net/rxrpc/ar-input.c

   1 /* RxRPC packet reception
   2  *
   3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/net.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/errqueue.h>
  16 #include <linux/udp.h>
  17 #include <linux/in.h>
  18 #include <linux/in6.h>
  19 #include <linux/icmp.h>
  20 #include <net/sock.h>
  21 #include <net/af_rxrpc.h>
  22 #include <net/ip.h>
  23 #include "ar-internal.h"
  24
  25 unsigned long rxrpc_ack_timeout = 1;
  26
  27 const char *rxrpc_pkts[] = {
  28         "?00",
  29         "DATA", "ACK", "BUSY", "ABORT", "ACKALL", "CHALL", "RESP", "DEBUG",
  30         "?09", "?10", "?11", "?12", "?13", "?14", "?15"
  31 };
  32
  33 /*
  34  * queue a packet for recvmsg to pass to userspace
  35  * - the caller must hold a lock on call->lock
  36  * - must not be called with interrupts disabled (sk_filter() disables BH's)
  37  * - eats the packet whether successful or not
  38  * - there must be just one reference to the packet, which the caller passes to
  39  *   this function
  40  */
  41 int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
  42                         bool force, bool terminal)
  43 {
  44         struct rxrpc_skb_priv *sp;
  45         struct rxrpc_sock *rx = call->socket;
  46         struct sock *sk;
  47         int skb_len, ret;
  48
  49         _enter(",,%d,%d", force, terminal);
  50
  51         ASSERT(!irqs_disabled());
  52
  53         sp = rxrpc_skb(skb);
  54         ASSERTCMP(sp->call, ==, call);
  55
  56         /* if we've already posted the terminal message for a call, then we
  57          * don't post any more */
  58         if (test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
  59                 _debug("already terminated");
  60                 ASSERTCMP(call->state, >=, RXRPC_CALL_COMPLETE);
  61                 skb->destructor = NULL;
  62                 sp->call = NULL;
  63                 rxrpc_put_call(call);
  64                 rxrpc_free_skb(skb);
  65                 return 0;
  66         }
  67
  68         sk = &rx->sk;
  69
  70         if (!force) {
  71                 /* cast skb->rcvbuf to unsigned...  It's pointless, but
  72                  * reduces number of warnings when compiling with -W
  73                  * --ANK */
  74 //              ret = -ENOBUFS;
  75 //              if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
  76 //                  (unsigned) sk->sk_rcvbuf)
  77 //                      goto out;
  78
  79                 ret = sk_filter(sk, skb);
  80                 if (ret < 0)
  81                         goto out;
  82         }
  83
  84         spin_lock_bh(&sk->sk_receive_queue.lock);
  85         if (!test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags) &&
  86             !test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
  87             call->socket->sk.sk_state != RXRPC_CLOSE) {
  88                 skb->destructor = rxrpc_packet_destructor;
  89                 skb->dev = NULL;
  90                 skb->sk = sk;
  91                 atomic_add(skb->truesize, &sk->sk_rmem_alloc);
  92
  93                 if (terminal) {
  94                         _debug("<<<< TERMINAL MESSAGE >>>>");
  95                         set_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags);
  96                 }
  97
  98                 /* allow interception by a kernel service */
  99                 if (rx->interceptor) {
 100                         rx->interceptor(sk, call->user_call_ID, skb);
 101                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 102                 } else {
 103
 104                         /* Cache the SKB length before we tack it onto the
 105                          * receive queue.  Once it is added it no longer
 106                          * belongs to us and may be freed by other threads of
 107                          * control pulling packets from the queue */
 108                         skb_len = skb->len;
 109
 110                         _net("post skb %p", skb);
 111                         __skb_queue_tail(&sk->sk_receive_queue, skb);
 112                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 113
 114                         if (!sock_flag(sk, SOCK_DEAD))
 115                                 sk->sk_data_ready(sk, skb_len);
