ssk);
1849 
1850         if (sk_filter(sk, skb)) {
1851                 err = skb->len;
1852                 kfree_skb(skb);
1853                 sock_put(sk);
1854                 return err;
1855         }
1856 
1857         err = netlink_attachskb(sk, skb, &timeo, ssk);
1858         if (err == 1)
1859                 goto retry;
1860         if (err)
1861                 return err;
1862 
1863         return netlink_sendskb(sk, skb);
1864 }
1865 EXPORT_SYMBOL(netlink_unicast);
1866 
1867 struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
1868                                   u32 dst_portid, gfp_t gfp_mask)
1869 {
1870 #ifdef CONFIG_NETLINK_MMAP
1871         struct sock *sk = NULL;
1872         struct sk_buff *skb;
1873         struct netlink_ring *ring;
1874         struct nl_mmap_hdr *hdr;
1875         unsigned int maxlen;
1876 
1877         sk = netlink_getsockbyportid(ssk, dst_portid);
1878         if (IS_ERR(sk))
1879                 goto out;
1880 
1881         ring = &nlk_sk(sk)->rx_ring;
1882         /* fast-path without atomic ops for common case: non-mmaped receiver */
1883         if (ring->pg_vec == NULL)
1884                 goto out_put;
1885 
1886         if (ring->frame_size - NL_MMAP_HDRLEN < size)
1887                 goto out_put;
1888 
1889         skb = alloc_skb_head(gfp_mask);
1890         if (skb == NULL)
1891                 goto err1;
1892 
1893         spin_lock_bh(&sk->sk_receive_queue.lock);
1894         /* check again under lock */
1895         if (ring->pg_vec == NULL)
1896                 goto out_free;
1897 
1898         /* check again under lock */
1899         maxlen = ring->frame_size - NL_MMAP_HDRLEN;
1900         if (maxlen < size)
1901                 goto out_free;
1902 
1903         netlink_forward_ring(ring);
1904         hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
1905         if (hdr == NULL)
1906                 goto err2;
1907         netlink_ring_setup_skb(skb, sk, ring, hdr);
1908         netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
1909         atomic_inc(&ring->pending);
1910         netlink_increment_head(ring);
1911 
1912         spin_unlock_bh(&sk->sk_receive_queue.lock);
1913         return skb;
1914 
1915 err2:
1916         kfree_skb(skb);
1917         spin_unlock_bh(&sk->sk_receive_queue.lock);
1918         netlink_overrun(sk);
1919 err1:
1920         sock_put(sk);
1921         return NULL;
1922 
1923 out_free:
1924         kfree_skb(skb);
1925         spin_unlock_bh(&sk->sk_receive_queue.lock);
1926 out_put:
1927         sock_put(sk);
1928 out:
1929 #endif
1930         return alloc_skb(size, gfp_mask);
1931 }
1932 EXPORT_SYMBOL_GPL(netlink_alloc_skb);
1933 
1934 int netlink_has_listeners(struct sock *sk, unsigned int group)
1935 {
1936         int res = 0;
1937         struct listeners *listeners;
1938 
1939         BUG_ON(!netlink_is_kernel(sk));
1940 
1941         rcu_read_lock();
1942         listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
1943 
1944         if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1945                 res = test_bit(group - 1, listeners->masks);
1946 
1947         rcu_read_unlock();
1948 
1949         return res;
1950 }
1951 EXPORT_SYMBOL_GPL(netlink_has_listeners);
1952 
1953 static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
1954 {
1955         struct netlink_sock *nlk = nlk_sk(sk);
1956 
1957         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1958             !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1959                 netlink_skb_set_owner_r(skb, sk);
1960                 __netlink_sendskb(sk, skb);
1961                 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
1962         }
1963         return -1;
1964 }
1965 
1966 struct netlink_broadcast_data {
1967         struct sock *exclude_sk;
1968         struct net *net;
1969         u32 portid;
1970         u32 group;
1971         int failure;
1972         int delivery_failure;
1973         int congested;
1974         int delivered;
1975         gfp_t allocation;
1976         struct sk_buff *skb, *skb2;
1977         int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
1978         void *tx_data;
1979 };
1980 
1981 static void do_one_broadcast(struct sock *sk,
1982                                     struct netlink_broadcast_data *p)
1983 {
1984         struct netlink_sock *nlk = nlk_sk(sk);
1985         int val;
1986 
1987         if (p->exclude_sk == sk)
1988                 return;
1989 
1990         if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1991             !test_bit(p->group - 1, nlk->groups))
1992                 return;
1993 
1994         if (!net_eq(sock_net(sk), p->net)) {
1995                 if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
1996                         return;
1997 
1998                 if (!peernet_has_id(sock_net(sk), p->net))
1999                         return;
2000 
2001                 if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
2002                                      CAP_NET_BROADCAST))
2003                         return;
2004         }
2005 
2006         if (p->failure) {
2007                 netlink_overrun(sk);
2008                 return;
2009         }
2010 
2011         sock_hold(sk);
2012         if (p->skb2 == NULL) {
2013                 if (skb_shared(p->skb)) {
2014                         p->skb2 = skb_clone(p->skb, p->allocation);
2015                 } else {
2016                         p->skb2 = skb_get(p->skb);
2017                         /*
2018                          * skb ownership may have been set when
2019                          * delivered to a previous socket.
