1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * VMware vSockets Driver
4 *
5 * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
6 */
7
8 /* Implementation notes:
9 *
10 * - There are two kinds of sockets: those created by user action (such as
11 * calling socket(2)) and those created by incoming connection request packets.
12 *
13 * - There are two "global" tables, one for bound sockets (sockets that have
14 * specified an address that they are responsible for) and one for connected
15 * sockets (sockets that have established a connection with another socket).
16 * These tables are "global" in that all sockets on the system are placed
17 * within them. - Note, though, that the bound table contains an extra entry
18 * for a list of unbound sockets and SOCK_DGRAM sockets will always remain in
19 * that list. The bound table is used solely for lookup of sockets when packets
20 * are received and that's not necessary for SOCK_DGRAM sockets since we create
21 * a datagram handle for each and need not perform a lookup. Keeping SOCK_DGRAM
22 * sockets out of the bound hash buckets will reduce the chance of collisions
23 * when looking for SOCK_STREAM sockets and prevents us from having to check the
24 * socket type in the hash table lookups.
25 *
26 * - Sockets created by user action will either be "client" sockets that
27 * initiate a connection or "server" sockets that listen for connections; we do
28 * not support simultaneous connects (two "client" sockets connecting).
29 *
30 * - "Server" sockets are referred to as listener sockets throughout this
31 * implementation because they are in the TCP_LISTEN state. When a
32 * connection request is received (the second kind of socket mentioned above),
33 * we create a new socket and refer to it as a pending socket. These pending
34 * sockets are placed on the pending connection list of the listener socket.
35 * When future packets are received for the address the listener socket is
36 * bound to, we check if the source of the packet is from one that has an
37 * existing pending connection. If it does, we process the packet for the
38 * pending socket. When that socket reaches the connected state, it is removed
39 * from the listener socket's pending list and enqueued in the listener
40 * socket's accept queue. Callers of accept(2) will accept connected sockets
41 * from the listener socket's accept queue. If the socket cannot be accepted
42 * for some reason then it is marked rejected. Once the connection is
43 * accepted, it is owned by the user process and the responsibility for cleanup
44 * falls with that user process.
45 *
46 * - It is possible that these pending sockets will never reach the connected
47 * state; in fact, we may never receive another packet after the connection
48 * request. Because of this, we must schedule a cleanup function to run in the
49 * future, after some amount of time passes where a connection should have been
50 * established. This function ensures that the socket is off all lists so it
51 * cannot be retrieved, then drops all references to the socket so it is cleaned
52 * up (sock_put() -> sk_free() -> our sk_destruct implementation). Note this
53 * function will also cleanup rejected sockets, those that reach the connected
54 * state but leave it before they have been accepted.
55 *
56 * - Lock ordering for pending or accept queue sockets is:
57 *
58 * lock_sock(listener);
59 * lock_sock_nested(pending, SINGLE_DEPTH_NESTING);
60 *
61 * Using explicit nested locking keeps lockdep happy since normally only one
62 * lock of a given class may be taken at a time.
63 *
64 * - Sockets created by user action will be cleaned up when the user process
65 * calls close(2), causing our release implementation to be called. Our release
66 * implementation will perform some cleanup then drop the last reference so our
67 * sk_destruct implementation is invoked. Our sk_destruct implementation will
68 * perform additional cleanup that's common for both types of sockets.
69 *
70 * - A socket's reference count is what ensures that the structure won't be
71 * freed. Each entry in a list (such as the "global" bound and connected tables
72 * and the listener socket's pending list and connected queue) ensures a
73 * reference. When we defer work until process context and pass a socket as our
74 * argument, we must ensure the reference count is increased to ensure the
75 * socket isn't freed before the function is run; the deferred function will
76 * then drop the reference.
77 *
78 * - sk->sk_state uses the TCP state constants because they are widely used by
79 * other address families and exposed to userspace tools like ss(8):
80 *
81 * TCP_CLOSE - unconnected
82 * TCP_SYN_SENT - connecting
83 * TCP_ESTABLISHED - connected
84 * TCP_CLOSING - disconnecting
85 * TCP_LISTEN - listening
86 */
87
88 #include <linux/types.h>
89 #include <linux/bitops.h>
90 #include <linux/cred.h>
91 #include <linux/init.h>
92 #include <linux/io.h>
93 #include <linux/kernel.h>
94 #include <linux/sched/signal.h>
95 #include <linux/kmod.h>
96 #include <linux/list.h>
97 #include <linux/miscdevice.h>
98 #include <linux/module.h>
99 #include <linux/mutex.h>
100 #include <linux/net.h>
101 #include <linux/poll.h>
102 #include <linux/random.h>
103 #include <linux/skbuff.h>
104 #include <linux/smp.h>
105 #include <linux/socket.h>
106 #include <linux/stddef.h>
107 #include <linux/unistd.h>
108 #include <linux/wait.h>
109 #include <linux/workqueue.h>
110 #include <net/sock.h>
111 #include <net/af_vsock.h>
112
113 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
114 static void vsock_sk_destruct(struct sock *sk);
115 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
116
117 /* Protocol family. */
118 static struct proto vsock_proto = {
119 .name = "AF_VSOCK",
120 .owner = THIS_MODULE,
121 .obj_size = sizeof(struct vsock_sock),
122 };
123
124 /* The default peer timeout indicates how long we will wait for a peer response
125 * to a control message.
126 */
127 #define VSOCK_DEFAULT_CONNECT_TIMEOUT (2 * HZ)
128
129 static const struct vsock_transport *transport;
130 static DEFINE_MUTEX(vsock_register_mutex);
131
132 /**** EXPORTS ****/
133
134 /* Get the ID of the local context. This is transport dependent. */
135
vm_sockets_get_local_cid(void)136 int vm_sockets_get_local_cid(void)
137 {
138 return transport->get_local_cid();
139 }
140 EXPORT_SYMBOL_GPL(vm_sockets_get_local_cid);
141
142 /**** UTILS ****/
143
144 /* Each bound VSocket is stored in the bind hash table and each connected
145 * VSocket is stored in the connected hash table.
146 *
147 * Unbound sockets are all put on the same list attached to the end of the hash
148 * table (vsock_unbound_sockets). Bound sockets are added to the hash table in
149 * the bucket that their local address hashes to (vsock_bound_sockets(addr)
150 * represents the list that addr hashes to).
151 *
152 * Specifically, we initialize the vsock_bind_table array to a size of
153 * VSOCK_HASH_SIZE + 1 so that vsock_bind_table[0] through
154 * vsock_bind_table[VSOCK_HASH_SIZE - 1] are for bound sockets and
155 * vsock_bind_table[VSOCK_HASH_SIZE] is for unbound sockets. The hash function
156 * mods with VSOCK_HASH_SIZE to ensure this.
