• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2017 - 2018 Covalent IO, Inc. http://covalent.io */
3 
4 #include <linux/skmsg.h>
5 #include <linux/skbuff.h>
6 #include <linux/scatterlist.h>
7 
8 #include <net/sock.h>
9 #include <net/tcp.h>
10 #include <net/tls.h>
11 
sk_msg_try_coalesce_ok(struct sk_msg * msg,int elem_first_coalesce)12 static bool sk_msg_try_coalesce_ok(struct sk_msg *msg, int elem_first_coalesce)
13 {
14 	if (msg->sg.end > msg->sg.start &&
15 	    elem_first_coalesce < msg->sg.end)
16 		return true;
17 
18 	if (msg->sg.end < msg->sg.start &&
19 	    (elem_first_coalesce > msg->sg.start ||
20 	     elem_first_coalesce < msg->sg.end))
21 		return true;
22 
23 	return false;
24 }
25 
sk_msg_alloc(struct sock * sk,struct sk_msg * msg,int len,int elem_first_coalesce)26 int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
27 		 int elem_first_coalesce)
28 {
29 	struct page_frag *pfrag = sk_page_frag(sk);
30 	u32 osize = msg->sg.size;
31 	int ret = 0;
32 
33 	len -= msg->sg.size;
34 	while (len > 0) {
35 		struct scatterlist *sge;
36 		u32 orig_offset;
37 		int use, i;
38 
39 		if (!sk_page_frag_refill(sk, pfrag)) {
40 			ret = -ENOMEM;
41 			goto msg_trim;
42 		}
43 
44 		orig_offset = pfrag->offset;
45 		use = min_t(int, len, pfrag->size - orig_offset);
46 		if (!sk_wmem_schedule(sk, use)) {
47 			ret = -ENOMEM;
48 			goto msg_trim;
49 		}
50 
51 		i = msg->sg.end;
52 		sk_msg_iter_var_prev(i);
53 		sge = &msg->sg.data[i];
54 
55 		if (sk_msg_try_coalesce_ok(msg, elem_first_coalesce) &&
56 		    sg_page(sge) == pfrag->page &&
57 		    sge->offset + sge->length == orig_offset) {
58 			sge->length += use;
59 		} else {
60 			if (sk_msg_full(msg)) {
61 				ret = -ENOSPC;
62 				break;
63 			}
64 
65 			sge = &msg->sg.data[msg->sg.end];
66 			sg_unmark_end(sge);
67 			sg_set_page(sge, pfrag->page, use, orig_offset);
68 			get_page(pfrag->page);
69 			sk_msg_iter_next(msg, end);
70 		}
71 
72 		sk_mem_charge(sk, use);
73 		msg->sg.size += use;
74 		pfrag->offset += use;
75 		len -= use;
76 	}
77 
78 	return ret;
79 
80 msg_trim:
81 	sk_msg_trim(sk, msg, osize);
82 	return ret;
83 }
84 EXPORT_SYMBOL_GPL(sk_msg_alloc);
85 
sk_msg_clone(struct sock * sk,struct sk_msg * dst,struct sk_msg * src,u32 off,u32 len)86 int sk_msg_clone(struct sock *sk, struct sk_msg *dst, struct sk_msg *src,
87 		 u32 off, u32 len)
88 {
89 	int i = src->sg.start;
90 	struct scatterlist *sge = sk_msg_elem(src, i);
91 	struct scatterlist *sgd = NULL;
92 	u32 sge_len, sge_off;
93 
94 	while (off) {
95 		if (sge->length > off)
96 			break;
97 		off -= sge->length;
98 		sk_msg_iter_var_next(i);
99 		if (i == src->sg.end && off)
100 			return -ENOSPC;
101 		sge = sk_msg_elem(src, i);
102 	}
103 
104 	while (len) {
105 		sge_len = sge->length - off;
106 		if (sge_len > len)
107 			sge_len = len;
108 
109 		if (dst->sg.end)
110 			sgd = sk_msg_elem(dst, dst->sg.end - 1);
111 
112 		if (sgd &&
113 		    (sg_page(sge) == sg_page(sgd)) &&
114 		    (sg_virt(sge) + off == sg_virt(sgd) + sgd->length)) {
115 			sgd->length += sge_len;
116 			dst->sg.size += sge_len;
117 		} else if (!sk_msg_full(dst)) {
118 			sge_off = sge->offset + off;
119 			sk_msg_page_add(dst, sg_page(sge), sge_len, sge_off);
120 		} else {
121 			return -ENOSPC;
122 		}
123 
124 		off = 0;
125 		len -= sge_len;
126 		sk_mem_charge(sk, sge_len);
127 		sk_msg_iter_var_next(i);
128 		if (i == src->sg.end && len)
129 			return -ENOSPC;
130 		sge = sk_msg_elem(src, i);
