1 /* 2 * NETLINK Kernel-user communication protocol. 3 * 4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk> 5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 6 * Patrick McHardy <kaber@trash.net> 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License 10 * as published by the Free Software Foundation; either version 11 * 2 of the License, or (at your option) any later version. 12 * 13 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith 14 * added netlink_proto_exit 15 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br> 16 * use nlk_sk, as sk->protinfo is on a diet 8) 17 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org> 18 * - inc module use count of module that owns 19 * the kernel socket in case userspace opens 20 * socket of same protocol 21 * - remove all module support, since netlink is 22 * mandatory if CONFIG_NET=y these days 23 */ 24 25 #include <linux/module.h> 26 27 #include <linux/capability.h> 28 #include <linux/kernel.h> 29 #include <linux/init.h> 30 #include <linux/signal.h> 31 #include <linux/sched.h> 32 #include <linux/errno.h> 33 #include <linux/string.h> 34 #include <linux/stat.h> 35 #include <linux/socket.h> 36 #include <linux/un.h> 37 #include <linux/fcntl.h> 38 #include <linux/termios.h> 39 #include <linux/sockios.h> 40 #include <linux/net.h> 41 #include <linux/fs.h> 42 #include <linux/slab.h> 43 #include <asm/uaccess.h> 44 #include <linux/skbuff.h> 45 #include <linux/netdevice.h> 46 #include <linux/rtnetlink.h> 47 #include <linux/proc_fs.h> 48 #include <linux/seq_file.h> 49 #include <linux/notifier.h> 50 #include <linux/security.h> 51 #include <linux/jhash.h> 52 #include <linux/jiffies.h> 53 #include <linux/random.h> 54 #include <linux/bitops.h> 55 #include <linux/mm.h> 56 #include <linux/types.h> 57 #include <linux/audit.h> 58 #include <linux/mutex.h> 59 #include <linux/vmalloc.h> 60 #include <linux/if_arp.h> 61 #include <linux/rhashtable.h> 62 #include <asm/cacheflush.h> 63 #include <linux/hash.h> 64 #include <linux/genetlink.h> 65 66 #include <net/net_namespace.h> 67 #include <net/sock.h> 68 #include <net/scm.h> 69 #include <net/netlink.h> 70 71 #include "af_netlink.h" 72 73 struct listeners { 74 struct rcu_head rcu; 75 unsigned long masks[0]; 76 }; 77 78 /* state bits */ 79 #define NETLINK_CONGESTED 0x0 80 81 /* flags */ 82 #define NETLINK_KERNEL_SOCKET 0x1 83 #define NETLINK_RECV_PKTINFO 0x2 84 #define NETLINK_BROADCAST_SEND_ERROR 0x4 85 #define NETLINK_RECV_NO_ENOBUFS 0x8 86 87 static inline int netlink_is_kernel(struct sock *sk) 88 { 89 return nlk_sk(sk)->flags & NETLINK_KERNEL_SOCKET; 90 } 91 92 struct netlink_table *nl_table; 93 EXPORT_SYMBOL_GPL(nl_table); 94 95 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); 96 97 static int netlink_dump(struct sock *sk); 98 static void netlink_skb_destructor(struct sk_buff *skb); 99 100 /* nl_table locking explained: 101 * Lookup and traversal are protected with an RCU read-side lock. Insertion 102 * and removal are protected with per bucket lock while using RCU list 103 * modification primitives and may run in parallel to RCU protected lookups. 104 * Destruction of the Netlink socket may only occur *after* nl_table_lock has 105 * been acquired * either during or after the socket has been removed from 106 * the list and after an RCU grace period. 107 */ 108 DEFINE_RWLOCK(nl_table_lock); 109 EXPORT_SYMBOL_GPL(nl_table_lock); 110 static atomic_t nl_table_users = ATOMIC_INIT(0); 111 112 #define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock)); 113 114 static ATOMIC_NOTIFIER_HEAD(netlink_chain); 115 116 static DEFINE_SPINLOCK(netlink_tap_lock); 117 static struct list_head netlink_tap_all __read_mostly; 118 119 static const struct rhashtable_params netlink_rhashtable_params; 120 121 static inline u32 netlink_group_mask(u32 group) 122 { 123 return group ? 1 << (group - 1) : 0; 124 } 125 126 int netlink_add_tap(struct netlink_tap *nt) 127 { 128 if (unlikely(nt->dev->type != ARPHRD_NETLINK)) 129 return -EINVAL; 130 131 spin_lock(&netlink_tap_lock); 132 list_add_rcu(&nt->list, &netlink_tap_all); 133 spin_unlock(&netlink_tap_lock); 134 135 __module_get(nt->module); 136 137 return 0; 138 } 139 EXPORT_SYMBOL_GPL(netlink_add_tap); 140 141 static int __netlink_remove_tap(struct netlink_tap *nt) 142 { 143 bool found = false; 144 struct netlink_tap *tmp; 145 146 spin_lock(&netlink_tap_lock); 147 148 list_for_each_entry(tmp, &netlink_tap_all, list) { 149 if (nt == tmp) { 150 list_del_rcu(&nt->list); 151 found = true; 152 goto out; 153 } 154 } 155 156 pr_warn("__netlink_remove_tap: %p not found\n", nt); 157 out: 158 spin_unlock(&netlink_tap_lock); 159 160 if (found && nt->module) 161 module_put(nt->module); 162 163 return found ? 0 : -ENODEV; 164 } 165 166 int netlink_remove_tap(struct netlink_tap *nt) 167 { 168 int ret; 169 170 ret = __netlink_remove_tap(nt); 171 synchronize_net(); 172 173 return ret; 174 } 175 EXPORT_SYMBOL_GPL(netlink_remove_tap); 176 177 static bool netlink_filter_tap(const struct sk_buff *skb) 178 { 179 struct sock *sk = skb->sk; 180 181 /* We take the more conservative approach and 182 * whitelist socket protocols that may pass. 183 */ 184 switch (sk->sk_protocol) { 185 case NETLINK_ROUTE: 186 case NETLINK_USERSOCK: 187 case NETLINK_SOCK_DIAG: 188 case NETLINK_NFLOG: 189 case NETLINK_XFRM: 190 case NETLINK_FIB_LOOKUP: 191 case NETLINK_NETFILTER: 192 case NETLINK_GENERIC: 193 return true; 194 } 195 196 return false; 197 } 198 199 static int __netlink_deliver_tap_skb(struct sk_buff *skb, 200 struct net_device *dev) 201 { 202 struct sk_buff *nskb; 203 struct sock *sk = skb->sk; 204 int ret = -ENOMEM; 205 206 dev_hold(dev); 207 nskb = skb_clone(skb, GFP_ATOMIC); 208 if (nskb) { 209 nskb->dev = dev; 210 nskb->protocol = htons((u16) sk->sk_protocol); 211 nskb->pkt_type = netlink_is_kernel(sk) ? 212 PACKET_KERNEL : PACKET_USER; 213 skb_reset_network_header(nskb); 214 ret = dev_queue_xmit(nskb); 215 if (unlikely(ret > 0)) 216 ret = net_xmit_errno(ret); 217 } 218 219 dev_put(dev); 220 return ret; 221 } 222 223 static void __netlink_deliver_tap(struct sk_buff *skb) 224 { 225 int ret; 226 struct netlink_tap *tmp; 227 228 if (!netlink_filter_tap(skb)) 229 return; 230 231 list_for_each_entry_rcu(tmp, &netlink_tap_all, list) { 232 ret = __netlink_deliver_tap_skb(skb, tmp->dev); 233 if (unlikely(ret)) 234 break; 235 } 236 } 237 238 static void netlink_deliver_tap(struct sk_buff *skb) 239 { 240 rcu_read_lock(); 241 242 if (unlikely(!list_empty(&netlink_tap_all))) 243 __netlink_deliver_tap(skb); 244 245 rcu_read_unlock(); 246 } 247 248 static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src, 249 struct sk_buff *skb) 250 { 251 if (!(netlink_is_kernel(dst) && netlink_is_kernel(src))) 252 netlink_deliver_tap(skb); 253 } 254 255 static void netlink_overrun(struct sock *sk) 256 { 257 struct netlink_sock *nlk = nlk_sk(sk); 258 259 if (!(nlk->flags & NETLINK_RECV_NO_ENOBUFS)) { 260 if (!test_and_set_bit(NETLINK_CONGESTED, &nlk_sk(sk)->state)) { 261 sk->sk_err = ENOBUFS; 262 sk->sk_error_report(sk); 263 } 264 } 265 atomic_inc(&sk->sk_drops); 266 } 267 268 static void netlink_rcv_wake(struct sock *sk) 269 { 270 struct netlink_sock *nlk = nlk_sk(sk); 271 272 if (skb_queue_empty(&sk->sk_receive_queue)) 273 clear_bit(NETLINK_CONGESTED, &nlk->state); 274 if (!test_bit(NETLINK_CONGESTED, &nlk->state)) 275 wake_up_interruptible(&nlk->wait); 276 } 277 278 #ifdef CONFIG_NETLINK_MMAP 279 static bool netlink_skb_is_mmaped(const struct sk_buff *skb) 280 { 281 return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED; 282 } 283 284 static bool netlink_rx_is_mmaped(struct sock *sk) 285 { 286 return nlk_sk(sk)->rx_ring.pg_vec != NULL; 287 } 288 289 static bool netlink_tx_is_mmaped(struct sock *sk) 290 { 291 return nlk_sk(sk)->tx_ring.pg_vec != NULL; 292 } 293 294 static __pure struct page *pgvec_to_page(const void *addr) 295 { 296 if (is_vmalloc_addr(addr)) 297 return vmalloc_to_page(addr); 298 else 299 return virt_to_page(addr); 300 } 301 302 static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len) 303 { 304 unsigned int i; 305 306 for (i = 0; i < len; i++) { 307 if (pg_vec[i] != NULL) { 308 if (is_vmalloc_addr(pg_vec[i])) 309 vfree(pg_vec[i]); 310 else 311 free_pages((unsigned long)pg_vec[i], order); 312 } 313 } 314 kfree(pg_vec); 315 } 316 317 static void *alloc_one_pg_vec_page(unsigned long order) 318 { 319 void *buffer; 320 gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO | 321 __GFP_NOWARN | __GFP_NORETRY; 322 323 buffer = (void *)__get_free_pages(gfp_flags, order); 324 if (buffer != NULL) 325 return buffer; 326 327 buffer = vzalloc((1 << order) * PAGE_SIZE); 328 if (buffer != NULL) 329 return buffer; 330 331 gfp_flags &= ~__GFP_NORETRY; 332 return (void *)__get_free_pages(gfp_flags, order); 333 } 334 335 static void **alloc_pg_vec(struct netlink_sock *nlk, 336 struct nl_mmap_req *req, unsigned int order) 337 { 338 unsigned int block_nr = req->nm_block_nr; 339 unsigned int i; 340 void **pg_vec; 341 342 pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL); 343 if (pg_vec == NULL) 344 return NULL; 345 346 for (i = 0; i < block_nr; i++) { 347 pg_vec[i] = alloc_one_pg_vec_page(order); 348 if (pg_vec[i] == NULL) 349 goto err1; 350 } 351 352 return pg_vec; 353 err1: 354 free_pg_vec(pg_vec, order, block_nr); 355 return NULL; 356 } 357 358 static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, 359 bool closing, bool tx_ring) 360 { 361 struct netlink_sock *nlk = nlk_sk(sk); 362 struct netlink_ring *ring; 363 struct sk_buff_head *queue; 364 void **pg_vec = NULL; 365 unsigned int order = 0; 366 int err; 367 368 ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; 369 queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; 370 371 if (!closing) { 372 if (atomic_read(&nlk->mapped)) 373 return -EBUSY; 374 if (atomic_read(&ring->pending)) 375 return -EBUSY; 376 } 377 378 if (req->nm_block_nr) { 379 if (ring->pg_vec != NULL) 380 return -EBUSY; 381 382 if ((int)req->nm_block_size <= 0) 383 return -EINVAL; 384 if (!PAGE_ALIGNED(req->nm_block_size)) 385 return -EINVAL; 386 if (req->nm_frame_size < NL_MMAP_HDRLEN) 387 return -EINVAL; 388 if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT)) 389 return -EINVAL; 390 391 ring->frames_per_block = req->nm_block_size / 392 req->nm_frame_size; 393 if (ring->frames_per_block == 0) 394 return -EINVAL; 395 if (ring->frames_per_block * req->nm_block_nr != 396 req->nm_frame_nr) 397 return -EINVAL; 398 399 order = get_order(req->nm_block_size); 400 pg_vec = alloc_pg_vec(nlk, req, order); 401 if (pg_vec == NULL) 402 return -ENOMEM; 403 } else { 404 if (req->nm_frame_nr) 405 return -EINVAL; 406 } 407 408 err = -EBUSY; 409 mutex_lock(&nlk->pg_vec_lock); 410 if (closing || atomic_read(&nlk->mapped) == 0) { 411 err = 0; 412 spin_lock_bh(&queue->lock); 413 414 ring->frame_max = req->nm_frame_nr - 1; 415 ring->head = 0; 416 ring->frame_size = req->nm_frame_size; 417 ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; 418 419 swap(ring->pg_vec_len, req->nm_block_nr); 420 swap(ring->pg_vec_order, order); 421 swap(ring->pg_vec, pg_vec); 422 423 __skb_queue_purge(queue); 424 spin_unlock_bh(&queue->lock); 425 426 WARN_ON(atomic_read(&nlk->mapped)); 427 } 428 mutex_unlock(&nlk->pg_vec_lock); 429 430 if (pg_vec) 431 free_pg_vec(pg_vec, order, req->nm_block_nr); 432 return err; 433 } 434 435 static void netlink_mm_open(struct vm_area_struct *vma) 436 { 437 struct file *file = vma->vm_file; 438 struct socket *sock = file->private_data; 439 struct sock *sk = sock->sk; 440 441 if (sk) 442 atomic_inc(&nlk_sk(sk)->mapped); 443 } 444 445 static void netlink_mm_close(struct vm_area_struct *vma) 446 { 447 struct file *file = vma->vm_file; 448 struct socket *sock = file->private_data; 449 struct sock *sk = sock->sk; 450 451 if (sk) 452 atomic_dec(&nlk_sk(sk)->mapped); 453 } 454 455 static const struct vm_operations_struct netlink_mmap_ops = { 456 .open = netlink_mm_open, 457 .close = netlink_mm_close, 458 }; 459 460 static int netlink_mmap(struct file *file, struct socket *sock, 461 struct vm_area_struct *vma) 462 { 463 struct sock *sk = sock->sk; 464 struct netlink_sock *nlk = nlk_sk(sk); 465 struct netlink_ring *ring; 466 unsigned long start, size, expected; 467 unsigned int i; 468 int err = -EINVAL; 469 470 if (vma->vm_pgoff) 471 return -EINVAL; 472 473 mutex_lock(&nlk->pg_vec_lock); 474 475 expected = 0; 476 for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { 477 if (ring->pg_vec == NULL) 478 continue; 479 expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE; 480 } 481 482 if (expected == 0) 483 goto out; 484 485 size = vma->vm_end - vma->vm_start; 486 if (size != expected) 487 goto out; 488 489 start = vma->vm_start; 490 for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { 491 if (ring->pg_vec == NULL) 492 continue; 493 494 for (i = 0; i < ring->pg_vec_len; i++) { 495 struct page *page; 496 void *kaddr = ring->pg_vec[i]; 497 unsigned int pg_num; 498 499 for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) { 500 page = pgvec_to_page(kaddr); 501 err = vm_insert_page(vma, start, page); 502 if (err < 0) 503 goto out; 504 start += PAGE_SIZE; 505 kaddr += PAGE_SIZE; 506 } 507 } 508 } 509 510 atomic_inc(&nlk->mapped); 511 vma->vm_ops = &netlink_mmap_ops; 512 err = 0; 513 out: 514 mutex_unlock(&nlk->pg_vec_lock); 515 return err; 516 } 517 518 static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) 519 { 520 #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 521 struct page *p_start, *p_end; 522 523 /* First page is flushed through netlink_{get,set}_status */ 524 p_start = pgvec_to_page(hdr + PAGE_SIZE); 525 p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); 526 while (p_start <= p_end) { 527 flush_dcache_page(p_start); 528 p_start++; 529 } 530 #endif 531 } 532 533 static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) 534 { 535 smp_rmb(); 536 flush_dcache_page(pgvec_to_page(hdr)); 537 return hdr->nm_status; 538 } 539 540 static void netlink_set_status(struct nl_mmap_hdr *hdr, 541 enum nl_mmap_status status) 542 { 543 smp_mb(); 544 hdr->nm_status = status; 545 flush_dcache_page(pgvec_to_page(hdr)); 546 } 547 548 static struct nl_mmap_hdr * 549 __netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos) 550 { 551 unsigned int pg_vec_pos, frame_off; 552 553 pg_vec_pos = pos / ring->frames_per_block; 554 frame_off = pos % ring->frames_per_block; 555 556 return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size); 557 } 558 559 static struct nl_mmap_hdr * 560 netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos, 561 enum nl_mmap_status status) 562 { 563 struct nl_mmap_hdr *hdr; 564 565 hdr = __netlink_lookup_frame(ring, pos); 566 if (netlink_get_status(hdr) != status) 567 return NULL; 568 569 return hdr; 570 } 571 572 static struct nl_mmap_hdr * 573 netlink_current_frame(const struct netlink_ring *ring, 574 enum nl_mmap_status status) 575 { 576 return netlink_lookup_frame(ring, ring->head, status); 577 } 578 579 static struct nl_mmap_hdr * 580 netlink_previous_frame(const struct netlink_ring *ring, 581 enum nl_mmap_status status) 582 { 583 unsigned int prev; 584 585 prev = ring->head ? ring->head - 1 : ring->frame_max; 586 return netlink_lookup_frame(ring, prev, status); 587 } 588 589 static void netlink_increment_head(struct netlink_ring *ring) 590 { 591 ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0; 592 } 593 594 static void netlink_forward_ring(struct netlink_ring *ring) 595 { 596 unsigned int head = ring->head, pos = head; 597 const struct nl_mmap_hdr *hdr; 598 599 do { 600 hdr = __netlink_lookup_frame(ring, pos); 601 if (hdr->nm_status == NL_MMAP_STATUS_UNUSED) 602 break; 603 if (hdr->nm_status != NL_MMAP_STATUS_SKIP) 604 break; 605 netlink_increment_head(ring); 606 } while (ring->head != head); 607 } 608 609 static bool netlink_dump_space(struct netlink_sock *nlk) 610 { 611 struct netlink_ring *ring = &nlk->rx_ring; 612 struct nl_mmap_hdr *hdr; 613 unsigned int n; 614 615 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); 616 if (hdr == NULL) 617 return false; 618 619 n = ring->head + ring->frame_max / 2; 620 if (n > ring->frame_max) 621 n -= ring->frame_max; 622 623 hdr = __netlink_lookup_frame(ring, n); 624 625 return hdr->nm_status == NL_MMAP_STATUS_UNUSED; 626 } 627 628 static unsigned int netlink_poll(struct file *file, struct socket *sock, 629 poll_table *wait) 630 { 631 struct sock *sk = sock->sk; 632 struct netlink_sock *nlk = nlk_sk(sk); 633 unsigned int mask; 634 int err; 635 636 if (nlk->rx_ring.pg_vec != NULL) { 637 /* Memory mapped sockets don't call recvmsg(), so flow control 638 * for dumps is performed here. A dump is allowed to continue 639 * if at least half the ring is unused. 640 */ 641 while (nlk->cb_running && netlink_dump_space(nlk)) { 642 err = netlink_dump(sk); 643 if (err < 0) { 644 sk->sk_err = -err; 645 sk->sk_error_report(sk); 646 break; 647 } 648 } 649 netlink_rcv_wake(sk); 650 } 651 652 mask = datagram_poll(file, sock, wait); 653 654 spin_lock_bh(&sk->sk_receive_queue.lock); 655 if (nlk->rx_ring.pg_vec) { 656 netlink_forward_ring(&nlk->rx_ring); 657 if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED)) 658 mask |= POLLIN | POLLRDNORM; 659 } 660 spin_unlock_bh(&sk->sk_receive_queue.lock); 661 662 spin_lock_bh(&sk->sk_write_queue.lock); 663 if (nlk->tx_ring.pg_vec) { 664 if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED)) 665 mask |= POLLOUT | POLLWRNORM; 666 } 667 spin_unlock_bh(&sk->sk_write_queue.lock); 668 669 return mask; 670 } 671 672 static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb) 673 { 674 return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN); 675 } 676 677 static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk, 678 struct netlink_ring *ring, 679 struct nl_mmap_hdr *hdr) 680 { 681 unsigned int size; 682 void *data; 683 684 size = ring->frame_size - NL_MMAP_HDRLEN; 685 data = (void *)hdr + NL_MMAP_HDRLEN; 686 687 skb->head = data; 688 skb->data = data; 689 skb_reset_tail_pointer(skb); 690 skb->end = skb->tail + size; 691 skb->len = 0; 692 693 skb->destructor = netlink_skb_destructor; 694 NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED; 695 NETLINK_CB(skb).sk = sk; 696 } 697 698 static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, 699 u32 dst_portid, u32 dst_group, 700 struct scm_cookie *scm) 701 { 702 struct netlink_sock *nlk = nlk_sk(sk); 703 struct netlink_ring *ring; 704 struct nl_mmap_hdr *hdr; 705 struct sk_buff *skb; 706 unsigned int maxlen; 707 int err = 0, len = 0; 708 709 mutex_lock(&nlk->pg_vec_lock); 710 711 ring = &nlk->tx_ring; 712 maxlen = ring->frame_size - NL_MMAP_HDRLEN; 713 714 do { 715 unsigned int nm_len; 716 717 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); 718 if (hdr == NULL) { 719 if (!(msg->msg_flags & MSG_DONTWAIT) && 720 atomic_read(&nlk->tx_ring.pending)) 721 schedule(); 722 continue; 723 } 724 725 nm_len = ACCESS_ONCE(hdr->nm_len); 726 if (nm_len > maxlen) { 727 err = -EINVAL; 728 goto out; 729 } 730 731 netlink_frame_flush_dcache(hdr, nm_len); 732 733 skb = alloc_skb(nm_len, GFP_KERNEL); 734 if (skb == NULL) { 735 err = -ENOBUFS; 736 goto out; 737 } 738 __skb_put(skb, nm_len); 739 memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); 740 netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); 741 742 netlink_increment_head(ring); 743 744 NETLINK_CB(skb).portid = nlk->portid; 745 NETLINK_CB(skb).dst_group = dst_group; 746 NETLINK_CB(skb).creds = scm->creds; 747 748 err = security_netlink_send(sk, skb); 749 if (err) { 750 kfree_skb(skb); 751 goto out; 752 } 753 754 if (unlikely(dst_group)) { 755 atomic_inc(&skb->users); 756 netlink_broadcast(sk, skb, dst_portid, dst_group, 757 GFP_KERNEL); 758 } 759 err = netlink_unicast(sk, skb, dst_portid, 760 msg->msg_flags & MSG_DONTWAIT); 761 if (err < 0) 762 goto out; 763 len += err; 764 765 } while (hdr != NULL || 766 (!(msg->msg_flags & MSG_DONTWAIT) && 767 atomic_read(&nlk->tx_ring.pending))); 768 769 if (len > 0) 770 err = len; 771 out: 772 mutex_unlock(&nlk->pg_vec_lock); 773 return err; 774 } 775 776 static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) 777 { 778 struct nl_mmap_hdr *hdr; 779 780 hdr = netlink_mmap_hdr(skb); 781 hdr->nm_len = skb->len; 782 hdr->nm_group = NETLINK_CB(skb).dst_group; 783 hdr->nm_pid = NETLINK_CB(skb).creds.pid; 784 hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); 785 hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); 786 netlink_frame_flush_dcache(hdr, hdr->nm_len); 787 netlink_set_status(hdr, NL_MMAP_STATUS_VALID); 788 789 NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; 790 kfree_skb(skb); 791 } 792 793 static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb) 794 { 795 struct netlink_sock *nlk = nlk_sk(sk); 796 struct netlink_ring *ring = &nlk->rx_ring; 797 struct nl_mmap_hdr *hdr; 798 799 spin_lock_bh(&sk->sk_receive_queue.lock); 800 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); 801 if (hdr == NULL) { 802 spin_unlock_bh(&sk->sk_receive_queue.lock); 803 kfree_skb(skb); 804 netlink_overrun(sk); 805 return; 806 } 807 netlink_increment_head(ring); 808 __skb_queue_tail(&sk->sk_receive_queue, skb); 809 spin_unlock_bh(&sk->sk_receive_queue.lock); 810 811 hdr->nm_len = skb->len; 812 hdr->nm_group = NETLINK_CB(skb).dst_group; 813 hdr->nm_pid = NETLINK_CB(skb).creds.pid; 814 hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); 815 hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); 816 netlink_set_status(hdr, NL_MMAP_STATUS_COPY); 817 } 818 819 #else /* CONFIG_NETLINK_MMAP */ 820 #define netlink_skb_is_mmaped(skb) false 821 #define netlink_rx_is_mmaped(sk) false 822 #define netlink_tx_is_mmaped(sk) false 823 #define netlink_mmap sock_no_mmap 824 #define netlink_poll datagram_poll 825 #define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm) 0 826 #endif /* CONFIG_NETLINK_MMAP */ 827 828 static void netlink_skb_destructor(struct sk_buff *skb) 829 { 830 #ifdef CONFIG_NETLINK_MMAP 831 struct nl_mmap_hdr *hdr; 832 struct netlink_ring *ring; 833 struct sock *sk; 834 835 /* If a packet from the kernel to userspace was freed because of an 836 * error without being delivered to userspace, the kernel must reset 837 * the status. In the direction userspace to kernel, the status is 838 * always reset here after the packet was processed and freed. 