dccp: CVE-2017-8824: use-after-free in DCCP code
[pandora-kernel.git] / net / dccp / proto.c
1 /*
2  *  net/dccp/proto.c
3  *
4  *  An implementation of the DCCP protocol
5  *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
6  *
7  *      This program is free software; you can redistribute it and/or modify it
8  *      under the terms of the GNU General Public License version 2 as
9  *      published by the Free Software Foundation.
10  */
11
12 #include <linux/dccp.h>
13 #include <linux/module.h>
14 #include <linux/types.h>
15 #include <linux/sched.h>
16 #include <linux/kernel.h>
17 #include <linux/skbuff.h>
18 #include <linux/netdevice.h>
19 #include <linux/in.h>
20 #include <linux/if_arp.h>
21 #include <linux/init.h>
22 #include <linux/random.h>
23 #include <linux/slab.h>
24 #include <net/checksum.h>
25
26 #include <net/inet_sock.h>
27 #include <net/sock.h>
28 #include <net/xfrm.h>
29
30 #include <asm/ioctls.h>
31 #include <linux/spinlock.h>
32 #include <linux/timer.h>
33 #include <linux/delay.h>
34 #include <linux/poll.h>
35
36 #include "ccid.h"
37 #include "dccp.h"
38 #include "feat.h"
39
40 DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
41
42 EXPORT_SYMBOL_GPL(dccp_statistics);
43
44 struct percpu_counter dccp_orphan_count;
45 EXPORT_SYMBOL_GPL(dccp_orphan_count);
46
47 struct inet_hashinfo dccp_hashinfo;
48 EXPORT_SYMBOL_GPL(dccp_hashinfo);
49
50 /* the maximum queue length for tx in packets. 0 is no limit */
51 int sysctl_dccp_tx_qlen __read_mostly = 5;
52
53 #ifdef CONFIG_IP_DCCP_DEBUG
54 static const char *dccp_state_name(const int state)
55 {
56         static const char *const dccp_state_names[] = {
57         [DCCP_OPEN]             = "OPEN",
58         [DCCP_REQUESTING]       = "REQUESTING",
59         [DCCP_PARTOPEN]         = "PARTOPEN",
60         [DCCP_LISTEN]           = "LISTEN",
61         [DCCP_RESPOND]          = "RESPOND",
62         [DCCP_CLOSING]          = "CLOSING",
63         [DCCP_ACTIVE_CLOSEREQ]  = "CLOSEREQ",
64         [DCCP_PASSIVE_CLOSE]    = "PASSIVE_CLOSE",
65         [DCCP_PASSIVE_CLOSEREQ] = "PASSIVE_CLOSEREQ",
66         [DCCP_TIME_WAIT]        = "TIME_WAIT",
67         [DCCP_CLOSED]           = "CLOSED",
68         };
69
70         if (state >= DCCP_MAX_STATES)
71                 return "INVALID STATE!";
72         else
73                 return dccp_state_names[state];
74 }
75 #endif
76
77 void dccp_set_state(struct sock *sk, const int state)
78 {
79         const int oldstate = sk->sk_state;
80
81         dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
82                       dccp_state_name(oldstate), dccp_state_name(state));
83         WARN_ON(state == oldstate);
84
85         switch (state) {
86         case DCCP_OPEN:
87                 if (oldstate != DCCP_OPEN)
88                         DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
89                 /* Client retransmits all Confirm options until entering OPEN */
90                 if (oldstate == DCCP_PARTOPEN)
91                         dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
92                 break;
93
94         case DCCP_CLOSED:
95                 if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
96                     oldstate == DCCP_CLOSING)
97                         DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
98
99                 sk->sk_prot->unhash(sk);
100                 if (inet_csk(sk)->icsk_bind_hash != NULL &&
101                     !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
102                         inet_put_port(sk);
103                 /* fall through */
104         default:
105                 if (oldstate == DCCP_OPEN)
106                         DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
107         }
108
109         /* Change state AFTER socket is unhashed to avoid closed
110          * socket sitting in hash tables.
