1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * NETLINK      Generic Netlink Family
   4 *
   5 * 		Authors:	Jamal Hadi Salim
   6 * 				Thomas Graf <tgraf@suug.ch>
   7 *				Johannes Berg <johannes@sipsolutions.net>
   8 */
   9
  10#include <linux/module.h>
  11#include <linux/kernel.h>
  12#include <linux/slab.h>
  13#include <linux/errno.h>
  14#include <linux/types.h>
  15#include <linux/socket.h>
  16#include <linux/string_helpers.h>
  17#include <linux/skbuff.h>
  18#include <linux/mutex.h>
  19#include <linux/bitmap.h>
  20#include <linux/rwsem.h>
  21#include <linux/idr.h>
  22#include <net/sock.h>
  23#include <net/genetlink.h>
  24
  25static DEFINE_MUTEX(genl_mutex); /* serialization of message processing */
  26static DECLARE_RWSEM(cb_lock);
  27
  28atomic_t genl_sk_destructing_cnt = ATOMIC_INIT(0);
  29DECLARE_WAIT_QUEUE_HEAD(genl_sk_destructing_waitq);
  30
  31void genl_lock(void)
  32{
  33	mutex_lock(&genl_mutex);
  34}
  35EXPORT_SYMBOL(genl_lock);
  36
  37void genl_unlock(void)
  38{
  39	mutex_unlock(&genl_mutex);
  40}
  41EXPORT_SYMBOL(genl_unlock);
  42
 
 
 
 
 
 
 
