Linux Audio

Check our new training course

Loading...
v6.13.7
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  net/dccp/proto.c
   4 *
   5 *  An implementation of the DCCP protocol
   6 *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
   7 */
   8
   9#include <linux/dccp.h>
  10#include <linux/module.h>
  11#include <linux/types.h>
  12#include <linux/sched.h>
  13#include <linux/kernel.h>
  14#include <linux/skbuff.h>
  15#include <linux/netdevice.h>
  16#include <linux/in.h>
  17#include <linux/if_arp.h>
  18#include <linux/init.h>
  19#include <linux/random.h>
  20#include <linux/slab.h>
  21#include <net/checksum.h>
  22
  23#include <net/inet_sock.h>
  24#include <net/inet_common.h>
  25#include <net/sock.h>
  26#include <net/xfrm.h>
  27
  28#include <asm/ioctls.h>
  29#include <linux/spinlock.h>
  30#include <linux/timer.h>
  31#include <linux/delay.h>
  32#include <linux/poll.h>
  33
  34#include "ccid.h"
  35#include "dccp.h"
  36#include "feat.h"
  37
  38#define CREATE_TRACE_POINTS
  39#include "trace.h"
  40
  41DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
  42
  43EXPORT_SYMBOL_GPL(dccp_statistics);
  44
  45DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
  46EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
  47
  48struct inet_hashinfo dccp_hashinfo;
  49EXPORT_SYMBOL_GPL(dccp_hashinfo);
  50
  51/* the maximum queue length for tx in packets. 0 is no limit */
  52int sysctl_dccp_tx_qlen __read_mostly = 5;
  53
  54#ifdef CONFIG_IP_DCCP_DEBUG
  55static const char *dccp_state_name(const int state)
  56{
  57	static const char *const dccp_state_names[] = {
  58	[DCCP_OPEN]		= "OPEN",
  59	[DCCP_REQUESTING]	= "REQUESTING",
  60	[DCCP_PARTOPEN]		= "PARTOPEN",
  61	[DCCP_LISTEN]		= "LISTEN",
  62	[DCCP_RESPOND]		= "RESPOND",
  63	[DCCP_CLOSING]		= "CLOSING",
  64	[DCCP_ACTIVE_CLOSEREQ]	= "CLOSEREQ",
  65	[DCCP_PASSIVE_CLOSE]	= "PASSIVE_CLOSE",
  66	[DCCP_PASSIVE_CLOSEREQ]	= "PASSIVE_CLOSEREQ",
  67	[DCCP_TIME_WAIT]	= "TIME_WAIT",
  68	[DCCP_CLOSED]		= "CLOSED",
  69	};
  70
  71	if (state >= DCCP_MAX_STATES)
  72		return "INVALID STATE!";
  73	else
  74		return dccp_state_names[state];
  75}
  76#endif
  77
  78void dccp_set_state(struct sock *sk, const int state)
  79{
  80	const int oldstate = sk->sk_state;
  81
  82	dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
  83		      dccp_state_name(oldstate), dccp_state_name(state));
  84	WARN_ON(state == oldstate);
  85
  86	switch (state) {
  87	case DCCP_OPEN:
  88		if (oldstate != DCCP_OPEN)
  89			DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
  90		/* Client retransmits all Confirm options until entering OPEN */
  91		if (oldstate == DCCP_PARTOPEN)
  92			dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
  93		break;
  94
  95	case DCCP_CLOSED:
  96		if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
  97		    oldstate == DCCP_CLOSING)
  98			DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
  99
 100		sk->sk_prot->unhash(sk);
 101		if (inet_csk(sk)->icsk_bind_hash != NULL &&
 102		    !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
 103			inet_put_port(sk);
 104		fallthrough;
 105	default:
 106		if (oldstate == DCCP_OPEN)
 107			DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
 108	}
 109
 110	/* Change state AFTER socket is unhashed to avoid closed
 111	 * socket sitting in hash tables.
 112	 */
 113	inet_sk_set_state(sk, state);
 114}
 115
 116EXPORT_SYMBOL_GPL(dccp_set_state);
 117
 118static void dccp_finish_passive_close(struct sock *sk)
 119{
 120	switch (sk->sk_state) {
 121	case DCCP_PASSIVE_CLOSE:
 122		/* Node (client or server) has received Close packet. */
 123		dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
 124		dccp_set_state(sk, DCCP_CLOSED);
 125		break;
 126	case DCCP_PASSIVE_CLOSEREQ:
 127		/*
 128		 * Client received CloseReq. We set the `active' flag so that
 129		 * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
 130		 */
 131		dccp_send_close(sk, 1);
 132		dccp_set_state(sk, DCCP_CLOSING);
 133	}
 134}
 135
 136void dccp_done(struct sock *sk)
 137{
 138	dccp_set_state(sk, DCCP_CLOSED);
 139	dccp_clear_xmit_timers(sk);
 140
 141	sk->sk_shutdown = SHUTDOWN_MASK;
 142
 143	if (!sock_flag(sk, SOCK_DEAD))
 144		sk->sk_state_change(sk);
 145	else
 146		inet_csk_destroy_sock(sk);
 147}
 148
 149EXPORT_SYMBOL_GPL(dccp_done);
 150
 151const char *dccp_packet_name(const int type)
 152{
 153	static const char *const dccp_packet_names[] = {
 154		[DCCP_PKT_REQUEST]  = "REQUEST",
 155		[DCCP_PKT_RESPONSE] = "RESPONSE",
 156		[DCCP_PKT_DATA]	    = "DATA",
 157		[DCCP_PKT_ACK]	    = "ACK",
 158		[DCCP_PKT_DATAACK]  = "DATAACK",
 159		[DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
 160		[DCCP_PKT_CLOSE]    = "CLOSE",
 161		[DCCP_PKT_RESET]    = "RESET",
 162		[DCCP_PKT_SYNC]	    = "SYNC",
 163		[DCCP_PKT_SYNCACK]  = "SYNCACK",
 164	};
 165
 166	if (type >= DCCP_NR_PKT_TYPES)
 167		return "INVALID";
 168	else
 169		return dccp_packet_names[type];
 170}
 171
 172EXPORT_SYMBOL_GPL(dccp_packet_name);
 173
 174void dccp_destruct_common(struct sock *sk)
 175{
 176	struct dccp_sock *dp = dccp_sk(sk);
 177
 178	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
 179	dp->dccps_hc_tx_ccid = NULL;
 180}
 181EXPORT_SYMBOL_GPL(dccp_destruct_common);
 182
 183static void dccp_sk_destruct(struct sock *sk)
 184{
 185	dccp_destruct_common(sk);
 186	inet_sock_destruct(sk);
 187}
 188
 189int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 190{
 191	struct dccp_sock *dp = dccp_sk(sk);
 192	struct inet_connection_sock *icsk = inet_csk(sk);
 193
 194	pr_warn_once("DCCP is deprecated and scheduled to be removed in 2025, "
 195		     "please contact the netdev mailing list\n");
 196
 197	icsk->icsk_rto		= DCCP_TIMEOUT_INIT;
 198	icsk->icsk_syn_retries	= sysctl_dccp_request_retries;
 199	sk->sk_state		= DCCP_CLOSED;
 200	sk->sk_write_space	= dccp_write_space;
 201	sk->sk_destruct		= dccp_sk_destruct;
 202	icsk->icsk_sync_mss	= dccp_sync_mss;
 203	dp->dccps_mss_cache	= 536;
 204	dp->dccps_rate_last	= jiffies;
 205	dp->dccps_role		= DCCP_ROLE_UNDEFINED;
 206	dp->dccps_service	= DCCP_SERVICE_CODE_IS_ABSENT;
 207	dp->dccps_tx_qlen	= sysctl_dccp_tx_qlen;
 208
 209	dccp_init_xmit_timers(sk);
 210
 211	INIT_LIST_HEAD(&dp->dccps_featneg);
 212	/* control socket doesn't need feat nego */
 213	if (likely(ctl_sock_initialized))
 214		return dccp_feat_init(sk);
 215	return 0;
 216}
 217
 218EXPORT_SYMBOL_GPL(dccp_init_sock);
 219
 220void dccp_destroy_sock(struct sock *sk)
 221{
 222	struct dccp_sock *dp = dccp_sk(sk);
 223
 224	__skb_queue_purge(&sk->sk_write_queue);
 225	if (sk->sk_send_head != NULL) {
 226		kfree_skb(sk->sk_send_head);
 227		sk->sk_send_head = NULL;
 228	}
 229
 230	/* Clean up a referenced DCCP bind bucket. */
 231	if (inet_csk(sk)->icsk_bind_hash != NULL)
 232		inet_put_port(sk);
 233
 234	kfree(dp->dccps_service_list);
 235	dp->dccps_service_list = NULL;
 236
 237	if (dp->dccps_hc_rx_ackvec != NULL) {
 238		dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
 239		dp->dccps_hc_rx_ackvec = NULL;
 240	}
 241	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 242	dp->dccps_hc_rx_ccid = NULL;
 243
 244	/* clean up feature negotiation state */
 245	dccp_feat_list_purge(&dp->dccps_featneg);
 246}
 247
 248EXPORT_SYMBOL_GPL(dccp_destroy_sock);
 249
 250static inline int dccp_need_reset(int state)
 251{
 252	return state != DCCP_CLOSED && state != DCCP_LISTEN &&
 253	       state != DCCP_REQUESTING;
 254}
 255
 256int dccp_disconnect(struct sock *sk, int flags)
 257{
 258	struct inet_connection_sock *icsk = inet_csk(sk);
 259	struct inet_sock *inet = inet_sk(sk);
 260	struct dccp_sock *dp = dccp_sk(sk);
 261	const int old_state = sk->sk_state;
 262
 263	if (old_state != DCCP_CLOSED)
 264		dccp_set_state(sk, DCCP_CLOSED);
 265
 266	/*
 267	 * This corresponds to the ABORT function of RFC793, sec. 3.8
 268	 * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
 269	 */
 270	if (old_state == DCCP_LISTEN) {
 271		inet_csk_listen_stop(sk);
 272	} else if (dccp_need_reset(old_state)) {
 273		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
 274		sk->sk_err = ECONNRESET;
 275	} else if (old_state == DCCP_REQUESTING)
 276		sk->sk_err = ECONNRESET;
 277
 278	dccp_clear_xmit_timers(sk);
 279	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 280	dp->dccps_hc_rx_ccid = NULL;
 281
 282	__skb_queue_purge(&sk->sk_receive_queue);
 283	__skb_queue_purge(&sk->sk_write_queue);
 284	if (sk->sk_send_head != NULL) {
 285		__kfree_skb(sk->sk_send_head);
 286		sk->sk_send_head = NULL;
 287	}
 288
 289	inet->inet_dport = 0;
 290
 291	inet_bhash2_reset_saddr(sk);
 292
 293	sk->sk_shutdown = 0;
 294	sock_reset_flag(sk, SOCK_DONE);
 295
 296	icsk->icsk_backoff = 0;
 297	inet_csk_delack_init(sk);
 298	__sk_dst_reset(sk);
 299
 300	WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 301
 302	sk_error_report(sk);
 303	return 0;
 304}
 305
 306EXPORT_SYMBOL_GPL(dccp_disconnect);
 307
 308/*
 309 *	Wait for a DCCP event.
