release/src-rt-6.x.4708/linux/linux-2.6.36/net/rxrpc/ar-input.c

   1 /* RxRPC packet reception
   2  *
   3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/net.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/errqueue.h>
  16 #include <linux/udp.h>
  17 #include <linux/in.h>
  18 #include <linux/in6.h>
  19 #include <linux/icmp.h>
  20 #include <linux/gfp.h>
  21 #include <net/sock.h>
  22 #include <net/af_rxrpc.h>
  23 #include <net/ip.h>
  24 #include <net/udp.h>
  25 #include <net/net_namespace.h>
  26 #include "ar-internal.h"
  27
  28 unsigned long rxrpc_ack_timeout = 1;
  29
  30 const char *rxrpc_pkts[] = {
  31         "?00",
  32         "DATA", "ACK", "BUSY", "ABORT", "ACKALL", "CHALL", "RESP", "DEBUG",
  33         "?09", "?10", "?11", "?12", "?13", "?14", "?15"
  34 };
  35
  36 /*
  37  * queue a packet for recvmsg to pass to userspace
  38  * - the caller must hold a lock on call->lock
  39  * - must not be called with interrupts disabled (sk_filter() disables BH's)
  40  * - eats the packet whether successful or not
  41  * - there must be just one reference to the packet, which the caller passes to
  42  *   this function
  43  */
  44 int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
  45                         bool force, bool terminal)
  46 {
  47         struct rxrpc_skb_priv *sp;
  48         struct rxrpc_sock *rx = call->socket;
  49         struct sock *sk;
  50         int skb_len, ret;
  51
  52         _enter(",,%d,%d", force, terminal);
  53
  54         ASSERT(!irqs_disabled());
  55
  56         sp = rxrpc_skb(skb);
  57         ASSERTCMP(sp->call, ==, call);
  58
  59         /* if we've already posted the terminal message for a call, then we
  60          * don't post any more */
  61         if (test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
  62                 _debug("already terminated");
  63                 ASSERTCMP(call->state, >=, RXRPC_CALL_COMPLETE);
  64                 skb->destructor = NULL;
  65                 sp->call = NULL;
  66                 rxrpc_put_call(call);
  67                 rxrpc_free_skb(skb);
  68                 return 0;
  69         }
  70
  71         sk = &rx->sk;
  72
  73         if (!force) {
  74                 /* cast skb->rcvbuf to unsigned...  It's pointless, but
  75                  * reduces number of warnings when compiling with -W
  76                  * --ANK */
  77 //              ret = -ENOBUFS;
  78 //              if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
  79 //                  (unsigned) sk->sk_rcvbuf)
  80 //                      goto out;
  81
  82                 ret = sk_filter(sk, skb);
  83                 if (ret < 0)
  84                         goto out;
  85         }
  86
  87         spin_lock_bh(&sk->sk_receive_queue.lock);
  88         if (!test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags) &&
  89             !test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
  90             call->socket->sk.sk_state != RXRPC_CLOSE) {
  91                 skb->destructor = rxrpc_packet_destructor;
  92                 skb->dev = NULL;
  93                 skb->sk = sk;
  94                 atomic_add(skb->truesize, &sk->sk_rmem_alloc);
  95
  96                 if (terminal) {
  97                         _debug("<<<< TERMINAL MESSAGE >>>>");
  98                         set_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags);
  99                 }
 100
 101                 /* allow interception by a kernel service */
 102                 if (rx->interceptor) {
 103                         rx->interceptor(sk, call->user_call_ID, skb);
 104                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 105                 } else {
 106
 107                         /* Cache the SKB length before we tack it onto the
 108                          * receive queue.  Once it is added it no longer
 109                          * belongs to us and may be freed by other threads of
 110                          * control pulling packets from the queue */
 111                         skb_len = skb->len;
 112
 113                         _net("post skb %p", skb);
 114                         __skb_queue_tail(&sk->sk_receive_queue, skb);
