?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[NETLINK]: Fix use after free in netlink_recvmsg
[linux-2.6/sactl.git] / net / netlink / af_netlink.c
blobac1ceadf4ed34b5289db8d50819ec1433dc1d589
1 /*
2 * NETLINK Kernel-user communication protocol.
3 *
4 * Authors: Alan Cox <alan@redhat.com>
5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
11 *
12 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
13 * added netlink_proto_exit
14 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
15 * use nlk_sk, as sk->protinfo is on a diet 8)
16 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
17 * - inc module use count of module that owns
18 * the kernel socket in case userspace opens
19 * socket of same protocol
20 * - remove all module support, since netlink is
21 * mandatory if CONFIG_NET=y these days
22 */
23
24 #include <linux/module.h>
25
26 #include <linux/capability.h>
27 #include <linux/kernel.h>
28 #include <linux/init.h>
29 #include <linux/signal.h>
30 #include <linux/sched.h>
31 #include <linux/errno.h>
32 #include <linux/string.h>
33 #include <linux/stat.h>
34 #include <linux/socket.h>
35 #include <linux/un.h>
36 #include <linux/fcntl.h>
37 #include <linux/termios.h>
38 #include <linux/sockios.h>
39 #include <linux/net.h>
40 #include <linux/fs.h>
41 #include <linux/slab.h>
42 #include <asm/uaccess.h>
43 #include <linux/skbuff.h>
44 #include <linux/netdevice.h>
45 #include <linux/rtnetlink.h>
46 #include <linux/proc_fs.h>
47 #include <linux/seq_file.h>
48 #include <linux/smp_lock.h>
49 #include <linux/notifier.h>
50 #include <linux/security.h>
51 #include <linux/jhash.h>
52 #include <linux/jiffies.h>
53 #include <linux/random.h>
54 #include <linux/bitops.h>
55 #include <linux/mm.h>
56 #include <linux/types.h>
57 #include <linux/audit.h>
58 #include <linux/selinux.h>
59 #include <linux/mutex.h>
60
61 #include <net/sock.h>
62 #include <net/scm.h>
63 #include <net/netlink.h>
64
65 #define NLGRPSZ(x) (ALIGN(x, sizeof(unsigned long) * 8) / 8)
66
67 struct netlink_sock {
68 /* struct sock has to be the first member of netlink_sock */
69 struct sock sk;
70 u32 pid;
71 u32 dst_pid;
72 u32 dst_group;
73 u32 flags;
74 u32 subscriptions;
75 u32 ngroups;
76 unsigned long *groups;
77 unsigned long state;
78 wait_queue_head_t wait;
79 struct netlink_callback *cb;
80 struct mutex *cb_mutex;
81 struct mutex cb_def_mutex;
82 void (*data_ready)(struct sock *sk, int bytes);
83 struct module *module;
84 };
85
86 #define NETLINK_KERNEL_SOCKET 0x1
87 #define NETLINK_RECV_PKTINFO 0x2
88
89 static inline struct netlink_sock *nlk_sk(struct sock *sk)
90 {
91 return (struct netlink_sock *)sk;
92 }
93
94 struct nl_pid_hash {
95 struct hlist_head *table;
96 unsigned long rehash_time;
97
98 unsigned int mask;
99 unsigned int shift;
100
101 unsigned int entries;
102 unsigned int max_shift;
103
104 u32 rnd;
105 };
106
107 struct netlink_table {
108 struct nl_pid_hash hash;
109 struct hlist_head mc_list;
110 unsigned long *listeners;
111 unsigned int nl_nonroot;
112 unsigned int groups;
113 struct mutex *cb_mutex;
114 struct module *module;
115 int registered;
116 };
117
118 static struct netlink_table *nl_table;
119
120 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
121
122 static int netlink_dump(struct sock *sk);
123 static void netlink_destroy_callback(struct netlink_callback *cb);
124 static void netlink_queue_skip(struct nlmsghdr *nlh, struct sk_buff *skb);
125
126 static DEFINE_RWLOCK(nl_table_lock);
127 static atomic_t nl_table_users = ATOMIC_INIT(0);
128
129 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
130
131 static u32 netlink_group_mask(u32 group)
132 {
133 return group ? 1 << (group - 1) : 0;
134 }
135
136 static struct hlist_head *nl_pid_hashfn(struct nl_pid_hash *hash, u32 pid)
137 {
138 return &hash->table[jhash_1word(pid, hash->rnd) & hash->mask];
139 }
140
141 static void netlink_sock_destruct(struct sock *sk)
142 {
143 struct netlink_sock *nlk = nlk_sk(sk);
144
145 BUG_ON(mutex_is_locked(nlk_sk(sk)->cb_mutex));
146 if (nlk->cb) {
147 if (nlk->cb->done)
148 nlk->cb->done(nlk->cb);
149 netlink_destroy_callback(nlk->cb);
150 }
151
152 skb_queue_purge(&sk->sk_receive_queue);
153
154 if (!sock_flag(sk, SOCK_DEAD)) {
155 printk("Freeing alive netlink socket %p\n", sk);
156 return;
157 }
158 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
159 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
160 BUG_TRAP(!nlk_sk(sk)->groups);
161 }
162
163 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on SMP.
164 * Look, when several writers sleep and reader wakes them up, all but one
165 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
166 * this, _but_ remember, it adds useless work on UP machines.
