af_netlink.c 76.2 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 * NETLINK      Kernel-user communication protocol.
 *
4
 * 		Authors:	Alan Cox <alan@lxorguk.ukuu.org.uk>
L
Linus Torvalds 已提交
5
 * 				Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6
 * 				Patrick McHardy <kaber@trash.net>
L
Linus Torvalds 已提交
7 8 9 10 11
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
12
 *
L
Linus Torvalds 已提交
13 14 15 16
 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
 *                               added netlink_proto_exit
 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
 * 				 use nlk_sk, as sk->protinfo is on a diet 8)
17 18 19 20 21 22
 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
 * 				 - inc module use count of module that owns
 * 				   the kernel socket in case userspace opens
 * 				   socket of same protocol
 * 				 - remove all module support, since netlink is
 * 				   mandatory if CONFIG_NET=y these days
L
Linus Torvalds 已提交
23 24 25 26
 */

#include <linux/module.h>

27
#include <linux/capability.h>
L
Linus Torvalds 已提交
28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/signal.h>
#include <linux/sched.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/un.h>
#include <linux/fcntl.h>
#include <linux/termios.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/notifier.h>
#include <linux/security.h>
#include <linux/jhash.h>
#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/bitops.h>
#include <linux/mm.h>
#include <linux/types.h>
A
Andrew Morton 已提交
57
#include <linux/audit.h>
58
#include <linux/mutex.h>
59
#include <linux/vmalloc.h>
60
#include <linux/if_arp.h>
61
#include <linux/rhashtable.h>
62
#include <asm/cacheflush.h>
63
#include <linux/hash.h>
64
#include <linux/genetlink.h>
A
Andrew Morton 已提交
65

66
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
67 68
#include <net/sock.h>
#include <net/scm.h>
69
#include <net/netlink.h>
L
Linus Torvalds 已提交
70

71
#include "af_netlink.h"
L
Linus Torvalds 已提交
72

73 74 75
struct listeners {
	struct rcu_head		rcu;
	unsigned long		masks[0];
76 77
};

78
/* state bits */
79
#define NETLINK_S_CONGESTED		0x0
80 81

/* flags */
82 83 84 85
#define NETLINK_F_KERNEL_SOCKET		0x1
#define NETLINK_F_RECV_PKTINFO		0x2
#define NETLINK_F_BROADCAST_SEND_ERROR	0x4
#define NETLINK_F_RECV_NO_ENOBUFS	0x8
86
#define NETLINK_F_LISTEN_ALL_NSID	0x10
87
#define NETLINK_F_CAP_ACK		0x20
88

89
static inline int netlink_is_kernel(struct sock *sk)
90
{
91
	return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
92 93
}

94
struct netlink_table *nl_table __read_mostly;
95
EXPORT_SYMBOL_GPL(nl_table);
L
Linus Torvalds 已提交
96 97 98 99

static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);

static int netlink_dump(struct sock *sk);
100
static void netlink_skb_destructor(struct sk_buff *skb);
L
Linus Torvalds 已提交
101

102
/* nl_table locking explained:
103
 * Lookup and traversal are protected with an RCU read-side lock. Insertion
Y
Ying Xue 已提交
104
 * and removal are protected with per bucket lock while using RCU list
105 106 107 108
 * modification primitives and may run in parallel to RCU protected lookups.
 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
 * been acquired * either during or after the socket has been removed from
 * the list and after an RCU grace period.
109
 */
110 111
DEFINE_RWLOCK(nl_table_lock);
EXPORT_SYMBOL_GPL(nl_table_lock);
L
Linus Torvalds 已提交
112 113
static atomic_t nl_table_users = ATOMIC_INIT(0);

114 115
#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));

116
static ATOMIC_NOTIFIER_HEAD(netlink_chain);
L
Linus Torvalds 已提交
117

118 119 120
static DEFINE_SPINLOCK(netlink_tap_lock);
static struct list_head netlink_tap_all __read_mostly;

121 122
static const struct rhashtable_params netlink_rhashtable_params;

123
static inline u32 netlink_group_mask(u32 group)
124 125 126 127
{
	return group ? 1 << (group - 1) : 0;
}

128 129 130 131 132 133 134 135 136
int netlink_add_tap(struct netlink_tap *nt)
{
	if (unlikely(nt->dev->type != ARPHRD_NETLINK))
		return -EINVAL;

	spin_lock(&netlink_tap_lock);
	list_add_rcu(&nt->list, &netlink_tap_all);
	spin_unlock(&netlink_tap_lock);

137
	__module_get(nt->module);
138 139 140 141 142

	return 0;
}
EXPORT_SYMBOL_GPL(netlink_add_tap);

143
static int __netlink_remove_tap(struct netlink_tap *nt)
144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161
{
	bool found = false;
	struct netlink_tap *tmp;

	spin_lock(&netlink_tap_lock);

	list_for_each_entry(tmp, &netlink_tap_all, list) {
		if (nt == tmp) {
			list_del_rcu(&nt->list);
			found = true;
			goto out;
		}
	}

	pr_warn("__netlink_remove_tap: %p not found\n", nt);
out:
	spin_unlock(&netlink_tap_lock);

162
	if (found)
163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178
		module_put(nt->module);

	return found ? 0 : -ENODEV;
}

int netlink_remove_tap(struct netlink_tap *nt)
{
	int ret;

	ret = __netlink_remove_tap(nt);
	synchronize_net();

	return ret;
}
EXPORT_SYMBOL_GPL(netlink_remove_tap);

179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194
static bool netlink_filter_tap(const struct sk_buff *skb)
{
	struct sock *sk = skb->sk;

	/* We take the more conservative approach and
	 * whitelist socket protocols that may pass.
	 */
	switch (sk->sk_protocol) {
	case NETLINK_ROUTE:
	case NETLINK_USERSOCK:
	case NETLINK_SOCK_DIAG:
	case NETLINK_NFLOG:
	case NETLINK_XFRM:
	case NETLINK_FIB_LOOKUP:
	case NETLINK_NETFILTER:
	case NETLINK_GENERIC:
V
Varka Bhadram 已提交
195
		return true;
196 197
	}

V
Varka Bhadram 已提交
198
	return false;
199 200
}

201 202 203 204
static int __netlink_deliver_tap_skb(struct sk_buff *skb,
				     struct net_device *dev)
{
	struct sk_buff *nskb;
205
	struct sock *sk = skb->sk;
206 207 208 209 210 211
	int ret = -ENOMEM;

	dev_hold(dev);
	nskb = skb_clone(skb, GFP_ATOMIC);
	if (nskb) {
		nskb->dev = dev;
212
		nskb->protocol = htons((u16) sk->sk_protocol);
213 214
		nskb->pkt_type = netlink_is_kernel(sk) ?
				 PACKET_KERNEL : PACKET_USER;
215
		skb_reset_network_header(nskb);
216 217 218 219 220 221 222 223 224 225 226 227 228 229
		ret = dev_queue_xmit(nskb);
		if (unlikely(ret > 0))
			ret = net_xmit_errno(ret);
	}

	dev_put(dev);
	return ret;
}

static void __netlink_deliver_tap(struct sk_buff *skb)
{
	int ret;
	struct netlink_tap *tmp;

230 231 232
	if (!netlink_filter_tap(skb))
		return;

233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249
	list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
		ret = __netlink_deliver_tap_skb(skb, tmp->dev);
		if (unlikely(ret))
			break;
	}
}

static void netlink_deliver_tap(struct sk_buff *skb)
{
	rcu_read_lock();

	if (unlikely(!list_empty(&netlink_tap_all)))
		__netlink_deliver_tap(skb);

	rcu_read_unlock();
}

250 251 252 253 254 255 256
static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
				       struct sk_buff *skb)
{
	if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
		netlink_deliver_tap(skb);
}

257 258 259 260
static void netlink_overrun(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

261 262 263
	if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
		if (!test_and_set_bit(NETLINK_S_CONGESTED,
				      &nlk_sk(sk)->state)) {
264 265 266 267 268 269 270 271 272 273 274 275
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
		}
	}
	atomic_inc(&sk->sk_drops);
}

static void netlink_rcv_wake(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (skb_queue_empty(&sk->sk_receive_queue))
276 277
		clear_bit(NETLINK_S_CONGESTED, &nlk->state);
	if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
278 279 280
		wake_up_interruptible(&nlk->wait);
}

281
#ifdef CONFIG_NETLINK_MMAP
282 283 284 285 286
static bool netlink_skb_is_mmaped(const struct sk_buff *skb)
{
	return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
}

287 288 289 290 291
static bool netlink_rx_is_mmaped(struct sock *sk)
{
	return nlk_sk(sk)->rx_ring.pg_vec != NULL;
}

292 293 294 295 296
static bool netlink_tx_is_mmaped(struct sock *sk)
{
	return nlk_sk(sk)->tx_ring.pg_vec != NULL;
}

297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342
static __pure struct page *pgvec_to_page(const void *addr)
{
	if (is_vmalloc_addr(addr))
		return vmalloc_to_page(addr);
	else
		return virt_to_page(addr);
}

static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
{
	unsigned int i;

	for (i = 0; i < len; i++) {
		if (pg_vec[i] != NULL) {
			if (is_vmalloc_addr(pg_vec[i]))
				vfree(pg_vec[i]);
			else
				free_pages((unsigned long)pg_vec[i], order);
		}
	}
	kfree(pg_vec);
}

static void *alloc_one_pg_vec_page(unsigned long order)
{
	void *buffer;
	gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
			  __GFP_NOWARN | __GFP_NORETRY;

	buffer = (void *)__get_free_pages(gfp_flags, order);
	if (buffer != NULL)
		return buffer;

	buffer = vzalloc((1 << order) * PAGE_SIZE);
	if (buffer != NULL)
		return buffer;

	gfp_flags &= ~__GFP_NORETRY;
	return (void *)__get_free_pages(gfp_flags, order);
}

static void **alloc_pg_vec(struct netlink_sock *nlk,
			   struct nl_mmap_req *req, unsigned int order)
{
	unsigned int block_nr = req->nm_block_nr;
	unsigned int i;
343
	void **pg_vec;
344 345 346 347 348 349

	pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
	if (pg_vec == NULL)
		return NULL;

	for (i = 0; i < block_nr; i++) {
350
		pg_vec[i] = alloc_one_pg_vec_page(order);
351 352 353 354 355 356 357 358 359 360
		if (pg_vec[i] == NULL)
			goto err1;
	}

	return pg_vec;
err1:
	free_pg_vec(pg_vec, order, block_nr);
	return NULL;
}

361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392

static void
__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
		   unsigned int order)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct sk_buff_head *queue;
	struct netlink_ring *ring;

	queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
	ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;

	spin_lock_bh(&queue->lock);

	ring->frame_max		= req->nm_frame_nr - 1;
	ring->head		= 0;
	ring->frame_size	= req->nm_frame_size;
	ring->pg_vec_pages	= req->nm_block_size / PAGE_SIZE;

	swap(ring->pg_vec_len, req->nm_block_nr);
	swap(ring->pg_vec_order, order);
	swap(ring->pg_vec, pg_vec);

	__skb_queue_purge(queue);
	spin_unlock_bh(&queue->lock);

	WARN_ON(atomic_read(&nlk->mapped));

	if (pg_vec)
		free_pg_vec(pg_vec, order, req->nm_block_nr);
}

393
static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
394
			    bool tx_ring)
395 396 397 398 399 400 401 402
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring;
	void **pg_vec = NULL;
	unsigned int order = 0;

	ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;

403 404 405 406
	if (atomic_read(&nlk->mapped))
		return -EBUSY;
	if (atomic_read(&ring->pending))
		return -EBUSY;
407 408 409 410 411 412 413

	if (req->nm_block_nr) {
		if (ring->pg_vec != NULL)
			return -EBUSY;

		if ((int)req->nm_block_size <= 0)
			return -EINVAL;
T
Tobias Klauser 已提交
414
		if (!PAGE_ALIGNED(req->nm_block_size))
415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438
			return -EINVAL;
		if (req->nm_frame_size < NL_MMAP_HDRLEN)
			return -EINVAL;
		if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
			return -EINVAL;

		ring->frames_per_block = req->nm_block_size /
					 req->nm_frame_size;
		if (ring->frames_per_block == 0)
			return -EINVAL;
		if (ring->frames_per_block * req->nm_block_nr !=
		    req->nm_frame_nr)
			return -EINVAL;

		order = get_order(req->nm_block_size);
		pg_vec = alloc_pg_vec(nlk, req, order);
		if (pg_vec == NULL)
			return -ENOMEM;
	} else {
		if (req->nm_frame_nr)
			return -EINVAL;
	}

	mutex_lock(&nlk->pg_vec_lock);
439 440 441 442
	if (atomic_read(&nlk->mapped) == 0) {
		__netlink_set_ring(sk, req, tx_ring, pg_vec, order);
		mutex_unlock(&nlk->pg_vec_lock);
		return 0;
443
	}
444