111          */
112         sk->sk_state = state;
113 }
114
115 EXPORT_SYMBOL_GPL(dccp_set_state);
116
117 static void dccp_finish_passive_close(struct sock *sk)
118 {
119         switch (sk->sk_state) {
120         case DCCP_PASSIVE_CLOSE:
121                 /* Node (client or server) has received Close packet. */
122                 dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
123                 dccp_set_state(sk, DCCP_CLOSED);
124                 break;
125         case DCCP_PASSIVE_CLOSEREQ:
126                 /*
127                  * Client received CloseReq. We set the `active' flag so that
128                  * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
129                  */
130                 dccp_send_close(sk, 1);
131                 dccp_set_state(sk, DCCP_CLOSING);
132         }
133 }
134
135 void dccp_done(struct sock *sk)
136 {
137         dccp_set_state(sk, DCCP_CLOSED);
138         dccp_clear_xmit_timers(sk);
139
140         sk->sk_shutdown = SHUTDOWN_MASK;
141
142         if (!sock_flag(sk, SOCK_DEAD))
143                 sk->sk_state_change(sk);
144         else
145                 inet_csk_destroy_sock(sk);
146 }
147
148 EXPORT_SYMBOL_GPL(dccp_done);
149
150 const char *dccp_packet_name(const int type)
151 {
152         static const char *const dccp_packet_names[] = {
153                 [DCCP_PKT_REQUEST]  = "REQUEST",
154                 [DCCP_PKT_RESPONSE] = "RESPONSE",
155                 [DCCP_PKT_DATA]     = "DATA",
156                 [DCCP_PKT_ACK]      = "ACK",
157                 [DCCP_PKT_DATAACK]  = "DATAACK",
158                 [DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
159                 [DCCP_PKT_CLOSE]    = "CLOSE",
160                 [DCCP_PKT_RESET]    = "RESET",
161                 [DCCP_PKT_SYNC]     = "SYNC",
162                 [DCCP_PKT_SYNCACK]  = "SYNCACK",
163         };
164
165         if (type >= DCCP_NR_PKT_TYPES)
166                 return "INVALID";
167         else
168                 return dccp_packet_names[type];
169 }
170
171 EXPORT_SYMBOL_GPL(dccp_packet_name);
172
173 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
174 {
175         struct dccp_sock *dp = dccp_sk(sk);
176         struct inet_connection_sock *icsk = inet_csk(sk);
177
178         icsk->icsk_rto          = DCCP_TIMEOUT_INIT;
179         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
180         sk->sk_state            = DCCP_CLOSED;
181         sk->sk_write_space      = dccp_write_space;
182         icsk->icsk_sync_mss     = dccp_sync_mss;
183         dp->dccps_mss_cache     = 536;
184         dp->dccps_rate_last     = jiffies;
185         dp->dccps_role          = DCCP_ROLE_UNDEFINED;
186         dp->dccps_service       = DCCP_SERVICE_CODE_IS_ABSENT;
187         dp->dccps_tx_qlen       = sysctl_dccp_tx_qlen;
188
189         dccp_init_xmit_timers(sk);
190
191         INIT_LIST_HEAD(&dp->dccps_featneg);
192         /* control socket doesn't need feat nego */
193         if (likely(ctl_sock_initialized))
194                 return dccp_feat_init(sk);
195         return 0;
196 }
197
198 EXPORT_SYMBOL_GPL(dccp_init_sock);
199
200 void dccp_destroy_sock(struct sock *sk)
201 {
202         struct dccp_sock *dp = dccp_sk(sk);
203
204         /*
205          * DCCP doesn't use sk_write_queue, just sk_send_head
206          * for retransmissions
207          */
208         if (sk->sk_send_head != NULL) {
209                 kfree_skb(sk->sk_send_head);
210                 sk->sk_send_head = NULL;
211         }
212
213         /* Clean up a referenced DCCP bind bucket. */
214         if (inet_csk(sk)->icsk_bind_hash != NULL)
215                 inet_put_port(sk);
216
217         kfree(dp->dccps_service_list);
218         dp->dccps_service_list = NULL;
219
220         if (dp->dccps_hc_rx_ackvec != NULL) {
221                 dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
222                 dp->dccps_hc_rx_ackvec = NULL;
223         }
224         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
225         ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
226         dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
227
228         /* clean up feature negotiation state */
229         dccp_feat_list_purge(&dp->dccps_featneg);
230 }
231
232 EXPORT_SYMBOL_GPL(dccp_destroy_sock);
233
234 static inline int dccp_listen_start(struct sock *sk, int backlog)
235 {
236         struct dccp_sock *dp = dccp_sk(sk);
237
238         dp->dccps_role = DCCP_ROLE_LISTEN;
239         /* do not start to listen if feature negotiation setup fails */
240         if (dccp_feat_finalise_settings(dp))
241                 return -EPROTO;
242         return inet_csk_listen_start(sk, backlog);
243 }
244
245 static inline int dccp_need_reset(int state)
246 {
247         return state != DCCP_CLOSED && state != DCCP_LISTEN &&
248                state != DCCP_REQUESTING;
249 }
250
251 int dccp_disconnect(struct sock *sk, int flags)
252 {
253         struct inet_connection_sock *icsk = inet_csk(sk);
254         struct inet_sock *inet = inet_sk(sk);
255         struct dccp_sock *dp = dccp_sk(sk);
256         int err = 0;
257         const int old_state = sk->sk_state;
258
259         if (old_state != DCCP_CLOSED)
260                 dccp_set_state(sk, DCCP_CLOSED);
261
262         /*
263          * This corresponds to the ABORT function of RFC793, sec. 3.8
264          * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
265          */
266         if (old_state == DCCP_LISTEN) {
267                 inet_csk_listen_stop(sk);
268         } else if (dccp_need_reset(old_state)) {
269                 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
270                 sk->sk_err = ECONNRESET;
271         } else if (old_state == DCCP_REQUESTING)
272                 sk->sk_err = ECONNRESET;
273
274         dccp_clear_xmit_timers(sk);
275         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
276         ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
277         dp->dccps_hc_rx_ccid = NULL;
278         dp->dccps_hc_tx_ccid = NULL;
279
280         __skb_queue_purge(&sk->sk_receive_queue);
281         __skb_queue_purge(&sk->sk_write_queue);
282         if (sk->sk_send_head != NULL) {
283                 __kfree_skb(sk->sk_send_head);
284                 sk->sk_send_head = NULL;
285         }
286
287         inet->inet_dport = 0;
288
289         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
290                 inet_reset_saddr(sk);
291
292         sk->sk_shutdown = 0;
293         sock_reset_flag(sk, SOCK_DONE);
294
295         icsk->icsk_backoff = 0;
296         inet_csk_delack_init(sk);
297         __sk_dst_reset(sk);
298
299         WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
300
301         sk->sk_error_report(sk);
302         return err;
303 }
304
305 EXPORT_SYMBOL_GPL(dccp_disconnect);
306
307 /*
308  *      Wait for a DCCP event.
