?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
cipso: unsigned buf_len cannot be negative
[linux-2.6/next.git] / net / packet / af_packet.c
blobc718e7e3f7dea66facd1483b0b27dd5b4ef974bc
1 /*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
5 *
6 * PACKET - implements raw packet sockets.
7 *
8 * Authors: Ross Biro
9 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10 * Alan Cox, <gw4pts@gw4pts.ampr.org>
11 *
12 * Fixes:
13 * Alan Cox : verify_area() now used correctly
14 * Alan Cox : new skbuff lists, look ma no backlogs!
15 * Alan Cox : tidied skbuff lists.
16 * Alan Cox : Now uses generic datagram routines I
17 * added. Also fixed the peek/read crash
18 * from all old Linux datagram code.
19 * Alan Cox : Uses the improved datagram code.
20 * Alan Cox : Added NULL's for socket options.
21 * Alan Cox : Re-commented the code.
22 * Alan Cox : Use new kernel side addressing
23 * Rob Janssen : Correct MTU usage.
24 * Dave Platt : Counter leaks caused by incorrect
25 * interrupt locking and some slightly
26 * dubious gcc output. Can you read
27 * compiler: it said _VOLATILE_
28 * Richard Kooijman : Timestamp fixes.
29 * Alan Cox : New buffers. Use sk->mac.raw.
30 * Alan Cox : sendmsg/recvmsg support.
31 * Alan Cox : Protocol setting support
32 * Alexey Kuznetsov : Untied from IPv4 stack.
33 * Cyrus Durgin : Fixed kerneld for kmod.
34 * Michal Ostrowski : Module initialization cleanup.
35 * Ulises Alonso : Frame number limit removal and
36 * packet_set_ring memory leak.
37 * Eric Biederman : Allow for > 8 byte hardware addresses.
38 * The convention is that longer addresses
39 * will simply extend the hardware address
40 * byte arrays at the end of sockaddr_ll
41 * and packet_mreq.
42 *
43 * This program is free software; you can redistribute it and/or
44 * modify it under the terms of the GNU General Public License
45 * as published by the Free Software Foundation; either version
46 * 2 of the License, or (at your option) any later version.
47 *
48 */
49
50 #include <linux/types.h>
51 #include <linux/mm.h>
52 #include <linux/capability.h>
53 #include <linux/fcntl.h>
54 #include <linux/socket.h>
55 #include <linux/in.h>
56 #include <linux/inet.h>
57 #include <linux/netdevice.h>
58 #include <linux/if_packet.h>
59 #include <linux/wireless.h>
60 #include <linux/kernel.h>
61 #include <linux/kmod.h>
62 #include <net/net_namespace.h>
63 #include <net/ip.h>
64 #include <net/protocol.h>
65 #include <linux/skbuff.h>
66 #include <net/sock.h>
67 #include <linux/errno.h>
68 #include <linux/timer.h>
69 #include <asm/system.h>
70 #include <asm/uaccess.h>
71 #include <asm/ioctls.h>
72 #include <asm/page.h>
73 #include <asm/cacheflush.h>
74 #include <asm/io.h>
75 #include <linux/proc_fs.h>
76 #include <linux/seq_file.h>
77 #include <linux/poll.h>
78 #include <linux/module.h>
79 #include <linux/init.h>
80
81 #ifdef CONFIG_INET
82 #include <net/inet_common.h>
83 #endif
84
85 /*
86 Assumptions:
87 - if device has no dev->hard_header routine, it adds and removes ll header
88 inside itself. In this case ll header is invisible outside of device,
89 but higher levels still should reserve dev->hard_header_len.
90 Some devices are enough clever to reallocate skb, when header
91 will not fit to reserved space (tunnel), another ones are silly
92 (PPP).
93 - packet socket receives packets with pulled ll header,
94 so that SOCK_RAW should push it back.
95
96 On receive:
97 -----------
98
99 Incoming, dev->hard_header!=NULL
100 mac_header -> ll header
101 data -> data
102
103 Outgoing, dev->hard_header!=NULL
104 mac_header -> ll header
105 data -> ll header
106
107 Incoming, dev->hard_header==NULL
108 mac_header -> UNKNOWN position. It is very likely, that it points to ll
109 header. PPP makes it, that is wrong, because introduce
110 assymetry between rx and tx paths.
111 data -> data
112
113 Outgoing, dev->hard_header==NULL
114 mac_header -> data. ll header is still not built!
115 data -> data
116
117 Resume
118 If dev->hard_header==NULL we are unlikely to restore sensible ll header.
119
120
121 On transmit:
122 ------------
123
124 dev->hard_header != NULL
125 mac_header -> ll header
126 data -> ll header
127
128 dev->hard_header == NULL (ll header is added by device, we cannot control it)
129 mac_header -> data
130 data -> data
131
132 We should set nh.raw on output to correct posistion,
133 packet classifier depends on it.
134 */
135
136 /* Private packet socket structures. */
137
138 struct packet_mclist
139 {
140 struct packet_mclist *next;
141 int ifindex;
142 int count;
143 unsigned short type;
144 unsigned short alen;
145 unsigned char addr[MAX_ADDR_LEN];
146 };
147 /* identical to struct packet_mreq except it has
148 * a longer address field.
149 */
150 struct packet_mreq_max
151 {
152 int mr_ifindex;
153 unsigned short mr_type;
154 unsigned short mr_alen;
155 unsigned char mr_address[MAX_ADDR_LEN];
156 };
157
158 #ifdef CONFIG_PACKET_MMAP
159 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
160 #endif
161
162 static void packet_flush_mclist(struct sock *sk);
163
164 struct packet_sock {
165 /* struct sock has to be the first member of packet_sock */
166 struct sock sk;
167 struct tpacket_stats stats;
168 #ifdef CONFIG_PACKET_MMAP
169 char * *pg_vec;
170 unsigned int head;
171 unsigned int frames_per_block;
172 unsigned int frame_size;
173 unsigned int frame_max;
174 int copy_thresh;
175 #endif
176 struct packet_type prot_hook;
177 spinlock_t bind_lock;
178 unsigned int running:1, /* prot_hook is attached*/
179 auxdata:1,
180 origdev:1;
181 int ifindex; /* bound device */
182 __be16 num;
183 struct packet_mclist *mclist;
184 #ifdef CONFIG_PACKET_MMAP
185 atomic_t mapped;
186 unsigned int pg_vec_order;
187 unsigned int pg_vec_pages;
188 unsigned int pg_vec_len;
189 enum tpacket_versions tp_version;
190 unsigned int tp_hdrlen;
191 unsigned int tp_reserve;
192 #endif
193 };
194
195 struct packet_skb_cb {
196 unsigned int origlen;
197 union {
198 struct sockaddr_pkt pkt;
199 struct sockaddr_ll ll;
200 } sa;
201 };
202
203 #define PACKET_SKB_CB(__skb) ((struct packet_skb_cb *)((__skb)->cb))
204
205 #ifdef CONFIG_PACKET_MMAP
206
207 static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
208 int status)
209 {
210 unsigned int pg_vec_pos, frame_offset;
211 union {
212 struct tpacket_hdr *h1;
213 struct tpacket2_hdr *h2;
214 void *raw;
215 } h;
216
217 pg_vec_pos = position / po->frames_per_block;
218 frame_offset = position % po->frames_per_block;
219
220 h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
221 switch (po->tp_version) {
222 case TPACKET_V1:
223 if (status != h.h1->tp_status ? TP_STATUS_USER :
224 TP_STATUS_KERNEL)
225 return NULL;
226 break;
227 case TPACKET_V2:
228 if (status != h.h2->tp_status ? TP_STATUS_USER :
229 TP_STATUS_KERNEL)
230 return NULL;
231 break;
232 }
233 return h.raw;
234 }
235
236 static void __packet_set_status(struct packet_sock *po, void *frame, int status)
237 {
238 union {
239 struct tpacket_hdr *h1;
240 struct tpacket2_hdr *h2;
241 void *raw;
242 } h;
243
244 h.raw = frame;
245 switch (po->tp_version) {
246 case TPACKET_V1:
247 h.h1->tp_status = status;
248 break;
249 case TPACKET_V2:
250 h.h2->tp_status = status;
251 break;
252 }
253 }
254 #endif
255
256 static inline struct packet_sock *pkt_sk(struct sock *sk)
257 {
258 return (struct packet_sock *)sk;
259 }
260
261 static void packet_sock_destruct(struct sock *sk)
262 {
263 WARN_ON(atomic_read(&sk->sk_rmem_alloc));
264 WARN_ON(atomic_read(&sk->sk_wmem_alloc));
265
266 if (!sock_flag(sk, SOCK_DEAD)) {
267 printk("Attempt to release alive packet socket: %p\n", sk);
268 return;
269 }
270
271 sk_refcnt_debug_dec(sk);
272 }
273
274
275 static const struct proto_ops packet_ops;
276
277 static const struct proto_ops packet_ops_spkt;
278
279 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
280 {
281 struct sock *sk;
282 struct sockaddr_pkt *spkt;
283
284 /*
285 * When we registered the protocol we saved the socket in the data
286 * field for just this event.