 115                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 116
 117                         if (!sock_flag(sk, SOCK_DEAD))
 118                                 sk->sk_data_ready(sk, skb_len);
 119                 }
 120                 skb = NULL;
 121         } else {
 122                 spin_unlock_bh(&sk->sk_receive_queue.lock);
 123         }
 124         ret = 0;
 125
 126 out:
 127         /* release the socket buffer */
 128         if (skb) {
 129                 skb->destructor = NULL;
 130                 sp->call = NULL;
 131                 rxrpc_put_call(call);
 132                 rxrpc_free_skb(skb);
 133         }
 134
 135         _leave(" = %d", ret);
 136         return ret;
 137 }
 138
 139 /*
 140  * process a DATA packet, posting the packet to the appropriate queue
 141  * - eats the packet if successful
 142  */
 143 static int rxrpc_fast_process_data(struct rxrpc_call *call,
 144                                    struct sk_buff *skb, u32 seq)
 145 {
 146         struct rxrpc_skb_priv *sp;
 147         bool terminal;
 148         int ret, ackbit, ack;
 149
 150         _enter("{%u,%u},,{%u}", call->rx_data_post, call->rx_first_oos, seq);
 151
 152         sp = rxrpc_skb(skb);
 153         ASSERTCMP(sp->call, ==, NULL);
 154
 155         spin_lock(&call->lock);
 156
 157         if (call->state > RXRPC_CALL_COMPLETE)
 158                 goto discard;
 159
 160         ASSERTCMP(call->rx_data_expect, >=, call->rx_data_post);
 161         ASSERTCMP(call->rx_data_post, >=, call->rx_data_recv);
 162         ASSERTCMP(call->rx_data_recv, >=, call->rx_data_eaten);
 163
 164         if (seq < call->rx_data_post) {
 165                 _debug("dup #%u [-%u]", seq, call->rx_data_post);
 166                 ack = RXRPC_ACK_DUPLICATE;
 167                 ret = -ENOBUFS;
 168                 goto discard_and_ack;
 169         }
 170
 171         /* we may already have the packet in the out of sequence queue */
 172         ackbit = seq - (call->rx_data_eaten + 1);
 173         ASSERTCMP(ackbit, >=, 0);
 174         if (__test_and_set_bit(ackbit, call->ackr_window)) {
 175                 _debug("dup oos #%u [%u,%u]",
 176                        seq, call->rx_data_eaten, call->rx_data_post);
 177                 ack = RXRPC_ACK_DUPLICATE;
 178                 goto discard_and_ack;
 179         }
 180
 181         if (seq >= call->ackr_win_top) {
 182                 _debug("exceed #%u [%u]", seq, call->ackr_win_top);
 183                 __clear_bit(ackbit, call->ackr_window);
 184                 ack = RXRPC_ACK_EXCEEDS_WINDOW;
 185                 goto discard_and_ack;
 186         }
 187
 188         if (seq == call->rx_data_expect) {
 189                 clear_bit(RXRPC_CALL_EXPECT_OOS, &call->flags);
 190                 call->rx_data_expect++;
 191         } else if (seq > call->rx_data_expect) {
 192                 _debug("oos #%u [%u]", seq, call->rx_data_expect);
 193                 call->rx_data_expect = seq + 1;
 194                 if (test_and_set_bit(RXRPC_CALL_EXPECT_OOS, &call->flags)) {
 195                         ack = RXRPC_ACK_OUT_OF_SEQUENCE;
 196                         goto enqueue_and_ack;
 197                 }
 198                 goto enqueue_packet;
 199         }
 200
 201         if (seq != call->rx_data_post) {
 202                 _debug("ahead #%u [%u]", seq, call->rx_data_post);
 203                 goto enqueue_packet;
 204         }
 205
 206         if (test_bit(RXRPC_CALL_RCVD_LAST, &call->flags))
 207                 goto protocol_error;
 208
 209         /* if the packet need security things doing to it, then it goes down
 210          * the slow path */
 211         if (call->conn->security)
 212                 goto enqueue_packet;
 213
 214         sp->call = call;
 215         rxrpc_get_call(call);
 216         terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
 217                     !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
 218         ret = rxrpc_queue_rcv_skb(call, skb, false, terminal);
 219         if (ret < 0) {
 220                 if (ret == -ENOMEM || ret == -ENOBUFS) {
 221                         __clear_bit(ackbit, call->ackr_window);
 222                         ack = RXRPC_ACK_NOSPACE;
 223                         goto discard_and_ack;