309  *
310  *      Note that we don't need to lock the socket, as the upper poll layers
311  *      take care of normal races (between the test and the event) and we don't
312  *      go look at any of the socket buffers directly.
313  */
314 unsigned int dccp_poll(struct file *file, struct socket *sock,
315                        poll_table *wait)
316 {
317         unsigned int mask;
318         struct sock *sk = sock->sk;
319
320         sock_poll_wait(file, sk_sleep(sk), wait);
321         if (sk->sk_state == DCCP_LISTEN)
322                 return inet_csk_listen_poll(sk);
323
324         /* Socket is not locked. We are protected from async events
325            by poll logic and correct handling of state changes
326            made by another threads is impossible in any case.
327          */
328
329         mask = 0;
330         if (sk->sk_err)
331                 mask = POLLERR;
332
333         if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == DCCP_CLOSED)
334                 mask |= POLLHUP;
335         if (sk->sk_shutdown & RCV_SHUTDOWN)
336                 mask |= POLLIN | POLLRDNORM | POLLRDHUP;
337
338         /* Connected? */
339         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
340                 if (atomic_read(&sk->sk_rmem_alloc) > 0)
341                         mask |= POLLIN | POLLRDNORM;
342
343                 if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
344                         if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
345                                 mask |= POLLOUT | POLLWRNORM;
346                         } else {  /* send SIGIO later */
347                                 set_bit(SOCK_ASYNC_NOSPACE,
348                                         &sk->sk_socket->flags);
349                                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
350
351                                 /* Race breaker. If space is freed after
352                                  * wspace test but before the flags are set,
353                                  * IO signal will be lost.
354                                  */
355                                 if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
356                                         mask |= POLLOUT | POLLWRNORM;
357                         }
358                 }
359         }
360         return mask;
361 }
362
363 EXPORT_SYMBOL_GPL(dccp_poll);
364
365 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
366 {
367         int rc = -ENOTCONN;
368
369         lock_sock(sk);
370
371         if (sk->sk_state == DCCP_LISTEN)
372                 goto out;
373
374         switch (cmd) {
375         case SIOCINQ: {
376                 struct sk_buff *skb;
377                 unsigned long amount = 0;
378
379                 skb = skb_peek(&sk->sk_receive_queue);
380                 if (skb != NULL) {
381                         /*
382                          * We will only return the amount of this packet since
383                          * that is all that will be read.
384                          */
385                         amount = skb->len;
386                 }
387                 rc = put_user(amount, (int __user *)arg);
388         }
389                 break;
390         default:
391                 rc = -ENOIOCTLCMD;
392                 break;
393         }
394 out:
395         release_sock(sk);
396         return rc;
397 }
398
399 EXPORT_SYMBOL_GPL(dccp_ioctl);
400
401 static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
402                                    char __user *optval, unsigned int optlen)
403 {
404         struct dccp_sock *dp = dccp_sk(sk);
405         struct dccp_service_list *sl = NULL;
406
407         if (service == DCCP_SERVICE_INVALID_VALUE ||
408             optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
409                 return -EINVAL;
410
411         if (optlen > sizeof(service)) {
412                 sl = kmalloc(optlen, GFP_KERNEL);
413                 if (sl == NULL)
414                         return -ENOMEM;
415
416                 sl->dccpsl_nr = optlen / sizeof(u32) - 1;
417                 if (copy_from_user(sl->dccpsl_list,
418                                    optval + sizeof(service),
419                                    optlen - sizeof(service)) ||
420                     dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
421                         kfree(sl);
422                         return -EFAULT;
423                 }
424         }
425
426         lock_sock(sk);
427         dp->dccps_service = service;
428
429         kfree(dp->dccps_service_list);
430
431         dp->dccps_service_list = sl;
432         release_sock(sk);
433         return 0;
434 }
435
436 static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
437 {
438         u8 *list, len;
439         int i, rc;
440
441         if (cscov < 0 || cscov > 15)
442                 return -EINVAL;
443         /*
444          * Populate a list of permissible values, in the range cscov...15. This
445          * is necessary since feature negotiation of single values only works if
446          * both sides incidentally choose the same value. Since the list starts
447          * lowest-value first, negotiation will pick the smallest shared value.
