af_netlink.c 71.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 * NETLINK      Kernel-user communication protocol.
 *
4
 * 		Authors:	Alan Cox <alan@lxorguk.ukuu.org.uk>
L
Linus Torvalds 已提交
5
 * 				Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6
 * 				Patrick McHardy <kaber@trash.net>
L
Linus Torvalds 已提交
7 8 9 10 11
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
12
 *
L
Linus Torvalds 已提交
13 14 15 16
 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
 *                               added netlink_proto_exit
 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
 * 				 use nlk_sk, as sk->protinfo is on a diet 8)
17 18 19 20 21 22
 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
 * 				 - inc module use count of module that owns
 * 				   the kernel socket in case userspace opens
 * 				   socket of same protocol
 * 				 - remove all module support, since netlink is
 * 				   mandatory if CONFIG_NET=y these days
L
Linus Torvalds 已提交
23 24 25 26
 */

#include <linux/module.h>

27
#include <linux/capability.h>
L
Linus Torvalds 已提交
28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/signal.h>
#include <linux/sched.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/un.h>
#include <linux/fcntl.h>
#include <linux/termios.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/notifier.h>
#include <linux/security.h>
#include <linux/jhash.h>
#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/bitops.h>
#include <linux/mm.h>
#include <linux/types.h>
A
Andrew Morton 已提交
57
#include <linux/audit.h>
58
#include <linux/mutex.h>
59
#include <linux/vmalloc.h>
60
#include <linux/if_arp.h>
61
#include <asm/cacheflush.h>
A
Andrew Morton 已提交
62

63
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
64 65
#include <net/sock.h>
#include <net/scm.h>
66
#include <net/netlink.h>
L
Linus Torvalds 已提交
67

68
#include "af_netlink.h"
L
Linus Torvalds 已提交
69

70 71 72
struct listeners {
	struct rcu_head		rcu;
	unsigned long		masks[0];
73 74
};

75 76 77 78
/* state bits */
#define NETLINK_CONGESTED	0x0

/* flags */
79
#define NETLINK_KERNEL_SOCKET	0x1
80
#define NETLINK_RECV_PKTINFO	0x2
81
#define NETLINK_BROADCAST_SEND_ERROR	0x4
82
#define NETLINK_RECV_NO_ENOBUFS	0x8
83

84
static inline int netlink_is_kernel(struct sock *sk)
85 86 87 88
{
	return nlk_sk(sk)->flags & NETLINK_KERNEL_SOCKET;
}

89 90
struct netlink_table *nl_table;
EXPORT_SYMBOL_GPL(nl_table);
L
Linus Torvalds 已提交
91 92 93 94

static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);

static int netlink_dump(struct sock *sk);
95
static void netlink_skb_destructor(struct sk_buff *skb);
L
Linus Torvalds 已提交
96

97 98
DEFINE_RWLOCK(nl_table_lock);
EXPORT_SYMBOL_GPL(nl_table_lock);
L
Linus Torvalds 已提交
99 100
static atomic_t nl_table_users = ATOMIC_INIT(0);

101 102
#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));

103
static ATOMIC_NOTIFIER_HEAD(netlink_chain);
L
Linus Torvalds 已提交
104

105 106 107
static DEFINE_SPINLOCK(netlink_tap_lock);
static struct list_head netlink_tap_all __read_mostly;

108
static inline u32 netlink_group_mask(u32 group)
109 110 111 112
{
	return group ? 1 << (group - 1) : 0;
}

113
static inline struct hlist_head *nl_portid_hashfn(struct nl_portid_hash *hash, u32 portid)
L
Linus Torvalds 已提交
114
{
115
	return &hash->table[jhash_1word(portid, hash->rnd) & hash->mask];
L
Linus Torvalds 已提交
116 117
}

118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133
int netlink_add_tap(struct netlink_tap *nt)
{
	if (unlikely(nt->dev->type != ARPHRD_NETLINK))
		return -EINVAL;

	spin_lock(&netlink_tap_lock);
	list_add_rcu(&nt->list, &netlink_tap_all);
	spin_unlock(&netlink_tap_lock);

	if (nt->module)
		__module_get(nt->module);

	return 0;
}
EXPORT_SYMBOL_GPL(netlink_add_tap);

134
static int __netlink_remove_tap(struct netlink_tap *nt)
135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169
{
	bool found = false;
	struct netlink_tap *tmp;

	spin_lock(&netlink_tap_lock);

	list_for_each_entry(tmp, &netlink_tap_all, list) {
		if (nt == tmp) {
			list_del_rcu(&nt->list);
			found = true;
			goto out;
		}
	}

	pr_warn("__netlink_remove_tap: %p not found\n", nt);
out:
	spin_unlock(&netlink_tap_lock);

	if (found && nt->module)
		module_put(nt->module);

	return found ? 0 : -ENODEV;
}

int netlink_remove_tap(struct netlink_tap *nt)
{
	int ret;

	ret = __netlink_remove_tap(nt);
	synchronize_net();

	return ret;
}
EXPORT_SYMBOL_GPL(netlink_remove_tap);

170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193
static bool netlink_filter_tap(const struct sk_buff *skb)
{
	struct sock *sk = skb->sk;
	bool pass = false;

	/* We take the more conservative approach and
	 * whitelist socket protocols that may pass.
	 */
	switch (sk->sk_protocol) {
	case NETLINK_ROUTE:
	case NETLINK_USERSOCK:
	case NETLINK_SOCK_DIAG:
	case NETLINK_NFLOG:
	case NETLINK_XFRM:
	case NETLINK_FIB_LOOKUP:
	case NETLINK_NETFILTER:
	case NETLINK_GENERIC:
		pass = true;
		break;
	}

	return pass;
}

194 195 196 197
static int __netlink_deliver_tap_skb(struct sk_buff *skb,
				     struct net_device *dev)
{
	struct sk_buff *nskb;
198
	struct sock *sk = skb->sk;
199 200 201 202 203 204
	int ret = -ENOMEM;

	dev_hold(dev);
	nskb = skb_clone(skb, GFP_ATOMIC);
	if (nskb) {
		nskb->dev = dev;
205
		nskb->protocol = htons((u16) sk->sk_protocol);
206 207
		nskb->pkt_type = netlink_is_kernel(sk) ?
				 PACKET_KERNEL : PACKET_USER;
208

209 210 211 212 213 214 215 216 217 218 219 220 221 222
		ret = dev_queue_xmit(nskb);
		if (unlikely(ret > 0))
			ret = net_xmit_errno(ret);
	}

	dev_put(dev);
	return ret;
}

static void __netlink_deliver_tap(struct sk_buff *skb)
{
	int ret;
	struct netlink_tap *tmp;

223 224 225
	if (!netlink_filter_tap(skb))
		return;

226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242
	list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
		ret = __netlink_deliver_tap_skb(skb, tmp->dev);
		if (unlikely(ret))
			break;
	}
}

static void netlink_deliver_tap(struct sk_buff *skb)
{
	rcu_read_lock();

	if (unlikely(!list_empty(&netlink_tap_all)))
		__netlink_deliver_tap(skb);

	rcu_read_unlock();
}

243 244 245 246 247 248 249
static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
				       struct sk_buff *skb)
{
	if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
		netlink_deliver_tap(skb);
}

250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272
static void netlink_overrun(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (!(nlk->flags & NETLINK_RECV_NO_ENOBUFS)) {
		if (!test_and_set_bit(NETLINK_CONGESTED, &nlk_sk(sk)->state)) {
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
		}
	}
	atomic_inc(&sk->sk_drops);
}

static void netlink_rcv_wake(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (skb_queue_empty(&sk->sk_receive_queue))
		clear_bit(NETLINK_CONGESTED, &nlk->state);
	if (!test_bit(NETLINK_CONGESTED, &nlk->state))
		wake_up_interruptible(&nlk->wait);
}

273
#ifdef CONFIG_NETLINK_MMAP
274 275 276 277 278
static bool netlink_skb_is_mmaped(const struct sk_buff *skb)
{
	return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
}

279 280 281 282 283
static bool netlink_rx_is_mmaped(struct sock *sk)
{
	return nlk_sk(sk)->rx_ring.pg_vec != NULL;
}

284 285 286 287 288
static bool netlink_tx_is_mmaped(struct sock *sk)
{
	return nlk_sk(sk)->tx_ring.pg_vec != NULL;
}

289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334
static __pure struct page *pgvec_to_page(const void *addr)
{
	if (is_vmalloc_addr(addr))
		return vmalloc_to_page(addr);
	else
		return virt_to_page(addr);
}

static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
{
	unsigned int i;

	for (i = 0; i < len; i++) {
		if (pg_vec[i] != NULL) {
			if (is_vmalloc_addr(pg_vec[i]))
				vfree(pg_vec[i]);
			else
				free_pages((unsigned long)pg_vec[i], order);
		}
	}
	kfree(pg_vec);
}

static void *alloc_one_pg_vec_page(unsigned long order)
{
	void *buffer;
	gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
			  __GFP_NOWARN | __GFP_NORETRY;

	buffer = (void *)__get_free_pages(gfp_flags, order);
	if (buffer != NULL)
		return buffer;

	buffer = vzalloc((1 << order) * PAGE_SIZE);
	if (buffer != NULL)
		return buffer;

	gfp_flags &= ~__GFP_NORETRY;
	return (void *)__get_free_pages(gfp_flags, order);
}

static void **alloc_pg_vec(struct netlink_sock *nlk,
			   struct nl_mmap_req *req, unsigned int order)
{
	unsigned int block_nr = req->nm_block_nr;
	unsigned int i;
335
	void **pg_vec;
336 337 338 339 340 341

	pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
	if (pg_vec == NULL)
		return NULL;

	for (i = 0; i < block_nr; i++) {
342
		pg_vec[i] = alloc_one_pg_vec_page(order);
343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509
		if (pg_vec[i] == NULL)
			goto err1;
	}

	return pg_vec;
err1:
	free_pg_vec(pg_vec, order, block_nr);
	return NULL;
}

static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
			    bool closing, bool tx_ring)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring;
	struct sk_buff_head *queue;
	void **pg_vec = NULL;
	unsigned int order = 0;
	int err;

	ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
	queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;

	if (!closing) {
		if (atomic_read(&nlk->mapped))
			return -EBUSY;
		if (atomic_read(&ring->pending))
			return -EBUSY;
	}

	if (req->nm_block_nr) {
		if (ring->pg_vec != NULL)
			return -EBUSY;

		if ((int)req->nm_block_size <= 0)
			return -EINVAL;
		if (!IS_ALIGNED(req->nm_block_size, PAGE_SIZE))
			return -EINVAL;
		if (req->nm_frame_size < NL_MMAP_HDRLEN)
			return -EINVAL;
		if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
			return -EINVAL;

		ring->frames_per_block = req->nm_block_size /
					 req->nm_frame_size;
		if (ring->frames_per_block == 0)
			return -EINVAL;
		if (ring->frames_per_block * req->nm_block_nr !=
		    req->nm_frame_nr)
			return -EINVAL;

		order = get_order(req->nm_block_size);
		pg_vec = alloc_pg_vec(nlk, req, order);
		if (pg_vec == NULL)
			return -ENOMEM;
	} else {
		if (req->nm_frame_nr)
			return -EINVAL;
	}

	err = -EBUSY;
	mutex_lock(&nlk->pg_vec_lock);
	if (closing || atomic_read(&nlk->mapped) == 0) {
		err = 0;
		spin_lock_bh(&queue->lock);

		ring->frame_max		= req->nm_frame_nr - 1;
		ring->head		= 0;
		ring->frame_size	= req->nm_frame_size;
		ring->pg_vec_pages	= req->nm_block_size / PAGE_SIZE;

		swap(ring->pg_vec_len, req->nm_block_nr);
		swap(ring->pg_vec_order, order);
		swap(ring->pg_vec, pg_vec);