167 */
168
169 static void netlink_table_grab(void)
170 {
171 write_lock_irq(&nl_table_lock);
172
173 if (atomic_read(&nl_table_users)) {
174 DECLARE_WAITQUEUE(wait, current);
175
176 add_wait_queue_exclusive(&nl_table_wait, &wait);
177 for(;;) {
178 set_current_state(TASK_UNINTERRUPTIBLE);
179 if (atomic_read(&nl_table_users) == 0)
180 break;
181 write_unlock_irq(&nl_table_lock);
182 schedule();
183 write_lock_irq(&nl_table_lock);
184 }
185
186 __set_current_state(TASK_RUNNING);
187 remove_wait_queue(&nl_table_wait, &wait);
188 }
189 }
190
191 static __inline__ void netlink_table_ungrab(void)
192 {
193 write_unlock_irq(&nl_table_lock);
194 wake_up(&nl_table_wait);
195 }
196
197 static __inline__ void
198 netlink_lock_table(void)
199 {
200 /* read_lock() synchronizes us to netlink_table_grab */
201
202 read_lock(&nl_table_lock);
203 atomic_inc(&nl_table_users);
204 read_unlock(&nl_table_lock);
205 }
206
207 static __inline__ void
208 netlink_unlock_table(void)
209 {
210 if (atomic_dec_and_test(&nl_table_users))
211 wake_up(&nl_table_wait);
212 }
213
214 static __inline__ struct sock *netlink_lookup(int protocol, u32 pid)
215 {
216 struct nl_pid_hash *hash = &nl_table[protocol].hash;
217 struct hlist_head *head;
218 struct sock *sk;
219 struct hlist_node *node;
220
221 read_lock(&nl_table_lock);
222 head = nl_pid_hashfn(hash, pid);
223 sk_for_each(sk, node, head) {
224 if (nlk_sk(sk)->pid == pid) {
225 sock_hold(sk);
226 goto found;
227 }
228 }
229 sk = NULL;
230 found:
231 read_unlock(&nl_table_lock);
232 return sk;
233 }
234
235 static inline struct hlist_head *nl_pid_hash_alloc(size_t size)
236 {
237 if (size <= PAGE_SIZE)
238 return kmalloc(size, GFP_ATOMIC);
239 else
240 return (struct hlist_head *)
241 __get_free_pages(GFP_ATOMIC, get_order(size));
242 }
243
244 static inline void nl_pid_hash_free(struct hlist_head *table, size_t size)
245 {
246 if (size <= PAGE_SIZE)
247 kfree(table);
248 else
249 free_pages((unsigned long)table, get_order(size));
250 }
251
252 static int nl_pid_hash_rehash(struct nl_pid_hash *hash, int grow)
253 {
254 unsigned int omask, mask, shift;
255 size_t osize, size;
256 struct hlist_head *otable, *table;
257 int i;
258
259 omask = mask = hash->mask;
260 osize = size = (mask + 1) * sizeof(*table);
261 shift = hash->shift;
262
263 if (grow) {
264 if (++shift > hash->max_shift)
265 return 0;
266 mask = mask * 2 + 1;
267 size *= 2;
268 }
269
270 table = nl_pid_hash_alloc(size);
271 if (!table)
272 return 0;
273
274 memset(table, 0, size);
275 otable = hash->table;
276 hash->table = table;
277 hash->mask = mask;
278 hash->shift = shift;
279 get_random_bytes(&hash->rnd, sizeof(hash->rnd));
280
281 for (i = 0; i <= omask; i++) {
282 struct sock *sk;
283 struct hlist_node *node, *tmp;
284
285 sk_for_each_safe(sk, node, tmp, &otable[i])
286 __sk_add_node(sk, nl_pid_hashfn(hash, nlk_sk(sk)->pid));
287 }
288
289 nl_pid_hash_free(otable, osize);
290 hash->rehash_time = jiffies + 10 * 60 * HZ;
291 return 1;
292 }
293
294 static inline int nl_pid_hash_dilute(struct nl_pid_hash *hash, int len)
295 {
296 int avg = hash->entries >> hash->shift;
297
298 if (unlikely(avg > 1) && nl_pid_hash_rehash(hash, 1))
299 return 1;
300
301 if (unlikely(len > avg) && time_after(jiffies, hash->rehash_time)) {
302 nl_pid_hash_rehash(hash, 0);
303 return 1;
304 }
305
306 return 0;
307 }
308
309 static const struct proto_ops netlink_ops;
310
311 static void
312 netlink_update_listeners(struct sock *sk)
313 {
314 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
315 struct hlist_node *node;
316 unsigned long mask;
317 unsigned int i;
318
319 for (i = 0; i < NLGRPSZ(tbl->groups)/sizeof(unsigned long); i++) {
320 mask = 0;
321 sk_for_each_bound(sk, node, &tbl->mc_list)
322 mask |= nlk_sk(sk)->groups[i];
323 tbl->listeners[i] = mask;
324 }
325 /* this function is only called with the netlink table "grabbed", which
326 * makes sure updates are visible before bind or setsockopt return. */
327 }
328
329 static int netlink_insert(struct sock *sk, u32 pid)
330 {
331 struct nl_pid_hash *hash = &nl_table[sk->sk_protocol].hash;
332 struct hlist_head *head;
333 int err = -EADDRINUSE;
334 struct sock *osk;
335 struct hlist_node *node;
336 int len;
337
338 netlink_table_grab();
339 head = nl_pid_hashfn(hash, pid);
340 len = 0;
341 sk_for_each(osk, node, head) {
342 if (nlk_sk(osk)->pid == pid)
343 break;
344 len++;
345 }
346 if (node)
347 goto err;
348
349 err = -EBUSY;
350 if (nlk_sk(sk)->pid)
351 goto err;
352
353 err = -ENOMEM;
354 if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
355 goto err;
356
357 if (len && nl_pid_hash_dilute(hash, len))
358 head = nl_pid_hashfn(hash, pid);
359 hash->entries++;
360 nlk_sk(sk)->pid = pid;
361 sk_add_node(sk, head);
362 err = 0;
363
364 err:
365 netlink_table_ungrab();
366 return err;
367 }
368
369 static void netlink_remove(struct sock *sk)
370 {
371 netlink_table_grab();
372 if (sk_del_node_init(sk))
373 nl_table[sk->sk_protocol].hash.entries--;
374 if (nlk_sk(sk)->subscriptions)
375 __sk_del_bind_node(sk);
376 netlink_table_ungrab();
377 }
378
379 static struct proto netlink_proto = {
380 .name = "NETLINK",
381 .owner = THIS_MODULE,
382 .obj_size = sizeof(struct netlink_sock),
383 };
384
385 static int __netlink_create(struct socket *sock, struct mutex *cb_mutex,
386 int protocol)
387 {
388 struct sock *sk;
389 struct netlink_sock *nlk;
390
391 sock->ops = &netlink_ops;
392
393 sk = sk_alloc(PF_NETLINK, GFP_KERNEL, &netlink_proto, 1);
394 if (!sk)
395 return -ENOMEM;
396
397 sock_init_data(sock, sk);
398
399 nlk = nlk_sk(sk);
400 if (cb_mutex)
401 nlk->cb_mutex = cb_mutex;
402 else {
403 nlk->cb_mutex = &nlk->cb_def_mutex;
404 mutex_init(nlk->cb_mutex);
405 }
406 init_waitqueue_head(&nlk->wait);
407
408 sk->sk_destruct = netlink_sock_destruct;
409 sk->sk_protocol = protocol;
410 return 0;
411 }
412
413 static int netlink_create(struct socket *sock, int protocol)
414 {
415 struct module *module = NULL;
416 struct mutex *cb_mutex;
417 struct netlink_sock *nlk;
418 int err = 0;
419
420 sock->state = SS_UNCONNECTED;
421
422 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
423 return -ESOCKTNOSUPPORT;
424
425 if (protocol<0 || protocol >= MAX_LINKS)
426 return -EPROTONOSUPPORT;
427
428 netlink_lock_table();
429 #ifdef CONFIG_KMOD
430 if (!nl_table[protocol].registered) {
431 netlink_unlock_table();
432 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
433 netlink_lock_table();
434 }
435 #endif
436 if (nl_table[protocol].registered &&
437 try_module_get(nl_table[protocol].module))
438 module = nl_table[protocol].module;
439 cb_mutex = nl_table[protocol].cb_mutex;
440 netlink_unlock_table();
441
442 if ((err = __netlink_create(sock, cb_mutex, protocol)) < 0)
443 goto out_module;
444
445 nlk = nlk_sk(sock->sk);
446 nlk->module = module;
447 out:
448 return err;
449
450 out_module:
451 module_put(module);
452 goto out;
453 }
454
455 static int netlink_release(struct socket *sock)
456 {
457 struct sock *sk = sock->sk;
458 struct netlink_sock *nlk;
459
460 if (!sk)
461 return 0;
462
463 netlink_remove(sk);
464 sock_orphan(sk);
465 nlk = nlk_sk(sk);
466
467 /*
468 * OK. Socket is unlinked, any packets that arrive now
469 * will be purged.
