X-Git-Url: http://ftp.safe.ca/?a=blobdiff_plain;f=drivers%2Fnet%2Fpppoe.c;h=805b64d1e893564bfc7aa1b3957c1df606dcf46a;hb=HEAD;hp=475dc930380f63b6a1b0fd52b2532b43354798c5;hpb=cbb042f9e1292434e3cacb90e67d8d381aeac5a9;p=safe%2Fjmp%2Flinux-2.6 diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c index 475dc93..805b64d 100644 --- a/drivers/net/pppoe.c +++ b/drivers/net/pppoe.c @@ -7,6 +7,12 @@ * * Version: 0.7.0 * + * 070228 : Fix to allow multiple sessions with same remote MAC and same + * session id by including the local device ifindex in the + * tuple identifying a session. This also ensures packets can't + * be injected into a session from interfaces other than the one + * specified by userspace. Florian Zumbiehl + * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme * 030700 : Fixed connect logic to allow for disconnect. * 270700 : Fixed potential SMP problems; we must protect against @@ -72,105 +78,142 @@ #include #include +#include +#include +#include #include #include #define PPPOE_HASH_BITS 4 -#define PPPOE_HASH_SIZE (1<sid == b->sid && - (memcmp(a->remote, b->remote, ETH_ALEN) == 0)); + return sid != 0; } -static inline int cmp_addr(struct pppoe_addr *a, unsigned long sid, char *addr) +static inline struct pppoe_net *pppoe_pernet(struct net *net) { - return (a->sid == sid && - (memcmp(a->remote,addr,ETH_ALEN) == 0)); + BUG_ON(!net); + + return net_generic(net, pppoe_net_id); } -static int hash_item(unsigned long sid, unsigned char *addr) +static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) { - char hash = 0; - int i, j; + return a->sid == b->sid && !memcmp(a->remote, b->remote, ETH_ALEN); +} - for (i = 0; i < ETH_ALEN ; ++i) { - for (j = 0; j < 8/PPPOE_HASH_BITS ; ++j) { - hash ^= addr[i] >> ( j * PPPOE_HASH_BITS ); - } - } +static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) +{ + return a->sid == sid && !memcmp(a->remote, addr, ETH_ALEN); +} - for (i = 0; i < (sizeof(unsigned long)*8) / PPPOE_HASH_BITS ; ++i) - hash ^= sid >> (i*PPPOE_HASH_BITS); +#if 8 % PPPOE_HASH_BITS +#error 8 must be a multiple of PPPOE_HASH_BITS +#endif - return hash & ( PPPOE_HASH_SIZE - 1 ); -} +static int hash_item(__be16 sid, unsigned char *addr) +{ + unsigned char hash = 0; + unsigned int i; + + for (i = 0; i < ETH_ALEN; i++) + hash ^= addr[i]; + for (i = 0; i < sizeof(sid_t) * 8; i += 8) + hash ^= (__force __u32)sid >> i; + for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) + hash ^= hash >> i; -/* zeroed because its in .bss */ -static struct pppox_sock *item_hash_table[PPPOE_HASH_SIZE]; + return hash & PPPOE_HASH_MASK; +} /********************************************************************** * * Set/get/delete/rehash items (internal versions) * **********************************************************************/ -static struct pppox_sock *__get_item(unsigned long sid, unsigned char *addr) +static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, + unsigned char *addr, int ifindex) { int hash = hash_item(sid, addr); struct pppox_sock *ret; - ret = item_hash_table[hash]; + ret = pn->hash_table[hash]; + while (ret) { + if (cmp_addr(&ret->pppoe_pa, sid, addr) && + ret->pppoe_ifindex == ifindex) + return ret; - while (ret && !cmp_addr(&ret->pppoe_pa, sid, addr)) ret = ret->next; + } - return ret; + return NULL; } -static int __set_item(struct pppox_sock *po) +static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) { int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); struct pppox_sock *ret; - ret = item_hash_table[hash]; + ret = pn->hash_table[hash]; while (ret) { - if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa)) + if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && + ret->pppoe_ifindex == po->pppoe_ifindex) return -EALREADY; ret = ret->next; } - if (!ret) { - po->next = item_hash_table[hash]; - item_hash_table[hash] = po; - } + po->next = pn->hash_table[hash]; + pn->hash_table[hash] = po; return 0; } -static struct pppox_sock *__delete_item(unsigned long sid, char *addr) +static struct pppox_sock *__delete_item(struct pppoe_net *pn, __be16 