 
  43static void genl_lock_all(void)
  44{
  45	down_write(&cb_lock);
  46	genl_lock();
  47}
  48
  49static void genl_unlock_all(void)
  50{
  51	genl_unlock();
  52	up_write(&cb_lock);
  53}
  54
  55static void genl_op_lock(const struct genl_family *family)
  56{
  57	if (!family->parallel_ops)
  58		genl_lock();
  59}
  60
  61static void genl_op_unlock(const struct genl_family *family)
  62{
  63	if (!family->parallel_ops)
  64		genl_unlock();
  65}
  66
  67static DEFINE_IDR(genl_fam_idr);
  68
  69/*
  70 * Bitmap of multicast groups that are currently in use.
  71 *
  72 * To avoid an allocation at boot of just one unsigned long,
  73 * declare it global instead.
  74 * Bit 0 is marked as already used since group 0 is invalid.
  75 * Bit 1 is marked as already used since the drop-monitor code
  76 * abuses the API and thinks it can statically use group 1.
  77 * That group will typically conflict with other groups that
  78 * any proper users use.
  79 * Bit 16 is marked as used since it's used for generic netlink
  80 * and the code no longer marks pre-reserved IDs as used.
  81 * Bit 17 is marked as already used since the VFS quota code
  82 * also abused this API and relied on family == group ID, we
  83 * cater to that by giving it a static family and group ID.
  84 * Bit 18 is marked as already used since the PMCRAID driver
  85 * did the same thing as the VFS quota code (maybe copied?)
  86 */
  87static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
  88				      BIT(GENL_ID_VFS_DQUOT) |
  89				      BIT(GENL_ID_PMCRAID);
  90static unsigned long *mc_groups = &mc_group_start;
  91static unsigned long mc_groups_longs = 1;
  92
  93/* We need the last attribute with non-zero ID therefore a 2-entry array */
  94static struct nla_policy genl_policy_reject_all[] = {
  95	{ .type = NLA_REJECT },
  96	{ .type = NLA_REJECT },
  97};
  98
  99static int genl_ctrl_event(int event, const struct genl_family *family,
 100			   const struct genl_multicast_group *grp,
 101			   int grp_id);
 102
 103static void
 104genl_op_fill_in_reject_policy(const struct genl_family *family,
 105			      struct genl_ops *op)
 106{
 107	BUILD_BUG_ON(ARRAY_SIZE(genl_policy_reject_all) - 1 != 1);
 108
 109	if (op->policy || op->cmd < family->resv_start_op)
 110		return;
 111
 112	op->policy = genl_policy_reject_all;
 113	op->maxattr = 1;
 114}
 115
 116static void
 117genl_op_fill_in_reject_policy_split(const struct genl_family *family,
 118				    struct genl_split_ops *op)
 119{
 120	if (op->policy)
 121		return;
 122
 123	op->policy = genl_policy_reject_all;
 124	op->maxattr = 1;
 125}
 126
 127static const struct genl_family *genl_family_find_byid(unsigned int id)
 128{
 129	return idr_find(&genl_fam_idr, id);
 130}
 131
 132static const struct genl_family *genl_family_find_byname(char *name)
 133{
 134	const struct genl_family *family;
 135	unsigned int id;
 136
 137	idr_for_each_entry(&genl_fam_idr, family, id)
 138		if (strcmp(family->name, name) == 0)
 139			return family;
 140
 141	return NULL;
 142}
 143
 144struct genl_op_iter {
 145	const struct genl_family *family;
 146	struct genl_split_ops doit;
 147	struct genl_split_ops dumpit;
 148	int cmd_idx;
 149	int entry_idx;
 150	u32 cmd;
 151	u8 flags;
 152};
 153
 154static void genl_op_from_full(const struct genl_family *family,
 155			      unsigned int i, struct genl_ops *op)
 156{
 157	*op = family->ops[i];
 158
 159	if (!op->maxattr)
 160		op->maxattr = family->maxattr;
 161	if (!op->policy)
 162		op->policy = family->policy;
 163
 164	genl_op_fill_in_reject_policy(family, op);
 165}
 166
 167static int genl_get_cmd_full(u32 cmd, const struct genl_family *family,
 168			     struct genl_ops *op)
 169{
 170	int i;
 171
 172	for (i = 0; i < family->n_ops; i++)
 173		if (family->ops[i].cmd == cmd) {
 174			genl_op_from_full(family, i, op);
 175			return 0;
 176		}
 177
 178	return -ENOENT;
 179}
 180
 181static void genl_op_from_small(const struct genl_family *family,
 182			       unsigned int i, struct genl_ops *op)
 183{
 184	memset(op, 0, sizeof(*op));
 185	op->doit	= family->small_ops[i].doit;
 186	op->dumpit	= family->small_ops[i].dumpit;
 187	op->cmd		= family->small_ops[i].cmd;
 188	op->internal_flags = family->small_ops[i].internal_flags;
 189	op->flags	= family->small_ops[i].flags;
 190	op->validate	= family->small_ops[i].validate;
 191
 192	op->maxattr = family->maxattr;
 193	op->policy = family->policy;
 194
 195	genl_op_fill_in_reject_policy(family, op);
 196}
 197
 198static int genl_get_cmd_small(u32 cmd, const struct genl_family *family,
 199			      struct genl_ops *op)
 200{
 201	int i;
 202
 203	for (i = 0; i < family->n_small_ops; i++)
 204		if (family->small_ops[i].cmd == cmd) {
 205			genl_op_from_small(family, i, op);
 206			return 0;
 207		}
 208
 209	return -ENOENT;
 210}
 211
 212static void genl_op_from_split(struct genl_op_iter *iter)
 213{
 214	const struct genl_family *family = iter->family;
 215	int i, cnt = 0;
 216
 217	i = iter->entry_idx - family->n_ops - family->n_small_ops;
 218
 219	if (family->split_ops[i + cnt].flags & GENL_CMD_CAP_DO) {
 220		iter->doit = family->split_ops[i + cnt];
 221		genl_op_fill_in_reject_policy_split(family, &iter->doit);
 222		cnt++;
 223	} else {
 224		memset(&iter->doit, 0, sizeof(iter->doit));
 225	}
 226
 227	if (i + cnt < family->n_split_ops &&
 228	    family->split_ops[i + cnt].flags & GENL_CMD_CAP_DUMP &&
 229	    (!cnt || family->split_ops[i + cnt].cmd == iter->doit.cmd)) {
 230		iter->dumpit = family->split_ops[i + cnt];
 231		genl_op_fill_in_reject_policy_split(family, &iter->dumpit);
 232		cnt++;
 233	} else {
 234		memset(&iter->dumpit, 0, sizeof(iter->dumpit));
 235	}
 236
 237	WARN_ON(!cnt);
 238	iter->entry_idx += cnt;
 239}
 240
 241static int
 242genl_get_cmd_split(u32 cmd, u8 flag, const struct genl_family *family,
 243		   struct genl_split_ops *op)
 244{
 245	int i;
 246
 247	for (i = 0; i < family->n_split_ops; i++)
 248		if (family->split_ops[i].cmd == cmd &&
 249		    family->split_ops[i].flags & flag) {
 250			*op = family->split_ops[i];
 251			return 0;
 252		}
 253
 254	return -ENOENT;
 255}
 256
 257static int
 258genl_cmd_full_to_split(struct genl_split_ops *op,
 259		       const struct genl_family *family,
 260		       const struct genl_ops *full, u8 flags)
 261{
 262	if ((flags & GENL_CMD_CAP_DO && !full->doit) ||
 263	    (flags & GENL_CMD_CAP_DUMP && !full->dumpit)) {
 264		memset(op, 0, sizeof(*op));
 265		return -ENOENT;
 266	}
 267
 268	if (flags & GENL_CMD_CAP_DUMP) {
 269		op->start	= full->start;
 270		op->dumpit	= full->dumpit;
 271		op->done	= full->done;
 272	} else {
 273		op->pre_doit	= family->pre_doit;
 274		op->doit	= full->doit;
 275		op->post_doit	= family->post_doit;
 276	}
 277
 278	if (flags & GENL_CMD_CAP_DUMP &&
 279	    full->validate & GENL_DONT_VALIDATE_DUMP) {
 280		op->policy	= NULL;
 281		op->maxattr	= 0;
 282	} else {
 283		op->policy	= full->policy;
 284		op->maxattr	= full->maxattr;
 285	}
 286
 287	op->cmd			= full->cmd;
 288	op->internal_flags	= full->internal_flags;
 289	op->flags		= full->flags;
 290	op->validate		= full->validate;
 291
 292	/* Make sure flags include the GENL_CMD_CAP_DO / GENL_CMD_CAP_DUMP */
 293	op->flags		|= flags;
 294
 295	return 0;
 296}
 297
 298/* Must make sure that op is initialized to 0 on failure */
 299static int
 300genl_get_cmd(u32 cmd, u8 flags, const struct genl_family *family,
