?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[NET]: Make packet reception network namespace safe
[linux-2.6/kmemtrace.git] / net / packet / af_packet.c
blobcae1ee4f2ad68a7f1d13552dd97c5787fc71479c
1 /*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
5 *
6 * PACKET - implements raw packet sockets.
7 *
8 * Version: $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
9 *
10 * Authors: Ross Biro
11 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
12 * Alan Cox, <gw4pts@gw4pts.ampr.org>
13 *
14 * Fixes:
15 * Alan Cox : verify_area() now used correctly
16 * Alan Cox : new skbuff lists, look ma no backlogs!
17 * Alan Cox : tidied skbuff lists.
18 * Alan Cox : Now uses generic datagram routines I
19 * added. Also fixed the peek/read crash
20 * from all old Linux datagram code.
21 * Alan Cox : Uses the improved datagram code.
22 * Alan Cox : Added NULL's for socket options.
23 * Alan Cox : Re-commented the code.
24 * Alan Cox : Use new kernel side addressing
25 * Rob Janssen : Correct MTU usage.
26 * Dave Platt : Counter leaks caused by incorrect
27 * interrupt locking and some slightly
28 * dubious gcc output. Can you read
29 * compiler: it said _VOLATILE_
30 * Richard Kooijman : Timestamp fixes.
31 * Alan Cox : New buffers. Use sk->mac.raw.
32 * Alan Cox : sendmsg/recvmsg support.
33 * Alan Cox : Protocol setting support
34 * Alexey Kuznetsov : Untied from IPv4 stack.
35 * Cyrus Durgin : Fixed kerneld for kmod.
36 * Michal Ostrowski : Module initialization cleanup.
37 * Ulises Alonso : Frame number limit removal and
38 * packet_set_ring memory leak.
39 * Eric Biederman : Allow for > 8 byte hardware addresses.
40 * The convention is that longer addresses
41 * will simply extend the hardware address
42 * byte arrays at the end of sockaddr_ll
43 * and packet_mreq.
44 *
45 * This program is free software; you can redistribute it and/or
46 * modify it under the terms of the GNU General Public License
47 * as published by the Free Software Foundation; either version
48 * 2 of the License, or (at your option) any later version.
49 *
50 */
51
52 #include <linux/types.h>
53 #include <linux/mm.h>
54 #include <linux/capability.h>
55 #include <linux/fcntl.h>
56 #include <linux/socket.h>
57 #include <linux/in.h>
58 #include <linux/inet.h>
59 #include <linux/netdevice.h>
60 #include <linux/if_packet.h>
61 #include <linux/wireless.h>
62 #include <linux/kernel.h>
63 #include <linux/kmod.h>
64 #include <net/net_namespace.h>
65 #include <net/ip.h>
66 #include <net/protocol.h>
67 #include <linux/skbuff.h>
68 #include <net/sock.h>
69 #include <linux/errno.h>
70 #include <linux/timer.h>
71 #include <asm/system.h>
72 #include <asm/uaccess.h>
73 #include <asm/ioctls.h>
74 #include <asm/page.h>
75 #include <asm/cacheflush.h>
76 #include <asm/io.h>
77 #include <linux/proc_fs.h>
78 #include <linux/seq_file.h>
79 #include <linux/poll.h>
80 #include <linux/module.h>
81 #include <linux/init.h>
82
83 #ifdef CONFIG_INET
84 #include <net/inet_common.h>
85 #endif
86
87 /*
88 Assumptions:
89 - if device has no dev->hard_header routine, it adds and removes ll header
90 inside itself. In this case ll header is invisible outside of device,
91 but higher levels still should reserve dev->hard_header_len.
92 Some devices are enough clever to reallocate skb, when header
93 will not fit to reserved space (tunnel), another ones are silly
94 (PPP).
95 - packet socket receives packets with pulled ll header,
96 so that SOCK_RAW should push it back.
97
98 On receive:
99 -----------
100
101 Incoming, dev->hard_header!=NULL
102 mac_header -> ll header
103 data -> data
104
105 Outgoing, dev->hard_header!=NULL
106 mac_header -> ll header
107 data -> ll header
108
109 Incoming, dev->hard_header==NULL
110 mac_header -> UNKNOWN position. It is very likely, that it points to ll
111 header. PPP makes it, that is wrong, because introduce
112 assymetry between rx and tx paths.
113 data -> data
114
115 Outgoing, dev->hard_header==NULL
116 mac_header -> data. ll header is still not built!
117 data -> data
118
119 Resume
120 If dev->hard_header==NULL we are unlikely to restore sensible ll header.
121
122
123 On transmit:
124 ------------
125
126 dev->hard_header != NULL
127 mac_header -> ll header
128 data -> ll header
129
130 dev->hard_header == NULL (ll header is added by device, we cannot control it)
131 mac_header -> data
132 data -> data
133
134 We should set nh.raw on output to correct posistion,
135 packet classifier depends on it.
136 */
137
138 /* List of all packet sockets. */
139 static HLIST_HEAD(packet_sklist);
140 static DEFINE_RWLOCK(packet_sklist_lock);
141
142 static atomic_t packet_socks_nr;
143
144
145 /* Private packet socket structures. */
146
147 struct packet_mclist
148 {
149 struct packet_mclist *next;
150 int ifindex;
151 int count;
152 unsigned short type;
153 unsigned short alen;
154 unsigned char addr[MAX_ADDR_LEN];
155 };
156 /* identical to struct packet_mreq except it has
157 * a longer address field.
158 */
159 struct packet_mreq_max
160 {
161 int mr_ifindex;
162 unsigned short mr_type;
163 unsigned short mr_alen;
164 unsigned char mr_address[MAX_ADDR_LEN];
165 };
166
167 #ifdef CONFIG_PACKET_MMAP
168 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
169 #endif
170
171 static void packet_flush_mclist(struct sock *sk);
172
173 struct packet_sock {
174 /* struct sock has to be the first member of packet_sock */
175 struct sock sk;
176 struct tpacket_stats stats;
177 #ifdef CONFIG_PACKET_MMAP
178 char * *pg_vec;
179 unsigned int head;
180 unsigned int frames_per_block;
181 unsigned int frame_size;
182 unsigned int frame_max;
183 int copy_thresh;
184 #endif
185 struct packet_type prot_hook;
186 spinlock_t bind_lock;
187 unsigned int running:1, /* prot_hook is attached*/
188 auxdata:1,
189 origdev:1;
190 int ifindex; /* bound device */
191 __be16 num;
192 struct packet_mclist *mclist;
193 #ifdef CONFIG_PACKET_MMAP
194 atomic_t mapped;
195 unsigned int pg_vec_order;
196 unsigned int pg_vec_pages;
197 unsigned int pg_vec_len;
198 #endif
199 };
200
201 struct packet_skb_cb {
202 unsigned int origlen;
203 union {
204 struct sockaddr_pkt pkt;
205 struct sockaddr_ll ll;
206 } sa;
207 };
208
209 #define PACKET_SKB_CB(__skb) ((struct packet_skb_cb *)((__skb)->cb))
210
211 #ifdef CONFIG_PACKET_MMAP
212
213 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position)
214 {
215 unsigned int pg_vec_pos, frame_offset;
216
217 pg_vec_pos = position / po->frames_per_block;
218 frame_offset = position % po->frames_per_block;
219
220 return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size));
221 }
222 #endif
223
224 static inline struct packet_sock *pkt_sk(struct sock *sk)
225 {
226 return (struct packet_sock *)sk;
227 }
228
229 static void packet_sock_destruct(struct sock *sk)
230 {
231 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
232 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
233
234 if (!sock_flag(sk, SOCK_DEAD)) {
235 printk("Attempt to release alive packet socket: %p\n", sk);
236 return;
237 }
238
239 atomic_dec(&packet_socks_nr);
240 #ifdef PACKET_REFCNT_DEBUG
241 printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
242 #endif
243 }
244
245
246 static const struct proto_ops packet_ops;
247
248 static const struct proto_ops packet_ops_spkt;
249
250 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
251 {
252 struct sock *sk;
253 struct sockaddr_pkt *spkt;
254
255 if (dev->nd_net != &init_net)
256 goto out;
257
258 /*
259 * When we registered the protocol we saved the socket in the data
260 * field for just this event.
