1 /*
2 * NETLINK Kernel-user communication protocol.
3 *
4 * Authors: Alan Cox <alan@lxorguk.ukuu.org.uk>
5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6 * Patrick McHardy <kaber@trash.net>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
12 *
13 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
14 * added netlink_proto_exit
15 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
16 * use nlk_sk, as sk->protinfo is on a diet 8)
17 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
18 * - inc module use count of module that owns
19 * the kernel socket in case userspace opens
20 * socket of same protocol
21 * - remove all module support, since netlink is
22 * mandatory if CONFIG_NET=y these days
23 */
24
25 #include <linux/module.h>
26
27 #include <linux/capability.h>
28 #include <linux/kernel.h>
29 #include <linux/init.h>
30 #include <linux/signal.h>
31 #include <linux/sched.h>
32 #include <linux/errno.h>
33 #include <linux/string.h>
34 #include <linux/stat.h>
35 #include <linux/socket.h>
36 #include <linux/un.h>
37 #include <linux/fcntl.h>
38 #include <linux/termios.h>
39 #include <linux/sockios.h>
40 #include <linux/net.h>
41 #include <linux/fs.h>
42 #include <linux/slab.h>
43 #include <linux/uaccess.h>
44 #include <linux/skbuff.h>
45 #include <linux/netdevice.h>
46 #include <linux/rtnetlink.h>
47 #include <linux/proc_fs.h>
48 #include <linux/seq_file.h>
49 #include <linux/notifier.h>
50 #include <linux/security.h>
51 #include <linux/jhash.h>
52 #include <linux/jiffies.h>
53 #include <linux/random.h>
54 #include <linux/bitops.h>
55 #include <linux/mm.h>
56 #include <linux/types.h>
57 #include <linux/audit.h>
58 #include <linux/mutex.h>
59 #include <linux/vmalloc.h>
60 #include <linux/if_arp.h>
61 #include <linux/rhashtable.h>
62 #include <asm/cacheflush.h>
63 #include <linux/hash.h>
64 #include <linux/genetlink.h>
65 #include <linux/net_namespace.h>
66 #include <linux/nospec.h>
67
68 #include <net/net_namespace.h>
69 #include <net/sock.h>
70 #include <net/scm.h>
71 #include <net/netlink.h>
72
73 #include "af_netlink.h"
74
75 struct listeners {
76 struct rcu_head rcu;
77 unsigned long masks[0];
78 };
79
80 /* state bits */
81 #define NETLINK_S_CONGESTED 0x0
82
netlink_is_kernel(struct sock * sk)83 static inline int netlink_is_kernel(struct sock *sk)
84 {
85 return nlk_sk(sk)->flags & NETLINK_F_KERNEL_SOCKET;
86 }
87
88 struct netlink_table *nl_table __read_mostly;
89 EXPORT_SYMBOL_GPL(nl_table);
90
91 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
92
93 static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS];
94
95 static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
96 "nlk_cb_mutex-ROUTE",
97 "nlk_cb_mutex-1",
98 "nlk_cb_mutex-USERSOCK",
99 "nlk_cb_mutex-FIREWALL",
100 "nlk_cb_mutex-SOCK_DIAG",
101 "nlk_cb_mutex-NFLOG",
102 "nlk_cb_mutex-XFRM",
103 "nlk_cb_mutex-SELINUX",
104 "nlk_cb_mutex-ISCSI",
105 "nlk_cb_mutex-AUDIT",
106 "nlk_cb_mutex-FIB_LOOKUP",
107 "nlk_cb_mutex-CONNECTOR",
108 "nlk_cb_mutex-NETFILTER",
109 "nlk_cb_mutex-IP6_FW",
110 "nlk_cb_mutex-DNRTMSG",
111 "nlk_cb_mutex-KOBJECT_UEVENT",
112 "nlk_cb_mutex-GENERIC",
113 "nlk_cb_mutex-17",
114 "nlk_cb_mutex-SCSITRANSPORT",
115 "nlk_cb_mutex-ECRYPTFS",
116 "nlk_cb_mutex-RDMA",
117 "nlk_cb_mutex-CRYPTO",
118 "nlk_cb_mutex-SMC",
119 "nlk_cb_mutex-23",
120 "nlk_cb_mutex-24",
121 "nlk_cb_mutex-25",
122 "nlk_cb_mutex-26",
123 "nlk_cb_mutex-27",
124 "nlk_cb_mutex-28",
125 "nlk_cb_mutex-29",
126 "nlk_cb_mutex-30",
127 "nlk_cb_mutex-31",
128 "nlk_cb_mutex-MAX_LINKS"
129 };
130
131 static int netlink_dump(struct sock *sk);
132 static void netlink_skb_destructor(struct sk_buff *skb);
133
134 /* nl_table locking explained:
135 * Lookup and traversal are protected with an RCU read-side lock. Insertion
136 * and removal are protected with per bucket lock while using RCU list
137 * modification primitives and may run in parallel to RCU protected lookups.
138 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
139 * been acquired * either during or after the socket has been removed from
140 * the list and after an RCU grace period.
141 */
142 DEFINE_RWLOCK(nl_table_lock);
143 EXPORT_SYMBOL_GPL(nl_table_lock);
144 static atomic_t nl_table_users = ATOMIC_INIT(0);
145
146 #define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
147
148 static BLOCKING_NOTIFIER_HEAD(netlink_chain);
149
150 static DEFINE_SPINLOCK(netlink_tap_lock);
151 static struct list_head netlink_tap_all __read_mostly;
152
153 static const struct rhashtable_params netlink_rhashtable_params;
154
netlink_group_mask(u32 group)155 static inline u32 netlink_group_mask(u32 group)
156 {
157 return group ? 1 << (group - 1) : 0;
158 }
159
netlink_to_full_skb(const struct sk_buff * skb,gfp_t gfp_mask)160 static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
161 gfp_t gfp_mask)
162 {
163 unsigned int len = skb_end_offset(skb);
164 struct sk_buff *new;
165
166 new = alloc_skb(len, gfp_mask);
167 if (new == NULL)
168 return NULL;
169
170 NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
171 NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
172 NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
173
174 skb_put_data(new, skb->data, len);
175 return new;
176 }
177
netlink_add_tap(struct netlink_tap * nt)178 int netlink_add_tap(struct netlink_tap *nt)
179 {
180 if (unlikely(nt->dev->type != ARPHRD_NETLINK))
181 return -EINVAL;
182
183 spin_lock(&netlink_tap_lock);
184 list_add_rcu(&nt->list, &netlink_tap_all);
185 spin_unlock(&netlink_tap_lock);
186
187 __module_get(nt->module);
188
189 return 0;
190 }
191 EXPORT_SYMBOL_GPL(netlink_add_tap);
192
__netlink_remove_tap(struct netlink_tap * nt)193 static int __netlink_remove_tap(struct netlink_tap *nt)
194 {
195 bool found = false;
196 struct netlink_tap *tmp;
197
198 spin_lock(&netlink_tap_lock);
199
200 list_for_each_entry(tmp, &netlink_tap_all, list) {
201 if (nt == tmp) {
202 list_del_rcu(&nt->list);
203 found = true;
204 goto out;
205 }
206 }
207
208 pr_warn("__netlink_remove_tap: %p not found\n", nt);
209 out:
210 spin_unlock(&netlink_tap_lock);
211
212 if (found)
213 module_put(nt->module);
214
215 return found ? 0 : -ENODEV;
216 }
217
netlink_remove_tap(struct netlink_tap * nt)218 int netlink_remove_tap(struct netlink_tap *nt)
219 {
220 int ret;
221
222 ret = __netlink_remove_tap(nt);
223 synchronize_net();
224
225 return ret;
226 }
227 EXPORT_SYMBOL_GPL(netlink_remove_tap);
228
netlink_filter_tap(const struct sk_buff * skb)229 static bool netlink_filter_tap(const struct sk_buff *skb)
230 {
231 struct sock *sk = skb->sk;
232
233 /* We take the more conservative approach and
234 * whitelist socket protocols that may pass.
235 */
236 switch (sk->sk_protocol) {
237 case NETLINK_ROUTE:
238 case NETLINK_USERSOCK:
239 case NETLINK_SOCK_DIAG:
240 case NETLINK_NFLOG:
241 case NETLINK_XFRM:
242 case NETLINK_FIB_LOOKUP:
243 case NETLINK_NETFILTER:
244 case NETLINK_GENERIC:
245 return true;
246 }
247
248 return false;
249 }
250
__netlink_deliver_tap_skb(struct sk_buff * skb,struct net_device * dev)251 static int __netlink_deliver_tap_skb(struct sk_buff *skb,
252 struct net_device *dev)
253 {
254 struct sk_buff *nskb;
255 struct sock *sk = skb->sk;
256 int ret = -ENOMEM;
257
258 if (!net_eq(dev_net(dev), sock_net(sk)))
259 return 0;
260
261 dev_hold(dev);
262
263 if (is_vmalloc_addr(skb->head))
264 nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
265 else
266 nskb = skb_clone(skb, GFP_ATOMIC);
267 if (nskb) {
268 nskb->dev = dev;
269 nskb->protocol = htons((u16) sk->sk_protocol);
270 nskb->pkt_type = netlink_is_kernel(sk) ?
271 PACKET_KERNEL : PACKET_USER;
272 skb_reset_network_header(nskb);
273 ret = dev_queue_xmit(nskb);
274 if (unlikely(ret > 0))
275 ret = net_xmit_errno(ret);
276 }
277
278 dev_put(dev);
279 return ret;
280 }
281
__netlink_deliver_tap(struct sk_buff * skb)282 static void __netlink_deliver_tap(struct sk_buff *skb)
283 {
284 int ret;
285 struct netlink_tap *tmp;
286
287 if (!netlink_filter_tap(skb))
288 return;
289
290 list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
291 ret = __netlink_deliver_tap_skb(skb, tmp->dev);
292 if (unlikely(ret))
293 break;
294 }
295 }
296
netlink_deliver_tap(struct sk_buff * skb)297 static void netlink_deliver_tap(struct sk_buff *skb)
298 {
299 rcu_read_lock();
300
301 if (unlikely(!list_empty(&netlink_tap_all)))
302 __netlink_deliver_tap(skb);
303
304 rcu_read_unlock();
305 }
306
netlink_deliver_tap_kernel(struct sock * dst,struct sock * src,struct sk_buff * skb)307 static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
308 struct sk_buff *skb)
309 {
310 if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
311 netlink_deliver_tap(skb);
312 }
313
netlink_overrun(struct sock * sk)314 static void netlink_overrun(struct sock *sk)
315 {
316 struct netlink_sock *nlk = nlk_sk(sk);
317
318 if (!(nlk->flags & NETLINK_F_RECV_NO_ENOBUFS)) {
319 if (!test_and_set_bit(NETLINK_S_CONGESTED,
320 &nlk_sk(sk)->state)) {
321 sk->sk_err = ENOBUFS;
322 sk->sk_error_report(sk);
323 }
324 }
325 atomic_inc(&sk->sk_drops);
326 }
327
netlink_rcv_wake(struct sock * sk)328 static void netlink_rcv_wake(struct sock *sk)
329 {
330 struct netlink_sock *nlk = nlk_sk(sk);
331
332 if (skb_queue_empty(&sk->sk_receive_queue))
333 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
334 if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
335 wake_up_interruptible(&nlk->wait);
336 }
337
netlink_skb_destructor(struct sk_buff * skb)338 static void netlink_skb_destructor(struct sk_buff *skb)
339 {
340 if (is_vmalloc_addr(skb->head)) {
341 if (!skb->cloned ||
342 !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
343 vfree(skb->head);
344
345 skb->head = NULL;
346 }
347 if (skb->sk != NULL)
348 sock_rfree(skb);
349 }
350
netlink_skb_set_owner_r(struct sk_buff * skb,struct sock * sk)351 static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
352 {
353 WARN_ON(skb->sk != NULL);
354 skb->sk = sk;
355 skb->destructor = netlink_skb_destructor;
356 atomic_add(skb->truesize, &sk->sk_rmem_alloc);
357 sk_mem_charge(sk, skb->truesize);
358 }
359
netlink_sock_destruct(struct sock * sk)360 static void netlink_sock_destruct(struct sock *sk)
361 {
362 struct netlink_sock *nlk = nlk_sk(sk);
363
364 if (nlk->cb_running) {
365 if (nlk->cb.done)
366 nlk->cb.done(&nlk->cb);
367 module_put(nlk->cb.module);
368 kfree_skb(nlk->cb.skb);
369 }
370
371 skb_queue_purge(&sk->sk_receive_queue);
372
373 if (!sock_flag(sk, SOCK_DEAD)) {
374 printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
375 return;
376 }
377
378 WARN_ON(atomic_read(&sk->sk_rmem_alloc));
379 WARN_ON(refcount_read(&sk->sk_wmem_alloc));
380 WARN_ON(nlk_sk(sk)->groups);
381 }
382
netlink_sock_destruct_work(struct work_struct * work)383 static void netlink_sock_destruct_work(struct work_struct *work)
384 {
385 struct netlink_sock *nlk = container_of(work, struct netlink_sock,
386 work);
387
388 sk_free(&nlk->sk);
389 }
390
391 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
392 * SMP. Look, when several writers sleep and reader wakes them up, all but one
393 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
394 * this, _but_ remember, it adds useless work on UP machines.
