Loading...
1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2017 - 2018 Covalent IO, Inc. http://covalent.io */
3
4#include <linux/skmsg.h>
5#include <linux/skbuff.h>
6#include <linux/scatterlist.h>
7
8#include <net/sock.h>
9#include <net/tcp.h>
10#include <net/tls.h>
11#include <trace/events/sock.h>
12
13static bool sk_msg_try_coalesce_ok(struct sk_msg *msg, int elem_first_coalesce)
14{
15 if (msg->sg.end > msg->sg.start &&
16 elem_first_coalesce < msg->sg.end)
17 return true;
18
19 if (msg->sg.end < msg->sg.start &&
20 (elem_first_coalesce > msg->sg.start ||
21 elem_first_coalesce < msg->sg.end))
22 return true;
23
24 return false;
25}
26
27int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
28 int elem_first_coalesce)
29{
30 struct page_frag *pfrag = sk_page_frag(sk);
31 u32 osize = msg->sg.size;
32 int ret = 0;
33
34 len -= msg->sg.size;
35 while (len > 0) {
36 struct scatterlist *sge;
37 u32 orig_offset;
38 int use, i;
39
40 if (!sk_page_frag_refill(sk, pfrag)) {
41 ret = -ENOMEM;
42 goto msg_trim;
43 }
44
45 orig_offset = pfrag->offset;
46 use = min_t(int, len, pfrag->size - orig_offset);
47 if (!sk_wmem_schedule(sk, use)) {
48 ret = -ENOMEM;
49 goto msg_trim;
50 }
51
52 i = msg->sg.end;
53 sk_msg_iter_var_prev(i);
54 sge = &msg->sg.data[i];
55
56 if (sk_msg_try_coalesce_ok(msg, elem_first_coalesce) &&
57 sg_page(sge) == pfrag->page &&
58 sge->offset + sge->length == orig_offset) {
59 sge->length += use;
60 } else {
61 if (sk_msg_full(msg)) {
62 ret = -ENOSPC;
63 break;
64 }
65
66 sge = &msg->sg.data[msg->sg.end];
67 sg_unmark_end(sge);
68 sg_set_page(sge, pfrag->page, use, orig_offset);
69 get_page(pfrag->page);
70 sk_msg_iter_next(msg, end);
71 }
72
73 sk_mem_charge(sk, use);
74 msg->sg.size += use;
75 pfrag->offset += use;
76 len -= use;
77 }
78
79 return ret;
80
81msg_trim:
82 sk_msg_trim(sk, msg, osize);
83 return ret;
84}
85EXPORT_SYMBOL_GPL(sk_msg_alloc);
86
87int sk_msg_clone(struct sock *sk, struct sk_msg *dst, struct sk_msg *src,
88 u32 off, u32 len)
89{
90 int i = src->sg.start;
91 struct scatterlist *sge = sk_msg_elem(src, i);
92 struct scatterlist *sgd = NULL;
93 u32 sge_len, sge_off;
94
95 while (off) {
96 if (sge->length > off)
97 break;
98 off -= sge->length;
99 sk_msg_iter_var_next(i);
100 if (i == src->sg.end && off)
101 return -ENOSPC;
102 sge = sk_msg_elem(src, i);
103 }
104
105 while (len) {
106 sge_len = sge->length - off;
107 if (sge_len > len)
108 sge_len = len;
109
110 if (dst->sg.end)
111 sgd = sk_msg_elem(dst, dst->sg.end - 1);
112
113 if (sgd &&
114 (sg_page(sge) == sg_page(sgd)) &&
115 (sg_virt(sge) + off == sg_virt(sgd) + sgd->length)) {
116 sgd->length += sge_len;
117 dst->sg.size += sge_len;
118 } else if (!sk_msg_full(dst)) {
119 sge_off = sge->offset + off;
120 sk_msg_page_add(dst, sg_page(sge), sge_len, sge_off);
121 } else {
122 return -ENOSPC;
123 }
124
125 off = 0;
126 len -= sge_len;
127 sk_mem_charge(sk, sge_len);
128 sk_msg_iter_var_next(i);
129 if (i == src->sg.end && len)
130 return -ENOSPC;
131 sge = sk_msg_elem(src, i);
132 }
133
134 return 0;
135}
136EXPORT_SYMBOL_GPL(sk_msg_clone);
137
138void sk_msg_return_zero(struct sock *sk, struct sk_msg *msg, int bytes)
139{
140 int i = msg->sg.start;
141
142 do {
143 struct scatterlist *sge = sk_msg_elem(msg, i);
144
145 if (bytes < sge->length) {
146 sge->length -= bytes;
147 sge->offset += bytes;
148 sk_mem_uncharge(sk, bytes);
149 break;
150 }
151
152 sk_mem_uncharge(sk, sge->length);
153 bytes -= sge->length;
154 sge->length = 0;
155 sge->offset = 0;
156 sk_msg_iter_var_next(i);
157 } while (bytes && i != msg->sg.end);
158 msg->sg.start = i;
159}
160EXPORT_SYMBOL_GPL(sk_msg_return_zero);
161
162void sk_msg_return(struct sock *sk, struct sk_msg *msg, int bytes)
163{
164 int i = msg->sg.start;
165
166 do {
167 struct scatterlist *sge = &msg->sg.data[i];
168 int uncharge = (bytes < sge->length) ? bytes : sge->length;
169
170 sk_mem_uncharge(sk, uncharge);
171 bytes -= uncharge;
172 sk_msg_iter_var_next(i);
173 } while (i != msg->sg.end);
174}
175EXPORT_SYMBOL_GPL(sk_msg_return);
176
177static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
178 bool charge)
179{
180 struct scatterlist *sge = sk_msg_elem(msg, i);
181 u32 len = sge->length;
182
183 /* When the skb owns the memory we free it from consume_skb path. */
184 if (!msg->skb) {
185 if (charge)
186 sk_mem_uncharge(sk, len);
187 put_page(sg_page(sge));
188 }
189 memset(sge, 0, sizeof(*sge));
190 return len;
191}
192
193static int __sk_msg_free(struct sock *sk, struct sk_msg *msg, u32 i,
194 bool charge)
195{
196 struct scatterlist *sge = sk_msg_elem(msg, i);
197 int freed = 0;
198
199 while (msg->sg.size) {
200 msg->sg.size -= sge->length;
201 freed += sk_msg_free_elem(sk, msg, i, charge);
202 sk_msg_iter_var_next(i);
203 sk_msg_check_to_free(msg, i, msg->sg.size);
204 sge = sk_msg_elem(msg, i);
205 }
206 consume_skb(msg->skb);
207 sk_msg_init(msg);
208 return freed;
209}
210
211int sk_msg_free_nocharge(struct sock *sk, struct sk_msg *msg)
212{
213 return __sk_msg_free(sk, msg, msg->sg.start, false);
214}
215EXPORT_SYMBOL_GPL(sk_msg_free_nocharge);
216
217int sk_msg_free(struct sock *sk, struct sk_msg *msg)
218{
219 return __sk_msg_free(sk, msg, msg->sg.start, true);
220}
221EXPORT_SYMBOL_GPL(sk_msg_free);
222
223static void __sk_msg_free_partial(struct sock *sk, struct sk_msg *msg,
224 u32 bytes, bool charge)
225{
226 struct scatterlist *sge;
227 u32 i = msg->sg.start;
228
229 while (bytes) {
230 sge = sk_msg_elem(msg, i);
231 if (!sge->length)
232 break;
233 if (bytes < sge->length) {
234 if (charge)
235 sk_mem_uncharge(sk, bytes);
236 sge->length -= bytes;
237 sge->offset += bytes;
238 msg->sg.size -= bytes;
239 break;
240 }
241
242 msg->sg.size -= sge->length;
243 bytes -= sge->length;
244 sk_msg_free_elem(sk, msg, i, charge);
245 sk_msg_iter_var_next(i);
246 sk_msg_check_to_free(msg, i, bytes);
247 }
248 msg->sg.start = i;
249}
250
251void sk_msg_free_partial(struct sock *sk, struct sk_msg *msg, u32 bytes)
252{
253 __sk_msg_free_partial(sk, msg, bytes, true);
254}
255EXPORT_SYMBOL_GPL(sk_msg_free_partial);
256
257void sk_msg_free_partial_nocharge(struct sock *sk, struct sk_msg *msg,
258 u32 bytes)
259{
260 __sk_msg_free_partial(sk, msg, bytes, false);
261}
262
263void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
264{
265 int trim = msg->sg.size - len;
266 u32 i = msg->sg.end;
267
268 if (trim <= 0) {
269 WARN_ON(trim < 0);
270 return;
271 }
272
273 sk_msg_iter_var_prev(i);
274 msg->sg.size = len;
275 while (msg->sg.data[i].length &&
276 trim >= msg->sg.data[i].length) {
277 trim -= msg->sg.data[i].length;
278 sk_msg_free_elem(sk, msg, i, true);
279 sk_msg_iter_var_prev(i);
280 if (!trim)
281 goto out;
282 }
283
284 msg->sg.data[i].length -= trim;
285 sk_mem_uncharge(sk, trim);
286 /* Adjust copybreak if it falls into the trimmed part of last buf */
287 if (msg->sg.curr == i && msg->sg.copybreak > msg->sg.data[i].length)
288 msg->sg.copybreak = msg->sg.data[i].length;
289out:
290 sk_msg_iter_var_next(i);
291 msg->sg.end = i;
292
293 /* If we trim data a full sg elem before curr pointer update
294 * copybreak and current so that any future copy operations
295 * start at new copy location.
296 * However trimmed data that has not yet been used in a copy op
297 * does not require an update.