2020                          */
2021                         skb_orphan(p->skb2);
2022                 }
2023         }
2024         if (p->skb2 == NULL) {
2025                 netlink_overrun(sk);
2026                 /* Clone failed. Notify ALL listeners. */
2027                 p->failure = 1;
2028                 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
2029                         p->delivery_failure = 1;
2030                 goto out;
2031         }
2032         if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
2033                 kfree_skb(p->skb2);
2034                 p->skb2 = NULL;
2035                 goto out;
2036         }
2037         if (sk_filter(sk, p->skb2)) {
2038                 kfree_skb(p->skb2);
2039                 p->skb2 = NULL;
2040                 goto out;
2041         }
2042         NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
2043         NETLINK_CB(p->skb2).nsid_is_set = true;
2044         val = netlink_broadcast_deliver(sk, p->skb2);
2045         if (val < 0) {
2046                 netlink_overrun(sk);
2047                 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
2048                         p->delivery_failure = 1;
2049         } else {
2050                 p->congested |= val;
2051                 p->delivered = 1;
2052                 p->skb2 = NULL;
2053         }
2054 out:
2055         sock_put(sk);
2056 }
2057 
2058 int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
2059         u32 group, gfp_t allocation,
2060         int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
2061         void *filter_data)
2062 {
2063         struct net *net = sock_net(ssk);
2064         struct netlink_broadcast_data info;
2065         struct sock *sk;
2066 
2067         skb = netlink_trim(skb, allocation);
2068 
2069         info.exclude_sk = ssk;
2070         info.net = net;
2071         info.portid = portid;
2072         info.group = group;
2073         info.failure = 0;
2074         info.delivery_failure = 0;
2075         info.congested = 0;
2076         info.delivered = 0;
2077         info.allocation = allocation;
2078         info.skb = skb;
2079         info.skb2 = NULL;
2080         info.tx_filter = filter;
2081         info.tx_data = filter_data;
2082 
2083         /* While we sleep in clone, do not allow to change socket list */
2084 
2085         netlink_lock_table();
2086 
2087         sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
2088                 do_one_broadcast(sk, &info);
2089 
2090         consume_skb(skb);
2091 
2092         netlink_unlock_table();
2093 
2094         if (info.delivery_failure) {
2095                 kfree_skb(info.skb2);
2096                 return -ENOBUFS;
2097         }
2098         consume_skb(info.skb2);
2099 
2100         if (info.delivered) {
2101                 if (info.congested && (allocation & __GFP_WAIT))
2102                         yield();
2103                 return 0;
2104         }
2105         return -ESRCH;
2106 }
2107 EXPORT_SYMBOL(netlink_broadcast_filtered);
2108 
2109 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
2110                       u32 group, gfp_t allocation)
2111 {
2112         return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
2113                 NULL, NULL);
2114 }
2115 EXPORT_SYMBOL(netlink_broadcast);
2116 
2117 struct netlink_set_err_data {
2118         struct sock *exclude_sk;
2119         u32 portid;
2120         u32 group;
2121         int code;
2122 };
2123 
2124 static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
2125 {
2126         struct netlink_sock *nlk = nlk_sk(sk);
2127         int ret = 0;
2128 
2129         if (sk == p->exclude_sk)
2130                 goto out;
2131 
2132         if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
2133                 goto out;
2134 
2135         if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
2136             !test_bit(p->group - 1, nlk->groups))
2137                 goto out;
2138 
2139         if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
2140                 ret = 1;
2141                 goto out;
2142         }
2143 
2144         sk->sk_err = p->code;
2145         sk->sk_error_report(sk);
2146 out:
2147         return ret;
2148 }
2149 
2150 /**
2151  * netlink_set_err - report error to broadcast listeners
2152  * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
2153  * @portid: the PORTID of a process that we want to skip (if any)
2154  * @group: the broadcast group that will notice the error
2155  * @code: error code, must be negative (as usual in kernelspace)
2156  *
2157  * This function returns the number of broadcast listeners that have set the
2158  * NETLINK_NO_ENOBUFS socket option.
2159  */
2160 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
2161 {
2162         struct netlink_set_err_data info;
2163         struct sock *sk;
2164         int ret = 0;
2165 
2166         info.exclude_sk = ssk;
2167         info.portid = portid;
2168         info.group = group;
2169         /* sk->sk_err wants a positive error value */
2170         info.code = -code;
2171 
2172         read_lock(&nl_table_lock);
2173 
2174         sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
2175                 ret += do_one_set_err(sk, &info);
2176 
2177         read_unlock(&nl_table_lock);
2178         return ret;
2179 }
2180 EXPORT_SYMBOL(netlink_set_err);
2181 
2182 /* must be called with netlink table grabbed */
2183 static void netlink_update_socket_mc(struct netlink_sock *nlk,
2184                                      unsigned int group,
2185                                      int is_new)
2186 {
2187         int old, new = !!is_new, subscriptions;
2188 
2189         old = test_bit(group - 1, nlk->groups);
2190         subscriptions = nlk->subscriptions - old + new;
2191         if (new)
2192                 __set_bit(group - 1, nlk->groups);
2193         else
2194                 __clear_bit(group - 1, nlk->groups);
2195         netlink_update_subscriptions(&nlk->sk, subscriptions);
2196         netlink_update_listeners(&nlk->sk);
2197 }
2198 
2199 static int netlink_setsockopt(struct socket *sock, int level, int optname,
2200                               char __user *optval, unsigned int optlen)
2201 {
2202         struct sock *sk = sock->sk;
2203         struct netlink_sock *nlk = nlk_sk(sk);
2204         unsigned int val = 0;
2205         int err;
2206 
2207         if (level != SOL_NETLINK)
2208                 return -ENOPROTOOPT;
2209 
2210         if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
2211             optlen >= sizeof(int) &&
2212             get_user(val, (unsigned int __user *)optval))
2213                 return -EFAULT;
2214 
2215         switch (optname) {
2216         case NETLINK_PKTINFO:
2217                 if (val)
2218                         nlk->flags |= NETLINK_F_RECV_PKTINFO;
2219                 else
2220                         nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
2221                 err = 0;
2222                 break;
2223         case NETLINK_ADD_MEMBERSHIP:
2224         case NETLINK_DROP_MEMBERSHIP: {
2225                 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
2226                         return -EPERM;
2227                 err = netlink_realloc_groups(sk);
2228                 if (err)
2229                         return err;
2230                 if (!val || val - 1 >= nlk->ngroups)
2231                         return -EINVAL;
2232                 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
2233                         err = nlk->netlink_bind(sock_net(sk), val);
2234                         if (err)
2235                                 return err;
2236                 }
2237                 netlink_table_grab();
2238                 netlink_update_socket_mc(nlk, val,
2239                                          optname == NETLINK_ADD_MEMBERSHIP);
2240                 netlink_table_ungrab();
2241                 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
2242                         nlk->netlink_unbind(sock_net(sk), val);
2243 
2244                 err = 0;
2245                 break;
2246         }
2247         case NETLINK_BROADCAST_ERROR:
2248                 if (val)
2249                         nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
2250                 else
2251                         nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
2252                 err = 0;
2253                 break;
2254         case NETLINK_NO_ENOBUFS:
2255                 if (val) {
2256                         nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
2257                         clear_bit(NETLINK_S_CONGESTED, &nlk->state);
2258                         wake_up_interruptible(&nlk->wait);
2259                 } else {
2260                         nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
2261                 }
2262                 err = 0;
2263                 break;
2264 #ifdef CONFIG_NETLINK_MMAP
2265         case NETLINK_RX_RING:
2266         case NETLINK_TX_RING: {
2267                 struct nl_mmap_req req;
2268 
2269                 /* Rings might consume more memory than queue limits, require
2270                  * CAP_NET_ADMIN.