287 */
288
289 sk = pt->af_packet_priv;
290
291 /*
292 * Yank back the headers [hope the device set this
293 * right or kerboom...]
294 *
295 * Incoming packets have ll header pulled,
296 * push it back.
297 *
298 * For outgoing ones skb->data == skb_mac_header(skb)
299 * so that this procedure is noop.
300 */
301
302 if (skb->pkt_type == PACKET_LOOPBACK)
303 goto out;
304
305 if (dev_net(dev) != sock_net(sk))
306 goto out;
307
308 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
309 goto oom;
310
311 /* drop any routing info */
312 dst_release(skb->dst);
313 skb->dst = NULL;
314
315 /* drop conntrack reference */
316 nf_reset(skb);
317
318 spkt = &PACKET_SKB_CB(skb)->sa.pkt;
319
320 skb_push(skb, skb->data - skb_mac_header(skb));
321
322 /*
323 * The SOCK_PACKET socket receives _all_ frames.
324 */
325
326 spkt->spkt_family = dev->type;
327 strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
328 spkt->spkt_protocol = skb->protocol;
329
330 /*
331 * Charge the memory to the socket. This is done specifically
332 * to prevent sockets using all the memory up.
333 */
334
335 if (sock_queue_rcv_skb(sk,skb) == 0)
336 return 0;
337
338 out:
339 kfree_skb(skb);
340 oom:
341 return 0;
342 }
343
344
345 /*
346 * Output a raw packet to a device layer. This bypasses all the other
347 * protocol layers and you must therefore supply it with a complete frame
348 */
349
350 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
351 struct msghdr *msg, size_t len)
352 {
353 struct sock *sk = sock->sk;
354 struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
355 struct sk_buff *skb;
356 struct net_device *dev;
357 __be16 proto=0;
358 int err;
359
360 /*
361 * Get and verify the address.
362 */
363
364 if (saddr)
365 {
366 if (msg->msg_namelen < sizeof(struct sockaddr))
367 return(-EINVAL);
368 if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
369 proto=saddr->spkt_protocol;
370 }
371 else
372 return(-ENOTCONN); /* SOCK_PACKET must be sent giving an address */
373
374 /*
375 * Find the device first to size check it
376 */
377
378 saddr->spkt_device[13] = 0;
379 dev = dev_get_by_name(sock_net(sk), saddr->spkt_device);
380 err = -ENODEV;
381 if (dev == NULL)
382 goto out_unlock;
383
384 err = -ENETDOWN;
385 if (!(dev->flags & IFF_UP))
386 goto out_unlock;
387
388 /*
389 * You may not queue a frame bigger than the mtu. This is the lowest level
390 * raw protocol and you must do your own fragmentation at this level.
391 */
392
393 err = -EMSGSIZE;
394 if (len > dev->mtu + dev->hard_header_len)
395 goto out_unlock;
396
397 err = -ENOBUFS;
398 skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
399
400 /*
401 * If the write buffer is full, then tough. At this level the user gets to
402 * deal with the problem - do your own algorithmic backoffs. That's far
403 * more flexible.
404 */
405
406 if (skb == NULL)
407 goto out_unlock;
408
409 /*
410 * Fill it in
411 */
412
413 /* FIXME: Save some space for broken drivers that write a
414 * hard header at transmission time by themselves. PPP is the
415 * notable one here. This should really be fixed at the driver level.
416 */
417 skb_reserve(skb, LL_RESERVED_SPACE(dev));
418 skb_reset_network_header(skb);
419
420 /* Try to align data part correctly */
421 if (dev->header_ops) {
422 skb->data -= dev->hard_header_len;
423 skb->tail -= dev->hard_header_len;
424 if (len < dev->hard_header_len)
425 skb_reset_network_header(skb);
426 }
427
428 /* Returns -EFAULT on error */
429 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
430 skb->protocol = proto;
431 skb->dev = dev;
432 skb->priority = sk->sk_priority;
433 if (err)
434 goto out_free;
435
436 /*
437 * Now send it
438 */
439
440 dev_queue_xmit(skb);
441 dev_put(dev);
442 return(len);
443
444 out_free:
445 kfree_skb(skb);
446 out_unlock:
447 if (dev)
448 dev_put(dev);
449 return err;
450 }
451
452 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
453 unsigned int res)
454 {
455 struct sk_filter *filter;
456
457 rcu_read_lock_bh();
458 filter = rcu_dereference(sk->sk_filter);
459 if (filter != NULL)
460 res = sk_run_filter(skb, filter->insns, filter->len);
461 rcu_read_unlock_bh();
462
463 return res;
464 }
465
466 /*
467 This function makes lazy skb cloning in hope that most of packets
468 are discarded by BPF.
469
470 Note tricky part: we DO mangle shared skb! skb->data, skb->len
471 and skb->cb are mangled. It works because (and until) packets
472 falling here are owned by current CPU. Output packets are cloned
473 by dev_queue_xmit_nit(), input packets are processed by net_bh
474 sequencially, so that if we return skb to original state on exit,
475 we will not harm anyone.
476 */
477
478 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
479 {
480 struct sock *sk;
481 struct sockaddr_ll *sll;
482 struct packet_sock *po;
483 u8 * skb_head = skb->data;
484 int skb_len = skb->len;
485 unsigned int snaplen, res;
486
487 if (skb->pkt_type == PACKET_LOOPBACK)
488 goto drop;
489
490 sk = pt->af_packet_priv;
491 po = pkt_sk(sk);
492
493 if (dev_net(dev) != sock_net(sk))
494 goto drop;
495
496 skb->dev = dev;
497
498 if (dev->header_ops) {
499 /* The device has an explicit notion of ll header,
500 exported to higher levels.
501
502 Otherwise, the device hides datails of it frame
503 structure, so that corresponding packet head
504 never delivered to user.
