1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * af_alg: User-space algorithm interface
4 *
5 * This file provides the user-space API for algorithms.
6 *
7 * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
8 */
9
10 #include <linux/atomic.h>
11 #include <crypto/if_alg.h>
12 #include <linux/crypto.h>
13 #include <linux/init.h>
14 #include <linux/kernel.h>
15 #include <linux/list.h>
16 #include <linux/module.h>
17 #include <linux/net.h>
18 #include <linux/rwsem.h>
19 #include <linux/sched.h>
20 #include <linux/sched/signal.h>
21 #include <linux/security.h>
22
23 struct alg_type_list {
24 const struct af_alg_type *type;
25 struct list_head list;
26 };
27
28 static atomic_long_t alg_memory_allocated;
29
30 static struct proto alg_proto = {
31 .name = "ALG",
32 .owner = THIS_MODULE,
33 .memory_allocated = &alg_memory_allocated,
34 .obj_size = sizeof(struct alg_sock),
35 };
36
37 static LIST_HEAD(alg_types);
38 static DECLARE_RWSEM(alg_types_sem);
39
alg_get_type(const char * name)40 static const struct af_alg_type *alg_get_type(const char *name)
41 {
42 const struct af_alg_type *type = ERR_PTR(-ENOENT);
43 struct alg_type_list *node;
44
45 down_read(&alg_types_sem);
46 list_for_each_entry(node, &alg_types, list) {
47 if (strcmp(node->type->name, name))
48 continue;
49
50 if (try_module_get(node->type->owner))
51 type = node->type;
52 break;
53 }
54 up_read(&alg_types_sem);
55
56 return type;
57 }
58
af_alg_register_type(const struct af_alg_type * type)59 int af_alg_register_type(const struct af_alg_type *type)
60 {
61 struct alg_type_list *node;
62 int err = -EEXIST;
63
64 down_write(&alg_types_sem);
65 list_for_each_entry(node, &alg_types, list) {
66 if (!strcmp(node->type->name, type->name))
67 goto unlock;
68 }
69
70 node = kmalloc(sizeof(*node), GFP_KERNEL);
71 err = -ENOMEM;
72 if (!node)
73 goto unlock;
74
75 type->ops->owner = THIS_MODULE;
76 if (type->ops_nokey)
77 type->ops_nokey->owner = THIS_MODULE;
78 node->type = type;
79 list_add(&node->list, &alg_types);
80 err = 0;
81
82 unlock:
83 up_write(&alg_types_sem);
84
85 return err;
86 }
87 EXPORT_SYMBOL_GPL(af_alg_register_type);
88
af_alg_unregister_type(const struct af_alg_type * type)89 int af_alg_unregister_type(const struct af_alg_type *type)
90 {
91 struct alg_type_list *node;
92 int err = -ENOENT;
93
94 down_write(&alg_types_sem);
95 list_for_each_entry(node, &alg_types, list) {
96 if (strcmp(node->type->name, type->name))
97 continue;
98
99 list_del(&node->list);
100 kfree(node);
101 err = 0;
102 break;
103 }
104 up_write(&alg_types_sem);
105
106 return err;
107 }
108 EXPORT_SYMBOL_GPL(af_alg_unregister_type);
109
alg_do_release(const struct af_alg_type * type,void * private)110 static void alg_do_release(const struct af_alg_type *type, void *private)
111 {
112 if (!type)
113 return;
114
115 type->release(private);
116 module_put(type->owner);
117 }
118
af_alg_release(struct socket * sock)119 int af_alg_release(struct socket *sock)
120 {
121 if (sock->sk) {
122 sock_put(sock->sk);
123 sock->sk = NULL;
124 }
125 return 0;
126 }
127 EXPORT_SYMBOL_GPL(af_alg_release);
128
af_alg_release_parent(struct sock * sk)129 void af_alg_release_parent(struct sock *sk)
130 {
131 struct alg_sock *ask = alg_sk(sk);
132 unsigned int nokey = atomic_read(&ask->nokey_refcnt);
133
134 sk = ask->parent;
135 ask = alg_sk(sk);
136
137 if (nokey)
138 atomic_dec(&ask->nokey_refcnt);
139
140 if (atomic_dec_and_test(&ask->refcnt))
141 sock_put(sk);
142 }
143 EXPORT_SYMBOL_GPL(af_alg_release_parent);
144
alg_bind(struct socket * sock,struct sockaddr * uaddr,int addr_len)145 static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
146 {
147 const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
148 struct sock *sk = sock->sk;
149 struct alg_sock *ask = alg_sk(sk);
150 struct sockaddr_alg_new *sa = (void *)uaddr;
151 const struct af_alg_type *type;
152 void *private;
153 int err;
154
155 if (sock->state == SS_CONNECTED)
156 return -EINVAL;
157
158 BUILD_BUG_ON(offsetof(struct sockaddr_alg_new, salg_name) !=