470 */
471
472 sock->sk = NULL;
473 wake_up_interruptible_all(&nlk->wait);
474
475 skb_queue_purge(&sk->sk_write_queue);
476
477 if (nlk->pid && !nlk->subscriptions) {
478 struct netlink_notify n = {
479 .protocol = sk->sk_protocol,
480 .pid = nlk->pid,
481 };
482 atomic_notifier_call_chain(&netlink_chain,
483 NETLINK_URELEASE, &n);
484 }
485
486 module_put(nlk->module);
487
488 netlink_table_grab();
489 if (nlk->flags & NETLINK_KERNEL_SOCKET) {
490 kfree(nl_table[sk->sk_protocol].listeners);
491 nl_table[sk->sk_protocol].module = NULL;
492 nl_table[sk->sk_protocol].registered = 0;
493 } else if (nlk->subscriptions)
494 netlink_update_listeners(sk);
495 netlink_table_ungrab();
496
497 kfree(nlk->groups);
498 nlk->groups = NULL;
499
500 sock_put(sk);
501 return 0;
502 }
503
504 static int netlink_autobind(struct socket *sock)
505 {
506 struct sock *sk = sock->sk;
507 struct nl_pid_hash *hash = &nl_table[sk->sk_protocol].hash;
508 struct hlist_head *head;
509 struct sock *osk;
510 struct hlist_node *node;
511 s32 pid = current->tgid;
512 int err;
513 static s32 rover = -4097;
514
515 retry:
516 cond_resched();
517 netlink_table_grab();
518 head = nl_pid_hashfn(hash, pid);
519 sk_for_each(osk, node, head) {
520 if (nlk_sk(osk)->pid == pid) {
521 /* Bind collision, search negative pid values. */
522 pid = rover--;
523 if (rover > -4097)
524 rover = -4097;
525 netlink_table_ungrab();
526 goto retry;
527 }
528 }
529 netlink_table_ungrab();
530
531 err = netlink_insert(sk, pid);
532 if (err == -EADDRINUSE)
533 goto retry;
534
535 /* If 2 threads race to autobind, that is fine. */
536 if (err == -EBUSY)
537 err = 0;
538
539 return err;
540 }
541
542 static inline int netlink_capable(struct socket *sock, unsigned int flag)
543 {
544 return (nl_table[sock->sk->sk_protocol].nl_nonroot & flag) ||
545 capable(CAP_NET_ADMIN);
546 }
547
548 static void
549 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
550 {
551 struct netlink_sock *nlk = nlk_sk(sk);
552
553 if (nlk->subscriptions && !subscriptions)
554 __sk_del_bind_node(sk);
555 else if (!nlk->subscriptions && subscriptions)
556 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
557 nlk->subscriptions = subscriptions;
558 }
559
560 static int netlink_alloc_groups(struct sock *sk)
561 {
562 struct netlink_sock *nlk = nlk_sk(sk);
563 unsigned int groups;
564 int err = 0;
565
566 netlink_lock_table();
567 groups = nl_table[sk->sk_protocol].groups;
568 if (!nl_table[sk->sk_protocol].registered)
569 err = -ENOENT;
570 netlink_unlock_table();
571
572 if (err)
573 return err;
574
575 nlk->groups = kzalloc(NLGRPSZ(groups), GFP_KERNEL);
576 if (nlk->groups == NULL)
577 return -ENOMEM;
578 nlk->ngroups = groups;
579 return 0;
580 }
581
582 static int netlink_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
583 {
584 struct sock *sk = sock->sk;
585 struct netlink_sock *nlk = nlk_sk(sk);
586 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
587 int err;
588
589 if (nladdr->nl_family != AF_NETLINK)
590 return -EINVAL;
591
592 /* Only superuser is allowed to listen multicasts */
593 if (nladdr->nl_groups) {
594 if (!netlink_capable(sock, NL_NONROOT_RECV))
595 return -EPERM;
596 if (nlk->groups == NULL) {
597 err = netlink_alloc_groups(sk);
598 if (err)
599 return err;
600 }
601 }
602
603 if (nlk->pid) {
604 if (nladdr->nl_pid != nlk->pid)
605 return -EINVAL;
606 } else {
607 err = nladdr->nl_pid ?
608 netlink_insert(sk, nladdr->nl_pid) :
609 netlink_autobind(sock);
610 if (err)
611 return err;
612 }
613
614 if (!nladdr->nl_groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
615 return 0;
616
617 netlink_table_grab();
618 netlink_update_subscriptions(sk, nlk->subscriptions +
619 hweight32(nladdr->nl_groups) -
620 hweight32(nlk->groups[0]));
621 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | nladdr->nl_groups;
622 netlink_update_listeners(sk);
623 netlink_table_ungrab();
624
625 return 0;
626 }
627
628 static int netlink_connect(struct socket *sock, struct sockaddr *addr,
629 int alen, int flags)
630 {
631 int err = 0;
632 struct sock *sk = sock->sk;
633 struct netlink_sock *nlk = nlk_sk(sk);
634 struct sockaddr_nl *nladdr=(struct sockaddr_nl*)addr;
635
636 if (addr->sa_family == AF_UNSPEC) {
637 sk->sk_state = NETLINK_UNCONNECTED;
638 nlk->dst_pid = 0;
639 nlk->dst_group = 0;
640 return 0;
641 }
642 if (addr->sa_family != AF_NETLINK)
643 return -EINVAL;
644
645 /* Only superuser is allowed to send multicasts */
646 if (nladdr->nl_groups && !netlink_capable(sock, NL_NONROOT_SEND))
647 return -EPERM;
648
649 if (!nlk->pid)
650 err = netlink_autobind(sock);
651
652 if (err == 0) {
653 sk->sk_state = NETLINK_CONNECTED;
654 nlk->dst_pid = nladdr->nl_pid;
655 nlk->dst_group = ffs(nladdr->nl_groups);
656 }
657
658 return err;
659 }
660
661 static int netlink_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
662 {
663 struct sock *sk = sock->sk;
664 struct netlink_sock *nlk = nlk_sk(sk);
665 struct sockaddr_nl *nladdr=(struct sockaddr_nl *)addr;
666
667 nladdr->nl_family = AF_NETLINK;
668 nladdr->nl_pad = 0;
669 *addr_len = sizeof(*nladdr);
670
671 if (peer) {
672 nladdr->nl_pid = nlk->dst_pid;
673 nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
674 } else {
675 nladdr->nl_pid = nlk->pid;
676 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
677 }
678 return 0;
679 }
680
681 static void netlink_overrun(struct sock *sk)
682 {
683 if (!test_and_set_bit(0, &nlk_sk(sk)->state)) {
684 sk->sk_err = ENOBUFS;
685 sk->sk_error_report(sk);
686 }
687 }
688
689 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
690 {
691 int protocol = ssk->sk_protocol;
692 struct sock *sock;
693 struct netlink_sock *nlk;
694
695 sock = netlink_lookup(protocol, pid);
696 if (!sock)
697 return ERR_PTR(-ECONNREFUSED);
698
699 /* Don't bother queuing skb if kernel socket has no input function */
700 nlk = nlk_sk(sock);
701 if ((nlk->pid == 0 && !nlk->data_ready) ||
702 (sock->sk_state == NETLINK_CONNECTED &&
703 nlk->dst_pid != nlk_sk(ssk)->pid)) {
704 sock_put(sock);
705 return ERR_PTR(-ECONNREFUSED);
706 }
707 return sock;
708 }
709
710 struct sock *netlink_getsockbyfilp(struct file *filp)
711 {
712 struct inode *inode = filp->f_path.dentry->d_inode;
713 struct sock *sock;
714
715 if (!S_ISSOCK(inode->i_mode))
716 return ERR_PTR(-ENOTSOCK);
717
718 sock = SOCKET_I(inode)->sk;
719 if (sock->sk_family != AF_NETLINK)
720 return ERR_PTR(-EINVAL);
721
722 sock_hold(sock);
723 return sock;
724 }
725
726 /*
727 * Attach a skb to a netlink socket.