445 446 447 448
	mutex_unlock(&nlk->pg_vec_lock);

	if (pg_vec)
		free_pg_vec(pg_vec, order, req->nm_block_nr);
449 450

	return -EBUSY;
451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532
}

static void netlink_mm_open(struct vm_area_struct *vma)
{
	struct file *file = vma->vm_file;
	struct socket *sock = file->private_data;
	struct sock *sk = sock->sk;

	if (sk)
		atomic_inc(&nlk_sk(sk)->mapped);
}

static void netlink_mm_close(struct vm_area_struct *vma)
{
	struct file *file = vma->vm_file;
	struct socket *sock = file->private_data;
	struct sock *sk = sock->sk;

	if (sk)
		atomic_dec(&nlk_sk(sk)->mapped);
}

static const struct vm_operations_struct netlink_mmap_ops = {
	.open	= netlink_mm_open,
	.close	= netlink_mm_close,
};

static int netlink_mmap(struct file *file, struct socket *sock,
			struct vm_area_struct *vma)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring;
	unsigned long start, size, expected;
	unsigned int i;
	int err = -EINVAL;

	if (vma->vm_pgoff)
		return -EINVAL;

	mutex_lock(&nlk->pg_vec_lock);

	expected = 0;
	for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
		if (ring->pg_vec == NULL)
			continue;
		expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
	}

	if (expected == 0)
		goto out;

	size = vma->vm_end - vma->vm_start;
	if (size != expected)
		goto out;

	start = vma->vm_start;
	for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
		if (ring->pg_vec == NULL)
			continue;

		for (i = 0; i < ring->pg_vec_len; i++) {
			struct page *page;
			void *kaddr = ring->pg_vec[i];
			unsigned int pg_num;

			for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
				page = pgvec_to_page(kaddr);
				err = vm_insert_page(vma, start, page);
				if (err < 0)
					goto out;
				start += PAGE_SIZE;
				kaddr += PAGE_SIZE;
			}
		}
	}

	atomic_inc(&nlk->mapped);
	vma->vm_ops = &netlink_mmap_ops;
	err = 0;
out:
	mutex_unlock(&nlk->pg_vec_lock);
533
	return err;
534
}
535

D
David Miller 已提交
536
static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
537 538 539 540 541 542
{
#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
	struct page *p_start, *p_end;

	/* First page is flushed through netlink_{get,set}_status */
	p_start = pgvec_to_page(hdr + PAGE_SIZE);
D
David Miller 已提交
543
	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560
	while (p_start <= p_end) {
		flush_dcache_page(p_start);
		p_start++;
	}
#endif
}

static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
{
	smp_rmb();
	flush_dcache_page(pgvec_to_page(hdr));
	return hdr->nm_status;
}

static void netlink_set_status(struct nl_mmap_hdr *hdr,
			       enum nl_mmap_status status)
{
561
	smp_mb();
562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626
	hdr->nm_status = status;
	flush_dcache_page(pgvec_to_page(hdr));
}

static struct nl_mmap_hdr *
__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
{
	unsigned int pg_vec_pos, frame_off;

	pg_vec_pos = pos / ring->frames_per_block;
	frame_off  = pos % ring->frames_per_block;

	return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
}

static struct nl_mmap_hdr *
netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
		     enum nl_mmap_status status)
{
	struct nl_mmap_hdr *hdr;

	hdr = __netlink_lookup_frame(ring, pos);
	if (netlink_get_status(hdr) != status)
		return NULL;

	return hdr;
}

static struct nl_mmap_hdr *
netlink_current_frame(const struct netlink_ring *ring,
		      enum nl_mmap_status status)
{
	return netlink_lookup_frame(ring, ring->head, status);
}

static struct nl_mmap_hdr *
netlink_previous_frame(const struct netlink_ring *ring,
		       enum nl_mmap_status status)
{
	unsigned int prev;

	prev = ring->head ? ring->head - 1 : ring->frame_max;
	return netlink_lookup_frame(ring, prev, status);
}

static void netlink_increment_head(struct netlink_ring *ring)
{
	ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
}

static void netlink_forward_ring(struct netlink_ring *ring)
{
	unsigned int head = ring->head, pos = head;
	const struct nl_mmap_hdr *hdr;

	do {
		hdr = __netlink_lookup_frame(ring, pos);
		if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
			break;
		if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
			break;
		netlink_increment_head(ring);
	} while (ring->head != head);
}

627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645
static bool netlink_dump_space(struct netlink_sock *nlk)
{
	struct netlink_ring *ring = &nlk->rx_ring;
	struct nl_mmap_hdr *hdr;
	unsigned int n;

	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
	if (hdr == NULL)
		return false;

	n = ring->head + ring->frame_max / 2;
	if (n > ring->frame_max)
		n -= ring->frame_max;

	hdr = __netlink_lookup_frame(ring, n);

	return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
}

646 647 648 649 650 651
static unsigned int netlink_poll(struct file *file, struct socket *sock,
				 poll_table *wait)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	unsigned int mask;
652
	int err;
653

654 655 656 657 658
	if (nlk->rx_ring.pg_vec != NULL) {
		/* Memory mapped sockets don't call recvmsg(), so flow control
		 * for dumps is performed here. A dump is allowed to continue
		 * if at least half the ring is unused.
		 */
659
		while (nlk->cb_running && netlink_dump_space(nlk)) {
660 661
			err = netlink_dump(sk);
			if (err < 0) {
662
				sk->sk_err = -err;
663 664 665 666 667 668
				sk->sk_error_report(sk);
				break;
			}
		}
		netlink_rcv_wake(sk);
	}
669

670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714
	mask = datagram_poll(file, sock, wait);

	spin_lock_bh(&sk->sk_receive_queue.lock);
	if (nlk->rx_ring.pg_vec) {
		netlink_forward_ring(&nlk->rx_ring);
		if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED))
			mask |= POLLIN | POLLRDNORM;
	}
	spin_unlock_bh(&sk->sk_receive_queue.lock);

	spin_lock_bh(&sk->sk_write_queue.lock);
	if (nlk->tx_ring.pg_vec) {
		if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
			mask |= POLLOUT | POLLWRNORM;
	}
	spin_unlock_bh(&sk->sk_write_queue.lock);

	return mask;
}

static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
{
	return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
}

static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
				   struct netlink_ring *ring,
				   struct nl_mmap_hdr *hdr)
{
	unsigned int size;
	void *data;

	size = ring->frame_size - NL_MMAP_HDRLEN;
	data = (void *)hdr + NL_MMAP_HDRLEN;

	skb->head	= data;
	skb->data	= data;
	skb_reset_tail_pointer(skb);
	skb->end	= skb->tail + size;
	skb->len	= 0;

	skb->destructor	= netlink_skb_destructor;
	NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
	NETLINK_CB(skb).sk = sk;
}
715 716 717

static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
				u32 dst_portid, u32 dst_group,
C
Christoph Hellwig 已提交
718
				struct scm_cookie *scm)
719 720 721 722 723 724 725 726 727 728 729 730 731 732
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring;
	struct nl_mmap_hdr *hdr;
	struct sk_buff *skb;
	unsigned int maxlen;
	int err = 0, len = 0;

	mutex_lock(&nlk->pg_vec_lock);

	ring   = &nlk->tx_ring;
	maxlen = ring->frame_size - NL_MMAP_HDRLEN;

	do {
D
David Miller 已提交
733 734
		unsigned int nm_len;

735 736 737 738 739 740 741
		hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
		if (hdr == NULL) {
			if (!(msg->msg_flags & MSG_DONTWAIT) &&
			    atomic_read(&nlk->tx_ring.pending))
				schedule();
			continue;
		}
D
David Miller 已提交
742 743 744

		nm_len = ACCESS_ONCE(hdr->nm_len);
		if (nm_len > maxlen) {
745 746 747 748
			err = -EINVAL;
			goto out;
		}

D
David Miller 已提交
749
		netlink_frame_flush_dcache(hdr, nm_len);
750

D
David Miller 已提交
751 752 753 754
		skb = alloc_skb(nm_len, GFP_KERNEL);
		if (skb == NULL) {
			err = -ENOBUFS;
			goto out;
755
		}
D
David Miller 已提交
756 757 758
		__skb_put(skb, nm_len);
		memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
		netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
759 760 761 762 763

		netlink_increment_head(ring);

		NETLINK_CB(skb).portid	  = nlk->portid;
		NETLINK_CB(skb).dst_group = dst_group;
C
Christoph Hellwig 已提交
764
		NETLINK_CB(skb).creds	  = scm->creds;
765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792

		err = security_netlink_send(sk, skb);
		if (err) {
			kfree_skb(skb);
			goto out;
		}

		if (unlikely(dst_group)) {
			atomic_inc(&skb->users);
			netlink_broadcast(sk, skb, dst_portid, dst_group,
					  GFP_KERNEL);
		}
		err = netlink_unicast(sk, skb, dst_portid,
				      msg->msg_flags & MSG_DONTWAIT);
		if (err < 0)
			goto out;
		len += err;

	} while (hdr != NULL ||
		 (!(msg->msg_flags & MSG_DONTWAIT) &&
		  atomic_read(&nlk->tx_ring.pending)));

	if (len > 0)
		err = len;
out:
	mutex_unlock(&nlk->pg_vec_lock);
	return err;
}
793 794 795 796 797 798 799 800 801

static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
{
	struct nl_mmap_hdr *hdr;

	hdr = netlink_mmap_hdr(skb);
	hdr->nm_len	= skb->len;
	hdr->nm_group	= NETLINK_CB(skb).dst_group;
	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
802 803
	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
D
David Miller 已提交
804
	netlink_frame_flush_dcache(hdr, hdr->nm_len);
805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821
	netlink_set_status(hdr, NL_MMAP_STATUS_VALID);

	NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
	kfree_skb(skb);
}

static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring = &nlk->rx_ring;
	struct nl_mmap_hdr *hdr;

	spin_lock_bh(&sk->sk_receive_queue.lock);
	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
	if (hdr == NULL) {
		spin_unlock_bh(&sk->sk_receive_queue.lock);
		kfree_skb(skb);
822
		netlink_overrun(sk);
823 824 825 826 827 828 829 830 831
		return;
	}
	netlink_increment_head(ring);
	__skb_queue_tail(&sk->sk_receive_queue, skb);
	spin_unlock_bh(&sk->sk_receive_queue.lock);

	hdr->nm_len	= skb->len;
	hdr->nm_group	= NETLINK_CB(skb).dst_group;
	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
832 833
	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
834 835 836
	netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
}

837
#else /* CONFIG_NETLINK_MMAP */
838
#define netlink_skb_is_mmaped(skb)	false
839
#define netlink_rx_is_mmaped(sk)	false
840
#define netlink_tx_is_mmaped(sk)	false
841
#define netlink_mmap			sock_no_mmap
842
#define netlink_poll			datagram_poll
C
Christoph Hellwig 已提交
843
#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm)	0
844 845
#endif /* CONFIG_NETLINK_MMAP */

846 847
static void netlink_skb_destructor(struct sk_buff *skb)
{
848 849 850 851 852 853 854 855 856 857 858 859 860 861
#ifdef CONFIG_NETLINK_MMAP
	struct nl_mmap_hdr *hdr;
	struct netlink_ring *ring;
	struct sock *sk;

	/* If a packet from the kernel to userspace was freed because of an
	 * error without being delivered to userspace, the kernel must reset
	 * the status. In the direction userspace to kernel, the status is
	 * always reset here after the packet was processed and freed.
	 */
	if (netlink_skb_is_mmaped(skb)) {
		hdr = netlink_mmap_hdr(skb);
		sk = NETLINK_CB(skb).sk;

862 863 864 865 866 867 868 869 870
		if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
			netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
			ring = &nlk_sk(sk)->tx_ring;
		} else {
			if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
				hdr->nm_len = 0;
				netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
			}
			ring = &nlk_sk(sk)->rx_ring;
871 872 873 874 875 876
		}

		WARN_ON(atomic_read(&ring->pending) == 0);
		atomic_dec(&ring->pending);
		sock_put(sk);

877
		skb->head = NULL;
878 879
	}
#endif
880
	if (is_vmalloc_addr(skb->head)) {
881 882 883 884
		if (!skb->cloned ||
		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
			vfree(skb->head);

885 886
		skb->head = NULL;
	}
887 888
	if (skb->sk != NULL)
		sock_rfree(skb);
889 890 891 892 893 894 895 896 897 898 899
}

static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
{
	WARN_ON(skb->sk != NULL);
	skb->sk = sk;
	skb->destructor = netlink_skb_destructor;
	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
	sk_mem_charge(sk, skb->truesize);
}

L
Linus Torvalds 已提交
900 901
static void netlink_sock_destruct(struct sock *sk)
{
902 903
	struct netlink_sock *nlk = nlk_sk(sk);

904 905 906
	if (nlk->cb_running) {
		if (nlk->cb.done)
			nlk->cb.done(&nlk->cb);
907

908 909
		module_put(nlk->cb.module);
		kfree_skb(nlk->cb.skb);
910 911
	}

L
Linus Torvalds 已提交
912
	skb_queue_purge(&sk->sk_receive_queue);
913 914 915 916 917 918
#ifdef CONFIG_NETLINK_MMAP
	if (1) {
		struct nl_mmap_req req;

		memset(&req, 0, sizeof(req));
		if (nlk->rx_ring.pg_vec)
919
			__netlink_set_ring(sk, &req, false, NULL, 0);
920 921
		memset(&req, 0, sizeof(req));
		if (nlk->tx_ring.pg_vec)
922
			__netlink_set_ring(sk, &req, true, NULL, 0);
923 924
	}
#endif /* CONFIG_NETLINK_MMAP */
L
Linus Torvalds 已提交
925 926

	if (!sock_flag(sk, SOCK_DEAD)) {
927
		printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
L
Linus Torvalds 已提交
928 929
		return;
	}
930 931 932 933