 116                 }
 117                 skb = NULL;
 118         } else {
 119                 spin_unlock_bh(&sk->sk_receive_queue.lock);
 120         }
 121         ret = 0;
 122
 123 out:
 124         /* release the socket buffer */
 125         if (skb) {
 126                 skb->destructor = NULL;
 127                 sp->call = NULL;
 128                 rxrpc_put_call(call);
 129                 rxrpc_free_skb(skb);
 130         }
 131
 132         _leave(" = %d", ret);
 133         return ret;
 134 }
 135
 136 /*
 137  * process a DATA packet, posting the packet to the appropriate queue
 138  * - eats the packet if successful
 139  */
 140 static int rxrpc_fast_process_data(struct rxrpc_call *call,
 141                                    struct sk_buff *skb, u32 seq)
 142 {
 143         struct rxrpc_skb_priv *sp;
 144         bool terminal;
 145         int ret, ackbit, ack;
 146
 147         _enter("{%u,%u},,{%u}", call->rx_data_post, call->rx_first_oos, seq);
 148
 149         sp = rxrpc_skb(skb);
 150         ASSERTCMP(sp->call, ==, NULL);
 151
 152         spin_lock(&call->lock);
 153
 154         if (call->state > RXRPC_CALL_COMPLETE)
 155                 goto discard;
 156
 157         ASSERTCMP(call->rx_data_expect, >=, call->rx_data_post);
 158         ASSERTCMP(call->rx_data_post, >=, call->rx_data_recv);
 159         ASSERTCMP(call->rx_data_recv, >=, call->rx_data_eaten);
 160
 161         if (seq < call->rx_data_post) {
 162                 _debug("dup #%u [-%u]", seq, call->rx_data_post);
 163                 ack = RXRPC_ACK_DUPLICATE;
 164                 ret = -ENOBUFS;
 165                 goto discard_and_ack;
 166         }
 167
 168         /* we may already have the packet in the out of sequence queue */
 169         ackbit = seq - (call->rx_data_eaten + 1);
 170         ASSERTCMP(ackbit, >=, 0);
 171         if (__test_and_set_bit(ackbit, &call->ackr_window)) {
 172                 _debug("dup oos #%u [%u,%u]",
 173                        seq, call->rx_data_eaten, call->rx_data_post);
 174                 ack = RXRPC_ACK_DUPLICATE;
 175                 goto discard_and_ack;
 176         }
 177
 178         if (seq >= call->ackr_win_top) {
 179                 _debug("exceed #%u [%u]", seq, call->ackr_win_top);
 180                 __clear_bit(ackbit, &call->ackr_window);
 181                 ack = RXRPC_ACK_EXCEEDS_WINDOW;
 182                 goto discard_and_ack;
 183         }
 184
 185         if (seq == call->rx_data_expect) {
 186                 clear_bit(RXRPC_CALL_EXPECT_OOS, &call->flags);
 187                 call->rx_data_expect++;
 188         } else if (seq > call->rx_data_expect) {
 189                 _debug("oos #%u [%u]", seq, call->rx_data_expect);
 190                 call->rx_data_expect = seq + 1;
 191                 if (test_and_set_bit(RXRPC_CALL_EXPECT_OOS, &call->flags)) {
 192                         ack = RXRPC_ACK_OUT_OF_SEQUENCE;
 193                         goto enqueue_and_ack;
 194                 }
 195                 goto enqueue_packet;
 196         }
 197
 198         if (seq != call->rx_data_post) {
 199                 _debug("ahead #%u [%u]", seq, call->rx_data_post);
 200                 goto enqueue_packet;
 201         }
 202
 203         if (test_bit(RXRPC_CALL_RCVD_LAST, &call->flags))
 204                 goto protocol_error;
 205
 206         /* if the packet need security things doing to it, then it goes down
 207          * the slow path */
 208         if (call->conn->security)
 209                 goto enqueue_packet;
 210
 211         sp->call = call;
 212         rxrpc_get_call(call);
 213         terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
 214                     !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
 215         ret = rxrpc_queue_rcv_skb(call, skb, false, terminal);
 216         if (ret < 0) {
 217                 if (ret == -ENOMEM || ret == -ENOBUFS) {
 218                         __clear_bit(ackbit, &call->ackr_window);
 219                         ack = RXRPC_ACK_NOSPACE;
 220                         goto discard_and_ack;
 221                 }
 222                 goto out;
 223         }
 224
 225         skb = NULL;
 226
 227         _debug("post #%u", seq);
 228         ASSERTCMP(call->rx_data_post, ==, seq);