298 */
299 if (!msg->sg.size) {
300 msg->sg.curr = msg->sg.start;
301 msg->sg.copybreak = 0;
302 } else if (sk_msg_iter_dist(msg->sg.start, msg->sg.curr) >=
303 sk_msg_iter_dist(msg->sg.start, msg->sg.end)) {
304 sk_msg_iter_var_prev(i);
305 msg->sg.curr = i;
306 msg->sg.copybreak = msg->sg.data[i].length;
307 }
308}
309EXPORT_SYMBOL_GPL(sk_msg_trim);
310
311int sk_msg_zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
312 struct sk_msg *msg, u32 bytes)
313{
314 int i, maxpages, ret = 0, num_elems = sk_msg_elem_used(msg);
315 const int to_max_pages = MAX_MSG_FRAGS;
316 struct page *pages[MAX_MSG_FRAGS];
317 ssize_t orig, copied, use, offset;
318
319 orig = msg->sg.size;
320 while (bytes > 0) {
321 i = 0;
322 maxpages = to_max_pages - num_elems;
323 if (maxpages == 0) {
324 ret = -EFAULT;
325 goto out;
326 }
327
328 copied = iov_iter_get_pages2(from, pages, bytes, maxpages,
329 &offset);
330 if (copied <= 0) {
331 ret = -EFAULT;
332 goto out;
333 }
334
335 bytes -= copied;
336 msg->sg.size += copied;
337
338 while (copied) {
339 use = min_t(int, copied, PAGE_SIZE - offset);
340 sg_set_page(&msg->sg.data[msg->sg.end],
341 pages[i], use, offset);
342 sg_unmark_end(&msg->sg.data[msg->sg.end]);
343 sk_mem_charge(sk, use);
344
345 offset = 0;
346 copied -= use;
347 sk_msg_iter_next(msg, end);
348 num_elems++;
349 i++;
350 }
351 /* When zerocopy is mixed with sk_msg_*copy* operations we
352 * may have a copybreak set in this case clear and prefer
353 * zerocopy remainder when possible.
354 */
355 msg->sg.copybreak = 0;
356 msg->sg.curr = msg->sg.end;
357 }
358out:
359 /* Revert iov_iter updates, msg will need to use 'trim' later if it
360 * also needs to be cleared.
361 */
362 if (ret)
363 iov_iter_revert(from, msg->sg.size - orig);
364 return ret;
365}
366EXPORT_SYMBOL_GPL(sk_msg_zerocopy_from_iter);
367
368int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from,
369 struct sk_msg *msg, u32 bytes)
370{
371 int ret = -ENOSPC, i = msg->sg.curr;
372 u32 copy, buf_size, copied = 0;
373 struct scatterlist *sge;
374 void *to;
375
376 do {
377 sge = sk_msg_elem(msg, i);
378 /* This is possible if a trim operation shrunk the buffer */
379 if (msg->sg.copybreak >= sge->length) {
380 msg->sg.copybreak = 0;
381 sk_msg_iter_var_next(i);
382 if (i == msg->sg.end)
383 break;
384 sge = sk_msg_elem(msg, i);
385 }
386
387 buf_size = sge->length - msg->sg.copybreak;
388 copy = (buf_size > bytes) ? bytes : buf_size;
389 to = sg_virt(sge) + msg->sg.copybreak;
390 msg->sg.copybreak += copy;
391 if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY)
392 ret = copy_from_iter_nocache(to, copy, from);
393 else
394 ret = copy_from_iter(to, copy, from);
395 if (ret != copy) {
396 ret = -EFAULT;
397 goto out;
398 }
399 bytes -= copy;
400 copied += copy;
401 if (!bytes)
402 break;
403 msg->sg.copybreak = 0;
404 sk_msg_iter_var_next(i);
405 } while (i != msg->sg.end);
406out:
407 msg->sg.curr = i;
408 return (ret < 0) ? ret : copied;
409}
410EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
411
412/* Receive sk_msg from psock->ingress_msg to @msg. */
413int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
414 int len, int flags)
415{
416 struct iov_iter *iter = &msg->msg_iter;
417 int peek = flags & MSG_PEEK;
418 struct sk_msg *msg_rx;
419 int i, copied = 0;
420
421 msg_rx = sk_psock_peek_msg(psock);
422 while (copied != len) {
423 struct scatterlist *sge;
424
425 if (unlikely(!msg_rx))
426 break;
427
428 i = msg_rx->sg.start;
429 do {
430 struct page *page;
431 int copy;
432
433 sge = sk_msg_elem(msg_rx, i);
434 copy = sge->length;
435 page = sg_page(sge);
436 if (copied + copy > len)
437 copy = len - copied;
438 if (copy)
439 copy = copy_page_to_iter(page, sge->offset, copy, iter);
440 if (!copy) {
441 copied = copied ? copied : -EFAULT;
442 goto out;
443 }
444
445 copied += copy;
446 if (likely(!peek)) {
447 sge->offset += copy;
448 sge->length -= copy;
449 if (!msg_rx->skb) {
450 sk_mem_uncharge(sk, copy);
451 atomic_sub(copy, &sk->sk_rmem_alloc);
452 }
453 msg_rx->sg.size -= copy;
454
455 if (!sge->length) {
456 sk_msg_iter_var_next(i);
457 if (!msg_rx->skb)
458 put_page(page);
459 }
460 } else {
461 /* Lets not optimize peek case if copy_page_to_iter
462 * didn't copy the entire length lets just break.
463 */
464 if (copy != sge->length)
465 goto out;
466 sk_msg_iter_var_next(i);
467 }
468
469 if (copied == len)
470 break;
471 } while ((i != msg_rx->sg.end) && !sg_is_last(sge));
472
473 if (unlikely(peek)) {
474 msg_rx = sk_psock_next_msg(psock, msg_rx);
475 if (!msg_rx)
476 break;
477 continue;
478 }
479
480 msg_rx->sg.start = i;
481 if (!sge->length && (i == msg_rx->sg.end || sg_is_last(sge))) {
482 msg_rx = sk_psock_dequeue_msg(psock);
483 kfree_sk_msg(msg_rx);
484 }
485 msg_rx = sk_psock_peek_msg(psock);
486 }
487out:
488 return copied;
489}
490EXPORT_SYMBOL_GPL(sk_msg_recvmsg);
491
492bool sk_msg_is_readable(struct sock *sk)
493{
494 struct sk_psock *psock;
495 bool empty = true;
496
497 rcu_read_lock();
498 psock = sk_psock(sk);
499 if (likely(psock))
500 empty = list_empty(&psock->ingress_msg);
501 rcu_read_unlock();
502 return !empty;
503}
504EXPORT_SYMBOL_GPL(sk_msg_is_readable);
505
506static struct sk_msg *alloc_sk_msg(gfp_t gfp)
507{
508 struct sk_msg *msg;
509
510 msg = kzalloc(sizeof(*msg), gfp | __GFP_NOWARN);
511 if (unlikely(!msg))
512 return NULL;
513 sg_init_marker(msg->sg.data, NR_MSG_FRAG_IDS);
514 return msg;
515}
516
517static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
518 struct sk_buff *skb)
519{
520 if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
521 return NULL;
522
523 if (!sk_rmem_schedule(sk, skb, skb->truesize))
524 return NULL;
525
526 return alloc_sk_msg(GFP_KERNEL);
527}
528
529static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
530 u32 off, u32 len,
531 struct sk_psock *psock,
532 struct sock *sk,
533 struct sk_msg *msg)
534{
535 int num_sge, copied;
536
537 num_sge = skb_to_sgvec(skb, msg->sg.data, off, len);
538 if (num_sge < 0) {
539 /* skb linearize may fail with ENOMEM, but lets simply try again
540 * later if this happens. Under memory pressure we don't want to
541 * drop the skb. We need to linearize the skb so that the mapping
542 * in skb_to_sgvec can not error.
543 */
544 if (skb_linearize(skb))
545 return -EAGAIN;
546
547 num_sge = skb_to_sgvec(skb, msg->sg.data, off, len);
548 if (unlikely(num_sge < 0))
549 return num_sge;
550 }
551
552 copied = len;
553 msg->sg.start = 0;
554 msg->sg.size = copied;
555 msg->sg.end = num_sge;
556 msg->skb = skb;
557
558 sk_psock_queue_msg(psock, msg);
559 sk_psock_data_ready(sk, psock);
560 return copied;
561}
562
563static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb,
564 u32 off, u32 len);
565
566static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb,
567 u32 off, u32 len)
568{
569 struct sock *sk = psock->sk;
570 struct sk_msg *msg;
571 int err;
572
573 /* If we are receiving on the same sock skb->sk is already assigned,
574 * skip memory accounting and owner transition seeing it already set
575 * correctly.
576 */
577 if (unlikely(skb->sk == sk))
578 return sk_psock_skb_ingress_self(psock, skb, off, len);
579 msg = sk_psock_create_ingress_msg(sk, skb);
580 if (!msg)
581 return -EAGAIN;
582
583 /* This will transition ownership of the data from the socket where
584 * the BPF program was run initiating the redirect to the socket
585 * we will eventually receive this data on. The data will be released
586 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
587 * into user buffers.
588 */
589 skb_set_owner_r(skb, sk);
590 err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg);
591 if (err < 0)
592 kfree(msg);
593 return err;
594}
595
596/* Puts an skb on the ingress queue of the socket already assigned to the
597 * skb. In this case we do not need to check memory limits or skb_set_owner_r
598 * because the skb is already accounted for here.