131 	}
132 
133 	return 0;
134 }
135 EXPORT_SYMBOL_GPL(sk_msg_clone);
136 
sk_msg_return_zero(struct sock * sk,struct sk_msg * msg,int bytes)137 void sk_msg_return_zero(struct sock *sk, struct sk_msg *msg, int bytes)
138 {
139 	int i = msg->sg.start;
140 
141 	do {
142 		struct scatterlist *sge = sk_msg_elem(msg, i);
143 
144 		if (bytes < sge->length) {
145 			sge->length -= bytes;
146 			sge->offset += bytes;
147 			sk_mem_uncharge(sk, bytes);
148 			break;
149 		}
150 
151 		sk_mem_uncharge(sk, sge->length);
152 		bytes -= sge->length;
153 		sge->length = 0;
154 		sge->offset = 0;
155 		sk_msg_iter_var_next(i);
156 	} while (bytes && i != msg->sg.end);
157 	msg->sg.start = i;
158 }
159 EXPORT_SYMBOL_GPL(sk_msg_return_zero);
160 
sk_msg_return(struct sock * sk,struct sk_msg * msg,int bytes)161 void sk_msg_return(struct sock *sk, struct sk_msg *msg, int bytes)
162 {
163 	int i = msg->sg.start;
164 
165 	do {
166 		struct scatterlist *sge = &msg->sg.data[i];
167 		int uncharge = (bytes < sge->length) ? bytes : sge->length;
168 
169 		sk_mem_uncharge(sk, uncharge);
170 		bytes -= uncharge;
171 		sk_msg_iter_var_next(i);
172 	} while (i != msg->sg.end);
173 }
174 EXPORT_SYMBOL_GPL(sk_msg_return);
175 
sk_msg_free_elem(struct sock * sk,struct sk_msg * msg,u32 i,bool charge)176 static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
177 			    bool charge)
178 {
179 	struct scatterlist *sge = sk_msg_elem(msg, i);
180 	u32 len = sge->length;
181 
182 	/* When the skb owns the memory we free it from consume_skb path. */
183 	if (!msg->skb) {
184 		if (charge)
185 			sk_mem_uncharge(sk, len);
186 		put_page(sg_page(sge));
187 	}
188 	memset(sge, 0, sizeof(*sge));
189 	return len;
190 }
191 
__sk_msg_free(struct sock * sk,struct sk_msg * msg,u32 i,bool charge)192 static int __sk_msg_free(struct sock *sk, struct sk_msg *msg, u32 i,
193 			 bool charge)
194 {
195 	struct scatterlist *sge = sk_msg_elem(msg, i);
196 	int freed = 0;
197 
198 	while (msg->sg.size) {
199 		msg->sg.size -= sge->length;
200 		freed += sk_msg_free_elem(sk, msg, i, charge);
201 		sk_msg_iter_var_next(i);
202 		sk_msg_check_to_free(msg, i, msg->sg.size);
203 		sge = sk_msg_elem(msg, i);
204 	}
205 	consume_skb(msg->skb);
206 	sk_msg_init(msg);
207 	return freed;
208 }
209 
sk_msg_free_nocharge(struct sock * sk,struct sk_msg * msg)210 int sk_msg_free_nocharge(struct sock *sk, struct sk_msg *msg)
211 {
212 	return __sk_msg_free(sk, msg, msg->sg.start, false);
213 }
214 EXPORT_SYMBOL_GPL(sk_msg_free_nocharge);
215 
sk_msg_free(struct sock * sk,struct sk_msg * msg)216 int sk_msg_free(struct sock *sk, struct sk_msg *msg)
217 {
218 	return __sk_msg_free(sk, msg, msg->sg.start, true);
219 }
220 EXPORT_SYMBOL_GPL(sk_msg_free);
221 
__sk_msg_free_partial(struct sock * sk,struct sk_msg * msg,u32 bytes,bool charge)222 static void __sk_msg_free_partial(struct sock *sk, struct sk_msg *msg,
223 				  u32 bytes, bool charge)
224 {
225 	struct scatterlist *sge;
226 	u32 i = msg->sg.start;
227 
228 	while (bytes) {
229 		sge = sk_msg_elem(msg, i);
230 		if (!sge->length)
231 			break;
232 		if (bytes < sge->length) {
233 			if (charge)
234 				sk_mem_uncharge(sk, bytes);
235 			sge->length -= bytes;
236 			sge->offset += bytes;
237 			msg->sg.size -= bytes;
238 			break;
239 		}
240 
241 		msg->sg.size -= sge->length;
242 		bytes -= sge->length;
243 		sk_msg_free_elem(sk, msg, i, charge);
244 		sk_msg_iter_var_next(i);
245 		sk_msg_check_to_free(msg, i, bytes);
