ksm: fix NULL pointer dereference in scan_get_next_rmap_item()
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / sched / act_api.c
blob14b42f4ad791eaf9191adb67e2b6d62d994c4e84
1 /*
2 * net/sched/act_api.c Packet action API.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
9 * Author: Jamal Hadi Salim
14 #include <linux/types.h>
15 #include <linux/kernel.h>
16 #include <linux/string.h>
17 #include <linux/errno.h>
18 #include <linux/slab.h>
19 #include <linux/skbuff.h>
20 #include <linux/init.h>
21 #include <linux/kmod.h>
22 #include <linux/err.h>
23 #include <net/net_namespace.h>
24 #include <net/sock.h>
25 #include <net/sch_generic.h>
26 #include <net/act_api.h>
27 #include <net/netlink.h>
29 static void tcf_common_free_rcu(struct rcu_head *head)
31 kfree(container_of(head, struct tcf_common, tcfc_rcu));
34 void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
36 unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
37 struct tcf_common **p1p;
39 for (p1p = &hinfo->htab[h]; *p1p; p1p = &(*p1p)->tcfc_next) {
40 if (*p1p == p) {
41 write_lock_bh(hinfo->lock);
42 *p1p = p->tcfc_next;
43 write_unlock_bh(hinfo->lock);
44 gen_kill_estimator(&p->tcfc_bstats,
45 &p->tcfc_rate_est);
47 * gen_estimator est_timer() might access p->tcfc_lock
48 * or bstats, wait a RCU grace period before freeing p
50 call_rcu(&p->tcfc_rcu, tcf_common_free_rcu);
51 return;
54 WARN_ON(1);
56 EXPORT_SYMBOL(tcf_hash_destroy);
58 int tcf_hash_release(struct tcf_common *p, int bind,
59 struct tcf_hashinfo *hinfo)
61 int ret = 0;
63 if (p) {
64 if (bind)
65 p->tcfc_bindcnt--;
67 p->tcfc_refcnt--;
68 if (p->tcfc_bindcnt <= 0 && p->tcfc_refcnt <= 0) {
69 tcf_hash_destroy(p, hinfo);
70 ret = 1;
73 return ret;
75 EXPORT_SYMBOL(tcf_hash_release);
77 static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
78 struct tc_action *a, struct tcf_hashinfo *hinfo)
80 struct tcf_common *p;
81 int err = 0, index = -1, i = 0, s_i = 0, n_i = 0;
82 struct nlattr *nest;
84 read_lock_bh(hinfo->lock);
86 s_i = cb->args[0];
88 for (i = 0; i < (hinfo->hmask + 1); i++) {
89 p = hinfo->htab[tcf_hash(i, hinfo->hmask)];
91 for (; p; p = p->tcfc_next) {
92 index++;
93 if (index < s_i)
94 continue;
95 a->priv = p;
96 a->order = n_i;
98 nest = nla_nest_start(skb, a->order);
99 if (nest == NULL)
100 goto nla_put_failure;
101 err = tcf_action_dump_1(skb, a, 0, 0);
102 if (err < 0) {
103 index--;
104 nlmsg_trim(skb, nest);
105 goto done;
107 nla_nest_end(skb, nest);
108 n_i++;
109 if (n_i >= TCA_ACT_MAX_PRIO)
110 goto done;
113 done:
114 read_unlock_bh(hinfo->lock);
115 if (n_i)
116 cb->args[0] += n_i;
117 return n_i;
119 nla_put_failure:
120 nla_nest_cancel(skb, nest);
121 goto done;
124 static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
125 struct tcf_hashinfo *hinfo)
127 struct tcf_common *p, *s_p;
128 struct nlattr *nest;
129 int i = 0, n_i = 0;
131 nest = nla_nest_start(skb, a->order);
132 if (nest == NULL)
133 goto nla_put_failure;
134 NLA_PUT_STRING(skb, TCA_KIND, a->ops->kind);
135 for (i = 0; i < (hinfo->hmask + 1); i++) {
136 p = hinfo->htab[tcf_hash(i, hinfo->hmask)];