 310 *
 311 *	Note that we don't need to lock the socket, as the upper poll layers
 312 *	take care of normal races (between the test and the event) and we don't
 313 *	go look at any of the socket buffers directly.
 314 */
 315__poll_t dccp_poll(struct file *file, struct socket *sock,
 316		       poll_table *wait)
 317{
 318	struct sock *sk = sock->sk;
 319	__poll_t mask;
 320	u8 shutdown;
 321	int state;
 322
 323	sock_poll_wait(file, sock, wait);
 324
 325	state = inet_sk_state_load(sk);
 326	if (state == DCCP_LISTEN)
 327		return inet_csk_listen_poll(sk);
 328
 329	/* Socket is not locked. We are protected from async events
 330	   by poll logic and correct handling of state changes
 331	   made by another threads is impossible in any case.
 332	 */
 333
 334	mask = 0;
 335	if (READ_ONCE(sk->sk_err))
 336		mask = EPOLLERR;
 337	shutdown = READ_ONCE(sk->sk_shutdown);
 338
 339	if (shutdown == SHUTDOWN_MASK || state == DCCP_CLOSED)
 340		mask |= EPOLLHUP;
 341	if (shutdown & RCV_SHUTDOWN)
 342		mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
 343
 344	/* Connected? */
 345	if ((1 << state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
 346		if (atomic_read(&sk->sk_rmem_alloc) > 0)
 347			mask |= EPOLLIN | EPOLLRDNORM;
 348
 349		if (!(shutdown & SEND_SHUTDOWN)) {
 350			if (sk_stream_is_writeable(sk)) {
 351				mask |= EPOLLOUT | EPOLLWRNORM;
 352			} else {  /* send SIGIO later */
 353				sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 354				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 355
 356				/* Race breaker. If space is freed after
 357				 * wspace test but before the flags are set,
 358				 * IO signal will be lost.
 359				 */
 360				if (sk_stream_is_writeable(sk))
 361					mask |= EPOLLOUT | EPOLLWRNORM;
 362			}
 363		}
 364	}
 365	return mask;
 366}
 367EXPORT_SYMBOL_GPL(dccp_poll);
 368
 369int dccp_ioctl(struct sock *sk, int cmd, int *karg)
 370{
 371	int rc = -ENOTCONN;
 372
 373	lock_sock(sk);
 374
 375	if (sk->sk_state == DCCP_LISTEN)
 376		goto out;
 377
 378	switch (cmd) {
 379	case SIOCOUTQ: {
 380		*karg = sk_wmem_alloc_get(sk);
 381		/* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and
 382		 * always 0, comparably to UDP.
 383		 */
 384
 385		rc = 0;
 386	}
 387		break;
 388	case SIOCINQ: {
 389		struct sk_buff *skb;
 390		*karg = 0;
 391
 392		skb = skb_peek(&sk->sk_receive_queue);
 393		if (skb != NULL) {
 394			/*
 395			 * We will only return the amount of this packet since
 396			 * that is all that will be read.
 397			 */
 398			*karg = skb->len;
 399		}
 400		rc = 0;
 401	}
 402		break;
 403	default:
 404		rc = -ENOIOCTLCMD;
 405		break;
 406	}
 407out:
 408	release_sock(sk);
 409	return rc;
 410}
 411
 412EXPORT_SYMBOL_GPL(dccp_ioctl);
 413
 414static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
 415				   sockptr_t optval, unsigned int optlen)
 416{
 417	struct dccp_sock *dp = dccp_sk(sk);
 418	struct dccp_service_list *sl = NULL;
 419
 420	if (service == DCCP_SERVICE_INVALID_VALUE ||
 421	    optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
 422		return -EINVAL;
 423
 424	if (optlen > sizeof(service)) {
 425		sl = kmalloc(optlen, GFP_KERNEL);
 426		if (sl == NULL)
 427			return -ENOMEM;
 428
 429		sl->dccpsl_nr = optlen / sizeof(u32) - 1;
 430		if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
 431				sizeof(service), optlen - sizeof(service)) ||
 432		    dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
 433			kfree(sl);
 434			return -EFAULT;
 435		}
 436	}
 437
 438	lock_sock(sk);
 439	dp->dccps_service = service;
 440
 441	kfree(dp->dccps_service_list);
 442
 443	dp->dccps_service_list = sl;
 444	release_sock(sk);
 445	return 0;
 446}
 447
 448static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 449{
 450	u8 *list, len;
 451	int i, rc;
 452
 453	if (cscov < 0 || cscov > 15)
 454		return -EINVAL;
 455	/*
 456	 * Populate a list of permissible values, in the range cscov...15. This
 457	 * is necessary since feature negotiation of single values only works if
 458	 * both sides incidentally choose the same value. Since the list starts
 459	 * lowest-value first, negotiation will pick the smallest shared value.
 460	 */
 461	if (cscov == 0)
 462		return 0;
 463	len = 16 - cscov;
 464
 465	list = kmalloc(len, GFP_KERNEL);
 466	if (list == NULL)
 467		return -ENOBUFS;
 468
 469	for (i = 0; i < len; i++)
 470		list[i] = cscov++;
 471
 472	rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
 473
 474	if (rc == 0) {
 475		if (rx)
 476			dccp_sk(sk)->dccps_pcrlen = cscov;
 477		else
 478			dccp_sk(sk)->dccps_pcslen = cscov;
 479	}
 480	kfree(list);
 481	return rc;
 482}
 483
 484static int dccp_setsockopt_ccid(struct sock *sk, int type,
 485				sockptr_t optval, unsigned int optlen)
 486{
 487	u8 *val;
 488	int rc = 0;
 489
 490	if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
 491		return -EINVAL;
 492
 493	val = memdup_sockptr(optval, optlen);
 494	if (IS_ERR(val))
 495		return PTR_ERR(val);
 496
 497	lock_sock(sk);
 498	if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
 499		rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
 500
 501	if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
 502		rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
 503	release_sock(sk);
 504
 505	kfree(val);
 506	return rc;
 507}
 508
 509static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 510		sockptr_t optval, unsigned int optlen)
 511{
 512	struct dccp_sock *dp = dccp_sk(sk);
 513	int val, err = 0;
 514
 515	switch (optname) {
 516	case DCCP_SOCKOPT_PACKET_SIZE:
 517		DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 518		return 0;
 519	case DCCP_SOCKOPT_CHANGE_L:
 520	case DCCP_SOCKOPT_CHANGE_R:
 521		DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
 522		return 0;
 523	case DCCP_SOCKOPT_CCID:
 524	case DCCP_SOCKOPT_RX_CCID:
 525	case DCCP_SOCKOPT_TX_CCID:
 526		return dccp_setsockopt_ccid(sk, optname, optval, optlen);
 527	}
 528
 529	if (optlen < (int)sizeof(int))
 530		return -EINVAL;
 531
 532	if (copy_from_sockptr(&val, optval, sizeof(int)))
 533		return -EFAULT;
 534
 535	if (optname == DCCP_SOCKOPT_SERVICE)
 536		return dccp_setsockopt_service(sk, val, optval, optlen);
 537
 538	lock_sock(sk);
 539	switch (optname) {
 540	case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 541		if (dp->dccps_role != DCCP_ROLE_SERVER)
 542			err = -EOPNOTSUPP;
 543		else
 544			dp->dccps_server_timewait = (val != 0);
 545		break;
 546	case DCCP_SOCKOPT_SEND_CSCOV:
 547		err = dccp_setsockopt_cscov(sk, val, false);
 548		break;
 549	case DCCP_SOCKOPT_RECV_CSCOV:
 550		err = dccp_setsockopt_cscov(sk, val, true);
 551		break;
 552	case DCCP_SOCKOPT_QPOLICY_ID:
 553		if (sk->sk_state != DCCP_CLOSED)
 554			err = -EISCONN;
 555		else if (val < 0 || val >= DCCPQ_POLICY_MAX)
 556			err = -EINVAL;
 557		else
 558			dp->dccps_qpolicy = val;
 559		break;
 560	case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 561		if (val < 0)
 562			err = -EINVAL;
 563		else
 564			dp->dccps_tx_qlen = val;
 565		break;
 566	default:
 567		err = -ENOPROTOOPT;
 568		break;
 569	}
 570	release_sock(sk);
 571
 572	return err;
 573}
 574
 575int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
 576		    unsigned int optlen)
 577{
 578	if (level != SOL_DCCP)
 579		return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
 580							     optname, optval,
 581							     optlen);
 582	return do_dccp_setsockopt(sk, level, optname, optval, optlen);
 583}
 584
 585EXPORT_SYMBOL_GPL(dccp_setsockopt);
 586
 587static int dccp_getsockopt_service(struct sock *sk, int len,
 588				   __be32 __user *optval,
 589				   int __user *optlen)
 590{
 591	const struct dccp_sock *dp = dccp_sk(sk);
 592	const struct dccp_service_list *sl;
 593	int err = -ENOENT, slen = 0, total_len = sizeof(u32);
 594
 595	lock_sock(sk);
 596	if ((sl = dp->dccps_service_list) != NULL) {
 597		slen = sl->dccpsl_nr * sizeof(u32);
 598		total_len += slen;
 599	}
 600
 601	err = -EINVAL;
 602	if (total_len > len)
 603		goto out;
 604
 605	err = 0;
 606	if (put_user(total_len, optlen) ||
 607	    put_user(dp->dccps_service, optval) ||
 608	    (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
 609		err = -EFAULT;
 610out:
 611	release_sock(sk);
 612	return err;
 613}
 614
 615static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
 616		    char __user *optval, int __user *optlen)
 617{
 618	struct dccp_sock *dp;
 619	int val, len;
 620
 621	if (get_user(len, optlen))
 622		return -EFAULT;
 623
 624	if (len < (int)sizeof(int))
 625		return -EINVAL;
 626
 627	dp = dccp_sk(sk);
 628
 629	switch (optname) {
 630	case DCCP_SOCKOPT_PACKET_SIZE:
 631		DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 632		return 0;
 633	case DCCP_SOCKOPT_SERVICE:
 634		return dccp_getsockopt_service(sk, len,
 635					       (__be32 __user *)optval, optlen);
 636	case DCCP_SOCKOPT_GET_CUR_MPS:
 637		val = READ_ONCE(dp->dccps_mss_cache);
 638		break;
 639	case DCCP_SOCKOPT_AVAILABLE_CCIDS:
 640		return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
 641	case DCCP_SOCKOPT_TX_CCID:
 642		val = ccid_get_current_tx_ccid(dp);
 643		if (val < 0)
 644			return -ENOPROTOOPT;
 645		break;
 646	case DCCP_SOCKOPT_RX_CCID:
 647		val = ccid_get_current_rx_ccid(dp);
 648		if (val < 0)
 649			return -ENOPROTOOPT;
 650		break;
 651	case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 652		val = dp->dccps_server_timewait;
 653		break;
 654	case DCCP_SOCKOPT_SEND_CSCOV:
 655		val = dp->dccps_pcslen;
 656		break;
 657	case DCCP_SOCKOPT_RECV_CSCOV:
 658		val = dp->dccps_pcrlen;
 659		break;
 660	case DCCP_SOCKOPT_QPOLICY_ID:
 661		val = dp->dccps_qpolicy;
 662		break;
 663	case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 664		val = dp->dccps_tx_qlen;
 665		break;
 666	case 128 ... 191:
 667		return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
 668					     len, (u32 __user *)optval, optlen);
 669	case 192 ... 255:
 670		return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
 671					     len, (u32 __user *)optval, optlen);
 672	default:
 673		return -ENOPROTOOPT;
 674	}
 675
 676	len = sizeof(val);
 677	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
 678		return -EFAULT;
 679
 680	return 0;
 681}
 682
 683int dccp_getsockopt(struct sock *sk, int level, int optname,
 684		    char __user *optval, int __user *optlen)
 685{
 686	if (level != SOL_DCCP)
 687		return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
 688							     optname, optval,
 689							     optlen);
 690	return do_dccp_getsockopt(sk, level, optname, optval, optlen);
 691}
 692
 693EXPORT_SYMBOL_GPL(dccp_getsockopt);
 694
 695static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
 696{
 697	struct cmsghdr *cmsg;
 698
 699	/*
 700	 * Assign an (opaque) qpolicy priority value to skb->priority.
