rxrpc: Fix a null ptr deref in rxrpc_fill_out_ack()
[linux-2.6-block.git] / net / rxrpc / output.c
CommitLineData
17926a79
DH
1/* RxRPC packet transmission
2 *
3 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
9b6d5398
JP
12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
17926a79 14#include <linux/net.h>
5a0e3ad6 15#include <linux/gfp.h>
17926a79 16#include <linux/skbuff.h>
bc3b2d7f 17#include <linux/export.h>
17926a79
DH
18#include <net/sock.h>
19#include <net/af_rxrpc.h>
20#include "ar-internal.h"
21
26cb02aa 22struct rxrpc_ack_buffer {
8d94aa38 23 struct rxrpc_wire_header whdr;
26cb02aa
DH
24 struct rxrpc_ackpacket ack;
25 u8 acks[255];
26 u8 pad[3];
8d94aa38
DH
27 struct rxrpc_ackinfo ackinfo;
28};
29
26cb02aa
DH
30struct rxrpc_abort_buffer {
31 struct rxrpc_wire_header whdr;
32 __be32 abort_code;
33};
34
8d94aa38
DH
35/*
36 * Fill out an ACK packet.
37 */
1457cc4c
DH
38static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
39 struct rxrpc_call *call,
26cb02aa 40 struct rxrpc_ack_buffer *pkt,
805b21b9 41 rxrpc_seq_t *_hard_ack,
a5af7e1f
DH
42 rxrpc_seq_t *_top,
43 u8 reason)
8d94aa38 44{
f3639df2 45 rxrpc_serial_t serial;
248f219c
DH
46 rxrpc_seq_t hard_ack, top, seq;
47 int ix;
8d94aa38
DH
48 u32 mtu, jmax;
49 u8 *ackp = pkt->acks;
50
248f219c 51 /* Barrier against rxrpc_input_data(). */
f3639df2 52 serial = call->ackr_serial;
248f219c
DH
53 hard_ack = READ_ONCE(call->rx_hard_ack);
54 top = smp_load_acquire(&call->rx_top);
805b21b9
DH
55 *_hard_ack = hard_ack;
56 *_top = top;
248f219c 57
8d94aa38 58 pkt->ack.bufferSpace = htons(8);
248f219c
DH
59 pkt->ack.maxSkew = htons(call->ackr_skew);
60 pkt->ack.firstPacket = htonl(hard_ack + 1);
8d94aa38 61 pkt->ack.previousPacket = htonl(call->ackr_prev_seq);
f3639df2 62 pkt->ack.serial = htonl(serial);
a5af7e1f 63 pkt->ack.reason = reason;
248f219c
DH
64 pkt->ack.nAcks = top - hard_ack;
65
a5af7e1f 66 if (reason == RXRPC_ACK_PING)
8e83134d
DH
67 pkt->whdr.flags |= RXRPC_REQUEST_ACK;
68
248f219c
DH
69 if (after(top, hard_ack)) {
70 seq = hard_ack + 1;
71 do {
72 ix = seq & RXRPC_RXTX_BUFF_MASK;
73 if (call->rxtx_buffer[ix])
74 *ackp++ = RXRPC_ACK_TYPE_ACK;
75 else
76 *ackp++ = RXRPC_ACK_TYPE_NACK;
77 seq++;
78 } while (before_eq(seq, top));
79 }
8d94aa38 80
1457cc4c
DH
81 mtu = conn->params.peer->if_mtu;
82 mtu -= conn->params.peer->hdrsize;
75e42126 83 jmax = (call->nr_jumbo_bad > 3) ? 1 : rxrpc_rx_jumbo_max;
8d94aa38
DH
84 pkt->ackinfo.rxMTU = htonl(rxrpc_rx_mtu);
85 pkt->ackinfo.maxMTU = htonl(mtu);
75e42126 86 pkt->ackinfo.rwind = htonl(call->rx_winsize);
8d94aa38
DH
87 pkt->ackinfo.jumbo_max = htonl(jmax);
88
89 *ackp++ = 0;
90 *ackp++ = 0;
91 *ackp++ = 0;
248f219c 92 return top - hard_ack + 3;
8d94aa38
DH
93}
94
95/*
26cb02aa 96 * Send an ACK call packet.