 229         call->rx_data_post++;
 230
 231         if (sp->hdr.flags & RXRPC_LAST_PACKET)
 232                 set_bit(RXRPC_CALL_RCVD_LAST, &call->flags);
 233
 234         /* if we've reached an out of sequence packet then we need to drain
 235          * that queue into the socket Rx queue now */
 236         if (call->rx_data_post == call->rx_first_oos) {
 237                 _debug("drain rx oos now");
 238                 read_lock(&call->state_lock);
 239                 if (call->state < RXRPC_CALL_COMPLETE &&
 240                     !test_and_set_bit(RXRPC_CALL_DRAIN_RX_OOS, &call->events))
 241                         rxrpc_queue_call(call);
 242                 read_unlock(&call->state_lock);
 243         }
 244
 245         spin_unlock(&call->lock);
 246         atomic_inc(&call->ackr_not_idle);
 247         rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, sp->hdr.serial, false);
 248         _leave(" = 0 [posted]");
 249         return 0;
 250
 251 protocol_error:
 252         ret = -EBADMSG;
 253 out:
 254         spin_unlock(&call->lock);
 255         _leave(" = %d", ret);
 256         return ret;
 257
 258 discard_and_ack:
 259         _debug("discard and ACK packet %p", skb);
 260         __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
 261 discard:
 262         spin_unlock(&call->lock);
 263         rxrpc_free_skb(skb);
 264         _leave(" = 0 [discarded]");
 265         return 0;
 266
 267 enqueue_and_ack:
 268         __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
 269 enqueue_packet:
 270         _net("defer skb %p", skb);
 271         spin_unlock(&call->lock);
 272         skb_queue_tail(&call->rx_queue, skb);
 273         atomic_inc(&call->ackr_not_idle);
 274         read_lock(&call->state_lock);
 275         if (call->state < RXRPC_CALL_DEAD)
 276                 rxrpc_queue_call(call);
 277         read_unlock(&call->state_lock);
 278         _leave(" = 0 [queued]");
 279         return 0;
 280 }
 281
 282 /*
 283  * assume an implicit ACKALL of the transmission phase of a client socket upon
 284  * reception of the first reply packet
 285  */
 286 static void rxrpc_assume_implicit_ackall(struct rxrpc_call *call, u32 serial)
 287 {
 288         write_lock_bh(&call->state_lock);
 289
 290         switch (call->state) {
 291         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
 292                 call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
 293                 call->acks_latest = serial;
 294
 295                 _debug("implicit ACKALL %%%u", call->acks_latest);
 296                 set_bit(RXRPC_CALL_RCVD_ACKALL, &call->events);
 297                 write_unlock_bh(&call->state_lock);
 298
 299                 if (try_to_del_timer_sync(&call->resend_timer) >= 0) {
 300                         clear_bit(RXRPC_CALL_RESEND_TIMER, &call->events);
 301                         clear_bit(RXRPC_CALL_RESEND, &call->events);
 302                         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 303                 }
 304                 break;
 305
 306         default:
 307                 write_unlock_bh(&call->state_lock);
 308                 break;
 309         }
 310 }
 311
 312 /*
 313  * post an incoming packet to the nominated call to deal with
 314  * - must get rid of the sk_buff, either by freeing it or by queuing it
 315  */
 316 void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
 317 {
 318         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 319         __be32 _abort_code;
 320         u32 serial, hi_serial, seq, abort_code;
 321
 322         _enter("%p,%p", call, skb);
 323
 324         ASSERT(!irqs_disabled());
 325
 326 #if 0 // INJECT RX ERROR
 327         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA) {
 328                 static int skip = 0;
 329                 if (++skip == 3) {
 330                         printk("DROPPED 3RD PACKET!!!!!!!!!!!!!\n");
 331                         skip = 0;
 332                         goto free_packet;
 333                 }
 334         }
 335 #endif
 336
 337         /* track the latest serial number on this connection for ACK packet
 338          * information */
 339         serial = ntohl(sp->hdr.serial);
 340         hi_serial = atomic_read(&call->conn->hi_serial);