505 */
506 if (sk->sk_type != SOCK_DGRAM)
507 skb_push(skb, skb->data - skb_mac_header(skb));
508 else if (skb->pkt_type == PACKET_OUTGOING) {
509 /* Special case: outgoing packets have ll header at head */
510 skb_pull(skb, skb_network_offset(skb));
511 }
512 }
513
514 snaplen = skb->len;
515
516 res = run_filter(skb, sk, snaplen);
517 if (!res)
518 goto drop_n_restore;
519 if (snaplen > res)
520 snaplen = res;
521
522 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
523 (unsigned)sk->sk_rcvbuf)
524 goto drop_n_acct;
525
526 if (skb_shared(skb)) {
527 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
528 if (nskb == NULL)
529 goto drop_n_acct;
530
531 if (skb_head != skb->data) {
532 skb->data = skb_head;
533 skb->len = skb_len;
534 }
535 kfree_skb(skb);
536 skb = nskb;
537 }
538
539 BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
540 sizeof(skb->cb));
541
542 sll = &PACKET_SKB_CB(skb)->sa.ll;
543 sll->sll_family = AF_PACKET;
544 sll->sll_hatype = dev->type;
545 sll->sll_protocol = skb->protocol;
546 sll->sll_pkttype = skb->pkt_type;
547 if (unlikely(po->origdev))
548 sll->sll_ifindex = orig_dev->ifindex;
549 else
550 sll->sll_ifindex = dev->ifindex;
551
552 sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
553
554 PACKET_SKB_CB(skb)->origlen = skb->len;
555
556 if (pskb_trim(skb, snaplen))
557 goto drop_n_acct;
558
559 skb_set_owner_r(skb, sk);
560 skb->dev = NULL;
561 dst_release(skb->dst);
562 skb->dst = NULL;
563
564 /* drop conntrack reference */
565 nf_reset(skb);
566
567 spin_lock(&sk->sk_receive_queue.lock);
568 po->stats.tp_packets++;
569 __skb_queue_tail(&sk->sk_receive_queue, skb);
570 spin_unlock(&sk->sk_receive_queue.lock);
571 sk->sk_data_ready(sk, skb->len);
572 return 0;
573
574 drop_n_acct:
575 spin_lock(&sk->sk_receive_queue.lock);
576 po->stats.tp_drops++;
577 spin_unlock(&sk->sk_receive_queue.lock);
578
579 drop_n_restore:
580 if (skb_head != skb->data && skb_shared(skb)) {
581 skb->data = skb_head;
582 skb->len = skb_len;
583 }
584 drop:
585 kfree_skb(skb);
586 return 0;
587 }
588
589 #ifdef CONFIG_PACKET_MMAP
590 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
591 {
592 struct sock *sk;
593 struct packet_sock *po;
594 struct sockaddr_ll *sll;
595 union {
596 struct tpacket_hdr *h1;
597 struct tpacket2_hdr *h2;
598 void *raw;
599 } h;
600 u8 * skb_head = skb->data;
601 int skb_len = skb->len;
602 unsigned int snaplen, res;
603 unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
604 unsigned short macoff, netoff, hdrlen;
605 struct sk_buff *copy_skb = NULL;
606 struct timeval tv;
607 struct timespec ts;
608
609 if (skb->pkt_type == PACKET_LOOPBACK)
610 goto drop;
611
612 sk = pt->af_packet_priv;
613 po = pkt_sk(sk);
614
615 if (dev_net(dev) != sock_net(sk))
616 goto drop;
617
618 if (dev->header_ops) {
619 if (sk->sk_type != SOCK_DGRAM)
620 skb_push(skb, skb->data - skb_mac_header(skb));
621 else if (skb->pkt_type == PACKET_OUTGOING) {
622 /* Special case: outgoing packets have ll header at head */
623 skb_pull(skb, skb_network_offset(skb));
624 }
625 }
626
627 if (skb->ip_summed == CHECKSUM_PARTIAL)
628 status |= TP_STATUS_CSUMNOTREADY;
629
630 snaplen = skb->len;
631
632 res = run_filter(skb, sk, snaplen);
633 if (!res)
634 goto drop_n_restore;
635 if (snaplen > res)
636 snaplen = res;
637
638 if (sk->sk_type == SOCK_DGRAM) {
639 macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 +
640 po->tp_reserve;
641 } else {
642 unsigned maclen = skb_network_offset(skb);
643 netoff = TPACKET_ALIGN(po->tp_hdrlen +
644 (maclen < 16 ? 16 : maclen)) +
645 po->tp_reserve;
646 macoff = netoff - maclen;
647 }
648
649 if (macoff + snaplen > po->frame_size) {
650 if (po->copy_thresh &&
651 atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
652 (unsigned)sk->sk_rcvbuf) {
653 if (skb_shared(skb)) {
654 copy_skb = skb_clone(skb, GFP_ATOMIC);
655 } else {
656 copy_skb = skb_get(skb);
657 skb_head = skb->data;
658 }
659 if (copy_skb)
660 skb_set_owner_r(copy_skb, sk);
661 }
662 snaplen = po->frame_size - macoff;
663 if ((int)snaplen < 0)
664 snaplen = 0;
665 }
666
667 spin_lock(&sk->sk_receive_queue.lock);
668 h.raw = packet_lookup_frame(po, po->head, TP_STATUS_KERNEL);
669 if (!h.raw)
670 goto ring_is_full;
671 po->head = po->head != po->frame_max ? po->head+1 : 0;
672 po->stats.tp_packets++;
673 if (copy_skb) {
674 status |= TP_STATUS_COPY;
675 __skb_queue_tail(&sk->sk_receive_queue, copy_skb);
676 }
677 if (!po->stats.tp_drops)
678 status &= ~TP_STATUS_LOSING;
679 spin_unlock(&sk->sk_receive_queue.lock);
680
681 skb_copy_bits(skb, 0, h.raw + macoff, snaplen);
682
683 switch (po->tp_version) {
684 case TPACKET_V1:
685 h.h1->tp_len = skb->len;
686 h.h1->tp_snaplen = snaplen;
687 h.h1->tp_mac = macoff;
688 h.h1->tp_net = netoff;
689 if (skb->tstamp.tv64)
690 tv = ktime_to_timeval(skb->tstamp);
691 else
692 do_gettimeofday(&tv);
693 h.h1->tp_sec = tv.tv_sec;
694 h.h1->tp_usec = tv.tv_usec;
695 hdrlen = sizeof(*h.h1);
696 break;
697 case TPACKET_V2:
698 h.h2->tp_len = skb->len;
699 h.h2->tp_snaplen = snaplen;
700 h.h2->tp_mac = macoff;
701 h.h2->tp_net = netoff;
702 if (skb->tstamp.tv64)
703 ts = ktime_to_timespec(skb->tstamp);
704 else
705 getnstimeofday(&ts);
706 h.h2->tp_sec = ts.tv_sec;
707 h.h2->tp_nsec = ts.tv_nsec;
708 h.h2->tp_vlan_tci = skb->vlan_tci;
709 hdrlen = sizeof(*h.h2);
710 break;
711 default:
712 BUG();
713 }
714
715 sll = h.raw + TPACKET_ALIGN(hdrlen);
716 sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
717 sll->sll_family = AF_PACKET;
718 sll->sll_hatype = dev->type;
719 sll->sll_protocol = skb->protocol;
720 sll->sll_pkttype = skb->pkt_type;
721 if (unlikely(po->origdev))
722 sll->sll_ifindex = orig_dev->ifindex;
723 else
724 sll->sll_ifindex = dev->ifindex;
725
726 __packet_set_status(po, h.raw, status);
727 smp_mb();
728
729 {
730 struct page *p_start, *p_end;
731 u8 *h_end = h.raw + macoff + snaplen - 1;
732
733 p_start = virt_to_page(h.raw);
734 p_end = virt_to_page(h_end);
735 while (p_start <= p_end) {
736 flush_dcache_page(p_start);
737 p_start++;
738 }
739 }
740
741 sk->sk_data_ready(sk, 0);
742
743 drop_n_restore:
744 if (skb_head != skb->data && skb_shared(skb)) {
745 skb->data = skb_head;
746 skb->len = skb_len;
747 }
748 drop:
749 kfree_skb(skb);
750 return 0;
751
752 ring_is_full:
753 po->stats.tp_drops++;
754 spin_unlock(&sk->sk_receive_queue.lock);
755
756 sk->sk_data_ready(sk, 0);
757 if (copy_skb)
758 kfree_skb(copy_skb);
759 goto drop_n_restore;
760 }
761
762 #endif
763
764
765 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
766 struct msghdr *msg, size_t len)
767 {
768 struct sock *sk = sock->sk;
769 struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
770 struct sk_buff *skb;
771 struct net_device *dev;
772 __be16 proto;
773 unsigned char *addr;
774 int ifindex, err, reserve = 0;
775
776 /*
777 * Get and verify the address.
