af_netlink.c 60.9 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 * NETLINK      Kernel-user communication protocol.
 *
4
 * 		Authors:	Alan Cox <alan@lxorguk.ukuu.org.uk>
L
Linus Torvalds 已提交
5
 * 				Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6
 * 				Patrick McHardy <kaber@trash.net>
L
Linus Torvalds 已提交
7 8 9 10 11
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
12
 *
L
Linus Torvalds 已提交
13 14 15 16
 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
 *                               added netlink_proto_exit
 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
 * 				 use nlk_sk, as sk->protinfo is on a diet 8)
17 18 19 20 21 22
 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
 * 				 - inc module use count of module that owns
 * 				   the kernel socket in case userspace opens
 * 				   socket of same protocol
 * 				 - remove all module support, since netlink is
 * 				   mandatory if CONFIG_NET=y these days
L
Linus Torvalds 已提交
23 24 25 26
 */

#include <linux/module.h>

27
#include <linux/capability.h>
L
Linus Torvalds 已提交
28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/signal.h>
#include <linux/sched.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/un.h>
#include <linux/fcntl.h>
#include <linux/termios.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/notifier.h>
#include <linux/security.h>
#include <linux/jhash.h>
#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/bitops.h>
#include <linux/mm.h>
#include <linux/types.h>
A
Andrew Morton 已提交
57
#include <linux/audit.h>
58
#include <linux/mutex.h>
59
#include <linux/vmalloc.h>
60
#include <linux/if_arp.h>
61
#include <linux/rhashtable.h>
62
#include <asm/cacheflush.h>
63
#include <linux/hash.h>
64
#include <linux/genetlink.h>
A
Andrew Morton 已提交
65

66
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
67 68
#include <net/sock.h>
#include <net/scm.h>
69
#include <net/netlink.h>
L
Linus Torvalds 已提交
70

71
#include "af_netlink.h"
L
Linus Torvalds 已提交
72

73 74 75
struct listeners {
	struct rcu_head		rcu;
	unsigned long		masks[0];
76 77
};

78
/* state bits */
79
#define NETLINK_S_CONGESTED		0x0
80 81

/* flags */
82 83 84 85
#define NETLINK_F_KERNEL_SOCKET		0x1
#define NETLINK_F_RECV_PKTINFO		0x2
#define NETLINK_F_BROADCAST_SEND_ERROR	0x4
#define NETLINK_F_RECV_NO_ENOBUFS	0x8
86
#define NETLINK_F_LISTEN_ALL_NSID	0x10
87
#define NETLINK_F_CAP_ACK		0x20
88

89
static inline int netlink_is_kernel(struct sock *sk)
90
{
91
	return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
92 93
}

94
struct netlink_table *nl_table __read_mostly;
95
EXPORT_SYMBOL_GPL(nl_table);
L
Linus Torvalds 已提交
96 97 98 99

static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);

static int netlink_dump(struct sock *sk);
100
static void netlink_skb_destructor(struct sk_buff *skb);
L
Linus Torvalds 已提交
101

102
/* nl_table locking explained:
103
 * Lookup and traversal are protected with an RCU read-side lock. Insertion
Y
Ying Xue 已提交
104
 * and removal are protected with per bucket lock while using RCU list
105 106 107 108
 * modification primitives and may run in parallel to RCU protected lookups.
 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
 * been acquired * either during or after the socket has been removed from
 * the list and after an RCU grace period.
109
 */
110 111
DEFINE_RWLOCK(nl_table_lock);
EXPORT_SYMBOL_GPL(nl_table_lock);
L
Linus Torvalds 已提交
112 113
static atomic_t nl_table_users = ATOMIC_INIT(0);

114 115
#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));

116
static ATOMIC_NOTIFIER_HEAD(netlink_chain);
L
Linus Torvalds 已提交
117

118 119 120
static DEFINE_SPINLOCK(netlink_tap_lock);
static struct list_head netlink_tap_all __read_mostly;

121 122
static const struct rhashtable_params netlink_rhashtable_params;

123
static inline u32 netlink_group_mask(u32 group)
124 125 126 127
{
	return group ? 1 << (group - 1) : 0;
}

128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145
static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
					   gfp_t gfp_mask)
{
	unsigned int len = skb_end_offset(skb);
	struct sk_buff *new;

	new = alloc_skb(len, gfp_mask);
	if (new == NULL)
		return NULL;

	NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
	NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
	NETLINK_CB(new).creds = NETLINK_CB(skb).creds;

	memcpy(skb_put(new, len), skb->data, len);
	return new;
}

146 147 148 149 150 151 152 153 154
int netlink_add_tap(struct netlink_tap *nt)
{
	if (unlikely(nt->dev->type != ARPHRD_NETLINK))
		return -EINVAL;

	spin_lock(&netlink_tap_lock);
	list_add_rcu(&nt->list, &netlink_tap_all);
	spin_unlock(&netlink_tap_lock);

155
	__module_get(nt->module);
156 157 158 159 160

	return 0;
}
EXPORT_SYMBOL_GPL(netlink_add_tap);

161
static int __netlink_remove_tap(struct netlink_tap *nt)
162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179
{
	bool found = false;
	struct netlink_tap *tmp;

	spin_lock(&netlink_tap_lock);

	list_for_each_entry(tmp, &netlink_tap_all, list) {
		if (nt == tmp) {
			list_del_rcu(&nt->list);
			found = true;
			goto out;
		}
	}

	pr_warn("__netlink_remove_tap: %p not found\n", nt);
out:
	spin_unlock(&netlink_tap_lock);

180
	if (found)
181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
		module_put(nt->module);

	return found ? 0 : -ENODEV;
}

int netlink_remove_tap(struct netlink_tap *nt)
{
	int ret;

	ret = __netlink_remove_tap(nt);
	synchronize_net();

	return ret;
}
EXPORT_SYMBOL_GPL(netlink_remove_tap);

197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212
static bool netlink_filter_tap(const struct sk_buff *skb)
{
	struct sock *sk = skb->sk;

	/* We take the more conservative approach and
	 * whitelist socket protocols that may pass.
	 */
	switch (sk->sk_protocol) {
	case NETLINK_ROUTE:
	case NETLINK_USERSOCK:
	case NETLINK_SOCK_DIAG:
	case NETLINK_NFLOG:
	case NETLINK_XFRM:
	case NETLINK_FIB_LOOKUP:
	case NETLINK_NETFILTER:
	case NETLINK_GENERIC:
V
Varka Bhadram 已提交
213
		return true;
214 215
	}

V
Varka Bhadram 已提交
216
	return false;
217 218
}

219 220 221 222
static int __netlink_deliver_tap_skb(struct sk_buff *skb,
				     struct net_device *dev)
{
	struct sk_buff *nskb;
223
	struct sock *sk = skb->sk;
224 225 226
	int ret = -ENOMEM;

	dev_hold(dev);
227

228
	if (is_vmalloc_addr(skb->head))
229 230 231
		nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
	else
		nskb = skb_clone(skb, GFP_ATOMIC);
232 233
	if (nskb) {
		nskb->dev = dev;
234
		nskb->protocol = htons((u16) sk->sk_protocol);
235 236
		nskb->pkt_type = netlink_is_kernel(sk) ?
				 PACKET_KERNEL : PACKET_USER;
237
		skb_reset_network_header(nskb);
238 239 240 241 242 243 244 245 246 247 248 249 250 251
		ret = dev_queue_xmit(nskb);
		if (unlikely(ret > 0))
			ret = net_xmit_errno(ret);
	}

	dev_put(dev);
	return ret;
}

static void __netlink_deliver_tap(struct sk_buff *skb)
{
	int ret;
	struct netlink_tap *tmp;

252 253 254
	if (!netlink_filter_tap(skb))
		return;

255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271
	list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
		ret = __netlink_deliver_tap_skb(skb, tmp->dev);
		if (unlikely(ret))
			break;
	}
}

static void netlink_deliver_tap(struct sk_buff *skb)
{
	rcu_read_lock();

	if (unlikely(!list_empty(&netlink_tap_all)))
		__netlink_deliver_tap(skb);

	rcu_read_unlock();
}

272 273 274 275 276 277 278
static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
				       struct sk_buff *skb)
{
	if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
		netlink_deliver_tap(skb);
}

279 280 281 282
static void netlink_overrun(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

283 284 285
	if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
		if (!test_and_set_bit(NETLINK_S_CONGESTED,
				      &nlk_sk(sk)->state)) {
286 287 288 289 290 291 292 293 294 295 296 297
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
		}
	}
	atomic_inc(&sk->sk_drops);
}

static void netlink_rcv_wake(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (skb_queue_empty(&sk->sk_receive_queue))
298 299
		clear_bit(NETLINK_S_CONGESTED, &nlk->state);
	if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
300 301 302
		wake_up_interruptible(&nlk->wait);
}

303 304
static void netlink_skb_destructor(struct sk_buff *skb)
{
305
	if (is_vmalloc_addr(skb->head)) {
306 307 308 309
		if (!skb->cloned ||
		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
			vfree(skb->head);

310 311
		skb->head = NULL;
	}
312 313
	if (skb->sk != NULL)
		sock_rfree(skb);
314 315 316 317 318 319 320 321 322 323 324
}

static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
{
	WARN_ON(skb->sk != NULL);
	skb->sk = sk;
	skb->destructor = netlink_skb_destructor;
	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
	sk_mem_charge(sk, skb->truesize);
}

325
static void netlink_sock_destruct(struct sock *sk)
L
Linus Torvalds 已提交
326
{
327 328
	struct netlink_sock *nlk = nlk_sk(sk);

329
	if (nlk->cb_running) {
330 331
		if (nlk->cb.done)
			nlk->cb.done(&nlk->cb);
332 333
		module_put(nlk->cb.module);
		kfree_skb(nlk->cb.skb);
334 335
	}

L
Linus Torvalds 已提交
336 337 338
	skb_queue_purge(&sk->sk_receive_queue);

	if (!sock_flag(sk, SOCK_DEAD)) {
339
		printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
L
Linus Torvalds 已提交
340 341
		return;
	}
342 343 344 345

	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
	WARN_ON(atomic_read(&sk->sk_wmem_alloc));
	WARN_ON(nlk_sk(sk)->groups);
L
Linus Torvalds 已提交
346 347
}

348 349 350 351 352
static void netlink_sock_destruct_work(struct work_struct *work)
{
	struct netlink_sock *nlk = container_of(work, struct netlink_sock,
						work);

353
	sk_free(&nlk->sk);
354 355
}

356 357
/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
 * SMP. Look, when several writers sleep and reader wakes them up, all but one
L
Linus Torvalds 已提交
358 359 360 361
 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
 * this, _but_ remember, it adds useless work on UP machines.
 */

362
void netlink_table_grab(void)
363
	__acquires(nl_table_lock)
L
Linus Torvalds 已提交
364
{
365 366
	might_sleep();