2271                  */
2272                 if (!capable(CAP_NET_ADMIN))
2273                         return -EPERM;
2274                 if (optlen < sizeof(req))
2275                         return -EINVAL;
2276                 if (copy_from_user(&req, optval, sizeof(req)))
2277                         return -EFAULT;
2278                 err = netlink_set_ring(sk, &req,
2279                                        optname == NETLINK_TX_RING);
2280                 break;
2281         }
2282 #endif /* CONFIG_NETLINK_MMAP */
2283         case NETLINK_LISTEN_ALL_NSID:
2284                 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
2285                         return -EPERM;
2286 
2287                 if (val)
2288                         nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
2289                 else
2290                         nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
2291                 err = 0;
2292                 break;
2293         default:
2294                 err = -ENOPROTOOPT;
2295         }
2296         return err;
2297 }
2298 
2299 static int netlink_getsockopt(struct socket *sock, int level, int optname,
2300                               char __user *optval, int __user *optlen)
2301 {
2302         struct sock *sk = sock->sk;
2303         struct netlink_sock *nlk = nlk_sk(sk);
2304         int len, val, err;
2305 
2306         if (level != SOL_NETLINK)
2307                 return -ENOPROTOOPT;
2308 
2309         if (get_user(len, optlen))
2310                 return -EFAULT;
2311         if (len < 0)
2312                 return -EINVAL;
2313 
2314         switch (optname) {
2315         case NETLINK_PKTINFO:
2316                 if (len < sizeof(int))
2317                         return -EINVAL;
2318                 len = sizeof(int);
2319                 val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
2320                 if (put_user(len, optlen) ||
2321                     put_user(val, optval))
2322                         return -EFAULT;
2323                 err = 0;
2324                 break;
2325         case NETLINK_BROADCAST_ERROR:
2326                 if (len < sizeof(int))
2327                         return -EINVAL;
2328                 len = sizeof(int);
2329                 val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
2330                 if (put_user(len, optlen) ||
2331                     put_user(val, optval))
2332                         return -EFAULT;
2333                 err = 0;
2334                 break;
2335         case NETLINK_NO_ENOBUFS:
2336                 if (len < sizeof(int))
2337                         return -EINVAL;
2338                 len = sizeof(int);
2339                 val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
2340                 if (put_user(len, optlen) ||
2341                     put_user(val, optval))
2342                         return -EFAULT;
2343                 err = 0;
2344                 break;
2345         case NETLINK_LIST_MEMBERSHIPS: {
2346                 int pos, idx, shift;
2347 
2348                 err = 0;
2349                 netlink_lock_table();
2350                 for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
2351                         if (len - pos < sizeof(u32))
2352                                 break;
2353 
2354                         idx = pos / sizeof(unsigned long);
2355                         shift = (pos % sizeof(unsigned long)) * 8;
2356                         if (put_user((u32)(nlk->groups[idx] >> shift),
2357                                      (u32 __user *)(optval + pos))) {
2358                                 err = -EFAULT;
2359                                 break;
2360                         }
2361                 }
2362                 if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
2363                         err = -EFAULT;
2364                 netlink_unlock_table();
2365                 break;
2366         }
2367         default:
2368                 err = -ENOPROTOOPT;
2369         }
2370         return err;
2371 }
2372 
2373 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
2374 {
2375         struct nl_pktinfo info;
2376 
2377         info.group = NETLINK_CB(skb).dst_group;
2378         put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
2379 }
2380 
2381 static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
2382                                          struct sk_buff *skb)
2383 {
2384         if (!NETLINK_CB(skb).nsid_is_set)
2385                 return;
2386 
2387         put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
2388                  &NETLINK_CB(skb).nsid);
2389 }
2390 
2391 static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
2392 {
2393         struct sock *sk = sock->sk;
2394         struct netlink_sock *nlk = nlk_sk(sk);
2395         DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
2396         u32 dst_portid;
2397         u32 dst_group;
2398         struct sk_buff *skb;
2399         int err;
2400         struct scm_cookie scm;
2401         u32 netlink_skb_flags = 0;
2402 
2403         if (msg->msg_flags&MSG_OOB)
2404                 return -EOPNOTSUPP;
2405 
2406         err = scm_send(sock, msg, &scm, true);
2407         if (err < 0)
2408                 return err;
2409 
2410         if (msg->msg_namelen) {
2411                 err = -EINVAL;
2412                 if (addr->nl_family != AF_NETLINK)
2413                         goto out;
2414                 dst_portid = addr->nl_pid;
2415                 dst_group = ffs(addr->nl_groups);
2416                 err =  -EPERM;
2417                 if ((dst_group || dst_portid) &&
2418                     !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
2419                         goto out;
2420                 netlink_skb_flags |= NETLINK_SKB_DST;
2421         } else {
2422                 dst_portid = nlk->dst_portid;
2423                 dst_group = nlk->dst_group;
2424         }
2425 
2426         if (!nlk->bound) {
2427                 err = netlink_autobind(sock);
2428                 if (err)
2429                         goto out;
2430         } else {
2431                 /* Ensure nlk is hashed and visible. */
2432                 smp_rmb();
2433         }
2434 
2435         /* It's a really convoluted way for userland to ask for mmaped
2436          * sendmsg(), but that's what we've got...