138 while (p != NULL) {
139 s_p = p->tcfc_next;
140 if (ACT_P_DELETED == tcf_hash_release(p, 0, hinfo))
141 module_put(a->ops->owner);
142 n_i++;
143 p = s_p;
146 NLA_PUT_U32(skb, TCA_FCNT, n_i);
147 nla_nest_end(skb, nest);
149 return n_i;
150 nla_put_failure:
151 nla_nest_cancel(skb, nest);
152 return -EINVAL;
155 int tcf_generic_walker(struct sk_buff *skb, struct netlink_callback *cb,
156 int type, struct tc_action *a)
158 struct tcf_hashinfo *hinfo = a->ops->hinfo;
160 if (type == RTM_DELACTION) {
161 return tcf_del_walker(skb, a, hinfo);
162 } else if (type == RTM_GETACTION) {
163 return tcf_dump_walker(skb, cb, a, hinfo);
164 } else {
165 WARN(1, "tcf_generic_walker: unknown action %d\n", type);
166 return -EINVAL;
169 EXPORT_SYMBOL(tcf_generic_walker);
171 struct tcf_common *tcf_hash_lookup(u32 index, struct tcf_hashinfo *hinfo)
173 struct tcf_common *p;
175 read_lock_bh(hinfo->lock);
176 for (p = hinfo->htab[tcf_hash(index, hinfo->hmask)]; p;
177 p = p->tcfc_next) {
178 if (p->tcfc_index == index)
179 break;
181 read_unlock_bh(hinfo->lock);
183 return p;
185 EXPORT_SYMBOL(tcf_hash_lookup);
187 u32 tcf_hash_new_index(u32 *idx_gen, struct tcf_hashinfo *hinfo)
189 u32 val = *idx_gen;
191 do {
192 if (++val == 0)
193 val = 1;
194 } while (tcf_hash_lookup(val, hinfo));
196 return (*idx_gen = val);
198 EXPORT_SYMBOL(tcf_hash_new_index);
200 int tcf_hash_search(struct tc_action *a, u32 index)
202 struct tcf_hashinfo *hinfo = a->ops->hinfo;
203 struct tcf_common *p = tcf_hash_lookup(index, hinfo);
205 if (p) {
206 a->priv = p;
207 return 1;
209 return 0;
211 EXPORT_SYMBOL(tcf_hash_search);
213 struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a, int bind,
214 struct tcf_hashinfo *hinfo)
216 struct tcf_common *p = NULL;
217 if (index && (p = tcf_hash_lookup(index, hinfo)) != NULL) {
218 if (bind)
219 p->tcfc_bindcnt++;
220 p->tcfc_refcnt++;
221 a->priv = p;
223 return p;
225 EXPORT_SYMBOL(tcf_hash_check);
227 struct tcf_common *tcf_hash_create(u32 index, struct nlattr *est,
228 struct tc_action *a, int size, int bind,
229 u32 *idx_gen, struct tcf_hashinfo *hinfo)
231 struct tcf_common *p = kzalloc(size, GFP_KERNEL);
233 if (unlikely(!p))
234 return ERR_PTR(-ENOMEM);
235 p->tcfc_refcnt = 1;
236 if (bind)
237 p->tcfc_bindcnt = 1;
239 spin_lock_init(&p->tcfc_lock);
240 p->tcfc_index = index ? index : tcf_hash_new_index(idx_gen, hinfo);
241 p->tcfc_tm.install = jiffies;
242 p->tcfc_tm.lastuse = jiffies;
243 if (est) {
244 int err = gen_new_estimator(&p->tcfc_bstats, &p->tcfc_rate_est,
245 &p->tcfc_lock, est);
246 if (err) {
247 kfree(p);
248 return ERR_PTR(err);
252 a->priv = (void *) p;
253 return p;
255 EXPORT_SYMBOL(tcf_hash_create);
257 void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo)
259 unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
261 write_lock_bh(hinfo->lock);
262 p->tcfc_next = hinfo->htab[h];
263 hinfo->htab[h] = p;
264 write_unlock_bh(hinfo->lock);
266 EXPORT_SYMBOL(tcf_hash_insert);
268 static struct tc_action_ops *act_base = NULL;
269 static DEFINE_RWLOCK(act_mod_lock);
271 int tcf_register_action(struct tc_action_ops *act)