778 */
779
780 if (saddr == NULL) {
781 struct packet_sock *po = pkt_sk(sk);
782
783 ifindex = po->ifindex;
784 proto = po->num;
785 addr = NULL;
786 } else {
787 err = -EINVAL;
788 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
789 goto out;
790 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
791 goto out;
792 ifindex = saddr->sll_ifindex;
793 proto = saddr->sll_protocol;
794 addr = saddr->sll_addr;
795 }
796
797
798 dev = dev_get_by_index(sock_net(sk), ifindex);
799 err = -ENXIO;
800 if (dev == NULL)
801 goto out_unlock;
802 if (sock->type == SOCK_RAW)
803 reserve = dev->hard_header_len;
804
805 err = -ENETDOWN;
806 if (!(dev->flags & IFF_UP))
807 goto out_unlock;
808
809 err = -EMSGSIZE;
810 if (len > dev->mtu+reserve)
811 goto out_unlock;
812
813 skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
814 msg->msg_flags & MSG_DONTWAIT, &err);
815 if (skb==NULL)
816 goto out_unlock;
817
818 skb_reserve(skb, LL_RESERVED_SPACE(dev));
819 skb_reset_network_header(skb);
820
821 err = -EINVAL;
822 if (sock->type == SOCK_DGRAM &&
823 dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
824 goto out_free;
825
826 /* Returns -EFAULT on error */
827 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
828 if (err)
829 goto out_free;
830
831 skb->protocol = proto;
832 skb->dev = dev;
833 skb->priority = sk->sk_priority;
834
835 /*
836 * Now send it
837 */
838
839 err = dev_queue_xmit(skb);
840 if (err > 0 && (err = net_xmit_errno(err)) != 0)
841 goto out_unlock;
842
843 dev_put(dev);
844
845 return(len);
846
847 out_free:
848 kfree_skb(skb);
849 out_unlock:
850 if (dev)
851 dev_put(dev);
852 out:
853 return err;
854 }
855
856 /*
857 * Close a PACKET socket. This is fairly simple. We immediately go
858 * to 'closed' state and remove our protocol entry in the device list.
859 */
860
861 static int packet_release(struct socket *sock)
862 {
863 struct sock *sk = sock->sk;
864 struct packet_sock *po;
865 struct net *net;
866
867 if (!sk)
868 return 0;
869
870 net = sock_net(sk);
871 po = pkt_sk(sk);
872
873 write_lock_bh(&net->packet.sklist_lock);
874 sk_del_node_init(sk);
875 write_unlock_bh(&net->packet.sklist_lock);
876
877 /*
878 * Unhook packet receive handler.
879 */
880
881 if (po->running) {
882 /*
883 * Remove the protocol hook
884 */
885 dev_remove_pack(&po->prot_hook);
886 po->running = 0;
887 po->num = 0;
888 __sock_put(sk);
889 }
890
891 packet_flush_mclist(sk);
892
893 #ifdef CONFIG_PACKET_MMAP
894 if (po->pg_vec) {
895 struct tpacket_req req;
896 memset(&req, 0, sizeof(req));
897 packet_set_ring(sk, &req, 1);
898 }
899 #endif
900
901 /*
902 * Now the socket is dead. No more input will appear.
903 */
904
905 sock_orphan(sk);
906 sock->sk = NULL;
907
908 /* Purge queues */
909
910 skb_queue_purge(&sk->sk_receive_queue);
911 sk_refcnt_debug_release(sk);
912
913 sock_put(sk);
914 return 0;
915 }
916
917 /*
918 * Attach a packet hook.
919 */
920
921 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
922 {
923 struct packet_sock *po = pkt_sk(sk);
924 /*
925 * Detach an existing hook if present.
926 */
927
928 lock_sock(sk);
929
930 spin_lock(&po->bind_lock);
931 if (po->running) {
932 __sock_put(sk);
933 po->running = 0;
934 po->num = 0;
935 spin_unlock(&po->bind_lock);
936 dev_remove_pack(&po->prot_hook);
937 spin_lock(&po->bind_lock);
938 }
939
940 po->num = protocol;
941 po->prot_hook.type = protocol;
942 po->prot_hook.dev = dev;
943
944 po->ifindex = dev ? dev->ifindex : 0;
945
946 if (protocol == 0)
947 goto out_unlock;
948
949 if (!dev || (dev->flags & IFF_UP)) {
950 dev_add_pack(&po->prot_hook);
951 sock_hold(sk);
952 po->running = 1;
953 } else {
954 sk->sk_err = ENETDOWN;
955 if (!sock_flag(sk, SOCK_DEAD))
956 sk->sk_error_report(sk);
957 }
958
959 out_unlock:
960 spin_unlock(&po->bind_lock);
961 release_sock(sk);
962 return 0;
963 }
964
965 /*
966 * Bind a packet socket to a device
967 */
968
969 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
970 {
971 struct sock *sk=sock->sk;
972 char name[15];
973 struct net_device *dev;
974 int err = -ENODEV;
975
976 /*
977 * Check legality
978 */
979
980 if (addr_len != sizeof(struct sockaddr))
981 return -EINVAL;
982 strlcpy(name,uaddr->sa_data,sizeof(name));
983
984 dev = dev_get_by_name(sock_net(sk), name);
985 if (dev) {
986 err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
987 dev_put(dev);
988 }
989 return err;
990 }
991
992 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
993 {
994 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
995 struct sock *sk=sock->sk;
996 struct net_device *dev = NULL;
997 int err;
998
999
1000 /*
1001 * Check legality
1002 */
1003
1004 if (addr_len < sizeof(struct sockaddr_ll))
1005 return -EINVAL;
1006 if (sll->sll_family != AF_PACKET)
1007 return -EINVAL;
1008
1009 if (sll->sll_ifindex) {
1010 err = -ENODEV;
1011 dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex);
1012 if (dev == NULL)
1013 goto out;
1014 }
1015 err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
1016 if (dev)
1017 dev_put(dev);
1018
1019 out:
1020 return err;
1021 }
1022
1023 static struct proto packet_proto = {
1024 .name = "PACKET",
1025 .owner = THIS_MODULE,
1026 .obj_size = sizeof(struct packet_sock),
1027 };
1028
1029 /*
1030 * Create a packet of type SOCK_PACKET.
1031 */
1032
1033 static int packet_create(struct net *net, struct socket *sock, int protocol)
1034 {
1035 struct sock *sk;
1036 struct packet_sock *po;
1037 __be16 proto = (__force __be16)protocol; /* weird, but documented */
1038 int err;
1039
1040 if (!capable(CAP_NET_RAW))
1041 return -EPERM;
1042 if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
1043 sock->type != SOCK_PACKET)
1044 return -ESOCKTNOSUPPORT;
1045
1046 sock->state = SS_UNCONNECTED;
1047
1048 err = -ENOBUFS;
1049 sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto);
1050 if (sk == NULL)
1051 goto out;
1052
1053 sock->ops = &packet_ops;
1054 if (sock->type == SOCK_PACKET)
1055 sock->ops = &packet_ops_spkt;
1056
1057 sock_init_data(sock, sk);
1058
1059 po = pkt_sk(sk);
1060 sk->sk_family = PF_PACKET;
1061 po->num = proto;
1062
1063 sk->sk_destruct = packet_sock_destruct;
1064 sk_refcnt_debug_inc(sk);
1065
1066 /*
1067 * Attach a protocol block
1068 */
1069
1070 spin_lock_init(&po->bind_lock);
1071 po->prot_hook.func = packet_rcv;
1072
1073 if (sock->type == SOCK_PACKET)
1074 po->prot_hook.func = packet_rcv_spkt;
1075
1076 po->prot_hook.af_packet_priv = sk;
1077
1078 if (proto) {
1079 po->prot_hook.type = proto;
1080 dev_add_pack(&po->prot_hook);
1081 sock_hold(sk);
1082 po->running = 1;
1083 }
1084
1085 write_lock_bh(&net->packet.sklist_lock);
1086 sk_add_node(sk, &net->packet.sklist);
1087 write_unlock_bh(&net->packet.sklist_lock);
1088 return(0);
1089 out:
1090 return err;
1091 }
1092
1093 /*
1094 * Pull a packet from our receive queue and hand it to the user.
1095 * If necessary we block.