448          */
449         if (cscov == 0)
450                 return 0;
451         len = 16 - cscov;
452
453         list = kmalloc(len, GFP_KERNEL);
454         if (list == NULL)
455                 return -ENOBUFS;
456
457         for (i = 0; i < len; i++)
458                 list[i] = cscov++;
459
460         rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
461
462         if (rc == 0) {
463                 if (rx)
464                         dccp_sk(sk)->dccps_pcrlen = cscov;
465                 else
466                         dccp_sk(sk)->dccps_pcslen = cscov;
467         }
468         kfree(list);
469         return rc;
470 }
471
472 static int dccp_setsockopt_ccid(struct sock *sk, int type,
473                                 char __user *optval, unsigned int optlen)
474 {
475         u8 *val;
476         int rc = 0;
477
478         if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
479                 return -EINVAL;
480
481         val = memdup_user(optval, optlen);
482         if (IS_ERR(val))
483                 return PTR_ERR(val);
484
485         lock_sock(sk);
486         if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
487                 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
488
489         if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
490                 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
491         release_sock(sk);
492
493         kfree(val);
494         return rc;
495 }
496
497 static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
498                 char __user *optval, unsigned int optlen)
499 {
500         struct dccp_sock *dp = dccp_sk(sk);
501         int val, err = 0;
502
503         switch (optname) {
504         case DCCP_SOCKOPT_PACKET_SIZE:
505                 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
506                 return 0;
507         case DCCP_SOCKOPT_CHANGE_L:
508         case DCCP_SOCKOPT_CHANGE_R:
509                 DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
510                 return 0;
511         case DCCP_SOCKOPT_CCID:
512         case DCCP_SOCKOPT_RX_CCID:
513         case DCCP_SOCKOPT_TX_CCID:
514                 return dccp_setsockopt_ccid(sk, optname, optval, optlen);
515         }
516
517         if (optlen < (int)sizeof(int))
518                 return -EINVAL;
519
520         if (get_user(val, (int __user *)optval))
521                 return -EFAULT;
522
523         if (optname == DCCP_SOCKOPT_SERVICE)
524                 return dccp_setsockopt_service(sk, val, optval, optlen);
525
526         lock_sock(sk);
527         switch (optname) {
528         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
529                 if (dp->dccps_role != DCCP_ROLE_SERVER)
530                         err = -EOPNOTSUPP;
531                 else
532                         dp->dccps_server_timewait = (val != 0);
533                 break;
534         case DCCP_SOCKOPT_SEND_CSCOV:
535                 err = dccp_setsockopt_cscov(sk, val, false);
536                 break;
537         case DCCP_SOCKOPT_RECV_CSCOV:
538                 err = dccp_setsockopt_cscov(sk, val, true);
539                 break;
540         case DCCP_SOCKOPT_QPOLICY_ID:
541                 if (sk->sk_state != DCCP_CLOSED)
542                         err = -EISCONN;
543                 else if (val < 0 || val >= DCCPQ_POLICY_MAX)
544                         err = -EINVAL;
545                 else
546                         dp->dccps_qpolicy = val;
547                 break;
548         case DCCP_SOCKOPT_QPOLICY_TXQLEN:
549                 if (val < 0)
550                         err = -EINVAL;
551                 else
552                         dp->dccps_tx_qlen = val;
553                 break;
554         default:
555                 err = -ENOPROTOOPT;
556                 break;
557         }
558         release_sock(sk);
559
560         return err;
561 }
562
563 int dccp_setsockopt(struct sock *sk, int level, int optname,
564                     char __user *optval, unsigned int optlen)
565 {
566         if (level != SOL_DCCP)
567                 return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
568                                                              optname, optval,
569                                                              optlen);
570         return do_dccp_setsockopt(sk, level, optname, optval, optlen);
571 }
572
573 EXPORT_SYMBOL_GPL(dccp_setsockopt);
574
575 #ifdef CONFIG_COMPAT
576 int compat_dccp_setsockopt(struct sock *sk, int level, int optname,
577                            char __user *optval, unsigned int optlen)
578 {
579         if (level != SOL_DCCP)
580                 return inet_csk_compat_setsockopt(sk, level, optname,
581                                                   optval, optlen);
582         return do_dccp_setsockopt(sk, level, optname, optval, optlen);
583 }
584
585 EXPORT_SYMBOL_GPL(compat_dccp_setsockopt);
586 #endif
587
588 static int dccp_getsockopt_service(struct sock *sk, int len,
589                                    __be32 __user *optval,
590                                    int __user *optlen)
591 {
592         const struct dccp_sock *dp = dccp_sk(sk);
593         const struct dccp_service_list *sl;
594         int err = -ENOENT, slen = 0, total_len = sizeof(u32);
595
596         lock_sock(sk);
597         if ((sl = dp->dccps_service_list) != NULL) {
598                 slen = sl->dccpsl_nr * sizeof(u32);
599                 total_len += slen;
600         }
601
602         err = -EINVAL;
603         if (total_len > len)
604                 goto out;
605
606         err = 0;
607         if (put_user(total_len, optlen) ||
608             put_user(dp->dccps_service, optval) ||
609             (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
610                 err = -EFAULT;
611 out:
612         release_sock(sk);
613         return err;
614 }
615
616 static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
617                     char __user *optval, int __user *optlen)