 301	     struct genl_split_ops *op)
 302{
 303	struct genl_ops full;
 304	int err;
 305
 306	err = genl_get_cmd_full(cmd, family, &full);
 307	if (err == -ENOENT)
 308		err = genl_get_cmd_small(cmd, family, &full);
 309	/* Found one of legacy forms */
 310	if (err == 0)
 311		return genl_cmd_full_to_split(op, family, &full, flags);
 312
 313	err = genl_get_cmd_split(cmd, flags, family, op);
 314	if (err)
 315		memset(op, 0, sizeof(*op));
 316	return err;
 317}
 318
 319/* For policy dumping only, get ops of both do and dump.
 320 * Fail if both are missing, genl_get_cmd() will zero-init in case of failure.
 321 */
 322static int
 323genl_get_cmd_both(u32 cmd, const struct genl_family *family,
 324		  struct genl_split_ops *doit, struct genl_split_ops *dumpit)
 325{
 326	int err1, err2;
 327
 328	err1 = genl_get_cmd(cmd, GENL_CMD_CAP_DO, family, doit);
 329	err2 = genl_get_cmd(cmd, GENL_CMD_CAP_DUMP, family, dumpit);
 330
 331	return err1 && err2 ? -ENOENT : 0;
 332}
 333
 334static bool
 335genl_op_iter_init(const struct genl_family *family, struct genl_op_iter *iter)
 336{
 337	iter->family = family;
 338	iter->cmd_idx = 0;
 339	iter->entry_idx = 0;
 340
 341	iter->flags = 0;
 342
 343	return iter->family->n_ops +
 344		iter->family->n_small_ops +
 345		iter->family->n_split_ops;
 346}
 347
 348static bool genl_op_iter_next(struct genl_op_iter *iter)
 349{
 350	const struct genl_family *family = iter->family;
 351	bool legacy_op = true;
 352	struct genl_ops op;
 353
 354	if (iter->entry_idx < family->n_ops) {
 355		genl_op_from_full(family, iter->entry_idx, &op);
 356	} else if (iter->entry_idx < family->n_ops + family->n_small_ops) {
 357		genl_op_from_small(family, iter->entry_idx - family->n_ops,
 358				   &op);
 359	} else if (iter->entry_idx <
 360		   family->n_ops + family->n_small_ops + family->n_split_ops) {
 361		legacy_op = false;
 362		/* updates entry_idx */
 363		genl_op_from_split(iter);
 364	} else {
 365		return false;
 366	}
 367
 368	iter->cmd_idx++;
 369
 370	if (legacy_op) {
 371		iter->entry_idx++;
 372
 373		genl_cmd_full_to_split(&iter->doit, family,
 374				       &op, GENL_CMD_CAP_DO);
 375		genl_cmd_full_to_split(&iter->dumpit, family,
 376				       &op, GENL_CMD_CAP_DUMP);
 377	}
 378
 379	iter->cmd = iter->doit.cmd | iter->dumpit.cmd;
 380	iter->flags = iter->doit.flags | iter->dumpit.flags;
 381
 382	return true;
 383}
 384
 385static void
 386genl_op_iter_copy(struct genl_op_iter *dst, struct genl_op_iter *src)
 387{
 388	*dst = *src;
 389}
 390
 391static unsigned int genl_op_iter_idx(struct genl_op_iter *iter)
 392{
 393	return iter->cmd_idx;
 394}
 395
 396static int genl_allocate_reserve_groups(int n_groups, int *first_id)
 397{
 398	unsigned long *new_groups;
 399	int start = 0;
 400	int i;
 401	int id;
 402	bool fits;
 403
 404	do {
 405		if (start == 0)
 406			id = find_first_zero_bit(mc_groups,
 407						 mc_groups_longs *
 408						 BITS_PER_LONG);
 409		else
 410			id = find_next_zero_bit(mc_groups,
 411						mc_groups_longs * BITS_PER_LONG,
 412						start);
 413
 414		fits = true;
 415		for (i = id;
 416		     i < min_t(int, id + n_groups,
 417			       mc_groups_longs * BITS_PER_LONG);
 418		     i++) {
 419			if (test_bit(i, mc_groups)) {
 420				start = i;
 421				fits = false;
 422				break;
 423			}
 424		}
 425
 426		if (id + n_groups > mc_groups_longs * BITS_PER_LONG) {
 427			unsigned long new_longs = mc_groups_longs +
 428						  BITS_TO_LONGS(n_groups);
 429			size_t nlen = new_longs * sizeof(unsigned long);
 430
 431			if (mc_groups == &mc_group_start) {
 432				new_groups = kzalloc(nlen, GFP_KERNEL);
 433				if (!new_groups)
 434					return -ENOMEM;
 435				mc_groups = new_groups;
 436				*mc_groups = mc_group_start;
 437			} else {
 438				new_groups = krealloc(mc_groups, nlen,
 439						      GFP_KERNEL);
 440				if (!new_groups)
 441					return -ENOMEM;
 442				mc_groups = new_groups;
 443				for (i = 0; i < BITS_TO_LONGS(n_groups); i++)
 444					mc_groups[mc_groups_longs + i] = 0;
 445			}
 446			mc_groups_longs = new_longs;
 447		}
 448	} while (!fits);
 449
 450	for (i = id; i < id + n_groups; i++)
 451		set_bit(i, mc_groups);
 452	*first_id = id;
 453	return 0;
 454}
 455
 456static struct genl_family genl_ctrl;
 457
 458static int genl_validate_assign_mc_groups(struct genl_family *family)
 459{
 460	int first_id;
 461	int n_groups = family->n_mcgrps;
 462	int err = 0, i;
 463	bool groups_allocated = false;
 464
 465	if (!n_groups)
 466		return 0;
 467
 468	for (i = 0; i < n_groups; i++) {
 469		const struct genl_multicast_group *grp = &family->mcgrps[i];
 470
 471		if (WARN_ON(grp->name[0] == '\0'))
 472			return -EINVAL;
 473		if (WARN_ON(!string_is_terminated(grp->name, GENL_NAMSIZ)))
 474			return -EINVAL;
 475	}
 476
 477	/* special-case our own group and hacks */
 478	if (family == &genl_ctrl) {
 479		first_id = GENL_ID_CTRL;
 480		BUG_ON(n_groups != 1);
 481	} else if (strcmp(family->name, "NET_DM") == 0) {
 482		first_id = 1;
 483		BUG_ON(n_groups != 1);
 484	} else if (family->id == GENL_ID_VFS_DQUOT) {
 485		first_id = GENL_ID_VFS_DQUOT;
 486		BUG_ON(n_groups != 1);
 487	} else if (family->id == GENL_ID_PMCRAID) {
 488		first_id = GENL_ID_PMCRAID;
 489		BUG_ON(n_groups != 1);
 490	} else {
 491		groups_allocated = true;
 492		err = genl_allocate_reserve_groups(n_groups, &first_id);
 493		if (err)
 494			return err;
 495	}
 496
 497	family->mcgrp_offset = first_id;
 498
 499	/* if still initializing, can't and don't need to realloc bitmaps */
 500	if (!init_net.genl_sock)
 501		return 0;
 502
 503	if (family->netnsok) {
 504		struct net *net;
 505
 506		netlink_table_grab();
 507		rcu_read_lock();
 508		for_each_net_rcu(net) {
 509			err = __netlink_change_ngroups(net->genl_sock,
 510					mc_groups_longs * BITS_PER_LONG);
 511			if (err) {
 512				/*
 513				 * No need to roll back, can only fail if
 514				 * memory allocation fails and then the
 515				 * number of _possible_ groups has been
 516				 * increased on some sockets which is ok.
 517				 */
 518				break;
 519			}
 520		}
 521		rcu_read_unlock();
 522		netlink_table_ungrab();
 523	} else {
 524		err = netlink_change_ngroups(init_net.genl_sock,
 525					     mc_groups_longs * BITS_PER_LONG);
 526	}
 527
 528	if (groups_allocated && err) {
 529		for (i = 0; i < family->n_mcgrps; i++)
 530			clear_bit(family->mcgrp_offset + i, mc_groups);
 531	}
 532
 533	return err;
 534}
 535
 536static void genl_unregister_mc_groups(const struct genl_family *family)
 537{
 538	struct net *net;
 539	int i;
 540
 541	netlink_table_grab();
 542	rcu_read_lock();
 543	for_each_net_rcu(net) {
 544		for (i = 0; i < family->n_mcgrps; i++)
 545			__netlink_clear_multicast_users(
 546				net->genl_sock, family->mcgrp_offset + i);
 547	}
 548	rcu_read_unlock();
 549	netlink_table_ungrab();
 550
 551	for (i = 0; i < family->n_mcgrps; i++) {
 552		int grp_id = family->mcgrp_offset + i;
 553
 554		if (grp_id != 1)
 555			clear_bit(grp_id, mc_groups);
 556		genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, family,
 557				&family->mcgrps[i], grp_id);
 558	}
 559}
 560
 561static bool genl_split_op_check(const struct genl_split_ops *op)
 562{
 563	if (WARN_ON(hweight8(op->flags & (GENL_CMD_CAP_DO |
 564					  GENL_CMD_CAP_DUMP)) != 1))
 565		return true;
 566	return false;
 567}
 568
 569static int genl_validate_ops(const struct genl_family *family)
 570{
 571	struct genl_op_iter i, j;
 572	unsigned int s;
 