273 struct tc_action_ops *a, **ap;
275 write_lock(&act_mod_lock);
276 for (ap = &act_base; (a = *ap) != NULL; ap = &a->next) {
277 if (act->type == a->type || (strcmp(act->kind, a->kind) == 0)) {
278 write_unlock(&act_mod_lock);
279 return -EEXIST;
282 act->next = NULL;
283 *ap = act;
284 write_unlock(&act_mod_lock);
285 return 0;
287 EXPORT_SYMBOL(tcf_register_action);
289 int tcf_unregister_action(struct tc_action_ops *act)
291 struct tc_action_ops *a, **ap;
292 int err = -ENOENT;
294 write_lock(&act_mod_lock);
295 for (ap = &act_base; (a = *ap) != NULL; ap = &a->next)
296 if (a == act)
297 break;
298 if (a) {
299 *ap = a->next;
300 a->next = NULL;
301 err = 0;
303 write_unlock(&act_mod_lock);
304 return err;
306 EXPORT_SYMBOL(tcf_unregister_action);
308 /* lookup by name */
309 static struct tc_action_ops *tc_lookup_action_n(char *kind)
311 struct tc_action_ops *a = NULL;
313 if (kind) {
314 read_lock(&act_mod_lock);
315 for (a = act_base; a; a = a->next) {
316 if (strcmp(kind, a->kind) == 0) {
317 if (!try_module_get(a->owner)) {
318 read_unlock(&act_mod_lock);
319 return NULL;
321 break;
324 read_unlock(&act_mod_lock);
326 return a;
329 /* lookup by nlattr */
330 static struct tc_action_ops *tc_lookup_action(struct nlattr *kind)
332 struct tc_action_ops *a = NULL;
334 if (kind) {
335 read_lock(&act_mod_lock);
336 for (a = act_base; a; a = a->next) {
337 if (nla_strcmp(kind, a->kind) == 0) {
338 if (!try_module_get(a->owner)) {
339 read_unlock(&act_mod_lock);
340 return NULL;
342 break;
345 read_unlock(&act_mod_lock);
347 return a;
350 #if 0
351 /* lookup by id */
352 static struct tc_action_ops *tc_lookup_action_id(u32 type)
354 struct tc_action_ops *a = NULL;
356 if (type) {
357 read_lock(&act_mod_lock);
358 for (a = act_base; a; a = a->next) {
359 if (a->type == type) {
360 if (!try_module_get(a->owner)) {
361 read_unlock(&act_mod_lock);
362 return NULL;
364 break;
367 read_unlock(&act_mod_lock);
369 return a;
371 #endif
373 int tcf_action_exec(struct sk_buff *skb, struct tc_action *act,
374 struct tcf_result *res)
376 struct tc_action *a;
377 int ret = -1;
379 if (skb->tc_verd & TC_NCLS) {
380 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
381 ret = TC_ACT_OK;
382 goto exec_done;
384 while ((a = act) != NULL) {
385 repeat:
386 if (a->ops && a->ops->act) {
387 ret = a->ops->act(skb, a, res);
388 if (TC_MUNGED & skb->tc_verd) {
389 /* copied already, allow trampling */
390 skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
391 skb->tc_verd = CLR_TC_MUNGED(skb->tc_verd);
393 if (ret == TC_ACT_REPEAT)
394 goto repeat; /* we need a ttl - JHS */
395 if (ret != TC_ACT_PIPE)
396 goto exec_done;
398 act = a->next;
400 exec_done:
401 return ret;
403 EXPORT_SYMBOL(tcf_action_exec);
405 void tcf_action_destroy(struct tc_action *act, int bind)
407 struct tc_action *a;
409 for (a = act; a; a = act) {
410 if (a->ops && a->ops->cleanup) {
411 if (a->ops->cleanup(a, bind) == ACT_P_DELETED)
412 module_put(a->ops->owner);
413 act = act->next;
414 kfree(a);
415 } else {
416 /*FIXME: Remove later - catch insertion bugs*/