8d94aa38 97 */
a5af7e1f 98int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping)
8d94aa38
DH
99{
100 struct rxrpc_connection *conn = NULL;
26cb02aa 101 struct rxrpc_ack_buffer *pkt;
8d94aa38
DH
102 struct msghdr msg;
103 struct kvec iov[2];
104 rxrpc_serial_t serial;
805b21b9 105 rxrpc_seq_t hard_ack, top;
8d94aa38 106 size_t len, n;
26cb02aa 107 int ret;
a5af7e1f 108 u8 reason;
8d94aa38
DH
109
110 spin_lock_bh(&call->lock);
111 if (call->conn)
112 conn = rxrpc_get_connection_maybe(call->conn);
113 spin_unlock_bh(&call->lock);
114 if (!conn)
115 return -ECONNRESET;
116
117 pkt = kzalloc(sizeof(*pkt), GFP_KERNEL);
118 if (!pkt) {
119 rxrpc_put_connection(conn);
120 return -ENOMEM;
121 }
122
8d94aa38
DH
123 msg.msg_name = &call->peer->srx.transport;
124 msg.msg_namelen = call->peer->srx.transport_len;
125 msg.msg_control = NULL;
126 msg.msg_controllen = 0;
127 msg.msg_flags = 0;
128
129 pkt->whdr.epoch = htonl(conn->proto.epoch);
130 pkt->whdr.cid = htonl(call->cid);
131 pkt->whdr.callNumber = htonl(call->call_id);
132 pkt->whdr.seq = 0;
26cb02aa
DH
133 pkt->whdr.type = RXRPC_PACKET_TYPE_ACK;
134 pkt->whdr.flags = RXRPC_SLOW_START_OK | conn->out_clientflag;
8d94aa38
DH
135 pkt->whdr.userStatus = 0;
136 pkt->whdr.securityIndex = call->security_ix;
137 pkt->whdr._rsvd = 0;
138 pkt->whdr.serviceId = htons(call->service_id);
139
26cb02aa 140 spin_lock_bh(&call->lock);
a5af7e1f
DH
141 if (ping) {
142 reason = RXRPC_ACK_PING;
143 } else {
144 reason = call->ackr_reason;
145 if (!call->ackr_reason) {
146 spin_unlock_bh(&call->lock);
147 ret = 0;
148 goto out;
149 }
150 call->ackr_reason = 0;
8d94aa38 151 }
1457cc4c 152 n = rxrpc_fill_out_ack(conn, call, pkt, &hard_ack, &top, reason);
26cb02aa
DH
153
154 spin_unlock_bh(&call->lock);
155
156 iov[0].iov_base = pkt;
157 iov[0].iov_len = sizeof(pkt->whdr) + sizeof(pkt->ack) + n;
158 iov[1].iov_base = &pkt->ackinfo;
159 iov[1].iov_len = sizeof(pkt->ackinfo);
160 len = iov[0].iov_len + iov[1].iov_len;
8d94aa38 161
b86e218e
DH
162 serial = atomic_inc_return(&conn->serial);
163 pkt->whdr.serial = htonl(serial);
26cb02aa
DH
164 trace_rxrpc_tx_ack(call, serial,
165 ntohl(pkt->ack.firstPacket),
166 ntohl(pkt->ack.serial),
167 pkt->ack.reason, pkt->ack.nAcks);
b86e218e 168
8e83134d 169 if (ping) {
a5af7e1f 170 call->ping_serial = serial;
8e83134d
DH
171 smp_wmb();
172 /* We need to stick a time in before we send the packet in case
173 * the reply gets back before kernel_sendmsg() completes - but
174 * asking UDP to send the packet can take a relatively long
175 * time, so we update the time after, on the assumption that
176 * the packet transmission is more likely to happen towards the
177 * end of the kernel_sendmsg() call.