395 */
396
netlink_table_grab(void)397 void netlink_table_grab(void)
398 __acquires(nl_table_lock)
399 {
400 might_sleep();
401
402 write_lock_irq(&nl_table_lock);
403
404 if (atomic_read(&nl_table_users)) {
405 DECLARE_WAITQUEUE(wait, current);
406
407 add_wait_queue_exclusive(&nl_table_wait, &wait);
408 for (;;) {
409 set_current_state(TASK_UNINTERRUPTIBLE);
410 if (atomic_read(&nl_table_users) == 0)
411 break;
412 write_unlock_irq(&nl_table_lock);
413 schedule();
414 write_lock_irq(&nl_table_lock);
415 }
416
417 __set_current_state(TASK_RUNNING);
418 remove_wait_queue(&nl_table_wait, &wait);
419 }
420 }
421
netlink_table_ungrab(void)422 void netlink_table_ungrab(void)
423 __releases(nl_table_lock)
424 {
425 write_unlock_irq(&nl_table_lock);
426 wake_up(&nl_table_wait);
427 }
428
429 static inline void
netlink_lock_table(void)430 netlink_lock_table(void)
431 {
432 /* read_lock() synchronizes us to netlink_table_grab */
433
434 read_lock(&nl_table_lock);
435 atomic_inc(&nl_table_users);
436 read_unlock(&nl_table_lock);
437 }
438
439 static inline void
netlink_unlock_table(void)440 netlink_unlock_table(void)
441 {
442 if (atomic_dec_and_test(&nl_table_users))
443 wake_up(&nl_table_wait);
444 }
445
446 struct netlink_compare_arg
447 {
448 possible_net_t pnet;
449 u32 portid;
450 };
451
452 /* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
453 #define netlink_compare_arg_len \
454 (offsetof(struct netlink_compare_arg, portid) + sizeof(u32))
455
netlink_compare(struct rhashtable_compare_arg * arg,const void * ptr)456 static inline int netlink_compare(struct rhashtable_compare_arg *arg,
457 const void *ptr)
458 {
459 const struct netlink_compare_arg *x = arg->key;
460 const struct netlink_sock *nlk = ptr;
461
462 return nlk->portid != x->portid ||
463 !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
464 }
465
netlink_compare_arg_init(struct netlink_compare_arg * arg,struct net * net,u32 portid)466 static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
467 struct net *net, u32 portid)
468 {
469 memset(arg, 0, sizeof(*arg));
470 write_pnet(&arg->pnet, net);
471 arg->portid = portid;
472 }
473
__netlink_lookup(struct netlink_table * table,u32 portid,struct net * net)474 static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
475 struct net *net)
476 {
477 struct netlink_compare_arg arg;
478
479 netlink_compare_arg_init(&arg, net, portid);
480 return rhashtable_lookup_fast(&table->hash, &arg,
481 netlink_rhashtable_params);
482 }
483
__netlink_insert(struct netlink_table * table,struct sock * sk)484 static int __netlink_insert(struct netlink_table *table, struct sock *sk)
485 {
486 struct netlink_compare_arg arg;
487
488 netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
489 return rhashtable_lookup_insert_key(&table->hash, &arg,
490 &nlk_sk(sk)->node,
491 netlink_rhashtable_params);
492 }
493
netlink_lookup(struct net * net,int protocol,u32 portid)494 static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
495 {
496 struct netlink_table *table = &nl_table[protocol];
497 struct sock *sk;
498
499 rcu_read_lock();
500 sk = __netlink_lookup(table, portid, net);
501 if (sk)
502 sock_hold(sk);
503 rcu_read_unlock();
504
505 return sk;
506 }
507
508 static const struct proto_ops netlink_ops;
509
510 static void
netlink_update_listeners(struct sock * sk)511 netlink_update_listeners(struct sock *sk)
512 {
513 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
514 unsigned long mask;
515 unsigned int i;
516 struct listeners *listeners;
517
518 listeners = nl_deref_protected(tbl->listeners);
519 if (!listeners)
520 return;
521
522 for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
523 mask = 0;
524 sk_for_each_bound(sk, &tbl->mc_list) {
525 if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
526 mask |= nlk_sk(sk)->groups[i];
527 }
528 listeners->masks[i] = mask;
529 }
530 /* this function is only called with the netlink table "grabbed", which
531 * makes sure updates are visible before bind or setsockopt return. */
532 }
533
netlink_insert(struct sock * sk,u32 portid)534 static int netlink_insert(struct sock *sk, u32 portid)
535 {
536 struct netlink_table *table = &nl_table[sk->sk_protocol];
537 int err;
538
539 lock_sock(sk);
540
541 err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
542 if (nlk_sk(sk)->bound)
543 goto err;
544
545 err = -ENOMEM;
546 if (BITS_PER_LONG > 32 &&
547 unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
548 goto err;
549
550 nlk_sk(sk)->portid = portid;
551 sock_hold(sk);
552
553 err = __netlink_insert(table, sk);
554 if (err) {
555 /* In case the hashtable backend returns with -EBUSY
556 * from here, it must not escape to the caller.
557 */
558 if (unlikely(err == -EBUSY))
559 err = -EOVERFLOW;
560 if (err == -EEXIST)
561 err = -EADDRINUSE;
562 sock_put(sk);
563 goto err;
564 }
565
566 /* We need to ensure that the socket is hashed and visible. */
567 smp_wmb();
568 nlk_sk(sk)->bound = portid;
569
570 err:
571 release_sock(sk);
572 return err;
573 }
574
netlink_remove(struct sock * sk)575 static void netlink_remove(struct sock *sk)
576 {
577 struct netlink_table *table;
578
579 table = &nl_table[sk->sk_protocol];
580 if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
581 netlink_rhashtable_params)) {
582 WARN_ON(refcount_read(&sk->sk_refcnt) == 1);
583 __sock_put(sk);
584 }
585
586 netlink_table_grab();
587 if (nlk_sk(sk)->subscriptions) {
588 __sk_del_bind_node(sk);
589 netlink_update_listeners(sk);
590 }
591 if (sk->sk_protocol == NETLINK_GENERIC)
592 atomic_inc(&genl_sk_destructing_cnt);
593 netlink_table_ungrab();
594 }
595
596 static struct proto netlink_proto = {
597 .name = "NETLINK",
598 .owner = THIS_MODULE,
599 .obj_size = sizeof(struct netlink_sock),
600 };
601
__netlink_create(struct net * net,struct socket * sock,struct mutex * cb_mutex,int protocol,int kern)602 static int __netlink_create(struct net *net, struct socket *sock,
603 struct mutex *cb_mutex, int protocol,
604 int kern)
605 {
606 struct sock *sk;
607 struct netlink_sock *nlk;
608
609 sock->ops = &netlink_ops;
610
611 sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
612 if (!sk)
613 return -ENOMEM;
614
615 sock_init_data(sock, sk);
616
617 nlk = nlk_sk(sk);
618 if (cb_mutex) {
619 nlk->cb_mutex = cb_mutex;
620 } else {
621 nlk->cb_mutex = &nlk->cb_def_mutex;
622 mutex_init(nlk->cb_mutex);
623 lockdep_set_class_and_name(nlk->cb_mutex,
624 nlk_cb_mutex_keys + protocol,
625 nlk_cb_mutex_key_strings[protocol]);
626 }
627 init_waitqueue_head(&nlk->wait);
628
629 sk->sk_destruct = netlink_sock_destruct;
630 sk->sk_protocol = protocol;
631 return 0;
632 }
633
netlink_create(struct net * net,struct socket * sock,int protocol,int kern)634 static int netlink_create(struct net *net, struct socket *sock, int protocol,
635 int kern)
636 {
637 struct module *module = NULL;
638 struct mutex *cb_mutex;
639 struct netlink_sock *nlk;
640 int (*bind)(struct net *net, int group);
641 void (*unbind)(struct net *net, int group);
642 int err = 0;
643
644 sock->state = SS_UNCONNECTED;
645
646 if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
647 return -ESOCKTNOSUPPORT;
648
649 if (protocol < 0 || protocol >= MAX_LINKS)
650 return -EPROTONOSUPPORT;
651 protocol = array_index_nospec(protocol, MAX_LINKS);
652
653 netlink_lock_table();
654 #ifdef CONFIG_MODULES
655 if (!nl_table[protocol].registered) {
656 netlink_unlock_table();
657 request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
658 netlink_lock_table();
659 }
660 #endif
661 if (nl_table[protocol].registered &&
662 try_module_get(nl_table[protocol].module))
663 module = nl_table[protocol].module;
664 else
665 err = -EPROTONOSUPPORT;
666 cb_mutex = nl_table[protocol].cb_mutex;
667 bind = nl_table[protocol].bind;
668 unbind = nl_table[protocol].unbind;
669 netlink_unlock_table();
670
671 if (err < 0)
672 goto out;
673
674 err = __netlink_create(net, sock, cb_mutex, protocol, kern);
675 if (err < 0)
676 goto out_module;
677
678 local_bh_disable();
679 sock_prot_inuse_add(net, &netlink_proto, 1);
680 local_bh_enable();
681
682 nlk = nlk_sk(sock->sk);
683 nlk->module = module;
684 nlk->netlink_bind = bind;
685 nlk->netlink_unbind = unbind;
686 out:
687 return err;
688
689 out_module:
690 module_put(module);
691 goto out;
692 }
693
deferred_put_nlk_sk(struct rcu_head * head)694 static void deferred_put_nlk_sk(struct rcu_head *head)
695 {
696 struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
697 struct sock *sk = &nlk->sk;
698
699 kfree(nlk->groups);
700 nlk->groups = NULL;
701
702 if (!refcount_dec_and_test(&sk->sk_refcnt))
703 return;
704
705 if (nlk->cb_running && nlk->cb.done) {
706 INIT_WORK(&nlk->work, netlink_sock_destruct_work);
707 schedule_work(&nlk->work);
708 return;
709 }
710
711 sk_free(sk);
712 }
713
netlink_release(struct socket * sock)714 static int netlink_release(struct socket *sock)
715 {
716 struct sock *sk = sock->sk;
717 struct netlink_sock *nlk;
718
719 if (!sk)
720 return 0;
721
722 netlink_remove(sk);
723 sock_orphan(sk);
724 nlk = nlk_sk(sk);
725
726 /*
727 * OK. Socket is unlinked, any packets that arrive now
728 * will be purged.