	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
	WARN_ON(atomic_read(&sk->sk_wmem_alloc));
	WARN_ON(nlk_sk(sk)->groups);
L
Linus Torvalds 已提交
934 935
}

936 937
/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
 * SMP. Look, when several writers sleep and reader wakes them up, all but one
L
Linus Torvalds 已提交
938 939 940 941
 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
 * this, _but_ remember, it adds useless work on UP machines.
 */

942
void netlink_table_grab(void)
943
	__acquires(nl_table_lock)
L
Linus Torvalds 已提交
944
{
945 946
	might_sleep();

947
	write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
948 949 950 951 952

	if (atomic_read(&nl_table_users)) {
		DECLARE_WAITQUEUE(wait, current);

		add_wait_queue_exclusive(&nl_table_wait, &wait);
953
		for (;;) {
L
Linus Torvalds 已提交
954 955 956
			set_current_state(TASK_UNINTERRUPTIBLE);
			if (atomic_read(&nl_table_users) == 0)
				break;
957
			write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
958
			schedule();
959
			write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
960 961 962 963 964 965 966
		}

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nl_table_wait, &wait);
	}
}

967
void netlink_table_ungrab(void)
968
	__releases(nl_table_lock)
L
Linus Torvalds 已提交
969
{
970
	write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
971 972 973
	wake_up(&nl_table_wait);
}

974
static inline void
L
Linus Torvalds 已提交
975 976 977 978 979 980 981 982 983
netlink_lock_table(void)
{
	/* read_lock() synchronizes us to netlink_table_grab */

	read_lock(&nl_table_lock);
	atomic_inc(&nl_table_users);
	read_unlock(&nl_table_lock);
}

984
static inline void
L
Linus Torvalds 已提交
985 986 987 988 989 990
netlink_unlock_table(void)
{
	if (atomic_dec_and_test(&nl_table_users))
		wake_up(&nl_table_wait);
}

991
struct netlink_compare_arg
L
Linus Torvalds 已提交
992
{
993
	possible_net_t pnet;
994 995
	u32 portid;
};
L
Linus Torvalds 已提交
996

997 998 999
/* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
#define netlink_compare_arg_len \
	(offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
1000 1001 1002

static inline int netlink_compare(struct rhashtable_compare_arg *arg,
				  const void *ptr)
L
Linus Torvalds 已提交
1003
{
1004 1005
	const struct netlink_compare_arg *x = arg->key;
	const struct netlink_sock *nlk = ptr;
L
Linus Torvalds 已提交
1006

1007 1008 1009 1010 1011 1012 1013 1014 1015 1016
	return nlk->portid != x->portid ||
	       !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
}

static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
				     struct net *net, u32 portid)
{
	memset(arg, 0, sizeof(*arg));
	write_pnet(&arg->pnet, net);
	arg->portid = portid;
L
Linus Torvalds 已提交
1017 1018
}

1019 1020
static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
				     struct net *net)
L
Linus Torvalds 已提交
1021
{
1022
	struct netlink_compare_arg arg;
L
Linus Torvalds 已提交
1023

1024 1025 1026
	netlink_compare_arg_init(&arg, net, portid);
	return rhashtable_lookup_fast(&table->hash, &arg,
				      netlink_rhashtable_params);
L
Linus Torvalds 已提交
1027 1028
}

1029
static int __netlink_insert(struct netlink_table *table, struct sock *sk)
Y
Ying Xue 已提交
1030
{
1031
	struct netlink_compare_arg arg;
Y
Ying Xue 已提交
1032

1033 1034 1035 1036
	netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
	return rhashtable_lookup_insert_key(&table->hash, &arg,
					    &nlk_sk(sk)->node,
					    netlink_rhashtable_params);
Y
Ying Xue 已提交
1037 1038
}

1039
static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
L
Linus Torvalds 已提交
1040
{
1041 1042
	struct netlink_table *table = &nl_table[protocol];
	struct sock *sk;
L
Linus Torvalds 已提交
1043

1044 1045 1046 1047 1048
	rcu_read_lock();
	sk = __netlink_lookup(table, portid, net);
	if (sk)
		sock_hold(sk);
	rcu_read_unlock();
L
Linus Torvalds 已提交
1049

1050
	return sk;
L
Linus Torvalds 已提交
1051 1052
}

1053
static const struct proto_ops netlink_ops;
L
Linus Torvalds 已提交
1054

1055 1056 1057 1058 1059 1060
static void
netlink_update_listeners(struct sock *sk)
{
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];
	unsigned long mask;
	unsigned int i;
1061 1062 1063 1064 1065
	struct listeners *listeners;

	listeners = nl_deref_protected(tbl->listeners);
	if (!listeners)
		return;
1066

1067
	for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
1068
		mask = 0;
1069
		sk_for_each_bound(sk, &tbl->mc_list) {
1070 1071 1072
			if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
				mask |= nlk_sk(sk)->groups[i];
		}
1073
		listeners->masks[i] = mask;
1074 1075 1076 1077 1078
	}
	/* this function is only called with the netlink table "grabbed", which
	 * makes sure updates are visible before bind or setsockopt return. */
}

1079
static int netlink_insert(struct sock *sk, u32 portid)
L
Linus Torvalds 已提交
1080
{
1081
	struct netlink_table *table = &nl_table[sk->sk_protocol];
1082
	int err;
L
Linus Torvalds 已提交
1083

Y
Ying Xue 已提交
1084
	lock_sock(sk);
L
Linus Torvalds 已提交
1085 1086

	err = -EBUSY;
1087
	if (nlk_sk(sk)->portid)
L
Linus Torvalds 已提交
1088 1089 1090
		goto err;

	err = -ENOMEM;
1091 1092
	if (BITS_PER_LONG > 32 &&
	    unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
L
Linus Torvalds 已提交
1093 1094
		goto err;

1095
	nlk_sk(sk)->portid = portid;
1096
	sock_hold(sk);
1097

1098 1099
	err = __netlink_insert(table, sk);
	if (err) {
1100 1101 1102 1103 1104
		/* In case the hashtable backend returns with -EBUSY
		 * from here, it must not escape to the caller.
		 */
		if (unlikely(err == -EBUSY))
			err = -EOVERFLOW;
1105 1106
		if (err == -EEXIST)
			err = -EADDRINUSE;
1107
		nlk_sk(sk)->portid = 0;
Y
Ying Xue 已提交
1108
		sock_put(sk);
1109 1110
	}

L
Linus Torvalds 已提交
1111
err:
Y
Ying Xue 已提交
1112
	release_sock(sk);
L
Linus Torvalds 已提交
1113 1114 1115 1116 1117
	return err;
}

static void netlink_remove(struct sock *sk)
{
1118 1119 1120
	struct netlink_table *table;

	table = &nl_table[sk->sk_protocol];
1121 1122
	if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
				    netlink_rhashtable_params)) {
1123 1124 1125 1126
		WARN_ON(atomic_read(&sk->sk_refcnt) == 1);
		__sock_put(sk);
	}

L
Linus Torvalds 已提交
1127
	netlink_table_grab();
1128
	if (nlk_sk(sk)->subscriptions) {
L
Linus Torvalds 已提交
1129
		__sk_del_bind_node(sk);
1130 1131
		netlink_update_listeners(sk);
	}
1132 1133
	if (sk->sk_protocol == NETLINK_GENERIC)
		atomic_inc(&genl_sk_destructing_cnt);
L
Linus Torvalds 已提交
1134 1135 1136 1137 1138 1139 1140 1141 1142
	netlink_table_ungrab();
}

static struct proto netlink_proto = {
	.name	  = "NETLINK",
	.owner	  = THIS_MODULE,
	.obj_size = sizeof(struct netlink_sock),
};

1143
static int __netlink_create(struct net *net, struct socket *sock,
1144 1145
			    struct mutex *cb_mutex, int protocol,
			    int kern)
L
Linus Torvalds 已提交
1146 1147 1148
{
	struct sock *sk;
	struct netlink_sock *nlk;
1149 1150 1151

	sock->ops = &netlink_ops;

1152
	sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
1153 1154 1155 1156 1157 1158
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	nlk = nlk_sk(sk);
E
Eric Dumazet 已提交
1159
	if (cb_mutex) {
1160
		nlk->cb_mutex = cb_mutex;
E
Eric Dumazet 已提交
1161
	} else {
1162 1163 1164
		nlk->cb_mutex = &nlk->cb_def_mutex;
		mutex_init(nlk->cb_mutex);
	}
1165
	init_waitqueue_head(&nlk->wait);
1166 1167 1168
#ifdef CONFIG_NETLINK_MMAP
	mutex_init(&nlk->pg_vec_lock);
#endif
1169 1170 1171 1172 1173 1174

	sk->sk_destruct = netlink_sock_destruct;
	sk->sk_protocol = protocol;
	return 0;
}

1175 1176
static int netlink_create(struct net *net, struct socket *sock, int protocol,
			  int kern)
1177 1178
{
	struct module *module = NULL;
1179
	struct mutex *cb_mutex;
1180
	struct netlink_sock *nlk;
1181 1182
	int (*bind)(struct net *net, int group);
	void (*unbind)(struct net *net, int group);
1183
	int err = 0;
L
Linus Torvalds 已提交
1184 1185 1186 1187 1188 1189

	sock->state = SS_UNCONNECTED;

	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
		return -ESOCKTNOSUPPORT;

1190
	if (protocol < 0 || protocol >= MAX_LINKS)
L
Linus Torvalds 已提交
1191 1192
		return -EPROTONOSUPPORT;

1193
	netlink_lock_table();
1194
#ifdef CONFIG_MODULES
1195
	if (!nl_table[protocol].registered) {
1196
		netlink_unlock_table();
1197
		request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
1198
		netlink_lock_table();
1199
	}
1200 1201 1202 1203
#endif
	if (nl_table[protocol].registered &&
	    try_module_get(nl_table[protocol].module))
		module = nl_table[protocol].module;
1204 1205
	else
		err = -EPROTONOSUPPORT;
1206
	cb_mutex = nl_table[protocol].cb_mutex;
1207
	bind = nl_table[protocol].bind;
1208
	unbind = nl_table[protocol].unbind;
1209
	netlink_unlock_table();
1210

1211 1212 1213
	if (err < 0)
		goto out;

1214
	err = __netlink_create(net, sock, cb_mutex, protocol, kern);
1215
	if (err < 0)
1216 1217
		goto out_module;

1218
	local_bh_disable();
1219
	sock_prot_inuse_add(net, &netlink_proto, 1);
1220 1221
	local_bh_enable();

1222 1223
	nlk = nlk_sk(sock->sk);
	nlk->module = module;
1224
	nlk->netlink_bind = bind;
1225
	nlk->netlink_unbind = unbind;
1226 1227
out:
	return err;
L
Linus Torvalds 已提交
1228

1229 1230 1231
out_module:
	module_put(module);
	goto out;
L
Linus Torvalds 已提交
1232 1233
}

1234 1235 1236 1237 1238 1239 1240
static void deferred_put_nlk_sk(struct rcu_head *head)
{
	struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);

	sock_put(&nlk->sk);
}

L
Linus Torvalds 已提交
1241 1242 1243 1244 1245 1246 1247 1248 1249
static int netlink_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk;

	if (!sk)
		return 0;

	netlink_remove(sk);
1250
	sock_orphan(sk);
L
Linus Torvalds 已提交
1251 1252
	nlk = nlk_sk(sk);

1253 1254 1255 1256
	/*
	 * OK. Socket is unlinked, any packets that arrive now
	 * will be purged.
	 */
L
Linus Torvalds 已提交
1257

1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271
	/* must not acquire netlink_table_lock in any way again before unbind
	 * and notifying genetlink is done as otherwise it might deadlock
	 */
	if (nlk->netlink_unbind) {
		int i;

		for (i = 0; i < nlk->ngroups; i++)
			if (test_bit(i, nlk->groups))
				nlk->netlink_unbind(sock_net(sk), i + 1);
	}
	if (sk->sk_protocol == NETLINK_GENERIC &&
	    atomic_dec_return(&genl_sk_destructing_cnt) == 0)
		wake_up(&genl_sk_destructing_waitq);

L
Linus Torvalds 已提交
1272 1273 1274 1275 1276
	sock->sk = NULL;
	wake_up_interruptible_all(&nlk->wait);

	skb_queue_purge(&sk->sk_write_queue);

1277
	if (nlk->portid) {
L
Linus Torvalds 已提交
1278
		struct netlink_notify n = {
1279
						.net = sock_net(sk),
L
Linus Torvalds 已提交
1280
						.protocol = sk->sk_protocol,
1281
						.portid = nlk->portid,
L
Linus Torvalds 已提交
1282
					  };
1283 1284
		atomic_notifier_call_chain(&netlink_chain,
				NETLINK_URELEASE, &n);
1285
	}
1286