159 offsetof(struct sockaddr_alg, salg_name));
160 BUILD_BUG_ON(offsetof(struct sockaddr_alg, salg_name) != sizeof(*sa));
161
162 if (addr_len < sizeof(*sa) + 1)
163 return -EINVAL;
164
165 /* If caller uses non-allowed flag, return error. */
166 if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed))
167 return -EINVAL;
168
169 sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
170 sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
171
172 type = alg_get_type(sa->salg_type);
173 if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
174 request_module("algif-%s", sa->salg_type);
175 type = alg_get_type(sa->salg_type);
176 }
177
178 if (IS_ERR(type))
179 return PTR_ERR(type);
180
181 private = type->bind(sa->salg_name, sa->salg_feat, sa->salg_mask);
182 if (IS_ERR(private)) {
183 module_put(type->owner);
184 return PTR_ERR(private);
185 }
186
187 err = -EBUSY;
188 lock_sock(sk);
189 if (atomic_read(&ask->refcnt))
190 goto unlock;
191
192 swap(ask->type, type);
193 swap(ask->private, private);
194
195 err = 0;
196
197 unlock:
198 release_sock(sk);
199
200 alg_do_release(type, private);
201
202 return err;
203 }
204
alg_setkey(struct sock * sk,char __user * ukey,unsigned int keylen)205 static int alg_setkey(struct sock *sk, char __user *ukey,
206 unsigned int keylen)
207 {
208 struct alg_sock *ask = alg_sk(sk);
209 const struct af_alg_type *type = ask->type;
210 u8 *key;
211 int err;
212
213 key = sock_kmalloc(sk, keylen, GFP_KERNEL);
214 if (!key)
215 return -ENOMEM;
216
217 err = -EFAULT;
218 if (copy_from_user(key, ukey, keylen))
219 goto out;
220
221 err = type->setkey(ask->private, key, keylen);
222
223 out:
224 sock_kzfree_s(sk, key, keylen);
225
226 return err;
227 }
228
alg_setsockopt(struct socket * sock,int level,int optname,char __user * optval,unsigned int optlen)229 static int alg_setsockopt(struct socket *sock, int level, int optname,
230 char __user *optval, unsigned int optlen)
231 {
232 struct sock *sk = sock->sk;
233 struct alg_sock *ask = alg_sk(sk);
234 const struct af_alg_type *type;
235 int err = -EBUSY;
236
237 lock_sock(sk);
238 if (atomic_read(&ask->refcnt) != atomic_read(&ask->nokey_refcnt))
239 goto unlock;
240
241 type = ask->type;
242
243 err = -ENOPROTOOPT;
244 if (level != SOL_ALG || !type)
245 goto unlock;
246
247 switch (optname) {
248 case ALG_SET_KEY:
249 if (sock->state == SS_CONNECTED)
250 goto unlock;
251 if (!type->setkey)
252 goto unlock;
253
254 err = alg_setkey(sk, optval, optlen);
255 break;
256 case ALG_SET_AEAD_AUTHSIZE:
257 if (sock->state == SS_CONNECTED)
258 goto unlock;
259 if (!type->setauthsize)
260 goto unlock;
261 err = type->setauthsize(ask->private, optlen);
262 }
263
264 unlock:
265 release_sock(sk);
266
267 return err;
268 }
269
af_alg_accept(struct sock * sk,struct socket * newsock,bool kern)270 int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern)
271 {
272 struct alg_sock *ask = alg_sk(sk);
273 const struct af_alg_type *type;
274 struct sock *sk2;
275 unsigned int nokey;
276 int err;
277
278 lock_sock(sk);
279 type = ask->type;
280
281 err = -EINVAL;
282 if (!type)
283 goto unlock;
284
285 sk2 = sk_alloc(sock_net(sk), PF_ALG, GFP_KERNEL, &alg_proto, kern);
286 err = -ENOMEM;
287 if (!sk2)
288 goto unlock;
289
290 sock_init_data(newsock, sk2);
291 security_sock_graft(sk2, newsock);
292 security_sk_clone(sk, sk2);
293
294 err = type->accept(ask->private, sk2);
295
296 nokey = err == -ENOKEY;
297 if (nokey && type->accept_nokey)
298 err = type->accept_nokey(ask->private, sk2);
299
300 if (err)
301 goto unlock;
302
303 if (atomic_inc_return_relaxed(&ask->refcnt) == 1)
304 sock_hold(sk);
305 if (nokey) {
306 atomic_inc(&ask->nokey_refcnt);
307 atomic_set(&alg_sk(sk2)->nokey_refcnt, 1);
308 }
309 alg_sk(sk2)->parent = sk;
310 alg_sk(sk2)->type = type;
311
312 newsock->ops = type->ops;
313 newsock->state = SS_CONNECTED;
314
315 if (nokey)
316 newsock->ops = type->ops_nokey;
317
318 err = 0;
319
320 unlock:
321 release_sock(sk);