729 */
730
731 /* must not acquire netlink_table_lock in any way again before unbind
732 * and notifying genetlink is done as otherwise it might deadlock
733 */
734 if (nlk->netlink_unbind) {
735 int i;
736
737 for (i = 0; i < nlk->ngroups; i++)
738 if (test_bit(i, nlk->groups))
739 nlk->netlink_unbind(sock_net(sk), i + 1);
740 }
741 if (sk->sk_protocol == NETLINK_GENERIC &&
742 atomic_dec_return(&genl_sk_destructing_cnt) == 0)
743 wake_up(&genl_sk_destructing_waitq);
744
745 sock->sk = NULL;
746 wake_up_interruptible_all(&nlk->wait);
747
748 skb_queue_purge(&sk->sk_write_queue);
749
750 if (nlk->portid && nlk->bound) {
751 struct netlink_notify n = {
752 .net = sock_net(sk),
753 .protocol = sk->sk_protocol,
754 .portid = nlk->portid,
755 };
756 blocking_notifier_call_chain(&netlink_chain,
757 NETLINK_URELEASE, &n);
758 }
759
760 module_put(nlk->module);
761
762 if (netlink_is_kernel(sk)) {
763 netlink_table_grab();
764 BUG_ON(nl_table[sk->sk_protocol].registered == 0);
765 if (--nl_table[sk->sk_protocol].registered == 0) {
766 struct listeners *old;
767
768 old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
769 RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
770 kfree_rcu(old, rcu);
771 nl_table[sk->sk_protocol].module = NULL;
772 nl_table[sk->sk_protocol].bind = NULL;
773 nl_table[sk->sk_protocol].unbind = NULL;
774 nl_table[sk->sk_protocol].flags = 0;
775 nl_table[sk->sk_protocol].registered = 0;
776 }
777 netlink_table_ungrab();
778 }
779
780 local_bh_disable();
781 sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);
782 local_bh_enable();
783 call_rcu(&nlk->rcu, deferred_put_nlk_sk);
784 return 0;
785 }
786
netlink_autobind(struct socket * sock)787 static int netlink_autobind(struct socket *sock)
788 {
789 struct sock *sk = sock->sk;
790 struct net *net = sock_net(sk);
791 struct netlink_table *table = &nl_table[sk->sk_protocol];
792 s32 portid = task_tgid_vnr(current);
793 int err;
794 s32 rover = -4096;
795 bool ok;
796
797 retry:
798 cond_resched();
799 rcu_read_lock();
800 ok = !__netlink_lookup(table, portid, net);
801 rcu_read_unlock();
802 if (!ok) {
803 /* Bind collision, search negative portid values. */
804 if (rover == -4096)
805 /* rover will be in range [S32_MIN, -4097] */
806 rover = S32_MIN + prandom_u32_max(-4096 - S32_MIN);
807 else if (rover >= -4096)
808 rover = -4097;
809 portid = rover--;
810 goto retry;
811 }
812
813 err = netlink_insert(sk, portid);
814 if (err == -EADDRINUSE)
815 goto retry;
816
817 /* If 2 threads race to autobind, that is fine. */
818 if (err == -EBUSY)
819 err = 0;
820
821 return err;
822 }
823
824 /**
825 * __netlink_ns_capable - General netlink message capability test
826 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
827 * @user_ns: The user namespace of the capability to use
828 * @cap: The capability to use
829 *
830 * Test to see if the opener of the socket we received the message
831 * from had when the netlink socket was created and the sender of the
832 * message has has the capability @cap in the user namespace @user_ns.
833 */
__netlink_ns_capable(const struct netlink_skb_parms * nsp,struct user_namespace * user_ns,int cap)834 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
835 struct user_namespace *user_ns, int cap)
836 {
837 return ((nsp->flags & NETLINK_SKB_DST) ||
838 file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
839 ns_capable(user_ns, cap);
840 }
841 EXPORT_SYMBOL(__netlink_ns_capable);
842
843 /**
844 * netlink_ns_capable - General netlink message capability test
845 * @skb: socket buffer holding a netlink command from userspace
846 * @user_ns: The user namespace of the capability to use
847 * @cap: The capability to use
848 *
849 * Test to see if the opener of the socket we received the message
850 * from had when the netlink socket was created and the sender of the
851 * message has has the capability @cap in the user namespace @user_ns.
852 */
netlink_ns_capable(const struct sk_buff * skb,struct user_namespace * user_ns,int cap)853 bool netlink_ns_capable(const struct sk_buff *skb,
854 struct user_namespace *user_ns, int cap)
855 {
856 return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
857 }
858 EXPORT_SYMBOL(netlink_ns_capable);
859
860 /**
861 * netlink_capable - Netlink global message capability test
862 * @skb: socket buffer holding a netlink command from userspace
863 * @cap: The capability to use
864 *
865 * Test to see if the opener of the socket we received the message
866 * from had when the netlink socket was created and the sender of the
867 * message has has the capability @cap in all user namespaces.
868 */
netlink_capable(const struct sk_buff * skb,int cap)869 bool netlink_capable(const struct sk_buff *skb, int cap)
870 {
871 return netlink_ns_capable(skb, &init_user_ns, cap);
872 }
873 EXPORT_SYMBOL(netlink_capable);
874
875 /**
876 * netlink_net_capable - Netlink network namespace message capability test
877 * @skb: socket buffer holding a netlink command from userspace
878 * @cap: The capability to use
879 *
880 * Test to see if the opener of the socket we received the message
881 * from had when the netlink socket was created and the sender of the
882 * message has has the capability @cap over the network namespace of
883 * the socket we received the message from.
884 */
netlink_net_capable(const struct sk_buff * skb,int cap)885 bool netlink_net_capable(const struct sk_buff *skb, int cap)
886 {
887 return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
888 }
889 EXPORT_SYMBOL(netlink_net_capable);
890
netlink_allowed(const struct socket * sock,unsigned int flag)891 static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
892 {
893 return (nl_table[sock->sk->sk_protocol].flags & flag) ||
894 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
895 }
896
897 static void
netlink_update_subscriptions(struct sock * sk,unsigned int subscriptions)898 netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
899 {
900 struct netlink_sock *nlk = nlk_sk(sk);
901
902 if (nlk->subscriptions && !subscriptions)
903 __sk_del_bind_node(sk);
904 else if (!nlk->subscriptions && subscriptions)
905 sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
906 nlk->subscriptions = subscriptions;
907 }
908
netlink_realloc_groups(struct sock * sk)909 static int netlink_realloc_groups(struct sock *sk)
910 {
911 struct netlink_sock *nlk = nlk_sk(sk);
912 unsigned int groups;
913 unsigned long *new_groups;
914 int err = 0;
915
916 netlink_table_grab();
917
918 groups = nl_table[sk->sk_protocol].groups;
919 if (!nl_table[sk->sk_protocol].registered) {
920 err = -ENOENT;
921 goto out_unlock;
922 }
923
924 if (nlk->ngroups >= groups)
925 goto out_unlock;
926
927 new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
928 if (new_groups == NULL) {
929 err = -ENOMEM;
930 goto out_unlock;
931 }
932 memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
933 NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));
934
935 nlk->groups = new_groups;
936 nlk->ngroups = groups;
937 out_unlock:
938 netlink_table_ungrab();
939 return err;
940 }
941
netlink_undo_bind(int group,long unsigned int groups,struct sock * sk)942 static void netlink_undo_bind(int group, long unsigned int groups,
943 struct sock *sk)
944 {
945 struct netlink_sock *nlk = nlk_sk(sk);
946 int undo;
947
948 if (!nlk->netlink_unbind)
949 return;
950
951 for (undo = 0; undo < group; undo++)
952 if (test_bit(undo, &groups))
953 nlk->netlink_unbind(sock_net(sk), undo + 1);
954 }
955
netlink_bind(struct socket * sock,struct sockaddr * addr,int addr_len)956 static int netlink_bind(struct socket *sock, struct sockaddr *addr,
957 int addr_len)
958 {
959 struct sock *sk = sock->sk;
960 struct net *net = sock_net(sk);
961 struct netlink_sock *nlk = nlk_sk(sk);
962 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
963 int err = 0;
964 long unsigned int groups = nladdr->nl_groups;
965 bool bound;
966
967 if (addr_len < sizeof(struct sockaddr_nl))
968 return -EINVAL;
969
970 if (nladdr->nl_family != AF_NETLINK)
971 return -EINVAL;
972
973 /* Only superuser is allowed to listen multicasts */
974 if (groups) {
975 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
976 return -EPERM;
977 err = netlink_realloc_groups(sk);
978 if (err)
979 return err;
980 }
981
982 if (nlk->ngroups == 0)
983 groups = 0;
984 else if (nlk->ngroups < 8*sizeof(groups))
985 groups &= (1UL << nlk->ngroups) - 1;
986
987 bound = nlk->bound;
988 if (bound) {
989 /* Ensure nlk->portid is up-to-date. */
990 smp_rmb();
991
992 if (nladdr->nl_pid != nlk->portid)
993 return -EINVAL;
994 }
995
996 netlink_lock_table();
997 if (nlk->netlink_bind && groups) {
998 int group;
999
1000 /* nl_groups is a u32, so cap the maximum groups we can bind */
1001 for (group = 0; group < BITS_PER_TYPE(u32); group++) {
1002 if (!test_bit(group, &groups))
1003 continue;
1004 err = nlk->netlink_bind(net, group + 1);
1005 if (!err)
1006 continue;
1007 netlink_undo_bind(group, groups, sk);
1008 goto unlock;
1009 }
1010 }
1011
1012 /* No need for barriers here as we return to user-space without
1013 * using any of the bound attributes.
1014 */
1015 if (!bound) {
1016 err = nladdr->nl_pid ?