 701	 *
 702	 * We are overloading this skb field for use with the qpolicy subystem.
 703	 * The skb->priority is normally used for the SO_PRIORITY option, which
 704	 * is initialised from sk_priority. Since the assignment of sk_priority
 705	 * to skb->priority happens later (on layer 3), we overload this field
 706	 * for use with queueing priorities as long as the skb is on layer 4.
 707	 * The default priority value (if nothing is set) is 0.
 708	 */
 709	skb->priority = 0;
 710
 711	for_each_cmsghdr(cmsg, msg) {
 712		if (!CMSG_OK(msg, cmsg))
 713			return -EINVAL;
 714
 715		if (cmsg->cmsg_level != SOL_DCCP)
 716			continue;
 717
 718		if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
 719		    !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
 720			return -EINVAL;
 721
 722		switch (cmsg->cmsg_type) {
 723		case DCCP_SCM_PRIORITY:
 724			if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
 725				return -EINVAL;
 726			skb->priority = *(__u32 *)CMSG_DATA(cmsg);
 727			break;
 728		default:
 729			return -EINVAL;
 730		}
 731	}
 732	return 0;
 733}
 734
 735int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 736{
 737	const struct dccp_sock *dp = dccp_sk(sk);
 738	const int flags = msg->msg_flags;
 739	const int noblock = flags & MSG_DONTWAIT;
 740	struct sk_buff *skb;
 741	int rc, size;
 742	long timeo;
 743
 744	trace_dccp_probe(sk, len);
 745
 746	if (len > READ_ONCE(dp->dccps_mss_cache))
 747		return -EMSGSIZE;
 748
 749	lock_sock(sk);
 750
 751	timeo = sock_sndtimeo(sk, noblock);
 752
 753	/*
 754	 * We have to use sk_stream_wait_connect here to set sk_write_pending,
 755	 * so that the trick in dccp_rcv_request_sent_state_process.
 756	 */
 757	/* Wait for a connection to finish. */
 758	if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
 759		if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
 760			goto out_release;
 761
 762	size = sk->sk_prot->max_header + len;
 763	release_sock(sk);
 764	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 765	lock_sock(sk);
 766	if (skb == NULL)
 767		goto out_release;
 768
 769	if (dccp_qpolicy_full(sk)) {
 770		rc = -EAGAIN;
 771		goto out_discard;
 772	}
 773
 774	if (sk->sk_state == DCCP_CLOSED) {
 775		rc = -ENOTCONN;
 776		goto out_discard;
 777	}
 778
 779	/* We need to check dccps_mss_cache after socket is locked. */
 780	if (len > dp->dccps_mss_cache) {
 781		rc = -EMSGSIZE;
 782		goto out_discard;
 783	}
 784
 785	skb_reserve(skb, sk->sk_prot->max_header);
 786	rc = memcpy_from_msg(skb_put(skb, len), msg, len);
 787	if (rc != 0)
 788		goto out_discard;
 789
 790	rc = dccp_msghdr_parse(msg, skb);
 791	if (rc != 0)
 792		goto out_discard;
 793
 794	dccp_qpolicy_push(sk, skb);
 795	/*
 796	 * The xmit_timer is set if the TX CCID is rate-based and will expire
 797	 * when congestion control permits to release further packets into the
 798	 * network. Window-based CCIDs do not use this timer.
 799	 */
 800	if (!timer_pending(&dp->dccps_xmit_timer))
 801		dccp_write_xmit(sk);
 802out_release:
 803	release_sock(sk);
 804	return rc ? : len;
 805out_discard:
 806	kfree_skb(skb);
 807	goto out_release;
 808}
 809
 810EXPORT_SYMBOL_GPL(dccp_sendmsg);
 811
 812int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
 813		 int *addr_len)
 814{
 815	const struct dccp_hdr *dh;
 816	long timeo;
 817
 818	lock_sock(sk);
 819
 820	if (sk->sk_state == DCCP_LISTEN) {
 821		len = -ENOTCONN;
 822		goto out;
 823	}
 824
 825	timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 826
 827	do {
 828		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 829
 830		if (skb == NULL)
 831			goto verify_sock_status;
 832
 833		dh = dccp_hdr(skb);
 834
 835		switch (dh->dccph_type) {
 836		case DCCP_PKT_DATA:
 837		case DCCP_PKT_DATAACK:
 838			goto found_ok_skb;
 839
 840		case DCCP_PKT_CLOSE:
 841		case DCCP_PKT_CLOSEREQ:
 842			if (!(flags & MSG_PEEK))
 843				dccp_finish_passive_close(sk);
 844			fallthrough;
 845		case DCCP_PKT_RESET:
 846			dccp_pr_debug("found fin (%s) ok!\n",
 847				      dccp_packet_name(dh->dccph_type));
 848			len = 0;
 849			goto found_fin_ok;
 850		default:
 851			dccp_pr_debug("packet_type=%s\n",
 852				      dccp_packet_name(dh->dccph_type));
 853			sk_eat_skb(sk, skb);
 854		}
 855verify_sock_status:
 856		if (sock_flag(sk, SOCK_DONE)) {
 857			len = 0;
 858			break;
 859		}
 860
 861		if (sk->sk_err) {
 862			len = sock_error(sk);
 863			break;
 864		}
 865
 866		if (sk->sk_shutdown & RCV_SHUTDOWN) {
 867			len = 0;
 868			break;
 869		}
 870
 871		if (sk->sk_state == DCCP_CLOSED) {
 872			if (!sock_flag(sk, SOCK_DONE)) {
 873				/* This occurs when user tries to read
 874				 * from never connected socket.
 875				 */
 876				len = -ENOTCONN;
 877				break;
 878			}
 879			len = 0;
 880			break;
 881		}
 882
 883		if (!timeo) {
 884			len = -EAGAIN;
 885			break;
 886		}
 887
 888		if (signal_pending(current)) {
 889			len = sock_intr_errno(timeo);
 890			break;
 891		}
 892
 893		sk_wait_data(sk, &timeo, NULL);
 894		continue;
 895	found_ok_skb:
 896		if (len > skb->len)
 897			len = skb->len;
 898		else if (len < skb->len)
 899			msg->msg_flags |= MSG_TRUNC;
 900
 901		if (skb_copy_datagram_msg(skb, 0, msg, len)) {
 902			/* Exception. Bailout! */
 903			len = -EFAULT;
 904			break;
 905		}
 906		if (flags & MSG_TRUNC)
 907			len = skb->len;
 908	found_fin_ok:
 909		if (!(flags & MSG_PEEK))
 910			sk_eat_skb(sk, skb);
 911		break;
 912	} while (1);
 913out:
 914	release_sock(sk);
 915	return len;
 916}
 917
 918EXPORT_SYMBOL_GPL(dccp_recvmsg);
 919
 920int inet_dccp_listen(struct socket *sock, int backlog)
 921{
 922	struct sock *sk = sock->sk;
 923	unsigned char old_state;
 924	int err;
 925
 926	lock_sock(sk);
 927
 928	err = -EINVAL;
 929	if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
 930		goto out;
 931
 932	old_state = sk->sk_state;
 933	if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
 934		goto out;
 935
 936	WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
 937	/* Really, if the socket is already in listen state
 938	 * we can only allow the backlog to be adjusted.