839 */ 840 if (netlink_skb_is_mmaped(skb)) { 841 hdr = netlink_mmap_hdr(skb); 842 sk = NETLINK_CB(skb).sk; 843 844 if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) { 845 netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); 846 ring = &nlk_sk(sk)->tx_ring; 847 } else { 848 if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) { 849 hdr->nm_len = 0; 850 netlink_set_status(hdr, NL_MMAP_STATUS_VALID); 851 } 852 ring = &nlk_sk(sk)->rx_ring; 853 } 854 855 WARN_ON(atomic_read(&ring->pending) == 0); 856 atomic_dec(&ring->pending); 857 sock_put(sk); 858 859 skb->head = NULL; 860 } 861 #endif 862 if (is_vmalloc_addr(skb->head)) { 863 if (!skb->cloned || 864 !atomic_dec_return(&(skb_shinfo(skb)->dataref))) 865 vfree(skb->head); 866 867 skb->head = NULL; 868 } 869 if (skb->sk != NULL) 870 sock_rfree(skb); 871 } 872 873 static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) 874 { 875 WARN_ON(skb->sk != NULL); 876 skb->sk = sk; 877 skb->destructor = netlink_skb_destructor; 878 atomic_add(skb->truesize, &sk->sk_rmem_alloc); 879 sk_mem_charge(sk, skb->truesize); 880 } 881 882 static void netlink_sock_destruct(struct sock *sk) 883 { 884 struct netlink_sock *nlk = nlk_sk(sk); 885 886 if (nlk->cb_running) { 887 if (nlk->cb.done) 888 nlk->cb.done(&nlk->cb); 889 890 module_put(nlk->cb.module); 891 kfree_skb(nlk->cb.skb); 892 } 893 894 skb_queue_purge(&sk->sk_receive_queue); 895 #ifdef CONFIG_NETLINK_MMAP 896 if (1) { 897 struct nl_mmap_req req; 898 899 memset(&req, 0, sizeof(req)); 900 if (nlk->rx_ring.pg_vec) 901 netlink_set_ring(sk, &req, true, false); 902 memset(&req, 0, sizeof(req)); 903 if (nlk->tx_ring.pg_vec) 904 netlink_set_ring(sk, &req, true, true); 905 } 906 #endif /* CONFIG_NETLINK_MMAP */ 907 908 if (!sock_flag(sk, SOCK_DEAD)) { 909 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); 910 return; 911 } 912 913 WARN_ON(atomic_read(&sk->sk_rmem_alloc)); 914 WARN_ON(atomic_read(&sk->sk_wmem_alloc)); 915 WARN_ON(nlk_sk(sk)->groups); 916 } 917 918 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on 919 * SMP. Look, when several writers sleep and reader wakes them up, all but one 920 * immediately hit write lock and grab all the cpus. Exclusive sleep solves 921 * this, _but_ remember, it adds useless work on UP machines. 922 */ 923 924 void netlink_table_grab(void) 925 __acquires(nl_table_lock) 926 { 927 might_sleep(); 928 929 write_lock_irq(&nl_table_lock); 930 931 if (atomic_read(&nl_table_users)) { 932 DECLARE_WAITQUEUE(wait, current); 933 934 add_wait_queue_exclusive(&nl_table_wait, &wait); 935 for (;;) { 936 set_current_state(TASK_UNINTERRUPTIBLE); 937 if (atomic_read(&nl_table_users) == 0) 938 break; 939 write_unlock_irq(&nl_table_lock); 940 schedule(); 941 write_lock_irq(&nl_table_lock); 942 } 943 944 __set_current_state(TASK_RUNNING); 945 remove_wait_queue(&nl_table_wait, &wait); 946 } 947 } 948 949 void netlink_table_ungrab(void) 950 __releases(nl_table_lock) 951 { 952 write_unlock_irq(&nl_table_lock); 953 wake_up(&nl_table_wait); 954 } 955 956 static inline void 957 netlink_lock_table(void) 958 { 959 /* read_lock() synchronizes us to netlink_table_grab */ 960 961 read_lock(&nl_table_lock); 962 atomic_inc(&nl_table_users); 963 read_unlock(&nl_table_lock); 964 } 965 966 static inline void 967 netlink_unlock_table(void) 968 { 969 if (atomic_dec_and_test(&nl_table_users)) 970 wake_up(&nl_table_wait); 971 } 972 973 struct netlink_compare_arg 974 { 975 possible_net_t pnet; 976 u32 portid; 977 }; 978 979 /* Doing sizeof directly may yield 4 extra bytes on 64-bit. */ 980 #define netlink_compare_arg_len \ 981 (offsetof(struct netlink_compare_arg, portid) + sizeof(u32)) 982 983 static inline int netlink_compare(struct rhashtable_compare_arg *arg, 984 const void *ptr) 985 { 986 const struct netlink_compare_arg *x = arg->key; 987 const struct netlink_sock *nlk = ptr; 988 989 return nlk->portid != x->portid || 990 !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet)); 991 } 992 993 static void netlink_compare_arg_init(struct netlink_compare_arg *arg, 994 struct net *net, u32 portid) 995 { 996 memset(arg, 0, sizeof(*arg)); 997 write_pnet(&arg->pnet, net); 998 arg->portid = portid; 999 } 1000 1001 static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid, 1002 struct net *net) 1003 { 1004 struct netlink_compare_arg arg; 1005 1006 netlink_compare_arg_init(&arg, net, portid); 1007 return rhashtable_lookup_fast(&table->hash, &arg, 1008 netlink_rhashtable_params); 1009 } 1010 1011 static int __netlink_insert(struct netlink_table *table, struct sock *sk) 1012 { 1013 struct netlink_compare_arg arg; 1014 1015 netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid); 1016 return rhashtable_lookup_insert_key(&table->hash, &arg, 1017 &nlk_sk(sk)->node, 1018 netlink_rhashtable_params); 1019 } 1020 1021 static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid) 1022 { 1023 struct netlink_table *table = &nl_table[protocol]; 1024 struct sock *sk; 1025 1026 rcu_read_lock(); 1027 sk = __netlink_lookup(table, portid, net); 1028 if (sk) 1029 sock_hold(sk); 1030 rcu_read_unlock(); 1031 1032 return sk; 1033 } 1034 1035 static const struct proto_ops netlink_ops; 1036 1037 static void 1038 netlink_update_listeners(struct sock *sk) 1039 { 1040 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 1041 unsigned long mask; 1042 unsigned int i; 1043 struct listeners *listeners; 1044 1045 listeners = nl_deref_protected(tbl->listeners); 1046 if (!listeners) 1047 return; 1048 1049 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) { 1050 mask = 0; 1051 sk_for_each_bound(sk, &tbl->mc_list) { 1052 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups)) 1053 mask |= nlk_sk(sk)->groups[i]; 1054 } 1055 listeners->masks[i] = mask; 1056 } 1057 /* this function is only called with the netlink table "grabbed", which 1058 * makes sure updates are visible before bind or setsockopt return. */ 1059 } 1060 1061 static int netlink_insert(struct sock *sk, u32 portid) 1062 { 1063 struct netlink_table *table = &nl_table[sk->sk_protocol]; 1064 int err; 1065 1066 lock_sock(sk); 1067 1068 err = -EBUSY; 1069 if (nlk_sk(sk)->portid) 1070 goto err; 1071 1072 err = -ENOMEM; 1073 if (BITS_PER_LONG > 32 && 1074 unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX)) 1075 goto err; 1076 1077 nlk_sk(sk)->portid = portid; 1078 sock_hold(sk); 1079 1080 err = __netlink_insert(table, sk); 1081 if (err) { 1082 if (err == -EEXIST) 1083 err = -EADDRINUSE; 1084 sock_put(sk); 1085 } 1086 1087 err: 1088 release_sock(sk); 1089 return err; 1090 } 1091 1092 static void netlink_remove(struct sock *sk) 1093 { 1094 struct netlink_table *table; 1095 1096 table = &nl_table[sk->sk_protocol]; 1097 if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node, 1098 netlink_rhashtable_params)) { 1099 WARN_ON(atomic_read(&sk->sk_refcnt) == 1); 1100 __sock_put(sk); 1101 } 1102 1103 netlink_table_grab(); 1104 if (nlk_sk(sk)->subscriptions) { 1105 __sk_del_bind_node(sk); 1106 netlink_update_listeners(sk); 1107 } 1108 if (sk->sk_protocol == NETLINK_GENERIC) 1109 atomic_inc(&genl_sk_destructing_cnt); 1110 netlink_table_ungrab(); 1111 } 1112 1113 static struct proto netlink_proto = { 1114 .name = "NETLINK", 1115 .owner = THIS_MODULE, 1116 .obj_size = sizeof(struct netlink_sock), 1117 }; 1118 1119 static int __netlink_create(struct net *net, struct socket *sock, 1120 struct mutex *cb_mutex, int protocol) 1121 { 1122 struct sock *sk; 1123 struct netlink_sock *nlk; 1124 1125 sock->ops = &netlink_ops; 1126 1127 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto); 1128 if (!sk) 1129 return -ENOMEM; 1130 1131 sock_init_data(sock, sk); 1132 1133 nlk = nlk_sk(sk); 1134 if (cb_mutex) { 1135 nlk->cb_mutex = cb_mutex; 1136 } else { 1137 nlk->cb_mutex = &nlk->cb_def_mutex; 1138 mutex_init(nlk->cb_mutex); 1139 } 1140 init_waitqueue_head(&nlk->wait); 1141 #ifdef CONFIG_NETLINK_MMAP 1142 mutex_init(&nlk->pg_vec_lock); 1143 #endif 1144 1145 sk->sk_destruct = netlink_sock_destruct; 1146 sk->sk_protocol = protocol; 1147 return 0; 1148 } 1149 1150 static int netlink_create(struct net *net, struct socket *sock, int protocol, 1151 int kern) 1152 { 1153 struct module *module = NULL; 1154 struct mutex *cb_mutex; 1155 struct netlink_sock *nlk; 1156 int (*bind)(struct net *net, int group); 1157 void (*unbind)(struct net *net, int group); 1158 int err = 0; 1159 1160 sock->state = SS_UNCONNECTED; 1161 1162 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) 1163 return -ESOCKTNOSUPPORT; 1164 1165 if (protocol < 0 || protocol >= MAX_LINKS) 1166 return -EPROTONOSUPPORT; 1167 1168 netlink_lock_table(); 1169 #ifdef CONFIG_MODULES 1170 if (!nl_table[protocol].registered) { 1171 netlink_unlock_table(); 1172 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol); 1173 netlink_lock_table(); 1174 } 1175 #endif 1176 if (nl_table[protocol].registered && 1177 try_module_get(nl_table[protocol].module)) 1178 module = nl_table[protocol].module; 1179 else 1180 err = -EPROTONOSUPPORT; 1181 cb_mutex = nl_table[protocol].cb_mutex; 1182 bind = nl_table[protocol].bind; 1183 unbind = nl_table[protocol].unbind; 1184 netlink_unlock_table(); 1185 1186 if (err < 0) 1187 goto out; 1188 1189 err = __netlink_create(net, sock, cb_mutex, protocol); 1190 if (err < 0) 1191 goto out_module; 1192 1193 local_bh_disable(); 1194 sock_prot_inuse_add(net, &netlink_proto, 1); 1195 local_bh_enable(); 1196 1197 nlk = nlk_sk(sock->sk); 1198 nlk->module = module; 1199 nlk->netlink_bind = bind; 1200 nlk->netlink_unbind = unbind; 1201 out: 1202 return err; 1203 1204 out_module: 1205 module_put(module); 1206 goto out; 1207 } 1208 1209 static void deferred_put_nlk_sk(struct rcu_head *head) 1210 { 1211 struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu); 1212 1213 sock_put(&nlk->sk); 1214 } 1215 1216 static int netlink_release(struct socket *sock) 1217 { 1218 struct sock *sk = sock->sk; 1219 struct netlink_sock *nlk; 1220 1221 if (!sk) 1222 return 0; 1223 1224 netlink_remove(sk); 1225 sock_orphan(sk); 1226 nlk = nlk_sk(sk); 1227 1228 /* 1229 * OK. Socket is unlinked, any packets that arrive now 1230 * will be purged. 