599 */
600static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb,
601 u32 off, u32 len)
602{
603 struct sk_msg *msg = alloc_sk_msg(GFP_ATOMIC);
604 struct sock *sk = psock->sk;
605 int err;
606
607 if (unlikely(!msg))
608 return -EAGAIN;
609 skb_set_owner_r(skb, sk);
610 err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg);
611 if (err < 0)
612 kfree(msg);
613 return err;
614}
615
616static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
617 u32 off, u32 len, bool ingress)
618{
619 int err = 0;
620
621 if (!ingress) {
622 if (!sock_writeable(psock->sk))
623 return -EAGAIN;
624 return skb_send_sock(psock->sk, skb, off, len);
625 }
626 skb_get(skb);
627 err = sk_psock_skb_ingress(psock, skb, off, len);
628 if (err < 0)
629 kfree_skb(skb);
630 return err;
631}
632
633static void sk_psock_skb_state(struct sk_psock *psock,
634 struct sk_psock_work_state *state,
635 int len, int off)
636{
637 spin_lock_bh(&psock->ingress_lock);
638 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
639 state->len = len;
640 state->off = off;
641 }
642 spin_unlock_bh(&psock->ingress_lock);
643}
644
645static void sk_psock_backlog(struct work_struct *work)
646{
647 struct delayed_work *dwork = to_delayed_work(work);
648 struct sk_psock *psock = container_of(dwork, struct sk_psock, work);
649 struct sk_psock_work_state *state = &psock->work_state;
650 struct sk_buff *skb = NULL;
651 u32 len = 0, off = 0;
652 bool ingress;
653 int ret;
654
655 mutex_lock(&psock->work_mutex);
656 if (unlikely(state->len)) {
657 len = state->len;
658 off = state->off;
659 }
660
661 while ((skb = skb_peek(&psock->ingress_skb))) {
662 len = skb->len;
663 off = 0;
664 if (skb_bpf_strparser(skb)) {
665 struct strp_msg *stm = strp_msg(skb);
666
667 off = stm->offset;
668 len = stm->full_len;
669 }
670 ingress = skb_bpf_ingress(skb);
671 skb_bpf_redirect_clear(skb);
672 do {
673 ret = -EIO;
674 if (!sock_flag(psock->sk, SOCK_DEAD))
675 ret = sk_psock_handle_skb(psock, skb, off,
676 len, ingress);
677 if (ret <= 0) {
678 if (ret == -EAGAIN) {
679 sk_psock_skb_state(psock, state, len, off);
680
681 /* Delay slightly to prioritize any
682 * other work that might be here.
683 */
684 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
685 schedule_delayed_work(&psock->work, 1);
686 goto end;
687 }
688 /* Hard errors break pipe and stop xmit. */
689 sk_psock_report_error(psock, ret ? -ret : EPIPE);
690 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
691 goto end;
692 }
693 off += ret;
694 len -= ret;
695 } while (len);
696
697 skb = skb_dequeue(&psock->ingress_skb);
698 kfree_skb(skb);
699 }
700end:
701 mutex_unlock(&psock->work_mutex);
702}
703
704struct sk_psock *sk_psock_init(struct sock *sk, int node)
705{
706 struct sk_psock *psock;
707 struct proto *prot;
708
709 write_lock_bh(&sk->sk_callback_lock);
710
711 if (sk_is_inet(sk) && inet_csk_has_ulp(sk)) {
712 psock = ERR_PTR(-EINVAL);
713 goto out;
714 }
715
716 if (sk->sk_user_data) {
717 psock = ERR_PTR(-EBUSY);
718 goto out;
719 }
720
721 psock = kzalloc_node(sizeof(*psock), GFP_ATOMIC | __GFP_NOWARN, node);
722 if (!psock) {
723 psock = ERR_PTR(-ENOMEM);
724 goto out;
725 }
726
727 prot = READ_ONCE(sk->sk_prot);
728 psock->sk = sk;
729 psock->eval = __SK_NONE;
730 psock->sk_proto = prot;
731 psock->saved_unhash = prot->unhash;
732 psock->saved_destroy = prot->destroy;
733 psock->saved_close = prot->close;
734 psock->saved_write_space = sk->sk_write_space;
735
736 INIT_LIST_HEAD(&psock->link);
737 spin_lock_init(&psock->link_lock);
738
739 INIT_DELAYED_WORK(&psock->work, sk_psock_backlog);
740 mutex_init(&psock->work_mutex);
741 INIT_LIST_HEAD(&psock->ingress_msg);
742 spin_lock_init(&psock->ingress_lock);
743 skb_queue_head_init(&psock->ingress_skb);
744
745 sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
746 refcount_set(&psock->refcnt, 1);
747
748 __rcu_assign_sk_user_data_with_flags(sk, psock,
749 SK_USER_DATA_NOCOPY |
750 SK_USER_DATA_PSOCK);
751 sock_hold(sk);
752
753out:
754 write_unlock_bh(&sk->sk_callback_lock);
755 return psock;
756}
757EXPORT_SYMBOL_GPL(sk_psock_init);
758
759struct sk_psock_link *sk_psock_link_pop(struct sk_psock *psock)
760{
761 struct sk_psock_link *link;
762
763 spin_lock_bh(&psock->link_lock);
764 link = list_first_entry_or_null(&psock->link, struct sk_psock_link,
765 list);
766 if (link)
767 list_del(&link->list);
768 spin_unlock_bh(&psock->link_lock);
769 return link;
770}
771
772static void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
773{
774 struct sk_msg *msg, *tmp;
775
776 list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
777 list_del(&msg->list);
778 if (!msg->skb)
779 atomic_sub(msg->sg.size, &psock->sk->sk_rmem_alloc);
780 sk_msg_free(psock->sk, msg);
781 kfree(msg);
782 }
783}
784
785static void __sk_psock_zap_ingress(struct sk_psock *psock)
786{
787 struct sk_buff *skb;
788
789 while ((skb = skb_dequeue(&psock->ingress_skb)) != NULL) {
790 skb_bpf_redirect_clear(skb);
791 sock_drop(psock->sk, skb);
792 }
793 __sk_psock_purge_ingress_msg(psock);
794}
795
796static void sk_psock_link_destroy(struct sk_psock *psock)
797{
798 struct sk_psock_link *link, *tmp;
799
800 list_for_each_entry_safe(link, tmp, &psock->link, list) {
801 list_del(&link->list);
802 sk_psock_free_link(link);
803 }
804}
805
806void sk_psock_stop(struct sk_psock *psock)
807{
808 spin_lock_bh(&psock->ingress_lock);
809 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
810 sk_psock_cork_free(psock);
811 spin_unlock_bh(&psock->ingress_lock);
812}
813
814static void sk_psock_done_strp(struct sk_psock *psock);
815
816static void sk_psock_destroy(struct work_struct *work)
817{
818 struct sk_psock *psock = container_of(to_rcu_work(work),
819 struct sk_psock, rwork);
820 /* No sk_callback_lock since already detached. */
821
822 sk_psock_done_strp(psock);
823
824 cancel_delayed_work_sync(&psock->work);
825 __sk_psock_zap_ingress(psock);
826 mutex_destroy(&psock->work_mutex);
827
828 psock_progs_drop(&psock->progs);
829
830 sk_psock_link_destroy(psock);
831 sk_psock_cork_free(psock);
832
833 if (psock->sk_redir)
834 sock_put(psock->sk_redir);
835 if (psock->sk_pair)
836 sock_put(psock->sk_pair);
837 sock_put(psock->sk);
838 kfree(psock);
839}
840
841void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
842{
843 write_lock_bh(&sk->sk_callback_lock);
844 sk_psock_restore_proto(sk, psock);
845 rcu_assign_sk_user_data(sk, NULL);
846 if (psock->progs.stream_parser)
847 sk_psock_stop_strp(sk, psock);
848 else if (psock->progs.stream_verdict || psock->progs.skb_verdict)
849 sk_psock_stop_verdict(sk, psock);
850 write_unlock_bh(&sk->sk_callback_lock);
851
852 sk_psock_stop(psock);
853
854 INIT_RCU_WORK(&psock->rwork, sk_psock_destroy);
855 queue_rcu_work(system_wq, &psock->rwork);
856}
857EXPORT_SYMBOL_GPL(sk_psock_drop);
858
859static int sk_psock_map_verd(int verdict, bool redir)
860{
861 switch (verdict) {
862 case SK_PASS:
863 return redir ? __SK_REDIRECT : __SK_PASS;
864 case SK_DROP:
865 default:
866 break;
867 }
868
869 return __SK_DROP;
870}
871
872int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
873 struct sk_msg *msg)
874{
875 struct bpf_prog *prog;
876 int ret;
877
878 rcu_read_lock();
879 prog = READ_ONCE(psock->progs.msg_parser);
880 if (unlikely(!prog)) {
881 ret = __SK_PASS;
882 goto out;
883 }
884
885 sk_msg_compute_data_pointers(msg);
886 msg->sk = sk;
887 ret = bpf_prog_run_pin_on_cpu(prog, msg);
888 ret = sk_psock_map_verd(ret, msg->sk_redir);
889 psock->apply_bytes = msg->apply_bytes;
890 if (ret == __SK_REDIRECT) {
891 if (psock->sk_redir) {
892 sock_put(psock->sk_redir);
893 psock->sk_redir = NULL;
894 }
895 if (!msg->sk_redir) {
896 ret = __SK_DROP;
897 goto out;
898 }
899 psock->redir_ingress = sk_msg_to_ingress(msg);
900 psock->sk_redir = msg->sk_redir;
901 sock_hold(psock->sk_redir);
902 }
903out:
904 rcu_read_unlock();
905 return ret;
906}
907EXPORT_SYMBOL_GPL(sk_psock_msg_verdict);
908
909static int sk_psock_skb_redirect(struct sk_psock *from, struct sk_buff *skb)
910{
911 struct sk_psock *psock_other;
912 struct sock *sk_other;
913
914 sk_other = skb_bpf_redirect_fetch(skb);
915 /* This error is a buggy BPF program, it returned a redirect
916 * return code, but then didn't set a redirect interface.
917 */
918 if (unlikely(!sk_other)) {
919 skb_bpf_redirect_clear(skb);
920 sock_drop(from->sk, skb);
921 return -EIO;
922 }
923 psock_other = sk_psock(sk_other);
924 /* This error indicates the socket is being torn down or had another
925 * error that caused the pipe to break. We can't send a packet on
926 * a socket that is in this state so we drop the skb.
