macvlan: Fix potential use-after free for broadcasts
[linux/fpc-iii.git] / net / tipc / subscr.c
blob0dd02244e21d72b8e53e371d51eeae53e4b15a41
1 /*
2 * net/tipc/subscr.c: TIPC network topology service
4 * Copyright (c) 2000-2006, Ericsson AB
5 * Copyright (c) 2005-2007, 2010-2013, Wind River Systems
6 * All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the names of the copyright holders nor the names of its
17 * contributors may be used to endorse or promote products derived from
18 * this software without specific prior written permission.
20 * Alternatively, this software may be distributed under the terms of the
21 * GNU General Public License ("GPL") version 2 as published by the Free
22 * Software Foundation.
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
37 #include "core.h"
38 #include "name_table.h"
39 #include "subscr.h"
41 /**
42 * struct tipc_subscriber - TIPC network topology subscriber
43 * @kref: reference counter to tipc_subscription object
44 * @conid: connection identifier to server connecting to subscriber
45 * @lock: control access to subscriber
46 * @subscrp_list: list of subscription objects for this subscriber
48 struct tipc_subscriber {
49 struct kref kref;
50 int conid;
51 spinlock_t lock;
52 struct list_head subscrp_list;
55 static void tipc_subscrp_delete(struct tipc_subscription *sub);
56 static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
58 /**
59 * htohl - convert value to endianness used by destination
60 * @in: value to convert
61 * @swap: non-zero if endianness must be reversed
63 * Returns converted value
65 static u32 htohl(u32 in, int swap)
67 return swap ? swab32(in) : in;
70 static void tipc_subscrp_send_event(struct tipc_subscription *sub,
71 u32 found_lower, u32 found_upper,
72 u32 event, u32 port_ref, u32 node)
74 struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
75 struct tipc_subscriber *subscriber = sub->subscriber;
76 struct kvec msg_sect;
78 msg_sect.iov_base = (void *)&sub->evt;
79 msg_sect.iov_len = sizeof(struct tipc_event);
80 sub->evt.event = htohl(event, sub->swap);
81 sub->evt.found_lower = htohl(found_lower, sub->swap);
82 sub->evt.found_upper = htohl(found_upper, sub->swap);
83 sub->evt.port.ref = htohl(port_ref, sub->swap);
84 sub->evt.port.node = htohl(node, sub->swap);
85 tipc_conn_sendmsg(tn->topsrv, subscriber->conid, NULL,
86 msg_sect.iov_base, msg_sect.iov_len);
89 /**
90 * tipc_subscrp_check_overlap - test for subscription overlap with the
91 * given values
93 * Returns 1 if there is overlap, otherwise 0.
95 int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
96 u32 found_upper)
98 if (found_lower < seq->lower)
99 found_lower = seq->lower;
100 if (found_upper > seq->upper)
101 found_upper = seq->upper;
102 if (found_lower > found_upper)
103 return 0;
104 return 1;
107 u32 tipc_subscrp_convert_seq_type(u32 type, int swap)
109 return htohl(type, swap);
112 void tipc_subscrp_convert_seq(struct tipc_name_seq *in, int swap,
113 struct tipc_name_seq *out)
115 out->type = htohl(in->type, swap);
116 out->lower = htohl(in->lower, swap);
117 out->upper = htohl(in->upper, swap);
120 void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
121 u32 found_upper, u32 event, u32 port_ref,
122 u32 node, int must)
124 struct tipc_name_seq seq;
126 tipc_subscrp_convert_seq(&sub->evt.s.seq, sub->swap, &seq);
127 if (!tipc_subscrp_check_overlap(&seq, found_lower, found_upper))
128 return;
129 if (!must &&
130 !(htohl(sub->evt.s.filter, sub->swap) & TIPC_SUB_PORTS))
131 return;
133 tipc_subscrp_send_event(sub, found_lower, found_upper, event, port_ref,