1231 */ 1232 1233 /* must not acquire netlink_table_lock in any way again before unbind 1234 * and notifying genetlink is done as otherwise it might deadlock 1235 */ 1236 if (nlk->netlink_unbind) { 1237 int i; 1238 1239 for (i = 0; i < nlk->ngroups; i++) 1240 if (test_bit(i, nlk->groups)) 1241 nlk->netlink_unbind(sock_net(sk), i + 1); 1242 } 1243 if (sk->sk_protocol == NETLINK_GENERIC && 1244 atomic_dec_return(&genl_sk_destructing_cnt) == 0) 1245 wake_up(&genl_sk_destructing_waitq); 1246 1247 sock->sk = NULL; 1248 wake_up_interruptible_all(&nlk->wait); 1249 1250 skb_queue_purge(&sk->sk_write_queue); 1251 1252 if (nlk->portid) { 1253 struct netlink_notify n = { 1254 .net = sock_net(sk), 1255 .protocol = sk->sk_protocol, 1256 .portid = nlk->portid, 1257 }; 1258 atomic_notifier_call_chain(&netlink_chain, 1259 NETLINK_URELEASE, &n); 1260 } 1261 1262 module_put(nlk->module); 1263 1264 if (netlink_is_kernel(sk)) { 1265 netlink_table_grab(); 1266 BUG_ON(nl_table[sk->sk_protocol].registered == 0); 1267 if (--nl_table[sk->sk_protocol].registered == 0) { 1268 struct listeners *old; 1269 1270 old = nl_deref_protected(nl_table[sk->sk_protocol].listeners); 1271 RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL); 1272 kfree_rcu(old, rcu); 1273 nl_table[sk->sk_protocol].module = NULL; 1274 nl_table[sk->sk_protocol].bind = NULL; 1275 nl_table[sk->sk_protocol].unbind = NULL; 1276 nl_table[sk->sk_protocol].flags = 0; 1277 nl_table[sk->sk_protocol].registered = 0; 1278 } 1279 netlink_table_ungrab(); 1280 } 1281 1282 kfree(nlk->groups); 1283 nlk->groups = NULL; 1284 1285 local_bh_disable(); 1286 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1); 1287 local_bh_enable(); 1288 call_rcu(&nlk->rcu, deferred_put_nlk_sk); 1289 return 0; 1290 } 1291 1292 static int netlink_autobind(struct socket *sock) 1293 { 1294 struct sock *sk = sock->sk; 1295 struct net *net = sock_net(sk); 1296 struct netlink_table *table = &nl_table[sk->sk_protocol]; 1297 s32 portid = task_tgid_vnr(current); 1298 int err; 1299 static s32 rover = -4097; 1300 1301 retry: 1302 cond_resched(); 1303 rcu_read_lock(); 1304 if (__netlink_lookup(table, portid, net)) { 1305 /* Bind collision, search negative portid values. */ 1306 portid = rover--; 1307 if (rover > -4097) 1308 rover = -4097; 1309 rcu_read_unlock(); 1310 goto retry; 1311 } 1312 rcu_read_unlock(); 1313 1314 err = netlink_insert(sk, portid); 1315 if (err == -EADDRINUSE) 1316 goto retry; 1317 1318 /* If 2 threads race to autobind, that is fine. */ 1319 if (err == -EBUSY) 1320 err = 0; 1321 1322 return err; 1323 } 1324 1325 /** 1326 * __netlink_ns_capable - General netlink message capability test 1327 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. 1328 * @user_ns: The user namespace of the capability to use 1329 * @cap: The capability to use 1330 * 1331 * Test to see if the opener of the socket we received the message 1332 * from had when the netlink socket was created and the sender of the 1333 * message has has the capability @cap in the user namespace @user_ns. 1334 */ 1335 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, 1336 struct user_namespace *user_ns, int cap) 1337 { 1338 return ((nsp->flags & NETLINK_SKB_DST) || 1339 file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && 1340 ns_capable(user_ns, cap); 1341 } 1342 EXPORT_SYMBOL(__netlink_ns_capable); 1343 1344 /** 1345 * netlink_ns_capable - General netlink message capability test 1346 * @skb: socket buffer holding a netlink command from userspace 1347 * @user_ns: The user namespace of the capability to use 1348 * @cap: The capability to use 1349 * 1350 * Test to see if the opener of the socket we received the message 1351 * from had when the netlink socket was created and the sender of the 1352 * message has has the capability @cap in the user namespace @user_ns. 1353 */ 1354 bool netlink_ns_capable(const struct sk_buff *skb, 1355 struct user_namespace *user_ns, int cap) 1356 { 1357 return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); 1358 } 1359 EXPORT_SYMBOL(netlink_ns_capable); 1360 1361 /** 1362 * netlink_capable - Netlink global message capability test 1363 * @skb: socket buffer holding a netlink command from userspace 1364 * @cap: The capability to use 1365 * 1366 * Test to see if the opener of the socket we received the message 1367 * from had when the netlink socket was created and the sender of the 1368 * message has has the capability @cap in all user namespaces. 1369 */ 1370 bool netlink_capable(const struct sk_buff *skb, int cap) 1371 { 1372 return netlink_ns_capable(skb, &init_user_ns, cap); 1373 } 1374 EXPORT_SYMBOL(netlink_capable); 1375 1376 /** 1377 * netlink_net_capable - Netlink network namespace message capability test 1378 * @skb: socket buffer holding a netlink command from userspace 1379 * @cap: The capability to use 1380 * 1381 * Test to see if the opener of the socket we received the message 1382 * from had when the netlink socket was created and the sender of the 1383 * message has has the capability @cap over the network namespace of 1384 * the socket we received the message from. 1385 */ 1386 bool netlink_net_capable(const struct sk_buff *skb, int cap) 1387 { 1388 return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); 1389 } 1390 EXPORT_SYMBOL(netlink_net_capable); 1391 1392 static inline int netlink_allowed(const struct socket *sock, unsigned int flag) 1393 { 1394 return (nl_table[sock->sk->sk_protocol].flags & flag) || 1395 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); 1396 } 1397 1398 static void 1399 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions) 1400 { 1401 struct netlink_sock *nlk = nlk_sk(sk); 1402 1403 if (nlk->subscriptions && !subscriptions) 1404 __sk_del_bind_node(sk); 1405 else if (!nlk->subscriptions && subscriptions) 1406 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list); 1407 nlk->subscriptions = subscriptions; 1408 } 1409 1410 static int netlink_realloc_groups(struct sock *sk) 1411 { 1412 struct netlink_sock *nlk = nlk_sk(sk); 1413 unsigned int groups; 1414 unsigned long *new_groups; 1415 int err = 0; 1416 1417 netlink_table_grab(); 1418 1419 groups = nl_table[sk->sk_protocol].groups; 1420 if (!nl_table[sk->sk_protocol].registered) { 1421 err = -ENOENT; 1422 goto out_unlock; 1423 } 1424 1425 if (nlk->ngroups >= groups) 1426 goto out_unlock; 1427 1428 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC); 1429 if (new_groups == NULL) { 1430 err = -ENOMEM; 1431 goto out_unlock; 1432 } 1433 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0, 1434 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups)); 1435 1436 nlk->groups = new_groups; 1437 nlk->ngroups = groups; 1438 out_unlock: 1439 netlink_table_ungrab(); 1440 return err; 1441 } 1442 1443 static void netlink_undo_bind(int group, long unsigned int groups, 1444 struct sock *sk) 1445 { 1446 struct netlink_sock *nlk = nlk_sk(sk); 1447 int undo; 1448 1449 if (!nlk->netlink_unbind) 1450 return; 1451 1452 for (undo = 0; undo < group; undo++) 1453 if (test_bit(undo, &groups)) 1454 nlk->netlink_unbind(sock_net(sk), undo + 1); 1455 } 1456 1457 static int netlink_bind(struct socket *sock, struct sockaddr *addr, 1458 int addr_len) 1459 { 1460 struct sock *sk = sock->sk; 1461 struct net *net = sock_net(sk); 1462 struct netlink_sock *nlk = nlk_sk(sk); 1463 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 1464 int err; 1465 long unsigned int groups = nladdr->nl_groups; 1466 1467 if (addr_len < sizeof(struct sockaddr_nl)) 1468 return -EINVAL; 1469 1470 if (nladdr->nl_family != AF_NETLINK) 1471 return -EINVAL; 1472 1473 /* Only superuser is allowed to listen multicasts */ 1474 if (groups) { 1475 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) 1476 return -EPERM; 1477 err = netlink_realloc_groups(sk); 1478 if (err) 1479 return err; 1480 } 1481 1482 if (nlk->portid) 1483 if (nladdr->nl_pid != nlk->portid) 1484 return -EINVAL; 1485 1486 if (nlk->netlink_bind && groups) { 1487 int group; 1488 1489 for (group = 0; group < nlk->ngroups; group++) { 1490 if (!test_bit(group, &groups)) 1491 continue; 1492 err = nlk->netlink_bind(net, group + 1); 1493 if (!err) 1494 continue; 1495 netlink_undo_bind(group, groups, sk); 1496 return err; 1497 } 1498 } 1499 1500 if (!nlk->portid) { 1501 err = nladdr->nl_pid ? 1502 netlink_insert(sk, nladdr->nl_pid) : 1503 netlink_autobind(sock); 1504 if (err) { 1505 netlink_undo_bind(nlk->ngroups, groups, sk); 1506 return err; 1507 } 1508 } 1509 1510 if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0])) 1511 return 0; 1512 1513 netlink_table_grab(); 1514 netlink_update_subscriptions(sk, nlk->subscriptions + 1515 hweight32(groups) - 1516 hweight32(nlk->groups[0])); 1517 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups; 1518 netlink_update_listeners(sk); 1519 netlink_table_ungrab(); 1520 1521 return 0; 1522 } 1523 1524 static int netlink_connect(struct socket *sock, struct sockaddr *addr, 1525 int alen, int flags) 1526 { 1527 int err = 0; 1528 struct sock *sk = sock->sk; 1529 struct netlink_sock *nlk = nlk_sk(sk); 1530 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; 1531 1532 if (alen < sizeof(addr->sa_family)) 1533 return -EINVAL; 1534 1535 if (addr->sa_family == AF_UNSPEC) { 1536 sk->sk_state = NETLINK_UNCONNECTED; 1537 nlk->dst_portid = 0; 1538 nlk->dst_group = 0; 1539 return 0; 1540 } 1541 if (addr->sa_family != AF_NETLINK) 1542 return -EINVAL; 1543 1544 if ((nladdr->nl_groups || nladdr->nl_pid) && 1545 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) 1546 return -EPERM; 1547 1548 if (!nlk->portid) 1549 err = netlink_autobind(sock); 1550 1551 if (err == 0) { 1552 sk->sk_state = NETLINK_CONNECTED; 1553 nlk->dst_portid = nladdr->nl_pid; 1554 nlk->dst_group = ffs(nladdr->nl_groups); 1555 } 1556 1557 return err; 1558 } 1559 1560 static int netlink_getname(struct socket *sock, struct sockaddr *addr, 1561 int *addr_len, int peer) 1562 { 1563 struct sock *sk = sock->sk; 1564 struct netlink_sock *nlk = nlk_sk(sk); 1565 DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr); 1566 1567 nladdr->nl_family = AF_NETLINK; 1568 