1287
	module_put(nlk->module);
1288

1289
	if (netlink_is_kernel(sk)) {
1290
		netlink_table_grab();
1291 1292
		BUG_ON(nl_table[sk->sk_protocol].registered == 0);
		if (--nl_table[sk->sk_protocol].registered == 0) {
1293 1294 1295 1296 1297
			struct listeners *old;

			old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
			RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
			kfree_rcu(old, rcu);
1298
			nl_table[sk->sk_protocol].module = NULL;
1299
			nl_table[sk->sk_protocol].bind = NULL;
1300
			nl_table[sk->sk_protocol].unbind = NULL;
1301
			nl_table[sk->sk_protocol].flags = 0;
1302 1303
			nl_table[sk->sk_protocol].registered = 0;
		}
1304
		netlink_table_ungrab();
E
Eric Dumazet 已提交
1305
	}
1306

1307 1308 1309
	kfree(nlk->groups);
	nlk->groups = NULL;

1310
	local_bh_disable();
1311
	sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
1312
	local_bh_enable();
1313
	call_rcu(&nlk->rcu, deferred_put_nlk_sk);
L
Linus Torvalds 已提交
1314 1315 1316 1317 1318 1319
	return 0;
}

static int netlink_autobind(struct socket *sock)
{
	struct sock *sk = sock->sk;
1320
	struct net *net = sock_net(sk);
1321
	struct netlink_table *table = &nl_table[sk->sk_protocol];
1322
	s32 portid = task_tgid_vnr(current);
L
Linus Torvalds 已提交
1323
	int err;
H
Herbert Xu 已提交
1324 1325
	s32 rover = -4096;
	bool ok;
L
Linus Torvalds 已提交
1326 1327 1328

retry:
	cond_resched();
1329
	rcu_read_lock();
H
Herbert Xu 已提交
1330 1331 1332
	ok = !__netlink_lookup(table, portid, net);
	rcu_read_unlock();
	if (!ok) {
1333
		/* Bind collision, search negative portid values. */
H
Herbert Xu 已提交
1334 1335 1336 1337
		if (rover == -4096)
			/* rover will be in range [S32_MIN, -4097] */
			rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
		else if (rover >= -4096)
1338
			rover = -4097;
H
Herbert Xu 已提交
1339
		portid = rover--;
1340
		goto retry;
L
Linus Torvalds 已提交
1341 1342
	}

1343
	err = netlink_insert(sk, portid);
L
Linus Torvalds 已提交
1344 1345
	if (err == -EADDRINUSE)
		goto retry;
1346 1347 1348 1349 1350 1351

	/* If 2 threads race to autobind, that is fine.  */
	if (err == -EBUSY)
		err = 0;

	return err;
L
Linus Torvalds 已提交
1352 1353
}

1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366
/**
 * __netlink_ns_capable - General netlink message capability test
 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in the user namespace @user_ns.
 */
bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
			struct user_namespace *user_ns, int cap)
{
1367 1368 1369
	return ((nsp->flags & NETLINK_SKB_DST) ||
		file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
		ns_capable(user_ns, cap);
1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420
}
EXPORT_SYMBOL(__netlink_ns_capable);

/**
 * netlink_ns_capable - General netlink message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in the user namespace @user_ns.
 */
bool netlink_ns_capable(const struct sk_buff *skb,
			struct user_namespace *user_ns, int cap)
{
	return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
}
EXPORT_SYMBOL(netlink_ns_capable);

/**
 * netlink_capable - Netlink global message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in all user namespaces.
 */
bool netlink_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, &init_user_ns, cap);
}
EXPORT_SYMBOL(netlink_capable);

/**
 * netlink_net_capable - Netlink network namespace message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap over the network namespace of
 * the socket we received the message from.
 */
bool netlink_net_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
}
EXPORT_SYMBOL(netlink_net_capable);

1421
static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
1422
{
1423
	return (nl_table[sock->sk->sk_protocol].flags & flag) ||
1424
		ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
1425
}
L
Linus Torvalds 已提交
1426

1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438
static void
netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (nlk->subscriptions && !subscriptions)
		__sk_del_bind_node(sk);
	else if (!nlk->subscriptions && subscriptions)
		sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
	nlk->subscriptions = subscriptions;
}

1439
static int netlink_realloc_groups(struct sock *sk)
1440 1441 1442
{
	struct netlink_sock *nlk = nlk_sk(sk);
	unsigned int groups;
1443
	unsigned long *new_groups;
1444 1445
	int err = 0;

1446 1447
	netlink_table_grab();

1448
	groups = nl_table[sk->sk_protocol].groups;
1449
	if (!nl_table[sk->sk_protocol].registered) {
1450
		err = -ENOENT;
1451 1452
		goto out_unlock;
	}
1453

1454 1455
	if (nlk->ngroups >= groups)
		goto out_unlock;
1456

1457 1458 1459 1460 1461
	new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
	if (new_groups == NULL) {
		err = -ENOMEM;
		goto out_unlock;
	}
1462
	memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
1463 1464 1465
	       NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));

	nlk->groups = new_groups;
1466
	nlk->ngroups = groups;
1467 1468 1469
 out_unlock:
	netlink_table_ungrab();
	return err;
1470 1471
}

1472
static void netlink_undo_bind(int group, long unsigned int groups,
1473
			      struct sock *sk)
1474
{
1475
	struct netlink_sock *nlk = nlk_sk(sk);
1476 1477 1478 1479 1480 1481
	int undo;

	if (!nlk->netlink_unbind)
		return;

	for (undo = 0; undo < group; undo++)
1482
		if (test_bit(undo, &groups))
1483
			nlk->netlink_unbind(sock_net(sk), undo + 1);
1484 1485
}

1486 1487
static int netlink_bind(struct socket *sock, struct sockaddr *addr,
			int addr_len)
L
Linus Torvalds 已提交
1488 1489
{
	struct sock *sk = sock->sk;
1490
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
1491 1492 1493
	struct netlink_sock *nlk = nlk_sk(sk);
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
	int err;
1494
	long unsigned int groups = nladdr->nl_groups;
1495

1496 1497 1498
	if (addr_len < sizeof(struct sockaddr_nl))
		return -EINVAL;

L
Linus Torvalds 已提交
1499 1500 1501 1502
	if (nladdr->nl_family != AF_NETLINK)
		return -EINVAL;

	/* Only superuser is allowed to listen multicasts */
1503
	if (groups) {
1504
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1505
			return -EPERM;
1506 1507 1508
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
1509
	}
L
Linus Torvalds 已提交
1510

1511
	if (nlk->portid)
1512
		if (nladdr->nl_pid != nlk->portid)
L
Linus Torvalds 已提交
1513
			return -EINVAL;
1514 1515 1516 1517 1518 1519 1520

	if (nlk->netlink_bind && groups) {
		int group;

		for (group = 0; group < nlk->ngroups; group++) {
			if (!test_bit(group, &groups))
				continue;
1521
			err = nlk->netlink_bind(net, group + 1);
1522 1523
			if (!err)
				continue;
1524
			netlink_undo_bind(group, groups, sk);
1525 1526 1527 1528 1529
			return err;
		}
	}

	if (!nlk->portid) {
L
Linus Torvalds 已提交
1530
		err = nladdr->nl_pid ?
1531
			netlink_insert(sk, nladdr->nl_pid) :
L
Linus Torvalds 已提交
1532
			netlink_autobind(sock);
1533
		if (err) {
1534
			netlink_undo_bind(nlk->ngroups, groups, sk);
L
Linus Torvalds 已提交
1535
			return err;
1536
		}
L
Linus Torvalds 已提交
1537 1538
	}

1539
	if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
L
Linus Torvalds 已提交
1540 1541 1542
		return 0;

	netlink_table_grab();
1543
	netlink_update_subscriptions(sk, nlk->subscriptions +
1544
					 hweight32(groups) -
1545
					 hweight32(nlk->groups[0]));
1546
	nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
1547
	netlink_update_listeners(sk);
L
Linus Torvalds 已提交
1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558
	netlink_table_ungrab();

	return 0;
}

static int netlink_connect(struct socket *sock, struct sockaddr *addr,
			   int alen, int flags)
{
	int err = 0;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1559
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
L
Linus Torvalds 已提交
1560

1561 1562 1563
	if (alen < sizeof(addr->sa_family))
		return -EINVAL;

L
Linus Torvalds 已提交
1564 1565
	if (addr->sa_family == AF_UNSPEC) {
		sk->sk_state	= NETLINK_UNCONNECTED;
1566
		nlk->dst_portid	= 0;
1567
		nlk->dst_group  = 0;
L
Linus Torvalds 已提交
1568 1569 1570 1571 1572
		return 0;
	}
	if (addr->sa_family != AF_NETLINK)
		return -EINVAL;

1573
	if ((nladdr->nl_groups || nladdr->nl_pid) &&
1574
	    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
L
Linus Torvalds 已提交
1575 1576
		return -EPERM;

1577
	if (!nlk->portid)
L
Linus Torvalds 已提交
1578 1579 1580 1581
		err = netlink_autobind(sock);

	if (err == 0) {
		sk->sk_state	= NETLINK_CONNECTED;
1582
		nlk->dst_portid = nladdr->nl_pid;
1583
		nlk->dst_group  = ffs(nladdr->nl_groups);
L
Linus Torvalds 已提交
1584 1585 1586 1587 1588
	}

	return err;
}

1589 1590
static int netlink_getname(struct socket *sock, struct sockaddr *addr,
			   int *addr_len, int peer)
L
Linus Torvalds 已提交
1591 1592 1593
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1594
	DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1595

L
Linus Torvalds 已提交
1596 1597 1598 1599 1600
	nladdr->nl_family = AF_NETLINK;
	nladdr->nl_pad = 0;
	*addr_len = sizeof(*nladdr);

	if (peer) {
1601
		nladdr->nl_pid = nlk->dst_portid;
1602
		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
L
Linus Torvalds 已提交
1603
	} else {
1604
		nladdr->nl_pid = nlk->portid;
1605
		nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
L
Linus Torvalds 已提交
1606 1607 1608 1609
	}
	return 0;
}

1610
static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
L
Linus Torvalds 已提交
1611 1612 1613 1614
{
	struct sock *sock;
	struct netlink_sock *nlk;

1615
	sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
L
Linus Torvalds 已提交
1616 1617 1618 1619 1620
	if (!sock)
		return ERR_PTR(-ECONNREFUSED);

	/* Don't bother queuing skb if kernel socket has no input function */
	nlk = nlk_sk(sock);
1621
	if (sock->sk_state == NETLINK_CONNECTED &&
1622
	    nlk->dst_portid != nlk_sk(ssk)->portid) {
L
Linus Torvalds 已提交
1623 1624 1625 1626 1627 1628 1629 1630
		sock_put(sock);
		return ERR_PTR(-ECONNREFUSED);
	}
	return sock;
}

struct sock *netlink_getsockbyfilp(struct file *filp)
{
A
Al Viro 已提交
1631
	struct inode *inode = file_inode(filp);
L
Linus Torvalds 已提交
1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644
	struct sock *sock;

	if (!S_ISSOCK(inode->i_mode))
		return ERR_PTR(-ENOTSOCK);

	sock = SOCKET_I(inode)->sk;
	if (sock->sk_family != AF_NETLINK)
		return ERR_PTR(-EINVAL);

	sock_hold(sock);
	return sock;
}

1645 1646
static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
					       int broadcast)
1647 1648 1649 1650
{
	struct sk_buff *skb;
	void *data;

1651
	if (size <= NLMSG_GOODSIZE || broadcast)
1652 1653
		return alloc_skb(size, GFP_KERNEL);

1654 1655
	size = SKB_DATA_ALIGN(size) +
	       SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1656 1657 1658

	data = vmalloc(size);
	if (data == NULL)
1659
		return NULL;
1660

E
Eric Dumazet 已提交
1661
	skb = __build_skb(data, size);
1662 1663
	if (skb == NULL)
		vfree(data);
E
Eric Dumazet 已提交
1664
	else
1665
		skb->destructor = netlink_skb_destructor;
1666 1667 1668 1669

	return skb;
}

L
Linus Torvalds 已提交
1670 1671 1672 1673 1674 1675 1676 1677 1678 1679
/*
 * Attach a skb to a netlink socket.
 * The caller must hold a reference to the destination socket. On error, the
 * reference is dropped. The skb is not send to the destination, just all
 * all error checks are performed and memory in the queue is reserved.
 * Return values:
 * < 0: error. skb freed, reference to sock dropped.
 * 0: continue
 * 1: repeat lookup - reference dropped while waiting for socket memory.
 */
1680
int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
P
Patrick McHardy 已提交
1681
		      long *timeo, struct sock *ssk)
L
Linus Torvalds 已提交
1682 1683 1684 1685 1686
{
	struct netlink_sock *nlk;

	nlk = nlk_sk(sk);

1687
	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1688
	     test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1689
	    !netlink_skb_is_mmaped(skb)) {
L
Linus Torvalds 已提交
1690
		DECLARE_WAITQUEUE(wait, current);
P
Patrick McHardy 已提交
1691
		if (!*timeo) {
1692
			if (!ssk || netlink_is_kernel(ssk))
L
Linus Torvalds 已提交
1693 1694 1695 1696 1697 1698 1699 1700 1701 1702
				netlink_overrun(sk);
			sock_put(sk);
			kfree_skb(skb);
			return -EAGAIN;
		}