 224                 }
 225                 goto out;
 226         }
 227
 228         skb = NULL;
 229
 230         _debug("post #%u", seq);
 231         ASSERTCMP(call->rx_data_post, ==, seq);
 232         call->rx_data_post++;
 233
 234         if (sp->hdr.flags & RXRPC_LAST_PACKET)
 235                 set_bit(RXRPC_CALL_RCVD_LAST, &call->flags);
 236
 237         /* if we've reached an out of sequence packet then we need to drain
 238          * that queue into the socket Rx queue now */
 239         if (call->rx_data_post == call->rx_first_oos) {
 240                 _debug("drain rx oos now");
 241                 read_lock(&call->state_lock);
 242                 if (call->state < RXRPC_CALL_COMPLETE &&
 243                     !test_and_set_bit(RXRPC_CALL_DRAIN_RX_OOS, &call->events))
 244                         rxrpc_queue_call(call);
 245                 read_unlock(&call->state_lock);
 246         }
 247
 248         spin_unlock(&call->lock);
 249         atomic_inc(&call->ackr_not_idle);
 250         rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, sp->hdr.serial, false);
 251         _leave(" = 0 [posted]");
 252         return 0;
 253
 254 protocol_error:
 255         ret = -EBADMSG;
 256 out:
 257         spin_unlock(&call->lock);
 258         _leave(" = %d", ret);
 259         return ret;
 260
 261 discard_and_ack:
 262         _debug("discard and ACK packet %p", skb);
 263         __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
 264 discard:
 265         spin_unlock(&call->lock);
 266         rxrpc_free_skb(skb);
 267         _leave(" = 0 [discarded]");
 268         return 0;
 269
 270 enqueue_and_ack:
 271         __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
 272 enqueue_packet:
 273         _net("defer skb %p", skb);
 274         spin_unlock(&call->lock);
 275         skb_queue_tail(&call->rx_queue, skb);
 276         atomic_inc(&call->ackr_not_idle);
 277         read_lock(&call->state_lock);
 278         if (call->state < RXRPC_CALL_DEAD)
 279                 rxrpc_queue_call(call);
 280         read_unlock(&call->state_lock);
 281         _leave(" = 0 [queued]");
 282         return 0;
 283 }
 284
 285 /*
 286  * assume an implicit ACKALL of the transmission phase of a client socket upon
 287  * reception of the first reply packet
 288  */
 289 static void rxrpc_assume_implicit_ackall(struct rxrpc_call *call, u32 serial)
 290 {
 291         write_lock_bh(&call->state_lock);
 292
 293         switch (call->state) {
 294         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
 295                 call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
 296                 call->acks_latest = serial;
 297
 298                 _debug("implicit ACKALL %%%u", call->acks_latest);
 299                 set_bit(RXRPC_CALL_RCVD_ACKALL, &call->events);
 300                 write_unlock_bh(&call->state_lock);
 301
 302                 if (try_to_del_timer_sync(&call->resend_timer) >= 0) {
 303                         clear_bit(RXRPC_CALL_RESEND_TIMER, &call->events);
 304                         clear_bit(RXRPC_CALL_RESEND, &call->events);
 305                         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 306                 }
 307                 break;
 308
 309         default:
 310                 write_unlock_bh(&call->state_lock);
 311                 break;
 312         }
 313 }
 314
 315 /*
 316  * post an incoming packet to the nominated call to deal with
 317  * - must get rid of the sk_buff, either by freeing it or by queuing it
 318  */
 319 void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
 320 {
 321         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 322         __be32 _abort_code;
 323         u32 serial, hi_serial, seq, abort_code;
 324
 325         _enter("%p,%p", call, skb);
 326
 327         ASSERT(!irqs_disabled());
 328
 329
 330         /* track the latest serial number on this connection for ACK packet
 331          * information */
 332         serial = ntohl(sp->hdr.serial);
 333         hi_serial = atomic_read(&call->conn->hi_serial);
 334         while (serial > hi_serial)
 335                 hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
 336                                            serial);
 337