261 */
262
263 sk = pt->af_packet_priv;
264
265 /*
266 * Yank back the headers [hope the device set this
267 * right or kerboom...]
268 *
269 * Incoming packets have ll header pulled,
270 * push it back.
271 *
272 * For outgoing ones skb->data == skb_mac_header(skb)
273 * so that this procedure is noop.
274 */
275
276 if (skb->pkt_type == PACKET_LOOPBACK)
277 goto out;
278
279 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
280 goto oom;
281
282 /* drop any routing info */
283 dst_release(skb->dst);
284 skb->dst = NULL;
285
286 /* drop conntrack reference */
287 nf_reset(skb);
288
289 spkt = &PACKET_SKB_CB(skb)->sa.pkt;
290
291 skb_push(skb, skb->data - skb_mac_header(skb));
292
293 /*
294 * The SOCK_PACKET socket receives _all_ frames.
295 */
296
297 spkt->spkt_family = dev->type;
298 strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
299 spkt->spkt_protocol = skb->protocol;
300
301 /*
302 * Charge the memory to the socket. This is done specifically
303 * to prevent sockets using all the memory up.
304 */
305
306 if (sock_queue_rcv_skb(sk,skb) == 0)
307 return 0;
308
309 out:
310 kfree_skb(skb);
311 oom:
312 return 0;
313 }
314
315
316 /*
317 * Output a raw packet to a device layer. This bypasses all the other
318 * protocol layers and you must therefore supply it with a complete frame
319 */
320
321 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
322 struct msghdr *msg, size_t len)
323 {
324 struct sock *sk = sock->sk;
325 struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
326 struct sk_buff *skb;
327 struct net_device *dev;
328 __be16 proto=0;
329 int err;
330
331 /*
332 * Get and verify the address.
333 */
334
335 if (saddr)
336 {
337 if (msg->msg_namelen < sizeof(struct sockaddr))
338 return(-EINVAL);
339 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
340 proto=saddr->spkt_protocol;
341 }
342 else
343 return(-ENOTCONN); /* SOCK_PACKET must be sent giving an address */
344
345 /*
346 * Find the device first to size check it
347 */
348
349 saddr->spkt_device[13] = 0;
350 dev = dev_get_by_name(saddr->spkt_device);
351 err = -ENODEV;
352 if (dev == NULL)
353 goto out_unlock;
354
355 err = -ENETDOWN;
356 if (!(dev->flags & IFF_UP))
357 goto out_unlock;
358
359 /*
360 * You may not queue a frame bigger than the mtu. This is the lowest level
361 * raw protocol and you must do your own fragmentation at this level.
362 */
363
364 err = -EMSGSIZE;
365 if (len > dev->mtu + dev->hard_header_len)
366 goto out_unlock;
367
368 err = -ENOBUFS;
369 skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
370
371 /*
372 * If the write buffer is full, then tough. At this level the user gets to
373 * deal with the problem - do your own algorithmic backoffs. That's far
374 * more flexible.
375 */
376
377 if (skb == NULL)
378 goto out_unlock;
379
380 /*
381 * Fill it in
382 */
383
384 /* FIXME: Save some space for broken drivers that write a
385 * hard header at transmission time by themselves. PPP is the
386 * notable one here. This should really be fixed at the driver level.
387 */
388 skb_reserve(skb, LL_RESERVED_SPACE(dev));
389 skb_reset_network_header(skb);
390
391 /* Try to align data part correctly */
392 if (dev->hard_header) {
393 skb->data -= dev->hard_header_len;
394 skb->tail -= dev->hard_header_len;
395 if (len < dev->hard_header_len)
396 skb_reset_network_header(skb);
397 }
398
399 /* Returns -EFAULT on error */
400 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
401 skb->protocol = proto;
402 skb->dev = dev;
403 skb->priority = sk->sk_priority;
404 if (err)
405 goto out_free;
406
407 /*
408 * Now send it
409 */
410
411 dev_queue_xmit(skb);
412 dev_put(dev);
413 return(len);
414
415 out_free:
416 kfree_skb(skb);
417 out_unlock:
418 if (dev)
419 dev_put(dev);
420 return err;
421 }
422
423 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
424 unsigned int res)
425 {
426 struct sk_filter *filter;
427
428 rcu_read_lock_bh();
429 filter = rcu_dereference(sk->sk_filter);
430 if (filter != NULL)
431 res = sk_run_filter(skb, filter->insns, filter->len);
432 rcu_read_unlock_bh();
433
434 return res;
435 }
436
437 /*
438 This function makes lazy skb cloning in hope that most of packets
439 are discarded by BPF.
440
441 Note tricky part: we DO mangle shared skb! skb->data, skb->len
442 and skb->cb are mangled. It works because (and until) packets
443 falling here are owned by current CPU. Output packets are cloned
444 by dev_queue_xmit_nit(), input packets are processed by net_bh
445 sequencially, so that if we return skb to original state on exit,
446 we will not harm anyone.
447 */
448
449 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
450 {
451 struct sock *sk;
452 struct sockaddr_ll *sll;
453 struct packet_sock *po;
454 u8 * skb_head = skb->data;
455 int skb_len = skb->len;
456 unsigned int snaplen, res;
457
458 if (dev->nd_net != &init_net)
459 goto drop;
460
461 if (skb->pkt_type == PACKET_LOOPBACK)
462 goto drop;
463
464 sk = pt->af_packet_priv;
465 po = pkt_sk(sk);
466
467 skb->dev = dev;
468
469 if (dev->hard_header) {
470 /* The device has an explicit notion of ll header,
471 exported to higher levels.
472
473 Otherwise, the device hides datails of it frame
474 structure, so that corresponding packet head
475 never delivered to user.
