commit 237f3cf13b20db183d3706d997eedc3c49eacd44 upstream. syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08 </TASK> Allocated by task 7549: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888028c6cde0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes to the right of allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2) The buggy address belongs to the physical page: page:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001 raw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2175 allocate_slab mm/slub.c:2338 [inline] new_slab+0x84/0x2f0 mm/slub.c:2391 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc_node+0x2db/0x4e0 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] __vmalloc_area_node mm/vmalloc.c:3197 [inline] __vmalloc_node_range+0x5f9/0x14a0 mm/vmalloc.c:3392 __vmalloc_node mm/vmalloc.c:3457 [inline] vzalloc+0x79/0x90 mm/vmalloc.c:3530 bpf_check+0x260/0x19010 kernel/bpf/verifier.c:21162 bpf_prog_load+0x1667/0x20f0 kernel/bpf/syscall.c:2895 __sys_bpf+0x4ee/0x810 kernel/bpf/syscall.c:5631 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 page last free pid 6650 tgid 6647 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346 free_unref_page_list+0x5a3/0x850 mm/page_alloc.c:2532 release_pages+0x2117/0x2400 mm/swap.c:1042 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x34d/0x4e0 mm/mmu_gather.c:300 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:392 exit_mmap+0x4b6/0xd40 mm/mmap.c:3300 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:569 do_exit+0x99e/0x27e0 kernel/exit.c:865 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 get_signal+0x176e/0x1850 kernel/signal.c:2907 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline] syscall_exit_to_user_mode+0xc9/0x360 kernel/entry/common.c:212 do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Memory state around the buggy address: ffff888028c6cc80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888028c6cd00: fa fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc >ffff888028c6cd80: fa fc fc fc fa fc fc fc fa fc fc fc 02 fc fc fc ^ ffff888028c6ce00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc ffff888028c6ce80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc Fixes: 423f38329d26 ("xsk: add umem fill queue support and mmap") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: "Björn Töpel" <bjorn@kernel.org> Cc: Magnus Karlsson <magnus.karlsson@intel.com> Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Cc: Jonathan Lemon <jonathan.lemon@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20240404202738.3634547-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [shung-hsi.yu: two additional changes not present in the original 1. Check optlen in the XDP_UMEM_REG case as well. It was added in commit c05cd36458147 ("xsk: add support to allow unaligned chunk placement") but seems like too big of a change for stable 2. copy_from_sockptr() in the context was replace copy_from_usr() because commit a7b75c5a8c414 ("net: pass a sockptr_t into ->setsockopt") was not present] Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
793 lines
16 KiB
C
793 lines
16 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* XDP sockets
|
|
*
|
|
* AF_XDP sockets allows a channel between XDP programs and userspace
|
|
* applications.
|
|
* Copyright(c) 2018 Intel Corporation.