1096 */
1097
1098 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
1099 struct msghdr *msg, size_t len, int flags)
1100 {
1101 struct sock *sk = sock->sk;
1102 struct sk_buff *skb;
1103 int copied, err;
1104 struct sockaddr_ll *sll;
1105
1106 err = -EINVAL;
1107 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
1108 goto out;
1109
1110 #if 0
1111 /* What error should we return now? EUNATTACH? */
1112 if (pkt_sk(sk)->ifindex < 0)
1113 return -ENODEV;
1114 #endif
1115
1116 /*
1117 * Call the generic datagram receiver. This handles all sorts
1118 * of horrible races and re-entrancy so we can forget about it
1119 * in the protocol layers.
1120 *
1121 * Now it will return ENETDOWN, if device have just gone down,
1122 * but then it will block.
1123 */
1124
1125 skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
1126
1127 /*
1128 * An error occurred so return it. Because skb_recv_datagram()
1129 * handles the blocking we don't see and worry about blocking
1130 * retries.
1131 */
1132
1133 if (skb == NULL)
1134 goto out;
1135
1136 /*
1137 * If the address length field is there to be filled in, we fill
1138 * it in now.
1139 */
1140
1141 sll = &PACKET_SKB_CB(skb)->sa.ll;
1142 if (sock->type == SOCK_PACKET)
1143 msg->msg_namelen = sizeof(struct sockaddr_pkt);
1144 else
1145 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
1146
1147 /*
1148 * You lose any data beyond the buffer you gave. If it worries a
1149 * user program they can ask the device for its MTU anyway.
1150 */
1151
1152 copied = skb->len;
1153 if (copied > len)
1154 {
1155 copied=len;
1156 msg->msg_flags|=MSG_TRUNC;
1157 }
1158
1159 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1160 if (err)
1161 goto out_free;
1162
1163 sock_recv_timestamp(msg, sk, skb);
1164
1165 if (msg->msg_name)
1166 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
1167 msg->msg_namelen);
1168
1169 if (pkt_sk(sk)->auxdata) {
1170 struct tpacket_auxdata aux;
1171
1172 aux.tp_status = TP_STATUS_USER;
1173 if (skb->ip_summed == CHECKSUM_PARTIAL)
1174 aux.tp_status |= TP_STATUS_CSUMNOTREADY;
1175 aux.tp_len = PACKET_SKB_CB(skb)->origlen;
1176 aux.tp_snaplen = skb->len;
1177 aux.tp_mac = 0;
1178 aux.tp_net = skb_network_offset(skb);
1179 aux.tp_vlan_tci = skb->vlan_tci;
1180
1181 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
1182 }
1183
1184 /*
1185 * Free or return the buffer as appropriate. Again this
1186 * hides all the races and re-entrancy issues from us.
1187 */
1188 err = (flags&MSG_TRUNC) ? skb->len : copied;
1189
1190 out_free:
1191 skb_free_datagram(sk, skb);
1192 out:
1193 return err;
1194 }
1195
1196 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
1197 int *uaddr_len, int peer)
1198 {
1199 struct net_device *dev;
1200 struct sock *sk = sock->sk;
1201
1202 if (peer)
1203 return -EOPNOTSUPP;
1204
1205 uaddr->sa_family = AF_PACKET;
1206 dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
1207 if (dev) {
1208 strlcpy(uaddr->sa_data, dev->name, 15);
1209 dev_put(dev);
1210 } else
1211 memset(uaddr->sa_data, 0, 14);
1212 *uaddr_len = sizeof(*uaddr);
1213
1214 return 0;
1215 }
1216
1217 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
1218 int *uaddr_len, int peer)
1219 {
1220 struct net_device *dev;
1221 struct sock *sk = sock->sk;
1222 struct packet_sock *po = pkt_sk(sk);
1223 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
1224
1225 if (peer)
1226 return -EOPNOTSUPP;
1227
1228 sll->sll_family = AF_PACKET;
1229 sll->sll_ifindex = po->ifindex;
1230 sll->sll_protocol = po->num;
1231 dev = dev_get_by_index(sock_net(sk), po->ifindex);
1232 if (dev) {
1233 sll->sll_hatype = dev->type;
1234 sll->sll_halen = dev->addr_len;
1235 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
1236 dev_put(dev);
1237 } else {
1238 sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */
1239 sll->sll_halen = 0;
1240 }
1241 *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
1242
1243 return 0;
1244 }
1245
1246 static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
1247 int what)
1248 {
1249 switch (i->type) {
1250 case PACKET_MR_MULTICAST:
1251 if (what > 0)
1252 dev_mc_add(dev, i->addr, i->alen, 0);
1253 else
1254 dev_mc_delete(dev, i->addr, i->alen, 0);
1255 break;
1256 case PACKET_MR_PROMISC:
1257 return dev_set_promiscuity(dev, what);
1258 break;
1259 case PACKET_MR_ALLMULTI:
1260 return dev_set_allmulti(dev, what);
1261 break;
1262 default:;
1263 }
1264 return 0;
1265 }
1266
1267 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
1268 {
1269 for ( ; i; i=i->next) {
1270 if (i->ifindex == dev->ifindex)
1271 packet_dev_mc(dev, i, what);
1272 }
1273 }
1274
1275 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
1276 {
1277 struct packet_sock *po = pkt_sk(sk);
1278 struct packet_mclist *ml, *i;
1279 struct net_device *dev;
1280 int err;
1281
1282 rtnl_lock();
1283
1284 err = -ENODEV;
1285 dev = __dev_get_by_index(sock_net(sk), mreq->mr_ifindex);
1286 if (!dev)
1287 goto done;
1288
1289 err = -EINVAL;
1290 if (mreq->mr_alen > dev->addr_len)
1291 goto done;
1292
1293 err = -ENOBUFS;
1294 i = kmalloc(sizeof(*i), GFP_KERNEL);
1295 if (i == NULL)
1296 goto done;
1297
1298 err = 0;
1299 for (ml = po->mclist; ml; ml = ml->next) {
1300 if (ml->ifindex == mreq->mr_ifindex &&
1301 ml->type == mreq->mr_type &&
1302 ml->alen == mreq->mr_alen &&
1303 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1304 ml->count++;
1305 /* Free the new element ... */
1306 kfree(i);
1307 goto done;
1308 }
1309 }
1310
1311 i->type = mreq->mr_type;
1312 i->ifindex = mreq->mr_ifindex;
1313 i->alen = mreq->mr_alen;
1314 memcpy(i->addr, mreq->mr_address, i->alen);
1315 i->count = 1;
1316 i->next = po->mclist;
1317 po->mclist = i;
1318 err = packet_dev_mc(dev, i, 1);
1319 if (err) {
1320 po->mclist = i->next;
1321 kfree(i);
1322 }
1323
1324 done:
1325 rtnl_unlock();
1326 return err;
1327 }
1328
1329 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
1330 {
1331 struct packet_mclist *ml, **mlp;
1332
1333 rtnl_lock();
1334
1335 for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) {
1336 if (ml->ifindex == mreq->mr_ifindex &&
1337 ml->type == mreq->mr_type &&
1338 ml->alen == mreq->mr_alen &&
1339 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) {
1340 if (--ml->count == 0) {
1341 struct net_device *dev;
1342 *mlp = ml->next;
1343 dev = dev_get_by_index(sock_net(sk), ml->ifindex);
1344 if (dev) {
1345 packet_dev_mc(dev, ml, -1);