 573
 574	if (WARN_ON(family->n_ops && !family->ops) ||
 575	    WARN_ON(family->n_small_ops && !family->small_ops) ||
 576	    WARN_ON(family->n_split_ops && !family->split_ops))
 577		return -EINVAL;
 578
 579	for (genl_op_iter_init(family, &i); genl_op_iter_next(&i); ) {
 580		if (!(i.flags & (GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP)))
 581			return -EINVAL;
 582
 583		if (WARN_ON(i.cmd >= family->resv_start_op &&
 584			    (i.doit.validate || i.dumpit.validate)))
 585			return -EINVAL;
 586
 587		genl_op_iter_copy(&j, &i);
 588		while (genl_op_iter_next(&j)) {
 589			if (i.cmd == j.cmd)
 590				return -EINVAL;
 591		}
 592	}
 593
 594	if (family->n_split_ops) {
 595		if (genl_split_op_check(&family->split_ops[0]))
 596			return -EINVAL;
 597	}
 598
 599	for (s = 1; s < family->n_split_ops; s++) {
 600		const struct genl_split_ops *a, *b;
 601
 602		a = &family->split_ops[s - 1];
 603		b = &family->split_ops[s];
 604
 605		if (genl_split_op_check(b))
 606			return -EINVAL;
 607
 608		/* Check sort order */
 609		if (a->cmd < b->cmd) {
 610			continue;
 611		} else if (a->cmd > b->cmd) {
 612			WARN_ON(1);
 613			return -EINVAL;
 614		}
 615
 616		if (a->internal_flags != b->internal_flags ||
 617		    ((a->flags ^ b->flags) & ~(GENL_CMD_CAP_DO |
 618					       GENL_CMD_CAP_DUMP))) {
 619			WARN_ON(1);
 620			return -EINVAL;
 621		}
 622
 623		if ((a->flags & GENL_CMD_CAP_DO) &&
 624		    (b->flags & GENL_CMD_CAP_DUMP))
 625			continue;
 626
 627		WARN_ON(1);
 628		return -EINVAL;
 629	}
 630
 631	return 0;
 632}
 633
 634static void *genl_sk_priv_alloc(struct genl_family *family)
 635{
 636	void *priv;
 637
 638	priv = kzalloc(family->sock_priv_size, GFP_KERNEL);
 639	if (!priv)
 640		return ERR_PTR(-ENOMEM);
 641
 642	if (family->sock_priv_init)
 643		family->sock_priv_init(priv);
 644
 645	return priv;
 646}
 647
 648static void genl_sk_priv_free(const struct genl_family *family, void *priv)
 649{
 650	if (family->sock_priv_destroy)
 651		family->sock_priv_destroy(priv);
 652	kfree(priv);
 653}
 654
 655static int genl_sk_privs_alloc(struct genl_family *family)
 656{
 657	if (!family->sock_priv_size)
 658		return 0;
 659
 660	family->sock_privs = kzalloc(sizeof(*family->sock_privs), GFP_KERNEL);
 661	if (!family->sock_privs)
 662		return -ENOMEM;
 663	xa_init(family->sock_privs);
 664	return 0;
 665}
 666
 667static void genl_sk_privs_free(const struct genl_family *family)
 668{
 669	unsigned long id;
 670	void *priv;
 671
 672	if (!family->sock_priv_size)
 673		return;
 674
 675	xa_for_each(family->sock_privs, id, priv)
 676		genl_sk_priv_free(family, priv);
 677
 678	xa_destroy(family->sock_privs);
 679	kfree(family->sock_privs);
 680}
 681
 682static void genl_sk_priv_free_by_sock(struct genl_family *family,
 683				      struct sock *sk)
 684{
 685	void *priv;
 686
 687	if (!family->sock_priv_size)
 688		return;
 689	priv = xa_erase(family->sock_privs, (unsigned long) sk);
 690	if (!priv)
 691		return;
 692	genl_sk_priv_free(family, priv);
 693}
 694
 695static void genl_release(struct sock *sk, unsigned long *groups)
 696{
 697	struct genl_family *family;
 698	unsigned int id;
 699
 700	down_read(&cb_lock);
 701
 702	idr_for_each_entry(&genl_fam_idr, family, id)
 703		genl_sk_priv_free_by_sock(family, sk);
 704
 705	up_read(&cb_lock);
 706}
 707
 708/**
 709 * __genl_sk_priv_get - Get family private pointer for socket, if exists
 710 *
 711 * @family: family
 712 * @sk: socket
 713 *
 714 * Lookup a private memory for a Generic netlink family and specified socket.
 715 *
 716 * Caller should make sure this is called in RCU read locked section.
 717 *
 718 * Return: valid pointer on success, otherwise negative error value
 719 * encoded by ERR_PTR(), NULL in case priv does not exist.
 720 */
 721void *__genl_sk_priv_get(struct genl_family *family, struct sock *sk)
 722{
 723	if (WARN_ON_ONCE(!family->sock_privs))
 724		return ERR_PTR(-EINVAL);
 725	return xa_load(family->sock_privs, (unsigned long) sk);
 726}
 727
 728/**
 729 * genl_sk_priv_get - Get family private pointer for socket
 730 *
 731 * @family: family
 732 * @sk: socket
 733 *
 734 * Lookup a private memory for a Generic netlink family and specified socket.
 735 * Allocate the private memory in case it was not already done.
 736 *
 737 * Return: valid pointer on success, otherwise negative error value
 738 * encoded by ERR_PTR().
 739 */
 740void *genl_sk_priv_get(struct genl_family *family, struct sock *sk)
 741{
 742	void *priv, *old_priv;
 743
 744	priv = __genl_sk_priv_get(family, sk);
 745	if (priv)
 746		return priv;
 747
 748	/* priv for the family does not exist so far, create it. */
 749
 750	priv = genl_sk_priv_alloc(family);
 751	if (IS_ERR(priv))
 752		return ERR_CAST(priv);
 753
 754	old_priv = xa_cmpxchg(family->sock_privs, (unsigned long) sk, NULL,
 755			      priv, GFP_KERNEL);
 756	if (old_priv) {
 757		genl_sk_priv_free(family, priv);
 758		if (xa_is_err(old_priv))
 759			return ERR_PTR(xa_err(old_priv));
 760		/* Race happened, priv for the socket was already inserted. */
 761		return old_priv;
 762	}
 763	return priv;
 764}
 765
 766/**
 767 * genl_register_family - register a generic netlink family
 768 * @family: generic netlink family
 769 *
 770 * Registers the specified family after validating it first. Only one
 771 * family may be registered with the same family name or identifier.
 772 *
 773 * The family's ops, multicast groups and module pointer must already
 774 * be assigned.
 775 *
 776 * Return 0 on success or a negative error code.
 777 */
 778int genl_register_family(struct genl_family *family)
 779{
 780	int err, i;
 781	int start = GENL_START_ALLOC, end = GENL_MAX_ID;
 782
 783	err = genl_validate_ops(family);
 784	if (err)
 785		return err;
 786
 787	genl_lock_all();
 788
 789	if (genl_family_find_byname(family->name)) {
 790		err = -EEXIST;
 791		goto errout_locked;
 792	}
 793
 794	err = genl_sk_privs_alloc(family);
 795	if (err)
 796		goto errout_locked;
 797
 798	/*
 799	 * Sadly, a few cases need to be special-cased
 800	 * due to them having previously abused the API
 801	 * and having used their family ID also as their
 802	 * multicast group ID, so we use reserved IDs
 803	 * for both to be sure we can do that mapping.
 804	 */
 805	if (family == &genl_ctrl) {
 806		/* and this needs to be special for initial family lookups */
 807		start = end = GENL_ID_CTRL;
 808	} else if (strcmp(family->name, "pmcraid") == 0) {
 809		start = end = GENL_ID_PMCRAID;
 810	} else if (strcmp(family->name, "VFS_DQUOT") == 0) {
 811		start = end = GENL_ID_VFS_DQUOT;
 812	}
 813
 814	family->id = idr_alloc_cyclic(&genl_fam_idr, family,
 815				      start, end + 1, GFP_KERNEL);
 816	if (family->id < 0) {
 817		err = family->id;
 818		goto errout_sk_privs_free;
 819	}
 820
 821	err = genl_validate_assign_mc_groups(family);
 822	if (err)
 823		goto errout_remove;
 824
 825	genl_unlock_all();
 826
 827	/* send all events */
 828	genl_ctrl_event(CTRL_CMD_NEWFAMILY, family, NULL, 0);
 829	for (i = 0; i < family->n_mcgrps; i++)
 830		genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, family,
 831				&family->mcgrps[i], family->mcgrp_offset + i);
 832
 833	return 0;
 834
 835errout_remove:
 836	idr_remove(&genl_fam_idr, family->id);
 837errout_sk_privs_free:
 838	genl_sk_privs_free(family);
 839errout_locked:
 840	genl_unlock_all();
 841	return err;
 842}
 843EXPORT_SYMBOL(genl_register_family);
 844
 845/**
 846 * genl_unregister_family - unregister generic netlink family
 847 * @family: generic netlink family
 848 *
 849 * Unregisters the specified family.
 850 *
 851 * Returns 0 on success or a negative error code.
 852 */
 853int genl_unregister_family(const struct genl_family *family)
 854{
 855	genl_lock_all();
 856
 857	if (!genl_family_find_byid(family->id)) {
 858		genl_unlock_all();
 859		return -ENOENT;
 860	}
 861
 862	genl_unregister_mc_groups(family);
 863
 864	idr_remove(&genl_fam_idr, family->id);
 865
 866	up_write(&cb_lock);
 867	wait_event(genl_sk_destructing_waitq,
 868		   atomic_read(&genl_sk_destructing_cnt) == 0);
 869
 870	genl_sk_privs_free(family);
 871
 872	genl_unlock();
 873
 874	genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
 875
 876	return 0;
 877}
 878EXPORT_SYMBOL(genl_unregister_family);
 879
 880/**
 881 * genlmsg_put - Add generic netlink header to netlink message
 882 * @skb: socket buffer holding the message
 883 * @portid: netlink portid the message is addressed to
 884 * @seq: sequence number (usually the one of the sender)
 885 * @family: generic netlink family
 886 * @flags: netlink message flags
 887 * @cmd: generic netlink command
 888 *
 889 * Returns pointer to user specific header
 890 */
 891void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
 892		  const struct genl_family *family, int flags, u8 cmd)
 893{
 894	struct nlmsghdr *nlh;
 895	struct genlmsghdr *hdr;
 896
 897	nlh = nlmsg_put(skb, portid, seq, family->id, GENL_HDRLEN +
 898			family->hdrsize, flags);
 899	if (nlh == NULL)
 900		return NULL;
 901
 902	hdr = nlmsg_data(nlh);
 903	hdr->cmd = cmd;
 904	hdr->version = family->version;
 905	hdr->reserved = 0;
 906
 907	return (char *) hdr + GENL_HDRLEN;
 908}
 909EXPORT_SYMBOL(genlmsg_put);
 910
 911static struct genl_dumpit_info *genl_dumpit_info_alloc(void)
 912{
 913	return kmalloc(sizeof(struct genl_dumpit_info), GFP_KERNEL);
 914}
 915
 916static void genl_dumpit_info_free(const struct genl_dumpit_info *info)
 917{
 918	kfree(info);
 919}
 920
 921static struct nlattr **
 922genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
 923				struct nlmsghdr *nlh,
 924				struct netlink_ext_ack *extack,
 925				const struct genl_split_ops *ops,
 926				int hdrlen,
 927				enum genl_validate_flags no_strict_flag)
 928{
 929	enum netlink_validation validate = ops->validate & no_strict_flag ?
 930					   NL_VALIDATE_LIBERAL :
 931					   NL_VALIDATE_STRICT;
 932	struct nlattr **attrbuf;
 933	int err;
 934
 935	if (!ops->maxattr)
 936		return NULL;
 937
 938	attrbuf = kmalloc_array(ops->maxattr + 1,
 939				sizeof(struct nlattr *), GFP_KERNEL);
 940	if (!attrbuf)
 941		return ERR_PTR(-ENOMEM);
 942
 943	err = __nlmsg_parse(nlh, hdrlen, attrbuf, ops->maxattr, ops->policy,
 944			    validate, extack);
 945	if (err) {
 946		kfree(attrbuf);
 947		return ERR_PTR(err);
 948	}
 949	return attrbuf;
 950}
 951
 952static void genl_family_rcv_msg_attrs_free(struct nlattr **attrbuf)
 953{
 954	kfree(attrbuf);
 955}
 956
 957struct genl_start_context {
 958	const struct genl_family *family;
 959	struct nlmsghdr *nlh;
 960	struct netlink_ext_ack *extack;
 961	const struct genl_split_ops *ops;
 962	int hdrlen;
 963};
 964
 965static int genl_start(struct netlink_callback *cb)
 966{
 967	struct genl_start_context *ctx = cb->data;
 968	const struct genl_split_ops *ops;
 969	struct genl_dumpit_info *info;
 970	struct nlattr **attrs = NULL;
 971	int rc = 0;
 972
 973	ops = ctx->ops;
 974	if (!(ops->validate & GENL_DONT_VALIDATE_DUMP) &&
 975	    ctx->nlh->nlmsg_len < nlmsg_msg_size(ctx->hdrlen))
 