322
323 return err;
324 }
325 EXPORT_SYMBOL_GPL(af_alg_accept);
326
alg_accept(struct socket * sock,struct socket * newsock,int flags,bool kern)327 static int alg_accept(struct socket *sock, struct socket *newsock, int flags,
328 bool kern)
329 {
330 return af_alg_accept(sock->sk, newsock, kern);
331 }
332
333 static const struct proto_ops alg_proto_ops = {
334 .family = PF_ALG,
335 .owner = THIS_MODULE,
336
337 .connect = sock_no_connect,
338 .socketpair = sock_no_socketpair,
339 .getname = sock_no_getname,
340 .ioctl = sock_no_ioctl,
341 .listen = sock_no_listen,
342 .shutdown = sock_no_shutdown,
343 .getsockopt = sock_no_getsockopt,
344 .mmap = sock_no_mmap,
345 .sendpage = sock_no_sendpage,
346 .sendmsg = sock_no_sendmsg,
347 .recvmsg = sock_no_recvmsg,
348
349 .bind = alg_bind,
350 .release = af_alg_release,
351 .setsockopt = alg_setsockopt,
352 .accept = alg_accept,
353 };
354
alg_sock_destruct(struct sock * sk)355 static void alg_sock_destruct(struct sock *sk)
356 {
357 struct alg_sock *ask = alg_sk(sk);
358
359 alg_do_release(ask->type, ask->private);
360 }
361
alg_create(struct net * net,struct socket * sock,int protocol,int kern)362 static int alg_create(struct net *net, struct socket *sock, int protocol,
363 int kern)
364 {
365 struct sock *sk;
366 int err;
367
368 if (sock->type != SOCK_SEQPACKET)
369 return -ESOCKTNOSUPPORT;
370 if (protocol != 0)
371 return -EPROTONOSUPPORT;
372
373 err = -ENOMEM;
374 sk = sk_alloc(net, PF_ALG, GFP_KERNEL, &alg_proto, kern);
375 if (!sk)
376 goto out;
377
378 sock->ops = &alg_proto_ops;
379 sock_init_data(sock, sk);
380
381 sk->sk_destruct = alg_sock_destruct;
382
383 return 0;
384 out:
385 return err;
386 }
387
388 static const struct net_proto_family alg_family = {
389 .family = PF_ALG,
390 .create = alg_create,
391 .owner = THIS_MODULE,
392 };
393
af_alg_make_sg(struct af_alg_sgl * sgl,struct iov_iter * iter,int len)394 int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len)
395 {
396 size_t off;
397 ssize_t n;
398 int npages, i;
399
400 n = iov_iter_get_pages(iter, sgl->pages, len, ALG_MAX_PAGES, &off);
401 if (n < 0)
402 return n;
403
404 npages = (off + n + PAGE_SIZE - 1) >> PAGE_SHIFT;
405 if (WARN_ON(npages == 0))
406 return -EINVAL;
407 /* Add one extra for linking */
408 sg_init_table(sgl->sg, npages + 1);
409
410 for (i = 0, len = n; i < npages; i++) {
411 int plen = min_t(int, len, PAGE_SIZE - off);
412
413 sg_set_page(sgl->sg + i, sgl->pages[i], plen, off);
414
415 off = 0;
416 len -= plen;
417 }
418 sg_mark_end(sgl->sg + npages - 1);
419 sgl->npages = npages;
420
421 return n;
422 }
423 EXPORT_SYMBOL_GPL(af_alg_make_sg);
424
af_alg_link_sg(struct af_alg_sgl * sgl_prev,struct af_alg_sgl * sgl_new)425 static void af_alg_link_sg(struct af_alg_sgl *sgl_prev,
426 struct af_alg_sgl *sgl_new)
427 {
428 sg_unmark_end(sgl_prev->sg + sgl_prev->npages - 1);
429 sg_chain(sgl_prev->sg, sgl_prev->npages + 1, sgl_new->sg);
430 }
431
af_alg_free_sg(struct af_alg_sgl * sgl)432 void af_alg_free_sg(struct af_alg_sgl *sgl)
433 {
434 int i;
435
436 for (i = 0; i < sgl->npages; i++)
437 put_page(sgl->pages[i]);
438 }
439 EXPORT_SYMBOL_GPL(af_alg_free_sg);
440
af_alg_cmsg_send(struct msghdr * msg,struct af_alg_control * con)441 static int af_alg_cmsg_send(struct msghdr *msg, struct af_alg_control *con)
442 {
443 struct cmsghdr *cmsg;
444
445 for_each_cmsghdr(cmsg, msg) {
446 if (!CMSG_OK(msg, cmsg))
447 return -EINVAL;
448 if (cmsg->cmsg_level != SOL_ALG)
449 continue;
450
451 switch (cmsg->cmsg_type) {
452 case ALG_SET_IV:
453 if (cmsg->cmsg_len < CMSG_LEN(sizeof(*con->iv)))
454 return -EINVAL;
455 con->iv = (void *)CMSG_DATA(cmsg);
456 if (cmsg->cmsg_len < CMSG_LEN(con->iv->ivlen +
457 sizeof(*con->iv)))
458 return -EINVAL;
459 break;
460
461 case ALG_SET_OP:
462 if (cmsg->cmsg_len < CMSG_LEN(sizeof(u32)))
463 return -EINVAL;
464 con->op = *(u32 *)CMSG_DATA(cmsg);
465 break;
466
467 case ALG_SET_AEAD_ASSOCLEN:
468 if (cmsg->cmsg_len < CMSG_LEN(sizeof(u32)))
469 return -EINVAL;