2437          */
2438         if (netlink_tx_is_mmaped(sk) &&
2439             iter_is_iovec(&msg->msg_iter) &&
2440             msg->msg_iter.nr_segs == 1 &&
2441             msg->msg_iter.iov->iov_base == NULL) {
2442                 err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
2443                                            &scm);
2444                 goto out;
2445         }
2446 
2447         err = -EMSGSIZE;
2448         if (len > sk->sk_sndbuf - 32)
2449                 goto out;
2450         err = -ENOBUFS;
2451         skb = netlink_alloc_large_skb(len, dst_group);
2452         if (skb == NULL)
2453                 goto out;
2454 
2455         NETLINK_CB(skb).portid  = nlk->portid;
2456         NETLINK_CB(skb).dst_group = dst_group;
2457         NETLINK_CB(skb).creds   = scm.creds;
2458         NETLINK_CB(skb).flags   = netlink_skb_flags;
2459 
2460         err = -EFAULT;
2461         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
2462                 kfree_skb(skb);
2463                 goto out;
2464         }
2465 
2466         err = security_netlink_send(sk, skb);
2467         if (err) {
2468                 kfree_skb(skb);
2469                 goto out;
2470         }
2471 
2472         if (dst_group) {
2473                 atomic_inc(&skb->users);
2474                 netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
2475         }
2476         err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
2477 
2478 out:
2479         scm_destroy(&scm);
2480         return err;
2481 }
2482 
2483 static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
2484                            int flags)
2485 {
2486         struct scm_cookie scm;
2487         struct sock *sk = sock->sk;
2488         struct netlink_sock *nlk = nlk_sk(sk);
2489         int noblock = flags&MSG_DONTWAIT;
2490         size_t copied;
2491         struct sk_buff *skb, *data_skb;
2492         int err, ret;
2493 
2494         if (flags&MSG_OOB)
2495                 return -EOPNOTSUPP;
2496 
2497         copied = 0;
2498 
2499         skb = skb_recv_datagram(sk, flags, noblock, &err);
2500         if (skb == NULL)
2501                 goto out;
2502 
2503         data_skb = skb;
2504 
2505 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
2506         if (unlikely(skb_shinfo(skb)->frag_list)) {
2507                 /*
2508                  * If this skb has a frag_list, then here that means that we
2509                  * will have to use the frag_list skb's data for compat tasks
2510                  * and the regular skb's data for normal (non-compat) tasks.
2511                  *
2512                  * If we need to send the compat skb, assign it to the
2513                  * 'data_skb' variable so that it will be used below for data
2514                  * copying. We keep 'skb' for everything else, including
2515                  * freeing both later.
2516                  */
2517                 if (flags & MSG_CMSG_COMPAT)
2518                         data_skb = skb_shinfo(skb)->frag_list;
2519         }
2520 #endif
2521 
2522         /* Record the max length of recvmsg() calls for future allocations */
2523         nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
2524         nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
2525                                      16384);
2526 
2527         copied = data_skb->len;
2528         if (len < copied) {
2529                 msg->msg_flags |= MSG_TRUNC;
2530                 copied = len;
2531         }
2532 
2533         skb_reset_transport_header(data_skb);
2534         err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
2535 
2536         if (msg->msg_name) {
2537                 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
2538                 addr->nl_family = AF_NETLINK;
2539                 addr->nl_pad    = 0;
2540                 addr->nl_pid    = NETLINK_CB(skb).portid;
2541                 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group);
2542                 msg->msg_namelen = sizeof(*addr);
2543         }
2544 
2545         if (nlk->flags & NETLINK_F_RECV_PKTINFO)
2546                 netlink_cmsg_recv_pktinfo(msg, skb);
2547         if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
2548                 netlink_cmsg_listen_all_nsid(sk, msg, skb);
2549 
2550         memset(&scm, 0, sizeof(scm));
2551         scm.creds = *NETLINK_CREDS(skb);
2552         if (flags & MSG_TRUNC)
2553                 copied = data_skb->len;
2554 
2555         skb_free_datagram(sk, skb);
2556 
2557         if (nlk->cb_running &&
2558             atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
2559                 ret = netlink_dump(sk);
2560                 if (ret) {
2561                         sk->sk_err = -ret;
2562                         sk->sk_error_report(sk);
2563                 }
2564         }
2565 
2566         scm_recv(sock, msg, &scm, flags);
2567 out:
2568         netlink_rcv_wake(sk);
2569         return err ? : copied;
2570 }
2571 
2572 static void netlink_data_ready(struct sock *sk)
2573 {
2574         BUG();
2575 }
2576 
2577 /*
2578  *      We export these functions to other modules. They provide a
2579  *      complete set of kernel non-blocking support for message
2580  *      queueing.
