OSDN Git Service

ceph: fix use-after-free on symlink traversal
[uclinux-h8/linux.git] / net / sched / act_skbedit.c
1 /*
2  * Copyright (c) 2008, Intel Corporation.
3  *
4  * This program is free software; you can redistribute it and/or modify it
5  * under the terms and conditions of the GNU General Public License,
6  * version 2, as published by the Free Software Foundation.
7  *
8  * This program is distributed in the hope it will be useful, but WITHOUT
9  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
11  * more details.
12  *
13  * You should have received a copy of the GNU General Public License along with
14  * this program; if not, see <http://www.gnu.org/licenses/>.
15  *
16  * Author: Alexander Duyck <alexander.h.duyck@intel.com>
17  */
18
19 #include <linux/module.h>
20 #include <linux/init.h>
21 #include <linux/kernel.h>
22 #include <linux/skbuff.h>
23 #include <linux/rtnetlink.h>
24 #include <net/netlink.h>
25 #include <net/pkt_sched.h>
26 #include <net/ip.h>
27 #include <net/ipv6.h>
28 #include <net/dsfield.h>
29
30 #include <linux/tc_act/tc_skbedit.h>
31 #include <net/tc_act/tc_skbedit.h>
32
33 static unsigned int skbedit_net_id;
34 static struct tc_action_ops act_skbedit_ops;
35
36 static int tcf_skbedit_act(struct sk_buff *skb, const struct tc_action *a,
37                            struct tcf_result *res)
38 {
39         struct tcf_skbedit *d = to_skbedit(a);
40         struct tcf_skbedit_params *params;
41         int action;
42
43         tcf_lastuse_update(&d->tcf_tm);
44         bstats_cpu_update(this_cpu_ptr(d->common.cpu_bstats), skb);
45
46         params = rcu_dereference_bh(d->params);
47         action = READ_ONCE(d->tcf_action);
48
49         if (params->flags & SKBEDIT_F_PRIORITY)
50                 skb->priority = params->priority;
51         if (params->flags & SKBEDIT_F_INHERITDSFIELD) {
52                 int wlen = skb_network_offset(skb);
53
54                 switch (tc_skb_protocol(skb)) {
55                 case htons(ETH_P_IP):
56                         wlen += sizeof(struct iphdr);
57                         if (!pskb_may_pull(skb, wlen))
58                                 goto err;
59                         skb->priority = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
60                         break;
61
62                 case htons(ETH_P_IPV6):
63                         wlen += sizeof(struct ipv6hdr);
64                         if (!pskb_may_pull(skb, wlen))
65                                 goto err;
66                         skb->priority = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
67                         break;
68                 }
69         }
70         if (params->flags & SKBEDIT_F_QUEUE_MAPPING &&
71             skb->dev->real_num_tx_queues > params->queue_mapping)
72                 skb_set_queue_mapping(skb, params->queue_mapping);
73         if (params->flags & SKBEDIT_F_MARK) {
74                 skb->mark &= ~params->mask;
75                 skb->mark |= params->mark & params->mask;
76         }
77         if (params->flags & SKBEDIT_F_PTYPE)
78                 skb->pkt_type = params->ptype;
79         return action;
80
81 err:
82         qstats_drop_inc(this_cpu_ptr(d->common.cpu_qstats));
83         return TC_ACT_SHOT;
84 }
85
86 static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
87         [TCA_SKBEDIT_PARMS]             = { .len = sizeof(struct tc_skbedit) },
88         [TCA_SKBEDIT_PRIORITY]          = { .len = sizeof(u32) },
89         [TCA_SKBEDIT_QUEUE_MAPPING]     = { .len = sizeof(u16) },
90         [TCA_SKBEDIT_MARK]              = { .len = sizeof(u32) },
91         [TCA_SKBEDIT_PTYPE]             = { .len = sizeof(u16) },
92         [TCA_SKBEDIT_MASK]              = { .len = sizeof(u32) },
93         [TCA_SKBEDIT_FLAGS]             = { .len = sizeof(u64) },
94 };
95
96 static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
97                             struct nlattr *est, struct tc_action **a,
98                             int ovr, int bind, bool rtnl_held,
99                             struct netlink_ext_ack *extack)
100 {
101         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
102         struct tcf_skbedit_params *params_new;
103         struct nlattr *tb[TCA_SKBEDIT_MAX + 1];
104         struct tc_skbedit *parm;
105         struct tcf_skbedit *d;
106         u32 flags = 0, *priority = NULL, *mark = NULL, *mask = NULL;
107         u16 *queue_mapping = NULL, *ptype = NULL;
108         bool exists = false;
109         int ret = 0, err;
110
111         if (nla == NULL)
112                 return -EINVAL;
113
114         err = nla_parse_nested(tb, TCA_SKBEDIT_MAX, nla, skbedit_policy, NULL);
115         if (err < 0)
116                 return err;
117
118         if (tb[TCA_SKBEDIT_PARMS] == NULL)
119                 return -EINVAL;
120
121         if (tb[TCA_SKBEDIT_PRIORITY] != NULL) {
122                 flags |= SKBEDIT_F_PRIORITY;
123                 priority = nla_data(tb[TCA_SKBEDIT_PRIORITY]);
124         }
125
126         if (tb[TCA_SKBEDIT_QUEUE_MAPPING] != NULL) {
127                 flags |= SKBEDIT_F_QUEUE_MAPPING;