|
|
*
|
|
* Author(s): Björn Töpel <bjorn.topel@intel.com>
|
|
* Magnus Karlsson <magnus.karlsson@intel.com>
|
|
*/
|
|
|
|
#define pr_fmt(fmt) "AF_XDP: %s: " fmt, __func__
|
|
|
|
#include <linux/if_xdp.h>
|
|
#include <linux/init.h>
|
|
#include <linux/sched/mm.h>
|
|
#include <linux/sched/signal.h>
|
|
#include <linux/sched/task.h>
|
|
#include <linux/socket.h>
|
|
#include <linux/file.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/net.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/rculist.h>
|
|
#include <net/xdp_sock.h>
|
|
#include <net/xdp.h>
|
|
|
|
#include "xsk_queue.h"
|
|
#include "xdp_umem.h"
|
|
|
|
#define TX_BATCH_SIZE 16
|
|
|
|
static struct xdp_sock *xdp_sk(struct sock *sk)
|
|
{
|
|
return (struct xdp_sock *)sk;
|
|
}
|
|
|
|
bool xsk_is_setup_for_bpf_map(struct xdp_sock *xs)
|
|
{
|
|
return READ_ONCE(xs->rx) && READ_ONCE(xs->umem) &&
|
|
READ_ONCE(xs->umem->fq);
|
|
}
|
|
|
|
u64 *xsk_umem_peek_addr(struct xdp_umem *umem, u64 *addr)
|
|
{
|
|
return xskq_peek_addr(umem->fq, addr);
|
|
}
|
|
EXPORT_SYMBOL(xsk_umem_peek_addr);
|
|
|
|
void xsk_umem_discard_addr(struct xdp_umem *umem)
|
|
{
|
|
xskq_discard_addr(umem->fq);
|
|
}
|
|
EXPORT_SYMBOL(xsk_umem_discard_addr);
|
|
|
|
static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
|
|
{
|
|
void *buffer;
|
|
u64 addr;
|
|
int err;
|
|
|
|
if (!xskq_peek_addr(xs->umem->fq, &addr) ||
|
|
len > xs->umem->chunk_size_nohr) {
|
|
xs->rx_dropped++;
|
|
return -ENOSPC;
|
|
}
|
|
|
|
addr += xs->umem->headroom;
|
|
|
|
buffer = xdp_umem_get_data(xs->umem, addr);
|
|
memcpy(buffer, xdp->data, len);
|
|
err = xskq_produce_batch_desc(xs->rx, addr, len);
|
|
if (!err) {
|
|
xskq_discard_addr(xs->umem->fq);
|
|
xdp_return_buff(xdp);
|
|
return 0;
|
|
}
|
|
|
|
xs->rx_dropped++;
|
|
return err;
|
|
}
|
|
|
|
static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
|
|
{
|
|
int err = xskq_produce_batch_desc(xs->rx, (u64)xdp->handle, len);
|
|
|
|
if (err)
|
|
xs->rx_dropped++;
|
|
|
|
return err;
|
|
}
|
|
|
|
int xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp)
|
|
{
|
|
u32 len;
|
|
|
|
if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
|
|
return -EINVAL;
|
|
|
|
len = xdp->data_end - xdp->data;
|
|
|
|
return (xdp->rxq->mem.type == MEM_TYPE_ZERO_COPY) ?
|
|
__xsk_rcv_zc(xs, xdp, len) : __xsk_rcv(xs, xdp, len);
|
|
}
|
|
|
|
void xsk_flush(struct xdp_sock *xs)
|
|
{
|
|
xskq_produce_flush_desc(xs->rx);
|
|
xs->sk.sk_data_ready(&xs->sk);
|
|
}
|
|
|
|
int xsk_generic_rcv(struct xdp_sock *xs, struct xdp_buff *xdp)
|
|
{
|
|
u32 len = xdp->data_end - xdp->data;
|
|
void *buffer;
|
|
u64 addr;
|
|
int err;
|
|
|
|
if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
