af_netlink.c 60.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 * NETLINK      Kernel-user communication protocol.
 *
4
 * 		Authors:	Alan Cox <alan@lxorguk.ukuu.org.uk>
L
Linus Torvalds 已提交
5
 * 				Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6
 * 				Patrick McHardy <kaber@trash.net>
L
Linus Torvalds 已提交
7 8 9 10 11
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
12
 *
L
Linus Torvalds 已提交
13 14 15 16
 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
 *                               added netlink_proto_exit
 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
 * 				 use nlk_sk, as sk->protinfo is on a diet 8)
17 18 19 20 21 22
 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
 * 				 - inc module use count of module that owns
 * 				   the kernel socket in case userspace opens
 * 				   socket of same protocol
 * 				 - remove all module support, since netlink is
 * 				   mandatory if CONFIG_NET=y these days
L
Linus Torvalds 已提交
23 24 25 26
 */

#include <linux/module.h>

27
#include <linux/capability.h>
L
Linus Torvalds 已提交
28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/signal.h>
#include <linux/sched.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/un.h>
#include <linux/fcntl.h>
#include <linux/termios.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/notifier.h>
#include <linux/security.h>
#include <linux/jhash.h>
#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/bitops.h>
#include <linux/mm.h>
#include <linux/types.h>
A
Andrew Morton 已提交
57
#include <linux/audit.h>
58
#include <linux/mutex.h>
59
#include <linux/vmalloc.h>
60
#include <linux/if_arp.h>
61
#include <linux/rhashtable.h>
62
#include <asm/cacheflush.h>
63
#include <linux/hash.h>
64
#include <linux/genetlink.h>
A
Andrew Morton 已提交
65

66
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
67 68
#include <net/sock.h>
#include <net/scm.h>
69
#include <net/netlink.h>
L
Linus Torvalds 已提交
70

71
#include "af_netlink.h"
L
Linus Torvalds 已提交
72

73 74 75
struct listeners {
	struct rcu_head		rcu;
	unsigned long		masks[0];
76 77
};

78
/* state bits */
79
#define NETLINK_S_CONGESTED		0x0
80 81

/* flags */
82 83 84 85
#define NETLINK_F_KERNEL_SOCKET		0x1
#define NETLINK_F_RECV_PKTINFO		0x2
#define NETLINK_F_BROADCAST_SEND_ERROR	0x4
#define NETLINK_F_RECV_NO_ENOBUFS	0x8
86
#define NETLINK_F_LISTEN_ALL_NSID	0x10
87
#define NETLINK_F_CAP_ACK		0x20
88

89
static inline int netlink_is_kernel(struct sock *sk)
90
{
91
	return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
92 93
}

94
struct netlink_table *nl_table __read_mostly;
95
EXPORT_SYMBOL_GPL(nl_table);
L
Linus Torvalds 已提交
96 97 98 99

static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);

static int netlink_dump(struct sock *sk);
100
static void netlink_skb_destructor(struct sk_buff *skb);
L
Linus Torvalds 已提交
101

102
/* nl_table locking explained:
103
 * Lookup and traversal are protected with an RCU read-side lock. Insertion
Y
Ying Xue 已提交
104
 * and removal are protected with per bucket lock while using RCU list
105 106 107 108
 * modification primitives and may run in parallel to RCU protected lookups.
 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
 * been acquired * either during or after the socket has been removed from
 * the list and after an RCU grace period.
109
 */
110 111
DEFINE_RWLOCK(nl_table_lock);
EXPORT_SYMBOL_GPL(nl_table_lock);
L
Linus Torvalds 已提交
112 113
static atomic_t nl_table_users = ATOMIC_INIT(0);

114 115
#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));

116
static ATOMIC_NOTIFIER_HEAD(netlink_chain);
L
Linus Torvalds 已提交
117

118 119 120
static DEFINE_SPINLOCK(netlink_tap_lock);
static struct list_head netlink_tap_all __read_mostly;

121 122
static const struct rhashtable_params netlink_rhashtable_params;

123
static inline u32 netlink_group_mask(u32 group)
124 125 126 127
{
	return group ? 1 << (group - 1) : 0;
}

128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145
static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
					   gfp_t gfp_mask)
{
	unsigned int len = skb_end_offset(skb);
	struct sk_buff *new;

	new = alloc_skb(len, gfp_mask);
	if (new == NULL)
		return NULL;

	NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
	NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
	NETLINK_CB(new).creds = NETLINK_CB(skb).creds;

	memcpy(skb_put(new, len), skb->data, len);
	return new;
}

146 147 148 149 150 151 152 153 154
int netlink_add_tap(struct netlink_tap *nt)
{
	if (unlikely(nt->dev->type != ARPHRD_NETLINK))
		return -EINVAL;

	spin_lock(&netlink_tap_lock);
	list_add_rcu(&nt->list, &netlink_tap_all);
	spin_unlock(&netlink_tap_lock);

155
	__module_get(nt->module);
156 157 158 159 160

	return 0;
}
EXPORT_SYMBOL_GPL(netlink_add_tap);

161
static int __netlink_remove_tap(struct netlink_tap *nt)
162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179
{
	bool found = false;
	struct netlink_tap *tmp;

	spin_lock(&netlink_tap_lock);

	list_for_each_entry(tmp, &netlink_tap_all, list) {
		if (nt == tmp) {
			list_del_rcu(&nt->list);
			found = true;
			goto out;
		}
	}

	pr_warn("__netlink_remove_tap: %p not found\n", nt);
out:
	spin_unlock(&netlink_tap_lock);

180
	if (found)
181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
		module_put(nt->module);

	return found ? 0 : -ENODEV;
}

int netlink_remove_tap(struct netlink_tap *nt)
{
	int ret;

	ret = __netlink_remove_tap(nt);
	synchronize_net();

	return ret;
}
EXPORT_SYMBOL_GPL(netlink_remove_tap);

197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212
static bool netlink_filter_tap(const struct sk_buff *skb)
{
	struct sock *sk = skb->sk;

	/* We take the more conservative approach and
	 * whitelist socket protocols that may pass.
	 */
	switch (sk->sk_protocol) {
	case NETLINK_ROUTE:
	case NETLINK_USERSOCK:
	case NETLINK_SOCK_DIAG:
	case NETLINK_NFLOG:
	case NETLINK_XFRM:
	case NETLINK_FIB_LOOKUP:
	case NETLINK_NETFILTER:
	case NETLINK_GENERIC:
V
Varka Bhadram 已提交
213
		return true;
214 215
	}

V
Varka Bhadram 已提交
216
	return false;
217 218
}

219 220 221 222
static int __netlink_deliver_tap_skb(struct sk_buff *skb,
				     struct net_device *dev)
{
	struct sk_buff *nskb;
223
	struct sock *sk = skb->sk;
224 225 226
	int ret = -ENOMEM;

	dev_hold(dev);
227

228
	if (is_vmalloc_addr(skb->head))
229 230 231
		nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
	else
		nskb = skb_clone(skb, GFP_ATOMIC);
232 233
	if (nskb) {
		nskb->dev = dev;
234
		nskb->protocol = htons((u16) sk->sk_protocol);
235 236
		nskb->pkt_type = netlink_is_kernel(sk) ?
				 PACKET_KERNEL : PACKET_USER;
237
		skb_reset_network_header(nskb);
238 239 240 241 242 243 244 245 246 247 248 249 250 251
		ret = dev_queue_xmit(nskb);
		if (unlikely(ret > 0))
			ret = net_xmit_errno(ret);
	}

	dev_put(dev);
	return ret;
}

static void __netlink_deliver_tap(struct sk_buff *skb)
{
	int ret;
	struct netlink_tap *tmp;

252 253 254
	if (!netlink_filter_tap(skb))
		return;

255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271
	list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
		ret = __netlink_deliver_tap_skb(skb, tmp->dev);
		if (unlikely(ret))
			break;
	}
}

static void netlink_deliver_tap(struct sk_buff *skb)
{
	rcu_read_lock();

	if (unlikely(!list_empty(&netlink_tap_all)))
		__netlink_deliver_tap(skb);

	rcu_read_unlock();
}

272 273 274 275 276 277 278
static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
				       struct sk_buff *skb)
{
	if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
		netlink_deliver_tap(skb);
}

279 280 281 282
static void netlink_overrun(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

283 284 285
	if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
		if (!test_and_set_bit(NETLINK_S_CONGESTED,
				      &nlk_sk(sk)->state)) {
286 287 288 289 290 291 292 293 294 295 296 297
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
		}
	}
	atomic_inc(&sk->sk_drops);
}

static void netlink_rcv_wake(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (skb_queue_empty(&sk->sk_receive_queue))
298 299
		clear_bit(NETLINK_S_CONGESTED, &nlk->state);
	if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
300 301 302
		wake_up_interruptible(&nlk->wait);
}

303 304
static void netlink_skb_destructor(struct sk_buff *skb)
{
305
	if (is_vmalloc_addr(skb->head)) {
306 307 308 309
		if (!skb->cloned ||
		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
			vfree(skb->head);

310 311
		skb->head = NULL;
	}
312 313
	if (skb->sk != NULL)
		sock_rfree(skb);
314 315 316 317 318 319 320 321 322 323 324
}

static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
{
	WARN_ON(skb->sk != NULL);
	skb->sk = sk;
	skb->destructor = netlink_skb_destructor;
	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
	sk_mem_charge(sk, skb->truesize);
}

L
Linus Torvalds 已提交
325 326
static void netlink_sock_destruct(struct sock *sk)
{
327 328
	struct netlink_sock *nlk = nlk_sk(sk);

329 330 331
	if (nlk->cb_running) {
		if (nlk->cb.done)
			nlk->cb.done(&nlk->cb);
332

333 334
		module_put(nlk->cb.module);
		kfree_skb(nlk->cb.skb);
335 336
	}

L
Linus Torvalds 已提交
337 338 339
	skb_queue_purge(&sk->sk_receive_queue);

	if (!sock_flag(sk, SOCK_DEAD)) {
340
		printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
L
Linus Torvalds 已提交
341 342
		return;
	}
343 344 345 346

	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
	WARN_ON(atomic_read(&sk->sk_wmem_alloc));
	WARN_ON(nlk_sk(sk)->groups);
L
Linus Torvalds 已提交
347 348
}

349 350
/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
 * SMP. Look, when several writers sleep and reader wakes them up, all but one
L
Linus Torvalds 已提交
351 352 353 354
 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
 * this, _but_ remember, it adds useless work on UP machines.
 */

355
void netlink_table_grab(void)
356
	__acquires(nl_table_lock)
L
Linus Torvalds 已提交
357
{
358 359
	might_sleep();