 939	 */
 940	if (old_state != DCCP_LISTEN) {
 941		struct dccp_sock *dp = dccp_sk(sk);
 942
 943		dp->dccps_role = DCCP_ROLE_LISTEN;
 944
 945		/* do not start to listen if feature negotiation setup fails */
 946		if (dccp_feat_finalise_settings(dp)) {
 947			err = -EPROTO;
 948			goto out;
 949		}
 950
 951		err = inet_csk_listen_start(sk);
 952		if (err)
 953			goto out;
 954	}
 955	err = 0;
 956
 957out:
 958	release_sock(sk);
 959	return err;
 960}
 961
 962EXPORT_SYMBOL_GPL(inet_dccp_listen);
 963
 964static void dccp_terminate_connection(struct sock *sk)
 965{
 966	u8 next_state = DCCP_CLOSED;
 967
 968	switch (sk->sk_state) {
 969	case DCCP_PASSIVE_CLOSE:
 970	case DCCP_PASSIVE_CLOSEREQ:
 971		dccp_finish_passive_close(sk);
 972		break;
 973	case DCCP_PARTOPEN:
 974		dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
 975		inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 976		fallthrough;
 977	case DCCP_OPEN:
 978		dccp_send_close(sk, 1);
 979
 980		if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
 981		    !dccp_sk(sk)->dccps_server_timewait)
 982			next_state = DCCP_ACTIVE_CLOSEREQ;
 983		else
 984			next_state = DCCP_CLOSING;
 985		fallthrough;
 986	default:
 987		dccp_set_state(sk, next_state);
 988	}
 989}
 990
 991void dccp_close(struct sock *sk, long timeout)
 992{
 993	struct dccp_sock *dp = dccp_sk(sk);
 994	struct sk_buff *skb;
 995	u32 data_was_unread = 0;
 996	int state;
 997
 998	lock_sock(sk);
 999
1000	sk->sk_shutdown = SHUTDOWN_MASK;
1001
1002	if (sk->sk_state == DCCP_LISTEN) {
1003		dccp_set_state(sk, DCCP_CLOSED);
1004
1005		/* Special case. */
1006		inet_csk_listen_stop(sk);
1007
1008		goto adjudge_to_death;
1009	}
1010
1011	sk_stop_timer(sk, &dp->dccps_xmit_timer);
1012
1013	/*
1014	 * We need to flush the recv. buffs.  We do this only on the
1015	 * descriptor close, not protocol-sourced closes, because the
1016	  *reader process may not have drained the data yet!
1017	 */
1018	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1019		data_was_unread += skb->len;
1020		__kfree_skb(skb);
1021	}
1022
1023	/* If socket has been already reset kill it. */
1024	if (sk->sk_state == DCCP_CLOSED)
1025		goto adjudge_to_death;
1026
1027	if (data_was_unread) {
1028		/* Unread data was tossed, send an appropriate Reset Code */
1029		DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1030		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1031		dccp_set_state(sk, DCCP_CLOSED);
1032	} else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1033		/* Check zero linger _after_ checking for unread data. */
1034		sk->sk_prot->disconnect(sk, 0);
1035	} else if (sk->sk_state != DCCP_CLOSED) {
1036		/*
1037		 * Normal connection termination. May need to wait if there are
1038		 * still packets in the TX queue that are delayed by the CCID.
1039		 */
1040		dccp_flush_write_queue(sk, &timeout);
1041		dccp_terminate_connection(sk);
1042	}
1043
1044	/*
1045	 * Flush write queue. This may be necessary in several cases:
1046	 * - we have been closed by the peer but still have application data;
1047	 * - abortive termination (unread data or zero linger time),
1048	 * - normal termination but queue could not be flushed within time limit
1049	 */
1050	__skb_queue_purge(&sk->sk_write_queue);
1051
1052	sk_stream_wait_close(sk, timeout);
1053
1054adjudge_to_death:
1055	state = sk->sk_state;
1056	sock_hold(sk);
1057	sock_orphan(sk);
1058
1059	/*
1060	 * It is the last release_sock in its life. It will remove backlog.
1061	 */
1062	release_sock(sk);
1063	/*
1064	 * Now socket is owned by kernel and we acquire BH lock
1065	 * to finish close. No need to check for user refs.
1066	 */
1067	local_bh_disable();
1068	bh_lock_sock(sk);
1069	WARN_ON(sock_owned_by_user(sk));
1070
1071	this_cpu_inc(dccp_orphan_count);
1072
1073	/* Have we already been destroyed by a softirq or backlog? */
1074	if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1075		goto out;
1076
1077	if (sk->sk_state == DCCP_CLOSED)
1078		inet_csk_destroy_sock(sk);
1079
1080	/* Otherwise, socket is reprieved until protocol close. */
1081
1082out:
1083	bh_unlock_sock(sk);
1084	local_bh_enable();
1085	sock_put(sk);
1086}
1087
1088EXPORT_SYMBOL_GPL(dccp_close);
1089
1090void dccp_shutdown(struct sock *sk, int how)
1091{
1092	dccp_pr_debug("called shutdown(%x)\n", how);
1093}
1094
1095EXPORT_SYMBOL_GPL(dccp_shutdown);
1096
1097static inline int __init dccp_mib_init(void)
1098{
1099	dccp_statistics = alloc_percpu(struct dccp_mib);
1100	if (!dccp_statistics)
1101		return -ENOMEM;
1102	return 0;
1103}
1104
1105static inline void dccp_mib_exit(void)
1106{
1107	free_percpu(dccp_statistics);
1108}
1109
1110static int thash_entries;
1111module_param(thash_entries, int, 0444);
1112MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1113
1114#ifdef CONFIG_IP_DCCP_DEBUG
1115bool dccp_debug;
1116module_param(dccp_debug, bool, 0644);
1117MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1118
1119EXPORT_SYMBOL_GPL(dccp_debug);
1120#endif
1121
1122static int __init dccp_init(void)
1123{
1124	unsigned long goal;
1125	unsigned long nr_pages = totalram_pages();
1126	int ehash_order, bhash_order, i;
1127	int rc;
1128
1129	BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1130		     sizeof_field(struct sk_buff, cb));
1131	rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
1132	if (rc)
1133		goto out_fail;
1134	rc = -ENOBUFS;
1135	dccp_hashinfo.bind_bucket_cachep =
1136		kmem_cache_create("dccp_bind_bucket",
1137				  sizeof(struct inet_bind_bucket), 0,
1138				  SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1139	if (!dccp_hashinfo.bind_bucket_cachep)
1140		goto out_free_hashinfo2;
1141	dccp_hashinfo.bind2_bucket_cachep =
1142		kmem_cache_create("dccp_bind2_bucket",
1143				  sizeof(struct inet_bind2_bucket), 0,
1144				  SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1145	if (!dccp_hashinfo.bind2_bucket_cachep)
1146		goto out_free_bind_bucket_cachep;
1147
1148	/*
1149	 * Size and allocate the main established and bind bucket
1150	 * hash tables.
1151	 *
1152	 * The methodology is similar to that of the buffer cache.
1153	 */
1154	if (nr_pages >= (128 * 1024))
1155		goal = nr_pages >> (21 - PAGE_SHIFT);
1156	else
1157		goal = nr_pages >> (23 - PAGE_SHIFT);
1158
1159	if (thash_entries)
1160		goal = (thash_entries *
1161			sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1162	for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1163		;
1164	do {
1165		unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1166					sizeof(struct inet_ehash_bucket);
1167
1168		while (hash_size & (hash_size - 1))
1169			hash_size--;
1170		dccp_hashinfo.ehash_mask = hash_size - 1;
1171		dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1172			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1173	} while (!dccp_hashinfo.ehash && --ehash_order > 0);
1174
1175	if (!dccp_hashinfo.ehash) {
1176		DCCP_CRIT("Failed to allocate DCCP established hash table");
1177		goto out_free_bind2_bucket_cachep;
1178	}
1179
1180	for (i = 0; i <= dccp_hashinfo.ehash_mask; i++)
1181		INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1182
1183	if (inet_ehash_locks_alloc(&dccp_hashinfo))
1184			goto out_free_dccp_ehash;
1185
1186	bhash_order = ehash_order;
1187
1188	do {
1189		dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1190					sizeof(struct inet_bind_hashbucket);
1191		if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1192		    bhash_order > 0)
1193			continue;
1194		dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1195			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1196	} while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1197
1198	if (!dccp_hashinfo.bhash) {
1199		DCCP_CRIT("Failed to allocate DCCP bind hash table");
1200		goto out_free_dccp_locks;
1201	}
1202
1203	dccp_hashinfo.bhash2 = (struct inet_bind_hashbucket *)
1204		__get_free_pages(GFP_ATOMIC | __GFP_NOWARN, bhash_order);
1205
1206	if (!dccp_hashinfo.bhash2) {
1207		DCCP_CRIT("Failed to allocate DCCP bind2 hash table");
1208		goto out_free_dccp_bhash;
1209	}
1210
1211	for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1212		spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1213		INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1214		spin_lock_init(&dccp_hashinfo.bhash2[i].lock);
1215		INIT_HLIST_HEAD(&dccp_hashinfo.bhash2[i].chain);
1216	}
1217
1218	dccp_hashinfo.pernet = false;
1219
1220	rc = dccp_mib_init();
1221	if (rc)
1222		goto out_free_dccp_bhash2;
1223
1224	rc = dccp_ackvec_init();
1225	if (rc)
1226		goto out_free_dccp_mib;
1227
1228	rc = dccp_sysctl_init();
1229	if (rc)
1230		goto out_ackvec_exit;
1231
1232	rc = ccid_initialize_builtins();
1233	if (rc)
1234		goto out_sysctl_exit;
1235
1236	dccp_timestamping_init();
1237
1238	return 0;
1239
1240out_sysctl_exit:
1241	dccp_sysctl_exit();
1242out_ackvec_exit:
1243	dccp_ackvec_exit();
1244out_free_dccp_mib:
1245	dccp_mib_exit();
1246out_free_dccp_bhash2:
1247	free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1248out_free_dccp_bhash:
1249	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1250out_free_dccp_locks:
1251	inet_ehash_locks_free(&dccp_hashinfo);
1252out_free_dccp_ehash:
1253	free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1254out_free_bind2_bucket_cachep:
1255	kmem_cache_destroy(dccp_hashinfo.bind2_bucket_cachep);
1256out_free_bind_bucket_cachep:
1257	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1258out_free_hashinfo2:
1259	inet_hashinfo2_free_mod(&dccp_hashinfo);
1260out_fail:
1261	dccp_hashinfo.bhash = NULL;
1262	dccp_hashinfo.bhash2 = NULL;
1263	dccp_hashinfo.ehash = NULL;
1264	dccp_hashinfo.bind_bucket_cachep = NULL;
1265	dccp_hashinfo.bind2_bucket_cachep = NULL;
1266	return rc;
1267}
1268
1269static void __exit dccp_fini(void)
1270{
