]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - net/tipc/subscr.c
rxrpc: Fix several cases where a padded len isn't checked in ticket decode
[mirror_ubuntu-zesty-kernel.git] / net / tipc / subscr.c
1 /*
2 * net/tipc/subscr.c: TIPC network topology service
3 *
4 * Copyright (c) 2000-2006, Ericsson AB
5 * Copyright (c) 2005-2007, 2010-2013, Wind River Systems
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the names of the copyright holders nor the names of its
17 * contributors may be used to endorse or promote products derived from
18 * this software without specific prior written permission.
19 *
20 * Alternatively, this software may be distributed under the terms of the
21 * GNU General Public License ("GPL") version 2 as published by the Free
22 * Software Foundation.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
25 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
28 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
32 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34 * POSSIBILITY OF SUCH DAMAGE.
35 */
36
37 #include "core.h"
38 #include "name_table.h"
39 #include "subscr.h"
40
41 /**
42 * struct tipc_subscriber - TIPC network topology subscriber
43 * @kref: reference counter to tipc_subscription object
44 * @conid: connection identifier to server connecting to subscriber
45 * @lock: control access to subscriber
46 * @subscrp_list: list of subscription objects for this subscriber
47 */
48 struct tipc_subscriber {
49 struct kref kref;
50 int conid;
51 spinlock_t lock;
52 struct list_head subscrp_list;
53 };
54
55 static void tipc_subscrp_delete(struct tipc_subscription *sub);
56 static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
57 static void tipc_subscrp_put(struct tipc_subscription *subscription);
58 static void tipc_subscrp_get(struct tipc_subscription *subscription);
59
60 /**
61 * htohl - convert value to endianness used by destination
62 * @in: value to convert
63 * @swap: non-zero if endianness must be reversed
64 *
65 * Returns converted value
66 */
67 static u32 htohl(u32 in, int swap)
68 {
69 return swap ? swab32(in) : in;
70 }
71
72 static void tipc_subscrp_send_event(struct tipc_subscription *sub,
73 u32 found_lower, u32 found_upper,
74 u32 event, u32 port_ref, u32 node)
75 {
76 struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
77 struct tipc_subscriber *subscriber = sub->subscriber;
78 struct kvec msg_sect;
79
80 msg_sect.iov_base = (void *)&sub->evt;
81 msg_sect.iov_len = sizeof(struct tipc_event);
82 sub->evt.event = htohl(event, sub->swap);
83 sub->evt.found_lower = htohl(found_lower, sub->swap);
84 sub->evt.found_upper = htohl(found_upper, sub->swap);
85 sub->evt.port.ref = htohl(port_ref, sub->swap);
86 sub->evt.port.node = htohl(node, sub->swap);
87 tipc_conn_sendmsg(tn->topsrv, subscriber->conid, NULL,
88 msg_sect.iov_base, msg_sect.iov_len);
89 }
90
91 /**
92 * tipc_subscrp_check_overlap - test for subscription overlap with the
93 * given values
94 *
95 * Returns 1 if there is overlap, otherwise 0.
96 */
97 int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
98 u32 found_upper)
99 {
100 if (found_lower < seq->lower)
101 found_lower = seq->lower;
102 if (found_upper > seq->upper)
103 found_upper = seq->upper;
104 if (found_lower > found_upper)
105 return 0;
106 return 1;
107 }
108
109 u32 tipc_subscrp_convert_seq_type(u32 type, int swap)
110 {
111 return htohl(type, swap);
112 }
113
114 void tipc_subscrp_convert_seq(struct tipc_name_seq *in, int swap,
115 struct tipc_name_seq *out)
116 {
117 out->type = htohl(in->type, swap);
118 out->lower = htohl(in->lower, swap);
119 out->upper = htohl(in->upper, swap);
120 }
121
122 void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
123 u32 found_upper, u32 event, u32 port_ref,
124 u32 node, int must)
125 {
126 struct tipc_name_seq seq;
127
128 tipc_subscrp_get(sub);
129 tipc_subscrp_convert_seq(&sub->evt.s.seq, sub->swap, &seq);
130 if (!tipc_subscrp_check_overlap(&seq, found_lower, found_upper))
131 return;
132 if (!must &&