 341         while (serial > hi_serial)
 342                 hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
 343                                            serial);
 344
 345         /* request ACK generation for any ACK or DATA packet that requests
 346          * it */
 347         if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
 348                 _proto("ACK Requested on %%%u", serial);
 349                 rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, sp->hdr.serial,
 350                                   !(sp->hdr.flags & RXRPC_MORE_PACKETS));
 351         }
 352
 353         switch (sp->hdr.type) {
 354         case RXRPC_PACKET_TYPE_ABORT:
 355                 _debug("abort");
 356
 357                 if (skb_copy_bits(skb, 0, &_abort_code,
 358                                   sizeof(_abort_code)) < 0)
 359                         goto protocol_error;
 360
 361                 abort_code = ntohl(_abort_code);
 362                 _proto("Rx ABORT %%%u { %x }", serial, abort_code);
 363
 364                 write_lock_bh(&call->state_lock);
 365                 if (call->state < RXRPC_CALL_COMPLETE) {
 366                         call->state = RXRPC_CALL_REMOTELY_ABORTED;
 367                         call->abort_code = abort_code;
 368                         set_bit(RXRPC_CALL_RCVD_ABORT, &call->events);
 369                         rxrpc_queue_call(call);
 370                 }
 371                 goto free_packet_unlock;
 372
 373         case RXRPC_PACKET_TYPE_BUSY:
 374                 _proto("Rx BUSY %%%u", serial);
 375
 376                 if (call->conn->out_clientflag)
 377                         goto protocol_error;
 378
 379                 write_lock_bh(&call->state_lock);
 380                 switch (call->state) {
 381                 case RXRPC_CALL_CLIENT_SEND_REQUEST:
 382                         call->state = RXRPC_CALL_SERVER_BUSY;
 383                         set_bit(RXRPC_CALL_RCVD_BUSY, &call->events);
 384                         rxrpc_queue_call(call);
 385                 case RXRPC_CALL_SERVER_BUSY:
 386                         goto free_packet_unlock;
 387                 default:
 388                         goto protocol_error_locked;
 389                 }
 390
 391         default:
 392                 _proto("Rx %s %%%u", rxrpc_pkts[sp->hdr.type], serial);
 393                 goto protocol_error;
 394
 395         case RXRPC_PACKET_TYPE_DATA:
 396                 seq = ntohl(sp->hdr.seq);
 397
 398                 _proto("Rx DATA %%%u { #%u }", serial, seq);
 399
 400                 if (seq == 0)
 401                         goto protocol_error;
 402
 403                 call->ackr_prev_seq = sp->hdr.seq;
 404
 405                 /* received data implicitly ACKs all of the request packets we
 406                  * sent when we're acting as a client */
 407                 if (call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY)
 408                         rxrpc_assume_implicit_ackall(call, serial);
 409
 410                 switch (rxrpc_fast_process_data(call, skb, seq)) {
 411                 case 0:
 412                         skb = NULL;
 413                         goto done;
 414
 415                 default:
 416                         BUG();
 417
 418                         /* data packet received beyond the last packet */
 419                 case -EBADMSG:
 420                         goto protocol_error;
 421                 }
 422
 423         case RXRPC_PACKET_TYPE_ACK:
 424                 /* ACK processing is done in process context */
 425                 read_lock_bh(&call->state_lock);
 426                 if (call->state < RXRPC_CALL_DEAD) {
 427                         skb_queue_tail(&call->rx_queue, skb);
 428                         rxrpc_queue_call(call);
 429                         skb = NULL;
 430                 }
 431                 read_unlock_bh(&call->state_lock);
 432                 goto free_packet;
 433         }
 434
 435 protocol_error:
 436         _debug("protocol error");
 437         write_lock_bh(&call->state_lock);
 438 protocol_error_locked:
 439         if (call->state <= RXRPC_CALL_COMPLETE) {
 440                 call->state = RXRPC_CALL_LOCALLY_ABORTED;
 441                 call->abort_code = RX_PROTOCOL_ERROR;