|
|
return -EINVAL;
|
|
|
|
if (!xskq_peek_addr(xs->umem->fq, &addr) ||
|
|
len > xs->umem->chunk_size_nohr) {
|
|
xs->rx_dropped++;
|
|
return -ENOSPC;
|
|
}
|
|
|
|
addr += xs->umem->headroom;
|
|
|
|
buffer = xdp_umem_get_data(xs->umem, addr);
|
|
memcpy(buffer, xdp->data, len);
|
|
err = xskq_produce_batch_desc(xs->rx, addr, len);
|
|
if (!err) {
|
|
xskq_discard_addr(xs->umem->fq);
|
|
xsk_flush(xs);
|
|
return 0;
|
|
}
|
|
|
|
xs->rx_dropped++;
|
|
return err;
|
|
}
|
|
|
|
void xsk_umem_complete_tx(struct xdp_umem *umem, u32 nb_entries)
|
|
{
|
|
xskq_produce_flush_addr_n(umem->cq, nb_entries);
|
|
}
|
|
EXPORT_SYMBOL(xsk_umem_complete_tx);
|
|
|
|
void xsk_umem_consume_tx_done(struct xdp_umem *umem)
|
|
{
|
|
struct xdp_sock *xs;
|
|
|
|
rcu_read_lock();
|
|
list_for_each_entry_rcu(xs, &umem->xsk_list, list) {
|
|
xs->sk.sk_write_space(&xs->sk);
|
|
}
|
|
rcu_read_unlock();
|
|
}
|
|
EXPORT_SYMBOL(xsk_umem_consume_tx_done);
|
|
|
|
bool xsk_umem_consume_tx(struct xdp_umem *umem, dma_addr_t *dma, u32 *len)
|
|
{
|
|
struct xdp_desc desc;
|
|
struct xdp_sock *xs;
|
|
|
|
rcu_read_lock();
|
|
list_for_each_entry_rcu(xs, &umem->xsk_list, list) {
|
|
if (!xskq_peek_desc(xs->tx, &desc))
|
|
continue;
|
|
|
|
if (xskq_produce_addr_lazy(umem->cq, desc.addr))
|
|
goto out;
|
|
|
|
*dma = xdp_umem_get_dma(umem, desc.addr);
|
|
*len = desc.len;
|
|
|
|
xskq_discard_desc(xs->tx);
|
|
rcu_read_unlock();
|
|
return true;
|
|
}
|
|
|
|
out:
|
|
rcu_read_unlock();
|
|
return false;
|
|
}
|
|
EXPORT_SYMBOL(xsk_umem_consume_tx);
|
|
|
|
static int xsk_zc_xmit(struct sock *sk)
|
|
{
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
struct net_device *dev = xs->dev;
|
|
|
|
return dev->netdev_ops->ndo_xsk_async_xmit(dev, xs->queue_id);
|
|
}
|
|
|
|
static void xsk_destruct_skb(struct sk_buff *skb)
|
|
{
|
|
u64 addr = (u64)(long)skb_shinfo(skb)->destructor_arg;
|
|
struct xdp_sock *xs = xdp_sk(skb->sk);
|
|
unsigned long flags;
|
|
|
|
spin_lock_irqsave(&xs->tx_completion_lock, flags);
|
|
WARN_ON_ONCE(xskq_produce_addr(xs->umem->cq, addr));
|
|
spin_unlock_irqrestore(&xs->tx_completion_lock, flags);
|
|
|
|
sock_wfree(skb);
|
|
}
|
|
|
|
static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
|
|
size_t total_len)
|
|
{
|
|
u32 max_batch = TX_BATCH_SIZE;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
bool sent_frame = false;
|
|
struct xdp_desc desc;
|
|
struct sk_buff *skb;
|
|
int err = 0;
|
|
|
|
mutex_lock(&xs->mutex);
|
|
|
|
if (xs->queue_id >= xs->dev->real_num_tx_queues)
|
|
goto out;
|
|
|
|
while (xskq_peek_desc(xs->tx, &desc)) {
|
|
char *buffer;
|
|
u64 addr;
|
|
u32 len;
|
|
|
|