nladdr->nl_pad = 0; 1569 *addr_len = sizeof(*nladdr); 1570 1571 if (peer) { 1572 nladdr->nl_pid = nlk->dst_portid; 1573 nladdr->nl_groups = netlink_group_mask(nlk->dst_group); 1574 } else { 1575 nladdr->nl_pid = nlk->portid; 1576 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0; 1577 } 1578 return 0; 1579 } 1580 1581 static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid) 1582 { 1583 struct sock *sock; 1584 struct netlink_sock *nlk; 1585 1586 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid); 1587 if (!sock) 1588 return ERR_PTR(-ECONNREFUSED); 1589 1590 /* Don't bother queuing skb if kernel socket has no input function */ 1591 nlk = nlk_sk(sock); 1592 if (sock->sk_state == NETLINK_CONNECTED && 1593 nlk->dst_portid != nlk_sk(ssk)->portid) { 1594 sock_put(sock); 1595 return ERR_PTR(-ECONNREFUSED); 1596 } 1597 return sock; 1598 } 1599 1600 struct sock *netlink_getsockbyfilp(struct file *filp) 1601 { 1602 struct inode *inode = file_inode(filp); 1603 struct sock *sock; 1604 1605 if (!S_ISSOCK(inode->i_mode)) 1606 return ERR_PTR(-ENOTSOCK); 1607 1608 sock = SOCKET_I(inode)->sk; 1609 if (sock->sk_family != AF_NETLINK) 1610 return ERR_PTR(-EINVAL); 1611 1612 sock_hold(sock); 1613 return sock; 1614 } 1615 1616 static struct sk_buff *netlink_alloc_large_skb(unsigned int size, 1617 int broadcast) 1618 { 1619 struct sk_buff *skb; 1620 void *data; 1621 1622 if (size <= NLMSG_GOODSIZE || broadcast) 1623 return alloc_skb(size, GFP_KERNEL); 1624 1625 size = SKB_DATA_ALIGN(size) + 1626 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); 1627 1628 data = vmalloc(size); 1629 if (data == NULL) 1630 return NULL; 1631 1632 skb = build_skb(data, size); 1633 if (skb == NULL) 1634 vfree(data); 1635 else { 1636 skb->head_frag = 0; 1637 skb->destructor = netlink_skb_destructor; 1638 } 1639 1640 return skb; 1641 } 1642 1643 /* 1644 * Attach a skb to a netlink socket. 1645 * The caller must hold a reference to the destination socket. On error, the 1646 * reference is dropped. The skb is not send to the destination, just all 1647 * all error checks are performed and memory in the queue is reserved. 1648 * Return values: 1649 * < 0: error. skb freed, reference to sock dropped. 1650 * 0: continue 1651 * 1: repeat lookup - reference dropped while waiting for socket memory. 1652 */ 1653 int netlink_attachskb(struct sock *sk, struct sk_buff *skb, 1654 long *timeo, struct sock *ssk) 1655 { 1656 struct netlink_sock *nlk; 1657 1658 nlk = nlk_sk(sk); 1659 1660 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 1661 test_bit(NETLINK_CONGESTED, &nlk->state)) && 1662 !netlink_skb_is_mmaped(skb)) { 1663 DECLARE_WAITQUEUE(wait, current); 1664 if (!*timeo) { 1665 if (!ssk || netlink_is_kernel(ssk)) 1666 netlink_overrun(sk); 1667 sock_put(sk); 1668 kfree_skb(skb); 1669 return -EAGAIN; 1670 } 1671 1672 __set_current_state(TASK_INTERRUPTIBLE); 1673 add_wait_queue(&nlk->wait, &wait); 1674 1675 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || 1676 test_bit(NETLINK_CONGESTED, &nlk->state)) && 1677 !sock_flag(sk, SOCK_DEAD)) 1678 *timeo = schedule_timeout(*timeo); 1679 1680 __set_current_state(TASK_RUNNING); 1681 remove_wait_queue(&nlk->wait, &wait); 1682 sock_put(sk); 1683 1684 if (signal_pending(current)) { 1685 kfree_skb(skb); 1686 return sock_intr_errno(*timeo); 1687 } 1688 return 1; 1689 } 1690 netlink_skb_set_owner_r(skb, sk); 1691 return 0; 1692 } 1693 1694 static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) 1695 { 1696 int len = skb->len; 1697 1698 netlink_deliver_tap(skb); 1699 1700 #ifdef CONFIG_NETLINK_MMAP 1701 if (netlink_skb_is_mmaped(skb)) 1702 netlink_queue_mmaped_skb(sk, skb); 1703 else if (netlink_rx_is_mmaped(sk)) 1704 netlink_ring_set_copied(sk, skb); 1705 else 1706 #endif /* CONFIG_NETLINK_MMAP */ 1707 skb_queue_tail(&sk->sk_receive_queue, skb); 1708 sk->sk_data_ready(sk); 1709 return len; 1710 } 1711 1712 int netlink_sendskb(struct sock *sk, struct sk_buff *skb) 1713 { 1714 int len = __netlink_sendskb(sk, skb); 1715 1716 sock_put(sk); 1717 return len; 1718 } 1719 1720 void netlink_detachskb(struct sock *sk, struct sk_buff *skb) 1721 { 1722 kfree_skb(skb); 1723 sock_put(sk); 1724 } 1725 1726 static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation) 1727 { 1728 int delta; 1729 1730 WARN_ON(skb->sk != NULL); 1731 if (netlink_skb_is_mmaped(skb)) 1732 return skb; 1733 1734 delta = skb->end - skb->tail; 1735 if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize) 1736 return skb; 1737 1738 if (skb_shared(skb)) { 1739 struct sk_buff *nskb = skb_clone(skb, allocation); 1740 if (!nskb) 1741 return skb; 1742 consume_skb(skb); 1743 skb = nskb; 1744 } 1745 1746 if (!pskb_expand_head(skb, 0, -delta, allocation)) 1747 skb->truesize -= delta; 1748 1749 return skb; 1750 } 1751 1752 static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb, 1753 struct sock *ssk) 1754 { 1755 int ret; 1756 struct netlink_sock *nlk = nlk_sk(sk); 1757 1758 ret = -ECONNREFUSED; 1759 if (nlk->netlink_rcv != NULL) { 1760 ret = skb->len; 1761 netlink_skb_set_owner_r(skb, sk); 1762 NETLINK_CB(skb).sk = ssk; 1763 netlink_deliver_tap_kernel(sk, ssk, skb); 1764 nlk->netlink_rcv(skb); 1765 consume_skb(skb); 1766 } else { 1767 kfree_skb(skb); 1768 } 1769 sock_put(sk); 1770 return ret; 1771 } 1772 1773 int netlink_unicast(struct sock *ssk, struct sk_buff *skb, 1774 u32 portid, int nonblock) 1775 { 1776 struct sock *sk; 1777 int err; 1778 long timeo; 1779 1780 skb = netlink_trim(skb, gfp_any()); 1781 1782 timeo = sock_sndtimeo(ssk, nonblock); 1783 retry: 1784 sk = netlink_getsockbyportid(ssk, portid); 1785 if (IS_ERR(sk)) { 1786 kfree_skb(skb); 1787 return PTR_ERR(sk); 1788 } 1789 if (netlink_is_kernel(sk)) 1790 return netlink_unicast_kernel(sk, skb, ssk); 1791 1792 if (sk_filter(sk, skb)) { 1793 err = skb->len; 1794 kfree_skb(skb); 1795 sock_put(sk); 1796 return err; 1797 } 1798 1799 err = netlink_attachskb(sk, skb, &timeo, ssk); 1800 if (err == 1) 1801 goto retry; 1802 if (err) 1803 return err; 1804 1805 return netlink_sendskb(sk, skb); 1806 } 1807 EXPORT_SYMBOL(netlink_unicast); 1808 1809 struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size, 1810 u32 dst_portid, gfp_t gfp_mask) 1811 { 1812 #ifdef CONFIG_NETLINK_MMAP 1813 struct sock *sk = NULL; 1814 struct sk_buff *skb; 1815 struct netlink_ring *ring; 1816 struct nl_mmap_hdr *hdr; 1817 unsigned int maxlen; 1818 1819 sk = netlink_getsockbyportid(ssk, dst_portid); 1820 if (IS_ERR(sk)) 1821 goto out; 1822 1823 ring = &nlk_sk(sk)->rx_ring; 1824 /* fast-path without atomic ops for common case: non-mmaped receiver */ 1825 if (ring->pg_vec == NULL) 1826 goto out_put; 1827 1828 if (ring->frame_size - NL_MMAP_HDRLEN < size) 1829 goto out_put; 1830 1831 skb = alloc_skb_head(gfp_mask); 1832 if (skb == NULL) 1833 goto err1; 1834 1835 spin_lock_bh(&sk->sk_receive_queue.lock); 1836 /* check again under lock */ 1837 if (ring->pg_vec == NULL) 1838 goto out_free; 1839 1840 /* check again under lock */ 1841 maxlen = ring->frame_size - NL_MMAP_HDRLEN; 1842 if (maxlen < size) 1843 goto out_free; 1844 1845 netlink_forward_ring(ring); 1846 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); 1847 if (hdr == NULL) 1848 goto err2; 1849 netlink_ring_setup_skb(skb, sk, ring, hdr); 1850 netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); 1851 atomic_inc(&ring->pending); 1852 netlink_increment_head(ring); 1853 1854 spin_unlock_bh(&sk->sk_receive_queue.lock); 1855 return skb; 1856 1857 err2: 1858 kfree_skb(skb); 1859 spin_unlock_bh(&sk->sk_receive_queue.lock); 1860 netlink_overrun(sk); 1861 err1: 1862 sock_put(sk); 1863 return NULL; 1864 1865 out_free: 1866 kfree_skb(skb); 1867 spin_unlock_bh(&sk->sk_receive_queue.lock); 1868 out_put: 1869 sock_put(sk); 1870 out: 1871 #endif 1872 return alloc_skb(size, gfp_mask); 1873 } 1874 EXPORT_SYMBOL_GPL(netlink_alloc_skb); 1875 1876 int netlink_has_listeners(struct sock *sk, unsigned int group) 1877 { 1878 int res = 0; 1879 struct listeners *listeners; 1880 1881 BUG_ON(!netlink_is_kernel(sk)); 1882 1883 rcu_read_lock(); 1884 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners); 1885 1886 if (listeners && group - 1 < nl_table[sk->sk_protocol].groups) 1887 res = test_bit(group - 1, listeners->masks); 1888 1889 rcu_read_unlock(); 1890 1891 return res; 1892 } 1893 EXPORT_SYMBOL_GPL(netlink_has_listeners); 1894 1895 static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb) 1896 { 1897 struct netlink_sock *nlk = nlk_sk(sk); 1898 1899 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && 1900 !test_bit(NETLINK_CONGESTED, &nlk->state)) { 1901 netlink_skb_set_owner_r(skb, sk); 1902 __netlink_sendskb(sk, skb); 1903 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1); 1904 } 1905 return -1; 1906 } 1907 1908 struct netlink_broadcast_data { 1909 struct sock *exclude_sk; 1910 struct net *net; 1911 u32 portid; 1912 u32 group; 1913 int failure; 1914 int delivery_failure; 1915 int congested; 1916 int delivered; 1917 gfp_t allocation; 1918 struct sk_buff *skb, *skb2; 1919 int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data); 1920 void *tx_data; 1921 }; 1922 1923 static void do_one_broadcast(struct sock *sk, 1924 struct netlink_broadcast_data *p) 1925 { 1926 struct netlink_sock *nlk = nlk_sk(sk); 1927 int val; 1928 1929 if (p->exclude_sk == sk) 1930 return; 1931 1932 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups || 1933 !test_bit(p->group - 1, nlk->groups)) 1934 return; 1935 1936 if (!net_eq(sock_net(sk), p->net)) 1937 return; 1938 1939 if (p->failure) { 1940 netlink_overrun(sk); 1941 return; 1942 } 1943 1944 sock_hold(sk); 1945 if (p->skb2 == NULL) { 1946 if (skb_shared(p->skb)) { 1947 p->skb2 = skb_clone(p->skb, p->allocation); 1948 } else { 1949 p->skb2 = skb_get(p->skb); 1950 /* 1951 * skb ownership may have been set when 1952 * delivered to a previous socket. 