netlink: fix splat in skb_clone with large messages

[platform/adaptation/renesas_rcar/renesas_kernel.git] / net / netlink / af_netlink.c

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8978755..0c61b59 100644 (file)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -57,6 +57,7 @@
 #include <linux/audit.h>
 #include <linux/mutex.h>
 #include <linux/vmalloc.h>
+#include <linux/if_arp.h>
 #include <asm/cacheflush.h>
 
 #include <net/net_namespace.h>
@@ -101,6 +102,9 @@ static atomic_t nl_table_users = ATOMIC_INIT(0);
 
 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
 
+static DEFINE_SPINLOCK(netlink_tap_lock);
+static struct list_head netlink_tap_all __read_mostly;
+
 static inline u32 netlink_group_mask(u32 group)
 {
        return group ? 1 << (group - 1) : 0;
@@ -111,6 +115,100 @@ static inline struct hlist_head *nl_portid_hashfn(struct nl_portid_hash *hash, u
        return &hash->table[jhash_1word(portid, hash->rnd) & hash->mask];
 }
 
+int netlink_add_tap(struct netlink_tap *nt)
+{
+       if (unlikely(nt->dev->type != ARPHRD_NETLINK))
+               return -EINVAL;
+
+       spin_lock(&netlink_tap_lock);
+       list_add_rcu(&nt->list, &netlink_tap_all);
+       spin_unlock(&netlink_tap_lock);
+
+       if (nt->module)
+               __module_get(nt->module);
+
+       return 0;
+}
+EXPORT_SYMBOL_GPL(netlink_add_tap);
+
+int __netlink_remove_tap(struct netlink_tap *nt)
+{
+       bool found = false;
+       struct netlink_tap *tmp;
+
+       spin_lock(&netlink_tap_lock);
+
+       list_for_each_entry(tmp, &netlink_tap_all, list) {
+               if (nt == tmp) {
+                       list_del_rcu(&nt->list);
+                       found = true;
+                       goto out;
+               }
+       }
+
+       pr_warn("__netlink_remove_tap: %p not found\n", nt);
+out:
+       spin_unlock(&netlink_tap_lock);
+
+       if (found && nt->module)
+               module_put(nt->module);
+
+       return found ? 0 : -ENODEV;
+}
+EXPORT_SYMBOL_GPL(__netlink_remove_tap);
+
+int netlink_remove_tap(struct netlink_tap *nt)
+{
+       int ret;
+
+       ret = __netlink_remove_tap(nt);
+       synchronize_net();
+
+       return ret;
+}
+EXPORT_SYMBOL_GPL(netlink_remove_tap);
+
+static int __netlink_deliver_tap_skb(struct sk_buff *skb,
+                                    struct net_device *dev)
+{
+       struct sk_buff *nskb;
+       int ret = -ENOMEM;
+
+       dev_hold(dev);
+       nskb = skb_clone(skb, GFP_ATOMIC);
+       if (nskb) {
+               nskb->dev = dev;
+               ret = dev_queue_xmit(nskb);
+               if (unlikely(ret > 0))
+                       ret = net_xmit_errno(ret);
+       }
+
+       dev_put(dev);
+       return ret;
+}
+
+static void __netlink_deliver_tap(struct sk_buff *skb)
+{
+       int ret;
+       struct netlink_tap *tmp;
+
+       list_for_each_entry_rcu(tmp, &netlink_tap_all, list) {
+               ret = __netlink_deliver_tap_skb(skb, tmp->dev);
+               if (unlikely(ret))
+                       break;
+       }
+}
+
+static void netlink_deliver_tap(struct sk_buff *skb)
+{
+       rcu_read_lock();
+
+       if (unlikely(!list_empty(&netlink_tap_all)))
+               __netlink_deliver_tap(skb);
+
+       rcu_read_unlock();
+}
+
 static void netlink_overrun(struct sock *sk)
 {
        struct netlink_sock *nlk = nlk_sk(sk);
@@ -371,7 +469,7 @@ static int netlink_mmap(struct file *file, struct socket *sock,
        err = 0;
 out:
        mutex_unlock(&nlk->pg_vec_lock);
-       return 0;
+       return err;
 }
 
 static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
@@ -751,7 +849,10 @@ static void netlink_skb_destructor(struct sk_buff *skb)
        }
 #endif
        if (is_vmalloc_addr(skb->head)) {
-               vfree(skb->head);
+               if (!skb->cloned ||
+                   !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
+                       vfree(skb->head);
+
                skb->head = NULL;
        }
        if (skb->sk != NULL)
@@ -1434,33 +1535,31 @@ struct sock *netlink_getsockbyfilp(struct file *filp)
        return sock;
 }
 
-static struct sk_buff *netlink_alloc_large_skb(unsigned int size)
+static struct sk_buff *netlink_alloc_large_skb(unsigned int size,
+                                              int broadcast)
 {
        struct sk_buff *skb;
        void *data;
 
-       if (size <= NLMSG_GOODSIZE)
+       if (size <= NLMSG_GOODSIZE || broadcast)
                return alloc_skb(size, GFP_KERNEL);
 
-       skb = alloc_skb_head(GFP_KERNEL);
-       if (skb == NULL)
-               return NULL;
+       size = SKB_DATA_ALIGN(size) +
+              SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
        data = vmalloc(size);
        if (data == NULL)
-               goto err;
+               return NULL;
 
-       skb->head       = data;
-       skb->data       = data;
-       skb_reset_tail_pointer(skb);
-       skb->end        = skb->tail + size;
-       skb->len        = 0;
-       skb->destructor = netlink_skb_destructor;
+       skb = build_skb(data, size);
+       if (skb == NULL)
+               vfree(data);
+       else {
+               skb->head_frag = 0;
+               skb->destructor = netlink_skb_destructor;
+       }
 
        return skb;
-err:
-       kfree_skb(skb);
-       return NULL;
 }
 
 /*
@@ -1518,6 +1617,8 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
 {
        int len = skb->len;
 
+       netlink_deliver_tap(skb);
+
 #ifdef CONFIG_NETLINK_MMAP
        if (netlink_skb_is_mmaped(skb))
                netlink_queue_mmaped_skb(sk, skb);
@@ -1578,6 +1679,11 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
 
        ret = -ECONNREFUSED;
        if (nlk->netlink_rcv != NULL) {
+               /* We could do a netlink_deliver_tap(skb) here as well
+                * but since this is intended for the kernel only, we
+                * should rather let it stay under the hood.
+                */
+
                ret = skb->len;
                netlink_skb_set_owner_r(skb, sk);
                NETLINK_CB(skb).sk = ssk;
@@ -2139,7 +2245,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
        if (len > sk->sk_sndbuf - 32)
                goto out;
        err = -ENOBUFS;
-       skb = netlink_alloc_large_skb(len);
+       skb = netlink_alloc_large_skb(len, dst_group);
        if (skb == NULL)
                goto out;
 
@@ -2975,6 +3081,8 @@ static int __init netlink_proto_init(void)
                nl_table[i].compare = netlink_compare;
        }
 
+       INIT_LIST_HEAD(&netlink_tap_all);
+
        netlink_add_usersock_entry();
 
        sock_register(&netlink_family_ops);