417 WARN(1, "tcf_action_destroy: BUG? destroying NULL ops\n");
418 act = act->next;
419 kfree(a);
425 tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
427 int err = -EINVAL;
429 if (a->ops == NULL || a->ops->dump == NULL)
430 return err;
431 return a->ops->dump(skb, a, bind, ref);
435 tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
437 int err = -EINVAL;
438 unsigned char *b = skb_tail_pointer(skb);
439 struct nlattr *nest;
441 if (a->ops == NULL || a->ops->dump == NULL)
442 return err;
444 NLA_PUT_STRING(skb, TCA_KIND, a->ops->kind);
445 if (tcf_action_copy_stats(skb, a, 0))
446 goto nla_put_failure;
447 nest = nla_nest_start(skb, TCA_OPTIONS);
448 if (nest == NULL)
449 goto nla_put_failure;
450 err = tcf_action_dump_old(skb, a, bind, ref);
451 if (err > 0) {
452 nla_nest_end(skb, nest);
453 return err;
456 nla_put_failure:
457 nlmsg_trim(skb, b);
458 return -1;
460 EXPORT_SYMBOL(tcf_action_dump_1);
463 tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
465 struct tc_action *a;
466 int err = -EINVAL;
467 struct nlattr *nest;
469 while ((a = act) != NULL) {
470 act = a->next;
471 nest = nla_nest_start(skb, a->order);
472 if (nest == NULL)
473 goto nla_put_failure;
474 err = tcf_action_dump_1(skb, a, bind, ref);
475 if (err < 0)
476 goto errout;
477 nla_nest_end(skb, nest);
480 return 0;
482 nla_put_failure:
483 err = -EINVAL;
484 errout:
485 nla_nest_cancel(skb, nest);
486 return err;
489 struct tc_action *tcf_action_init_1(struct nlattr *nla, struct nlattr *est,
490 char *name, int ovr, int bind)
492 struct tc_action *a;
493 struct tc_action_ops *a_o;
494 char act_name[IFNAMSIZ];
495 struct nlattr *tb[TCA_ACT_MAX + 1];
496 struct nlattr *kind;
497 int err;
499 if (name == NULL) {
500 err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL);
501 if (err < 0)
502 goto err_out;
503 err = -EINVAL;
504 kind = tb[TCA_ACT_KIND];
505 if (kind == NULL)
506 goto err_out;
507 if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ)
508 goto err_out;
509 } else {
510 err = -EINVAL;
511 if (strlcpy(act_name, name, IFNAMSIZ) >= IFNAMSIZ)
512 goto err_out;
515 a_o = tc_lookup_action_n(act_name);
516 if (a_o == NULL) {
517 #ifdef CONFIG_MODULES
518 rtnl_unlock();
519 request_module("act_%s", act_name);
520 rtnl_lock();
522 a_o = tc_lookup_action_n(act_name);
524 /* We dropped the RTNL semaphore in order to
525 * perform the module load. So, even if we
526 * succeeded in loading the module we have to
527 * tell the caller to replay the request. We
528 * indicate this using -EAGAIN.
530 if (a_o != NULL) {
531 err = -EAGAIN;
532 goto err_mod;
534 #endif
535 err = -ENOENT;
536 goto err_out;
539 err = -ENOMEM;
540 a = kzalloc(sizeof(*a), GFP_KERNEL);
541 if (a == NULL)
542 goto err_mod;
544 /* backward compatibility for policer */
545 if (name == NULL)
546 err = a_o->init(tb[TCA_ACT_OPTIONS], est, a, ovr, bind);
547 else
548 err = a_o->init(nla, est, a, ovr, bind);
549 if (err < 0)
550 goto err_free;
552 /* module count goes up only when brand new policy is created
553 * if it exists and is only bound to in a_o->init() then
554 * ACT_P_CREATED is not returned (a zero is).