157 */
158 #define MAX_PORT_RETRIES 24
159
160 #define VSOCK_HASH(addr) ((addr)->svm_port % VSOCK_HASH_SIZE)
161 #define vsock_bound_sockets(addr) (&vsock_bind_table[VSOCK_HASH(addr)])
162 #define vsock_unbound_sockets (&vsock_bind_table[VSOCK_HASH_SIZE])
163
164 /* XXX This can probably be implemented in a better way. */
165 #define VSOCK_CONN_HASH(src, dst) \
166 (((src)->svm_cid ^ (dst)->svm_port) % VSOCK_HASH_SIZE)
167 #define vsock_connected_sockets(src, dst) \
168 (&vsock_connected_table[VSOCK_CONN_HASH(src, dst)])
169 #define vsock_connected_sockets_vsk(vsk) \
170 vsock_connected_sockets(&(vsk)->remote_addr, &(vsk)->local_addr)
171
172 struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
173 EXPORT_SYMBOL_GPL(vsock_bind_table);
174 struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
175 EXPORT_SYMBOL_GPL(vsock_connected_table);
176 DEFINE_SPINLOCK(vsock_table_lock);
177 EXPORT_SYMBOL_GPL(vsock_table_lock);
178
179 /* Autobind this socket to the local address if necessary. */
vsock_auto_bind(struct vsock_sock * vsk)180 static int vsock_auto_bind(struct vsock_sock *vsk)
181 {
182 struct sock *sk = sk_vsock(vsk);
183 struct sockaddr_vm local_addr;
184
185 if (vsock_addr_bound(&vsk->local_addr))
186 return 0;
187 vsock_addr_init(&local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
188 return __vsock_bind(sk, &local_addr);
189 }
190
vsock_init_tables(void)191 static int __init vsock_init_tables(void)
192 {
193 int i;
194
195 for (i = 0; i < ARRAY_SIZE(vsock_bind_table); i++)
196 INIT_LIST_HEAD(&vsock_bind_table[i]);
197
198 for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++)
199 INIT_LIST_HEAD(&vsock_connected_table[i]);
200 return 0;
201 }
202
__vsock_insert_bound(struct list_head * list,struct vsock_sock * vsk)203 static void __vsock_insert_bound(struct list_head *list,
204 struct vsock_sock *vsk)
205 {
206 sock_hold(&vsk->sk);
207 list_add(&vsk->bound_table, list);
208 }
209
__vsock_insert_connected(struct list_head * list,struct vsock_sock * vsk)210 static void __vsock_insert_connected(struct list_head *list,
211 struct vsock_sock *vsk)
212 {
213 sock_hold(&vsk->sk);
214 list_add(&vsk->connected_table, list);
215 }
216
__vsock_remove_bound(struct vsock_sock * vsk)217 static void __vsock_remove_bound(struct vsock_sock *vsk)
218 {
219 list_del_init(&vsk->bound_table);
220 sock_put(&vsk->sk);
221 }
222
__vsock_remove_connected(struct vsock_sock * vsk)223 static void __vsock_remove_connected(struct vsock_sock *vsk)
224 {
225 list_del_init(&vsk->connected_table);
226 sock_put(&vsk->sk);
227 }
228
__vsock_find_bound_socket(struct sockaddr_vm * addr)229 static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr)
230 {
231 struct vsock_sock *vsk;
232
233 list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table)
234 if (addr->svm_port == vsk->local_addr.svm_port)
235 return sk_vsock(vsk);
236
237 return NULL;
238 }
239
__vsock_find_connected_socket(struct sockaddr_vm * src,struct sockaddr_vm * dst)240 static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
241 struct sockaddr_vm *dst)
242 {
243 struct vsock_sock *vsk;
244
245 list_for_each_entry(vsk, vsock_connected_sockets(src, dst),
246 connected_table) {
247 if (vsock_addr_equals_addr(src, &vsk->remote_addr) &&
248 dst->svm_port == vsk->local_addr.svm_port) {
249 return sk_vsock(vsk);
250 }
251 }
252
253 return NULL;
254 }
255
vsock_insert_unbound(struct vsock_sock * vsk)256 static void vsock_insert_unbound(struct vsock_sock *vsk)
257 {
258 spin_lock_bh(&vsock_table_lock);
259 __vsock_insert_bound(vsock_unbound_sockets, vsk);
260 spin_unlock_bh(&vsock_table_lock);
261 }
262
vsock_insert_connected(struct vsock_sock * vsk)263 void vsock_insert_connected(struct vsock_sock *vsk)
264 {
265 struct list_head *list = vsock_connected_sockets(
266 &vsk->remote_addr, &vsk->local_addr);
267
268 spin_lock_bh(&vsock_table_lock);
269 __vsock_insert_connected(list, vsk);
270 spin_unlock_bh(&vsock_table_lock);
271 }
272 EXPORT_SYMBOL_GPL(vsock_insert_connected);
273
vsock_remove_bound(struct vsock_sock * vsk)274 void vsock_remove_bound(struct vsock_sock *vsk)
275 {
276 spin_lock_bh(&vsock_table_lock);
277 if (__vsock_in_bound_table(vsk))
278 __vsock_remove_bound(vsk);
279 spin_unlock_bh(&vsock_table_lock);
280 }
281 EXPORT_SYMBOL_GPL(vsock_remove_bound);
282
vsock_remove_connected(struct vsock_sock * vsk)283 void vsock_remove_connected(struct vsock_sock *vsk)
284 {
285 spin_lock_bh(&vsock_table_lock);
286 if (__vsock_in_connected_table(vsk))
287 __vsock_remove_connected(vsk);
288 spin_unlock_bh(&vsock_table_lock);
289 }
290 EXPORT_SYMBOL_GPL(vsock_remove_connected);
291
vsock_find_bound_socket(struct sockaddr_vm * addr)292 struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)
293 {
294 struct sock *sk;
295
296 spin_lock_bh(&vsock_table_lock);
297 sk = __vsock_find_bound_socket(addr);
298 if (sk)
299 sock_hold(sk);
300
301 spin_unlock_bh(&vsock_table_lock);
302
303 return sk;
304 }
305 EXPORT_SYMBOL_GPL(vsock_find_bound_socket);
306
vsock_find_connected_socket(struct sockaddr_vm * src,struct sockaddr_vm * dst)307 struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
308 struct sockaddr_vm *dst)
309 {
310 struct sock *sk;
311
312 spin_lock_bh(&vsock_table_lock);
313 sk = __vsock_find_connected_socket(src, dst);
314 if (sk)
315 sock_hold(sk);
316
317 spin_unlock_bh(&vsock_table_lock);
318
319 return sk;
320 }
321 EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
322
vsock_remove_sock(struct vsock_sock * vsk)323 void vsock_remove_sock(struct vsock_sock *vsk)
324 {
325 vsock_remove_bound(vsk);
326 vsock_remove_connected(vsk);
327 }
328 EXPORT_SYMBOL_GPL(vsock_remove_sock);
329
vsock_for_each_connected_socket(void (* fn)(struct sock * sk))330 void vsock_for_each_connected_socket(void (*fn)(struct sock *sk))
331 {
332 int i;
333
334 spin_lock_bh(&vsock_table_lock);
335
336 for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) {
337 struct vsock_sock *vsk;
338 list_for_each_entry(vsk, &vsock_connected_table[i],
339 connected_table)
340 fn(sk_vsock(vsk));
341 }
342
343 spin_unlock_bh(&vsock_table_lock);
344 }
345 EXPORT_SYMBOL_GPL(vsock_for_each_connected_socket);
346
vsock_add_pending(struct sock * listener,struct sock * pending)347 void vsock_add_pending(struct sock *listener, struct sock *pending)
348 {
349 struct vsock_sock *vlistener;
350 struct vsock_sock *vpending;
351
352 vlistener = vsock_sk(listener);
353 vpending = vsock_sk(pending);
354
355 sock_hold(pending);
356 sock_hold(listener);
357 list_add_tail(&vpending->pending_links, &vlistener->pending_links);
358 }
359 EXPORT_SYMBOL_GPL(vsock_add_pending);
360
vsock_remove_pending(struct sock * listener,struct sock * pending)361 void vsock_remove_pending(struct sock *listener, struct sock *pending)
362 {
363 struct vsock_sock *vpending = vsock_sk(pending);
364
365 list_del_init(&vpending->pending_links);
366 sock_put(listener);
367 sock_put(pending);
368 }
369 EXPORT_SYMBOL_GPL(vsock_remove_pending);
370
vsock_enqueue_accept(struct sock * listener,struct sock * connected)371 void vsock_enqueue_accept(struct sock *listener, struct sock *connected)
372 {
373 struct vsock_sock *vlistener;
374 struct vsock_sock *vconnected;
375
376 vlistener = vsock_sk(listener);
377 vconnected = vsock_sk(connected);
378
379 sock_hold(connected);
380 sock_hold(listener);
381 list_add_tail(&vconnected->accept_queue, &vlistener->accept_queue);
382 }
383 EXPORT_SYMBOL_GPL(vsock_enqueue_accept);
384
vsock_dequeue_accept(struct sock * listener)385 static struct sock *vsock_dequeue_accept(struct sock *listener)
386 {
387 struct vsock_sock *vlistener;
388 struct vsock_sock *vconnected;
389
390 vlistener = vsock_sk(listener);
391
392 if (list_empty(&vlistener->accept_queue))
393 return NULL;
394
395 vconnected = list_entry(vlistener->accept_queue.next,
396 struct vsock_sock, accept_queue);
397
398 list_del_init(&vconnected->accept_queue);
399 sock_put(listener);
400 /* The caller will need a reference on the connected socket so we let
401 * it call sock_put().
402 */
403
404 return sk_vsock(vconnected);
405 }
406
vsock_is_accept_queue_empty(struct sock * sk)407 static bool vsock_is_accept_queue_empty(struct sock *sk)
408 {
409 struct vsock_sock *vsk = vsock_sk(sk);
410 return list_empty(&vsk->accept_queue);
411 }
412
vsock_is_pending(struct sock * sk)413 static bool vsock_is_pending(struct sock *sk)
414 {
415 struct vsock_sock *vsk = vsock_sk(sk);
416 return !list_empty(&vsk->pending_links);
417 }
418
vsock_send_shutdown(struct sock * sk,int mode)419 static int vsock_send_shutdown(struct sock *sk, int mode)
420 {
421 return transport->shutdown(vsock_sk(sk), mode);
422 }
423
vsock_pending_work(struct work_struct * work)424 static void vsock_pending_work(struct work_struct *work)
425 {
426 struct sock *sk;
427 struct sock *listener;
428 struct vsock_sock *vsk;
429 bool cleanup;
430
431 vsk = container_of(work, struct vsock_sock, pending_work.work);
432 sk = sk_vsock(vsk);
433 listener = vsk->listener;
434 cleanup = true;
435
436 lock_sock(listener);
437 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
438
439 if (vsock_is_pending(sk)) {
440 vsock_remove_pending(listener, sk);
441
442 listener->sk_ack_backlog--;
443 } else if (!vsk->rejected) {
444 /* We are not on the pending list and accept() did not reject
445 * us, so we must have been accepted by our user process. We
446 * just need to drop our references to the sockets and be on
447 * our way.