246 	}
247 	msg->sg.start = i;
248 }
249 
sk_msg_free_partial(struct sock * sk,struct sk_msg * msg,u32 bytes)250 void sk_msg_free_partial(struct sock *sk, struct sk_msg *msg, u32 bytes)
251 {
252 	__sk_msg_free_partial(sk, msg, bytes, true);
253 }
254 EXPORT_SYMBOL_GPL(sk_msg_free_partial);
255 
sk_msg_free_partial_nocharge(struct sock * sk,struct sk_msg * msg,u32 bytes)256 void sk_msg_free_partial_nocharge(struct sock *sk, struct sk_msg *msg,
257 				  u32 bytes)
258 {
259 	__sk_msg_free_partial(sk, msg, bytes, false);
260 }
261 
sk_msg_trim(struct sock * sk,struct sk_msg * msg,int len)262 void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
263 {
264 	int trim = msg->sg.size - len;
265 	u32 i = msg->sg.end;
266 
267 	if (trim <= 0) {
268 		WARN_ON(trim < 0);
269 		return;
270 	}
271 
272 	sk_msg_iter_var_prev(i);
273 	msg->sg.size = len;
274 	while (msg->sg.data[i].length &&
275 	       trim >= msg->sg.data[i].length) {
276 		trim -= msg->sg.data[i].length;
277 		sk_msg_free_elem(sk, msg, i, true);
278 		sk_msg_iter_var_prev(i);
279 		if (!trim)
280 			goto out;
281 	}
282 
283 	msg->sg.data[i].length -= trim;
284 	sk_mem_uncharge(sk, trim);
285 	/* Adjust copybreak if it falls into the trimmed part of last buf */
286 	if (msg->sg.curr == i && msg->sg.copybreak > msg->sg.data[i].length)
287 		msg->sg.copybreak = msg->sg.data[i].length;
288 out:
289 	sk_msg_iter_var_next(i);
290 	msg->sg.end = i;
291 
292 	/* If we trim data a full sg elem before curr pointer update
293 	 * copybreak and current so that any future copy operations
294 	 * start at new copy location.
295 	 * However trimed data that has not yet been used in a copy op
296 	 * does not require an update.
297 	 */
298 	if (!msg->sg.size) {
299 		msg->sg.curr = msg->sg.start;
300 		msg->sg.copybreak = 0;
301 	} else if (sk_msg_iter_dist(msg->sg.start, msg->sg.curr) >=
302 		   sk_msg_iter_dist(msg->sg.start, msg->sg.end)) {
303 		sk_msg_iter_var_prev(i);
304 		msg->sg.curr = i;
305 		msg->sg.copybreak = msg->sg.data[i].length;
306 	}
307 }
308 EXPORT_SYMBOL_GPL(sk_msg_trim);
309 
sk_msg_zerocopy_from_iter(struct sock * sk,struct iov_iter * from,struct sk_msg * msg,u32 bytes)310 int sk_msg_zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
311 			      struct sk_msg *msg, u32 bytes)
312 {
313 	int i, maxpages, ret = 0, num_elems = sk_msg_elem_used(msg);
314 	const int to_max_pages = MAX_MSG_FRAGS;
315 	struct page *pages[MAX_MSG_FRAGS];
316 	ssize_t orig, copied, use, offset;
317 
318 	orig = msg->sg.size;
319 	while (bytes > 0) {
320 		i = 0;
321 		maxpages = to_max_pages - num_elems;
322 		if (maxpages == 0) {
323 			ret = -EFAULT;
324 			goto out;
325 		}
326 
327 		copied = iov_iter_get_pages(from, pages, bytes, maxpages,
328 					    &offset);
329 		if (copied <= 0) {
330 			ret = -EFAULT;
331 			goto out;
332 		}
333 
334 		iov_iter_advance(from, copied);
335 		bytes -= copied;
336 		msg->sg.size += copied;
337 
338 		while (copied) {
339 			use = min_t(int, copied, PAGE_SIZE - offset);
340 			sg_set_page(&msg->sg.data[msg->sg.end],
341 				    pages[i], use, offset);
342 			sg_unmark_end(&msg->sg.data[msg->sg.end]);
343 			sk_mem_charge(sk, use);
344 
345 			offset = 0;
346 			copied -= use;
347 			sk_msg_iter_next(msg, end);
348 			num_elems++;
349 			i++;
350 		}
351 		/* When zerocopy is mixed with sk_msg_*copy* operations we
352 		 * may have a copybreak set in this case clear and prefer
353 		 * zerocopy remainder when possible.