476 */
477 if (sk->sk_type != SOCK_DGRAM)
478 skb_push(skb, skb->data - skb_mac_header(skb));
479 else if (skb->pkt_type == PACKET_OUTGOING) {
480 /* Special case: outgoing packets have ll header at head */
481 skb_pull(skb, skb_network_offset(skb));
482 }
483 }
484
485 snaplen = skb->len;
486
487 res = run_filter(skb, sk, snaplen);
488 if (!res)
489 goto drop_n_restore;
490 if (snaplen > res)
491 snaplen = res;
492
493 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
494 (unsigned)sk->sk_rcvbuf)
495 goto drop_n_acct;
496
497 if (skb_shared(skb)) {
498 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
499 if (nskb == NULL)
500 goto drop_n_acct;
501
502 if (skb_head != skb->data) {
503 skb->data = skb_head;
504 skb->len = skb_len;
505 }
506 kfree_skb(skb);
507 skb = nskb;
508 }
509
510 BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
511 sizeof(skb->cb));
512
513 sll = &PACKET_SKB_CB(skb)->sa.ll;
514 sll->sll_family = AF_PACKET;
515 sll->sll_hatype = dev->type;
516 sll->sll_protocol = skb->protocol;
517 sll->sll_pkttype = skb->pkt_type;
518 if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
519 sll->sll_ifindex = orig_dev->ifindex;
520 else
521 sll->sll_ifindex = dev->ifindex;
522 sll->sll_halen = 0;
523
524 if (dev->hard_header_parse)
525 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
526
527 PACKET_SKB_CB(skb)->origlen = skb->len;
528
529 if (pskb_trim(skb, snaplen))
530 goto drop_n_acct;
531
532 skb_set_owner_r(skb, sk);
533 skb->dev = NULL;
534 dst_release(skb->dst);
535 skb->dst = NULL;
536
537 /* drop conntrack reference */
538 nf_reset(skb);
539
540 spin_lock(&sk->sk_receive_queue.lock);
541 po->stats.tp_packets++;
542 __skb_queue_tail(&sk->sk_receive_queue, skb);
543 spin_unlock(&sk->sk_receive_queue.lock);
544 sk->sk_data_ready(sk, skb->len);
545 return 0;
546
547 drop_n_acct:
548 spin_lock(&sk->sk_receive_queue.lock);
549 po->stats.tp_drops++;
550 spin_unlock(&sk->sk_receive_queue.lock);
551
552 drop_n_restore:
553 if (skb_head != skb->data && skb_shared(skb)) {
554 skb->data = skb_head;
555 skb->len = skb_len;
556 }
557 drop:
558 kfree_skb(skb);
559 return 0;
560 }
561
562 #ifdef CONFIG_PACKET_MMAP
563 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
564 {
565 struct sock *sk;
566 struct packet_sock *po;
567 struct sockaddr_ll *sll;
568 struct tpacket_hdr *h;
569 u8 * skb_head = skb->data;
570 int skb_len = skb->len;
571 unsigned int snaplen, res;
572 unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
573 unsigned short macoff, netoff;
574 struct sk_buff *copy_skb = NULL;
575 struct timeval tv;
576
577 if (dev->nd_net != &init_net)
578 goto drop;
579
580 if (skb->pkt_type == PACKET_LOOPBACK)
581 goto drop;
582
583 sk = pt->af_packet_priv;
584 po = pkt_sk(sk);
585
586 if (dev->hard_header) {
587 if (sk->sk_type != SOCK_DGRAM)
588 skb_push(skb, skb->data - skb_mac_header(skb));
589 else if (skb->pkt_type == PACKET_OUTGOING) {
590 /* Special case: outgoing packets have ll header at head */
591 skb_pull(skb, skb_network_offset(skb));
592 }
593 }
594
595 if (skb->ip_summed == CHECKSUM_PARTIAL)
596 status |= TP_STATUS_CSUMNOTREADY;
597
598 snaplen = skb->len;
599
600 res = run_filter(skb, sk, snaplen);
601 if (!res)
602 goto drop_n_restore;
603 if (snaplen > res)
604 snaplen = res;
605
606 if (sk->sk_type == SOCK_DGRAM) {
607 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
608 } else {
609 unsigned maclen = skb_network_offset(skb);
610 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen));
611 macoff = netoff - maclen;
612 }
613
614 if (macoff + snaplen > po->frame_size) {
615 if (po->copy_thresh &&
616 atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
617 (unsigned)sk->sk_rcvbuf) {
618 if (skb_shared(skb)) {
619 copy_skb = skb_clone(skb, GFP_ATOMIC);
620 } else {
621 copy_skb = skb_get(skb);
622 skb_head = skb->data;
623 }
624 if (copy_skb)
625 skb_set_owner_r(copy_skb, sk);
626 }
627 snaplen = po->frame_size - macoff;
628 if ((int)snaplen < 0)
629 snaplen = 0;
630 }
631
632 spin_lock(&sk->sk_receive_queue.lock);
633 h = packet_lookup_frame(po, po->head);
634
635 if (h->tp_status)
636 goto ring_is_full;
637 po->head = po->head != po->frame_max ? po->head+1 : 0;
638 po->stats.tp_packets++;
639 if (copy_skb) {
640 status |= TP_STATUS_COPY;
641 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
642 }
643 if (!po->stats.tp_drops)
644 status &= ~TP_STATUS_LOSING;
645 spin_unlock(&sk->sk_receive_queue.lock);
646
647 skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
648
649 h->tp_len = skb->len;
650 h->tp_snaplen = snaplen;
651 h->tp_mac = macoff;
652 h->tp_net = netoff;
653 if (skb->tstamp.tv64)
654 tv = ktime_to_timeval(skb->tstamp);
655 else
656 do_gettimeofday(&tv);
657 h->tp_sec = tv.tv_sec;
658 h->tp_usec = tv.tv_usec;
659
660 sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
661 sll->sll_halen = 0;
662 if (dev->hard_header_parse)
663 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
664 sll->sll_family = AF_PACKET;
665 sll->sll_hatype = dev->type;
666 sll->sll_protocol = skb->protocol;
667 sll->sll_pkttype = skb->pkt_type;
668 if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
669 sll->sll_ifindex = orig_dev->ifindex;
670 else
671 sll->sll_ifindex = dev->ifindex;
672
673 h->tp_status = status;
674 smp_mb();
675
676 {
677 struct page *p_start, *p_end;
678 u8 *h_end = (u8 *)h + macoff + snaplen - 1;
679
680 p_start = virt_to_page(h);
681 p_end = virt_to_page(h_end);
682 while (p_start <= p_end) {
683 flush_dcache_page(p_start);
684 p_start++;
685 }
686 }
687
688 sk->sk_data_ready(sk, 0);
689
690 drop_n_restore:
691 if (skb_head != skb->data && skb_shared(skb)) {
692 skb->data = skb_head;
693 skb->len = skb_len;
694 }
695 drop:
696 kfree_skb(skb);
697 return 0;
698
699 ring_is_full:
700 po->stats.tp_drops++;
701 spin_unlock(&sk->sk_receive_queue.lock);
702
703 sk->sk_data_ready(sk, 0);
704 if (copy_skb)
705 kfree_skb(copy_skb);
706 goto drop_n_restore;
707 }
708
709 #endif
710
711
712 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
713 struct msghdr *msg, size_t len)
714 {
715 struct sock *sk = sock->sk;
716 struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
717 struct sk_buff *skb;
718 struct net_device *dev;
719 __be16 proto;
720 unsigned char *addr;
721 int ifindex, err, reserve = 0;
722
723 /*
724 * Get and verify the address.
