1 /* 2 * NETLINK Kernel-user communication protocol. 3 * 4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk> 5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License 9 * as published by the Free Software Foundation; either version 10 * 2 of the License, or (at your option) any later version. 11 * 12 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith 13 * added netlink_proto_exit 14 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br> 15 * use nlk_sk, as sk->protinfo is on a diet 8) 16 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org> 17 * - inc module use count of module that owns 18 * the kernel socket in case userspace opens 19 * socket of same protocol 20 * - remove all module support, since netlink is 21 * mandatory if CONFIG_NET=y these days 22 */ 23 24 #include <linux/module.h> 25 26 #include <linux/capability.h> 27 #include <linux/kernel.h> 28 #include <linux/init.h> 29 #include <linux/signal.h> 30 #include <linux/sched.h> 31 #include <linux/errno.h> 32 #include <linux/string.h> 33 #include <linux/stat.h> 34 #include <linux/socket.h> 35 #include <linux/un.h> 36 #include <linux/fcntl.h> 37 #include <linux/termios.h> 38 #include <linux/sockios.h> 39 #include <linux/net.h> 40 #include <linux/fs.h> 41 #include <linux/slab.h> 42 #include <asm/uaccess.h> 43 #include <linux/skbuff.h> 44 #include <linux/netdevice.h> 45 #include <linux/rtnetlink.h> 46 #include <linux/proc_fs.h> 47 #include <linux/seq_file.h> 48 #include <linux/notifier.h> 49 #include <linux/security.h> 50 #include <linux/jhash.h> 51 #include <linux/jiffies.h> 52 #include <linux/random.h> 53 #include <linux/bitops.h> 54 #include <linux/mm.h> 55 #include <linux/types.h> 56 #include <linux/audit.h> 57 #include <linux/mutex.h> 58 59 #include <net/net_namespace.h> 60 #include <net/sock.h> 61 #include <net/scm.h> 62 #include <net/netlink.h> 63 64 #define NLGRPSZ(x) (ALIGN(x, sizeof(unsigned long) * 8) / 8) 65 #define NLGRPLONGS(x) (NLGRPSZ(x)/sizeof(unsigned long)) 66 67 struct netlink_sock { 68 /* struct sock has to be the first member of netlink_sock */ 69 struct sock sk; 70 u32 pid; 71 u32 dst_pid; 72 u32 dst_group; 73 u32 flags; 74 u32 subscriptions; 75 u32 ngroups; 76 unsigned long *groups; 77 unsigned long state; 78 wait_queue_head_t wait; 79 struct netlink_callback *cb; 80 struct mutex *cb_mutex; 81 struct mutex cb_def_mutex; 82 void (*netlink_rcv)(struct sk_buff *skb); 83 struct module *module; 84 }; 85 86 struct listeners_rcu_head { 87 struct rcu_head rcu_head; 88 void *ptr; 89 }; 90 91 #define NETLINK_KERNEL_SOCKET 0x1 92 #define NETLINK_RECV_PKTINFO 0x2 93 #define NETLINK_BROADCAST_SEND_ERROR 0x4 94 #define NETLINK_RECV_NO_ENOBUFS 0x8 95 96 static inline struct netlink_sock *nlk_sk(struct sock *sk) 97 { 98 return container_of(sk, struct netlink_sock, sk); 99 } 100 101 static inline int netlink_is_kernel(struct sock *sk) 102 { 103 return nlk_sk(sk)->flags & NETLINK_KERNEL_SOCKET; 104 } 105 106 struct nl_pid_hash { 107 struct hlist_head *table; 108 unsigned long rehash_time; 109 110 unsigned int mask; 111 unsigned int shift; 112 113 unsigned int entries; 114 unsigned int max_shift; 115 116 u32 rnd; 117 }; 118 119 struct netlink_table { 120 struct nl_pid_hash hash; 121 struct hlist_head mc_list; 122 unsigned long *listeners; 123 unsigned int nl_nonroot; 124 unsigned int groups; 125 struct mutex *cb_mutex; 126 struct module *module; 127 int registered; 128 }; 129 130 static struct netlink_table *nl_table; 131 132 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); 133 134 static int netlink_dump(struct sock *sk); 135 static void netlink_destroy_callback(struct netlink_callback *cb); 136 137 static DEFINE_RWLOCK(nl_table_lock); 138 static atomic_t nl_table_users = ATOMIC_INIT(0); 139 140 static ATOMIC_NOTIFIER_HEAD(netlink_chain); 141 142 static u32 netlink_group_mask(u32 group) 143 { 144 return group ? 1 << (group - 1) : 0; 145 } 146 147 static struct hlist_head *nl_pid_hashfn(struct nl_pid_hash *hash, u32 pid) 148 { 149 return &hash->table[jhash_1word(pid, hash->rnd) & hash->mask]; 150 } 151 152 static void netlink_sock_destruct(struct sock *sk) 153 { 154 struct netlink_sock *nlk = nlk_sk(sk); 155 156 if (nlk->cb) { 157 if (nlk->cb->done) 158 nlk->cb->done(nlk->cb); 159 netlink_destroy_callback(nlk->cb); 160 } 161 162 skb_queue_purge(&sk->sk_receive_queue); 163 164 if (!sock_flag(sk, SOCK_DEAD)) { 165 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); 166 return; 167 } 168 169 WARN_ON(atomic_read(&sk->sk_rmem_alloc)); 170 WARN_ON(atomic_read(&sk->sk_wmem_alloc)); 171 WARN_ON(nlk_sk(sk)->groups); 172 } 173 174 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on 175 * SMP. Look, when several writers sleep and reader wakes them up, all but one 176 * immediately hit write lock and grab all the cpus. Exclusive sleep solves 177 * this, _but_ remember, it adds useless work on UP machines. 178 */ 179 180 void netlink_table_grab(void) 181 __acquires(nl_table_lock) 182 { 183 might_sleep(); 184 185 write_lock_irq(&nl_table_lock); 186 187 if (atomic_read(&nl_table_users)) { 188 DECLARE_WAITQUEUE(wait, current); 189 190 add_wait_queue_exclusive(&nl_table_wait, &wait); 191 for (;;) { 192 set_current_state(TASK_UNINTERRUPTIBLE); 193 if (atomic_read(&nl_table_users) == 0) 194 break; 195 write_unlock_irq(&nl_table_lock); 196 schedule(); 197 write_lock_irq(&nl_table_lock); 198 } 199 200 __set_current_state(TASK_RUNNING); 201 remove_wait_queue(&nl_table_wait, &wait); 202 } 203 } 204 205 void netlink_table_ungrab(void) 206 __releases(nl_table_lock) 207 { 208 write_unlock_irq(&nl_table_lock); 209 wake_up(&nl_table_wait); 210 } 211 212 static inline void 213 netlink_lock_table(void) 214 { 215 /* read_lock() synchronizes us to netlink_table_grab */ 216 217 read_lock(&nl_table_lock); 218 atomic_inc(&nl_table_users); 219 read_unlock(&nl_table_lock); 220 } 221 222 static inline void 223 netlink_unlock_table(void) 224 { 225 if (atomic_dec_and_test(&nl_table_users)) 226 wake_up(&nl_table_wait); 227 } 228 229 static inline struct sock *netlink_lookup(struct net *net, int protocol, 230 u32 pid) 231 { 232 struct nl_pid_hash *hash = &nl_table[protocol].hash; 233 struct hlist_head *head; 234 struct sock *sk; 235 struct hlist_node *node; 236 237 read_lock(&nl_table_lock); 238 head = nl_pid_hashfn(hash, pid); 239 sk_for_each(sk, node, head) { 240 if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->pid == pid)) { 241 sock_hold(sk); 242 goto found; 243 } 244 } 245 sk = NULL; 246 found: 247 read_unlock(&nl_table_lock); 248 return sk; 249 } 250 251 static inline struct hlist_head *nl_pid_hash_zalloc(size_t size) 252 { 253 if (size <= PAGE_SIZE) 254 return kzalloc(size, GFP_ATOMIC); 255 else 256 return (struct hlist_head *) 257 __get_free_pages(GFP_ATOMIC | __GFP_ZERO, 258 get_order(size)); 259 } 260 261 static inline void nl_pid_hash_free(struct hlist_head *table, size_t size) 262 { 263 if (size <= PAGE_SIZE) 264 kfree(table); 265 else 266 free_pages((unsigned long)table, get_order(size)); 267 } 268 269 static int nl_pid_hash_rehash(struct nl_pid_hash *hash, int grow) 270 { 271 unsigned int omask, mask, shift; 272 size_t osize, size; 273 struct hlist_head *otable, *table; 274 int i; 275 276 omask = mask = hash->mask; 277 osize = size = (mask + 1) * sizeof(*table); 278 shift = hash->shift; 279 280 if (grow) { 281 if (++shift > hash->max_shift) 282 return 0; 283 mask = mask * 2 + 1; 284 size *= 2; 285 } 286 287 table = nl_pid_hash_zalloc(size); 288 if (!table) 289 return 0; 290 291 otable = hash->table; 292 hash->table = table; 293 hash->mask = mask; 294 hash->shift = shift; 295 get_random_bytes(&hash->rnd, sizeof(hash->rnd)); 296 297 for (i = 0; i <= omask; i++) { 298 struct sock *sk; 299 struct hlist_node *node, *tmp; 300 301 sk_for_each_safe(sk, node, tmp, &otable[i]) 302 __sk_add_node(sk, nl_pid_hashfn(hash, nlk_sk(sk)->pid)); 303 } 304 305 nl_pid_hash_free(otable, osize); 306 hash->rehash_time = jiffies + 10 * 60 * HZ; 307 return 1; 308 } 309 310 static inline int nl_pid_hash_dilute(struct nl_pid_hash *hash, int len) 311 { 312 int avg = hash->entries >> hash->shift; 313 314 if (unlikely(avg > 1) && nl_pid_hash_rehash(hash, 1)) 315 return 1; 316 317 if (unlikely(len > avg) && time_after(jiffies, hash->rehash_time)) { 318 nl_pid_hash_rehash(hash, 0); 319 return 1; 320 } 321 322 return 0; 323 } 324 325 static const struct proto_ops netlink_ops; 326 327 static void 328 netlink_update_listeners(struct sock *sk) 329 { 330 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 331 struct hlist_node *node; 332 unsigned long mask; 333 unsigned int i; 334 335 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) { 336 mask = 0; 337 sk_for_each_bound(sk, node, &tbl->mc_list) { 338 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups)) 339 mask |= nlk_sk(sk)->groups[i]; 340 } 341 tbl->listeners[i] = mask; 342 } 343 /* this function is only called with the netlink table "grabbed", which 344 * makes sure updates are visible before bind or setsockopt return. */ 345 } 346 347 static int netlink_insert(struct sock *sk, struct net *net, u32 pid) 348 { 349 struct nl_pid_hash *hash = &nl_table[sk->sk_protocol].hash; 350 struct hlist_head *head; 351 int err = -EADDRINUSE; 352 struct sock *osk; 353 struct hlist_node *node; 354 int len; 355 356 netlink_table_grab(); 357 head = nl_pid_hashfn(hash, pid); 358 len = 0; 359 sk_for_each(osk, node, head) { 360 if (net_eq(sock_net(osk), net) && (nlk_sk(osk)->pid == pid)) 361 break; 362 len++; 363 } 364 if (node) 365 goto err; 366 367 err = -EBUSY; 368 if (nlk_sk(sk)->pid) 369 goto err; 370 371 err = -ENOMEM; 372 if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX)) 373 goto err; 374 375 if (len && nl_pid_hash_dilute(hash, len)) 376 head = nl_pid_hashfn(hash, pid); 377 hash->entries++; 378 nlk_sk(sk)->pid = pid; 379 sk_add_node(sk, head); 380 err = 0; 381 382 err: 383 netlink_table_ungrab(); 384 return err; 385 } 386 387 static void netlink_remove(struct sock *sk) 388 { 389 netlink_table_grab(); 390 if (sk_del_node_init(sk)) 391 nl_table[sk->sk_protocol].hash.entries--; 392 if (nlk_sk(sk)->subscriptions) 393 __sk_del_bind_node(sk); 394 netlink_table_ungrab(); 395 } 396 397 static struct proto netlink_proto = { 398 .name = "NETLINK", 399 .owner = THIS_MODULE, 400 .obj_size = sizeof(struct netlink_sock), 401 }; 402 403 static int __netlink_create(struct net *net, struct socket *sock, 404 struct mutex *cb_mutex, int protocol) 405 { 406 struct sock *sk; 407 struct netlink_sock *nlk; 408 409 sock->ops = &netlink_ops; 410 411 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto); 412 if (!sk) 413 return -ENOMEM; 414 415 sock_init_data(sock, sk); 416 417 nlk = nlk_sk(sk); 418 if (cb_mutex) 419 nlk->cb_mutex = cb_mutex; 420 else { 421 nlk->cb_mutex = &nlk->cb_def_mutex; 422 mutex_init(nlk->cb_mutex); 423 } 424 init_waitqueue_head(&nlk->wait); 425 426 sk->sk_destruct = netlink_sock_destruct; 427 sk->sk_protocol = protocol; 428 return 0; 429 } 430 431 static int netlink_create(struct net *net, struct socket *sock, int protocol, 432 int kern) 433 { 434 struct module *module = NULL; 435 struct mutex *cb_mutex; 436 struct netlink_sock *nlk; 437 int err = 0; 438 439 sock->state = SS_UNCONNECTED; 440 441 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) 442 return -ESOCKTNOSUPPORT; 443 444 if (protocol < 0 || protocol >= MAX_LINKS) 445 return -EPROTONOSUPPORT; 446 447 netlink_lock_table(); 448 #ifdef CONFIG_MODULES 449 if (!nl_table[protocol].registered) { 450 netlink_unlock_table(); 451 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol); 452 netlink_lock_table(); 453 } 454 #endif 455 if (nl_table[protocol].registered && 456 try_module_get(nl_table[protocol].module)) 457 module = nl_table[protocol].module; 458 cb_mutex = nl_table[protocol].cb_mutex; 459 netlink_unlock_table(); 460 461 err = __netlink_create(net, sock, cb_mutex, protocol); 462 if (err < 0) 463 goto out_module; 464 465 local_bh_disable(); 466 sock_prot_inuse_add(net, &netlink_proto, 1); 467 local_bh_enable(); 468 469 nlk = nlk_sk(sock->sk); 470 nlk->module = module; 471 out: 472 return err; 473 474 out_module: 475 module_put(module); 476 goto out; 477 } 478 479 static int netlink_release(struct socket *sock) 480 { 481 struct sock *sk = sock->sk; 482 struct netlink_sock *nlk; 483 484 if (!sk) 485 return 0; 486 487 netlink_remove(sk); 488 sock_orphan(sk); 489 nlk = nlk_sk(sk); 490 491 /* 492 * OK. Socket is unlinked, any packets that arrive now 493 * will be purged. 494 */ 495 496 sock->sk = NULL; 497 wake_up_interruptible_all(&nlk->wait); 498 499 skb_queue_purge(&sk->sk_write_queue); 500 501 if (nlk->pid) { 502 struct netlink_notify n = { 503 .net = sock_net(sk), 504 .protocol = sk->sk_protocol, 505 .pid = nlk->pid, 506 }; 507 atomic_notifier_call_chain(&netlink_chain, 508 NETLINK_URELEASE, &n); 509 } 510 511 module_put(nlk->module); 512 513 netlink_table_grab(); 514 if (netlink_is_kernel(sk)) { 515 BUG_ON(nl_table[sk->sk_protocol].registered == 0); 516 if (--nl_table[sk->sk_protocol].registered == 0) { 517 kfree(nl_table[sk->sk_protocol].listeners); 518 nl_table[sk->sk_protocol].module = NULL; 519 nl_table[sk->sk_protocol].registered = 0; 520 } 521 } else if (nlk->subscriptions) 522 netlink_update_listeners(sk); 523 netlink_table_ungrab(); 524 525 kfree(nlk->groups); 526 nlk->groups = NULL; 527 528 local_bh_disable(); 529 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1); 530 local_bh_enable(); 531 sock_put(sk); 532 return 0; 533 } 534 535 static int netlink_autobind(struct socket *sock) 536 { 537 struct sock *sk = sock->sk; 538 struct net *net = sock_net(sk); 539 struct nl_pid_hash *hash = &nl_table[sk->sk_protocol].hash; 540 struct hlist_head *head; 541 struct sock *osk; 542 struct