1017 netlink_insert(sk, nladdr->nl_pid) :
1018 netlink_autobind(sock);
1019 if (err) {
1020 netlink_undo_bind(BITS_PER_TYPE(u32), groups, sk);
1021 goto unlock;
1022 }
1023 }
1024
1025 if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
1026 goto unlock;
1027 netlink_unlock_table();
1028
1029 netlink_table_grab();
1030 netlink_update_subscriptions(sk, nlk->subscriptions +
1031 hweight32(groups) -
1032 hweight32(nlk->groups[0]));
1033 nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
1034 netlink_update_listeners(sk);
1035 netlink_table_ungrab();
1036
1037 return 0;
1038
1039 unlock:
1040 netlink_unlock_table();
1041 return err;
1042 }
1043
netlink_connect(struct socket * sock,struct sockaddr * addr,int alen,int flags)1044 static int netlink_connect(struct socket *sock, struct sockaddr *addr,
1045 int alen, int flags)
1046 {
1047 int err = 0;
1048 struct sock *sk = sock->sk;
1049 struct netlink_sock *nlk = nlk_sk(sk);
1050 struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
1051
1052 if (alen < sizeof(addr->sa_family))
1053 return -EINVAL;
1054
1055 if (addr->sa_family == AF_UNSPEC) {
1056 sk->sk_state = NETLINK_UNCONNECTED;
1057 nlk->dst_portid = 0;
1058 nlk->dst_group = 0;
1059 return 0;
1060 }
1061 if (addr->sa_family != AF_NETLINK)
1062 return -EINVAL;
1063
1064 if (alen < sizeof(struct sockaddr_nl))
1065 return -EINVAL;
1066
1067 if ((nladdr->nl_groups || nladdr->nl_pid) &&
1068 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1069 return -EPERM;
1070
1071 /* No need for barriers here as we return to user-space without
1072 * using any of the bound attributes.
1073 */
1074 if (!nlk->bound)
1075 err = netlink_autobind(sock);
1076
1077 if (err == 0) {
1078 sk->sk_state = NETLINK_CONNECTED;
1079 nlk->dst_portid = nladdr->nl_pid;
1080 nlk->dst_group = ffs(nladdr->nl_groups);
1081 }
1082
1083 return err;
1084 }
1085
netlink_getname(struct socket * sock,struct sockaddr * addr,int * addr_len,int peer)1086 static int netlink_getname(struct socket *sock, struct sockaddr *addr,
1087 int *addr_len, int peer)
1088 {
1089 struct sock *sk = sock->sk;
1090 struct netlink_sock *nlk = nlk_sk(sk);
1091 DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);
1092
1093 nladdr->nl_family = AF_NETLINK;
1094 nladdr->nl_pad = 0;
1095 *addr_len = sizeof(*nladdr);
1096
1097 if (peer) {
1098 nladdr->nl_pid = nlk->dst_portid;
1099 nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
1100 } else {
1101 nladdr->nl_pid = nlk->portid;
1102 netlink_lock_table();
1103 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
1104 netlink_unlock_table();
1105 }
1106 return 0;
1107 }
1108
netlink_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1109 static int netlink_ioctl(struct socket *sock, unsigned int cmd,
1110 unsigned long arg)
1111 {
1112 /* try to hand this ioctl down to the NIC drivers.
1113 */
1114 return -ENOIOCTLCMD;
1115 }
1116
netlink_getsockbyportid(struct sock * ssk,u32 portid)1117 static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
1118 {
1119 struct sock *sock;
1120 struct netlink_sock *nlk;
1121
1122 sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
1123 if (!sock)
1124 return ERR_PTR(-ECONNREFUSED);
1125
1126 /* Don't bother queuing skb if kernel socket has no input function */
1127 nlk = nlk_sk(sock);
1128 if (sock->sk_state == NETLINK_CONNECTED &&
1129 nlk->dst_portid != nlk_sk(ssk)->portid) {
1130 sock_put(sock);
1131 return ERR_PTR(-ECONNREFUSED);
1132 }
1133 return sock;
1134 }
1135
netlink_getsockbyfilp(struct file * filp)1136 struct sock *netlink_getsockbyfilp(struct file *filp)
1137 {
1138 struct inode *inode = file_inode(filp);
1139 struct sock *sock;
1140
1141 if (!S_ISSOCK(inode->i_mode))
1142 return ERR_PTR(-ENOTSOCK);
1143
1144 sock = SOCKET_I(inode)->sk;
1145 if (sock->sk_family != AF_NETLINK)
1146 return ERR_PTR(-EINVAL);
1147
1148 sock_hold(sock);
1149 return sock;
1150 }
1151
netlink_alloc_large_skb(unsigned int size,int broadcast)1152 static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
1153 int broadcast)
1154 {
1155 struct sk_buff *skb;
1156 void *data;
1157
1158 if (size <= NLMSG_GOODSIZE || broadcast)
1159 return alloc_skb(size, GFP_KERNEL);
1160
1161 size = SKB_DATA_ALIGN(size) +
1162 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1163
1164 data = vmalloc(size);
1165 if (data == NULL)
1166 return NULL;
1167
1168 skb = __build_skb(data, size);
1169 if (skb == NULL)
1170 vfree(data);
1171 else
1172 skb->destructor = netlink_skb_destructor;
1173
1174 return skb;
1175 }
1176
1177 /*
1178 * Attach a skb to a netlink socket.
1179 * The caller must hold a reference to the destination socket. On error, the
1180 * reference is dropped. The skb is not send to the destination, just all
1181 * all error checks are performed and memory in the queue is reserved.
1182 * Return values:
1183 * < 0: error. skb freed, reference to sock dropped.
1184 * 0: continue
1185 * 1: repeat lookup - reference dropped while waiting for socket memory.
1186 */
netlink_attachskb(struct sock * sk,struct sk_buff * skb,long * timeo,struct sock * ssk)1187 int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
1188 long *timeo, struct sock *ssk)
1189 {
1190 struct netlink_sock *nlk;
1191
1192 nlk = nlk_sk(sk);
1193
1194 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1195 test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
1196 DECLARE_WAITQUEUE(wait, current);
1197 if (!*timeo) {
1198 if (!ssk || netlink_is_kernel(ssk))
1199 netlink_overrun(sk);
1200 sock_put(sk);
1201 kfree_skb(skb);
1202 return -EAGAIN;
1203 }
1204
1205 __set_current_state(TASK_INTERRUPTIBLE);
1206 add_wait_queue(&nlk->wait, &wait);
1207
1208 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
1209 test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1210 !sock_flag(sk, SOCK_DEAD))
1211 *timeo = schedule_timeout(*timeo);
1212
1213 __set_current_state(TASK_RUNNING);
1214 remove_wait_queue(&nlk->wait, &wait);
1215 sock_put(sk);
1216
1217 if (signal_pending(current)) {
1218 kfree_skb(skb);
1219 return sock_intr_errno(*timeo);
1220 }
1221 return 1;
1222 }
1223 netlink_skb_set_owner_r(skb, sk);
1224 return 0;
1225 }
1226
__netlink_sendskb(struct sock * sk,struct sk_buff * skb)1227 static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1228 {
1229 int len = skb->len;
1230
1231 netlink_deliver_tap(skb);
1232
1233 skb_queue_tail(&sk->sk_receive_queue, skb);
1234 sk->sk_data_ready(sk);
1235 return len;
1236 }
1237
netlink_sendskb(struct sock * sk,struct sk_buff * skb)1238 int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
1239 {
1240 int len = __netlink_sendskb(sk, skb);
1241
1242 sock_put(sk);
1243 return len;
1244 }
1245
netlink_detachskb(struct sock * sk,struct sk_buff * skb)1246 void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
1247 {
1248 kfree_skb(skb);
1249 sock_put(sk);
1250 }
1251
netlink_trim(struct sk_buff * skb,gfp_t allocation)1252 static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
1253 {
1254 int delta;
1255
1256 WARN_ON(skb->sk != NULL);
1257 delta = skb->end - skb->tail;
1258 if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
1259 return skb;
1260
1261 if (skb_shared(skb)) {
1262 struct sk_buff *nskb = skb_clone(skb, allocation);
1263 if (!nskb)
1264 return skb;
1265 consume_skb(skb);
1266 skb = nskb;
1267 }
1268
1269 pskb_expand_head(skb, 0, -delta,
1270 (allocation & ~__GFP_DIRECT_RECLAIM) |
1271 __GFP_NOWARN | __GFP_NORETRY);
1272 return skb;
1273 }
1274
netlink_unicast_kernel(struct sock * sk,struct sk_buff * skb,struct sock * ssk)1275 static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
1276 struct sock *ssk)
1277 {
1278 int ret;
1279 struct netlink_sock *nlk = nlk_sk(sk);
1280
1281 ret = -ECONNREFUSED;
1282 if (nlk->netlink_rcv != NULL) {
1283 ret = skb->len;
1284 netlink_skb_set_owner_r(skb, sk);
1285 NETLINK_CB(skb).sk = ssk;
1286 netlink_deliver_tap_kernel(sk, ssk, skb);
1287 nlk->netlink_rcv(skb);
1288 consume_skb(skb);
1289 } else {
1290 kfree_skb(skb);
1291 }
1292 sock_put(sk);
1293 return ret;
1294 }
1295
netlink_unicast(struct sock * ssk,struct sk_buff * skb,u32 portid,int nonblock)1296 int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
1297 u32 portid, int nonblock)
1298 {
1299 struct sock *sk;
1300 int err;
1301 long timeo;
1302
1303 skb = netlink_trim(skb, gfp_any());
1304
1305 timeo = sock_sndtimeo(ssk, nonblock);
1306 retry:
1307 sk = netlink_getsockbyportid(ssk, portid);
1308 if (IS_ERR(sk)) {
1309 kfree_skb(skb);
1310 return PTR_ERR(sk);
1311 }
1312 if (netlink_is_kernel(sk))
1313 return netlink_unicast_kernel(sk, skb, ssk);
1314
1315 if (sk_filter(sk, skb)) {
1316 err = skb->len;
1317 kfree_skb(skb);
1318 sock_put(sk);
1319 return err;
1320 }
1321
1322 err = netlink_attachskb(sk, skb, &timeo, ssk);
1323 if (err == 1)
1324 goto retry;
1325 if (err)
1326 return err;
1327
1328 return netlink_sendskb(sk, skb);
1329 }
1330 EXPORT_SYMBOL(netlink_unicast);
1331
netlink_has_listeners(struct sock * sk,unsigned int group)1332 int netlink_has_listeners(struct sock *sk, unsigned int group)
1333 {
1334 int res = 0;
1335 struct listeners *listeners;
1336
1337 BUG_ON(!netlink_is_kernel(sk));
1338
1339 rcu_read_lock();
1340 listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
1341
1342 if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
1343 res = test_bit(group - 1, listeners->masks);
1344
1345 rcu_read_unlock();
1346
1347 return res;
1348 }
1349 EXPORT_SYMBOL_GPL(netlink_has_listeners);
1350
netlink_broadcast_deliver(struct sock * sk,struct sk_buff * skb)1351 static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
1352 {
1353 struct netlink_sock *nlk = nlk_sk(sk);
1354
1355 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
1356 !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1357 netlink_skb_set_owner_r(skb, sk);
1358 __netlink_sendskb(sk, skb);
1359 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
1360 }
1361 return -1;
1362 }
1363
1364 struct netlink_broadcast_data {
1365 struct sock *exclude_sk;
1366 struct net *net;
1367 u32 portid;
1368 u32 group;
1369 int failure;
1370 int delivery_failure;
1371 int congested;
1372 int delivered;
1373 gfp_t allocation;
1374 struct sk_buff *skb, *skb2;
1375 int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
1376 void *tx_data;
1377 };
1378
do_one_broadcast(struct sock * sk,struct netlink_broadcast_data * p)1379 static void do_one_broadcast(struct sock *sk,
1380 struct netlink_broadcast_data *p)
1381 {
1382 struct netlink_sock *nlk = nlk_sk(sk);
1383 int val;
1384
1385 if (p->exclude_sk == sk)
1386 return;
1387
1388 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1389 !test_bit(p->group - 1, nlk->groups))
1390 return;
1391
1392 if (!net_eq(sock_net(sk), p->net)) {
1393 if (!(nlk->flags & NETLINK_F_LISTEN_ALL_NSID))
1394 return;
1395
1396 if (!peernet_has_id(sock_net(sk), p->net))
1397 return;
1398
1399 if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
1400 CAP_NET_BROADCAST))
1401 return;
1402 }
1403
1404 if (p->failure) {
1405 netlink_overrun(sk);
1406 return;
1407 }
1408
1409 sock_hold(sk);
1410 if (p->skb2 == NULL) {
1411 if (skb_shared(p->skb)) {
1412 p->skb2 = skb_clone(p->skb, p->allocation);
1413 } else {
1414 p->skb2 = skb_get(p->skb);
1415 /*
1416 * skb ownership may have been set when
1417 * delivered to a previous socket.