178 */
a5af7e1f 179 call->ping_time = ktime_get_real();
8e83134d
DH
180 set_bit(RXRPC_CALL_PINGING, &call->flags);
181 trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_ping, serial);
182 }
26cb02aa
DH
183
184 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
8e83134d 185 if (ping)
a5af7e1f 186 call->ping_time = ktime_get_real();
8d94aa38 187
26cb02aa 188 if (call->state < RXRPC_CALL_COMPLETE) {
805b21b9 189 if (ret < 0) {
a5af7e1f
DH
190 if (ping)
191 clear_bit(RXRPC_CALL_PINGING, &call->flags);
248f219c
DH
192 rxrpc_propose_ACK(call, pkt->ack.reason,
193 ntohs(pkt->ack.maxSkew),
194 ntohl(pkt->ack.serial),
9c7ad434
DH
195 true, true,
196 rxrpc_propose_ack_retry_tx);
805b21b9
DH
197 } else {
198 spin_lock_bh(&call->lock);
199 if (after(hard_ack, call->ackr_consumed))
200 call->ackr_consumed = hard_ack;
201 if (after(top, call->ackr_seen))
202 call->ackr_seen = top;
203 spin_unlock_bh(&call->lock);
248f219c
DH
204 }
205 }
206
8d94aa38
DH
207out:
208 rxrpc_put_connection(conn);
209 kfree(pkt);
210 return ret;
211}
212
26cb02aa
DH
213/*
214 * Send an ABORT call packet.
215 */
216int rxrpc_send_abort_packet(struct rxrpc_call *call)
217{
218 struct rxrpc_connection *conn = NULL;
219 struct rxrpc_abort_buffer pkt;
220 struct msghdr msg;
221 struct kvec iov[1];
222 rxrpc_serial_t serial;
223 int ret;
224
225 spin_lock_bh(&call->lock);
226 if (call->conn)
227 conn = rxrpc_get_connection_maybe(call->conn);
228 spin_unlock_bh(&call->lock);
229 if (!conn)
230 return -ECONNRESET;
231
232 msg.msg_name = &call->peer->srx.transport;
233 msg.msg_namelen = call->peer->srx.transport_len;
234 msg.msg_control = NULL;
235 msg.msg_controllen = 0;
236 msg.msg_flags = 0;
237
238 pkt.whdr.epoch = htonl(conn->proto.epoch);
239 pkt.whdr.cid = htonl(call->cid);
240 pkt.whdr.callNumber = htonl(call->call_id);
241 pkt.whdr.seq = 0;
242 pkt.whdr.type = RXRPC_PACKET_TYPE_ABORT;
243 pkt.whdr.flags = conn->out_clientflag;
244 pkt.whdr.userStatus = 0;
245 pkt.whdr.securityIndex = call->security_ix;
246 pkt.whdr._rsvd = 0;
247 pkt.whdr.serviceId = htons(call->service_id);
248 pkt.abort_code = htonl(call->abort_code);
249
250 iov[0].iov_base = &pkt;
251 iov[0].iov_len = sizeof(pkt);
252
253 serial = atomic_inc_return(&conn->serial);
254 pkt.whdr.serial = htonl(serial);
255
256 ret = kernel_sendmsg(conn->params.local->socket,
257 &msg, iov, 1, sizeof(pkt));
258
259 rxrpc_put_connection(conn);
260 return ret;
261}
262
17926a79
DH
263/*
264 * send a packet through the transport endpoint
265 */
a1767077
DH
266int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
267 bool retrans)
17926a79 268{
5a924b89
DH
269 struct rxrpc_connection *conn = call->conn;
270 struct rxrpc_wire_header whdr;
271 struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
17926a79 272 struct msghdr msg;
5a924b89
DH
273 struct kvec iov[2];
274 rxrpc_serial_t serial;
275 size_t len;
a1767077 276 bool lost = false;
17926a79
DH
277 int ret, opt;
278
279 _enter(",{%d}", skb->len);
280
5a924b89
DH