1271	int bhash_order = get_order(dccp_hashinfo.bhash_size *
1272				    sizeof(struct inet_bind_hashbucket));
1273
1274	ccid_cleanup_builtins();
1275	dccp_mib_exit();
1276	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1277	free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1278	free_pages((unsigned long)dccp_hashinfo.ehash,
1279		   get_order((dccp_hashinfo.ehash_mask + 1) *
1280			     sizeof(struct inet_ehash_bucket)));
1281	inet_ehash_locks_free(&dccp_hashinfo);
1282	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1283	dccp_ackvec_exit();
1284	dccp_sysctl_exit();
1285	inet_hashinfo2_free_mod(&dccp_hashinfo);
1286}
1287
1288module_init(dccp_init);
1289module_exit(dccp_fini);
1290
1291MODULE_LICENSE("GPL");
1292MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1293MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");
v6.9.4
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  net/dccp/proto.c
   4 *
   5 *  An implementation of the DCCP protocol
   6 *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
   7 */
   8
   9#include <linux/dccp.h>
  10#include <linux/module.h>
  11#include <linux/types.h>
  12#include <linux/sched.h>
  13#include <linux/kernel.h>
  14#include <linux/skbuff.h>
  15#include <linux/netdevice.h>
  16#include <linux/in.h>
  17#include <linux/if_arp.h>
  18#include <linux/init.h>
  19#include <linux/random.h>
  20#include <linux/slab.h>
  21#include <net/checksum.h>
  22
  23#include <net/inet_sock.h>
  24#include <net/inet_common.h>
  25#include <net/sock.h>
  26#include <net/xfrm.h>
  27
  28#include <asm/ioctls.h>
  29#include <linux/spinlock.h>
  30#include <linux/timer.h>
  31#include <linux/delay.h>
  32#include <linux/poll.h>
  33
  34#include "ccid.h"
  35#include "dccp.h"
  36#include "feat.h"
  37
  38#define CREATE_TRACE_POINTS
  39#include "trace.h"
  40
  41DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
  42
  43EXPORT_SYMBOL_GPL(dccp_statistics);
  44
  45DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
  46EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
  47
  48struct inet_hashinfo dccp_hashinfo;
  49EXPORT_SYMBOL_GPL(dccp_hashinfo);
  50
  51/* the maximum queue length for tx in packets. 0 is no limit */
  52int sysctl_dccp_tx_qlen __read_mostly = 5;
  53
  54#ifdef CONFIG_IP_DCCP_DEBUG
  55static const char *dccp_state_name(const int state)
  56{
  57	static const char *const dccp_state_names[] = {
  58	[DCCP_OPEN]		= "OPEN",
  59	[DCCP_REQUESTING]	= "REQUESTING",
  60	[DCCP_PARTOPEN]		= "PARTOPEN",
  61	[DCCP_LISTEN]		= "LISTEN",
  62	[DCCP_RESPOND]		= "RESPOND",
  63	[DCCP_CLOSING]		= "CLOSING",
  64	[DCCP_ACTIVE_CLOSEREQ]	= "CLOSEREQ",
  65	[DCCP_PASSIVE_CLOSE]	= "PASSIVE_CLOSE",
  66	[DCCP_PASSIVE_CLOSEREQ]	= "PASSIVE_CLOSEREQ",
  67	[DCCP_TIME_WAIT]	= "TIME_WAIT",
  68	[DCCP_CLOSED]		= "CLOSED",
  69	};
  70
  71	if (state >= DCCP_MAX_STATES)
  72		return "INVALID STATE!";
  73	else
  74		return dccp_state_names[state];
  75}
  76#endif
  77
  78void dccp_set_state(struct sock *sk, const int state)
  79{
  80	const int oldstate = sk->sk_state;
  81
  82	dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
  83		      dccp_state_name(oldstate), dccp_state_name(state));
  84	WARN_ON(state == oldstate);
  85
  86	switch (state) {
  87	case DCCP_OPEN:
  88		if (oldstate != DCCP_OPEN)
  89			DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
  90		/* Client retransmits all Confirm options until entering OPEN */
  91		if (oldstate == DCCP_PARTOPEN)
  92			dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
  93		break;
  94
  95	case DCCP_CLOSED:
  96		if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
  97		    oldstate == DCCP_CLOSING)
  98			DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
  99
 100		sk->sk_prot->unhash(sk);
 101		if (inet_csk(sk)->icsk_bind_hash != NULL &&
 102		    !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
 103			inet_put_port(sk);
 104		fallthrough;
 105	default:
 106		if (oldstate == DCCP_OPEN)
 107			DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
 108	}
 109
 110	/* Change state AFTER socket is unhashed to avoid closed
 111	 * socket sitting in hash tables.
 112	 */
 113	inet_sk_set_state(sk, state);
 114}
 115
 116EXPORT_SYMBOL_GPL(dccp_set_state);
 117
 118static void dccp_finish_passive_close(struct sock *sk)
 119{
 120	switch (sk->sk_state) {
 121	case DCCP_PASSIVE_CLOSE:
 122		/* Node (client or server) has received Close packet. */
 123		dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
 124		dccp_set_state(sk, DCCP_CLOSED);
 125		break;
 126	case DCCP_PASSIVE_CLOSEREQ:
 127		/*
 128		 * Client received CloseReq. We set the `active' flag so that
 129		 * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
 130		 */
 131		dccp_send_close(sk, 1);
 132		dccp_set_state(sk, DCCP_CLOSING);
 133	}
 134}
 135
 136void dccp_done(struct sock *sk)
 137{
 138	dccp_set_state(sk, DCCP_CLOSED);
 139	dccp_clear_xmit_timers(sk);
 140
 141	sk->sk_shutdown = SHUTDOWN_MASK;
 142
 143	if (!sock_flag(sk, SOCK_DEAD))
 144		sk->sk_state_change(sk);
 145	else
 146		inet_csk_destroy_sock(sk);
 147}
 148
 149EXPORT_SYMBOL_GPL(dccp_done);
 150
 151const char *dccp_packet_name(const int type)
 152{
 153	static const char *const dccp_packet_names[] = {
 154		[DCCP_PKT_REQUEST]  = "REQUEST",
 155		[DCCP_PKT_RESPONSE] = "RESPONSE",
 156		[DCCP_PKT_DATA]	    = "DATA",
 157		[DCCP_PKT_ACK]	    = "ACK",
 158		[DCCP_PKT_DATAACK]  = "DATAACK",
 159		[DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
 160		[DCCP_PKT_CLOSE]    = "CLOSE",
 161		[DCCP_PKT_RESET]    = "RESET",
 162		[DCCP_PKT_SYNC]	    = "SYNC",
 163		[DCCP_PKT_SYNCACK]  = "SYNCACK",
 164	};
 165
 166	if (type >= DCCP_NR_PKT_TYPES)
 167		return "INVALID";
 168	else
 169		return dccp_packet_names[type];
 170}
 171
 172EXPORT_SYMBOL_GPL(dccp_packet_name);
 173
 174void dccp_destruct_common(struct sock *sk)
 175{
 176	struct dccp_sock *dp = dccp_sk(sk);
 177
 178	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
 179	dp->dccps_hc_tx_ccid = NULL;
 180}
 181EXPORT_SYMBOL_GPL(dccp_destruct_common);
 182
 183static void dccp_sk_destruct(struct sock *sk)
 184{
 185	dccp_destruct_common(sk);
 186	inet_sock_destruct(sk);
 187}
 188
 189int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 190{
 191	struct dccp_sock *dp = dccp_sk(sk);
 192	struct inet_connection_sock *icsk = inet_csk(sk);
 193
 194	pr_warn_once("DCCP is deprecated and scheduled to be removed in 2025, "
 195		     "please contact the netdev mailing list\n");
 196
 197	icsk->icsk_rto		= DCCP_TIMEOUT_INIT;
 198	icsk->icsk_syn_retries	= sysctl_dccp_request_retries;
 199	sk->sk_state		= DCCP_CLOSED;
 200	sk->sk_write_space	= dccp_write_space;
 201	sk->sk_destruct		= dccp_sk_destruct;
 202	icsk->icsk_sync_mss	= dccp_sync_mss;
 203	dp->dccps_mss_cache	= 536;
 204	dp->dccps_rate_last	= jiffies;
 205	dp->dccps_role		= DCCP_ROLE_UNDEFINED;
 206	dp->dccps_service	= DCCP_SERVICE_CODE_IS_ABSENT;
 207	dp->dccps_tx_qlen	= sysctl_dccp_tx_qlen;
 208
 209	dccp_init_xmit_timers(sk);
 210
 211	INIT_LIST_HEAD(&dp->dccps_featneg);
 212	/* control socket doesn't need feat nego */
 213	if (likely(ctl_sock_initialized))
 214		return dccp_feat_init(sk);
 215	return 0;
 216}
 217
 218EXPORT_SYMBOL_GPL(dccp_init_sock);
 219
 220void dccp_destroy_sock(struct sock *sk)
 221{
 222	struct dccp_sock *dp = dccp_sk(sk);
 223
 224	__skb_queue_purge(&sk->sk_write_queue);
 225	if (sk->sk_send_head != NULL) {
 226		kfree_skb(sk->sk_send_head);
 227		sk->sk_send_head = NULL;
 228	}
 229
 230	/* Clean up a referenced DCCP bind bucket. */
 231	if (inet_csk(sk)->icsk_bind_hash != NULL)
 232		inet_put_port(sk);
 233
 234	kfree(dp->dccps_service_list);
 235	dp->dccps_service_list = NULL;
 236
 237	if (dp->dccps_hc_rx_ackvec != NULL) {
 238		dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
 239		dp->dccps_hc_rx_ackvec = NULL;
 240	}
 241	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 242	dp->dccps_hc_rx_ccid = NULL;
 243
 244	/* clean up feature negotiation state */
 245	dccp_feat_list_purge(&dp->dccps_featneg);
 246}
 247
 248EXPORT_SYMBOL_GPL(dccp_destroy_sock);
 249
 250static inline int dccp_need_reset(int state)
 251{
 252	return state != DCCP_CLOSED && state != DCCP_LISTEN &&
 253	       state != DCCP_REQUESTING;
 254}
 255
 256int dccp_disconnect(struct sock *sk, int flags)
 257{
 258	struct inet_connection_sock *icsk = inet_csk(sk);
 259	struct inet_sock *inet = inet_sk(sk);
 260	struct dccp_sock *dp = dccp_sk(sk);
 261	const int old_state = sk->sk_state;
 262
 263	if (old_state != DCCP_CLOSED)
 264		dccp_set_state(sk, DCCP_CLOSED);
 265
 266	/*
 267	 * This corresponds to the ABORT function of RFC793, sec. 3.8
 268	 * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
 269	 */
 270	if (old_state == DCCP_LISTEN) {
 271		inet_csk_listen_stop(sk);
 272	} else if (dccp_need_reset(old_state)) {
 273		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
 274		sk->sk_err = ECONNRESET;
 275	} else if (old_state == DCCP_REQUESTING)
 276		sk->sk_err = ECONNRESET;
 277
 278	dccp_clear_xmit_timers(sk);
 279	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 280	dp->dccps_hc_rx_ccid = NULL;
 281
 282	__skb_queue_purge(&sk->sk_receive_queue);
 283	__skb_queue_purge(&sk->sk_write_queue);
 284	if (sk->sk_send_head != NULL) {
 285		__kfree_skb(sk->sk_send_head);
 286		sk->sk_send_head = NULL;
 287	}
 288
 289	inet->inet_dport = 0;
 290
 291	inet_bhash2_reset_saddr(sk);
 292
 293	sk->sk_shutdown = 0;
 294	sock_reset_flag(sk, SOCK_DONE);
 295
 296	icsk->icsk_backoff = 0;
 297	inet_csk_delack_init(sk);
 298	__sk_dst_reset(sk);
 299
 300	WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 301
 302	sk_error_report(sk);
 303	return 0;
 304}
 305
 306EXPORT_SYMBOL_GPL(dccp_disconnect);
 307
 308/*
 309 *	Wait for a DCCP event.