		__set_current_state(TASK_INTERRUPTIBLE);
		add_wait_queue(&nlk->wait, &wait);

		if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1703
		     test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
L
Linus Torvalds 已提交
1704
		    !sock_flag(sk, SOCK_DEAD))
P
Patrick McHardy 已提交
1705
			*timeo = schedule_timeout(*timeo);
L
Linus Torvalds 已提交
1706 1707 1708 1709 1710 1711 1712

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nlk->wait, &wait);
		sock_put(sk);

		if (signal_pending(current)) {
			kfree_skb(skb);
P
Patrick McHardy 已提交
1713
			return sock_intr_errno(*timeo);
L
Linus Torvalds 已提交
1714 1715 1716
		}
		return 1;
	}
1717
	netlink_skb_set_owner_r(skb, sk);
L
Linus Torvalds 已提交
1718 1719 1720
	return 0;
}

1721
static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1722 1723 1724
{
	int len = skb->len;

1725 1726
	netlink_deliver_tap(skb);

1727 1728 1729 1730 1731 1732 1733 1734
#ifdef CONFIG_NETLINK_MMAP
	if (netlink_skb_is_mmaped(skb))
		netlink_queue_mmaped_skb(sk, skb);
	else if (netlink_rx_is_mmaped(sk))
		netlink_ring_set_copied(sk, skb);
	else
#endif /* CONFIG_NETLINK_MMAP */
		skb_queue_tail(&sk->sk_receive_queue, skb);
1735
	sk->sk_data_ready(sk);
1736 1737 1738 1739 1740 1741 1742
	return len;
}

int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
	int len = __netlink_sendskb(sk, skb);

L
Linus Torvalds 已提交
1743 1744 1745 1746 1747 1748 1749 1750 1751 1752
	sock_put(sk);
	return len;
}

void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
{
	kfree_skb(skb);
	sock_put(sk);
}

1753
static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
L
Linus Torvalds 已提交
1754 1755 1756
{
	int delta;

1757
	WARN_ON(skb->sk != NULL);
1758 1759
	if (netlink_skb_is_mmaped(skb))
		return skb;
L
Linus Torvalds 已提交
1760

1761
	delta = skb->end - skb->tail;
1762
	if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
L
Linus Torvalds 已提交
1763 1764 1765 1766 1767 1768
		return skb;

	if (skb_shared(skb)) {
		struct sk_buff *nskb = skb_clone(skb, allocation);
		if (!nskb)
			return skb;
1769
		consume_skb(skb);
L
Linus Torvalds 已提交
1770 1771 1772 1773 1774 1775 1776 1777 1778
		skb = nskb;
	}

	if (!pskb_expand_head(skb, 0, -delta, allocation))
		skb->truesize -= delta;

	return skb;
}

1779 1780
static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
				  struct sock *ssk)
1781 1782 1783 1784 1785 1786 1787
{
	int ret;
	struct netlink_sock *nlk = nlk_sk(sk);

	ret = -ECONNREFUSED;
	if (nlk->netlink_rcv != NULL) {
		ret = skb->len;
1788
		netlink_skb_set_owner_r(skb, sk);
1789
		NETLINK_CB(skb).sk = ssk;
1790
		netlink_deliver_tap_kernel(sk, ssk, skb);
1791
		nlk->netlink_rcv(skb);
1792 1793 1794
		consume_skb(skb);
	} else {
		kfree_skb(skb);
1795 1796 1797 1798 1799 1800
	}
	sock_put(sk);
	return ret;
}

int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1801
		    u32 portid, int nonblock)
L
Linus Torvalds 已提交
1802 1803 1804 1805 1806 1807 1808 1809 1810
{
	struct sock *sk;
	int err;
	long timeo;

	skb = netlink_trim(skb, gfp_any());

	timeo = sock_sndtimeo(ssk, nonblock);
retry:
1811
	sk = netlink_getsockbyportid(ssk, portid);
L
Linus Torvalds 已提交
1812 1813 1814 1815
	if (IS_ERR(sk)) {
		kfree_skb(skb);
		return PTR_ERR(sk);
	}
1816
	if (netlink_is_kernel(sk))
1817
		return netlink_unicast_kernel(sk, skb, ssk);
1818

1819
	if (sk_filter(sk, skb)) {
W
Wang Chen 已提交
1820
		err = skb->len;
1821 1822 1823 1824 1825
		kfree_skb(skb);
		sock_put(sk);
		return err;
	}

1826
	err = netlink_attachskb(sk, skb, &timeo, ssk);
L
Linus Torvalds 已提交
1827 1828 1829 1830 1831
	if (err == 1)
		goto retry;
	if (err)
		return err;

1832
	return netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
1833
}
1834
EXPORT_SYMBOL(netlink_unicast);
L
Linus Torvalds 已提交
1835

1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854
struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
				  u32 dst_portid, gfp_t gfp_mask)
{
#ifdef CONFIG_NETLINK_MMAP
	struct sock *sk = NULL;
	struct sk_buff *skb;
	struct netlink_ring *ring;
	struct nl_mmap_hdr *hdr;
	unsigned int maxlen;

	sk = netlink_getsockbyportid(ssk, dst_portid);
	if (IS_ERR(sk))
		goto out;

	ring = &nlk_sk(sk)->rx_ring;
	/* fast-path without atomic ops for common case: non-mmaped receiver */
	if (ring->pg_vec == NULL)
		goto out_put;

1855 1856 1857
	if (ring->frame_size - NL_MMAP_HDRLEN < size)
		goto out_put;

1858 1859 1860 1861 1862 1863 1864 1865 1866
	skb = alloc_skb_head(gfp_mask);
	if (skb == NULL)
		goto err1;

	spin_lock_bh(&sk->sk_receive_queue.lock);
	/* check again under lock */
	if (ring->pg_vec == NULL)
		goto out_free;

1867
	/* check again under lock */
1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886
	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
	if (maxlen < size)
		goto out_free;

	netlink_forward_ring(ring);
	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
	if (hdr == NULL)
		goto err2;
	netlink_ring_setup_skb(skb, sk, ring, hdr);
	netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
	atomic_inc(&ring->pending);
	netlink_increment_head(ring);

	spin_unlock_bh(&sk->sk_receive_queue.lock);
	return skb;

err2:
	kfree_skb(skb);
	spin_unlock_bh(&sk->sk_receive_queue.lock);
1887
	netlink_overrun(sk);
1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902
err1:
	sock_put(sk);
	return NULL;

out_free:
	kfree_skb(skb);
	spin_unlock_bh(&sk->sk_receive_queue.lock);
out_put:
	sock_put(sk);
out:
#endif
	return alloc_skb(size, gfp_mask);
}
EXPORT_SYMBOL_GPL(netlink_alloc_skb);

1903 1904 1905
int netlink_has_listeners(struct sock *sk, unsigned int group)
{
	int res = 0;
1906
	struct listeners *listeners;
1907

1908
	BUG_ON(!netlink_is_kernel(sk));
1909 1910 1911 1912

	rcu_read_lock();
	listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);

1913
	if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1914
		res = test_bit(group - 1, listeners->masks);
1915 1916 1917

	rcu_read_unlock();

1918 1919 1920 1921
	return res;
}
EXPORT_SYMBOL_GPL(netlink_has_listeners);

1922
static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1923 1924 1925 1926
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1927
	    !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1928
		netlink_skb_set_owner_r(skb, sk);
1929
		__netlink_sendskb(sk, skb);
1930
		return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
L
Linus Torvalds 已提交
1931 1932 1933 1934 1935 1936
	}
	return -1;
}

struct netlink_broadcast_data {
	struct sock *exclude_sk;
1937
	struct net *net;
1938
	u32 portid;
L
Linus Torvalds 已提交
1939 1940
	u32 group;
	int failure;
1941
	int delivery_failure;
L
Linus Torvalds 已提交
1942 1943
	int congested;
	int delivered;
A
Al Viro 已提交
1944
	gfp_t allocation;
L
Linus Torvalds 已提交
1945
	struct sk_buff *skb, *skb2;
1946 1947
	int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
	void *tx_data;
L
Linus Torvalds 已提交
1948 1949
};

1950 1951
static void do_one_broadcast(struct sock *sk,
				    struct netlink_broadcast_data *p)
L
Linus Torvalds 已提交
1952 1953 1954 1955 1956
{
	struct netlink_sock *nlk = nlk_sk(sk);
	int val;

	if (p->exclude_sk == sk)
1957
		return;
L
Linus Torvalds 已提交
1958

1959
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1960
	    !test_bit(p->group - 1, nlk->groups))
1961
		return;
L
Linus Torvalds 已提交
1962

1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973
	if (!net_eq(sock_net(sk), p->net)) {
		if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
			return;

		if (!peernet_has_id(sock_net(sk), p->net))
			return;

		if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
				     CAP_NET_BROADCAST))
			return;
	}
1974

L
Linus Torvalds 已提交
1975 1976
	if (p->failure) {
		netlink_overrun(sk);
1977
		return;
L
Linus Torvalds 已提交
1978 1979 1980 1981
	}

	sock_hold(sk);
	if (p->skb2 == NULL) {
1982
		if (skb_shared(p->skb)) {
L
Linus Torvalds 已提交
1983 1984
			p->skb2 = skb_clone(p->skb, p->allocation);
		} else {
1985 1986 1987 1988 1989 1990
			p->skb2 = skb_get(p->skb);
			/*
			 * skb ownership may have been set when
			 * delivered to a previous socket.
			 */
			skb_orphan(p->skb2);
L
Linus Torvalds 已提交
1991 1992 1993 1994 1995 1996
		}
	}
	if (p->skb2 == NULL) {
		netlink_overrun(sk);
		/* Clone failed. Notify ALL listeners. */
		p->failure = 1;
1997
		if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1998
			p->delivery_failure = 1;
1999 2000 2001
		goto out;
	}
	if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
2002 2003
		kfree_skb(p->skb2);
		p->skb2 = NULL;
2004 2005 2006
		goto out;
	}
	if (sk_filter(sk, p->skb2)) {
2007 2008
		kfree_skb(p->skb2);
		p->skb2 = NULL;
2009 2010 2011 2012 2013 2014
		goto out;
	}
	NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
	NETLINK_CB(p->skb2).nsid_is_set = true;
	val = netlink_broadcast_deliver(sk, p->skb2);
	if (val < 0) {
L
Linus Torvalds 已提交
2015
		netlink_overrun(sk);
2016
		if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
2017
			p->delivery_failure = 1;
L
Linus Torvalds 已提交
2018 2019 2020 2021 2022
	} else {
		p->congested |= val;
		p->delivered = 1;
		p->skb2 = NULL;
	}
2023
out:
L
Linus Torvalds 已提交
2024 2025 2026
	sock_put(sk);
}

2027
int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
2028 2029 2030
	u32 group, gfp_t allocation,
	int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
	void *filter_data)
L
Linus Torvalds 已提交
2031
{
2032
	struct net *net = sock_net(ssk);
L
Linus Torvalds 已提交
2033 2034 2035 2036 2037 2038
	struct netlink_broadcast_data info;
	struct sock *sk;

	skb = netlink_trim(skb, allocation);

	info.exclude_sk = ssk;
2039
	info.net = net;
2040
	info.portid = portid;
L
Linus Torvalds 已提交
2041 2042
	info.group = group;
	info.failure = 0;
2043
	info.delivery_failure = 0;
L
Linus Torvalds 已提交
2044 2045 2046 2047 2048
	info.congested = 0;
	info.delivered = 0;
	info.allocation = allocation;
	info.skb = skb;
	info.skb2 = NULL;
2049 2050
	info.tx_filter = filter;
	info.tx_data = filter_data;
L
Linus Torvalds 已提交
2051 2052 2053 2054 2055

	/* While we sleep in clone, do not allow to change socket list */

	netlink_lock_table();

2056
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
L
Linus Torvalds 已提交
2057 2058
		do_one_broadcast(sk, &info);

2059
	consume_skb(skb);
2060

L
Linus Torvalds 已提交
2061 2062
	netlink_unlock_table();

2063 2064
	if (info.delivery_failure) {
		kfree_skb(info.skb2);
2065
		return -ENOBUFS;
E
Eric Dumazet 已提交
2066 2067
	}
	consume_skb(info.skb2);
2068

L
Linus Torvalds 已提交
2069 2070 2071 2072 2073 2074 2075
	if (info.delivered) {
		if (info.congested && (allocation & __GFP_WAIT))
			yield();
		return 0;
	}
	return -ESRCH;
}
2076 2077
EXPORT_SYMBOL(netlink_broadcast_filtered);

2078
int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
2079 2080
		      u32 group, gfp_t allocation)
{
2081
	return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
2082 2083
		NULL, NULL);
}
2084
EXPORT_SYMBOL(netlink_broadcast);
L
Linus Torvalds 已提交
2085 2086 2087

struct netlink_set_err_data {
	struct sock *exclude_sk;
2088
	u32 portid;
L
Linus Torvalds 已提交
2089 2090 2091 2092
	u32 group;
	int code;
};

2093
static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
L
Linus Torvalds 已提交
2094 2095
{
	struct netlink_sock *nlk = nlk_sk(sk);
2096
	int ret = 0;
L
Linus Torvalds 已提交
2097 2098 2099 2100

	if (sk == p->exclude_sk)
		goto out;

O
Octavian Purdila 已提交
2101
	if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
2102 2103
		goto out;