728 * The caller must hold a reference to the destination socket. On error, the
729 * reference is dropped. The skb is not send to the destination, just all
730 * all error checks are performed and memory in the queue is reserved.
731 * Return values:
732 * < 0: error. skb freed, reference to sock dropped.
733 * 0: continue
734 * 1: repeat lookup - reference dropped while waiting for socket memory.
735 */
736 int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
737 long timeo, struct sock *ssk)
738 {
739 struct netlink_sock *nlk;
740
741 nlk = nlk_sk(sk);
742
743 if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
744 test_bit(0, &nlk->state)) {
745 DECLARE_WAITQUEUE(wait, current);
746 if (!timeo) {
747 if (!ssk || nlk_sk(ssk)->pid == 0)
748 netlink_overrun(sk);
749 sock_put(sk);
750 kfree_skb(skb);
751 return -EAGAIN;
752 }
753
754 __set_current_state(TASK_INTERRUPTIBLE);
755 add_wait_queue(&nlk->wait, &wait);
756
757 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
758 test_bit(0, &nlk->state)) &&
759 !sock_flag(sk, SOCK_DEAD))
760 timeo = schedule_timeout(timeo);
761
762 __set_current_state(TASK_RUNNING);
763 remove_wait_queue(&nlk->wait, &wait);
764 sock_put(sk);
765
766 if (signal_pending(current)) {
767 kfree_skb(skb);
768 return sock_intr_errno(timeo);
769 }
770 return 1;
771 }
772 skb_set_owner_r(skb, sk);
773 return 0;
774 }
775
776 int netlink_sendskb(struct sock *sk, struct sk_buff *skb, int protocol)
777 {
778 int len = skb->len;
779
780 skb_queue_tail(&sk->sk_receive_queue, skb);
781 sk->sk_data_ready(sk, len);
782 sock_put(sk);
783 return len;
784 }
785
786 void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
787 {
788 kfree_skb(skb);
789 sock_put(sk);
790 }
791
792 static inline struct sk_buff *netlink_trim(struct sk_buff *skb,
793 gfp_t allocation)
794 {
795 int delta;
796
797 skb_orphan(skb);
798
799 delta = skb->end - skb->tail;
800 if (delta * 2 < skb->truesize)
801 return skb;
802
803 if (skb_shared(skb)) {
804 struct sk_buff *nskb = skb_clone(skb, allocation);
805 if (!nskb)
806 return skb;
807 kfree_skb(skb);
808 skb = nskb;
809 }
810
811 if (!pskb_expand_head(skb, 0, -delta, allocation))
812 skb->truesize -= delta;
813
814 return skb;
815 }
816
817 int netlink_unicast(struct sock *ssk, struct sk_buff *skb, u32 pid, int nonblock)
818 {
819 struct sock *sk;
820 int err;
821 long timeo;
822
823 skb = netlink_trim(skb, gfp_any());
824
825 timeo = sock_sndtimeo(ssk, nonblock);
826 retry:
827 sk = netlink_getsockbypid(ssk, pid);
828 if (IS_ERR(sk)) {
829 kfree_skb(skb);
830 return PTR_ERR(sk);
831 }
832 err = netlink_attachskb(sk, skb, nonblock, timeo, ssk);
833 if (err == 1)
834 goto retry;
835 if (err)
836 return err;
837
838 return netlink_sendskb(sk, skb, ssk->sk_protocol);
839 }
840
841 int netlink_has_listeners(struct sock *sk, unsigned int group)
842 {
843 int res = 0;
844
845 BUG_ON(!(nlk_sk(sk)->flags & NETLINK_KERNEL_SOCKET));
846 if (group - 1 < nl_table[sk->sk_protocol].groups)
847 res = test_bit(group - 1, nl_table[sk->sk_protocol].listeners);
848 return res;
849 }
850 EXPORT_SYMBOL_GPL(netlink_has_listeners);
851
852 static __inline__ int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
853 {
854 struct netlink_sock *nlk = nlk_sk(sk);
855
856 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
857 !test_bit(0, &nlk->state)) {
858 skb_set_owner_r(skb, sk);
859 skb_queue_tail(&sk->sk_receive_queue, skb);
860 sk->sk_data_ready(sk, skb->len);
861 return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
862 }
863 return -1;
864 }
865
866 struct netlink_broadcast_data {
867 struct sock *exclude_sk;
868 u32 pid;
869 u32 group;
870 int failure;
871 int congested;
872 int delivered;
873 gfp_t allocation;
874 struct sk_buff *skb, *skb2;
875 };
876
877 static inline int do_one_broadcast(struct sock *sk,
878 struct netlink_broadcast_data *p)
879 {
880 struct netlink_sock *nlk = nlk_sk(sk);
881 int val;
882
883 if (p->exclude_sk == sk)
884 goto out;
885
886 if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups ||
887 !test_bit(p->group - 1, nlk->groups))
888 goto out;
889
890 if (p->failure) {
891 netlink_overrun(sk);
892 goto out;
893 }
894
895 sock_hold(sk);
896 if (p->skb2 == NULL) {
897 if (skb_shared(p->skb)) {
898 p->skb2 = skb_clone(p->skb, p->allocation);
899 } else {
900 p->skb2 = skb_get(p->skb);
901 /*
902 * skb ownership may have been set when
903 * delivered to a previous socket.
