1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* RxRPC virtual connection handler, common bits. 3 * 4 * Copyright (C) 2007, 2016 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 9 10 #include <linux/module.h> 11 #include <linux/slab.h> 12 #include <linux/net.h> 13 #include <linux/skbuff.h> 14 #include "ar-internal.h" 15 16 /* 17 * Time till a connection expires after last use (in seconds). 18 */ 19 unsigned int __read_mostly rxrpc_connection_expiry = 10 * 60; 20 unsigned int __read_mostly rxrpc_closed_conn_expiry = 10; 21 22 static void rxrpc_destroy_connection(struct rcu_head *); 23 24 static void rxrpc_connection_timer(struct timer_list *timer) 25 { 26 struct rxrpc_connection *conn = 27 container_of(timer, struct rxrpc_connection, timer); 28 29 rxrpc_queue_conn(conn); 30 } 31 32 /* 33 * allocate a new connection 34 */ 35 struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp) 36 { 37 struct rxrpc_connection *conn; 38 39 _enter(""); 40 41 conn = kzalloc(sizeof(struct rxrpc_connection), gfp); 42 if (conn) { 43 INIT_LIST_HEAD(&conn->cache_link); 44 spin_lock_init(&conn->channel_lock); 45 INIT_LIST_HEAD(&conn->waiting_calls); 46 timer_setup(&conn->timer, &rxrpc_connection_timer, 0); 47 INIT_WORK(&conn->processor, &rxrpc_process_connection); 48 INIT_LIST_HEAD(&conn->proc_link); 49 INIT_LIST_HEAD(&conn->link); 50 skb_queue_head_init(&conn->rx_queue); 51 conn->security = &rxrpc_no_security; 52 spin_lock_init(&conn->state_lock); 53 conn->debug_id = atomic_inc_return(&rxrpc_debug_id); 54 conn->size_align = 4; 55 conn->idle_timestamp = jiffies; 56 } 57 58 _leave(" = %p{%d}", conn, conn ? conn->debug_id : 0); 59 return conn; 60 } 61 62 /* 63 * Look up a connection in the cache by protocol parameters. 64 * 65 * If successful, a pointer to the connection is returned, but no ref is taken. 66 * NULL is returned if there is no match. 67 * 68 * When searching for a service call, if we find a peer but no connection, we 69 * return that through *_peer in case we need to create a new service call. 70 * 71 * The caller must be holding the RCU read lock. 72 */ 73 struct rxrpc_connection *rxrpc_find_connection_rcu(struct rxrpc_local *local, 74 struct sk_buff *skb, 75 struct rxrpc_peer **_peer) 76 { 77 struct rxrpc_connection *conn; 78 struct rxrpc_conn_proto k; 79 struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 80 struct sockaddr_rxrpc srx; 81 struct rxrpc_peer *peer; 82 83 _enter(",%x", sp->hdr.cid & RXRPC_CIDMASK); 84 85 if (rxrpc_extract_addr_from_skb(&srx, skb) < 0) 86 goto not_found; 87 88 if (srx.transport.family != local->srx.transport.family && 89 (srx.transport.family == AF_INET && 90 local->srx.transport.family != AF_INET6)) { 91 pr_warn_ratelimited("AF_RXRPC: Protocol mismatch %u not %u\n", 92 srx.transport.family, 93 local->srx.transport.family); 94 goto not_found; 95 } 96 97 k.epoch = sp->hdr.epoch; 98 k.cid = sp->hdr.cid & RXRPC_CIDMASK; 99 100 if (rxrpc_to_server(sp)) { 101 /* We need to look up service connections by the full protocol 102 * parameter set. We look up the peer first as an intermediate 103 * step and then the connection from the peer's tree. 104 */ 105 peer = rxrpc_lookup_peer_rcu(local, &srx); 106 if (!peer) 107 goto not_found; 108 *_peer = peer; 109 conn = rxrpc_find_service_conn_rcu(peer, skb); 110 if (!conn || atomic_read(&conn->usage) == 0) 111 goto not_found; 112 _leave(" = %p", conn); 113 return conn; 114 } else { 115 /* Look up client connections by connection ID alone as their 116 * IDs are unique for this machine. 