556 if (err != ACT_P_CREATED)
557 module_put(a_o->owner);
558 a->ops = a_o;
560 return a;
562 err_free:
563 kfree(a);
564 err_mod:
565 module_put(a_o->owner);
566 err_out:
567 return ERR_PTR(err);
570 struct tc_action *tcf_action_init(struct nlattr *nla, struct nlattr *est,
571 char *name, int ovr, int bind)
573 struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
574 struct tc_action *head = NULL, *act, *act_prev = NULL;
575 int err;
576 int i;
578 err = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL);
579 if (err < 0)
580 return ERR_PTR(err);
582 for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
583 act = tcf_action_init_1(tb[i], est, name, ovr, bind);
584 if (IS_ERR(act))
585 goto err;
586 act->order = i;
588 if (head == NULL)
589 head = act;
590 else
591 act_prev->next = act;
592 act_prev = act;
594 return head;
596 err:
597 if (head != NULL)
598 tcf_action_destroy(head, bind);
599 return act;
602 int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *a,
603 int compat_mode)
605 int err = 0;
606 struct gnet_dump d;
607 struct tcf_act_hdr *h = a->priv;
609 if (h == NULL)
610 goto errout;
612 /* compat_mode being true specifies a call that is supposed
613 * to add additional backward compatibility statistic TLVs.
615 if (compat_mode) {
616 if (a->type == TCA_OLD_COMPAT)
617 err = gnet_stats_start_copy_compat(skb, 0,
618 TCA_STATS, TCA_XSTATS, &h->tcf_lock, &d);
619 else
620 return 0;
621 } else
622 err = gnet_stats_start_copy(skb, TCA_ACT_STATS,
623 &h->tcf_lock, &d);
625 if (err < 0)
626 goto errout;
628 if (a->ops != NULL && a->ops->get_stats != NULL)
629 if (a->ops->get_stats(skb, a) < 0)
630 goto errout;
632 if (gnet_stats_copy_basic(&d, &h->tcf_bstats) < 0 ||
633 gnet_stats_copy_rate_est(&d, &h->tcf_bstats,
634 &h->tcf_rate_est) < 0 ||
635 gnet_stats_copy_queue(&d, &h->tcf_qstats) < 0)
636 goto errout;
638 if (gnet_stats_finish_copy(&d) < 0)
639 goto errout;
641 return 0;
643 errout:
644 return -1;
647 static int
648 tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
649 u16 flags, int event, int bind, int ref)
651 struct tcamsg *t;
652 struct nlmsghdr *nlh;
653 unsigned char *b = skb_tail_pointer(skb);
654 struct nlattr *nest;
656 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
658 t = NLMSG_DATA(nlh);
659 t->tca_family = AF_UNSPEC;
660 t->tca__pad1 = 0;
661 t->tca__pad2 = 0;
663 nest = nla_nest_start(skb, TCA_ACT_TAB);
664 if (nest == NULL)
665 goto nla_put_failure;
667 if (tcf_action_dump(skb, a, bind, ref) < 0)
668 goto nla_put_failure;
670 nla_nest_end(skb, nest);
672 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
673 return skb->len;
675 nla_put_failure:
676 nlmsg_failure:
677 nlmsg_trim(skb, b);
678 return -1;
681 static int
682 act_get_notify(struct net *net, u32 pid, struct nlmsghdr *n,
683 struct tc_action *a, int event)
685 struct sk_buff *skb;
687 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
688 if (!skb)
689 return -ENOBUFS;
690 if (tca_get_fill(skb, a, pid, n->nlmsg_seq, 0, event, 0, 0) <= 0) {
691 kfree_skb(skb);
692 return -EINVAL;
695 return rtnl_unicast(skb, net, pid);
698 static struct tc_action *
699 tcf_action_get_1(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
701 struct nlattr *tb[TCA_ACT_MAX + 1];
702 struct tc_action *a;