367
	write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
368 369 370 371 372

	if (atomic_read(&nl_table_users)) {
		DECLARE_WAITQUEUE(wait, current);

		add_wait_queue_exclusive(&nl_table_wait, &wait);
373
		for (;;) {
L
Linus Torvalds 已提交
374 375 376
			set_current_state(TASK_UNINTERRUPTIBLE);
			if (atomic_read(&nl_table_users) == 0)
				break;
377
			write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
378
			schedule();
379
			write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
380 381 382 383 384 385 386
		}

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nl_table_wait, &wait);
	}
}

387
void netlink_table_ungrab(void)
388
	__releases(nl_table_lock)
L
Linus Torvalds 已提交
389
{
390
	write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
391 392 393
	wake_up(&nl_table_wait);
}

394
static inline void
L
Linus Torvalds 已提交
395 396 397 398 399 400 401 402 403
netlink_lock_table(void)
{
	/* read_lock() synchronizes us to netlink_table_grab */

	read_lock(&nl_table_lock);
	atomic_inc(&nl_table_users);
	read_unlock(&nl_table_lock);
}

404
static inline void
L
Linus Torvalds 已提交
405 406 407 408 409 410
netlink_unlock_table(void)
{
	if (atomic_dec_and_test(&nl_table_users))
		wake_up(&nl_table_wait);
}

411
struct netlink_compare_arg
L
Linus Torvalds 已提交
412
{
413
	possible_net_t pnet;
414 415
	u32 portid;
};
L
Linus Torvalds 已提交
416

417 418 419
/* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
#define netlink_compare_arg_len \
	(offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
420 421 422

static inline int netlink_compare(struct rhashtable_compare_arg *arg,
				  const void *ptr)
L
Linus Torvalds 已提交
423
{
424 425
	const struct netlink_compare_arg *x = arg->key;
	const struct netlink_sock *nlk = ptr;
L
Linus Torvalds 已提交
426

427
	return nlk->portid != x->portid ||
428 429 430 431 432 433 434 435 436
	       !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
}

static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
				     struct net *net, u32 portid)
{
	memset(arg, 0, sizeof(*arg));
	write_pnet(&arg->pnet, net);
	arg->portid = portid;
L
Linus Torvalds 已提交
437 438
}

439 440
static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
				     struct net *net)
L
Linus Torvalds 已提交
441
{
442
	struct netlink_compare_arg arg;
L
Linus Torvalds 已提交
443

444 445 446
	netlink_compare_arg_init(&arg, net, portid);
	return rhashtable_lookup_fast(&table->hash, &arg,
				      netlink_rhashtable_params);
L
Linus Torvalds 已提交
447 448
}

449
static int __netlink_insert(struct netlink_table *table, struct sock *sk)
Y
Ying Xue 已提交
450
{
451
	struct netlink_compare_arg arg;
Y
Ying Xue 已提交
452

453
	netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
454 455 456
	return rhashtable_lookup_insert_key(&table->hash, &arg,
					    &nlk_sk(sk)->node,
					    netlink_rhashtable_params);
Y
Ying Xue 已提交
457 458
}

459
static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
L
Linus Torvalds 已提交
460
{
461 462
	struct netlink_table *table = &nl_table[protocol];
	struct sock *sk;
L
Linus Torvalds 已提交
463

464 465 466 467 468
	rcu_read_lock();
	sk = __netlink_lookup(table, portid, net);
	if (sk)
		sock_hold(sk);
	rcu_read_unlock();
L
Linus Torvalds 已提交
469

470
	return sk;
L
Linus Torvalds 已提交
471 472
}

473
static const struct proto_ops netlink_ops;
L
Linus Torvalds 已提交
474

475 476 477 478 479 480
static void
netlink_update_listeners(struct sock *sk)
{
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];
	unsigned long mask;
	unsigned int i;
481 482 483 484 485
	struct listeners *listeners;

	listeners = nl_deref_protected(tbl->listeners);
	if (!listeners)
		return;
486

487
	for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
488
		mask = 0;
489
		sk_for_each_bound(sk, &tbl->mc_list) {
490 491 492
			if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
				mask |= nlk_sk(sk)->groups[i];
		}
493
		listeners->masks[i] = mask;
494 495 496 497 498
	}
	/* this function is only called with the netlink table "grabbed", which
	 * makes sure updates are visible before bind or setsockopt return. */
}

499
static int netlink_insert(struct sock *sk, u32 portid)
L
Linus Torvalds 已提交
500
{
501
	struct netlink_table *table = &nl_table[sk->sk_protocol];
502
	int err;
L
Linus Torvalds 已提交
503

Y
Ying Xue 已提交
504
	lock_sock(sk);
L
Linus Torvalds 已提交
505

506 507
	err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
	if (nlk_sk(sk)->bound)
L
Linus Torvalds 已提交
508 509 510
		goto err;

	err = -ENOMEM;
511 512
	if (BITS_PER_LONG > 32 &&
	    unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
L
Linus Torvalds 已提交
513 514
		goto err;

515
	nlk_sk(sk)->portid = portid;
516
	sock_hold(sk);
517

518 519
	err = __netlink_insert(table, sk);
	if (err) {
520 521 522 523 524
		/* In case the hashtable backend returns with -EBUSY
		 * from here, it must not escape to the caller.
		 */
		if (unlikely(err == -EBUSY))
			err = -EOVERFLOW;
525 526
		if (err == -EEXIST)
			err = -EADDRINUSE;
Y
Ying Xue 已提交
527
		sock_put(sk);
528
		goto err;
529 530
	}

531 532 533
	/* We need to ensure that the socket is hashed and visible. */
	smp_wmb();
	nlk_sk(sk)->bound = portid;
534

L
Linus Torvalds 已提交
535
err:
Y
Ying Xue 已提交
536
	release_sock(sk);
L
Linus Torvalds 已提交
537 538 539 540 541
	return err;
}

static void netlink_remove(struct sock *sk)
{
542 543 544
	struct netlink_table *table;

	table = &nl_table[sk->sk_protocol];
545 546
	if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
				    netlink_rhashtable_params)) {
547 548 549 550
		WARN_ON(atomic_read(&sk->sk_refcnt) == 1);
		__sock_put(sk);
	}

L
Linus Torvalds 已提交
551
	netlink_table_grab();
552
	if (nlk_sk(sk)->subscriptions) {
L
Linus Torvalds 已提交
553
		__sk_del_bind_node(sk);
554 555
		netlink_update_listeners(sk);
	}
556 557
	if (sk->sk_protocol == NETLINK_GENERIC)
		atomic_inc(&genl_sk_destructing_cnt);
L
Linus Torvalds 已提交
558 559 560 561 562 563 564 565 566
	netlink_table_ungrab();
}

static struct proto netlink_proto = {
	.name	  = "NETLINK",
	.owner	  = THIS_MODULE,
	.obj_size = sizeof(struct netlink_sock),
};

567
static int __netlink_create(struct net *net, struct socket *sock,
568 569
			    struct mutex *cb_mutex, int protocol,
			    int kern)
L
Linus Torvalds 已提交
570 571 572
{
	struct sock *sk;
	struct netlink_sock *nlk;
573 574 575

	sock->ops = &netlink_ops;

576
	sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
577 578 579 580 581 582
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	nlk = nlk_sk(sk);
E
Eric Dumazet 已提交
583
	if (cb_mutex) {
584
		nlk->cb_mutex = cb_mutex;
E
Eric Dumazet 已提交
585
	} else {
586 587 588
		nlk->cb_mutex = &nlk->cb_def_mutex;
		mutex_init(nlk->cb_mutex);
	}
589 590 591 592 593 594 595
	init_waitqueue_head(&nlk->wait);

	sk->sk_destruct = netlink_sock_destruct;
	sk->sk_protocol = protocol;
	return 0;
}

596 597
static int netlink_create(struct net *net, struct socket *sock, int protocol,
			  int kern)
598 599
{
	struct module *module = NULL;
600
	struct mutex *cb_mutex;
601
	struct netlink_sock *nlk;
602 603
	int (*bind)(struct net *net, int group);
	void (*unbind)(struct net *net, int group);
604
	int err = 0;
L
Linus Torvalds 已提交
605 606 607 608 609 610

	sock->state = SS_UNCONNECTED;

	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
		return -ESOCKTNOSUPPORT;

611
	if (protocol < 0 || protocol >= MAX_LINKS)
L
Linus Torvalds 已提交
612 613
		return -EPROTONOSUPPORT;

614
	netlink_lock_table();
615
#ifdef CONFIG_MODULES
616
	if (!nl_table[protocol].registered) {
617
		netlink_unlock_table();
618
		request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
619
		netlink_lock_table();
620
	}
621 622 623 624
#endif
	if (nl_table[protocol].registered &&
	    try_module_get(nl_table[protocol].module))
		module = nl_table[protocol].module;
625 626
	else
		err = -EPROTONOSUPPORT;
627
	cb_mutex = nl_table[protocol].cb_mutex;
628
	bind = nl_table[protocol].bind;
629
	unbind = nl_table[protocol].unbind;
630
	netlink_unlock_table();
631

632 633 634
	if (err < 0)
		goto out;

635
	err = __netlink_create(net, sock, cb_mutex, protocol, kern);
636
	if (err < 0)
637 638
		goto out_module;

639
	local_bh_disable();
640
	sock_prot_inuse_add(net, &netlink_proto, 1);
641 642
	local_bh_enable();

643 644
	nlk = nlk_sk(sock->sk);
	nlk->module = module;
645
	nlk->netlink_bind = bind;
646
	nlk->netlink_unbind = unbind;
647 648
out:
	return err;
L
Linus Torvalds 已提交
649

650 651 652
out_module:
	module_put(module);
	goto out;
L
Linus Torvalds 已提交
653 654
}

655 656 657
static void deferred_put_nlk_sk(struct rcu_head *head)
{
	struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
658 659 660 661 662 663 664 665 666 667
	struct sock *sk = &nlk->sk;

	if (!atomic_dec_and_test(&sk->sk_refcnt))
		return;

	if (nlk->cb_running && nlk->cb.done) {
		INIT_WORK(&nlk->work, netlink_sock_destruct_work);
		schedule_work(&nlk->work);
		return;
	}
668

669
	sk_free(sk);
670 671
}

L
Linus Torvalds 已提交
672 673 674 675 676 677 678 679 680
static int netlink_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk;

	if (!sk)
		return 0;

	netlink_remove(sk);
681
	sock_orphan(sk);
L
Linus Torvalds 已提交
682 683
	nlk = nlk_sk(sk);

684 685 686 687
	/*
	 * OK. Socket is unlinked, any packets that arrive now
	 * will be purged.
	 */
L
Linus Torvalds 已提交
688