354 		 */
355 		msg->sg.copybreak = 0;
356 		msg->sg.curr = msg->sg.end;
357 	}
358 out:
359 	/* Revert iov_iter updates, msg will need to use 'trim' later if it
360 	 * also needs to be cleared.
361 	 */
362 	if (ret)
363 		iov_iter_revert(from, msg->sg.size - orig);
364 	return ret;
365 }
366 EXPORT_SYMBOL_GPL(sk_msg_zerocopy_from_iter);
367 
sk_msg_memcopy_from_iter(struct sock * sk,struct iov_iter * from,struct sk_msg * msg,u32 bytes)368 int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from,
369 			     struct sk_msg *msg, u32 bytes)
370 {
371 	int ret = -ENOSPC, i = msg->sg.curr;
372 	struct scatterlist *sge;
373 	u32 copy, buf_size;
374 	void *to;
375 
376 	do {
377 		sge = sk_msg_elem(msg, i);
378 		/* This is possible if a trim operation shrunk the buffer */
379 		if (msg->sg.copybreak >= sge->length) {
380 			msg->sg.copybreak = 0;
381 			sk_msg_iter_var_next(i);
382 			if (i == msg->sg.end)
383 				break;
384 			sge = sk_msg_elem(msg, i);
385 		}
386 
387 		buf_size = sge->length - msg->sg.copybreak;
388 		copy = (buf_size > bytes) ? bytes : buf_size;
389 		to = sg_virt(sge) + msg->sg.copybreak;
390 		msg->sg.copybreak += copy;
391 		if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY)
392 			ret = copy_from_iter_nocache(to, copy, from);
393 		else
394 			ret = copy_from_iter(to, copy, from);
395 		if (ret != copy) {
396 			ret = -EFAULT;
397 			goto out;
398 		}
399 		bytes -= copy;
400 		if (!bytes)
401 			break;
402 		msg->sg.copybreak = 0;
403 		sk_msg_iter_var_next(i);
404 	} while (i != msg->sg.end);
405 out:
406 	msg->sg.curr = i;
407 	return ret;
408 }
409 EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
410 
sk_psock_create_ingress_msg(struct sock * sk,struct sk_buff * skb)411 static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
412 						  struct sk_buff *skb)
413 {
414 	struct sk_msg *msg;
415 
416 	if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
417 		return NULL;
418 
419 	if (!sk_rmem_schedule(sk, skb, skb->truesize))
420 		return NULL;
421 
422 	msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
423 	if (unlikely(!msg))
424 		return NULL;
425 
426 	sk_msg_init(msg);
427 	return msg;
428 }
429 
sk_psock_skb_ingress_enqueue(struct sk_buff * skb,struct sk_psock * psock,struct sock * sk,struct sk_msg * msg)430 static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
431 					struct sk_psock *psock,
432 					struct sock *sk,
433 					struct sk_msg *msg)
434 {
435 	int num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
436 	int copied;
437 
438 	if (unlikely(num_sge < 0)) {
439 		kfree(msg);
440 		return num_sge;
441 	}
442 
443 	copied = skb->len;
444 	msg->sg.start = 0;
445 	msg->sg.size = copied;
446 	msg->sg.end = num_sge;
447 	msg->skb = skb;
448 
449 	sk_psock_queue_msg(psock, msg);
450 	sk_psock_data_ready(sk, psock);
451 	return copied;
452 }
453 
sk_psock_skb_ingress(struct sk_psock * psock,struct sk_buff * skb)454 static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
455 {
456 	struct sock *sk = psock->sk;
457 	struct sk_msg *msg;
458 
459 	msg = sk_psock_create_ingress_msg(sk, skb);
460 	if (!msg)
461 		return -EAGAIN;
462 
463 	/* This will transition ownership of the data from the socket where
464 	 * the BPF program was run initiating the redirect to the socket
465 	 * we will eventually receive this data on. The data will be released
466 	 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
467 	 * into user buffers.
468 	 */
469 	skb_set_owner_r(skb, sk);
470 	return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
471 }
472 
473 /* Puts an skb on the ingress queue of the socket already assigned to the
474  * skb. In this case we do not need to check memory limits or skb_set_owner_r
475  * because the skb is already accounted for here.