2104
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
2105
	    !test_bit(p->group - 1, nlk->groups))
L
Linus Torvalds 已提交
2106 2107
		goto out;

2108
	if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
2109 2110 2111 2112
		ret = 1;
		goto out;
	}

L
Linus Torvalds 已提交
2113 2114 2115
	sk->sk_err = p->code;
	sk->sk_error_report(sk);
out:
2116
	return ret;
L
Linus Torvalds 已提交
2117 2118
}

2119 2120 2121
/**
 * netlink_set_err - report error to broadcast listeners
 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
2122
 * @portid: the PORTID of a process that we want to skip (if any)
2123
 * @group: the broadcast group that will notice the error
2124
 * @code: error code, must be negative (as usual in kernelspace)
2125 2126
 *
 * This function returns the number of broadcast listeners that have set the
2127
 * NETLINK_NO_ENOBUFS socket option.
2128
 */
2129
int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
L
Linus Torvalds 已提交
2130 2131 2132
{
	struct netlink_set_err_data info;
	struct sock *sk;
2133
	int ret = 0;
L
Linus Torvalds 已提交
2134 2135

	info.exclude_sk = ssk;
2136
	info.portid = portid;
L
Linus Torvalds 已提交
2137
	info.group = group;
2138 2139
	/* sk->sk_err wants a positive error value */
	info.code = -code;
L
Linus Torvalds 已提交
2140 2141 2142

	read_lock(&nl_table_lock);

2143
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
2144
		ret += do_one_set_err(sk, &info);
L
Linus Torvalds 已提交
2145 2146

	read_unlock(&nl_table_lock);
2147
	return ret;
L
Linus Torvalds 已提交
2148
}
2149
EXPORT_SYMBOL(netlink_set_err);
L
Linus Torvalds 已提交
2150

2151 2152 2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167
/* must be called with netlink table grabbed */
static void netlink_update_socket_mc(struct netlink_sock *nlk,
				     unsigned int group,
				     int is_new)
{
	int old, new = !!is_new, subscriptions;

	old = test_bit(group - 1, nlk->groups);
	subscriptions = nlk->subscriptions - old + new;
	if (new)
		__set_bit(group - 1, nlk->groups);
	else
		__clear_bit(group - 1, nlk->groups);
	netlink_update_subscriptions(&nlk->sk, subscriptions);
	netlink_update_listeners(&nlk->sk);
}

2168
static int netlink_setsockopt(struct socket *sock, int level, int optname,
2169
			      char __user *optval, unsigned int optlen)
2170 2171 2172
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
2173 2174
	unsigned int val = 0;
	int err;
2175 2176 2177 2178

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

2179 2180
	if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
	    optlen >= sizeof(int) &&
2181
	    get_user(val, (unsigned int __user *)optval))
2182 2183 2184 2185 2186
		return -EFAULT;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (val)
2187
			nlk->flags |= NETLINK_F_RECV_PKTINFO;
2188
		else
2189
			nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
2190 2191 2192 2193
		err = 0;
		break;
	case NETLINK_ADD_MEMBERSHIP:
	case NETLINK_DROP_MEMBERSHIP: {
2194
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
2195
			return -EPERM;
2196 2197 2198
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
2199 2200
		if (!val || val - 1 >= nlk->ngroups)
			return -EINVAL;
2201
		if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
2202
			err = nlk->netlink_bind(sock_net(sk), val);
2203 2204 2205
			if (err)
				return err;
		}
2206
		netlink_table_grab();
2207 2208
		netlink_update_socket_mc(nlk, val,
					 optname == NETLINK_ADD_MEMBERSHIP);
2209
		netlink_table_ungrab();
2210
		if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
2211
			nlk->netlink_unbind(sock_net(sk), val);
2212

2213 2214 2215
		err = 0;
		break;
	}
2216 2217
	case NETLINK_BROADCAST_ERROR:
		if (val)
2218
			nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
2219
		else
2220
			nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
2221 2222
		err = 0;
		break;
2223 2224
	case NETLINK_NO_ENOBUFS:
		if (val) {
2225 2226
			nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
			clear_bit(NETLINK_S_CONGESTED, &nlk->state);
2227
			wake_up_interruptible(&nlk->wait);
E
Eric Dumazet 已提交
2228
		} else {
2229
			nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
E
Eric Dumazet 已提交
2230
		}
2231 2232
		err = 0;
		break;
2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246
#ifdef CONFIG_NETLINK_MMAP
	case NETLINK_RX_RING:
	case NETLINK_TX_RING: {
		struct nl_mmap_req req;

		/* Rings might consume more memory than queue limits, require
		 * CAP_NET_ADMIN.
		 */
		if (!capable(CAP_NET_ADMIN))
			return -EPERM;
		if (optlen < sizeof(req))
			return -EINVAL;
		if (copy_from_user(&req, optval, sizeof(req)))
			return -EFAULT;
2247
		err = netlink_set_ring(sk, &req,
2248 2249 2250 2251
				       optname == NETLINK_TX_RING);
		break;
	}
#endif /* CONFIG_NETLINK_MMAP */
2252 2253 2254 2255 2256 2257 2258 2259 2260 2261
	case NETLINK_LISTEN_ALL_NSID:
		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
			return -EPERM;

		if (val)
			nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
		else
			nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
		err = 0;
		break;
2262 2263 2264 2265 2266 2267 2268
	case NETLINK_CAP_ACK:
		if (val)
			nlk->flags |= NETLINK_F_CAP_ACK;
		else
			nlk->flags &= ~NETLINK_F_CAP_ACK;
		err = 0;
		break;
2269 2270 2271 2272 2273 2274 2275
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static int netlink_getsockopt(struct socket *sock, int level, int optname,
2276
			      char __user *optval, int __user *optlen)
2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int len, val, err;

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

	if (get_user(len, optlen))
		return -EFAULT;
	if (len < 0)
		return -EINVAL;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
2295
		val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
H
Heiko Carstens 已提交
2296 2297 2298
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
2299 2300
		err = 0;
		break;
2301 2302 2303 2304
	case NETLINK_BROADCAST_ERROR:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
2305
		val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
2306 2307 2308 2309 2310
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
2311 2312 2313 2314
	case NETLINK_NO_ENOBUFS:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
2315
		val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
2316 2317 2318 2319 2320
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342
	case NETLINK_LIST_MEMBERSHIPS: {
		int pos, idx, shift;

		err = 0;
		netlink_table_grab();
		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
			if (len - pos < sizeof(u32))
				break;

			idx = pos / sizeof(unsigned long);
			shift = (pos % sizeof(unsigned long)) * 8;
			if (put_user((u32)(nlk->groups[idx] >> shift),
				     (u32 __user *)(optval + pos))) {
				err = -EFAULT;
				break;
			}
		}
		if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
			err = -EFAULT;
		netlink_table_ungrab();
		break;
	}
2343 2344 2345 2346 2347 2348 2349 2350 2351 2352
	case NETLINK_CAP_ACK:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
		val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
{
	struct nl_pktinfo info;

	info.group = NETLINK_CB(skb).dst_group;
	put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
}

2367 2368 2369 2370 2371 2372 2373 2374 2375 2376
static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
					 struct sk_buff *skb)
{
	if (!NETLINK_CB(skb).nsid_is_set)
		return;

	put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
		 &NETLINK_CB(skb).nsid);
}

2377
static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
L
Linus Torvalds 已提交
2378 2379 2380
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
2381
	DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
2382
	u32 dst_portid;
2383
	u32 dst_group;
L
Linus Torvalds 已提交
2384 2385 2386
	struct sk_buff *skb;
	int err;
	struct scm_cookie scm;
2387
	u32 netlink_skb_flags = 0;
L
Linus Torvalds 已提交
2388 2389 2390 2391

	if (msg->msg_flags&MSG_OOB)
		return -EOPNOTSUPP;

C
Christoph Hellwig 已提交
2392
	err = scm_send(sock, msg, &scm, true);
L
Linus Torvalds 已提交
2393 2394 2395 2396
	if (err < 0)
		return err;

	if (msg->msg_namelen) {
2397
		err = -EINVAL;
L
Linus Torvalds 已提交
2398
		if (addr->nl_family != AF_NETLINK)
2399
			goto out;
2400
		dst_portid = addr->nl_pid;
2401
		dst_group = ffs(addr->nl_groups);
2402
		err =  -EPERM;
2403
		if ((dst_group || dst_portid) &&
2404
		    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
2405
			goto out;
2406
		netlink_skb_flags |= NETLINK_SKB_DST;
L
Linus Torvalds 已提交
2407
	} else {
2408
		dst_portid = nlk->dst_portid;
2409
		dst_group = nlk->dst_group;
L
Linus Torvalds 已提交
2410 2411
	}

2412
	if (!nlk->portid) {
L
Linus Torvalds 已提交
2413 2414 2415 2416 2417
		err = netlink_autobind(sock);
		if (err)
			goto out;
	}

2418 2419 2420
	/* It's a really convoluted way for userland to ask for mmaped
	 * sendmsg(), but that's what we've got...
	 */
2421
	if (netlink_tx_is_mmaped(sk) &&
2422
	    iter_is_iovec(&msg->msg_iter) &&
2423
	    msg->msg_iter.nr_segs == 1 &&
A
Al Viro 已提交
2424
	    msg->msg_iter.iov->iov_base == NULL) {
2425
		err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
C
Christoph Hellwig 已提交
2426
					   &scm);
2427 2428 2429
		goto out;
	}

L
Linus Torvalds 已提交
2430 2431 2432 2433
	err = -EMSGSIZE;
	if (len > sk->sk_sndbuf - 32)
		goto out;
	err = -ENOBUFS;
2434
	skb = netlink_alloc_large_skb(len, dst_group);
2435
	if (skb == NULL)
L
Linus Torvalds 已提交
2436 2437
		goto out;

2438
	NETLINK_CB(skb).portid	= nlk->portid;
2439
	NETLINK_CB(skb).dst_group = dst_group;
C
Christoph Hellwig 已提交
2440
	NETLINK_CB(skb).creds	= scm.creds;
2441
	NETLINK_CB(skb).flags	= netlink_skb_flags;
L
Linus Torvalds 已提交
2442 2443

	err = -EFAULT;
A
Al Viro 已提交
2444
	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
L
Linus Torvalds 已提交
2445 2446 2447 2448 2449 2450 2451 2452 2453 2454
		kfree_skb(skb);
		goto out;
	}

	err = security_netlink_send(sk, skb);
	if (err) {
		kfree_skb(skb);
		goto out;
	}

2455
	if (dst_group) {
L
Linus Torvalds 已提交
2456
		atomic_inc(&skb->users);
2457
		netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
L
Linus Torvalds 已提交
2458
	}
2459
	err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
L
Linus Torvalds 已提交
2460 2461

out:
C
Christoph Hellwig 已提交
2462
	scm_destroy(&scm);
L
Linus Torvalds 已提交
2463 2464 2465
	return err;
}

2466
static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
L
Linus Torvalds 已提交
2467 2468 2469 2470 2471 2472 2473
			   int flags)
{
	struct scm_cookie scm;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int noblock = flags&MSG_DONTWAIT;
	size_t copied;
J
Johannes Berg 已提交
2474
	struct sk_buff *skb, *data_skb;
2475
	int err, ret;
L
Linus Torvalds 已提交
2476 2477 2478 2479 2480 2481

	if (flags&MSG_OOB)
		return -EOPNOTSUPP;

	copied = 0;

2482 2483
	skb = skb_recv_datagram(sk, flags, noblock, &err);
	if (skb == NULL)
L
Linus Torvalds 已提交
2484 2485
		goto out;

J
Johannes Berg 已提交
2486 2487
	data_skb = skb;

2488 2489 2490
#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
	if (unlikely(skb_shinfo(skb)->frag_list)) {
		/*
J
Johannes Berg 已提交
2491 2492 2493
		 * If this skb has a frag_list, then here that means that we
		 * will have to use the frag_list skb's data for compat tasks
		 * and the regular skb's data for normal (non-compat) tasks.
2494
		 *
J
Johannes Berg 已提交
2495 2496 2497 2498
		 * If we need to send the compat skb, assign it to the
		 * 'data_skb' variable so that it will be used below for data
		 * copying. We keep 'skb' for everything else, including
		 * freeing both later.
2499
		 */
J
Johannes Berg 已提交
2500 2501
		if (flags & MSG_CMSG_COMPAT)
			data_skb = skb_shinfo(skb)->frag_list;
2502 2503 2504
	}
#endif

E
Eric Dumazet 已提交
2505 2506 2507 2508 2509
	/* Record the max length of recvmsg() calls for future allocations */
	nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
	nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
				     16384);

J
Johannes Berg 已提交
2510
	copied = data_skb->len;
L
Linus Torvalds 已提交
2511 2512 2513 2514 2515
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

J
Johannes Berg 已提交
2516
	skb_reset_transport_header(data_skb);
2517
	err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
L
Linus Torvalds 已提交
2518 2519

	if (msg->msg_name) {
2520
		DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
L
Linus Torvalds 已提交
2521 2522
		addr->nl_family = AF_NETLINK;
		addr->nl_pad    = 0;
2523
		addr->nl_pid	= NETLINK_CB(skb).portid;
2524
		addr->nl_groups	= netlink_group_mask(NETLINK_CB(skb).dst_group);
L
Linus Torvalds 已提交
2525 2526 2527
		msg->msg_namelen = sizeof(*addr);
	}