		__skb_queue_purge(queue);
		spin_unlock_bh(&queue->lock);

		WARN_ON(atomic_read(&nlk->mapped));
	}
	mutex_unlock(&nlk->pg_vec_lock);

	if (pg_vec)
		free_pg_vec(pg_vec, order, req->nm_block_nr);
	return err;
}

static void netlink_mm_open(struct vm_area_struct *vma)
{
	struct file *file = vma->vm_file;
	struct socket *sock = file->private_data;
	struct sock *sk = sock->sk;

	if (sk)
		atomic_inc(&nlk_sk(sk)->mapped);
}

static void netlink_mm_close(struct vm_area_struct *vma)
{
	struct file *file = vma->vm_file;
	struct socket *sock = file->private_data;
	struct sock *sk = sock->sk;

	if (sk)
		atomic_dec(&nlk_sk(sk)->mapped);
}

static const struct vm_operations_struct netlink_mmap_ops = {
	.open	= netlink_mm_open,
	.close	= netlink_mm_close,
};

static int netlink_mmap(struct file *file, struct socket *sock,
			struct vm_area_struct *vma)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring;
	unsigned long start, size, expected;
	unsigned int i;
	int err = -EINVAL;

	if (vma->vm_pgoff)
		return -EINVAL;

	mutex_lock(&nlk->pg_vec_lock);

	expected = 0;
	for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
		if (ring->pg_vec == NULL)
			continue;
		expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
	}

	if (expected == 0)
		goto out;

	size = vma->vm_end - vma->vm_start;
	if (size != expected)
		goto out;

	start = vma->vm_start;
	for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
		if (ring->pg_vec == NULL)
			continue;

		for (i = 0; i < ring->pg_vec_len; i++) {
			struct page *page;
			void *kaddr = ring->pg_vec[i];
			unsigned int pg_num;

			for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
				page = pgvec_to_page(kaddr);
				err = vm_insert_page(vma, start, page);
				if (err < 0)
					goto out;
				start += PAGE_SIZE;
				kaddr += PAGE_SIZE;
			}
		}
	}

	atomic_inc(&nlk->mapped);
	vma->vm_ops = &netlink_mmap_ops;
	err = 0;
out:
	mutex_unlock(&nlk->pg_vec_lock);
510
	return err;
511
}
512 513 514 515 516 517 518 519

static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
{
#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
	struct page *p_start, *p_end;

	/* First page is flushed through netlink_{get,set}_status */
	p_start = pgvec_to_page(hdr + PAGE_SIZE);
520
	p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603
	while (p_start <= p_end) {
		flush_dcache_page(p_start);
		p_start++;
	}
#endif
}

static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
{
	smp_rmb();
	flush_dcache_page(pgvec_to_page(hdr));
	return hdr->nm_status;
}

static void netlink_set_status(struct nl_mmap_hdr *hdr,
			       enum nl_mmap_status status)
{
	hdr->nm_status = status;
	flush_dcache_page(pgvec_to_page(hdr));
	smp_wmb();
}

static struct nl_mmap_hdr *
__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
{
	unsigned int pg_vec_pos, frame_off;

	pg_vec_pos = pos / ring->frames_per_block;
	frame_off  = pos % ring->frames_per_block;

	return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
}

static struct nl_mmap_hdr *
netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
		     enum nl_mmap_status status)
{
	struct nl_mmap_hdr *hdr;

	hdr = __netlink_lookup_frame(ring, pos);
	if (netlink_get_status(hdr) != status)
		return NULL;

	return hdr;
}

static struct nl_mmap_hdr *
netlink_current_frame(const struct netlink_ring *ring,
		      enum nl_mmap_status status)
{
	return netlink_lookup_frame(ring, ring->head, status);
}

static struct nl_mmap_hdr *
netlink_previous_frame(const struct netlink_ring *ring,
		       enum nl_mmap_status status)
{
	unsigned int prev;

	prev = ring->head ? ring->head - 1 : ring->frame_max;
	return netlink_lookup_frame(ring, prev, status);
}

static void netlink_increment_head(struct netlink_ring *ring)
{
	ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
}

static void netlink_forward_ring(struct netlink_ring *ring)
{
	unsigned int head = ring->head, pos = head;
	const struct nl_mmap_hdr *hdr;

	do {
		hdr = __netlink_lookup_frame(ring, pos);
		if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
			break;
		if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
			break;
		netlink_increment_head(ring);
	} while (ring->head != head);
}

604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622
static bool netlink_dump_space(struct netlink_sock *nlk)
{
	struct netlink_ring *ring = &nlk->rx_ring;
	struct nl_mmap_hdr *hdr;
	unsigned int n;

	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
	if (hdr == NULL)
		return false;

	n = ring->head + ring->frame_max / 2;
	if (n > ring->frame_max)
		n -= ring->frame_max;

	hdr = __netlink_lookup_frame(ring, n);

	return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
}

623 624 625 626 627 628
static unsigned int netlink_poll(struct file *file, struct socket *sock,
				 poll_table *wait)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	unsigned int mask;
629
	int err;
630

631 632 633 634 635
	if (nlk->rx_ring.pg_vec != NULL) {
		/* Memory mapped sockets don't call recvmsg(), so flow control
		 * for dumps is performed here. A dump is allowed to continue
		 * if at least half the ring is unused.
		 */
636
		while (nlk->cb_running && netlink_dump_space(nlk)) {
637 638 639 640 641 642 643 644 645
			err = netlink_dump(sk);
			if (err < 0) {
				sk->sk_err = err;
				sk->sk_error_report(sk);
				break;
			}
		}
		netlink_rcv_wake(sk);
	}
646

647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691
	mask = datagram_poll(file, sock, wait);

	spin_lock_bh(&sk->sk_receive_queue.lock);
	if (nlk->rx_ring.pg_vec) {
		netlink_forward_ring(&nlk->rx_ring);
		if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED))
			mask |= POLLIN | POLLRDNORM;
	}
	spin_unlock_bh(&sk->sk_receive_queue.lock);

	spin_lock_bh(&sk->sk_write_queue.lock);
	if (nlk->tx_ring.pg_vec) {
		if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
			mask |= POLLOUT | POLLWRNORM;
	}
	spin_unlock_bh(&sk->sk_write_queue.lock);

	return mask;
}

static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
{
	return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
}

static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
				   struct netlink_ring *ring,
				   struct nl_mmap_hdr *hdr)
{
	unsigned int size;
	void *data;

	size = ring->frame_size - NL_MMAP_HDRLEN;
	data = (void *)hdr + NL_MMAP_HDRLEN;

	skb->head	= data;
	skb->data	= data;
	skb_reset_tail_pointer(skb);
	skb->end	= skb->tail + size;
	skb->len	= 0;

	skb->destructor	= netlink_skb_destructor;
	NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
	NETLINK_CB(skb).sk = sk;
}
692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789

static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
				u32 dst_portid, u32 dst_group,
				struct sock_iocb *siocb)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring;
	struct nl_mmap_hdr *hdr;
	struct sk_buff *skb;
	unsigned int maxlen;
	bool excl = true;
	int err = 0, len = 0;

	/* Netlink messages are validated by the receiver before processing.
	 * In order to avoid userspace changing the contents of the message
	 * after validation, the socket and the ring may only be used by a
	 * single process, otherwise we fall back to copying.
	 */
	if (atomic_long_read(&sk->sk_socket->file->f_count) > 2 ||
	    atomic_read(&nlk->mapped) > 1)
		excl = false;

	mutex_lock(&nlk->pg_vec_lock);

	ring   = &nlk->tx_ring;
	maxlen = ring->frame_size - NL_MMAP_HDRLEN;

	do {
		hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
		if (hdr == NULL) {
			if (!(msg->msg_flags & MSG_DONTWAIT) &&
			    atomic_read(&nlk->tx_ring.pending))
				schedule();
			continue;
		}
		if (hdr->nm_len > maxlen) {
			err = -EINVAL;
			goto out;
		}

		netlink_frame_flush_dcache(hdr);

		if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
			skb = alloc_skb_head(GFP_KERNEL);
			if (skb == NULL) {
				err = -ENOBUFS;
				goto out;
			}
			sock_hold(sk);
			netlink_ring_setup_skb(skb, sk, ring, hdr);
			NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
			__skb_put(skb, hdr->nm_len);
			netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
			atomic_inc(&ring->pending);
		} else {
			skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
			if (skb == NULL) {
				err = -ENOBUFS;
				goto out;
			}
			__skb_put(skb, hdr->nm_len);
			memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
			netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
		}

		netlink_increment_head(ring);

		NETLINK_CB(skb).portid	  = nlk->portid;
		NETLINK_CB(skb).dst_group = dst_group;
		NETLINK_CB(skb).creds	  = siocb->scm->creds;

		err = security_netlink_send(sk, skb);
		if (err) {
			kfree_skb(skb);
			goto out;
		}

		if (unlikely(dst_group)) {
			atomic_inc(&skb->users);
			netlink_broadcast(sk, skb, dst_portid, dst_group,
					  GFP_KERNEL);
		}
		err = netlink_unicast(sk, skb, dst_portid,
				      msg->msg_flags & MSG_DONTWAIT);
		if (err < 0)
			goto out;
		len += err;

	} while (hdr != NULL ||
		 (!(msg->msg_flags & MSG_DONTWAIT) &&
		  atomic_read(&nlk->tx_ring.pending)));

	if (len > 0)
		err = len;
out:
	mutex_unlock(&nlk->pg_vec_lock);
	return err;
}
790 791 792 793 794 795 796 797 798

static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
{
	struct nl_mmap_hdr *hdr;

	hdr = netlink_mmap_hdr(skb);
	hdr->nm_len	= skb->len;
	hdr->nm_group	= NETLINK_CB(skb).dst_group;
	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
799 800
	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818
	netlink_frame_flush_dcache(hdr);
	netlink_set_status(hdr, NL_MMAP_STATUS_VALID);

	NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
	kfree_skb(skb);
}

static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_ring *ring = &nlk->rx_ring;
	struct nl_mmap_hdr *hdr;

	spin_lock_bh(&sk->sk_receive_queue.lock);
	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
	if (hdr == NULL) {
		spin_unlock_bh(&sk->sk_receive_queue.lock);
		kfree_skb(skb);
819
		netlink_overrun(sk);
820 821 822 823 824 825 826 827 828
		return;
	}
	netlink_increment_head(ring);
	__skb_queue_tail(&sk->sk_receive_queue, skb);
	spin_unlock_bh(&sk->sk_receive_queue.lock);

	hdr->nm_len	= skb->len;
	hdr->nm_group	= NETLINK_CB(skb).dst_group;
	hdr->nm_pid	= NETLINK_CB(skb).creds.pid;
829 830
	hdr->nm_uid	= from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
	hdr->nm_gid	= from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
831 832 833
	netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
}

834
#else /* CONFIG_NETLINK_MMAP */
835
#define netlink_skb_is_mmaped(skb)	false
836
#define netlink_rx_is_mmaped(sk)	false
837
#define netlink_tx_is_mmaped(sk)	false
838
#define netlink_mmap			sock_no_mmap
839
#define netlink_poll			datagram_poll
840
#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, siocb)	0
841 842
#endif /* CONFIG_NETLINK_MMAP */

843 844
static void netlink_skb_destructor(struct sk_buff *skb)
{
845 846 847 848 849 850 851 852 853 854 855 856 857 858
#ifdef CONFIG_NETLINK_MMAP
	struct nl_mmap_hdr *hdr;
	struct netlink_ring *ring;
	struct sock *sk;

	/* If a packet from the kernel to userspace was freed because of an
	 * error without being delivered to userspace, the kernel must reset
	 * the status. In the direction userspace to kernel, the status is
	 * always reset here after the packet was processed and freed.
	 */
	if (netlink_skb_is_mmaped(skb)) {
		hdr = netlink_mmap_hdr(skb);
		sk = NETLINK_CB(skb).sk;

859 860 861 862 863 864 865 866 867
		if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
			netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
			ring = &nlk_sk(sk)->tx_ring;
		} else {
			if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
				hdr->nm_len = 0;
				netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
			}
			ring = &nlk_sk(sk)->rx_ring;
868 869 870 871 872 873
		}

		WARN_ON(atomic_read(&ring->pending) == 0);
		atomic_dec(&ring->pending);
		sock_put(sk);

874
		skb->head = NULL;
875 876
	}
#endif
877
	if (is_vmalloc_addr(skb->head)) {
878 879 880 881
		if (!skb->cloned ||
		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
			vfree(skb->head);

882 883
		skb->head = NULL;
	}
884 885
	if (skb->sk != NULL)
		sock_rfree(skb);
886 887 888 889 890 891 892 893 894 895 896
}

static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
{
	WARN_ON(skb->sk != NULL);
	skb->sk = sk;
	skb->destructor = netlink_skb_destructor;
	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
	sk_mem_charge(sk, skb->truesize);
}

L
Linus Torvalds 已提交
897 898
static void netlink_sock_destruct(struct sock *sk)
{
899 900
	struct netlink_sock *nlk = nlk_sk(sk);

901 902 903
	if (nlk->cb_running) {
		if (nlk->cb.done)
			nlk->cb.done(&nlk->cb);
904

905 906
		module_put(nlk->cb.module);
		kfree_skb(nlk->cb.skb);
907 908
	}

L
Linus Torvalds 已提交
909
	skb_queue_purge(&sk->sk_receive_queue);
910 911 912 913 914 915 916 917 918 919 920 921
#ifdef CONFIG_NETLINK_MMAP
	if (1) {
		struct nl_mmap_req req;

		memset(&req, 0, sizeof(req));
		if (nlk->rx_ring.pg_vec)
			netlink_set_ring(sk, &req, true, false);
		memset(&req, 0, sizeof(req));
		if (nlk->tx_ring.pg_vec)
			netlink_set_ring(sk, &req, true, true);
	}
#endif /* CONFIG_NETLINK_MMAP */
L
Linus Torvalds 已提交
922 923

	if (!sock_flag(sk, SOCK_DEAD)) {
924
		printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
L
Linus Torvalds 已提交
925 926
		return;
	}
927 928 929 930