927 */
928 if (!psock_other || sock_flag(sk_other, SOCK_DEAD)) {
929 skb_bpf_redirect_clear(skb);
930 sock_drop(from->sk, skb);
931 return -EIO;
932 }
933 spin_lock_bh(&psock_other->ingress_lock);
934 if (!sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED)) {
935 spin_unlock_bh(&psock_other->ingress_lock);
936 skb_bpf_redirect_clear(skb);
937 sock_drop(from->sk, skb);
938 return -EIO;
939 }
940
941 skb_queue_tail(&psock_other->ingress_skb, skb);
942 schedule_delayed_work(&psock_other->work, 0);
943 spin_unlock_bh(&psock_other->ingress_lock);
944 return 0;
945}
946
947static void sk_psock_tls_verdict_apply(struct sk_buff *skb,
948 struct sk_psock *from, int verdict)
949{
950 switch (verdict) {
951 case __SK_REDIRECT:
952 sk_psock_skb_redirect(from, skb);
953 break;
954 case __SK_PASS:
955 case __SK_DROP:
956 default:
957 break;
958 }
959}
960
961int sk_psock_tls_strp_read(struct sk_psock *psock, struct sk_buff *skb)
962{
963 struct bpf_prog *prog;
964 int ret = __SK_PASS;
965
966 rcu_read_lock();
967 prog = READ_ONCE(psock->progs.stream_verdict);
968 if (likely(prog)) {
969 skb->sk = psock->sk;
970 skb_dst_drop(skb);
971 skb_bpf_redirect_clear(skb);
972 ret = bpf_prog_run_pin_on_cpu(prog, skb);
973 ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
974 skb->sk = NULL;
975 }
976 sk_psock_tls_verdict_apply(skb, psock, ret);
977 rcu_read_unlock();
978 return ret;
979}
980EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
981
982static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
983 int verdict)
984{
985 struct sock *sk_other;
986 int err = 0;
987 u32 len, off;
988
989 switch (verdict) {
990 case __SK_PASS:
991 err = -EIO;
992 sk_other = psock->sk;
993 if (sock_flag(sk_other, SOCK_DEAD) ||
994 !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
995 goto out_free;
996
997 skb_bpf_set_ingress(skb);
998
999 /* If the queue is empty then we can submit directly
1000 * into the msg queue. If its not empty we have to
1001 * queue work otherwise we may get OOO data. Otherwise,
1002 * if sk_psock_skb_ingress errors will be handled by
1003 * retrying later from workqueue.
1004 */
1005 if (skb_queue_empty(&psock->ingress_skb)) {
1006 len = skb->len;
1007 off = 0;
1008 if (skb_bpf_strparser(skb)) {
1009 struct strp_msg *stm = strp_msg(skb);
1010
1011 off = stm->offset;
1012 len = stm->full_len;
1013 }
1014 err = sk_psock_skb_ingress_self(psock, skb, off, len);
1015 }
1016 if (err < 0) {
1017 spin_lock_bh(&psock->ingress_lock);
1018 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
1019 skb_queue_tail(&psock->ingress_skb, skb);
1020 schedule_delayed_work(&psock->work, 0);
1021 err = 0;
1022 }
1023 spin_unlock_bh(&psock->ingress_lock);
1024 if (err < 0)
1025 goto out_free;
1026 }
1027 break;
1028 case __SK_REDIRECT:
1029 tcp_eat_skb(psock->sk, skb);
1030 err = sk_psock_skb_redirect(psock, skb);
1031 break;
1032 case __SK_DROP:
1033 default:
1034out_free:
1035 skb_bpf_redirect_clear(skb);
1036 tcp_eat_skb(psock->sk, skb);
1037 sock_drop(psock->sk, skb);
1038 }
1039
1040 return err;
1041}
1042
1043static void sk_psock_write_space(struct sock *sk)
1044{
1045 struct sk_psock *psock;
1046 void (*write_space)(struct sock *sk) = NULL;
1047
1048 rcu_read_lock();
1049 psock = sk_psock(sk);
1050 if (likely(psock)) {
1051 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
1052 schedule_delayed_work(&psock->work, 0);
1053 write_space = psock->saved_write_space;
1054 }
1055 rcu_read_unlock();
1056 if (write_space)
1057 write_space(sk);
1058}
1059
1060#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)
1061static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb)
1062{
1063 struct sk_psock *psock;
1064 struct bpf_prog *prog;
1065 int ret = __SK_DROP;
1066 struct sock *sk;
1067
1068 rcu_read_lock();
1069 sk = strp->sk;
1070 psock = sk_psock(sk);
1071 if (unlikely(!psock)) {
1072 sock_drop(sk, skb);
1073 goto out;
1074 }
1075 prog = READ_ONCE(psock->progs.stream_verdict);
1076 if (likely(prog)) {
1077 skb->sk = sk;
1078 skb_dst_drop(skb);
1079 skb_bpf_redirect_clear(skb);
1080 ret = bpf_prog_run_pin_on_cpu(prog, skb);
1081 skb_bpf_set_strparser(skb);
1082 ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
1083 skb->sk = NULL;
1084 }
1085 sk_psock_verdict_apply(psock, skb, ret);
1086out:
1087 rcu_read_unlock();
1088}
1089
1090static int sk_psock_strp_read_done(struct strparser *strp, int err)
1091{
1092 return err;
1093}
1094
1095static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
1096{
1097 struct sk_psock *psock = container_of(strp, struct sk_psock, strp);
1098 struct bpf_prog *prog;
1099 int ret = skb->len;
1100
1101 rcu_read_lock();
1102 prog = READ_ONCE(psock->progs.stream_parser);
1103 if (likely(prog)) {
1104 skb->sk = psock->sk;
1105 ret = bpf_prog_run_pin_on_cpu(prog, skb);
1106 skb->sk = NULL;
1107 }
1108 rcu_read_unlock();
1109 return ret;
1110}
1111
1112/* Called with socket lock held. */
1113static void sk_psock_strp_data_ready(struct sock *sk)
1114{
1115 struct sk_psock *psock;
1116
1117 trace_sk_data_ready(sk);
1118
1119 rcu_read_lock();
1120 psock = sk_psock(sk);
1121 if (likely(psock)) {
1122 if (tls_sw_has_ctx_rx(sk)) {
1123 psock->saved_data_ready(sk);
1124 } else {
1125 read_lock_bh(&sk->sk_callback_lock);
1126 strp_data_ready(&psock->strp);
1127 read_unlock_bh(&sk->sk_callback_lock);
1128 }
1129 }
1130 rcu_read_unlock();
1131}
1132
1133int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
1134{
1135 int ret;
1136
1137 static const struct strp_callbacks cb = {
1138 .rcv_msg = sk_psock_strp_read,
1139 .read_sock_done = sk_psock_strp_read_done,
1140 .parse_msg = sk_psock_strp_parse,
1141 };
1142
1143 ret = strp_init(&psock->strp, sk, &cb);
1144 if (!ret)
1145 sk_psock_set_state(psock, SK_PSOCK_RX_STRP_ENABLED);
1146
1147 return ret;
1148}
1149
1150void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
1151{
1152 if (psock->saved_data_ready)
1153 return;
1154
1155 psock->saved_data_ready = sk->sk_data_ready;
1156 sk->sk_data_ready = sk_psock_strp_data_ready;
1157 sk->sk_write_space = sk_psock_write_space;
1158}
1159
1160void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
1161{
1162 psock_set_prog(&psock->progs.stream_parser, NULL);
1163
1164 if (!psock->saved_data_ready)
1165 return;
1166
1167 sk->sk_data_ready = psock->saved_data_ready;
1168 psock->saved_data_ready = NULL;
1169 strp_stop(&psock->strp);
1170}
1171
1172static void sk_psock_done_strp(struct sk_psock *psock)
1173{
1174 /* Parser has been stopped */
1175 if (sk_psock_test_state(psock, SK_PSOCK_RX_STRP_ENABLED))
1176 strp_done(&psock->strp);
1177}
1178#else
1179static void sk_psock_done_strp(struct sk_psock *psock)
1180{
1181}
1182#endif /* CONFIG_BPF_STREAM_PARSER */
1183
1184static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb)
1185{
1186 struct sk_psock *psock;
1187 struct bpf_prog *prog;
1188 int ret = __SK_DROP;
1189 int len = skb->len;
1190
1191 rcu_read_lock();
1192 psock = sk_psock(sk);
1193 if (unlikely(!psock)) {
1194 len = 0;
1195 tcp_eat_skb(sk, skb);
1196 sock_drop(sk, skb);
1197 goto out;
1198 }
1199 prog = READ_ONCE(psock->progs.stream_verdict);
1200 if (!prog)
1201 prog = READ_ONCE(psock->progs.skb_verdict);
1202 if (likely(prog)) {
1203 skb_dst_drop(skb);
1204 skb_bpf_redirect_clear(skb);
1205 ret = bpf_prog_run_pin_on_cpu(prog, skb);
1206 ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
1207 }
1208 ret = sk_psock_verdict_apply(psock, skb, ret);
1209 if (ret < 0)
1210 len = ret;
1211out:
1212 rcu_read_unlock();
1213 return len;
1214}
1215
1216static void sk_psock_verdict_data_ready(struct sock *sk)
1217{
1218 struct socket *sock = sk->sk_socket;
1219 const struct proto_ops *ops;
1220 int copied;
1221
1222 trace_sk_data_ready(sk);
1223
1224 if (unlikely(!sock))
1225 return;
1226 ops = READ_ONCE(sock->ops);
1227 if (!ops || !ops->read_skb)
1228 return;
1229 copied = ops->read_skb(sk, sk_psock_verdict_recv);
1230 if (copied >= 0) {
1231 struct sk_psock *psock;