689 690 691 692 693 694 695 696 697 698 699 700 701 702
	/* must not acquire netlink_table_lock in any way again before unbind
	 * and notifying genetlink is done as otherwise it might deadlock
	 */
	if (nlk->netlink_unbind) {
		int i;

		for (i = 0; i < nlk->ngroups; i++)
			if (test_bit(i, nlk->groups))
				nlk->netlink_unbind(sock_net(sk), i + 1);
	}
	if (sk->sk_protocol == NETLINK_GENERIC &&
	    atomic_dec_return(&genl_sk_destructing_cnt) == 0)
		wake_up(&genl_sk_destructing_waitq);

L
Linus Torvalds 已提交
703 704 705 706 707
	sock->sk = NULL;
	wake_up_interruptible_all(&nlk->wait);

	skb_queue_purge(&sk->sk_write_queue);

708
	if (nlk->portid && nlk->bound) {
L
Linus Torvalds 已提交
709
		struct netlink_notify n = {
710
						.net = sock_net(sk),
L
Linus Torvalds 已提交
711
						.protocol = sk->sk_protocol,
712
						.portid = nlk->portid,
L
Linus Torvalds 已提交
713
					  };
714 715
		atomic_notifier_call_chain(&netlink_chain,
				NETLINK_URELEASE, &n);
716
	}
717

718
	module_put(nlk->module);
719

720
	if (netlink_is_kernel(sk)) {
721
		netlink_table_grab();
722 723
		BUG_ON(nl_table[sk->sk_protocol].registered == 0);
		if (--nl_table[sk->sk_protocol].registered == 0) {
724 725 726 727 728
			struct listeners *old;

			old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
			RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
			kfree_rcu(old, rcu);
729
			nl_table[sk->sk_protocol].module = NULL;
730
			nl_table[sk->sk_protocol].bind = NULL;
731
			nl_table[sk->sk_protocol].unbind = NULL;
732
			nl_table[sk->sk_protocol].flags = 0;
733 734
			nl_table[sk->sk_protocol].registered = 0;
		}
735
		netlink_table_ungrab();
E
Eric Dumazet 已提交
736
	}
737

738 739 740
	kfree(nlk->groups);
	nlk->groups = NULL;

741
	local_bh_disable();
742
	sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
743
	local_bh_enable();
744
	call_rcu(&nlk->rcu, deferred_put_nlk_sk);
L
Linus Torvalds 已提交
745 746 747 748 749 750
	return 0;
}

static int netlink_autobind(struct socket *sock)
{
	struct sock *sk = sock->sk;
751
	struct net *net = sock_net(sk);
752
	struct netlink_table *table = &nl_table[sk->sk_protocol];
753
	s32 portid = task_tgid_vnr(current);
L
Linus Torvalds 已提交
754
	int err;
H
Herbert Xu 已提交
755 756
	s32 rover = -4096;
	bool ok;
L
Linus Torvalds 已提交
757 758 759

retry:
	cond_resched();
760
	rcu_read_lock();
H
Herbert Xu 已提交
761 762 763
	ok = !__netlink_lookup(table, portid, net);
	rcu_read_unlock();
	if (!ok) {
764
		/* Bind collision, search negative portid values. */
H
Herbert Xu 已提交
765 766 767 768
		if (rover == -4096)
			/* rover will be in range [S32_MIN, -4097] */
			rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
		else if (rover >= -4096)
769
			rover = -4097;
H
Herbert Xu 已提交
770
		portid = rover--;
771
		goto retry;
L
Linus Torvalds 已提交
772 773
	}

774
	err = netlink_insert(sk, portid);
L
Linus Torvalds 已提交
775 776
	if (err == -EADDRINUSE)
		goto retry;
777 778 779 780 781 782

	/* If 2 threads race to autobind, that is fine.  */
	if (err == -EBUSY)
		err = 0;

	return err;
L
Linus Torvalds 已提交
783 784
}

785 786 787 788 789 790 791 792 793 794 795 796 797
/**
 * __netlink_ns_capable - General netlink message capability test
 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in the user namespace @user_ns.
 */
bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
			struct user_namespace *user_ns, int cap)
{
798 799 800
	return ((nsp->flags & NETLINK_SKB_DST) ||
		file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
		ns_capable(user_ns, cap);
801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851
}
EXPORT_SYMBOL(__netlink_ns_capable);

/**
 * netlink_ns_capable - General netlink message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in the user namespace @user_ns.
 */
bool netlink_ns_capable(const struct sk_buff *skb,
			struct user_namespace *user_ns, int cap)
{
	return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
}
EXPORT_SYMBOL(netlink_ns_capable);

/**
 * netlink_capable - Netlink global message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in all user namespaces.
 */
bool netlink_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, &init_user_ns, cap);
}
EXPORT_SYMBOL(netlink_capable);

/**
 * netlink_net_capable - Netlink network namespace message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap over the network namespace of
 * the socket we received the message from.
 */
bool netlink_net_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
}
EXPORT_SYMBOL(netlink_net_capable);

852
static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
853
{
854
	return (nl_table[sock->sk->sk_protocol].flags & flag) ||
855
		ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
856
}
L
Linus Torvalds 已提交
857

858 859 860 861 862 863 864 865 866 867 868 869
static void
netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (nlk->subscriptions && !subscriptions)
		__sk_del_bind_node(sk);
	else if (!nlk->subscriptions && subscriptions)
		sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
	nlk->subscriptions = subscriptions;
}

870
static int netlink_realloc_groups(struct sock *sk)
871 872 873
{
	struct netlink_sock *nlk = nlk_sk(sk);
	unsigned int groups;
874
	unsigned long *new_groups;
875 876
	int err = 0;

877 878
	netlink_table_grab();

879
	groups = nl_table[sk->sk_protocol].groups;
880
	if (!nl_table[sk->sk_protocol].registered) {
881
		err = -ENOENT;
882 883
		goto out_unlock;
	}
884

885 886
	if (nlk->ngroups >= groups)
		goto out_unlock;
887

888 889 890 891 892
	new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
	if (new_groups == NULL) {
		err = -ENOMEM;
		goto out_unlock;
	}
893
	memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
894 895 896
	       NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));

	nlk->groups = new_groups;
897
	nlk->ngroups = groups;
898 899 900
 out_unlock:
	netlink_table_ungrab();
	return err;
901 902
}

903
static void netlink_undo_bind(int group, long unsigned int groups,
904
			      struct sock *sk)
905
{
906
	struct netlink_sock *nlk = nlk_sk(sk);
907 908 909 910 911 912
	int undo;

	if (!nlk->netlink_unbind)
		return;

	for (undo = 0; undo < group; undo++)
913
		if (test_bit(undo, &groups))
914
			nlk->netlink_unbind(sock_net(sk), undo + 1);
915 916
}

917 918
static int netlink_bind(struct socket *sock, struct sockaddr *addr,
			int addr_len)
L
Linus Torvalds 已提交
919 920
{
	struct sock *sk = sock->sk;
921
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
922 923 924
	struct netlink_sock *nlk = nlk_sk(sk);
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
	int err;
925
	long unsigned int groups = nladdr->nl_groups;
926
	bool bound;
927

928 929 930
	if (addr_len < sizeof(struct sockaddr_nl))
		return -EINVAL;

L
Linus Torvalds 已提交
931 932 933 934
	if (nladdr->nl_family != AF_NETLINK)
		return -EINVAL;

	/* Only superuser is allowed to listen multicasts */
935
	if (groups) {
936
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
937
			return -EPERM;
938 939 940
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
941
	}
L
Linus Torvalds 已提交
942

943 944 945 946 947
	bound = nlk->bound;
	if (bound) {
		/* Ensure nlk->portid is up-to-date. */
		smp_rmb();

948
		if (nladdr->nl_pid != nlk->portid)
L
Linus Torvalds 已提交
949
			return -EINVAL;
950
	}
951 952 953 954 955 956 957

	if (nlk->netlink_bind && groups) {
		int group;

		for (group = 0; group < nlk->ngroups; group++) {
			if (!test_bit(group, &groups))
				continue;
958
			err = nlk->netlink_bind(net, group + 1);
959 960
			if (!err)
				continue;
961
			netlink_undo_bind(group, groups, sk);
962 963 964 965
			return err;
		}
	}

966 967 968 969
	/* No need for barriers here as we return to user-space without
	 * using any of the bound attributes.
	 */
	if (!bound) {
L
Linus Torvalds 已提交
970
		err = nladdr->nl_pid ?
971
			netlink_insert(sk, nladdr->nl_pid) :
L
Linus Torvalds 已提交
972
			netlink_autobind(sock);
973
		if (err) {
974
			netlink_undo_bind(nlk->ngroups, groups, sk);
L
Linus Torvalds 已提交
975
			return err;
976
		}
L
Linus Torvalds 已提交
977 978
	}

979
	if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
L
Linus Torvalds 已提交
980 981 982
		return 0;

	netlink_table_grab();
983
	netlink_update_subscriptions(sk, nlk->subscriptions +
984
					 hweight32(groups) -
985
					 hweight32(nlk->groups[0]));
986
	nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
987
	netlink_update_listeners(sk);
L
Linus Torvalds 已提交
988 989 990 991 992 993 994 995 996 997 998
	netlink_table_ungrab();

	return 0;
}

static int netlink_connect(struct socket *sock, struct sockaddr *addr,
			   int alen, int flags)
{
	int err = 0;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
999
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
L
Linus Torvalds 已提交
1000

1001 1002 1003
	if (alen < sizeof(addr->sa_family))
		return -EINVAL;

L
Linus Torvalds 已提交
1004 1005
	if (addr->sa_family == AF_UNSPEC) {
		sk->sk_state	= NETLINK_UNCONNECTED;
1006
		nlk->dst_portid	= 0;
1007
		nlk->dst_group  = 0;
L
Linus Torvalds 已提交
1008 1009 1010 1011 1012
		return 0;
	}
	if (addr->sa_family != AF_NETLINK)
		return -EINVAL;

1013
	if ((nladdr->nl_groups || nladdr->nl_pid) &&
1014
	    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
L
Linus Torvalds 已提交
1015 1016
		return -EPERM;

1017 1018 1019 1020
	/* No need for barriers here as we return to user-space without
	 * using any of the bound attributes.
	 */
	if (!nlk->bound)
L
Linus Torvalds 已提交
1021 1022 1023 1024
		err = netlink_autobind(sock);

	if (err == 0) {
		sk->sk_state	= NETLINK_CONNECTED;
1025
		nlk->dst_portid = nladdr->nl_pid;
1026
		nlk->dst_group  = ffs(nladdr->nl_groups);
L
Linus Torvalds 已提交
1027 1028 1029 1030 1031
	}

	return err;
}

1032 1033
static int netlink_getname(struct socket *sock, struct sockaddr *addr,
			   int *addr_len, int peer)
L
Linus Torvalds 已提交
1034 1035 1036
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1037
	DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1038