	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
	WARN_ON(atomic_read(&sk->sk_wmem_alloc));
	WARN_ON(nlk_sk(sk)->groups);
L
Linus Torvalds 已提交
931 932
}

933 934
/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
 * SMP. Look, when several writers sleep and reader wakes them up, all but one
L
Linus Torvalds 已提交
935 936 937 938
 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
 * this, _but_ remember, it adds useless work on UP machines.
 */

939
void netlink_table_grab(void)
940
	__acquires(nl_table_lock)
L
Linus Torvalds 已提交
941
{
942 943
	might_sleep();

944
	write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
945 946 947 948 949

	if (atomic_read(&nl_table_users)) {
		DECLARE_WAITQUEUE(wait, current);

		add_wait_queue_exclusive(&nl_table_wait, &wait);
950
		for (;;) {
L
Linus Torvalds 已提交
951 952 953
			set_current_state(TASK_UNINTERRUPTIBLE);
			if (atomic_read(&nl_table_users) == 0)
				break;
954
			write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
955
			schedule();
956
			write_lock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
957 958 959 960 961 962 963
		}

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nl_table_wait, &wait);
	}
}

964
void netlink_table_ungrab(void)
965
	__releases(nl_table_lock)
L
Linus Torvalds 已提交
966
{
967
	write_unlock_irq(&nl_table_lock);
L
Linus Torvalds 已提交
968 969 970
	wake_up(&nl_table_wait);
}

971
static inline void
L
Linus Torvalds 已提交
972 973 974 975 976 977 978 979 980
netlink_lock_table(void)
{
	/* read_lock() synchronizes us to netlink_table_grab */

	read_lock(&nl_table_lock);
	atomic_inc(&nl_table_users);
	read_unlock(&nl_table_lock);
}

981
static inline void
L
Linus Torvalds 已提交
982 983 984 985 986 987
netlink_unlock_table(void)
{
	if (atomic_dec_and_test(&nl_table_users))
		wake_up(&nl_table_wait);
}

988 989 990 991 992
static bool netlink_compare(struct net *net, struct sock *sk)
{
	return net_eq(sock_net(sk), net);
}

993
static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
L
Linus Torvalds 已提交
994
{
995 996
	struct netlink_table *table = &nl_table[protocol];
	struct nl_portid_hash *hash = &table->hash;
L
Linus Torvalds 已提交
997 998 999 1000
	struct hlist_head *head;
	struct sock *sk;

	read_lock(&nl_table_lock);
1001
	head = nl_portid_hashfn(hash, portid);
1002
	sk_for_each(sk, head) {
1003 1004
		if (table->compare(net, sk) &&
		    (nlk_sk(sk)->portid == portid)) {
L
Linus Torvalds 已提交
1005 1006 1007 1008 1009 1010 1011 1012 1013 1014
			sock_hold(sk);
			goto found;
		}
	}
	sk = NULL;
found:
	read_unlock(&nl_table_lock);
	return sk;
}

1015
static struct hlist_head *nl_portid_hash_zalloc(size_t size)
L
Linus Torvalds 已提交
1016 1017
{
	if (size <= PAGE_SIZE)
E
Eric Dumazet 已提交
1018
		return kzalloc(size, GFP_ATOMIC);
L
Linus Torvalds 已提交
1019 1020
	else
		return (struct hlist_head *)
E
Eric Dumazet 已提交
1021 1022
			__get_free_pages(GFP_ATOMIC | __GFP_ZERO,
					 get_order(size));
L
Linus Torvalds 已提交
1023 1024
}

1025
static void nl_portid_hash_free(struct hlist_head *table, size_t size)
L
Linus Torvalds 已提交
1026 1027 1028 1029 1030 1031 1032
{
	if (size <= PAGE_SIZE)
		kfree(table);
	else
		free_pages((unsigned long)table, get_order(size));
}

1033
static int nl_portid_hash_rehash(struct nl_portid_hash *hash, int grow)
L
Linus Torvalds 已提交
1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050
{
	unsigned int omask, mask, shift;
	size_t osize, size;
	struct hlist_head *otable, *table;
	int i;

	omask = mask = hash->mask;
	osize = size = (mask + 1) * sizeof(*table);
	shift = hash->shift;

	if (grow) {
		if (++shift > hash->max_shift)
			return 0;
		mask = mask * 2 + 1;
		size *= 2;
	}

1051
	table = nl_portid_hash_zalloc(size);
L
Linus Torvalds 已提交
1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062
	if (!table)
		return 0;

	otable = hash->table;
	hash->table = table;
	hash->mask = mask;
	hash->shift = shift;
	get_random_bytes(&hash->rnd, sizeof(hash->rnd));

	for (i = 0; i <= omask; i++) {
		struct sock *sk;
1063
		struct hlist_node *tmp;
L
Linus Torvalds 已提交
1064

1065
		sk_for_each_safe(sk, tmp, &otable[i])
1066
			__sk_add_node(sk, nl_portid_hashfn(hash, nlk_sk(sk)->portid));
L
Linus Torvalds 已提交
1067 1068
	}

1069
	nl_portid_hash_free(otable, osize);
L
Linus Torvalds 已提交
1070 1071 1072 1073
	hash->rehash_time = jiffies + 10 * 60 * HZ;
	return 1;
}

1074
static inline int nl_portid_hash_dilute(struct nl_portid_hash *hash, int len)
L
Linus Torvalds 已提交
1075 1076 1077
{
	int avg = hash->entries >> hash->shift;

1078
	if (unlikely(avg > 1) && nl_portid_hash_rehash(hash, 1))
L
Linus Torvalds 已提交
1079 1080 1081
		return 1;

	if (unlikely(len > avg) && time_after(jiffies, hash->rehash_time)) {
1082
		nl_portid_hash_rehash(hash, 0);
L
Linus Torvalds 已提交
1083 1084 1085 1086 1087 1088
		return 1;
	}

	return 0;
}

1089
static const struct proto_ops netlink_ops;
L
Linus Torvalds 已提交
1090

1091 1092 1093 1094 1095 1096
static void
netlink_update_listeners(struct sock *sk)
{
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];
	unsigned long mask;
	unsigned int i;
1097 1098 1099 1100 1101
	struct listeners *listeners;

	listeners = nl_deref_protected(tbl->listeners);
	if (!listeners)
		return;
1102

1103
	for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
1104
		mask = 0;
1105
		sk_for_each_bound(sk, &tbl->mc_list) {
1106 1107 1108
			if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
				mask |= nlk_sk(sk)->groups[i];
		}
1109
		listeners->masks[i] = mask;
1110 1111 1112 1113 1114
	}
	/* this function is only called with the netlink table "grabbed", which
	 * makes sure updates are visible before bind or setsockopt return. */
}

1115
static int netlink_insert(struct sock *sk, struct net *net, u32 portid)
L
Linus Torvalds 已提交
1116
{
1117 1118
	struct netlink_table *table = &nl_table[sk->sk_protocol];
	struct nl_portid_hash *hash = &table->hash;
L
Linus Torvalds 已提交
1119 1120 1121 1122 1123 1124
	struct hlist_head *head;
	int err = -EADDRINUSE;
	struct sock *osk;
	int len;

	netlink_table_grab();
1125
	head = nl_portid_hashfn(hash, portid);
L
Linus Torvalds 已提交
1126
	len = 0;
1127
	sk_for_each(osk, head) {
1128 1129
		if (table->compare(net, osk) &&
		    (nlk_sk(osk)->portid == portid))
L
Linus Torvalds 已提交
1130 1131 1132
			break;
		len++;
	}
1133
	if (osk)
L
Linus Torvalds 已提交
1134 1135 1136
		goto err;

	err = -EBUSY;
1137
	if (nlk_sk(sk)->portid)
L
Linus Torvalds 已提交
1138 1139 1140 1141 1142 1143
		goto err;

	err = -ENOMEM;
	if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
		goto err;

1144 1145
	if (len && nl_portid_hash_dilute(hash, len))
		head = nl_portid_hashfn(hash, portid);
L
Linus Torvalds 已提交
1146
	hash->entries++;
1147
	nlk_sk(sk)->portid = portid;
L
Linus Torvalds 已提交
1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158
	sk_add_node(sk, head);
	err = 0;

err:
	netlink_table_ungrab();
	return err;
}

static void netlink_remove(struct sock *sk)
{
	netlink_table_grab();
1159 1160
	if (sk_del_node_init(sk))
		nl_table[sk->sk_protocol].hash.entries--;
1161
	if (nlk_sk(sk)->subscriptions)
L
Linus Torvalds 已提交
1162 1163 1164 1165 1166 1167 1168 1169 1170 1171
		__sk_del_bind_node(sk);
	netlink_table_ungrab();
}

static struct proto netlink_proto = {
	.name	  = "NETLINK",
	.owner	  = THIS_MODULE,
	.obj_size = sizeof(struct netlink_sock),
};

1172 1173
static int __netlink_create(struct net *net, struct socket *sock,
			    struct mutex *cb_mutex, int protocol)
L
Linus Torvalds 已提交
1174 1175 1176
{
	struct sock *sk;
	struct netlink_sock *nlk;
1177 1178 1179

	sock->ops = &netlink_ops;

1180
	sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto);
1181 1182 1183 1184 1185 1186
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	nlk = nlk_sk(sk);
E
Eric Dumazet 已提交
1187
	if (cb_mutex) {
1188
		nlk->cb_mutex = cb_mutex;
E
Eric Dumazet 已提交
1189
	} else {
1190 1191 1192
		nlk->cb_mutex = &nlk->cb_def_mutex;
		mutex_init(nlk->cb_mutex);
	}
1193
	init_waitqueue_head(&nlk->wait);
1194 1195 1196
#ifdef CONFIG_NETLINK_MMAP
	mutex_init(&nlk->pg_vec_lock);
#endif
1197 1198 1199 1200 1201 1202

	sk->sk_destruct = netlink_sock_destruct;
	sk->sk_protocol = protocol;
	return 0;
}

1203 1204
static int netlink_create(struct net *net, struct socket *sock, int protocol,
			  int kern)
1205 1206
{
	struct module *module = NULL;
1207
	struct mutex *cb_mutex;
1208
	struct netlink_sock *nlk;
1209
	void (*bind)(int group);
1210
	int err = 0;
L
Linus Torvalds 已提交
1211 1212 1213 1214 1215 1216

	sock->state = SS_UNCONNECTED;

	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
		return -ESOCKTNOSUPPORT;

1217
	if (protocol < 0 || protocol >= MAX_LINKS)
L
Linus Torvalds 已提交
1218 1219
		return -EPROTONOSUPPORT;

1220
	netlink_lock_table();
1221
#ifdef CONFIG_MODULES
1222
	if (!nl_table[protocol].registered) {
1223
		netlink_unlock_table();
1224
		request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
1225
		netlink_lock_table();
1226
	}
1227 1228 1229 1230
#endif
	if (nl_table[protocol].registered &&
	    try_module_get(nl_table[protocol].module))
		module = nl_table[protocol].module;
1231 1232
	else
		err = -EPROTONOSUPPORT;
1233
	cb_mutex = nl_table[protocol].cb_mutex;
1234
	bind = nl_table[protocol].bind;
1235
	netlink_unlock_table();
1236

1237 1238 1239
	if (err < 0)
		goto out;

1240 1241
	err = __netlink_create(net, sock, cb_mutex, protocol);
	if (err < 0)
1242 1243
		goto out_module;

1244
	local_bh_disable();
1245
	sock_prot_inuse_add(net, &netlink_proto, 1);
1246 1247
	local_bh_enable();

1248 1249
	nlk = nlk_sk(sock->sk);
	nlk->module = module;
1250
	nlk->netlink_bind = bind;
1251 1252
out:
	return err;
L
Linus Torvalds 已提交
1253

1254 1255 1256
out_module:
	module_put(module);
	goto out;
L
Linus Torvalds 已提交
1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267
}

static int netlink_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk;

	if (!sk)
		return 0;

	netlink_remove(sk);
1268
	sock_orphan(sk);
L
Linus Torvalds 已提交
1269 1270
	nlk = nlk_sk(sk);

1271 1272 1273 1274
	/*
	 * OK. Socket is unlinked, any packets that arrive now
	 * will be purged.
	 */
L
Linus Torvalds 已提交
1275 1276 1277 1278 1279 1280

	sock->sk = NULL;
	wake_up_interruptible_all(&nlk->wait);

	skb_queue_purge(&sk->sk_write_queue);

1281
	if (nlk->portid) {
L
Linus Torvalds 已提交
1282
		struct netlink_notify n = {
1283
						.net = sock_net(sk),
L
Linus Torvalds 已提交
1284
						.protocol = sk->sk_protocol,
1285
						.portid = nlk->portid,
L
Linus Torvalds 已提交
1286
					  };
1287 1288
		atomic_notifier_call_chain(&netlink_chain,
				NETLINK_URELEASE, &n);
1289
	}
1290