360
	write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
361 362 363 364 365

	if (atomic_read(&nl_table_users)) {
		DECLARE_WAITQUEUE(wait, current);

		add_wait_queue_exclusive(&nl_table_wait, &wait);
366
		for (;;) {
L
Linus Torvalds 已提交
367 368 369
			set_current_state(TASK_UNINTERRUPTIBLE);
			if (atomic_read(&nl_table_users) == 0)
				break;
370
			write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
371
			schedule();
372
			write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
373 374 375 376 377 378 379
		}

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nl_table_wait, &wait);
	}
}

380
void netlink_table_ungrab(void)
381
	__releases(nl_table_lock)
L
Linus Torvalds 已提交
382
{
383
	write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
384 385 386
	wake_up(&nl_table_wait);
}

387
static inline void
L
Linus Torvalds 已提交
388 389 390 391 392 393 394 395 396
netlink_lock_table(void)
{
	/* read_lock() synchronizes us to netlink_table_grab */

	read_lock(&nl_table_lock);
	atomic_inc(&nl_table_users);
	read_unlock(&nl_table_lock);
}

397
static inline void
L
Linus Torvalds 已提交
398 399 400 401 402 403
netlink_unlock_table(void)
{
	if (atomic_dec_and_test(&nl_table_users))
		wake_up(&nl_table_wait);
}

404
struct netlink_compare_arg
L
Linus Torvalds 已提交
405
{
406
	possible_net_t pnet;
407 408
	u32 portid;
};
L
Linus Torvalds 已提交
409

410 411 412
/* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
#define netlink_compare_arg_len \
	(offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
413 414 415

static inline int netlink_compare(struct rhashtable_compare_arg *arg,
				  const void *ptr)
L
Linus Torvalds 已提交
416
{
417 418
	const struct netlink_compare_arg *x = arg->key;
	const struct netlink_sock *nlk = ptr;
L
Linus Torvalds 已提交
419

420
	return nlk->portid != x->portid ||
421 422 423 424 425 426 427 428 429
	       !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
}

static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
				     struct net *net, u32 portid)
{
	memset(arg, 0, sizeof(*arg));
	write_pnet(&arg->pnet, net);
	arg->portid = portid;
L
Linus Torvalds 已提交
430 431
}

432 433
static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
				     struct net *net)
L
Linus Torvalds 已提交
434
{
435
	struct netlink_compare_arg arg;
L
Linus Torvalds 已提交
436

437 438 439
	netlink_compare_arg_init(&arg, net, portid);
	return rhashtable_lookup_fast(&table->hash, &arg,
				      netlink_rhashtable_params);
L
Linus Torvalds 已提交
440 441
}

442
static int __netlink_insert(struct netlink_table *table, struct sock *sk)
Y
Ying Xue 已提交
443
{
444
	struct netlink_compare_arg arg;
Y
Ying Xue 已提交
445

446
	netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
447 448 449
	return rhashtable_lookup_insert_key(&table->hash, &arg,
					    &nlk_sk(sk)->node,
					    netlink_rhashtable_params);
Y
Ying Xue 已提交
450 451
}

452
static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
L
Linus Torvalds 已提交
453
{
454 455
	struct netlink_table *table = &nl_table[protocol];
	struct sock *sk;
L
Linus Torvalds 已提交
456

457 458 459 460 461
	rcu_read_lock();
	sk = __netlink_lookup(table, portid, net);
	if (sk)
		sock_hold(sk);
	rcu_read_unlock();
L
Linus Torvalds 已提交
462

463
	return sk;
L
Linus Torvalds 已提交
464 465
}

466
static const struct proto_ops netlink_ops;
L
Linus Torvalds 已提交
467

468 469 470 471 472 473
static void
netlink_update_listeners(struct sock *sk)
{
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];
	unsigned long mask;
	unsigned int i;
474 475 476 477 478
	struct listeners *listeners;

	listeners = nl_deref_protected(tbl->listeners);
	if (!listeners)
		return;
479

480
	for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
481
		mask = 0;
482
		sk_for_each_bound(sk, &tbl->mc_list) {
483 484 485
			if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
				mask |= nlk_sk(sk)->groups[i];
		}
486
		listeners->masks[i] = mask;
487 488 489 490 491
	}
	/* this function is only called with the netlink table "grabbed", which
	 * makes sure updates are visible before bind or setsockopt return. */
}

492
static int netlink_insert(struct sock *sk, u32 portid)
L
Linus Torvalds 已提交
493
{
494
	struct netlink_table *table = &nl_table[sk->sk_protocol];
495
	int err;
L
Linus Torvalds 已提交
496

Y
Ying Xue 已提交
497
	lock_sock(sk);
L
Linus Torvalds 已提交
498

499 500
	err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
	if (nlk_sk(sk)->bound)
L
Linus Torvalds 已提交
501 502 503
		goto err;

	err = -ENOMEM;
504 505
	if (BITS_PER_LONG > 32 &&
	    unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
L
Linus Torvalds 已提交
506 507
		goto err;

508
	nlk_sk(sk)->portid = portid;
509
	sock_hold(sk);
510

511 512
	err = __netlink_insert(table, sk);
	if (err) {
513 514 515 516 517
		/* In case the hashtable backend returns with -EBUSY
		 * from here, it must not escape to the caller.
		 */
		if (unlikely(err == -EBUSY))
			err = -EOVERFLOW;
518 519
		if (err == -EEXIST)
			err = -EADDRINUSE;
Y
Ying Xue 已提交
520
		sock_put(sk);
521
		goto err;
522 523
	}

524 525 526
	/* We need to ensure that the socket is hashed and visible. */
	smp_wmb();
	nlk_sk(sk)->bound = portid;
527

L
Linus Torvalds 已提交
528
err:
Y
Ying Xue 已提交
529
	release_sock(sk);
L
Linus Torvalds 已提交
530 531 532 533 534
	return err;
}

static void netlink_remove(struct sock *sk)
{
535 536 537
	struct netlink_table *table;

	table = &nl_table[sk->sk_protocol];
538 539
	if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
				    netlink_rhashtable_params)) {
540 541 542 543
		WARN_ON(atomic_read(&sk->sk_refcnt) == 1);
		__sock_put(sk);
	}

L
Linus Torvalds 已提交
544
	netlink_table_grab();
545
	if (nlk_sk(sk)->subscriptions) {
L
Linus Torvalds 已提交
546
		__sk_del_bind_node(sk);
547 548
		netlink_update_listeners(sk);
	}
549 550
	if (sk->sk_protocol == NETLINK_GENERIC)
		atomic_inc(&genl_sk_destructing_cnt);
L
Linus Torvalds 已提交
551 552 553 554 555 556 557 558 559
	netlink_table_ungrab();
}

static struct proto netlink_proto = {
	.name	  = "NETLINK",
	.owner	  = THIS_MODULE,
	.obj_size = sizeof(struct netlink_sock),
};

560
static int __netlink_create(struct net *net, struct socket *sock,
561 562
			    struct mutex *cb_mutex, int protocol,
			    int kern)
L
Linus Torvalds 已提交
563 564 565
{
	struct sock *sk;
	struct netlink_sock *nlk;
566 567 568

	sock->ops = &netlink_ops;

569
	sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
570 571 572 573 574 575
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	nlk = nlk_sk(sk);
E
Eric Dumazet 已提交
576
	if (cb_mutex) {
577
		nlk->cb_mutex = cb_mutex;
E
Eric Dumazet 已提交
578
	} else {
579 580 581
		nlk->cb_mutex = &nlk->cb_def_mutex;
		mutex_init(nlk->cb_mutex);
	}
582 583 584 585 586 587 588
	init_waitqueue_head(&nlk->wait);

	sk->sk_destruct = netlink_sock_destruct;
	sk->sk_protocol = protocol;
	return 0;
}

589 590
static int netlink_create(struct net *net, struct socket *sock, int protocol,
			  int kern)
591 592
{
	struct module *module = NULL;
593
	struct mutex *cb_mutex;
594
	struct netlink_sock *nlk;
595 596
	int (*bind)(struct net *net, int group);
	void (*unbind)(struct net *net, int group);
597
	int err = 0;
L
Linus Torvalds 已提交
598 599 600 601 602 603

	sock->state = SS_UNCONNECTED;

	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
		return -ESOCKTNOSUPPORT;

604
	if (protocol < 0 || protocol >= MAX_LINKS)
L
Linus Torvalds 已提交
605 606
		return -EPROTONOSUPPORT;

607
	netlink_lock_table();
608
#ifdef CONFIG_MODULES
609
	if (!nl_table[protocol].registered) {
610
		netlink_unlock_table();
611
		request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
612
		netlink_lock_table();
613
	}
614 615 616 617
#endif
	if (nl_table[protocol].registered &&
	    try_module_get(nl_table[protocol].module))
		module = nl_table[protocol].module;
618 619
	else
		err = -EPROTONOSUPPORT;
620
	cb_mutex = nl_table[protocol].cb_mutex;
621
	bind = nl_table[protocol].bind;
622
	unbind = nl_table[protocol].unbind;
623
	netlink_unlock_table();
624

625 626 627
	if (err < 0)
		goto out;

628
	err = __netlink_create(net, sock, cb_mutex, protocol, kern);
629
	if (err < 0)
630 631
		goto out_module;

632
	local_bh_disable();
633
	sock_prot_inuse_add(net, &netlink_proto, 1);
634 635
	local_bh_enable();

636 637
	nlk = nlk_sk(sock->sk);
	nlk->module = module;
638
	nlk->netlink_bind = bind;
639
	nlk->netlink_unbind = unbind;
640 641
out:
	return err;
L
Linus Torvalds 已提交
642

643 644 645
out_module:
	module_put(module);
	goto out;
L
Linus Torvalds 已提交
646 647
}

648 649 650 651 652 653 654
static void deferred_put_nlk_sk(struct rcu_head *head)
{
	struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);

	sock_put(&nlk->sk);
}

L
Linus Torvalds 已提交
655 656 657 658 659 660 661 662 663
static int netlink_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk;

	if (!sk)
		return 0;

	netlink_remove(sk);
664
	sock_orphan(sk);
L
Linus Torvalds 已提交
665 666
	nlk = nlk_sk(sk);

667 668 669 670
	/*
	 * OK. Socket is unlinked, any packets that arrive now
	 * will be purged.
	 */
L
Linus Torvalds 已提交
671

672 673 674 675 676 677 678 679 680 681 682 683 684 685
	/* must not acquire netlink_table_lock in any way again before unbind
	 * and notifying genetlink is done as otherwise it might deadlock
	 */
	if (nlk->netlink_unbind) {
		int i;

		for (i = 0; i < nlk->ngroups; i++)
			if (test_bit(i, nlk->groups))
				nlk->netlink_unbind(sock_net(sk), i + 1);
	}
	if (sk->sk_protocol == NETLINK_GENERIC &&
	    atomic_dec_return(&genl_sk_destructing_cnt) == 0)
		wake_up(&genl_sk_destructing_waitq);

