1 /* Local endpoint object management
2 *
3 * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include <linux/module.h>
15 #include <linux/net.h>
16 #include <linux/skbuff.h>
17 #include <linux/slab.h>
18 #include <linux/udp.h>
19 #include <linux/ip.h>
20 #include <linux/hashtable.h>
21 #include <net/sock.h>
22 #include <net/af_rxrpc.h>
23 #include "ar-internal.h"
24
25 static void rxrpc_local_processor(struct work_struct *);
26 static void rxrpc_local_rcu(struct rcu_head *);
27
28 /*
29 * Compare a local to an address. Return -ve, 0 or +ve to indicate less than,
30 * same or greater than.
31 *
32 * We explicitly don't compare the RxRPC service ID as we want to reject
33 * conflicting uses by differing services. Further, we don't want to share
34 * addresses with different options (IPv6), so we don't compare those bits
35 * either.
36 */
rxrpc_local_cmp_key(const struct rxrpc_local * local,const struct sockaddr_rxrpc * srx)37 static long rxrpc_local_cmp_key(const struct rxrpc_local *local,
38 const struct sockaddr_rxrpc *srx)
39 {
40 long diff;
41
42 diff = ((local->srx.transport_type - srx->transport_type) ?:
43 (local->srx.transport_len - srx->transport_len) ?:
44 (local->srx.transport.family - srx->transport.family));
45 if (diff != 0)
46 return diff;
47
48 switch (srx->transport.family) {
49 case AF_INET:
50 /* If the choice of UDP port is left up to the transport, then
51 * the endpoint record doesn't match.
52 */
53 return ((u16 __force)local->srx.transport.sin.sin_port -
54 (u16 __force)srx->transport.sin.sin_port) ?:
55 memcmp(&local->srx.transport.sin.sin_addr,
56 &srx->transport.sin.sin_addr,
57 sizeof(struct in_addr));
58 #ifdef CONFIG_AF_RXRPC_IPV6
59 case AF_INET6:
60 /* If the choice of UDP6 port is left up to the transport, then
61 * the endpoint record doesn't match.
62 */
63 return ((u16 __force)local->srx.transport.sin6.sin6_port -
64 (u16 __force)srx->transport.sin6.sin6_port) ?:
65 memcmp(&local->srx.transport.sin6.sin6_addr,
66 &srx->transport.sin6.sin6_addr,
67 sizeof(struct in6_addr));
68 #endif
69 default:
70 BUG();
71 }
72 }
73
74 /*
75 * Allocate a new local endpoint.
76 */
rxrpc_alloc_local(struct rxrpc_net * rxnet,const struct sockaddr_rxrpc * srx)77 static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
78 const struct sockaddr_rxrpc *srx)
79 {
80 struct rxrpc_local *local;
81
82 local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
83 if (local) {
84 atomic_set(&local->usage, 1);
85 local->rxnet = rxnet;
86 INIT_LIST_HEAD(&local->link);
87 INIT_WORK(&local->processor, rxrpc_local_processor);
88 init_rwsem(&local->defrag_sem);
89 skb_queue_head_init(&local->reject_queue);
90 skb_queue_head_init(&local->event_queue);
91 local->client_conns = RB_ROOT;
92 spin_lock_init(&local->client_conns_lock);
93 spin_lock_init(&local->lock);
94 rwlock_init(&local->services_lock);
95 local->debug_id = atomic_inc_return(&rxrpc_debug_id);
96 memcpy(&local->srx, srx, sizeof(*srx));
97 local->srx.srx_service = 0;
98 }
99
100 _leave(" = %p", local);
101 return local;
102 }
103
104 /*
105 * create the local socket
106 * - must be called with rxrpc_local_mutex locked
107 */
rxrpc_open_socket(struct rxrpc_local * local,struct net * net)108 static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net)
109 {
110 struct sock *sock;
111 int ret, opt;
112
113 _enter("%p{%d,%d}",
114 local, local->srx.transport_type, local->srx.transport.family);
115
116 /* create a socket to represent the local endpoint */
117 ret = sock_create_kern(net, local->srx.transport.family,
118 local->srx.transport_type, 0, &local->socket);
119 if (ret < 0) {
120 _leave(" = %d [socket]", ret);
121 return ret;
122 }
123
124 /* if a local address was supplied then bind it */
125 if (local->srx.transport_len > sizeof(sa_family_t)) {
126 _debug("bind");
127 ret = kernel_bind(local->socket,
128 (struct sockaddr *)&local->srx.transport,