1346 dev_put(dev);
1347 }
1348 kfree(ml);
1349 }
1350 rtnl_unlock();
1351 return 0;
1352 }
1353 }
1354 rtnl_unlock();
1355 return -EADDRNOTAVAIL;
1356 }
1357
1358 static void packet_flush_mclist(struct sock *sk)
1359 {
1360 struct packet_sock *po = pkt_sk(sk);
1361 struct packet_mclist *ml;
1362
1363 if (!po->mclist)
1364 return;
1365
1366 rtnl_lock();
1367 while ((ml = po->mclist) != NULL) {
1368 struct net_device *dev;
1369
1370 po->mclist = ml->next;
1371 if ((dev = dev_get_by_index(sock_net(sk), ml->ifindex)) != NULL) {
1372 packet_dev_mc(dev, ml, -1);
1373 dev_put(dev);
1374 }
1375 kfree(ml);
1376 }
1377 rtnl_unlock();
1378 }
1379
1380 static int
1381 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1382 {
1383 struct sock *sk = sock->sk;
1384 struct packet_sock *po = pkt_sk(sk);
1385 int ret;
1386
1387 if (level != SOL_PACKET)
1388 return -ENOPROTOOPT;
1389
1390 switch(optname) {
1391 case PACKET_ADD_MEMBERSHIP:
1392 case PACKET_DROP_MEMBERSHIP:
1393 {
1394 struct packet_mreq_max mreq;
1395 int len = optlen;
1396 memset(&mreq, 0, sizeof(mreq));
1397 if (len < sizeof(struct packet_mreq))
1398 return -EINVAL;
1399 if (len > sizeof(mreq))
1400 len = sizeof(mreq);
1401 if (copy_from_user(&mreq,optval,len))
1402 return -EFAULT;
1403 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
1404 return -EINVAL;
1405 if (optname == PACKET_ADD_MEMBERSHIP)
1406 ret = packet_mc_add(sk, &mreq);
1407 else
1408 ret = packet_mc_drop(sk, &mreq);
1409 return ret;
1410 }
1411
1412 #ifdef CONFIG_PACKET_MMAP
1413 case PACKET_RX_RING:
1414 {
1415 struct tpacket_req req;
1416
1417 if (optlen<sizeof(req))
1418 return -EINVAL;
1419 if (copy_from_user(&req,optval,sizeof(req)))
1420 return -EFAULT;
1421 return packet_set_ring(sk, &req, 0);
1422 }
1423 case PACKET_COPY_THRESH:
1424 {
1425 int val;
1426
1427 if (optlen!=sizeof(val))
1428 return -EINVAL;
1429 if (copy_from_user(&val,optval,sizeof(val)))
1430 return -EFAULT;
1431
1432 pkt_sk(sk)->copy_thresh = val;
1433 return 0;
1434 }
1435 case PACKET_VERSION:
1436 {
1437 int val;
1438
1439 if (optlen != sizeof(val))
1440 return -EINVAL;
1441 if (po->pg_vec)
1442 return -EBUSY;
1443 if (copy_from_user(&val, optval, sizeof(val)))
1444 return -EFAULT;
1445 switch (val) {
1446 case TPACKET_V1:
1447 case TPACKET_V2:
1448 po->tp_version = val;
1449 return 0;
1450 default:
1451 return -EINVAL;
1452 }
1453 }
1454 case PACKET_RESERVE:
1455 {
1456 unsigned int val;
1457
1458 if (optlen != sizeof(val))
1459 return -EINVAL;
1460 if (po->pg_vec)
1461 return -EBUSY;
1462 if (copy_from_user(&val, optval, sizeof(val)))
1463 return -EFAULT;
1464 po->tp_reserve = val;
1465 return 0;
1466 }
1467 #endif
1468 case PACKET_AUXDATA:
1469 {
1470 int val;
1471
1472 if (optlen < sizeof(val))
1473 return -EINVAL;
1474 if (copy_from_user(&val, optval, sizeof(val)))
1475 return -EFAULT;
1476
1477 po->auxdata = !!val;
1478 return 0;
1479 }
1480 case PACKET_ORIGDEV:
1481 {
1482 int val;
1483
1484 if (optlen < sizeof(val))
1485 return -EINVAL;
1486 if (copy_from_user(&val, optval, sizeof(val)))
1487 return -EFAULT;
1488
1489 po->origdev = !!val;
1490 return 0;
1491 }
1492 default:
1493 return -ENOPROTOOPT;
1494 }
1495 }
1496
1497 static int packet_getsockopt(struct socket *sock, int level, int optname,
1498 char __user *optval, int __user *optlen)
1499 {
1500 int len;
1501 int val;
1502 struct sock *sk = sock->sk;
1503 struct packet_sock *po = pkt_sk(sk);
1504 void *data;
1505 struct tpacket_stats st;
1506
1507 if (level != SOL_PACKET)
1508 return -ENOPROTOOPT;
1509
1510 if (get_user(len, optlen))
1511 return -EFAULT;
1512
1513 if (len < 0)
1514 return -EINVAL;
1515
1516 switch(optname) {
1517 case PACKET_STATISTICS:
1518 if (len > sizeof(struct tpacket_stats))
1519 len = sizeof(struct tpacket_stats);
1520 spin_lock_bh(&sk->sk_receive_queue.lock);
1521 st = po->stats;
1522 memset(&po->stats, 0, sizeof(st));
1523 spin_unlock_bh(&sk->sk_receive_queue.lock);
1524 st.tp_packets += st.tp_drops;
1525
1526 data = &st;
1527 break;
1528 case PACKET_AUXDATA:
1529 if (len > sizeof(int))
1530 len = sizeof(int);
1531 val = po->auxdata;
1532
1533 data = &val;
1534 break;
1535 case PACKET_ORIGDEV:
1536 if (len > sizeof(int))
1537 len = sizeof(int);
1538 val = po->origdev;
1539
1540 data = &val;
1541 break;
1542 #ifdef CONFIG_PACKET_MMAP
1543 case PACKET_VERSION:
1544 if (len > sizeof(int))
1545 len = sizeof(int);
1546 val = po->tp_version;
1547 data = &val;
1548 break;
1549 case PACKET_HDRLEN:
1550 if (len > sizeof(int))
1551 len = sizeof(int);
1552 if (copy_from_user(&val, optval, len))
1553 return -EFAULT;
1554 switch (val) {
1555 case TPACKET_V1:
1556 val = sizeof(struct tpacket_hdr);
1557 break;
1558 case TPACKET_V2:
1559 val = sizeof(struct tpacket2_hdr);
1560 break;
1561 default:
1562 return -EINVAL;
1563 }
1564 data = &val;
1565 break;
1566 case PACKET_RESERVE:
1567 if (len > sizeof(unsigned int))
1568 len = sizeof(unsigned int);
1569 val = po->tp_reserve;
1570 data = &val;
1571 break;
1572 #endif
1573 default:
1574 return -ENOPROTOOPT;
1575 }
1576
1577 if (put_user(len, optlen))
1578 return -EFAULT;
1579 if (copy_to_user(optval, data, len))
1580 return -EFAULT;
1581 return 0;
1582 }
1583
1584
1585 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data)
1586 {
1587 struct sock *sk;
1588 struct hlist_node *node;
1589 struct net_device *dev = data;
1590 struct net *net = dev_net(dev);
1591
1592 read_lock(&net->packet.sklist_lock);
1593 sk_for_each(sk, node, &net->packet.sklist) {
1594 struct packet_sock *po = pkt_sk(sk);
1595
1596 switch (msg) {
1597 case NETDEV_UNREGISTER:
1598 if (po->mclist)
1599 packet_dev_mclist(dev, po->mclist, -1);
1600 /* fallthrough */
1601
1602 case NETDEV_DOWN:
1603 if (dev->ifindex == po->ifindex) {
1604 spin_lock(&po->bind_lock);
1605 if (po->running) {
1606 __dev_remove_pack(&po->prot_hook);
1607 __sock_put(sk);
1608 po->running = 0;
1609 sk->sk_err = ENETDOWN;
1610 if (!sock_flag(sk, SOCK_DEAD))
1611 sk->sk_error_report(sk);
1612 }
1613 if (msg == NETDEV_UNREGISTER) {
1614 po->ifindex = -1;
1615 po->prot_hook.dev = NULL;
1616 }
1617 spin_unlock(&po->bind_lock);
1618 }
1619 break;
1620 case NETDEV_UP:
1621 spin_lock(&po->bind_lock);
1622 if (dev->ifindex == po->ifindex && po->num &&
1623 !po->running) {
1624 dev_add_pack(&po->prot_hook);
1625 sock_hold(sk);
1626 po->running = 1;
1627 }
1628 spin_unlock(&po->bind_lock);
1629 break;
1630 }
1631 }
1632 read_unlock(&net->packet.sklist_lock);