if (max_batch-- == 0) {
|
|
err = -EAGAIN;
|
|
goto out;
|
|
}
|
|
|
|
len = desc.len;
|
|
skb = sock_alloc_send_skb(sk, len, 1, &err);
|
|
if (unlikely(!skb))
|
|
goto out;
|
|
|
|
skb_put(skb, len);
|
|
addr = desc.addr;
|
|
buffer = xdp_umem_get_data(xs->umem, addr);
|
|
err = skb_store_bits(skb, 0, buffer, len);
|
|
if (unlikely(err) || xskq_reserve_addr(xs->umem->cq)) {
|
|
kfree_skb(skb);
|
|
goto out;
|
|
}
|
|
|
|
skb->dev = xs->dev;
|
|
skb->priority = sk->sk_priority;
|
|
skb->mark = sk->sk_mark;
|
|
skb_shinfo(skb)->destructor_arg = (void *)(long)addr;
|
|
skb->destructor = xsk_destruct_skb;
|
|
|
|
err = dev_direct_xmit(skb, xs->queue_id);
|
|
xskq_discard_desc(xs->tx);
|
|
/* Ignore NET_XMIT_CN as packet might have been sent */
|
|
if (err == NET_XMIT_DROP || err == NETDEV_TX_BUSY) {
|
|
/* SKB completed but not sent */
|
|
err = -EBUSY;
|
|
goto out;
|
|
}
|
|
|
|
sent_frame = true;
|
|
}
|
|
|
|
out:
|
|
if (sent_frame)
|
|
sk->sk_write_space(sk);
|
|
|
|
mutex_unlock(&xs->mutex);
|
|
return err;
|
|
}
|
|
|
|
static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
|
|
{
|
|
bool need_wait = !(m->msg_flags & MSG_DONTWAIT);
|
|
struct sock *sk = sock->sk;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
|
|
if (unlikely(!xs->dev))
|
|
return -ENXIO;
|
|
if (unlikely(!(xs->dev->flags & IFF_UP)))
|
|
return -ENETDOWN;
|
|
if (unlikely(!xs->tx))
|
|
return -ENOBUFS;
|
|
if (need_wait)
|
|
return -EOPNOTSUPP;
|
|
|
|
return (xs->zc) ? xsk_zc_xmit(sk) : xsk_generic_xmit(sk, m, total_len);
|
|
}
|
|
|
|
static __poll_t xsk_poll(struct file *file, struct socket *sock,
|
|
struct poll_table_struct *wait)
|
|
{
|
|
__poll_t mask = datagram_poll(file, sock, wait);
|
|
struct sock *sk = sock->sk;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
|
|
if (xs->rx && !xskq_empty_desc(xs->rx))
|
|
mask |= EPOLLIN | EPOLLRDNORM;
|
|
if (xs->tx && !xskq_full_desc(xs->tx))
|
|
mask |= EPOLLOUT | EPOLLWRNORM;
|
|
|
|
return mask;
|
|
}
|
|
|
|
static int xsk_init_queue(u32 entries, struct xsk_queue **queue,
|
|
bool umem_queue)
|
|
{
|
|
struct xsk_queue *q;
|
|
|
|
if (entries == 0 || *queue || !is_power_of_2(entries))
|
|
return -EINVAL;
|
|
|
|
q = xskq_create(entries, umem_queue);
|
|
if (!q)
|
|
return -ENOMEM;
|
|
|
|
/* Make sure queue is ready before it can be seen by others */
|
|
smp_wmb();
|
|
WRITE_ONCE(*queue, q);
|
|
return 0;
|
|
}
|
|
|
|
static int xsk_release(struct socket *sock)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
struct net *net;
|
|
|
|
if (!sk)
|
|
return 0;
|
|
|
|
net = sock_net(sk);
|
|
|
|
local_bh_disable();
|
|
sock_prot_inuse_add(net, sk->sk_prot, -1);
|
|
local_bh_enable();
|
|
|
|
if (xs->dev) {