134 node);
137 static void tipc_subscrp_timeout(unsigned long data)
139 struct tipc_subscription *sub = (struct tipc_subscription *)data;
140 struct tipc_subscriber *subscriber = sub->subscriber;
142 /* Notify subscriber of timeout */
143 tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
144 TIPC_SUBSCR_TIMEOUT, 0, 0);
146 spin_lock_bh(&subscriber->lock);
147 tipc_subscrp_delete(sub);
148 spin_unlock_bh(&subscriber->lock);
150 tipc_subscrb_put(subscriber);
153 static void tipc_subscrb_kref_release(struct kref *kref)
155 struct tipc_subscriber *subcriber = container_of(kref,
156 struct tipc_subscriber, kref);
158 kfree(subcriber);
161 static void tipc_subscrb_put(struct tipc_subscriber *subscriber)
163 kref_put(&subscriber->kref, tipc_subscrb_kref_release);
166 static void tipc_subscrb_get(struct tipc_subscriber *subscriber)
168 kref_get(&subscriber->kref);
171 static struct tipc_subscriber *tipc_subscrb_create(int conid)
173 struct tipc_subscriber *subscriber;
175 subscriber = kzalloc(sizeof(*subscriber), GFP_ATOMIC);
176 if (!subscriber) {
177 pr_warn("Subscriber rejected, no memory\n");
178 return NULL;
180 kref_init(&subscriber->kref);
181 INIT_LIST_HEAD(&subscriber->subscrp_list);
182 subscriber->conid = conid;
183 spin_lock_init(&subscriber->lock);
185 return subscriber;
188 static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
190 struct tipc_subscription *sub, *temp;
191 u32 timeout;
193 spin_lock_bh(&subscriber->lock);
194 /* Destroy any existing subscriptions for subscriber */
195 list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
196 subscrp_list) {
197 timeout = htohl(sub->evt.s.timeout, sub->swap);
198 if ((timeout == TIPC_WAIT_FOREVER) || del_timer(&sub->timer)) {
199 tipc_subscrp_delete(sub);
200 tipc_subscrb_put(subscriber);
203 spin_unlock_bh(&subscriber->lock);
205 tipc_subscrb_put(subscriber);
208 static void tipc_subscrp_delete(struct tipc_subscription *sub)
210 struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
212 tipc_nametbl_unsubscribe(sub);
213 list_del(&sub->subscrp_list);
214 kfree(sub);
215 atomic_dec(&tn->subscription_count);
218 static void tipc_subscrp_cancel(struct tipc_subscr *s,
219 struct tipc_subscriber *subscriber)
221 struct tipc_subscription *sub, *temp;
222 u32 timeout;
224 spin_lock_bh(&subscriber->lock);
225 /* Find first matching subscription, exit if not found */
226 list_for_each_entry_safe(sub, temp, &subscriber->subscrp_list,
227 subscrp_list) {
228 if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
229 timeout = htohl(sub->evt.s.timeout, sub->swap);
230 if ((timeout == TIPC_WAIT_FOREVER) ||
231 del_timer(&sub->timer)) {
232 tipc_subscrp_delete(sub);
233 tipc_subscrb_put(subscriber);
235 break;
238 spin_unlock_bh(&subscriber->lock);
241 static struct tipc_subscription *tipc_subscrp_create(struct net *net,
242 struct tipc_subscr *s,
243 int swap)
245 struct tipc_net *tn = net_generic(net, tipc_net_id);
246 struct tipc_subscription *sub;
247 u32 filter = htohl(s->filter, swap);
249 /* Refuse subscription if global limit exceeded */
250 if (atomic_read(&tn->subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
251 pr_warn("Subscription rejected, limit reached (%u)\n",
252 TIPC_MAX_SUBSCRIPTIONS);
253 return NULL;
256 /* Allocate subscription object */
257 sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
258 if (!sub) {
259 pr_warn("Subscription rejected, no memory\n");
260 return NULL;
263 /* Initialize subscription object */
264 sub->net = net;
265 if (((filter & TIPC_SUB_PORTS) && (filter & TIPC_SUB_SERVICE)) ||