476  */
sk_psock_skb_ingress_self(struct sk_psock * psock,struct sk_buff * skb)477 static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb)
478 {
479 	struct sk_msg *msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
480 	struct sock *sk = psock->sk;
481 
482 	if (unlikely(!msg))
483 		return -EAGAIN;
484 	sk_msg_init(msg);
485 	return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
486 }
487 
sk_psock_handle_skb(struct sk_psock * psock,struct sk_buff * skb,u32 off,u32 len,bool ingress)488 static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
489 			       u32 off, u32 len, bool ingress)
490 {
491 	if (ingress)
492 		return sk_psock_skb_ingress(psock, skb);
493 	else
494 		return skb_send_sock_locked(psock->sk, skb, off, len);
495 }
496 
sk_psock_backlog(struct work_struct * work)497 static void sk_psock_backlog(struct work_struct *work)
498 {
499 	struct sk_psock *psock = container_of(work, struct sk_psock, work);
500 	struct sk_psock_work_state *state = &psock->work_state;
501 	struct sk_buff *skb;
502 	bool ingress;
503 	u32 len, off;
504 	int ret;
505 
506 	/* Lock sock to avoid losing sk_socket during loop. */
507 	lock_sock(psock->sk);
508 	if (state->skb) {
509 		skb = state->skb;
510 		len = state->len;
511 		off = state->off;
512 		state->skb = NULL;
513 		goto start;
514 	}
515 
516 	while ((skb = skb_dequeue(&psock->ingress_skb))) {
517 		len = skb->len;
518 		off = 0;
519 start:
520 		ingress = tcp_skb_bpf_ingress(skb);
521 		do {
522 			ret = -EIO;
523 			if (likely(psock->sk->sk_socket))
524 				ret = sk_psock_handle_skb(psock, skb, off,
525 							  len, ingress);
526 			if (ret <= 0) {
527 				if (ret == -EAGAIN) {
528 					state->skb = skb;
529 					state->len = len;
530 					state->off = off;
531 					goto end;
532 				}
533 				/* Hard errors break pipe and stop xmit. */
534 				sk_psock_report_error(psock, ret ? -ret : EPIPE);
535 				sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
536 				kfree_skb(skb);
537 				goto end;
538 			}
539 			off += ret;
540 			len -= ret;
541 		} while (len);
542 
543 		if (!ingress)
544 			kfree_skb(skb);
545 	}
546 end:
547 	release_sock(psock->sk);
548 }
549 
sk_psock_init(struct sock * sk,int node)550 struct sk_psock *sk_psock_init(struct sock *sk, int node)
551 {
552 	struct sk_psock *psock = kzalloc_node(sizeof(*psock),
553 					      GFP_ATOMIC | __GFP_NOWARN,
554 					      node);
555 	if (!psock)
556 		return NULL;
557 
558 	psock->sk = sk;
559 	psock->eval =  __SK_NONE;
560 
561 	INIT_LIST_HEAD(&psock->link);
562 	spin_lock_init(&psock->link_lock);
563 
564 	INIT_WORK(&psock->work, sk_psock_backlog);
565 	INIT_LIST_HEAD(&psock->ingress_msg);
566 	skb_queue_head_init(&psock->ingress_skb);
567 
568 	sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
569 	refcount_set(&psock->refcnt, 1);
570 
571 	rcu_assign_sk_user_data(sk, psock);
572 	sock_hold(sk);
573 
574 	return psock;
575 }
576 EXPORT_SYMBOL_GPL(sk_psock_init);
577 
sk_psock_link_pop(struct sk_psock * psock)578 struct sk_psock_link *sk_psock_link_pop(struct sk_psock *psock)
579 {
580 	struct sk_psock_link *link;
581 
582 	spin_lock_bh(&psock->link_lock);
583 	link = list_first_entry_or_null(&psock->link, struct sk_psock_link,
584 					list);
585 	if (link)
586 		list_del(&link->list);
587 	spin_unlock_bh(&psock->link_lock);
588 	return link;
589 }
590 
__sk_psock_purge_ingress_msg(struct sk_psock * psock)591 void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
592 {
593 	struct sk_msg *msg, *tmp;
594 
595 	list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
596 		list_del(&msg->list);
597 		sk_msg_free(psock->sk, msg);
598 		kfree(msg);
599 	}
600 }
601 
sk_psock_zap_ingress(struct sk_psock * psock)602 static void sk_psock_zap_ingress(struct sk_psock *psock)
603 {
604 	__skb_queue_purge(&psock->ingress_skb);