 442                 set_bit(RXRPC_CALL_ABORT, &call->events);
 443                 rxrpc_queue_call(call);
 444         }
 445 free_packet_unlock:
 446         write_unlock_bh(&call->state_lock);
 447 free_packet:
 448         rxrpc_free_skb(skb);
 449 done:
 450         _leave("");
 451 }
 452
 453 /*
 454  * split up a jumbo data packet
 455  */
 456 static void rxrpc_process_jumbo_packet(struct rxrpc_call *call,
 457                                        struct sk_buff *jumbo)
 458 {
 459         struct rxrpc_jumbo_header jhdr;
 460         struct rxrpc_skb_priv *sp;
 461         struct sk_buff *part;
 462
 463         _enter(",{%u,%u}", jumbo->data_len, jumbo->len);
 464
 465         sp = rxrpc_skb(jumbo);
 466
 467         do {
 468                 sp->hdr.flags &= ~RXRPC_JUMBO_PACKET;
 469
 470                 /* make a clone to represent the first subpacket in what's left
 471                  * of the jumbo packet */
 472                 part = skb_clone(jumbo, GFP_ATOMIC);
 473                 if (!part) {
 474                         /* simply ditch the tail in the event of ENOMEM */
 475                         pskb_trim(jumbo, RXRPC_JUMBO_DATALEN);
 476                         break;
 477                 }
 478                 rxrpc_new_skb(part);
 479
 480                 pskb_trim(part, RXRPC_JUMBO_DATALEN);
 481
 482                 if (!pskb_pull(jumbo, RXRPC_JUMBO_DATALEN))
 483                         goto protocol_error;
 484
 485                 if (skb_copy_bits(jumbo, 0, &jhdr, sizeof(jhdr)) < 0)
 486                         goto protocol_error;
 487                 if (!pskb_pull(jumbo, sizeof(jhdr)))
 488                         BUG();
 489
 490                 sp->hdr.seq     = htonl(ntohl(sp->hdr.seq) + 1);
 491                 sp->hdr.serial  = htonl(ntohl(sp->hdr.serial) + 1);
 492                 sp->hdr.flags   = jhdr.flags;
 493                 sp->hdr._rsvd   = jhdr._rsvd;
 494
 495                 _proto("Rx DATA Jumbo %%%u", ntohl(sp->hdr.serial) - 1);
 496
 497                 rxrpc_fast_process_packet(call, part);
 498                 part = NULL;
 499
 500         } while (sp->hdr.flags & RXRPC_JUMBO_PACKET);
 501
 502         rxrpc_fast_process_packet(call, jumbo);
 503         _leave("");
 504         return;
 505
 506 protocol_error:
 507         _debug("protocol error");
 508         rxrpc_free_skb(part);
 509         rxrpc_free_skb(jumbo);
 510         write_lock_bh(&call->state_lock);
 511         if (call->state <= RXRPC_CALL_COMPLETE) {
 512                 call->state = RXRPC_CALL_LOCALLY_ABORTED;
 513                 call->abort_code = RX_PROTOCOL_ERROR;
 514                 set_bit(RXRPC_CALL_ABORT, &call->events);
 515                 rxrpc_queue_call(call);
 516         }
 517         write_unlock_bh(&call->state_lock);
 518         _leave("");
 519 }
 520
 521 /*
 522  * post an incoming packet to the appropriate call/socket to deal with
 523  * - must get rid of the sk_buff, either by freeing it or by queuing it
 524  */
 525 static void rxrpc_post_packet_to_call(struct rxrpc_connection *conn,
 526                                       struct sk_buff *skb)
 527 {
 528         struct rxrpc_skb_priv *sp;
 529         struct rxrpc_call *call;
 530         struct rb_node *p;
 531         __be32 call_id;
 532
 533         _enter("%p,%p", conn, skb);
 534
 535         read_lock_bh(&conn->lock);
 536
 537         sp = rxrpc_skb(skb);
 538
 539         /* look at extant calls by channel number first */
 540         call = conn->channels[ntohl(sp->hdr.cid) & RXRPC_CHANNELMASK];
 541         if (!call || call->call_id != sp->hdr.callNumber)
 542                 goto call_not_extant;
 543
 544         _debug("extant call [%d]", call->state);
 545         ASSERTCMP(call->conn, ==, conn);
 546
 547         read_lock(&call->state_lock);
 548         switch (call->state) {
 549         case RXRPC_CALL_LOCALLY_ABORTED:
 550                 if (!test_and_set_bit(RXRPC_CALL_ABORT, &call->events))
 551                         rxrpc_queue_call(call);
 552         case RXRPC_CALL_REMOTELY_ABORTED:
 553         case RXRPC_CALL_NETWORK_ERROR:
 554         case RXRPC_CALL_DEAD:
 555                 goto free_unlock;
 556         default:
 557                 break;
 558         }
 559