448 */
449 cleanup = false;
450 goto out;
451 }
452
453 /* We need to remove ourself from the global connected sockets list so
454 * incoming packets can't find this socket, and to reduce the reference
455 * count.
456 */
457 vsock_remove_connected(vsk);
458
459 sk->sk_state = TCP_CLOSE;
460
461 out:
462 release_sock(sk);
463 release_sock(listener);
464 if (cleanup)
465 sock_put(sk);
466
467 sock_put(sk);
468 sock_put(listener);
469 }
470
471 /**** SOCKET OPERATIONS ****/
472
__vsock_bind_stream(struct vsock_sock * vsk,struct sockaddr_vm * addr)473 static int __vsock_bind_stream(struct vsock_sock *vsk,
474 struct sockaddr_vm *addr)
475 {
476 static u32 port;
477 struct sockaddr_vm new_addr;
478
479 if (!port)
480 port = LAST_RESERVED_PORT + 1 +
481 prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
482
483 vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
484
485 if (addr->svm_port == VMADDR_PORT_ANY) {
486 bool found = false;
487 unsigned int i;
488
489 for (i = 0; i < MAX_PORT_RETRIES; i++) {
490 if (port <= LAST_RESERVED_PORT)
491 port = LAST_RESERVED_PORT + 1;
492
493 new_addr.svm_port = port++;
494
495 if (!__vsock_find_bound_socket(&new_addr)) {
496 found = true;
497 break;
498 }
499 }
500
501 if (!found)
502 return -EADDRNOTAVAIL;
503 } else {
504 /* If port is in reserved range, ensure caller
505 * has necessary privileges.
506 */
507 if (addr->svm_port <= LAST_RESERVED_PORT &&
508 !capable(CAP_NET_BIND_SERVICE)) {
509 return -EACCES;
510 }
511
512 if (__vsock_find_bound_socket(&new_addr))
513 return -EADDRINUSE;
514 }
515
516 vsock_addr_init(&vsk->local_addr, new_addr.svm_cid, new_addr.svm_port);
517
518 /* Remove stream sockets from the unbound list and add them to the hash
519 * table for easy lookup by its address. The unbound list is simply an
520 * extra entry at the end of the hash table, a trick used by AF_UNIX.
521 */
522 __vsock_remove_bound(vsk);
523 __vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk);
524
525 return 0;
526 }
527
__vsock_bind_dgram(struct vsock_sock * vsk,struct sockaddr_vm * addr)528 static int __vsock_bind_dgram(struct vsock_sock *vsk,
529 struct sockaddr_vm *addr)
530 {
531 return transport->dgram_bind(vsk, addr);
532 }
533
__vsock_bind(struct sock * sk,struct sockaddr_vm * addr)534 static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr)
535 {
536 struct vsock_sock *vsk = vsock_sk(sk);
537 u32 cid;
538 int retval;
539
540 /* First ensure this socket isn't already bound. */
541 if (vsock_addr_bound(&vsk->local_addr))
542 return -EINVAL;
543
544 /* Now bind to the provided address or select appropriate values if
545 * none are provided (VMADDR_CID_ANY and VMADDR_PORT_ANY). Note that
546 * like AF_INET prevents binding to a non-local IP address (in most
547 * cases), we only allow binding to the local CID.
548 */
549 cid = transport->get_local_cid();
550 if (addr->svm_cid != cid && addr->svm_cid != VMADDR_CID_ANY)
551 return -EADDRNOTAVAIL;
552
553 switch (sk->sk_socket->type) {
554 case SOCK_STREAM:
555 spin_lock_bh(&vsock_table_lock);
556 retval = __vsock_bind_stream(vsk, addr);
557 spin_unlock_bh(&vsock_table_lock);
558 break;
559
560 case SOCK_DGRAM:
561 retval = __vsock_bind_dgram(vsk, addr);
562 break;
563
564 default:
565 retval = -EINVAL;
566 break;
567 }
568
569 return retval;
570 }
571
572 static void vsock_connect_timeout(struct work_struct *work);
573
__vsock_create(struct net * net,struct socket * sock,struct sock * parent,gfp_t priority,unsigned short type,int kern)574 struct sock *__vsock_create(struct net *net,
575 struct socket *sock,
576 struct sock *parent,
577 gfp_t priority,
578 unsigned short type,
579 int kern)
580 {
581 struct sock *sk;
582 struct vsock_sock *psk;
583 struct vsock_sock *vsk;
584
585 sk = sk_alloc(net, AF_VSOCK, priority, &vsock_proto, kern);
586 if (!sk)
587 return NULL;
588
589 sock_init_data(sock, sk);
590
591 /* sk->sk_type is normally set in sock_init_data, but only if sock is
592 * non-NULL. We make sure that our sockets always have a type by
593 * setting it here if needed.
594 */
595 if (!sock)
596 sk->sk_type = type;
597
598 vsk = vsock_sk(sk);
599 vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
600 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
601
602 sk->sk_destruct = vsock_sk_destruct;
603 sk->sk_backlog_rcv = vsock_queue_rcv_skb;
604 sock_reset_flag(sk, SOCK_DONE);
605
606 INIT_LIST_HEAD(&vsk->bound_table);
607 INIT_LIST_HEAD(&vsk->connected_table);
608 vsk->listener = NULL;
609 INIT_LIST_HEAD(&vsk->pending_links);
610 INIT_LIST_HEAD(&vsk->accept_queue);
611 vsk->rejected = false;
612 vsk->sent_request = false;
613 vsk->ignore_connecting_rst = false;
614 vsk->peer_shutdown = 0;
615 INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout);
616 INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work);
617
618 psk = parent ? vsock_sk(parent) : NULL;
619 if (parent) {
620 vsk->trusted = psk->trusted;
621 vsk->owner = get_cred(psk->owner);
622 vsk->connect_timeout = psk->connect_timeout;
623 security_sk_clone(parent, sk);
624 } else {
625 vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
626 vsk->owner = get_current_cred();
627 vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
628 }
629
630 if (transport->init(vsk, psk) < 0) {
631 sk_free(sk);
632 return NULL;
633 }
634
635 if (sock)
636 vsock_insert_unbound(vsk);
637
638 return sk;
639 }
640 EXPORT_SYMBOL_GPL(__vsock_create);
641
__vsock_release(struct sock * sk,int level)642 static void __vsock_release(struct sock *sk, int level)
643 {
644 if (sk) {
645 struct sk_buff *skb;
646 struct sock *pending;
647 struct vsock_sock *vsk;
648
649 vsk = vsock_sk(sk);
650 pending = NULL; /* Compiler warning. */
651
652 /* The release call is supposed to use lock_sock_nested()
653 * rather than lock_sock(), if a sock lock should be acquired.
654 */
655 transport->release(vsk);
656
657 /* When "level" is SINGLE_DEPTH_NESTING, use the nested
658 * version to avoid the warning "possible recursive locking
659 * detected". When "level" is 0, lock_sock_nested(sk, level)
660 * is the same as lock_sock(sk).
661 */
662 lock_sock_nested(sk, level);
663 sock_orphan(sk);
664 sk->sk_shutdown = SHUTDOWN_MASK;
665
666 while ((skb = skb_dequeue(&sk->sk_receive_queue)))
667 kfree_skb(skb);
668
669 /* Clean up any sockets that never were accepted. */
670 while ((pending = vsock_dequeue_accept(sk)) != NULL) {
671 __vsock_release(pending, SINGLE_DEPTH_NESTING);
672 sock_put(pending);
673 }
674
675 release_sock(sk);
676 sock_put(sk);
677 }
678 }
679
vsock_sk_destruct(struct sock * sk)680 static void vsock_sk_destruct(struct sock *sk)
681 {
682 struct vsock_sock *vsk = vsock_sk(sk);
683
684 transport->destruct(vsk);
685
686 /* When clearing these addresses, there's no need to set the family and
687 * possibly register the address family with the kernel.