133 !(htohl(sub->evt.s.filter, sub->swap) & TIPC_SUB_PORTS))
134 return;
135
136 tipc_subscrp_send_event(sub, found_lower, found_upper, event, port_ref,
137 node);
138 tipc_subscrp_put(sub);
139 }
140
141 static void tipc_subscrp_timeout(unsigned long data)
142 {
143 struct tipc_subscription *sub = (struct tipc_subscription *)data;
144
145 /* Notify subscriber of timeout */
146 tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
147 TIPC_SUBSCR_TIMEOUT, 0, 0);
148
149 tipc_subscrp_put(sub);
150 }
151
152 static void tipc_subscrb_kref_release(struct kref *kref)
153 {
154 kfree(container_of(kref,struct tipc_subscriber, kref));
155 }
156
157 static void tipc_subscrb_put(struct tipc_subscriber *subscriber)
158 {
159 kref_put(&subscriber->kref, tipc_subscrb_kref_release);
160 }
161
162 static void tipc_subscrb_get(struct tipc_subscriber *subscriber)
163 {
164 kref_get(&subscriber->kref);
165 }
166
167 static void tipc_subscrp_kref_release(struct kref *kref)
168 {
169 struct tipc_subscription *sub = container_of(kref,
170 struct tipc_subscription,
171 kref);
172 struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
173 struct tipc_subscriber *subscriber = sub->subscriber;
174
175 spin_lock_bh(&subscriber->lock);
176 tipc_nametbl_unsubscribe(sub);
177 list_del(&sub->subscrp_list);
178 atomic_dec(&tn->subscription_count);
179 spin_unlock_bh(&subscriber->lock);
180 kfree(sub);
181 tipc_subscrb_put(subscriber);
182 }
183
184 static void tipc_subscrp_put(struct tipc_subscription *subscription)
185 {
186 kref_put(&subscription->kref, tipc_subscrp_kref_release);
187 }
188
189 static void tipc_subscrp_get(struct tipc_subscription *subscription)
190 {
191 kref_get(&subscription->kref);
192 }
193
194 /* tipc_subscrb_subscrp_delete - delete a specific subscription or all
195 * subscriptions for a given subscriber.
196 */
197 static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
198 struct tipc_subscr *s)
199 {
200 struct list_head *subscription_list = &subscriber->subscrp_list;
201 struct tipc_subscription *sub, *temp;
202
203 spin_lock_bh(&subscriber->lock);
204 list_for_each_entry_safe(sub, temp, subscription_list, subscrp_list) {
205 if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
206 continue;
207
208 tipc_subscrp_get(sub);
209 spin_unlock_bh(&subscriber->lock);
210 tipc_subscrp_delete(sub);
211 tipc_subscrp_put(sub);
212 spin_lock_bh(&subscriber->lock);
213
214 if (s)
215 break;
216 }
217 spin_unlock_bh(&subscriber->lock);
218 }
219
220 static struct tipc_subscriber *tipc_subscrb_create(int conid)
221 {
222 struct tipc_subscriber *subscriber;
223
224 subscriber = kzalloc(sizeof(*subscriber), GFP_ATOMIC);
225 if (!subscriber) {
226 pr_warn("Subscriber rejected, no memory\n");
227 return NULL;
228 }
229 INIT_LIST_HEAD(&subscriber->subscrp_list);
230 kref_init(&subscriber->kref);
231 subscriber->conid = conid;
232 spin_lock_init(&subscriber->lock);
233
234 return subscriber;
235 }
236
237 static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
238 {
239 tipc_subscrb_subscrp_delete(subscriber, NULL);
240 tipc_subscrb_put(subscriber);
241 }
242
243 static void tipc_subscrp_delete(struct tipc_subscription *sub)
244 {
245 u32 timeout = htohl(sub->evt.s.timeout, sub->swap);
246
247 if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer))
248 tipc_subscrp_put(sub);
249 }
250
251 static void tipc_subscrp_cancel(struct tipc_subscr *s,
252 struct tipc_subscriber *subscriber)
253 {
254 tipc_subscrb_subscrp_delete(subscriber, s);
255 }
256
257 static struct tipc_subscription *tipc_subscrp_create(struct net *net,
258 struct tipc_subscr *s,
259 int swap)
260 {
261 struct tipc_net *tn = net_generic(net, tipc_net_id);
262 struct tipc_subscription *sub;
263 u32 filter = htohl(s->filter, swap);
264
265 /* Refuse subscription if global limit exceeded */
266 if (atomic_read(&tn->subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
267 pr_warn("Subscription rejected, limit reached (%u)\n",
268 TIPC_MAX_SUBSCRIPTIONS);
269 return NULL;
270 }
271
272 /* Allocate subscription object */