281 /* Each transmission of a Tx packet needs a new serial number */
282 serial = atomic_inc_return(&conn->serial);
17926a79 283
5a924b89
DH
284 whdr.epoch = htonl(conn->proto.epoch);
285 whdr.cid = htonl(call->cid);
286 whdr.callNumber = htonl(call->call_id);
287 whdr.seq = htonl(sp->hdr.seq);
288 whdr.serial = htonl(serial);
289 whdr.type = RXRPC_PACKET_TYPE_DATA;
290 whdr.flags = sp->hdr.flags;
291 whdr.userStatus = 0;
292 whdr.securityIndex = call->security_ix;
293 whdr._rsvd = htons(sp->hdr._rsvd);
294 whdr.serviceId = htons(call->service_id);
295
4e255721
DH
296 if (test_bit(RXRPC_CONN_PROBING_FOR_UPGRADE, &conn->flags) &&
297 sp->hdr.seq == 1)
298 whdr.userStatus = RXRPC_USERSTATUS_SERVICE_UPGRADE;
299
5a924b89
DH
300 iov[0].iov_base = &whdr;
301 iov[0].iov_len = sizeof(whdr);
302 iov[1].iov_base = skb->head;
303 iov[1].iov_len = skb->len;
304 len = iov[0].iov_len + iov[1].iov_len;
305
306 msg.msg_name = &call->peer->srx.transport;
307 msg.msg_namelen = call->peer->srx.transport_len;
17926a79
DH
308 msg.msg_control = NULL;
309 msg.msg_controllen = 0;
310 msg.msg_flags = 0;
311
57494343
DH
312 /* If our RTT cache needs working on, request an ACK. Also request
313 * ACKs if a DATA packet appears to have been lost.
314 */
bf7d620a
DH
315 if (!(sp->hdr.flags & RXRPC_LAST_PACKET) &&
316 (retrans ||
317 call->cong_mode == RXRPC_CALL_SLOW_START ||
318 (call->peer->rtt_usage < 3 && sp->hdr.seq & 1) ||
319 ktime_before(ktime_add_ms(call->peer->rtt_last_req, 1000),
320 ktime_get_real())))
0d4b103c
DH
321 whdr.flags |= RXRPC_REQUEST_ACK;
322
8a681c36
DH
323 if (IS_ENABLED(CONFIG_AF_RXRPC_INJECT_LOSS)) {
324 static int lose;
325 if ((lose++ & 7) == 7) {
a1767077
DH
326 ret = 0;
327 lost = true;
328 goto done;
8a681c36
DH
329 }
330 }
331
5a924b89
DH
332 _proto("Tx DATA %%%u { #%u }", serial, sp->hdr.seq);
333
17926a79
DH
334 /* send the packet with the don't fragment bit set if we currently
335 * think it's small enough */
5a924b89
DH
336 if (iov[1].iov_len >= call->peer->maxdata)
337 goto send_fragmentable;
338
339 down_read(&conn->params.local->defrag_sem);
340 /* send the packet by UDP
341 * - returns -EMSGSIZE if UDP would have to fragment the packet
342 * to go out of the interface
343 * - in which case, we'll have processed the ICMP error
344 * message and update the peer record
345 */
346 ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
347
348 up_read(&conn->params.local->defrag_sem);
349 if (ret == -EMSGSIZE)
350 goto send_fragmentable;
351
352done:
a1767077
DH
353 trace_rxrpc_tx_data(call, sp->hdr.seq, serial, whdr.flags,
354 retrans, lost);
50235c4b 355 if (ret >= 0) {
0d4b103c
DH
356 ktime_t now = ktime_get_real();
357 skb->tstamp = now;
50235c4b 358 smp_wmb();
5a924b89 359 sp->hdr.serial = serial;
0d4b103c
DH
360 if (whdr.flags & RXRPC_REQUEST_ACK) {
361 call->peer->rtt_last_req = now;
50235c4b 362 trace_rxrpc_rtt_tx(call, rxrpc_rtt_tx_data, serial);
0d4b103c 363 }
17926a79 364 }
5a924b89
DH
365 _leave(" = %d [%u]", ret, call->peer->maxdata);