 976		return -EINVAL;
 977
 978	attrs = genl_family_rcv_msg_attrs_parse(ctx->family, ctx->nlh, ctx->extack,
 979						ops, ctx->hdrlen,
 980						GENL_DONT_VALIDATE_DUMP_STRICT);
 981	if (IS_ERR(attrs))
 982		return PTR_ERR(attrs);
 983
 
 984	info = genl_dumpit_info_alloc();
 985	if (!info) {
 986		genl_family_rcv_msg_attrs_free(attrs);
 987		return -ENOMEM;
 988	}
 989	info->op = *ops;
 990	info->info.family	= ctx->family;
 991	info->info.snd_seq	= cb->nlh->nlmsg_seq;
 992	info->info.snd_portid	= NETLINK_CB(cb->skb).portid;
 993	info->info.nlhdr	= cb->nlh;
 994	info->info.genlhdr	= nlmsg_data(cb->nlh);
 995	info->info.attrs	= attrs;
 996	genl_info_net_set(&info->info, sock_net(cb->skb->sk));
 997	info->info.extack	= cb->extack;
 998	memset(&info->info.user_ptr, 0, sizeof(info->info.user_ptr));
 999
1000	cb->data = info;
1001	if (ops->start) {
1002		genl_op_lock(ctx->family);
 
1003		rc = ops->start(cb);
1004		genl_op_unlock(ctx->family);
 
1005	}
1006
1007	if (rc) {
1008		genl_family_rcv_msg_attrs_free(info->info.attrs);
1009		genl_dumpit_info_free(info);
1010		cb->data = NULL;
1011	}
1012	return rc;
1013}
1014
1015static int genl_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
1016{
1017	struct genl_dumpit_info *dump_info = cb->data;
1018	const struct genl_split_ops *ops = &dump_info->op;
1019	struct genl_info *info = &dump_info->info;
1020	int rc;
1021
1022	info->extack = cb->extack;
1023
1024	genl_op_lock(info->family);
1025	rc = ops->dumpit(skb, cb);
1026	genl_op_unlock(info->family);
1027	return rc;
1028}
1029
1030static int genl_done(struct netlink_callback *cb)
1031{
1032	struct genl_dumpit_info *dump_info = cb->data;
1033	const struct genl_split_ops *ops = &dump_info->op;
1034	struct genl_info *info = &dump_info->info;
1035	int rc = 0;
1036
1037	info->extack = cb->extack;
1038
1039	if (ops->done) {
1040		genl_op_lock(info->family);
1041		rc = ops->done(cb);
1042		genl_op_unlock(info->family);
1043	}
1044	genl_family_rcv_msg_attrs_free(info->attrs);
1045	genl_dumpit_info_free(dump_info);
 
 
 
 
 
 
 
 
 
 
 
 
 
1046	return rc;
1047}
1048
1049static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
1050				      struct sk_buff *skb,
1051				      struct nlmsghdr *nlh,
1052				      struct netlink_ext_ack *extack,
1053				      const struct genl_split_ops *ops,
1054				      int hdrlen, struct net *net)
1055{
1056	struct genl_start_context ctx;
1057	struct netlink_dump_control c = {
1058		.module = family->module,
1059		.data = &ctx,
1060		.start = genl_start,
1061		.dump = genl_dumpit,
1062		.done = genl_done,
1063		.extack = extack,
1064	};
1065	int err;
1066
 
 
 
1067	ctx.family = family;
1068	ctx.nlh = nlh;
1069	ctx.extack = extack;
1070	ctx.ops = ops;
1071	ctx.hdrlen = hdrlen;
1072
1073	genl_op_unlock(family);
1074	err = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
1075	genl_op_lock(family);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1076
1077	return err;
1078}
1079
1080static int genl_family_rcv_msg_doit(const struct genl_family *family,
1081				    struct sk_buff *skb,
1082				    struct nlmsghdr *nlh,
1083				    struct netlink_ext_ack *extack,
1084				    const struct genl_split_ops *ops,
1085				    int hdrlen, struct net *net)
1086{
1087	struct nlattr **attrbuf;
1088	struct genl_info info;
1089	int err;
1090
 
 
 
1091	attrbuf = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
1092						  ops, hdrlen,
1093						  GENL_DONT_VALIDATE_STRICT);
1094	if (IS_ERR(attrbuf))
1095		return PTR_ERR(attrbuf);
1096
1097	info.snd_seq = nlh->nlmsg_seq;
1098	info.snd_portid = NETLINK_CB(skb).portid;
1099	info.family = family;
1100	info.nlhdr = nlh;
1101	info.genlhdr = nlmsg_data(nlh);
 
1102	info.attrs = attrbuf;
1103	info.extack = extack;
1104	genl_info_net_set(&info, net);
1105	memset(&info.user_ptr, 0, sizeof(info.user_ptr));
1106
1107	if (ops->pre_doit) {
1108		err = ops->pre_doit(ops, skb, &info);
1109		if (err)
1110			goto out;
1111	}
1112
1113	err = ops->doit(skb, &info);
1114
1115	if (ops->post_doit)
1116		ops->post_doit(ops, skb, &info);
1117
1118out:
1119	genl_family_rcv_msg_attrs_free(attrbuf);
1120
1121	return err;
1122}
1123
1124static int genl_header_check(const struct genl_family *family,
1125			     struct nlmsghdr *nlh, struct genlmsghdr *hdr,
1126			     struct netlink_ext_ack *extack)
1127{
1128	u16 flags;
1129
1130	/* Only for commands added after we started validating */
1131	if (hdr->cmd < family->resv_start_op)
1132		return 0;
1133
1134	if (hdr->reserved) {
1135		NL_SET_ERR_MSG(extack, "genlmsghdr.reserved field is not 0");
1136		return -EINVAL;
1137	}
1138
1139	/* Old netlink flags have pretty loose semantics, allow only the flags
1140	 * consumed by the core where we can enforce the meaning.
1141	 */
1142	flags = nlh->nlmsg_flags;
1143	if ((flags & NLM_F_DUMP) == NLM_F_DUMP) /* DUMP is 2 bits */
1144		flags &= ~NLM_F_DUMP;
1145	if (flags & ~(NLM_F_REQUEST | NLM_F_ACK | NLM_F_ECHO)) {
1146		NL_SET_ERR_MSG(extack,
1147			       "ambiguous or reserved bits set in nlmsg_flags");
1148		return -EINVAL;
1149	}
1150
1151	return 0;
1152}
1153
1154static int genl_family_rcv_msg(const struct genl_family *family,
1155			       struct sk_buff *skb,
1156			       struct nlmsghdr *nlh,
1157			       struct netlink_ext_ack *extack)
1158{
 
1159	struct net *net = sock_net(skb->sk);
1160	struct genlmsghdr *hdr = nlmsg_data(nlh);
1161	struct genl_split_ops op;
1162	int hdrlen;
1163	u8 flags;
1164
1165	/* this family doesn't exist in this netns */
1166	if (!family->netnsok && !net_eq(net, &init_net))
1167		return -ENOENT;
1168
1169	hdrlen = GENL_HDRLEN + family->hdrsize;
1170	if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
1171		return -EINVAL;
1172
1173	if (genl_header_check(family, nlh, hdr, extack))
1174		return -EINVAL;
1175
1176	flags = (nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP ?
1177		GENL_CMD_CAP_DUMP : GENL_CMD_CAP_DO;
1178	if (genl_get_cmd(hdr->cmd, flags, family, &op))
1179		return -EOPNOTSUPP;
1180
1181	if ((op.flags & GENL_ADMIN_PERM) &&
1182	    !netlink_capable(skb, CAP_NET_ADMIN))
1183		return -EPERM;
1184
1185	if ((op.flags & GENL_UNS_ADMIN_PERM) &&
1186	    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
1187		return -EPERM;
1188
1189	if (flags & GENL_CMD_CAP_DUMP)
1190		return genl_family_rcv_msg_dumpit(family, skb, nlh, extack,
1191						  &op, hdrlen, net);
1192	else
1193		return genl_family_rcv_msg_doit(family, skb, nlh, extack,
1194						&op, hdrlen, net);
1195}
1196
1197static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
1198			struct netlink_ext_ack *extack)
1199{
1200	const struct genl_family *family;
1201	int err;
1202
1203	family = genl_family_find_byid(nlh->nlmsg_type);
1204	if (family == NULL)
1205		return -ENOENT;
1206
1207	genl_op_lock(family);
 
 
1208	err = genl_family_rcv_msg(family, skb, nlh, extack);
1209	genl_op_unlock(family);
 
 
1210
1211	return err;
1212}
1213
1214static void genl_rcv(struct sk_buff *skb)
1215{
1216	down_read(&cb_lock);
1217	netlink_rcv_skb(skb, &genl_rcv_msg);
1218	up_read(&cb_lock);
1219}
1220
1221/**************************************************************************
1222 * Controller
1223 **************************************************************************/
1224
1225static struct genl_family genl_ctrl;
1226
1227static int ctrl_fill_info(const struct genl_family *family, u32 portid, u32 seq,
1228			  u32 flags, struct sk_buff *skb, u8 cmd)
1229{
1230	struct genl_op_iter i;
1231	void *hdr;
1232
1233	hdr = genlmsg_put(skb, portid, seq, &genl_ctrl, flags, cmd);
1234	if (hdr == NULL)
1235		return -1;
1236
1237	if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
1238	    nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id) ||
1239	    nla_put_u32(skb, CTRL_ATTR_VERSION, family->version) ||
1240	    nla_put_u32(skb, CTRL_ATTR_HDRSIZE, family->hdrsize) ||
1241	    nla_put_u32(skb, CTRL_ATTR_MAXATTR, family->maxattr))
1242		goto nla_put_failure;
1243
1244	if (genl_op_iter_init(family, &i)) {
1245		struct nlattr *nla_ops;
 