L
Linus Torvalds 已提交
686 687 688 689 690
	sock->sk = NULL;
	wake_up_interruptible_all(&nlk->wait);

	skb_queue_purge(&sk->sk_write_queue);

691
	if (nlk->portid && nlk->bound) {
L
Linus Torvalds 已提交
692
		struct netlink_notify n = {
693
						.net = sock_net(sk),
L
Linus Torvalds 已提交
694
						.protocol = sk->sk_protocol,
695
						.portid = nlk->portid,
L
Linus Torvalds 已提交
696
					  };
697 698
		atomic_notifier_call_chain(&netlink_chain,
				NETLINK_URELEASE, &n);
699
	}
700

701
	module_put(nlk->module);
702

703
	if (netlink_is_kernel(sk)) {
704
		netlink_table_grab();
705 706
		BUG_ON(nl_table[sk->sk_protocol].registered == 0);
		if (--nl_table[sk->sk_protocol].registered == 0) {
707 708 709 710 711
			struct listeners *old;

			old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
			RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
			kfree_rcu(old, rcu);
712
			nl_table[sk->sk_protocol].module = NULL;
713
			nl_table[sk->sk_protocol].bind = NULL;
714
			nl_table[sk->sk_protocol].unbind = NULL;
715
			nl_table[sk->sk_protocol].flags = 0;
716 717
			nl_table[sk->sk_protocol].registered = 0;
		}
718
		netlink_table_ungrab();
E
Eric Dumazet 已提交
719
	}
720

721 722 723
	kfree(nlk->groups);
	nlk->groups = NULL;

724
	local_bh_disable();
725
	sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
726
	local_bh_enable();
727
	call_rcu(&nlk->rcu, deferred_put_nlk_sk);
L
Linus Torvalds 已提交
728 729 730 731 732 733
	return 0;
}

static int netlink_autobind(struct socket *sock)
{
	struct sock *sk = sock->sk;
734
	struct net *net = sock_net(sk);
735
	struct netlink_table *table = &nl_table[sk->sk_protocol];
736
	s32 portid = task_tgid_vnr(current);
L
Linus Torvalds 已提交
737
	int err;
H
Herbert Xu 已提交
738 739
	s32 rover = -4096;
	bool ok;
L
Linus Torvalds 已提交
740 741 742

retry:
	cond_resched();
743
	rcu_read_lock();
H
Herbert Xu 已提交
744 745 746
	ok = !__netlink_lookup(table, portid, net);
	rcu_read_unlock();
	if (!ok) {
747
		/* Bind collision, search negative portid values. */
H
Herbert Xu 已提交
748 749 750 751
		if (rover == -4096)
			/* rover will be in range [S32_MIN, -4097] */
			rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
		else if (rover >= -4096)
752
			rover = -4097;
H
Herbert Xu 已提交
753
		portid = rover--;
754
		goto retry;
L
Linus Torvalds 已提交
755 756
	}

757
	err = netlink_insert(sk, portid);
L
Linus Torvalds 已提交
758 759
	if (err == -EADDRINUSE)
		goto retry;
760 761 762 763 764 765

	/* If 2 threads race to autobind, that is fine.  */
	if (err == -EBUSY)
		err = 0;

	return err;
L
Linus Torvalds 已提交
766 767
}

768 769 770 771 772 773 774 775 776 777 778 779 780
/**
 * __netlink_ns_capable - General netlink message capability test
 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in the user namespace @user_ns.
 */
bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
			struct user_namespace *user_ns, int cap)
{
781 782 783
	return ((nsp->flags & NETLINK_SKB_DST) ||
		file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
		ns_capable(user_ns, cap);
784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834
}
EXPORT_SYMBOL(__netlink_ns_capable);

/**
 * netlink_ns_capable - General netlink message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in the user namespace @user_ns.
 */
bool netlink_ns_capable(const struct sk_buff *skb,
			struct user_namespace *user_ns, int cap)
{
	return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
}
EXPORT_SYMBOL(netlink_ns_capable);

/**
 * netlink_capable - Netlink global message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap in all user namespaces.
 */
bool netlink_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, &init_user_ns, cap);
}
EXPORT_SYMBOL(netlink_capable);

/**
 * netlink_net_capable - Netlink network namespace message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has has the capability @cap over the network namespace of
 * the socket we received the message from.
 */
bool netlink_net_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
}
EXPORT_SYMBOL(netlink_net_capable);

835
static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
836
{
837
	return (nl_table[sock->sk->sk_protocol].flags & flag) ||
838
		ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
839
}
L
Linus Torvalds 已提交
840

841 842 843 844 845 846 847 848 849 850 851 852
static void
netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (nlk->subscriptions && !subscriptions)
		__sk_del_bind_node(sk);
	else if (!nlk->subscriptions && subscriptions)
		sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
	nlk->subscriptions = subscriptions;
}

853
static int netlink_realloc_groups(struct sock *sk)
854 855 856
{
	struct netlink_sock *nlk = nlk_sk(sk);
	unsigned int groups;
857
	unsigned long *new_groups;
858 859
	int err = 0;

860 861
	netlink_table_grab();

862
	groups = nl_table[sk->sk_protocol].groups;
863
	if (!nl_table[sk->sk_protocol].registered) {
864
		err = -ENOENT;
865 866
		goto out_unlock;
	}
867

868 869
	if (nlk->ngroups >= groups)
		goto out_unlock;
870

871 872 873 874 875
	new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
	if (new_groups == NULL) {
		err = -ENOMEM;
		goto out_unlock;
	}
876
	memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
877 878 879
	       NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));

	nlk->groups = new_groups;
880
	nlk->ngroups = groups;
881 882 883
 out_unlock:
	netlink_table_ungrab();
	return err;
884 885
}

886
static void netlink_undo_bind(int group, long unsigned int groups,
887
			      struct sock *sk)
888
{
889
	struct netlink_sock *nlk = nlk_sk(sk);
890 891 892 893 894 895
	int undo;

	if (!nlk->netlink_unbind)
		return;

	for (undo = 0; undo < group; undo++)
896
		if (test_bit(undo, &groups))
897
			nlk->netlink_unbind(sock_net(sk), undo + 1);
898 899
}

900 901
static int netlink_bind(struct socket *sock, struct sockaddr *addr,
			int addr_len)
L
Linus Torvalds 已提交
902 903
{
	struct sock *sk = sock->sk;
904
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
905 906 907
	struct netlink_sock *nlk = nlk_sk(sk);
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
	int err;
908
	long unsigned int groups = nladdr->nl_groups;
909
	bool bound;
910

911 912 913
	if (addr_len < sizeof(struct sockaddr_nl))
		return -EINVAL;

L
Linus Torvalds 已提交
914 915 916 917
	if (nladdr->nl_family != AF_NETLINK)
		return -EINVAL;

	/* Only superuser is allowed to listen multicasts */
918
	if (groups) {
919
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
920
			return -EPERM;
921 922 923
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
924
	}
L
Linus Torvalds 已提交
925

926 927 928 929 930
	bound = nlk->bound;
	if (bound) {
		/* Ensure nlk->portid is up-to-date. */
		smp_rmb();

931
		if (nladdr->nl_pid != nlk->portid)
L
Linus Torvalds 已提交
932
			return -EINVAL;
933
	}
934 935 936 937 938 939 940

	if (nlk->netlink_bind && groups) {
		int group;

		for (group = 0; group < nlk->ngroups; group++) {
			if (!test_bit(group, &groups))
				continue;
941
			err = nlk->netlink_bind(net, group + 1);
942 943
			if (!err)
				continue;
944
			netlink_undo_bind(group, groups, sk);
945 946 947 948
			return err;
		}
	}

949 950 951 952
	/* No need for barriers here as we return to user-space without
	 * using any of the bound attributes.
	 */
	if (!bound) {
L
Linus Torvalds 已提交
953
		err = nladdr->nl_pid ?
954
			netlink_insert(sk, nladdr->nl_pid) :
L
Linus Torvalds 已提交
955
			netlink_autobind(sock);
956
		if (err) {
957
			netlink_undo_bind(nlk->ngroups, groups, sk);
L
Linus Torvalds 已提交
958
			return err;
959
		}
L
Linus Torvalds 已提交
960 961
	}

962
	if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
L
Linus Torvalds 已提交
963 964 965
		return 0;

	netlink_table_grab();
966
	netlink_update_subscriptions(sk, nlk->subscriptions +
967
					 hweight32(groups) -
968
					 hweight32(nlk->groups[0]));
969
	nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
970
	netlink_update_listeners(sk);
L
Linus Torvalds 已提交
971 972 973 974 975 976 977 978 979 980 981
	netlink_table_ungrab();

	return 0;
}

static int netlink_connect(struct socket *sock, struct sockaddr *addr,
			   int alen, int flags)
{
	int err = 0;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
982
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
L
Linus Torvalds 已提交
983

984 985 986
	if (alen < sizeof(addr->sa_family))
		return -EINVAL;

L
Linus Torvalds 已提交
987 988
	if (addr->sa_family == AF_UNSPEC) {
		sk->sk_state	= NETLINK_UNCONNECTED;
989
		nlk->dst_portid	= 0;
990
		nlk->dst_group  = 0;
L
Linus Torvalds 已提交
991 992 993 994 995
		return 0;
	}
	if (addr->sa_family != AF_NETLINK)
		return -EINVAL;

996
	if ((nladdr->nl_groups || nladdr->nl_pid) &&
997
	    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
L
Linus Torvalds 已提交
998 999
		return -EPERM;

1000 1001 1002 1003
	/* No need for barriers here as we return to user-space without
	 * using any of the bound attributes.
	 */
	if (!nlk->bound)
L
Linus Torvalds 已提交
1004 1005 1006 1007
		err = netlink_autobind(sock);

	if (err == 0) {
		sk->sk_state	= NETLINK_CONNECTED;
1008
		nlk->dst_portid = nladdr->nl_pid;
1009
		nlk->dst_group  = ffs(nladdr->nl_groups);
L
Linus Torvalds 已提交
1010 1011 1012 1013 1014
	}

	return err;
}

1015 1016
static int netlink_getname(struct socket *sock, struct sockaddr *addr,
			   int *addr_len, int peer)
L
Linus Torvalds 已提交
1017 1018 1019
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1020
	DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1021

L
Linus Torvalds 已提交
1022 1023 1024 1025 1026
	nladdr->nl_family = AF_NETLINK;
	nladdr->nl_pad = 0;
	*addr_len = sizeof(*nladdr);

	if (peer) {
1027
		nladdr->nl_pid = nlk->dst_portid;
1028
		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
L
Linus Torvalds 已提交
1029
	} else {
1030
		nladdr->nl_pid = nlk->portid;
1031
		nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
L
Linus Torvalds 已提交
1032 1033 1034 1035
	}
	return 0;
}