1232
1233 rcu_read_lock();
1234 psock = sk_psock(sk);
1235 if (psock)
1236 sk_psock_data_ready(sk, psock);
1237 rcu_read_unlock();
1238 }
1239}
1240
1241void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock)
1242{
1243 if (psock->saved_data_ready)
1244 return;
1245
1246 psock->saved_data_ready = sk->sk_data_ready;
1247 sk->sk_data_ready = sk_psock_verdict_data_ready;
1248 sk->sk_write_space = sk_psock_write_space;
1249}
1250
1251void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock)
1252{
1253 psock_set_prog(&psock->progs.stream_verdict, NULL);
1254 psock_set_prog(&psock->progs.skb_verdict, NULL);
1255
1256 if (!psock->saved_data_ready)
1257 return;
1258
1259 sk->sk_data_ready = psock->saved_data_ready;
1260 psock->saved_data_ready = NULL;
1261}
1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2017 - 2018 Covalent IO, Inc. http://covalent.io */
3
4#include <linux/skmsg.h>
5#include <linux/skbuff.h>
6#include <linux/scatterlist.h>
7
8#include <net/sock.h>
9#include <net/tcp.h>
10#include <net/tls.h>
11
12static bool sk_msg_try_coalesce_ok(struct sk_msg *msg, int elem_first_coalesce)
13{
14 if (msg->sg.end > msg->sg.start &&
15 elem_first_coalesce < msg->sg.end)
16 return true;
17
18 if (msg->sg.end < msg->sg.start &&
19 (elem_first_coalesce > msg->sg.start ||
20 elem_first_coalesce < msg->sg.end))
21 return true;
22
23 return false;
24}
25
26int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
27 int elem_first_coalesce)
28{
29 struct page_frag *pfrag = sk_page_frag(sk);
30 u32 osize = msg->sg.size;
31 int ret = 0;
32
33 len -= msg->sg.size;
34 while (len > 0) {
35 struct scatterlist *sge;
36 u32 orig_offset;
37 int use, i;
38
39 if (!sk_page_frag_refill(sk, pfrag)) {
40 ret = -ENOMEM;
41 goto msg_trim;
42 }
43
44 orig_offset = pfrag->offset;
45 use = min_t(int, len, pfrag->size - orig_offset);
46 if (!sk_wmem_schedule(sk, use)) {
47 ret = -ENOMEM;
48 goto msg_trim;
49 }
50
51 i = msg->sg.end;
52 sk_msg_iter_var_prev(i);
53 sge = &msg->sg.data[i];
54
55 if (sk_msg_try_coalesce_ok(msg, elem_first_coalesce) &&
56 sg_page(sge) == pfrag->page &&
57 sge->offset + sge->length == orig_offset) {
58 sge->length += use;
59 } else {
60 if (sk_msg_full(msg)) {
61 ret = -ENOSPC;
62 break;
63 }
64
65 sge = &msg->sg.data[msg->sg.end];
66 sg_unmark_end(sge);
67 sg_set_page(sge, pfrag->page, use, orig_offset);
68 get_page(pfrag->page);
69 sk_msg_iter_next(msg, end);
70 }
71
72 sk_mem_charge(sk, use);
73 msg->sg.size += use;
74 pfrag->offset += use;
75 len -= use;
76 }
77
78 return ret;
79
80msg_trim:
81 sk_msg_trim(sk, msg, osize);
82 return ret;
83}
84EXPORT_SYMBOL_GPL(sk_msg_alloc);
85
86int sk_msg_clone(struct sock *sk, struct sk_msg *dst, struct sk_msg *src,
87 u32 off, u32 len)
88{
89 int i = src->sg.start;
90 struct scatterlist *sge = sk_msg_elem(src, i);
91 struct scatterlist *sgd = NULL;
92 u32 sge_len, sge_off;
93
94 while (off) {
95 if (sge->length > off)
96 break;
97 off -= sge->length;
98 sk_msg_iter_var_next(i);
99 if (i == src->sg.end && off)
100 return -ENOSPC;
101 sge = sk_msg_elem(src, i);
102 }
103
104 while (len) {
105 sge_len = sge->length - off;
106 if (sge_len > len)
107 sge_len = len;
108
109 if (dst->sg.end)
110 sgd = sk_msg_elem(dst, dst->sg.end - 1);
111
112 if (sgd &&
113 (sg_page(sge) == sg_page(sgd)) &&
114 (sg_virt(sge) + off == sg_virt(sgd) + sgd->length)) {
115 sgd->length += sge_len;
116 dst->sg.size += sge_len;
117 } else if (!sk_msg_full(dst)) {
118 sge_off = sge->offset + off;
119 sk_msg_page_add(dst, sg_page(sge), sge_len, sge_off);
120 } else {
121 return -ENOSPC;
122 }
123
124 off = 0;
125 len -= sge_len;
126 sk_mem_charge(sk, sge_len);
127 sk_msg_iter_var_next(i);
128 if (i == src->sg.end && len)
129 return -ENOSPC;
130 sge = sk_msg_elem(src, i);
131 }
132
133 return 0;
134}
135EXPORT_SYMBOL_GPL(sk_msg_clone);
136
137void sk_msg_return_zero(struct sock *sk, struct sk_msg *msg, int bytes)
138{
139 int i = msg->sg.start;
140
141 do {
142 struct scatterlist *sge = sk_msg_elem(msg, i);
143
144 if (bytes < sge->length) {
145 sge->length -= bytes;
146 sge->offset += bytes;
147 sk_mem_uncharge(sk, bytes);
148 break;
149 }
150
151 sk_mem_uncharge(sk, sge->length);
152 bytes -= sge->length;
153 sge->length = 0;
154 sge->offset = 0;
155 sk_msg_iter_var_next(i);
156 } while (bytes && i != msg->sg.end);
157 msg->sg.start = i;
158}
159EXPORT_SYMBOL_GPL(sk_msg_return_zero);
160
161void sk_msg_return(struct sock *sk, struct sk_msg *msg, int bytes)
162{
163 int i = msg->sg.start;
164
165 do {
166 struct scatterlist *sge = &msg->sg.data[i];
167 int uncharge = (bytes < sge->length) ? bytes : sge->length;
168
169 sk_mem_uncharge(sk, uncharge);
170 bytes -= uncharge;
171 sk_msg_iter_var_next(i);
172 } while (i != msg->sg.end);
173}
174EXPORT_SYMBOL_GPL(sk_msg_return);
175
176static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
177 bool charge)
178{
179 struct scatterlist *sge = sk_msg_elem(msg, i);
180 u32 len = sge->length;
181
182 /* When the skb owns the memory we free it from consume_skb path. */
183 if (!msg->skb) {
184 if (charge)
185 sk_mem_uncharge(sk, len);
186 put_page(sg_page(sge));
187 }
188 memset(sge, 0, sizeof(*sge));
189 return len;
190}
191
192static int __sk_msg_free(struct sock *sk, struct sk_msg *msg, u32 i,
193 bool charge)
194{
195 struct scatterlist *sge = sk_msg_elem(msg, i);
196 int freed = 0;
197
198 while (msg->sg.size) {
199 msg->sg.size -= sge->length;
200 freed += sk_msg_free_elem(sk, msg, i, charge);
201 sk_msg_iter_var_next(i);
202 sk_msg_check_to_free(msg, i, msg->sg.size);
203 sge = sk_msg_elem(msg, i);
204 }
205 consume_skb(msg->skb);
206 sk_msg_init(msg);
207 return freed;
208}
209
210int sk_msg_free_nocharge(struct sock *sk, struct sk_msg *msg)
211{
212 return __sk_msg_free(sk, msg, msg->sg.start, false);
213}
214EXPORT_SYMBOL_GPL(sk_msg_free_nocharge);
215
216int sk_msg_free(struct sock *sk, struct sk_msg *msg)
217{
218 return __sk_msg_free(sk, msg, msg->sg.start, true);
219}
220EXPORT_SYMBOL_GPL(sk_msg_free);
221
222static void __sk_msg_free_partial(struct sock *sk, struct sk_msg *msg,
223 u32 bytes, bool charge)
224{
225 struct scatterlist *sge;
226 u32 i = msg->sg.start;
227
228 while (bytes) {
229 sge = sk_msg_elem(msg, i);
230 if (!sge->length)
231 break;
232 if (bytes < sge->length) {
233 if (charge)
234 sk_mem_uncharge(sk, bytes);
235 sge->length -= bytes;
236 sge->offset += bytes;
237 msg->sg.size -= bytes;
238 break;
239 }
240
241 msg->sg.size -= sge->length;
242 bytes -= sge->length;
243 sk_msg_free_elem(sk, msg, i, charge);
244 sk_msg_iter_var_next(i);
245 sk_msg_check_to_free(msg, i, bytes);
246 }
247 msg->sg.start = i;
248}
249
250void sk_msg_free_partial(struct sock *sk, struct sk_msg *msg, u32 bytes)
251{
252 __sk_msg_free_partial(sk, msg, bytes, true);
253}
254EXPORT_SYMBOL_GPL(sk_msg_free_partial);
255
256void sk_msg_free_partial_nocharge(struct sock *sk, struct sk_msg *msg,
257 u32 bytes)
258{
259 __sk_msg_free_partial(sk, msg, bytes, false);
260}
261
262void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
263{
264 int trim = msg->sg.size - len;
265 u32 i = msg->sg.end;
266
267 if (trim <= 0) {
268 WARN_ON(trim < 0);
269 return;
270 }
271
272 sk_msg_iter_var_prev(i);
273 msg->sg.size = len;
274 while (msg->sg.data[i].length &&
275 trim >= msg->sg.data[i].length) {
276 trim -= msg->sg.data[i].length;
277 sk_msg_free_elem(sk, msg, i, true);
278 sk_msg_iter_var_prev(i);
279 if (!trim)
280 goto out;
281 }
282
283 msg->sg.data[i].length -= trim;
284 sk_mem_uncharge(sk, trim);
285 /* Adjust copybreak if it falls into the trimmed part of last buf */
286 if (msg->sg.curr == i && msg->sg.copybreak > msg->sg.data[i].length)
287 msg->sg.copybreak = msg->sg.data[i].length;
288out:
289 sk_msg_iter_var_next(i);
290 msg->sg.end = i;
291
292 /* If we trim data a full sg elem before curr pointer update
293 * copybreak and current so that any future copy operations
294 * start at new copy location.