703 int index;
704 int err;
706 err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL);
707 if (err < 0)
708 goto err_out;
710 err = -EINVAL;
711 if (tb[TCA_ACT_INDEX] == NULL ||
712 nla_len(tb[TCA_ACT_INDEX]) < sizeof(index))
713 goto err_out;
714 index = nla_get_u32(tb[TCA_ACT_INDEX]);
716 err = -ENOMEM;
717 a = kzalloc(sizeof(struct tc_action), GFP_KERNEL);
718 if (a == NULL)
719 goto err_out;
721 err = -EINVAL;
722 a->ops = tc_lookup_action(tb[TCA_ACT_KIND]);
723 if (a->ops == NULL)
724 goto err_free;
725 if (a->ops->lookup == NULL)
726 goto err_mod;
727 err = -ENOENT;
728 if (a->ops->lookup(a, index) == 0)
729 goto err_mod;
731 module_put(a->ops->owner);
732 return a;
734 err_mod:
735 module_put(a->ops->owner);
736 err_free:
737 kfree(a);
738 err_out:
739 return ERR_PTR(err);
742 static void cleanup_a(struct tc_action *act)
744 struct tc_action *a;
746 for (a = act; a; a = act) {
747 act = a->next;
748 kfree(a);
752 static struct tc_action *create_a(int i)
754 struct tc_action *act;
756 act = kzalloc(sizeof(*act), GFP_KERNEL);
757 if (act == NULL) {
758 pr_debug("create_a: failed to alloc!\n");
759 return NULL;
761 act->order = i;
762 return act;
765 static int tca_action_flush(struct net *net, struct nlattr *nla,
766 struct nlmsghdr *n, u32 pid)
768 struct sk_buff *skb;
769 unsigned char *b;
770 struct nlmsghdr *nlh;
771 struct tcamsg *t;
772 struct netlink_callback dcb;
773 struct nlattr *nest;
774 struct nlattr *tb[TCA_ACT_MAX + 1];
775 struct nlattr *kind;
776 struct tc_action *a = create_a(0);
777 int err = -ENOMEM;
779 if (a == NULL) {
780 pr_debug("tca_action_flush: couldnt create tc_action\n");
781 return err;
784 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
785 if (!skb) {
786 pr_debug("tca_action_flush: failed skb alloc\n");
787 kfree(a);
788 return err;
791 b = skb_tail_pointer(skb);
793 err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL);
794 if (err < 0)
795 goto err_out;
797 err = -EINVAL;
798 kind = tb[TCA_ACT_KIND];
799 a->ops = tc_lookup_action(kind);
800 if (a->ops == NULL)
801 goto err_out;
803 nlh = NLMSG_PUT(skb, pid, n->nlmsg_seq, RTM_DELACTION, sizeof(*t));
804 t = NLMSG_DATA(nlh);
805 t->tca_family = AF_UNSPEC;
806 t->tca__pad1 = 0;
807 t->tca__pad2 = 0;
809 nest = nla_nest_start(skb, TCA_ACT_TAB);
810 if (nest == NULL)
811 goto nla_put_failure;
813 err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
814 if (err < 0)
815 goto nla_put_failure;
816 if (err == 0)
817 goto noflush_out;
819 nla_nest_end(skb, nest);
821 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
822 nlh->nlmsg_flags |= NLM_F_ROOT;
823 module_put(a->ops->owner);
824 kfree(a);
825 err = rtnetlink_send(skb, net, pid, RTNLGRP_TC,
826 n->nlmsg_flags & NLM_F_ECHO);
827 if (err > 0)
828 return 0;
830 return err;
832 nla_put_failure:
833 nlmsg_failure:
834 module_put(a->ops->owner);
835 err_out:
836 noflush_out:
837 kfree_skb(skb);
838 kfree(a);
839 return err;
842 static int
843 tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
844 u32 pid, int event)
846 int i, ret;
847 struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
848 struct tc_action *head = NULL, *act, *act_prev = NULL;
850 ret = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL);
851 if (ret < 0)
852 return ret;