470 con->aead_assoclen = *(u32 *)CMSG_DATA(cmsg);
471 break;
472
473 default:
474 return -EINVAL;
475 }
476 }
477
478 return 0;
479 }
480
481 /**
482 * af_alg_alloc_tsgl - allocate the TX SGL
483 *
484 * @sk socket of connection to user space
485 * @return: 0 upon success, < 0 upon error
486 */
af_alg_alloc_tsgl(struct sock * sk)487 static int af_alg_alloc_tsgl(struct sock *sk)
488 {
489 struct alg_sock *ask = alg_sk(sk);
490 struct af_alg_ctx *ctx = ask->private;
491 struct af_alg_tsgl *sgl;
492 struct scatterlist *sg = NULL;
493
494 sgl = list_entry(ctx->tsgl_list.prev, struct af_alg_tsgl, list);
495 if (!list_empty(&ctx->tsgl_list))
496 sg = sgl->sg;
497
498 if (!sg || sgl->cur >= MAX_SGL_ENTS) {
499 sgl = sock_kmalloc(sk,
500 struct_size(sgl, sg, (MAX_SGL_ENTS + 1)),
501 GFP_KERNEL);
502 if (!sgl)
503 return -ENOMEM;
504
505 sg_init_table(sgl->sg, MAX_SGL_ENTS + 1);
506 sgl->cur = 0;
507
508 if (sg)
509 sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg);
510
511 list_add_tail(&sgl->list, &ctx->tsgl_list);
512 }
513
514 return 0;
515 }
516
517 /**
518 * aead_count_tsgl - Count number of TX SG entries
519 *
520 * The counting starts from the beginning of the SGL to @bytes. If
521 * an offset is provided, the counting of the SG entries starts at the offset.
522 *
523 * @sk socket of connection to user space
524 * @bytes Count the number of SG entries holding given number of bytes.
525 * @offset Start the counting of SG entries from the given offset.
526 * @return Number of TX SG entries found given the constraints
527 */
af_alg_count_tsgl(struct sock * sk,size_t bytes,size_t offset)528 unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset)
529 {
530 const struct alg_sock *ask = alg_sk(sk);
531 const struct af_alg_ctx *ctx = ask->private;
532 const struct af_alg_tsgl *sgl;
533 unsigned int i;
534 unsigned int sgl_count = 0;
535
536 if (!bytes)
537 return 0;
538
539 list_for_each_entry(sgl, &ctx->tsgl_list, list) {
540 const struct scatterlist *sg = sgl->sg;
541
542 for (i = 0; i < sgl->cur; i++) {
543 size_t bytes_count;
544
545 /* Skip offset */
546 if (offset >= sg[i].length) {
547 offset -= sg[i].length;
548 bytes -= sg[i].length;
549 continue;
550 }
551
552 bytes_count = sg[i].length - offset;
553
554 offset = 0;
555 sgl_count++;
556
557 /* If we have seen requested number of bytes, stop */
558 if (bytes_count >= bytes)
559 return sgl_count;
560
561 bytes -= bytes_count;
562 }
563 }
564
565 return sgl_count;
566 }
567 EXPORT_SYMBOL_GPL(af_alg_count_tsgl);
568
569 /**
570 * aead_pull_tsgl - Release the specified buffers from TX SGL
571 *
572 * If @dst is non-null, reassign the pages to dst. The caller must release
573 * the pages. If @dst_offset is given only reassign the pages to @dst starting
574 * at the @dst_offset (byte). The caller must ensure that @dst is large
575 * enough (e.g. by using af_alg_count_tsgl with the same offset).
576 *
577 * @sk socket of connection to user space
578 * @used Number of bytes to pull from TX SGL
579 * @dst If non-NULL, buffer is reassigned to dst SGL instead of releasing. The
580 * caller must release the buffers in dst.
581 * @dst_offset Reassign the TX SGL from given offset. All buffers before
582 * reaching the offset is released.
583 */
af_alg_pull_tsgl(struct sock * sk,size_t used,struct scatterlist * dst,size_t dst_offset)584 void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
585 size_t dst_offset)
586 {
587 struct alg_sock *ask = alg_sk(sk);
588 struct af_alg_ctx *ctx = ask->private;
589 struct af_alg_tsgl *sgl;
590 struct scatterlist *sg;
591 unsigned int i, j = 0;
592
593 while (!list_empty(&ctx->tsgl_list)) {
594 sgl = list_first_entry(&ctx->tsgl_list, struct af_alg_tsgl,
595 list);
596 sg = sgl->sg;
597
598 for (i = 0; i < sgl->cur; i++) {
599 size_t plen = min_t(size_t, used, sg[i].length);
600 struct page *page = sg_page(sg + i);
601
602 if (!page)
603 continue;
604
605 /*
606 * Assumption: caller created af_alg_count_tsgl(len)
607 * SG entries in dst.