 310 *
 311 *	Note that we don't need to lock the socket, as the upper poll layers
 312 *	take care of normal races (between the test and the event) and we don't
 313 *	go look at any of the socket buffers directly.
 314 */
 315__poll_t dccp_poll(struct file *file, struct socket *sock,
 316		       poll_table *wait)
 317{
 318	struct sock *sk = sock->sk;
 319	__poll_t mask;
 320	u8 shutdown;
 321	int state;
 322
 323	sock_poll_wait(file, sock, wait);
 324
 325	state = inet_sk_state_load(sk);
 326	if (state == DCCP_LISTEN)
 327		return inet_csk_listen_poll(sk);
 328
 329	/* Socket is not locked. We are protected from async events
 330	   by poll logic and correct handling of state changes
 331	   made by another threads is impossible in any case.
 332	 */
 333
 334	mask = 0;
 335	if (READ_ONCE(sk->sk_err))
 336		mask = EPOLLERR;
 337	shutdown = READ_ONCE(sk->sk_shutdown);
 338
 339	if (shutdown == SHUTDOWN_MASK || state == DCCP_CLOSED)
 340		mask |= EPOLLHUP;
 341	if (shutdown & RCV_SHUTDOWN)
 342		mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
 343
 344	/* Connected? */
 345	if ((1 << state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
 346		if (atomic_read(&sk->sk_rmem_alloc) > 0)
 347			mask |= EPOLLIN | EPOLLRDNORM;
 348
 349		if (!(shutdown & SEND_SHUTDOWN)) {
 350			if (sk_stream_is_writeable(sk)) {
 351				mask |= EPOLLOUT | EPOLLWRNORM;
 352			} else {  /* send SIGIO later */
 353				sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 354				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 355
 356				/* Race breaker. If space is freed after
 357				 * wspace test but before the flags are set,
 358				 * IO signal will be lost.
 359				 */
 360				if (sk_stream_is_writeable(sk))
 361					mask |= EPOLLOUT | EPOLLWRNORM;
 362			}
 363		}
 364	}
 365	return mask;
 366}
 367EXPORT_SYMBOL_GPL(dccp_poll);
 368
 369int dccp_ioctl(struct sock *sk, int cmd, int *karg)
 370{
 371	int rc = -ENOTCONN;
 372
 373	lock_sock(sk);
 374
 375	if (sk->sk_state == DCCP_LISTEN)
 376		goto out;
 377
 378	switch (cmd) {
 379	case SIOCOUTQ: {
 380		*karg = sk_wmem_alloc_get(sk);
 381		/* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and
 382		 * always 0, comparably to UDP.
 383		 */
 384
 385		rc = 0;
 386	}
 387		break;
 388	case SIOCINQ: {
 389		struct sk_buff *skb;
 390		*karg = 0;
 391
 392		skb = skb_peek(&sk->sk_receive_queue);
 393		if (skb != NULL) {
 394			/*
 395			 * We will only return the amount of this packet since
 396			 * that is all that will be read.
 397			 */
 398			*karg = skb->len;
 399		}
 400		rc = 0;
 401	}
 402		break;
 403	default:
 404		rc = -ENOIOCTLCMD;
 405		break;
 406	}
 407out:
 408	release_sock(sk);
 409	return rc;
 410}
 411
 412EXPORT_SYMBOL_GPL(dccp_ioctl);
 413
 414static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
 415				   sockptr_t optval, unsigned int optlen)
 416{
 417	struct dccp_sock *dp = dccp_sk(sk);
 418	struct dccp_service_list *sl = NULL;
 419
 420	if (service == DCCP_SERVICE_INVALID_VALUE ||
 421	    optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
 422		return -EINVAL;
 423
 424	if (optlen > sizeof(service)) {
 425		sl = kmalloc(optlen, GFP_KERNEL);
 426		if (sl == NULL)
 427			return -ENOMEM;
 428
 429		sl->dccpsl_nr = optlen / sizeof(u32) - 1;
 430		if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
 431				sizeof(service), optlen - sizeof(service)) ||
 432		    dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
 433			kfree(sl);
 434			return -EFAULT;
 435		}
 436	}
 437
 438	lock_sock(sk);
 439	dp->dccps_service = service;
 440
 441	kfree(dp->dccps_service_list);
 442
 443	dp->dccps_service_list = sl;
 444	release_sock(sk);
 445	return 0;
 446}
 447
 448static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 449{
 450	u8 *list, len;
 451	int i, rc;
 452
 453	if (cscov < 0 || cscov > 15)
 454		return -EINVAL;
 455	/*
 456	 * Populate a list of permissible values, in the range cscov...15. This
 457	 * is necessary since feature negotiation of single values only works if
 458	 * both sides incidentally choose the same value. Since the list starts
 459	 * lowest-value first, negotiation will pick the smallest shared value.
 460	 */
 461	if (cscov == 0)
 462		return 0;
 463	len = 16 - cscov;
 464
 465	list = kmalloc(len, GFP_KERNEL);
 466	if (list == NULL)
 467		return -ENOBUFS;
 468
 469	for (i = 0; i < len; i++)
 470		list[i] = cscov++;
 471
 472	rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
 473
 474	if (rc == 0) {
 475		if (rx)
 476			dccp_sk(sk)->dccps_pcrlen = cscov;
 477		else
 478			dccp_sk(sk)->dccps_pcslen = cscov;
 479	}
 480	kfree(list);
 481	return rc;
 482}
 483
 484static int dccp_setsockopt_ccid(struct sock *sk, int type,
 485				sockptr_t optval, unsigned int optlen)
 486{
 487	u8 *val;
 488	int rc = 0;
 489
 490	if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
 491		return -EINVAL;
 492
 493	val = memdup_sockptr(optval, optlen);
 494	if (IS_ERR(val))
 495		return PTR_ERR(val);
 496
 497	lock_sock(sk);
 498	if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
 499		rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
 500
 501	if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
 502		rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
 503	release_sock(sk);
 504
 505	kfree(val);
 506	return rc;
 507}
 508
 509static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 510		sockptr_t optval, unsigned int optlen)
 511{
 512	struct dccp_sock *dp = dccp_sk(sk);
 513	int val, err = 0;
 514
 515	switch (optname) {
 516	case DCCP_SOCKOPT_PACKET_SIZE:
 517		DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 518		return 0;
 519	case DCCP_SOCKOPT_CHANGE_L:
 520	case DCCP_SOCKOPT_CHANGE_R:
 521		DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
 522		return 0;
 523	case DCCP_SOCKOPT_CCID:
 524	case DCCP_SOCKOPT_RX_CCID:
 525	case DCCP_SOCKOPT_TX_CCID:
 526		return dccp_setsockopt_ccid(sk, optname, optval, optlen);
 527	}
 528
 529	if (optlen < (int)sizeof(int))
 530		return -EINVAL;
 531
 532	if (copy_from_sockptr(&val, optval, sizeof(int)))
 533		return -EFAULT;
 534
 535	if (optname == DCCP_SOCKOPT_SERVICE)
 536		return dccp_setsockopt_service(sk, val, optval, optlen);
 537
 538	lock_sock(sk);
 539	switch (optname) {
 540	case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 541		if (dp->dccps_role != DCCP_ROLE_SERVER)
 542			err = -EOPNOTSUPP;
 543		else
 544			dp->dccps_server_timewait = (val != 0);
 545		break;
 546	case DCCP_SOCKOPT_SEND_CSCOV:
 547		err = dccp_setsockopt_cscov(sk, val, false);
 548		break;
 549	case DCCP_SOCKOPT_RECV_CSCOV:
 550		err = dccp_setsockopt_cscov(sk, val, true);
 551		break;
 552	case DCCP_SOCKOPT_QPOLICY_ID:
 553		if (sk->sk_state != DCCP_CLOSED)
 554			err = -EISCONN;
 555		else if (val < 0 || val >= DCCPQ_POLICY_MAX)
 556			err = -EINVAL;
 557		else
 558			dp->dccps_qpolicy = val;
 559		break;
 560	case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 561		if (val < 0)
 562			err = -EINVAL;
 563		else
 564			dp->dccps_tx_qlen = val;
 565		break;
 566	default:
 567		err = -ENOPROTOOPT;
 568		break;
 569	}
 570	release_sock(sk);
 571
 572	return err;
 573}
 574
 575int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
 576		    unsigned int optlen)
 577{
 578	if (level != SOL_DCCP)
 579		return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
 580							     optname, optval,
 581							     optlen);
 582	return do_dccp_setsockopt(sk, level, optname, optval, optlen);
 583}
 584
 585EXPORT_SYMBOL_GPL(dccp_setsockopt);
 586
 587static int dccp_getsockopt_service(struct sock *sk, int len,
 588				   __be32 __user *optval,
 589				   int __user *optlen)
 590{
 591	const struct dccp_sock *dp = dccp_sk(sk);
 592	const struct dccp_service_list *sl;
 593	int err = -ENOENT, slen = 0, total_len = sizeof(u32);
 594
 595	lock_sock(sk);
 596	if ((sl = dp->dccps_service_list) != NULL) {
 597		slen = sl->dccpsl_nr * sizeof(u32);
 598		total_len += slen;
 599	}
 600
 601	err = -EINVAL;
 602	if (total_len > len)
 603		goto out;
 604
 605	err = 0;
 606	if (put_user(total_len, optlen) ||
 607	    put_user(dp->dccps_service, optval) ||
 608	    (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
 609		err = -EFAULT;
 610out:
 611	release_sock(sk);
 612	return err;
 613}
 614
 615static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
 616		    char __user *optval, int __user *optlen)
 617{
 618	struct dccp_sock *dp;
 619	int val, len;
 620
 621	if (get_user(len, optlen))
 622		return -EFAULT;
 623
 624	if (len < (int)sizeof(int))
 625		return -EINVAL;
 626
 627	dp = dccp_sk(sk);
 628
 629	switch (optname) {
 630	case DCCP_SOCKOPT_PACKET_SIZE:
 631		DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 632		return 0;
 633	case DCCP_SOCKOPT_SERVICE:
 634		return dccp_getsockopt_service(sk, len,
 635					       (__be32 __user *)optval, optlen);
 636	case DCCP_SOCKOPT_GET_CUR_MPS:
 637		val = READ_ONCE(dp->dccps_mss_cache);
 638		break;
 639	case DCCP_SOCKOPT_AVAILABLE_CCIDS:
 640		return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
 641	case DCCP_SOCKOPT_TX_CCID:
 642		val = ccid_get_current_tx_ccid(dp);
 643		if (val < 0)
 644			return -ENOPROTOOPT;
 645		break;
 646	case DCCP_SOCKOPT_RX_CCID:
 647		val = ccid_get_current_rx_ccid(dp);
 648		if (val < 0)
 649			return -ENOPROTOOPT;
 650		break;
 651	case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 652		val = dp->dccps_server_timewait;
 653		break;
 654	case DCCP_SOCKOPT_SEND_CSCOV:
 655		val = dp->dccps_pcslen;
 656		break;
 657	case DCCP_SOCKOPT_RECV_CSCOV:
 658		val = dp->dccps_pcrlen;
 659		break;
 660	case DCCP_SOCKOPT_QPOLICY_ID:
 661		val = dp->dccps_qpolicy;
 662		break;
 663	case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 664		val = dp->dccps_tx_qlen;
 665		break;
 666	case 128 ... 191:
 667		return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
 668					     len, (u32 __user *)optval, optlen);
 669	case 192 ... 255:
 670		return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
 671					     len, (u32 __user *)optval, optlen);
 672	default:
 673		return -ENOPROTOOPT;
 674	}
 675
 676	len = sizeof(val);
 677	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
 678		return -EFAULT;
 679
 680	return 0;
 681}
 682
 683int dccp_getsockopt(struct sock *sk, int level, int optname,
 684		    char __user *optval, int __user *optlen)
 685{
 686	if (level != SOL_DCCP)
 687		return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
 688							     optname, optval,
 689							     optlen);
 690	return do_dccp_getsockopt(sk, level, optname, optval, optlen);
 691}
 692
 693EXPORT_SYMBOL_GPL(dccp_getsockopt);
 694
 695static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
 696{
 697	struct cmsghdr *cmsg;
 698
 699	/*
 700	 * Assign an (opaque) qpolicy priority value to skb->priority.