605 	__sk_psock_purge_ingress_msg(psock);
606 }
607 
sk_psock_link_destroy(struct sk_psock * psock)608 static void sk_psock_link_destroy(struct sk_psock *psock)
609 {
610 	struct sk_psock_link *link, *tmp;
611 
612 	list_for_each_entry_safe(link, tmp, &psock->link, list) {
613 		list_del(&link->list);
614 		sk_psock_free_link(link);
615 	}
616 }
617 
sk_psock_destroy_deferred(struct work_struct * gc)618 static void sk_psock_destroy_deferred(struct work_struct *gc)
619 {
620 	struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
621 
622 	/* No sk_callback_lock since already detached. */
623 
624 	/* Parser has been stopped */
625 	if (psock->progs.skb_parser)
626 		strp_done(&psock->parser.strp);
627 
628 	cancel_work_sync(&psock->work);
629 
630 	psock_progs_drop(&psock->progs);
631 
632 	sk_psock_link_destroy(psock);
633 	sk_psock_cork_free(psock);
634 	sk_psock_zap_ingress(psock);
635 
636 	if (psock->sk_redir)
637 		sock_put(psock->sk_redir);
638 	sock_put(psock->sk);
639 	kfree(psock);
640 }
641 
sk_psock_destroy(struct rcu_head * rcu)642 void sk_psock_destroy(struct rcu_head *rcu)
643 {
644 	struct sk_psock *psock = container_of(rcu, struct sk_psock, rcu);
645 
646 	INIT_WORK(&psock->gc, sk_psock_destroy_deferred);
647 	schedule_work(&psock->gc);
648 }
649 EXPORT_SYMBOL_GPL(sk_psock_destroy);
650 
sk_psock_drop(struct sock * sk,struct sk_psock * psock)651 void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
652 {
653 	sk_psock_cork_free(psock);
654 	sk_psock_zap_ingress(psock);
655 
656 	write_lock_bh(&sk->sk_callback_lock);
657 	sk_psock_restore_proto(sk, psock);
658 	rcu_assign_sk_user_data(sk, NULL);
659 	if (psock->progs.skb_parser)
660 		sk_psock_stop_strp(sk, psock);
661 	write_unlock_bh(&sk->sk_callback_lock);
662 	sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
663 
664 	call_rcu(&psock->rcu, sk_psock_destroy);
665 }
666 EXPORT_SYMBOL_GPL(sk_psock_drop);
667 
sk_psock_map_verd(int verdict,bool redir)668 static int sk_psock_map_verd(int verdict, bool redir)
669 {
670 	switch (verdict) {
671 	case SK_PASS:
672 		return redir ? __SK_REDIRECT : __SK_PASS;
673 	case SK_DROP:
674 	default:
675 		break;
676 	}
677 
678 	return __SK_DROP;
679 }
680 
sk_psock_msg_verdict(struct sock * sk,struct sk_psock * psock,struct sk_msg * msg)681 int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
682 			 struct sk_msg *msg)
683 {
684 	struct bpf_prog *prog;
685 	int ret;
686 
687 	preempt_disable();
688 	rcu_read_lock();
689 	prog = READ_ONCE(psock->progs.msg_parser);
690 	if (unlikely(!prog)) {
691 		ret = __SK_PASS;
692 		goto out;
693 	}
694 
695 	sk_msg_compute_data_pointers(msg);
696 	msg->sk = sk;
697 	ret = BPF_PROG_RUN(prog, msg);
698 	ret = sk_psock_map_verd(ret, msg->sk_redir);
699 	psock->apply_bytes = msg->apply_bytes;
700 	if (ret == __SK_REDIRECT) {
701 		if (psock->sk_redir)
702 			sock_put(psock->sk_redir);
703 		psock->sk_redir = msg->sk_redir;
704 		if (!psock->sk_redir) {
705 			ret = __SK_DROP;
706 			goto out;
707 		}
708 		sock_hold(psock->sk_redir);
709 	}
710 out:
711 	rcu_read_unlock();
712 	preempt_enable();
713 	return ret;
714 }
715 EXPORT_SYMBOL_GPL(sk_psock_msg_verdict);
716 
sk_psock_bpf_run(struct sk_psock * psock,struct bpf_prog * prog,struct sk_buff * skb)717 static int sk_psock_bpf_run(struct sk_psock *psock, struct bpf_prog *prog,
718 			    struct sk_buff *skb)
719 {
720 	int ret;
721 
722 	skb->sk = psock->sk;
723 	bpf_compute_data_end_sk_skb(skb);
724 	preempt_disable();
725 	ret = BPF_PROG_RUN(prog, skb);
726 	preempt_enable();
727 	/* strparser clones the skb before handing it to a upper layer,
728 	 * meaning skb_orphan has been called. We NULL sk on the way out
729 	 * to ensure we don't trigger a BUG_ON() in skb/sk operations
730 	 * later and because we are not charging the memory of this skb
731 	 * to any socket yet.