1036 1037 1038 1039 1040 1041 1042 1043
static int netlink_ioctl(struct socket *sock, unsigned int cmd,
			 unsigned long arg)
{
	/* try to hand this ioctl down to the NIC drivers.
	 */
	return -ENOIOCTLCMD;
}

1044
static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
L
Linus Torvalds 已提交
1045 1046 1047 1048
{
	struct sock *sock;
	struct netlink_sock *nlk;

1049
	sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
L
Linus Torvalds 已提交
1050 1051 1052 1053 1054
	if (!sock)
		return ERR_PTR(-ECONNREFUSED);

	/* Don't bother queuing skb if kernel socket has no input function */
	nlk = nlk_sk(sock);
1055
	if (sock->sk_state == NETLINK_CONNECTED &&
1056
	    nlk->dst_portid != nlk_sk(ssk)->portid) {
L
Linus Torvalds 已提交
1057 1058 1059 1060 1061 1062 1063 1064
		sock_put(sock);
		return ERR_PTR(-ECONNREFUSED);
	}
	return sock;
}

struct sock *netlink_getsockbyfilp(struct file *filp)
{
A
Al Viro 已提交
1065
	struct inode *inode = file_inode(filp);
L
Linus Torvalds 已提交
1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078
	struct sock *sock;

	if (!S_ISSOCK(inode->i_mode))
		return ERR_PTR(-ENOTSOCK);

	sock = SOCKET_I(inode)->sk;
	if (sock->sk_family != AF_NETLINK)
		return ERR_PTR(-EINVAL);

	sock_hold(sock);
	return sock;
}

1079 1080
static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
					       int broadcast)
1081 1082 1083 1084
{
	struct sk_buff *skb;
	void *data;

1085
	if (size <= NLMSG_GOODSIZE || broadcast)
1086 1087
		return alloc_skb(size, GFP_KERNEL);

1088 1089
	size = SKB_DATA_ALIGN(size) +
	       SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1090 1091 1092

	data = vmalloc(size);
	if (data == NULL)
1093
		return NULL;
1094

E
Eric Dumazet 已提交
1095
	skb = __build_skb(data, size);
1096 1097
	if (skb == NULL)
		vfree(data);
E
Eric Dumazet 已提交
1098
	else
1099
		skb->destructor = netlink_skb_destructor;
1100 1101 1102 1103

	return skb;
}

L
Linus Torvalds 已提交
1104 1105 1106 1107 1108 1109 1110 1111 1112 1113
/*
 * Attach a skb to a netlink socket.
 * The caller must hold a reference to the destination socket. On error, the
 * reference is dropped. The skb is not send to the destination, just all
 * all error checks are performed and memory in the queue is reserved.
 * Return values:
 * < 0: error. skb freed, reference to sock dropped.
 * 0: continue
 * 1: repeat lookup - reference dropped while waiting for socket memory.
 */
1114
int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
P
Patrick McHardy 已提交
1115
		      long *timeo, struct sock *ssk)
L
Linus Torvalds 已提交
1116 1117 1118 1119 1120
{
	struct netlink_sock *nlk;

	nlk = nlk_sk(sk);

1121
	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1122
	     test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
L
Linus Torvalds 已提交
1123
		DECLARE_WAITQUEUE(wait, current);
P
Patrick McHardy 已提交
1124
		if (!*timeo) {
1125
			if (!ssk || netlink_is_kernel(ssk))
L
Linus Torvalds 已提交
1126 1127 1128 1129 1130 1131 1132 1133 1134 1135
				netlink_overrun(sk);
			sock_put(sk);
			kfree_skb(skb);
			return -EAGAIN;
		}

		__set_current_state(TASK_INTERRUPTIBLE);
		add_wait_queue(&nlk->wait, &wait);

		if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1136
		     test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
L
Linus Torvalds 已提交
1137
		    !sock_flag(sk, SOCK_DEAD))
P
Patrick McHardy 已提交
1138
			*timeo = schedule_timeout(*timeo);
L
Linus Torvalds 已提交
1139 1140 1141 1142 1143 1144 1145

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nlk->wait, &wait);
		sock_put(sk);

		if (signal_pending(current)) {
			kfree_skb(skb);
P
Patrick McHardy 已提交
1146
			return sock_intr_errno(*timeo);
L
Linus Torvalds 已提交
1147 1148 1149
		}
		return 1;
	}
1150
	netlink_skb_set_owner_r(skb, sk);
L
Linus Torvalds 已提交
1151 1152 1153
	return 0;
}

1154
static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1155 1156 1157
{
	int len = skb->len;

1158 1159
	netlink_deliver_tap(skb);

1160
	skb_queue_tail(&sk->sk_receive_queue, skb);
1161
	sk->sk_data_ready(sk);
1162 1163 1164 1165 1166 1167 1168
	return len;
}

int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
	int len = __netlink_sendskb(sk, skb);

L
Linus Torvalds 已提交
1169 1170 1171 1172 1173 1174 1175 1176 1177 1178
	sock_put(sk);
	return len;
}

void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
{
	kfree_skb(skb);
	sock_put(sk);
}

1179
static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
L
Linus Torvalds 已提交
1180 1181 1182
{
	int delta;

1183
	WARN_ON(skb->sk != NULL);
1184
	delta = skb->end - skb->tail;
1185
	if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
L
Linus Torvalds 已提交
1186 1187 1188 1189 1190 1191
		return skb;

	if (skb_shared(skb)) {
		struct sk_buff *nskb = skb_clone(skb, allocation);
		if (!nskb)
			return skb;
1192
		consume_skb(skb);
L
Linus Torvalds 已提交
1193 1194 1195 1196 1197 1198 1199 1200 1201
		skb = nskb;
	}

	if (!pskb_expand_head(skb, 0, -delta, allocation))
		skb->truesize -= delta;

	return skb;
}

1202 1203
static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
				  struct sock *ssk)
1204 1205 1206 1207 1208 1209 1210
{
	int ret;
	struct netlink_sock *nlk = nlk_sk(sk);

	ret = -ECONNREFUSED;
	if (nlk->netlink_rcv != NULL) {
		ret = skb->len;
1211
		netlink_skb_set_owner_r(skb, sk);
1212
		NETLINK_CB(skb).sk = ssk;
1213
		netlink_deliver_tap_kernel(sk, ssk, skb);
1214
		nlk->netlink_rcv(skb);
1215 1216 1217
		consume_skb(skb);
	} else {
		kfree_skb(skb);
1218 1219 1220 1221 1222 1223
	}
	sock_put(sk);
	return ret;
}

int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1224
		    u32 portid, int nonblock)
L
Linus Torvalds 已提交
1225 1226 1227 1228 1229 1230 1231 1232 1233
{
	struct sock *sk;
	int err;
	long timeo;

	skb = netlink_trim(skb, gfp_any());

	timeo = sock_sndtimeo(ssk, nonblock);
retry:
1234
	sk = netlink_getsockbyportid(ssk, portid);
L
Linus Torvalds 已提交
1235 1236 1237 1238
	if (IS_ERR(sk)) {
		kfree_skb(skb);
		return PTR_ERR(sk);
	}
1239
	if (netlink_is_kernel(sk))
1240
		return netlink_unicast_kernel(sk, skb, ssk);
1241

1242
	if (sk_filter(sk, skb)) {
W
Wang Chen 已提交
1243
		err = skb->len;
1244 1245 1246 1247 1248
		kfree_skb(skb);
		sock_put(sk);
		return err;
	}

1249
	err = netlink_attachskb(sk, skb, &timeo, ssk);
L
Linus Torvalds 已提交
1250 1251 1252 1253 1254
	if (err == 1)
		goto retry;
	if (err)
		return err;

1255
	return netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
1256
}
1257
EXPORT_SYMBOL(netlink_unicast);
L
Linus Torvalds 已提交
1258

1259 1260 1261
int netlink_has_listeners(struct sock *sk, unsigned int group)
{
	int res = 0;
1262
	struct listeners *listeners;
1263

1264
	BUG_ON(!netlink_is_kernel(sk));
1265 1266 1267 1268

	rcu_read_lock();
	listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);

1269
	if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1270
		res = test_bit(group - 1, listeners->masks);
1271 1272 1273

	rcu_read_unlock();

1274 1275 1276 1277
	return res;
}
EXPORT_SYMBOL_GPL(netlink_has_listeners);

1278
static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1279 1280 1281 1282
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1283
	    !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1284
		netlink_skb_set_owner_r(skb, sk);
1285
		__netlink_sendskb(sk, skb);
1286
		return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
L
Linus Torvalds 已提交
1287 1288 1289 1290 1291 1292
	}
	return -1;
}

struct netlink_broadcast_data {
	struct sock *exclude_sk;
1293
	struct net *net;
1294
	u32 portid;
L
Linus Torvalds 已提交
1295 1296
	u32 group;
	int failure;
1297
	int delivery_failure;
L
Linus Torvalds 已提交
1298 1299
	int congested;
	int delivered;
A
Al Viro 已提交
1300
	gfp_t allocation;
L
Linus Torvalds 已提交
1301
	struct sk_buff *skb, *skb2;
1302 1303
	int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
	void *tx_data;
L
Linus Torvalds 已提交
1304 1305
};

1306 1307
static void do_one_broadcast(struct sock *sk,
				    struct netlink_broadcast_data *p)
L
Linus Torvalds 已提交
1308 1309 1310 1311 1312
{
	struct netlink_sock *nlk = nlk_sk(sk);
	int val;

	if (p->exclude_sk == sk)
1313
		return;
L
Linus Torvalds 已提交
1314

1315
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1316
	    !test_bit(p->group - 1, nlk->groups))
1317
		return;
L
Linus Torvalds 已提交
1318

1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329
	if (!net_eq(sock_net(sk), p->net)) {
		if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
			return;

		if (!peernet_has_id(sock_net(sk), p->net))
			return;

		if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
				     CAP_NET_BROADCAST))
			return;
	}
1330