1633 return NOTIFY_DONE;
1634 }
1635
1636
1637 static int packet_ioctl(struct socket *sock, unsigned int cmd,
1638 unsigned long arg)
1639 {
1640 struct sock *sk = sock->sk;
1641
1642 switch(cmd) {
1643 case SIOCOUTQ:
1644 {
1645 int amount = atomic_read(&sk->sk_wmem_alloc);
1646 return put_user(amount, (int __user *)arg);
1647 }
1648 case SIOCINQ:
1649 {
1650 struct sk_buff *skb;
1651 int amount = 0;
1652
1653 spin_lock_bh(&sk->sk_receive_queue.lock);
1654 skb = skb_peek(&sk->sk_receive_queue);
1655 if (skb)
1656 amount = skb->len;
1657 spin_unlock_bh(&sk->sk_receive_queue.lock);
1658 return put_user(amount, (int __user *)arg);
1659 }
1660 case SIOCGSTAMP:
1661 return sock_get_timestamp(sk, (struct timeval __user *)arg);
1662 case SIOCGSTAMPNS:
1663 return sock_get_timestampns(sk, (struct timespec __user *)arg);
1664
1665 #ifdef CONFIG_INET
1666 case SIOCADDRT:
1667 case SIOCDELRT:
1668 case SIOCDARP:
1669 case SIOCGARP:
1670 case SIOCSARP:
1671 case SIOCGIFADDR:
1672 case SIOCSIFADDR:
1673 case SIOCGIFBRDADDR:
1674 case SIOCSIFBRDADDR:
1675 case SIOCGIFNETMASK:
1676 case SIOCSIFNETMASK:
1677 case SIOCGIFDSTADDR:
1678 case SIOCSIFDSTADDR:
1679 case SIOCSIFFLAGS:
1680 if (!net_eq(sock_net(sk), &init_net))
1681 return -ENOIOCTLCMD;
1682 return inet_dgram_ops.ioctl(sock, cmd, arg);
1683 #endif
1684
1685 default:
1686 return -ENOIOCTLCMD;
1687 }
1688 return 0;
1689 }
1690
1691 #ifndef CONFIG_PACKET_MMAP
1692 #define packet_mmap sock_no_mmap
1693 #define packet_poll datagram_poll
1694 #else
1695
1696 static unsigned int packet_poll(struct file * file, struct socket *sock,
1697 poll_table *wait)
1698 {
1699 struct sock *sk = sock->sk;
1700 struct packet_sock *po = pkt_sk(sk);
1701 unsigned int mask = datagram_poll(file, sock, wait);
1702
1703 spin_lock_bh(&sk->sk_receive_queue.lock);
1704 if (po->pg_vec) {
1705 unsigned last = po->head ? po->head-1 : po->frame_max;
1706
1707 if (packet_lookup_frame(po, last, TP_STATUS_USER))
1708 mask |= POLLIN | POLLRDNORM;
1709 }
1710 spin_unlock_bh(&sk->sk_receive_queue.lock);
1711 return mask;
1712 }
1713
1714
1715 /* Dirty? Well, I still did not learn better way to account
1716 * for user mmaps.
1717 */
1718
1719 static void packet_mm_open(struct vm_area_struct *vma)
1720 {
1721 struct file *file = vma->vm_file;
1722 struct socket * sock = file->private_data;
1723 struct sock *sk = sock->sk;
1724
1725 if (sk)
1726 atomic_inc(&pkt_sk(sk)->mapped);
1727 }
1728
1729 static void packet_mm_close(struct vm_area_struct *vma)
1730 {
1731 struct file *file = vma->vm_file;
1732 struct socket * sock = file->private_data;
1733 struct sock *sk = sock->sk;
1734
1735 if (sk)
1736 atomic_dec(&pkt_sk(sk)->mapped);
1737 }
1738
1739 static struct vm_operations_struct packet_mmap_ops = {
1740 .open = packet_mm_open,
1741 .close =packet_mm_close,
1742 };
1743
1744 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
1745 {
1746 int i;
1747
1748 for (i = 0; i < len; i++) {
1749 if (likely(pg_vec[i]))
1750 free_pages((unsigned long) pg_vec[i], order);
1751 }
1752 kfree(pg_vec);
1753 }
1754
1755 static inline char *alloc_one_pg_vec_page(unsigned long order)
1756 {
1757 return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO,
1758 order);
1759 }
1760
1761 static char **alloc_pg_vec(struct tpacket_req *req, int order)
1762 {
1763 unsigned int block_nr = req->tp_block_nr;
1764 char **pg_vec;
1765 int i;
1766
1767 pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL);
1768 if (unlikely(!pg_vec))
1769 goto out;
1770
1771 for (i = 0; i < block_nr; i++) {
1772 pg_vec[i] = alloc_one_pg_vec_page(order);
1773 if (unlikely(!pg_vec[i]))
1774 goto out_free_pgvec;
1775 }
1776
1777 out:
1778 return pg_vec;
1779
1780 out_free_pgvec:
1781 free_pg_vec(pg_vec, order, block_nr);
1782 pg_vec = NULL;
1783 goto out;
1784 }
1785
1786 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
1787 {
1788 char **pg_vec = NULL;
1789 struct packet_sock *po = pkt_sk(sk);
1790 int was_running, order = 0;
1791 __be16 num;
1792 int err = 0;
1793
1794 if (req->tp_block_nr) {
1795 int i;
1796
1797 /* Sanity tests and some calculations */
1798
1799 if (unlikely(po->pg_vec))
1800 return -EBUSY;
1801
1802 switch (po->tp_version) {
1803 case TPACKET_V1:
1804 po->tp_hdrlen = TPACKET_HDRLEN;
1805 break;
1806 case TPACKET_V2:
1807 po->tp_hdrlen = TPACKET2_HDRLEN;
1808 break;
1809 }
1810
1811 if (unlikely((int)req->tp_block_size <= 0))
1812 return -EINVAL;
1813 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
1814 return -EINVAL;
1815 if (unlikely(req->tp_frame_size < po->tp_hdrlen +
1816 po->tp_reserve))
1817 return -EINVAL;
1818 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
1819 return -EINVAL;
1820
1821 po->frames_per_block = req->tp_block_size/req->tp_frame_size;
1822 if (unlikely(po->frames_per_block <= 0))
1823 return -EINVAL;
1824 if (unlikely((po->frames_per_block * req->tp_block_nr) !=
1825 req->tp_frame_nr))
1826 return -EINVAL;
1827
1828 err = -ENOMEM;
1829 order = get_order(req->tp_block_size);
1830 pg_vec = alloc_pg_vec(req, order);
1831 if (unlikely(!pg_vec))
1832 goto out;
1833
1834 for (i = 0; i < req->tp_block_nr; i++) {
1835 void *ptr = pg_vec[i];
1836 int k;
1837
1838 for (k = 0; k < po->frames_per_block; k++) {
1839 __packet_set_status(po, ptr, TP_STATUS_KERNEL);
1840 ptr += req->tp_frame_size;
1841 }
1842 }
1843 /* Done */
1844 } else {
1845 if (unlikely(req->tp_frame_nr))
1846 return -EINVAL;
1847 }
1848
1849 lock_sock(sk);
1850
1851 /* Detach socket from network */
1852 spin_lock(&po->bind_lock);
1853 was_running = po->running;
1854 num = po->num;
1855 if (was_running) {
1856 __dev_remove_pack(&po->prot_hook);
1857 po->num = 0;
1858 po->running = 0;
1859 __sock_put(sk);
1860 }
1861 spin_unlock(&po->bind_lock);
1862
1863 synchronize_net();
1864
1865 err = -EBUSY;
1866 if (closing || atomic_read(&po->mapped) == 0) {
1867 err = 0;
1868 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
1869
1870 spin_lock_bh(&sk->sk_receive_queue.lock);
1871 pg_vec = XC(po->pg_vec, pg_vec);
1872 po->frame_max = (req->tp_frame_nr - 1);
1873 po->head = 0;
1874 po->frame_size = req->tp_frame_size;
1875 spin_unlock_bh(&sk->sk_receive_queue.lock);
1876
1877 order = XC(po->pg_vec_order, order);
1878 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
1879
1880 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
1881 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
1882 skb_queue_purge(&sk->sk_receive_queue);