618 {
619         struct dccp_sock *dp;
620         int val, len;
621
622         if (get_user(len, optlen))
623                 return -EFAULT;
624
625         if (len < (int)sizeof(int))
626                 return -EINVAL;
627
628         dp = dccp_sk(sk);
629
630         switch (optname) {
631         case DCCP_SOCKOPT_PACKET_SIZE:
632                 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
633                 return 0;
634         case DCCP_SOCKOPT_SERVICE:
635                 return dccp_getsockopt_service(sk, len,
636                                                (__be32 __user *)optval, optlen);
637         case DCCP_SOCKOPT_GET_CUR_MPS:
638                 val = dp->dccps_mss_cache;
639                 break;
640         case DCCP_SOCKOPT_AVAILABLE_CCIDS:
641                 return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
642         case DCCP_SOCKOPT_TX_CCID:
643                 val = ccid_get_current_tx_ccid(dp);
644                 if (val < 0)
645                         return -ENOPROTOOPT;
646                 break;
647         case DCCP_SOCKOPT_RX_CCID:
648                 val = ccid_get_current_rx_ccid(dp);
649                 if (val < 0)
650                         return -ENOPROTOOPT;
651                 break;
652         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
653                 val = dp->dccps_server_timewait;
654                 break;
655         case DCCP_SOCKOPT_SEND_CSCOV:
656                 val = dp->dccps_pcslen;
657                 break;
658         case DCCP_SOCKOPT_RECV_CSCOV:
659                 val = dp->dccps_pcrlen;
660                 break;
661         case DCCP_SOCKOPT_QPOLICY_ID:
662                 val = dp->dccps_qpolicy;
663                 break;
664         case DCCP_SOCKOPT_QPOLICY_TXQLEN:
665                 val = dp->dccps_tx_qlen;
666                 break;
667         case 128 ... 191:
668                 return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
669                                              len, (u32 __user *)optval, optlen);
670         case 192 ... 255:
671                 return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
672                                              len, (u32 __user *)optval, optlen);
673         default:
674                 return -ENOPROTOOPT;
675         }
676
677         len = sizeof(val);
678         if (put_user(len, optlen) || copy_to_user(optval, &val, len))
679                 return -EFAULT;
680
681         return 0;
682 }
683
684 int dccp_getsockopt(struct sock *sk, int level, int optname,
685                     char __user *optval, int __user *optlen)
686 {
687         if (level != SOL_DCCP)
688                 return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
689                                                              optname, optval,
690                                                              optlen);
691         return do_dccp_getsockopt(sk, level, optname, optval, optlen);
692 }
693
694 EXPORT_SYMBOL_GPL(dccp_getsockopt);
695
696 #ifdef CONFIG_COMPAT
697 int compat_dccp_getsockopt(struct sock *sk, int level, int optname,
698                            char __user *optval, int __user *optlen)
699 {
700         if (level != SOL_DCCP)
701                 return inet_csk_compat_getsockopt(sk, level, optname,
702                                                   optval, optlen);
703         return do_dccp_getsockopt(sk, level, optname, optval, optlen);
704 }
705
706 EXPORT_SYMBOL_GPL(compat_dccp_getsockopt);
707 #endif
708
709 static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
710 {
711         struct cmsghdr *cmsg = CMSG_FIRSTHDR(msg);
712
713         /*
714          * Assign an (opaque) qpolicy priority value to skb->priority.
715          *
716          * We are overloading this skb field for use with the qpolicy subystem.
717          * The skb->priority is normally used for the SO_PRIORITY option, which
718          * is initialised from sk_priority. Since the assignment of sk_priority
719          * to skb->priority happens later (on layer 3), we overload this field
720          * for use with queueing priorities as long as the skb is on layer 4.
721          * The default priority value (if nothing is set) is 0.
722          */
723         skb->priority = 0;
724
725         for (; cmsg != NULL; cmsg = CMSG_NXTHDR(msg, cmsg)) {
726
727                 if (!CMSG_OK(msg, cmsg))
728                         return -EINVAL;
729
730                 if (cmsg->cmsg_level != SOL_DCCP)
731                         continue;
732
733                 if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
734                     !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
735                         return -EINVAL;
736
737                 switch (cmsg->cmsg_type) {
738                 case DCCP_SCM_PRIORITY:
739                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
740                                 return -EINVAL;
741                         skb->priority = *(__u32 *)CMSG_DATA(cmsg);
742                         break;
743                 default:
744                         return -EINVAL;
745                 }
746         }
747         return 0;
748 }
749
750 int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
751                  size_t len)
752 {
753         const struct dccp_sock *dp = dccp_sk(sk);
754         const int flags = msg->msg_flags;
755         const int noblock = flags & MSG_DONTWAIT;
756         struct sk_buff *skb;
757         int rc, size;
758         long timeo;
759
760         if (len > dp->dccps_mss_cache)
761                 return -EMSGSIZE;
762
763         lock_sock(sk);
764
765         if (dccp_qpolicy_full(sk)) {
766                 rc = -EAGAIN;
767                 goto out_release;
768         }
769
770         timeo = sock_sndtimeo(sk, noblock);
771
772         /*
773          * We have to use sk_stream_wait_connect here to set sk_write_pending,
774          * so that the trick in dccp_rcv_request_sent_state_process.