L
Linus Torvalds 已提交
1039 1040 1041 1042 1043
	nladdr->nl_family = AF_NETLINK;
	nladdr->nl_pad = 0;
	*addr_len = sizeof(*nladdr);

	if (peer) {
1044
		nladdr->nl_pid = nlk->dst_portid;
1045
		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
L
Linus Torvalds 已提交
1046
	} else {
1047
		nladdr->nl_pid = nlk->portid;
1048
		nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
L
Linus Torvalds 已提交
1049 1050 1051 1052
	}
	return 0;
}

1053 1054 1055 1056 1057 1058 1059 1060
static int netlink_ioctl(struct socket *sock, unsigned int cmd,
			 unsigned long arg)
{
	/* try to hand this ioctl down to the NIC drivers.
	 */
	return -ENOIOCTLCMD;
}

1061
static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
L
Linus Torvalds 已提交
1062 1063 1064 1065
{
	struct sock *sock;
	struct netlink_sock *nlk;

1066
	sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
L
Linus Torvalds 已提交
1067 1068 1069 1070 1071
	if (!sock)
		return ERR_PTR(-ECONNREFUSED);

	/* Don't bother queuing skb if kernel socket has no input function */
	nlk = nlk_sk(sock);
1072
	if (sock->sk_state == NETLINK_CONNECTED &&
1073
	    nlk->dst_portid != nlk_sk(ssk)->portid) {
L
Linus Torvalds 已提交
1074 1075 1076 1077 1078 1079 1080 1081
		sock_put(sock);
		return ERR_PTR(-ECONNREFUSED);
	}
	return sock;
}

struct sock *netlink_getsockbyfilp(struct file *filp)
{
A
Al Viro 已提交
1082
	struct inode *inode = file_inode(filp);
L
Linus Torvalds 已提交
1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095
	struct sock *sock;

	if (!S_ISSOCK(inode->i_mode))
		return ERR_PTR(-ENOTSOCK);

	sock = SOCKET_I(inode)->sk;
	if (sock->sk_family != AF_NETLINK)
		return ERR_PTR(-EINVAL);

	sock_hold(sock);
	return sock;
}

1096 1097
static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
					       int broadcast)
1098 1099 1100 1101
{
	struct sk_buff *skb;
	void *data;

1102
	if (size <= NLMSG_GOODSIZE || broadcast)
1103 1104
		return alloc_skb(size, GFP_KERNEL);

1105 1106
	size = SKB_DATA_ALIGN(size) +
	       SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1107 1108 1109

	data = vmalloc(size);
	if (data == NULL)
1110
		return NULL;
1111

E
Eric Dumazet 已提交
1112
	skb = __build_skb(data, size);
1113 1114
	if (skb == NULL)
		vfree(data);
E
Eric Dumazet 已提交
1115
	else
1116
		skb->destructor = netlink_skb_destructor;
1117 1118 1119 1120

	return skb;
}

L
Linus Torvalds 已提交
1121 1122 1123 1124 1125 1126 1127 1128 1129 1130
/*
 * Attach a skb to a netlink socket.
 * The caller must hold a reference to the destination socket. On error, the
 * reference is dropped. The skb is not send to the destination, just all
 * all error checks are performed and memory in the queue is reserved.
 * Return values:
 * < 0: error. skb freed, reference to sock dropped.
 * 0: continue
 * 1: repeat lookup - reference dropped while waiting for socket memory.
 */
1131
int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
P
Patrick McHardy 已提交
1132
		      long *timeo, struct sock *ssk)
L
Linus Torvalds 已提交
1133 1134 1135 1136 1137
{
	struct netlink_sock *nlk;

	nlk = nlk_sk(sk);

1138
	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1139
	     test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
L
Linus Torvalds 已提交
1140
		DECLARE_WAITQUEUE(wait, current);
P
Patrick McHardy 已提交
1141
		if (!*timeo) {
1142
			if (!ssk || netlink_is_kernel(ssk))
L
Linus Torvalds 已提交
1143 1144 1145 1146 1147 1148 1149 1150 1151 1152
				netlink_overrun(sk);
			sock_put(sk);
			kfree_skb(skb);
			return -EAGAIN;
		}

		__set_current_state(TASK_INTERRUPTIBLE);
		add_wait_queue(&nlk->wait, &wait);

		if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1153
		     test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
L
Linus Torvalds 已提交
1154
		    !sock_flag(sk, SOCK_DEAD))
P
Patrick McHardy 已提交
1155
			*timeo = schedule_timeout(*timeo);
L
Linus Torvalds 已提交
1156 1157 1158 1159 1160 1161 1162

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nlk->wait, &wait);
		sock_put(sk);

		if (signal_pending(current)) {
			kfree_skb(skb);
P
Patrick McHardy 已提交
1163
			return sock_intr_errno(*timeo);
L
Linus Torvalds 已提交
1164 1165 1166
		}
		return 1;
	}
1167
	netlink_skb_set_owner_r(skb, sk);
L
Linus Torvalds 已提交
1168 1169 1170
	return 0;
}

1171
static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1172 1173 1174
{
	int len = skb->len;

1175 1176
	netlink_deliver_tap(skb);

1177
	skb_queue_tail(&sk->sk_receive_queue, skb);
1178
	sk->sk_data_ready(sk);
1179 1180 1181 1182 1183 1184 1185
	return len;
}

int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
	int len = __netlink_sendskb(sk, skb);

L
Linus Torvalds 已提交
1186 1187 1188 1189 1190 1191 1192 1193 1194 1195
	sock_put(sk);
	return len;
}

void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
{
	kfree_skb(skb);
	sock_put(sk);
}

1196
static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
L
Linus Torvalds 已提交
1197 1198 1199
{
	int delta;

1200
	WARN_ON(skb->sk != NULL);
1201
	delta = skb->end - skb->tail;
1202
	if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
L
Linus Torvalds 已提交
1203 1204 1205 1206 1207 1208
		return skb;

	if (skb_shared(skb)) {
		struct sk_buff *nskb = skb_clone(skb, allocation);
		if (!nskb)
			return skb;
1209
		consume_skb(skb);
L
Linus Torvalds 已提交
1210 1211 1212 1213 1214 1215 1216 1217 1218
		skb = nskb;
	}

	if (!pskb_expand_head(skb, 0, -delta, allocation))
		skb->truesize -= delta;

	return skb;
}

1219 1220
static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
				  struct sock *ssk)
1221 1222 1223 1224 1225 1226 1227
{
	int ret;
	struct netlink_sock *nlk = nlk_sk(sk);

	ret = -ECONNREFUSED;
	if (nlk->netlink_rcv != NULL) {
		ret = skb->len;
1228
		netlink_skb_set_owner_r(skb, sk);
1229
		NETLINK_CB(skb).sk = ssk;
1230
		netlink_deliver_tap_kernel(sk, ssk, skb);
1231
		nlk->netlink_rcv(skb);
1232 1233 1234
		consume_skb(skb);
	} else {
		kfree_skb(skb);
1235 1236 1237 1238 1239 1240
	}
	sock_put(sk);
	return ret;
}

int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1241
		    u32 portid, int nonblock)
L
Linus Torvalds 已提交
1242 1243 1244 1245 1246 1247 1248 1249 1250
{
	struct sock *sk;
	int err;
	long timeo;

	skb = netlink_trim(skb, gfp_any());

	timeo = sock_sndtimeo(ssk, nonblock);
retry:
1251
	sk = netlink_getsockbyportid(ssk, portid);
L
Linus Torvalds 已提交
1252 1253 1254 1255
	if (IS_ERR(sk)) {
		kfree_skb(skb);
		return PTR_ERR(sk);
	}
1256
	if (netlink_is_kernel(sk))
1257
		return netlink_unicast_kernel(sk, skb, ssk);
1258

1259
	if (sk_filter(sk, skb)) {
W
Wang Chen 已提交
1260
		err = skb->len;
1261 1262 1263 1264 1265
		kfree_skb(skb);
		sock_put(sk);
		return err;
	}

1266
	err = netlink_attachskb(sk, skb, &timeo, ssk);
L
Linus Torvalds 已提交
1267 1268 1269 1270 1271
	if (err == 1)
		goto retry;
	if (err)
		return err;

1272
	return netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
1273
}
1274
EXPORT_SYMBOL(netlink_unicast);
L
Linus Torvalds 已提交
1275

1276 1277 1278
int netlink_has_listeners(struct sock *sk, unsigned int group)
{
	int res = 0;
1279
	struct listeners *listeners;
1280

1281
	BUG_ON(!netlink_is_kernel(sk));
1282 1283 1284 1285

	rcu_read_lock();
	listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);

1286
	if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1287
		res = test_bit(group - 1, listeners->masks);
1288 1289 1290

	rcu_read_unlock();

1291 1292 1293 1294
	return res;
}
EXPORT_SYMBOL_GPL(netlink_has_listeners);

1295
static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1296 1297 1298 1299
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1300
	    !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1301
		netlink_skb_set_owner_r(skb, sk);
1302
		__netlink_sendskb(sk, skb);
1303
		return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
L
Linus Torvalds 已提交
1304 1305 1306 1307 1308 1309
	}
	return -1;
}

struct netlink_broadcast_data {
	struct sock *exclude_sk;
1310
	struct net *net;
1311
	u32 portid;
L
Linus Torvalds 已提交
1312 1313
	u32 group;
	int failure;
1314
	int delivery_failure;
L
Linus Torvalds 已提交
1315 1316
	int congested;
	int delivered;
A
Al Viro 已提交
1317
	gfp_t allocation;
L
Linus Torvalds 已提交
1318
	struct sk_buff *skb, *skb2;
1319 1320
	int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
	void *tx_data;
L
Linus Torvalds 已提交
1321 1322
};

1323 1324
static void do_one_broadcast(struct sock *sk,
				    struct netlink_broadcast_data *p)
L
Linus Torvalds 已提交
1325 1326 1327 1328 1329
{
	struct netlink_sock *nlk = nlk_sk(sk);
	int val;

	if (p->exclude_sk == sk)
1330
		return;
L
Linus Torvalds 已提交
1331

1332
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1333
	    !test_bit(p->group - 1, nlk->groups))
1334
		return;
L
Linus Torvalds 已提交
1335

1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346
	if (!net_eq(sock_net(sk), p->net)) {
		if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
			return;

		if (!peernet_has_id(sock_net(sk), p->net))
			return;

		if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
				     CAP_NET_BROADCAST))
			return;
	}
1347