732 	 */
733 	skb->sk = NULL;
734 	return ret;
735 }
736 
sk_psock_from_strp(struct strparser * strp)737 static struct sk_psock *sk_psock_from_strp(struct strparser *strp)
738 {
739 	struct sk_psock_parser *parser;
740 
741 	parser = container_of(strp, struct sk_psock_parser, strp);
742 	return container_of(parser, struct sk_psock, parser);
743 }
744 
sk_psock_skb_redirect(struct sk_buff * skb)745 static void sk_psock_skb_redirect(struct sk_buff *skb)
746 {
747 	struct sk_psock *psock_other;
748 	struct sock *sk_other;
749 	bool ingress;
750 
751 	sk_other = tcp_skb_bpf_redirect_fetch(skb);
752 	if (unlikely(!sk_other)) {
753 		kfree_skb(skb);
754 		return;
755 	}
756 	psock_other = sk_psock(sk_other);
757 	if (!psock_other || sock_flag(sk_other, SOCK_DEAD) ||
758 	    !sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED)) {
759 		kfree_skb(skb);
760 		return;
761 	}
762 
763 	ingress = tcp_skb_bpf_ingress(skb);
764 	if ((!ingress && sock_writeable(sk_other)) ||
765 	    (ingress &&
766 	     atomic_read(&sk_other->sk_rmem_alloc) <=
767 	     sk_other->sk_rcvbuf)) {
768 		if (!ingress)
769 			skb_set_owner_w(skb, sk_other);
770 		skb_queue_tail(&psock_other->ingress_skb, skb);
771 		schedule_work(&psock_other->work);
772 	} else {
773 		kfree_skb(skb);
774 	}
775 }
776 
sk_psock_tls_verdict_apply(struct sk_buff * skb,int verdict)777 static void sk_psock_tls_verdict_apply(struct sk_buff *skb, int verdict)
778 {
779 	switch (verdict) {
780 	case __SK_REDIRECT:
781 		sk_psock_skb_redirect(skb);
782 		break;
783 	case __SK_PASS:
784 	case __SK_DROP:
785 	default:
786 		break;
787 	}
788 }
789 
sk_psock_tls_strp_read(struct sk_psock * psock,struct sk_buff * skb)790 int sk_psock_tls_strp_read(struct sk_psock *psock, struct sk_buff *skb)
791 {
792 	struct bpf_prog *prog;
793 	int ret = __SK_PASS;
794 
795 	rcu_read_lock();
796 	prog = READ_ONCE(psock->progs.skb_verdict);
797 	if (likely(prog)) {
798 		tcp_skb_bpf_redirect_clear(skb);
799 		ret = sk_psock_bpf_run(psock, prog, skb);
800 		ret = sk_psock_map_verd(ret, tcp_skb_bpf_redirect_fetch(skb));
801 	}
802 	sk_psock_tls_verdict_apply(skb, ret);
803 	rcu_read_unlock();
804 	return ret;
805 }
806 EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
807 
sk_psock_verdict_apply(struct sk_psock * psock,struct sk_buff * skb,int verdict)808 static void sk_psock_verdict_apply(struct sk_psock *psock,
809 				   struct sk_buff *skb, int verdict)
810 {
811 	struct tcp_skb_cb *tcp;
812 	struct sock *sk_other;
813 	int err = -EIO;
814 
815 	switch (verdict) {
816 	case __SK_PASS:
817 		sk_other = psock->sk;
818 		if (sock_flag(sk_other, SOCK_DEAD) ||
819 		    !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
820 			goto out_free;
821 		}
822 
823 		tcp = TCP_SKB_CB(skb);
824 		tcp->bpf.flags |= BPF_F_INGRESS;
825 
826 		/* If the queue is empty then we can submit directly
827 		 * into the msg queue. If its not empty we have to
828 		 * queue work otherwise we may get OOO data. Otherwise,
829 		 * if sk_psock_skb_ingress errors will be handled by
830 		 * retrying later from workqueue.