 560         read_unlock(&call->state_lock);
 561         rxrpc_get_call(call);
 562         read_unlock_bh(&conn->lock);
 563
 564         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 565             sp->hdr.flags & RXRPC_JUMBO_PACKET)
 566                 rxrpc_process_jumbo_packet(call, skb);
 567         else
 568                 rxrpc_fast_process_packet(call, skb);
 569
 570         rxrpc_put_call(call);
 571         goto done;
 572
 573 call_not_extant:
 574         /* search the completed calls in case what we're dealing with is
 575          * there */
 576         _debug("call not extant");
 577
 578         call_id = sp->hdr.callNumber;
 579         p = conn->calls.rb_node;
 580         while (p) {
 581                 call = rb_entry(p, struct rxrpc_call, conn_node);
 582
 583                 if (call_id < call->call_id)
 584                         p = p->rb_left;
 585                 else if (call_id > call->call_id)
 586                         p = p->rb_right;
 587                 else
 588                         goto found_completed_call;
 589         }
 590
 591 dead_call:
 592         /* it's a either a really old call that we no longer remember or its a
 593          * new incoming call */
 594         read_unlock_bh(&conn->lock);
 595
 596         if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
 597             sp->hdr.seq == __constant_cpu_to_be32(1)) {
 598                 _debug("incoming call");
 599                 skb_queue_tail(&conn->trans->local->accept_queue, skb);
 600                 rxrpc_queue_work(&conn->trans->local->acceptor);
 601                 goto done;
 602         }
 603
 604         _debug("dead call");
 605         skb->priority = RX_CALL_DEAD;
 606         rxrpc_reject_packet(conn->trans->local, skb);
 607         goto done;
 608
 609         /* resend last packet of a completed call
 610          * - client calls may have been aborted or ACK'd
 611          * - server calls may have been aborted
 612          */
 613 found_completed_call:
 614         _debug("completed call");
 615
 616         if (atomic_read(&call->usage) == 0)
 617                 goto dead_call;
 618
 619         /* synchronise any state changes */
 620         read_lock(&call->state_lock);
 621         ASSERTIFCMP(call->state != RXRPC_CALL_CLIENT_FINAL_ACK,
 622                     call->state, >=, RXRPC_CALL_COMPLETE);
 623
 624         if (call->state == RXRPC_CALL_LOCALLY_ABORTED ||
 625             call->state == RXRPC_CALL_REMOTELY_ABORTED ||
 626             call->state == RXRPC_CALL_DEAD) {
 627                 read_unlock(&call->state_lock);
 628                 goto dead_call;
 629         }
 630
 631         if (call->conn->in_clientflag) {
 632                 read_unlock(&call->state_lock);
 633                 goto dead_call; /* complete server call */
 634         }
 635
 636         _debug("final ack again");
 637         rxrpc_get_call(call);
 638         set_bit(RXRPC_CALL_ACK_FINAL, &call->events);
 639         rxrpc_queue_call(call);
 640
 641 free_unlock:
 642         read_unlock(&call->state_lock);
 643         read_unlock_bh(&conn->lock);
 644         rxrpc_free_skb(skb);
 645 done:
 646         _leave("");
 647 }
 648
 649 /*
 650  * post connection-level events to the connection
 651  * - this includes challenges, responses and some aborts
 652  */
 653 static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
 654                                       struct sk_buff *skb)
 655 {
 656         _enter("%p,%p", conn, skb);
 657
 658         atomic_inc(&conn->usage);
 659         skb_queue_tail(&conn->rx_queue, skb);
 660         rxrpc_queue_conn(conn);
 661 }
 662
 663 /*
 664  * handle data received on the local endpoint
 665  * - may be called in interrupt context
 666  */
 667 void rxrpc_data_ready(struct sock *sk, int count)
 668 {
 669         struct rxrpc_connection *conn;
 670         struct rxrpc_transport *trans;
 671         struct rxrpc_skb_priv *sp;
 672         struct rxrpc_local *local;
 673         struct rxrpc_peer *peer;
 674         struct sk_buff *skb;
 675         int ret;
 676
 677         _enter("%p, %d", sk, count);
 678
 679         ASSERT(!irqs_disabled());
 680
 681         read_lock_bh(&rxrpc_local_lock);
 682         local = sk->sk_user_data;