688 */
689 vsock_addr_init(&vsk->local_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
690 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY, VMADDR_PORT_ANY);
691
692 put_cred(vsk->owner);
693 }
694
vsock_queue_rcv_skb(struct sock * sk,struct sk_buff * skb)695 static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
696 {
697 int err;
698
699 err = sock_queue_rcv_skb(sk, skb);
700 if (err)
701 kfree_skb(skb);
702
703 return err;
704 }
705
vsock_stream_has_data(struct vsock_sock * vsk)706 s64 vsock_stream_has_data(struct vsock_sock *vsk)
707 {
708 return transport->stream_has_data(vsk);
709 }
710 EXPORT_SYMBOL_GPL(vsock_stream_has_data);
711
vsock_stream_has_space(struct vsock_sock * vsk)712 s64 vsock_stream_has_space(struct vsock_sock *vsk)
713 {
714 return transport->stream_has_space(vsk);
715 }
716 EXPORT_SYMBOL_GPL(vsock_stream_has_space);
717
vsock_release(struct socket * sock)718 static int vsock_release(struct socket *sock)
719 {
720 __vsock_release(sock->sk, 0);
721 sock->sk = NULL;
722 sock->state = SS_FREE;
723
724 return 0;
725 }
726
727 static int
vsock_bind(struct socket * sock,struct sockaddr * addr,int addr_len)728 vsock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
729 {
730 int err;
731 struct sock *sk;
732 struct sockaddr_vm *vm_addr;
733
734 sk = sock->sk;
735
736 if (vsock_addr_cast(addr, addr_len, &vm_addr) != 0)
737 return -EINVAL;
738
739 lock_sock(sk);
740 err = __vsock_bind(sk, vm_addr);
741 release_sock(sk);
742
743 return err;
744 }
745
vsock_getname(struct socket * sock,struct sockaddr * addr,int peer)746 static int vsock_getname(struct socket *sock,
747 struct sockaddr *addr, int peer)
748 {
749 int err;
750 struct sock *sk;
751 struct vsock_sock *vsk;
752 struct sockaddr_vm *vm_addr;
753
754 sk = sock->sk;
755 vsk = vsock_sk(sk);
756 err = 0;
757
758 lock_sock(sk);
759
760 if (peer) {
761 if (sock->state != SS_CONNECTED) {
762 err = -ENOTCONN;
763 goto out;
764 }
765 vm_addr = &vsk->remote_addr;
766 } else {
767 vm_addr = &vsk->local_addr;
768 }
769
770 if (!vm_addr) {
771 err = -EINVAL;
772 goto out;
773 }
774
775 /* sys_getsockname() and sys_getpeername() pass us a
776 * MAX_SOCK_ADDR-sized buffer and don't set addr_len. Unfortunately
777 * that macro is defined in socket.c instead of .h, so we hardcode its
778 * value here.
779 */
780 BUILD_BUG_ON(sizeof(*vm_addr) > 128);
781 memcpy(addr, vm_addr, sizeof(*vm_addr));
782 err = sizeof(*vm_addr);
783
784 out:
785 release_sock(sk);
786 return err;
787 }
788
vsock_shutdown(struct socket * sock,int mode)789 static int vsock_shutdown(struct socket *sock, int mode)
790 {
791 int err;
792 struct sock *sk;
793
794 /* User level uses SHUT_RD (0) and SHUT_WR (1), but the kernel uses
795 * RCV_SHUTDOWN (1) and SEND_SHUTDOWN (2), so we must increment mode
796 * here like the other address families do. Note also that the
797 * increment makes SHUT_RDWR (2) into RCV_SHUTDOWN | SEND_SHUTDOWN (3),
798 * which is what we want.
799 */
800 mode++;
801
802 if ((mode & ~SHUTDOWN_MASK) || !mode)
803 return -EINVAL;
804
805 /* If this is a STREAM socket and it is not connected then bail out
806 * immediately. If it is a DGRAM socket then we must first kick the
807 * socket so that it wakes up from any sleeping calls, for example
808 * recv(), and then afterwards return the error.
809 */
810
811 sk = sock->sk;
812
813 lock_sock(sk);
814 if (sock->state == SS_UNCONNECTED) {
815 err = -ENOTCONN;
816 if (sk->sk_type == SOCK_STREAM)
817 goto out;
818 } else {
819 sock->state = SS_DISCONNECTING;
820 err = 0;
821 }
822
823 /* Receive and send shutdowns are treated alike. */
824 mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
825 if (mode) {
826 sk->sk_shutdown |= mode;
827 sk->sk_state_change(sk);
828
829 if (sk->sk_type == SOCK_STREAM) {
830 sock_reset_flag(sk, SOCK_DONE);
831 vsock_send_shutdown(sk, mode);
832 }
833 }
834
835 out:
836 release_sock(sk);
837 return err;
838 }
839
vsock_poll(struct file * file,struct socket * sock,poll_table * wait)840 static __poll_t vsock_poll(struct file *file, struct socket *sock,
841 poll_table *wait)
842 {
843 struct sock *sk;
844 __poll_t mask;
845 struct vsock_sock *vsk;
846
847 sk = sock->sk;
848 vsk = vsock_sk(sk);
849
850 poll_wait(file, sk_sleep(sk), wait);
851 mask = 0;
852
853 if (sk->sk_err)
854 /* Signify that there has been an error on this socket. */
855 mask |= EPOLLERR;
856
857 /* INET sockets treat local write shutdown and peer write shutdown as a
858 * case of EPOLLHUP set.
859 */
860 if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
861 ((sk->sk_shutdown & SEND_SHUTDOWN) &&
862 (vsk->peer_shutdown & SEND_SHUTDOWN))) {
863 mask |= EPOLLHUP;
864 }
865
866 if (sk->sk_shutdown & RCV_SHUTDOWN ||
867 vsk->peer_shutdown & SEND_SHUTDOWN) {
868 mask |= EPOLLRDHUP;
869 }
870
871 if (sock->type == SOCK_DGRAM) {
872 /* For datagram sockets we can read if there is something in
873 * the queue and write as long as the socket isn't shutdown for
874 * sending.
875 */
876 if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
877 (sk->sk_shutdown & RCV_SHUTDOWN)) {
878 mask |= EPOLLIN | EPOLLRDNORM;
879 }
880
881 if (!(sk->sk_shutdown & SEND_SHUTDOWN))
882 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
883
884 } else if (sock->type == SOCK_STREAM) {
885 lock_sock(sk);
886
887 /* Listening sockets that have connections in their accept
888 * queue can be read.
889 */
890 if (sk->sk_state == TCP_LISTEN
891 && !vsock_is_accept_queue_empty(sk))
892 mask |= EPOLLIN | EPOLLRDNORM;
893
894 /* If there is something in the queue then we can read. */
895 if (transport->stream_is_active(vsk) &&
896 !(sk->sk_shutdown & RCV_SHUTDOWN)) {
897 bool data_ready_now = false;
898 int ret = transport->notify_poll_in(
899 vsk, 1, &data_ready_now);
900 if (ret < 0) {
901 mask |= EPOLLERR;
902 } else {
903 if (data_ready_now)
904 mask |= EPOLLIN | EPOLLRDNORM;
905
906 }
907 }
908
909 /* Sockets whose connections have been closed, reset, or
910 * terminated should also be considered read, and we check the
911 * shutdown flag for that.
912 */
913 if (sk->sk_shutdown & RCV_SHUTDOWN ||
914 vsk->peer_shutdown & SEND_SHUTDOWN) {
915 mask |= EPOLLIN | EPOLLRDNORM;
916 }
917
918 /* Connected sockets that can produce data can be written. */
919 if (sk->sk_state == TCP_ESTABLISHED) {
920 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
921 bool space_avail_now = false;
922 int ret = transport->notify_poll_out(
923 vsk, 1, &space_avail_now);
924 if (ret < 0) {
925 mask |= EPOLLERR;
926 } else {
927 if (space_avail_now)
928 /* Remove EPOLLWRBAND since INET
929 * sockets are not setting it.
930 */
931 mask |= EPOLLOUT | EPOLLWRNORM;
932
933 }
934 }
935 }
936
937 /* Simulate INET socket poll behaviors, which sets
938 * EPOLLOUT|EPOLLWRNORM when peer is closed and nothing to read,
939 * but local send is not shutdown.