129 local->srx.transport_len);
130 if (ret < 0) {
131 _debug("bind failed %d", ret);
132 goto error;
133 }
134 }
135
136 switch (local->srx.transport.family) {
137 case AF_INET:
138 /* we want to receive ICMP errors */
139 opt = 1;
140 ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR,
141 (char *) &opt, sizeof(opt));
142 if (ret < 0) {
143 _debug("setsockopt failed");
144 goto error;
145 }
146
147 /* we want to set the don't fragment bit */
148 opt = IP_PMTUDISC_DO;
149 ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER,
150 (char *) &opt, sizeof(opt));
151 if (ret < 0) {
152 _debug("setsockopt failed");
153 goto error;
154 }
155 break;
156
157 case AF_INET6:
158 /* we want to receive ICMP errors */
159 opt = 1;
160 ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR,
161 (char *) &opt, sizeof(opt));
162 if (ret < 0) {
163 _debug("setsockopt failed");
164 goto error;
165 }
166
167 /* we want to set the don't fragment bit */
168 opt = IPV6_PMTUDISC_DO;
169 ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
170 (char *) &opt, sizeof(opt));
171 if (ret < 0) {
172 _debug("setsockopt failed");
173 goto error;
174 }
175 break;
176
177 default:
178 BUG();
179 }
180
181 /* set the socket up */
182 sock = local->socket->sk;
183 sock->sk_user_data = local;
184 sock->sk_data_ready = rxrpc_data_ready;
185 sock->sk_error_report = rxrpc_error_report;
186 _leave(" = 0");
187 return 0;
188
189 error:
190 kernel_sock_shutdown(local->socket, SHUT_RDWR);
191 local->socket->sk->sk_user_data = NULL;
192 sock_release(local->socket);
193 local->socket = NULL;
194
195 _leave(" = %d", ret);
196 return ret;
197 }
198
199 /*
200 * Look up or create a new local endpoint using the specified local address.
201 */
rxrpc_lookup_local(struct net * net,const struct sockaddr_rxrpc * srx)202 struct rxrpc_local *rxrpc_lookup_local(struct net *net,
203 const struct sockaddr_rxrpc *srx)
204 {
205 struct rxrpc_local *local;
206 struct rxrpc_net *rxnet = rxrpc_net(net);
207 struct list_head *cursor;
208 const char *age;
209 long diff;
210 int ret;
211
212 _enter("{%d,%d,%pISp}",
213 srx->transport_type, srx->transport.family, &srx->transport);
214
215 mutex_lock(&rxnet->local_mutex);
216
217 for (cursor = rxnet->local_endpoints.next;
218 cursor != &rxnet->local_endpoints;
219 cursor = cursor->next) {
220 local = list_entry(cursor, struct rxrpc_local, link);
221
222 diff = rxrpc_local_cmp_key(local, srx);
223 if (diff < 0)
224 continue;
225 if (diff > 0)
226 break;
227
228 /* Services aren't allowed to share transport sockets, so
229 * reject that here. It is possible that the object is dying -
230 * but it may also still have the local transport address that
231 * we want bound.
232 */
233 if (srx->srx_service) {
234 local = NULL;
235 goto addr_in_use;
236 }
237
238 /* Found a match. We replace a dying object. Attempting to
239 * bind the transport socket may still fail if we're attempting
240 * to use a local address that the dying object is still using.
241 */
242 if (!rxrpc_get_local_maybe(local)) {
243 cursor = cursor->next;
244 list_del_init(&local->link);
245 break;
246 }
247
248 age = "old";
249 goto found;
250 }
251
252 local = rxrpc_alloc_local(rxnet, srx);
253 if (!local)
254 goto nomem;
255
256 ret = rxrpc_open_socket(local, net);
257 if (ret < 0)
258 goto sock_error;
259
260 list_add_tail(&local->link, cursor);
261 age = "new";
262
263 found:
264 mutex_unlock(&rxnet->local_mutex);
265
266 _net("LOCAL %s %d {%pISp}",
267 age, local->debug_id, &local->srx.transport);
268
269 _leave(" = %p", local);
270 return local;
271
272 nomem:
273 ret = -ENOMEM;
274 sock_error:
275 mutex_unlock(&rxnet->local_mutex);
276 kfree(local);
277 _leave(" = %d", ret);
278 return ERR_PTR(ret);
279
280 addr_in_use:
281 mutex_unlock(&rxnet->local_mutex);
282 _leave(" = -EADDRINUSE");
283 return ERR_PTR(-EADDRINUSE);
284 }
285
286 /*
287 * A local endpoint reached its end of life.