1418 */
1419 skb_orphan(p->skb2);
1420 }
1421 }
1422 if (p->skb2 == NULL) {
1423 netlink_overrun(sk);
1424 /* Clone failed. Notify ALL listeners. */
1425 p->failure = 1;
1426 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1427 p->delivery_failure = 1;
1428 goto out;
1429 }
1430 if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
1431 kfree_skb(p->skb2);
1432 p->skb2 = NULL;
1433 goto out;
1434 }
1435 if (sk_filter(sk, p->skb2)) {
1436 kfree_skb(p->skb2);
1437 p->skb2 = NULL;
1438 goto out;
1439 }
1440 NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
1441 if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
1442 NETLINK_CB(p->skb2).nsid_is_set = true;
1443 val = netlink_broadcast_deliver(sk, p->skb2);
1444 if (val < 0) {
1445 netlink_overrun(sk);
1446 if (nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR)
1447 p->delivery_failure = 1;
1448 } else {
1449 p->congested |= val;
1450 p->delivered = 1;
1451 p->skb2 = NULL;
1452 }
1453 out:
1454 sock_put(sk);
1455 }
1456
netlink_broadcast_filtered(struct sock * ssk,struct sk_buff * skb,u32 portid,u32 group,gfp_t allocation,int (* filter)(struct sock * dsk,struct sk_buff * skb,void * data),void * filter_data)1457 int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb, u32 portid,
1458 u32 group, gfp_t allocation,
1459 int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
1460 void *filter_data)
1461 {
1462 struct net *net = sock_net(ssk);
1463 struct netlink_broadcast_data info;
1464 struct sock *sk;
1465
1466 skb = netlink_trim(skb, allocation);
1467
1468 info.exclude_sk = ssk;
1469 info.net = net;
1470 info.portid = portid;
1471 info.group = group;
1472 info.failure = 0;
1473 info.delivery_failure = 0;
1474 info.congested = 0;
1475 info.delivered = 0;
1476 info.allocation = allocation;
1477 info.skb = skb;
1478 info.skb2 = NULL;
1479 info.tx_filter = filter;
1480 info.tx_data = filter_data;
1481
1482 /* While we sleep in clone, do not allow to change socket list */
1483
1484 netlink_lock_table();
1485
1486 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
1487 do_one_broadcast(sk, &info);
1488
1489 consume_skb(skb);
1490
1491 netlink_unlock_table();
1492
1493 if (info.delivery_failure) {
1494 kfree_skb(info.skb2);
1495 return -ENOBUFS;
1496 }
1497 consume_skb(info.skb2);
1498
1499 if (info.delivered) {
1500 if (info.congested && gfpflags_allow_blocking(allocation))
1501 yield();
1502 return 0;
1503 }
1504 return -ESRCH;
1505 }
1506 EXPORT_SYMBOL(netlink_broadcast_filtered);
1507
netlink_broadcast(struct sock * ssk,struct sk_buff * skb,u32 portid,u32 group,gfp_t allocation)1508 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
1509 u32 group, gfp_t allocation)
1510 {
1511 return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
1512 NULL, NULL);
1513 }
1514 EXPORT_SYMBOL(netlink_broadcast);
1515
1516 struct netlink_set_err_data {
1517 struct sock *exclude_sk;
1518 u32 portid;
1519 u32 group;
1520 int code;
1521 };
1522
do_one_set_err(struct sock * sk,struct netlink_set_err_data * p)1523 static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
1524 {
1525 struct netlink_sock *nlk = nlk_sk(sk);
1526 int ret = 0;
1527
1528 if (sk == p->exclude_sk)
1529 goto out;
1530
1531 if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
1532 goto out;
1533
1534 if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
1535 !test_bit(p->group - 1, nlk->groups))
1536 goto out;
1537
1538 if (p->code == ENOBUFS && nlk->flags & NETLINK_F_RECV_NO_ENOBUFS) {
1539 ret = 1;
1540 goto out;
1541 }
1542
1543 sk->sk_err = p->code;
1544 sk->sk_error_report(sk);
1545 out:
1546 return ret;
1547 }
1548
1549 /**
1550 * netlink_set_err - report error to broadcast listeners
1551 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
1552 * @portid: the PORTID of a process that we want to skip (if any)
1553 * @group: the broadcast group that will notice the error
1554 * @code: error code, must be negative (as usual in kernelspace)
1555 *
1556 * This function returns the number of broadcast listeners that have set the
1557 * NETLINK_NO_ENOBUFS socket option.
1558 */
netlink_set_err(struct sock * ssk,u32 portid,u32 group,int code)1559 int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
1560 {
1561 struct netlink_set_err_data info;
1562 struct sock *sk;
1563 int ret = 0;
1564
1565 info.exclude_sk = ssk;
1566 info.portid = portid;
1567 info.group = group;
1568 /* sk->sk_err wants a positive error value */
1569 info.code = -code;
1570
1571 read_lock(&nl_table_lock);
1572
1573 sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
1574 ret += do_one_set_err(sk, &info);
1575
1576 read_unlock(&nl_table_lock);
1577 return ret;
1578 }
1579 EXPORT_SYMBOL(netlink_set_err);
1580
1581 /* must be called with netlink table grabbed */
netlink_update_socket_mc(struct netlink_sock * nlk,unsigned int group,int is_new)1582 static void netlink_update_socket_mc(struct netlink_sock *nlk,
1583 unsigned int group,
1584 int is_new)
1585 {
1586 int old, new = !!is_new, subscriptions;
1587
1588 old = test_bit(group - 1, nlk->groups);
1589 subscriptions = nlk->subscriptions - old + new;
1590 if (new)
1591 __set_bit(group - 1, nlk->groups);
1592 else
1593 __clear_bit(group - 1, nlk->groups);
1594 netlink_update_subscriptions(&nlk->sk, subscriptions);
1595 netlink_update_listeners(&nlk->sk);
1596 }
1597
netlink_setsockopt(struct socket * sock,int level,int optname,char __user * optval,unsigned int optlen)1598 static int netlink_setsockopt(struct socket *sock, int level, int optname,
1599 char __user *optval, unsigned int optlen)
1600 {
1601 struct sock *sk = sock->sk;
1602 struct netlink_sock *nlk = nlk_sk(sk);
1603 unsigned int val = 0;
1604 int err;
1605
1606 if (level != SOL_NETLINK)
1607 return -ENOPROTOOPT;
1608
1609 if (optlen >= sizeof(int) &&
1610 get_user(val, (unsigned int __user *)optval))
1611 return -EFAULT;
1612
1613 switch (optname) {
1614 case NETLINK_PKTINFO:
1615 if (val)
1616 nlk->flags |= NETLINK_F_RECV_PKTINFO;
1617 else
1618 nlk->flags &= ~NETLINK_F_RECV_PKTINFO;
1619 err = 0;
1620 break;
1621 case NETLINK_ADD_MEMBERSHIP:
1622 case NETLINK_DROP_MEMBERSHIP: {
1623 if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
1624 return -EPERM;
1625 err = netlink_realloc_groups(sk);
1626 if (err)
1627 return err;
1628 if (!val || val - 1 >= nlk->ngroups)
1629 return -EINVAL;
1630 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
1631 err = nlk->netlink_bind(sock_net(sk), val);
1632 if (err)
1633 return err;
1634 }
1635 netlink_table_grab();
1636 netlink_update_socket_mc(nlk, val,
1637 optname == NETLINK_ADD_MEMBERSHIP);
1638 netlink_table_ungrab();
1639 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
1640 nlk->netlink_unbind(sock_net(sk), val);
1641
1642 err = 0;
1643 break;
1644 }
1645 case NETLINK_BROADCAST_ERROR:
1646 if (val)
1647 nlk->flags |= NETLINK_F_BROADCAST_SEND_ERROR;
1648 else
1649 nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR;
1650 err = 0;
1651 break;
1652 case NETLINK_NO_ENOBUFS:
1653 if (val) {
1654 nlk->flags |= NETLINK_F_RECV_NO_ENOBUFS;
1655 clear_bit(NETLINK_S_CONGESTED, &nlk->state);
1656 wake_up_interruptible(&nlk->wait);
1657 } else {
1658 nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS;
1659 }
1660 err = 0;
1661 break;
1662 case NETLINK_LISTEN_ALL_NSID:
1663 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
1664 return -EPERM;
1665
1666 if (val)
1667 nlk->flags |= NETLINK_F_LISTEN_ALL_NSID;
1668 else
1669 nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID;
1670 err = 0;
1671 break;
1672 case NETLINK_CAP_ACK:
1673 if (val)
1674 nlk->flags |= NETLINK_F_CAP_ACK;
1675 else
1676 nlk->flags &= ~NETLINK_F_CAP_ACK;
1677 err = 0;
1678 break;
1679 case NETLINK_EXT_ACK:
1680 if (val)
1681 nlk->flags |= NETLINK_F_EXT_ACK;
1682 else
1683 nlk->flags &= ~NETLINK_F_EXT_ACK;
1684 err = 0;
1685 break;
1686 default:
1687 err = -ENOPROTOOPT;
1688 }
1689 return err;
1690 }
1691
netlink_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)1692 static int netlink_getsockopt(struct socket *sock, int level, int optname,
1693 char __user *optval, int __user *optlen)
1694 {
1695 struct sock *sk = sock->sk;
1696 struct netlink_sock *nlk = nlk_sk(sk);
1697 int len, val, err;
1698
1699 if (level != SOL_NETLINK)
1700 return -ENOPROTOOPT;
1701
1702 if (get_user(len, optlen))
1703 return -EFAULT;
1704 if (len < 0)
1705 return -EINVAL;
1706
1707 switch (optname) {
1708 case NETLINK_PKTINFO:
1709 if (len < sizeof(int))
1710 return -EINVAL;
1711 len = sizeof(int);
1712 val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
1713 if (put_user(len, optlen) ||
1714 put_user(val, optval))
1715 return -EFAULT;
1716 err = 0;
1717 break;
1718 case NETLINK_BROADCAST_ERROR:
1719 if (len < sizeof(int))
1720 return -EINVAL;
1721 len = sizeof(int);
1722 val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
1723 if (put_user(len, optlen) ||
1724 put_user(val, optval))
1725 return -EFAULT;
1726 err = 0;
1727 break;
1728 case NETLINK_NO_ENOBUFS:
1729 if (len < sizeof(int))
1730 return -EINVAL;
1731 len = sizeof(int);
1732 val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
1733 if (put_user(len, optlen) ||
1734 put_user(val, optval))
1735 return -EFAULT;
1736 err = 0;
1737 break;
1738 case NETLINK_LIST_MEMBERSHIPS: {
1739 int pos, idx, shift;
1740
1741 err = 0;
1742 netlink_lock_table();
1743 for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
1744 if (len - pos < sizeof(u32))
1745 break;
1746
1747 idx = pos / sizeof(unsigned long);
1748 shift = (pos % sizeof(unsigned long)) * 8;
1749 if (put_user((u32)(nlk->groups[idx] >> shift),
1750 (u32 __user *)(optval + pos))) {
1751 err = -EFAULT;
1752 break;
1753 }
1754 }
1755 if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
1756 err = -EFAULT;
1757 netlink_unlock_table();