2581  */
2582 
2583 struct sock *
2584 __netlink_kernel_create(struct net *net, int unit, struct module *module,
2585                         struct netlink_kernel_cfg *cfg)
2586 {
2587         struct socket *sock;
2588         struct sock *sk;
2589         struct netlink_sock *nlk;
2590         struct listeners *listeners = NULL;
2591         struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
2592         unsigned int groups;
2593 
2594         BUG_ON(!nl_table);
2595 
2596         if (unit < 0 || unit >= MAX_LINKS)
2597                 return NULL;
2598 
2599         if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
2600                 return NULL;
2601 
2602         if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
2603                 goto out_sock_release_nosk;
2604 
2605         sk = sock->sk;
2606 
2607         if (!cfg || cfg->groups < 32)
2608                 groups = 32;
2609         else
2610                 groups = cfg->groups;
2611 
2612         listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2613         if (!listeners)
2614                 goto out_sock_release;
2615 
2616         sk->sk_data_ready = netlink_data_ready;
2617         if (cfg && cfg->input)
2618                 nlk_sk(sk)->netlink_rcv = cfg->input;
2619 
2620         if (netlink_insert(sk, 0))
2621                 goto out_sock_release;
2622 
2623         nlk = nlk_sk(sk);
2624         nlk->flags |= NETLINK_F_KERNEL_SOCKET;
2625 
2626         netlink_table_grab();
2627         if (!nl_table[unit].registered) {
2628                 nl_table[unit].groups = groups;
2629                 rcu_assign_pointer(nl_table[unit].listeners, listeners);
2630                 nl_table[unit].cb_mutex = cb_mutex;
2631                 nl_table[unit].module = module;
2632                 if (cfg) {
2633                         nl_table[unit].bind = cfg->bind;
2634                         nl_table[unit].unbind = cfg->unbind;
2635                         nl_table[unit].flags = cfg->flags;
2636                         if (cfg->compare)
2637                                 nl_table[unit].compare = cfg->compare;
2638                 }
2639                 nl_table[unit].registered = 1;
2640         } else {
2641                 kfree(listeners);
2642                 nl_table[unit].registered++;
2643         }
2644         netlink_table_ungrab();
2645         return sk;
2646 
2647 out_sock_release:
2648         kfree(listeners);
2649         netlink_kernel_release(sk);
2650         return NULL;
2651 
2652 out_sock_release_nosk:
2653         sock_release(sock);
2654         return NULL;
2655 }
2656 EXPORT_SYMBOL(__netlink_kernel_create);
2657 
2658 void
2659 netlink_kernel_release(struct sock *sk)
2660 {
2661         if (sk == NULL || sk->sk_socket == NULL)
2662                 return;
2663 
2664         sock_release(sk->sk_socket);
2665 }
2666 EXPORT_SYMBOL(netlink_kernel_release);
2667 
2668 int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
2669 {
2670         struct listeners *new, *old;
2671         struct netlink_table *tbl = &nl_table[sk->sk_protocol];
2672 
2673         if (groups < 32)
2674                 groups = 32;
2675 
2676         if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2677                 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
2678                 if (!new)
2679                         return -ENOMEM;
2680                 old = nl_deref_protected(tbl->listeners);
2681                 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
2682                 rcu_assign_pointer(tbl->listeners, new);
2683 
2684                 kfree_rcu(old, rcu);
2685         }
2686         tbl->groups = groups;
2687 
2688         return 0;
2689 }
2690 
2691 /**
2692  * netlink_change_ngroups - change number of multicast groups
2693  *
2694  * This changes the number of multicast groups that are available
2695  * on a certain netlink family. Note that it is not possible to
2696  * change the number of groups to below 32. Also note that it does
2697  * not implicitly call netlink_clear_multicast_users() when the
2698  * number of groups is reduced.
2699  *
2700  * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
2701  * @groups: The new number of groups.
2702  */
2703 int netlink_change_ngroups(struct sock *sk, unsigned int groups)
2704 {
2705         int err;
2706 
2707         netlink_table_grab();
2708         err = __netlink_change_ngroups(sk, groups);
2709         netlink_table_ungrab();
2710 
2711         return err;
2712 }
2713 
2714 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
2715 {
2716         struct sock *sk;
2717         struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
2718 
2719         sk_for_each_bound(sk, &tbl->mc_list)
2720                 netlink_update_socket_mc(nlk_sk(sk), group, 0);
2721 }
2722 
2723 struct nlmsghdr *
2724 __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2725 {
2726         struct nlmsghdr *nlh;
2727         int size = nlmsg_msg_size(len);
2728 
2729         nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2730         nlh->nlmsg_type = type;
2731         nlh->nlmsg_len = size;
2732         nlh->nlmsg_flags = flags;
2733         nlh->nlmsg_pid = portid;
2734         nlh->nlmsg_seq = seq;
2735         if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2736                 memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2737         return nlh;
2738 }
2739 EXPORT_SYMBOL(__nlmsg_put);
2740 
2741 /*
2742  * It looks a bit ugly.
2743  * It would be better to create kernel thread.
2744  */
2745 
2746 static int netlink_dump(struct sock *sk)
2747 {
2748         struct netlink_sock *nlk = nlk_sk(sk);
2749         struct netlink_callback *cb;
2750         struct sk_buff *skb = NULL;
2751         struct nlmsghdr *nlh;
2752         int len, err = -ENOBUFS;
2753         int alloc_min_size;
2754         int alloc_size;
2755 
2756         mutex_lock(nlk->cb_mutex);
2757         if (!nlk->cb_running) {
2758                 err = -EINVAL;
2759                 goto errout_skb;
2760         }
2761 
2762         if (!netlink_rx_is_mmaped(sk) &&
2763             atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2764                 goto errout_skb;
2765 
2766         /* NLMSG_GOODSIZE is small to avoid high order allocations being
2767          * required, but it makes sense to _attempt_ a 16K bytes allocation
2768          * to reduce number of system calls on dump operations, if user
2769          * ever provided a big enough buffer.