904 */
905 skb_orphan(p->skb2);
906 }
907 }
908 if (p->skb2 == NULL) {
909 netlink_overrun(sk);
910 /* Clone failed. Notify ALL listeners. */
911 p->failure = 1;
912 } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) {
913 netlink_overrun(sk);
914 } else {
915 p->congested |= val;
916 p->delivered = 1;
917 p->skb2 = NULL;
918 }
919 sock_put(sk);
920
921 out:
922 return 0;
923 }
924
925 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid,
926 u32 group, gfp_t allocation)
927 {
928 struct netlink_broadcast_data info;
929 struct hlist_node *node;
930 struct sock *sk;
931
932 skb = netlink_trim(skb, allocation);
933
934 info.exclude_sk = ssk;
935 info.pid = pid;
936 info.group = group;
937 info.failure = 0;
938 info.congested = 0;
939 info.delivered = 0;
940 info.allocation = allocation;
941 info.skb = skb;
942 info.skb2 = NULL;
943
944 /* While we sleep in clone, do not allow to change socket list */
945
946 netlink_lock_table();
947
948 sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
949 do_one_broadcast(sk, &info);
950
951 kfree_skb(skb);
952
953 netlink_unlock_table();
954
955 if (info.skb2)
956 kfree_skb(info.skb2);
957
958 if (info.delivered) {
959 if (info.congested && (allocation & __GFP_WAIT))
960 yield();
961 return 0;
962 }
963 if (info.failure)
964 return -ENOBUFS;
965 return -ESRCH;
966 }
967
968 struct netlink_set_err_data {
969 struct sock *exclude_sk;
970 u32 pid;
971 u32 group;
972 int code;
973 };
974
975 static inline int do_one_set_err(struct sock *sk,
976 struct netlink_set_err_data *p)
977 {
978 struct netlink_sock *nlk = nlk_sk(sk);
979
980 if (sk == p->exclude_sk)
981 goto out;
982
983 if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups ||
984 !test_bit(p->group - 1, nlk->groups))
985 goto out;
986
987 sk->sk_err = p->code;
988 sk->sk_error_report(sk);
989 out:
990 return 0;
991 }
992
993 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
994 {
995 struct netlink_set_err_data info;
996 struct hlist_node *node;
997 struct sock *sk;
998
999 info.exclude_sk = ssk;
1000 info.pid = pid;
1001 info.group = group;
1002 info.code = code;
1003
1004 read_lock(&nl_table_lock);
1005
1006 sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
1007 do_one_set_err(sk, &info);
1008
1009 read_unlock(&nl_table_lock);
1010 }
1011
1012 static int netlink_setsockopt(struct socket *sock, int level, int optname,
1013 char __user *optval, int optlen)
1014 {
1015 struct sock *sk = sock->sk;
1016 struct netlink_sock *nlk = nlk_sk(sk);
1017 int val = 0, err;
1018
1019 if (level != SOL_NETLINK)
1020 return -ENOPROTOOPT;
1021
1022 if (optlen >= sizeof(int) &&
1023 get_user(val, (int __user *)optval))
1024 return -EFAULT;
1025
1026 switch (optname) {
1027 case NETLINK_PKTINFO:
1028 if (val)
1029 nlk->flags |= NETLINK_RECV_PKTINFO;
1030 else
1031 nlk->flags &= ~NETLINK_RECV_PKTINFO;
1032 err = 0;
1033 break;
1034 case NETLINK_ADD_MEMBERSHIP:
1035 case NETLINK_DROP_MEMBERSHIP: {
1036 unsigned int subscriptions;
1037 int old, new = optname == NETLINK_ADD_MEMBERSHIP ? 1 : 0;
1038
1039 if (!netlink_capable(sock, NL_NONROOT_RECV))
1040 return -EPERM;
1041 if (nlk->groups == NULL) {
1042 err = netlink_alloc_groups(sk);
1043 if (err)
1044 return err;
1045 }
1046 if (!val || val - 1 >= nlk->ngroups)
1047 return -EINVAL;
1048 netlink_table_grab();
1049 old = test_bit(val - 1, nlk->groups);
1050 subscriptions = nlk->subscriptions - old + new;
1051 if (new)
1052 __set_bit(val - 1, nlk->groups);
1053 else
1054 __clear_bit(val - 1, nlk->groups);
1055 netlink_update_subscriptions(sk, subscriptions);
1056 netlink_update_listeners(sk);
1057 netlink_table_ungrab();
1058 err = 0;
1059 break;
1060 }
1061 default:
1062 err = -ENOPROTOOPT;
1063 }
1064 return err;
1065 }
1066
1067 static int netlink_getsockopt(struct socket *sock, int level, int optname,
1068 char __user *optval, int __user *optlen)
1069 {
1070 struct sock *sk = sock->sk;
1071 struct netlink_sock *nlk = nlk_sk(sk);
1072 int len, val, err;
1073
1074 if (level != SOL_NETLINK)
1075 return -ENOPROTOOPT;
1076
1077 if (get_user(len, optlen))
1078 return -EFAULT;
1079 if (len < 0)
1080 return -EINVAL;
1081
1082 switch (optname) {
1083 case NETLINK_PKTINFO:
1084 if (len < sizeof(int))
1085 return -EINVAL;
1086 len = sizeof(int);
1087 val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0;
1088 if (put_user(len, optlen) ||
1089 put_user(val, optval))
1090 return -EFAULT;
1091 err = 0;
1092 break;
1093 default:
1094 err = -ENOPROTOOPT;
1095 }
1096 return err;
1097 }
1098
1099 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
1100 {
1101 struct nl_pktinfo info;
1102
1103 info.group = NETLINK_CB(skb).dst_group;
1104 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
1105 }
1106
1107 static inline void netlink_rcv_wake(struct sock *sk)
1108 {
1109 struct netlink_sock *nlk = nlk_sk(sk);
1110
1111 if (skb_queue_empty(&sk->sk_receive_queue))
1112 clear_bit(0, &nlk->state);
1113 if (!test_bit(0, &nlk->state))
1114 wake_up_interruptible(&nlk->wait);
1115 }
1116
1117 static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
1118 struct msghdr *msg, size_t len)
1119 {
1120 struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
1121 struct sock *sk = sock->sk;
1122 struct netlink_sock *nlk = nlk_sk(sk);
1123 struct sockaddr_nl *addr=msg->msg_name;
1124 u32 dst_pid;
1125 u32 dst_group;
1126 struct sk_buff *skb;
1127 int err;
1128 struct scm_cookie scm;
1129
1130 if (msg->msg_flags&MSG_OOB)
1131 return -EOPNOTSUPP;
1132
1133 if (NULL == siocb->scm)
1134 siocb->scm = &scm;
1135 err = scm_send(sock, msg, siocb->scm);
1136 if (err < 0)
1137 return err;
1138
1139 if (msg->msg_namelen) {
1140 if (addr->nl_family != AF_NETLINK)
1141 return -EINVAL;
1142 dst_pid = addr->nl_pid;
1143 dst_group = ffs(addr->nl_groups);
1144 if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
1145 return -EPERM;
1146 } else {
1147 dst_pid = nlk->dst_pid;
1148 dst_group = nlk->dst_group;
1149 }
1150
1151 if (!nlk->pid) {
1152 err = netlink_autobind(sock);
1153 if (err)
1154 goto out;
1155 }
1156
1157 err = -EMSGSIZE;
1158 if (len > sk->sk_sndbuf - 32)
1159 goto out;