831 		 */
832 		if (skb_queue_empty(&psock->ingress_skb)) {
833 			err = sk_psock_skb_ingress_self(psock, skb);
834 		}
835 		if (err < 0) {
836 			skb_queue_tail(&psock->ingress_skb, skb);
837 			schedule_work(&psock->work);
838 		}
839 		break;
840 	case __SK_REDIRECT:
841 		sk_psock_skb_redirect(skb);
842 		break;
843 	case __SK_DROP:
844 		/* fall-through */
845 	default:
846 out_free:
847 		kfree_skb(skb);
848 	}
849 }
850 
sk_psock_strp_read(struct strparser * strp,struct sk_buff * skb)851 static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb)
852 {
853 	struct sk_psock *psock;
854 	struct bpf_prog *prog;
855 	int ret = __SK_DROP;
856 	struct sock *sk;
857 
858 	rcu_read_lock();
859 	sk = strp->sk;
860 	psock = sk_psock(sk);
861 	if (unlikely(!psock)) {
862 		kfree_skb(skb);
863 		goto out;
864 	}
865 	prog = READ_ONCE(psock->progs.skb_verdict);
866 	if (likely(prog)) {
867 		skb_orphan(skb);
868 		tcp_skb_bpf_redirect_clear(skb);
869 		ret = sk_psock_bpf_run(psock, prog, skb);
870 		ret = sk_psock_map_verd(ret, tcp_skb_bpf_redirect_fetch(skb));
871 	}
872 	sk_psock_verdict_apply(psock, skb, ret);
873 out:
874 	rcu_read_unlock();
875 }
876 
sk_psock_strp_read_done(struct strparser * strp,int err)877 static int sk_psock_strp_read_done(struct strparser *strp, int err)
878 {
879 	return err;
880 }
881 
sk_psock_strp_parse(struct strparser * strp,struct sk_buff * skb)882 static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
883 {
884 	struct sk_psock *psock = sk_psock_from_strp(strp);
885 	struct bpf_prog *prog;
886 	int ret = skb->len;
887 
888 	rcu_read_lock();
889 	prog = READ_ONCE(psock->progs.skb_parser);
890 	if (likely(prog))
891 		ret = sk_psock_bpf_run(psock, prog, skb);
892 	rcu_read_unlock();
893 	return ret;
894 }
895 
896 /* Called with socket lock held. */
sk_psock_strp_data_ready(struct sock * sk)897 static void sk_psock_strp_data_ready(struct sock *sk)
898 {
899 	struct sk_psock *psock;
900 
901 	rcu_read_lock();
902 	psock = sk_psock(sk);
903 	if (likely(psock)) {
904 		if (tls_sw_has_ctx_rx(sk)) {
905 			psock->parser.saved_data_ready(sk);
906 		} else {
907 			write_lock_bh(&sk->sk_callback_lock);
908 			strp_data_ready(&psock->parser.strp);
909 			write_unlock_bh(&sk->sk_callback_lock);
910 		}
911 	}
912 	rcu_read_unlock();
913 }
914 
sk_psock_write_space(struct sock * sk)915 static void sk_psock_write_space(struct sock *sk)
916 {
917 	struct sk_psock *psock;
918 	void (*write_space)(struct sock *sk) = NULL;
919 
920 	rcu_read_lock();
921 	psock = sk_psock(sk);
922 	if (likely(psock)) {
923 		if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
924 			schedule_work(&psock->work);
925 		write_space = psock->saved_write_space;
926 	}
927 	rcu_read_unlock();
928 	if (write_space)
929 		write_space(sk);
930 }
931 
sk_psock_init_strp(struct sock * sk,struct sk_psock * psock)932 int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
933 {
934 	static const struct strp_callbacks cb = {
935 		.rcv_msg	= sk_psock_strp_read,
936 		.read_sock_done	= sk_psock_strp_read_done,
937 		.parse_msg	= sk_psock_strp_parse,
938 	};
939 
940 	psock->parser.enabled = false;
941 	return strp_init(&psock->parser.strp, sk, &cb);
942 }
943 
sk_psock_start_strp(struct sock * sk,struct sk_psock * psock)944 void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
945 {
946 	struct sk_psock_parser *parser = &psock->parser;
947 
948 	if (parser->enabled)
949 		return;
950 
951 	parser->saved_data_ready = sk->sk_data_ready;
952 	sk->sk_data_ready = sk_psock_strp_data_ready;
953 	sk->sk_write_space = sk_psock_write_space;
954 	parser->enabled = true;
955 }
956 
sk_psock_stop_strp(struct sock * sk,struct sk_psock * psock)957 void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
958 {
959 	struct sk_psock_parser *parser = &psock->parser;
960 
961 	if (!parser->enabled)
962 		return;
963 
964 	sk->sk_data_ready = parser->saved_data_ready;
965 	parser->saved_data_ready = NULL;
966 	strp_stop(&parser->strp);
967 	parser->enabled = false;
968 }
969