295 * However trimed data that has not yet been used in a copy op
296 * does not require an update.
297 */
298 if (!msg->sg.size) {
299 msg->sg.curr = msg->sg.start;
300 msg->sg.copybreak = 0;
301 } else if (sk_msg_iter_dist(msg->sg.start, msg->sg.curr) >=
302 sk_msg_iter_dist(msg->sg.start, msg->sg.end)) {
303 sk_msg_iter_var_prev(i);
304 msg->sg.curr = i;
305 msg->sg.copybreak = msg->sg.data[i].length;
306 }
307}
308EXPORT_SYMBOL_GPL(sk_msg_trim);
309
310int sk_msg_zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
311 struct sk_msg *msg, u32 bytes)
312{
313 int i, maxpages, ret = 0, num_elems = sk_msg_elem_used(msg);
314 const int to_max_pages = MAX_MSG_FRAGS;
315 struct page *pages[MAX_MSG_FRAGS];
316 ssize_t orig, copied, use, offset;
317
318 orig = msg->sg.size;
319 while (bytes > 0) {
320 i = 0;
321 maxpages = to_max_pages - num_elems;
322 if (maxpages == 0) {
323 ret = -EFAULT;
324 goto out;
325 }
326
327 copied = iov_iter_get_pages2(from, pages, bytes, maxpages,
328 &offset);
329 if (copied <= 0) {
330 ret = -EFAULT;
331 goto out;
332 }
333
334 bytes -= copied;
335 msg->sg.size += copied;
336
337 while (copied) {
338 use = min_t(int, copied, PAGE_SIZE - offset);
339 sg_set_page(&msg->sg.data[msg->sg.end],
340 pages[i], use, offset);
341 sg_unmark_end(&msg->sg.data[msg->sg.end]);
342 sk_mem_charge(sk, use);
343
344 offset = 0;
345 copied -= use;
346 sk_msg_iter_next(msg, end);
347 num_elems++;
348 i++;
349 }
350 /* When zerocopy is mixed with sk_msg_*copy* operations we
351 * may have a copybreak set in this case clear and prefer
352 * zerocopy remainder when possible.
353 */
354 msg->sg.copybreak = 0;
355 msg->sg.curr = msg->sg.end;
356 }
357out:
358 /* Revert iov_iter updates, msg will need to use 'trim' later if it
359 * also needs to be cleared.
360 */
361 if (ret)
362 iov_iter_revert(from, msg->sg.size - orig);
363 return ret;
364}
365EXPORT_SYMBOL_GPL(sk_msg_zerocopy_from_iter);
366
367int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from,
368 struct sk_msg *msg, u32 bytes)
369{
370 int ret = -ENOSPC, i = msg->sg.curr;
371 struct scatterlist *sge;
372 u32 copy, buf_size;
373 void *to;
374
375 do {
376 sge = sk_msg_elem(msg, i);
377 /* This is possible if a trim operation shrunk the buffer */
378 if (msg->sg.copybreak >= sge->length) {
379 msg->sg.copybreak = 0;
380 sk_msg_iter_var_next(i);
381 if (i == msg->sg.end)
382 break;
383 sge = sk_msg_elem(msg, i);
384 }
385
386 buf_size = sge->length - msg->sg.copybreak;
387 copy = (buf_size > bytes) ? bytes : buf_size;
388 to = sg_virt(sge) + msg->sg.copybreak;
389 msg->sg.copybreak += copy;
390 if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY)
391 ret = copy_from_iter_nocache(to, copy, from);
392 else
393 ret = copy_from_iter(to, copy, from);
394 if (ret != copy) {
395 ret = -EFAULT;
396 goto out;
397 }
398 bytes -= copy;
399 if (!bytes)
400 break;
401 msg->sg.copybreak = 0;
402 sk_msg_iter_var_next(i);
403 } while (i != msg->sg.end);
404out:
405 msg->sg.curr = i;
406 return ret;
407}
408EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
409
410/* Receive sk_msg from psock->ingress_msg to @msg. */
411int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
412 int len, int flags)
413{
414 struct iov_iter *iter = &msg->msg_iter;
415 int peek = flags & MSG_PEEK;
416 struct sk_msg *msg_rx;
417 int i, copied = 0;
418
419 msg_rx = sk_psock_peek_msg(psock);
420 while (copied != len) {
421 struct scatterlist *sge;
422
423 if (unlikely(!msg_rx))
424 break;
425
426 i = msg_rx->sg.start;
427 do {
428 struct page *page;
429 int copy;
430
431 sge = sk_msg_elem(msg_rx, i);
432 copy = sge->length;
433 page = sg_page(sge);
434 if (copied + copy > len)
435 copy = len - copied;
436 copy = copy_page_to_iter(page, sge->offset, copy, iter);
437 if (!copy) {
438 copied = copied ? copied : -EFAULT;
439 goto out;
440 }
441
442 copied += copy;
443 if (likely(!peek)) {
444 sge->offset += copy;
445 sge->length -= copy;
446 if (!msg_rx->skb)
447 sk_mem_uncharge(sk, copy);
448 msg_rx->sg.size -= copy;
449
450 if (!sge->length) {
451 sk_msg_iter_var_next(i);
452 if (!msg_rx->skb)
453 put_page(page);
454 }
455 } else {
456 /* Lets not optimize peek case if copy_page_to_iter
457 * didn't copy the entire length lets just break.
458 */
459 if (copy != sge->length)
460 goto out;
461 sk_msg_iter_var_next(i);
462 }
463
464 if (copied == len)
465 break;
466 } while ((i != msg_rx->sg.end) && !sg_is_last(sge));
467
468 if (unlikely(peek)) {
469 msg_rx = sk_psock_next_msg(psock, msg_rx);
470 if (!msg_rx)
471 break;
472 continue;
473 }
474
475 msg_rx->sg.start = i;
476 if (!sge->length && (i == msg_rx->sg.end || sg_is_last(sge))) {
477 msg_rx = sk_psock_dequeue_msg(psock);
478 kfree_sk_msg(msg_rx);
479 }
480 msg_rx = sk_psock_peek_msg(psock);
481 }
482out:
483 if (psock->work_state.skb && copied > 0)
484 schedule_work(&psock->work);
485 return copied;
486}
487EXPORT_SYMBOL_GPL(sk_msg_recvmsg);
488
489bool sk_msg_is_readable(struct sock *sk)
490{
491 struct sk_psock *psock;
492 bool empty = true;
493
494 rcu_read_lock();
495 psock = sk_psock(sk);
496 if (likely(psock))
497 empty = list_empty(&psock->ingress_msg);
498 rcu_read_unlock();
499 return !empty;
500}
501EXPORT_SYMBOL_GPL(sk_msg_is_readable);
502
503static struct sk_msg *alloc_sk_msg(gfp_t gfp)
504{
505 struct sk_msg *msg;
506
507 msg = kzalloc(sizeof(*msg), gfp | __GFP_NOWARN);
508 if (unlikely(!msg))
509 return NULL;
510 sg_init_marker(msg->sg.data, NR_MSG_FRAG_IDS);
511 return msg;
512}
513
514static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
515 struct sk_buff *skb)
516{
517 if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
518 return NULL;
519
520 if (!sk_rmem_schedule(sk, skb, skb->truesize))
521 return NULL;
522
523 return alloc_sk_msg(GFP_KERNEL);
524}
525
526static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
527 u32 off, u32 len,
528 struct sk_psock *psock,
529 struct sock *sk,
530 struct sk_msg *msg)
531{
532 int num_sge, copied;
533
534 num_sge = skb_to_sgvec(skb, msg->sg.data, off, len);
535 if (num_sge < 0) {
536 /* skb linearize may fail with ENOMEM, but lets simply try again
537 * later if this happens. Under memory pressure we don't want to
538 * drop the skb. We need to linearize the skb so that the mapping
539 * in skb_to_sgvec can not error.
540 */
541 if (skb_linearize(skb))
542 return -EAGAIN;
543
544 num_sge = skb_to_sgvec(skb, msg->sg.data, off, len);
545 if (unlikely(num_sge < 0))
546 return num_sge;
547 }
548
549 copied = len;
550 msg->sg.start = 0;
551 msg->sg.size = copied;
552 msg->sg.end = num_sge;
553 msg->skb = skb;
554
555 sk_psock_queue_msg(psock, msg);
556 sk_psock_data_ready(sk, psock);
557 return copied;
558}
559
560static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb,
561 u32 off, u32 len);
562
563static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb,
564 u32 off, u32 len)
565{
566 struct sock *sk = psock->sk;
567 struct sk_msg *msg;
568 int err;
569
570 /* If we are receiving on the same sock skb->sk is already assigned,
571 * skip memory accounting and owner transition seeing it already set
572 * correctly.
573 */
574 if (unlikely(skb->sk == sk))
575 return sk_psock_skb_ingress_self(psock, skb, off, len);
576 msg = sk_psock_create_ingress_msg(sk, skb);
577 if (!msg)
578 return -EAGAIN;
579
580 /* This will transition ownership of the data from the socket where
581 * the BPF program was run initiating the redirect to the socket
582 * we will eventually receive this data on. The data will be released
583 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
584 * into user buffers.
585 */
586 skb_set_owner_r(skb, sk);
587 err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg);
588 if (err < 0)
589 kfree(msg);
590 return err;
591}
592
593/* Puts an skb on the ingress queue of the socket already assigned to the
594 * skb. In this case we do not need to check memory limits or skb_set_owner_r
595 * because the skb is already accounted for here.