117 */ 118 conn = idr_find(&rxrpc_client_conn_ids, 119 sp->hdr.cid >> RXRPC_CIDSHIFT); 120 if (!conn || atomic_read(&conn->usage) == 0) { 121 _debug("no conn"); 122 goto not_found; 123 } 124 125 if (conn->proto.epoch != k.epoch || 126 conn->params.local != local) 127 goto not_found; 128 129 peer = conn->params.peer; 130 switch (srx.transport.family) { 131 case AF_INET: 132 if (peer->srx.transport.sin.sin_port != 133 srx.transport.sin.sin_port || 134 peer->srx.transport.sin.sin_addr.s_addr != 135 srx.transport.sin.sin_addr.s_addr) 136 goto not_found; 137 break; 138 #ifdef CONFIG_AF_RXRPC_IPV6 139 case AF_INET6: 140 if (peer->srx.transport.sin6.sin6_port != 141 srx.transport.sin6.sin6_port || 142 memcmp(&peer->srx.transport.sin6.sin6_addr, 143 &srx.transport.sin6.sin6_addr, 144 sizeof(struct in6_addr)) != 0) 145 goto not_found; 146 break; 147 #endif 148 default: 149 BUG(); 150 } 151 152 _leave(" = %p", conn); 153 return conn; 154 } 155 156 not_found: 157 _leave(" = NULL"); 158 return NULL; 159 } 160 161 /* 162 * Disconnect a call and clear any channel it occupies when that call 163 * terminates. The caller must hold the channel_lock and must release the 164 * call's ref on the connection. 165 */ 166 void __rxrpc_disconnect_call(struct rxrpc_connection *conn, 167 struct rxrpc_call *call) 168 { 169 struct rxrpc_channel *chan = 170 &conn->channels[call->cid & RXRPC_CHANNELMASK]; 171 172 _enter("%d,%x", conn->debug_id, call->cid); 173 174 if (rcu_access_pointer(chan->call) == call) { 175 /* Save the result of the call so that we can repeat it if necessary 176 * through the channel, whilst disposing of the actual call record. 177 */ 178 trace_rxrpc_disconnect_call(call); 179 switch (call->completion) { 180 case RXRPC_CALL_SUCCEEDED: 181 chan->last_seq = call->rx_hard_ack; 182 chan->last_type = RXRPC_PACKET_TYPE_ACK; 183 break; 184 case RXRPC_CALL_LOCALLY_ABORTED: 185 chan->last_abort = call->abort_code; 186 chan->last_type = RXRPC_PACKET_TYPE_ABORT; 187 break; 188 default: 189 chan->last_abort = RX_USER_ABORT; 190 chan->last_type = RXRPC_PACKET_TYPE_ABORT; 191 break; 192 } 193 194 /* Sync with rxrpc_conn_retransmit(). */ 195 smp_wmb(); 196 chan->last_call = chan->call_id; 197 chan->call_id = chan->call_counter; 198 199 rcu_assign_pointer(chan->call, NULL); 200 } 201 202 _leave(""); 203 } 204 205 /* 206 * Disconnect a call and clear any channel it occupies when that call 207 * terminates. 208 */ 209 void rxrpc_disconnect_call(struct rxrpc_call *call) 210 { 211 struct rxrpc_connection *conn = call->conn; 212 213 call->peer->cong_cwnd = call->cong_cwnd; 214 215 spin_lock_bh(&conn->params.peer->lock); 216 hlist_del_rcu(&call->error_link); 217 spin_unlock_bh(&conn->params.peer->lock); 218 219 if (rxrpc_is_client_call(call)) 220 return rxrpc_disconnect_client_call(call); 221 222 spin_lock(&conn->channel_lock); 223 __rxrpc_disconnect_call(conn, call); 224 spin_unlock(&conn->channel_lock); 225 226 set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); 227 conn->idle_timestamp = jiffies; 228 } 229 230 /* 231 * Kill off a connection. 232 */ 233 void rxrpc_kill_connection(struct rxrpc_connection *conn) 234 { 235 struct rxrpc_net *rxnet = conn->params.local->rxnet; 236 237 ASSERT(!rcu_access_pointer(conn->channels[0].call) && 238 !rcu_access_pointer(conn->channels[1].call) && 239 !rcu_access_pointer(conn->channels[2].call) && 240 !rcu_access_pointer(conn->channels[3].call)); 241 ASSERT(list_empty(&conn->cache_link)); 242 243 write_lock(&rxnet->conn_lock); 244 list_del_init(&conn->proc_link); 245 write_unlock(&rxnet->conn_lock); 246 247 /* Drain the Rx queue. Note that even though we've unpublished, an 248 * incoming packet could still be being added to our Rx queue, so we 249 * will need to drain it again in the RCU cleanup handler. 