sid, + char *addr, int ifindex) { int hash = hash_item(sid, addr); struct pppox_sock *ret, **src; - ret = item_hash_table[hash]; - src = &item_hash_table[hash]; + ret = pn->hash_table[hash]; + src = &pn->hash_table[hash]; while (ret) { - if (cmp_addr(&ret->pppoe_pa, sid, addr)) { + if (cmp_addr(&ret->pppoe_pa, sid, addr) && + ret->pppoe_ifindex == ifindex) { *src = ret->next; break; } @@ -187,52 +230,53 @@ static struct pppox_sock *__delete_item(unsigned long sid, char *addr) * Set/get/delete/rehash items * **********************************************************************/ -static inline struct pppox_sock *get_item(unsigned long sid, - unsigned char *addr) +static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, + unsigned char *addr, int ifindex) { struct pppox_sock *po; - read_lock_bh(&pppoe_hash_lock); - po = __get_item(sid, addr); + read_lock_bh(&pn->hash_lock); + po = __get_item(pn, sid, addr, ifindex); if (po) sock_hold(sk_pppox(po)); - read_unlock_bh(&pppoe_hash_lock); + read_unlock_bh(&pn->hash_lock); return po; } -static inline struct pppox_sock *get_item_by_addr(struct sockaddr_pppox *sp) +static inline struct pppox_sock *get_item_by_addr(struct net *net, + struct sockaddr_pppox *sp) { - return get_item(sp->sa_addr.pppoe.sid, sp->sa_addr.pppoe.remote); -} - -static inline int set_item(struct pppox_sock *po) -{ - int i; - - if (!po) - return -EINVAL; - - write_lock_bh(&pppoe_hash_lock); - i = __set_item(po); - write_unlock_bh(&pppoe_hash_lock); - - return i; + struct net_device *dev; + struct pppoe_net *pn; + struct pppox_sock *pppox_sock = NULL; + + int ifindex; + + rcu_read_lock(); + dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); + if (dev) { + ifindex = dev->ifindex; + pn = pppoe_pernet(net); + pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid, + sp->sa_addr.pppoe.remote, ifindex); + } + rcu_read_unlock(); + return pppox_sock; } -static inline struct pppox_sock *delete_item(unsigned long sid, char *addr) +static inline struct pppox_sock *delete_item(struct pppoe_net *pn, __be16 sid, + char *addr, int ifindex) { struct pppox_sock *ret; - write_lock_bh(&pppoe_hash_lock); - ret = __delete_item(sid, addr); - write_unlock_bh(&pppoe_hash_lock); + write_lock_bh(&pn->hash_lock); + ret = __delete_item(pn, sid, addr, ifindex); + write_unlock_bh(&pn->hash_lock); return ret; } - - /*************************************************************************** * * Handler for device events. @@ -242,61 +286,66 @@ static inline struct pppox_sock *delete_item(unsigned long sid, char *addr) static void pppoe_flush_dev(struct net_device *dev) { - int hash; - - BUG_ON(dev == NULL); + struct pppoe_net *pn; + int i; - read_lock_bh(&pppoe_hash_lock); - for (hash = 0; hash < PPPOE_HASH_SIZE; hash++) { - struct pppox_sock *po = item_hash_table[hash]; + pn = pppoe_pernet(dev_net(dev)); + write_lock_bh(&pn->hash_lock); + for (i = 0; i < PPPOE_HASH_SIZE; i++) { + struct pppox_sock *po = pn->hash_table[i]; + struct sock *sk; - while (po != NULL) { - if (po->pppoe_dev == dev) { - struct sock *sk = sk_pppox(po); + while (po) { + while (po && po->pppoe_dev != dev) { + po = po->next; + } - sock_hold(sk); - po->pppoe_dev = NULL; + if (!po) + break; - /* We hold a reference to SK, now drop the - * hash table lock so that we may attempt - * to lock the socket (which can sleep). - */ - read_unlock_bh(&pppoe_hash_lock); + sk = sk_pppox(po); - lock_sock(sk); + /* We always grab the socket lock, followed by the + * hash_lock, in that order. Since we should hold the + * sock lock while doing any unbinding, we need to + * release the lock we're holding. Hold a reference to + * the sock so it doesn't disappear as we're jumping + * between locks. + */ - if (sk->sk_state & - (PPPOX_CONNECTED | PPPOX_BOUND)) { - pppox_unbind_sock(sk); - dev_put(dev); - sk->sk_state = PPPOX_ZOMBIE; - sk->sk_state_change(sk); - } + sock_hold(sk); + write_unlock_bh(&pn->hash_lock); + lock_sock(sk); - release_sock(sk); + if (po->pppoe_dev == dev && + sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { + pppox_unbind_sock(sk); + sk->sk_state = PPPOX_ZOMBIE; + sk->sk_state_change(sk); + po->pppoe_dev = NULL; + dev_put(dev); + } - sock_put(sk); + release_sock(sk); + sock_put(sk); - read_lock_bh(&pppoe_hash_lock); + /* Restart the process from the start of the current + * hash chain. We dropped locks so the world may have + * change from underneath us. + */ - /* Now restart from the beginning of this - * hash chain. We always NULL out pppoe_dev - * so we are guaranteed to make forward - * progress. - */ - po = item_hash_table[hash]; - continue; - } - po = po->next; + BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); + write_lock_bh(&pn->hash_lock); + po = pn->hash_table[i]; } } - read_unlock_bh(&pppoe_hash_lock); + write_unlock_bh(&pn->hash_lock); } static int pppoe_device_event(struct notifier_block *this, unsigned long event, void *ptr) { - struct net_device *dev = (struct net_device *) ptr; + struct net_device *dev = (struct net_device *)ptr; /* Only look at sockets that are using this specific device. */ switch (event) { @@ -313,17 +362,15 @@ static int pppoe_device_event(struct notifier_block *this, default: break; - }; + } return NOTIFY_DONE; } - static struct notifier_block pppoe_notifier = { .notifier_call = pppoe_device_event, }; - /************************************************************************ * * Do the real work of receiving a PPPoE Session frame. @@ -332,26 +379,24 @@ static struct notifier_block pppoe_notifier = { static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) { struct pppox_sock *po = pppox_sk(sk); - struct pppox_sock *relay_po = NULL; + struct pppox_sock *relay_po; - if (sk->sk_state & PPPOX_BOUND) { - struct pppoe_hdr *ph = (struct pppoe_hdr *) skb->nh.raw; - int len = ntohs(ph->length); - skb_pull_rcsum(skb, sizeof(struct pppoe_hdr)); - if (pskb_trim_rcsum(skb, len)) - goto abort_kfree; + /* Backlog receive. Semantics of backlog rcv preclude any code from + * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state + * can't change. + */ + if (sk->sk_state & PPPOX_BOUND) { ppp_input(&po->chan, skb); } else if (sk->sk_state & PPPOX_RELAY) { - relay_po = get_item_by_addr(&po->pppoe_relay); - + relay_po = get_item_by_addr(sock_net(sk), + &po->pppoe_relay); if (relay_po == NULL) goto abort_kfree; if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) goto abort_put; - skb_pull(skb, sizeof(struct pppoe_hdr)); if (!__pppoe_xmit(sk_pppox(relay_po), skb)) goto abort_put; } else { @@ -374,26 +419,42 @@ abort_kfree: * Receive wrapper called in BH context. * ***********************************************************************/ -static int pppoe_rcv(struct sk_buff *skb, - struct net_device *dev, - struct packet_type *pt, - struct net_device *orig_dev) - +static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, + struct packet_type *pt, struct net_device *orig_dev) { struct pppoe_hdr *ph; struct pppox_sock *po; + struct pppoe_net *pn; + int len; + + skb = skb_share_check(skb, GFP_ATOMIC); + if (!skb) + goto out; if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) goto drop; - if (!(skb = skb_share_check(skb, GFP_ATOMIC))) - goto out; + ph = pppoe_hdr(skb); + len = ntohs(ph->length); - ph = (struct pppoe_hdr *) skb->nh.raw; + skb_pull_rcsum(skb, sizeof(*ph)); + if (skb->len < len) + goto drop; + + if (pskb_trim_rcsum(skb, len)) + goto drop; + + pn = pppoe_pernet(dev_net(dev)); + + /* Note that get_item does a sock_hold(), so sk_pppox(po) + * is known to be safe. + */ + po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); + if (!po) + goto drop; + + return sk_receive_skb(sk_pppox(po), skb, 0); - po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source); - if (po != NULL) - return sk_receive_skb(sk_pppox(po), skb); drop: kfree_skb(skb); out: @@ -406,26 +467,27 @@ out: * This is solely for detection of PADT frames * ***********************************************************************/ -static int pppoe_disc_rcv(struct sk_buff *skb, - struct net_device *dev, - struct packet_type *pt, - struct net_device *orig_dev) +static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, + struct packet_type *pt, struct net_device *orig_dev) { struct pppoe_hdr *ph; struct pppox_sock *po; + struct pppoe_net *pn; + + skb = skb_share_check(skb, GFP_ATOMIC); + if (!skb) + goto out; if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) goto abort; - if (!