2528
	if (nlk->flags & NETLINK_F_RECV_PKTINFO)
2529
		netlink_cmsg_recv_pktinfo(msg, skb);
2530 2531
	if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
		netlink_cmsg_listen_all_nsid(sk, msg, skb);
2532

C
Christoph Hellwig 已提交
2533 2534
	memset(&scm, 0, sizeof(scm));
	scm.creds = *NETLINK_CREDS(skb);
2535
	if (flags & MSG_TRUNC)
J
Johannes Berg 已提交
2536
		copied = data_skb->len;
2537

L
Linus Torvalds 已提交
2538 2539
	skb_free_datagram(sk, skb);

2540 2541
	if (nlk->cb_running &&
	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
2542 2543
		ret = netlink_dump(sk);
		if (ret) {
2544
			sk->sk_err = -ret;
2545 2546 2547
			sk->sk_error_report(sk);
		}
	}
L
Linus Torvalds 已提交
2548

C
Christoph Hellwig 已提交
2549
	scm_recv(sock, msg, &scm, flags);
L
Linus Torvalds 已提交
2550 2551 2552 2553 2554
out:
	netlink_rcv_wake(sk);
	return err ? : copied;
}

2555
static void netlink_data_ready(struct sock *sk)
L
Linus Torvalds 已提交
2556
{
2557
	BUG();
L
Linus Torvalds 已提交
2558 2559 2560
}

/*
2561
 *	We export these functions to other modules. They provide a
L
Linus Torvalds 已提交
2562 2563 2564 2565 2566
 *	complete set of kernel non-blocking support for message
 *	queueing.
 */

struct sock *
2567 2568
__netlink_kernel_create(struct net *net, int unit, struct module *module,
			struct netlink_kernel_cfg *cfg)
L
Linus Torvalds 已提交
2569 2570 2571
{
	struct socket *sock;
	struct sock *sk;
2572
	struct netlink_sock *nlk;
2573
	struct listeners *listeners = NULL;
2574 2575
	struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
	unsigned int groups;
L
Linus Torvalds 已提交
2576

2577
	BUG_ON(!nl_table);
L
Linus Torvalds 已提交
2578

2579
	if (unit < 0 || unit >= MAX_LINKS)
L
Linus Torvalds 已提交
2580 2581 2582 2583
		return NULL;

	if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
		return NULL;
2584 2585

	if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
2586 2587 2588
		goto out_sock_release_nosk;

	sk = sock->sk;
2589

2590
	if (!cfg || cfg->groups < 32)
2591
		groups = 32;
2592 2593
	else
		groups = cfg->groups;
2594

2595
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2596 2597 2598
	if (!listeners)
		goto out_sock_release;

L
Linus Torvalds 已提交
2599
	sk->sk_data_ready = netlink_data_ready;
2600 2601
	if (cfg && cfg->input)
		nlk_sk(sk)->netlink_rcv = cfg->input;
L
Linus Torvalds 已提交
2602

2603
	if (netlink_insert(sk, 0))
2604
		goto out_sock_release;
2605

2606
	nlk = nlk_sk(sk);
2607
	nlk->flags |= NETLINK_F_KERNEL_SOCKET;
2608 2609

	netlink_table_grab();
2610 2611
	if (!nl_table[unit].registered) {
		nl_table[unit].groups = groups;
2612
		rcu_assign_pointer(nl_table[unit].listeners, listeners);
2613 2614
		nl_table[unit].cb_mutex = cb_mutex;
		nl_table[unit].module = module;
2615 2616
		if (cfg) {
			nl_table[unit].bind = cfg->bind;
2617
			nl_table[unit].unbind = cfg->unbind;
2618
			nl_table[unit].flags = cfg->flags;
2619 2620
			if (cfg->compare)
				nl_table[unit].compare = cfg->compare;
2621
		}
2622
		nl_table[unit].registered = 1;
2623 2624
	} else {
		kfree(listeners);
2625
		nl_table[unit].registered++;
2626
	}
2627
	netlink_table_ungrab();
2628 2629
	return sk;

2630
out_sock_release:
2631
	kfree(listeners);
2632
	netlink_kernel_release(sk);
2633 2634 2635
	return NULL;

out_sock_release_nosk:
2636
	sock_release(sock);
2637
	return NULL;
L
Linus Torvalds 已提交
2638
}
2639
EXPORT_SYMBOL(__netlink_kernel_create);
2640 2641 2642 2643

void
netlink_kernel_release(struct sock *sk)
{
2644 2645 2646 2647
	if (sk == NULL || sk->sk_socket == NULL)
		return;

	sock_release(sk->sk_socket);
2648 2649 2650
}
EXPORT_SYMBOL(netlink_kernel_release);

2651
int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
2652
{
2653
	struct listeners *new, *old;
2654 2655 2656 2657 2658 2659
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];

	if (groups < 32)
		groups = 32;

	if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2660 2661
		new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
		if (!new)
2662
			return -ENOMEM;
2663
		old = nl_deref_protected(tbl->listeners);
2664 2665 2666
		memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
		rcu_assign_pointer(tbl->listeners, new);

2667
		kfree_rcu(old, rcu);
2668 2669 2670
	}
	tbl->groups = groups;

2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691
	return 0;
}

/**
 * netlink_change_ngroups - change number of multicast groups
 *
 * This changes the number of multicast groups that are available
 * on a certain netlink family. Note that it is not possible to
 * change the number of groups to below 32. Also note that it does
 * not implicitly call netlink_clear_multicast_users() when the
 * number of groups is reduced.
 *
 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
 * @groups: The new number of groups.
 */
int netlink_change_ngroups(struct sock *sk, unsigned int groups)
{
	int err;

	netlink_table_grab();
	err = __netlink_change_ngroups(sk, groups);
2692
	netlink_table_ungrab();
2693

2694 2695 2696
	return err;
}

2697 2698 2699 2700 2701
void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
{
	struct sock *sk;
	struct netlink_table *tbl = &nl_table[ksk->sk_protocol];

2702
	sk_for_each_bound(sk, &tbl->mc_list)
2703 2704 2705
		netlink_update_socket_mc(nlk_sk(sk), group, 0);
}

2706
struct nlmsghdr *
2707
__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2708 2709
{
	struct nlmsghdr *nlh;
2710
	int size = nlmsg_msg_size(len);
2711

2712
	nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2713 2714 2715
	nlh->nlmsg_type = type;
	nlh->nlmsg_len = size;
	nlh->nlmsg_flags = flags;
2716
	nlh->nlmsg_pid = portid;
2717 2718
	nlh->nlmsg_seq = seq;
	if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2719
		memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2720 2721 2722 2723
	return nlh;
}
EXPORT_SYMBOL(__nlmsg_put);

L
Linus Torvalds 已提交
2724 2725 2726 2727 2728 2729 2730 2731 2732
/*
 * It looks a bit ugly.
 * It would be better to create kernel thread.
 */

static int netlink_dump(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_callback *cb;
2733
	struct sk_buff *skb = NULL;
L
Linus Torvalds 已提交
2734
	struct nlmsghdr *nlh;
2735
	int len, err = -ENOBUFS;
2736
	int alloc_size;
L
Linus Torvalds 已提交
2737

2738
	mutex_lock(nlk->cb_mutex);
2739
	if (!nlk->cb_running) {
2740 2741
		err = -EINVAL;
		goto errout_skb;
L
Linus Torvalds 已提交
2742 2743
	}

2744
	cb = &nlk->cb;
2745 2746
	alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);

2747 2748 2749
	if (!netlink_rx_is_mmaped(sk) &&
	    atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
		goto errout_skb;
E
Eric Dumazet 已提交
2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770

	/* NLMSG_GOODSIZE is small to avoid high order allocations being
	 * required, but it makes sense to _attempt_ a 16K bytes allocation
	 * to reduce number of system calls on dump operations, if user
	 * ever provided a big enough buffer.
	 */
	if (alloc_size < nlk->max_recvmsg_len) {
		skb = netlink_alloc_skb(sk,
					nlk->max_recvmsg_len,
					nlk->portid,
					GFP_KERNEL |
					__GFP_NOWARN |
					__GFP_NORETRY);
		/* available room should be exact amount to avoid MSG_TRUNC */
		if (skb)
			skb_reserve(skb, skb_tailroom(skb) -
					 nlk->max_recvmsg_len);
	}
	if (!skb)
		skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
					GFP_KERNEL);
2771
	if (!skb)
2772
		goto errout_skb;
2773
	netlink_skb_set_owner_r(skb, sk);
2774

L
Linus Torvalds 已提交
2775 2776 2777
	len = cb->dump(skb, cb);

	if (len > 0) {
2778
		mutex_unlock(nlk->cb_mutex);
2779 2780 2781

		if (sk_filter(sk, skb))
			kfree_skb(skb);
2782 2783
		else
			__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2784 2785 2786
		return 0;
	}

2787 2788 2789 2790
	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
	if (!nlh)
		goto errout_skb;

2791 2792
	nl_dump_check_consistent(cb, nlh);

2793 2794
	memcpy(nlmsg_data(nlh), &len, sizeof(len));

2795 2796
	if (sk_filter(sk, skb))
		kfree_skb(skb);
2797 2798
	else
		__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2799

2800 2801
	if (cb->done)
		cb->done(cb);
L
Linus Torvalds 已提交
2802

2803 2804
	nlk->cb_running = false;
	mutex_unlock(nlk->cb_mutex);
2805
	module_put(cb->module);
2806
	consume_skb(cb->skb);
L
Linus Torvalds 已提交
2807
	return 0;
2808

2809
errout_skb:
2810
	mutex_unlock(nlk->cb_mutex);
2811 2812
	kfree_skb(skb);
	return err;
L
Linus Torvalds 已提交
2813 2814
}

2815 2816 2817
int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
			 const struct nlmsghdr *nlh,
			 struct netlink_dump_control *control)
L
Linus Torvalds 已提交
2818 2819 2820 2821
{
	struct netlink_callback *cb;
	struct sock *sk;
	struct netlink_sock *nlk;
2822
	int ret;
L
Linus Torvalds 已提交
2823

2824 2825 2826 2827 2828 2829
	/* Memory mapped dump requests need to be copied to avoid looping
	 * on the pending state in netlink_mmap_sendmsg() while the CB hold
	 * a reference to the skb.
	 */
	if (netlink_skb_is_mmaped(skb)) {
		skb = skb_copy(skb, GFP_KERNEL);
2830
		if (skb == NULL)
2831 2832 2833 2834
			return -ENOBUFS;
	} else
		atomic_inc(&skb->users);

2835
	sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
2836
	if (sk == NULL) {
2837 2838
		ret = -ECONNREFUSED;
		goto error_free;
L
Linus Torvalds 已提交
2839
	}
2840

2841
	nlk = nlk_sk(sk);
2842
	mutex_lock(nlk->cb_mutex);
2843
	/* A dump is in progress... */
2844
	if (nlk->cb_running) {
2845
		ret = -EBUSY;
2846
		goto error_unlock;
L
Linus Torvalds 已提交
2847
	}
2848
	/* add reference of module which cb->dump belongs to */
2849
	if (!try_module_get(control->module)) {
2850
		ret = -EPROTONOSUPPORT;
2851
		goto error_unlock;
2852 2853
	}

2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865
	cb = &nlk->cb;
	memset(cb, 0, sizeof(*cb));
	cb->dump = control->dump;
	cb->done = control->done;
	cb->nlh = nlh;
	cb->data = control->data;
	cb->module = control->module;
	cb->min_dump_alloc = control->min_dump_alloc;
	cb->skb = skb;

	nlk->cb_running = true;

2866
	mutex_unlock(nlk->cb_mutex);
L
Linus Torvalds 已提交
2867

2868
	ret = netlink_dump(sk);
L
Linus Torvalds 已提交
2869
	sock_put(sk);
2870

2871 2872 2873
	if (ret)
		return ret;

2874 2875 2876 2877
	/* We successfully started a dump, by returning -EINTR we
	 * signal not to send ACK even if it was requested.
	 */
	return -EINTR;
2878 2879 2880 2881 2882 2883 2884

error_unlock:
	sock_put(sk);
	mutex_unlock(nlk->cb_mutex);
error_free:
	kfree_skb(skb);
	return ret;
L
Linus Torvalds 已提交
2885
}
2886
EXPORT_SYMBOL(__netlink_dump_start);
L
Linus Torvalds 已提交
2887 2888 2889 2890 2891 2892

void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
{
	struct sk_buff *skb;
	struct nlmsghdr *rep;
	struct nlmsgerr *errmsg;
2893
	size_t payload = sizeof(*errmsg);
2894
	struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
L
Linus Torvalds 已提交
2895

2896 2897 2898 2899
	/* Error messages get the original request appened, unless the user
	 * requests to cap the error message.
	 */
	if (!(nlk->flags & NETLINK_F_CAP_ACK) && err)
2900
		payload += nlmsg_len(nlh);
L
Linus Torvalds 已提交
2901

2902 2903
	skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload),
				NETLINK_CB(in_skb).portid, GFP_KERNEL);
L
Linus Torvalds 已提交
2904 2905 2906
	if (!skb) {
		struct sock *sk;