940 */
941 if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) {
942 if (!(sk->sk_shutdown & SEND_SHUTDOWN))
943 mask |= EPOLLOUT | EPOLLWRNORM;
944
945 }
946
947 release_sock(sk);
948 }
949
950 return mask;
951 }
952
vsock_dgram_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)953 static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
954 size_t len)
955 {
956 int err;
957 struct sock *sk;
958 struct vsock_sock *vsk;
959 struct sockaddr_vm *remote_addr;
960
961 if (msg->msg_flags & MSG_OOB)
962 return -EOPNOTSUPP;
963
964 /* For now, MSG_DONTWAIT is always assumed... */
965 err = 0;
966 sk = sock->sk;
967 vsk = vsock_sk(sk);
968
969 lock_sock(sk);
970
971 err = vsock_auto_bind(vsk);
972 if (err)
973 goto out;
974
975
976 /* If the provided message contains an address, use that. Otherwise
977 * fall back on the socket's remote handle (if it has been connected).
978 */
979 if (msg->msg_name &&
980 vsock_addr_cast(msg->msg_name, msg->msg_namelen,
981 &remote_addr) == 0) {
982 /* Ensure this address is of the right type and is a valid
983 * destination.
984 */
985
986 if (remote_addr->svm_cid == VMADDR_CID_ANY)
987 remote_addr->svm_cid = transport->get_local_cid();
988
989 if (!vsock_addr_bound(remote_addr)) {
990 err = -EINVAL;
991 goto out;
992 }
993 } else if (sock->state == SS_CONNECTED) {
994 remote_addr = &vsk->remote_addr;
995
996 if (remote_addr->svm_cid == VMADDR_CID_ANY)
997 remote_addr->svm_cid = transport->get_local_cid();
998
999 /* XXX Should connect() or this function ensure remote_addr is
1000 * bound?
1001 */
1002 if (!vsock_addr_bound(&vsk->remote_addr)) {
1003 err = -EINVAL;
1004 goto out;
1005 }
1006 } else {
1007 err = -EINVAL;
1008 goto out;
1009 }
1010
1011 if (!transport->dgram_allow(remote_addr->svm_cid,
1012 remote_addr->svm_port)) {
1013 err = -EINVAL;
1014 goto out;
1015 }
1016
1017 err = transport->dgram_enqueue(vsk, remote_addr, msg, len);
1018
1019 out:
1020 release_sock(sk);
1021 return err;
1022 }
1023
vsock_dgram_connect(struct socket * sock,struct sockaddr * addr,int addr_len,int flags)1024 static int vsock_dgram_connect(struct socket *sock,
1025 struct sockaddr *addr, int addr_len, int flags)
1026 {
1027 int err;
1028 struct sock *sk;
1029 struct vsock_sock *vsk;
1030 struct sockaddr_vm *remote_addr;
1031
1032 sk = sock->sk;
1033 vsk = vsock_sk(sk);
1034
1035 err = vsock_addr_cast(addr, addr_len, &remote_addr);
1036 if (err == -EAFNOSUPPORT && remote_addr->svm_family == AF_UNSPEC) {
1037 lock_sock(sk);
1038 vsock_addr_init(&vsk->remote_addr, VMADDR_CID_ANY,
1039 VMADDR_PORT_ANY);
1040 sock->state = SS_UNCONNECTED;
1041 release_sock(sk);
1042 return 0;
1043 } else if (err != 0)
1044 return -EINVAL;
1045
1046 lock_sock(sk);
1047
1048 err = vsock_auto_bind(vsk);
1049 if (err)
1050 goto out;
1051
1052 if (!transport->dgram_allow(remote_addr->svm_cid,
1053 remote_addr->svm_port)) {
1054 err = -EINVAL;
1055 goto out;
1056 }
1057
1058 memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr));
1059 sock->state = SS_CONNECTED;
1060
1061 out:
1062 release_sock(sk);
1063 return err;
1064 }
1065
vsock_dgram_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)1066 static int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
1067 size_t len, int flags)
1068 {
1069 return transport->dgram_dequeue(vsock_sk(sock->sk), msg, len, flags);
1070 }
1071
1072 static const struct proto_ops vsock_dgram_ops = {
1073 .family = PF_VSOCK,
1074 .owner = THIS_MODULE,
1075 .release = vsock_release,
1076 .bind = vsock_bind,
1077 .connect = vsock_dgram_connect,
1078 .socketpair = sock_no_socketpair,
1079 .accept = sock_no_accept,
1080 .getname = vsock_getname,
1081 .poll = vsock_poll,
1082 .ioctl = sock_no_ioctl,
1083 .listen = sock_no_listen,
1084 .shutdown = vsock_shutdown,
1085 .setsockopt = sock_no_setsockopt,
1086 .getsockopt = sock_no_getsockopt,
1087 .sendmsg = vsock_dgram_sendmsg,
1088 .recvmsg = vsock_dgram_recvmsg,
1089 .mmap = sock_no_mmap,
1090 .sendpage = sock_no_sendpage,
1091 };
1092
vsock_transport_cancel_pkt(struct vsock_sock * vsk)1093 static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
1094 {
1095 if (!transport->cancel_pkt)
1096 return -EOPNOTSUPP;
1097
1098 return transport->cancel_pkt(vsk);
1099 }
1100
vsock_connect_timeout(struct work_struct * work)1101 static void vsock_connect_timeout(struct work_struct *work)
1102 {
1103 struct sock *sk;
1104 struct vsock_sock *vsk;
1105
1106 vsk = container_of(work, struct vsock_sock, connect_work.work);
1107 sk = sk_vsock(vsk);
1108
1109 lock_sock(sk);
1110 if (sk->sk_state == TCP_SYN_SENT &&
1111 (sk->sk_shutdown != SHUTDOWN_MASK)) {
1112 sk->sk_state = TCP_CLOSE;
1113 sk->sk_socket->state = SS_UNCONNECTED;
1114 sk->sk_err = ETIMEDOUT;
1115 sk->sk_error_report(sk);
1116 vsock_transport_cancel_pkt(vsk);
1117 }
1118 release_sock(sk);
1119
1120 sock_put(sk);
1121 }
1122
vsock_stream_connect(struct socket * sock,struct sockaddr * addr,int addr_len,int flags)1123 static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
1124 int addr_len, int flags)
1125 {
1126 int err;
1127 struct sock *sk;
1128 struct vsock_sock *vsk;
1129 struct sockaddr_vm *remote_addr;
1130 long timeout;
1131 DEFINE_WAIT(wait);
1132
1133 err = 0;
1134 sk = sock->sk;
1135 vsk = vsock_sk(sk);
1136
1137 lock_sock(sk);
1138
1139 /* XXX AF_UNSPEC should make us disconnect like AF_INET. */
1140 switch (sock->state) {
1141 case SS_CONNECTED:
1142 err = -EISCONN;
1143 goto out;
1144 case SS_DISCONNECTING:
1145 err = -EINVAL;
1146 goto out;
1147 case SS_CONNECTING:
1148 /* This continues on so we can move sock into the SS_CONNECTED
1149 * state once the connection has completed (at which point err
1150 * will be set to zero also). Otherwise, we will either wait
1151 * for the connection or return -EALREADY should this be a
1152 * non-blocking call.
1153 */
1154 err = -EALREADY;
1155 if (flags & O_NONBLOCK)
1156 goto out;
1157 break;
1158 default:
1159 if ((sk->sk_state == TCP_LISTEN) ||
1160 vsock_addr_cast(addr, addr_len, &remote_addr) != 0) {
1161 err = -EINVAL;
1162 goto out;
1163 }
1164
1165 /* The hypervisor and well-known contexts do not have socket
1166 * endpoints.
1167 */
1168 if (!transport->stream_allow(remote_addr->svm_cid,
1169 remote_addr->svm_port)) {
1170 err = -ENETUNREACH;
1171 goto out;
1172 }
1173
1174 /* Set the remote address that we are connecting to. */
1175 memcpy(&vsk->remote_addr, remote_addr,
1176 sizeof(vsk->remote_addr));
1177
1178 err = vsock_auto_bind(vsk);
1179 if (err)
1180 goto out;
1181
1182 sk->sk_state = TCP_SYN_SENT;
1183
1184 err = transport->connect(vsk);
1185 if (err < 0)
1186 goto out;
1187
1188 /* Mark sock as connecting and set the error code to in
1189 * progress in case this is a non-blocking connect.
1190 */
1191 sock->state = SS_CONNECTING;
1192 err = -EINPROGRESS;
1193 }
1194
1195 /* The receive path will handle all communication until we are able to
1196 * enter the connected state. Here we wait for the connection to be
1197 * completed or a notification of an error.
1198 */
1199 timeout = vsk->connect_timeout;
1200 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1201
1202 while (sk->sk_state != TCP_ESTABLISHED && sk->sk_err == 0) {
1203 if (flags & O_NONBLOCK) {
1204 /* If we're not going to block, we schedule a timeout
1205 * function to generate a timeout on the connection
1206 * attempt, in case the peer doesn't respond in a
1207 * timely manner. We hold on to the socket until the
1208 * timeout fires.