608 */
609 if (dst) {
610 if (dst_offset >= plen) {
611 /* discard page before offset */
612 dst_offset -= plen;
613 } else {
614 /* reassign page to dst after offset */
615 get_page(page);
616 sg_set_page(dst + j, page,
617 plen - dst_offset,
618 sg[i].offset + dst_offset);
619 dst_offset = 0;
620 j++;
621 }
622 }
623
624 sg[i].length -= plen;
625 sg[i].offset += plen;
626
627 used -= plen;
628 ctx->used -= plen;
629
630 if (sg[i].length)
631 return;
632
633 put_page(page);
634 sg_assign_page(sg + i, NULL);
635 }
636
637 list_del(&sgl->list);
638 sock_kfree_s(sk, sgl, struct_size(sgl, sg, MAX_SGL_ENTS + 1));
639 }
640
641 if (!ctx->used)
642 ctx->merge = 0;
643 ctx->init = ctx->more;
644 }
645 EXPORT_SYMBOL_GPL(af_alg_pull_tsgl);
646
647 /**
648 * af_alg_free_areq_sgls - Release TX and RX SGLs of the request
649 *
650 * @areq Request holding the TX and RX SGL
651 */
af_alg_free_areq_sgls(struct af_alg_async_req * areq)652 static void af_alg_free_areq_sgls(struct af_alg_async_req *areq)
653 {
654 struct sock *sk = areq->sk;
655 struct alg_sock *ask = alg_sk(sk);
656 struct af_alg_ctx *ctx = ask->private;
657 struct af_alg_rsgl *rsgl, *tmp;
658 struct scatterlist *tsgl;
659 struct scatterlist *sg;
660 unsigned int i;
661
662 list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) {
663 atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused);
664 af_alg_free_sg(&rsgl->sgl);
665 list_del(&rsgl->list);
666 if (rsgl != &areq->first_rsgl)
667 sock_kfree_s(sk, rsgl, sizeof(*rsgl));
668 }
669
670 tsgl = areq->tsgl;
671 if (tsgl) {
672 for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
673 if (!sg_page(sg))
674 continue;
675 put_page(sg_page(sg));
676 }
677
678 sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl));
679 }
680 }
681
682 /**
683 * af_alg_wait_for_wmem - wait for availability of writable memory
684 *
685 * @sk socket of connection to user space
686 * @flags If MSG_DONTWAIT is set, then only report if function would sleep
687 * @return 0 when writable memory is available, < 0 upon error
688 */
af_alg_wait_for_wmem(struct sock * sk,unsigned int flags)689 static int af_alg_wait_for_wmem(struct sock *sk, unsigned int flags)
690 {
691 DEFINE_WAIT_FUNC(wait, woken_wake_function);
692 int err = -ERESTARTSYS;
693 long timeout;
694
695 if (flags & MSG_DONTWAIT)
696 return -EAGAIN;
697
698 sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
699
700 add_wait_queue(sk_sleep(sk), &wait);
701 for (;;) {
702 if (signal_pending(current))
703 break;
704 timeout = MAX_SCHEDULE_TIMEOUT;
705 if (sk_wait_event(sk, &timeout, af_alg_writable(sk), &wait)) {
706 err = 0;
707 break;
708 }
709 }
710 remove_wait_queue(sk_sleep(sk), &wait);
711
712 return err;
713 }
714
715 /**
716 * af_alg_wmem_wakeup - wakeup caller when writable memory is available
717 *
718 * @sk socket of connection to user space
719 */
af_alg_wmem_wakeup(struct sock * sk)720 void af_alg_wmem_wakeup(struct sock *sk)
721 {
722 struct socket_wq *wq;
723
724 if (!af_alg_writable(sk))
725 return;
726
727 rcu_read_lock();
728 wq = rcu_dereference(sk->sk_wq);
729 if (skwq_has_sleeper(wq))
730 wake_up_interruptible_sync_poll(&wq->wait, EPOLLIN |
731 EPOLLRDNORM |
732 EPOLLRDBAND);
733 sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
734 rcu_read_unlock();
735 }
736 EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup);
737
738 /**
739 * af_alg_wait_for_data - wait for availability of TX data
740 *
741 * @sk socket of connection to user space
742 * @flags If MSG_DONTWAIT is set, then only report if function would sleep
743 * @min Set to minimum request size if partial requests are allowed.