(skb = skb_share_check(skb, GFP_ATOMIC))) - goto out; - - ph = (struct pppoe_hdr *) skb->nh.raw; + ph = pppoe_hdr(skb); if (ph->code != PADT_CODE) goto abort; - po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source); + pn = pppoe_pernet(dev_net(dev)); + po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); if (po) { struct sock *sk = sk_pppox(po); @@ -453,17 +515,17 @@ out: return NET_RX_SUCCESS; /* Lies... :-) */ } -static struct packet_type pppoes_ptype = { - .type = __constant_htons(ETH_P_PPP_SES), +static struct packet_type pppoes_ptype __read_mostly = { + .type = cpu_to_be16(ETH_P_PPP_SES), .func = pppoe_rcv, }; -static struct packet_type pppoed_ptype = { - .type = __constant_htons(ETH_P_PPP_DISC), +static struct packet_type pppoed_ptype __read_mostly = { + .type = cpu_to_be16(ETH_P_PPP_DISC), .func = pppoe_disc_rcv, }; -static struct proto pppoe_sk_proto = { +static struct proto pppoe_sk_proto __read_mostly = { .name = "PPPOE", .owner = THIS_MODULE, .obj_size = sizeof(struct pppox_sock), @@ -474,74 +536,85 @@ static struct proto pppoe_sk_proto = { * Initialize a new struct sock. * **********************************************************************/ -static int pppoe_create(struct socket *sock) +static int pppoe_create(struct net *net, struct socket *sock) { - int error = -ENOMEM; struct sock *sk; - sk = sk_alloc(PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, 1); + sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto); if (!sk) - goto out; + return -ENOMEM; sock_init_data(sock, sk); - sock->state = SS_UNCONNECTED; - sock->ops = &pppoe_ops; + sock->state = SS_UNCONNECTED; + sock->ops = &pppoe_ops; - sk->sk_backlog_rcv = pppoe_rcv_core; - sk->sk_state = PPPOX_NONE; - sk->sk_type = SOCK_STREAM; - sk->sk_family = PF_PPPOX; - sk->sk_protocol = PX_PROTO_OE; + sk->sk_backlog_rcv = pppoe_rcv_core; + sk->sk_state = PPPOX_NONE; + sk->sk_type = SOCK_STREAM; + sk->sk_family = PF_PPPOX; + sk->sk_protocol = PX_PROTO_OE; - error = 0; -out: return error; + return 0; } static int pppoe_release(struct socket *sock) { struct sock *sk = sock->sk; struct pppox_sock *po; - int error = 0; + struct pppoe_net *pn; + struct net *net = NULL; if (!sk) return 0; - if (sock_flag(sk, SOCK_DEAD)) + lock_sock(sk); + if (sock_flag(sk, SOCK_DEAD)) { + release_sock(sk); return -EBADF; + } + + po = pppox_sk(sk); + + if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { + dev_put(po->pppoe_dev); + po->pppoe_dev = NULL; + } pppox_unbind_sock(sk); /* Signal the death of the socket. */ sk->sk_state = PPPOX_DEAD; - po = pppox_sk(sk); - if (po->pppoe_pa.sid) { - delete_item(po->pppoe_pa.sid, po->pppoe_pa.remote); - } - - if (po->pppoe_dev) - dev_put(po->pppoe_dev); + net = sock_net(sk); + pn = pppoe_pernet(net); - po->pppoe_dev = NULL; + /* + * protect "po" from concurrent updates + * on pppoe_flush_dev + */ + delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, + po->pppoe_ifindex); sock_orphan(sk); sock->sk = NULL; skb_queue_purge(&sk->sk_receive_queue); + release_sock(sk); sock_put(sk); - return error; + return 0; } - static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, int sockaddr_len, int flags) { struct sock *sk = sock->sk; - struct net_device *dev = NULL; - struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr; + struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; struct pppox_sock *po = pppox_sk(sk); + struct net_device *dev = NULL; + struct pppoe_net *pn; + struct net *net = NULL; int error; lock_sock(sk); @@ -552,67 +625,79 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, /* Check for already bound sockets */ error = -EBUSY; - if ((sk->sk_state & PPPOX_CONNECTED) && sp->sa_addr.pppoe.sid) + if ((sk->sk_state & PPPOX_CONNECTED) && + stage_session(sp->sa_addr.pppoe.sid)) goto