1209 */
1210 sock_hold(sk);
1211
1212 /* If the timeout function is already scheduled,
1213 * reschedule it, then ungrab the socket refcount to
1214 * keep it balanced.
1215 */
1216 if (mod_delayed_work(system_wq, &vsk->connect_work,
1217 timeout))
1218 sock_put(sk);
1219
1220 /* Skip ahead to preserve error code set above. */
1221 goto out_wait;
1222 }
1223
1224 release_sock(sk);
1225 timeout = schedule_timeout(timeout);
1226 lock_sock(sk);
1227
1228 if (signal_pending(current)) {
1229 err = sock_intr_errno(timeout);
1230 sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE;
1231 sock->state = SS_UNCONNECTED;
1232 vsock_transport_cancel_pkt(vsk);
1233 vsock_remove_connected(vsk);
1234 goto out_wait;
1235 } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) {
1236 err = -ETIMEDOUT;
1237 sk->sk_state = TCP_CLOSE;
1238 sock->state = SS_UNCONNECTED;
1239 vsock_transport_cancel_pkt(vsk);
1240 goto out_wait;
1241 }
1242
1243 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1244 }
1245
1246 if (sk->sk_err) {
1247 err = -sk->sk_err;
1248 sk->sk_state = TCP_CLOSE;
1249 sock->state = SS_UNCONNECTED;
1250 } else {
1251 err = 0;
1252 }
1253
1254 out_wait:
1255 finish_wait(sk_sleep(sk), &wait);
1256 out:
1257 release_sock(sk);
1258 return err;
1259 }
1260
vsock_accept(struct socket * sock,struct socket * newsock,int flags,bool kern)1261 static int vsock_accept(struct socket *sock, struct socket *newsock, int flags,
1262 bool kern)
1263 {
1264 struct sock *listener;
1265 int err;
1266 struct sock *connected;
1267 struct vsock_sock *vconnected;
1268 long timeout;
1269 DEFINE_WAIT(wait);
1270
1271 err = 0;
1272 listener = sock->sk;
1273
1274 lock_sock(listener);
1275
1276 if (sock->type != SOCK_STREAM) {
1277 err = -EOPNOTSUPP;
1278 goto out;
1279 }
1280
1281 if (listener->sk_state != TCP_LISTEN) {
1282 err = -EINVAL;
1283 goto out;
1284 }
1285
1286 /* Wait for children sockets to appear; these are the new sockets
1287 * created upon connection establishment.
1288 */
1289 timeout = sock_rcvtimeo(listener, flags & O_NONBLOCK);
1290 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
1291
1292 while ((connected = vsock_dequeue_accept(listener)) == NULL &&
1293 listener->sk_err == 0) {
1294 release_sock(listener);
1295 timeout = schedule_timeout(timeout);
1296 finish_wait(sk_sleep(listener), &wait);
1297 lock_sock(listener);
1298
1299 if (signal_pending(current)) {
1300 err = sock_intr_errno(timeout);
1301 goto out;
1302 } else if (timeout == 0) {
1303 err = -EAGAIN;
1304 goto out;
1305 }
1306
1307 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
1308 }
1309 finish_wait(sk_sleep(listener), &wait);
1310
1311 if (listener->sk_err)
1312 err = -listener->sk_err;
1313
1314 if (connected) {
1315 listener->sk_ack_backlog--;
1316
1317 lock_sock_nested(connected, SINGLE_DEPTH_NESTING);
1318 vconnected = vsock_sk(connected);
1319
1320 /* If the listener socket has received an error, then we should
1321 * reject this socket and return. Note that we simply mark the
1322 * socket rejected, drop our reference, and let the cleanup
1323 * function handle the cleanup; the fact that we found it in
1324 * the listener's accept queue guarantees that the cleanup
1325 * function hasn't run yet.
1326 */
1327 if (err) {
1328 vconnected->rejected = true;
1329 } else {
1330 newsock->state = SS_CONNECTED;
1331 sock_graft(connected, newsock);
1332 }
1333
1334 release_sock(connected);
1335 sock_put(connected);
1336 }
1337
1338 out:
1339 release_sock(listener);
1340 return err;
1341 }
1342
vsock_listen(struct socket * sock,int backlog)1343 static int vsock_listen(struct socket *sock, int backlog)
1344 {
1345 int err;
1346 struct sock *sk;
1347 struct vsock_sock *vsk;
1348
1349 sk = sock->sk;
1350
1351 lock_sock(sk);
1352
1353 if (sock->type != SOCK_STREAM) {
1354 err = -EOPNOTSUPP;
1355 goto out;
1356 }
1357
1358 if (sock->state != SS_UNCONNECTED) {
1359 err = -EINVAL;
1360 goto out;
1361 }
1362
1363 vsk = vsock_sk(sk);
1364
1365 if (!vsock_addr_bound(&vsk->local_addr)) {
1366 err = -EINVAL;
1367 goto out;
1368 }
1369
1370 sk->sk_max_ack_backlog = backlog;
1371 sk->sk_state = TCP_LISTEN;
1372
1373 err = 0;
1374
1375 out:
1376 release_sock(sk);
1377 return err;
1378 }
1379
vsock_stream_setsockopt(struct socket * sock,int level,int optname,char __user * optval,unsigned int optlen)1380 static int vsock_stream_setsockopt(struct socket *sock,
1381 int level,
1382 int optname,
1383 char __user *optval,
1384 unsigned int optlen)
1385 {
1386 int err;
1387 struct sock *sk;
1388 struct vsock_sock *vsk;
1389 u64 val;
1390
1391 if (level != AF_VSOCK)
1392 return -ENOPROTOOPT;
1393
1394 #define COPY_IN(_v) \
1395 do { \
1396 if (optlen < sizeof(_v)) { \
1397 err = -EINVAL; \
1398 goto exit; \
1399 } \
1400 if (copy_from_user(&_v, optval, sizeof(_v)) != 0) { \
1401 err = -EFAULT; \
1402 goto exit; \
1403 } \
1404 } while (0)
1405
1406 err = 0;
1407 sk = sock->sk;
1408 vsk = vsock_sk(sk);
1409
1410 lock_sock(sk);
1411
1412 switch (optname) {
1413 case SO_VM_SOCKETS_BUFFER_SIZE:
1414 COPY_IN(val);
1415 transport->set_buffer_size(vsk, val);
1416 break;
1417
1418 case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
1419 COPY_IN(val);
1420 transport->set_max_buffer_size(vsk, val);
1421 break;
1422
1423 case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
1424 COPY_IN(val);
1425 transport->set_min_buffer_size(vsk, val);
1426 break;
1427
1428 case SO_VM_SOCKETS_CONNECT_TIMEOUT: {
1429 struct __kernel_old_timeval tv;
1430 COPY_IN(tv);
1431 if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC &&
1432 tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) {
1433 vsk->connect_timeout = tv.tv_sec * HZ +
1434 DIV_ROUND_UP(tv.tv_usec, (1000000 / HZ));
1435 if (vsk->connect_timeout == 0)
1436 vsk->connect_timeout =
1437 VSOCK_DEFAULT_CONNECT_TIMEOUT;
1438
1439 } else {
1440 err = -ERANGE;
1441 }
1442 break;
1443 }
1444
1445 default:
1446 err = -ENOPROTOOPT;
1447 break;
1448 }
1449
1450 #undef COPY_IN
1451
1452 exit:
1453 release_sock(sk);
1454 return err;
1455 }
1456
vsock_stream_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)1457 static int vsock_stream_getsockopt(struct socket *sock,
1458 int level, int optname,
1459 char __user *optval,
1460 int __user *optlen)
1461 {
1462 int err;
1463 int len;
1464 struct sock *sk;
1465 struct vsock_sock *vsk;
1466 u64 val;
1467
1468 if (level != AF_VSOCK)
1469 return -ENOPROTOOPT;
1470
1471 err = get_user(len, optlen);
1472 if (err != 0)
1473 return err;
1474
1475 #define COPY_OUT(_v) \
1476 do { \
1477 if (len < sizeof(_v)) \
1478 return -EINVAL; \
1479 \
1480 len = sizeof(_v); \
1481 if (copy_to_user(optval, &_v, len) != 0) \
1482 return -EFAULT; \
1483 \
1484 } while (0)
1485
1486 err = 0;
1487 sk = sock->sk;
1488 vsk = vsock_sk(sk);
1489
1490 switch (optname) {
1491 case SO_VM_SOCKETS_BUFFER_SIZE:
1492 val = transport->get_buffer_size(vsk);
1493 COPY_OUT(val);
1494 break;
1495
1496 case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
1497 val = transport->get_max_buffer_size(vsk);
1498 COPY_OUT(val);
1499 break;
1500
1501 case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
1502 val = transport->get_min_buffer_size(vsk);
1503 COPY_OUT(val);
1504 break;
1505
1506 case SO_VM_SOCKETS_CONNECT_TIMEOUT: {