2770          */
2771         cb = &nlk->cb;
2772         alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
2773 
2774         if (alloc_min_size < nlk->max_recvmsg_len) {
2775                 alloc_size = nlk->max_recvmsg_len;
2776                 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
2777                                         GFP_KERNEL |
2778                                         __GFP_NOWARN |
2779                                         __GFP_NORETRY);
2780         }
2781         if (!skb) {
2782                 alloc_size = alloc_min_size;
2783                 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
2784                                         GFP_KERNEL);
2785         }
2786         if (!skb)
2787                 goto errout_skb;
2788 
2789         /* Trim skb to allocated size. User is expected to provide buffer as
2790          * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
2791          * netlink_recvmsg())). dump will pack as many smaller messages as
2792          * could fit within the allocated skb. skb is typically allocated
2793          * with larger space than required (could be as much as near 2x the
2794          * requested size with align to next power of 2 approach). Allowing
2795          * dump to use the excess space makes it difficult for a user to have a
2796          * reasonable static buffer based on the expected largest dump of a
2797          * single netdev. The outcome is MSG_TRUNC error.
2798          */
2799         skb_reserve(skb, skb_tailroom(skb) - alloc_size);
2800         netlink_skb_set_owner_r(skb, sk);
2801 
2802         len = cb->dump(skb, cb);
2803 
2804         if (len > 0) {
2805                 mutex_unlock(nlk->cb_mutex);
2806 
2807                 if (sk_filter(sk, skb))
2808                         kfree_skb(skb);
2809                 else
2810                         __netlink_sendskb(sk, skb);
2811                 return 0;
2812         }
2813 
2814         nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
2815         if (!nlh)
2816                 goto errout_skb;
2817 
2818         nl_dump_check_consistent(cb, nlh);
2819 
2820         memcpy(nlmsg_data(nlh), &len, sizeof(len));
2821 
2822         if (sk_filter(sk, skb))
2823                 kfree_skb(skb);
2824         else
2825                 __netlink_sendskb(sk, skb);
2826 
2827         if (cb->done)
2828                 cb->done(cb);
2829 
2830         nlk->cb_running = false;
2831         mutex_unlock(nlk->cb_mutex);
2832         module_put(cb->module);
2833         consume_skb(cb->skb);
2834         return 0;
2835 
2836 errout_skb:
2837         mutex_unlock(nlk->cb_mutex);
2838         kfree_skb(skb);
2839         return err;
2840 }
2841 
2842 int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
2843                          const struct nlmsghdr *nlh,
2844                          struct netlink_dump_control *control)
2845 {
2846         struct netlink_callback *cb;
2847         struct sock *sk;
2848         struct netlink_sock *nlk;
2849         int ret;
2850 
2851         /* Memory mapped dump requests need to be copied to avoid looping
2852          * on the pending state in netlink_mmap_sendmsg() while the CB hold
2853          * a reference to the skb.
2854          */
2855         if (netlink_skb_is_mmaped(skb)) {
2856                 skb = skb_copy(skb, GFP_KERNEL);
2857                 if (skb == NULL)
2858                         return -ENOBUFS;
2859         } else
2860                 atomic_inc(&skb->users);
2861 
2862         sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
2863         if (sk == NULL) {
2864                 ret = -ECONNREFUSED;
2865                 goto error_free;
2866         }
2867 
2868         nlk = nlk_sk(sk);
2869         mutex_lock(nlk->cb_mutex);
2870         /* A dump is in progress... */
2871         if (nlk->cb_running) {
2872                 ret = -EBUSY;
2873                 goto error_unlock;
2874         }
2875         /* add reference of module which cb->dump belongs to */
2876         if (!try_module_get(control->module)) {
2877                 ret = -EPROTONOSUPPORT;
2878                 goto error_unlock;
2879         }
2880 
2881         cb = &nlk->cb;
2882         memset(cb, 0, sizeof(*cb));
2883         cb->dump = control->dump;
2884         cb->done = control->done;
2885         cb->nlh = nlh;
2886         cb->data = control->data;
2887         cb->module = control->module;
2888         cb->min_dump_alloc = control->min_dump_alloc;
2889         cb->skb = skb;
2890 
2891         nlk->cb_running = true;
2892 
2893         mutex_unlock(nlk->cb_mutex);
2894 
2895         ret = netlink_dump(sk);
2896         sock_put(sk);
2897 
2898         if (ret)
2899                 return ret;
2900 
2901         /* We successfully started a dump, by returning -EINTR we
2902          * signal not to send ACK even if it was requested.