L
Linus Torvalds 已提交
1331 1332
	if (p->failure) {
		netlink_overrun(sk);
1333
		return;
L
Linus Torvalds 已提交
1334 1335 1336 1337
	}

	sock_hold(sk);
	if (p->skb2 == NULL) {
1338
		if (skb_shared(p->skb)) {
L
Linus Torvalds 已提交
1339 1340
			p->skb2 = skb_clone(p->skb, p->allocation);
		} else {
1341 1342 1343 1344 1345 1346
			p->skb2 = skb_get(p->skb);
			/*
			 * skb ownership may have been set when
			 * delivered to a previous socket.
			 */
			skb_orphan(p->skb2);
L
Linus Torvalds 已提交
1347 1348 1349 1350 1351 1352
		}
	}
	if (p->skb2 == NULL) {
		netlink_overrun(sk);
		/* Clone failed. Notify ALL listeners. */
		p->failure = 1;
1353
		if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1354
			p->delivery_failure = 1;
1355 1356 1357
		goto out;
	}
	if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
1358 1359
		kfree_skb(p->skb2);
		p->skb2 = NULL;
1360 1361 1362
		goto out;
	}
	if (sk_filter(sk, p->skb2)) {
1363 1364
		kfree_skb(p->skb2);
		p->skb2 = NULL;
1365 1366 1367 1368 1369 1370
		goto out;
	}
	NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
	NETLINK_CB(p->skb2).nsid_is_set = true;
	val = netlink_broadcast_deliver(sk, p->skb2);
	if (val < 0) {
L
Linus Torvalds 已提交
1371
		netlink_overrun(sk);
1372
		if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1373
			p->delivery_failure = 1;
L
Linus Torvalds 已提交
1374 1375 1376 1377 1378
	} else {
		p->congested |= val;
		p->delivered = 1;
		p->skb2 = NULL;
	}
1379
out:
L
Linus Torvalds 已提交
1380 1381 1382
	sock_put(sk);
}

1383
int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
1384 1385 1386
	u32 group, gfp_t allocation,
	int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
	void *filter_data)
L
Linus Torvalds 已提交
1387
{
1388
	struct net *net = sock_net(ssk);
L
Linus Torvalds 已提交
1389 1390 1391 1392 1393 1394
	struct netlink_broadcast_data info;
	struct sock *sk;

	skb = netlink_trim(skb, allocation);

	info.exclude_sk = ssk;
1395
	info.net = net;
1396
	info.portid = portid;
L
Linus Torvalds 已提交
1397 1398
	info.group = group;
	info.failure = 0;
1399
	info.delivery_failure = 0;
L
Linus Torvalds 已提交
1400 1401 1402 1403 1404
	info.congested = 0;
	info.delivered = 0;
	info.allocation = allocation;
	info.skb = skb;
	info.skb2 = NULL;
1405 1406
	info.tx_filter = filter;
	info.tx_data = filter_data;
L
Linus Torvalds 已提交
1407 1408 1409 1410 1411

	/* While we sleep in clone, do not allow to change socket list */

	netlink_lock_table();

1412
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
L
Linus Torvalds 已提交
1413 1414
		do_one_broadcast(sk, &info);

1415
	consume_skb(skb);
1416

L
Linus Torvalds 已提交
1417 1418
	netlink_unlock_table();

1419 1420
	if (info.delivery_failure) {
		kfree_skb(info.skb2);
1421
		return -ENOBUFS;
E
Eric Dumazet 已提交
1422 1423
	}
	consume_skb(info.skb2);
1424

L
Linus Torvalds 已提交
1425
	if (info.delivered) {
1426
		if (info.congested && gfpflags_allow_blocking(allocation))
L
Linus Torvalds 已提交
1427 1428 1429 1430 1431
			yield();
		return 0;
	}
	return -ESRCH;
}
1432 1433
EXPORT_SYMBOL(netlink_broadcast_filtered);

1434
int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
1435 1436
		      u32 group, gfp_t allocation)
{
1437
	return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
1438 1439
		NULL, NULL);
}
1440
EXPORT_SYMBOL(netlink_broadcast);
L
Linus Torvalds 已提交
1441 1442 1443

struct netlink_set_err_data {
	struct sock *exclude_sk;
1444
	u32 portid;
L
Linus Torvalds 已提交
1445 1446 1447 1448
	u32 group;
	int code;
};

1449
static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
L
Linus Torvalds 已提交
1450 1451
{
	struct netlink_sock *nlk = nlk_sk(sk);
1452
	int ret = 0;
L
Linus Torvalds 已提交
1453 1454 1455 1456

	if (sk == p->exclude_sk)
		goto out;

O
Octavian Purdila 已提交
1457
	if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
1458 1459
		goto out;

1460
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1461
	    !test_bit(p->group - 1, nlk->groups))
L
Linus Torvalds 已提交
1462 1463
		goto out;

1464
	if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
1465 1466 1467 1468
		ret = 1;
		goto out;
	}

L
Linus Torvalds 已提交
1469 1470 1471
	sk->sk_err = p->code;
	sk->sk_error_report(sk);
out:
1472
	return ret;
L
Linus Torvalds 已提交
1473 1474
}

1475 1476 1477
/**
 * netlink_set_err - report error to broadcast listeners
 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
1478
 * @portid: the PORTID of a process that we want to skip (if any)
1479
 * @group: the broadcast group that will notice the error
1480
 * @code: error code, must be negative (as usual in kernelspace)
1481 1482
 *
 * This function returns the number of broadcast listeners that have set the
1483
 * NETLINK_NO_ENOBUFS socket option.
1484
 */
1485
int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
L
Linus Torvalds 已提交
1486 1487 1488
{
	struct netlink_set_err_data info;
	struct sock *sk;
1489
	int ret = 0;
L
Linus Torvalds 已提交
1490 1491

	info.exclude_sk = ssk;
1492
	info.portid = portid;
L
Linus Torvalds 已提交
1493
	info.group = group;
1494 1495
	/* sk->sk_err wants a positive error value */
	info.code = -code;
L
Linus Torvalds 已提交
1496 1497 1498

	read_lock(&nl_table_lock);

1499
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
1500
		ret += do_one_set_err(sk, &info);
L
Linus Torvalds 已提交
1501 1502

	read_unlock(&nl_table_lock);
1503
	return ret;
L
Linus Torvalds 已提交
1504
}
1505
EXPORT_SYMBOL(netlink_set_err);
L
Linus Torvalds 已提交
1506

1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523
/* must be called with netlink table grabbed */
static void netlink_update_socket_mc(struct netlink_sock *nlk,
				     unsigned int group,
				     int is_new)
{
	int old, new = !!is_new, subscriptions;

	old = test_bit(group - 1, nlk->groups);
	subscriptions = nlk->subscriptions - old + new;
	if (new)
		__set_bit(group - 1, nlk->groups);
	else
		__clear_bit(group - 1, nlk->groups);
	netlink_update_subscriptions(&nlk->sk, subscriptions);
	netlink_update_listeners(&nlk->sk);
}

1524
static int netlink_setsockopt(struct socket *sock, int level, int optname,
1525
			      char __user *optval, unsigned int optlen)
1526 1527 1528
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1529 1530
	unsigned int val = 0;
	int err;
1531 1532 1533 1534

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

1535
	if (optlen >= sizeof(int) &&
1536
	    get_user(val, (unsigned int __user *)optval))
1537 1538 1539 1540 1541
		return -EFAULT;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (val)
1542
			nlk->flags |= NETLINK_F_RECV_PKTINFO;
1543
		else
1544
			nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
1545 1546 1547 1548
		err = 0;
		break;
	case NETLINK_ADD_MEMBERSHIP:
	case NETLINK_DROP_MEMBERSHIP: {
1549
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1550
			return -EPERM;
1551 1552 1553
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
1554 1555
		if (!val || val - 1 >= nlk->ngroups)
			return -EINVAL;
1556
		if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
1557
			err = nlk->netlink_bind(sock_net(sk), val);
1558 1559 1560
			if (err)
				return err;
		}
1561
		netlink_table_grab();
1562 1563
		netlink_update_socket_mc(nlk, val,
					 optname == NETLINK_ADD_MEMBERSHIP);
1564
		netlink_table_ungrab();
1565
		if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
1566
			nlk->netlink_unbind(sock_net(sk), val);
1567

1568 1569 1570
		err = 0;
		break;
	}
1571 1572
	case NETLINK_BROADCAST_ERROR:
		if (val)
1573
			nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
1574
		else
1575
			nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
1576 1577
		err = 0;
		break;
1578 1579
	case NETLINK_NO_ENOBUFS:
		if (val) {
1580 1581
			nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
			clear_bit(NETLINK_S_CONGESTED, &nlk->state);
1582
			wake_up_interruptible(&nlk->wait);
E
Eric Dumazet 已提交
1583
		} else {
1584
			nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
E
Eric Dumazet 已提交
1585
		}
1586 1587
		err = 0;
		break;
1588 1589 1590 1591 1592 1593 1594 1595 1596 1597
	case NETLINK_LISTEN_ALL_NSID:
		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
			return -EPERM;

		if (val)
			nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
		else
			nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
		err = 0;
		break;
1598 1599 1600 1601 1602 1603 1604
	case NETLINK_CAP_ACK:
		if (val)
			nlk->flags |= NETLINK_F_CAP_ACK;
		else
			nlk->flags &= ~NETLINK_F_CAP_ACK;
		err = 0;
		break;
1605 1606 1607 1608 1609 1610 1611
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static int netlink_getsockopt(struct socket *sock, int level, int optname,
1612
			      char __user *optval, int __user *optlen)
1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int len, val, err;

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

	if (get_user(len, optlen))
		return -EFAULT;
	if (len < 0)
		return -EINVAL;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
1631
		val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
H
Heiko Carstens 已提交
1632 1633 1634
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
1635 1636
		err = 0;
		break;
1637 1638 1639 1640
	case NETLINK_BROADCAST_ERROR:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
1641
		val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
1642 1643 1644 1645 1646
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
1647 1648 1649 1650
	case NETLINK_NO_ENOBUFS:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
1651
		val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
1652 1653 1654 1655 1656
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
1657 1658 1659 1660
	case NETLINK_LIST_MEMBERSHIPS: {
		int pos, idx, shift;

		err = 0;
1661
		netlink_lock_table();
1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675
		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
			if (len - pos < sizeof(u32))
				break;

			idx = pos / sizeof(unsigned long);
			shift = (pos % sizeof(unsigned long)) * 8;
			if (put_user((u32)(nlk->groups[idx] >> shift),
				     (u32 __user *)(optval + pos))) {
				err = -EFAULT;
				break;
			}
		}
		if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
			err = -EFAULT;
1676
		netlink_unlock_table();
1677 1678
		break;
	}
1679 1680 1681 1682 1683 1684 1685 1686 1687 1688
	case NETLINK_CAP_ACK:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
		val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
{
	struct nl_pktinfo info;

	info.group = NETLINK_CB(skb).dst_group;
	put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
}

1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
					 struct sk_buff *skb)
{
	if (!NETLINK_CB(skb).nsid_is_set)
		return;

	put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
		 &NETLINK_CB(skb).nsid);
}

1713
static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
L
Linus Torvalds 已提交
1714 1715 1716
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1717
	DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
1718
	u32 dst_portid;
1719
	u32 dst_group;
L
Linus Torvalds 已提交
1720 1721 1722
	struct sk_buff *skb;
	int err;
	struct scm_cookie scm;
1723
	u32 netlink_skb_flags = 0;
L
Linus Torvalds 已提交
1724 1725 1726 1727

	if (msg->msg_flags&MSG_OOB)
		return -EOPNOTSUPP;