|
|
struct net_device *dev = xs->dev;
|
|
|
|
/* Wait for driver to stop using the xdp socket. */
|
|
xdp_del_sk_umem(xs->umem, xs);
|
|
xs->dev = NULL;
|
|
synchronize_net();
|
|
dev_put(dev);
|
|
}
|
|
|
|
xskq_destroy(xs->rx);
|
|
xskq_destroy(xs->tx);
|
|
|
|
sock_orphan(sk);
|
|
sock->sk = NULL;
|
|
|
|
sk_refcnt_debug_release(sk);
|
|
sock_put(sk);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct socket *xsk_lookup_xsk_from_fd(int fd)
|
|
{
|
|
struct socket *sock;
|
|
int err;
|
|
|
|
sock = sockfd_lookup(fd, &err);
|
|
if (!sock)
|
|
return ERR_PTR(-ENOTSOCK);
|
|
|
|
if (sock->sk->sk_family != PF_XDP) {
|
|
sockfd_put(sock);
|
|
return ERR_PTR(-ENOPROTOOPT);
|
|
}
|
|
|
|
return sock;
|
|
}
|
|
|
|
static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
|
|
{
|
|
struct sockaddr_xdp *sxdp = (struct sockaddr_xdp *)addr;
|
|
struct sock *sk = sock->sk;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
struct net_device *dev;
|
|
u32 flags, qid;
|
|
int err = 0;
|
|
|
|
if (addr_len < sizeof(struct sockaddr_xdp))
|
|
return -EINVAL;
|
|
if (sxdp->sxdp_family != AF_XDP)
|
|
return -EINVAL;
|
|
|
|
mutex_lock(&xs->mutex);
|
|
if (xs->dev) {
|
|
err = -EBUSY;
|
|
goto out_release;
|
|
}
|
|
|
|
dev = dev_get_by_index(sock_net(sk), sxdp->sxdp_ifindex);
|
|
if (!dev) {
|
|
err = -ENODEV;
|
|
goto out_release;
|
|
}
|
|
|
|
if (!xs->rx && !xs->tx) {
|
|
err = -EINVAL;
|
|
goto out_unlock;
|
|
}
|
|
|
|
qid = sxdp->sxdp_queue_id;
|
|
|
|
if ((xs->rx && qid >= dev->real_num_rx_queues) ||
|
|
(xs->tx && qid >= dev->real_num_tx_queues)) {
|
|
err = -EINVAL;
|
|
goto out_unlock;
|
|
}
|
|
|
|
flags = sxdp->sxdp_flags;
|
|
|
|
if (flags & XDP_SHARED_UMEM) {
|
|
struct xdp_sock *umem_xs;
|
|
struct socket *sock;
|
|
|
|
if ((flags & XDP_COPY) || (flags & XDP_ZEROCOPY)) {
|
|
/* Cannot specify flags for shared sockets. */
|
|
err = -EINVAL;
|
|
goto out_unlock;
|
|
}
|
|
|
|
if (xs->umem) {
|
|
/* We have already our own. */
|
|
err = -EINVAL;
|
|
goto out_unlock;
|
|
}
|
|
|
|
sock = xsk_lookup_xsk_from_fd(sxdp->sxdp_shared_umem_fd);
|
|
if (IS_ERR(sock)) {
|
|
err = PTR_ERR(sock);
|
|
goto out_unlock;
|
|
}
|
|
|
|
umem_xs = xdp_sk(sock->sk);
|
|
if (!umem_xs->umem) {
|
|
/* No umem to inherit. */
|
|
err = -EBADF;
|
|
sockfd_put(sock);
|
|
goto out_unlock;
|
|
} else if (umem_xs->dev != dev || umem_xs->queue_id != qid) {
|
|
err = -EINVAL;
|
|
sockfd_put(sock);
|
|
goto out_unlock;
|
|
}
|
|
|
|
xdp_get_umem(umem_xs->umem);
|
|
WRITE_ONCE(xs->umem, umem_xs->umem);
|
|
sockfd_put(sock);
|
|
} else if (!xs->umem || !xdp_umem_validate_queues(xs->umem)) {
|
|
err = -EINVAL;
|
|
goto out_unlock;
|
|
} else {
|
|