L
Linus Torvalds 已提交
1348 1349
	if (p->failure) {
		netlink_overrun(sk);
1350
		return;
L
Linus Torvalds 已提交
1351 1352 1353 1354
	}

	sock_hold(sk);
	if (p->skb2 == NULL) {
1355
		if (skb_shared(p->skb)) {
L
Linus Torvalds 已提交
1356 1357
			p->skb2 = skb_clone(p->skb, p->allocation);
		} else {
1358 1359 1360 1361 1362 1363
			p->skb2 = skb_get(p->skb);
			/*
			 * skb ownership may have been set when
			 * delivered to a previous socket.
			 */
			skb_orphan(p->skb2);
L
Linus Torvalds 已提交
1364 1365 1366 1367 1368 1369
		}
	}
	if (p->skb2 == NULL) {
		netlink_overrun(sk);
		/* Clone failed. Notify ALL listeners. */
		p->failure = 1;
1370
		if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1371
			p->delivery_failure = 1;
1372 1373 1374
		goto out;
	}
	if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
1375 1376
		kfree_skb(p->skb2);
		p->skb2 = NULL;
1377 1378 1379
		goto out;
	}
	if (sk_filter(sk, p->skb2)) {
1380 1381
		kfree_skb(p->skb2);
		p->skb2 = NULL;
1382 1383 1384 1385 1386 1387
		goto out;
	}
	NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
	NETLINK_CB(p->skb2).nsid_is_set = true;
	val = netlink_broadcast_deliver(sk, p->skb2);
	if (val < 0) {
L
Linus Torvalds 已提交
1388
		netlink_overrun(sk);
1389
		if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1390
			p->delivery_failure = 1;
L
Linus Torvalds 已提交
1391 1392 1393 1394 1395
	} else {
		p->congested |= val;
		p->delivered = 1;
		p->skb2 = NULL;
	}
1396
out:
L
Linus Torvalds 已提交
1397 1398 1399
	sock_put(sk);
}

1400
int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
1401 1402 1403
	u32 group, gfp_t allocation,
	int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
	void *filter_data)
L
Linus Torvalds 已提交
1404
{
1405
	struct net *net = sock_net(ssk);
L
Linus Torvalds 已提交
1406 1407 1408 1409 1410 1411
	struct netlink_broadcast_data info;
	struct sock *sk;

	skb = netlink_trim(skb, allocation);

	info.exclude_sk = ssk;
1412
	info.net = net;
1413
	info.portid = portid;
L
Linus Torvalds 已提交
1414 1415
	info.group = group;
	info.failure = 0;
1416
	info.delivery_failure = 0;
L
Linus Torvalds 已提交
1417 1418 1419 1420 1421
	info.congested = 0;
	info.delivered = 0;
	info.allocation = allocation;
	info.skb = skb;
	info.skb2 = NULL;
1422 1423
	info.tx_filter = filter;
	info.tx_data = filter_data;
L
Linus Torvalds 已提交
1424 1425 1426 1427 1428

	/* While we sleep in clone, do not allow to change socket list */

	netlink_lock_table();

1429
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
L
Linus Torvalds 已提交
1430 1431
		do_one_broadcast(sk, &info);

1432
	consume_skb(skb);
1433

L
Linus Torvalds 已提交
1434 1435
	netlink_unlock_table();

1436 1437
	if (info.delivery_failure) {
		kfree_skb(info.skb2);
1438
		return -ENOBUFS;
E
Eric Dumazet 已提交
1439 1440
	}
	consume_skb(info.skb2);
1441

L
Linus Torvalds 已提交
1442
	if (info.delivered) {
1443
		if (info.congested && gfpflags_allow_blocking(allocation))
L
Linus Torvalds 已提交
1444 1445 1446 1447 1448
			yield();
		return 0;
	}
	return -ESRCH;
}
1449 1450
EXPORT_SYMBOL(netlink_broadcast_filtered);

1451
int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
1452 1453
		      u32 group, gfp_t allocation)
{
1454
	return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
1455 1456
		NULL, NULL);
}
1457
EXPORT_SYMBOL(netlink_broadcast);
L
Linus Torvalds 已提交
1458 1459 1460

struct netlink_set_err_data {
	struct sock *exclude_sk;
1461
	u32 portid;
L
Linus Torvalds 已提交
1462 1463 1464 1465
	u32 group;
	int code;
};

1466
static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
L
Linus Torvalds 已提交
1467 1468
{
	struct netlink_sock *nlk = nlk_sk(sk);
1469
	int ret = 0;
L
Linus Torvalds 已提交
1470 1471 1472 1473

	if (sk == p->exclude_sk)
		goto out;

O
Octavian Purdila 已提交
1474
	if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
1475 1476
		goto out;

1477
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1478
	    !test_bit(p->group - 1, nlk->groups))
L
Linus Torvalds 已提交
1479 1480
		goto out;

1481
	if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
1482 1483 1484 1485
		ret = 1;
		goto out;
	}

L
Linus Torvalds 已提交
1486 1487 1488
	sk->sk_err = p->code;
	sk->sk_error_report(sk);
out:
1489
	return ret;
L
Linus Torvalds 已提交
1490 1491
}

1492 1493 1494
/**
 * netlink_set_err - report error to broadcast listeners
 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
1495
 * @portid: the PORTID of a process that we want to skip (if any)
1496
 * @group: the broadcast group that will notice the error
1497
 * @code: error code, must be negative (as usual in kernelspace)
1498 1499
 *
 * This function returns the number of broadcast listeners that have set the
1500
 * NETLINK_NO_ENOBUFS socket option.
1501
 */
1502
int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
L
Linus Torvalds 已提交
1503 1504 1505
{
	struct netlink_set_err_data info;
	struct sock *sk;
1506
	int ret = 0;
L
Linus Torvalds 已提交
1507 1508

	info.exclude_sk = ssk;
1509
	info.portid = portid;
L
Linus Torvalds 已提交
1510
	info.group = group;
1511 1512
	/* sk->sk_err wants a positive error value */
	info.code = -code;
L
Linus Torvalds 已提交
1513 1514 1515

	read_lock(&nl_table_lock);

1516
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
1517
		ret += do_one_set_err(sk, &info);
L
Linus Torvalds 已提交
1518 1519

	read_unlock(&nl_table_lock);
1520
	return ret;
L
Linus Torvalds 已提交
1521
}
1522
EXPORT_SYMBOL(netlink_set_err);
L
Linus Torvalds 已提交
1523

1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540
/* must be called with netlink table grabbed */
static void netlink_update_socket_mc(struct netlink_sock *nlk,
				     unsigned int group,
				     int is_new)
{
	int old, new = !!is_new, subscriptions;

	old = test_bit(group - 1, nlk->groups);
	subscriptions = nlk->subscriptions - old + new;
	if (new)
		__set_bit(group - 1, nlk->groups);
	else
		__clear_bit(group - 1, nlk->groups);
	netlink_update_subscriptions(&nlk->sk, subscriptions);
	netlink_update_listeners(&nlk->sk);
}

1541
static int netlink_setsockopt(struct socket *sock, int level, int optname,
1542
			      char __user *optval, unsigned int optlen)
1543 1544 1545
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1546 1547
	unsigned int val = 0;
	int err;
1548 1549 1550 1551

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

1552
	if (optlen >= sizeof(int) &&
1553
	    get_user(val, (unsigned int __user *)optval))
1554 1555 1556 1557 1558
		return -EFAULT;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (val)
1559
			nlk->flags |= NETLINK_F_RECV_PKTINFO;
1560
		else
1561
			nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
1562 1563 1564 1565
		err = 0;
		break;
	case NETLINK_ADD_MEMBERSHIP:
	case NETLINK_DROP_MEMBERSHIP: {
1566
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1567
			return -EPERM;
1568 1569 1570
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
1571 1572
		if (!val || val - 1 >= nlk->ngroups)
			return -EINVAL;
1573
		if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
1574
			err = nlk->netlink_bind(sock_net(sk), val);
1575 1576 1577
			if (err)
				return err;
		}
1578
		netlink_table_grab();
1579 1580
		netlink_update_socket_mc(nlk, val,
					 optname == NETLINK_ADD_MEMBERSHIP);
1581
		netlink_table_ungrab();
1582
		if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
1583
			nlk->netlink_unbind(sock_net(sk), val);
1584

1585 1586 1587
		err = 0;
		break;
	}
1588 1589
	case NETLINK_BROADCAST_ERROR:
		if (val)
1590
			nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
1591
		else
1592
			nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
1593 1594
		err = 0;
		break;
1595 1596
	case NETLINK_NO_ENOBUFS:
		if (val) {
1597 1598
			nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
			clear_bit(NETLINK_S_CONGESTED, &nlk->state);
1599
			wake_up_interruptible(&nlk->wait);
E
Eric Dumazet 已提交
1600
		} else {
1601
			nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
E
Eric Dumazet 已提交
1602
		}
1603 1604
		err = 0;
		break;
1605 1606 1607 1608 1609 1610 1611 1612 1613 1614
	case NETLINK_LISTEN_ALL_NSID:
		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
			return -EPERM;

		if (val)
			nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
		else
			nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
		err = 0;
		break;
1615 1616 1617 1618 1619 1620 1621
	case NETLINK_CAP_ACK:
		if (val)
			nlk->flags |= NETLINK_F_CAP_ACK;
		else
			nlk->flags &= ~NETLINK_F_CAP_ACK;
		err = 0;
		break;
1622 1623 1624 1625 1626 1627 1628
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static int netlink_getsockopt(struct socket *sock, int level, int optname,
1629
			      char __user *optval, int __user *optlen)
1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int len, val, err;

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

	if (get_user(len, optlen))
		return -EFAULT;
	if (len < 0)
		return -EINVAL;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
1648
		val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
H
Heiko Carstens 已提交
1649 1650 1651
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
1652 1653
		err = 0;
		break;
1654 1655 1656 1657
	case NETLINK_BROADCAST_ERROR:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
1658
		val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
1659 1660 1661 1662 1663
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
1664 1665 1666 1667
	case NETLINK_NO_ENOBUFS:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
1668
		val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
1669 1670 1671 1672 1673
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
1674 1675 1676 1677
	case NETLINK_LIST_MEMBERSHIPS: {
		int pos, idx, shift;

		err = 0;
1678
		netlink_lock_table();
1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692
		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
			if (len - pos < sizeof(u32))
				break;

			idx = pos / sizeof(unsigned long);
			shift = (pos % sizeof(unsigned long)) * 8;
			if (put_user((u32)(nlk->groups[idx] >> shift),
				     (u32 __user *)(optval + pos))) {
				err = -EFAULT;
				break;
			}
		}
		if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
			err = -EFAULT;
1693
		netlink_unlock_table();
1694 1695
		break;
	}
1696 1697 1698 1699 1700 1701 1702 1703 1704 1705
	case NETLINK_CAP_ACK:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
		val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
{
	struct nl_pktinfo info;

	info.group = NETLINK_CB(skb).dst_group;
	put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
}

1720 1721 1722 1723 1724 1725 1726 1727 1728 1729
static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
					 struct sk_buff *skb)
{
	if (!NETLINK_CB(skb).nsid_is_set)
		return;

	put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
		 &NETLINK_CB(skb).nsid);
}