1758 break;
1759 }
1760 case NETLINK_CAP_ACK:
1761 if (len < sizeof(int))
1762 return -EINVAL;
1763 len = sizeof(int);
1764 val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
1765 if (put_user(len, optlen) ||
1766 put_user(val, optval))
1767 return -EFAULT;
1768 err = 0;
1769 break;
1770 case NETLINK_EXT_ACK:
1771 if (len < sizeof(int))
1772 return -EINVAL;
1773 len = sizeof(int);
1774 val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
1775 if (put_user(len, optlen) || put_user(val, optval))
1776 return -EFAULT;
1777 err = 0;
1778 break;
1779 default:
1780 err = -ENOPROTOOPT;
1781 }
1782 return err;
1783 }
1784
netlink_cmsg_recv_pktinfo(struct msghdr * msg,struct sk_buff * skb)1785 static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
1786 {
1787 struct nl_pktinfo info;
1788
1789 info.group = NETLINK_CB(skb).dst_group;
1790 put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
1791 }
1792
netlink_cmsg_listen_all_nsid(struct sock * sk,struct msghdr * msg,struct sk_buff * skb)1793 static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
1794 struct sk_buff *skb)
1795 {
1796 if (!NETLINK_CB(skb).nsid_is_set)
1797 return;
1798
1799 put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
1800 &NETLINK_CB(skb).nsid);
1801 }
1802
netlink_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)1803 static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1804 {
1805 struct sock *sk = sock->sk;
1806 struct netlink_sock *nlk = nlk_sk(sk);
1807 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
1808 u32 dst_portid;
1809 u32 dst_group;
1810 struct sk_buff *skb;
1811 int err;
1812 struct scm_cookie scm;
1813 u32 netlink_skb_flags = 0;
1814
1815 if (msg->msg_flags&MSG_OOB)
1816 return -EOPNOTSUPP;
1817
1818 err = scm_send(sock, msg, &scm, true);
1819 if (err < 0)
1820 return err;
1821
1822 if (msg->msg_namelen) {
1823 err = -EINVAL;
1824 if (msg->msg_namelen < sizeof(struct sockaddr_nl))
1825 goto out;
1826 if (addr->nl_family != AF_NETLINK)
1827 goto out;
1828 dst_portid = addr->nl_pid;
1829 dst_group = ffs(addr->nl_groups);
1830 err = -EPERM;
1831 if ((dst_group || dst_portid) &&
1832 !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
1833 goto out;
1834 netlink_skb_flags |= NETLINK_SKB_DST;
1835 } else {
1836 dst_portid = nlk->dst_portid;
1837 dst_group = nlk->dst_group;
1838 }
1839
1840 if (!nlk->bound) {
1841 err = netlink_autobind(sock);
1842 if (err)
1843 goto out;
1844 } else {
1845 /* Ensure nlk is hashed and visible. */
1846 smp_rmb();
1847 }
1848
1849 err = -EMSGSIZE;
1850 if (len > sk->sk_sndbuf - 32)
1851 goto out;
1852 err = -ENOBUFS;
1853 skb = netlink_alloc_large_skb(len, dst_group);
1854 if (skb == NULL)
1855 goto out;
1856
1857 NETLINK_CB(skb).portid = nlk->portid;
1858 NETLINK_CB(skb).dst_group = dst_group;
1859 NETLINK_CB(skb).creds = scm.creds;
1860 NETLINK_CB(skb).flags = netlink_skb_flags;
1861
1862 err = -EFAULT;
1863 if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1864 kfree_skb(skb);
1865 goto out;
1866 }
1867
1868 err = security_netlink_send(sk, skb);
1869 if (err) {
1870 kfree_skb(skb);
1871 goto out;
1872 }
1873
1874 if (dst_group) {
1875 refcount_inc(&skb->users);
1876 netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
1877 }
1878 err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags&MSG_DONTWAIT);
1879
1880 out:
1881 scm_destroy(&scm);
1882 return err;
1883 }
1884
netlink_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)1885 static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
1886 int flags)
1887 {
1888 struct scm_cookie scm;
1889 struct sock *sk = sock->sk;
1890 struct netlink_sock *nlk = nlk_sk(sk);
1891 int noblock = flags&MSG_DONTWAIT;
1892 size_t copied;
1893 struct sk_buff *skb, *data_skb;
1894 int err, ret;
1895
1896 if (flags&MSG_OOB)
1897 return -EOPNOTSUPP;
1898
1899 copied = 0;
1900
1901 skb = skb_recv_datagram(sk, flags, noblock, &err);
1902 if (skb == NULL)
1903 goto out;
1904
1905 data_skb = skb;
1906
1907 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
1908 if (unlikely(skb_shinfo(skb)->frag_list)) {
1909 /*
1910 * If this skb has a frag_list, then here that means that we
1911 * will have to use the frag_list skb's data for compat tasks
1912 * and the regular skb's data for normal (non-compat) tasks.
1913 *
1914 * If we need to send the compat skb, assign it to the
1915 * 'data_skb' variable so that it will be used below for data
1916 * copying. We keep 'skb' for everything else, including
1917 * freeing both later.
1918 */
1919 if (flags & MSG_CMSG_COMPAT)
1920 data_skb = skb_shinfo(skb)->frag_list;
1921 }
1922 #endif
1923
1924 /* Record the max length of recvmsg() calls for future allocations */
1925 nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
1926 nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
1927 SKB_WITH_OVERHEAD(32768));
1928
1929 copied = data_skb->len;
1930 if (len < copied) {
1931 msg->msg_flags |= MSG_TRUNC;
1932 copied = len;
1933 }
1934
1935 skb_reset_transport_header(data_skb);
1936 err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
1937
1938 if (msg->msg_name) {
1939 DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
1940 addr->nl_family = AF_NETLINK;
1941 addr->nl_pad = 0;
1942 addr->nl_pid = NETLINK_CB(skb).portid;
1943 addr->nl_groups = netlink_group_mask(NETLINK_CB(skb).dst_group);
1944 msg->msg_namelen = sizeof(*addr);
1945 }
1946
1947 if (nlk->flags & NETLINK_F_RECV_PKTINFO)
1948 netlink_cmsg_recv_pktinfo(msg, skb);
1949 if (nlk->flags & NETLINK_F_LISTEN_ALL_NSID)
1950 netlink_cmsg_listen_all_nsid(sk, msg, skb);
1951
1952 memset(&scm, 0, sizeof(scm));
1953 scm.creds = *NETLINK_CREDS(skb);
1954 if (flags & MSG_TRUNC)
1955 copied = data_skb->len;
1956
1957 skb_free_datagram(sk, skb);
1958
1959 if (nlk->cb_running &&
1960 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
1961 ret = netlink_dump(sk);
1962 if (ret) {
1963 sk->sk_err = -ret;
1964 sk->sk_error_report(sk);
1965 }
1966 }
1967
1968 scm_recv(sock, msg, &scm, flags);
1969 out:
1970 netlink_rcv_wake(sk);
1971 return err ? : copied;
1972 }
1973
netlink_data_ready(struct sock * sk)1974 static void netlink_data_ready(struct sock *sk)
1975 {
1976 BUG();
1977 }
1978
1979 /*
1980 * We export these functions to other modules. They provide a
1981 * complete set of kernel non-blocking support for message
1982 * queueing.
1983 */
1984
1985 struct sock *
__netlink_kernel_create(struct net * net,int unit,struct module * module,struct netlink_kernel_cfg * cfg)1986 __netlink_kernel_create(struct net *net, int unit, struct module *module,
1987 struct netlink_kernel_cfg *cfg)
1988 {
1989 struct socket *sock;
1990 struct sock *sk;
1991 struct netlink_sock *nlk;
1992 struct listeners *listeners = NULL;
1993 struct mutex *cb_mutex = cfg ? cfg->cb_mutex : NULL;
1994 unsigned int groups;
1995
1996 BUG_ON(!nl_table);
1997
1998 if (unit < 0 || unit >= MAX_LINKS)
1999 return NULL;
2000
2001 if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
2002 return NULL;
2003
2004 if (__netlink_create(net, sock, cb_mutex, unit, 1) < 0)
2005 goto out_sock_release_nosk;
2006
2007 sk = sock->sk;
2008
2009 if (!cfg || cfg->groups < 32)
2010 groups = 32;
2011 else
2012 groups = cfg->groups;
2013
2014 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2015 if (!listeners)
2016 goto out_sock_release;
2017
2018 sk->sk_data_ready = netlink_data_ready;
2019 if (cfg && cfg->input)
2020 nlk_sk(sk)->netlink_rcv = cfg->input;
2021
2022 if (netlink_insert(sk, 0))
2023 goto out_sock_release;
2024
2025 nlk = nlk_sk(sk);
2026 nlk->flags |= NETLINK_F_KERNEL_SOCKET;
2027
2028 netlink_table_grab();
2029 if (!nl_table[unit].registered) {
2030 nl_table[unit].groups = groups;
2031 rcu_assign_pointer(nl_table[unit].listeners, listeners);
2032 nl_table[unit].cb_mutex = cb_mutex;
2033 nl_table[unit].module = module;
2034 if (cfg) {
2035 nl_table[unit].bind = cfg->bind;
2036 nl_table[unit].unbind = cfg->unbind;
2037 nl_table[unit].flags = cfg->flags;
2038 if (cfg->compare)
2039 nl_table[unit].compare = cfg->compare;
2040 }
2041 nl_table[unit].registered = 1;
2042 } else {
2043 kfree(listeners);
2044 nl_table[unit].registered++;
2045 }
2046 netlink_table_ungrab();
2047 return sk;
2048
2049 out_sock_release:
2050 kfree(listeners);
2051 netlink_kernel_release(sk);
2052 return NULL;
2053
2054 out_sock_release_nosk:
2055 sock_release(sock);
2056 return NULL;
2057 }
2058 EXPORT_SYMBOL(__netlink_kernel_create);
2059
2060 void
netlink_kernel_release(struct sock * sk)2061 netlink_kernel_release(struct sock *sk)
2062 {
2063 if (sk == NULL || sk->sk_socket == NULL)
2064 return;
2065
2066 sock_release(sk->sk_socket);
2067 }
2068 EXPORT_SYMBOL(netlink_kernel_release);
2069
__netlink_change_ngroups(struct sock * sk,unsigned int groups)2070 int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
2071 {
2072 struct listeners *new, *old;
2073 struct netlink_table *tbl = &nl_table[sk->sk_protocol];
2074
2075 if (groups < 32)
2076 groups = 32;
2077
2078 if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
2079 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
2080 if (!new)
2081 return -ENOMEM;
2082 old = nl_deref_protected(tbl->listeners);
2083 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
2084 rcu_assign_pointer(tbl->listeners, new);
2085
2086 kfree_rcu(old, rcu);
2087 }
2088 tbl->groups = groups;
2089
2090 return 0;
2091 }
2092
2093 /**
2094 * netlink_change_ngroups - change number of multicast groups
2095 *
2096 * This changes the number of multicast groups that are available
2097 * on a certain netlink family. Note that it is not possible to
2098 * change the number of groups to below 32. Also note that it does
2099 * not implicitly call netlink_clear_multicast_users() when the
2100 * number of groups is reduced.