 683         if (local && atomic_read(&local->usage) > 0)
 684                 rxrpc_get_local(local);
 685         else
 686                 local = NULL;
 687         read_unlock_bh(&rxrpc_local_lock);
 688         if (!local) {
 689                 _leave(" [local dead]");
 690                 return;
 691         }
 692
 693         skb = skb_recv_datagram(sk, 0, 1, &ret);
 694         if (!skb) {
 695                 rxrpc_put_local(local);
 696                 if (ret == -EAGAIN)
 697                         return;
 698                 _debug("UDP socket error %d", ret);
 699                 return;
 700         }
 701
 702         rxrpc_new_skb(skb);
 703
 704         _net("recv skb %p", skb);
 705
 706         /* we'll probably need to checksum it (didn't call sock_recvmsg) */
 707         if (skb_checksum_complete(skb)) {
 708                 rxrpc_free_skb(skb);
 709                 rxrpc_put_local(local);
 710                 _leave(" [CSUM failed]");
 711                 return;
 712         }
 713
 714         /* the socket buffer we have is owned by UDP, with UDP's data all over
 715          * it, but we really want our own */
 716         skb_orphan(skb);
 717         sp = rxrpc_skb(skb);
 718         memset(sp, 0, sizeof(*sp));
 719
 720         _net("Rx UDP packet from %08x:%04hu",
 721              ntohl(ip_hdr(skb)->saddr), ntohs(udp_hdr(skb)->source));
 722
 723         /* dig out the RxRPC connection details */
 724         if (skb_copy_bits(skb, sizeof(struct udphdr), &sp->hdr,
 725                           sizeof(sp->hdr)) < 0)
 726                 goto bad_message;
 727         if (!pskb_pull(skb, sizeof(struct udphdr) + sizeof(sp->hdr)))
 728                 BUG();
 729
 730         _net("Rx RxRPC %s ep=%x call=%x:%x",
 731              sp->hdr.flags & RXRPC_CLIENT_INITIATED ? "ToServer" : "ToClient",
 732              ntohl(sp->hdr.epoch),
 733              ntohl(sp->hdr.cid),
 734              ntohl(sp->hdr.callNumber));
 735
 736         if (sp->hdr.type == 0 || sp->hdr.type >= RXRPC_N_PACKET_TYPES) {
 737                 _proto("Rx Bad Packet Type %u", sp->hdr.type);
 738                 goto bad_message;
 739         }
 740
 741         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 742             (sp->hdr.callNumber == 0 || sp->hdr.seq == 0))
 743                 goto bad_message;
 744
 745         peer = rxrpc_find_peer(local, ip_hdr(skb)->saddr, udp_hdr(skb)->source);
 746         if (IS_ERR(peer))
 747                 goto cant_route_call;
 748
 749         trans = rxrpc_find_transport(local, peer);
 750         rxrpc_put_peer(peer);
 751         if (!trans)
 752                 goto cant_route_call;
 753
 754         conn = rxrpc_find_connection(trans, &sp->hdr);
 755         rxrpc_put_transport(trans);
 756         if (!conn)
 757                 goto cant_route_call;
 758
 759         _debug("CONN %p {%d}", conn, conn->debug_id);
 760
 761         if (sp->hdr.callNumber == 0)
 762                 rxrpc_post_packet_to_conn(conn, skb);
 763         else
 764                 rxrpc_post_packet_to_call(conn, skb);
 765         rxrpc_put_connection(conn);
 766         rxrpc_put_local(local);
 767         return;
 768
 769 cant_route_call:
 770         _debug("can't route call");
 771         if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
 772             sp->hdr.type == RXRPC_PACKET_TYPE_DATA) {
 773                 if (sp->hdr.seq == __constant_cpu_to_be32(1)) {
 774                         _debug("first packet");
 775                         skb_queue_tail(&local->accept_queue, skb);
 776                         rxrpc_queue_work(&local->acceptor);
 777                         rxrpc_put_local(local);
 778                         _leave(" [incoming]");
 779                         return;
 780                 }
 781                 skb->priority = RX_INVALID_OPERATION;
 782         } else {
 783                 skb->priority = RX_CALL_DEAD;
 784         }
 785
 786         _debug("reject");
 787         rxrpc_reject_packet(local, skb);
 788         rxrpc_put_local(local);
 789         _leave(" [no call]");
 790         return;
 791
 792 bad_message:
 793         skb->priority = RX_PROTOCOL_ERROR;
 794         rxrpc_reject_packet(local, skb);
 795         rxrpc_put_local(local);
 796         _leave(" [badmsg]");
 797 }