2903          */
2904         return -EINTR;
2905 
2906 error_unlock:
2907         sock_put(sk);
2908         mutex_unlock(nlk->cb_mutex);
2909 error_free:
2910         kfree_skb(skb);
2911         return ret;
2912 }
2913 EXPORT_SYMBOL(__netlink_dump_start);
2914 
2915 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
2916 {
2917         struct sk_buff *skb;
2918         struct nlmsghdr *rep;
2919         struct nlmsgerr *errmsg;
2920         size_t payload = sizeof(*errmsg);
2921 
2922         /* error messages get the original request appened */
2923         if (err)
2924                 payload += nlmsg_len(nlh);
2925 
2926         skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload),
2927                                 NETLINK_CB(in_skb).portid, GFP_KERNEL);
2928         if (!skb) {
2929                 struct sock *sk;
2930 
2931                 sk = netlink_lookup(sock_net(in_skb->sk),
2932                                     in_skb->sk->sk_protocol,
2933                                     NETLINK_CB(in_skb).portid);
2934                 if (sk) {
2935                         sk->sk_err = ENOBUFS;
2936                         sk->sk_error_report(sk);
2937                         sock_put(sk);
2938                 }
2939                 return;
2940         }
2941 
2942         rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2943                           NLMSG_ERROR, payload, 0);
2944         errmsg = nlmsg_data(rep);
2945         errmsg->error = err;
2946         memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
2947         netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
2948 }
2949 EXPORT_SYMBOL(netlink_ack);
2950 
2951 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2952                                                      struct nlmsghdr *))
2953 {
2954         struct nlmsghdr *nlh;
2955         int err;
2956 
2957         while (skb->len >= nlmsg_total_size(0)) {
2958                 int msglen;
2959 
2960                 nlh = nlmsg_hdr(skb);
2961                 err = 0;
2962 
2963                 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2964                         return 0;
2965 
2966                 /* Only requests are handled by the kernel */
2967                 if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2968                         goto ack;
2969 
2970                 /* Skip control messages */
2971                 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2972                         goto ack;
2973 
2974                 err = cb(skb, nlh);
2975                 if (err == -EINTR)
2976                         goto skip;
2977 
2978 ack:
2979                 if (nlh->nlmsg_flags & NLM_F_ACK || err)
2980                         netlink_ack(skb, nlh, err);
2981 
2982 skip:
2983                 msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2984                 if (msglen > skb->len)
2985                         msglen = skb->len;
2986                 skb_pull(skb, msglen);
2987         }
2988 
2989         return 0;
2990 }
2991 EXPORT_SYMBOL(netlink_rcv_skb);
2992 
2993 /**
2994  * nlmsg_notify - send a notification netlink message
2995  * @sk: netlink socket to use
2996  * @skb: notification message
2997  * @portid: destination netlink portid for reports or 0
2998  * @group: destination multicast group or 0
2999  * @report: 1 to report back, 0 to disable
3000  * @flags: allocation flags
3001  */
3002 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
3003                  unsigned int group, int report, gfp_t flags)
3004 {
3005         int err = 0;
3006 
3007         if (group) {
3008                 int exclude_portid = 0;
3009 
3010                 if (report) {
3011                         atomic_inc(&skb->users);
3012                         exclude_portid = portid;
3013                 }
3014 
3015                 /* errors reported via destination sk->sk_err, but propagate
3016                  * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
3017                 err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
3018         }
3019 
3020         if (report) {
3021                 int err2;
3022 
3023                 err2 = nlmsg_unicast(sk, skb, portid);
3024                 if (!err || err == -ESRCH)
3025                         err = err2;
3026         }
3027 
3028         return err;
3029 }
3030 EXPORT_SYMBOL(nlmsg_notify);
3031 
3032 #ifdef CONFIG_PROC_FS
3033 struct nl_seq_iter {
3034         struct seq_net_private p;
3035         struct rhashtable_iter hti;
3036         int link;
3037 };
3038 
3039 static int netlink_walk_start(struct nl_seq_iter *iter)
3040 {
3041         int err;
3042 
3043         err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti);
3044         if (err) {
3045                 iter->link = MAX_LINKS;
3046                 return err;
3047         }
3048 
3049         err = rhashtable_walk_start(&iter->hti);
3050         return err == -EAGAIN ? 0 : err;
3051 }
3052 
3053 static void netlink_walk_stop(struct nl_seq_iter *iter)
3054 {
3055         rhashtable_walk_stop(&iter->hti);
3056         rhashtable_walk_exit(&iter->hti);
3057 }
3058 
3059 static void *__netlink_seq_next(struct seq_file *seq)
3060 {
3061         struct nl_seq_iter *iter = seq->private;
3062         struct netlink_sock *nlk;
3063 
3064         do {
3065                 for (;;) {
3066                         int err;
3067 
3068                         nlk = rhashtable_walk_next(&iter->hti);
3069 
3070                         if (IS_ERR(nlk)) {
3071                                 if (PTR_ERR(nlk) == -EAGAIN)
3072                                         continue;
3073 
3074                                 return nlk;
3075                         }
3076 
3077                         if (nlk)
3078                                 break;
3079 
3080                         netlink_walk_stop(iter);
3081                         if (++iter->link >= MAX_LINKS)
3082                                 return NULL;
3083 
3084                         err = netlink_walk_start(iter);
3085                         if (err)
3086                                 return ERR_PTR(err);
3087                 }
3088         } while (sock_net(&nlk->sk) != seq_file_net(seq));
3089 
3090         return nlk;
3091 }
3092 
3093 static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
3094 {
3095         struct nl_seq_iter *iter = seq->private;
3096         void *obj = SEQ_START_TOKEN;
3097         loff_t pos;
3098         int err;
3099 
3100         iter->link = 0;
3101 
3102         err = netlink_walk_start(iter);
3103         if (err)
3104                 return ERR_PTR(err);
3105 
3106         for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
3107                 obj = __netlink_seq_next(seq);
3108 
3109         return obj;
3110 }
3111 
3112 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3113 {
3114         ++*pos;
3115         return __netlink_seq_next(seq);
3116 }
3117 