1291
	module_put(nlk->module);
1292

1293
	netlink_table_grab();
1294
	if (netlink_is_kernel(sk)) {
1295 1296
		BUG_ON(nl_table[sk->sk_protocol].registered == 0);
		if (--nl_table[sk->sk_protocol].registered == 0) {
1297 1298 1299 1300 1301
			struct listeners *old;

			old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
			RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
			kfree_rcu(old, rcu);
1302
			nl_table[sk->sk_protocol].module = NULL;
1303 1304
			nl_table[sk->sk_protocol].bind = NULL;
			nl_table[sk->sk_protocol].flags = 0;
1305 1306
			nl_table[sk->sk_protocol].registered = 0;
		}
E
Eric Dumazet 已提交
1307
	} else if (nlk->subscriptions) {
1308
		netlink_update_listeners(sk);
E
Eric Dumazet 已提交
1309
	}
1310
	netlink_table_ungrab();
1311

1312 1313 1314
	kfree(nlk->groups);
	nlk->groups = NULL;

1315
	local_bh_disable();
1316
	sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
1317
	local_bh_enable();
L
Linus Torvalds 已提交
1318 1319 1320 1321 1322 1323 1324
	sock_put(sk);
	return 0;
}

static int netlink_autobind(struct socket *sock)
{
	struct sock *sk = sock->sk;
1325
	struct net *net = sock_net(sk);
1326 1327
	struct netlink_table *table = &nl_table[sk->sk_protocol];
	struct nl_portid_hash *hash = &table->hash;
L
Linus Torvalds 已提交
1328 1329
	struct hlist_head *head;
	struct sock *osk;
1330
	s32 portid = task_tgid_vnr(current);
L
Linus Torvalds 已提交
1331 1332 1333 1334 1335 1336
	int err;
	static s32 rover = -4097;

retry:
	cond_resched();
	netlink_table_grab();
1337
	head = nl_portid_hashfn(hash, portid);
1338
	sk_for_each(osk, head) {
1339
		if (!table->compare(net, osk))
1340
			continue;
1341 1342 1343
		if (nlk_sk(osk)->portid == portid) {
			/* Bind collision, search negative portid values. */
			portid = rover--;
L
Linus Torvalds 已提交
1344 1345 1346 1347 1348 1349 1350 1351
			if (rover > -4097)
				rover = -4097;
			netlink_table_ungrab();
			goto retry;
		}
	}
	netlink_table_ungrab();

1352
	err = netlink_insert(sk, net, portid);
L
Linus Torvalds 已提交
1353 1354
	if (err == -EADDRINUSE)
		goto retry;
1355 1356 1357 1358 1359 1360

	/* If 2 threads race to autobind, that is fine.  */
	if (err == -EBUSY)
		err = 0;

	return err;
L
Linus Torvalds 已提交
1361 1362
}

1363
static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
1364
{
1365
	return (nl_table[sock->sk->sk_protocol].flags & flag) ||
1366
		ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
1367
}
L
Linus Torvalds 已提交
1368

1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380
static void
netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (nlk->subscriptions && !subscriptions)
		__sk_del_bind_node(sk);
	else if (!nlk->subscriptions && subscriptions)
		sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
	nlk->subscriptions = subscriptions;
}

1381
static int netlink_realloc_groups(struct sock *sk)
1382 1383 1384
{
	struct netlink_sock *nlk = nlk_sk(sk);
	unsigned int groups;
1385
	unsigned long *new_groups;
1386 1387
	int err = 0;

1388 1389
	netlink_table_grab();

1390
	groups = nl_table[sk->sk_protocol].groups;
1391
	if (!nl_table[sk->sk_protocol].registered) {
1392
		err = -ENOENT;
1393 1394
		goto out_unlock;
	}
1395

1396 1397
	if (nlk->ngroups >= groups)
		goto out_unlock;
1398

1399 1400 1401 1402 1403
	new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
	if (new_groups == NULL) {
		err = -ENOMEM;
		goto out_unlock;
	}
1404
	memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
1405 1406 1407
	       NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));

	nlk->groups = new_groups;
1408
	nlk->ngroups = groups;
1409 1410 1411
 out_unlock:
	netlink_table_ungrab();
	return err;
1412 1413
}

1414 1415
static int netlink_bind(struct socket *sock, struct sockaddr *addr,
			int addr_len)
L
Linus Torvalds 已提交
1416 1417
{
	struct sock *sk = sock->sk;
1418
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
1419 1420 1421
	struct netlink_sock *nlk = nlk_sk(sk);
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
	int err;
1422

1423 1424 1425
	if (addr_len < sizeof(struct sockaddr_nl))
		return -EINVAL;

L
Linus Torvalds 已提交
1426 1427 1428 1429
	if (nladdr->nl_family != AF_NETLINK)
		return -EINVAL;

	/* Only superuser is allowed to listen multicasts */
1430
	if (nladdr->nl_groups) {
1431
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1432
			return -EPERM;
1433 1434 1435
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
1436
	}
L
Linus Torvalds 已提交
1437

1438 1439
	if (nlk->portid) {
		if (nladdr->nl_pid != nlk->portid)
L
Linus Torvalds 已提交
1440 1441 1442
			return -EINVAL;
	} else {
		err = nladdr->nl_pid ?
1443
			netlink_insert(sk, net, nladdr->nl_pid) :
L
Linus Torvalds 已提交
1444 1445 1446 1447 1448
			netlink_autobind(sock);
		if (err)
			return err;
	}

1449
	if (!nladdr->nl_groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
L
Linus Torvalds 已提交
1450 1451 1452
		return 0;

	netlink_table_grab();
1453
	netlink_update_subscriptions(sk, nlk->subscriptions +
1454 1455 1456
					 hweight32(nladdr->nl_groups) -
					 hweight32(nlk->groups[0]));
	nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | nladdr->nl_groups;
1457
	netlink_update_listeners(sk);
L
Linus Torvalds 已提交
1458 1459
	netlink_table_ungrab();

1460 1461 1462
	if (nlk->netlink_bind && nlk->groups[0]) {
		int i;

1463
		for (i = 0; i < nlk->ngroups; i++) {
1464 1465 1466 1467 1468
			if (test_bit(i, nlk->groups))
				nlk->netlink_bind(i);
		}
	}

L
Linus Torvalds 已提交
1469 1470 1471 1472 1473 1474 1475 1476 1477
	return 0;
}

static int netlink_connect(struct socket *sock, struct sockaddr *addr,
			   int alen, int flags)
{
	int err = 0;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1478
	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
L
Linus Torvalds 已提交
1479

1480 1481 1482
	if (alen < sizeof(addr->sa_family))
		return -EINVAL;

L
Linus Torvalds 已提交
1483 1484
	if (addr->sa_family == AF_UNSPEC) {
		sk->sk_state	= NETLINK_UNCONNECTED;
1485
		nlk->dst_portid	= 0;
1486
		nlk->dst_group  = 0;
L
Linus Torvalds 已提交
1487 1488 1489 1490 1491
		return 0;
	}
	if (addr->sa_family != AF_NETLINK)
		return -EINVAL;

1492
	if ((nladdr->nl_groups || nladdr->nl_pid) &&
1493
	    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
L
Linus Torvalds 已提交
1494 1495
		return -EPERM;

1496
	if (!nlk->portid)
L
Linus Torvalds 已提交
1497 1498 1499 1500
		err = netlink_autobind(sock);

	if (err == 0) {
		sk->sk_state	= NETLINK_CONNECTED;
1501
		nlk->dst_portid = nladdr->nl_pid;
1502
		nlk->dst_group  = ffs(nladdr->nl_groups);
L
Linus Torvalds 已提交
1503 1504 1505 1506 1507
	}

	return err;
}

1508 1509
static int netlink_getname(struct socket *sock, struct sockaddr *addr,
			   int *addr_len, int peer)
L
Linus Torvalds 已提交
1510 1511 1512
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
1513
	DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1514

L
Linus Torvalds 已提交
1515 1516 1517 1518 1519
	nladdr->nl_family = AF_NETLINK;
	nladdr->nl_pad = 0;
	*addr_len = sizeof(*nladdr);

	if (peer) {
1520
		nladdr->nl_pid = nlk->dst_portid;
1521
		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
L
Linus Torvalds 已提交
1522
	} else {
1523
		nladdr->nl_pid = nlk->portid;
1524
		nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
L
Linus Torvalds 已提交
1525 1526 1527 1528
	}
	return 0;
}

1529
static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
L
Linus Torvalds 已提交
1530 1531 1532 1533
{
	struct sock *sock;
	struct netlink_sock *nlk;

1534
	sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
L
Linus Torvalds 已提交
1535 1536 1537 1538 1539
	if (!sock)
		return ERR_PTR(-ECONNREFUSED);

	/* Don't bother queuing skb if kernel socket has no input function */
	nlk = nlk_sk(sock);
1540
	if (sock->sk_state == NETLINK_CONNECTED &&
1541
	    nlk->dst_portid != nlk_sk(ssk)->portid) {
L
Linus Torvalds 已提交
1542 1543 1544 1545 1546 1547 1548 1549
		sock_put(sock);
		return ERR_PTR(-ECONNREFUSED);
	}
	return sock;
}

struct sock *netlink_getsockbyfilp(struct file *filp)
{
A
Al Viro 已提交
1550
	struct inode *inode = file_inode(filp);
L
Linus Torvalds 已提交
1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563
	struct sock *sock;

	if (!S_ISSOCK(inode->i_mode))
		return ERR_PTR(-ENOTSOCK);

	sock = SOCKET_I(inode)->sk;
	if (sock->sk_family != AF_NETLINK)
		return ERR_PTR(-EINVAL);

	sock_hold(sock);
	return sock;
}

1564 1565
static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
					       int broadcast)
1566 1567 1568 1569
{
	struct sk_buff *skb;
	void *data;

1570
	if (size <= NLMSG_GOODSIZE || broadcast)
1571 1572
		return alloc_skb(size, GFP_KERNEL);

1573 1574
	size = SKB_DATA_ALIGN(size) +
	       SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1575 1576 1577

	data = vmalloc(size);
	if (data == NULL)
1578
		return NULL;
1579

1580 1581 1582 1583 1584 1585 1586
	skb = build_skb(data, size);
	if (skb == NULL)
		vfree(data);
	else {
		skb->head_frag = 0;
		skb->destructor = netlink_skb_destructor;
	}
1587 1588 1589 1590

	return skb;
}

L
Linus Torvalds 已提交
1591 1592 1593 1594 1595 1596 1597 1598 1599 1600
/*
 * Attach a skb to a netlink socket.
 * The caller must hold a reference to the destination socket. On error, the
 * reference is dropped. The skb is not send to the destination, just all
 * all error checks are performed and memory in the queue is reserved.
 * Return values:
 * < 0: error. skb freed, reference to sock dropped.
 * 0: continue
 * 1: repeat lookup - reference dropped while waiting for socket memory.
 */
1601
int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
P
Patrick McHardy 已提交
1602
		      long *timeo, struct sock *ssk)
L
Linus Torvalds 已提交
1603 1604 1605 1606 1607
{
	struct netlink_sock *nlk;

	nlk = nlk_sk(sk);

1608 1609 1610
	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
	     test_bit(NETLINK_CONGESTED, &nlk->state)) &&
	    !netlink_skb_is_mmaped(skb)) {
L
Linus Torvalds 已提交
1611
		DECLARE_WAITQUEUE(wait, current);
P
Patrick McHardy 已提交
1612
		if (!*timeo) {
1613
			if (!ssk || netlink_is_kernel(ssk))
L
Linus Torvalds 已提交
1614 1615 1616 1617 1618 1619 1620 1621 1622 1623
				netlink_overrun(sk);
			sock_put(sk);
			kfree_skb(skb);
			return -EAGAIN;
		}

		__set_current_state(TASK_INTERRUPTIBLE);
		add_wait_queue(&nlk->wait, &wait);

		if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1624
		     test_bit(NETLINK_CONGESTED, &nlk->state)) &&
L
Linus Torvalds 已提交
1625
		    !sock_flag(sk, SOCK_DEAD))
P
Patrick McHardy 已提交
1626
			*timeo = schedule_timeout(*timeo);
L
Linus Torvalds 已提交
1627 1628 1629 1630 1631 1632 1633

		__set_current_state(TASK_RUNNING);
		remove_wait_queue(&nlk->wait, &wait);
		sock_put(sk);

		if (signal_pending(current)) {
			kfree_skb(skb);
P
Patrick McHardy 已提交
1634
			return sock_intr_errno(*timeo);
L
Linus Torvalds 已提交
1635 1636 1637
		}
		return 1;
	}
1638
	netlink_skb_set_owner_r(skb, sk);
L
Linus Torvalds 已提交
1639 1640 1641
	return 0;
}