744 * @return 0 when writable memory is available, < 0 upon error
745 */
af_alg_wait_for_data(struct sock * sk,unsigned flags,unsigned min)746 int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min)
747 {
748 DEFINE_WAIT_FUNC(wait, woken_wake_function);
749 struct alg_sock *ask = alg_sk(sk);
750 struct af_alg_ctx *ctx = ask->private;
751 long timeout;
752 int err = -ERESTARTSYS;
753
754 if (flags & MSG_DONTWAIT)
755 return -EAGAIN;
756
757 sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
758
759 add_wait_queue(sk_sleep(sk), &wait);
760 for (;;) {
761 if (signal_pending(current))
762 break;
763 timeout = MAX_SCHEDULE_TIMEOUT;
764 if (sk_wait_event(sk, &timeout,
765 ctx->init && (!ctx->more ||
766 (min && ctx->used >= min)),
767 &wait)) {
768 err = 0;
769 break;
770 }
771 }
772 remove_wait_queue(sk_sleep(sk), &wait);
773
774 sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
775
776 return err;
777 }
778 EXPORT_SYMBOL_GPL(af_alg_wait_for_data);
779
780 /**
781 * af_alg_data_wakeup - wakeup caller when new data can be sent to kernel
782 *
783 * @sk socket of connection to user space
784 */
af_alg_data_wakeup(struct sock * sk)785 static void af_alg_data_wakeup(struct sock *sk)
786 {
787 struct alg_sock *ask = alg_sk(sk);
788 struct af_alg_ctx *ctx = ask->private;
789 struct socket_wq *wq;
790
791 if (!ctx->used)
792 return;
793
794 rcu_read_lock();
795 wq = rcu_dereference(sk->sk_wq);
796 if (skwq_has_sleeper(wq))
797 wake_up_interruptible_sync_poll(&wq->wait, EPOLLOUT |
798 EPOLLRDNORM |
799 EPOLLRDBAND);
800 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
801 rcu_read_unlock();
802 }
803
804 /**
805 * af_alg_sendmsg - implementation of sendmsg system call handler
806 *
807 * The sendmsg system call handler obtains the user data and stores it
808 * in ctx->tsgl_list. This implies allocation of the required numbers of
809 * struct af_alg_tsgl.
810 *
811 * In addition, the ctx is filled with the information sent via CMSG.
812 *
813 * @sock socket of connection to user space
814 * @msg message from user space
815 * @size size of message from user space
816 * @ivsize the size of the IV for the cipher operation to verify that the
817 * user-space-provided IV has the right size
818 * @return the number of copied data upon success, < 0 upon error
819 */
af_alg_sendmsg(struct socket * sock,struct msghdr * msg,size_t size,unsigned int ivsize)820 int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
821 unsigned int ivsize)
822 {
823 struct sock *sk = sock->sk;
824 struct alg_sock *ask = alg_sk(sk);
825 struct af_alg_ctx *ctx = ask->private;
826 struct af_alg_tsgl *sgl;
827 struct af_alg_control con = {};
828 long copied = 0;
829 bool enc = 0;
830 bool init = 0;
831 int err = 0;
832
833 if (msg->msg_controllen) {
834 err = af_alg_cmsg_send(msg, &con);
835 if (err)
836 return err;
837
838 init = 1;
839 switch (con.op) {
840 case ALG_OP_ENCRYPT:
841 enc = 1;
842 break;
843 case ALG_OP_DECRYPT:
844 enc = 0;
845 break;
846 default:
847 return -EINVAL;
848 }
849
850 if (con.iv && con.iv->ivlen != ivsize)
851 return -EINVAL;
852 }
853
854 lock_sock(sk);
855 if (ctx->init && !ctx->more) {
856 if (ctx->used) {
857 err = -EINVAL;
858 goto unlock;
859 }
860
861 pr_info_once(
862 "%s sent an empty control message without MSG_MORE.\n",
863 current->comm);
864 }
865 ctx->init = true;
866
867 if (init) {
868 ctx->enc = enc;
869 if (con.iv)
870 memcpy(ctx->iv, con.iv->iv, ivsize);
871
872 ctx->aead_assoclen = con.aead_assoclen;
873 }
874
875 while (size) {
876 struct scatterlist *sg;
877 size_t len = size;
878 size_t plen;
879
880 /* use the existing memory in an allocated page */
881 if (ctx->merge) {
882 sgl = list_entry(ctx->tsgl_list.prev,
883 struct af_alg_tsgl, list);
884 sg = sgl->sg + sgl->cur - 1;
885 len = min_t(size_t, len,
886 PAGE_SIZE - sg->offset - sg->length);
887
888 err = memcpy_from_msg(page_address(sg_page(sg)) +
889 sg->offset + sg->length,
890 msg, len);
891 if (err)
892 goto unlock;
893
894 sg->length += len;
895 ctx->merge = (sg->offset + sg->length) &
896 (PAGE_SIZE - 1);
897
898 ctx->used += len;
899 copied += len;
900 size -= len;
901 continue;
902 }
903
904 if (!af_alg_writable(sk)) {
905 err = af_alg_wait_for_wmem(sk, msg->msg_flags);
906 if (err)
907 goto unlock;
908 }
909
910 /* allocate a new page */
911 len = min_t(unsigned long, len, af_alg_sndbuf(sk));
912
913 err = af_alg_alloc_tsgl(sk);
914 if (err)
915 goto unlock;
916
917 sgl = list_entry(ctx->tsgl_list.prev, struct af_alg_tsgl,
918 list);
919 sg = sgl->sg;
920 if (sgl->cur)
921 sg_unmark_end(sg + sgl->cur - 1);
922
923 do {
924 unsigned int i = sgl->cur;
925
926 plen = min_t(size_t, len, PAGE_SIZE);
927
928 sg_assign_page(sg + i, alloc_page(GFP_KERNEL));
929 if (!sg_page(sg + i)) {
930 err = -ENOMEM;
931 goto unlock;
932 }
933
934 err = memcpy_from_msg(page_address(sg_page(sg + i)),
935 msg, plen);
936 if (err) {
937 __free_page(sg_page(sg + i));
938 sg_assign_page(sg + i, NULL);
939 goto unlock;
940 }
941
942 sg[i].length = plen;
943 len -= plen;
944 ctx->used += plen;
945 copied += plen;
946 size -= plen;
947 sgl->cur++;
948 } while (len && sgl->cur < MAX_SGL_ENTS);
949
950 if (!size)
951 sg_mark_end(sg + sgl->cur - 1);
952
953 ctx->merge = plen & (PAGE_SIZE - 1);
954 }
955
956 err = 0;
957
958 ctx->more = msg->msg_flags & MSG_MORE;
959
960 unlock:
961 af_alg_data_wakeup(sk);
962 release_sock(sk);
963
964 return copied ?: err;
965 }
966 EXPORT_SYMBOL_GPL(af_alg_sendmsg);
967
968 /**
969 * af_alg_sendpage - sendpage system call handler
970 *
971 * This is a generic implementation of sendpage to fill ctx->tsgl_list.