3118 static void netlink_seq_stop(struct seq_file *seq, void *v)
3119 {
3120         struct nl_seq_iter *iter = seq->private;
3121 
3122         if (iter->link >= MAX_LINKS)
3123                 return;
3124 
3125         netlink_walk_stop(iter);
3126 }
3127 
3128 
3129 static int netlink_seq_show(struct seq_file *seq, void *v)
3130 {
3131         if (v == SEQ_START_TOKEN) {
3132                 seq_puts(seq,
3133                          "sk       Eth Pid    Groups   "
3134                          "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
3135         } else {
3136                 struct sock *s = v;
3137                 struct netlink_sock *nlk = nlk_sk(s);
3138 
3139                 seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
3140                            s,
3141                            s->sk_protocol,
3142                            nlk->portid,
3143                            nlk->groups ? (u32)nlk->groups[0] : 0,
3144                            sk_rmem_alloc_get(s),
3145                            sk_wmem_alloc_get(s),
3146                            nlk->cb_running,
3147                            atomic_read(&s->sk_refcnt),
3148                            atomic_read(&s->sk_drops),
3149                            sock_i_ino(s)
3150                         );
3151 
3152         }
3153         return 0;
3154 }
3155 
3156 static const struct seq_operations netlink_seq_ops = {
3157         .start  = netlink_seq_start,
3158         .next   = netlink_seq_next,
3159         .stop   = netlink_seq_stop,
3160         .show   = netlink_seq_show,
3161 };
3162 
3163 
3164 static int netlink_seq_open(struct inode *inode, struct file *file)
3165 {
3166         return seq_open_net(inode, file, &netlink_seq_ops,
3167                                 sizeof(struct nl_seq_iter));
3168 }
3169 
3170 static const struct file_operations netlink_seq_fops = {
3171         .owner          = THIS_MODULE,
3172         .open           = netlink_seq_open,
3173         .read           = seq_read,
3174         .llseek         = seq_lseek,
3175         .release        = seq_release_net,
3176 };
3177 
3178 #endif
3179 
3180 int netlink_register_notifier(struct notifier_block *nb)
3181 {
3182         return atomic_notifier_chain_register(&netlink_chain, nb);
3183 }
3184 EXPORT_SYMBOL(netlink_register_notifier);
3185 
3186 int netlink_unregister_notifier(struct notifier_block *nb)
3187 {
3188         return atomic_notifier_chain_unregister(&netlink_chain, nb);
3189 }
3190 EXPORT_SYMBOL(netlink_unregister_notifier);
3191 
3192 static const struct proto_ops netlink_ops = {
3193         .family =       PF_NETLINK,
3194         .owner =        THIS_MODULE,
3195         .release =      netlink_release,
3196         .bind =         netlink_bind,
3197         .connect =      netlink_connect,
3198         .socketpair =   sock_no_socketpair,
3199         .accept =       sock_no_accept,
3200         .getname =      netlink_getname,
3201         .poll =         netlink_poll,
3202         .ioctl =        sock_no_ioctl,
3203         .listen =       sock_no_listen,
3204         .shutdown =     sock_no_shutdown,
3205         .setsockopt =   netlink_setsockopt,
3206         .getsockopt =   netlink_getsockopt,
3207         .sendmsg =      netlink_sendmsg,
3208         .recvmsg =      netlink_recvmsg,
3209         .mmap =         netlink_mmap,
3210         .sendpage =     sock_no_sendpage,
3211 };
3212 
3213 static const struct net_proto_family netlink_family_ops = {
3214         .family = PF_NETLINK,
3215         .create = netlink_create,
3216         .owner  = THIS_MODULE,  /* for consistency 8) */
3217 };
3218 
3219 static int __net_init netlink_net_init(struct net *net)
3220 {
3221 #ifdef CONFIG_PROC_FS
3222         if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
3223                 return -ENOMEM;
3224 #endif
3225         return 0;
3226 }
3227 
3228 static void __net_exit netlink_net_exit(struct net *net)
3229 {
3230 #ifdef CONFIG_PROC_FS
3231         remove_proc_entry("netlink", net->proc_net);
3232 #endif
3233 }
3234 
3235 static void __init netlink_add_usersock_entry(void)
3236 {
3237         struct listeners *listeners;
3238         int groups = 32;
3239 
3240         listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
3241         if (!listeners)
3242                 panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
3243 
3244         netlink_table_grab();
3245 
3246         nl_table[NETLINK_USERSOCK].groups = groups;
3247         rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
3248         nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
3249         nl_table[NETLINK_USERSOCK].registered = 1;
3250         nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
3251 
3252         netlink_table_ungrab();
3253 }
3254 
3255 static struct pernet_operations __net_initdata netlink_net_ops = {
3256         .init = netlink_net_init,
3257         .exit = netlink_net_exit,
3258 };
3259 
3260 static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
3261 {
3262         const struct netlink_sock *nlk = data;
3263         struct netlink_compare_arg arg;
3264 
3265         netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
3266         return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
3267 }
3268 
3269 static const struct rhashtable_params netlink_rhashtable_params = {
3270         .head_offset = offsetof(struct netlink_sock, node),
3271         .key_len = netlink_compare_arg_len,
3272         .obj_hashfn = netlink_hash,
3273         .obj_cmpfn = netlink_compare,
3274         .automatic_shrinking = true,
3275 };
3276 
3277 static int __init netlink_proto_init(void)
3278 {
3279         int i;
3280         int err = proto_register(&netlink_proto, 0);
3281 
3282         if (err != 0)
3283                 goto out;
3284 
3285         BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
3286 
3287         nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
3288         if (!nl_table)
3289                 goto panic;
3290 
3291         for (i = 0; i < MAX_LINKS; i++) {
3292                 if (rhashtable_init(&nl_table[i].hash,
3293                                     &netlink_rhashtable_params) < 0) {
3294                         while (--i > 0)
3295                                 rhashtable_destroy(&nl_table[i].hash);
3296                         kfree(nl_table);
3297                         goto panic;
3298                 }
3299         }
3300 
3301         INIT_LIST_HEAD(&netlink_tap_all);
3302 
3303         netlink_add_usersock_entry();
3304 
3305         sock_register(&netlink_family_ops);
3306         register_pernet_subsys(&netlink_net_ops);
3307         /* The netlink device handler may be needed early. */
3308         rtnetlink_init();
3309 out:
3310         return err;
3311 panic:
3312         panic("netlink_init: Cannot allocate nl_table\n");
3313 }
3314 
3315 core_initcall(netlink_proto_init);
3316 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp