net/sched: avoid double free on matchall reoffload
[linux-2.6-block.git] / net / sched / cls_matchall.c
1 /*
2  * net/sched/cls_matchll.c              Match-all classifier
3  *
4  * Copyright (c) 2016 Jiri Pirko <jiri@mellanox.com>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  */
11
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/percpu.h>
16
17 #include <net/sch_generic.h>
18 #include <net/pkt_cls.h>
19
20 struct cls_mall_head {
21         struct tcf_exts exts;
22         struct tcf_result res;
23         u32 handle;
24         u32 flags;
25         unsigned int in_hw_count;
26         struct tc_matchall_pcnt __percpu *pf;
27         struct rcu_work rwork;
28 };
29
30 static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp,
31                          struct tcf_result *res)
32 {
33         struct cls_mall_head *head = rcu_dereference_bh(tp->root);
34
35         if (unlikely(!head))
36                 return -1;
37
38         if (tc_skip_sw(head->flags))
39                 return -1;
40
41         *res = head->res;
42         __this_cpu_inc(head->pf->rhit);
43         return tcf_exts_exec(skb, &head->exts, res);
44 }
45
46 static int mall_init(struct tcf_proto *tp)
47 {
48         return 0;
49 }
50
51 static void __mall_destroy(struct cls_mall_head *head)
52 {
53         tcf_exts_destroy(&head->exts);
54         tcf_exts_put_net(&head->exts);
55         free_percpu(head->pf);
56         kfree(head);
57 }
58
59 static void mall_destroy_work(struct work_struct *work)
60 {
61         struct cls_mall_head *head = container_of(to_rcu_work(work),
62                                                   struct cls_mall_head,
63                                                   rwork);
64         rtnl_lock();
65         __mall_destroy(head);
66         rtnl_unlock();
67 }
68
69 static void mall_destroy_hw_filter(struct tcf_proto *tp,
70                                    struct cls_mall_head *head,
71                                    unsigned long cookie,
72                                    struct netlink_ext_ack *extack)
73 {
74         struct tc_cls_matchall_offload cls_mall = {};
75         struct tcf_block *block = tp->chain->block;
76
77         tc_cls_common_offload_init(&cls_mall.common, tp, head->flags, extack);
78         cls_mall.command = TC_CLSMATCHALL_DESTROY;
79         cls_mall.cookie = cookie;
80
81         tc_setup_cb_call(block, TC_SETUP_CLSMATCHALL, &cls_mall, false);
82         tcf_block_offload_dec(block, &head->flags);
83 }
84
85 static int mall_replace_hw_filter(struct tcf_proto *tp,
86                                   struct cls_mall_head *head,
87                                   unsigned long cookie,
88                                   struct netlink_ext_ack *extack)
89 {
90         struct tc_cls_matchall_offload cls_mall = {};
91         struct tcf_block *block = tp->chain->block;
92         bool skip_sw = tc_skip_sw(head->flags);
93         int err;
94
95         cls_mall.rule = flow_rule_alloc(tcf_exts_num_actions(&head->exts));
96         if (!cls_mall.rule)
97                 return -ENOMEM;
98
99         tc_cls_common_offload_init(&cls_mall.common, tp, head->flags, extack);
100         cls_mall.command = TC_CLSMATCHALL_REPLACE;
101         cls_mall.cookie = cookie;
102
103         err = tc_setup_flow_action(&cls_mall.rule->action, &head->exts);
104         if (err) {
105                 kfree(cls_mall.rule);
106                 mall_destroy_hw_filter(tp, head, cookie, NULL);
107                 if (skip_sw)
108                         NL_SET_ERR_MSG_MOD(extack, "Failed to setup flow action");
109                 else
110                         err = 0;
111
112                 return err;
113         }
114
115         err = tc_setup_cb_call(block, TC_SETUP_CLSMATCHALL, &cls_mall, skip_sw);
116         kfree(cls_mall.rule);
117
118         if (err < 0) {
119                 mall_destroy_hw_filter(tp, head, cookie, NULL);
120                 return err;
121         } else if (err > 0) {
122                 head->in_hw_count = err;
123                 tcf_block_offload_inc(block, &head->flags);
124         }
125
126         if (skip_sw && !(head->flags & TCA_CLS_FLAGS_IN_HW))
127                 return -EINVAL;
128
129         return 0;
130 }
131
132 static void mall_destroy(struct tcf_proto *tp, bool rtnl_held,
133                          struct netlink_ext_ack *extack)
134 {
135         struct cls_mall_head *head = rtnl_dereference(tp->root);
136
137         if (!head)
138                 return;
139
140         tcf_unbind_filter(tp, &head->res);
141
142         if (!tc_skip_hw(head->flags))
143                 mall_destroy_hw_filter(tp, head, (unsigned long) head, extack);
144
145         if (tcf_exts_get_net(&head->exts))
146                 tcf_queue_work(&head->rwork, mall_destroy_work);
147         else
148                 __mall_destroy(head);
149 }
150
151 static void *mall_get(struct tcf_proto *tp, u32 handle)
152 {
153         struct cls_mall_head *head = rtnl_dereference(tp->root);
154
155         if (head && head->handle == handle)
156                 return head;
157
158         return NULL;
159 }
160
161 static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
162         [TCA_MATCHALL_UNSPEC]           = { .type = NLA_UNSPEC },
163         [TCA_MATCHALL_CLASSID]          = { .type = NLA_U32 },
164 };
165
166 static int mall_set_parms(struct net *net, struct tcf_proto *tp,
167                           struct cls_mall_head *head,
168                           unsigned long base, struct nlattr **tb,
169                           struct nlattr *est, bool ovr,
170                           struct netlink_ext_ack *extack)
171 {
172         int err;
173
174         err = tcf_exts_validate(net, tp, tb, est, &head->exts, ovr, true,
175                                 extack);
176         if (err < 0)
177                 return err;
178
179         if (tb[TCA_MATCHALL_CLASSID]) {
180                 head->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
181                 tcf_bind_filter(tp, &head->res, base);
182         }
183         return 0;
184 }
185
186 static int mall_change(struct net *net, struct sk_buff *in_skb,
187                        struct tcf_proto *tp, unsigned long base,
188                        u32 handle, struct nlattr **tca,
189                        void **arg, bool ovr, bool rtnl_held,
190                        struct netlink_ext_ack *extack)
191 {
192         struct cls_mall_head *head = rtnl_dereference(tp->root);
193         struct nlattr *tb[TCA_MATCHALL_MAX + 1];
194         struct cls_mall_head *new;
195         u32 flags = 0;
196         int err;
197
198         if (!tca[TCA_OPTIONS])
199                 return -EINVAL;
200
201         if (head)
202                 return -EEXIST;
203
204         err = nla_parse_nested_deprecated(tb, TCA_MATCHALL_MAX,
205                                           tca[TCA_OPTIONS], mall_policy, NULL);
206         if (err < 0)
207                 return err;
208
209         if (tb[TCA_MATCHALL_FLAGS]) {
210                 flags = nla_get_u32(tb[TCA_MATCHALL_FLAGS]);
211                 if (!tc_flags_valid(flags))
212                         return -EINVAL;
213         }
214
215         new = kzalloc(sizeof(*new), GFP_KERNEL);
216         if (!new)
217                 return -ENOBUFS;
218
219         err = tcf_exts_init(&new->exts, net, TCA_MATCHALL_ACT, 0);
220         if (err)
221                 goto err_exts_init;
222
223         if (!handle)
224                 handle = 1;
225         new->handle = handle;
226         new->flags = flags;
227         new->pf = alloc_percpu(struct tc_matchall_pcnt);
228         if (!new->pf) {
229                 err = -ENOMEM;
230                 goto err_alloc_percpu;
231         }
232
233         err = mall_set_parms(net, tp, new, base, tb, tca[TCA_RATE], ovr,
234                              extack);
235         if (err)
236                 goto err_set_parms;
237
238         if (!tc_skip_hw(new->flags)) {
239                 err = mall_replace_hw_filter(tp, new, (unsigned long)new,
240                                              extack);
241                 if (err)
242                         goto err_replace_hw_filter;
243         }
244
245         if (!tc_in_hw(new->flags))
246                 new->flags |= TCA_CLS_FLAGS_NOT_IN_HW;
247
248         *arg = head;
249         rcu_assign_pointer(tp->root, new);
250         return 0;
251
252 err_replace_hw_filter:
253 err_set_parms:
254         free_percpu(new->pf);
255 err_alloc_percpu:
256         tcf_exts_destroy(&new->exts);
257 err_exts_init:
258         kfree(new);
259         return err;
260 }
261
262 static int mall_delete(struct tcf_proto *tp, void *arg, bool *last,
263                        bool rtnl_held, struct netlink_ext_ack *extack)
264 {
265         return -EOPNOTSUPP;
266 }
267
268 static void mall_walk(struct tcf_proto *tp, struct tcf_walker *arg,
269                       bool rtnl_held)
270 {
271         struct cls_mall_head *head = rtnl_dereference(tp->root);
272
273         if (arg->count < arg->skip)
274                 goto skip;
275
276         if (!head)
277                 return;
278         if (arg->fn(tp, head, arg) < 0)
279                 arg->stop = 1;
280 skip:
281         arg->count++;
282 }
283
284 static int mall_reoffload(struct tcf_proto *tp, bool add, tc_setup_cb_t *cb,
285                           void *cb_priv, struct netlink_ext_ack *extack)
286 {
287         struct cls_mall_head *head = rtnl_dereference(tp->root);
288         struct tc_cls_matchall_offload cls_mall = {};
289         struct tcf_block *block = tp->chain->block;
290         int err;
291
292         if (tc_skip_hw(head->flags))
293                 return 0;
294
295         cls_mall.rule = flow_rule_alloc(tcf_exts_num_actions(&head->exts));
296         if (!cls_mall.rule)
297                 return -ENOMEM;
298
299         tc_cls_common_offload_init(&cls_mall.common, tp, head->flags, extack);
300         cls_mall.command = add ?