725 */
726
727 if (saddr == NULL) {
728 struct packet_sock *po = pkt_sk(sk);
729
730 ifindex = po->ifindex;
731 proto = po->num;
732 addr = NULL;
733 } else {
734 err = -EINVAL;
735 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
736 goto out;
737 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
738 goto out;
739 ifindex = saddr->sll_ifindex;
740 proto = saddr->sll_protocol;
741 addr = saddr->sll_addr;
742 }
743
744
745 dev = dev_get_by_index(ifindex);
746 err = -ENXIO;
747 if (dev == NULL)
748 goto out_unlock;
749 if (sock->type == SOCK_RAW)
750 reserve = dev->hard_header_len;
751
752 err = -ENETDOWN;
753 if (!(dev->flags & IFF_UP))
754 goto out_unlock;
755
756 err = -EMSGSIZE;
757 if (len > dev->mtu+reserve)
758 goto out_unlock;
759
760 skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
761 msg->msg_flags & MSG_DONTWAIT, &err);
762 if (skb==NULL)
763 goto out_unlock;
764
765 skb_reserve(skb, LL_RESERVED_SPACE(dev));
766 skb_reset_network_header(skb);
767
768 if (dev->hard_header) {
769 int res;
770 err = -EINVAL;
771 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
772 if (sock->type != SOCK_DGRAM) {
773 skb_reset_tail_pointer(skb);
774 skb->len = 0;
775 } else if (res < 0)
776 goto out_free;
777 }
778
779 /* Returns -EFAULT on error */
780 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
781 if (err)
782 goto out_free;
783
784 skb->protocol = proto;
785 skb->dev = dev;
786 skb->priority = sk->sk_priority;
787
788 /*
789 * Now send it
790 */
791
792 err = dev_queue_xmit(skb);
793 if (err > 0 && (err = net_xmit_errno(err)) != 0)
794 goto out_unlock;
795
796 dev_put(dev);
797
798 return(len);
799
800 out_free:
801 kfree_skb(skb);
802 out_unlock:
803 if (dev)
804 dev_put(dev);
805 out:
806 return err;
807 }
808
809 /*
810 * Close a PACKET socket. This is fairly simple. We immediately go
811 * to 'closed' state and remove our protocol entry in the device list.
812 */
813
814 static int packet_release(struct socket *sock)
815 {
816 struct sock *sk = sock->sk;
817 struct packet_sock *po;
818
819 if (!sk)
820 return 0;
821
822 po = pkt_sk(sk);
823
824 write_lock_bh(&packet_sklist_lock);
825 sk_del_node_init(sk);
826 write_unlock_bh(&packet_sklist_lock);
827
828 /*
829 * Unhook packet receive handler.
830 */
831
832 if (po->running) {
833 /*
834 * Remove the protocol hook
835 */
836 dev_remove_pack(&po->prot_hook);
837 po->running = 0;
838 po->num = 0;
839 __sock_put(sk);
840 }
841
842 packet_flush_mclist(sk);
843
844 #ifdef CONFIG_PACKET_MMAP
845 if (po->pg_vec) {
846 struct tpacket_req req;
847 memset(&req, 0, sizeof(req));
848 packet_set_ring(sk, &req, 1);
849 }
850 #endif
851
852 /*
853 * Now the socket is dead. No more input will appear.
854 */
855
856 sock_orphan(sk);
857 sock->sk = NULL;
858
859 /* Purge queues */
860
861 skb_queue_purge(&sk->sk_receive_queue);
862
863 sock_put(sk);
864 return 0;
865 }
866
867 /*
868 * Attach a packet hook.
869 */
870
871 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
872 {
873 struct packet_sock *po = pkt_sk(sk);
874 /*
875 * Detach an existing hook if present.
876 */
877
878 lock_sock(sk);
879
880 spin_lock(&po->bind_lock);
881 if (po->running) {
882 __sock_put(sk);
883 po->running = 0;
884 po->num = 0;
885 spin_unlock(&po->bind_lock);
886 dev_remove_pack(&po->prot_hook);
887 spin_lock(&po->bind_lock);
888 }
889
890 po->num = protocol;
891 po->prot_hook.type = protocol;
892 po->prot_hook.dev = dev;
893
894 po->ifindex = dev ? dev->ifindex : 0;
895
896 if (protocol == 0)
897 goto out_unlock;
898
899 if (dev) {
900 if (dev->flags&IFF_UP) {
901 dev_add_pack(&po->prot_hook);
902 sock_hold(sk);
903 po->running = 1;
904 } else {
905 sk->sk_err = ENETDOWN;
906 if (!sock_flag(sk, SOCK_DEAD))
907 sk->sk_error_report(sk);
908 }
909 } else {
910 dev_add_pack(&po->prot_hook);
911 sock_hold(sk);
912 po->running = 1;
913 }
914
915 out_unlock:
916 spin_unlock(&po->bind_lock);
917 release_sock(sk);
918 return 0;
919 }
920
921 /*
922 * Bind a packet socket to a device
923 */
924
925 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
926 {
927 struct sock *sk=sock->sk;
928 char name[15];
929 struct net_device *dev;
930 int err = -ENODEV;
931
932 /*
933 * Check legality
934 */
935
936 if (addr_len != sizeof(struct sockaddr))
937 return -EINVAL;
938 strlcpy(name,uaddr->sa_data,sizeof(name));
939
940 dev = dev_get_by_name(name);
941 if (dev) {
942 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
943 dev_put(dev);
944 }
945 return err;
946 }
947
948 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
949 {
950 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
951 struct sock *sk=sock->sk;
952 struct net_device *dev = NULL;
953 int err;
954
955
956 /*
957 * Check legality
958 */
959
960 if (addr_len < sizeof(struct sockaddr_ll))
961 return -EINVAL;
962 if (sll->sll_family != AF_PACKET)
963 return -EINVAL;
964
965 if (sll->sll_ifindex) {
966 err = -ENODEV;
967 dev = dev_get_by_index(sll->sll_ifindex);
968 if (dev == NULL)
969 goto out;
970 }
971 err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
972 if (dev)
973 dev_put(dev);
974
975 out:
976 return err;
977 }
978
979 static struct proto packet_proto = {
980 .name = "PACKET",
981 .owner = THIS_MODULE,
982 .obj_size = sizeof(struct packet_sock),
983 };
984
985 /*
986 * Create a packet of type SOCK_PACKET.
987 */
988
989 static int packet_create(struct net *net, struct socket *sock, int protocol)
990 {
991 struct sock *sk;
992 struct packet_sock *po;
993 __be16 proto = (__force __be16)protocol; /* weird, but documented */
994 int err;
995
996 if (net != &init_net)
997 return -EAFNOSUPPORT;
998
999 if (!capable(CAP_NET_RAW))
1000 return -EPERM;
1001 if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
1002 sock->type != SOCK_PACKET)
1003 return -ESOCKTNOSUPPORT;
1004
1005 sock->state = SS_UNCONNECTED;
1006
1007 err = -ENOBUFS;
1008 sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto, 1);
1009 if (sk == NULL)
1010 goto out;
1011
1012 sock->ops = &packet_ops;
1013 if (sock->type == SOCK_PACKET)
1014 sock->ops = &packet_ops_spkt;
1015
1016 sock_init_data(sock, sk);
1017
1018 po = pkt_sk(sk);
1019 sk->sk_family = PF_PACKET;
1020 po->num = proto;
1021
1022 sk->sk_destruct = packet_sock_destruct;
1023 atomic_inc(&packet_socks_nr);
1024
1025 /*
1026 * Attach a protocol block
1027 */
1028
1029 spin_lock_init(&po->bind_lock);
1030 po->prot_hook.func = packet_rcv;
1031
1032 if (sock->type == SOCK_PACKET)
1033 po->prot_hook.func = packet_rcv_spkt;
1034
1035 po->prot_hook.af_packet_priv = sk;
1036
1037 if (proto) {
1038 po->prot_hook.type = proto;
1039 dev_add_pack(&po->prot_hook);
1040 sock_hold(sk);
1041 po->running = 1;
1042 }
1043
1044 write_lock_bh(&packet_sklist_lock);
1045 sk_add_node(sk, &packet_sklist);
1046 write_unlock_bh(&packet_sklist_lock);
1047 return(0);
1048 out:
1049 return err;
1050 }
1051
1052 /*
1053 * Pull a packet from our receive queue and hand it to the user.