1160 err = -ENOBUFS;
1161 skb = alloc_skb(len, GFP_KERNEL);
1162 if (skb==NULL)
1163 goto out;
1164
1165 NETLINK_CB(skb).pid = nlk->pid;
1166 NETLINK_CB(skb).dst_group = dst_group;
1167 NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
1168 selinux_get_task_sid(current, &(NETLINK_CB(skb).sid));
1169 memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
1170
1171 /* What can I do? Netlink is asynchronous, so that
1172 we will have to save current capabilities to
1173 check them, when this message will be delivered
1174 to corresponding kernel module. --ANK (980802)
1175 */
1176
1177 err = -EFAULT;
1178 if (memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len)) {
1179 kfree_skb(skb);
1180 goto out;
1181 }
1182
1183 err = security_netlink_send(sk, skb);
1184 if (err) {
1185 kfree_skb(skb);
1186 goto out;
1187 }
1188
1189 if (dst_group) {
1190 atomic_inc(&skb->users);
1191 netlink_broadcast(sk, skb, dst_pid, dst_group, GFP_KERNEL);
1192 }
1193 err = netlink_unicast(sk, skb, dst_pid, msg->msg_flags&MSG_DONTWAIT);
1194
1195 out:
1196 return err;
1197 }
1198
1199 static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
1200 struct msghdr *msg, size_t len,
1201 int flags)
1202 {
1203 struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
1204 struct scm_cookie scm;
1205 struct sock *sk = sock->sk;
1206 struct netlink_sock *nlk = nlk_sk(sk);
1207 int noblock = flags&MSG_DONTWAIT;
1208 size_t copied;
1209 struct sk_buff *skb;
1210 int err;
1211
1212 if (flags&MSG_OOB)
1213 return -EOPNOTSUPP;
1214
1215 copied = 0;
1216
1217 skb = skb_recv_datagram(sk,flags,noblock,&err);
1218 if (skb==NULL)
1219 goto out;
1220
1221 msg->msg_namelen = 0;
1222
1223 copied = skb->len;
1224 if (len < copied) {
1225 msg->msg_flags |= MSG_TRUNC;
1226 copied = len;
1227 }
1228
1229 skb_reset_transport_header(skb);
1230 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1231
1232 if (msg->msg_name) {
1233 struct sockaddr_nl *addr = (struct sockaddr_nl*)msg->msg_name;
1234 addr->nl_family = AF_NETLINK;
1235 addr->nl_pad = 0;
1236 addr->nl_pid = NETLINK_CB(skb).pid;
1237 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group);
1238 msg->msg_namelen = sizeof(*addr);
1239 }
1240
1241 if (nlk->flags & NETLINK_RECV_PKTINFO)
1242 netlink_cmsg_recv_pktinfo(msg, skb);
1243
1244 if (NULL == siocb->scm) {
1245 memset(&scm, 0, sizeof(scm));
1246 siocb->scm = &scm;
1247 }
1248 siocb->scm->creds = *NETLINK_CREDS(skb);
1249 if (flags & MSG_TRUNC)
1250 copied = skb->len;
1251 skb_free_datagram(sk, skb);
1252
1253 if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
1254 netlink_dump(sk);
1255
1256 scm_recv(sock, msg, siocb->scm, flags);
1257 out:
1258 netlink_rcv_wake(sk);
1259 return err ? : copied;
1260 }
1261
1262 static void netlink_data_ready(struct sock *sk, int len)
1263 {
1264 struct netlink_sock *nlk = nlk_sk(sk);
1265
1266 if (nlk->data_ready)
1267 nlk->data_ready(sk, len);
1268 netlink_rcv_wake(sk);
1269 }
1270
1271 /*
1272 * We export these functions to other modules. They provide a
1273 * complete set of kernel non-blocking support for message
1274 * queueing.
1275 */
1276
1277 struct sock *
1278 netlink_kernel_create(int unit, unsigned int groups,
1279 void (*input)(struct sock *sk, int len),
1280 struct mutex *cb_mutex, struct module *module)
1281 {
1282 struct socket *sock;
1283 struct sock *sk;
1284 struct netlink_sock *nlk;
1285 unsigned long *listeners = NULL;
1286
1287 BUG_ON(!nl_table);
1288
1289 if (unit<0 || unit>=MAX_LINKS)
1290 return NULL;
1291
1292 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
1293 return NULL;
1294
1295 if (__netlink_create(sock, cb_mutex, unit) < 0)
1296 goto out_sock_release;
1297
1298 if (groups < 32)
1299 groups = 32;
1300
1301 listeners = kzalloc(NLGRPSZ(groups), GFP_KERNEL);
1302 if (!listeners)
1303 goto out_sock_release;
1304
1305 sk = sock->sk;
1306 sk->sk_data_ready = netlink_data_ready;
1307 if (input)
1308 nlk_sk(sk)->data_ready = input;
1309
1310 if (netlink_insert(sk, 0))
1311 goto out_sock_release;
1312
1313 nlk = nlk_sk(sk);
1314 nlk->flags |= NETLINK_KERNEL_SOCKET;
1315
1316 netlink_table_grab();
1317 nl_table[unit].groups = groups;
1318 nl_table[unit].listeners = listeners;
1319 nl_table[unit].cb_mutex = cb_mutex;
1320 nl_table[unit].module = module;
1321 nl_table[unit].registered = 1;
1322 netlink_table_ungrab();
1323
1324 return sk;
1325
1326 out_sock_release:
1327 kfree(listeners);
1328 sock_release(sock);
1329 return NULL;
1330 }
1331
1332 void netlink_set_nonroot(int protocol, unsigned int flags)
1333 {
1334 if ((unsigned int)protocol < MAX_LINKS)
1335 nl_table[protocol].nl_nonroot = flags;
1336 }
1337
1338 static void netlink_destroy_callback(struct netlink_callback *cb)
1339 {
1340 if (cb->skb)
1341 kfree_skb(cb->skb);
1342 kfree(cb);
1343 }
1344
1345 /*
1346 * It looks a bit ugly.
1347 * It would be better to create kernel thread.
1348 */
1349
1350 static int netlink_dump(struct sock *sk)
1351 {
1352 struct netlink_sock *nlk = nlk_sk(sk);
1353 struct netlink_callback *cb;
1354 struct sk_buff *skb;
1355 struct nlmsghdr *nlh;
1356 int len, err = -ENOBUFS;
1357
1358 skb = sock_rmalloc(sk, NLMSG_GOODSIZE, 0, GFP_KERNEL);
1359 if (!skb)
1360 goto errout;
1361
1362 mutex_lock(nlk->cb_mutex);
1363
1364 cb = nlk->cb;
1365 if (cb == NULL) {
1366 err = -EINVAL;
1367 goto errout_skb;
1368 }
1369
1370 len = cb->dump(skb, cb);
1371
1372 if (len > 0) {
1373 mutex_unlock(nlk->cb_mutex);
1374 skb_queue_tail(&sk->sk_receive_queue, skb);
1375 sk->sk_data_ready(sk, len);
1376 return 0;
1377 }
1378
1379 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
1380 if (!nlh)
1381 goto errout_skb;
1382
1383 memcpy(nlmsg_data(nlh), &len, sizeof(len));
1384
1385 skb_queue_tail(&sk->sk_receive_queue, skb);
1386 sk->sk_data_ready(sk, skb->len);
1387
1388 if (cb->done)
1389 cb->done(cb);
1390 nlk->cb = NULL;
1391 mutex_unlock(nlk->cb_mutex);
1392
1393 netlink_destroy_callback(cb);
1394 return 0;
1395
1396 errout_skb:
1397 mutex_unlock(nlk->cb_mutex);
1398 kfree_skb(skb);
1399 errout:
1400 return err;
1401 }
1402
1403 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