775          */
776         /* Wait for a connection to finish. */
777         if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
778                 if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
779                         goto out_release;
780
781         size = sk->sk_prot->max_header + len;
782         release_sock(sk);
783         skb = sock_alloc_send_skb(sk, size, noblock, &rc);
784         lock_sock(sk);
785         if (skb == NULL)
786                 goto out_release;
787
788         skb_reserve(skb, sk->sk_prot->max_header);
789         rc = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
790         if (rc != 0)
791                 goto out_discard;
792
793         rc = dccp_msghdr_parse(msg, skb);
794         if (rc != 0)
795                 goto out_discard;
796
797         dccp_qpolicy_push(sk, skb);
798         /*
799          * The xmit_timer is set if the TX CCID is rate-based and will expire
800          * when congestion control permits to release further packets into the
801          * network. Window-based CCIDs do not use this timer.
802          */
803         if (!timer_pending(&dp->dccps_xmit_timer))
804                 dccp_write_xmit(sk);
805 out_release:
806         release_sock(sk);
807         return rc ? : len;
808 out_discard:
809         kfree_skb(skb);
810         goto out_release;
811 }
812
813 EXPORT_SYMBOL_GPL(dccp_sendmsg);
814
815 int dccp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
816                  size_t len, int nonblock, int flags, int *addr_len)
817 {
818         const struct dccp_hdr *dh;
819         long timeo;
820
821         lock_sock(sk);
822
823         if (sk->sk_state == DCCP_LISTEN) {
824                 len = -ENOTCONN;
825                 goto out;
826         }
827
828         timeo = sock_rcvtimeo(sk, nonblock);
829
830         do {
831                 struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
832
833                 if (skb == NULL)
834                         goto verify_sock_status;
835
836                 dh = dccp_hdr(skb);
837
838                 switch (dh->dccph_type) {
839                 case DCCP_PKT_DATA:
840                 case DCCP_PKT_DATAACK:
841                         goto found_ok_skb;
842
843                 case DCCP_PKT_CLOSE:
844                 case DCCP_PKT_CLOSEREQ:
845                         if (!(flags & MSG_PEEK))
846                                 dccp_finish_passive_close(sk);
847                         /* fall through */
848                 case DCCP_PKT_RESET:
849                         dccp_pr_debug("found fin (%s) ok!\n",
850                                       dccp_packet_name(dh->dccph_type));
851                         len = 0;
852                         goto found_fin_ok;
853                 default:
854                         dccp_pr_debug("packet_type=%s\n",
855                                       dccp_packet_name(dh->dccph_type));
856                         sk_eat_skb(sk, skb, 0);
857                 }
858 verify_sock_status:
859                 if (sock_flag(sk, SOCK_DONE)) {
860                         len = 0;
861                         break;
862                 }
863
864                 if (sk->sk_err) {
865                         len = sock_error(sk);
866                         break;
867                 }
868
869                 if (sk->sk_shutdown & RCV_SHUTDOWN) {
870                         len = 0;
871                         break;
872                 }
873
874                 if (sk->sk_state == DCCP_CLOSED) {
875                         if (!sock_flag(sk, SOCK_DONE)) {
876                                 /* This occurs when user tries to read
877                                  * from never connected socket.
878                                  */
879                                 len = -ENOTCONN;
880                                 break;
881                         }
882                         len = 0;
883                         break;
884                 }
885
886                 if (!timeo) {
887                         len = -EAGAIN;
888                         break;
889                 }
890
891                 if (signal_pending(current)) {
892                         len = sock_intr_errno(timeo);
893                         break;
894                 }
895
896                 sk_wait_data(sk, &timeo);
897                 continue;
898         found_ok_skb:
899                 if (len > skb->len)
900                         len = skb->len;
901                 else if (len < skb->len)
902                         msg->msg_flags |= MSG_TRUNC;
903
904                 if (skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len)) {
905                         /* Exception. Bailout! */
906                         len = -EFAULT;
907                         break;
908                 }
909                 if (flags & MSG_TRUNC)
910                         len = skb->len;
911         found_fin_ok:
912                 if (!(flags & MSG_PEEK))
913                         sk_eat_skb(sk, skb, 0);
914                 break;
915         } while (1);
916 out:
917         release_sock(sk);
918         return len;
919 }
920
921 EXPORT_SYMBOL_GPL(dccp_recvmsg);
922
923 int inet_dccp_listen(struct socket *sock, int backlog)
924 {
925         struct sock *sk = sock->sk;
926         unsigned char old_state;
927         int err;
928
929         lock_sock(sk);
930
931         err = -EINVAL;
932         if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
933                 goto out;
934
935         old_state = sk->sk_state;
936         if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
937                 goto out;
938
939         /* Really, if the socket is already in listen state
940          * we can only allow the backlog to be adjusted.