1507 struct __kernel_old_timeval tv;
1508 tv.tv_sec = vsk->connect_timeout / HZ;
1509 tv.tv_usec =
1510 (vsk->connect_timeout -
1511 tv.tv_sec * HZ) * (1000000 / HZ);
1512 COPY_OUT(tv);
1513 break;
1514 }
1515 default:
1516 return -ENOPROTOOPT;
1517 }
1518
1519 err = put_user(len, optlen);
1520 if (err != 0)
1521 return -EFAULT;
1522
1523 #undef COPY_OUT
1524
1525 return 0;
1526 }
1527
vsock_stream_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)1528 static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
1529 size_t len)
1530 {
1531 struct sock *sk;
1532 struct vsock_sock *vsk;
1533 ssize_t total_written;
1534 long timeout;
1535 int err;
1536 struct vsock_transport_send_notify_data send_data;
1537 DEFINE_WAIT_FUNC(wait, woken_wake_function);
1538
1539 sk = sock->sk;
1540 vsk = vsock_sk(sk);
1541 total_written = 0;
1542 err = 0;
1543
1544 if (msg->msg_flags & MSG_OOB)
1545 return -EOPNOTSUPP;
1546
1547 lock_sock(sk);
1548
1549 /* Callers should not provide a destination with stream sockets. */
1550 if (msg->msg_namelen) {
1551 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
1552 goto out;
1553 }
1554
1555 /* Send data only if both sides are not shutdown in the direction. */
1556 if (sk->sk_shutdown & SEND_SHUTDOWN ||
1557 vsk->peer_shutdown & RCV_SHUTDOWN) {
1558 err = -EPIPE;
1559 goto out;
1560 }
1561
1562 if (sk->sk_state != TCP_ESTABLISHED ||
1563 !vsock_addr_bound(&vsk->local_addr)) {
1564 err = -ENOTCONN;
1565 goto out;
1566 }
1567
1568 if (!vsock_addr_bound(&vsk->remote_addr)) {
1569 err = -EDESTADDRREQ;
1570 goto out;
1571 }
1572
1573 /* Wait for room in the produce queue to enqueue our user's data. */
1574 timeout = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1575
1576 err = transport->notify_send_init(vsk, &send_data);
1577 if (err < 0)
1578 goto out;
1579
1580 while (total_written < len) {
1581 ssize_t written;
1582
1583 add_wait_queue(sk_sleep(sk), &wait);
1584 while (vsock_stream_has_space(vsk) == 0 &&
1585 sk->sk_err == 0 &&
1586 !(sk->sk_shutdown & SEND_SHUTDOWN) &&
1587 !(vsk->peer_shutdown & RCV_SHUTDOWN)) {
1588
1589 /* Don't wait for non-blocking sockets. */
1590 if (timeout == 0) {
1591 err = -EAGAIN;
1592 remove_wait_queue(sk_sleep(sk), &wait);
1593 goto out_err;
1594 }
1595
1596 err = transport->notify_send_pre_block(vsk, &send_data);
1597 if (err < 0) {
1598 remove_wait_queue(sk_sleep(sk), &wait);
1599 goto out_err;
1600 }
1601
1602 release_sock(sk);
1603 timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
1604 lock_sock(sk);
1605 if (signal_pending(current)) {
1606 err = sock_intr_errno(timeout);
1607 remove_wait_queue(sk_sleep(sk), &wait);
1608 goto out_err;
1609 } else if (timeout == 0) {
1610 err = -EAGAIN;
1611 remove_wait_queue(sk_sleep(sk), &wait);
1612 goto out_err;
1613 }
1614 }
1615 remove_wait_queue(sk_sleep(sk), &wait);
1616
1617 /* These checks occur both as part of and after the loop
1618 * conditional since we need to check before and after
1619 * sleeping.
1620 */
1621 if (sk->sk_err) {
1622 err = -sk->sk_err;
1623 goto out_err;
1624 } else if ((sk->sk_shutdown & SEND_SHUTDOWN) ||
1625 (vsk->peer_shutdown & RCV_SHUTDOWN)) {
1626 err = -EPIPE;
1627 goto out_err;
1628 }
1629
1630 err = transport->notify_send_pre_enqueue(vsk, &send_data);
1631 if (err < 0)
1632 goto out_err;
1633
1634 /* Note that enqueue will only write as many bytes as are free
1635 * in the produce queue, so we don't need to ensure len is
1636 * smaller than the queue size. It is the caller's
1637 * responsibility to check how many bytes we were able to send.
1638 */
1639
1640 written = transport->stream_enqueue(
1641 vsk, msg,
1642 len - total_written);
1643 if (written < 0) {
1644 err = -ENOMEM;
1645 goto out_err;
1646 }
1647
1648 total_written += written;
1649
1650 err = transport->notify_send_post_enqueue(
1651 vsk, written, &send_data);
1652 if (err < 0)
1653 goto out_err;
1654
1655 }
1656
1657 out_err:
1658 if (total_written > 0)
1659 err = total_written;
1660 out:
1661 release_sock(sk);
1662 return err;
1663 }
1664
1665
1666 static int
vsock_stream_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)1667 vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
1668 int flags)
1669 {
1670 struct sock *sk;
1671 struct vsock_sock *vsk;
1672 int err;
1673 size_t target;
1674 ssize_t copied;
1675 long timeout;
1676 struct vsock_transport_recv_notify_data recv_data;
1677
1678 DEFINE_WAIT(wait);
1679
1680 sk = sock->sk;
1681 vsk = vsock_sk(sk);
1682 err = 0;
1683
1684 lock_sock(sk);
1685
1686 if (sk->sk_state != TCP_ESTABLISHED) {
1687 /* Recvmsg is supposed to return 0 if a peer performs an
1688 * orderly shutdown. Differentiate between that case and when a
1689 * peer has not connected or a local shutdown occured with the
1690 * SOCK_DONE flag.
1691 */
1692 if (sock_flag(sk, SOCK_DONE))
1693 err = 0;
1694 else
1695 err = -ENOTCONN;
1696
1697 goto out;
1698 }
1699
1700 if (flags & MSG_OOB) {
1701 err = -EOPNOTSUPP;
1702 goto out;
1703 }
1704
1705 /* We don't check peer_shutdown flag here since peer may actually shut
1706 * down, but there can be data in the queue that a local socket can
1707 * receive.
1708 */
1709 if (sk->sk_shutdown & RCV_SHUTDOWN) {
1710 err = 0;
1711 goto out;
1712 }
1713
1714 /* It is valid on Linux to pass in a zero-length receive buffer. This
1715 * is not an error. We may as well bail out now.
1716 */
1717 if (!len) {
1718 err = 0;
1719 goto out;
1720 }
1721
1722 /* We must not copy less than target bytes into the user's buffer
1723 * before returning successfully, so we wait for the consume queue to
1724 * have that much data to consume before dequeueing. Note that this
1725 * makes it impossible to handle cases where target is greater than the
1726 * queue size.
1727 */
1728 target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
1729 if (target >= transport->stream_rcvhiwat(vsk)) {
1730 err = -ENOMEM;
1731 goto out;
1732 }
1733 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
1734 copied = 0;
1735
1736 err = transport->notify_recv_init(vsk, target, &recv_data);
1737 if (err < 0)
1738 goto out;
1739
1740
1741 while (1) {
1742 s64 ready;
1743
1744 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1745 ready = vsock_stream_has_data(vsk);
1746
1747 if (ready == 0) {
1748 if (sk->sk_err != 0 ||
1749 (sk->sk_shutdown & RCV_SHUTDOWN) ||
1750 (vsk->peer_shutdown & SEND_SHUTDOWN)) {
1751 finish_wait(sk_sleep(sk), &wait);
1752 break;
1753 }
1754 /* Don't wait for non-blocking sockets. */
1755 if (timeout == 0) {
1756 err = -EAGAIN;
1757 finish_wait(sk_sleep(sk), &wait);
1758 break;
1759 }
1760
1761 err = transport->notify_recv_pre_block(
1762 vsk, target, &recv_data);
1763 if (err < 0) {
1764 finish_wait(sk_sleep(sk), &wait);
1765 break;
1766 }
1767 release_sock(sk);
1768 timeout = schedule_timeout(timeout);
1769 lock_sock(sk);
1770
1771 if (signal_pending(current)) {
1772 err = sock_intr_errno(timeout);
1773 finish_wait(sk_sleep(sk), &wait);
1774 break;
1775 } else if (timeout == 0) {
1776 err = -EAGAIN;
1777 finish_wait(sk_sleep(sk), &wait);
1778 break;
1779 }
1780 } else {
1781 ssize_t read;
1782
1783 finish_wait(sk_sleep(sk), &wait);
1784
1785 if (ready < 0) {
1786 /* Invalid queue pair content. XXX This should
1787 * be changed to a connection reset in a later
1788 * change.