854 if (event == RTM_DELACTION && n->nlmsg_flags & NLM_F_ROOT) {
855 if (tb[1] != NULL)
856 return tca_action_flush(net, tb[1], n, pid);
857 else
858 return -EINVAL;
861 for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
862 act = tcf_action_get_1(tb[i], n, pid);
863 if (IS_ERR(act)) {
864 ret = PTR_ERR(act);
865 goto err;
867 act->order = i;
869 if (head == NULL)
870 head = act;
871 else
872 act_prev->next = act;
873 act_prev = act;
876 if (event == RTM_GETACTION)
877 ret = act_get_notify(net, pid, n, head, event);
878 else { /* delete */
879 struct sk_buff *skb;
881 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
882 if (!skb) {
883 ret = -ENOBUFS;
884 goto err;
887 if (tca_get_fill(skb, head, pid, n->nlmsg_seq, 0, event,
888 0, 1) <= 0) {
889 kfree_skb(skb);
890 ret = -EINVAL;
891 goto err;
894 /* now do the delete */
895 tcf_action_destroy(head, 0);
896 ret = rtnetlink_send(skb, net, pid, RTNLGRP_TC,
897 n->nlmsg_flags & NLM_F_ECHO);
898 if (ret > 0)
899 return 0;
900 return ret;
902 err:
903 cleanup_a(head);
904 return ret;
907 static int tcf_add_notify(struct net *net, struct tc_action *a,
908 u32 pid, u32 seq, int event, u16 flags)
910 struct tcamsg *t;
911 struct nlmsghdr *nlh;
912 struct sk_buff *skb;
913 struct nlattr *nest;
914 unsigned char *b;
915 int err = 0;
917 skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
918 if (!skb)
919 return -ENOBUFS;
921 b = skb_tail_pointer(skb);
923 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
924 t = NLMSG_DATA(nlh);
925 t->tca_family = AF_UNSPEC;
926 t->tca__pad1 = 0;
927 t->tca__pad2 = 0;
929 nest = nla_nest_start(skb, TCA_ACT_TAB);
930 if (nest == NULL)
931 goto nla_put_failure;
933 if (tcf_action_dump(skb, a, 0, 0) < 0)
934 goto nla_put_failure;
936 nla_nest_end(skb, nest);
938 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
939 NETLINK_CB(skb).dst_group = RTNLGRP_TC;
941 err = rtnetlink_send(skb, net, pid, RTNLGRP_TC, flags & NLM_F_ECHO);
942 if (err > 0)
943 err = 0;
944 return err;
946 nla_put_failure:
947 nlmsg_failure:
948 kfree_skb(skb);
949 return -1;
953 static int
954 tcf_action_add(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
955 u32 pid, int ovr)
957 int ret = 0;
958 struct tc_action *act;
959 struct tc_action *a;
960 u32 seq = n->nlmsg_seq;
962 act = tcf_action_init(nla, NULL, NULL, ovr, 0);
963 if (act == NULL)
964 goto done;
965 if (IS_ERR(act)) {
966 ret = PTR_ERR(act);
967 goto done;
970 /* dump then free all the actions after update; inserted policy
971 * stays intact
973 ret = tcf_add_notify(net, act, pid, seq, RTM_NEWACTION, n->nlmsg_flags);
974 for (a = act; a; a = act) {
975 act = a->next;
976 kfree(a);
978 done:
979 return ret;
982 static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
984 struct net *net = sock_net(skb->sk);
985 struct nlattr *tca[TCA_ACT_MAX + 1];
986 u32 pid = skb ? NETLINK_CB(skb).pid : 0;
987 int ret = 0, ovr = 0;
989 ret = nlmsg_parse(n, sizeof(struct tcamsg), tca, TCA_ACT_MAX, NULL);
990 if (ret < 0)
991 return ret;
993 if (tca[TCA_ACT_TAB] == NULL) {
994 pr_notice("tc_ctl_action: received NO action attribs\n");
995 return -EINVAL;
998 /* n->nlmsg_flags & NLM_F_CREATE */
999 switch (n->nlmsg_type) {
1000 case RTM_NEWACTION:
1001 /* we are going to assume all other flags