941          */
942         if (old_state != DCCP_LISTEN) {
943                 /*
944                  * FIXME: here it probably should be sk->sk_prot->listen_start
945                  * see tcp_listen_start
946                  */
947                 err = dccp_listen_start(sk, backlog);
948                 if (err)
949                         goto out;
950         }
951         sk->sk_max_ack_backlog = backlog;
952         err = 0;
953
954 out:
955         release_sock(sk);
956         return err;
957 }
958
959 EXPORT_SYMBOL_GPL(inet_dccp_listen);
960
961 static void dccp_terminate_connection(struct sock *sk)
962 {
963         u8 next_state = DCCP_CLOSED;
964
965         switch (sk->sk_state) {
966         case DCCP_PASSIVE_CLOSE:
967         case DCCP_PASSIVE_CLOSEREQ:
968                 dccp_finish_passive_close(sk);
969                 break;
970         case DCCP_PARTOPEN:
971                 dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
972                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
973                 /* fall through */
974         case DCCP_OPEN:
975                 dccp_send_close(sk, 1);
976
977                 if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
978                     !dccp_sk(sk)->dccps_server_timewait)
979                         next_state = DCCP_ACTIVE_CLOSEREQ;
980                 else
981                         next_state = DCCP_CLOSING;
982                 /* fall through */
983         default:
984                 dccp_set_state(sk, next_state);
985         }
986 }
987
988 void dccp_close(struct sock *sk, long timeout)
989 {
990         struct dccp_sock *dp = dccp_sk(sk);
991         struct sk_buff *skb;
992         u32 data_was_unread = 0;
993         int state;
994
995         lock_sock(sk);
996
997         sk->sk_shutdown = SHUTDOWN_MASK;
998
999         if (sk->sk_state == DCCP_LISTEN) {
1000                 dccp_set_state(sk, DCCP_CLOSED);
1001
1002                 /* Special case. */
1003                 inet_csk_listen_stop(sk);
1004
1005                 goto adjudge_to_death;
1006         }
1007
1008         sk_stop_timer(sk, &dp->dccps_xmit_timer);
1009
1010         /*
1011          * We need to flush the recv. buffs.  We do this only on the
1012          * descriptor close, not protocol-sourced closes, because the
1013           *reader process may not have drained the data yet!
1014          */
1015         while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1016                 data_was_unread += skb->len;
1017                 __kfree_skb(skb);
1018         }
1019
1020         /* If socket has been already reset kill it. */
1021         if (sk->sk_state == DCCP_CLOSED)
1022                 goto adjudge_to_death;
1023
1024         if (data_was_unread) {
1025                 /* Unread data was tossed, send an appropriate Reset Code */
1026                 DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1027                 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1028                 dccp_set_state(sk, DCCP_CLOSED);
1029         } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1030                 /* Check zero linger _after_ checking for unread data. */
1031                 sk->sk_prot->disconnect(sk, 0);
1032         } else if (sk->sk_state != DCCP_CLOSED) {
1033                 /*
1034                  * Normal connection termination. May need to wait if there are
1035                  * still packets in the TX queue that are delayed by the CCID.
1036                  */
1037                 dccp_flush_write_queue(sk, &timeout);
1038                 dccp_terminate_connection(sk);
1039         }
1040
1041         /*
1042          * Flush write queue. This may be necessary in several cases:
1043          * - we have been closed by the peer but still have application data;
1044          * - abortive termination (unread data or zero linger time),
1045          * - normal termination but queue could not be flushed within time limit
1046          */
1047         __skb_queue_purge(&sk->sk_write_queue);
1048
1049         sk_stream_wait_close(sk, timeout);
1050
1051 adjudge_to_death:
1052         state = sk->sk_state;
1053         sock_hold(sk);
1054         sock_orphan(sk);
1055
1056         /*
1057          * It is the last release_sock in its life. It will remove backlog.
1058          */
1059         release_sock(sk);
1060         /*
1061          * Now socket is owned by kernel and we acquire BH lock
1062          * to finish close. No need to check for user refs.
1063          */
1064         local_bh_disable();
1065         bh_lock_sock(sk);
1066         WARN_ON(sock_owned_by_user(sk));
1067
1068         percpu_counter_inc(sk->sk_prot->orphan_count);
1069
1070         /* Have we already been destroyed by a softirq or backlog? */
1071         if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1072                 goto out;
1073
1074         if (sk->sk_state == DCCP_CLOSED)
1075                 inet_csk_destroy_sock(sk);
1076
1077         /* Otherwise, socket is reprieved until protocol close. */
1078
1079 out:
1080         bh_unlock_sock(sk);
1081         local_bh_enable();
1082         sock_put(sk);
1083 }
1084
1085 EXPORT_SYMBOL_GPL(dccp_close);
1086
1087 void dccp_shutdown(struct sock *sk, int how)
1088 {
1089         dccp_pr_debug("called shutdown(%x)\n", how);
1090 }
1091
1092 EXPORT_SYMBOL_GPL(dccp_shutdown);
1093
1094 static inline int dccp_mib_init(void)
1095 {
1096         return snmp_mib_init((void __percpu **)dccp_statistics,
1097                              sizeof(struct dccp_mib),
1098                              __alignof__(struct dccp_mib));
1099 }
1100
1101 static inline void dccp_mib_exit(void)
1102 {
1103         snmp_mib_free((void __percpu **)dccp_statistics);
1104 }
1105
1106 static int thash_entries;
1107 module_param(thash_entries, int, 0444);
1108 MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1109
1110 #ifdef CONFIG_IP_DCCP_DEBUG
1111 int dccp_debug;
1112 module_param(dccp_debug, bool, 0644);
1113 MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1114
1115 EXPORT_SYMBOL_GPL(dccp_debug);
1116 #endif
1117
1118 static int __init dccp_init(void)
1119 {
1120         unsigned long goal;
1121         int ehash_order, bhash_order, i;
1122         int rc;
1123
1124         BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1125                      FIELD_SIZEOF(struct sk_buff, cb));
1126         rc = percpu_counter_init(&dccp_orphan_count, 0);
1127         if (rc)
1128                 goto out_fail;
1129         rc = -ENOBUFS;
1130         inet_hashinfo_init(&dccp_hashinfo);
1131         dccp_hashinfo.bind_bucket_cachep =
1132                 kmem_cache_create("dccp_bind_bucket",
1133                                   sizeof(struct inet_bind_bucket), 0,
1134                                   SLAB_HWCACHE_ALIGN, NULL);
1135         if (!dccp_hashinfo.bind_bucket_cachep)
1136                 goto out_free_percpu;
1137
1138         /*
1139          * Size and allocate the main established and bind bucket
1140          * hash tables.