1883 #undef XC
1884 if (atomic_read(&po->mapped))
1885 printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
1886 }
1887
1888 spin_lock(&po->bind_lock);
1889 if (was_running && !po->running) {
1890 sock_hold(sk);
1891 po->running = 1;
1892 po->num = num;
1893 dev_add_pack(&po->prot_hook);
1894 }
1895 spin_unlock(&po->bind_lock);
1896
1897 release_sock(sk);
1898
1899 if (pg_vec)
1900 free_pg_vec(pg_vec, order, req->tp_block_nr);
1901 out:
1902 return err;
1903 }
1904
1905 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
1906 {
1907 struct sock *sk = sock->sk;
1908 struct packet_sock *po = pkt_sk(sk);
1909 unsigned long size;
1910 unsigned long start;
1911 int err = -EINVAL;
1912 int i;
1913
1914 if (vma->vm_pgoff)
1915 return -EINVAL;
1916
1917 size = vma->vm_end - vma->vm_start;
1918
1919 lock_sock(sk);
1920 if (po->pg_vec == NULL)
1921 goto out;
1922 if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
1923 goto out;
1924
1925 start = vma->vm_start;
1926 for (i = 0; i < po->pg_vec_len; i++) {
1927 struct page *page = virt_to_page(po->pg_vec[i]);
1928 int pg_num;
1929
1930 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
1931 err = vm_insert_page(vma, start, page);
1932 if (unlikely(err))
1933 goto out;
1934 start += PAGE_SIZE;
1935 }
1936 }
1937 atomic_inc(&po->mapped);
1938 vma->vm_ops = &packet_mmap_ops;
1939 err = 0;
1940
1941 out:
1942 release_sock(sk);
1943 return err;
1944 }
1945 #endif
1946
1947
1948 static const struct proto_ops packet_ops_spkt = {
1949 .family = PF_PACKET,
1950 .owner = THIS_MODULE,
1951 .release = packet_release,
1952 .bind = packet_bind_spkt,
1953 .connect = sock_no_connect,
1954 .socketpair = sock_no_socketpair,
1955 .accept = sock_no_accept,
1956 .getname = packet_getname_spkt,
1957 .poll = datagram_poll,
1958 .ioctl = packet_ioctl,
1959 .listen = sock_no_listen,
1960 .shutdown = sock_no_shutdown,
1961 .setsockopt = sock_no_setsockopt,
1962 .getsockopt = sock_no_getsockopt,
1963 .sendmsg = packet_sendmsg_spkt,
1964 .recvmsg = packet_recvmsg,
1965 .mmap = sock_no_mmap,
1966 .sendpage = sock_no_sendpage,
1967 };
1968
1969 static const struct proto_ops packet_ops = {
1970 .family = PF_PACKET,
1971 .owner = THIS_MODULE,
1972 .release = packet_release,
1973 .bind = packet_bind,
1974 .connect = sock_no_connect,
1975 .socketpair = sock_no_socketpair,
1976 .accept = sock_no_accept,
1977 .getname = packet_getname,
1978 .poll = packet_poll,
1979 .ioctl = packet_ioctl,
1980 .listen = sock_no_listen,
1981 .shutdown = sock_no_shutdown,
1982 .setsockopt = packet_setsockopt,
1983 .getsockopt = packet_getsockopt,
1984 .sendmsg = packet_sendmsg,
1985 .recvmsg = packet_recvmsg,
1986 .mmap = packet_mmap,
1987 .sendpage = sock_no_sendpage,
1988 };
1989
1990 static struct net_proto_family packet_family_ops = {
1991 .family = PF_PACKET,
1992 .create = packet_create,
1993 .owner = THIS_MODULE,
1994 };
1995
1996 static struct notifier_block packet_netdev_notifier = {
1997 .notifier_call =packet_notifier,
1998 };
1999
2000 #ifdef CONFIG_PROC_FS
2001 static inline struct sock *packet_seq_idx(struct net *net, loff_t off)
2002 {
2003 struct sock *s;
2004 struct hlist_node *node;
2005
2006 sk_for_each(s, node, &net->packet.sklist) {
2007 if (!off--)
2008 return s;
2009 }
2010 return NULL;
2011 }
2012
2013 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
2014 __acquires(seq_file_net(seq)->packet.sklist_lock)
2015 {
2016 struct net *net = seq_file_net(seq);
2017 read_lock(&net->packet.sklist_lock);
2018 return *pos ? packet_seq_idx(net, *pos - 1) : SEQ_START_TOKEN;
2019 }
2020
2021 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2022 {
2023 struct net *net = seq_file_net(seq);
2024 ++*pos;
2025 return (v == SEQ_START_TOKEN)
2026 ? sk_head(&net->packet.sklist)
2027 : sk_next((struct sock*)v) ;
2028 }
2029
2030 static void packet_seq_stop(struct seq_file *seq, void *v)
2031 __releases(seq_file_net(seq)->packet.sklist_lock)
2032 {
2033 struct net *net = seq_file_net(seq);
2034 read_unlock(&net->packet.sklist_lock);
2035 }
2036
2037 static int packet_seq_show(struct seq_file *seq, void *v)
2038 {
2039 if (v == SEQ_START_TOKEN)
2040 seq_puts(seq, "sk RefCnt Type Proto Iface R Rmem User Inode\n");
2041 else {
2042 struct sock *s = v;
2043 const struct packet_sock *po = pkt_sk(s);
2044
2045 seq_printf(seq,
2046 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
2047 s,
2048 atomic_read(&s->sk_refcnt),
2049 s->sk_type,
2050 ntohs(po->num),
2051 po->ifindex,
2052 po->running,
2053 atomic_read(&s->sk_rmem_alloc),
2054 sock_i_uid(s),
2055 sock_i_ino(s) );
2056 }
2057
2058 return 0;
2059 }
2060
2061 static const struct seq_operations packet_seq_ops = {
2062 .start = packet_seq_start,
2063 .next = packet_seq_next,
2064 .stop = packet_seq_stop,
2065 .show = packet_seq_show,
2066 };
2067
2068 static int packet_seq_open(struct inode *inode, struct file *file)
2069 {
2070 return seq_open_net(inode, file, &packet_seq_ops,
2071 sizeof(struct seq_net_private));
2072 }
2073
2074 static const struct file_operations packet_seq_fops = {
2075 .owner = THIS_MODULE,
2076 .open = packet_seq_open,
2077 .read = seq_read,
2078 .llseek = seq_lseek,
2079 .release = seq_release_net,
2080 };
2081
2082 #endif
2083
2084 static int packet_net_init(struct net *net)
2085 {
2086 rwlock_init(&net->packet.sklist_lock);
2087 INIT_HLIST_HEAD(&net->packet.sklist);
2088
2089 if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
2090 return -ENOMEM;
2091
2092 return 0;
2093 }
2094
2095 static void packet_net_exit(struct net *net)
2096 {
2097 proc_net_remove(net, "packet");
2098 }
2099
2100 static struct pernet_operations packet_net_ops = {
2101 .init = packet_net_init,
2102 .exit = packet_net_exit,
2103 };
2104
2105
2106 static void __exit packet_exit(void)
2107 {
2108 unregister_netdevice_notifier(&packet_netdev_notifier);
2109 unregister_pernet_subsys(&packet_net_ops);
2110 sock_unregister(PF_PACKET);
2111 proto_unregister(&packet_proto);
2112 }
2113
2114 static int __init packet_init(void)
2115 {
2116 int rc = proto_register(&packet_proto, 0);
2117
2118 if (rc != 0)
2119 goto out;
2120
2121 sock_register(&packet_family_ops);
2122 register_pernet_subsys(&packet_net_ops);
2123 register_netdevice_notifier(&packet_netdev_notifier);
2124 out:
2125 return rc;
2126 }
2127
2128 module_init(packet_init);
2129 module_exit(packet_exit);
2130 MODULE_LICENSE("GPL");
2131 MODULE_ALIAS_NETPROTO(PF_PACKET);
linux-next