266 (htohl(s->seq.lower, swap) > htohl(s->seq.upper, swap))) {
267 pr_warn("Subscription rejected, illegal request\n");
268 kfree(sub);
269 return NULL;
272 sub->swap = swap;
273 memcpy(&sub->evt.s, s, sizeof(*s));
274 atomic_inc(&tn->subscription_count);
275 return sub;
278 static void tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
279 struct tipc_subscriber *subscriber, int swap)
281 struct tipc_net *tn = net_generic(net, tipc_net_id);
282 struct tipc_subscription *sub = NULL;
283 u32 timeout;
285 sub = tipc_subscrp_create(net, s, swap);
286 if (!sub)
287 return tipc_conn_terminate(tn->topsrv, subscriber->conid);
289 spin_lock_bh(&subscriber->lock);
290 list_add(&sub->subscrp_list, &subscriber->subscrp_list);
291 tipc_subscrb_get(subscriber);
292 sub->subscriber = subscriber;
293 tipc_nametbl_subscribe(sub);
294 spin_unlock_bh(&subscriber->lock);
296 timeout = htohl(sub->evt.s.timeout, swap);
297 if (timeout == TIPC_WAIT_FOREVER)
298 return;
300 setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
301 mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout));
304 /* Handle one termination request for the subscriber */
305 static void tipc_subscrb_release_cb(int conid, void *usr_data)
307 tipc_subscrb_delete((struct tipc_subscriber *)usr_data);
310 /* Handle one request to create a new subscription for the subscriber */
311 static void tipc_subscrb_rcv_cb(struct net *net, int conid,
312 struct sockaddr_tipc *addr, void *usr_data,
313 void *buf, size_t len)
315 struct tipc_subscriber *subscriber = usr_data;
316 struct tipc_subscr *s = (struct tipc_subscr *)buf;
317 int swap;
319 /* Determine subscriber's endianness */
320 swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE |
321 TIPC_SUB_CANCEL));
323 /* Detect & process a subscription cancellation request */
324 if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
325 s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
326 return tipc_subscrp_cancel(s, subscriber);
329 tipc_subscrp_subscribe(net, s, subscriber, swap);
332 /* Handle one request to establish a new subscriber */
333 static void *tipc_subscrb_connect_cb(int conid)
335 return (void *)tipc_subscrb_create(conid);
338 int tipc_topsrv_start(struct net *net)
340 struct tipc_net *tn = net_generic(net, tipc_net_id);
341 const char name[] = "topology_server";
342 struct tipc_server *topsrv;
343 struct sockaddr_tipc *saddr;
345 saddr = kzalloc(sizeof(*saddr), GFP_ATOMIC);
346 if (!saddr)
347 return -ENOMEM;
348 saddr->family = AF_TIPC;
349 saddr->addrtype = TIPC_ADDR_NAMESEQ;
350 saddr->addr.nameseq.type = TIPC_TOP_SRV;
351 saddr->addr.nameseq.lower = TIPC_TOP_SRV;
352 saddr->addr.nameseq.upper = TIPC_TOP_SRV;
353 saddr->scope = TIPC_NODE_SCOPE;
355 topsrv = kzalloc(sizeof(*topsrv), GFP_ATOMIC);
356 if (!topsrv) {
357 kfree(saddr);
358 return -ENOMEM;
360 topsrv->net = net;
361 topsrv->saddr = saddr;
362 topsrv->imp = TIPC_CRITICAL_IMPORTANCE;
363 topsrv->type = SOCK_SEQPACKET;
364 topsrv->max_rcvbuf_size = sizeof(struct tipc_subscr);
365 topsrv->tipc_conn_recvmsg = tipc_subscrb_rcv_cb;
366 topsrv->tipc_conn_new = tipc_subscrb_connect_cb;
367 topsrv->tipc_conn_release = tipc_subscrb_release_cb;
369 strncpy(topsrv->name, name, strlen(name) + 1);
370 tn->topsrv = topsrv;
371 atomic_set(&tn->subscription_count, 0);
373 return tipc_server_start(topsrv);
376 void tipc_topsrv_stop(struct net *net)
378 struct tipc_net *tn = net_generic(net, tipc_net_id);
379 struct tipc_server *topsrv = tn->topsrv;
381 tipc_server_stop(topsrv);
382 kfree(topsrv->saddr);
383 kfree(topsrv);