/* This xsk has its own umem. */
|
|
xskq_set_umem(xs->umem->fq, &xs->umem->props);
|
|
xskq_set_umem(xs->umem->cq, &xs->umem->props);
|
|
|
|
err = xdp_umem_assign_dev(xs->umem, dev, qid, flags);
|
|
if (err)
|
|
goto out_unlock;
|
|
}
|
|
|
|
xs->dev = dev;
|
|
xs->zc = xs->umem->zc;
|
|
xs->queue_id = qid;
|
|
xskq_set_umem(xs->rx, &xs->umem->props);
|
|
xskq_set_umem(xs->tx, &xs->umem->props);
|
|
xdp_add_sk_umem(xs->umem, xs);
|
|
|
|
out_unlock:
|
|
if (err)
|
|
dev_put(dev);
|
|
out_release:
|
|
mutex_unlock(&xs->mutex);
|
|
return err;
|
|
}
|
|
|
|
static int xsk_setsockopt(struct socket *sock, int level, int optname,
|
|
char __user *optval, unsigned int optlen)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
int err;
|
|
|
|
if (level != SOL_XDP)
|
|
return -ENOPROTOOPT;
|
|
|
|
switch (optname) {
|
|
case XDP_RX_RING:
|
|
case XDP_TX_RING:
|
|
{
|
|
struct xsk_queue **q;
|
|
int entries;
|
|
|
|
if (optlen < sizeof(entries))
|
|
return -EINVAL;
|
|
if (copy_from_user(&entries, optval, sizeof(entries)))
|
|
return -EFAULT;
|
|
|
|
mutex_lock(&xs->mutex);
|
|
q = (optname == XDP_TX_RING) ? &xs->tx : &xs->rx;
|
|
err = xsk_init_queue(entries, q, false);
|
|
mutex_unlock(&xs->mutex);
|
|
return err;
|
|
}
|
|
case XDP_UMEM_REG:
|
|
{
|
|
struct xdp_umem_reg mr;
|
|
struct xdp_umem *umem;
|
|
|
|
if (optlen < sizeof(mr))
|
|
return -EINVAL;
|
|
if (copy_from_user(&mr, optval, sizeof(mr)))
|
|
return -EFAULT;
|
|
|
|
mutex_lock(&xs->mutex);
|
|
if (xs->umem) {
|
|
mutex_unlock(&xs->mutex);
|
|
return -EBUSY;
|
|
}
|
|
|
|
umem = xdp_umem_create(&mr);
|
|
if (IS_ERR(umem)) {
|
|
mutex_unlock(&xs->mutex);
|
|
return PTR_ERR(umem);
|
|
}
|
|
|
|
/* Make sure umem is ready before it can be seen by others */
|
|
smp_wmb();
|
|
WRITE_ONCE(xs->umem, umem);
|
|
mutex_unlock(&xs->mutex);
|
|
return 0;
|
|
}
|
|
case XDP_UMEM_FILL_RING:
|
|
case XDP_UMEM_COMPLETION_RING:
|
|
{
|
|
struct xsk_queue **q;
|
|
int entries;
|
|
|
|
if (optlen < sizeof(entries))
|
|
return -EINVAL;
|
|
if (copy_from_user(&entries, optval, sizeof(entries)))
|
|
return -EFAULT;
|
|
|
|
mutex_lock(&xs->mutex);
|
|
if (!xs->umem) {
|
|
mutex_unlock(&xs->mutex);
|
|
return -EINVAL;
|
|
}
|
|
|
|
q = (optname == XDP_UMEM_FILL_RING) ? &xs->umem->fq :
|
|
&xs->umem->cq;
|
|
err = xsk_init_queue(entries, q, true);
|
|
mutex_unlock(&xs->mutex);
|
|
return err;
|
|
}
|
|
default:
|
|
break;
|
|
}
|
|
|
|
return -ENOPROTOOPT;
|
|
}
|
|
|
|
static int xsk_getsockopt(struct socket *sock, int level, int optname,
|
|
char __user *optval, int __user *optlen)
|
|
{
|
|
struct sock *sk = sock->sk;
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
int len;
|
|
|
|
if (level != SOL_XDP)