250 */ 251 rxrpc_purge_queue(&conn->rx_queue); 252 253 /* Leave final destruction to RCU. The connection processor work item 254 * must carry a ref on the connection to prevent us getting here whilst 255 * it is queued or running. 256 */ 257 call_rcu(&conn->rcu, rxrpc_destroy_connection); 258 } 259 260 /* 261 * Queue a connection's work processor, getting a ref to pass to the work 262 * queue. 263 */ 264 bool rxrpc_queue_conn(struct rxrpc_connection *conn) 265 { 266 const void *here = __builtin_return_address(0); 267 int n = atomic_fetch_add_unless(&conn->usage, 1, 0); 268 if (n == 0) 269 return false; 270 if (rxrpc_queue_work(&conn->processor)) 271 trace_rxrpc_conn(conn->debug_id, rxrpc_conn_queued, n + 1, here); 272 else 273 rxrpc_put_connection(conn); 274 return true; 275 } 276 277 /* 278 * Note the re-emergence of a connection. 279 */ 280 void rxrpc_see_connection(struct rxrpc_connection *conn) 281 { 282 const void *here = __builtin_return_address(0); 283 if (conn) { 284 int n = atomic_read(&conn->usage); 285 286 trace_rxrpc_conn(conn->debug_id, rxrpc_conn_seen, n, here); 287 } 288 } 289 290 /* 291 * Get a ref on a connection. 292 */ 293 void rxrpc_get_connection(struct rxrpc_connection *conn) 294 { 295 const void *here = __builtin_return_address(0); 296 int n = atomic_inc_return(&conn->usage); 297 298 trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n, here); 299 } 300 301 /* 302 * Try to get a ref on a connection. 303 */ 304 struct rxrpc_connection * 305 rxrpc_get_connection_maybe(struct rxrpc_connection *conn) 306 { 307 const void *here = __builtin_return_address(0); 308 309 if (conn) { 310 int n = atomic_fetch_add_unless(&conn->usage, 1, 0); 311 if (n > 0) 312 trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n + 1, here); 313 else 314 conn = NULL; 315 } 316 return conn; 317 } 318 319 /* 320 * Set the service connection reap timer. 321 */ 322 static void rxrpc_set_service_reap_timer(struct rxrpc_net *rxnet, 323 unsigned long reap_at) 324 { 325 if (rxnet->live) 326 timer_reduce(&rxnet->service_conn_reap_timer, reap_at); 327 } 328 329 /* 330 * Release a service connection 331 */ 332 void rxrpc_put_service_conn(struct rxrpc_connection *conn) 333 { 334 const void *here = __builtin_return_address(0); 335 unsigned int debug_id = conn->debug_id; 336 int n; 337 338 n = atomic_dec_return(&conn->usage); 339 trace_rxrpc_conn(debug_id, rxrpc_conn_put_service, n, here); 340 ASSERTCMP(n, >=, 0); 341 if (n == 1) 342 rxrpc_set_service_reap_timer(conn->params.local->rxnet, 343 jiffies + rxrpc_connection_expiry); 344 } 345 346 /* 347 * destroy a virtual connection 348 */ 349 static void rxrpc_destroy_connection(struct rcu_head *rcu) 350 { 351 struct rxrpc_connection *conn = 352 container_of(rcu, struct rxrpc_connection, rcu); 353 354 _enter("{%d,u=%d}", conn->debug_id, atomic_read(&conn->usage)); 355 356 ASSERTCMP(atomic_read(&conn->usage), ==, 0); 357 358 _net("DESTROY CONN %d", conn->debug_id); 359 360 del_timer_sync(&conn->timer); 361 rxrpc_purge_queue(&conn->rx_queue); 362 363 conn->security->clear(conn); 364 key_put(conn->params.key); 365 key_put(conn->server_key); 366 rxrpc_put_peer(conn->params.peer); 