1642
static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1643 1644 1645
{
	int len = skb->len;

1646 1647
	netlink_deliver_tap(skb);

1648 1649 1650 1651 1652 1653 1654 1655
#ifdef CONFIG_NETLINK_MMAP
	if (netlink_skb_is_mmaped(skb))
		netlink_queue_mmaped_skb(sk, skb);
	else if (netlink_rx_is_mmaped(sk))
		netlink_ring_set_copied(sk, skb);
	else
#endif /* CONFIG_NETLINK_MMAP */
		skb_queue_tail(&sk->sk_receive_queue, skb);
1656
	sk->sk_data_ready(sk);
1657 1658 1659 1660 1661 1662 1663
	return len;
}

int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
	int len = __netlink_sendskb(sk, skb);

L
Linus Torvalds 已提交
1664 1665 1666 1667 1668 1669 1670 1671 1672 1673
	sock_put(sk);
	return len;
}

void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
{
	kfree_skb(skb);
	sock_put(sk);
}

1674
static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
L
Linus Torvalds 已提交
1675 1676 1677
{
	int delta;

1678
	WARN_ON(skb->sk != NULL);
1679 1680
	if (netlink_skb_is_mmaped(skb))
		return skb;
L
Linus Torvalds 已提交
1681

1682
	delta = skb->end - skb->tail;
1683
	if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
L
Linus Torvalds 已提交
1684 1685 1686 1687 1688 1689
		return skb;

	if (skb_shared(skb)) {
		struct sk_buff *nskb = skb_clone(skb, allocation);
		if (!nskb)
			return skb;
1690
		consume_skb(skb);
L
Linus Torvalds 已提交
1691 1692 1693 1694 1695 1696 1697 1698 1699
		skb = nskb;
	}

	if (!pskb_expand_head(skb, 0, -delta, allocation))
		skb->truesize -= delta;

	return skb;
}

1700 1701
static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
				  struct sock *ssk)
1702 1703 1704 1705 1706 1707 1708
{
	int ret;
	struct netlink_sock *nlk = nlk_sk(sk);

	ret = -ECONNREFUSED;
	if (nlk->netlink_rcv != NULL) {
		ret = skb->len;
1709
		netlink_skb_set_owner_r(skb, sk);
1710
		NETLINK_CB(skb).sk = ssk;
1711
		netlink_deliver_tap_kernel(sk, ssk, skb);
1712
		nlk->netlink_rcv(skb);
1713 1714 1715
		consume_skb(skb);
	} else {
		kfree_skb(skb);
1716 1717 1718 1719 1720 1721
	}
	sock_put(sk);
	return ret;
}

int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1722
		    u32 portid, int nonblock)
L
Linus Torvalds 已提交
1723 1724 1725 1726 1727 1728 1729 1730 1731
{
	struct sock *sk;
	int err;
	long timeo;

	skb = netlink_trim(skb, gfp_any());

	timeo = sock_sndtimeo(ssk, nonblock);
retry:
1732
	sk = netlink_getsockbyportid(ssk, portid);
L
Linus Torvalds 已提交
1733 1734 1735 1736
	if (IS_ERR(sk)) {
		kfree_skb(skb);
		return PTR_ERR(sk);
	}
1737
	if (netlink_is_kernel(sk))
1738
		return netlink_unicast_kernel(sk, skb, ssk);
1739

1740
	if (sk_filter(sk, skb)) {
W
Wang Chen 已提交
1741
		err = skb->len;
1742 1743 1744 1745 1746
		kfree_skb(skb);
		sock_put(sk);
		return err;
	}

1747
	err = netlink_attachskb(sk, skb, &timeo, ssk);
L
Linus Torvalds 已提交
1748 1749 1750 1751 1752
	if (err == 1)
		goto retry;
	if (err)
		return err;

1753
	return netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
1754
}
1755
EXPORT_SYMBOL(netlink_unicast);
L
Linus Torvalds 已提交
1756

1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775
struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
				  u32 dst_portid, gfp_t gfp_mask)
{
#ifdef CONFIG_NETLINK_MMAP
	struct sock *sk = NULL;
	struct sk_buff *skb;
	struct netlink_ring *ring;
	struct nl_mmap_hdr *hdr;
	unsigned int maxlen;

	sk = netlink_getsockbyportid(ssk, dst_portid);
	if (IS_ERR(sk))
		goto out;

	ring = &nlk_sk(sk)->rx_ring;
	/* fast-path without atomic ops for common case: non-mmaped receiver */
	if (ring->pg_vec == NULL)
		goto out_put;

1776 1777 1778
	if (ring->frame_size - NL_MMAP_HDRLEN < size)
		goto out_put;

1779 1780 1781 1782 1783 1784 1785 1786 1787
	skb = alloc_skb_head(gfp_mask);
	if (skb == NULL)
		goto err1;

	spin_lock_bh(&sk->sk_receive_queue.lock);
	/* check again under lock */
	if (ring->pg_vec == NULL)
		goto out_free;

1788
	/* check again under lock */
1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807
	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
	if (maxlen < size)
		goto out_free;

	netlink_forward_ring(ring);
	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
	if (hdr == NULL)
		goto err2;
	netlink_ring_setup_skb(skb, sk, ring, hdr);
	netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
	atomic_inc(&ring->pending);
	netlink_increment_head(ring);

	spin_unlock_bh(&sk->sk_receive_queue.lock);
	return skb;

err2:
	kfree_skb(skb);
	spin_unlock_bh(&sk->sk_receive_queue.lock);
1808
	netlink_overrun(sk);
1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823
err1:
	sock_put(sk);
	return NULL;

out_free:
	kfree_skb(skb);
	spin_unlock_bh(&sk->sk_receive_queue.lock);
out_put:
	sock_put(sk);
out:
#endif
	return alloc_skb(size, gfp_mask);
}
EXPORT_SYMBOL_GPL(netlink_alloc_skb);

1824 1825 1826
int netlink_has_listeners(struct sock *sk, unsigned int group)
{
	int res = 0;
1827
	struct listeners *listeners;
1828

1829
	BUG_ON(!netlink_is_kernel(sk));
1830 1831 1832 1833

	rcu_read_lock();
	listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);

1834
	if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1835
		res = test_bit(group - 1, listeners->masks);
1836 1837 1838

	rcu_read_unlock();

1839 1840 1841 1842
	return res;
}
EXPORT_SYMBOL_GPL(netlink_has_listeners);

1843
static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
1844 1845 1846 1847
{
	struct netlink_sock *nlk = nlk_sk(sk);

	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1848
	    !test_bit(NETLINK_CONGESTED, &nlk->state)) {
1849
		netlink_skb_set_owner_r(skb, sk);
1850
		__netlink_sendskb(sk, skb);
1851
		return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
L
Linus Torvalds 已提交
1852 1853 1854 1855 1856 1857
	}
	return -1;
}

struct netlink_broadcast_data {
	struct sock *exclude_sk;
1858
	struct net *net;
1859
	u32 portid;
L
Linus Torvalds 已提交
1860 1861
	u32 group;
	int failure;
1862
	int delivery_failure;
L
Linus Torvalds 已提交
1863 1864
	int congested;
	int delivered;
A
Al Viro 已提交
1865
	gfp_t allocation;
L
Linus Torvalds 已提交
1866
	struct sk_buff *skb, *skb2;
1867 1868
	int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
	void *tx_data;
L
Linus Torvalds 已提交
1869 1870
};

1871
static int do_one_broadcast(struct sock *sk,
L
Linus Torvalds 已提交
1872 1873 1874 1875 1876 1877 1878 1879
				   struct netlink_broadcast_data *p)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	int val;

	if (p->exclude_sk == sk)
		goto out;

1880
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1881
	    !test_bit(p->group - 1, nlk->groups))
L
Linus Torvalds 已提交
1882 1883
		goto out;

1884
	if (!net_eq(sock_net(sk), p->net))
1885 1886
		goto out;

L
Linus Torvalds 已提交
1887 1888 1889 1890 1891 1892 1893
	if (p->failure) {
		netlink_overrun(sk);
		goto out;
	}

	sock_hold(sk);
	if (p->skb2 == NULL) {
1894
		if (skb_shared(p->skb)) {
L
Linus Torvalds 已提交
1895 1896
			p->skb2 = skb_clone(p->skb, p->allocation);
		} else {
1897 1898 1899 1900 1901 1902
			p->skb2 = skb_get(p->skb);
			/*
			 * skb ownership may have been set when
			 * delivered to a previous socket.
			 */
			skb_orphan(p->skb2);
L
Linus Torvalds 已提交
1903 1904 1905 1906 1907 1908
		}
	}
	if (p->skb2 == NULL) {
		netlink_overrun(sk);
		/* Clone failed. Notify ALL listeners. */
		p->failure = 1;
1909 1910
		if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR)
			p->delivery_failure = 1;
1911 1912 1913
	} else if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
		kfree_skb(p->skb2);
		p->skb2 = NULL;
1914 1915 1916
	} else if (sk_filter(sk, p->skb2)) {
		kfree_skb(p->skb2);
		p->skb2 = NULL;
L
Linus Torvalds 已提交
1917 1918
	} else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) {
		netlink_overrun(sk);
1919 1920
		if (nlk->flags & NETLINK_BROADCAST_SEND_ERROR)
			p->delivery_failure = 1;
L
Linus Torvalds 已提交
1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931
	} else {
		p->congested |= val;
		p->delivered = 1;
		p->skb2 = NULL;
	}
	sock_put(sk);

out:
	return 0;
}

1932
int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
1933 1934 1935
	u32 group, gfp_t allocation,
	int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
	void *filter_data)
L
Linus Torvalds 已提交
1936
{
1937
	struct net *net = sock_net(ssk);
L
Linus Torvalds 已提交
1938 1939 1940 1941 1942 1943
	struct netlink_broadcast_data info;
	struct sock *sk;

	skb = netlink_trim(skb, allocation);

	info.exclude_sk = ssk;
1944
	info.net = net;
1945
	info.portid = portid;
L
Linus Torvalds 已提交
1946 1947
	info.group = group;
	info.failure = 0;
1948
	info.delivery_failure = 0;
L
Linus Torvalds 已提交
1949 1950 1951 1952 1953
	info.congested = 0;
	info.delivered = 0;
	info.allocation = allocation;
	info.skb = skb;
	info.skb2 = NULL;
1954 1955
	info.tx_filter = filter;
	info.tx_data = filter_data;
L
Linus Torvalds 已提交
1956 1957 1958 1959 1960

	/* While we sleep in clone, do not allow to change socket list */

	netlink_lock_table();

1961
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
L
Linus Torvalds 已提交
1962 1963
		do_one_broadcast(sk, &info);

1964
	consume_skb(skb);
1965

L
Linus Torvalds 已提交
1966 1967
	netlink_unlock_table();

1968 1969
	if (info.delivery_failure) {
		kfree_skb(info.skb2);
1970
		return -ENOBUFS;
E
Eric Dumazet 已提交
1971 1972
	}
	consume_skb(info.skb2);
1973

L
Linus Torvalds 已提交
1974 1975 1976 1977 1978 1979 1980
	if (info.delivered) {
		if (info.congested && (allocation & __GFP_WAIT))
			yield();
		return 0;
	}
	return -ESRCH;
}
1981 1982
EXPORT_SYMBOL(netlink_broadcast_filtered);

1983
int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
1984 1985
		      u32 group, gfp_t allocation)
{
1986
	return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
1987 1988
		NULL, NULL);
}
1989
EXPORT_SYMBOL(netlink_broadcast);
L
Linus Torvalds 已提交
1990 1991 1992

struct netlink_set_err_data {
	struct sock *exclude_sk;
1993
	u32 portid;
L
Linus Torvalds 已提交
1994 1995 1996 1997
	u32 group;
	int code;
};

1998
static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
L
Linus Torvalds 已提交
1999 2000
{
	struct netlink_sock *nlk = nlk_sk(sk);
2001
	int ret = 0;
L
Linus Torvalds 已提交
2002 2003 2004 2005

	if (sk == p->exclude_sk)
		goto out;

O
Octavian Purdila 已提交
2006
	if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
2007 2008
		goto out;

2009
	if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
2010
	    !test_bit(p->group - 1, nlk->groups))
L
Linus Torvalds 已提交
2011 2012
		goto out;

2013 2014 2015 2016 2017
	if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) {
		ret = 1;
		goto out;
	}

L
Linus Torvalds 已提交
2018 2019 2020
	sk->sk_err = p->code;
	sk->sk_error_report(sk);
out:
2021
	return ret;
L
Linus Torvalds 已提交
2022 2023
}