 338         /* request ACK generation for any ACK or DATA packet that requests
 339          * it */
 340         if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
 341                 _proto("ACK Requested on %%%u", serial);
 342                 rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, sp->hdr.serial,
 343                                   !(sp->hdr.flags & RXRPC_MORE_PACKETS));
 344         }
 345
 346         switch (sp->hdr.type) {
 347         case RXRPC_PACKET_TYPE_ABORT:
 348                 _debug("abort");
 349
 350                 if (skb_copy_bits(skb, 0, &_abort_code,
 351                                   sizeof(_abort_code)) < 0)
 352                         goto protocol_error;
 353
 354                 abort_code = ntohl(_abort_code);
 355                 _proto("Rx ABORT %%%u { %x }", serial, abort_code);
 356
 357                 write_lock_bh(&call->state_lock);
 358                 if (call->state < RXRPC_CALL_COMPLETE) {
 359                         call->state = RXRPC_CALL_REMOTELY_ABORTED;
 360                         call->abort_code = abort_code;
 361                         set_bit(RXRPC_CALL_RCVD_ABORT, &call->events);
 362                         rxrpc_queue_call(call);
 363                 }
 364                 goto free_packet_unlock;
 365
 366         case RXRPC_PACKET_TYPE_BUSY:
 367                 _proto("Rx BUSY %%%u", serial);
 368
 369                 if (call->conn->out_clientflag)
 370                         goto protocol_error;
 371
 372                 write_lock_bh(&call->state_lock);
 373                 switch (call->state) {
 374                 case RXRPC_CALL_CLIENT_SEND_REQUEST:
 375                         call->state = RXRPC_CALL_SERVER_BUSY;
 376                         set_bit(RXRPC_CALL_RCVD_BUSY, &call->events);
 377                         rxrpc_queue_call(call);
 378                 case RXRPC_CALL_SERVER_BUSY:
 379                         goto free_packet_unlock;
 380                 default:
 381                         goto protocol_error_locked;
 382                 }
 383
 384         default:
 385                 _proto("Rx %s %%%u", rxrpc_pkts[sp->hdr.type], serial);
 386                 goto protocol_error;
 387
 388         case RXRPC_PACKET_TYPE_DATA:
 389                 seq = ntohl(sp->hdr.seq);
 390
 391                 _proto("Rx DATA %%%u { #%u }", serial, seq);
 392
 393                 if (seq == 0)
 394                         goto protocol_error;
 395
 396                 call->ackr_prev_seq = sp->hdr.seq;
 397
 398                 /* received data implicitly ACKs all of the request packets we
 399                  * sent when we're acting as a client */
 400                 if (call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY)
 401                         rxrpc_assume_implicit_ackall(call, serial);
 402
 403                 switch (rxrpc_fast_process_data(call, skb, seq)) {
 404                 case 0:
 405                         skb = NULL;
 406                         goto done;
 407
 408                 default:
 409                         BUG();
 410
 411                         /* data packet received beyond the last packet */
 412                 case -EBADMSG:
 413                         goto protocol_error;
 414                 }
 415
 416         case RXRPC_PACKET_TYPE_ACK:
 417                 /* ACK processing is done in process context */
 418                 read_lock_bh(&call->state_lock);
 419                 if (call->state < RXRPC_CALL_DEAD) {
 420                         skb_queue_tail(&call->rx_queue, skb);
 421                         rxrpc_queue_call(call);
 422                         skb = NULL;
 423                 }
 424                 read_unlock_bh(&call->state_lock);
 425                 goto free_packet;
 426         }
 427
 428 protocol_error:
 429         _debug("protocol error");
 430         write_lock_bh(&call->state_lock);
 431 protocol_error_locked:
 432         if (call->state <= RXRPC_CALL_COMPLETE) {
 433                 call->state = RXRPC_CALL_LOCALLY_ABORTED;
 434                 call->abort_code = RX_PROTOCOL_ERROR;
 435                 set_bit(RXRPC_CALL_ABORT, &call->events);
 436                 rxrpc_queue_call(call);
 437         }
 438 free_packet_unlock:
 439         write_unlock_bh(&call->state_lock);
 440 free_packet:
 441         rxrpc_free_skb(skb);
 442 done:
 443         _leave("");
 444 }
 445
 446 /*
 447  * split up a jumbo data packet
 448  */
 449 static void rxrpc_process_jumbo_packet(struct rxrpc_call *call,
 450                                        struct sk_buff *jumbo)
 451 {
 452         struct rxrpc_jumbo_header jhdr;
 453         struct rxrpc_skb_priv *sp;
 454         struct sk_buff *part;
 455
 456         _enter(",{%u,%u}", jumbo->data_len, jumbo->len);
 457
 458         sp = rxrpc_skb(jumbo);
 459
 460         do {
 461                 sp->hdr.flags &= ~RXRPC_JUMBO_PACKET;
 462
 463                 /* make a clone to represent the first subpacket in what's left
 464                  * of the jumbo packet */
 465                 part = skb_clone(jumbo, GFP_ATOMIC);
 466                 if (!part) {
 467                         /* simply ditch the tail in the event of ENOMEM */
 468                         pskb_trim(jumbo, RXRPC_JUMBO_DATALEN);
 469                         break;
 470                 }
 471                 rxrpc_new_skb(part);
 472
 473                 pskb_trim(part, RXRPC_JUMBO_DATALEN);
 474
 475                 if (!pskb_pull(jumbo, RXRPC_JUMBO_DATALEN))
 476                         goto protocol_error;
 477
 478                 if (skb_copy_bits(jumbo, 0, &jhdr, sizeof(jhdr)) < 0)
 479                         goto protocol_error;
 480                 if (!pskb_pull(jumbo, sizeof(jhdr)))
 481                         BUG();
 482
 483                 sp->hdr.seq     = htonl(ntohl(sp->hdr.seq) + 1);
 484                 sp->hdr.serial  = htonl(ntohl(sp->hdr.serial) + 1);
 485                 sp->hdr.flags   = jhdr.flags;
 486                 sp->hdr._rsvd   = jhdr._rsvd;
 487
 488                 _proto("Rx DATA Jumbo %%%u", ntohl(sp->hdr.serial) - 1);
 489
 490                 rxrpc_fast_process_packet(call, part);
 491                 part = NULL;
 492
 493         } while (sp->hdr.flags & RXRPC_JUMBO_PACKET);
 494
 495         rxrpc_fast_process_packet(call, jumbo);
 496         _leave("");
 497         return;
 498
 499 protocol_error:
 500         _debug("protocol error");
 501         rxrpc_free_skb(part);
 502         rxrpc_free_skb(jumbo);
 503         write_lock_bh(&call->state_lock);
 504         if (call->state <= RXRPC_CALL_COMPLETE) {
 505                 call->state = RXRPC_CALL_LOCALLY_ABORTED;
 506                 call->abort_code = RX_PROTOCOL_ERROR;
 507                 set_bit(RXRPC_CALL_ABORT, &call->events);
 508                 rxrpc_queue_call(call);
 509         }
 510         write_unlock_bh(&call->state_lock);
 511         _leave("");
 512 }
 513
 514 /*
 515  * post an incoming packet to the appropriate call/socket to deal with
 516  * - must get rid of the sk_buff, either by freeing it or by queuing it
 517  */
 518 static void rxrpc_post_packet_to_call(struct rxrpc_connection *conn,
 519                                       struct sk_buff *skb)
 520 {
 521         struct rxrpc_skb_priv *sp;
 522         struct rxrpc_call *call;
 523         struct rb_node *p;
 524         __be32 call_id;
 525
 526         _enter("%p,%p", conn, skb);
 527
 528         read_lock_bh(&conn->lock);
 529
 530         sp = rxrpc_skb(skb);
 531
 532         /* look at extant calls by channel number first */
 533         call = conn->channels[ntohl(sp->hdr.cid) & RXRPC_CHANNELMASK];
 534         if (!call || call->call_id != sp->hdr.callNumber)
 535                 goto call_not_extant;
 536
 537         _debug("extant call [%d]", call->state);
 538         ASSERTCMP(call->conn, ==, conn);
 539
 540         read_lock(&call->state_lock);
 541         switch (call->state) {
 542         case RXRPC_CALL_LOCALLY_ABORTED:
 543                 if (!test_and_set_bit(RXRPC_CALL_ABORT, &call->events))
 544                         rxrpc_queue_call(call);
 545         case RXRPC_CALL_REMOTELY_ABORTED:
 546         case RXRPC_CALL_NETWORK_ERROR:
 547         case RXRPC_CALL_DEAD:
 548                 goto free_unlock;
 549         default:
 550                 break;
 551         }
 552
 553         read_unlock(&call->state_lock);
 554         rxrpc_get_call(call);
 555         read_unlock_bh(&conn->lock);
 556