1246
1247		nla_ops = nla_nest_start_noflag(skb, CTRL_ATTR_OPS);
1248		if (nla_ops == NULL)
1249			goto nla_put_failure;
1250
1251		while (genl_op_iter_next(&i)) {
1252			struct nlattr *nest;
1253			u32 op_flags;
 
1254
1255			op_flags = i.flags;
1256			if (i.doit.policy || i.dumpit.policy)
 
 
 
1257				op_flags |= GENL_CMD_CAP_HASPOL;
1258
1259			nest = nla_nest_start_noflag(skb, genl_op_iter_idx(&i));
1260			if (nest == NULL)
1261				goto nla_put_failure;
1262
1263			if (nla_put_u32(skb, CTRL_ATTR_OP_ID, i.cmd) ||
1264			    nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, op_flags))
1265				goto nla_put_failure;
1266
1267			nla_nest_end(skb, nest);
1268		}
1269
1270		nla_nest_end(skb, nla_ops);
1271	}
1272
1273	if (family->n_mcgrps) {
1274		struct nlattr *nla_grps;
1275		int i;
1276
1277		nla_grps = nla_nest_start_noflag(skb, CTRL_ATTR_MCAST_GROUPS);
1278		if (nla_grps == NULL)
1279			goto nla_put_failure;
1280
1281		for (i = 0; i < family->n_mcgrps; i++) {
1282			struct nlattr *nest;
1283			const struct genl_multicast_group *grp;
1284
1285			grp = &family->mcgrps[i];
1286
1287			nest = nla_nest_start_noflag(skb, i + 1);
1288			if (nest == NULL)
1289				goto nla_put_failure;
1290
1291			if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID,
1292					family->mcgrp_offset + i) ||
1293			    nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
1294					   grp->name))
1295				goto nla_put_failure;
1296
1297			nla_nest_end(skb, nest);
1298		}
1299		nla_nest_end(skb, nla_grps);
1300	}
1301
1302	genlmsg_end(skb, hdr);
1303	return 0;
1304
1305nla_put_failure:
1306	genlmsg_cancel(skb, hdr);
1307	return -EMSGSIZE;
1308}
1309
1310static int ctrl_fill_mcgrp_info(const struct genl_family *family,
1311				const struct genl_multicast_group *grp,
1312				int grp_id, u32 portid, u32 seq, u32 flags,
1313				struct sk_buff *skb, u8 cmd)
1314{
1315	void *hdr;
1316	struct nlattr *nla_grps;
1317	struct nlattr *nest;
1318
1319	hdr = genlmsg_put(skb, portid, seq, &genl_ctrl, flags, cmd);
1320	if (hdr == NULL)
1321		return -1;
1322
1323	if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
1324	    nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id))
1325		goto nla_put_failure;
1326
1327	nla_grps = nla_nest_start_noflag(skb, CTRL_ATTR_MCAST_GROUPS);
1328	if (nla_grps == NULL)
1329		goto nla_put_failure;
1330
1331	nest = nla_nest_start_noflag(skb, 1);
1332	if (nest == NULL)
1333		goto nla_put_failure;
1334
1335	if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp_id) ||
1336	    nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
1337			   grp->name))
1338		goto nla_put_failure;
1339
1340	nla_nest_end(skb, nest);
1341	nla_nest_end(skb, nla_grps);
1342
1343	genlmsg_end(skb, hdr);
1344	return 0;
1345
1346nla_put_failure:
1347	genlmsg_cancel(skb, hdr);
1348	return -EMSGSIZE;
1349}
1350
1351static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
1352{
1353	int n = 0;
1354	struct genl_family *rt;
1355	struct net *net = sock_net(skb->sk);
1356	int fams_to_skip = cb->args[0];
1357	unsigned int id;
1358
1359	idr_for_each_entry(&genl_fam_idr, rt, id) {
1360		if (!rt->netnsok && !net_eq(net, &init_net))
1361			continue;
1362
1363		if (n++ < fams_to_skip)
1364			continue;
1365
1366		if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).portid,
1367				   cb->nlh->nlmsg_seq, NLM_F_MULTI,
1368				   skb, CTRL_CMD_NEWFAMILY) < 0) {
1369			n--;
1370			break;
1371		}
1372	}
1373
1374	cb->args[0] = n;
1375	return skb->len;
1376}
1377
1378static struct sk_buff *ctrl_build_family_msg(const struct genl_family *family,
1379					     u32 portid, int seq, u8 cmd)
1380{
1381	struct sk_buff *skb;
1382	int err;
1383
1384	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1385	if (skb == NULL)
1386		return ERR_PTR(-ENOBUFS);
1387
1388	err = ctrl_fill_info(family, portid, seq, 0, skb, cmd);
1389	if (err < 0) {
1390		nlmsg_free(skb);
1391		return ERR_PTR(err);
1392	}
1393
1394	return skb;
1395}
1396
1397static struct sk_buff *
1398ctrl_build_mcgrp_msg(const struct genl_family *family,
1399		     const struct genl_multicast_group *grp,
1400		     int grp_id, u32 portid, int seq, u8 cmd)
1401{
1402	struct sk_buff *skb;
1403	int err;
1404
1405	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1406	if (skb == NULL)
1407		return ERR_PTR(-ENOBUFS);
1408
1409	err = ctrl_fill_mcgrp_info(family, grp, grp_id, portid,
1410				   seq, 0, skb, cmd);
1411	if (err < 0) {
1412		nlmsg_free(skb);
1413		return ERR_PTR(err);
1414	}
1415
1416	return skb;
1417}
1418
1419static const struct nla_policy ctrl_policy_family[] = {
1420	[CTRL_ATTR_FAMILY_ID]	= { .type = NLA_U16 },
1421	[CTRL_ATTR_FAMILY_NAME]	= { .type = NLA_NUL_STRING,
1422				    .len = GENL_NAMSIZ - 1 },
1423};
1424
1425static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
1426{
1427	struct sk_buff *msg;
1428	const struct genl_family *res = NULL;
1429	int err = -EINVAL;
1430
1431	if (info->attrs[CTRL_ATTR_FAMILY_ID]) {
1432		u16 id = nla_get_u16(info->attrs[CTRL_ATTR_FAMILY_ID]);
1433		res = genl_family_find_byid(id);
1434		err = -ENOENT;
1435	}
1436
1437	if (info->attrs[CTRL_ATTR_FAMILY_NAME]) {
1438		char *name;
1439
1440		name = nla_data(info->attrs[CTRL_ATTR_FAMILY_NAME]);
1441		res = genl_family_find_byname(name);
1442#ifdef CONFIG_MODULES
1443		if (res == NULL) {
1444			genl_unlock();
1445			up_read(&cb_lock);
1446			request_module("net-pf-%d-proto-%d-family-%s",
1447				       PF_NETLINK, NETLINK_GENERIC, name);
1448			down_read(&cb_lock);
1449			genl_lock();
1450			res = genl_family_find_byname(name);
1451		}
1452#endif
1453		err = -ENOENT;
1454	}
1455
1456	if (res == NULL)
1457		return err;
1458
1459	if (!res->netnsok && !net_eq(genl_info_net(info), &init_net)) {
1460		/* family doesn't exist here */
1461		return -ENOENT;
1462	}
1463
1464	msg = ctrl_build_family_msg(res, info->snd_portid, info->snd_seq,
1465				    CTRL_CMD_NEWFAMILY);
1466	if (IS_ERR(msg))
1467		return PTR_ERR(msg);
1468
1469	return genlmsg_reply(msg, info);
1470}
1471
1472static int genl_ctrl_event(int event, const struct genl_family *family,
1473			   const struct genl_multicast_group *grp,
1474			   int grp_id)
1475{
1476	struct sk_buff *msg;
1477
1478	/* genl is still initialising */
1479	if (!init_net.genl_sock)
1480		return 0;
1481
1482	switch (event) {
1483	case CTRL_CMD_NEWFAMILY:
1484	case CTRL_CMD_DELFAMILY:
1485		WARN_ON(grp);
1486		msg = ctrl_build_family_msg(family, 0, 0, event);
1487		break;
1488	case CTRL_CMD_NEWMCAST_GRP:
1489	case CTRL_CMD_DELMCAST_GRP:
1490		BUG_ON(!grp);
1491		msg = ctrl_build_mcgrp_msg(family, grp, grp_id, 0, 0, event);
1492		break;
1493	default:
1494		return -EINVAL;
1495	}
1496
1497	if (IS_ERR(msg))
1498		return PTR_ERR(msg);
1499
1500	if (!family->netnsok) {
1501		genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
1502					0, GFP_KERNEL);
1503	} else {
1504		rcu_read_lock();
1505		genlmsg_multicast_allns(&genl_ctrl, msg, 0,
1506					0, GFP_ATOMIC);
1507		rcu_read_unlock();
1508	}
1509
1510	return 0;
1511}
1512
1513struct ctrl_dump_policy_ctx {
1514	struct netlink_policy_dump_state *state;
1515	const struct genl_family *rt;
1516	struct genl_op_iter *op_iter;
1517	u32 op;
1518	u16 fam_id;
1519	u8 dump_map:1,
1520	   single_op:1;
1521};
1522
1523static const struct nla_policy ctrl_policy_policy[] = {
1524	[CTRL_ATTR_FAMILY_ID]	= { .type = NLA_U16 },
1525	[CTRL_ATTR_FAMILY_NAME]	= { .type = NLA_NUL_STRING,
1526				    .len = GENL_NAMSIZ - 1 },
1527	[CTRL_ATTR_OP]		= { .type = NLA_U32 },
1528};
1529
1530static int ctrl_dumppolicy_start(struct netlink_callback *cb)
1531{
1532	const struct genl_dumpit_info *info = genl_dumpit_info(cb);
1533	struct ctrl_dump_policy_ctx *ctx = (void *)cb->ctx;
1534	struct nlattr **tb = info->info.attrs;
1535	const struct genl_family *rt;
1536	struct genl_op_iter i;
1537	int err;
1538
1539	BUILD_BUG_ON(sizeof(*ctx) > sizeof(cb->ctx));
1540
1541	if (!tb[CTRL_ATTR_FAMILY_ID] && !tb[CTRL_ATTR_FAMILY_NAME])
1542		return -EINVAL;
1543
1544	if (tb[CTRL_ATTR_FAMILY_ID]) {
1545		ctx->fam_id = nla_get_u16(tb[CTRL_ATTR_FAMILY_ID]);
1546	} else {
1547		rt = genl_family_find_byname(
1548			nla_data(tb[CTRL_ATTR_FAMILY_NAME]));
1549		if (!rt)
1550			return -ENOENT;
1551		ctx->fam_id = rt->id;
1552	}
1553
1554	rt = genl_family_find_byid(ctx->fam_id);
1555	if (!rt)
1556		return -ENOENT;
1557
1558	ctx->rt = rt;
1559
1560	if (tb[CTRL_ATTR_OP]) {
1561		struct genl_split_ops doit, dump;
1562
1563		ctx->single_op = true;
1564		ctx->op = nla_get_u32(tb[CTRL_ATTR_OP]);
1565
1566		err = genl_get_cmd_both(ctx->op, rt, &doit, &dump);
1567		if (err) {
1568			NL_SET_BAD_ATTR(cb->extack, tb[CTRL_ATTR_OP]);
 