hlist_node *node; 543 s32 pid = current->tgid; 544 int err; 545 static s32 rover = -4097; 546 547 retry: 548 cond_resched(); 549 netlink_table_grab(); 550 head = nl_pid_hashfn(hash, pid); 551 sk_for_each(osk, node, head) { 552 if (!net_eq(sock_net(osk), net)) 553 continue; 554 if (nlk_sk(osk)->pid == pid) { 555 /* Bind collision, search negative pid values. */ 556 pid = rover--; 557 if (rover > -4097) 558 rover = -4097; 559 netlink_table_ungrab(); 560 goto retry; 561 } 562 } 563 netlink_table_ungrab(); 564 565 err = netlink_insert(sk, net, pid); 566 if (err == -EADDRINUSE) 567 goto retry; 568 569 /* If 2 threads race to autobind, that is fine. */ 570 if (err == -EBUSY) 571 err = 0; 572 573 return err; 574 } 575 576 static inline int netlink_capable(struct socket *sock, unsigned int flag) 577 { 578 return (nl_table[sock->sk->sk_protocol].nl_nonroot & flag) || 579 capable(CAP_NET_ADMIN); 580 } 581 582 static void 583 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions) 584 { 585 struct netlink_sock *nlk = nlk_sk(sk); 586 587 if (nlk->subscriptions && !subscriptions) 588 __sk_del_bind_node(sk); 589 else if (!nlk->subscriptions && subscriptions) 590 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list); 591 nlk->subscriptions = subscriptions; 592 } 593 594 static int netlink_realloc_groups(struct sock *sk) 595 { 596 struct netlink_sock *nlk = nlk_sk(sk); 597 unsigned int groups; 598 unsigned long *new_groups; 599 int err = 0; 600 601 netlink_table_grab(); 602 603 groups = nl_table[sk->sk_protocol].groups; 604 if (!nl_table[sk->sk_protocol].registered) { 605 err = -ENOENT; 606 goto out_unlock; 607 } 608 609 if (nlk->ngroups >= groups) 610 goto out_unlock; 611 612 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC); 613 if (new_groups == NULL) { 614 err = -ENOMEM; 615 goto out_unlock; 616 } 617 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0, 618 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups)); 619 620 nlk->groups = new_groups; 621 nlk->ngroups = groups; 622 out_unlock: 623 netlink_table_ungrab(); 624 return err; 625 } 626 627 static int netlink_bind(struct socket *sock, struct sockaddr *addr, 628 int addr_len) 629 { 630 struct sock *sk = sock->sk; 631 struct net *net = sock_net(sk); 632 struct netlink_sock *nlk = nlk_sk(sk); 633 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 634 int err; 635 636 if (nladdr->nl_family != AF_NETLINK) 637 return -EINVAL; 638 639 /* Only superuser is allowed to listen multicasts */ 640 if (nladdr->nl_groups) { 641 if (!netlink_capable(sock, NL_NONROOT_RECV)) 642 return -EPERM; 643 err = netlink_realloc_groups(sk); 644 if (err) 645 return err; 646 } 647 648 if (nlk->pid) { 649 if (nladdr->nl_pid != nlk->pid) 650 return -EINVAL; 651 } else { 652 err = nladdr->nl_pid ? 653 netlink_insert(sk, net, nladdr->nl_pid) : 654 netlink_autobind(sock); 655 if (err) 656 return err; 657 } 658 659 if (!nladdr->nl_groups && (nlk->groups == NULL || !(u32)nlk->groups[0])) 660 return 0; 661 662 netlink_table_grab(); 663 netlink_update_subscriptions(sk, nlk->subscriptions + 664 hweight32(nladdr->nl_groups) - 665 hweight32(nlk->groups[0])); 666 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | nladdr->nl_groups; 667 netlink_update_listeners(sk); 668 netlink_table_ungrab(); 669 670 return 0; 671 } 672 673 static int netlink_connect(struct socket *sock, struct sockaddr *addr, 674 int alen, int flags) 675 { 676 int err = 0; 677 struct sock *sk = sock->sk; 678 struct netlink_sock *nlk = nlk_sk(sk); 679 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 680 681 if (addr->sa_family == AF_UNSPEC) { 682 sk->sk_state = NETLINK_UNCONNECTED; 683 nlk->dst_pid = 0; 684 nlk->dst_group = 0; 685 return 0; 686 } 687 if (addr->sa_family != AF_NETLINK) 688 return -EINVAL; 689 690 /* Only superuser is allowed to send multicasts */ 691 if (nladdr->nl_groups && !netlink_capable(sock, NL_NONROOT_SEND)) 692 return -EPERM; 693 694 if (!nlk->pid) 695 err = netlink_autobind(sock); 696 697 if (err == 0) { 698 sk->sk_state = NETLINK_CONNECTED; 699 nlk->dst_pid = nladdr->nl_pid; 700 nlk->dst_group = ffs(nladdr->nl_groups); 701 } 702 703 return err; 704 } 705 706 static int netlink_getname(struct socket *sock, struct sockaddr *addr, 707 int *addr_len, int peer) 708 { 709 struct sock *sk = sock->sk; 710 struct netlink_sock *nlk = nlk_sk(sk); 711 DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr); 712 713 nladdr->nl_family = AF_NETLINK; 714 nladdr->nl_pad = 0; 715 *addr_len = sizeof(*nladdr); 716 717 if (peer) { 718 nladdr->nl_pid = nlk->dst_pid; 719 nladdr->nl_groups = netlink_group_mask(nlk->dst_group); 720 } else { 721 nladdr->nl_pid = nlk->pid; 722 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0; 723 } 724 return 0; 725 } 726 727 static void netlink_overrun(struct sock *sk) 728 { 729 struct netlink_sock *nlk = nlk_sk(sk); 730 731 if (!(nlk->flags & NETLINK_RECV_NO_ENOBUFS)) { 732 if (!test_and_set_bit(0, &nlk_sk(sk)->state)) { 733 sk->sk_err = ENOBUFS; 734 sk->sk_error_report(sk); 735 } 736 } 737 atomic_inc(&sk->sk_drops); 738 } 739 740 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid) 741 { 742 struct sock *sock; 743 struct netlink_sock *nlk; 744 745 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, pid); 746 if (!sock) 747 return ERR_PTR(-ECONNREFUSED); 748 749 /* Don't bother queuing skb if kernel socket has no input function */ 750 nlk = nlk_sk(sock); 751 if (sock->sk_state == NETLINK_CONNECTED && 752 nlk->dst_pid != nlk_sk(ssk)->pid) { 753 sock_put(sock); 754 return ERR_PTR(-ECONNREFUSED); 755 } 756 return sock; 757 } 758 759 struct sock *netlink_getsockbyfilp(struct file *filp) 760 { 761 struct inode *inode = filp->f_path.dentry->d_inode; 762 struct sock *sock; 763 764 if (!S_ISSOCK(inode->i_mode)) 765 return ERR_PTR(-ENOTSOCK); 766 767 sock = SOCKET_I(inode)->sk; 768 if (sock->sk_family != AF_NETLINK) 769 return ERR_PTR(-EINVAL); 770 771 sock_hold(sock); 772 return sock; 773 } 774 775 /* 776 * Attach a skb to a netlink socket. 777 * The caller must hold a reference to the destination socket. On error, the 778 * reference is dropped. The skb is not send to the destination, just all 779 * all error checks are performed and memory in the queue is reserved. 780 * Return values: 781 * < 0: error. skb freed, reference to sock dropped. 782 * 0: continue 783 * 1: repeat lookup - reference dropped while waiting for socket memory. 784 */ 785 int netlink_attachskb(struct sock *sk, struct sk_buff *skb, 786 long *timeo, struct sock *ssk) 787 { 788 struct netlink_sock *nlk; 789 790 nlk = nlk_sk(sk); 791 792 if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 793 test_bit(0, &nlk->state)) { 794 DECLARE_WAITQUEUE(wait, current); 795 if (!