C
Christoph Hellwig 已提交
1728
	err = scm_send(sock, msg, &scm, true);
L
Linus Torvalds 已提交
1729 1730 1731 1732
	if (err < 0)
		return err;

	if (msg->msg_namelen) {
1733
		err = -EINVAL;
L
Linus Torvalds 已提交
1734
		if (addr->nl_family != AF_NETLINK)
1735
			goto out;
1736
		dst_portid = addr->nl_pid;
1737
		dst_group = ffs(addr->nl_groups);
1738
		err =  -EPERM;
1739
		if ((dst_group || dst_portid) &&
1740
		    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1741
			goto out;
1742
		netlink_skb_flags |= NETLINK_SKB_DST;
L
Linus Torvalds 已提交
1743
	} else {
1744
		dst_portid = nlk->dst_portid;
1745
		dst_group = nlk->dst_group;
L
Linus Torvalds 已提交
1746 1747
	}

1748
	if (!nlk->bound) {
L
Linus Torvalds 已提交
1749 1750 1751
		err = netlink_autobind(sock);
		if (err)
			goto out;
1752 1753 1754
	} else {
		/* Ensure nlk is hashed and visible. */
		smp_rmb();
L
Linus Torvalds 已提交
1755 1756 1757 1758 1759 1760
	}

	err = -EMSGSIZE;
	if (len > sk->sk_sndbuf - 32)
		goto out;
	err = -ENOBUFS;
1761
	skb = netlink_alloc_large_skb(len, dst_group);
1762
	if (skb == NULL)
L
Linus Torvalds 已提交
1763 1764
		goto out;

1765
	NETLINK_CB(skb).portid	= nlk->portid;
1766
	NETLINK_CB(skb).dst_group = dst_group;
C
Christoph Hellwig 已提交
1767
	NETLINK_CB(skb).creds	= scm.creds;
1768
	NETLINK_CB(skb).flags	= netlink_skb_flags;
L
Linus Torvalds 已提交
1769 1770

	err = -EFAULT;
A
Al Viro 已提交
1771
	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
L
Linus Torvalds 已提交
1772 1773 1774 1775 1776 1777 1778 1779 1780 1781
		kfree_skb(skb);
		goto out;
	}

	err = security_netlink_send(sk, skb);
	if (err) {
		kfree_skb(skb);
		goto out;
	}

1782
	if (dst_group) {
L
Linus Torvalds 已提交
1783
		atomic_inc(&skb->users);
1784
		netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
L
Linus Torvalds 已提交
1785
	}
1786
	err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
L
Linus Torvalds 已提交
1787 1788

out:
C
Christoph Hellwig 已提交
1789
	scm_destroy(&scm);
L
Linus Torvalds 已提交
1790 1791 1792
	return err;
}

1793
static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
L
Linus Torvalds 已提交
1794 1795 1796 1797 1798 1799 1800
			   int flags)
{
	struct scm_cookie scm;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int noblock = flags&MSG_DONTWAIT;
	size_t copied;
J
Johannes Berg 已提交
1801
	struct sk_buff *skb, *data_skb;
1802
	int err, ret;
L
Linus Torvalds 已提交
1803 1804 1805 1806 1807 1808

	if (flags&MSG_OOB)
		return -EOPNOTSUPP;

	copied = 0;

1809 1810
	skb = skb_recv_datagram(sk, flags, noblock, &err);
	if (skb == NULL)
L
Linus Torvalds 已提交
1811 1812
		goto out;

J
Johannes Berg 已提交
1813 1814
	data_skb = skb;

1815 1816 1817
#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
	if (unlikely(skb_shinfo(skb)->frag_list)) {
		/*
J
Johannes Berg 已提交
1818 1819 1820
		 * If this skb has a frag_list, then here that means that we
		 * will have to use the frag_list skb's data for compat tasks
		 * and the regular skb's data for normal (non-compat) tasks.
1821
		 *
J
Johannes Berg 已提交
1822 1823 1824 1825
		 * If we need to send the compat skb, assign it to the
		 * 'data_skb' variable so that it will be used below for data
		 * copying. We keep 'skb' for everything else, including
		 * freeing both later.
1826
		 */
J
Johannes Berg 已提交
1827 1828
		if (flags & MSG_CMSG_COMPAT)
			data_skb = skb_shinfo(skb)->frag_list;
1829 1830 1831
	}
#endif

E
Eric Dumazet 已提交
1832 1833 1834
	/* Record the max length of recvmsg() calls for future allocations */
	nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
	nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
1835
				     SKB_WITH_OVERHEAD(32768));
E
Eric Dumazet 已提交
1836

J
Johannes Berg 已提交
1837
	copied = data_skb->len;
L
Linus Torvalds 已提交
1838 1839 1840 1841 1842
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

J
Johannes Berg 已提交
1843
	skb_reset_transport_header(data_skb);
1844
	err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
L
Linus Torvalds 已提交
1845 1846

	if (msg->msg_name) {
1847
		DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
L
Linus Torvalds 已提交
1848 1849
		addr->nl_family = AF_NETLINK;
		addr->nl_pad    = 0;
1850
		addr->nl_pid	= NETLINK_CB(skb).portid;
1851
		addr->nl_groups	= netlink_group_mask(NETLINK_CB(skb).dst_group);
L
Linus Torvalds 已提交
1852 1853 1854
		msg->msg_namelen = sizeof(*addr);
	}

1855
	if (nlk->flags & NETLINK_F_RECV_PKTINFO)
1856
		netlink_cmsg_recv_pktinfo(msg, skb);
1857 1858
	if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
		netlink_cmsg_listen_all_nsid(sk, msg, skb);
1859

C
Christoph Hellwig 已提交
1860 1861
	memset(&scm, 0, sizeof(scm));
	scm.creds = *NETLINK_CREDS(skb);
1862
	if (flags & MSG_TRUNC)
J
Johannes Berg 已提交
1863
		copied = data_skb->len;
1864

L
Linus Torvalds 已提交
1865 1866
	skb_free_datagram(sk, skb);

1867 1868
	if (nlk->cb_running &&
	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
1869 1870
		ret = netlink_dump(sk);
		if (ret) {
1871
			sk->sk_err = -ret;
1872 1873 1874
			sk->sk_error_report(sk);
		}
	}
L
Linus Torvalds 已提交
1875

C
Christoph Hellwig 已提交
1876
	scm_recv(sock, msg, &scm, flags);
L
Linus Torvalds 已提交
1877 1878 1879 1880 1881
out:
	netlink_rcv_wake(sk);
	return err ? : copied;
}

1882
static void netlink_data_ready(struct sock *sk)
L
Linus Torvalds 已提交
1883
{
1884
	BUG();
L
Linus Torvalds 已提交
1885 1886 1887
}

/*
1888
 *	We export these functions to other modules. They provide a
L
Linus Torvalds 已提交
1889 1890 1891 1892 1893
 *	complete set of kernel non-blocking support for message
 *	queueing.
 */

struct sock *
1894 1895
__netlink_kernel_create(struct net *net, int unit, struct module *module,
			struct netlink_kernel_cfg *cfg)
L
Linus Torvalds 已提交
1896 1897 1898
{
	struct socket *sock;
	struct sock *sk;
1899
	struct netlink_sock *nlk;
1900
	struct listeners *listeners = NULL;
1901 1902
	struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
	unsigned int groups;
L
Linus Torvalds 已提交
1903

1904
	BUG_ON(!nl_table);
L
Linus Torvalds 已提交
1905

1906
	if (unit < 0 || unit >= MAX_LINKS)
L
Linus Torvalds 已提交
1907 1908 1909 1910
		return NULL;

	if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
		return NULL;
1911 1912

	if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
1913 1914 1915
		goto out_sock_release_nosk;

	sk = sock->sk;
1916

1917
	if (!cfg || cfg->groups < 32)
1918
		groups = 32;
1919 1920
	else
		groups = cfg->groups;
1921

1922
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
1923 1924 1925
	if (!listeners)
		goto out_sock_release;

L
Linus Torvalds 已提交
1926
	sk->sk_data_ready = netlink_data_ready;
1927 1928
	if (cfg && cfg->input)
		nlk_sk(sk)->netlink_rcv = cfg->input;
L
Linus Torvalds 已提交
1929

1930
	if (netlink_insert(sk, 0))
1931
		goto out_sock_release;
1932

1933
	nlk = nlk_sk(sk);
1934
	nlk->flags |= NETLINK_F_KERNEL_SOCKET;
1935 1936

	netlink_table_grab();
1937 1938
	if (!nl_table[unit].registered) {
		nl_table[unit].groups = groups;
1939
		rcu_assign_pointer(nl_table[unit].listeners, listeners);
1940 1941
		nl_table[unit].cb_mutex = cb_mutex;
		nl_table[unit].module = module;
1942 1943
		if (cfg) {
			nl_table[unit].bind = cfg->bind;
1944
			nl_table[unit].unbind = cfg->unbind;
1945
			nl_table[unit].flags = cfg->flags;
1946 1947
			if (cfg->compare)
				nl_table[unit].compare = cfg->compare;
1948
		}
1949
		nl_table[unit].registered = 1;
1950 1951
	} else {
		kfree(listeners);
1952
		nl_table[unit].registered++;
1953
	}
1954
	netlink_table_ungrab();
1955 1956
	return sk;

1957
out_sock_release:
1958
	kfree(listeners);
1959
	netlink_kernel_release(sk);
1960 1961 1962
	return NULL;

out_sock_release_nosk:
1963
	sock_release(sock);
1964
	return NULL;
L
Linus Torvalds 已提交
1965
}
1966
EXPORT_SYMBOL(__netlink_kernel_create);
1967 1968 1969 1970

void
netlink_kernel_release(struct sock *sk)
{
1971 1972 1973 1974
	if (sk == NULL || sk->sk_socket == NULL)
		return;

	sock_release(sk->sk_socket);
1975 1976 1977
}
EXPORT_SYMBOL(netlink_kernel_release);

1978
int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
1979
{
1980
	struct listeners *new, *old;
1981 1982 1983 1984 1985 1986
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];

	if (groups < 32)
		groups = 32;

	if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
1987 1988
		new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
		if (!new)
1989
			return -ENOMEM;
1990
		old = nl_deref_protected(tbl->listeners);
1991 1992 1993
		memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
		rcu_assign_pointer(tbl->listeners, new);

1994
		kfree_rcu(old, rcu);
1995 1996 1997
	}
	tbl->groups = groups;