366 return ret;
17926a79
DH
367
368send_fragmentable:
369 /* attempt to send this message with fragmentation enabled */
370 _debug("send fragment");
371
985a5c82
DH
372 down_write(&conn->params.local->defrag_sem);
373
374 switch (conn->params.local->srx.transport.family) {
375 case AF_INET:
376 opt = IP_PMTUDISC_DONT;
377 ret = kernel_setsockopt(conn->params.local->socket,
378 SOL_IP, IP_MTU_DISCOVER,
379 (char *)&opt, sizeof(opt));
380 if (ret == 0) {
5a924b89
DH
381 ret = kernel_sendmsg(conn->params.local->socket, &msg,
382 iov, 2, len);
985a5c82
DH
383
384 opt = IP_PMTUDISC_DO;
385 kernel_setsockopt(conn->params.local->socket, SOL_IP,
386 IP_MTU_DISCOVER,
387 (char *)&opt, sizeof(opt));
388 }
389 break;
75b54cb5 390
d1912747 391#ifdef CONFIG_AF_RXRPC_IPV6
75b54cb5
DH
392 case AF_INET6:
393 opt = IPV6_PMTUDISC_DONT;
394 ret = kernel_setsockopt(conn->params.local->socket,
395 SOL_IPV6, IPV6_MTU_DISCOVER,
396 (char *)&opt, sizeof(opt));
397 if (ret == 0) {
398 ret = kernel_sendmsg(conn->params.local->socket, &msg,
399 iov, 1, iov[0].iov_len);
400
401 opt = IPV6_PMTUDISC_DO;
402 kernel_setsockopt(conn->params.local->socket,
403 SOL_IPV6, IPV6_MTU_DISCOVER,
404 (char *)&opt, sizeof(opt));
405 }
406 break;
d1912747 407#endif
17926a79
DH
408 }
409
985a5c82 410 up_write(&conn->params.local->defrag_sem);
5a924b89 411 goto done;
17926a79 412}
248f219c
DH
413
414/*
415 * reject packets through the local endpoint
416 */
417void rxrpc_reject_packets(struct rxrpc_local *local)
418{
1c2bc7b9 419 struct sockaddr_rxrpc srx;
248f219c
DH
420 struct rxrpc_skb_priv *sp;
421 struct rxrpc_wire_header whdr;
422 struct sk_buff *skb;
423 struct msghdr msg;
424 struct kvec iov[2];
425 size_t size;
426 __be32 code;
427
428 _enter("%d", local->debug_id);
429
430 iov[0].iov_base = &whdr;
431 iov[0].iov_len = sizeof(whdr);
432 iov[1].iov_base = &code;
433 iov[1].iov_len = sizeof(code);
434 size = sizeof(whdr) + sizeof(code);
435
1c2bc7b9 436 msg.msg_name = &srx.transport;
248f219c
DH
437 msg.msg_control = NULL;
438 msg.msg_controllen = 0;
439 msg.msg_flags = 0;
440
248f219c
DH
441 memset(&whdr, 0, sizeof(whdr));
442 whdr.type = RXRPC_PACKET_TYPE_ABORT;
443
444 while ((skb = skb_dequeue(&local->reject_queue))) {
71f3ca40 445 rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
248f219c 446 sp = rxrpc_skb(skb);
1c2bc7b9 447
7b674e39 448 if (rxrpc_extract_addr_from_skb(local, &srx, skb) == 0) {
1c2bc7b9
DH
449 msg.msg_namelen = srx.transport_len;
450
248f219c
DH
451 code = htonl(skb->priority);
452
453 whdr.epoch = htonl(sp->hdr.epoch);
454 whdr.cid = htonl(sp->hdr.cid);
455 whdr.callNumber = htonl(sp->hdr.callNumber);
456 whdr.serviceId = htons(sp->hdr.serviceId);
457 whdr.flags = sp->hdr.flags;
458 whdr.flags ^= RXRPC_CLIENT_INITIATED;
459 whdr.flags &= RXRPC_CLIENT_INITIATED;
460
461 kernel_sendmsg(local->socket, &msg, iov, 2, size);
248f219c
DH
462 }
463
71f3ca40 464 rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
248f219c
DH
465 }
466
467 _leave("");
468}