2101 *
2102 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
2103 * @groups: The new number of groups.
2104 */
netlink_change_ngroups(struct sock * sk,unsigned int groups)2105 int netlink_change_ngroups(struct sock *sk, unsigned int groups)
2106 {
2107 int err;
2108
2109 netlink_table_grab();
2110 err = __netlink_change_ngroups(sk, groups);
2111 netlink_table_ungrab();
2112
2113 return err;
2114 }
2115
__netlink_clear_multicast_users(struct sock * ksk,unsigned int group)2116 void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
2117 {
2118 struct sock *sk;
2119 struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
2120
2121 sk_for_each_bound(sk, &tbl->mc_list)
2122 netlink_update_socket_mc(nlk_sk(sk), group, 0);
2123 }
2124
2125 struct nlmsghdr *
__nlmsg_put(struct sk_buff * skb,u32 portid,u32 seq,int type,int len,int flags)2126 __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
2127 {
2128 struct nlmsghdr *nlh;
2129 int size = nlmsg_msg_size(len);
2130
2131 nlh = skb_put(skb, NLMSG_ALIGN(size));
2132 nlh->nlmsg_type = type;
2133 nlh->nlmsg_len = size;
2134 nlh->nlmsg_flags = flags;
2135 nlh->nlmsg_pid = portid;
2136 nlh->nlmsg_seq = seq;
2137 if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
2138 memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
2139 return nlh;
2140 }
2141 EXPORT_SYMBOL(__nlmsg_put);
2142
2143 /*
2144 * It looks a bit ugly.
2145 * It would be better to create kernel thread.
2146 */
2147
netlink_dump(struct sock * sk)2148 static int netlink_dump(struct sock *sk)
2149 {
2150 struct netlink_sock *nlk = nlk_sk(sk);
2151 struct netlink_callback *cb;
2152 struct sk_buff *skb = NULL;
2153 struct nlmsghdr *nlh;
2154 struct module *module;
2155 int err = -ENOBUFS;
2156 int alloc_min_size;
2157 int alloc_size;
2158
2159 mutex_lock(nlk->cb_mutex);
2160 if (!nlk->cb_running) {
2161 err = -EINVAL;
2162 goto errout_skb;
2163 }
2164
2165 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2166 goto errout_skb;
2167
2168 /* NLMSG_GOODSIZE is small to avoid high order allocations being
2169 * required, but it makes sense to _attempt_ a 16K bytes allocation
2170 * to reduce number of system calls on dump operations, if user
2171 * ever provided a big enough buffer.
2172 */
2173 cb = &nlk->cb;
2174 alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
2175
2176 if (alloc_min_size < nlk->max_recvmsg_len) {
2177 alloc_size = nlk->max_recvmsg_len;
2178 skb = alloc_skb(alloc_size,
2179 (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) |
2180 __GFP_NOWARN | __GFP_NORETRY);
2181 }
2182 if (!skb) {
2183 alloc_size = alloc_min_size;
2184 skb = alloc_skb(alloc_size, GFP_KERNEL);
2185 }
2186 if (!skb)
2187 goto errout_skb;
2188
2189 /* Trim skb to allocated size. User is expected to provide buffer as
2190 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
2191 * netlink_recvmsg())). dump will pack as many smaller messages as
2192 * could fit within the allocated skb. skb is typically allocated
2193 * with larger space than required (could be as much as near 2x the
2194 * requested size with align to next power of 2 approach). Allowing
2195 * dump to use the excess space makes it difficult for a user to have a
2196 * reasonable static buffer based on the expected largest dump of a
2197 * single netdev. The outcome is MSG_TRUNC error.
2198 */
2199 skb_reserve(skb, skb_tailroom(skb) - alloc_size);
2200 netlink_skb_set_owner_r(skb, sk);
2201
2202 if (nlk->dump_done_errno > 0)
2203 nlk->dump_done_errno = cb->dump(skb, cb);
2204
2205 if (nlk->dump_done_errno > 0 ||
2206 skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
2207 mutex_unlock(nlk->cb_mutex);
2208
2209 if (sk_filter(sk, skb))
2210 kfree_skb(skb);
2211 else
2212 __netlink_sendskb(sk, skb);
2213 return 0;
2214 }
2215
2216 nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE,
2217 sizeof(nlk->dump_done_errno), NLM_F_MULTI);
2218 if (WARN_ON(!nlh))
2219 goto errout_skb;
2220
2221 nl_dump_check_consistent(cb, nlh);
2222
2223 memcpy(nlmsg_data(nlh), &nlk->dump_done_errno,
2224 sizeof(nlk->dump_done_errno));
2225
2226 if (sk_filter(sk, skb))
2227 kfree_skb(skb);
2228 else
2229 __netlink_sendskb(sk, skb);
2230
2231 if (cb->done)
2232 cb->done(cb);
2233
2234 nlk->cb_running = false;
2235 module = cb->module;
2236 skb = cb->skb;
2237 mutex_unlock(nlk->cb_mutex);
2238 module_put(module);
2239 consume_skb(skb);
2240 return 0;
2241
2242 errout_skb:
2243 mutex_unlock(nlk->cb_mutex);
2244 kfree_skb(skb);
2245 return err;
2246 }
2247
__netlink_dump_start(struct sock * ssk,struct sk_buff * skb,const struct nlmsghdr * nlh,struct netlink_dump_control * control)2248 int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
2249 const struct nlmsghdr *nlh,
2250 struct netlink_dump_control *control)
2251 {
2252 struct netlink_callback *cb;
2253 struct sock *sk;
2254 struct netlink_sock *nlk;
2255 int ret;
2256
2257 refcount_inc(&skb->users);
2258
2259 sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
2260 if (sk == NULL) {
2261 ret = -ECONNREFUSED;
2262 goto error_free;
2263 }
2264
2265 nlk = nlk_sk(sk);
2266 mutex_lock(nlk->cb_mutex);
2267 /* A dump is in progress... */
2268 if (nlk->cb_running) {
2269 ret = -EBUSY;
2270 goto error_unlock;
2271 }
2272 /* add reference of module which cb->dump belongs to */
2273 if (!try_module_get(control->module)) {
2274 ret = -EPROTONOSUPPORT;
2275 goto error_unlock;
2276 }
2277
2278 cb = &nlk->cb;
2279 memset(cb, 0, sizeof(*cb));
2280 cb->start = control->start;
2281 cb->dump = control->dump;
2282 cb->done = control->done;
2283 cb->nlh = nlh;
2284 cb->data = control->data;
2285 cb->module = control->module;
2286 cb->min_dump_alloc = control->min_dump_alloc;
2287 cb->skb = skb;
2288
2289 if (cb->start) {
2290 ret = cb->start(cb);
2291 if (ret)
2292 goto error_put;
2293 }
2294
2295 nlk->cb_running = true;
2296 nlk->dump_done_errno = INT_MAX;
2297
2298 mutex_unlock(nlk->cb_mutex);
2299
2300 ret = netlink_dump(sk);
2301
2302 sock_put(sk);
2303
2304 if (ret)
2305 return ret;
2306
2307 /* We successfully started a dump, by returning -EINTR we
2308 * signal not to send ACK even if it was requested.
2309 */
2310 return -EINTR;
2311
2312 error_put:
2313 module_put(control->module);
2314 error_unlock:
2315 sock_put(sk);
2316 mutex_unlock(nlk->cb_mutex);
2317 error_free:
2318 kfree_skb(skb);
2319 return ret;
2320 }
2321 EXPORT_SYMBOL(__netlink_dump_start);
2322
netlink_ack(struct sk_buff * in_skb,struct nlmsghdr * nlh,int err,const struct netlink_ext_ack * extack)2323 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
2324 const struct netlink_ext_ack *extack)
2325 {
2326 struct sk_buff *skb;
2327 struct nlmsghdr *rep;
2328 struct nlmsgerr *errmsg;
2329 size_t payload = sizeof(*errmsg);
2330 size_t tlvlen = 0;
2331 struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
2332 unsigned int flags = 0;
2333 bool nlk_has_extack = nlk->flags & NETLINK_F_EXT_ACK;
2334
2335 /* Error messages get the original request appened, unless the user
2336 * requests to cap the error message, and get extra error data if
2337 * requested.