1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
	return 0;
}

/**
 * netlink_change_ngroups - change number of multicast groups
 *
 * This changes the number of multicast groups that are available
 * on a certain netlink family. Note that it is not possible to
 * change the number of groups to below 32. Also note that it does
 * not implicitly call netlink_clear_multicast_users() when the
 * number of groups is reduced.
 *
 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
 * @groups: The new number of groups.
 */
int netlink_change_ngroups(struct sock *sk, unsigned int groups)
{
	int err;

	netlink_table_grab();
	err = __netlink_change_ngroups(sk, groups);
2019
	netlink_table_ungrab();
2020

2021 2022 2023
	return err;
}

2024 2025 2026 2027 2028
void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
{
	struct sock *sk;
	struct netlink_table *tbl = &nl_table[ksk->sk_protocol];

2029
	sk_for_each_bound(sk, &tbl->mc_list)
2030 2031 2032
		netlink_update_socket_mc(nlk_sk(sk), group, 0);
}

2033
struct nlmsghdr *
2034
__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2035 2036
{
	struct nlmsghdr *nlh;
2037
	int size = nlmsg_msg_size(len);
2038

2039
	nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2040 2041 2042
	nlh->nlmsg_type = type;
	nlh->nlmsg_len = size;
	nlh->nlmsg_flags = flags;
2043
	nlh->nlmsg_pid = portid;
2044 2045
	nlh->nlmsg_seq = seq;
	if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2046
		memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2047 2048 2049 2050
	return nlh;
}
EXPORT_SYMBOL(__nlmsg_put);

L
Linus Torvalds 已提交
2051 2052 2053 2054 2055 2056 2057 2058 2059
/*
 * It looks a bit ugly.
 * It would be better to create kernel thread.
 */

static int netlink_dump(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_callback *cb;
2060
	struct sk_buff *skb = NULL;
L
Linus Torvalds 已提交
2061
	struct nlmsghdr *nlh;
2062
	struct module *module;
2063
	int len, err = -ENOBUFS;
2064
	int alloc_min_size;
2065
	int alloc_size;
L
Linus Torvalds 已提交
2066

2067
	mutex_lock(nlk->cb_mutex);
2068
	if (!nlk->cb_running) {
2069 2070
		err = -EINVAL;
		goto errout_skb;
L
Linus Torvalds 已提交
2071 2072
	}

2073
	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2074
		goto errout_skb;
E
Eric Dumazet 已提交
2075 2076 2077 2078 2079 2080

	/* NLMSG_GOODSIZE is small to avoid high order allocations being
	 * required, but it makes sense to _attempt_ a 16K bytes allocation
	 * to reduce number of system calls on dump operations, if user
	 * ever provided a big enough buffer.
	 */
2081 2082 2083 2084 2085
	cb = &nlk->cb;
	alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);

	if (alloc_min_size < nlk->max_recvmsg_len) {
		alloc_size = nlk->max_recvmsg_len;
2086 2087 2088
		skb = alloc_skb(alloc_size,
				(GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) |
				__GFP_NOWARN | __GFP_NORETRY);
E
Eric Dumazet 已提交
2089
	}
2090 2091
	if (!skb) {
		alloc_size = alloc_min_size;
2092
		skb = alloc_skb(alloc_size, GFP_KERNEL);
2093
	}
2094
	if (!skb)
2095
		goto errout_skb;
2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106

	/* Trim skb to allocated size. User is expected to provide buffer as
	 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
	 * netlink_recvmsg())). dump will pack as many smaller messages as
	 * could fit within the allocated skb. skb is typically allocated
	 * with larger space than required (could be as much as near 2x the
	 * requested size with align to next power of 2 approach). Allowing
	 * dump to use the excess space makes it difficult for a user to have a
	 * reasonable static buffer based on the expected largest dump of a
	 * single netdev. The outcome is MSG_TRUNC error.
	 */
2107
	skb_reserve(skb, skb_tailroom(skb) - alloc_size);
2108
	netlink_skb_set_owner_r(skb, sk);
2109

L
Linus Torvalds 已提交
2110 2111 2112
	len = cb->dump(skb, cb);

	if (len > 0) {
2113
		mutex_unlock(nlk->cb_mutex);
2114 2115 2116

		if (sk_filter(sk, skb))
			kfree_skb(skb);
2117 2118
		else
			__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2119 2120 2121
		return 0;
	}

2122 2123 2124 2125
	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
	if (!nlh)
		goto errout_skb;

2126 2127
	nl_dump_check_consistent(cb, nlh);

2128 2129
	memcpy(nlmsg_data(nlh), &len, sizeof(len));

2130 2131
	if (sk_filter(sk, skb))
		kfree_skb(skb);
2132 2133
	else
		__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2134

2135 2136
	if (cb->done)
		cb->done(cb);
L
Linus Torvalds 已提交
2137

2138
	nlk->cb_running = false;
2139 2140
	module = cb->module;
	skb = cb->skb;
2141
	mutex_unlock(nlk->cb_mutex);
2142 2143
	module_put(module);
	consume_skb(skb);
L
Linus Torvalds 已提交
2144
	return 0;
2145

2146
errout_skb:
2147
	mutex_unlock(nlk->cb_mutex);
2148 2149
	kfree_skb(skb);
	return err;
L
Linus Torvalds 已提交
2150 2151
}

2152 2153 2154
int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
			 const struct nlmsghdr *nlh,
			 struct netlink_dump_control *control)
L
Linus Torvalds 已提交
2155 2156 2157 2158
{
	struct netlink_callback *cb;
	struct sock *sk;
	struct netlink_sock *nlk;
2159
	int ret;
L
Linus Torvalds 已提交
2160

2161
	atomic_inc(&skb->users);
2162

2163
	sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
2164
	if (sk == NULL) {
2165 2166
		ret = -ECONNREFUSED;
		goto error_free;
L
Linus Torvalds 已提交
2167
	}
2168

2169
	nlk = nlk_sk(sk);
2170
	mutex_lock(nlk->cb_mutex);
2171
	/* A dump is in progress... */
2172
	if (nlk->cb_running) {
2173
		ret = -EBUSY;
2174
		goto error_unlock;
L
Linus Torvalds 已提交
2175
	}
2176
	/* add reference of module which cb->dump belongs to */
2177
	if (!try_module_get(control->module)) {
2178
		ret = -EPROTONOSUPPORT;
2179
		goto error_unlock;
2180 2181
	}

2182 2183
	cb = &nlk->cb;
	memset(cb, 0, sizeof(*cb));
2184
	cb->start = control->start;
2185 2186 2187 2188 2189 2190 2191 2192 2193 2194
	cb->dump = control->dump;
	cb->done = control->done;
	cb->nlh = nlh;
	cb->data = control->data;
	cb->module = control->module;
	cb->min_dump_alloc = control->min_dump_alloc;
	cb->skb = skb;

	nlk->cb_running = true;

2195
	mutex_unlock(nlk->cb_mutex);
L
Linus Torvalds 已提交
2196

2197 2198 2199
	if (cb->start)
		cb->start(cb);

2200
	ret = netlink_dump(sk);
L
Linus Torvalds 已提交
2201
	sock_put(sk);
2202

2203 2204 2205
	if (ret)
		return ret;

2206 2207 2208 2209
	/* We successfully started a dump, by returning -EINTR we
	 * signal not to send ACK even if it was requested.
	 */
	return -EINTR;
2210 2211 2212 2213 2214 2215 2216

error_unlock:
	sock_put(sk);
	mutex_unlock(nlk->cb_mutex);
error_free:
	kfree_skb(skb);
	return ret;
L
Linus Torvalds 已提交
2217
}
2218
EXPORT_SYMBOL(__netlink_dump_start);
L
Linus Torvalds 已提交
2219 2220 2221 2222 2223 2224

void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
{
	struct sk_buff *skb;
	struct nlmsghdr *rep;
	struct nlmsgerr *errmsg;
2225
	size_t payload = sizeof(*errmsg);
2226
	struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
L
Linus Torvalds 已提交
2227

2228 2229 2230 2231
	/* Error messages get the original request appened, unless the user
	 * requests to cap the error message.
	 */
	if (!(nlk->flags & NETLINK_F_CAP_ACK) && err)
2232
		payload += nlmsg_len(nlh);
L
Linus Torvalds 已提交
2233

2234
	skb = nlmsg_new(payload, GFP_KERNEL);
L
Linus Torvalds 已提交
2235 2236 2237
	if (!skb) {
		struct sock *sk;

2238
		sk = netlink_lookup(sock_net(in_skb->sk),
2239
				    in_skb->sk->sk_protocol,
2240
				    NETLINK_CB(in_skb).portid);
L
Linus Torvalds 已提交
2241 2242 2243 2244 2245 2246 2247 2248
		if (sk) {
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
			sock_put(sk);
		}
		return;
	}

2249
	rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2250
			  NLMSG_ERROR, payload, 0);
2251
	errmsg = nlmsg_data(rep);
L
Linus Torvalds 已提交
2252
	errmsg->error = err;
2253
	memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
2254
	netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
L
Linus Torvalds 已提交
2255
}
2256
EXPORT_SYMBOL(netlink_ack);
L
Linus Torvalds 已提交
2257

2258
int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2259
						     struct nlmsghdr *))
2260 2261 2262 2263 2264
{
	struct nlmsghdr *nlh;
	int err;

	while (skb->len >= nlmsg_total_size(0)) {
2265 2266
		int msglen;

2267
		nlh = nlmsg_hdr(skb);
2268
		err = 0;
2269

2270
		if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2271 2272
			return 0;

2273 2274
		/* Only requests are handled by the kernel */
		if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2275
			goto ack;
2276 2277 2278

		/* Skip control messages */
		if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2279
			goto ack;
2280

2281
		err = cb(skb, nlh);
2282 2283 2284 2285
		if (err == -EINTR)
			goto skip;

ack:
2286
		if (nlh->nlmsg_flags & NLM_F_ACK || err)
2287 2288
			netlink_ack(skb, nlh, err);

2289
skip:
2290
		msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2291 2292 2293
		if (msglen > skb->len)
			msglen = skb->len;
		skb_pull(skb, msglen);
2294 2295 2296 2297
	}

	return 0;
}
2298
EXPORT_SYMBOL(netlink_rcv_skb);
2299

2300 2301 2302 2303
/**
 * nlmsg_notify - send a notification netlink message
 * @sk: netlink socket to use
 * @skb: notification message
2304
 * @portid: destination netlink portid for reports or 0
2305 2306 2307 2308
 * @group: destination multicast group or 0
 * @report: 1 to report back, 0 to disable
 * @flags: allocation flags
 */
2309
int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
2310 2311 2312 2313 2314
		 unsigned int group, int report, gfp_t flags)
{
	int err = 0;

	if (group) {
2315
		int exclude_portid = 0;
2316 2317 2318

		if (report) {
			atomic_inc(&skb->users);
2319
			exclude_portid = portid;
2320 2321
		}