1054 * If necessary we block.
1055 */
1056
1057 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1058 struct msghdr *msg, size_t len, int flags)
1059 {
1060 struct sock *sk = sock->sk;
1061 struct sk_buff *skb;
1062 int copied, err;
1063 struct sockaddr_ll *sll;
1064
1065 err = -EINVAL;
1066 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1067 goto out;
1068
1069 #if 0
1070 /* What error should we return now? EUNATTACH? */
1071 if (pkt_sk(sk)->ifindex < 0)
1072 return -ENODEV;
1073 #endif
1074
1075 /*
1076 * Call the generic datagram receiver. This handles all sorts
1077 * of horrible races and re-entrancy so we can forget about it
1078 * in the protocol layers.
1079 *
1080 * Now it will return ENETDOWN, if device have just gone down,
1081 * but then it will block.
1082 */
1083
1084 skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1085
1086 /*
1087 * An error occurred so return it. Because skb_recv_datagram()
1088 * handles the blocking we don't see and worry about blocking
1089 * retries.
1090 */
1091
1092 if (skb == NULL)
1093 goto out;
1094
1095 /*
1096 * If the address length field is there to be filled in, we fill
1097 * it in now.
1098 */
1099
1100 sll = &PACKET_SKB_CB(skb)->sa.ll;
1101 if (sock->type == SOCK_PACKET)
1102 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1103 else
1104 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1105
1106 /*
1107 * You lose any data beyond the buffer you gave. If it worries a
1108 * user program they can ask the device for its MTU anyway.
1109 */
1110
1111 copied = skb->len;
1112 if (copied > len)
1113 {
1114 copied=len;
1115 msg->msg_flags|=MSG_TRUNC;
1116 }
1117
1118 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1119 if (err)
1120 goto out_free;
1121
1122 sock_recv_timestamp(msg, sk, skb);
1123
1124 if (msg->msg_name)
1125 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1126 msg->msg_namelen);
1127
1128 if (pkt_sk(sk)->auxdata) {
1129 struct tpacket_auxdata aux;
1130
1131 aux.tp_status = TP_STATUS_USER;
1132 if (skb->ip_summed == CHECKSUM_PARTIAL)
1133 aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1134 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1135 aux.tp_snaplen = skb->len;
1136 aux.tp_mac = 0;
1137 aux.tp_net = skb_network_offset(skb);
1138
1139 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1140 }
1141
1142 /*
1143 * Free or return the buffer as appropriate. Again this
1144 * hides all the races and re-entrancy issues from us.
1145 */
1146 err = (flags&MSG_TRUNC) ? skb->len : copied;
1147
1148 out_free:
1149 skb_free_datagram(sk, skb);
1150 out:
1151 return err;
1152 }
1153
1154 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1155 int *uaddr_len, int peer)
1156 {
1157 struct net_device *dev;
1158 struct sock *sk = sock->sk;
1159
1160 if (peer)
1161 return -EOPNOTSUPP;
1162
1163 uaddr->sa_family = AF_PACKET;
1164 dev = dev_get_by_index(pkt_sk(sk)->ifindex);
1165 if (dev) {
1166 strlcpy(uaddr->sa_data, dev->name, 15);
1167 dev_put(dev);
1168 } else
1169 memset(uaddr->sa_data, 0, 14);
1170 *uaddr_len = sizeof(*uaddr);
1171
1172 return 0;
1173 }
1174
1175 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1176 int *uaddr_len, int peer)
1177 {
1178 struct net_device *dev;
1179 struct sock *sk = sock->sk;
1180 struct packet_sock *po = pkt_sk(sk);
1181 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1182
1183 if (peer)
1184 return -EOPNOTSUPP;
1185
1186 sll->sll_family = AF_PACKET;
1187 sll->sll_ifindex = po->ifindex;
1188 sll->sll_protocol = po->num;
1189 dev = dev_get_by_index(po->ifindex);
1190 if (dev) {
1191 sll->sll_hatype = dev->type;
1192 sll->sll_halen = dev->addr_len;
1193 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1194 dev_put(dev);
1195 } else {
1196 sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */
1197 sll->sll_halen = 0;
1198 }
1199 *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1200
1201 return 0;
1202 }
1203
1204 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
1205 {
1206 switch (i->type) {
1207 case PACKET_MR_MULTICAST:
1208 if (what > 0)
1209 dev_mc_add(dev, i->addr, i->alen, 0);
1210 else
1211 dev_mc_delete(dev, i->addr, i->alen, 0);
1212 break;
1213 case PACKET_MR_PROMISC:
1214 dev_set_promiscuity(dev, what);
1215 break;
1216 case PACKET_MR_ALLMULTI:
1217 dev_set_allmulti(dev, what);
1218 break;
1219 default:;
1220 }
1221 }
1222
1223 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1224 {
1225 for ( ; i; i=i->next) {
1226 if (i->ifindex == dev->ifindex)
1227 packet_dev_mc(dev, i, what);
1228 }
1229 }
1230
1231 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1232 {
1233 struct packet_sock *po = pkt_sk(sk);
1234 struct packet_mclist *ml, *i;
1235 struct net_device *dev;
1236 int err;
1237
1238 rtnl_lock();
1239
1240 err = -ENODEV;
1241 dev = __dev_get_by_index(mreq->mr_ifindex);
1242 if (!dev)
1243 goto done;
1244
1245 err = -EINVAL;
1246 if (mreq->mr_alen > dev->addr_len)
1247 goto done;
1248
1249 err = -ENOBUFS;
1250 i = kmalloc(sizeof(*i), GFP_KERNEL);
1251 if (i == NULL)
1252 goto done;
1253
1254 err = 0;
1255 for (ml = po->mclist; ml; ml = ml->next) {
1256 if (ml->ifindex == mreq->mr_ifindex &&
1257 ml->type == mreq->mr_type &&
1258 ml->alen == mreq->mr_alen &&
1259 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1260 ml->count++;
1261 /* Free the new element ... */
1262 kfree(i);
1263 goto done;
1264 }
1265 }
1266
1267 i->type = mreq->mr_type;
1268 i->ifindex = mreq->mr_ifindex;
1269 i->alen = mreq->mr_alen;
1270 memcpy(i->addr, mreq->mr_address, i->alen);
1271 i->count = 1;
1272 i->next = po->mclist;
1273 po->mclist = i;
1274 packet_dev_mc(dev, i, +1);
1275
1276 done:
1277 rtnl_unlock();
1278 return err;
1279 }
1280
1281 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1282 {
1283 struct packet_mclist *ml, **mlp;