2907
		sk = netlink_lookup(sock_net(in_skb->sk),
2908
				    in_skb->sk->sk_protocol,
2909
				    NETLINK_CB(in_skb).portid);
L
Linus Torvalds 已提交
2910 2911 2912 2913 2914 2915 2916 2917
		if (sk) {
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
			sock_put(sk);
		}
		return;
	}

2918
	rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2919
			  NLMSG_ERROR, payload, 0);
2920
	errmsg = nlmsg_data(rep);
L
Linus Torvalds 已提交
2921
	errmsg->error = err;
2922
	memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
2923
	netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
L
Linus Torvalds 已提交
2924
}
2925
EXPORT_SYMBOL(netlink_ack);
L
Linus Torvalds 已提交
2926

2927
int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2928
						     struct nlmsghdr *))
2929 2930 2931 2932 2933
{
	struct nlmsghdr *nlh;
	int err;

	while (skb->len >= nlmsg_total_size(0)) {
2934 2935
		int msglen;

2936
		nlh = nlmsg_hdr(skb);
2937
		err = 0;
2938

2939
		if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2940 2941
			return 0;

2942 2943
		/* Only requests are handled by the kernel */
		if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2944
			goto ack;
2945 2946 2947

		/* Skip control messages */
		if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2948
			goto ack;
2949

2950
		err = cb(skb, nlh);
2951 2952 2953 2954
		if (err == -EINTR)
			goto skip;

ack:
2955
		if (nlh->nlmsg_flags & NLM_F_ACK || err)
2956 2957
			netlink_ack(skb, nlh, err);

2958
skip:
2959
		msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2960 2961 2962
		if (msglen > skb->len)
			msglen = skb->len;
		skb_pull(skb, msglen);
2963 2964 2965 2966
	}

	return 0;
}
2967
EXPORT_SYMBOL(netlink_rcv_skb);
2968

2969 2970 2971 2972
/**
 * nlmsg_notify - send a notification netlink message
 * @sk: netlink socket to use
 * @skb: notification message
2973
 * @portid: destination netlink portid for reports or 0
2974 2975 2976 2977
 * @group: destination multicast group or 0
 * @report: 1 to report back, 0 to disable
 * @flags: allocation flags
 */
2978
int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
2979 2980 2981 2982 2983
		 unsigned int group, int report, gfp_t flags)
{
	int err = 0;

	if (group) {
2984
		int exclude_portid = 0;
2985 2986 2987

		if (report) {
			atomic_inc(&skb->users);
2988
			exclude_portid = portid;
2989 2990
		}

2991 2992
		/* errors reported via destination sk->sk_err, but propagate
		 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
2993
		err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
2994 2995
	}

2996 2997 2998
	if (report) {
		int err2;

2999
		err2 = nlmsg_unicast(sk, skb, portid);
3000 3001 3002
		if (!err || err == -ESRCH)
			err = err2;
	}
3003 3004 3005

	return err;
}
3006
EXPORT_SYMBOL(nlmsg_notify);
3007

L
Linus Torvalds 已提交
3008 3009
#ifdef CONFIG_PROC_FS
struct nl_seq_iter {
3010
	struct seq_net_private p;
3011
	struct rhashtable_iter hti;
L
Linus Torvalds 已提交
3012 3013 3014
	int link;
};

3015
static int netlink_walk_start(struct nl_seq_iter *iter)
L
Linus Torvalds 已提交
3016
{
3017
	int err;
L
Linus Torvalds 已提交
3018

3019 3020 3021 3022
	err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti);
	if (err) {
		iter->link = MAX_LINKS;
		return err;
L
Linus Torvalds 已提交
3023
	}
3024 3025 3026

	err = rhashtable_walk_start(&iter->hti);
	return err == -EAGAIN ? 0 : err;
L
Linus Torvalds 已提交
3027 3028
}

3029
static void netlink_walk_stop(struct nl_seq_iter *iter)
L
Linus Torvalds 已提交
3030
{
3031 3032
	rhashtable_walk_stop(&iter->hti);
	rhashtable_walk_exit(&iter->hti);
L
Linus Torvalds 已提交
3033 3034
}

3035
static void *__netlink_seq_next(struct seq_file *seq)
L
Linus Torvalds 已提交
3036
{
3037
	struct nl_seq_iter *iter = seq->private;
3038
	struct netlink_sock *nlk;
L
Linus Torvalds 已提交
3039

3040 3041 3042
	do {
		for (;;) {
			int err;
L
Linus Torvalds 已提交
3043

3044
			nlk = rhashtable_walk_next(&iter->hti);
3045

3046 3047 3048
			if (IS_ERR(nlk)) {
				if (PTR_ERR(nlk) == -EAGAIN)
					continue;
3049

3050 3051
				return nlk;
			}
L
Linus Torvalds 已提交
3052

3053 3054
			if (nlk)
				break;
L
Linus Torvalds 已提交
3055

3056 3057 3058
			netlink_walk_stop(iter);
			if (++iter->link >= MAX_LINKS)
				return NULL;
3059

3060 3061 3062
			err = netlink_walk_start(iter);
			if (err)
				return ERR_PTR(err);
L
Linus Torvalds 已提交
3063
		}
3064
	} while (sock_net(&nlk->sk) != seq_file_net(seq));
L
Linus Torvalds 已提交
3065

3066 3067
	return nlk;
}
L
Linus Torvalds 已提交
3068

3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091
static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
{
	struct nl_seq_iter *iter = seq->private;
	void *obj = SEQ_START_TOKEN;
	loff_t pos;
	int err;

	iter->link = 0;

	err = netlink_walk_start(iter);
	if (err)
		return ERR_PTR(err);

	for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
		obj = __netlink_seq_next(seq);

	return obj;
}

static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	++*pos;
	return __netlink_seq_next(seq);
L
Linus Torvalds 已提交
3092 3093 3094 3095
}

static void netlink_seq_stop(struct seq_file *seq, void *v)
{
3096 3097 3098 3099 3100 3101
	struct nl_seq_iter *iter = seq->private;

	if (iter->link >= MAX_LINKS)
		return;

	netlink_walk_stop(iter);
L
Linus Torvalds 已提交
3102 3103 3104 3105 3106
}


static int netlink_seq_show(struct seq_file *seq, void *v)
{
E
Eric Dumazet 已提交
3107
	if (v == SEQ_START_TOKEN) {
L
Linus Torvalds 已提交
3108 3109
		seq_puts(seq,
			 "sk       Eth Pid    Groups   "
3110
			 "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
E
Eric Dumazet 已提交
3111
	} else {
L
Linus Torvalds 已提交
3112 3113 3114
		struct sock *s = v;
		struct netlink_sock *nlk = nlk_sk(s);

3115
		seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
L
Linus Torvalds 已提交
3116 3117
			   s,
			   s->sk_protocol,
3118
			   nlk->portid,
3119
			   nlk->groups ? (u32)nlk->groups[0] : 0,
3120 3121
			   sk_rmem_alloc_get(s),
			   sk_wmem_alloc_get(s),
3122
			   nlk->cb_running,
3123
			   atomic_read(&s->sk_refcnt),
3124 3125
			   atomic_read(&s->sk_drops),
			   sock_i_ino(s)
L
Linus Torvalds 已提交
3126 3127 3128 3129 3130 3131
			);

	}
	return 0;
}

3132
static const struct seq_operations netlink_seq_ops = {
L
Linus Torvalds 已提交
3133 3134 3135 3136 3137 3138 3139 3140 3141
	.start  = netlink_seq_start,
	.next   = netlink_seq_next,
	.stop   = netlink_seq_stop,
	.show   = netlink_seq_show,
};


static int netlink_seq_open(struct inode *inode, struct file *file)
{
3142 3143
	return seq_open_net(inode, file, &netlink_seq_ops,
				sizeof(struct nl_seq_iter));
3144 3145
}

3146
static const struct file_operations netlink_seq_fops = {
L
Linus Torvalds 已提交
3147 3148 3149 3150
	.owner		= THIS_MODULE,
	.open		= netlink_seq_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
3151
	.release	= seq_release_net,
L
Linus Torvalds 已提交
3152 3153 3154 3155 3156 3157
};

#endif

int netlink_register_notifier(struct notifier_block *nb)
{
3158
	return atomic_notifier_chain_register(&netlink_chain, nb);
L
Linus Torvalds 已提交
3159
}
3160
EXPORT_SYMBOL(netlink_register_notifier);
L
Linus Torvalds 已提交
3161 3162 3163

int netlink_unregister_notifier(struct notifier_block *nb)
{
3164
	return atomic_notifier_chain_unregister(&netlink_chain, nb);
L
Linus Torvalds 已提交
3165
}
3166
EXPORT_SYMBOL(netlink_unregister_notifier);
3167

3168
static const struct proto_ops netlink_ops = {
L
Linus Torvalds 已提交
3169 3170 3171 3172 3173 3174 3175 3176
	.family =	PF_NETLINK,
	.owner =	THIS_MODULE,
	.release =	netlink_release,
	.bind =		netlink_bind,
	.connect =	netlink_connect,
	.socketpair =	sock_no_socketpair,
	.accept =	sock_no_accept,
	.getname =	netlink_getname,
3177
	.poll =		netlink_poll,
L
Linus Torvalds 已提交
3178 3179 3180
	.ioctl =	sock_no_ioctl,
	.listen =	sock_no_listen,
	.shutdown =	sock_no_shutdown,
3181 3182
	.setsockopt =	netlink_setsockopt,
	.getsockopt =	netlink_getsockopt,
L
Linus Torvalds 已提交
3183 3184
	.sendmsg =	netlink_sendmsg,
	.recvmsg =	netlink_recvmsg,
3185
	.mmap =		netlink_mmap,
L
Linus Torvalds 已提交
3186 3187 3188
	.sendpage =	sock_no_sendpage,
};

3189
static const struct net_proto_family netlink_family_ops = {
L
Linus Torvalds 已提交
3190 3191 3192 3193 3194
	.family = PF_NETLINK,
	.create = netlink_create,
	.owner	= THIS_MODULE,	/* for consistency 8) */
};

3195
static int __net_init netlink_net_init(struct net *net)
3196 3197
{
#ifdef CONFIG_PROC_FS
3198
	if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
3199 3200 3201 3202 3203
		return -ENOMEM;
#endif
	return 0;
}

3204
static void __net_exit netlink_net_exit(struct net *net)
3205 3206
{
#ifdef CONFIG_PROC_FS
3207
	remove_proc_entry("netlink", net->proc_net);
3208 3209 3210
#endif
}

3211 3212
static void __init netlink_add_usersock_entry(void)
{
3213
	struct listeners *listeners;
3214 3215
	int groups = 32;

3216
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
3217
	if (!listeners)
3218
		panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
3219 3220 3221 3222

	netlink_table_grab();

	nl_table[NETLINK_USERSOCK].groups = groups;
3223
	rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
3224 3225
	nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
	nl_table[NETLINK_USERSOCK].registered = 1;
3226
	nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
3227 3228 3229 3230

	netlink_table_ungrab();
}

3231
static struct pernet_operations __net_initdata netlink_net_ops = {
3232 3233 3234 3235
	.init = netlink_net_init,
	.exit = netlink_net_exit,
};

3236
static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
3237 3238 3239 3240 3241
{
	const struct netlink_sock *nlk = data;
	struct netlink_compare_arg arg;

	netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
3242
	return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
3243 3244 3245 3246 3247 3248 3249
}

static const struct rhashtable_params netlink_rhashtable_params = {
	.head_offset = offsetof(struct netlink_sock, node),
	.key_len = netlink_compare_arg_len,
	.obj_hashfn = netlink_hash,
	.obj_cmpfn = netlink_compare,
3250
	.automatic_shrinking = true,
3251 3252
};

L
Linus Torvalds 已提交
3253 3254 3255 3256 3257 3258 3259 3260
static int __init netlink_proto_init(void)
{
	int i;
	int err = proto_register(&netlink_proto, 0);

	if (err != 0)
		goto out;

3261
	BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
L
Linus Torvalds 已提交
3262

3263
	nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
3264 3265
	if (!nl_table)
		goto panic;
L
Linus Torvalds 已提交
3266 3267

	for (i = 0; i < MAX_LINKS; i++) {
3268 3269
		if (rhashtable_init(&nl_table[i].hash,
				    &netlink_rhashtable_params) < 0) {
3270 3271
			while (--i > 0)
				rhashtable_destroy(&nl_table[i].hash);
L
Linus Torvalds 已提交
3272
			kfree(nl_table);
3273
			goto panic;
L
Linus Torvalds 已提交
3274 3275 3276
		}
	}

3277 3278
	INIT_LIST_HEAD(&netlink_tap_all);

3279 3280
	netlink_add_usersock_entry();

L
Linus Torvalds 已提交
3281
	sock_register(&netlink_family_ops);
3282
	register_pernet_subsys(&netlink_net_ops);
3283
	/* The netlink device handler may be needed early. */
L
Linus Torvalds 已提交
3284 3285 3286
	rtnetlink_init();
out:
	return err;
3287 3288
panic:
	panic("netlink_init: Cannot allocate nl_table\n");
L
Linus Torvalds 已提交
3289 3290 3291
}

core_initcall(netlink_proto_init);