|
|
return -ENOPROTOOPT;
|
|
|
|
if (get_user(len, optlen))
|
|
return -EFAULT;
|
|
if (len < 0)
|
|
return -EINVAL;
|
|
|
|
switch (optname) {
|
|
case XDP_STATISTICS:
|
|
{
|
|
struct xdp_statistics stats;
|
|
|
|
if (len < sizeof(stats))
|
|
return -EINVAL;
|
|
|
|
mutex_lock(&xs->mutex);
|
|
stats.rx_dropped = xs->rx_dropped;
|
|
stats.rx_invalid_descs = xskq_nb_invalid_descs(xs->rx);
|
|
stats.tx_invalid_descs = xskq_nb_invalid_descs(xs->tx);
|
|
mutex_unlock(&xs->mutex);
|
|
|
|
if (copy_to_user(optval, &stats, sizeof(stats)))
|
|
return -EFAULT;
|
|
if (put_user(sizeof(stats), optlen))
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
}
|
|
case XDP_MMAP_OFFSETS:
|
|
{
|
|
struct xdp_mmap_offsets off;
|
|
|
|
if (len < sizeof(off))
|
|
return -EINVAL;
|
|
|
|
off.rx.producer = offsetof(struct xdp_rxtx_ring, ptrs.producer);
|
|
off.rx.consumer = offsetof(struct xdp_rxtx_ring, ptrs.consumer);
|
|
off.rx.desc = offsetof(struct xdp_rxtx_ring, desc);
|
|
off.tx.producer = offsetof(struct xdp_rxtx_ring, ptrs.producer);
|
|
off.tx.consumer = offsetof(struct xdp_rxtx_ring, ptrs.consumer);
|
|
off.tx.desc = offsetof(struct xdp_rxtx_ring, desc);
|
|
|
|
off.fr.producer = offsetof(struct xdp_umem_ring, ptrs.producer);
|
|
off.fr.consumer = offsetof(struct xdp_umem_ring, ptrs.consumer);
|
|
off.fr.desc = offsetof(struct xdp_umem_ring, desc);
|
|
off.cr.producer = offsetof(struct xdp_umem_ring, ptrs.producer);
|
|
off.cr.consumer = offsetof(struct xdp_umem_ring, ptrs.consumer);
|
|
off.cr.desc = offsetof(struct xdp_umem_ring, desc);
|
|
|
|
len = sizeof(off);
|
|
if (copy_to_user(optval, &off, len))
|
|
return -EFAULT;
|
|
if (put_user(len, optlen))
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
}
|
|
default:
|
|
break;
|
|
}
|
|
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static int xsk_mmap(struct file *file, struct socket *sock,
|
|
struct vm_area_struct *vma)
|
|
{
|
|
loff_t offset = (loff_t)vma->vm_pgoff << PAGE_SHIFT;
|
|
unsigned long size = vma->vm_end - vma->vm_start;
|
|
struct xdp_sock *xs = xdp_sk(sock->sk);
|
|
struct xsk_queue *q = NULL;
|
|
struct xdp_umem *umem;
|
|
unsigned long pfn;
|
|
struct page *qpg;
|
|
|
|
if (offset == XDP_PGOFF_RX_RING) {
|
|
q = READ_ONCE(xs->rx);
|
|
} else if (offset == XDP_PGOFF_TX_RING) {
|
|
q = READ_ONCE(xs->tx);
|
|
} else {
|
|
umem = READ_ONCE(xs->umem);
|
|
if (!umem)
|
|
return -EINVAL;
|
|
|
|
/* Matches the smp_wmb() in XDP_UMEM_REG */
|
|
smp_rmb();
|
|
if (offset == XDP_UMEM_PGOFF_FILL_RING)
|
|
q = READ_ONCE(umem->fq);
|
|
else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
|
|
q = READ_ONCE(umem->cq);
|
|
}
|
|
|
|
if (!q)
|
|
return -EINVAL;