596 */
597static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb,
598 u32 off, u32 len)
599{
600 struct sk_msg *msg = alloc_sk_msg(GFP_ATOMIC);
601 struct sock *sk = psock->sk;
602 int err;
603
604 if (unlikely(!msg))
605 return -EAGAIN;
606 skb_set_owner_r(skb, sk);
607 err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg);
608 if (err < 0)
609 kfree(msg);
610 return err;
611}
612
613static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
614 u32 off, u32 len, bool ingress)
615{
616 if (!ingress) {
617 if (!sock_writeable(psock->sk))
618 return -EAGAIN;
619 return skb_send_sock(psock->sk, skb, off, len);
620 }
621 return sk_psock_skb_ingress(psock, skb, off, len);
622}
623
624static void sk_psock_skb_state(struct sk_psock *psock,
625 struct sk_psock_work_state *state,
626 struct sk_buff *skb,
627 int len, int off)
628{
629 spin_lock_bh(&psock->ingress_lock);
630 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
631 state->skb = skb;
632 state->len = len;
633 state->off = off;
634 } else {
635 sock_drop(psock->sk, skb);
636 }
637 spin_unlock_bh(&psock->ingress_lock);
638}
639
640static void sk_psock_backlog(struct work_struct *work)
641{
642 struct sk_psock *psock = container_of(work, struct sk_psock, work);
643 struct sk_psock_work_state *state = &psock->work_state;
644 struct sk_buff *skb = NULL;
645 bool ingress;
646 u32 len, off;
647 int ret;
648
649 mutex_lock(&psock->work_mutex);
650 if (unlikely(state->skb)) {
651 spin_lock_bh(&psock->ingress_lock);
652 skb = state->skb;
653 len = state->len;
654 off = state->off;
655 state->skb = NULL;
656 spin_unlock_bh(&psock->ingress_lock);
657 }
658 if (skb)
659 goto start;
660
661 while ((skb = skb_dequeue(&psock->ingress_skb))) {
662 len = skb->len;
663 off = 0;
664 if (skb_bpf_strparser(skb)) {
665 struct strp_msg *stm = strp_msg(skb);
666
667 off = stm->offset;
668 len = stm->full_len;
669 }
670start:
671 ingress = skb_bpf_ingress(skb);
672 skb_bpf_redirect_clear(skb);
673 do {
674 ret = -EIO;
675 if (!sock_flag(psock->sk, SOCK_DEAD))
676 ret = sk_psock_handle_skb(psock, skb, off,
677 len, ingress);
678 if (ret <= 0) {
679 if (ret == -EAGAIN) {
680 sk_psock_skb_state(psock, state, skb,
681 len, off);
682 goto end;
683 }
684 /* Hard errors break pipe and stop xmit. */
685 sk_psock_report_error(psock, ret ? -ret : EPIPE);
686 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
687 sock_drop(psock->sk, skb);
688 goto end;
689 }
690 off += ret;
691 len -= ret;
692 } while (len);
693
694 if (!ingress)
695 kfree_skb(skb);
696 }
697end:
698 mutex_unlock(&psock->work_mutex);
699}
700
701struct sk_psock *sk_psock_init(struct sock *sk, int node)
702{
703 struct sk_psock *psock;
704 struct proto *prot;
705
706 write_lock_bh(&sk->sk_callback_lock);
707
708 if (sk_is_inet(sk) && inet_csk_has_ulp(sk)) {
709 psock = ERR_PTR(-EINVAL);
710 goto out;
711 }
712
713 if (sk->sk_user_data) {
714 psock = ERR_PTR(-EBUSY);
715 goto out;
716 }
717
718 psock = kzalloc_node(sizeof(*psock), GFP_ATOMIC | __GFP_NOWARN, node);
719 if (!psock) {
720 psock = ERR_PTR(-ENOMEM);
721 goto out;
722 }
723
724 prot = READ_ONCE(sk->sk_prot);
725 psock->sk = sk;
726 psock->eval = __SK_NONE;
727 psock->sk_proto = prot;
728 psock->saved_unhash = prot->unhash;
729 psock->saved_destroy = prot->destroy;
730 psock->saved_close = prot->close;
731 psock->saved_write_space = sk->sk_write_space;
732
733 INIT_LIST_HEAD(&psock->link);
734 spin_lock_init(&psock->link_lock);
735
736 INIT_WORK(&psock->work, sk_psock_backlog);
737 mutex_init(&psock->work_mutex);
738 INIT_LIST_HEAD(&psock->ingress_msg);
739 spin_lock_init(&psock->ingress_lock);
740 skb_queue_head_init(&psock->ingress_skb);
741
742 sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
743 refcount_set(&psock->refcnt, 1);
744
745 __rcu_assign_sk_user_data_with_flags(sk, psock,
746 SK_USER_DATA_NOCOPY |
747 SK_USER_DATA_PSOCK);
748 sock_hold(sk);
749
750out:
751 write_unlock_bh(&sk->sk_callback_lock);
752 return psock;
753}
754EXPORT_SYMBOL_GPL(sk_psock_init);
755
756struct sk_psock_link *sk_psock_link_pop(struct sk_psock *psock)
757{
758 struct sk_psock_link *link;
759
760 spin_lock_bh(&psock->link_lock);
761 link = list_first_entry_or_null(&psock->link, struct sk_psock_link,
762 list);
763 if (link)
764 list_del(&link->list);
765 spin_unlock_bh(&psock->link_lock);
766 return link;
767}
768
769static void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
770{
771 struct sk_msg *msg, *tmp;
772
773 list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
774 list_del(&msg->list);
775 sk_msg_free(psock->sk, msg);
776 kfree(msg);
777 }
778}
779
780static void __sk_psock_zap_ingress(struct sk_psock *psock)
781{
782 struct sk_buff *skb;
783
784 while ((skb = skb_dequeue(&psock->ingress_skb)) != NULL) {
785 skb_bpf_redirect_clear(skb);
786 sock_drop(psock->sk, skb);
787 }
788 kfree_skb(psock->work_state.skb);
789 /* We null the skb here to ensure that calls to sk_psock_backlog
790 * do not pick up the free'd skb.
791 */
792 psock->work_state.skb = NULL;
793 __sk_psock_purge_ingress_msg(psock);
794}
795
796static void sk_psock_link_destroy(struct sk_psock *psock)
797{
798 struct sk_psock_link *link, *tmp;
799
800 list_for_each_entry_safe(link, tmp, &psock->link, list) {
801 list_del(&link->list);
802 sk_psock_free_link(link);
803 }
804}
805
806void sk_psock_stop(struct sk_psock *psock)
807{
808 spin_lock_bh(&psock->ingress_lock);
809 sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
810 sk_psock_cork_free(psock);
811 __sk_psock_zap_ingress(psock);
812 spin_unlock_bh(&psock->ingress_lock);
813}
814
815static void sk_psock_done_strp(struct sk_psock *psock);
816
817static void sk_psock_destroy(struct work_struct *work)
818{
819 struct sk_psock *psock = container_of(to_rcu_work(work),
820 struct sk_psock, rwork);
821 /* No sk_callback_lock since already detached. */
822
823 sk_psock_done_strp(psock);
824
825 cancel_work_sync(&psock->work);
826 mutex_destroy(&psock->work_mutex);
827
828 psock_progs_drop(&psock->progs);
829
830 sk_psock_link_destroy(psock);
831 sk_psock_cork_free(psock);
832
833 if (psock->sk_redir)
834 sock_put(psock->sk_redir);
835 sock_put(psock->sk);
836 kfree(psock);
837}
838
839void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
840{
841 write_lock_bh(&sk->sk_callback_lock);
842 sk_psock_restore_proto(sk, psock);
843 rcu_assign_sk_user_data(sk, NULL);
844 if (psock->progs.stream_parser)
845 sk_psock_stop_strp(sk, psock);
846 else if (psock->progs.stream_verdict || psock->progs.skb_verdict)
847 sk_psock_stop_verdict(sk, psock);
848 write_unlock_bh(&sk->sk_callback_lock);
849
850 sk_psock_stop(psock);
851
852 INIT_RCU_WORK(&psock->rwork, sk_psock_destroy);
853 queue_rcu_work(system_wq, &psock->rwork);
854}
855EXPORT_SYMBOL_GPL(sk_psock_drop);
856
857static int sk_psock_map_verd(int verdict, bool redir)
858{
859 switch (verdict) {
860 case SK_PASS:
861 return redir ? __SK_REDIRECT : __SK_PASS;
862 case SK_DROP:
863 default:
864 break;
865 }
866
867 return __SK_DROP;
868}
869
870int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
871 struct sk_msg *msg)
872{
873 struct bpf_prog *prog;
874 int ret;
875
876 rcu_read_lock();
877 prog = READ_ONCE(psock->progs.msg_parser);
878 if (unlikely(!prog)) {
879 ret = __SK_PASS;
880 goto out;
881 }
882
883 sk_msg_compute_data_pointers(msg);
884 msg->sk = sk;
885 ret = bpf_prog_run_pin_on_cpu(prog, msg);
886 ret = sk_psock_map_verd(ret, msg->sk_redir);
887 psock->apply_bytes = msg->apply_bytes;
888 if (ret == __SK_REDIRECT) {
889 if (psock->sk_redir) {
890 sock_put(psock->sk_redir);
891 psock->sk_redir = NULL;
892 }
893 if (!msg->sk_redir) {
894 ret = __SK_DROP;
895 goto out;
896 }
897 psock->redir_ingress = sk_msg_to_ingress(msg);
898 psock->sk_redir = msg->sk_redir;
899 sock_hold(psock->sk_redir);
900 }
901out:
902 rcu_read_unlock();
903 return ret;
904}
905EXPORT_SYMBOL_GPL(sk_psock_msg_verdict);
906
907static int sk_psock_skb_redirect(struct sk_psock *from, struct sk_buff *skb)
908{
909 struct sk_psock *psock_other;
910 struct sock *sk_other;
911
912 sk_other = skb_bpf_redirect_fetch(skb);
913 /* This error is a buggy BPF program, it returned a redirect
914 * return code, but then didn't set a redirect interface.
915 */
916 if (unlikely(!sk_other)) {
917 skb_bpf_redirect_clear(skb);
918 sock_drop(from->sk, skb);
919 return -EIO;
920 }
921 psock_other = sk_psock(sk_other);
922 /* This error indicates the socket is being torn down or had another
923 * error that caused the pipe to break. We can't send a packet on
924 * a socket that is in this state so we drop the skb.