end; /* Check for already disconnected sockets, on attempts to disconnect */ error = -EALREADY; - if ((sk->sk_state & PPPOX_DEAD) && !sp->sa_addr.pppoe.sid ) + if ((sk->sk_state & PPPOX_DEAD) && + !stage_session(sp->sa_addr.pppoe.sid)) goto end; error = 0; - if (po->pppoe_pa.sid) { - pppox_unbind_sock(sk); - - /* Delete the old binding */ - delete_item(po->pppoe_pa.sid,po->pppoe_pa.remote); - if(po->pppoe_dev) + /* Delete the old binding */ + if (stage_session(po->pppoe_pa.sid)) { + pppox_unbind_sock(sk); + pn = pppoe_pernet(sock_net(sk)); + delete_item(pn, po->pppoe_pa.sid, + po->pppoe_pa.remote, po->pppoe_ifindex); + if (po->pppoe_dev) { dev_put(po->pppoe_dev); + po->pppoe_dev = NULL; + } memset(sk_pppox(po) + 1, 0, sizeof(struct pppox_sock) - sizeof(struct sock)); - sk->sk_state = PPPOX_NONE; } - /* Don't re-bind if sid==0 */ - if (sp->sa_addr.pppoe.sid != 0) { - dev = dev_get_by_name(sp->sa_addr.pppoe.dev); - + /* Re-bind in session stage only */ + if (stage_session(sp->sa_addr.pppoe.sid)) { error = -ENODEV; + net = sock_net(sk); + dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); if (!dev) - goto end; + goto err_put; po->pppoe_dev = dev; - - if (!(dev->flags & IFF_UP)) + po->pppoe_ifindex = dev->ifindex; + pn = pppoe_pernet(net); + if (!(dev->flags & IFF_UP)) { goto err_put; + } memcpy(&po->pppoe_pa, &sp->sa_addr.pppoe, sizeof(struct pppoe_addr)); - error = set_item(po); + write_lock_bh(&pn->hash_lock); + error = __set_item(pn, po); + write_unlock_bh(&pn->hash_lock); if (error < 0) goto err_put; po->chan.hdrlen = (sizeof(struct pppoe_hdr) + dev->hard_header_len); + po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr); po->chan.private = sk; po->chan.ops = &pppoe_chan_ops; - error = ppp_register_channel(&po->chan); - if (error) + error = ppp_register_net_channel(dev_net(dev), &po->chan); + if (error) { + delete_item(pn, po->pppoe_pa.sid, + po->pppoe_pa.remote, po->pppoe_ifindex); goto err_put; + } sk->sk_state = PPPOX_CONNECTED; } po->num = sp->sa_addr.pppoe.sid; - end: +end: release_sock(sk); return error; err_put: @@ -623,7 +708,6 @@ err_put: goto end; } - static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, int *usockaddr_len, int peer) { @@ -642,19 +726,17 @@ static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, return 0; } - static int pppoe_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) { struct sock *sk = sock->sk; struct pppox_sock *po = pppox_sk(sk); - int val = 0; - int err = 0; + int val; + int err; switch (cmd) { case PPPIOCGMRU: err = -ENXIO; - if (!(sk->sk_state & PPPOX_CONNECTED)) break; @@ -662,7 +744,7 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd, if (put_user(po->pppoe_dev->mtu - sizeof(struct pppoe_hdr) - PPP_HDRLEN, - (int __user *) arg)) + (int __user *)arg)) break; err = 0; break; @@ -673,7 +755,7 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd, break; err = -EFAULT; - if (get_user(val,(int __user *) arg)) + if (get_user(val, (int __user *)arg)) break; if (val < (po->pppoe_dev->mtu @@ -686,7 +768,7 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd, case PPPIOCSFLAGS: err = -EFAULT; - if (get_user(val, (int __user *) arg)) + if (get_user(val, (int __user *)arg)) break; err = 0; break; @@ -704,7 +786,7 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd, break; /* PPPoE address from the user specifies an outbound - PPPoE address to which frames are forwarded to */ + PPPoE address which frames are forwarded to */ err = -EFAULT; if (copy_from_user(&po->pppoe_relay, (void __user *)arg, @@ -713,13 +795,12 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd, err = -EINVAL; if (po->pppoe_relay.sa_family != AF_PPPOX || - po->pppoe_relay.sa_protocol!