1141          *
1142          * The methodology is similar to that of the buffer cache.
1143          */
1144         if (totalram_pages >= (128 * 1024))
1145                 goal = totalram_pages >> (21 - PAGE_SHIFT);
1146         else
1147                 goal = totalram_pages >> (23 - PAGE_SHIFT);
1148
1149         if (thash_entries)
1150                 goal = (thash_entries *
1151                         sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1152         for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1153                 ;
1154         do {
1155                 unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1156                                         sizeof(struct inet_ehash_bucket);
1157
1158                 while (hash_size & (hash_size - 1))
1159                         hash_size--;
1160                 dccp_hashinfo.ehash_mask = hash_size - 1;
1161                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1162                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1163         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
1164
1165         if (!dccp_hashinfo.ehash) {
1166                 DCCP_CRIT("Failed to allocate DCCP established hash table");
1167                 goto out_free_bind_bucket_cachep;
1168         }
1169
1170         for (i = 0; i <= dccp_hashinfo.ehash_mask; i++) {
1171                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1172                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].twchain, i);
1173         }
1174
1175         if (inet_ehash_locks_alloc(&dccp_hashinfo))
1176                         goto out_free_dccp_ehash;
1177
1178         bhash_order = ehash_order;
1179
1180         do {
1181                 dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1182                                         sizeof(struct inet_bind_hashbucket);
1183                 if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1184                     bhash_order > 0)
1185                         continue;
1186                 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1187                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1188         } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1189
1190         if (!dccp_hashinfo.bhash) {
1191                 DCCP_CRIT("Failed to allocate DCCP bind hash table");
1192                 goto out_free_dccp_locks;
1193         }
1194
1195         for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1196                 spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1197                 INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1198         }
1199
1200         rc = dccp_mib_init();
1201         if (rc)
1202                 goto out_free_dccp_bhash;
1203
1204         rc = dccp_ackvec_init();
1205         if (rc)
1206                 goto out_free_dccp_mib;
1207
1208         rc = dccp_sysctl_init();
1209         if (rc)
1210                 goto out_ackvec_exit;
1211
1212         rc = ccid_initialize_builtins();
1213         if (rc)
1214                 goto out_sysctl_exit;
1215
1216         dccp_timestamping_init();
1217
1218         return 0;
1219
1220 out_sysctl_exit:
1221         dccp_sysctl_exit();
1222 out_ackvec_exit:
1223         dccp_ackvec_exit();
1224 out_free_dccp_mib:
1225         dccp_mib_exit();
1226 out_free_dccp_bhash:
1227         free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1228 out_free_dccp_locks:
1229         inet_ehash_locks_free(&dccp_hashinfo);
1230 out_free_dccp_ehash:
1231         free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1232 out_free_bind_bucket_cachep:
1233         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1234 out_free_percpu:
1235         percpu_counter_destroy(&dccp_orphan_count);
1236 out_fail:
1237         dccp_hashinfo.bhash = NULL;
1238         dccp_hashinfo.ehash = NULL;
1239         dccp_hashinfo.bind_bucket_cachep = NULL;
1240         return rc;
1241 }
1242
1243 static void __exit dccp_fini(void)
1244 {
1245         ccid_cleanup_builtins();
1246         dccp_mib_exit();
1247         free_pages((unsigned long)dccp_hashinfo.bhash,
1248                    get_order(dccp_hashinfo.bhash_size *
1249                              sizeof(struct inet_bind_hashbucket)));
1250         free_pages((unsigned long)dccp_hashinfo.ehash,
1251                    get_order((dccp_hashinfo.ehash_mask + 1) *
1252                              sizeof(struct inet_ehash_bucket)));
1253         inet_ehash_locks_free(&dccp_hashinfo);
1254         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1255         dccp_ackvec_exit();
1256         dccp_sysctl_exit();
1257         percpu_counter_destroy(&dccp_orphan_count);
1258 }
1259
1260 module_init(dccp_init);
1261 module_exit(dccp_fini);
1262
1263 MODULE_LICENSE("GPL");
1264 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1265 MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");