301                 TC_CLSMATCHALL_REPLACE : TC_CLSMATCHALL_DESTROY;
302         cls_mall.cookie = (unsigned long)head;
303
304         err = tc_setup_flow_action(&cls_mall.rule->action, &head->exts);
305         if (err) {
306                 kfree(cls_mall.rule);
307                 if (add && tc_skip_sw(head->flags)) {
308                         NL_SET_ERR_MSG_MOD(extack, "Failed to setup flow action");
309                         return err;
310                 }
311                 return 0;
312         }
313
314         err = cb(TC_SETUP_CLSMATCHALL, &cls_mall, cb_priv);
315         kfree(cls_mall.rule);
316
317         if (err) {
318                 if (add && tc_skip_sw(head->flags))
319                         return err;
320                 return 0;
321         }
322
323         tc_cls_offload_cnt_update(block, &head->in_hw_count, &head->flags, add);
324
325         return 0;
326 }
327
328 static void mall_stats_hw_filter(struct tcf_proto *tp,
329                                  struct cls_mall_head *head,
330                                  unsigned long cookie)
331 {
332         struct tc_cls_matchall_offload cls_mall = {};
333         struct tcf_block *block = tp->chain->block;
334
335         tc_cls_common_offload_init(&cls_mall.common, tp, head->flags, NULL);
336         cls_mall.command = TC_CLSMATCHALL_STATS;
337         cls_mall.cookie = cookie;
338
339         tc_setup_cb_call(block, TC_SETUP_CLSMATCHALL, &cls_mall, false);
340
341         tcf_exts_stats_update(&head->exts, cls_mall.stats.bytes,
342                               cls_mall.stats.pkts, cls_mall.stats.lastused);
343 }
344
345 static int mall_dump(struct net *net, struct tcf_proto *tp, void *fh,
346                      struct sk_buff *skb, struct tcmsg *t, bool rtnl_held)
347 {
348         struct tc_matchall_pcnt gpf = {};
349         struct cls_mall_head *head = fh;
350         struct nlattr *nest;
351         int cpu;
352
353         if (!head)
354                 return skb->len;
355
356         if (!tc_skip_hw(head->flags))
357                 mall_stats_hw_filter(tp, head, (unsigned long)head);
358
359         t->tcm_handle = head->handle;
360
361         nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
362         if (!nest)
363                 goto nla_put_failure;
364
365         if (head->res.classid &&
366             nla_put_u32(skb, TCA_MATCHALL_CLASSID, head->res.classid))
367                 goto nla_put_failure;
368
369         if (head->flags && nla_put_u32(skb, TCA_MATCHALL_FLAGS, head->flags))
370                 goto nla_put_failure;
371
372         for_each_possible_cpu(cpu) {
373                 struct tc_matchall_pcnt *pf = per_cpu_ptr(head->pf, cpu);
374
375                 gpf.rhit += pf->rhit;
376         }
377
378         if (nla_put_64bit(skb, TCA_MATCHALL_PCNT,
379                           sizeof(struct tc_matchall_pcnt),
380                           &gpf, TCA_MATCHALL_PAD))
381                 goto nla_put_failure;
382
383         if (tcf_exts_dump(skb, &head->exts))
384                 goto nla_put_failure;
385
386         nla_nest_end(skb, nest);
387
388         if (tcf_exts_dump_stats(skb, &head->exts) < 0)
389                 goto nla_put_failure;
390
391         return skb->len;
392
393 nla_put_failure:
394         nla_nest_cancel(skb, nest);
395         return -1;
396 }
397
398 static void mall_bind_class(void *fh, u32 classid, unsigned long cl)
399 {
400         struct cls_mall_head *head = fh;
401
402         if (head && head->res.classid == classid)
403                 head->res.class = cl;
404 }
405
406 static struct tcf_proto_ops cls_mall_ops __read_mostly = {
407         .kind           = "matchall",
408         .classify       = mall_classify,
409         .init           = mall_init,
410         .destroy        = mall_destroy,
411         .get            = mall_get,
412         .change         = mall_change,
413         .delete         = mall_delete,
414         .walk           = mall_walk,
415         .reoffload      = mall_reoffload,
416         .dump           = mall_dump,
417         .bind_class     = mall_bind_class,
418         .owner          = THIS_MODULE,
419 };
420
421 static int __init cls_mall_init(void)
422 {
423         return register_tcf_proto_ops(&cls_mall_ops);
424 }
425
426 static void __exit cls_mall_exit(void)
427 {
428         unregister_tcf_proto_ops(&cls_mall_ops);
429 }
430
431 module_init(cls_mall_init);
432 module_exit(cls_mall_exit);
433
434 MODULE_AUTHOR("Jiri Pirko <jiri@mellanox.com>");
435 MODULE_DESCRIPTION("Match-all classifier");
436 MODULE_LICENSE("GPL v2");