*timeo) { 796 if (!ssk || netlink_is_kernel(ssk)) 797 netlink_overrun(sk); 798 sock_put(sk); 799 kfree_skb(skb); 800 return -EAGAIN; 801 } 802 803 __set_current_state(TASK_INTERRUPTIBLE); 804 add_wait_queue(&nlk->wait, &wait); 805 806 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 807 test_bit(0, &nlk->state)) && 808 !sock_flag(sk, SOCK_DEAD)) 809 *timeo = schedule_timeout(*timeo); 810 811 __set_current_state(TASK_RUNNING); 812 remove_wait_queue(&nlk->wait, &wait); 813 sock_put(sk); 814 815 if (signal_pending(current)) { 816 kfree_skb(skb); 817 return sock_intr_errno(*timeo); 818 } 819 return 1; 820 } 821 skb_set_owner_r(skb, sk); 822 return 0; 823 } 824 825 int netlink_sendskb(struct sock *sk, struct sk_buff *skb) 826 { 827 int len = skb->len; 828 829 skb_queue_tail(&sk->sk_receive_queue, skb); 830 sk->sk_data_ready(sk, len); 831 sock_put(sk); 832 return len; 833 } 834 835 void netlink_detachskb(struct sock *sk, struct sk_buff *skb) 836 { 837 kfree_skb(skb); 838 sock_put(sk); 839 } 840 841 static inline struct sk_buff *netlink_trim(struct sk_buff *skb, 842 gfp_t allocation) 843 { 844 int delta; 845 846 skb_orphan(skb); 847 848 delta = skb->end - skb->tail; 849 if (delta * 2 < skb->truesize) 850 return skb; 851 852 if (skb_shared(skb)) { 853 struct sk_buff *nskb = skb_clone(skb, allocation); 854 if (!nskb) 855 return skb; 856 kfree_skb(skb); 857 skb = nskb; 858 } 859 860 if (!pskb_expand_head(skb, 0, -delta, allocation)) 861 skb->truesize -= delta; 862 863 return skb; 864 } 865 866 static inline void netlink_rcv_wake(struct sock *sk) 867 { 868 struct netlink_sock *nlk = nlk_sk(sk); 869 870 if (skb_queue_empty(&sk->sk_receive_queue)) 871 clear_bit(0, &nlk->state); 872 if (!test_bit(0, &nlk->state)) 873 wake_up_interruptible(&nlk->wait); 874 } 875 876 static inline int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb) 877 { 878 int ret; 879 struct netlink_sock *nlk = nlk_sk(sk); 880 881 ret = -ECONNREFUSED; 882 if (nlk->netlink_rcv != NULL) { 883 ret = skb->len; 884 skb_set_owner_r(skb, sk); 885 nlk->netlink_rcv(skb); 886 } 887 kfree_skb(skb); 888 sock_put(sk); 889 return ret; 890 } 891 892 int netlink_unicast(struct sock *ssk, struct sk_buff *skb, 893 u32 pid, int nonblock) 894 { 895 struct sock *sk; 896 int err; 897 long timeo; 898 899 skb = netlink_trim(skb, gfp_any()); 900 901 timeo = sock_sndtimeo(ssk, nonblock); 902 retry: 903 sk = netlink_getsockbypid(ssk, pid); 904 if (IS_ERR(sk)) { 905 kfree_skb(skb); 906 return PTR_ERR(sk); 907 } 908 if (netlink_is_kernel(sk)) 909 return netlink_unicast_kernel(sk, skb); 910 911 if (sk_filter(sk, skb)) { 912 err = skb->len; 913 kfree_skb(skb); 914 sock_put(sk); 915 return err; 916 } 917 918 err = netlink_attachskb(sk, skb, &timeo, ssk); 919 if (err == 1) 920 goto retry; 921 if (err) 922 return err; 923 924 return netlink_sendskb(sk, skb); 925 } 926 EXPORT_SYMBOL(netlink_unicast); 927 928 int netlink_has_listeners(struct sock *sk, unsigned int group) 929 { 930 int res = 0; 931 unsigned long *listeners; 932 933 BUG_ON(!netlink_is_kernel(sk)); 934 935 rcu_read_lock(); 936 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners); 937 938 if (group - 1 < nl_table[sk->sk_protocol].groups) 939 res = test_bit(group - 1, listeners); 940 941 rcu_read_unlock(); 942 943 return res; 944 } 945 EXPORT_SYMBOL_GPL(netlink_has_listeners); 946 947 static inline int netlink_broadcast_deliver(struct sock *sk, 948 struct sk_buff *skb) 949 { 950 struct netlink_sock *nlk = nlk_sk(sk); 951 952 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && 953 !test_bit(0, &nlk->state)) { 954 skb_set_owner_r(skb, sk); 955 skb_queue_tail(&sk->sk_receive_queue, skb); 956 sk->sk_data_ready(sk, skb->len); 957 return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf; 958 } 959 return -1; 960 } 961 962 struct netlink_broadcast_data { 963 struct sock *exclude_sk; 964 struct net *net; 965 u32 pid; 966 u32 group; 967 int failure; 968 int delivery_failure; 969 int congested; 970 int delivered; 971 gfp_t allocation; 972 struct sk_buff *skb, *skb2; 973 }; 974 975 static inline int do_one_broadcast(struct sock *sk, 976 struct netlink_broadcast_data *p) 977 { 978 struct netlink_sock *nlk = nlk_sk(sk); 979 int val; 980 981 if (p->exclude_sk == sk) 982 goto out; 983 984 if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups || 985 !test_bit(p->group - 1, nlk->groups)) 986 goto out; 987 988 if (!net_eq(sock_net(sk), p->net)) 989 goto out; 990 991 if (p->failure) { 992 netlink_overrun(sk); 993 goto out; 994 } 995 996 sock_hold(sk); 997 if (p->skb2 == NULL) { 998 if (skb_shared(p->skb)) { 999 p->skb2 = skb_clone(p->skb, p->allocation); 1000 } else { 1001 p->skb2 = skb_get(p->skb); 1002 /* 1003 * skb ownership may have been set when 1004 * delivered to a previous socket. 1005 */ 1006 skb_orphan(p->skb2); 1007 } 1008 } 1009 if (p->skb2 == NULL) { 1010 netlink_overrun(sk); 1011 /* Clone failed. Notify ALL listeners. */ 1012 p->failure = 1; 1013 if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) 1014 p->delivery_failure = 1; 1015 } else if (sk_filter(sk, p->skb2)) { 1016 kfree_skb(p->skb2); 1017 p->skb2 = NULL; 1018 } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) { 1019 netlink_overrun(sk); 1020 if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) 1021 p->delivery_failure = 1; 1022 } else { 1023 p->congested |= val; 1024 p->delivered = 1; 1025 p->skb2 = NULL; 1026 } 1027 sock_put(sk); 1028 1029 out: 1030 return 0; 1031 } 1032 1033 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid, 1034 u32 group, gfp_t allocation) 1035 { 1036 struct net *net = sock_net(ssk); 1037 struct netlink_broadcast_data info; 1038 struct hlist_node *node; 1039 struct sock *sk; 1040 1041 skb = netlink_trim(skb, allocation); 1042 1043 info.exclude_sk = ssk; 1044 info.net = net; 1045 info.pid = pid; 1046 info.group = group; 1047 info.failure = 0; 1048 info.delivery_failure = 0; 1049 info.congested = 0; 1050 info.delivered = 0; 1051 info.allocation = allocation; 1052 info.skb = skb; 1053 info.skb2 = NULL; 1054 1055 /* While we sleep in clone, do not allow to change socket list */ 1056 1057 netlink_lock_table(); 1058 1059 sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list) 1060 do_one_broadcast(sk, &info); 1061 1062 kfree_skb(skb); 1063 1064 netlink_unlock_table(); 1065 1066 kfree_skb(info.skb2); 1067 1068 if (info.delivery_failure) 1069 return -ENOBUFS; 1070 1071 if (info.delivered) { 1072 if (info.congested && (allocation & __GFP_WAIT)) 1073 yield(); 1074 return 0; 1075 } 1076 return -ESRCH; 1077 } 1078 EXPORT_SYMBOL(netlink_broadcast); 1079 1080 struct netlink_set_err_data { 1081 struct sock *exclude_sk; 1082 u32 pid; 1083 u32 group; 1084 int code; 1085 }; 1086 1087 static inline int do_one_set_err(struct sock *sk, 1088 struct netlink_set_err_data *p) 1089 { 1090 struct netlink_sock *nlk = nlk_sk(sk); 1091 1092 if (sk == p->exclude_sk) 1093 goto out; 1094 1095 if (!net_eq(sock_net(sk), sock_net(p->exclude_sk))) 1096 goto out; 1097 1098 if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups || 1099 !test_bit(p->group - 1, nlk->groups)) 1100 goto out; 1101 1102 sk->sk_err = p->code; 1103 sk->sk_error_report(sk); 1104 out: 1105 return 0; 1106 } 1107 1108 /** 1109 * netlink_set_err - report error to broadcast listeners 1110 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create() 1111 * @pid: the PID of a process that we want to skip (if any) 1112 * @groups: the broadcast group that will notice the error 1113 * @code: error code, must be negative (as usual in kernelspace) 1114 */ 1115 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code) 1116 { 1117 struct netlink_set_err_data info; 1118 struct hlist_node *node; 1119 struct sock *sk; 1120 1121 info.exclude_sk = ssk; 1122 info.pid = pid; 1123 info.group = group; 1124 /* sk->sk_err wants a positive error value */ 1125 info.code = -code; 1126 1127 read_lock(&nl_table_lock); 1128 1129 sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list) 1130 do_one_set_err(sk, &info); 1131 1132 read_unlock(&nl_table_lock); 1133 } 1134 EXPORT_SYMBOL(netlink_set_err); 1135 1136 /* must be called with netlink table grabbed */ 1137 static void netlink_update_socket_mc(struct netlink_sock *nlk, 1138 unsigned int group, 1139 int is_new) 1140 { 1141 int old, new = !!is_new, subscriptions; 1142 1143 old = test_bit(group - 1, nlk->groups); 1144 subscriptions = nlk->subscriptions - old + new; 1145 if (new) 1146 __set_bit(group - 1, nlk->groups); 1147 else 1148 __clear_bit(group - 1, nlk->groups); 1149 netlink_update_subscriptions(&nlk->sk, subscriptions); 1150 netlink_update_listeners(&nlk->sk); 1151 } 1152 1153 static int netlink_setsockopt(struct socket *sock, int level, int optname, 1154 char __user *optval, unsigned int optlen) 1155 { 1156 struct sock *sk = sock->sk; 1157 struct netlink_sock *nlk = nlk_sk(sk); 1158 unsigned int val = 0; 1159 int err; 1160 1161 if (level != SOL_NETLINK) 1162 return -ENOPROTOOPT; 1163 1164 if (optlen >= sizeof(int) && 1165 get_user(val, (unsigned int __user *)optval)) 1166 return -EFAULT; 1167 1168 switch (optname) { 1169 case NETLINK_PKTINFO: 1170 if (val) 1171 nlk->flags |= NETLINK_RECV_PKTINFO; 1172 else 1173 nlk->flags &= ~NETLINK_RECV_PKTINFO; 1174 err = 0; 1175 break; 1176 case NETLINK_ADD_MEMBERSHIP: 1177 case NETLINK_DROP_MEMBERSHIP: { 1178 if (!netlink_capable(sock, NL_NONROOT_RECV)) 1179 return -EPERM; 1180 err = netlink_realloc_groups(sk); 1181 if (err) 1182 return err; 1183 if (!val || val - 1 >= nlk->ngroups) 1184 return -EINVAL; 1185 netlink_table_grab(); 1186 netlink_update_socket_mc(nlk, val, 1187 optname == NETLINK_ADD_MEMBERSHIP); 1188 netlink_table_ungrab(); 1189 err = 0; 1190 break; 1191 } 1192 case NETLINK_BROADCAST_ERROR: 1193 if (val) 1194 nlk->flags |= NETLINK_BROADCAST_SEND_ERROR; 1195 else 1196 nlk->flags &= ~NETLINK_BROADCAST_SEND_ERROR; 1197 err = 0; 1198 break; 1199 case NETLINK_NO_ENOBUFS: 1200 if (val) { 1201 nlk->flags |= NETLINK_RECV_NO_ENOBUFS; 1202 clear_bit(0, &nlk->state); 1203 wake_up_interruptible(&nlk->wait); 1204 } else 1205 nlk->flags &= ~NETLINK_RECV_NO_ENOBUFS; 1206 err = 0; 1207 break; 1208 default: 1209 err = -ENOPROTOOPT; 1210 } 1211 return err; 1212 } 1213 1214 static int netlink_getsockopt(struct socket *sock, int level, int optname, 1215 char __user *optval, int __user *optlen) 1216 { 1217 struct sock *sk = sock->sk; 1218 struct netlink_sock *nlk = nlk_sk(sk); 1219 int len, val, err; 1220 1221 if (level != SOL_NETLINK) 1222 return -ENOPROTOOPT; 1223 1224 if (get_user(len, optlen)) 1225 return -EFAULT; 1226 if (len < 0) 1227 return -EINVAL; 1228 1229 switch (optname) { 1230 case NETLINK_PKTINFO: 1231 if (len < sizeof(int)) 1232 return -EINVAL; 1233 len = sizeof(int); 1234 val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0; 1235 if (put_user(len, optlen) || 1236 put_user(val, optval)) 1237 return -EFAULT; 1238 err = 0; 1239 break; 1240 case NETLINK_BROADCAST_ERROR: 1241 if (len < sizeof(int)) 1242 return -EINVAL; 1243 len = sizeof(int); 1244 val = nlk->flags & NETLINK_BROADCAST_SEND_ERROR ? 1 : 0; 1245 if (put_user(len, optlen) || 1246 put_user(val, optval)) 1247 return -EFAULT; 1248 err = 0; 1249 break; 1250 case NETLINK_NO_ENOBUFS: 1251 if (len < sizeof(int)) 1252 return -EINVAL; 1253 len = sizeof(int); 1254 val = nlk->flags & NETLINK_RECV_NO_ENOBUFS ? 1 : 0; 1255 if (put_user(len, optlen) || 1256 put_user(val, optval)) 1257 return -EFAULT; 1258 err = 0; 1259 break; 1260 default: 1261 err = -ENOPROTOOPT; 1262 } 1263 return err; 1264 } 1265 1266 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) 1267 { 1268 struct nl_pktinfo info; 1269 1270 info.group = NETLINK_CB(skb).dst_group; 1271 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info); 1272 } 1273 1274 static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, 1275 struct msghdr *msg, size_t len) 1276 { 1277 struct sock_iocb *siocb = kiocb_to_siocb(kiocb); 1278 struct sock *sk = sock->sk; 1279 struct netlink_sock *nlk = nlk_sk(sk); 1280 struct sockaddr_nl *addr = msg->msg_name; 1281 u32 dst_pid; 1282 u32 dst_group; 1283 struct sk_buff *skb; 1284 int err; 1285 struct scm_cookie scm; 1286 1287 if (msg->msg_flags&MSG_OOB) 1288 return -EOPNOTSUPP; 1289 1290 if (NULL == siocb->scm) 1291 siocb->scm = &scm; 1292 err = scm_send(sock, msg, siocb->scm); 1293 if (err < 0) 1294 return err; 1295 1296 if (msg->msg_namelen) { 1297 if (addr->nl_family != AF_NETLINK) 1298 return -EINVAL; 1299 dst_pid = addr->nl_pid; 1300 dst_group = ffs(addr->nl_groups); 1301 if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND)) 1302 return -EPERM; 1303 } else { 1304 dst_pid = nlk->dst_pid; 1305 dst_group = nlk->dst_group; 1306 } 1307 1308 if (!nlk->pid) { 1309 err = netlink_autobind(sock); 1310 if (err) 1311 goto out; 1312 } 1313 1314 err = -EMSGSIZE; 1315 if (len > sk->sk_sndbuf - 32) 1316 goto out; 1317 err = -ENOBUFS; 1318 skb = alloc_skb(len, GFP_KERNEL); 1319 if (skb == NULL) 1320 goto out; 1321 1322 NETLINK_CB(skb).pid = nlk->pid; 1323 NETLINK_CB(skb).dst_group = dst_group; 1324 NETLINK_CB(skb).loginuid = audit_get_loginuid(current); 1325 NETLINK_CB(skb).sessionid = audit_get_sessionid(current); 1326 security_task_getsecid(current, &(NETLINK_CB(skb).sid)); 1327 memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); 1328 1329 /* What can I do? Netlink is asynchronous, so that 1330 we will have to save current capabilities to 1331 check them, when this message will be delivered 1332 to corresponding kernel module. --ANK (980802) 1333 */ 1334 1335 err = -EFAULT; 1336 if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { 1337 kfree_skb(skb); 1338 goto out; 1339 } 1340 1341 err = security_netlink_send(sk, skb); 1342 if (err) { 1343 kfree_skb(skb); 1344 goto out; 1345 } 1346 1347 if (dst_group) { 1348 atomic_inc(&skb->users); 1349 netlink_broadcast(sk, skb, dst_pid, dst_group, GFP_KERNEL); 1350 } 1351 err = netlink_unicast(sk, skb, dst_pid, msg->msg_flags&MSG_DONTWAIT); 1352 1353 out: 1354 return err; 1355 } 1356 1357 static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, 1358 struct msghdr *msg, size_t len, 1359 int flags) 1360 { 1361 struct sock_iocb *siocb = kiocb_to_siocb(kiocb); 1362 struct scm_cookie scm; 1363 struct sock *sk = sock->sk; 1364 struct netlink_sock *nlk = nlk_sk(sk); 1365 int noblock = flags&MSG_DONTWAIT; 1366 size_t copied; 1367 struct sk_buff *skb, *frag __maybe_unused = NULL; 1368 int err; 1369 1370 if (flags&MSG_OOB) 1371 return -EOPNOTSUPP; 1372 1373 copied = 0; 1374 1375 skb = skb_recv_datagram(sk, flags, noblock, &err); 1376 if (skb == NULL) 1377 goto out; 1378 1379 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES 1380 if (unlikely(skb_shinfo(skb)->frag_list)) { 1381 bool need_compat = !!