 701	 *
 702	 * We are overloading this skb field for use with the qpolicy subystem.
 703	 * The skb->priority is normally used for the SO_PRIORITY option, which
 704	 * is initialised from sk_priority. Since the assignment of sk_priority
 705	 * to skb->priority happens later (on layer 3), we overload this field
 706	 * for use with queueing priorities as long as the skb is on layer 4.
 707	 * The default priority value (if nothing is set) is 0.
 708	 */
 709	skb->priority = 0;
 710
 711	for_each_cmsghdr(cmsg, msg) {
 712		if (!CMSG_OK(msg, cmsg))
 713			return -EINVAL;
 714
 715		if (cmsg->cmsg_level != SOL_DCCP)
 716			continue;
 717
 718		if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
 719		    !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
 720			return -EINVAL;
 721
 722		switch (cmsg->cmsg_type) {
 723		case DCCP_SCM_PRIORITY:
 724			if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
 725				return -EINVAL;
 726			skb->priority = *(__u32 *)CMSG_DATA(cmsg);
 727			break;
 728		default:
 729			return -EINVAL;
 730		}
 731	}
 732	return 0;
 733}
 734
 735int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 736{
 737	const struct dccp_sock *dp = dccp_sk(sk);
 738	const int flags = msg->msg_flags;
 739	const int noblock = flags & MSG_DONTWAIT;
 740	struct sk_buff *skb;
 741	int rc, size;
 742	long timeo;
 743
 744	trace_dccp_probe(sk, len);
 745
 746	if (len > READ_ONCE(dp->dccps_mss_cache))
 747		return -EMSGSIZE;
 748
 749	lock_sock(sk);
 750
 751	timeo = sock_sndtimeo(sk, noblock);
 752
 753	/*
 754	 * We have to use sk_stream_wait_connect here to set sk_write_pending,
 755	 * so that the trick in dccp_rcv_request_sent_state_process.
 756	 */
 757	/* Wait for a connection to finish. */
 758	if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
 759		if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
 760			goto out_release;
 761
 762	size = sk->sk_prot->max_header + len;
 763	release_sock(sk);
 764	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 765	lock_sock(sk);
 766	if (skb == NULL)
 767		goto out_release;
 768
 769	if (dccp_qpolicy_full(sk)) {
 770		rc = -EAGAIN;
 771		goto out_discard;
 772	}
 773
 774	if (sk->sk_state == DCCP_CLOSED) {
 775		rc = -ENOTCONN;
 776		goto out_discard;
 777	}
 778
 779	/* We need to check dccps_mss_cache after socket is locked. */
 780	if (len > dp->dccps_mss_cache) {
 781		rc = -EMSGSIZE;
 782		goto out_discard;
 783	}
 784
 785	skb_reserve(skb, sk->sk_prot->max_header);
 786	rc = memcpy_from_msg(skb_put(skb, len), msg, len);
 787	if (rc != 0)
 788		goto out_discard;
 789
 790	rc = dccp_msghdr_parse(msg, skb);
 791	if (rc != 0)
 792		goto out_discard;
 793
 794	dccp_qpolicy_push(sk, skb);
 795	/*
 796	 * The xmit_timer is set if the TX CCID is rate-based and will expire
 797	 * when congestion control permits to release further packets into the
 798	 * network. Window-based CCIDs do not use this timer.
 799	 */
 800	if (!timer_pending(&dp->dccps_xmit_timer))
 801		dccp_write_xmit(sk);
 802out_release:
 803	release_sock(sk);
 804	return rc ? : len;
 805out_discard:
 806	kfree_skb(skb);
 807	goto out_release;
 808}
 809
 810EXPORT_SYMBOL_GPL(dccp_sendmsg);
 811
 812int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
 813		 int *addr_len)
 814{
 815	const struct dccp_hdr *dh;
 816	long timeo;
 817
 818	lock_sock(sk);
 819
 820	if (sk->sk_state == DCCP_LISTEN) {
 821		len = -ENOTCONN;
 822		goto out;
 823	}
 824
 825	timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 826
 827	do {
 828		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 829
 830		if (skb == NULL)
 831			goto verify_sock_status;
 832
 833		dh = dccp_hdr(skb);
 834
 835		switch (dh->dccph_type) {
 836		case DCCP_PKT_DATA:
 837		case DCCP_PKT_DATAACK:
 838			goto found_ok_skb;
 839
 840		case DCCP_PKT_CLOSE:
 841		case DCCP_PKT_CLOSEREQ:
 842			if (!(flags & MSG_PEEK))
 843				dccp_finish_passive_close(sk);
 844			fallthrough;
 845		case DCCP_PKT_RESET:
 846			dccp_pr_debug("found fin (%s) ok!\n",
 847				      dccp_packet_name(dh->dccph_type));
 848			len = 0;
 849			goto found_fin_ok;
 850		default:
 851			dccp_pr_debug("packet_type=%s\n",
 852				      dccp_packet_name(dh->dccph_type));
 853			sk_eat_skb(sk, skb);
 854		}
 855verify_sock_status:
 856		if (sock_flag(sk, SOCK_DONE)) {
 857			len = 0;
 858			break;
 859		}
 860
 861		if (sk->sk_err) {
 862			len = sock_error(sk);
 863			break;
 864		}
 865
 866		if (sk->sk_shutdown & RCV_SHUTDOWN) {
 867			len = 0;
 868			break;
 869		}
 870
 871		if (sk->sk_state == DCCP_CLOSED) {
 872			if (!sock_flag(sk, SOCK_DONE)) {
 873				/* This occurs when user tries to read
 874				 * from never connected socket.
 875				 */
 876				len = -ENOTCONN;
 877				break;
 878			}
 879			len = 0;
 880			break;
 881		}
 882
 883		if (!timeo) {
 884			len = -EAGAIN;
 885			break;
 886		}
 887
 888		if (signal_pending(current)) {
 889			len = sock_intr_errno(timeo);
 890			break;
 891		}
 892
 893		sk_wait_data(sk, &timeo, NULL);
 894		continue;
 895	found_ok_skb:
 896		if (len > skb->len)
 897			len = skb->len;
 898		else if (len < skb->len)
 899			msg->msg_flags |= MSG_TRUNC;
 900
 901		if (skb_copy_datagram_msg(skb, 0, msg, len)) {
 902			/* Exception. Bailout! */
 903			len = -EFAULT;
 904			break;
 905		}
 906		if (flags & MSG_TRUNC)
 907			len = skb->len;
 908	found_fin_ok:
 909		if (!(flags & MSG_PEEK))
 910			sk_eat_skb(sk, skb);
 911		break;
 912	} while (1);
 913out:
 914	release_sock(sk);
 915	return len;
 916}
 917
 918EXPORT_SYMBOL_GPL(dccp_recvmsg);
 919
 920int inet_dccp_listen(struct socket *sock, int backlog)
 921{
 922	struct sock *sk = sock->sk;
 923	unsigned char old_state;
 924	int err;
 925
 926	lock_sock(sk);
 927
 928	err = -EINVAL;
 929	if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
 930		goto out;
 931
 932	old_state = sk->sk_state;
 933	if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
 934		goto out;
 935
 936	WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
 937	/* Really, if the socket is already in listen state
 938	 * we can only allow the backlog to be adjusted.