1953 */ 1954 skb_orphan(p->skb2); 1955 } 1956 } 1957 if (p->skb2 == NULL) { 1958 netlink_overrun(sk); 1959 /* Clone failed. Notify ALL listeners. */ 1960 p->failure = 1; 1961 if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) 1962 p->delivery_failure = 1; 1963 } else if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) { 1964 kfree_skb(p->skb2); 1965 p->skb2 = NULL; 1966 } else if (sk_filter(sk, p->skb2)) { 1967 kfree_skb(p->skb2); 1968 p->skb2 = NULL; 1969 } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) { 1970 netlink_overrun(sk); 1971 if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR) 1972 p->delivery_failure = 1; 1973 } else { 1974 p->congested |= val; 1975 p->delivered = 1; 1976 p->skb2 = NULL; 1977 } 1978 sock_put(sk); 1979 } 1980 1981 int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid, 1982 u32 group, gfp_t allocation, 1983 int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data), 1984 void *filter_data) 1985 { 1986 struct net *net = sock_net(ssk); 1987 struct netlink_broadcast_data info; 1988 struct sock *sk; 1989 1990 skb = netlink_trim(skb, allocation); 1991 1992 info.exclude_sk = ssk; 1993 info.net = net; 1994 info.portid = portid; 1995 info.group = group; 1996 info.failure = 0; 1997 info.delivery_failure = 0; 1998 info.congested = 0; 1999 info.delivered = 0; 2000 info.allocation = allocation; 2001 info.skb = skb; 2002 info.skb2 = NULL; 2003 info.tx_filter = filter; 2004 info.tx_data = filter_data; 2005 2006 /* While we sleep in clone, do not allow to change socket list */ 2007 2008 netlink_lock_table(); 2009 2010 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) 2011 do_one_broadcast(sk, &info); 2012 2013 consume_skb(skb); 2014 2015 netlink_unlock_table(); 2016 2017 if (info.delivery_failure) { 2018 kfree_skb(info.skb2); 2019 return -ENOBUFS; 2020 } 2021 consume_skb(info.skb2); 2022 2023 if (info.delivered) { 2024 if (info.congested && (allocation & __GFP_WAIT)) 2025 yield(); 2026 return 0; 2027 } 2028 return -ESRCH; 2029 } 2030 EXPORT_SYMBOL(netlink_broadcast_filtered); 2031 2032 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid, 2033 u32 group, gfp_t allocation) 2034 { 2035 return netlink_broadcast_filtered(ssk, skb, portid, group, allocation, 2036 NULL, NULL); 2037 } 2038 EXPORT_SYMBOL(netlink_broadcast); 2039 2040 struct netlink_set_err_data { 2041 struct sock *exclude_sk; 2042 u32 portid; 2043 u32 group; 2044 int code; 2045 }; 2046 2047 static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p) 2048 { 2049 struct netlink_sock *nlk = nlk_sk(sk); 2050 int ret = 0; 2051 2052 if (sk == p->exclude_sk) 2053 goto out; 2054 2055 if (!net_eq(sock_net(sk), sock_net(p->exclude_sk))) 2056 goto out; 2057 2058 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups || 2059 !test_bit(p->group - 1, nlk->groups)) 2060 goto out; 2061 2062 if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) { 2063 ret = 1; 2064 goto out; 2065 } 2066 2067 sk->sk_err = p->code; 2068 sk->sk_error_report(sk); 2069 out: 2070 return ret; 2071 } 2072 2073 /** 2074 * netlink_set_err - report error to broadcast listeners 2075 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create() 2076 * @portid: the PORTID of a process that we want to skip (if any) 2077 * @group: the broadcast group that will notice the error 2078 * @code: error code, must be negative (as usual in kernelspace) 2079 * 2080 * This function returns the number of broadcast listeners that have set the 2081 * NETLINK_RECV_NO_ENOBUFS socket option. 2082 */ 2083 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code) 2084 { 2085 struct netlink_set_err_data info; 2086 struct sock *sk; 2087 int ret = 0; 2088 2089 info.exclude_sk = ssk; 2090 info.portid = portid; 2091 info.group = group; 2092 /* sk->sk_err wants a positive error value */ 2093 info.code = -code; 2094 2095 read_lock(&nl_table_lock); 2096 2097 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list) 2098 ret += do_one_set_err(sk, &info); 2099 2100 read_unlock(&nl_table_lock); 2101 return ret; 2102 } 2103 EXPORT_SYMBOL(netlink_set_err); 2104 2105 /* must be called with netlink table grabbed */ 2106 static void netlink_update_socket_mc(struct netlink_sock *nlk, 2107 unsigned int group, 2108 int is_new) 2109 { 2110 int old, new = !!is_new, subscriptions; 2111 2112 old = test_bit(group - 1, nlk->groups); 2113 subscriptions = nlk->subscriptions - old + new; 2114 if (new) 2115 __set_bit(group - 1, nlk->groups); 2116 else 2117 __clear_bit(group - 1, nlk->groups); 2118 netlink_update_subscriptions(&nlk->sk, subscriptions); 2119 netlink_update_listeners(&nlk->sk); 2120 } 2121 2122 static int netlink_setsockopt(struct socket *sock, int level, int optname, 2123 char __user *optval, unsigned int optlen) 2124 { 2125 struct sock *sk = sock->sk; 2126 struct netlink_sock *nlk = nlk_sk(sk); 2127 unsigned int val = 0; 2128 int err; 2129 2130 if (level != SOL_NETLINK) 2131 return -ENOPROTOOPT; 2132 2133 if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING && 2134 optlen >= sizeof(int) && 2135 get_user(val, (unsigned int __user *)optval)) 2136 return -EFAULT; 2137 2138 switch (optname) { 2139 case NETLINK_PKTINFO: 2140 if (val) 2141 nlk->flags |= NETLINK_RECV_PKTINFO; 2142 else 2143 nlk->flags &= ~NETLINK_RECV_PKTINFO; 2144 err = 0; 2145 break; 2146 case NETLINK_ADD_MEMBERSHIP: 2147 case NETLINK_DROP_MEMBERSHIP: { 2148 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) 2149 return -EPERM; 2150 err = netlink_realloc_groups(sk); 2151 if (err) 2152 return err; 2153 if (!val || val - 1 >= nlk->ngroups) 2154 return -EINVAL; 2155 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) { 2156 err = nlk->netlink_bind(sock_net(sk), val); 2157 if (err) 2158 return err; 2159 } 2160 netlink_table_grab(); 2161 netlink_update_socket_mc(nlk, val, 2162 optname == NETLINK_ADD_MEMBERSHIP); 2163 netlink_table_ungrab(); 2164 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind) 2165 nlk->netlink_unbind(sock_net(sk), val); 2166 2167 err = 0; 2168 break; 2169 } 2170 case NETLINK_BROADCAST_ERROR: 2171 if (val) 2172 nlk->flags |= NETLINK_BROADCAST_SEND_ERROR; 2173 else 2174 nlk->flags &= ~NETLINK_BROADCAST_SEND_ERROR; 2175 err = 0; 2176 break; 2177 case NETLINK_NO_ENOBUFS: 2178 if (val) { 2179 nlk->flags |= NETLINK_RECV_NO_ENOBUFS; 2180 clear_bit(NETLINK_CONGESTED, &nlk->state); 2181 wake_up_interruptible(&nlk->wait); 2182 } else { 2183 nlk->flags &= ~NETLINK_RECV_NO_ENOBUFS; 2184 } 2185 err = 0; 2186 break; 2187 #ifdef CONFIG_NETLINK_MMAP 2188 case NETLINK_RX_RING: 2189 case NETLINK_TX_RING: { 2190 struct nl_mmap_req req; 2191 2192 /* Rings might consume more memory than queue limits, require 2193 * CAP_NET_ADMIN. 2194 */ 2195 if (!capable(CAP_NET_ADMIN)) 2196 return -EPERM; 2197 if (optlen < sizeof(req)) 2198 return -EINVAL; 2199 if (copy_from_user(&req, optval, sizeof(req))) 2200 return -EFAULT; 2201 err = netlink_set_ring(sk, &req, false, 2202 optname == NETLINK_TX_RING); 2203 break; 2204 } 2205 #endif /* CONFIG_NETLINK_MMAP */ 2206 default: 2207 err = -ENOPROTOOPT; 2208 } 2209 return err; 2210 } 2211 2212 static int netlink_getsockopt(struct socket *sock, int level, int optname, 2213 char __user *optval, int __user *optlen) 2214 { 2215 struct sock *sk = sock->sk; 2216 struct netlink_sock *nlk = nlk_sk(sk); 2217 int len, val, err; 2218 2219 if (level != SOL_NETLINK) 2220 return -ENOPROTOOPT; 2221 2222 if (get_user(len, optlen)) 2223 return -EFAULT; 2224 if (len < 0) 2225 return -EINVAL; 2226 2227 switch (optname) { 2228 case NETLINK_PKTINFO: 2229 if (len < sizeof(int)) 2230 return -EINVAL; 2231 len = sizeof(int); 2232 val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0; 2233 if (put_user(len, optlen) || 2234 put_user(val, optval)) 2235 return -EFAULT; 2236 err = 0; 2237 break; 2238 case NETLINK_BROADCAST_ERROR: 2239 if (len < sizeof(int)) 2240 return -EINVAL; 2241 len = sizeof(int); 2242 val = nlk->flags & NETLINK_BROADCAST_SEND_ERROR ? 1 : 0; 2243 if (put_user(len, optlen) || 2244 put_user(val, optval)) 2245 return -EFAULT; 2246 err = 0; 2247 break; 2248 case NETLINK_NO_ENOBUFS: 2249 if (len < sizeof(int)) 2250 return -EINVAL; 2251 len = sizeof(int); 2252 val = nlk->flags & NETLINK_RECV_NO_ENOBUFS ? 1 : 0; 2253 if (put_user(len, optlen) || 2254 put_user(val, optval)) 2255 return -EFAULT; 2256 err = 0; 2257 break; 2258 default: 2259 err = -ENOPROTOOPT; 2260 } 2261 return err; 2262 } 2263 2264 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) 2265 { 2266 struct nl_pktinfo info; 2267 2268 info.group = NETLINK_CB(skb).dst_group; 2269 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info); 2270 } 2271 2272 static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) 2273 { 2274 struct sock *sk = sock->sk; 2275 struct netlink_sock *nlk = nlk_sk(sk); 2276 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name); 2277 u32 dst_portid; 2278 u32 dst_group; 2279 struct sk_buff *skb; 2280 int err; 2281 struct scm_cookie scm; 2282 u32 netlink_skb_flags = 0; 2283 2284 if (msg->msg_flags&MSG_OOB) 2285 return -EOPNOTSUPP; 2286 2287 err = scm_send(sock, msg, &scm, true); 2288 if (err < 0) 2289 return err; 2290 2291 if (msg->msg_namelen) { 2292 err = -EINVAL; 2293 if (addr->nl_family != AF_NETLINK) 2294 goto out; 2295 dst_portid = addr->nl_pid; 2296 dst_group = ffs(addr->nl_groups); 2297 err = -EPERM; 2298 if ((dst_group || dst_portid) && 2299 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) 2300 goto out; 2301 netlink_skb_flags |= NETLINK_SKB_DST; 2302 } else { 2303 dst_portid = nlk->dst_portid; 2304 dst_group = nlk->dst_group; 2305 } 2306 2307 if (!nlk->portid) { 2308 err = netlink_autobind(sock); 2309 if (err) 2310 goto out; 2311 } 2312 2313 /* It's a really convoluted way for userland to ask for mmaped 2314 * sendmsg(), but that's what we've got... 2315 */ 2316 if (netlink_tx_is_mmaped(sk) && 2317 msg->msg_iter.type == ITER_IOVEC && 2318 msg->msg_iter.nr_segs == 1 && 2319 msg->msg_iter.iov->iov_base == NULL) { 2320 err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, 2321 &scm); 2322 goto out; 2323 } 2324 2325 err = -EMSGSIZE; 2326 if (len > sk->sk_sndbuf - 32) 2327 goto out; 2328 err = -ENOBUFS; 2329 skb = netlink_alloc_large_skb(len, dst_group); 2330 if (skb == NULL) 2331 goto out; 2332 2333 NETLINK_CB(skb).portid = nlk->portid; 2334 NETLINK_CB(skb).dst_group = dst_group; 2335 NETLINK_CB(skb).creds = scm.creds; 2336 NETLINK_CB(skb).flags = netlink_skb_flags; 2337 2338 err = -EFAULT; 2339 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 2340 kfree_skb(skb); 2341 goto out; 2342 } 2343 2344 err = security_netlink_send(sk, skb); 2345 if (err) { 2346 kfree_skb(skb); 2347 goto out; 2348 } 2349 2350 if (dst_group) { 2351 atomic_inc(&skb->users); 2352 netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL); 2353 } 2354 err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT); 2355 2356 out: 2357 scm_destroy(&scm); 2358 return err; 2359 } 2360 2361 static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, 2362 int flags) 2363 { 2364 struct scm_cookie scm; 2365 struct sock *sk = sock->sk; 2366 struct netlink_sock *nlk = nlk_sk(sk); 2367 int noblock = flags&MSG_DONTWAIT; 2368 size_t copied; 2369 struct sk_buff *skb, *data_skb; 2370 int err, ret; 2371 2372 if (flags&MSG_OOB) 2373 return -EOPNOTSUPP; 2374 2375 copied = 0; 2376 2377 skb = skb_recv_datagram(sk, flags, noblock, &err); 2378 if (skb == NULL) 2379 goto out; 2380 2381 data_skb = skb; 2382 2383 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES 2384 if (unlikely(skb_shinfo(skb)->frag_list)) { 2385 /* 2386 * If this skb has a frag_list, then here that means that we 2387 * will have to use the frag_list skb's data for compat tasks 2388 * and the regular skb's data for normal (non-compat) tasks. 