1789 */
1790
1791 err = -ENOMEM;
1792 goto out;
1793 }
1794
1795 err = transport->notify_recv_pre_dequeue(
1796 vsk, target, &recv_data);
1797 if (err < 0)
1798 break;
1799
1800 read = transport->stream_dequeue(
1801 vsk, msg,
1802 len - copied, flags);
1803 if (read < 0) {
1804 err = -ENOMEM;
1805 break;
1806 }
1807
1808 copied += read;
1809
1810 err = transport->notify_recv_post_dequeue(
1811 vsk, target, read,
1812 !(flags & MSG_PEEK), &recv_data);
1813 if (err < 0)
1814 goto out;
1815
1816 if (read >= target || flags & MSG_PEEK)
1817 break;
1818
1819 target -= read;
1820 }
1821 }
1822
1823 if (sk->sk_err)
1824 err = -sk->sk_err;
1825 else if (sk->sk_shutdown & RCV_SHUTDOWN)
1826 err = 0;
1827
1828 if (copied > 0)
1829 err = copied;
1830
1831 out:
1832 release_sock(sk);
1833 return err;
1834 }
1835
1836 static const struct proto_ops vsock_stream_ops = {
1837 .family = PF_VSOCK,
1838 .owner = THIS_MODULE,
1839 .release = vsock_release,
1840 .bind = vsock_bind,
1841 .connect = vsock_stream_connect,
1842 .socketpair = sock_no_socketpair,
1843 .accept = vsock_accept,
1844 .getname = vsock_getname,
1845 .poll = vsock_poll,
1846 .ioctl = sock_no_ioctl,
1847 .listen = vsock_listen,
1848 .shutdown = vsock_shutdown,
1849 .setsockopt = vsock_stream_setsockopt,
1850 .getsockopt = vsock_stream_getsockopt,
1851 .sendmsg = vsock_stream_sendmsg,
1852 .recvmsg = vsock_stream_recvmsg,
1853 .mmap = sock_no_mmap,
1854 .sendpage = sock_no_sendpage,
1855 };
1856
vsock_create(struct net * net,struct socket * sock,int protocol,int kern)1857 static int vsock_create(struct net *net, struct socket *sock,
1858 int protocol, int kern)
1859 {
1860 if (!sock)
1861 return -EINVAL;
1862
1863 if (protocol && protocol != PF_VSOCK)
1864 return -EPROTONOSUPPORT;
1865
1866 switch (sock->type) {
1867 case SOCK_DGRAM:
1868 sock->ops = &vsock_dgram_ops;
1869 break;
1870 case SOCK_STREAM:
1871 sock->ops = &vsock_stream_ops;
1872 break;
1873 default:
1874 return -ESOCKTNOSUPPORT;
1875 }
1876
1877 sock->state = SS_UNCONNECTED;
1878
1879 return __vsock_create(net, sock, NULL, GFP_KERNEL, 0, kern) ? 0 : -ENOMEM;
1880 }
1881
1882 static const struct net_proto_family vsock_family_ops = {
1883 .family = AF_VSOCK,
1884 .create = vsock_create,
1885 .owner = THIS_MODULE,
1886 };
1887
vsock_dev_do_ioctl(struct file * filp,unsigned int cmd,void __user * ptr)1888 static long vsock_dev_do_ioctl(struct file *filp,
1889 unsigned int cmd, void __user *ptr)
1890 {
1891 u32 __user *p = ptr;
1892 int retval = 0;
1893
1894 switch (cmd) {
1895 case IOCTL_VM_SOCKETS_GET_LOCAL_CID:
1896 if (put_user(transport->get_local_cid(), p) != 0)
1897 retval = -EFAULT;
1898 break;
1899
1900 default:
1901 pr_err("Unknown ioctl %d\n", cmd);
1902 retval = -EINVAL;
1903 }
1904
1905 return retval;
1906 }
1907
vsock_dev_ioctl(struct file * filp,unsigned int cmd,unsigned long arg)1908 static long vsock_dev_ioctl(struct file *filp,
1909 unsigned int cmd, unsigned long arg)
1910 {
1911 return vsock_dev_do_ioctl(filp, cmd, (void __user *)arg);
1912 }
1913
1914 #ifdef CONFIG_COMPAT
vsock_dev_compat_ioctl(struct file * filp,unsigned int cmd,unsigned long arg)1915 static long vsock_dev_compat_ioctl(struct file *filp,
1916 unsigned int cmd, unsigned long arg)
1917 {
1918 return vsock_dev_do_ioctl(filp, cmd, compat_ptr(arg));
1919 }
1920 #endif
1921
1922 static const struct file_operations vsock_device_ops = {
1923 .owner = THIS_MODULE,
1924 .unlocked_ioctl = vsock_dev_ioctl,
1925 #ifdef CONFIG_COMPAT
1926 .compat_ioctl = vsock_dev_compat_ioctl,
1927 #endif
1928 .open = nonseekable_open,
1929 };
1930
1931 static struct miscdevice vsock_device = {
1932 .name = "vsock",
1933 .fops = &vsock_device_ops,
1934 };
1935
__vsock_core_init(const struct vsock_transport * t,struct module * owner)1936 int __vsock_core_init(const struct vsock_transport *t, struct module *owner)
1937 {
1938 int err = mutex_lock_interruptible(&vsock_register_mutex);
1939
1940 if (err)
1941 return err;
1942
1943 if (transport) {
1944 err = -EBUSY;
1945 goto err_busy;
1946 }
1947
1948 /* Transport must be the owner of the protocol so that it can't
1949 * unload while there are open sockets.
1950 */
1951 vsock_proto.owner = owner;
1952 transport = t;
1953
1954 vsock_device.minor = MISC_DYNAMIC_MINOR;
1955 err = misc_register(&vsock_device);
1956 if (err) {
1957 pr_err("Failed to register misc device\n");
1958 goto err_reset_transport;
1959 }
1960
1961 err = proto_register(&vsock_proto, 1); /* we want our slab */
1962 if (err) {
1963 pr_err("Cannot register vsock protocol\n");
1964 goto err_deregister_misc;
1965 }
1966
1967 err = sock_register(&vsock_family_ops);
1968 if (err) {
1969 pr_err("could not register af_vsock (%d) address family: %d\n",
1970 AF_VSOCK, err);
1971 goto err_unregister_proto;
1972 }
1973
1974 mutex_unlock(&vsock_register_mutex);
1975 return 0;
1976
1977 err_unregister_proto:
1978 proto_unregister(&vsock_proto);
1979 err_deregister_misc:
1980 misc_deregister(&vsock_device);
1981 err_reset_transport:
1982 transport = NULL;
1983 err_busy:
1984 mutex_unlock(&vsock_register_mutex);
1985 return err;
1986 }
1987 EXPORT_SYMBOL_GPL(__vsock_core_init);
1988
vsock_core_exit(void)1989 void vsock_core_exit(void)
1990 {
1991 mutex_lock(&vsock_register_mutex);
1992
1993 misc_deregister(&vsock_device);
1994 sock_unregister(AF_VSOCK);
1995 proto_unregister(&vsock_proto);
1996
1997 /* We do not want the assignment below re-ordered. */
1998 mb();
1999 transport = NULL;
2000
2001 mutex_unlock(&vsock_register_mutex);
2002 }
2003 EXPORT_SYMBOL_GPL(vsock_core_exit);
2004
vsock_core_get_transport(void)2005 const struct vsock_transport *vsock_core_get_transport(void)
2006 {
2007 /* vsock_register_mutex not taken since only the transport uses this
2008 * function and only while registered.
2009 */
2010 return transport;
2011 }
2012 EXPORT_SYMBOL_GPL(vsock_core_get_transport);
2013
vsock_exit(void)2014 static void __exit vsock_exit(void)
2015 {
2016 /* Do nothing. This function makes this module removable. */
2017 }
2018
2019 module_init(vsock_init_tables);
2020 module_exit(vsock_exit);
2021
2022 MODULE_AUTHOR("VMware, Inc.");
2023 MODULE_DESCRIPTION("VMware Virtual Socket Family");
2024 MODULE_VERSION("1.0.2.0-k");
2025 MODULE_LICENSE("GPL v2");
2026