925 */
926 if (!psock_other || sock_flag(sk_other, SOCK_DEAD)) {
927 skb_bpf_redirect_clear(skb);
928 sock_drop(from->sk, skb);
929 return -EIO;
930 }
931 spin_lock_bh(&psock_other->ingress_lock);
932 if (!sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED)) {
933 spin_unlock_bh(&psock_other->ingress_lock);
934 skb_bpf_redirect_clear(skb);
935 sock_drop(from->sk, skb);
936 return -EIO;
937 }
938
939 skb_queue_tail(&psock_other->ingress_skb, skb);
940 schedule_work(&psock_other->work);
941 spin_unlock_bh(&psock_other->ingress_lock);
942 return 0;
943}
944
945static void sk_psock_tls_verdict_apply(struct sk_buff *skb,
946 struct sk_psock *from, int verdict)
947{
948 switch (verdict) {
949 case __SK_REDIRECT:
950 sk_psock_skb_redirect(from, skb);
951 break;
952 case __SK_PASS:
953 case __SK_DROP:
954 default:
955 break;
956 }
957}
958
959int sk_psock_tls_strp_read(struct sk_psock *psock, struct sk_buff *skb)
960{
961 struct bpf_prog *prog;
962 int ret = __SK_PASS;
963
964 rcu_read_lock();
965 prog = READ_ONCE(psock->progs.stream_verdict);
966 if (likely(prog)) {
967 skb->sk = psock->sk;
968 skb_dst_drop(skb);
969 skb_bpf_redirect_clear(skb);
970 ret = bpf_prog_run_pin_on_cpu(prog, skb);
971 ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
972 skb->sk = NULL;
973 }
974 sk_psock_tls_verdict_apply(skb, psock, ret);
975 rcu_read_unlock();
976 return ret;
977}
978EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
979
980static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
981 int verdict)
982{
983 struct sock *sk_other;
984 int err = 0;
985 u32 len, off;
986
987 switch (verdict) {
988 case __SK_PASS:
989 err = -EIO;
990 sk_other = psock->sk;
991 if (sock_flag(sk_other, SOCK_DEAD) ||
992 !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
993 skb_bpf_redirect_clear(skb);
994 goto out_free;
995 }
996
997 skb_bpf_set_ingress(skb);
998
999 /* If the queue is empty then we can submit directly
1000 * into the msg queue. If its not empty we have to
1001 * queue work otherwise we may get OOO data. Otherwise,
1002 * if sk_psock_skb_ingress errors will be handled by
1003 * retrying later from workqueue.
1004 */
1005 if (skb_queue_empty(&psock->ingress_skb)) {
1006 len = skb->len;
1007 off = 0;
1008 if (skb_bpf_strparser(skb)) {
1009 struct strp_msg *stm = strp_msg(skb);
1010
1011 off = stm->offset;
1012 len = stm->full_len;
1013 }
1014 err = sk_psock_skb_ingress_self(psock, skb, off, len);
1015 }
1016 if (err < 0) {
1017 spin_lock_bh(&psock->ingress_lock);
1018 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
1019 skb_queue_tail(&psock->ingress_skb, skb);
1020 schedule_work(&psock->work);
1021 err = 0;
1022 }
1023 spin_unlock_bh(&psock->ingress_lock);
1024 if (err < 0) {
1025 skb_bpf_redirect_clear(skb);
1026 goto out_free;
1027 }
1028 }
1029 break;
1030 case __SK_REDIRECT:
1031 err = sk_psock_skb_redirect(psock, skb);
1032 break;
1033 case __SK_DROP:
1034 default:
1035out_free:
1036 sock_drop(psock->sk, skb);
1037 }
1038
1039 return err;
1040}
1041
1042static void sk_psock_write_space(struct sock *sk)
1043{
1044 struct sk_psock *psock;
1045 void (*write_space)(struct sock *sk) = NULL;
1046
1047 rcu_read_lock();
1048 psock = sk_psock(sk);
1049 if (likely(psock)) {
1050 if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
1051 schedule_work(&psock->work);
1052 write_space = psock->saved_write_space;
1053 }
1054 rcu_read_unlock();
1055 if (write_space)
1056 write_space(sk);
1057}
1058
1059#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)
1060static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb)
1061{
1062 struct sk_psock *psock;
1063 struct bpf_prog *prog;
1064 int ret = __SK_DROP;
1065 struct sock *sk;
1066
1067 rcu_read_lock();
1068 sk = strp->sk;
1069 psock = sk_psock(sk);
1070 if (unlikely(!psock)) {
1071 sock_drop(sk, skb);
1072 goto out;
1073 }
1074 prog = READ_ONCE(psock->progs.stream_verdict);
1075 if (likely(prog)) {
1076 skb->sk = sk;
1077 skb_dst_drop(skb);
1078 skb_bpf_redirect_clear(skb);
1079 ret = bpf_prog_run_pin_on_cpu(prog, skb);
1080 if (ret == SK_PASS)
1081 skb_bpf_set_strparser(skb);
1082 ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
1083 skb->sk = NULL;
1084 }
1085 sk_psock_verdict_apply(psock, skb, ret);
1086out:
1087 rcu_read_unlock();
1088}
1089
1090static int sk_psock_strp_read_done(struct strparser *strp, int err)
1091{
1092 return err;
1093}
1094
1095static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
1096{
1097 struct sk_psock *psock = container_of(strp, struct sk_psock, strp);
1098 struct bpf_prog *prog;
1099 int ret = skb->len;
1100
1101 rcu_read_lock();
1102 prog = READ_ONCE(psock->progs.stream_parser);
1103 if (likely(prog)) {
1104 skb->sk = psock->sk;
1105 ret = bpf_prog_run_pin_on_cpu(prog, skb);
1106 skb->sk = NULL;
1107 }
1108 rcu_read_unlock();
1109 return ret;
1110}
1111
1112/* Called with socket lock held. */
1113static void sk_psock_strp_data_ready(struct sock *sk)
1114{
1115 struct sk_psock *psock;
1116
1117 rcu_read_lock();
1118 psock = sk_psock(sk);
1119 if (likely(psock)) {
1120 if (tls_sw_has_ctx_rx(sk)) {
1121 psock->saved_data_ready(sk);
1122 } else {
1123 write_lock_bh(&sk->sk_callback_lock);
1124 strp_data_ready(&psock->strp);
1125 write_unlock_bh(&sk->sk_callback_lock);
1126 }
1127 }
1128 rcu_read_unlock();
1129}
1130
1131int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
1132{
1133 static const struct strp_callbacks cb = {
1134 .rcv_msg = sk_psock_strp_read,
1135 .read_sock_done = sk_psock_strp_read_done,
1136 .parse_msg = sk_psock_strp_parse,
1137 };
1138
1139 return strp_init(&psock->strp, sk, &cb);
1140}
1141
1142void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
1143{
1144 if (psock->saved_data_ready)
1145 return;
1146
1147 psock->saved_data_ready = sk->sk_data_ready;
1148 sk->sk_data_ready = sk_psock_strp_data_ready;
1149 sk->sk_write_space = sk_psock_write_space;
1150}
1151
1152void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
1153{
1154 psock_set_prog(&psock->progs.stream_parser, NULL);
1155
1156 if (!psock->saved_data_ready)
1157 return;
1158
1159 sk->sk_data_ready = psock->saved_data_ready;
1160 psock->saved_data_ready = NULL;
1161 strp_stop(&psock->strp);
1162}
1163
1164static void sk_psock_done_strp(struct sk_psock *psock)
1165{
1166 /* Parser has been stopped */
1167 if (psock->progs.stream_parser)
1168 strp_done(&psock->strp);
1169}
1170#else
1171static void sk_psock_done_strp(struct sk_psock *psock)
1172{
1173}
1174#endif /* CONFIG_BPF_STREAM_PARSER */
1175
1176static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb)
1177{
1178 struct sk_psock *psock;
1179 struct bpf_prog *prog;
1180 int ret = __SK_DROP;
1181 int len = skb->len;
1182
1183 skb_get(skb);
1184
1185 rcu_read_lock();
1186 psock = sk_psock(sk);
1187 if (unlikely(!psock)) {
1188 len = 0;
1189 sock_drop(sk, skb);
1190 goto out;
1191 }
1192 prog = READ_ONCE(psock->progs.stream_verdict);
1193 if (!prog)
1194 prog = READ_ONCE(psock->progs.skb_verdict);
1195 if (likely(prog)) {
1196 skb_dst_drop(skb);
1197 skb_bpf_redirect_clear(skb);
1198 ret = bpf_prog_run_pin_on_cpu(prog, skb);
1199 ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
1200 }
1201 ret = sk_psock_verdict_apply(psock, skb, ret);
1202 if (ret < 0)
1203 len = ret;
1204out:
1205 rcu_read_unlock();
1206 return len;
1207}
1208
1209static void sk_psock_verdict_data_ready(struct sock *sk)
1210{
1211 struct socket *sock = sk->sk_socket;
1212
1213 if (unlikely(!sock || !sock->ops || !sock->ops->read_skb))
1214 return;
1215 sock->ops->read_skb(sk, sk_psock_verdict_recv);
1216}
1217
1218void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock)
1219{
1220 if (psock->saved_data_ready)
1221 return;
1222
1223 psock->saved_data_ready = sk->sk_data_ready;
1224 sk->sk_data_ready = sk_psock_verdict_data_ready;
1225 sk->sk_write_space = sk_psock_write_space;
1226}
1227
1228void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock)
1229{
1230 psock_set_prog(&psock->progs.stream_verdict, NULL);
1231 psock_set_prog(&psock->progs.skb_verdict, NULL);
1232
1233 if (!psock->saved_data_ready)
1234 return;
1235
1236 sk->sk_data_ready = psock->saved_data_ready;
1237 psock->saved_data_ready = NULL;
1238}