288 */
__rxrpc_put_local(struct rxrpc_local * local)289 void __rxrpc_put_local(struct rxrpc_local *local)
290 {
291 _enter("%d", local->debug_id);
292 rxrpc_queue_work(&local->processor);
293 }
294
295 /*
296 * Destroy a local endpoint's socket and then hand the record to RCU to dispose
297 * of.
298 *
299 * Closing the socket cannot be done from bottom half context or RCU callback
300 * context because it might sleep.
301 */
rxrpc_local_destroyer(struct rxrpc_local * local)302 static void rxrpc_local_destroyer(struct rxrpc_local *local)
303 {
304 struct socket *socket = local->socket;
305 struct rxrpc_net *rxnet = local->rxnet;
306
307 _enter("%d", local->debug_id);
308
309 /* We can get a race between an incoming call packet queueing the
310 * processor again and the work processor starting the destruction
311 * process which will shut down the UDP socket.
312 */
313 if (local->dead) {
314 _leave(" [already dead]");
315 return;
316 }
317 local->dead = true;
318
319 mutex_lock(&rxnet->local_mutex);
320 list_del_init(&local->link);
321 mutex_unlock(&rxnet->local_mutex);
322
323 ASSERT(RB_EMPTY_ROOT(&local->client_conns));
324 ASSERT(!local->service);
325
326 if (socket) {
327 local->socket = NULL;
328 kernel_sock_shutdown(socket, SHUT_RDWR);
329 socket->sk->sk_user_data = NULL;
330 sock_release(socket);
331 }
332
333 /* At this point, there should be no more packets coming in to the
334 * local endpoint.
335 */
336 rxrpc_purge_queue(&local->reject_queue);
337 rxrpc_purge_queue(&local->event_queue);
338
339 _debug("rcu local %d", local->debug_id);
340 call_rcu(&local->rcu, rxrpc_local_rcu);
341 }
342
343 /*
344 * Process events on an endpoint
345 */
rxrpc_local_processor(struct work_struct * work)346 static void rxrpc_local_processor(struct work_struct *work)
347 {
348 struct rxrpc_local *local =
349 container_of(work, struct rxrpc_local, processor);
350 bool again;
351
352 _enter("%d", local->debug_id);
353
354 do {
355 again = false;
356 if (atomic_read(&local->usage) == 0)
357 return rxrpc_local_destroyer(local);
358
359 if (!skb_queue_empty(&local->reject_queue)) {
360 rxrpc_reject_packets(local);
361 again = true;
362 }
363
364 if (!skb_queue_empty(&local->event_queue)) {
365 rxrpc_process_local_events(local);
366 again = true;
367 }
368 } while (again);
369 }
370
371 /*
372 * Destroy a local endpoint after the RCU grace period expires.
373 */
rxrpc_local_rcu(struct rcu_head * rcu)374 static void rxrpc_local_rcu(struct rcu_head *rcu)
375 {
376 struct rxrpc_local *local = container_of(rcu, struct rxrpc_local, rcu);
377
378 _enter("%d", local->debug_id);
379
380 ASSERT(!work_pending(&local->processor));
381
382 _net("DESTROY LOCAL %d", local->debug_id);
383 kfree(local);
384 _leave("");
385 }
386
387 /*
388 * Verify the local endpoint list is empty by this point.
389 */
rxrpc_destroy_all_locals(struct rxrpc_net * rxnet)390 void rxrpc_destroy_all_locals(struct rxrpc_net *rxnet)
391 {
392 struct rxrpc_local *local;
393
394 _enter("");
395
396 flush_workqueue(rxrpc_workqueue);
397
398 if (!list_empty(&rxnet->local_endpoints)) {
399 mutex_lock(&rxnet->local_mutex);
400 list_for_each_entry(local, &rxnet->local_endpoints, link) {
401 pr_err("AF_RXRPC: Leaked local %p {%d}\n",
402 local, atomic_read(&local->usage));
403 }
404 mutex_unlock(&rxnet->local_mutex);
405 BUG();
406 }
407 }
408