972 */
af_alg_sendpage(struct socket * sock,struct page * page,int offset,size_t size,int flags)973 ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
974 int offset, size_t size, int flags)
975 {
976 struct sock *sk = sock->sk;
977 struct alg_sock *ask = alg_sk(sk);
978 struct af_alg_ctx *ctx = ask->private;
979 struct af_alg_tsgl *sgl;
980 int err = -EINVAL;
981
982 if (flags & MSG_SENDPAGE_NOTLAST)
983 flags |= MSG_MORE;
984
985 lock_sock(sk);
986 if (!ctx->more && ctx->used)
987 goto unlock;
988
989 if (!size)
990 goto done;
991
992 if (!af_alg_writable(sk)) {
993 err = af_alg_wait_for_wmem(sk, flags);
994 if (err)
995 goto unlock;
996 }
997
998 err = af_alg_alloc_tsgl(sk);
999 if (err)
1000 goto unlock;
1001
1002 ctx->merge = 0;
1003 sgl = list_entry(ctx->tsgl_list.prev, struct af_alg_tsgl, list);
1004
1005 if (sgl->cur)
1006 sg_unmark_end(sgl->sg + sgl->cur - 1);
1007
1008 sg_mark_end(sgl->sg + sgl->cur);
1009
1010 get_page(page);
1011 sg_set_page(sgl->sg + sgl->cur, page, size, offset);
1012 sgl->cur++;
1013 ctx->used += size;
1014
1015 done:
1016 ctx->more = flags & MSG_MORE;
1017
1018 unlock:
1019 af_alg_data_wakeup(sk);
1020 release_sock(sk);
1021
1022 return err ?: size;
1023 }
1024 EXPORT_SYMBOL_GPL(af_alg_sendpage);
1025
1026 /**
1027 * af_alg_free_resources - release resources required for crypto request
1028 */
af_alg_free_resources(struct af_alg_async_req * areq)1029 void af_alg_free_resources(struct af_alg_async_req *areq)
1030 {
1031 struct sock *sk = areq->sk;
1032 struct af_alg_ctx *ctx;
1033
1034 af_alg_free_areq_sgls(areq);
1035 sock_kfree_s(sk, areq, areq->areqlen);
1036
1037 ctx = alg_sk(sk)->private;
1038 ctx->inflight = false;
1039 }
1040 EXPORT_SYMBOL_GPL(af_alg_free_resources);
1041
1042 /**
1043 * af_alg_async_cb - AIO callback handler
1044 *
1045 * This handler cleans up the struct af_alg_async_req upon completion of the
1046 * AIO operation.
1047 *
1048 * The number of bytes to be generated with the AIO operation must be set
1049 * in areq->outlen before the AIO callback handler is invoked.