2322 2323
		/* errors reported via destination sk->sk_err, but propagate
		 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
2324
		err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
2325 2326
	}

2327 2328 2329
	if (report) {
		int err2;

2330
		err2 = nlmsg_unicast(sk, skb, portid);
2331 2332 2333
		if (!err || err == -ESRCH)
			err = err2;
	}
2334 2335 2336

	return err;
}
2337
EXPORT_SYMBOL(nlmsg_notify);
2338

L
Linus Torvalds 已提交
2339 2340
#ifdef CONFIG_PROC_FS
struct nl_seq_iter {
2341
	struct seq_net_private p;
2342
	struct rhashtable_iter hti;
L
Linus Torvalds 已提交
2343 2344 2345
	int link;
};

2346
static int netlink_walk_start(struct nl_seq_iter *iter)
L
Linus Torvalds 已提交
2347
{
2348
	int err;
L
Linus Torvalds 已提交
2349

2350 2351
	err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti,
				   GFP_KERNEL);
2352 2353 2354
	if (err) {
		iter->link = MAX_LINKS;
		return err;
L
Linus Torvalds 已提交
2355
	}
2356 2357 2358

	err = rhashtable_walk_start(&iter->hti);
	return err == -EAGAIN ? 0 : err;
L
Linus Torvalds 已提交
2359 2360
}

2361
static void netlink_walk_stop(struct nl_seq_iter *iter)
L
Linus Torvalds 已提交
2362
{
2363 2364
	rhashtable_walk_stop(&iter->hti);
	rhashtable_walk_exit(&iter->hti);
L
Linus Torvalds 已提交
2365 2366
}

2367
static void *__netlink_seq_next(struct seq_file *seq)
L
Linus Torvalds 已提交
2368
{
2369
	struct nl_seq_iter *iter = seq->private;
2370
	struct netlink_sock *nlk;
L
Linus Torvalds 已提交
2371

2372 2373 2374
	do {
		for (;;) {
			int err;
L
Linus Torvalds 已提交
2375

2376
			nlk = rhashtable_walk_next(&iter->hti);
2377

2378 2379 2380
			if (IS_ERR(nlk)) {
				if (PTR_ERR(nlk) == -EAGAIN)
					continue;
2381

2382 2383
				return nlk;
			}
L
Linus Torvalds 已提交
2384

2385 2386
			if (nlk)
				break;
L
Linus Torvalds 已提交
2387

2388 2389 2390
			netlink_walk_stop(iter);
			if (++iter->link >= MAX_LINKS)
				return NULL;
2391

2392 2393 2394
			err = netlink_walk_start(iter);
			if (err)
				return ERR_PTR(err);
L
Linus Torvalds 已提交
2395
		}
2396
	} while (sock_net(&nlk->sk) != seq_file_net(seq));
L
Linus Torvalds 已提交
2397

2398 2399
	return nlk;
}
L
Linus Torvalds 已提交
2400

2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423
static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
{
	struct nl_seq_iter *iter = seq->private;
	void *obj = SEQ_START_TOKEN;
	loff_t pos;
	int err;

	iter->link = 0;

	err = netlink_walk_start(iter);
	if (err)
		return ERR_PTR(err);

	for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
		obj = __netlink_seq_next(seq);

	return obj;
}

static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	++*pos;
	return __netlink_seq_next(seq);
L
Linus Torvalds 已提交
2424 2425 2426 2427
}

static void netlink_seq_stop(struct seq_file *seq, void *v)
{
2428 2429 2430 2431 2432 2433
	struct nl_seq_iter *iter = seq->private;

	if (iter->link >= MAX_LINKS)
		return;

	netlink_walk_stop(iter);
L
Linus Torvalds 已提交
2434 2435 2436 2437 2438
}


static int netlink_seq_show(struct seq_file *seq, void *v)
{
E
Eric Dumazet 已提交
2439
	if (v == SEQ_START_TOKEN) {
L
Linus Torvalds 已提交
2440 2441
		seq_puts(seq,
			 "sk       Eth Pid    Groups   "
2442
			 "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
E
Eric Dumazet 已提交
2443
	} else {
L
Linus Torvalds 已提交
2444 2445 2446
		struct sock *s = v;
		struct netlink_sock *nlk = nlk_sk(s);

2447
		seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
L
Linus Torvalds 已提交
2448 2449
			   s,
			   s->sk_protocol,
2450
			   nlk->portid,
2451
			   nlk->groups ? (u32)nlk->groups[0] : 0,
2452 2453
			   sk_rmem_alloc_get(s),
			   sk_wmem_alloc_get(s),
2454
			   nlk->cb_running,
2455
			   atomic_read(&s->sk_refcnt),
2456 2457
			   atomic_read(&s->sk_drops),
			   sock_i_ino(s)
L
Linus Torvalds 已提交
2458 2459 2460 2461 2462 2463
			);

	}
	return 0;
}

2464
static const struct seq_operations netlink_seq_ops = {
L
Linus Torvalds 已提交
2465 2466 2467 2468 2469 2470 2471 2472 2473
	.start  = netlink_seq_start,
	.next   = netlink_seq_next,
	.stop   = netlink_seq_stop,
	.show   = netlink_seq_show,
};


static int netlink_seq_open(struct inode *inode, struct file *file)
{
2474 2475
	return seq_open_net(inode, file, &netlink_seq_ops,
				sizeof(struct nl_seq_iter));
2476 2477
}

2478
static const struct file_operations netlink_seq_fops = {
L
Linus Torvalds 已提交
2479 2480 2481 2482
	.owner		= THIS_MODULE,
	.open		= netlink_seq_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
2483
	.release	= seq_release_net,
L
Linus Torvalds 已提交
2484 2485 2486 2487 2488 2489
};

#endif

int netlink_register_notifier(struct notifier_block *nb)
{
2490
	return atomic_notifier_chain_register(&netlink_chain, nb);
L
Linus Torvalds 已提交
2491
}
2492
EXPORT_SYMBOL(netlink_register_notifier);
L
Linus Torvalds 已提交
2493 2494 2495

int netlink_unregister_notifier(struct notifier_block *nb)
{
2496
	return atomic_notifier_chain_unregister(&netlink_chain, nb);
L
Linus Torvalds 已提交
2497
}
2498
EXPORT_SYMBOL(netlink_unregister_notifier);
2499

2500
static const struct proto_ops netlink_ops = {
L
Linus Torvalds 已提交
2501 2502 2503 2504 2505 2506 2507 2508
	.family =	PF_NETLINK,
	.owner =	THIS_MODULE,
	.release =	netlink_release,
	.bind =		netlink_bind,
	.connect =	netlink_connect,
	.socketpair =	sock_no_socketpair,
	.accept =	sock_no_accept,
	.getname =	netlink_getname,
2509
	.poll =		datagram_poll,
2510
	.ioctl =	netlink_ioctl,
L
Linus Torvalds 已提交
2511 2512
	.listen =	sock_no_listen,
	.shutdown =	sock_no_shutdown,
2513 2514
	.setsockopt =	netlink_setsockopt,
	.getsockopt =	netlink_getsockopt,
L
Linus Torvalds 已提交
2515 2516
	.sendmsg =	netlink_sendmsg,
	.recvmsg =	netlink_recvmsg,
2517
	.mmap =		sock_no_mmap,
L
Linus Torvalds 已提交
2518 2519 2520
	.sendpage =	sock_no_sendpage,
};

2521
static const struct net_proto_family netlink_family_ops = {
L
Linus Torvalds 已提交
2522 2523 2524 2525 2526
	.family = PF_NETLINK,
	.create = netlink_create,
	.owner	= THIS_MODULE,	/* for consistency 8) */
};

2527
static int __net_init netlink_net_init(struct net *net)
2528 2529
{
#ifdef CONFIG_PROC_FS
2530
	if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
2531 2532 2533 2534 2535
		return -ENOMEM;
#endif
	return 0;
}

2536
static void __net_exit netlink_net_exit(struct net *net)
2537 2538
{
#ifdef CONFIG_PROC_FS
2539
	remove_proc_entry("netlink", net->proc_net);
2540 2541 2542
#endif
}

2543 2544
static void __init netlink_add_usersock_entry(void)
{
2545
	struct listeners *listeners;
2546 2547
	int groups = 32;

2548
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2549
	if (!listeners)
2550
		panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
2551 2552 2553 2554

	netlink_table_grab();

	nl_table[NETLINK_USERSOCK].groups = groups;
2555
	rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
2556 2557
	nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
	nl_table[NETLINK_USERSOCK].registered = 1;
2558
	nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
2559 2560 2561 2562

	netlink_table_ungrab();
}

2563
static struct pernet_operations __net_initdata netlink_net_ops = {
2564 2565 2566 2567
	.init = netlink_net_init,
	.exit = netlink_net_exit,
};

2568
static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
2569 2570 2571 2572
{
	const struct netlink_sock *nlk = data;
	struct netlink_compare_arg arg;

2573
	netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
2574
	return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
2575 2576 2577 2578 2579 2580 2581
}

static const struct rhashtable_params netlink_rhashtable_params = {
	.head_offset = offsetof(struct netlink_sock, node),
	.key_len = netlink_compare_arg_len,
	.obj_hashfn = netlink_hash,
	.obj_cmpfn = netlink_compare,
2582
	.automatic_shrinking = true,
2583 2584
};

L
Linus Torvalds 已提交
2585 2586 2587 2588 2589 2590 2591 2592
static int __init netlink_proto_init(void)
{
	int i;
	int err = proto_register(&netlink_proto, 0);

	if (err != 0)
		goto out;

2593
	BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
L
Linus Torvalds 已提交
2594

2595
	nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
2596 2597
	if (!nl_table)
		goto panic;
L
Linus Torvalds 已提交
2598 2599

	for (i = 0; i < MAX_LINKS; i++) {
2600 2601
		if (rhashtable_init(&nl_table[i].hash,
				    &netlink_rhashtable_params) < 0) {
2602 2603
			while (--i > 0)
				rhashtable_destroy(&nl_table[i].hash);
L
Linus Torvalds 已提交
2604
			kfree(nl_table);
2605
			goto panic;
L
Linus Torvalds 已提交
2606 2607 2608
		}
	}

2609 2610
	INIT_LIST_HEAD(&netlink_tap_all);

2611 2612
	netlink_add_usersock_entry();

L
Linus Torvalds 已提交
2613
	sock_register(&netlink_family_ops);
2614
	register_pernet_subsys(&netlink_net_ops);
2615
	/* The netlink device handler may be needed early. */
L
Linus Torvalds 已提交
2616 2617 2618
	rtnetlink_init();
out:
	return err;
2619 2620
panic:
	panic("netlink_init: Cannot allocate nl_table\n");
L
Linus Torvalds 已提交
2621 2622 2623
}

core_initcall(netlink_proto_init);