2389 * 2390 * If we need to send the compat skb, assign it to the 2391 * 'data_skb' variable so that it will be used below for data 2392 * copying. We keep 'skb' for everything else, including 2393 * freeing both later. 2394 */ 2395 if (flags & MSG_CMSG_COMPAT) 2396 data_skb = skb_shinfo(skb)->frag_list; 2397 } 2398 #endif 2399 2400 /* Record the max length of recvmsg() calls for future allocations */ 2401 nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); 2402 nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, 2403 16384); 2404 2405 copied = data_skb->len; 2406 if (len < copied) { 2407 msg->msg_flags |= MSG_TRUNC; 2408 copied = len; 2409 } 2410 2411 skb_reset_transport_header(data_skb); 2412 err = skb_copy_datagram_msg(data_skb, 0, msg, copied); 2413 2414 if (msg->msg_name) { 2415 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name); 2416 addr->nl_family = AF_NETLINK; 2417 addr->nl_pad = 0; 2418 addr->nl_pid = NETLINK_CB(skb).portid; 2419 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group); 2420 msg->msg_namelen = sizeof(*addr); 2421 } 2422 2423 if (nlk->flags & NETLINK_RECV_PKTINFO) 2424 netlink_cmsg_recv_pktinfo(msg, skb); 2425 2426 memset(&scm, 0, sizeof(scm)); 2427 scm.creds = *NETLINK_CREDS(skb); 2428 if (flags & MSG_TRUNC) 2429 copied = data_skb->len; 2430 2431 skb_free_datagram(sk, skb); 2432 2433 if (nlk->cb_running && 2434 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) { 2435 ret = netlink_dump(sk); 2436 if (ret) { 2437 sk->sk_err = -ret; 2438 sk->sk_error_report(sk); 2439 } 2440 } 2441 2442 scm_recv(sock, msg, &scm, flags); 2443 out: 2444 netlink_rcv_wake(sk); 2445 return err ? : copied; 2446 } 2447 2448 static void netlink_data_ready(struct sock *sk) 2449 { 2450 BUG(); 2451 } 2452 2453 /* 2454 * We export these functions to other modules. They provide a 2455 * complete set of kernel non-blocking support for message 2456 * queueing. 2457 */ 2458 2459 struct sock * 2460 __netlink_kernel_create(struct net *net, int unit, struct module *module, 2461 struct netlink_kernel_cfg *cfg) 2462 { 2463 struct socket *sock; 2464 struct sock *sk; 2465 struct netlink_sock *nlk; 2466 struct listeners *listeners = NULL; 2467 struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL; 2468 unsigned int groups; 2469 2470 BUG_ON(!nl_table); 2471 2472 if (unit < 0 || unit >= MAX_LINKS) 2473 return NULL; 2474 2475 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock)) 2476 return NULL; 2477 2478 /* 2479 * We have to just have a reference on the net from sk, but don't 2480 * get_net it. Besides, we cannot get and then put the net here. 2481 * So we create one inside init_net and the move it to net. 2482 */ 2483 2484 if (__netlink_create(&init_net, sock, cb_mutex, unit) < 0) 2485 goto out_sock_release_nosk; 2486 2487 sk = sock->sk; 2488 sk_change_net(sk, net); 2489 2490 if (!cfg || cfg->groups < 32) 2491 groups = 32; 2492 else 2493 groups = cfg->groups; 2494 2495 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL); 2496 if (!listeners) 2497 goto out_sock_release; 2498 2499 sk->sk_data_ready = netlink_data_ready; 2500 if (cfg && cfg->input) 2501 nlk_sk(sk)->netlink_rcv = cfg->input; 2502 2503 if (netlink_insert(sk, 0)) 2504 goto out_sock_release; 2505 2506 nlk = nlk_sk(sk); 2507 nlk->flags |= NETLINK_KERNEL_SOCKET; 2508 2509 netlink_table_grab(); 2510 if (!nl_table[unit].registered) { 2511 nl_table[unit].groups = groups; 2512 rcu_assign_pointer(nl_table[unit].listeners, listeners); 2513 nl_table[unit].cb_mutex = cb_mutex; 2514 nl_table[unit].module = module; 2515 if (cfg) { 2516 nl_table[unit].bind = cfg->bind; 2517 nl_table[unit].unbind = cfg->unbind; 2518 nl_table[unit].flags = cfg->flags; 2519 if (cfg->compare) 2520 nl_table[unit].compare = cfg->compare; 2521 } 2522 nl_table[unit].registered = 1; 2523 } else { 2524 kfree(listeners); 2525 nl_table[unit].registered++; 2526 } 2527 netlink_table_ungrab(); 2528 return sk; 2529 2530 out_sock_release: 2531 kfree(listeners); 2532 netlink_kernel_release(sk); 2533 return NULL; 2534 2535 out_sock_release_nosk: 2536 sock_release(sock); 2537 return NULL; 2538 } 2539 EXPORT_SYMBOL(__netlink_kernel_create); 2540 2541 void 2542 netlink_kernel_release(struct sock *sk) 2543 { 2544 sk_release_kernel(sk); 2545 } 2546 EXPORT_SYMBOL(netlink_kernel_release); 2547 2548 int __netlink_change_ngroups(struct sock *sk, unsigned int groups) 2549 { 2550 struct listeners *new, *old; 2551 struct netlink_table *tbl = &nl_table[sk->sk_protocol]; 2552 2553 if (groups < 32) 2554 groups = 32; 2555 2556 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) { 2557 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC); 2558 if (!new) 2559 return -ENOMEM; 2560 old = nl_deref_protected(tbl->listeners); 2561 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups)); 2562 rcu_assign_pointer(tbl->listeners, new); 2563 2564 kfree_rcu(old, rcu); 2565 } 2566 tbl->groups = groups; 2567 2568 return 0; 2569 } 2570 2571 /** 2572 * netlink_change_ngroups - change number of multicast groups 2573 * 2574 * This changes the number of multicast groups that are available 2575 * on a certain netlink family. Note that it is not possible to 2576 * change the number of groups to below 32. Also note that it does 2577 * not implicitly call netlink_clear_multicast_users() when the 2578 * number of groups is reduced. 2579 * 2580 * @sk: The kernel netlink socket, as returned by netlink_kernel_create(). 2581 * @groups: The new number of groups. 2582 */ 2583 int netlink_change_ngroups(struct sock *sk, unsigned int groups) 2584 { 2585 int err; 2586 2587 netlink_table_grab(); 2588 err = __netlink_change_ngroups(sk, groups); 2589 netlink_table_ungrab(); 2590 2591 return err; 2592 } 2593 2594 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) 2595 { 2596 struct sock *sk; 2597 struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; 2598 2599 sk_for_each_bound(sk, &tbl->mc_list) 2600 netlink_update_socket_mc(nlk_sk(sk), group, 0); 2601 } 2602 2603 struct nlmsghdr * 2604 __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags) 2605 { 2606 struct nlmsghdr *nlh; 2607 int size = nlmsg_msg_size(len); 2608 2609 nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size)); 2610 nlh->nlmsg_type = type; 2611 nlh->nlmsg_len = size; 2612 nlh->nlmsg_flags = flags; 2613 nlh->nlmsg_pid = portid; 2614 nlh->nlmsg_seq = seq; 2615 if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0) 2616 memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size); 2617 return nlh; 2618 } 2619 EXPORT_SYMBOL(__nlmsg_put); 2620 2621 /* 2622 * It looks a bit ugly. 2623 * It would be better to create kernel thread. 2624 */ 2625 2626 static int netlink_dump(struct sock *sk) 2627 { 2628 struct netlink_sock *nlk = nlk_sk(sk); 2629 struct netlink_callback *cb; 2630 struct sk_buff *skb = NULL; 2631 struct nlmsghdr *nlh; 2632 int len, err = -ENOBUFS; 2633 int alloc_size; 2634 2635 mutex_lock(nlk->cb_mutex); 2636 if (!nlk->cb_running) { 2637 err = -EINVAL; 2638 goto errout_skb; 2639 } 2640 2641 cb = &nlk->cb; 2642 alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); 2643 2644 if (!netlink_rx_is_mmaped(sk) && 2645 atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) 2646 goto errout_skb; 2647 2648 /* NLMSG_GOODSIZE is small to avoid high order allocations being 2649 * required, but it makes sense to _attempt_ a 16K bytes allocation 2650 * to reduce number of system calls on dump operations, if user 2651 * ever provided a big enough buffer. 2652 */ 2653 if (alloc_size < nlk->max_recvmsg_len) { 2654 skb = netlink_alloc_skb(sk, 2655 nlk->max_recvmsg_len, 2656 nlk->portid, 2657 GFP_KERNEL | 2658 __GFP_NOWARN | 2659 __GFP_NORETRY); 2660 /* available room should be exact amount to avoid MSG_TRUNC */ 2661 if (skb) 2662 skb_reserve(skb, skb_tailroom(skb) - 2663 nlk->max_recvmsg_len); 2664 } 2665 if (!skb) 2666 skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, 2667 GFP_KERNEL); 2668 if (!skb) 2669 goto errout_skb; 2670 netlink_skb_set_owner_r(skb, sk); 2671 2672 len = cb->dump(skb, cb); 2673 2674 if (len > 0) { 2675 mutex_unlock(nlk->cb_mutex); 2676 2677 if (sk_filter(sk, skb)) 2678 kfree_skb(skb); 2679 else 2680 __netlink_sendskb(sk, skb); 2681 return 0; 2682 } 2683 2684 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI); 2685 if (!nlh) 2686 goto errout_skb; 2687 2688 nl_dump_check_consistent(cb, nlh); 2689 2690 memcpy(nlmsg_data(nlh), &len, sizeof(len)); 2691 2692 if (sk_filter(sk, skb)) 2693 kfree_skb(skb); 2694 else 2695 __netlink_sendskb(sk, skb); 2696 2697 if (cb->done) 2698 cb->done(cb); 2699 2700 nlk->cb_running = false; 2701 mutex_unlock(nlk->cb_mutex); 2702 module_put(cb->module); 2703 consume_skb(cb->skb); 2704 return 0; 2705 2706 errout_skb: 2707 mutex_unlock(nlk->cb_mutex); 2708 kfree_skb(skb); 2709 return err; 2710 } 2711 2712 int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, 2713 const struct nlmsghdr *nlh, 2714 struct netlink_dump_control *control) 2715 { 2716 struct netlink_callback *cb; 2717 struct sock *sk; 2718 struct netlink_sock *nlk; 2719 int ret; 2720 2721 /* Memory mapped dump requests need to be copied to avoid looping 2722 * on the pending state in netlink_mmap_sendmsg() while the CB hold 2723 * a reference to the skb. 2724 */ 2725 if (netlink_skb_is_mmaped(skb)) { 2726 skb = skb_copy(skb, GFP_KERNEL); 2727 if (skb == NULL) 2728 return -ENOBUFS; 2729 } else 2730 atomic_inc(&skb->users); 2731 2732 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid); 2733 if (sk == NULL) { 2734 ret = -ECONNREFUSED; 2735 goto error_free; 2736 } 2737 2738 nlk = nlk_sk(sk); 2739 mutex_lock(nlk->cb_mutex); 2740 /* A dump is in progress... */ 2741 if (nlk->cb_running) { 2742 ret = -EBUSY; 2743 goto error_unlock; 2744 } 2745 /* add reference of module which cb->dump belongs to */ 2746 if (!try_module_get(control->module)) { 2747 ret = -EPROTONOSUPPORT; 2748 goto error_unlock; 2749 } 2750 2751 cb = &nlk->cb; 2752 memset(cb, 0, sizeof(*cb)); 2753 cb->dump = control->dump; 2754 cb->done = control->done; 2755 cb->nlh = nlh; 2756 cb->data = control->data; 2757 cb->module = control->module; 2758 cb->min_dump_alloc = control->min_dump_alloc; 2759 cb->skb = skb; 2760 2761 nlk->cb_running = true; 2762 2763 mutex_unlock(nlk->cb_mutex); 2764 2765 ret = netlink_dump(sk); 2766 sock_put(sk); 2767 2768 if (ret) 2769 return ret; 2770 2771 /* We successfully started a dump, by returning -EINTR we 2772 * signal not to send ACK even if it was requested. 