= PX_PROTO_OE) + po->pppoe_relay.sa_protocol != PX_PROTO_OE) break; /* Check that the socket referenced by the address actually exists. */ - relay_po = get_item_by_addr(&po->pppoe_relay); - + relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay); if (!relay_po) break; @@ -738,25 +819,26 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd, err = 0; break; - default:; - }; + default: + err = -ENOTTY; + } return err; } - -static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock, +static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m, size_t total_len) { - struct sk_buff *skb = NULL; + struct sk_buff *skb; struct sock *sk = sock->sk; struct pppox_sock *po = pppox_sk(sk); - int error = 0; + int error; struct pppoe_hdr hdr; struct pppoe_hdr *ph; struct net_device *dev; char *start; + lock_sock(sk); if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { error = -ENOTCONN; goto end; @@ -767,12 +849,10 @@ static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock, hdr.code = 0; hdr.sid = po->num; - lock_sock(sk); - dev = po->pppoe_dev; error = -EMSGSIZE; - if (total_len > (dev->mtu + dev->hard_header_len)) + if (total_len > (dev->mtu + dev->hard_header_len)) goto end; @@ -785,26 +865,25 @@ static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock, /* Reserve space for headers. */ skb_reserve(skb, dev->hard_header_len); - skb->nh.raw = skb->data; + skb_reset_network_header(skb); skb->dev = dev; skb->priority = sk->sk_priority; - skb->protocol = __constant_htons(ETH_P_PPP_SES); + skb->protocol = cpu_to_be16(ETH_P_PPP_SES); - ph = (struct pppoe_hdr *) skb_put(skb, total_len + sizeof(struct pppoe_hdr)); - start = (char *) &ph->tag[0]; + ph = (struct pppoe_hdr *)skb_put(skb, total_len + sizeof(struct pppoe_hdr)); + start = (char *)&ph->tag[0]; error = memcpy_fromiovec(start, m->msg_iov, total_len); - if (error < 0) { kfree_skb(skb); goto end; } error = total_len; - dev->hard_header(skb, dev, ETH_P_PPP_SES, - po->pppoe_pa.remote, NULL, total_len); + dev_hard_header(skb, dev, ETH_P_PPP_SES, + po->pppoe_pa.remote, NULL, total_len); memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); @@ -817,7 +896,6 @@ end: return error; } - /************************************************************************ * * xmit function for internal use. @@ -827,70 +905,53 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) { struct pppox_sock *po = pppox_sk(sk); struct net_device *dev = po->pppoe_dev; - struct pppoe_hdr hdr; struct pppoe_hdr *ph; - int headroom = skb_headroom(skb); int data_len = skb->len; - struct sk_buff *skb2; + + /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP + * xmit operations conclude prior to an unregistration call. Thus + * sk->sk_state cannot change, so we don't need to do lock_sock(). + * But, we also can't do a lock_sock since that introduces a potential + * deadlock as we'd reverse the lock ordering used when calling + * ppp_unregister_channel(). + */ if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) goto abort; - hdr.ver = 1; - hdr.type = 1; - hdr.code = 0; - hdr.sid = po->num; - hdr.length = htons(skb->len); - if (!dev) goto abort; - /* Copy the skb if there is no space for the header. */ - if (headroom < (sizeof(struct pppoe_hdr) + dev->hard_header_len)) { - skb2 = dev_alloc_skb(32+skb->len + - sizeof(struct pppoe_hdr) + - dev->hard_header_len); - - if (skb2 == NULL) - goto abort; - - skb_reserve(skb2, dev->hard_header_len + sizeof(struct pppoe_hdr)); - memcpy(skb_put(skb2, skb->len), skb->data, skb->len); - } else { - /* Make a clone so as to not disturb the original skb, - * give dev_queue_xmit something it can free. - */ - skb2 = skb_clone(skb, GFP_ATOMIC); - } - - ph = (struct pppoe_hdr *) skb_push(skb2, sizeof(struct pppoe_hdr)); - memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); - skb2->protocol = __constant_htons(ETH_P_PPP_SES); - - skb2->nh.raw = skb2->data; + /* Copy the data if there is no space for the header or if it's + * read-only. + */ + if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) + goto abort; - skb2->dev = dev; + __skb_push(skb, sizeof(*ph)); + skb_reset_network_header(skb); - dev->hard_header(skb2, dev, ETH_P_PPP_SES, - po->pppoe_pa.remote, NULL, data_len); + ph = pppoe_hdr(skb); + ph->ver = 1; + ph->type = 1; + ph->code = 0; + ph->sid = po->num; + ph->length = htons(data_len); - /* We're transmitting skb2, and assuming that dev_queue_xmit - * will free it. The generic