2024 2025 2026
/**
 * netlink_set_err - report error to broadcast listeners
 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
2027
 * @portid: the PORTID of a process that we want to skip (if any)
2028
 * @group: the broadcast group that will notice the error
2029
 * @code: error code, must be negative (as usual in kernelspace)
2030 2031 2032
 *
 * This function returns the number of broadcast listeners that have set the
 * NETLINK_RECV_NO_ENOBUFS socket option.
2033
 */
2034
int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
L
Linus Torvalds 已提交
2035 2036 2037
{
	struct netlink_set_err_data info;
	struct sock *sk;
2038
	int ret = 0;
L
Linus Torvalds 已提交
2039 2040

	info.exclude_sk = ssk;
2041
	info.portid = portid;
L
Linus Torvalds 已提交
2042
	info.group = group;
2043 2044
	/* sk->sk_err wants a positive error value */
	info.code = -code;
L
Linus Torvalds 已提交
2045 2046 2047

	read_lock(&nl_table_lock);

2048
	sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
2049
		ret += do_one_set_err(sk, &info);
L
Linus Torvalds 已提交
2050 2051

	read_unlock(&nl_table_lock);
2052
	return ret;
L
Linus Torvalds 已提交
2053
}
2054
EXPORT_SYMBOL(netlink_set_err);
L
Linus Torvalds 已提交
2055

2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072
/* must be called with netlink table grabbed */
static void netlink_update_socket_mc(struct netlink_sock *nlk,
				     unsigned int group,
				     int is_new)
{
	int old, new = !!is_new, subscriptions;

	old = test_bit(group - 1, nlk->groups);
	subscriptions = nlk->subscriptions - old + new;
	if (new)
		__set_bit(group - 1, nlk->groups);
	else
		__clear_bit(group - 1, nlk->groups);
	netlink_update_subscriptions(&nlk->sk, subscriptions);
	netlink_update_listeners(&nlk->sk);
}

2073
static int netlink_setsockopt(struct socket *sock, int level, int optname,
2074
			      char __user *optval, unsigned int optlen)
2075 2076 2077
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
2078 2079
	unsigned int val = 0;
	int err;
2080 2081 2082 2083

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

2084 2085
	if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
	    optlen >= sizeof(int) &&
2086
	    get_user(val, (unsigned int __user *)optval))
2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098
		return -EFAULT;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (val)
			nlk->flags |= NETLINK_RECV_PKTINFO;
		else
			nlk->flags &= ~NETLINK_RECV_PKTINFO;
		err = 0;
		break;
	case NETLINK_ADD_MEMBERSHIP:
	case NETLINK_DROP_MEMBERSHIP: {
2099
		if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
2100
			return -EPERM;
2101 2102 2103
		err = netlink_realloc_groups(sk);
		if (err)
			return err;
2104 2105 2106
		if (!val || val - 1 >= nlk->ngroups)
			return -EINVAL;
		netlink_table_grab();
2107 2108
		netlink_update_socket_mc(nlk, val,
					 optname == NETLINK_ADD_MEMBERSHIP);
2109
		netlink_table_ungrab();
2110 2111 2112 2113

		if (nlk->netlink_bind)
			nlk->netlink_bind(val);

2114 2115 2116
		err = 0;
		break;
	}
2117 2118 2119 2120 2121 2122 2123
	case NETLINK_BROADCAST_ERROR:
		if (val)
			nlk->flags |= NETLINK_BROADCAST_SEND_ERROR;
		else
			nlk->flags &= ~NETLINK_BROADCAST_SEND_ERROR;
		err = 0;
		break;
2124 2125 2126
	case NETLINK_NO_ENOBUFS:
		if (val) {
			nlk->flags |= NETLINK_RECV_NO_ENOBUFS;
2127
			clear_bit(NETLINK_CONGESTED, &nlk->state);
2128
			wake_up_interruptible(&nlk->wait);
E
Eric Dumazet 已提交
2129
		} else {
2130
			nlk->flags &= ~NETLINK_RECV_NO_ENOBUFS;
E
Eric Dumazet 已提交
2131
		}
2132 2133
		err = 0;
		break;
2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152
#ifdef CONFIG_NETLINK_MMAP
	case NETLINK_RX_RING:
	case NETLINK_TX_RING: {
		struct nl_mmap_req req;

		/* Rings might consume more memory than queue limits, require
		 * CAP_NET_ADMIN.
		 */
		if (!capable(CAP_NET_ADMIN))
			return -EPERM;
		if (optlen < sizeof(req))
			return -EINVAL;
		if (copy_from_user(&req, optval, sizeof(req)))
			return -EFAULT;
		err = netlink_set_ring(sk, &req, false,
				       optname == NETLINK_TX_RING);
		break;
	}
#endif /* CONFIG_NETLINK_MMAP */
2153 2154 2155 2156 2157 2158 2159
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static int netlink_getsockopt(struct socket *sock, int level, int optname,
2160
			      char __user *optval, int __user *optlen)
2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179
{
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int len, val, err;

	if (level != SOL_NETLINK)
		return -ENOPROTOOPT;

	if (get_user(len, optlen))
		return -EFAULT;
	if (len < 0)
		return -EINVAL;

	switch (optname) {
	case NETLINK_PKTINFO:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
		val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0;
H
Heiko Carstens 已提交
2180 2181 2182
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
2183 2184
		err = 0;
		break;
2185 2186 2187 2188 2189 2190 2191 2192 2193 2194
	case NETLINK_BROADCAST_ERROR:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
		val = nlk->flags & NETLINK_BROADCAST_SEND_ERROR ? 1 : 0;
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
2195 2196 2197 2198 2199 2200 2201 2202 2203 2204
	case NETLINK_NO_ENOBUFS:
		if (len < sizeof(int))
			return -EINVAL;
		len = sizeof(int);
		val = nlk->flags & NETLINK_RECV_NO_ENOBUFS ? 1 : 0;
		if (put_user(len, optlen) ||
		    put_user(val, optval))
			return -EFAULT;
		err = 0;
		break;
2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218
	default:
		err = -ENOPROTOOPT;
	}
	return err;
}

static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
{
	struct nl_pktinfo info;

	info.group = NETLINK_CB(skb).dst_group;
	put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
}

L
Linus Torvalds 已提交
2219 2220 2221 2222 2223 2224
static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
			   struct msghdr *msg, size_t len)
{
	struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
2225
	DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
2226
	u32 dst_portid;
2227
	u32 dst_group;
L
Linus Torvalds 已提交
2228 2229 2230 2231 2232 2233 2234
	struct sk_buff *skb;
	int err;
	struct scm_cookie scm;

	if (msg->msg_flags&MSG_OOB)
		return -EOPNOTSUPP;

2235
	if (NULL == siocb->scm)
L
Linus Torvalds 已提交
2236
		siocb->scm = &scm;
2237

2238
	err = scm_send(sock, msg, siocb->scm, true);
L
Linus Torvalds 已提交
2239 2240 2241 2242
	if (err < 0)
		return err;

	if (msg->msg_namelen) {
2243
		err = -EINVAL;
L
Linus Torvalds 已提交
2244
		if (addr->nl_family != AF_NETLINK)
2245
			goto out;
2246
		dst_portid = addr->nl_pid;
2247
		dst_group = ffs(addr->nl_groups);
2248
		err =  -EPERM;
2249
		if ((dst_group || dst_portid) &&
2250
		    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
2251
			goto out;
L
Linus Torvalds 已提交
2252
	} else {
2253
		dst_portid = nlk->dst_portid;
2254
		dst_group = nlk->dst_group;
L
Linus Torvalds 已提交
2255 2256
	}

2257
	if (!nlk->portid) {
L
Linus Torvalds 已提交
2258 2259 2260 2261 2262
		err = netlink_autobind(sock);
		if (err)
			goto out;
	}

2263 2264 2265 2266 2267 2268 2269
	if (netlink_tx_is_mmaped(sk) &&
	    msg->msg_iov->iov_base == NULL) {
		err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
					   siocb);
		goto out;
	}

L
Linus Torvalds 已提交
2270 2271 2272 2273
	err = -EMSGSIZE;
	if (len > sk->sk_sndbuf - 32)
		goto out;
	err = -ENOBUFS;
2274
	skb = netlink_alloc_large_skb(len, dst_group);
2275
	if (skb == NULL)
L
Linus Torvalds 已提交
2276 2277
		goto out;

2278
	NETLINK_CB(skb).portid	= nlk->portid;
2279
	NETLINK_CB(skb).dst_group = dst_group;
2280
	NETLINK_CB(skb).creds	= siocb->scm->creds;
L
Linus Torvalds 已提交
2281 2282

	err = -EFAULT;
2283
	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
L
Linus Torvalds 已提交
2284 2285 2286 2287 2288 2289 2290 2291 2292 2293
		kfree_skb(skb);
		goto out;
	}

	err = security_netlink_send(sk, skb);
	if (err) {
		kfree_skb(skb);
		goto out;
	}

2294
	if (dst_group) {
L
Linus Torvalds 已提交
2295
		atomic_inc(&skb->users);
2296
		netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
L
Linus Torvalds 已提交
2297
	}
2298
	err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
L
Linus Torvalds 已提交
2299 2300

out:
2301
	scm_destroy(siocb->scm);
L
Linus Torvalds 已提交
2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314
	return err;
}

static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
			   struct msghdr *msg, size_t len,
			   int flags)
{
	struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
	struct scm_cookie scm;
	struct sock *sk = sock->sk;
	struct netlink_sock *nlk = nlk_sk(sk);
	int noblock = flags&MSG_DONTWAIT;
	size_t copied;
J
Johannes Berg 已提交
2315
	struct sk_buff *skb, *data_skb;
2316
	int err, ret;
L
Linus Torvalds 已提交
2317 2318 2319 2320 2321 2322

	if (flags&MSG_OOB)
		return -EOPNOTSUPP;

	copied = 0;

2323 2324
	skb = skb_recv_datagram(sk, flags, noblock, &err);
	if (skb == NULL)
L
Linus Torvalds 已提交
2325 2326
		goto out;

J
Johannes Berg 已提交
2327 2328
	data_skb = skb;

2329 2330 2331
#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
	if (unlikely(skb_shinfo(skb)->frag_list)) {
		/*
J
Johannes Berg 已提交
2332 2333 2334
		 * If this skb has a frag_list, then here that means that we
		 * will have to use the frag_list skb's data for compat tasks
		 * and the regular skb's data for normal (non-compat) tasks.
2335
		 *
J
Johannes Berg 已提交
2336 2337 2338 2339
		 * If we need to send the compat skb, assign it to the
		 * 'data_skb' variable so that it will be used below for data
		 * copying. We keep 'skb' for everything else, including
		 * freeing both later.
2340
		 */
J
Johannes Berg 已提交
2341 2342
		if (flags & MSG_CMSG_COMPAT)
			data_skb = skb_shinfo(skb)->frag_list;
2343 2344 2345
	}
#endif

E
Eric Dumazet 已提交
2346 2347 2348 2349 2350
	/* Record the max length of recvmsg() calls for future allocations */
	nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
	nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
				     16384);

J
Johannes Berg 已提交
2351
	copied = data_skb->len;
L
Linus Torvalds 已提交
2352 2353 2354 2355 2356
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

J
Johannes Berg 已提交
2357 2358
	skb_reset_transport_header(data_skb);
	err = skb_copy_datagram_iovec(data_skb, 0, msg->msg_iov, copied);
L
Linus Torvalds 已提交
2359 2360

	if (msg->msg_name) {
2361
		DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
L
Linus Torvalds 已提交
2362 2363
		addr->nl_family = AF_NETLINK;
		addr->nl_pad    = 0;
2364
		addr->nl_pid	= NETLINK_CB(skb).portid;
2365
		addr->nl_groups	= netlink_group_mask(NETLINK_CB(skb).dst_group);
L
Linus Torvalds 已提交
2366 2367 2368
		msg->msg_namelen = sizeof(*addr);
	}

2369 2370 2371
	if (nlk->flags & NETLINK_RECV_PKTINFO)
		netlink_cmsg_recv_pktinfo(msg, skb);

L
Linus Torvalds 已提交
2372 2373 2374 2375 2376
	if (NULL == siocb->scm) {
		memset(&scm, 0, sizeof(scm));
		siocb->scm = &scm;
	}
	siocb->scm->creds = *NETLINK_CREDS(skb);
2377
	if (flags & MSG_TRUNC)
J
Johannes Berg 已提交
2378
		copied = data_skb->len;
2379

L
Linus Torvalds 已提交
2380 2381
	skb_free_datagram(sk, skb);

2382 2383
	if (nlk->cb_running &&
	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
2384 2385 2386 2387 2388 2389
		ret = netlink_dump(sk);
		if (ret) {
			sk->sk_err = ret;
			sk->sk_error_report(sk);
		}
	}
L
Linus Torvalds 已提交
2390 2391 2392 2393 2394 2395 2396

	scm_recv(sock, msg, siocb->scm, flags);
out:
	netlink_rcv_wake(sk);
	return err ? : copied;
}

2397
static void netlink_data_ready(struct sock *sk)
L
Linus Torvalds 已提交
2398
{
2399
	BUG();
L
Linus Torvalds 已提交
2400 2401 2402
}