1404 struct nlmsghdr *nlh,
1405 int (*dump)(struct sk_buff *skb, struct netlink_callback*),
1406 int (*done)(struct netlink_callback*))
1407 {
1408 struct netlink_callback *cb;
1409 struct sock *sk;
1410 struct netlink_sock *nlk;
1411
1412 cb = kzalloc(sizeof(*cb), GFP_KERNEL);
1413 if (cb == NULL)
1414 return -ENOBUFS;
1415
1416 cb->dump = dump;
1417 cb->done = done;
1418 cb->nlh = nlh;
1419 atomic_inc(&skb->users);
1420 cb->skb = skb;
1421
1422 sk = netlink_lookup(ssk->sk_protocol, NETLINK_CB(skb).pid);
1423 if (sk == NULL) {
1424 netlink_destroy_callback(cb);
1425 return -ECONNREFUSED;
1426 }
1427 nlk = nlk_sk(sk);
1428 /* A dump is in progress... */
1429 mutex_lock(nlk->cb_mutex);
1430 if (nlk->cb) {
1431 mutex_unlock(nlk->cb_mutex);
1432 netlink_destroy_callback(cb);
1433 sock_put(sk);
1434 return -EBUSY;
1435 }
1436 nlk->cb = cb;
1437 mutex_unlock(nlk->cb_mutex);
1438
1439 netlink_dump(sk);
1440 sock_put(sk);
1441
1442 /* We successfully started a dump, by returning -EINTR we
1443 * signal the queue mangement to interrupt processing of
1444 * any netlink messages so userspace gets a chance to read
1445 * the results. */
1446 return -EINTR;
1447 }
1448
1449 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
1450 {
1451 struct sk_buff *skb;
1452 struct nlmsghdr *rep;
1453 struct nlmsgerr *errmsg;
1454 size_t payload = sizeof(*errmsg);
1455
1456 /* error messages get the original request appened */
1457 if (err)
1458 payload += nlmsg_len(nlh);
1459
1460 skb = nlmsg_new(payload, GFP_KERNEL);
1461 if (!skb) {
1462 struct sock *sk;
1463
1464 sk = netlink_lookup(in_skb->sk->sk_protocol,
1465 NETLINK_CB(in_skb).pid);
1466 if (sk) {
1467 sk->sk_err = ENOBUFS;
1468 sk->sk_error_report(sk);
1469 sock_put(sk);
1470 }
1471 return;
1472 }
1473
1474 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
1475 NLMSG_ERROR, sizeof(struct nlmsgerr), 0);
1476 errmsg = nlmsg_data(rep);
1477 errmsg->error = err;
1478 memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
1479 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).pid, MSG_DONTWAIT);
1480 }
1481
1482 static int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
1483 struct nlmsghdr *))
1484 {
1485 struct nlmsghdr *nlh;
1486 int err;
1487
1488 while (skb->len >= nlmsg_total_size(0)) {
1489 nlh = nlmsg_hdr(skb);
1490 err = 0;
1491
1492 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
1493 return 0;
1494
1495 /* Only requests are handled by the kernel */
1496 if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
1497 goto skip;
1498
1499 /* Skip control messages */
1500 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
1501 goto skip;
1502
1503 err = cb(skb, nlh);
1504 if (err == -EINTR) {
1505 /* Not an error, but we interrupt processing */
1506 netlink_queue_skip(nlh, skb);
1507 return err;
1508 }
1509 skip:
1510 if (nlh->nlmsg_flags & NLM_F_ACK || err)
1511 netlink_ack(skb, nlh, err);
1512
1513 netlink_queue_skip(nlh, skb);
1514 }
1515
1516 return 0;
1517 }
1518
1519 /**
1520 * nelink_run_queue - Process netlink receive queue.
1521 * @sk: Netlink socket containing the queue
1522 * @qlen: Place to store queue length upon entry
1523 * @cb: Callback function invoked for each netlink message found
1524 *
1525 * Processes as much as there was in the queue upon entry and invokes
1526 * a callback function for each netlink message found. The callback
1527 * function may refuse a message by returning a negative error code
1528 * but setting the error pointer to 0 in which case this function
1529 * returns with a qlen != 0.
1530 *
1531 * qlen must be initialized to 0 before the initial entry, afterwards
1532 * the function may be called repeatedly until qlen reaches 0.
1533 *
1534 * The callback function may return -EINTR to signal that processing
1535 * of netlink messages shall be interrupted. In this case the message
1536 * currently being processed will NOT be requeued onto the receive
1537 * queue.
1538 */
1539 void netlink_run_queue(struct sock *sk, unsigned int *qlen,
1540 int (*cb)(struct sk_buff *, struct nlmsghdr *))
1541 {
1542 struct sk_buff *skb;
1543
1544 if (!*qlen || *qlen > skb_queue_len(&sk->sk_receive_queue))
1545 *qlen = skb_queue_len(&sk->sk_receive_queue);
1546
1547 for (; *qlen; (*qlen)--) {
1548 skb = skb_dequeue(&sk->sk_receive_queue);
1549 if (netlink_rcv_skb(skb, cb)) {
1550 if (skb->len)
1551 skb_queue_head(&sk->sk_receive_queue, skb);
1552 else {
1553 kfree_skb(skb);
1554 (*qlen)--;
1555 }
1556 break;
1557 }
1558
1559 kfree_skb(skb);
1560 }
1561 }
1562
1563 /**
1564 * netlink_queue_skip - Skip netlink message while processing queue.
1565 * @nlh: Netlink message to be skipped
1566 * @skb: Socket buffer containing the netlink messages.
1567 *
1568 * Pulls the given netlink message off the socket buffer so the next
1569 * call to netlink_queue_run() will not reconsider the message.
1570 */
1571 static void netlink_queue_skip(struct nlmsghdr *nlh, struct sk_buff *skb)
1572 {
1573 int msglen = NLMSG_ALIGN(nlh->nlmsg_len);
1574
1575 if (msglen > skb->len)
1576 msglen = skb->len;
1577
1578 skb_pull(skb, msglen);
1579 }
1580
1581 /**
1582 * nlmsg_notify - send a notification netlink message
1583 * @sk: netlink socket to use
1584 * @skb: notification message
1585 * @pid: destination netlink pid for reports or 0
1586 * @group: destination multicast group or 0
1587 * @report: 1 to report back, 0 to disable
1588 * @flags: allocation flags
1589 */
1590 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 pid,
1591 unsigned int group, int report, gfp_t flags)
1592 {
1593 int err = 0;
1594
1595 if (group) {
1596 int exclude_pid = 0;
1597
1598 if (report) {
1599 atomic_inc(&skb->users);
1600 exclude_pid = pid;
1601 }
1602
1603 /* errors reported via destination sk->sk_err */
1604 nlmsg_multicast(sk, skb, exclude_pid, group, flags);
1605 }
1606
1607 if (report)
1608 err = nlmsg_unicast(sk, skb, pid);
1609
1610 return err;
1611 }
1612
1613 #ifdef CONFIG_PROC_FS
1614 struct nl_seq_iter {
1615 int link;
1616 int hash_idx;
1617 };
1618
1619 static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos)
1620 {