1730
static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
L
Linus Torvalds 已提交
1731 1732 1733
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1734
	DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
1735
	u32 dst_portid;
1736
	u32 dst_group;
L
Linus Torvalds 已提交
1737 1738 1739
	struct sk_buff *skb;
	int err;
	struct scm_cookie scm;
1740
	u32 netlink_skb_flags = 0;
L
Linus Torvalds 已提交
1741 1742 1743 1744

	if (msg->msg_flags&MSG_OOB)
		return -EOPNOTSUPP;

C
Christoph Hellwig 已提交
1745
	err = scm_send(sock, msg, &scm, true);
L
Linus Torvalds 已提交
1746 1747 1748 1749
	if (err < 0)
		return err;

	if (msg->msg_namelen) {
1750
		err = -EINVAL;
L
Linus Torvalds 已提交
1751
		if (addr->nl_family != AF_NETLINK)
1752
			goto out;
1753
		dst_portid = addr->nl_pid;
1754
		dst_group = ffs(addr->nl_groups);
1755
		err =  -EPERM;
1756
		if ((dst_group || dst_portid) &&
1757
		    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1758
			goto out;
1759
		netlink_skb_flags |= NETLINK_SKB_DST;
L
Linus Torvalds 已提交
1760
	} else {
1761
		dst_portid = nlk->dst_portid;
1762
		dst_group = nlk->dst_group;
L
Linus Torvalds 已提交
1763 1764
	}

1765
	if (!nlk->bound) {
L
Linus Torvalds 已提交
1766 1767 1768
		err = netlink_autobind(sock);
		if (err)
			goto out;
1769 1770 1771
	} else {
		/* Ensure nlk is hashed and visible. */
		smp_rmb();
L
Linus Torvalds 已提交
1772 1773 1774 1775 1776 1777
	}

	err = -EMSGSIZE;
	if (len > sk->sk_sndbuf - 32)
		goto out;
	err = -ENOBUFS;
1778
	skb = netlink_alloc_large_skb(len, dst_group);
1779
	if (skb == NULL)
L
Linus Torvalds 已提交
1780 1781
		goto out;

1782
	NETLINK_CB(skb).portid	= nlk->portid;
1783
	NETLINK_CB(skb).dst_group = dst_group;
C
Christoph Hellwig 已提交
1784
	NETLINK_CB(skb).creds	= scm.creds;
1785
	NETLINK_CB(skb).flags	= netlink_skb_flags;
L
Linus Torvalds 已提交
1786 1787

	err = -EFAULT;
A
Al Viro 已提交
1788
	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
L
Linus Torvalds 已提交
1789 1790 1791 1792 1793 1794 1795 1796 1797 1798
		kfree_skb(skb);
		goto out;
	}

	err = security_netlink_send(sk, skb);
	if (err) {
		kfree_skb(skb);
		goto out;
	}

1799
	if (dst_group) {
L
Linus Torvalds 已提交
1800
		atomic_inc(&skb->users);
1801
		netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
L
Linus Torvalds 已提交
1802
	}
1803
	err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
L
Linus Torvalds 已提交
1804 1805

out:
C
Christoph Hellwig 已提交
1806
	scm_destroy(&scm);
L
Linus Torvalds 已提交
1807 1808 1809
	return err;
}

1810
static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
L
Linus Torvalds 已提交
1811 1812 1813 1814 1815 1816 1817
			   int flags)
{
	struct scm_cookie scm;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int noblock = flags&MSG_DONTWAIT;
	size_t copied;
J
Johannes Berg 已提交
1818
	struct sk_buff *skb, *data_skb;
1819
	int err, ret;
L
Linus Torvalds 已提交
1820 1821 1822 1823 1824 1825

	if (flags&MSG_OOB)
		return -EOPNOTSUPP;

	copied = 0;

1826 1827
	skb = skb_recv_datagram(sk, flags, noblock, &err);
	if (skb == NULL)
L
Linus Torvalds 已提交
1828 1829
		goto out;

J
Johannes Berg 已提交
1830 1831
	data_skb = skb;

1832 1833 1834
#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
	if (unlikely(skb_shinfo(skb)->frag_list)) {
		/*
J
Johannes Berg 已提交
1835 1836 1837
		 * If this skb has a frag_list, then here that means that we
		 * will have to use the frag_list skb's data for compat tasks
		 * and the regular skb's data for normal (non-compat) tasks.
1838
		 *
J
Johannes Berg 已提交
1839 1840 1841 1842
		 * If we need to send the compat skb, assign it to the
		 * 'data_skb' variable so that it will be used below for data
		 * copying. We keep 'skb' for everything else, including
		 * freeing both later.
1843
		 */
J
Johannes Berg 已提交
1844 1845
		if (flags & MSG_CMSG_COMPAT)
			data_skb = skb_shinfo(skb)->frag_list;
1846 1847 1848
	}
#endif

E
Eric Dumazet 已提交
1849 1850 1851
	/* Record the max length of recvmsg() calls for future allocations */
	nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
	nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
1852
				     SKB_WITH_OVERHEAD(32768));
E
Eric Dumazet 已提交
1853

J
Johannes Berg 已提交
1854
	copied = data_skb->len;
L
Linus Torvalds 已提交
1855 1856 1857 1858 1859
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

J
Johannes Berg 已提交
1860
	skb_reset_transport_header(data_skb);
1861
	err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
L
Linus Torvalds 已提交
1862 1863

	if (msg->msg_name) {
1864
		DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
L
Linus Torvalds 已提交
1865 1866
		addr->nl_family = AF_NETLINK;
		addr->nl_pad    = 0;
1867
		addr->nl_pid	= NETLINK_CB(skb).portid;
1868
		addr->nl_groups	= netlink_group_mask(NETLINK_CB(skb).dst_group);
L
Linus Torvalds 已提交
1869 1870 1871
		msg->msg_namelen = sizeof(*addr);
	}

1872
	if (nlk->flags & NETLINK_F_RECV_PKTINFO)
1873
		netlink_cmsg_recv_pktinfo(msg, skb);
1874 1875
	if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
		netlink_cmsg_listen_all_nsid(sk, msg, skb);
1876

C
Christoph Hellwig 已提交
1877 1878
	memset(&scm, 0, sizeof(scm));
	scm.creds = *NETLINK_CREDS(skb);
1879
	if (flags & MSG_TRUNC)
J
Johannes Berg 已提交
1880
		copied = data_skb->len;
1881

L
Linus Torvalds 已提交
1882 1883
	skb_free_datagram(sk, skb);

1884 1885
	if (nlk->cb_running &&
	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
1886 1887
		ret = netlink_dump(sk);
		if (ret) {
1888
			sk->sk_err = -ret;
1889 1890 1891
			sk->sk_error_report(sk);
		}
	}
L
Linus Torvalds 已提交
1892

C
Christoph Hellwig 已提交
1893
	scm_recv(sock, msg, &scm, flags);
L
Linus Torvalds 已提交
1894 1895 1896 1897 1898
out:
	netlink_rcv_wake(sk);
	return err ? : copied;
}

1899
static void netlink_data_ready(struct sock *sk)
L
Linus Torvalds 已提交
1900
{
1901
	BUG();
L
Linus Torvalds 已提交
1902 1903 1904
}

/*
1905
 *	We export these functions to other modules. They provide a
L
Linus Torvalds 已提交
1906 1907 1908 1909 1910
 *	complete set of kernel non-blocking support for message
 *	queueing.
 */

struct sock *
1911 1912
__netlink_kernel_create(struct net *net, int unit, struct module *module,
			struct netlink_kernel_cfg *cfg)
L
Linus Torvalds 已提交
1913 1914 1915
{
	struct socket *sock;
	struct sock *sk;
1916
	struct netlink_sock *nlk;
1917
	struct listeners *listeners = NULL;
1918 1919
	struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
	unsigned int groups;
L
Linus Torvalds 已提交
1920

1921
	BUG_ON(!nl_table);
L
Linus Torvalds 已提交
1922

1923
	if (unit < 0 || unit >= MAX_LINKS)
L
Linus Torvalds 已提交
1924 1925 1926 1927
		return NULL;

	if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
		return NULL;
1928 1929

	if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
1930 1931 1932
		goto out_sock_release_nosk;

	sk = sock->sk;
1933

1934
	if (!cfg || cfg->groups < 32)
1935
		groups = 32;
1936 1937
	else
		groups = cfg->groups;
1938

1939
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
1940 1941 1942
	if (!listeners)
		goto out_sock_release;

L
Linus Torvalds 已提交
1943
	sk->sk_data_ready = netlink_data_ready;
1944 1945
	if (cfg && cfg->input)
		nlk_sk(sk)->netlink_rcv = cfg->input;
L
Linus Torvalds 已提交
1946

1947
	if (netlink_insert(sk, 0))
1948
		goto out_sock_release;
1949

1950
	nlk = nlk_sk(sk);
1951
	nlk->flags |= NETLINK_F_KERNEL_SOCKET;
1952 1953

	netlink_table_grab();
1954 1955
	if (!nl_table[unit].registered) {
		nl_table[unit].groups = groups;
1956
		rcu_assign_pointer(nl_table[unit].listeners, listeners);
1957 1958
		nl_table[unit].cb_mutex = cb_mutex;
		nl_table[unit].module = module;
1959 1960
		if (cfg) {
			nl_table[unit].bind = cfg->bind;
1961
			nl_table[unit].unbind = cfg->unbind;
1962
			nl_table[unit].flags = cfg->flags;
1963 1964
			if (cfg->compare)
				nl_table[unit].compare = cfg->compare;
1965
		}
1966
		nl_table[unit].registered = 1;
1967 1968
	} else {
		kfree(listeners);
1969
		nl_table[unit].registered++;
1970
	}
1971
	netlink_table_ungrab();
1972 1973
	return sk;

1974
out_sock_release:
1975
	kfree(listeners);
1976
	netlink_kernel_release(sk);
1977 1978 1979
	return NULL;

out_sock_release_nosk:
1980
	sock_release(sock);
1981
	return NULL;
L
Linus Torvalds 已提交
1982
}
1983
EXPORT_SYMBOL(__netlink_kernel_create);
1984 1985 1986 1987

void
netlink_kernel_release(struct sock *sk)
{
1988 1989 1990 1991
	if (sk == NULL || sk->sk_socket == NULL)
		return;

	sock_release(sk->sk_socket);
1992 1993 1994
}
EXPORT_SYMBOL(netlink_kernel_release);

1995
int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
1996
{
1997
	struct listeners *new, *old;
1998 1999 2000 2001 2002 2003
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];

	if (groups < 32)
		groups = 32;

	if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2004 2005
		new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
		if (!new)
2006
			return -ENOMEM;
2007
		old = nl_deref_protected(tbl->listeners);
2008 2009 2010
		memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
		rcu_assign_pointer(tbl->listeners, new);

2011
		kfree_rcu(old, rcu);
2012 2013 2014
	}
	tbl->groups = groups;