/*
2403
 *	We export these functions to other modules. They provide a
L
Linus Torvalds 已提交
2404 2405 2406 2407 2408
 *	complete set of kernel non-blocking support for message
 *	queueing.
 */

struct sock *
2409 2410
__netlink_kernel_create(struct net *net, int unit, struct module *module,
			struct netlink_kernel_cfg *cfg)
L
Linus Torvalds 已提交
2411 2412 2413
{
	struct socket *sock;
	struct sock *sk;
2414
	struct netlink_sock *nlk;
2415
	struct listeners *listeners = NULL;
2416 2417
	struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
	unsigned int groups;
L
Linus Torvalds 已提交
2418

2419
	BUG_ON(!nl_table);
L
Linus Torvalds 已提交
2420

2421
	if (unit < 0 || unit >= MAX_LINKS)
L
Linus Torvalds 已提交
2422 2423 2424 2425 2426
		return NULL;

	if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
		return NULL;

2427 2428 2429 2430 2431 2432 2433 2434 2435 2436
	/*
	 * We have to just have a reference on the net from sk, but don't
	 * get_net it. Besides, we cannot get and then put the net here.
	 * So we create one inside init_net and the move it to net.
	 */

	if (__netlink_create(&init_net, sock, cb_mutex, unit) < 0)
		goto out_sock_release_nosk;

	sk = sock->sk;
2437
	sk_change_net(sk, net);
2438

2439
	if (!cfg || cfg->groups < 32)
2440
		groups = 32;
2441 2442
	else
		groups = cfg->groups;
2443

2444
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2445 2446 2447
	if (!listeners)
		goto out_sock_release;

L
Linus Torvalds 已提交
2448
	sk->sk_data_ready = netlink_data_ready;
2449 2450
	if (cfg && cfg->input)
		nlk_sk(sk)->netlink_rcv = cfg->input;
L
Linus Torvalds 已提交
2451

2452
	if (netlink_insert(sk, net, 0))
2453
		goto out_sock_release;
2454

2455 2456
	nlk = nlk_sk(sk);
	nlk->flags |= NETLINK_KERNEL_SOCKET;
2457 2458

	netlink_table_grab();
2459 2460
	if (!nl_table[unit].registered) {
		nl_table[unit].groups = groups;
2461
		rcu_assign_pointer(nl_table[unit].listeners, listeners);
2462 2463
		nl_table[unit].cb_mutex = cb_mutex;
		nl_table[unit].module = module;
2464 2465 2466
		if (cfg) {
			nl_table[unit].bind = cfg->bind;
			nl_table[unit].flags = cfg->flags;
2467 2468
			if (cfg->compare)
				nl_table[unit].compare = cfg->compare;
2469
		}
2470
		nl_table[unit].registered = 1;
2471 2472
	} else {
		kfree(listeners);
2473
		nl_table[unit].registered++;
2474
	}
2475
	netlink_table_ungrab();
2476 2477
	return sk;

2478
out_sock_release:
2479
	kfree(listeners);
2480
	netlink_kernel_release(sk);
2481 2482 2483
	return NULL;

out_sock_release_nosk:
2484
	sock_release(sock);
2485
	return NULL;
L
Linus Torvalds 已提交
2486
}
2487
EXPORT_SYMBOL(__netlink_kernel_create);
2488 2489 2490 2491

void
netlink_kernel_release(struct sock *sk)
{
2492
	sk_release_kernel(sk);
2493 2494 2495
}
EXPORT_SYMBOL(netlink_kernel_release);

2496
int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
2497
{
2498
	struct listeners *new, *old;
2499 2500 2501 2502 2503 2504
	struct netlink_table *tbl = &nl_table[sk->sk_protocol];

	if (groups < 32)
		groups = 32;

	if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2505 2506
		new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
		if (!new)
2507
			return -ENOMEM;
2508
		old = nl_deref_protected(tbl->listeners);
2509 2510 2511
		memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
		rcu_assign_pointer(tbl->listeners, new);

2512
		kfree_rcu(old, rcu);
2513 2514 2515
	}
	tbl->groups = groups;

2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536
	return 0;
}

/**
 * netlink_change_ngroups - change number of multicast groups
 *
 * This changes the number of multicast groups that are available
 * on a certain netlink family. Note that it is not possible to
 * change the number of groups to below 32. Also note that it does
 * not implicitly call netlink_clear_multicast_users() when the
 * number of groups is reduced.
 *
 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
 * @groups: The new number of groups.
 */
int netlink_change_ngroups(struct sock *sk, unsigned int groups)
{
	int err;

	netlink_table_grab();
	err = __netlink_change_ngroups(sk, groups);
2537
	netlink_table_ungrab();
2538

2539 2540 2541
	return err;
}

2542 2543 2544 2545 2546
void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
{
	struct sock *sk;
	struct netlink_table *tbl = &nl_table[ksk->sk_protocol];

2547
	sk_for_each_bound(sk, &tbl->mc_list)
2548 2549 2550
		netlink_update_socket_mc(nlk_sk(sk), group, 0);
}

2551
struct nlmsghdr *
2552
__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2553 2554
{
	struct nlmsghdr *nlh;
2555
	int size = nlmsg_msg_size(len);
2556

2557
	nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_ALIGN(size));
2558 2559 2560
	nlh->nlmsg_type = type;
	nlh->nlmsg_len = size;
	nlh->nlmsg_flags = flags;
2561
	nlh->nlmsg_pid = portid;
2562 2563
	nlh->nlmsg_seq = seq;
	if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2564
		memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2565 2566 2567 2568
	return nlh;
}
EXPORT_SYMBOL(__nlmsg_put);

L
Linus Torvalds 已提交
2569 2570 2571 2572 2573 2574 2575 2576 2577
/*
 * It looks a bit ugly.
 * It would be better to create kernel thread.
 */

static int netlink_dump(struct sock *sk)
{
	struct netlink_sock *nlk = nlk_sk(sk);
	struct netlink_callback *cb;
2578
	struct sk_buff *skb = NULL;
L
Linus Torvalds 已提交
2579
	struct nlmsghdr *nlh;
2580
	int len, err = -ENOBUFS;
2581
	int alloc_size;
L
Linus Torvalds 已提交
2582

2583
	mutex_lock(nlk->cb_mutex);
2584
	if (!nlk->cb_running) {
2585 2586
		err = -EINVAL;
		goto errout_skb;
L
Linus Torvalds 已提交
2587 2588
	}

2589
	cb = &nlk->cb;
2590 2591
	alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);

2592 2593 2594
	if (!netlink_rx_is_mmaped(sk) &&
	    atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
		goto errout_skb;
E
Eric Dumazet 已提交
2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615

	/* NLMSG_GOODSIZE is small to avoid high order allocations being
	 * required, but it makes sense to _attempt_ a 16K bytes allocation
	 * to reduce number of system calls on dump operations, if user
	 * ever provided a big enough buffer.
	 */
	if (alloc_size < nlk->max_recvmsg_len) {
		skb = netlink_alloc_skb(sk,
					nlk->max_recvmsg_len,
					nlk->portid,
					GFP_KERNEL |
					__GFP_NOWARN |
					__GFP_NORETRY);
		/* available room should be exact amount to avoid MSG_TRUNC */
		if (skb)
			skb_reserve(skb, skb_tailroom(skb) -
					 nlk->max_recvmsg_len);
	}
	if (!skb)
		skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
					GFP_KERNEL);
2616
	if (!skb)
2617
		goto errout_skb;
2618
	netlink_skb_set_owner_r(skb, sk);
2619

L
Linus Torvalds 已提交
2620 2621 2622
	len = cb->dump(skb, cb);

	if (len > 0) {
2623
		mutex_unlock(nlk->cb_mutex);
2624 2625 2626

		if (sk_filter(sk, skb))
			kfree_skb(skb);
2627 2628
		else
			__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2629 2630 2631
		return 0;
	}

2632 2633 2634 2635
	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
	if (!nlh)
		goto errout_skb;

2636 2637
	nl_dump_check_consistent(cb, nlh);

2638 2639
	memcpy(nlmsg_data(nlh), &len, sizeof(len));

2640 2641
	if (sk_filter(sk, skb))
		kfree_skb(skb);
2642 2643
	else
		__netlink_sendskb(sk, skb);
L
Linus Torvalds 已提交
2644

2645 2646
	if (cb->done)
		cb->done(cb);
L
Linus Torvalds 已提交
2647

2648 2649
	nlk->cb_running = false;
	mutex_unlock(nlk->cb_mutex);
2650
	module_put(cb->module);
2651
	consume_skb(cb->skb);
L
Linus Torvalds 已提交
2652
	return 0;
2653

2654
errout_skb:
2655
	mutex_unlock(nlk->cb_mutex);
2656 2657
	kfree_skb(skb);
	return err;
L
Linus Torvalds 已提交
2658 2659
}

2660 2661 2662
int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
			 const struct nlmsghdr *nlh,
			 struct netlink_dump_control *control)
L
Linus Torvalds 已提交
2663 2664 2665 2666
{
	struct netlink_callback *cb;
	struct sock *sk;
	struct netlink_sock *nlk;
2667
	int ret;
L
Linus Torvalds 已提交
2668

2669 2670 2671 2672 2673 2674
	/* Memory mapped dump requests need to be copied to avoid looping
	 * on the pending state in netlink_mmap_sendmsg() while the CB hold
	 * a reference to the skb.
	 */
	if (netlink_skb_is_mmaped(skb)) {
		skb = skb_copy(skb, GFP_KERNEL);
2675
		if (skb == NULL)
2676 2677 2678 2679
			return -ENOBUFS;
	} else
		atomic_inc(&skb->users);

2680
	sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
L
Linus Torvalds 已提交
2681
	if (sk == NULL) {
2682 2683
		ret = -ECONNREFUSED;
		goto error_free;
L
Linus Torvalds 已提交
2684
	}
2685

2686
	nlk = nlk_sk(sk);
2687
	mutex_lock(nlk->cb_mutex);
2688
	/* A dump is in progress... */
2689
	if (nlk->cb_running) {
2690
		ret = -EBUSY;
2691
		goto error_unlock;
L
Linus Torvalds 已提交
2692
	}
2693
	/* add reference of module which cb->dump belongs to */
2694
	if (!try_module_get(control->module)) {
2695
		ret = -EPROTONOSUPPORT;
2696
		goto error_unlock;
2697 2698
	}

2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710
	cb = &nlk->cb;
	memset(cb, 0, sizeof(*cb));
	cb->dump = control->dump;
	cb->done = control->done;
	cb->nlh = nlh;
	cb->data = control->data;
	cb->module = control->module;
	cb->min_dump_alloc = control->min_dump_alloc;
	cb->skb = skb;

	nlk->cb_running = true;

2711
	mutex_unlock(nlk->cb_mutex);
L
Linus Torvalds 已提交
2712

2713
	ret = netlink_dump(sk);
L
Linus Torvalds 已提交
2714
	sock_put(sk);
2715

2716 2717 2718
	if (ret)
		return ret;

2719 2720 2721 2722
	/* We successfully started a dump, by returning -EINTR we
	 * signal not to send ACK even if it was requested.
	 */
	return -EINTR;
2723 2724 2725 2726 2727 2728 2729

error_unlock:
	sock_put(sk);
	mutex_unlock(nlk->cb_mutex);
error_free:
	kfree_skb(skb);
	return ret;
L
Linus Torvalds 已提交
2730
}
2731
EXPORT_SYMBOL(__netlink_dump_start);
L
Linus Torvalds 已提交
2732 2733 2734 2735 2736 2737

void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
{
	struct sk_buff *skb;
	struct nlmsghdr *rep;
	struct nlmsgerr *errmsg;
2738
	size_t payload = sizeof(*errmsg);
L
Linus Torvalds 已提交
2739

2740 2741 2742
	/* error messages get the original request appened */
	if (err)
		payload += nlmsg_len(nlh);
L
Linus Torvalds 已提交
2743

2744 2745
	skb = netlink_alloc_skb(in_skb->sk, nlmsg_total_size(payload),
				NETLINK_CB(in_skb).portid, GFP_KERNEL);
L
Linus Torvalds 已提交
2746 2747 2748
	if (!skb) {
		struct sock *sk;

2749
		sk = netlink_lookup(sock_net(in_skb->sk),
2750
				    in_skb->sk->sk_protocol,
2751
				    NETLINK_CB(in_skb).portid);
L
Linus Torvalds 已提交
2752 2753 2754 2755 2756 2757 2758 2759
		if (sk) {
			sk->sk_err = ENOBUFS;
			sk->sk_error_report(sk);
			sock_put(sk);
		}
		return;
	}

2760
	rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2761
			  NLMSG_ERROR, payload, 0);
2762
	errmsg = nlmsg_data(rep);
L
Linus Torvalds 已提交
2763
	errmsg->error = err;
2764
	memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
2765
	netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
L
Linus Torvalds 已提交
2766
}
2767
EXPORT_SYMBOL(netlink_ack);
L
Linus Torvalds 已提交
2768