2773 */ 2774 return -EINTR; 2775 2776 error_unlock: 2777 sock_put(sk); 2778 mutex_unlock(nlk->cb_mutex); 2779 error_free: 2780 kfree_skb(skb); 2781 return ret; 2782 } 2783 EXPORT_SYMBOL(__netlink_dump_start); 2784 2785 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err) 2786 { 2787 struct sk_buff *skb; 2788 struct nlmsghdr *rep; 2789 struct nlmsgerr *errmsg; 2790 size_t payload = sizeof(*errmsg); 2791 2792 /* error messages get the original request appened */ 2793 if (err) 2794 payload += nlmsg_len(nlh); 2795 2796 skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload), 2797 NETLINK_CB(in_skb).portid, GFP_KERNEL); 2798 if (!skb) { 2799 struct sock *sk; 2800 2801 sk = netlink_lookup(sock_net(in_skb->sk), 2802 in_skb->sk->sk_protocol, 2803 NETLINK_CB(in_skb).portid); 2804 if (sk) { 2805 sk->sk_err = ENOBUFS; 2806 sk->sk_error_report(sk); 2807 sock_put(sk); 2808 } 2809 return; 2810 } 2811 2812 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, 2813 NLMSG_ERROR, payload, 0); 2814 errmsg = nlmsg_data(rep); 2815 errmsg->error = err; 2816 memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh)); 2817 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT); 2818 } 2819 EXPORT_SYMBOL(netlink_ack); 2820 2821 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *, 2822 struct nlmsghdr *)) 2823 { 2824 struct nlmsghdr *nlh; 2825 int err; 2826 2827 while (skb->len >= nlmsg_total_size(0)) { 2828 int msglen; 2829 2830 nlh = nlmsg_hdr(skb); 2831 err = 0; 2832 2833 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len) 2834 return 0; 2835 2836 /* Only requests are handled by the kernel */ 2837 if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) 2838 goto ack; 2839 2840 /* Skip control messages */ 2841 if (nlh->nlmsg_type < NLMSG_MIN_TYPE) 2842 goto ack; 2843 2844 err = cb(skb, nlh); 2845 if (err == -EINTR) 2846 goto skip; 2847 2848 ack: 2849 if (nlh->nlmsg_flags & NLM_F_ACK || err) 2850 netlink_ack(skb, nlh, err); 2851 2852 skip: 2853 msglen = NLMSG_ALIGN(nlh->nlmsg_len); 2854 if (msglen > skb->len) 2855 msglen = skb->len; 2856 skb_pull(skb, msglen); 2857 } 2858 2859 return 0; 2860 } 2861 EXPORT_SYMBOL(netlink_rcv_skb); 2862 2863 /** 2864 * nlmsg_notify - send a notification netlink message 2865 * @sk: netlink socket to use 2866 * @skb: notification message 2867 * @portid: destination netlink portid for reports or 0 2868 * @group: destination multicast group or 0 2869 * @report: 1 to report back, 0 to disable 2870 * @flags: allocation flags 2871 */ 2872 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid, 2873 unsigned int group, int report, gfp_t flags) 2874 { 2875 int err = 0; 2876 2877 if (group) { 2878 int exclude_portid = 0; 2879 2880 if (report) { 2881 atomic_inc(&skb->users); 2882 exclude_portid = portid; 2883 } 2884 2885 /* errors reported via destination sk->sk_err, but propagate 2886 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ 2887 err = nlmsg_multicast(sk, skb, exclude_portid, group, flags); 2888 } 2889 2890 if (report) { 2891 int err2; 2892 2893 err2 = nlmsg_unicast(sk, skb, portid); 2894 if (!err || err == -ESRCH) 2895 err = err2; 2896 } 2897 2898 return err; 2899 } 2900 EXPORT_SYMBOL(nlmsg_notify); 2901 2902 #ifdef CONFIG_PROC_FS 2903 struct nl_seq_iter { 2904 struct seq_net_private p; 2905 struct rhashtable_iter hti; 2906 int link; 2907 }; 2908 2909 static int netlink_walk_start(struct nl_seq_iter *iter) 2910 { 2911 int err; 2912 2913 err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti); 2914 if (err) { 2915 iter->link = MAX_LINKS; 2916 return err; 2917 } 2918 2919 err = rhashtable_walk_start(&iter->hti); 2920 return err == -EAGAIN ? 0 : err; 2921 } 2922 2923 static void netlink_walk_stop(struct nl_seq_iter *iter) 2924 { 2925 rhashtable_walk_stop(&iter->hti); 2926 rhashtable_walk_exit(&iter->hti); 2927 } 2928 2929 static void *__netlink_seq_next(struct seq_file *seq) 2930 { 2931 struct nl_seq_iter *iter = seq->private; 2932 struct netlink_sock *nlk; 2933 2934 do { 2935 for (;;) { 2936 int err; 2937 2938 nlk = rhashtable_walk_next(&iter->hti); 2939 2940 if (IS_ERR(nlk)) { 2941 if (PTR_ERR(nlk) == -EAGAIN) 2942 continue; 2943 2944 return nlk; 2945 } 2946 2947 if (nlk) 2948 break; 2949 2950 netlink_walk_stop(iter); 2951 if (++iter->link >= MAX_LINKS) 2952 return NULL; 2953 2954 err = netlink_walk_start(iter); 2955 if (err) 2956 return ERR_PTR(err); 2957 } 2958 } while (sock_net(&nlk->sk) != seq_file_net(seq)); 2959 2960 return nlk; 2961 } 2962 2963 static void *netlink_seq_start(struct seq_file *seq, loff_t *posp) 2964 { 2965 struct nl_seq_iter *iter = seq->private; 2966 void *obj = SEQ_START_TOKEN; 2967 loff_t pos; 2968 int err; 2969 2970 iter->link = 0; 2971 2972 err = netlink_walk_start(iter); 2973 if (err) 2974 return ERR_PTR(err); 2975 2976 for (pos = *posp; pos && obj && !IS_ERR(obj); pos--) 2977 obj = __netlink_seq_next(seq); 2978 2979 return obj; 2980 } 2981 2982 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) 2983 { 2984 ++*pos; 2985 return __netlink_seq_next(seq); 2986 } 2987 2988 static void netlink_seq_stop(struct seq_file *seq, void *v) 2989 { 2990 struct nl_seq_iter *iter = seq->private; 2991 2992 if (iter->link >= MAX_LINKS) 2993 return; 2994 2995 netlink_walk_stop(iter); 2996 } 2997 2998 2999 static int netlink_seq_show(struct seq_file *seq, void *v) 3000 { 3001 if (v == SEQ_START_TOKEN) { 3002 seq_puts(seq, 3003 "sk Eth Pid Groups " 3004 "Rmem Wmem Dump Locks Drops Inode\n"); 3005 } else { 3006 struct sock *s = v; 3007 struct netlink_sock *nlk = nlk_sk(s); 3008 3009 seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n", 3010 s, 3011 s->sk_protocol, 3012 nlk->portid, 3013 nlk->groups ? (u32)nlk->groups[0] : 0, 3014 sk_rmem_alloc_get(s), 3015 sk_wmem_alloc_get(s), 3016 nlk->cb_running, 3017 atomic_read(&s->sk_refcnt), 3018 atomic_read(&s->sk_drops), 3019 sock_i_ino(s) 3020 ); 3021 3022 } 3023 return 0; 3024 } 3025 3026 static const struct seq_operations netlink_seq_ops = { 3027 .start = netlink_seq_start, 3028 .next = netlink_seq_next, 3029 .stop = netlink_seq_stop, 3030 .show = netlink_seq_show, 3031 }; 3032 3033 3034 static int netlink_seq_open(struct inode *inode, struct file *file) 3035 { 3036 return seq_open_net(inode, file, &netlink_seq_ops, 3037 sizeof(struct nl_seq_iter)); 3038 } 3039 3040 static const struct file_operations netlink_seq_fops = { 3041 .owner = THIS_MODULE, 3042 .open = netlink_seq_open, 3043 .read = seq_read, 3044 .llseek = seq_lseek, 3045 .release = seq_release_net, 3046 }; 3047 3048 #endif 3049 3050 int netlink_register_notifier(struct notifier_block *nb) 3051 { 3052 return atomic_notifier_chain_register(&netlink_chain, nb); 3053 } 3054 EXPORT_SYMBOL(netlink_register_notifier); 3055 3056 int netlink_unregister_notifier(struct notifier_block *nb) 3057 { 3058 return atomic_notifier_chain_unregister(&netlink_chain, nb); 3059 } 3060 EXPORT_SYMBOL(netlink_unregister_notifier); 3061 3062 static const struct proto_ops netlink_ops = { 3063 .family = PF_NETLINK, 3064 .owner = THIS_MODULE, 3065 .release = netlink_release, 3066 .bind = netlink_bind, 3067 .connect = netlink_connect, 3068 .socketpair = sock_no_socketpair, 3069 .accept = sock_no_accept, 3070 .getname = netlink_getname, 3071 .poll = netlink_poll, 3072 .ioctl = sock_no_ioctl, 3073 .listen = sock_no_listen, 3074 .shutdown = sock_no_shutdown, 3075 .setsockopt = netlink_setsockopt, 3076 .getsockopt = netlink_getsockopt, 3077 .sendmsg = netlink_sendmsg, 3078 .recvmsg = netlink_recvmsg, 3079 .mmap = netlink_mmap, 3080 .sendpage = sock_no_sendpage, 3081 }; 3082 3083 static const struct net_proto_family netlink_family_ops = { 3084 .family = PF_NETLINK, 3085 .create = netlink_create, 3086 .owner = THIS_MODULE, /* for consistency 8) */ 3087 }; 3088 3089 static int __net_init netlink_net_init(struct net *net) 3090 { 3091 #ifdef CONFIG_PROC_FS 3092 if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops)) 3093 return -ENOMEM; 3094 #endif 3095 return 0; 3096 } 3097 3098 static void __net_exit netlink_net_exit(struct net *net) 3099 { 3100 #ifdef CONFIG_PROC_FS 3101 remove_proc_entry("netlink", net->proc_net); 3102 #endif 3103 } 3104 3105 static void __init netlink_add_usersock_entry(void) 3106 { 3107 struct listeners *listeners; 3108 int groups = 32; 3109 3110 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL); 3111 if (!listeners) 3112 panic("netlink_add_usersock_entry: Cannot allocate listeners\n"); 3113 3114 netlink_table_grab(); 3115 3116 nl_table[NETLINK_USERSOCK].groups = groups; 3117 rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners); 3118 nl_table[NETLINK_USERSOCK].module = THIS_MODULE; 3119 nl_table[NETLINK_USERSOCK].registered = 1; 3120 nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND; 3121 3122 netlink_table_ungrab(); 3123 } 3124 3125 static struct pernet_operations __net_initdata netlink_net_ops = { 3126 .init = netlink_net_init, 3127 .exit = netlink_net_exit, 3128 }; 3129 3130 static inline u32 netlink_hash(const void *data, u32 len, u32 seed) 3131 { 3132 const struct netlink_sock *nlk = data; 3133 struct netlink_compare_arg arg; 3134 3135 netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid); 3136 return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed); 3137 } 3138 3139 static const struct rhashtable_params netlink_rhashtable_params = { 3140 .head_offset = offsetof(struct netlink_sock, node), 3141 .key_len = netlink_compare_arg_len, 3142 .obj_hashfn = netlink_hash, 3143 .obj_cmpfn = netlink_compare, 3144 .max_size = 65536, 3145 .automatic_shrinking = true, 3146 }; 3147 3148 static int __init netlink_proto_init(void) 3149 { 3150 int i; 3151 int err = proto_register(&netlink_proto, 0); 3152 3153 if (err != 0) 3154 goto out; 3155 3156 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb)); 3157 3158 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL); 3159 if (!nl_table) 3160 goto panic; 3161 3162 for (i = 0; i < MAX_LINKS; i++) { 3163 if (rhashtable_init(&nl_table[i].hash, 3164 &netlink_rhashtable_params) < 0) { 3165 while (--i > 0) 3166 rhashtable_destroy(&nl_table[i].hash); 3167 kfree(nl_table); 3168 goto panic; 3169 } 3170 } 3171 3172 INIT_LIST_HEAD(&netlink_tap_all); 3173 3174 netlink_add_usersock_entry(); 3175 3176 sock_register(&netlink_family_ops); 3177 register_pernet_subsys(&netlink_net_ops); 3178 /* The netlink device handler may be needed early. */ 3179 rtnetlink_init(); 3180 out: 3181 return err; 3182 panic: 3183 panic("netlink_init: Cannot allocate nl_table\n"); 3184 } 3185 3186 core_initcall(netlink_proto_init); 3187