273 sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
274 if (!sub) {
275 pr_warn("Subscription rejected, no memory\n");
276 return NULL;
277 }
278
279 /* Initialize subscription object */
280 sub->net = net;
281 if (((filter & TIPC_SUB_PORTS) && (filter & TIPC_SUB_SERVICE)) ||
282 (htohl(s->seq.lower, swap) > htohl(s->seq.upper, swap))) {
283 pr_warn("Subscription rejected, illegal request\n");
284 kfree(sub);
285 return NULL;
286 }
287
288 sub->swap = swap;
289 memcpy(&sub->evt.s, s, sizeof(*s));
290 atomic_inc(&tn->subscription_count);
291 kref_init(&sub->kref);
292 return sub;
293 }
294
295 static void tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
296 struct tipc_subscriber *subscriber, int swap)
297 {
298 struct tipc_net *tn = net_generic(net, tipc_net_id);
299 struct tipc_subscription *sub = NULL;
300 u32 timeout;
301
302 sub = tipc_subscrp_create(net, s, swap);
303 if (!sub)
304 return tipc_conn_terminate(tn->topsrv, subscriber->conid);
305
306 spin_lock_bh(&subscriber->lock);
307 list_add(&sub->subscrp_list, &subscriber->subscrp_list);
308 sub->subscriber = subscriber;
309 tipc_nametbl_subscribe(sub);
310 tipc_subscrb_get(subscriber);
311 spin_unlock_bh(&subscriber->lock);
312
313 setup_timer(&sub->timer, tipc_subscrp_timeout, (unsigned long)sub);
314 timeout = htohl(sub->evt.s.timeout, swap);
315
316 if (timeout != TIPC_WAIT_FOREVER)
317 mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout));
318 }
319
320 /* Handle one termination request for the subscriber */
321 static void tipc_subscrb_release_cb(int conid, void *usr_data)
322 {
323 tipc_subscrb_delete((struct tipc_subscriber *)usr_data);
324 }
325
326 /* Handle one request to create a new subscription for the subscriber */
327 static void tipc_subscrb_rcv_cb(struct net *net, int conid,
328 struct sockaddr_tipc *addr, void *usr_data,
329 void *buf, size_t len)
330 {
331 struct tipc_subscriber *subscriber = usr_data;
332 struct tipc_subscr *s = (struct tipc_subscr *)buf;
333 int swap;
334
335 /* Determine subscriber's endianness */
336 swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE |
337 TIPC_SUB_CANCEL));
338
339 /* Detect & process a subscription cancellation request */
340 if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
341 s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
342 return tipc_subscrp_cancel(s, subscriber);
343 }
344
345 tipc_subscrp_subscribe(net, s, subscriber, swap);
346 }
347
348 /* Handle one request to establish a new subscriber */
349 static void *tipc_subscrb_connect_cb(int conid)
350 {
351 return (void *)tipc_subscrb_create(conid);
352 }
353
354 int tipc_topsrv_start(struct net *net)
355 {
356 struct tipc_net *tn = net_generic(net, tipc_net_id);
357 const char name[] = "topology_server";
358 struct tipc_server *topsrv;
359 struct sockaddr_tipc *saddr;
360
361 saddr = kzalloc(sizeof(*saddr), GFP_ATOMIC);
362 if (!saddr)
363 return -ENOMEM;
364 saddr->family = AF_TIPC;
365 saddr->addrtype = TIPC_ADDR_NAMESEQ;
366 saddr->addr.nameseq.type = TIPC_TOP_SRV;
367 saddr->addr.nameseq.lower = TIPC_TOP_SRV;
368 saddr->addr.nameseq.upper = TIPC_TOP_SRV;
369 saddr->scope = TIPC_NODE_SCOPE;
370
371 topsrv = kzalloc(sizeof(*topsrv), GFP_ATOMIC);
372 if (!topsrv) {
373 kfree(saddr);
374 return -ENOMEM;
375 }
376 topsrv->net = net;
377 topsrv->saddr = saddr;
378 topsrv->imp = TIPC_CRITICAL_IMPORTANCE;
379 topsrv->type = SOCK_SEQPACKET;
380 topsrv->max_rcvbuf_size = sizeof(struct tipc_subscr);
381 topsrv->tipc_conn_recvmsg = tipc_subscrb_rcv_cb;
382 topsrv->tipc_conn_new = tipc_subscrb_connect_cb;
383 topsrv->tipc_conn_release = tipc_subscrb_release_cb;
384
385 strncpy(topsrv->name, name, strlen(name) + 1);
386 tn->topsrv = topsrv;
387 atomic_set(&tn->subscription_count, 0);
388
389 return tipc_server_start(topsrv);
390 }
391
392 void tipc_topsrv_stop(struct net *net)
393 {
394 struct tipc_net *tn = net_generic(net, tipc_net_id);
395 struct tipc_server *topsrv = tn->topsrv;
396
397 tipc_server_stop(topsrv);
398 kfree(topsrv->saddr);
399 kfree(topsrv);
400 }