 557         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 558             sp->hdr.flags & RXRPC_JUMBO_PACKET)
 559                 rxrpc_process_jumbo_packet(call, skb);
 560         else
 561                 rxrpc_fast_process_packet(call, skb);
 562
 563         rxrpc_put_call(call);
 564         goto done;
 565
 566 call_not_extant:
 567         /* search the completed calls in case what we're dealing with is
 568          * there */
 569         _debug("call not extant");
 570
 571         call_id = sp->hdr.callNumber;
 572         p = conn->calls.rb_node;
 573         while (p) {
 574                 call = rb_entry(p, struct rxrpc_call, conn_node);
 575
 576                 if (call_id < call->call_id)
 577                         p = p->rb_left;
 578                 else if (call_id > call->call_id)
 579                         p = p->rb_right;
 580                 else
 581                         goto found_completed_call;
 582         }
 583
 584 dead_call:
 585         /* it's a either a really old call that we no longer remember or its a
 586          * new incoming call */
 587         read_unlock_bh(&conn->lock);
 588
 589         if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
 590             sp->hdr.seq == cpu_to_be32(1)) {
 591                 _debug("incoming call");
 592                 skb_queue_tail(&conn->trans->local->accept_queue, skb);
 593                 rxrpc_queue_work(&conn->trans->local->acceptor);
 594                 goto done;
 595         }
 596
 597         _debug("dead call");
 598         skb->priority = RX_CALL_DEAD;
 599         rxrpc_reject_packet(conn->trans->local, skb);
 600         goto done;
 601
 602         /* resend last packet of a completed call
 603          * - client calls may have been aborted or ACK'd
 604          * - server calls may have been aborted
 605          */
 606 found_completed_call:
 607         _debug("completed call");
 608
 609         if (atomic_read(&call->usage) == 0)
 610                 goto dead_call;
 611
 612         /* synchronise any state changes */
 613         read_lock(&call->state_lock);
 614         ASSERTIFCMP(call->state != RXRPC_CALL_CLIENT_FINAL_ACK,
 615                     call->state, >=, RXRPC_CALL_COMPLETE);
 616
 617         if (call->state == RXRPC_CALL_LOCALLY_ABORTED ||
 618             call->state == RXRPC_CALL_REMOTELY_ABORTED ||
 619             call->state == RXRPC_CALL_DEAD) {
 620                 read_unlock(&call->state_lock);
 621                 goto dead_call;
 622         }
 623
 624         if (call->conn->in_clientflag) {
 625                 read_unlock(&call->state_lock);
 626                 goto dead_call; /* complete server call */
 627         }
 628
 629         _debug("final ack again");
 630         rxrpc_get_call(call);
 631         set_bit(RXRPC_CALL_ACK_FINAL, &call->events);
 632         rxrpc_queue_call(call);
 633
 634 free_unlock:
 635         read_unlock(&call->state_lock);
 636         read_unlock_bh(&conn->lock);
 637         rxrpc_free_skb(skb);
 638 done:
 639         _leave("");
 640 }
 641
 642 /*
 643  * post connection-level events to the connection
 644  * - this includes challenges, responses and some aborts
 645  */
 646 static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
 647                                       struct sk_buff *skb)
 648 {
 649         _enter("%p,%p", conn, skb);
 650
 651         atomic_inc(&conn->usage);
 652         skb_queue_tail(&conn->rx_queue, skb);
 653         rxrpc_queue_conn(conn);
 654 }
 655
 656 /*
 657  * handle data received on the local endpoint
 658  * - may be called in interrupt context
 659  */
 660 void rxrpc_data_ready(struct sock *sk, int count)
 661 {
 662         struct rxrpc_connection *conn;
 663         struct rxrpc_transport *trans;
 664         struct rxrpc_skb_priv *sp;
 665         struct rxrpc_local *local;
 666         struct rxrpc_peer *peer;
 667         struct sk_buff *skb;
 668         int ret;
 669
 670         _enter("%p, %d", sk, count);
 671
 672         ASSERT(!irqs_disabled());
 673
 674         read_lock_bh(&rxrpc_local_lock);
 675         local = sk->sk_user_data;
 676         if (local && atomic_read(&local->usage) > 0)
 677                 rxrpc_get_local(local);
 678         else
 679                 local = NULL;