1621 struct nl_seq_iter *iter = seq->private;
1622 int i, j;
1623 struct sock *s;
1624 struct hlist_node *node;
1625 loff_t off = 0;
1626
1627 for (i=0; i<MAX_LINKS; i++) {
1628 struct nl_pid_hash *hash = &nl_table[i].hash;
1629
1630 for (j = 0; j <= hash->mask; j++) {
1631 sk_for_each(s, node, &hash->table[j]) {
1632 if (off == pos) {
1633 iter->link = i;
1634 iter->hash_idx = j;
1635 return s;
1636 }
1637 ++off;
1638 }
1639 }
1640 }
1641 return NULL;
1642 }
1643
1644 static void *netlink_seq_start(struct seq_file *seq, loff_t *pos)
1645 {
1646 read_lock(&nl_table_lock);
1647 return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN;
1648 }
1649
1650 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1651 {
1652 struct sock *s;
1653 struct nl_seq_iter *iter;
1654 int i, j;
1655
1656 ++*pos;
1657
1658 if (v == SEQ_START_TOKEN)
1659 return netlink_seq_socket_idx(seq, 0);
1660
1661 s = sk_next(v);
1662 if (s)
1663 return s;
1664
1665 iter = seq->private;
1666 i = iter->link;
1667 j = iter->hash_idx + 1;
1668
1669 do {
1670 struct nl_pid_hash *hash = &nl_table[i].hash;
1671
1672 for (; j <= hash->mask; j++) {
1673 s = sk_head(&hash->table[j]);
1674 if (s) {
1675 iter->link = i;
1676 iter->hash_idx = j;
1677 return s;
1678 }
1679 }
1680
1681 j = 0;
1682 } while (++i < MAX_LINKS);
1683
1684 return NULL;
1685 }
1686
1687 static void netlink_seq_stop(struct seq_file *seq, void *v)
1688 {
1689 read_unlock(&nl_table_lock);
1690 }
1691
1692
1693 static int netlink_seq_show(struct seq_file *seq, void *v)
1694 {
1695 if (v == SEQ_START_TOKEN)
1696 seq_puts(seq,
1697 "sk Eth Pid Groups "
1698 "Rmem Wmem Dump Locks\n");
1699 else {
1700 struct sock *s = v;
1701 struct netlink_sock *nlk = nlk_sk(s);
1702
1703 seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %d\n",
1704 s,
1705 s->sk_protocol,
1706 nlk->pid,
1707 nlk->groups ? (u32)nlk->groups[0] : 0,
1708 atomic_read(&s->sk_rmem_alloc),
1709 atomic_read(&s->sk_wmem_alloc),
1710 nlk->cb,
1711 atomic_read(&s->sk_refcnt)
1712 );
1713
1714 }
1715 return 0;
1716 }
1717
1718 static struct seq_operations netlink_seq_ops = {
1719 .start = netlink_seq_start,
1720 .next = netlink_seq_next,
1721 .stop = netlink_seq_stop,
1722 .show = netlink_seq_show,
1723 };
1724
1725
1726 static int netlink_seq_open(struct inode *inode, struct file *file)
1727 {
1728 struct seq_file *seq;
1729 struct nl_seq_iter *iter;
1730 int err;
1731
1732 iter = kzalloc(sizeof(*iter), GFP_KERNEL);
1733 if (!iter)
1734 return -ENOMEM;
1735
1736 err = seq_open(file, &netlink_seq_ops);
1737 if (err) {
1738 kfree(iter);
1739 return err;
1740 }
1741
1742 seq = file->private_data;
1743 seq->private = iter;
1744 return 0;
1745 }
1746
1747 static const struct file_operations netlink_seq_fops = {
1748 .owner = THIS_MODULE,
1749 .open = netlink_seq_open,
1750 .read = seq_read,
1751 .llseek = seq_lseek,
1752 .release = seq_release_private,
1753 };
1754
1755 #endif
1756
1757 int netlink_register_notifier(struct notifier_block *nb)
1758 {
1759 return atomic_notifier_chain_register(&netlink_chain, nb);
1760 }
1761
1762 int netlink_unregister_notifier(struct notifier_block *nb)
1763 {
1764 return atomic_notifier_chain_unregister(&netlink_chain, nb);
1765 }
1766
1767 static const struct proto_ops netlink_ops = {
1768 .family = PF_NETLINK,
1769 .owner = THIS_MODULE,
1770 .release = netlink_release,
1771 .bind = netlink_bind,
1772 .connect = netlink_connect,
1773 .socketpair = sock_no_socketpair,
1774 .accept = sock_no_accept,
1775 .getname = netlink_getname,
1776 .poll = datagram_poll,
1777 .ioctl = sock_no_ioctl,
1778 .listen = sock_no_listen,
1779 .shutdown = sock_no_shutdown,
1780 .setsockopt = netlink_setsockopt,
1781 .getsockopt = netlink_getsockopt,
1782 .sendmsg = netlink_sendmsg,
1783 .recvmsg = netlink_recvmsg,
1784 .mmap = sock_no_mmap,
1785 .sendpage = sock_no_sendpage,
1786 };
1787
1788 static struct net_proto_family netlink_family_ops = {
1789 .family = PF_NETLINK,
1790 .create = netlink_create,
1791 .owner = THIS_MODULE, /* for consistency 8) */
1792 };
1793
1794 static int __init netlink_proto_init(void)
1795 {
1796 struct sk_buff *dummy_skb;
1797 int i;
1798 unsigned long max;
1799 unsigned int order;
1800 int err = proto_register(&netlink_proto, 0);
1801
1802 if (err != 0)
1803 goto out;
1804
1805 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > sizeof(dummy_skb->cb));
1806
1807 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
1808 if (!nl_table)
1809 goto panic;
1810
1811 if (num_physpages >= (128 * 1024))
1812 max = num_physpages >> (21 - PAGE_SHIFT);
1813 else
1814 max = num_physpages >> (23 - PAGE_SHIFT);
1815
1816 order = get_bitmask_order(max) - 1 + PAGE_SHIFT;
1817 max = (1UL << order) / sizeof(struct hlist_head);
1818 order = get_bitmask_order(max > UINT_MAX ? UINT_MAX : max) - 1;
1819
1820 for (i = 0; i < MAX_LINKS; i++) {
1821 struct nl_pid_hash *hash = &nl_table[i].hash;
1822
1823 hash->table = nl_pid_hash_alloc(1 * sizeof(*hash->table));
1824 if (!hash->table) {
1825 while (i-- > 0)
1826 nl_pid_hash_free(nl_table[i].hash.table,
1827 1 * sizeof(*hash->table));
1828 kfree(nl_table);
1829 goto panic;
1830 }
1831 memset(hash->table, 0, 1 * sizeof(*hash->table));
1832 hash->max_shift = order;
1833 hash->shift = 0;
1834 hash->mask = 0;
1835 hash->rehash_time = jiffies;
1836 }
1837
1838 sock_register(&netlink_family_ops);
1839 #ifdef CONFIG_PROC_FS
1840 proc_net_fops_create("netlink", 0, &netlink_seq_fops);
1841 #endif
1842 /* The netlink device handler may be needed early. */
1843 rtnetlink_init();
1844 out:
1845 return err;
1846 panic:
1847 panic("netlink_init: Cannot allocate nl_table\n");
1848 }
1849
1850 core_initcall(netlink_proto_init);
1851
1852 EXPORT_SYMBOL(netlink_ack);
1853 EXPORT_SYMBOL(netlink_run_queue);
1854 EXPORT_SYMBOL(netlink_broadcast);
1855 EXPORT_SYMBOL(netlink_dump_start);
1856 EXPORT_SYMBOL(netlink_kernel_create);
1857 EXPORT_SYMBOL(netlink_register_notifier);
1858 EXPORT_SYMBOL(netlink_set_nonroot);
1859 EXPORT_SYMBOL(netlink_unicast);
1860 EXPORT_SYMBOL(netlink_unregister_notifier);
1861 EXPORT_SYMBOL(nlmsg_notify);
SocketAccessConTroL development