1284
1285 rtnl_lock();
1286
1287 for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1288 if (ml->ifindex == mreq->mr_ifindex &&
1289 ml->type == mreq->mr_type &&
1290 ml->alen == mreq->mr_alen &&
1291 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1292 if (--ml->count == 0) {
1293 struct net_device *dev;
1294 *mlp = ml->next;
1295 dev = dev_get_by_index(ml->ifindex);
1296 if (dev) {
1297 packet_dev_mc(dev, ml, -1);
1298 dev_put(dev);
1299 }
1300 kfree(ml);
1301 }
1302 rtnl_unlock();
1303 return 0;
1304 }
1305 }
1306 rtnl_unlock();
1307 return -EADDRNOTAVAIL;
1308 }
1309
1310 static void packet_flush_mclist(struct sock *sk)
1311 {
1312 struct packet_sock *po = pkt_sk(sk);
1313 struct packet_mclist *ml;
1314
1315 if (!po->mclist)
1316 return;
1317
1318 rtnl_lock();
1319 while ((ml = po->mclist) != NULL) {
1320 struct net_device *dev;
1321
1322 po->mclist = ml->next;
1323 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) {
1324 packet_dev_mc(dev, ml, -1);
1325 dev_put(dev);
1326 }
1327 kfree(ml);
1328 }
1329 rtnl_unlock();
1330 }
1331
1332 static int
1333 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1334 {
1335 struct sock *sk = sock->sk;
1336 struct packet_sock *po = pkt_sk(sk);
1337 int ret;
1338
1339 if (level != SOL_PACKET)
1340 return -ENOPROTOOPT;
1341
1342 switch(optname) {
1343 case PACKET_ADD_MEMBERSHIP:
1344 case PACKET_DROP_MEMBERSHIP:
1345 {
1346 struct packet_mreq_max mreq;
1347 int len = optlen;
1348 memset(&mreq, 0, sizeof(mreq));
1349 if (len < sizeof(struct packet_mreq))
1350 return -EINVAL;
1351 if (len > sizeof(mreq))
1352 len = sizeof(mreq);
1353 if (copy_from_user(&mreq,optval,len))
1354 return -EFAULT;
1355 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1356 return -EINVAL;
1357 if (optname == PACKET_ADD_MEMBERSHIP)
1358 ret = packet_mc_add(sk, &mreq);
1359 else
1360 ret = packet_mc_drop(sk, &mreq);
1361 return ret;
1362 }
1363
1364 #ifdef CONFIG_PACKET_MMAP
1365 case PACKET_RX_RING:
1366 {
1367 struct tpacket_req req;
1368
1369 if (optlen<sizeof(req))
1370 return -EINVAL;
1371 if (copy_from_user(&req,optval,sizeof(req)))
1372 return -EFAULT;
1373 return packet_set_ring(sk, &req, 0);
1374 }
1375 case PACKET_COPY_THRESH:
1376 {
1377 int val;
1378
1379 if (optlen!=sizeof(val))
1380 return -EINVAL;
1381 if (copy_from_user(&val,optval,sizeof(val)))
1382 return -EFAULT;
1383
1384 pkt_sk(sk)->copy_thresh = val;
1385 return 0;
1386 }
1387 #endif
1388 case PACKET_AUXDATA:
1389 {
1390 int val;
1391
1392 if (optlen < sizeof(val))
1393 return -EINVAL;
1394 if (copy_from_user(&val, optval, sizeof(val)))
1395 return -EFAULT;
1396
1397 po->auxdata = !!val;
1398 return 0;
1399 }
1400 case PACKET_ORIGDEV:
1401 {
1402 int val;
1403
1404 if (optlen < sizeof(val))
1405 return -EINVAL;
1406 if (copy_from_user(&val, optval, sizeof(val)))
1407 return -EFAULT;
1408
1409 po->origdev = !!val;
1410 return 0;
1411 }
1412 default:
1413 return -ENOPROTOOPT;
1414 }
1415 }
1416
1417 static int packet_getsockopt(struct socket *sock, int level, int optname,
1418 char __user *optval, int __user *optlen)
1419 {
1420 int len;
1421 int val;
1422 struct sock *sk = sock->sk;
1423 struct packet_sock *po = pkt_sk(sk);
1424 void *data;
1425 struct tpacket_stats st;
1426
1427 if (level != SOL_PACKET)
1428 return -ENOPROTOOPT;
1429
1430 if (get_user(len, optlen))
1431 return -EFAULT;
1432
1433 if (len < 0)
1434 return -EINVAL;
1435
1436 switch(optname) {
1437 case PACKET_STATISTICS:
1438 if (len > sizeof(struct tpacket_stats))
1439 len = sizeof(struct tpacket_stats);
1440 spin_lock_bh(&sk->sk_receive_queue.lock);
1441 st = po->stats;
1442 memset(&po->stats, 0, sizeof(st));
1443 spin_unlock_bh(&sk->sk_receive_queue.lock);
1444 st.tp_packets += st.tp_drops;
1445
1446 data = &st;
1447 break;
1448 case PACKET_AUXDATA:
1449 if (len > sizeof(int))
1450 len = sizeof(int);
1451 val = po->auxdata;
1452
1453 data = &val;
1454 break;
1455 case PACKET_ORIGDEV:
1456 if (len > sizeof(int))
1457 len = sizeof(int);
1458 val = po->origdev;
1459
1460 data = &val;
1461 break;
1462 default:
1463 return -ENOPROTOOPT;
1464 }
1465
1466 if (put_user(len, optlen))
1467 return -EFAULT;
1468 if (copy_to_user(optval, data, len))
1469 return -EFAULT;
1470 return 0;
1471 }
1472
1473
1474 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1475 {
1476 struct sock *sk;
1477 struct hlist_node *node;
1478 struct net_device *dev = data;
1479
1480 read_lock(&packet_sklist_lock);
1481 sk_for_each(sk, node, &packet_sklist) {
1482 struct packet_sock *po = pkt_sk(sk);
1483
1484 switch (msg) {
1485 case NETDEV_UNREGISTER:
1486 if (po->mclist)
1487 packet_dev_mclist(dev, po->mclist, -1);
1488 /* fallthrough */
1489
1490 case NETDEV_DOWN:
1491 if (dev->ifindex == po->ifindex) {
1492 spin_lock(&po->bind_lock);
1493 if (po->running) {
1494 __dev_remove_pack(&po->prot_hook);
1495 __sock_put(sk);
1496 po->running = 0;
1497 sk->sk_err = ENETDOWN;
1498 if (!sock_flag(sk, SOCK_DEAD))
1499 sk->sk_error_report(sk);
1500 }
1501 if (msg == NETDEV_UNREGISTER) {
1502 po->ifindex = -1;
1503 po->prot_hook.dev = NULL;
1504 }
1505 spin_unlock(&po->bind_lock);
1506 }
1507 break;
1508 case NETDEV_UP:
1509 spin_lock(&po->bind_lock);
1510 if (dev->ifindex == po->ifindex && po->num &&
1511 !po->running) {
1512 dev_add_pack(&po->prot_hook);
1513 sock_hold(sk);
1514 po->running = 1;
1515 }
1516 spin_unlock(&po->bind_lock);
1517 break;
1518 }
1519 }
1520 read_unlock(&packet_sklist_lock);
1521 return NOTIFY_DONE;
1522 }
1523
1524
1525 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1526 unsigned long arg)
1527 {
1528 struct sock *sk = sock->sk;
1529
1530 switch(cmd) {
1531 case SIOCOUTQ:
1532 {
1533 int amount = atomic_read(&sk->sk_wmem_alloc);
1534 return put_user(amount, (int __user *)arg);
1535 }
1536 case SIOCINQ:
1537 {
1538 struct sk_buff *skb;