ppp layer however, is expecting - * that we give back 'skb' (not 'skb2') in case of failure, - * but free it in case of success. - */ + skb->protocol = cpu_to_be16(ETH_P_PPP_SES); + skb->dev = dev; - if (dev_queue_xmit(skb2) < 0) - goto abort; + dev_hard_header(skb, dev, ETH_P_PPP_SES, + po->pppoe_pa.remote, NULL, data_len); - kfree_skb(skb); + dev_queue_xmit(skb); return 1; abort: - return 0; + kfree_skb(skb); + return 1; } - /************************************************************************ * * xmit function called by generic PPP driver @@ -899,23 +960,20 @@ abort: ***********************************************************************/ static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) { - struct sock *sk = (struct sock *) chan->private; + struct sock *sk = (struct sock *)chan->private; return __pppoe_xmit(sk, skb); } - -static struct ppp_channel_ops pppoe_chan_ops = { - .start_xmit = pppoe_xmit, +static struct ppp_channel_ops pppoe_chan_ops = { + .start_xmit = pppoe_xmit, }; static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m, size_t total_len, int flags) { struct sock *sk = sock->sk; - struct sk_buff *skb = NULL; + struct sk_buff *skb; int error = 0; - int len; - struct pppoe_hdr *ph = NULL; if (sk->sk_state & PPPOX_BOUND) { error = -EIO; @@ -924,27 +982,19 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock, skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &error); - - if (error < 0) { + if (error < 0) goto end; - } m->msg_namelen = 0; if (skb) { - error = 0; - ph = (struct pppoe_hdr *) skb->nh.raw; - len = ntohs(ph->length); - - error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len); - if (error < 0) - goto do_skb_free; - error = len; + total_len = min_t(size_t, total_len, skb->len); + error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len); + if (error == 0) + error = total_len; } -do_skb_free: - if (skb) - kfree_skb(skb); + kfree_skb(skb); end: return error; } @@ -963,71 +1013,76 @@ static int pppoe_seq_show(struct seq_file *seq, void *v) po = v; dev_name = po->pppoe_pa.dev; - seq_printf(seq, "%08X %02X:%02X:%02X:%02X:%02X:%02X %8s\n", - po->pppoe_pa.sid, - po->pppoe_pa.remote[0], po->pppoe_pa.remote[1], - po->pppoe_pa.remote[2], po->pppoe_pa.remote[3], - po->pppoe_pa.remote[4], po->pppoe_pa.remote[5], dev_name); + seq_printf(seq, "%08X %pM %8s\n", + po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); out: return 0; } -static __inline__ struct pppox_sock *pppoe_get_idx(loff_t pos) +static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) { - struct pppox_sock *po = NULL; - int i = 0; + struct pppox_sock *po; + int i; - for (; i < PPPOE_HASH_SIZE; i++) { - po = item_hash_table[i]; + for (i = 0; i < PPPOE_HASH_SIZE; i++) { + po = pn->hash_table[i]; while (po) { if (!pos--) goto out; po = po->next; } } + out: return po; } static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) + __acquires(pn->hash_lock) { + struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); loff_t l = *pos; - read_lock_bh(&pppoe_hash_lock); - return l ? pppoe_get_idx(--l) : SEQ_START_TOKEN; + read_lock_bh(&pn->hash_lock); + return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; } static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) { + struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); struct pppox_sock *po; ++*pos; if (v == SEQ_START_TOKEN) { - po = pppoe_get_idx(0); + po = pppoe_get_idx(pn, 0); goto out; } po = v; - if (po->next) + if (po->next) po = po->next; else { int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); + po = NULL; while (++hash < PPPOE_HASH_SIZE) { - po = item_hash_table[hash]; + po = pn->hash_table[hash]; if (po) break; } } + out: return po; } static void pppoe_seq_stop(struct seq_file *seq, void *v) + __releases(pn->hash_lock) { - read_unlock_bh(&pppoe_hash_lock); + struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); + read_unlock_bh(&pn->hash_lock); } -static struct seq_operations pppoe_seq_ops = { +static const struct seq_operations pppoe_seq_ops = { .start = pppoe_seq_start, .next = pppoe_seq_next, .stop = pppoe_seq_stop, @@ -1036,94 +1091,112 @@ static struct seq_operations pppoe_seq_ops = { static int pppoe_seq_open(struct inode *inode, struct file *file) { - return seq_open(file, &pppoe_seq_ops); + return seq_open_net(inode, file, &pppoe_seq_ops, + sizeof(struct seq_net_private)); } -static struct file_operations pppoe_seq_fops = { +static const struct file_operations pppoe_seq_fops = { .owner = THIS_MODULE, .open = pppoe_seq_open, .read = seq_read, .llseek = seq_lseek, - .release = seq_release, + .release = seq_release_net, +}; + +#endif /* CONFIG_PROC_FS */ + +static const struct proto_ops pppoe_ops = { + .family = AF_PPPOX, + .owner = THIS_MODULE, + .release = pppoe_release, + .bind = sock_no_bind, + .connect = pppoe_connect, + .socketpair = sock_no_socketpair, + .accept = sock_no_accept, + .getname = pppoe_getname, + .poll = datagram_poll, + .listen = sock_no_listen, + .shutdown = sock_no_shutdown, + .setsockopt = sock_no_setsockopt, + .getsockopt = sock_no_getsockopt, + .sendmsg = pppoe_sendmsg, + .recvmsg = pppoe_recvmsg, + .mmap = sock_no_mmap, + .ioctl = pppox_ioctl, +}; + +static struct pppox_proto pppoe_proto = { + .create = pppoe_create, + .ioctl = pppoe_ioctl, + .owner = THIS_MODULE, }; -static int __init pppoe_proc_init(void) +static __net_init int pppoe_init_net(struct net *net) { - struct proc_dir_entry *p; + struct pppoe_net *pn = pppoe_pernet(net); + struct proc_dir_entry *pde; + + rwlock_init(&pn->hash_lock); - p = create_proc_entry("net/pppoe", S_IRUGO, NULL); - if (!p) + pde = proc_net_fops_create(net, "pppoe", S_IRUGO, &pppoe_seq_fops); +#ifdef CONFIG_PROC_FS + if (!pde) return -ENOMEM; +#endif - p->proc_fops = &pppoe_seq_fops; return 0; } -#else /* CONFIG_PROC_FS */ -static inline int pppoe_proc_init(void) { return 0; } -#endif /* CONFIG_PROC_FS */ -static const struct proto_ops pppoe_ops = { - .family = AF_PPPOX, - .owner = THIS_MODULE, - .release = pppoe_release, - .bind = sock_no_bind, - .connect = pppoe_connect, - .socketpair = sock_no_socketpair, - .accept = sock_no_accept, - .getname = pppoe_getname, - .poll = datagram_poll, - .listen = sock_no_listen, - .shutdown = sock_no_shutdown, - .setsockopt = sock_no_setsockopt, - .getsockopt = sock_no_getsockopt, - .sendmsg = pppoe_sendmsg, - .recvmsg = pppoe_recvmsg, - .mmap = sock_no_mmap, - .ioctl = pppox_ioctl, -}; +static __net_exit void pppoe_exit_net(struct net *net) +{ + proc_net_remove(net, "pppoe"); +} -static struct pppox_proto pppoe_proto = { - .create = pppoe_create, - .ioctl = pppoe_ioctl, - .owner = THIS_MODULE, +static struct pernet_operations pppoe_net_ops = { + .init = pppoe_init_net, + .exit = pppoe_exit_net, + .id = &pppoe_net_id, + .size = sizeof(struct pppoe_net), }; - static int __init pppoe_init(void) { - int err = proto_register(&pppoe_sk_proto, 0); + int err; + err = register_pernet_device(&pppoe_net_ops); if (err) goto out; - err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); + err = proto_register(&pppoe_sk_proto, 0); if (err) - goto out_unregister_pppoe_proto; + goto out_unregister_net_ops; - err = pppoe_proc_init(); + err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); if (err) - goto out_unregister_pppox_proto; - + goto out_unregister_pppoe_proto; + dev_add_pack(&pppoes_ptype); dev_add_pack(&pppoed_ptype); register_netdevice_notifier(&pppoe_notifier); -out: - return err; -out_unregister_pppox_proto: - unregister_pppox_proto(PX_PROTO_OE); + + return 0; + out_unregister_pppoe_proto: proto_unregister(&pppoe_sk_proto); - goto out; +out_unregister_net_ops: + unregister_pernet_device(&pppoe_net_ops); +out: + return err; } static void __exit pppoe_exit(void) { - unregister_pppox_proto(PX_PROTO_OE); - dev_remove_pack(&pppoes_ptype); - dev_remove_pack(&pppoed_ptype); unregister_netdevice_notifier(&pppoe_notifier); - remove_proc_entry("net/pppoe", NULL); + dev_remove_pack(&pppoed_ptype); + dev_remove_pack(&pppoes_ptype); + unregister_pppox_proto(PX_PROTO_OE); proto_unregister(&pppoe_sk_proto); + unregister_pernet_device(&pppoe_net_ops); } module_init(pppoe_init);