2769
int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2770
						     struct nlmsghdr *))
2771 2772 2773 2774 2775
{
	struct nlmsghdr *nlh;
	int err;

	while (skb->len >= nlmsg_total_size(0)) {
2776 2777
		int msglen;

2778
		nlh = nlmsg_hdr(skb);
2779
		err = 0;
2780

2781
		if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2782 2783
			return 0;

2784 2785
		/* Only requests are handled by the kernel */
		if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2786
			goto ack;
2787 2788 2789

		/* Skip control messages */
		if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2790
			goto ack;
2791

2792
		err = cb(skb, nlh);
2793 2794 2795 2796
		if (err == -EINTR)
			goto skip;

ack:
2797
		if (nlh->nlmsg_flags & NLM_F_ACK || err)
2798 2799
			netlink_ack(skb, nlh, err);

2800
skip:
2801
		msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2802 2803 2804
		if (msglen > skb->len)
			msglen = skb->len;
		skb_pull(skb, msglen);
2805 2806 2807 2808
	}

	return 0;
}
2809
EXPORT_SYMBOL(netlink_rcv_skb);
2810

2811 2812 2813 2814
/**
 * nlmsg_notify - send a notification netlink message
 * @sk: netlink socket to use
 * @skb: notification message
2815
 * @portid: destination netlink portid for reports or 0
2816 2817 2818 2819
 * @group: destination multicast group or 0
 * @report: 1 to report back, 0 to disable
 * @flags: allocation flags
 */
2820
int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
2821 2822 2823 2824 2825
		 unsigned int group, int report, gfp_t flags)
{
	int err = 0;

	if (group) {
2826
		int exclude_portid = 0;
2827 2828 2829

		if (report) {
			atomic_inc(&skb->users);
2830
			exclude_portid = portid;
2831 2832
		}

2833 2834
		/* errors reported via destination sk->sk_err, but propagate
		 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
2835
		err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
2836 2837
	}

2838 2839 2840
	if (report) {
		int err2;

2841
		err2 = nlmsg_unicast(sk, skb, portid);
2842 2843 2844
		if (!err || err == -ESRCH)
			err = err2;
	}
2845 2846 2847

	return err;
}
2848
EXPORT_SYMBOL(nlmsg_notify);
2849

L
Linus Torvalds 已提交
2850 2851
#ifdef CONFIG_PROC_FS
struct nl_seq_iter {
2852
	struct seq_net_private p;
L
Linus Torvalds 已提交
2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863
	int link;
	int hash_idx;
};

static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos)
{
	struct nl_seq_iter *iter = seq->private;
	int i, j;
	struct sock *s;
	loff_t off = 0;

2864
	for (i = 0; i < MAX_LINKS; i++) {
2865
		struct nl_portid_hash *hash = &nl_table[i].hash;
L
Linus Torvalds 已提交
2866 2867

		for (j = 0; j <= hash->mask; j++) {
2868
			sk_for_each(s, &hash->table[j]) {
2869
				if (sock_net(s) != seq_file_net(seq))
2870
					continue;
L
Linus Torvalds 已提交
2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883
				if (off == pos) {
					iter->link = i;
					iter->hash_idx = j;
					return s;
				}
				++off;
			}
		}
	}
	return NULL;
}

static void *netlink_seq_start(struct seq_file *seq, loff_t *pos)
2884
	__acquires(nl_table_lock)
L
Linus Torvalds 已提交
2885 2886 2887 2888 2889 2890 2891 2892 2893
{
	read_lock(&nl_table_lock);
	return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN;
}

static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	struct sock *s;
	struct nl_seq_iter *iter;
2894
	struct net *net;
L
Linus Torvalds 已提交
2895 2896 2897 2898 2899 2900
	int i, j;

	++*pos;

	if (v == SEQ_START_TOKEN)
		return netlink_seq_socket_idx(seq, 0);
2901

2902
	net = seq_file_net(seq);
2903 2904 2905 2906
	iter = seq->private;
	s = v;
	do {
		s = sk_next(s);
2907
	} while (s && !nl_table[s->sk_protocol].compare(net, s));
L
Linus Torvalds 已提交
2908 2909 2910 2911 2912 2913 2914
	if (s)
		return s;

	i = iter->link;
	j = iter->hash_idx + 1;

	do {
2915
		struct nl_portid_hash *hash = &nl_table[i].hash;
L
Linus Torvalds 已提交
2916 2917 2918

		for (; j <= hash->mask; j++) {
			s = sk_head(&hash->table[j]);
2919 2920

			while (s && !nl_table[s->sk_protocol].compare(net, s))
2921
				s = sk_next(s);
L
Linus Torvalds 已提交
2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935
			if (s) {
				iter->link = i;
				iter->hash_idx = j;
				return s;
			}
		}

		j = 0;
	} while (++i < MAX_LINKS);

	return NULL;
}

static void netlink_seq_stop(struct seq_file *seq, void *v)
2936
	__releases(nl_table_lock)
L
Linus Torvalds 已提交
2937 2938 2939 2940 2941 2942 2943
{
	read_unlock(&nl_table_lock);
}


static int netlink_seq_show(struct seq_file *seq, void *v)
{
E
Eric Dumazet 已提交
2944
	if (v == SEQ_START_TOKEN) {
L
Linus Torvalds 已提交
2945 2946
		seq_puts(seq,
			 "sk       Eth Pid    Groups   "
2947
			 "Rmem     Wmem     Dump     Locks     Drops     Inode\n");
E
Eric Dumazet 已提交
2948
	} else {
L
Linus Torvalds 已提交
2949 2950 2951
		struct sock *s = v;
		struct netlink_sock *nlk = nlk_sk(s);

2952
		seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
L
Linus Torvalds 已提交
2953 2954
			   s,
			   s->sk_protocol,
2955
			   nlk->portid,
2956
			   nlk->groups ? (u32)nlk->groups[0] : 0,
2957 2958
			   sk_rmem_alloc_get(s),
			   sk_wmem_alloc_get(s),
2959
			   nlk->cb_running,
2960
			   atomic_read(&s->sk_refcnt),
2961 2962
			   atomic_read(&s->sk_drops),
			   sock_i_ino(s)
L
Linus Torvalds 已提交
2963 2964 2965 2966 2967 2968
			);

	}
	return 0;
}

2969
static const struct seq_operations netlink_seq_ops = {
L
Linus Torvalds 已提交
2970 2971 2972 2973 2974 2975 2976 2977 2978
	.start  = netlink_seq_start,
	.next   = netlink_seq_next,
	.stop   = netlink_seq_stop,
	.show   = netlink_seq_show,
};


static int netlink_seq_open(struct inode *inode, struct file *file)
{
2979 2980
	return seq_open_net(inode, file, &netlink_seq_ops,
				sizeof(struct nl_seq_iter));
2981 2982
}

2983
static const struct file_operations netlink_seq_fops = {
L
Linus Torvalds 已提交
2984 2985 2986 2987
	.owner		= THIS_MODULE,
	.open		= netlink_seq_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
2988
	.release	= seq_release_net,
L
Linus Torvalds 已提交
2989 2990 2991 2992 2993 2994
};

#endif

int netlink_register_notifier(struct notifier_block *nb)
{
2995
	return atomic_notifier_chain_register(&netlink_chain, nb);
L
Linus Torvalds 已提交
2996
}
2997
EXPORT_SYMBOL(netlink_register_notifier);
L
Linus Torvalds 已提交
2998 2999 3000

int netlink_unregister_notifier(struct notifier_block *nb)
{
3001
	return atomic_notifier_chain_unregister(&netlink_chain, nb);
L
Linus Torvalds 已提交
3002
}
3003
EXPORT_SYMBOL(netlink_unregister_notifier);
3004

3005
static const struct proto_ops netlink_ops = {
L
Linus Torvalds 已提交
3006 3007 3008 3009 3010 3011 3012 3013
	.family =	PF_NETLINK,
	.owner =	THIS_MODULE,
	.release =	netlink_release,
	.bind =		netlink_bind,
	.connect =	netlink_connect,
	.socketpair =	sock_no_socketpair,
	.accept =	sock_no_accept,
	.getname =	netlink_getname,
3014
	.poll =		netlink_poll,
L
Linus Torvalds 已提交
3015 3016 3017
	.ioctl =	sock_no_ioctl,
	.listen =	sock_no_listen,
	.shutdown =	sock_no_shutdown,
3018 3019
	.setsockopt =	netlink_setsockopt,
	.getsockopt =	netlink_getsockopt,
L
Linus Torvalds 已提交
3020 3021
	.sendmsg =	netlink_sendmsg,
	.recvmsg =	netlink_recvmsg,
3022
	.mmap =		netlink_mmap,
L
Linus Torvalds 已提交
3023 3024 3025
	.sendpage =	sock_no_sendpage,
};

3026
static const struct net_proto_family netlink_family_ops = {
L
Linus Torvalds 已提交
3027 3028 3029 3030 3031
	.family = PF_NETLINK,
	.create = netlink_create,
	.owner	= THIS_MODULE,	/* for consistency 8) */
};

3032
static int __net_init netlink_net_init(struct net *net)
3033 3034
{
#ifdef CONFIG_PROC_FS
3035
	if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
3036 3037 3038 3039 3040
		return -ENOMEM;
#endif
	return 0;
}

3041
static void __net_exit netlink_net_exit(struct net *net)
3042 3043
{
#ifdef CONFIG_PROC_FS
3044
	remove_proc_entry("netlink", net->proc_net);
3045 3046 3047
#endif
}

3048 3049
static void __init netlink_add_usersock_entry(void)
{
3050
	struct listeners *listeners;
3051 3052
	int groups = 32;

3053
	listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
3054
	if (!listeners)
3055
		panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
3056 3057 3058 3059

	netlink_table_grab();

	nl_table[NETLINK_USERSOCK].groups = groups;
3060
	rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
3061 3062
	nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
	nl_table[NETLINK_USERSOCK].registered = 1;
3063
	nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
3064 3065 3066 3067

	netlink_table_ungrab();
}

3068
static struct pernet_operations __net_initdata netlink_net_ops = {
3069 3070 3071 3072
	.init = netlink_net_init,
	.exit = netlink_net_exit,
};

L
Linus Torvalds 已提交
3073 3074 3075
static int __init netlink_proto_init(void)
{
	int i;
3076
	unsigned long limit;
L
Linus Torvalds 已提交
3077 3078 3079 3080 3081 3082
	unsigned int order;
	int err = proto_register(&netlink_proto, 0);

	if (err != 0)
		goto out;

3083
	BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
L
Linus Torvalds 已提交
3084

3085
	nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
3086 3087
	if (!nl_table)
		goto panic;
L
Linus Torvalds 已提交
3088

3089 3090
	if (totalram_pages >= (128 * 1024))
		limit = totalram_pages >> (21 - PAGE_SHIFT);
L
Linus Torvalds 已提交
3091
	else
3092
		limit = totalram_pages >> (23 - PAGE_SHIFT);
L
Linus Torvalds 已提交
3093

3094 3095 3096
	order = get_bitmask_order(limit) - 1 + PAGE_SHIFT;
	limit = (1UL << order) / sizeof(struct hlist_head);
	order = get_bitmask_order(min(limit, (unsigned long)UINT_MAX)) - 1;
L
Linus Torvalds 已提交
3097 3098

	for (i = 0; i < MAX_LINKS; i++) {
3099
		struct nl_portid_hash *hash = &nl_table[i].hash;
L
Linus Torvalds 已提交
3100

3101
		hash->table = nl_portid_hash_zalloc(1 * sizeof(*hash->table));
L
Linus Torvalds 已提交
3102 3103
		if (!hash->table) {
			while (i-- > 0)
3104
				nl_portid_hash_free(nl_table[i].hash.table,
L
Linus Torvalds 已提交
3105 3106
						 1 * sizeof(*hash->table));
			kfree(nl_table);
3107
			goto panic;
L
Linus Torvalds 已提交
3108 3109 3110 3111 3112
		}
		hash->max_shift = order;
		hash->shift = 0;
		hash->mask = 0;
		hash->rehash_time = jiffies;
3113 3114

		nl_table[i].compare = netlink_compare;
L
Linus Torvalds 已提交
3115 3116
	}

3117 3118
	INIT_LIST_HEAD(&netlink_tap_all);

3119 3120
	netlink_add_usersock_entry();

L
Linus Torvalds 已提交
3121
	sock_register(&netlink_family_ops);
3122
	register_pernet_subsys(&netlink_net_ops);
3123
	/* The netlink device handler may be needed early. */
L
Linus Torvalds 已提交
3124 3125 3126
	rtnetlink_init();
out:
	return err;
3127 3128
panic:
	panic("netlink_init: Cannot allocate nl_table\n");
L
Linus Torvalds 已提交
3129 3130 3131
}

core_initcall(netlink_proto_init);