1050 */
af_alg_async_cb(struct crypto_async_request * _req,int err)1051 void af_alg_async_cb(struct crypto_async_request *_req, int err)
1052 {
1053 struct af_alg_async_req *areq = _req->data;
1054 struct sock *sk = areq->sk;
1055 struct kiocb *iocb = areq->iocb;
1056 unsigned int resultlen;
1057
1058 /* Buffer size written by crypto operation. */
1059 resultlen = areq->outlen;
1060
1061 af_alg_free_resources(areq);
1062 sock_put(sk);
1063
1064 iocb->ki_complete(iocb, err ? err : (int)resultlen, 0);
1065 }
1066 EXPORT_SYMBOL_GPL(af_alg_async_cb);
1067
1068 /**
1069 * af_alg_poll - poll system call handler
1070 */
af_alg_poll(struct file * file,struct socket * sock,poll_table * wait)1071 __poll_t af_alg_poll(struct file *file, struct socket *sock,
1072 poll_table *wait)
1073 {
1074 struct sock *sk = sock->sk;
1075 struct alg_sock *ask = alg_sk(sk);
1076 struct af_alg_ctx *ctx = ask->private;
1077 __poll_t mask;
1078
1079 sock_poll_wait(file, sock, wait);
1080 mask = 0;
1081
1082 if (!ctx->more || ctx->used)
1083 mask |= EPOLLIN | EPOLLRDNORM;
1084
1085 if (af_alg_writable(sk))
1086 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
1087
1088 return mask;
1089 }
1090 EXPORT_SYMBOL_GPL(af_alg_poll);
1091
1092 /**
1093 * af_alg_alloc_areq - allocate struct af_alg_async_req
1094 *
1095 * @sk socket of connection to user space
1096 * @areqlen size of struct af_alg_async_req + crypto_*_reqsize
1097 * @return allocated data structure or ERR_PTR upon error
1098 */
af_alg_alloc_areq(struct sock * sk,unsigned int areqlen)1099 struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
1100 unsigned int areqlen)
1101 {
1102 struct af_alg_ctx *ctx = alg_sk(sk)->private;
1103 struct af_alg_async_req *areq;
1104
1105 /* Only one AIO request can be in flight. */
1106 if (ctx->inflight)
1107 return ERR_PTR(-EBUSY);
1108
1109 areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
1110 if (unlikely(!areq))
1111 return ERR_PTR(-ENOMEM);
1112
1113 ctx->inflight = true;
1114
1115 areq->areqlen = areqlen;
1116 areq->sk = sk;
1117 areq->last_rsgl = NULL;
1118 INIT_LIST_HEAD(&areq->rsgl_list);
1119 areq->tsgl = NULL;
1120 areq->tsgl_entries = 0;
1121
1122 return areq;
1123 }
1124 EXPORT_SYMBOL_GPL(af_alg_alloc_areq);
1125
1126 /**
1127 * af_alg_get_rsgl - create the RX SGL for the output data from the crypto
1128 * operation
1129 *
1130 * @sk socket of connection to user space
1131 * @msg user space message
1132 * @flags flags used to invoke recvmsg with
1133 * @areq instance of the cryptographic request that will hold the RX SGL
1134 * @maxsize maximum number of bytes to be pulled from user space
1135 * @outlen number of bytes in the RX SGL
1136 * @return 0 on success, < 0 upon error
1137 */
af_alg_get_rsgl(struct sock * sk,struct msghdr * msg,int flags,struct af_alg_async_req * areq,size_t maxsize,size_t * outlen)1138 int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
1139 struct af_alg_async_req *areq, size_t maxsize,
1140 size_t *outlen)
1141 {
1142 struct alg_sock *ask = alg_sk(sk);
1143 struct af_alg_ctx *ctx = ask->private;
1144 size_t len = 0;
1145
1146 while (maxsize > len && msg_data_left(msg)) {
1147 struct af_alg_rsgl *rsgl;
1148 size_t seglen;
1149 int err;
1150
1151 /* limit the amount of readable buffers */
1152 if (!af_alg_readable(sk))
1153 break;
1154
1155 seglen = min_t(size_t, (maxsize - len),
1156 msg_data_left(msg));
1157
1158 if (list_empty(&areq->rsgl_list)) {
1159 rsgl = &areq->first_rsgl;
1160 } else {
1161 rsgl = sock_kmalloc(sk, sizeof(*rsgl), GFP_KERNEL);
1162 if (unlikely(!rsgl))
1163 return -ENOMEM;
1164 }
1165
1166 rsgl->sgl.npages = 0;
1167 list_add_tail(&rsgl->list, &areq->rsgl_list);
1168
1169 /* make one iovec available as scatterlist */
1170 err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen);
1171 if (err < 0) {
1172 rsgl->sg_num_bytes = 0;
1173 return err;
1174 }
1175
1176 /* chain the new scatterlist with previous one */
1177 if (areq->last_rsgl)
1178 af_alg_link_sg(&areq->last_rsgl->sgl, &rsgl->sgl);
1179
1180 areq->last_rsgl = rsgl;
1181 len += err;
1182 atomic_add(err, &ctx->rcvused);
1183 rsgl->sg_num_bytes = err;
1184 iov_iter_advance(&msg->msg_iter, err);
1185 }
1186
1187 *outlen = len;
1188 return 0;
1189 }
1190 EXPORT_SYMBOL_GPL(af_alg_get_rsgl);
1191
af_alg_init(void)1192 static int __init af_alg_init(void)
1193 {
1194 int err = proto_register(&alg_proto, 0);
1195
1196 if (err)
1197 goto out;
1198
1199 err = sock_register(&alg_family);
1200 if (err != 0)
1201 goto out_unregister_proto;
1202
1203 out:
1204 return err;
1205
1206 out_unregister_proto:
1207 proto_unregister(&alg_proto);
1208 goto out;
1209 }
1210
af_alg_exit(void)1211 static void __exit af_alg_exit(void)
1212 {
1213 sock_unregister(PF_ALG);
1214 proto_unregister(&alg_proto);
1215 }
1216
1217 module_init(af_alg_init);
1218 module_exit(af_alg_exit);
1219 MODULE_LICENSE("GPL");
1220 MODULE_ALIAS_NETPROTO(AF_ALG);
1221