|
|
|
|
/* Matches the smp_wmb() in xsk_init_queue */
|
|
smp_rmb();
|
|
qpg = virt_to_head_page(q->ring);
|
|
if (size > (PAGE_SIZE << compound_order(qpg)))
|
|
return -EINVAL;
|
|
|
|
pfn = virt_to_phys(q->ring) >> PAGE_SHIFT;
|
|
return remap_pfn_range(vma, vma->vm_start, pfn,
|
|
size, vma->vm_page_prot);
|
|
}
|
|
|
|
static struct proto xsk_proto = {
|
|
.name = "XDP",
|
|
.owner = THIS_MODULE,
|
|
.obj_size = sizeof(struct xdp_sock),
|
|
};
|
|
|
|
static const struct proto_ops xsk_proto_ops = {
|
|
.family = PF_XDP,
|
|
.owner = THIS_MODULE,
|
|
.release = xsk_release,
|
|
.bind = xsk_bind,
|
|
.connect = sock_no_connect,
|
|
.socketpair = sock_no_socketpair,
|
|
.accept = sock_no_accept,
|
|
.getname = sock_no_getname,
|
|
.poll = xsk_poll,
|
|
.ioctl = sock_no_ioctl,
|
|
.listen = sock_no_listen,
|
|
.shutdown = sock_no_shutdown,
|
|
.setsockopt = xsk_setsockopt,
|
|
.getsockopt = xsk_getsockopt,
|
|
.sendmsg = xsk_sendmsg,
|
|
.recvmsg = sock_no_recvmsg,
|
|
.mmap = xsk_mmap,
|
|
.sendpage = sock_no_sendpage,
|
|
};
|
|
|
|
static void xsk_destruct(struct sock *sk)
|
|
{
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
|
|
if (!sock_flag(sk, SOCK_DEAD))
|
|
return;
|
|
|
|
xdp_put_umem(xs->umem);
|
|
|
|
sk_refcnt_debug_dec(sk);
|
|
}
|
|
|
|
static int xsk_create(struct net *net, struct socket *sock, int protocol,
|
|
int kern)
|
|
{
|
|
struct sock *sk;
|
|
struct xdp_sock *xs;
|
|
|
|
if (!ns_capable(net->user_ns, CAP_NET_RAW))
|
|
return -EPERM;
|
|
if (sock->type != SOCK_RAW)
|
|
return -ESOCKTNOSUPPORT;
|
|
|
|
if (protocol)
|
|
return -EPROTONOSUPPORT;
|
|
|
|
sock->state = SS_UNCONNECTED;
|
|
|
|
sk = sk_alloc(net, PF_XDP, GFP_KERNEL, &xsk_proto, kern);
|
|
if (!sk)
|
|
return -ENOBUFS;
|
|
|
|
sock->ops = &xsk_proto_ops;
|
|
|
|
sock_init_data(sock, sk);
|
|
|
|
sk->sk_family = PF_XDP;
|
|
|
|
sk->sk_destruct = xsk_destruct;
|
|
sk_refcnt_debug_inc(sk);
|
|
|
|
sock_set_flag(sk, SOCK_RCU_FREE);
|
|
|
|
xs = xdp_sk(sk);
|
|
mutex_init(&xs->mutex);
|
|
spin_lock_init(&xs->tx_completion_lock);
|
|
|
|
local_bh_disable();
|
|
sock_prot_inuse_add(net, &xsk_proto, 1);
|
|
local_bh_enable();
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct net_proto_family xsk_family_ops = {
|
|
.family = PF_XDP,
|
|
.create = xsk_create,
|
|
.owner = THIS_MODULE,
|
|
};
|
|
|
|
static int __init xsk_init(void)
|
|
{
|
|
int err;
|
|
|
|
err = proto_register(&xsk_proto, 0 /* no slab */);
|
|
if (err)
|
|
goto out;
|
|
|
|
err = sock_register(&xsk_family_ops);
|
|
if (err)
|
|
goto out_proto;
|
|
|
|
return 0;
|
|
|
|
out_proto:
|
|
proto_unregister(&xsk_proto);
|
|
out:
|
|
return err;
|
|
}
|
|
|
|
fs_initcall(xsk_init);
|