2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035
	return 0;
}

/**
 * netlink_change_ngroups - change number of multicast groups
 *
 * This changes the number of multicast groups that are available
 * on a certain netlink family. Note that it is not possible to
 * change the number of groups to below 32. Also note that it does
 * not implicitly call netlink_clear_multicast_users() when the
 * number of groups is reduced.
 *
 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
 * @groups: The new number of groups.
 */
int netlink_change_ngroups(struct sock *sk, unsigned int groups)
{
	int err;

	netlink_table_grab();
	err = __netlink_change_ngroups(sk, groups);
2036
	netlink_table_ungrab();
2037

2038 2039 2040
	return err;
}

2041 2042 2043 2044 2045
void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
{
	struct sock *sk;
	struct netlink_table *tbl = &nl_table[ksk->sk_protocol];

2046
	sk_for_each_bound(sk, &tbl->mc_list)
2047 2048 2049
		netlink_update_socket_mc(nlk_sk(sk), group, 0);
}

2050
struct nlmsghdr *
2051
__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2052 2053
{
	struct nlmsghdr *nlh;
2054
	int size = nlmsg_msg_size(len);
2055

2056
	nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2057 2058 2059
	nlh->nlmsg_type = type;
	nlh->nlmsg_len = size;
	nlh->nlmsg_flags = flags;
2060
	nlh->nlmsg_pid = portid;
2061 2062
	nlh->nlmsg_seq = seq;
	if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2063
		memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2064 2065 2066 2067
	return nlh;
}
EXPORT_SYMBOL(__nlmsg_put);

L
Linus Torvalds 已提交
2068 2069 2070 2071 2072 2073 2074 2075 2076
/*
 * It looks a bit ugly.
 * It would be better to create kernel thread.
 */

static int netlink_dump(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_callback *cb;
2077
	struct sk_buff *skb = NULL;
L
Linus Torvalds 已提交
2078
	struct nlmsghdr *nlh;
2079
	struct module *module;
2080
	int len, err = -ENOBUFS;
2081
	int alloc_min_size;
2082
	int alloc_size;
L
Linus Torvalds 已提交
2083

2084
	mutex_lock(nlk->cb_mutex);
2085
	if (!nlk->cb_running) {
2086 2087
		err = -EINVAL;
		goto errout_skb;
L
Linus Torvalds 已提交
2088 2089
	}

2090
	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2091
		goto errout_skb;
E
Eric Dumazet 已提交
2092 2093 2094 2095 2096 2097

	/* NLMSG_GOODSIZE is small to avoid high order allocations being
	 * required, but it makes sense to _attempt_ a 16K bytes allocation
	 * to reduce number of system calls on dump operations, if user
	 * ever provided a big enough buffer.
	 */
2098 2099 2100 2101 2102
	cb = &nlk->cb;
	alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);

	if (alloc_min_size < nlk->max_recvmsg_len) {
		alloc_size = nlk->max_recvmsg_len;
2103 2104 2105
		skb = alloc_skb(alloc_size,
				(GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) |
				__GFP_NOWARN | __GFP_NORETRY);
E
Eric Dumazet 已提交
2106
	}
2107 2108
	if (!skb) {
		alloc_size = alloc_min_size;
2109
		skb = alloc_skb(alloc_size, GFP_KERNEL);
2110
	}
2111
	if (!skb)
2112
		goto errout_skb;
2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123

	/* Trim skb to allocated size. User is expected to provide buffer as
	 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
	 * netlink_recvmsg())). dump will pack as many smaller messages as
	 * could fit within the allocated skb. skb is typically allocated
	 * with larger space than required (could be as much as near 2x the
	 * requested size with align to next power of 2 approach). Allowing
	 * dump to use the excess space makes it difficult for a user to have a
	 * reasonable static buffer based on the expected largest dump of a
	 * single netdev. The outcome is MSG_TRUNC error.
	 */
2124
	skb_reserve(skb, skb_tailroom(skb) - alloc_size);
2125
	netlink_skb_set_owner_r(skb, sk);
2126

L
Linus Torvalds 已提交
2127 2128 2129
	len = cb->dump(skb, cb);

	if (len > 0) {
2130
		mutex_unlock(nlk->cb_mutex);
2131 2132 2133

		if (sk_filter(sk, skb))
			kfree_skb(skb);
2134 2135
		else
			__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2136 2137 2138
		return 0;
	}

2139 2140 2141 2142
	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
	if (!nlh)
		goto errout_skb;

2143 2144
	nl_dump_check_consistent(cb, nlh);

2145 2146
	memcpy(nlmsg_data(nlh), &len, sizeof(len));

2147 2148
	if (sk_filter(sk, skb))
		kfree_skb(skb);
2149 2150
	else
		__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2151

2152 2153
	if (cb->done)
		cb->done(cb);
L
Linus Torvalds 已提交
2154

2155
	nlk->cb_running = false;
2156 2157
	module = cb->module;
	skb = cb->skb;
2158
	mutex_unlock(nlk->cb_mutex);
2159 2160
	module_put(module);
	consume_skb(skb);
L
Linus Torvalds 已提交
2161
	return 0;
2162

2163
errout_skb:
2164
	mutex_unlock(nlk->cb_mutex);
2165 2166
	kfree_skb(skb);
	return err;
L
Linus Torvalds 已提交
2167 2168
}

2169 2170 2171
int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
			 const struct nlmsghdr *nlh,
			 struct netlink_dump_control *control)
L
Linus Torvalds 已提交
2172 2173 2174 2175
{
	struct netlink_callback *cb;
	struct sock *sk;
	struct netlink_sock *nlk;
2176
	int ret;
L
Linus Torvalds 已提交
2177

2178
	atomic_inc(&skb->users);
2179

2180
	sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
2181
	if (sk == NULL) {
2182 2183
		ret = -ECONNREFUSED;
		goto error_free;
L
Linus Torvalds 已提交
2184
	}
2185

2186
	nlk = nlk_sk(sk);
2187
	mutex_lock(nlk->cb_mutex);
2188
	/* A dump is in progress... */
2189
	if (nlk->cb_running) {
2190
		ret = -EBUSY;
2191
		goto error_unlock;
L
Linus Torvalds 已提交
2192
	}
2193
	/* add reference of module which cb->dump belongs to */
2194
	if (!try_module_get(control->module)) {
2195
		ret = -EPROTONOSUPPORT;
2196
		goto error_unlock;
2197 2198
	}

2199 2200
	cb = &nlk->cb;
	memset(cb, 0, sizeof(*cb));
2201
	cb->start = control->start;
2202 2203 2204 2205 2206 2207 2208 2209 2210 2211
	cb->dump = control->dump;
	cb->done = control->done;
	cb->nlh = nlh;
	cb->data = control->data;
	cb->module = control->module;
	cb->min_dump_alloc = control->min_dump_alloc;
	cb->skb = skb;

	nlk->cb_running = true;

2212
	mutex_unlock(nlk->cb_mutex);
L
Linus Torvalds 已提交
2213

2214 2215 2216
	if (cb->start)
		cb->start(cb);

2217
	ret = netlink_dump(sk);
L
Linus Torvalds 已提交
2218
	sock_put(sk);
2219

2220 2221 2222
	if (ret)
		return ret;

2223 2224 2225 2226
	/* We successfully started a dump, by returning -EINTR we
	 * signal not to send ACK even if it was requested.
	 */
	return -EINTR;
2227 2228 2229 2230 2231 2232 2233

error_unlock:
	sock_put(sk);
	mutex_unlock(nlk->cb_mutex);
error_free:
	kfree_skb(skb);
	return ret;
L
Linus Torvalds 已提交
2234
}
2235
EXPORT_SYMBOL(__netlink_dump_start);
L
Linus Torvalds 已提交
2236 2237 2238 2239 2240 2241

void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
{
	struct sk_buff *skb;
	struct nlmsghdr *rep;
	struct nlmsgerr *errmsg;
2242
	size_t payload = sizeof(*errmsg);
2243
	struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
L
Linus Torvalds 已提交
2244

2245 2246 2247 2248
	/* Error messages get the original request appened, unless the user
	 * requests to cap the error message.
	 */
	if (!(nlk->flags & NETLINK_F_CAP_ACK) && err)
2249
		payload += nlmsg_len(nlh);
L
Linus Torvalds 已提交
2250

2251
	skb = nlmsg_new(payload, GFP_KERNEL);
L
Linus Torvalds 已提交
2252 2253 2254
	if (!skb) {
		struct sock *sk;

2255
		sk = netlink_lookup(sock_net(in_skb->sk),
2256
				    in_skb->sk->sk_protocol,
2257
				    NETLINK_CB(in_skb).portid);
L
Linus Torvalds 已提交
2258 2259 2260 2261 2262 2263 2264 2265
		if (sk) {
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
			sock_put(sk);
		}
		return;
	}

2266
	rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2267
			  NLMSG_ERROR, payload, 0);
2268
	errmsg = nlmsg_data(rep);
L
Linus Torvalds 已提交
2269
	errmsg->error = err;
2270
	memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
2271
	netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
L
Linus Torvalds 已提交
2272
}
2273
EXPORT_SYMBOL(netlink_ack);
L
Linus Torvalds 已提交
2274

2275
int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2276
						     struct nlmsghdr *))
2277 2278 2279 2280 2281
{
	struct nlmsghdr *nlh;
	int err;

	while (skb->len >= nlmsg_total_size(0)) {
2282 2283
		int msglen;

2284
		nlh = nlmsg_hdr(skb);
2285
		err = 0;
2286

2287
		if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2288 2289
			return 0;

2290 2291
		/* Only requests are handled by the kernel */
		if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2292
			goto ack;
2293 2294 2295

		/* Skip control messages */
		if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2296
			goto ack;
2297

2298
		err = cb(skb, nlh);
2299 2300 2301 2302
		if (err == -EINTR)
			goto skip;

ack:
2303
		if (nlh->nlmsg_flags & NLM_F_ACK || err)
2304 2305
			netlink_ack(skb, nlh, err);

2306
skip:
2307
		msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2308 2309 2310
		if (msglen > skb->len)
			msglen = skb->len;
		skb_pull(skb, msglen);
2311 2312 2313 2314
	}

	return 0;
}
2315
EXPORT_SYMBOL(netlink_rcv_skb);
2316

2317 2318 2319 2320
/**
 * nlmsg_notify - send a notification netlink message
 * @sk: netlink socket to use
 * @skb: notification message
2321
 * @portid: destination netlink portid for reports or 0
2322 2323 2324 2325
 * @group: destination multicast group or 0
 * @report: 1 to report back, 0 to disable
 * @flags: allocation flags
 */
2326
int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
2327 2328 2329 2330 2331
		 unsigned int group, int report, gfp_t flags)
{
	int err = 0;

	if (group) {
2332
		int exclude_portid = 0;
2333 2334 2335

		if (report) {
			atomic_inc(&skb->users);
2336
			exclude_portid = portid;
2337 2338
		}