(flags & MSG_CMSG_COMPAT); 1382 1383 /* 1384 * If this skb has a frag_list, then here that means that 1385 * we will have to use the frag_list skb for compat tasks 1386 * and the regular skb for non-compat tasks. 1387 * 1388 * The skb might (and likely will) be cloned, so we can't 1389 * just reset frag_list and go on with things -- we need to 1390 * keep that. For the compat case that's easy -- simply get 1391 * a reference to the compat skb and free the regular one 1392 * including the frag. For the non-compat case, we need to 1393 * avoid sending the frag to the user -- so assign NULL but 1394 * restore it below before freeing the skb. 1395 */ 1396 if (need_compat) { 1397 struct sk_buff *compskb = skb_shinfo(skb)->frag_list; 1398 skb_get(compskb); 1399 kfree_skb(skb); 1400 skb = compskb; 1401 } else { 1402 frag = skb_shinfo(skb)->frag_list; 1403 skb_shinfo(skb)->frag_list = NULL; 1404 } 1405 } 1406 #endif 1407 1408 msg->msg_namelen = 0; 1409 1410 copied = skb->len; 1411 if (len < copied) { 1412 msg->msg_flags |= MSG_TRUNC; 1413 copied = len; 1414 } 1415 1416 skb_reset_transport_header(skb); 1417 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 1418 1419 if (msg->msg_name) { 1420 struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name; 1421 addr->nl_family = AF_NETLINK; 1422 addr->nl_pad = 0; 1423 addr->nl_pid = NETLINK_CB(skb).pid; 1424 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group); 1425 msg->msg_namelen = sizeof(*addr); 1426 } 1427 1428 if (nlk->flags & NETLINK_RECV_PKTINFO) 1429 netlink_cmsg_recv_pktinfo(msg, skb); 1430 1431 if (NULL == siocb->scm) { 1432 memset(&scm, 0, sizeof(scm)); 1433 siocb->scm = &scm; 1434 } 1435 siocb->scm->creds = *NETLINK_CREDS(skb); 1436 if (flags & MSG_TRUNC) 1437 copied = skb->len; 1438 1439 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES 1440 skb_shinfo(skb)->frag_list = frag; 1441 #endif 1442 1443 skb_free_datagram(sk, skb); 1444 1445 if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) 1446 netlink_dump(sk); 1447 1448 scm_recv(sock, msg, siocb->scm, flags); 1449 out: 1450 netlink_rcv_wake(sk); 1451 return err ? : copied; 1452 } 1453 1454 static void netlink_data_ready(struct sock *sk, int len) 1455 { 1456 BUG(); 1457 } 1458 1459 /* 1460 * We export these functions to other modules. They provide a 1461 * complete set of kernel non-blocking support for message 1462 * queueing. 1463 */ 1464 1465 struct sock * 1466 netlink_kernel_create(struct net *net, int unit, unsigned int groups, 1467 void (*input)(struct sk_buff *skb), 1468 struct mutex *cb_mutex, struct module *module) 1469 { 1470 struct socket *sock; 1471 struct sock *sk; 1472 struct netlink_sock *nlk; 1473 unsigned long *listeners = NULL; 1474 1475 BUG_ON(!nl_table); 1476 1477 if (unit < 0 || unit >= MAX_LINKS) 1478 return NULL; 1479 1480 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock)) 1481 return NULL; 1482 1483 /* 1484 * We have to just have a reference on the net from sk, but don't 1485 * get_net it. Besides, we cannot get and then put the net here. 1486 * So we create one inside init_net and the move it to net. 1487 */ 1488 1489 if (__netlink_create(&init_net, sock, cb_mutex, unit) < 0) 1490 goto out_sock_release_nosk; 1491 1492 sk = sock->sk; 1493 sk_change_net(sk, net); 1494 1495 if (groups < 32) 1496 groups = 32; 1497 1498 listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head), 1499 GFP_KERNEL); 1500 if (!listeners) 1501 goto out_sock_release; 1502 1503 sk->sk_data_ready = netlink_data_ready; 1504 if (input) 1505 nlk_sk(sk)->netlink_rcv = input; 1506 1507 if (netlink_insert(sk, net, 0)) 1508 goto out_sock_release; 1509 1510 nlk = nlk_sk(sk); 1511 nlk->flags |= NETLINK_KERNEL_SOCKET; 1512 1513 netlink_table_grab(); 1514 if (!nl_table[unit].registered) { 1515 nl_table[unit].groups = groups; 1516 nl_table[unit].listeners = listeners; 1517 nl_table[unit].cb_mutex = cb_mutex; 1518 nl_table[unit].module = module; 1519 nl_table[unit].registered = 1; 1520 } else { 1521 kfree(listeners); 1522 nl_table[unit].registered++; 1523 } 1524 netlink_table_ungrab(); 1525 return sk; 1526 1527 out_sock_release: 1528 kfree(listeners); 1529 netlink_kernel_release(sk); 1530 return NULL; 1531 1532 out_sock_release_nosk: 1533 sock_release(sock); 1534 return NULL; 1535 } 1536 EXPORT_SYMBOL(netlink_kernel_create); 1537 1538 1539 void 1540 netlink_kernel_release(struct sock *sk) 1541 { 1542 sk_release_kernel(sk); 1543 } 1544 EXPORT_SYMBOL(netlink_kernel_release); 1545 1546 1547 static void netlink_free_old_listeners(struct rcu_head *rcu_head) 1548 { 1549 struct listeners_rcu_head *lrh; 1550 1551 lrh = container_of(rcu_head, struct listeners_rcu_head, rcu_head); 1552 kfree(lrh->ptr); 1553 } 1554 1555 int __netlink_change_ngroups(struct sock *sk, unsigned int groups) 1556 { 1557 unsigned long *listeners, *old = NULL; 1558 struct listeners_rcu_head *old_rcu_head; 1559 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 1560 1561 if (groups < 32) 1562 groups = 32; 1563 1564 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) { 1565 listeners = kzalloc(NLGRPSZ(groups) + 1566 sizeof(struct listeners_rcu_head), 1567 GFP_ATOMIC); 1568 if (!listeners) 1569 return -ENOMEM; 1570 old = tbl->listeners; 1571 memcpy(listeners, old, NLGRPSZ(tbl->groups)); 1572 rcu_assign_pointer(tbl->listeners, listeners); 1573 /* 1574 * Free the old memory after an RCU grace period so we 1575 * don't leak it. We use call_rcu() here in order to be 1576 * able to call this function from atomic contexts. The 1577 * allocation of this memory will have reserved enough 1578 * space for struct listeners_rcu_head at the end. 1579 */ 1580 old_rcu_head = (void *)(tbl->listeners + 1581 NLGRPLONGS(tbl->groups)); 1582 old_rcu_head->ptr = old; 1583 call_rcu(&old_rcu_head->rcu_head, netlink_free_old_listeners); 1584 } 1585 tbl->groups = groups; 1586 1587 return 0; 1588 } 1589 1590 /** 1591 * netlink_change_ngroups - change number of multicast groups 1592 * 1593 * This changes the number of multicast groups that are available 1594 * on a certain netlink family. Note that it is not possible to 1595 * change the number of groups to below 32. Also note that it does 1596 * not implicitly call netlink_clear_multicast_users() when the 1597 * number of groups is reduced. 