367 368 if (atomic_dec_and_test(&conn->params.local->rxnet->nr_conns)) 369 wake_up_var(&conn->params.local->rxnet->nr_conns); 370 rxrpc_put_local(conn->params.local); 371 372 kfree(conn); 373 _leave(""); 374 } 375 376 /* 377 * reap dead service connections 378 */ 379 void rxrpc_service_connection_reaper(struct work_struct *work) 380 { 381 struct rxrpc_connection *conn, *_p; 382 struct rxrpc_net *rxnet = 383 container_of(work, struct rxrpc_net, service_conn_reaper); 384 unsigned long expire_at, earliest, idle_timestamp, now; 385 386 LIST_HEAD(graveyard); 387 388 _enter(""); 389 390 now = jiffies; 391 earliest = now + MAX_JIFFY_OFFSET; 392 393 write_lock(&rxnet->conn_lock); 394 list_for_each_entry_safe(conn, _p, &rxnet->service_conns, link) { 395 ASSERTCMP(atomic_read(&conn->usage), >, 0); 396 if (likely(atomic_read(&conn->usage) > 1)) 397 continue; 398 if (conn->state == RXRPC_CONN_SERVICE_PREALLOC) 399 continue; 400 401 if (rxnet->live && !conn->params.local->dead) { 402 idle_timestamp = READ_ONCE(conn->idle_timestamp); 403 expire_at = idle_timestamp + rxrpc_connection_expiry * HZ; 404 if (conn->params.local->service_closed) 405 expire_at = idle_timestamp + rxrpc_closed_conn_expiry * HZ; 406 407 _debug("reap CONN %d { u=%d,t=%ld }", 408 conn->debug_id, atomic_read(&conn->usage), 409 (long)expire_at - (long)now); 410 411 if (time_before(now, expire_at)) { 412 if (time_before(expire_at, earliest)) 413 earliest = expire_at; 414 continue; 415 } 416 } 417 418 /* The usage count sits at 1 whilst the object is unused on the 419 * list; we reduce that to 0 to make the object unavailable. 420 */ 421 if (atomic_cmpxchg(&conn->usage, 1, 0) != 1) 422 continue; 423 trace_rxrpc_conn(conn->debug_id, rxrpc_conn_reap_service, 0, NULL); 424 425 if (rxrpc_conn_is_client(conn)) 426 BUG(); 427 else 428 rxrpc_unpublish_service_conn(conn); 429 430 list_move_tail(&conn->link, &graveyard); 431 } 432 write_unlock(&rxnet->conn_lock); 433 434 if (earliest != now + MAX_JIFFY_OFFSET) { 435 _debug("reschedule reaper %ld", (long)earliest - (long)now); 436 ASSERT(time_after(earliest, now)); 437 rxrpc_set_service_reap_timer(rxnet, earliest); 438 } 439 440 while (!list_empty(&graveyard)) { 441 conn = list_entry(graveyard.next, struct rxrpc_connection, 442 link); 443 list_del_init(&conn->link); 444 445 ASSERTCMP(atomic_read(&conn->usage), ==, 0); 446 rxrpc_kill_connection(conn); 447 } 448 449 _leave(""); 450 } 451 452 /* 453 * preemptively destroy all the service connection records rather than 454 * waiting for them to time out 455 */ 456 void rxrpc_destroy_all_connections(struct rxrpc_net *rxnet) 457 { 458 struct rxrpc_connection *conn, *_p; 459 bool leak = false; 460 461 _enter(""); 462 463 atomic_dec(&rxnet->nr_conns); 464 rxrpc_destroy_all_client_connections(rxnet); 465 466 del_timer_sync(&rxnet->service_conn_reap_timer); 467 rxrpc_queue_work(&rxnet->service_conn_reaper); 468 flush_workqueue(rxrpc_workqueue); 469 470 write_lock(&rxnet->conn_lock); 471 list_for_each_entry_safe(conn, _p, &rxnet->service_conns, link) { 472 pr_err("AF_RXRPC: Leaked conn %p {%d}\n", 473 conn, atomic_read(&conn->usage)); 474 leak = true; 475 } 476 write_unlock(&rxnet->conn_lock); 477 BUG_ON(leak); 478 479 ASSERT(list_empty(&rxnet->conn_proc_list)); 480 481 /* We need to wait for the connections to be destroyed by RCU as they 482 * pin things that we still need to get rid of. 483 */ 484 wait_var_event(&rxnet->nr_conns, !atomic_read(&rxnet->nr_conns)); 485 _leave(""); 486 } 487