 680         read_unlock_bh(&rxrpc_local_lock);
 681         if (!local) {
 682                 _leave(" [local dead]");
 683                 return;
 684         }
 685
 686         skb = skb_recv_datagram(sk, 0, 1, &ret);
 687         if (!skb) {
 688                 rxrpc_put_local(local);
 689                 if (ret == -EAGAIN)
 690                         return;
 691                 _debug("UDP socket error %d", ret);
 692                 return;
 693         }
 694
 695         rxrpc_new_skb(skb);
 696
 697         _net("recv skb %p", skb);
 698
 699         /* we'll probably need to checksum it (didn't call sock_recvmsg) */
 700         if (skb_checksum_complete(skb)) {
 701                 rxrpc_free_skb(skb);
 702                 rxrpc_put_local(local);
 703                 UDP_INC_STATS_BH(&init_net, UDP_MIB_INERRORS, 0);
 704                 _leave(" [CSUM failed]");
 705                 return;
 706         }
 707
 708         UDP_INC_STATS_BH(&init_net, UDP_MIB_INDATAGRAMS, 0);
 709
 710         /* the socket buffer we have is owned by UDP, with UDP's data all over
 711          * it, but we really want our own */
 712         skb_orphan(skb);
 713         sp = rxrpc_skb(skb);
 714         memset(sp, 0, sizeof(*sp));
 715
 716         _net("Rx UDP packet from %08x:%04hu",
 717              ntohl(ip_hdr(skb)->saddr), ntohs(udp_hdr(skb)->source));
 718
 719         /* dig out the RxRPC connection details */
 720         if (skb_copy_bits(skb, sizeof(struct udphdr), &sp->hdr,
 721                           sizeof(sp->hdr)) < 0)
 722                 goto bad_message;
 723         if (!pskb_pull(skb, sizeof(struct udphdr) + sizeof(sp->hdr)))
 724                 BUG();
 725
 726         _net("Rx RxRPC %s ep=%x call=%x:%x",
 727              sp->hdr.flags & RXRPC_CLIENT_INITIATED ? "ToServer" : "ToClient",
 728              ntohl(sp->hdr.epoch),
 729              ntohl(sp->hdr.cid),
 730              ntohl(sp->hdr.callNumber));
 731
 732         if (sp->hdr.type == 0 || sp->hdr.type >= RXRPC_N_PACKET_TYPES) {
 733                 _proto("Rx Bad Packet Type %u", sp->hdr.type);
 734                 goto bad_message;
 735         }
 736
 737         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 738             (sp->hdr.callNumber == 0 || sp->hdr.seq == 0))
 739                 goto bad_message;
 740
 741         peer = rxrpc_find_peer(local, ip_hdr(skb)->saddr, udp_hdr(skb)->source);
 742         if (IS_ERR(peer))
 743                 goto cant_route_call;
 744
 745         trans = rxrpc_find_transport(local, peer);
 746         rxrpc_put_peer(peer);
 747         if (!trans)
 748                 goto cant_route_call;
 749
 750         conn = rxrpc_find_connection(trans, &sp->hdr);
 751         rxrpc_put_transport(trans);
 752         if (!conn)
 753                 goto cant_route_call;
 754
 755         _debug("CONN %p {%d}", conn, conn->debug_id);
 756
 757         if (sp->hdr.callNumber == 0)
 758                 rxrpc_post_packet_to_conn(conn, skb);
 759         else
 760                 rxrpc_post_packet_to_call(conn, skb);
 761         rxrpc_put_connection(conn);
 762         rxrpc_put_local(local);
 763         return;
 764
 765 cant_route_call:
 766         _debug("can't route call");
 767         if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
 768             sp->hdr.type == RXRPC_PACKET_TYPE_DATA) {
 769                 if (sp->hdr.seq == cpu_to_be32(1)) {
 770                         _debug("first packet");
 771                         skb_queue_tail(&local->accept_queue, skb);
 772                         rxrpc_queue_work(&local->acceptor);
 773                         rxrpc_put_local(local);
 774                         _leave(" [incoming]");
 775                         return;
 776                 }
 777                 skb->priority = RX_INVALID_OPERATION;
 778         } else {
 779                 skb->priority = RX_CALL_DEAD;
 780         }
 781
 782         _debug("reject");
 783         rxrpc_reject_packet(local, skb);
 784         rxrpc_put_local(local);
 785         _leave(" [no call]");
 786         return;
 787
 788 bad_message:
 789         skb->priority = RX_PROTOCOL_ERROR;
 790         rxrpc_reject_packet(local, skb);
 791         rxrpc_put_local(local);
 792         _leave(" [badmsg]");
 793 }