 939	 */
 940	if (old_state != DCCP_LISTEN) {
 941		struct dccp_sock *dp = dccp_sk(sk);
 942
 943		dp->dccps_role = DCCP_ROLE_LISTEN;
 944
 945		/* do not start to listen if feature negotiation setup fails */
 946		if (dccp_feat_finalise_settings(dp)) {
 947			err = -EPROTO;
 948			goto out;
 949		}
 950
 951		err = inet_csk_listen_start(sk);
 952		if (err)
 953			goto out;
 954	}
 955	err = 0;
 956
 957out:
 958	release_sock(sk);
 959	return err;
 960}
 961
 962EXPORT_SYMBOL_GPL(inet_dccp_listen);
 963
 964static void dccp_terminate_connection(struct sock *sk)
 965{
 966	u8 next_state = DCCP_CLOSED;
 967
 968	switch (sk->sk_state) {
 969	case DCCP_PASSIVE_CLOSE:
 970	case DCCP_PASSIVE_CLOSEREQ:
 971		dccp_finish_passive_close(sk);
 972		break;
 973	case DCCP_PARTOPEN:
 974		dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
 975		inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 976		fallthrough;
 977	case DCCP_OPEN:
 978		dccp_send_close(sk, 1);
 979
 980		if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
 981		    !dccp_sk(sk)->dccps_server_timewait)
 982			next_state = DCCP_ACTIVE_CLOSEREQ;
 983		else
 984			next_state = DCCP_CLOSING;
 985		fallthrough;
 986	default:
 987		dccp_set_state(sk, next_state);
 988	}
 989}
 990
 991void dccp_close(struct sock *sk, long timeout)
 992{
 993	struct dccp_sock *dp = dccp_sk(sk);
 994	struct sk_buff *skb;
 995	u32 data_was_unread = 0;
 996	int state;
 997
 998	lock_sock(sk);
 999
1000	sk->sk_shutdown = SHUTDOWN_MASK;
1001
1002	if (sk->sk_state == DCCP_LISTEN) {
1003		dccp_set_state(sk, DCCP_CLOSED);
1004
1005		/* Special case. */
1006		inet_csk_listen_stop(sk);
1007
1008		goto adjudge_to_death;
1009	}
1010
1011	sk_stop_timer(sk, &dp->dccps_xmit_timer);
1012
1013	/*
1014	 * We need to flush the recv. buffs.  We do this only on the
1015	 * descriptor close, not protocol-sourced closes, because the
1016	  *reader process may not have drained the data yet!
1017	 */
1018	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1019		data_was_unread += skb->len;
1020		__kfree_skb(skb);
1021	}
1022
1023	/* If socket has been already reset kill it. */
1024	if (sk->sk_state == DCCP_CLOSED)
1025		goto adjudge_to_death;
1026
1027	if (data_was_unread) {
1028		/* Unread data was tossed, send an appropriate Reset Code */
1029		DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1030		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1031		dccp_set_state(sk, DCCP_CLOSED);
1032	} else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1033		/* Check zero linger _after_ checking for unread data. */
1034		sk->sk_prot->disconnect(sk, 0);
1035	} else if (sk->sk_state != DCCP_CLOSED) {
1036		/*
1037		 * Normal connection termination. May need to wait if there are
1038		 * still packets in the TX queue that are delayed by the CCID.
1039		 */
1040		dccp_flush_write_queue(sk, &timeout);
1041		dccp_terminate_connection(sk);
1042	}
1043
1044	/*
1045	 * Flush write queue. This may be necessary in several cases:
1046	 * - we have been closed by the peer but still have application data;
1047	 * - abortive termination (unread data or zero linger time),
1048	 * - normal termination but queue could not be flushed within time limit
1049	 */
1050	__skb_queue_purge(&sk->sk_write_queue);
1051
1052	sk_stream_wait_close(sk, timeout);
1053
1054adjudge_to_death:
1055	state = sk->sk_state;
1056	sock_hold(sk);
1057	sock_orphan(sk);
1058
1059	/*
1060	 * It is the last release_sock in its life. It will remove backlog.
1061	 */
1062	release_sock(sk);
1063	/*
1064	 * Now socket is owned by kernel and we acquire BH lock
1065	 * to finish close. No need to check for user refs.
1066	 */
1067	local_bh_disable();
1068	bh_lock_sock(sk);
1069	WARN_ON(sock_owned_by_user(sk));
1070
1071	this_cpu_inc(dccp_orphan_count);
1072
1073	/* Have we already been destroyed by a softirq or backlog? */
1074	if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1075		goto out;
1076
1077	if (sk->sk_state == DCCP_CLOSED)
1078		inet_csk_destroy_sock(sk);
1079
1080	/* Otherwise, socket is reprieved until protocol close. */
1081
1082out:
1083	bh_unlock_sock(sk);
1084	local_bh_enable();
1085	sock_put(sk);
1086}
1087
1088EXPORT_SYMBOL_GPL(dccp_close);
1089
1090void dccp_shutdown(struct sock *sk, int how)
1091{
1092	dccp_pr_debug("called shutdown(%x)\n", how);
1093}
1094
1095EXPORT_SYMBOL_GPL(dccp_shutdown);
1096
1097static inline int __init dccp_mib_init(void)
1098{
1099	dccp_statistics = alloc_percpu(struct dccp_mib);
1100	if (!dccp_statistics)
1101		return -ENOMEM;
1102	return 0;
1103}
1104
1105static inline void dccp_mib_exit(void)
1106{
1107	free_percpu(dccp_statistics);
1108}
1109
1110static int thash_entries;
1111module_param(thash_entries, int, 0444);
1112MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1113
1114#ifdef CONFIG_IP_DCCP_DEBUG
1115bool dccp_debug;
1116module_param(dccp_debug, bool, 0644);
1117MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1118
1119EXPORT_SYMBOL_GPL(dccp_debug);
1120#endif
1121
1122static int __init dccp_init(void)
1123{
1124	unsigned long goal;
1125	unsigned long nr_pages = totalram_pages();
1126	int ehash_order, bhash_order, i;
1127	int rc;
1128
1129	BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1130		     sizeof_field(struct sk_buff, cb));
1131	rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
1132	if (rc)
1133		goto out_fail;
1134	rc = -ENOBUFS;
1135	dccp_hashinfo.bind_bucket_cachep =
1136		kmem_cache_create("dccp_bind_bucket",
1137				  sizeof(struct inet_bind_bucket), 0,
1138				  SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1139	if (!dccp_hashinfo.bind_bucket_cachep)
1140		goto out_free_hashinfo2;
1141	dccp_hashinfo.bind2_bucket_cachep =
1142		kmem_cache_create("dccp_bind2_bucket",
1143				  sizeof(struct inet_bind2_bucket), 0,
1144				  SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1145	if (!dccp_hashinfo.bind2_bucket_cachep)
1146		goto out_free_bind_bucket_cachep;
1147
1148	/*
1149	 * Size and allocate the main established and bind bucket
1150	 * hash tables.
1151	 *
1152	 * The methodology is similar to that of the buffer cache.
1153	 */
1154	if (nr_pages >= (128 * 1024))
1155		goal = nr_pages >> (21 - PAGE_SHIFT);
1156	else
1157		goal = nr_pages >> (23 - PAGE_SHIFT);
1158
1159	if (thash_entries)
1160		goal = (thash_entries *
1161			sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1162	for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1163		;
1164	do {
1165		unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1166					sizeof(struct inet_ehash_bucket);
1167
1168		while (hash_size & (hash_size - 1))
1169			hash_size--;
1170		dccp_hashinfo.ehash_mask = hash_size - 1;
1171		dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1172			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1173	} while (!dccp_hashinfo.ehash && --ehash_order > 0);
1174
1175	if (!dccp_hashinfo.ehash) {
1176		DCCP_CRIT("Failed to allocate DCCP established hash table");
1177		goto out_free_bind2_bucket_cachep;
1178	}
1179
1180	for (i = 0; i <= dccp_hashinfo.ehash_mask; i++)
1181		INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1182
1183	if (inet_ehash_locks_alloc(&dccp_hashinfo))
1184			goto out_free_dccp_ehash;
1185
1186	bhash_order = ehash_order;
1187
1188	do {
1189		dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1190					sizeof(struct inet_bind_hashbucket);
1191		if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1192		    bhash_order > 0)
1193			continue;
1194		dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1195			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1196	} while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1197
1198	if (!dccp_hashinfo.bhash) {
1199		DCCP_CRIT("Failed to allocate DCCP bind hash table");
1200		goto out_free_dccp_locks;
1201	}
1202
1203	dccp_hashinfo.bhash2 = (struct inet_bind_hashbucket *)
1204		__get_free_pages(GFP_ATOMIC | __GFP_NOWARN, bhash_order);
1205
1206	if (!dccp_hashinfo.bhash2) {
1207		DCCP_CRIT("Failed to allocate DCCP bind2 hash table");
1208		goto out_free_dccp_bhash;
1209	}
1210
1211	for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1212		spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1213		INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1214		spin_lock_init(&dccp_hashinfo.bhash2[i].lock);
1215		INIT_HLIST_HEAD(&dccp_hashinfo.bhash2[i].chain);
1216	}
1217
1218	dccp_hashinfo.pernet = false;
1219
1220	rc = dccp_mib_init();
1221	if (rc)
1222		goto out_free_dccp_bhash2;
1223
1224	rc = dccp_ackvec_init();
1225	if (rc)
1226		goto out_free_dccp_mib;
1227
1228	rc = dccp_sysctl_init();
1229	if (rc)
1230		goto out_ackvec_exit;
1231
1232	rc = ccid_initialize_builtins();
1233	if (rc)
1234		goto out_sysctl_exit;
1235
1236	dccp_timestamping_init();
1237
1238	return 0;
1239
1240out_sysctl_exit:
1241	dccp_sysctl_exit();
1242out_ackvec_exit:
1243	dccp_ackvec_exit();
1244out_free_dccp_mib:
1245	dccp_mib_exit();
1246out_free_dccp_bhash2:
1247	free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1248out_free_dccp_bhash:
1249	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1250out_free_dccp_locks:
1251	inet_ehash_locks_free(&dccp_hashinfo);
1252out_free_dccp_ehash:
1253	free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1254out_free_bind2_bucket_cachep:
1255	kmem_cache_destroy(dccp_hashinfo.bind2_bucket_cachep);
1256out_free_bind_bucket_cachep:
1257	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1258out_free_hashinfo2:
1259	inet_hashinfo2_free_mod(&dccp_hashinfo);
1260out_fail:
1261	dccp_hashinfo.bhash = NULL;
1262	dccp_hashinfo.bhash2 = NULL;
1263	dccp_hashinfo.ehash = NULL;
1264	dccp_hashinfo.bind_bucket_cachep = NULL;
1265	dccp_hashinfo.bind2_bucket_cachep = NULL;
1266	return rc;
1267}
1268
1269static void __exit dccp_fini(void)
1270{
1271	int bhash_order = get_order(dccp_hashinfo.bhash_size *
1272				    sizeof(struct inet_bind_hashbucket));
1273
1274	ccid_cleanup_builtins();
1275	dccp_mib_exit();
1276	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1277	free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1278	free_pages((unsigned long)dccp_hashinfo.ehash,
1279		   get_order((dccp_hashinfo.ehash_mask + 1) *
1280			     sizeof(struct inet_ehash_bucket)));
1281	inet_ehash_locks_free(&dccp_hashinfo);
1282	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1283	dccp_ackvec_exit();
1284	dccp_sysctl_exit();
1285	inet_hashinfo2_free_mod(&dccp_hashinfo);
1286}
1287
1288module_init(dccp_init);
1289module_exit(dccp_fini);
1290
1291MODULE_LICENSE("GPL");
1292MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1293MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");