1539 int amount = 0;
1540
1541 spin_lock_bh(&sk->sk_receive_queue.lock);
1542 skb = skb_peek(&sk->sk_receive_queue);
1543 if (skb)
1544 amount = skb->len;
1545 spin_unlock_bh(&sk->sk_receive_queue.lock);
1546 return put_user(amount, (int __user *)arg);
1547 }
1548 case SIOCGSTAMP:
1549 return sock_get_timestamp(sk, (struct timeval __user *)arg);
1550 case SIOCGSTAMPNS:
1551 return sock_get_timestampns(sk, (struct timespec __user *)arg);
1552
1553 #ifdef CONFIG_INET
1554 case SIOCADDRT:
1555 case SIOCDELRT:
1556 case SIOCDARP:
1557 case SIOCGARP:
1558 case SIOCSARP:
1559 case SIOCGIFADDR:
1560 case SIOCSIFADDR:
1561 case SIOCGIFBRDADDR:
1562 case SIOCSIFBRDADDR:
1563 case SIOCGIFNETMASK:
1564 case SIOCSIFNETMASK:
1565 case SIOCGIFDSTADDR:
1566 case SIOCSIFDSTADDR:
1567 case SIOCSIFFLAGS:
1568 return inet_dgram_ops.ioctl(sock, cmd, arg);
1569 #endif
1570
1571 default:
1572 return -ENOIOCTLCMD;
1573 }
1574 return 0;
1575 }
1576
1577 #ifndef CONFIG_PACKET_MMAP
1578 #define packet_mmap sock_no_mmap
1579 #define packet_poll datagram_poll
1580 #else
1581
1582 static unsigned int packet_poll(struct file * file, struct socket *sock,
1583 poll_table *wait)
1584 {
1585 struct sock *sk = sock->sk;
1586 struct packet_sock *po = pkt_sk(sk);
1587 unsigned int mask = datagram_poll(file, sock, wait);
1588
1589 spin_lock_bh(&sk->sk_receive_queue.lock);
1590 if (po->pg_vec) {
1591 unsigned last = po->head ? po->head-1 : po->frame_max;
1592 struct tpacket_hdr *h;
1593
1594 h = packet_lookup_frame(po, last);
1595
1596 if (h->tp_status)
1597 mask |= POLLIN | POLLRDNORM;
1598 }
1599 spin_unlock_bh(&sk->sk_receive_queue.lock);
1600 return mask;
1601 }
1602
1603
1604 /* Dirty? Well, I still did not learn better way to account
1605 * for user mmaps.
1606 */
1607
1608 static void packet_mm_open(struct vm_area_struct *vma)
1609 {
1610 struct file *file = vma->vm_file;
1611 struct socket * sock = file->private_data;
1612 struct sock *sk = sock->sk;
1613
1614 if (sk)
1615 atomic_inc(&pkt_sk(sk)->mapped);
1616 }
1617
1618 static void packet_mm_close(struct vm_area_struct *vma)
1619 {
1620 struct file *file = vma->vm_file;
1621 struct socket * sock = file->private_data;
1622 struct sock *sk = sock->sk;
1623
1624 if (sk)
1625 atomic_dec(&pkt_sk(sk)->mapped);
1626 }
1627
1628 static struct vm_operations_struct packet_mmap_ops = {
1629 .open = packet_mm_open,
1630 .close =packet_mm_close,
1631 };
1632
1633 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order)
1634 {
1635 return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1);
1636 }
1637
1638 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1639 {
1640 int i;
1641
1642 for (i = 0; i < len; i++) {
1643 if (likely(pg_vec[i]))
1644 free_pages((unsigned long) pg_vec[i], order);
1645 }
1646 kfree(pg_vec);
1647 }
1648
1649 static inline char *alloc_one_pg_vec_page(unsigned long order)
1650 {
1651 return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1652 order);
1653 }
1654
1655 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1656 {
1657 unsigned int block_nr = req->tp_block_nr;
1658 char **pg_vec;
1659 int i;
1660
1661 pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1662 if (unlikely(!pg_vec))
1663 goto out;
1664
1665 for (i = 0; i < block_nr; i++) {
1666 pg_vec[i] = alloc_one_pg_vec_page(order);
1667 if (unlikely(!pg_vec[i]))
1668 goto out_free_pgvec;
1669 }
1670
1671 out:
1672 return pg_vec;
1673
1674 out_free_pgvec:
1675 free_pg_vec(pg_vec, order, block_nr);
1676 pg_vec = NULL;
1677 goto out;
1678 }
1679
1680 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1681 {
1682 char **pg_vec = NULL;
1683 struct packet_sock *po = pkt_sk(sk);
1684 int was_running, order = 0;
1685 __be16 num;
1686 int err = 0;
1687
1688 if (req->tp_block_nr) {
1689 int i, l;
1690
1691 /* Sanity tests and some calculations */
1692
1693 if (unlikely(po->pg_vec))
1694 return -EBUSY;
1695
1696 if (unlikely((int)req->tp_block_size <= 0))
1697 return -EINVAL;
1698 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1699 return -EINVAL;
1700 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN))
1701 return -EINVAL;
1702 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1703 return -EINVAL;
1704
1705 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1706 if (unlikely(po->frames_per_block <= 0))
1707 return -EINVAL;
1708 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1709 req->tp_frame_nr))
1710 return -EINVAL;
1711
1712 err = -ENOMEM;
1713 order = get_order(req->tp_block_size);
1714 pg_vec = alloc_pg_vec(req, order);
1715 if (unlikely(!pg_vec))
1716 goto out;
1717
1718 l = 0;
1719 for (i = 0; i < req->tp_block_nr; i++) {
1720 char *ptr = pg_vec[i];
1721 struct tpacket_hdr *header;
1722 int k;
1723
1724 for (k = 0; k < po->frames_per_block; k++) {
1725 header = (struct tpacket_hdr *) ptr;
1726 header->tp_status = TP_STATUS_KERNEL;
1727 ptr += req->tp_frame_size;
1728 }
1729 }
1730 /* Done */
1731 } else {
1732 if (unlikely(req->tp_frame_nr))
1733 return -EINVAL;
1734 }
1735
1736 lock_sock(sk);
1737
1738 /* Detach socket from network */
1739 spin_lock(&po->bind_lock);
1740 was_running = po->running;
1741 num = po->num;
1742 if (was_running) {
1743 __dev_remove_pack(&po->prot_hook);
1744 po->num = 0;
1745 po->running = 0;
1746 __sock_put(sk);
1747 }
1748 spin_unlock(&po->bind_lock);
1749
1750 synchronize_net();
1751
1752 err = -EBUSY;
1753 if (closing || atomic_read(&po->mapped) == 0) {
1754 err = 0;
1755 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1756
1757 spin_lock_bh(&sk->sk_receive_queue.lock);
1758 pg_vec = XC(po->pg_vec, pg_vec);
1759 po->frame_max = (req->tp_frame_nr - 1);
1760 po->head = 0;
1761 po->frame_size = req->tp_frame_size;
1762 spin_unlock_bh(&sk->sk_receive_queue.lock);
1763
1764 order = XC(po->pg_vec_order, order);
1765 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1766