1569			return err;
1570		}
1571
1572		if (doit.policy) {
1573			err = netlink_policy_dump_add_policy(&ctx->state,
1574							     doit.policy,
1575							     doit.maxattr);
1576			if (err)
1577				goto err_free_state;
1578		}
1579		if (dump.policy) {
1580			err = netlink_policy_dump_add_policy(&ctx->state,
1581							     dump.policy,
1582							     dump.maxattr);
1583			if (err)
1584				goto err_free_state;
1585		}
1586
1587		if (!ctx->state)
1588			return -ENODATA;
1589
1590		ctx->dump_map = 1;
1591		return 0;
1592	}
1593
1594	ctx->op_iter = kmalloc(sizeof(*ctx->op_iter), GFP_KERNEL);
1595	if (!ctx->op_iter)
1596		return -ENOMEM;
1597
1598	genl_op_iter_init(rt, ctx->op_iter);
1599	ctx->dump_map = genl_op_iter_next(ctx->op_iter);
1600
1601	for (genl_op_iter_init(rt, &i); genl_op_iter_next(&i); ) {
1602		if (i.doit.policy) {
1603			err = netlink_policy_dump_add_policy(&ctx->state,
1604							     i.doit.policy,
1605							     i.doit.maxattr);
1606			if (err)
1607				goto err_free_state;
1608		}
1609		if (i.dumpit.policy) {
1610			err = netlink_policy_dump_add_policy(&ctx->state,
1611							     i.dumpit.policy,
1612							     i.dumpit.maxattr);
1613			if (err)
1614				goto err_free_state;
1615		}
1616	}
1617
1618	if (!ctx->state) {
1619		err = -ENODATA;
1620		goto err_free_op_iter;
1621	}
1622	return 0;
1623
1624err_free_state:
1625	netlink_policy_dump_free(ctx->state);
1626err_free_op_iter:
1627	kfree(ctx->op_iter);
1628	return err;
1629}
1630
1631static void *ctrl_dumppolicy_prep(struct sk_buff *skb,
1632				  struct netlink_callback *cb)
1633{
1634	struct ctrl_dump_policy_ctx *ctx = (void *)cb->ctx;
1635	void *hdr;
1636
1637	hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
1638			  cb->nlh->nlmsg_seq, &genl_ctrl,
1639			  NLM_F_MULTI, CTRL_CMD_GETPOLICY);
1640	if (!hdr)
1641		return NULL;
1642
1643	if (nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, ctx->fam_id))
1644		return NULL;
1645
1646	return hdr;
1647}
1648
1649static int ctrl_dumppolicy_put_op(struct sk_buff *skb,
1650				  struct netlink_callback *cb,
1651				  struct genl_split_ops *doit,
1652				  struct genl_split_ops *dumpit)
1653{
1654	struct ctrl_dump_policy_ctx *ctx = (void *)cb->ctx;
1655	struct nlattr *nest_pol, *nest_op;
1656	void *hdr;
1657	int idx;
1658
1659	/* skip if we have nothing to show */
1660	if (!doit->policy && !dumpit->policy)
1661		return 0;
1662
1663	hdr = ctrl_dumppolicy_prep(skb, cb);
1664	if (!hdr)
1665		return -ENOBUFS;
1666
1667	nest_pol = nla_nest_start(skb, CTRL_ATTR_OP_POLICY);
1668	if (!nest_pol)
1669		goto err;
1670
1671	nest_op = nla_nest_start(skb, doit->cmd);
1672	if (!nest_op)
1673		goto err;
1674
1675	if (doit->policy) {
1676		idx = netlink_policy_dump_get_policy_idx(ctx->state,
1677							 doit->policy,
1678							 doit->maxattr);
1679
1680		if (nla_put_u32(skb, CTRL_ATTR_POLICY_DO, idx))
1681			goto err;
1682	}
1683	if (dumpit->policy) {
1684		idx = netlink_policy_dump_get_policy_idx(ctx->state,
1685							 dumpit->policy,
1686							 dumpit->maxattr);
1687
1688		if (nla_put_u32(skb, CTRL_ATTR_POLICY_DUMP, idx))
1689			goto err;
1690	}
1691
1692	nla_nest_end(skb, nest_op);
1693	nla_nest_end(skb, nest_pol);
1694	genlmsg_end(skb, hdr);
1695
1696	return 0;
1697err:
1698	genlmsg_cancel(skb, hdr);
1699	return -ENOBUFS;
1700}
1701
1702static int ctrl_dumppolicy(struct sk_buff *skb, struct netlink_callback *cb)
1703{
1704	struct ctrl_dump_policy_ctx *ctx = (void *)cb->ctx;
1705	void *hdr;
1706
1707	if (ctx->dump_map) {
1708		if (ctx->single_op) {
1709			struct genl_split_ops doit, dumpit;
1710
1711			if (WARN_ON(genl_get_cmd_both(ctx->op, ctx->rt,
1712						      &doit, &dumpit)))
1713				return -ENOENT;
1714
1715			if (ctrl_dumppolicy_put_op(skb, cb, &doit, &dumpit))
1716				return skb->len;
1717
1718			/* done with the per-op policy index list */
1719			ctx->dump_map = 0;
1720		}
1721
1722		while (ctx->dump_map) {
1723			if (ctrl_dumppolicy_put_op(skb, cb,
1724						   &ctx->op_iter->doit,
1725						   &ctx->op_iter->dumpit))
1726				return skb->len;
1727
1728			ctx->dump_map = genl_op_iter_next(ctx->op_iter);
1729		}
1730	}
1731
1732	while (netlink_policy_dump_loop(ctx->state)) {
 