1598 * 1599 * @sk: The kernel netlink socket, as returned by netlink_kernel_create(). 1600 * @groups: The new number of groups. 1601 */ 1602 int netlink_change_ngroups(struct sock *sk, unsigned int groups) 1603 { 1604 int err; 1605 1606 netlink_table_grab(); 1607 err = __netlink_change_ngroups(sk, groups); 1608 netlink_table_ungrab(); 1609 1610 return err; 1611 } 1612 1613 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) 1614 { 1615 struct sock *sk; 1616 struct hlist_node *node; 1617 struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; 1618 1619 sk_for_each_bound(sk, node, &tbl->mc_list) 1620 netlink_update_socket_mc(nlk_sk(sk), group, 0); 1621 } 1622 1623 /** 1624 * netlink_clear_multicast_users - kick off multicast listeners 1625 * 1626 * This function removes all listeners from the given group. 1627 * @ksk: The kernel netlink socket, as returned by 1628 * netlink_kernel_create(). 1629 * @group: The multicast group to clear. 1630 */ 1631 void netlink_clear_multicast_users(struct sock *ksk, unsigned int group) 1632 { 1633 netlink_table_grab(); 1634 __netlink_clear_multicast_users(ksk, group); 1635 netlink_table_ungrab(); 1636 } 1637 1638 void netlink_set_nonroot(int protocol, unsigned int flags) 1639 { 1640 if ((unsigned int)protocol < MAX_LINKS) 1641 nl_table[protocol].nl_nonroot = flags; 1642 } 1643 EXPORT_SYMBOL(netlink_set_nonroot); 1644 1645 static void netlink_destroy_callback(struct netlink_callback *cb) 1646 { 1647 kfree_skb(cb->skb); 1648 kfree(cb); 1649 } 1650 1651 /* 1652 * It looks a bit ugly. 1653 * It would be better to create kernel thread. 1654 */ 1655 1656 static int netlink_dump(struct sock *sk) 1657 { 1658 struct netlink_sock *nlk = nlk_sk(sk); 1659 struct netlink_callback *cb; 1660 struct sk_buff *skb; 1661 struct nlmsghdr *nlh; 1662 int len, err = -ENOBUFS; 1663 1664 skb = sock_rmalloc(sk, NLMSG_GOODSIZE, 0, GFP_KERNEL); 1665 if (!skb) 1666 goto errout; 1667 1668 mutex_lock(nlk->cb_mutex); 1669 1670 cb = nlk->cb; 1671 if (cb == NULL) { 1672 err = -EINVAL; 1673 goto errout_skb; 1674 } 1675 1676 len = cb->dump(skb, cb); 1677 1678 if (len > 0) { 1679 mutex_unlock(nlk->cb_mutex); 1680 1681 if (sk_filter(sk, skb)) 1682 kfree_skb(skb); 1683 else { 1684 skb_queue_tail(&sk->sk_receive_queue, skb); 1685 sk->sk_data_ready(sk, skb->len); 1686 } 1687 return 0; 1688 } 1689 1690 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI); 1691 if (!nlh) 1692 goto errout_skb; 1693 1694 memcpy(nlmsg_data(nlh), &len, sizeof(len)); 1695 1696 if (sk_filter(sk, skb)) 1697 kfree_skb(skb); 1698 else { 1699 skb_queue_tail(&sk->sk_receive_queue, skb); 1700 sk->sk_data_ready(sk, skb->len); 1701 } 1702 1703 if (cb->done) 1704 cb->done(cb); 1705 nlk->cb = NULL; 1706 mutex_unlock(nlk->cb_mutex); 1707 1708 netlink_destroy_callback(cb); 1709 return 0; 1710 1711 errout_skb: 1712 mutex_unlock(nlk->cb_mutex); 1713 kfree_skb(skb); 1714 errout: 1715 return err; 1716 } 1717 1718 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb, 1719 const struct nlmsghdr *nlh, 1720 int (*dump)(struct sk_buff *skb, 1721 struct netlink_callback *), 1722 int (*done)(struct netlink_callback *)) 1723 { 1724 struct netlink_callback *cb; 1725 struct sock *sk; 1726 struct netlink_sock *nlk; 1727 1728 cb = kzalloc(sizeof(*cb), GFP_KERNEL); 1729 if (cb == NULL) 1730 return -ENOBUFS; 1731 1732 cb->dump = dump; 1733 cb->done = done; 1734 cb->nlh = nlh; 1735 atomic_inc(&skb->users); 1736 cb->skb = skb; 1737 1738 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).pid); 1739 if (sk == NULL) { 1740 netlink_destroy_callback(cb); 1741 return -ECONNREFUSED; 1742 } 1743 nlk = nlk_sk(sk); 1744 /* A dump is in progress... */ 1745 mutex_lock(nlk->cb_mutex); 1746 if (nlk->cb) { 1747 mutex_unlock(nlk->cb_mutex); 1748 netlink_destroy_callback(cb); 1749 sock_put(sk); 1750 return -EBUSY; 1751 } 1752 nlk->cb = cb; 1753 mutex_unlock(nlk->cb_mutex); 1754 1755 netlink_dump(sk); 1756 sock_put(sk); 1757 1758 /* We successfully started a dump, by returning -EINTR we 1759 * signal not to send ACK even if it was requested. 1760 */ 1761 return -EINTR; 1762 } 1763 EXPORT_SYMBOL(netlink_dump_start); 1764 1765 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err) 1766 { 1767 struct sk_buff *skb; 1768 struct nlmsghdr *rep; 1769 struct nlmsgerr *errmsg; 1770 size_t payload = sizeof(*errmsg); 1771 1772 /* error messages get the original request appened */ 1773 if (err) 1774 payload += nlmsg_len(nlh); 1775 1776 skb = nlmsg_new(payload, GFP_KERNEL); 1777 if (!skb) { 1778 struct sock *sk; 1779 1780 sk = netlink_lookup(sock_net(in_skb->sk), 1781 in_skb->sk->sk_protocol, 1782 NETLINK_CB(in_skb).pid); 1783 if (sk) { 1784 sk->sk_err = ENOBUFS; 1785 sk->sk_error_report(sk); 1786 sock_put(sk); 1787 } 1788 return; 1789 } 1790 1791 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, 1792 NLMSG_ERROR, payload, 0); 1793 errmsg = nlmsg_data(rep); 1794 errmsg->error = err; 1795 memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh)); 1796 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).pid, MSG_DONTWAIT); 1797 } 1798 EXPORT_SYMBOL(netlink_ack); 1799 1800 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *, 1801 struct nlmsghdr *)) 1802 { 1803 struct nlmsghdr *nlh; 1804 int err; 1805 1806 while (skb->len >= nlmsg_total_size(0)) { 1807 int msglen; 1808 1809 nlh = nlmsg_hdr(skb); 1810 err = 0; 1811 1812 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len) 1813 return 0; 1814 1815 /* Only requests are handled by the kernel */ 1816 if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) 1817 goto ack; 1818 1819 /* Skip control messages */ 1820 if (nlh->nlmsg_type < NLMSG_MIN_TYPE) 1821 goto ack; 1822 1823 err = cb(skb, nlh); 1824 if (err == -EINTR) 1825 goto skip; 1826 1827 ack: 1828 if (nlh->nlmsg_flags & NLM_F_ACK || err) 1829 netlink_ack(skb, nlh, err); 1830 1831 skip: 1832 msglen = NLMSG_ALIGN(nlh->nlmsg_len); 1833 if (msglen > skb->len) 1834 msglen = skb->len; 1835 skb_pull(skb, msglen); 1836 } 1837 1838 return 0; 1839 } 1840 EXPORT_SYMBOL(netlink_rcv_skb); 1841 1842 /** 1843 * nlmsg_notify - send a notification netlink message 1844 * @sk: netlink socket to use 1845 * @skb: notification message 1846 * @pid: destination netlink pid for reports or 0 1847 * @group: destination multicast group or 0 1848 * @report: 1 to report back, 0 to disable 1849 * @flags: allocation flags 1850 */ 1851 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 pid, 1852 unsigned int group, int report, gfp_t flags) 1853 { 1854 int err = 0; 1855 1856 if (group) { 1857 int exclude_pid = 0; 1858 1859 if (report) { 1860 atomic_inc(&skb->users); 1861 exclude_pid = pid; 1862 } 1863 1864 /* errors reported via destination sk->sk_err, but propagate 1865 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ 1866 err = nlmsg_multicast(sk, skb, exclude_pid, group, flags); 1867 } 1868 1869 if (report) { 1870 int err2; 1871 1872 err2 = nlmsg_unicast(sk, skb, pid); 1873 if (!err || err == -ESRCH) 1874 err = err2; 1875 } 1876 1877 return err; 1878 } 1879 EXPORT_SYMBOL(nlmsg_notify); 1880 1881 #ifdef CONFIG_PROC_FS 1882 struct nl_seq_iter { 1883 struct seq_net_private p; 1884 int link; 1885 int hash_idx; 1886 }; 1887 1888 static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos) 1889 { 1890 struct nl_seq_iter *iter = seq->private; 1891 int i, j; 1892 struct sock *s; 1893 struct hlist_node *node; 1894 loff_t off = 0; 1895 1896 for (i = 0; i < MAX_LINKS; i++) { 1897 struct nl_pid_hash *hash = &nl_table[i].hash; 1898 1899 for (j = 0; j <= hash->mask; j++) { 1900 sk_for_each(s, node, &hash->table[j]) { 1901 if (sock_net(s) != seq_file_net(seq)) 1902 continue; 1903 if (off == pos) { 1904 iter->link = i; 1905 iter->hash_idx = j; 1906 return s; 1907 } 1908 ++off; 1909 } 1910 } 1911 } 1912 return NULL; 1913 } 1914 1915 static void *netlink_seq_start(struct seq_file *seq, loff_t *pos) 1916 __acquires(nl_table_lock) 1917 { 1918 read_lock(&nl_table_lock); 1919 return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN; 1920 } 1921 1922 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1923 { 1924 struct sock *s; 1925 struct nl_seq_iter *iter; 1926 int i, j; 1927 1928 ++*pos; 1929 1930 if (v == SEQ_START_TOKEN) 1931 return netlink_seq_socket_idx(seq, 0); 1932 1933 iter = seq->private; 1934 s = v; 1935 do { 1936 s = sk_next(s); 1937 } while (s && sock_net(s) != seq_file_net(seq)); 1938 if (s) 1939 return s; 1940 1941 i = iter->link; 1942 j = iter->hash_idx + 1; 1943 1944 do { 1945 struct nl_pid_hash *hash = &nl_table[i].hash; 1946 1947 for (; j <= hash->mask; j++) { 1948 s = sk_head(&hash->table[j]); 1949 while (s && sock_net(s) != seq_file_net(seq)) 1950 s = sk_next(s); 1951 if (s) { 1952 iter->link = i; 1953 iter->hash_idx = j; 1954 return s; 1955 } 1956 } 1957 1958 j = 0; 1959 } while (++i < MAX_LINKS); 1960 1961 return NULL; 1962 } 1963 1964 static void netlink_seq_stop(struct seq_file *seq, void *v) 1965 __releases(nl_table_lock) 1966 { 1967 read_unlock(&nl_table_lock); 1968 } 1969 1970 1971 static int netlink_seq_show(struct seq_file *seq, void *v) 1972 { 1973 if (v == SEQ_START_TOKEN) 1974 seq_puts(seq, 1975 "sk Eth Pid Groups " 1976 "Rmem Wmem Dump Locks Drops\n"); 1977 else { 1978 struct sock *s = v; 1979 struct netlink_sock *nlk = nlk_sk(s); 1980 1981 seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n", 1982 s, 1983 s->sk_protocol, 1984 nlk->pid, 1985 nlk->groups ? (u32)nlk->groups[0] : 0, 1986 sk_rmem_alloc_get(s), 1987 sk_wmem_alloc_get(s), 1988 nlk->cb, 1989 atomic_read(&s->sk_refcnt), 1990 atomic_read(&s->sk_drops) 1991 ); 1992 1993 } 1994 return 0; 1995 } 1996 1997 static const struct seq_operations netlink_seq_ops = { 1998 .start = netlink_seq_start, 1999 .next = netlink_seq_next, 2000 .stop = netlink_seq_stop, 2001 .show = netlink_seq_show, 2002 }; 2003 2004 2005 static int netlink_seq_open(struct inode *inode, struct file *file) 2006 { 2007 return seq_open_net(inode, file, &netlink_seq_ops, 2008 sizeof(struct nl_seq_iter)); 2009 } 2010 2011 static const struct file_operations netlink_seq_fops = { 2012 .owner = THIS_MODULE, 2013 .open = netlink_seq_open, 2014 .read = seq_read, 2015 .llseek = seq_lseek, 2016 .release = seq_release_net, 2017 }; 2018 2019 #endif 2020 2021 int netlink_register_notifier(struct notifier_block *nb) 2022 { 2023 return atomic_notifier_chain_register(&netlink_chain, nb); 2024 } 2025 EXPORT_SYMBOL(netlink_register_notifier); 2026 2027 int netlink_unregister_notifier(struct notifier_block *nb) 2028 { 2029 return atomic_notifier_chain_unregister(&netlink_chain, nb); 2030 } 2031 EXPORT_SYMBOL(netlink_unregister_notifier); 2032 2033 static const struct proto_ops netlink_ops = { 2034 .family = PF_NETLINK, 2035 .owner = THIS_MODULE, 2036 .release = netlink_release, 2037 .bind = netlink_bind, 2038 .connect = netlink_connect, 2039 .socketpair = sock_no_socketpair, 2040 .accept = sock_no_accept, 2041 .getname = netlink_getname, 2042 .poll = datagram_poll, 2043 .ioctl = sock_no_ioctl, 2044 .listen = sock_no_listen, 2045 .shutdown = sock_no_shutdown, 2046 .setsockopt = netlink_setsockopt, 2047 .getsockopt = netlink_getsockopt, 2048 .sendmsg = netlink_sendmsg, 2049 .recvmsg = netlink_recvmsg, 2050 .mmap = sock_no_mmap, 2051 .sendpage = sock_no_sendpage, 2052 }; 2053 2054 static const struct net_proto_family netlink_family_ops = { 2055 .family = PF_NETLINK, 2056 .create = netlink_create, 2057 .owner = THIS_MODULE, /* for consistency 8) */ 2058 }; 2059 2060 static int __net_init netlink_net_init(struct net *net) 2061 { 2062 #ifdef CONFIG_PROC_FS 2063 if (!proc_net_fops_create(net, "netlink", 0, &netlink_seq_fops)) 2064 return -ENOMEM; 2065 #endif 2066 return 0; 2067 } 2068 2069 static void __net_exit netlink_net_exit(struct net *net) 2070 { 2071 #ifdef CONFIG_PROC_FS 2072 proc_net_remove(net, "netlink"); 2073 #endif 2074 } 2075 2076 static struct pernet_operations __net_initdata netlink_net_ops = { 2077 .init = netlink_net_init, 2078 .exit = netlink_net_exit, 2079 }; 2080 2081 static int __init netlink_proto_init(void) 2082 { 2083 struct sk_buff *dummy_skb; 2084 int i; 2085 unsigned long limit; 2086 unsigned int order; 2087 int err = proto_register(&netlink_proto, 0); 2088 2089 if (err != 0) 2090 goto out; 2091 2092 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > sizeof(dummy_skb->cb)); 2093 2094 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL); 2095 if (!nl_table) 2096 goto panic; 2097 2098 if (totalram_pages >= (128 * 1024)) 2099 limit = totalram_pages >> (21 - PAGE_SHIFT); 2100 else 2101 limit = totalram_pages >> (23 - PAGE_SHIFT); 2102 2103 order = get_bitmask_order(limit) - 1 + PAGE_SHIFT; 2104 limit = (1UL << order) / sizeof(struct hlist_head); 2105 order = get_bitmask_order(min(limit, (unsigned long)UINT_MAX)) - 1; 2106 2107 for (i = 0; i < MAX_LINKS; i++) { 2108 struct nl_pid_hash *hash = &nl_table[i].hash; 2109 2110 hash->table = nl_pid_hash_zalloc(1 * sizeof(*hash->table)); 2111 if (!hash->table) { 2112 while (i-- > 0) 2113 nl_pid_hash_free(nl_table[i].hash.table, 2114 1 * sizeof(*hash->table)); 2115 kfree(nl_table); 2116 goto panic; 2117 } 2118 hash->max_shift = order; 2119 hash->shift = 0; 2120 hash->mask = 0; 2121 hash->rehash_time = jiffies; 2122 } 2123 2124 sock_register(&netlink_family_ops); 2125 register_pernet_subsys(&netlink_net_ops); 2126 /* The netlink device handler may be needed early. */ 2127 rtnetlink_init(); 2128 out: 2129 return err; 2130 panic: 2131 panic("netlink_init: Cannot allocate nl_table\n"); 2132 } 2133 2134 core_initcall(netlink_proto_init); 2135