2338 */
2339 if (err) {
2340 if (!(nlk->flags & NETLINK_F_CAP_ACK))
2341 payload += nlmsg_len(nlh);
2342 else
2343 flags |= NLM_F_CAPPED;
2344 if (nlk_has_extack && extack) {
2345 if (extack->_msg)
2346 tlvlen += nla_total_size(strlen(extack->_msg) + 1);
2347 if (extack->bad_attr)
2348 tlvlen += nla_total_size(sizeof(u32));
2349 }
2350 } else {
2351 flags |= NLM_F_CAPPED;
2352
2353 if (nlk_has_extack && extack && extack->cookie_len)
2354 tlvlen += nla_total_size(extack->cookie_len);
2355 }
2356
2357 if (tlvlen)
2358 flags |= NLM_F_ACK_TLVS;
2359
2360 skb = nlmsg_new(payload + tlvlen, GFP_KERNEL);
2361 if (!skb) {
2362 struct sock *sk;
2363
2364 sk = netlink_lookup(sock_net(in_skb->sk),
2365 in_skb->sk->sk_protocol,
2366 NETLINK_CB(in_skb).portid);
2367 if (sk) {
2368 sk->sk_err = ENOBUFS;
2369 sk->sk_error_report(sk);
2370 sock_put(sk);
2371 }
2372 return;
2373 }
2374
2375 rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2376 NLMSG_ERROR, payload, flags);
2377 errmsg = nlmsg_data(rep);
2378 errmsg->error = err;
2379 memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
2380
2381 if (nlk_has_extack && extack) {
2382 if (err) {
2383 if (extack->_msg)
2384 WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG,
2385 extack->_msg));
2386 if (extack->bad_attr &&
2387 !WARN_ON((u8 *)extack->bad_attr < in_skb->data ||
2388 (u8 *)extack->bad_attr >= in_skb->data +
2389 in_skb->len))
2390 WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS,
2391 (u8 *)extack->bad_attr -
2392 (u8 *)nlh));
2393 } else {
2394 if (extack->cookie_len)
2395 WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE,
2396 extack->cookie_len,
2397 extack->cookie));
2398 }
2399 }
2400
2401 nlmsg_end(skb, rep);
2402
2403 netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
2404 }
2405 EXPORT_SYMBOL(netlink_ack);
2406
netlink_rcv_skb(struct sk_buff * skb,int (* cb)(struct sk_buff *,struct nlmsghdr *,struct netlink_ext_ack *))2407 int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
2408 struct nlmsghdr *,
2409 struct netlink_ext_ack *))
2410 {
2411 struct netlink_ext_ack extack;
2412 struct nlmsghdr *nlh;
2413 int err;
2414
2415 while (skb->len >= nlmsg_total_size(0)) {
2416 int msglen;
2417
2418 memset(&extack, 0, sizeof(extack));
2419 nlh = nlmsg_hdr(skb);
2420 err = 0;
2421
2422 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
2423 return 0;
2424
2425 /* Only requests are handled by the kernel */
2426 if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
2427 goto ack;
2428
2429 /* Skip control messages */
2430 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
2431 goto ack;
2432
2433 err = cb(skb, nlh, &extack);
2434 if (err == -EINTR)
2435 goto skip;
2436
2437 ack:
2438 if (nlh->nlmsg_flags & NLM_F_ACK || err)
2439 netlink_ack(skb, nlh, err, &extack);
2440
2441 skip:
2442 msglen = NLMSG_ALIGN(nlh->nlmsg_len);
2443 if (msglen > skb->len)
2444 msglen = skb->len;
2445 skb_pull(skb, msglen);
2446 }
2447
2448 return 0;
2449 }
2450 EXPORT_SYMBOL(netlink_rcv_skb);
2451
2452 /**
2453 * nlmsg_notify - send a notification netlink message
2454 * @sk: netlink socket to use
2455 * @skb: notification message
2456 * @portid: destination netlink portid for reports or 0
2457 * @group: destination multicast group or 0
2458 * @report: 1 to report back, 0 to disable
2459 * @flags: allocation flags
2460 */
nlmsg_notify(struct sock * sk,struct sk_buff * skb,u32 portid,unsigned int group,int report,gfp_t flags)2461 int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
2462 unsigned int group, int report, gfp_t flags)
2463 {
2464 int err = 0;
2465
2466 if (group) {
2467 int exclude_portid = 0;
2468
2469 if (report) {
2470 refcount_inc(&skb->users);
2471 exclude_portid = portid;
2472 }
2473
2474 /* errors reported via destination sk->sk_err, but propagate
2475 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
2476 err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
2477 }
2478
2479 if (report) {
2480 int err2;
2481
2482 err2 = nlmsg_unicast(sk, skb, portid);
2483 if (!err || err == -ESRCH)
2484 err = err2;
2485 }
2486
2487 return err;
2488 }
2489 EXPORT_SYMBOL(nlmsg_notify);
2490
2491 #ifdef CONFIG_PROC_FS
2492 struct nl_seq_iter {
2493 struct seq_net_private p;
2494 struct rhashtable_iter hti;
2495 int link;
2496 };
2497
netlink_walk_start(struct nl_seq_iter * iter)2498 static int netlink_walk_start(struct nl_seq_iter *iter)
2499 {
2500 int err;
2501
2502 err = rhashtable_walk_init(&nl_table[iter->link].hash, &iter->hti,
2503 GFP_KERNEL);
2504 if (err) {
2505 iter->link = MAX_LINKS;
2506 return err;
2507 }
2508
2509 err = rhashtable_walk_start(&iter->hti);
2510 return err == -EAGAIN ? 0 : err;
2511 }
2512
netlink_walk_stop(struct nl_seq_iter * iter)2513 static void netlink_walk_stop(struct nl_seq_iter *iter)
2514 {
2515 rhashtable_walk_stop(&iter->hti);
2516 rhashtable_walk_exit(&iter->hti);
2517 }
2518
__netlink_seq_next(struct seq_file * seq)2519 static void *__netlink_seq_next(struct seq_file *seq)
2520 {
2521 struct nl_seq_iter *iter = seq->private;
2522 struct netlink_sock *nlk;
2523
2524 do {
2525 for (;;) {
2526 int err;
2527
2528 nlk = rhashtable_walk_next(&iter->hti);
2529
2530 if (IS_ERR(nlk)) {
2531 if (PTR_ERR(nlk) == -EAGAIN)
2532 continue;
2533
2534 return nlk;
2535 }
2536
2537 if (nlk)
2538 break;
2539
2540 netlink_walk_stop(iter);
2541 if (++iter->link >= MAX_LINKS)
2542 return NULL;
2543
2544 err = netlink_walk_start(iter);
2545 if (err)
2546 return ERR_PTR(err);
2547 }
2548 } while (sock_net(&nlk->sk) != seq_file_net(seq));
2549
2550 return nlk;
2551 }
2552
netlink_seq_start(struct seq_file * seq,loff_t * posp)2553 static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
2554 {
2555 struct nl_seq_iter *iter = seq->private;
2556 void *obj = SEQ_START_TOKEN;
2557 loff_t pos;
2558 int err;
2559
2560 iter->link = 0;
2561
2562 err = netlink_walk_start(iter);
2563 if (err)
2564 return ERR_PTR(err);
2565
2566 for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
2567 obj = __netlink_seq_next(seq);
2568
2569 return obj;
2570 }
2571
netlink_seq_next(struct seq_file * seq,void * v,loff_t * pos)2572 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2573 {
2574 ++*pos;
2575 return __netlink_seq_next(seq);
2576 }
2577
netlink_seq_stop(struct seq_file * seq,void * v)2578 static void netlink_seq_stop(struct seq_file *seq, void *v)
2579 {
2580 struct nl_seq_iter *iter = seq->private;
2581
2582 if (iter->link >= MAX_LINKS)
2583 return;
2584
2585 netlink_walk_stop(iter);
2586 }
2587
2588
netlink_seq_show(struct seq_file * seq,void * v)2589 static int netlink_seq_show(struct seq_file *seq, void *v)
2590 {
2591 if (v == SEQ_START_TOKEN) {
2592 seq_puts(seq,
2593 "sk Eth Pid Groups "
2594 "Rmem Wmem Dump Locks Drops Inode\n");
2595 } else {
2596 struct sock *s = v;
2597 struct netlink_sock *nlk = nlk_sk(s);
2598
2599 seq_printf(seq, "%pK %-3d %-6u %08x %-8d %-8d %d %-8d %-8d %-8lu\n",
2600 s,
2601 s->sk_protocol,
2602 nlk->portid,
2603 nlk->groups ? (u32)nlk->groups[0] : 0,
2604 sk_rmem_alloc_get(s),
2605 sk_wmem_alloc_get(s),
2606 nlk->cb_running,
2607 refcount_read(&s->sk_refcnt),
2608 atomic_read(&s->sk_drops),
2609 sock_i_ino(s)
2610 );
2611
2612 }
2613 return 0;
2614 }
2615
2616 static const struct seq_operations netlink_seq_ops = {
2617 .start = netlink_seq_start,
2618 .next = netlink_seq_next,
2619 .stop = netlink_seq_stop,
2620 .show = netlink_seq_show,
2621 };
2622
2623
netlink_seq_open(struct inode * inode,struct file * file)2624 static int netlink_seq_open(struct inode *inode, struct file *file)
2625 {
2626 return seq_open_net(inode, file, &netlink_seq_ops,
2627 sizeof(struct nl_seq_iter));
2628 }
2629
2630 static const struct file_operations netlink_seq_fops = {
2631 .owner = THIS_MODULE,
2632 .open = netlink_seq_open,
2633 .read = seq_read,
2634 .llseek = seq_lseek,
2635 .release = seq_release_net,
2636 };
2637
2638 #endif
2639
netlink_register_notifier(struct notifier_block * nb)2640 int netlink_register_notifier(struct notifier_block *nb)
2641 {
2642 return blocking_notifier_chain_register(&netlink_chain, nb);
2643 }
2644 EXPORT_SYMBOL(netlink_register_notifier);
2645
netlink_unregister_notifier(struct notifier_block * nb)2646 int netlink_unregister_notifier(struct notifier_block *nb)
2647 {
2648 return blocking_notifier_chain_unregister(&netlink_chain, nb);
2649 }
2650 EXPORT_SYMBOL(netlink_unregister_notifier);
2651
2652 static const struct proto_ops netlink_ops = {
2653 .family = PF_NETLINK,
2654 .owner = THIS_MODULE,
2655 .release = netlink_release,
2656 .bind = netlink_bind,
2657 .connect = netlink_connect,
2658 .socketpair = sock_no_socketpair,
2659 .accept = sock_no_accept,
2660 .getname = netlink_getname,
2661 .poll = datagram_poll,
2662 .ioctl = netlink_ioctl,
2663 .listen = sock_no_listen,
2664 .shutdown = sock_no_shutdown,
2665 .setsockopt = netlink_setsockopt,
2666 .getsockopt = netlink_getsockopt,
2667 .sendmsg = netlink_sendmsg,
2668 .recvmsg = netlink_recvmsg,
2669 .mmap = sock_no_mmap,
2670 .sendpage = sock_no_sendpage,
2671 };
2672
2673 static const struct net_proto_family netlink_family_ops = {
2674 .family = PF_NETLINK,
2675 .create = netlink_create,
2676 .owner = THIS_MODULE, /* for consistency 8) */
2677 };
2678
netlink_net_init(struct net * net)2679 static int __net_init netlink_net_init(struct net *net)
2680 {
2681 #ifdef CONFIG_PROC_FS
2682 if (!proc_create("netlink", 0, net->proc_net, &netlink_seq_fops))
2683 return -ENOMEM;
2684 #endif
2685 return 0;
2686 }
2687
netlink_net_exit(struct net * net)2688 static void __net_exit netlink_net_exit(struct net *net)
2689 {
2690 #ifdef CONFIG_PROC_FS
2691 remove_proc_entry("netlink", net->proc_net);
2692 #endif
2693 }
2694
netlink_add_usersock_entry(void)2695 static void __init netlink_add_usersock_entry(void)
2696 {
2697 struct listeners *listeners;
2698 int groups = 32;
2699
2700 listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
2701 if (!listeners)
2702 panic("netlink_add_usersock_entry: Cannot allocate listeners\n");
2703
2704 netlink_table_grab();
2705
2706 nl_table[NETLINK_USERSOCK].groups = groups;
2707 rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
2708 nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
2709 nl_table[NETLINK_USERSOCK].registered = 1;
2710 nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;
2711
2712 netlink_table_ungrab();
2713 }
2714
2715 static struct pernet_operations __net_initdata netlink_net_ops = {
2716 .init = netlink_net_init,
2717 .exit = netlink_net_exit,
2718 };
2719
netlink_hash(const void * data,u32 len,u32 seed)2720 static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
2721 {
2722 const struct netlink_sock *nlk = data;
2723 struct netlink_compare_arg arg;
2724
2725 netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
2726 return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
2727 }
2728
2729 static const struct rhashtable_params netlink_rhashtable_params = {
2730 .head_offset = offsetof(struct netlink_sock, node),
2731 .key_len = netlink_compare_arg_len,
2732 .obj_hashfn = netlink_hash,
2733 .obj_cmpfn = netlink_compare,
2734 .automatic_shrinking = true,
2735 };
2736
netlink_proto_init(void)2737 static int __init netlink_proto_init(void)
2738 {
2739 int i;
2740 int err = proto_register(&netlink_proto, 0);
2741
2742 if (err != 0)
2743 goto out;
2744
2745 BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
2746
2747 nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
2748 if (!nl_table)
2749 goto panic;
2750
2751 for (i = 0; i < MAX_LINKS; i++) {
2752 if (rhashtable_init(&nl_table[i].hash,
2753 &netlink_rhashtable_params) < 0) {
2754 while (--i > 0)
2755 rhashtable_destroy(&nl_table[i].hash);
2756 kfree(nl_table);
2757 goto panic;
2758 }
2759 }
2760
2761 INIT_LIST_HEAD(&netlink_tap_all);
2762
2763 netlink_add_usersock_entry();
2764
2765 sock_register(&netlink_family_ops);
2766 register_pernet_subsys(&netlink_net_ops);
2767 /* The netlink device handler may be needed early. */
2768 rtnetlink_init();
2769 out:
2770 return err;
2771 panic:
2772 panic("netlink_init: Cannot allocate nl_table\n");
2773 }
2774
2775 core_initcall(netlink_proto_init);
2776