1002 * imply create only if it doesn't exist
1003 * Note that CREATE | EXCL implies that
1004 * but since we want avoid ambiguity (eg when flags
1005 * is zero) then just set this
1007 if (n->nlmsg_flags & NLM_F_REPLACE)
1008 ovr = 1;
1009 replay:
1010 ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, pid, ovr);
1011 if (ret == -EAGAIN)
1012 goto replay;
1013 break;
1014 case RTM_DELACTION:
1015 ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
1016 pid, RTM_DELACTION);
1017 break;
1018 case RTM_GETACTION:
1019 ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
1020 pid, RTM_GETACTION);
1021 break;
1022 default:
1023 BUG();
1026 return ret;
1029 static struct nlattr *
1030 find_dump_kind(const struct nlmsghdr *n)
1032 struct nlattr *tb1, *tb2[TCA_ACT_MAX + 1];
1033 struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
1034 struct nlattr *nla[TCAA_MAX + 1];
1035 struct nlattr *kind;
1037 if (nlmsg_parse(n, sizeof(struct tcamsg), nla, TCAA_MAX, NULL) < 0)
1038 return NULL;
1039 tb1 = nla[TCA_ACT_TAB];
1040 if (tb1 == NULL)
1041 return NULL;
1043 if (nla_parse(tb, TCA_ACT_MAX_PRIO, nla_data(tb1),
1044 NLMSG_ALIGN(nla_len(tb1)), NULL) < 0)
1045 return NULL;
1047 if (tb[1] == NULL)
1048 return NULL;
1049 if (nla_parse(tb2, TCA_ACT_MAX, nla_data(tb[1]),
1050 nla_len(tb[1]), NULL) < 0)
1051 return NULL;
1052 kind = tb2[TCA_ACT_KIND];
1054 return kind;
1057 static int
1058 tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
1060 struct nlmsghdr *nlh;
1061 unsigned char *b = skb_tail_pointer(skb);
1062 struct nlattr *nest;
1063 struct tc_action_ops *a_o;
1064 struct tc_action a;
1065 int ret = 0;
1066 struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
1067 struct nlattr *kind = find_dump_kind(cb->nlh);
1069 if (kind == NULL) {
1070 pr_info("tc_dump_action: action bad kind\n");
1071 return 0;
1074 a_o = tc_lookup_action(kind);
1075 if (a_o == NULL)
1076 return 0;
1078 memset(&a, 0, sizeof(struct tc_action));
1079 a.ops = a_o;
1081 if (a_o->walk == NULL) {
1082 WARN(1, "tc_dump_action: %s !capable of dumping table\n",
1083 a_o->kind);
1084 goto nla_put_failure;
1087 nlh = NLMSG_PUT(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
1088 cb->nlh->nlmsg_type, sizeof(*t));
1089 t = NLMSG_DATA(nlh);
1090 t->tca_family = AF_UNSPEC;
1091 t->tca__pad1 = 0;
1092 t->tca__pad2 = 0;
1094 nest = nla_nest_start(skb, TCA_ACT_TAB);
1095 if (nest == NULL)
1096 goto nla_put_failure;
1098 ret = a_o->walk(skb, cb, RTM_GETACTION, &a);
1099 if (ret < 0)
1100 goto nla_put_failure;
1102 if (ret > 0) {
1103 nla_nest_end(skb, nest);
1104 ret = skb->len;
1105 } else
1106 nla_nest_cancel(skb, nest);
1108 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1109 if (NETLINK_CB(cb->skb).pid && ret)
1110 nlh->nlmsg_flags |= NLM_F_MULTI;
1111 module_put(a_o->owner);
1112 return skb->len;
1114 nla_put_failure:
1115 nlmsg_failure:
1116 module_put(a_o->owner);
1117 nlmsg_trim(skb, b);
1118 return skb->len;
1121 static int __init tc_action_init(void)
1123 rtnl_register(PF_UNSPEC, RTM_NEWACTION, tc_ctl_action, NULL);
1124 rtnl_register(PF_UNSPEC, RTM_DELACTION, tc_ctl_action, NULL);
1125 rtnl_register(PF_UNSPEC, RTM_GETACTION, tc_ctl_action, tc_dump_action);
1127 return 0;
1130 subsys_initcall(tc_action_init);