1767 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1768 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1769 skb_queue_purge(&sk->sk_receive_queue);
1770 #undef XC
1771 if (atomic_read(&po->mapped))
1772 printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1773 }
1774
1775 spin_lock(&po->bind_lock);
1776 if (was_running && !po->running) {
1777 sock_hold(sk);
1778 po->running = 1;
1779 po->num = num;
1780 dev_add_pack(&po->prot_hook);
1781 }
1782 spin_unlock(&po->bind_lock);
1783
1784 release_sock(sk);
1785
1786 if (pg_vec)
1787 free_pg_vec(pg_vec, order, req->tp_block_nr);
1788 out:
1789 return err;
1790 }
1791
1792 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1793 {
1794 struct sock *sk = sock->sk;
1795 struct packet_sock *po = pkt_sk(sk);
1796 unsigned long size;
1797 unsigned long start;
1798 int err = -EINVAL;
1799 int i;
1800
1801 if (vma->vm_pgoff)
1802 return -EINVAL;
1803
1804 size = vma->vm_end - vma->vm_start;
1805
1806 lock_sock(sk);
1807 if (po->pg_vec == NULL)
1808 goto out;
1809 if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1810 goto out;
1811
1812 start = vma->vm_start;
1813 for (i = 0; i < po->pg_vec_len; i++) {
1814 struct page *page = virt_to_page(po->pg_vec[i]);
1815 int pg_num;
1816
1817 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1818 err = vm_insert_page(vma, start, page);
1819 if (unlikely(err))
1820 goto out;
1821 start += PAGE_SIZE;
1822 }
1823 }
1824 atomic_inc(&po->mapped);
1825 vma->vm_ops = &packet_mmap_ops;
1826 err = 0;
1827
1828 out:
1829 release_sock(sk);
1830 return err;
1831 }
1832 #endif
1833
1834
1835 static const struct proto_ops packet_ops_spkt = {
1836 .family = PF_PACKET,
1837 .owner = THIS_MODULE,
1838 .release = packet_release,
1839 .bind = packet_bind_spkt,
1840 .connect = sock_no_connect,
1841 .socketpair = sock_no_socketpair,
1842 .accept = sock_no_accept,
1843 .getname = packet_getname_spkt,
1844 .poll = datagram_poll,
1845 .ioctl = packet_ioctl,
1846 .listen = sock_no_listen,
1847 .shutdown = sock_no_shutdown,
1848 .setsockopt = sock_no_setsockopt,
1849 .getsockopt = sock_no_getsockopt,
1850 .sendmsg = packet_sendmsg_spkt,
1851 .recvmsg = packet_recvmsg,
1852 .mmap = sock_no_mmap,
1853 .sendpage = sock_no_sendpage,
1854 };
1855
1856 static const struct proto_ops packet_ops = {
1857 .family = PF_PACKET,
1858 .owner = THIS_MODULE,
1859 .release = packet_release,
1860 .bind = packet_bind,
1861 .connect = sock_no_connect,
1862 .socketpair = sock_no_socketpair,
1863 .accept = sock_no_accept,
1864 .getname = packet_getname,
1865 .poll = packet_poll,
1866 .ioctl = packet_ioctl,
1867 .listen = sock_no_listen,
1868 .shutdown = sock_no_shutdown,
1869 .setsockopt = packet_setsockopt,
1870 .getsockopt = packet_getsockopt,
1871 .sendmsg = packet_sendmsg,
1872 .recvmsg = packet_recvmsg,
1873 .mmap = packet_mmap,
1874 .sendpage = sock_no_sendpage,
1875 };
1876
1877 static struct net_proto_family packet_family_ops = {
1878 .family = PF_PACKET,
1879 .create = packet_create,
1880 .owner = THIS_MODULE,
1881 };
1882
1883 static struct notifier_block packet_netdev_notifier = {
1884 .notifier_call =packet_notifier,
1885 };
1886
1887 #ifdef CONFIG_PROC_FS
1888 static inline struct sock *packet_seq_idx(loff_t off)
1889 {
1890 struct sock *s;
1891 struct hlist_node *node;
1892
1893 sk_for_each(s, node, &packet_sklist) {
1894 if (!off--)
1895 return s;
1896 }
1897 return NULL;
1898 }
1899
1900 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
1901 {
1902 read_lock(&packet_sklist_lock);
1903 return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN;
1904 }
1905
1906 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1907 {
1908 ++*pos;
1909 return (v == SEQ_START_TOKEN)
1910 ? sk_head(&packet_sklist)
1911 : sk_next((struct sock*)v) ;
1912 }
1913
1914 static void packet_seq_stop(struct seq_file *seq, void *v)
1915 {
1916 read_unlock(&packet_sklist_lock);
1917 }
1918
1919 static int packet_seq_show(struct seq_file *seq, void *v)
1920 {
1921 if (v == SEQ_START_TOKEN)
1922 seq_puts(seq, "sk RefCnt Type Proto Iface R Rmem User Inode\n");
1923 else {
1924 struct sock *s = v;
1925 const struct packet_sock *po = pkt_sk(s);
1926
1927 seq_printf(seq,
1928 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
1929 s,
1930 atomic_read(&s->sk_refcnt),
1931 s->sk_type,
1932 ntohs(po->num),
1933 po->ifindex,
1934 po->running,
1935 atomic_read(&s->sk_rmem_alloc),
1936 sock_i_uid(s),
1937 sock_i_ino(s) );
1938 }
1939
1940 return 0;
1941 }
1942
1943 static const struct seq_operations packet_seq_ops = {
1944 .start = packet_seq_start,
1945 .next = packet_seq_next,
1946 .stop = packet_seq_stop,
1947 .show = packet_seq_show,
1948 };
1949
1950 static int packet_seq_open(struct inode *inode, struct file *file)
1951 {
1952 return seq_open(file, &packet_seq_ops);
1953 }
1954
1955 static const struct file_operations packet_seq_fops = {
1956 .owner = THIS_MODULE,
1957 .open = packet_seq_open,
1958 .read = seq_read,
1959 .llseek = seq_lseek,
1960 .release = seq_release,
1961 };
1962
1963 #endif
1964
1965 static void __exit packet_exit(void)
1966 {
1967 proc_net_remove(&init_net, "packet");
1968 unregister_netdevice_notifier(&packet_netdev_notifier);
1969 sock_unregister(PF_PACKET);
1970 proto_unregister(&packet_proto);
1971 }
1972
1973 static int __init packet_init(void)
1974 {
1975 int rc = proto_register(&packet_proto, 0);
1976
1977 if (rc != 0)
1978 goto out;
1979
1980 sock_register(&packet_family_ops);
1981 register_netdevice_notifier(&packet_netdev_notifier);
1982 proc_net_fops_create(&init_net, "packet", 0, &packet_seq_fops);
1983 out:
1984 return rc;
1985 }
1986
1987 module_init(packet_init);
1988 module_exit(packet_exit);
1989 MODULE_LICENSE("GPL");
1990 MODULE_ALIAS_NETPROTO(PF_PACKET);
kmemtrace - Kernel memory tracer