2339 2340
		/* errors reported via destination sk->sk_err, but propagate
		 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
2341
		err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
2342 2343
	}

2344 2345 2346
	if (report) {
		int err2;

2347
		err2 = nlmsg_unicast(sk, skb, portid);
2348 2349 2350
		if (!err || err == -ESRCH)
			err = err2;
	}
2351 2352 2353

	return err;
}
2354
EXPORT_SYMBOL(nlmsg_notify);
2355

L
Linus Torvalds 已提交
2356 2357
#ifdef CONFIG_PROC_FS
struct nl_seq_iter {
2358
	struct seq_net_private p;
2359
	struct rhashtable_iter hti;
L
Linus Torvalds 已提交
2360 2361 2362
	int link;
};

2363
static int netlink_walk_start(struct nl_seq_iter *iter)
L
Linus Torvalds 已提交
2364
{
2365
	int err;
L
Linus Torvalds 已提交
2366

2367 2368
	err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti,
				   GFP_KERNEL);
2369 2370 2371
	if (err) {
		iter->link = MAX_LINKS;
		return err;
L
Linus Torvalds 已提交
2372
	}
2373 2374 2375

	err = rhashtable_walk_start(&iter->hti);
	return err == -EAGAIN ? 0 : err;
L
Linus Torvalds 已提交
2376 2377
}

2378
static void netlink_walk_stop(struct nl_seq_iter *iter)
L
Linus Torvalds 已提交
2379
{
2380 2381
	rhashtable_walk_stop(&iter->hti);
	rhashtable_walk_exit(&iter->hti);
L
Linus Torvalds 已提交
2382 2383
}

2384
static void *__netlink_seq_next(struct seq_file *seq)
L
Linus Torvalds 已提交
2385
{
2386
	struct nl_seq_iter *iter = seq->private;
2387
	struct netlink_sock *nlk;
L
Linus Torvalds 已提交
2388

2389 2390 2391
	do {
		for (;;) {
			int err;
L
Linus Torvalds 已提交
2392

2393
			nlk = rhashtable_walk_next(&iter->hti);
2394

2395 2396 2397
			if (IS_ERR(nlk)) {
				if (PTR_ERR(nlk) == -EAGAIN)
					continue;
2398

2399 2400
				return nlk;
			}
L
Linus Torvalds 已提交
2401

2402 2403
			if (nlk)
				break;
L
Linus Torvalds 已提交
2404

2405 2406 2407
			netlink_walk_stop(iter);
			if (++iter->link >= MAX_LINKS)
				return NULL;
2408

2409 2410 2411
			err = netlink_walk_start(iter);
			if (err)
				return ERR_PTR(err);
L
Linus Torvalds 已提交
2412
		}
2413
	} while (sock_net(&nlk->sk) != seq_file_net(seq));
L
Linus Torvalds 已提交
2414

2415 2416
	return nlk;
}
L
Linus Torvalds 已提交
2417

2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440
static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
{
	struct nl_seq_iter *iter = seq->private;
	void *obj = SEQ_START_TOKEN;
	loff_t pos;
	int err;

	iter->link = 0;

	err = netlink_walk_start(iter);
	if (err)
		return ERR_PTR(err);

	for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
		obj = __netlink_seq_next(seq);

	return obj;
}

static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	++*pos;
	return __netlink_seq_next(seq);
L
Linus Torvalds 已提交
2441 2442 2443 2444
}

static void netlink_seq_stop(struct seq_file *seq, void *v)
{
2445 2446 2447 2448 2449 2450
	struct nl_seq_iter *iter = seq->private;

	if (iter->link >= MAX_LINKS)
		return;

	netlink_walk_stop(iter);
L
Linus Torvalds 已提交
2451 2452 2453 2454 2455
}


static int netlink_seq_show(struct seq_file *seq, void *v)
{
E
Eric Dumazet 已提交
2456
	if (v == SEQ_START_TOKEN) {
L
Linus Torvalds 已提交
2457 2458
		seq_puts(seq,
			 "sk       Eth Pid    Groups   "
2459
			 "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
E
Eric Dumazet 已提交
2460
	} else {
L
Linus Torvalds 已提交
2461 2462 2463
		struct sock *s = v;
		struct netlink_sock *nlk = nlk_sk(s);

2464
		seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
L
Linus Torvalds 已提交
2465 2466
			   s,
			   s->sk_protocol,
2467
			   nlk->portid,
2468
			   nlk->groups ? (u32)nlk->groups[0] : 0,
2469 2470
			   sk_rmem_alloc_get(s),
			   sk_wmem_alloc_get(s),
2471
			   nlk->cb_running,
2472
			   atomic_read(&s->sk_refcnt),
2473 2474
			   atomic_read(&s->sk_drops),
			   sock_i_ino(s)
L
Linus Torvalds 已提交
2475 2476 2477 2478 2479 2480
			);

	}
	return 0;
}

2481
static const struct seq_operations netlink_seq_ops = {
L
Linus Torvalds 已提交
2482 2483 2484 2485 2486 2487 2488 2489 2490
	.start  = netlink_seq_start,
	.next   = netlink_seq_next,
	.stop   = netlink_seq_stop,
	.show   = netlink_seq_show,
};


static int netlink_seq_open(struct inode *inode, struct file *file)
{
2491 2492
	return seq_open_net(inode, file, &netlink_seq_ops,
				sizeof(struct nl_seq_iter));
2493 2494
}

2495
static const struct file_operations netlink_seq_fops = {
L
Linus Torvalds 已提交
2496 2497 2498 2499
	.owner		= THIS_MODULE,
	.open		= netlink_seq_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
2500
	.release	= seq_release_net,
L
Linus Torvalds 已提交
2501 2502 2503 2504 2505 2506
};

#endif

int netlink_register_notifier(struct notifier_block *nb)
{
2507
	return atomic_notifier_chain_register(&netlink_chain, nb);
L
Linus Torvalds 已提交
2508
}
2509
EXPORT_SYMBOL(netlink_register_notifier);
L
Linus Torvalds 已提交
2510 2511 2512

int netlink_unregister_notifier(struct notifier_block *nb)
{
2513
	return atomic_notifier_chain_unregister(&netlink_chain, nb);
L
Linus Torvalds 已提交
2514
}
2515
EXPORT_SYMBOL(netlink_unregister_notifier);
2516

2517
static const struct proto_ops netlink_ops = {
L
Linus Torvalds 已提交
2518 2519 2520 2521 2522 2523 2524 2525
	.family =	PF_NETLINK,
	.owner =	THIS_MODULE,
	.release =	netlink_release,
	.bind =		netlink_bind,
	.connect =	netlink_connect,
	.socketpair =	sock_no_socketpair,
	.accept =	sock_no_accept,
	.getname =	netlink_getname,
2526
	.poll =		datagram_poll,
2527
	.ioctl =	netlink_ioctl,
L
Linus Torvalds 已提交
2528 2529
	.listen =	sock_no_listen,
	.shutdown =	sock_no_shutdown,
2530 2531
	.setsockopt =	netlink_setsockopt,
	.getsockopt =	netlink_getsockopt,
L
Linus Torvalds 已提交
2532 2533
	.sendmsg =	netlink_sendmsg,
	.recvmsg =	netlink_recvmsg,
2534
	.mmap =		sock_no_mmap,
L
Linus Torvalds 已提交
2535 2536 2537
	.sendpage =	sock_no_sendpage,
};

2538
static const struct net_proto_family netlink_family_ops = {
L
Linus Torvalds 已提交
2539 2540 2541 2542 2543
	.family = PF_NETLINK,
	.create = netlink_create,
	.owner	= THIS_MODULE,	/* for consistency 8) */
};

2544
static int __net_init netlink_net_init(struct net *net)
2545 2546
{
#ifdef CONFIG_PROC_FS
2547
	if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
2548 2549 2550 2551 2552
		return -ENOMEM;
#endif
	return 0;
}

2553
static void __net_exit netlink_net_exit(struct net *net)
2554 2555
{
#ifdef CONFIG_PROC_FS
2556
	remove_proc_entry("netlink", net->proc_net);
2557 2558 2559
#endif
}

2560 2561
static void __init netlink_add_usersock_entry(void)
{
2562
	struct listeners *listeners;
2563 2564
	int groups = 32;

2565
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2566
	if (!listeners)
2567
		panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
2568 2569 2570 2571

	netlink_table_grab();

	nl_table[NETLINK_USERSOCK].groups = groups;
2572
	rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
2573 2574
	nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
	nl_table[NETLINK_USERSOCK].registered = 1;
2575
	nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
2576 2577 2578 2579

	netlink_table_ungrab();
}

2580
static struct pernet_operations __net_initdata netlink_net_ops = {
2581 2582 2583 2584
	.init = netlink_net_init,
	.exit = netlink_net_exit,
};

2585
static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
2586 2587 2588 2589
{
	const struct netlink_sock *nlk = data;
	struct netlink_compare_arg arg;

2590
	netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
2591
	return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
2592 2593 2594 2595 2596 2597 2598
}

static const struct rhashtable_params netlink_rhashtable_params = {
	.head_offset = offsetof(struct netlink_sock, node),
	.key_len = netlink_compare_arg_len,
	.obj_hashfn = netlink_hash,
	.obj_cmpfn = netlink_compare,
2599
	.automatic_shrinking = true,
2600 2601
};

L
Linus Torvalds 已提交
2602 2603 2604 2605 2606 2607 2608 2609
static int __init netlink_proto_init(void)
{
	int i;
	int err = proto_register(&netlink_proto, 0);

	if (err != 0)
		goto out;

2610
	BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
L
Linus Torvalds 已提交
2611

2612
	nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
2613 2614
	if (!nl_table)
		goto panic;
L
Linus Torvalds 已提交
2615 2616

	for (i = 0; i < MAX_LINKS; i++) {
2617 2618
		if (rhashtable_init(&nl_table[i].hash,
				    &netlink_rhashtable_params) < 0) {
2619 2620
			while (--i > 0)
				rhashtable_destroy(&nl_table[i].hash);
L
Linus Torvalds 已提交
2621
			kfree(nl_table);
2622
			goto panic;
L
Linus Torvalds 已提交
2623 2624 2625
		}
	}

2626 2627
	INIT_LIST_HEAD(&netlink_tap_all);

2628 2629
	netlink_add_usersock_entry();

L
Linus Torvalds 已提交
2630
	sock_register(&netlink_family_ops);
2631
	register_pernet_subsys(&netlink_net_ops);
2632
	/* The netlink device handler may be needed early. */
L
Linus Torvalds 已提交
2633 2634 2635
	rtnetlink_init();
out:
	return err;
2636 2637
panic:
	panic("netlink_init: Cannot allocate nl_table\n");
L
Linus Torvalds 已提交
2638 2639 2640
}

core_initcall(netlink_proto_init);