1733		struct nlattr *nest;
1734
1735		hdr = ctrl_dumppolicy_prep(skb, cb);
 
 
1736		if (!hdr)
1737			goto nla_put_failure;
1738
 
 
 
1739		nest = nla_nest_start(skb, CTRL_ATTR_POLICY);
1740		if (!nest)
1741			goto nla_put_failure;
1742
1743		if (netlink_policy_dump_write(skb, ctx->state))
1744			goto nla_put_failure;
1745
1746		nla_nest_end(skb, nest);
1747
1748		genlmsg_end(skb, hdr);
1749	}
1750
1751	return skb->len;
1752
1753nla_put_failure:
1754	genlmsg_cancel(skb, hdr);
 
 
 
 
1755	return skb->len;
1756}
1757
1758static int ctrl_dumppolicy_done(struct netlink_callback *cb)
1759{
1760	struct ctrl_dump_policy_ctx *ctx = (void *)cb->ctx;
1761
1762	kfree(ctx->op_iter);
1763	netlink_policy_dump_free(ctx->state);
1764	return 0;
1765}
1766
1767static const struct genl_split_ops genl_ctrl_ops[] = {
1768	{
1769		.cmd		= CTRL_CMD_GETFAMILY,
1770		.validate	= GENL_DONT_VALIDATE_STRICT,
1771		.policy		= ctrl_policy_family,
1772		.maxattr	= ARRAY_SIZE(ctrl_policy_family) - 1,
1773		.doit		= ctrl_getfamily,
1774		.flags		= GENL_CMD_CAP_DO,
1775	},
1776	{
1777		.cmd		= CTRL_CMD_GETFAMILY,
1778		.validate	= GENL_DONT_VALIDATE_DUMP,
1779		.policy		= ctrl_policy_family,
1780		.maxattr	= ARRAY_SIZE(ctrl_policy_family) - 1,
1781		.dumpit		= ctrl_dumpfamily,
1782		.flags		= GENL_CMD_CAP_DUMP,
1783	},
1784	{
1785		.cmd		= CTRL_CMD_GETPOLICY,
1786		.policy		= ctrl_policy_policy,
1787		.maxattr	= ARRAY_SIZE(ctrl_policy_policy) - 1,
1788		.start		= ctrl_dumppolicy_start,
1789		.dumpit		= ctrl_dumppolicy,
1790		.done		= ctrl_dumppolicy_done,
1791		.flags		= GENL_CMD_CAP_DUMP,
1792	},
1793};
1794
1795static const struct genl_multicast_group genl_ctrl_groups[] = {
1796	{ .name = "notify", },
1797};
1798
1799static struct genl_family genl_ctrl __ro_after_init = {
1800	.module = THIS_MODULE,
1801	.split_ops = genl_ctrl_ops,
1802	.n_split_ops = ARRAY_SIZE(genl_ctrl_ops),
1803	.resv_start_op = CTRL_CMD_GETPOLICY + 1,
1804	.mcgrps = genl_ctrl_groups,
1805	.n_mcgrps = ARRAY_SIZE(genl_ctrl_groups),
1806	.id = GENL_ID_CTRL,
1807	.name = "nlctrl",
1808	.version = 0x2,
 
 
1809	.netnsok = true,
1810};
1811
1812static int genl_bind(struct net *net, int group)
1813{
1814	const struct genl_family *family;
1815	unsigned int id;
1816	int ret = 0;
1817
1818	down_read(&cb_lock);
1819
1820	idr_for_each_entry(&genl_fam_idr, family, id) {
1821		const struct genl_multicast_group *grp;
1822		int i;
1823
1824		if (family->n_mcgrps == 0)
1825			continue;
1826
1827		i = group - family->mcgrp_offset;
1828		if (i < 0 || i >= family->n_mcgrps)
1829			continue;
1830
1831		grp = &family->mcgrps[i];
1832		if ((grp->flags & GENL_MCAST_CAP_NET_ADMIN) &&
1833		    !ns_capable(net->user_ns, CAP_NET_ADMIN))
1834			ret = -EPERM;
1835		if ((grp->flags & GENL_MCAST_CAP_SYS_ADMIN) &&
1836		    !ns_capable(net->user_ns, CAP_SYS_ADMIN))
1837			ret = -EPERM;
1838
1839		break;
1840	}
1841
1842	up_read(&cb_lock);
1843	return ret;
1844}
1845
1846static int __net_init genl_pernet_init(struct net *net)
1847{
1848	struct netlink_kernel_cfg cfg = {
1849		.input		= genl_rcv,
1850		.flags		= NL_CFG_F_NONROOT_RECV,
1851		.bind		= genl_bind,
1852		.release	= genl_release,
1853	};
1854
1855	/* we'll bump the group number right afterwards */
1856	net->genl_sock = netlink_kernel_create(net, NETLINK_GENERIC, &cfg);
1857
1858	if (!net->genl_sock && net_eq(net, &init_net))
1859		panic("GENL: Cannot initialize generic netlink\n");
1860
1861	if (!net->genl_sock)
1862		return -ENOMEM;
1863
1864	return 0;
1865}
1866
1867static void __net_exit genl_pernet_exit(struct net *net)
1868{
1869	netlink_kernel_release(net->genl_sock);
1870	net->genl_sock = NULL;
1871}
1872
1873static struct pernet_operations genl_pernet_ops = {
1874	.init = genl_pernet_init,
1875	.exit = genl_pernet_exit,
1876};
1877
1878static int __init genl_init(void)
1879{
1880	int err;
1881
1882	err = genl_register_family(&genl_ctrl);
1883	if (err < 0)
1884		goto problem;
1885
1886	err = register_pernet_subsys(&genl_pernet_ops);
1887	if (err)
1888		goto problem;
1889
1890	return 0;
1891
1892problem:
1893	panic("GENL: Cannot register controller: %d\n", err);
1894}
1895
1896core_initcall(genl_init);
1897
1898static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
1899			 gfp_t flags)
1900{
1901	struct sk_buff *tmp;
1902	struct net *net, *prev = NULL;
1903	bool delivered = false;
1904	int err;
1905
1906	for_each_net_rcu(net) {
1907		if (prev) {
1908			tmp = skb_clone(skb, flags);
1909			if (!tmp) {
1910				err = -ENOMEM;
1911				goto error;
1912			}
1913			err = nlmsg_multicast(prev->genl_sock, tmp,
1914					      portid, group, flags);
1915			if (!err)
1916				delivered = true;
1917			else if (err != -ESRCH)
1918				goto error;
1919		}
1920
1921		prev = net;
1922	}
1923
1924	err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
1925	if (!err)
1926		delivered = true;
1927	else if (err != -ESRCH)
1928		return err;
1929	return delivered ? 0 : -ESRCH;
1930 error:
1931	kfree_skb(skb);
1932	return err;
1933}
1934
1935int genlmsg_multicast_allns(const struct genl_family *family,
1936			    struct sk_buff *skb, u32 portid,
1937			    unsigned int group, gfp_t flags)
1938{
1939	if (WARN_ON_ONCE(group >= family->n_mcgrps))
1940		return -EINVAL;
1941
1942	group = family->mcgrp_offset + group;
1943	return genlmsg_mcast(skb, portid, group, flags);
1944}
1945EXPORT_SYMBOL(genlmsg_multicast_allns);
1946
1947void genl_notify(const struct genl_family *family, struct sk_buff *skb,
1948		 struct genl_info *info, u32 group, gfp_t flags)
1949{
1950	struct net *net = genl_info_net(info);
1951	struct sock *sk = net->genl_sock;
 
 
 
 
1952
1953	if (WARN_ON_ONCE(group >= family->n_mcgrps))
1954		return;
1955
1956	group = family->mcgrp_offset + group;
1957	nlmsg_notify(sk, skb, info->snd_portid, group,
1958		     nlmsg_report(info->nlhdr), flags);
1959}
1960EXPORT_SYMBOL(genl_notify);