128                 queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
129         }
130
131         if (tb[TCA_SKBEDIT_PTYPE] != NULL) {
132                 ptype = nla_data(tb[TCA_SKBEDIT_PTYPE]);
133                 if (!skb_pkt_type_ok(*ptype))
134                         return -EINVAL;
135                 flags |= SKBEDIT_F_PTYPE;
136         }
137
138         if (tb[TCA_SKBEDIT_MARK] != NULL) {
139                 flags |= SKBEDIT_F_MARK;
140                 mark = nla_data(tb[TCA_SKBEDIT_MARK]);
141         }
142
143         if (tb[TCA_SKBEDIT_MASK] != NULL) {
144                 flags |= SKBEDIT_F_MASK;
145                 mask = nla_data(tb[TCA_SKBEDIT_MASK]);
146         }
147
148         if (tb[TCA_SKBEDIT_FLAGS] != NULL) {
149                 u64 *pure_flags = nla_data(tb[TCA_SKBEDIT_FLAGS]);
150
151                 if (*pure_flags & SKBEDIT_F_INHERITDSFIELD)
152                         flags |= SKBEDIT_F_INHERITDSFIELD;
153         }
154
155         parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
156
157         err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
158         if (err < 0)
159                 return err;
160         exists = err;
161         if (exists && bind)
162                 return 0;
163
164         if (!flags) {
165                 if (exists)
166                         tcf_idr_release(*a, bind);
167                 else
168                         tcf_idr_cleanup(tn, parm->index);
169                 return -EINVAL;
170         }
171
172         if (!exists) {
173                 ret = tcf_idr_create(tn, parm->index, est, a,
174                                      &act_skbedit_ops, bind, true);
175                 if (ret) {
176                         tcf_idr_cleanup(tn, parm->index);
177                         return ret;
178                 }
179
180                 d = to_skbedit(*a);
181                 ret = ACT_P_CREATED;
182         } else {
183                 d = to_skbedit(*a);
184                 if (!ovr) {
185                         tcf_idr_release(*a, bind);
186                         return -EEXIST;
187                 }
188         }
189
190         params_new = kzalloc(sizeof(*params_new), GFP_KERNEL);
191         if (unlikely(!params_new)) {
192                 tcf_idr_release(*a, bind);
193                 return -ENOMEM;
194         }
195
196         params_new->flags = flags;
197         if (flags & SKBEDIT_F_PRIORITY)
198                 params_new->priority = *priority;
199         if (flags & SKBEDIT_F_QUEUE_MAPPING)
200                 params_new->queue_mapping = *queue_mapping;
201         if (flags & SKBEDIT_F_MARK)
202                 params_new->mark = *mark;
203         if (flags & SKBEDIT_F_PTYPE)
204                 params_new->ptype = *ptype;
205         /* default behaviour is to use all the bits */
206         params_new->mask = 0xffffffff;
207         if (flags & SKBEDIT_F_MASK)
208                 params_new->mask = *mask;
209
210         spin_lock_bh(&d->tcf_lock);
211         d->tcf_action = parm->action;
212         rcu_swap_protected(d->params, params_new,
213                            lockdep_is_held(&d->tcf_lock));
214         spin_unlock_bh(&d->tcf_lock);
215         if (params_new)
216                 kfree_rcu(params_new, rcu);
217
218         if (ret == ACT_P_CREATED)
219                 tcf_idr_insert(tn, *a);
220         return ret;
221 }
222
223 static int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
224                             int bind, int ref)
225 {
226         unsigned char *b = skb_tail_pointer(skb);
227         struct tcf_skbedit *d = to_skbedit(a);
228         struct tcf_skbedit_params *params;
229         struct tc_skbedit opt = {
230                 .index   = d->tcf_index,
231                 .refcnt  = refcount_read(&d->tcf_refcnt) - ref,
232                 .bindcnt = atomic_read(&d->tcf_bindcnt) - bind,
233         };
234         u64 pure_flags = 0;
235         struct tcf_t t;
236
237         spin_lock_bh(&d->tcf_lock);
238         params = rcu_dereference_protected(d->params,
239                                            lockdep_is_held(&d->tcf_lock));
240         opt.action = d->tcf_action;
241
242         if (nla_put(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt))
243                 goto nla_put_failure;
244         if ((params->flags & SKBEDIT_F_PRIORITY) &&
245             nla_put_u32(skb, TCA_SKBEDIT_PRIORITY, params->priority))
246                 goto nla_put_failure;
247         if ((params->flags & SKBEDIT_F_QUEUE_MAPPING) &&
248             nla_put_u16(skb, TCA_SKBEDIT_QUEUE_MAPPING, params->queue_mapping))
249                 goto nla_put_failure;
250         if ((params->flags & SKBEDIT_F_MARK) &&
251             nla_put_u32(skb, TCA_SKBEDIT_MARK, params->mark))
252                 goto nla_put_failure;
253         if ((params->flags & SKBEDIT_F_PTYPE) &&
254             nla_put_u16(skb, TCA_SKBEDIT_PTYPE, params->ptype))
255                 goto nla_put_failure;
256         if ((params->flags & SKBEDIT_F_MASK) &&
257             nla_put_u32(skb, TCA_SKBEDIT_MASK, params->mask))
258                 goto nla_put_failure;
259         if (params->flags & SKBEDIT_F_INHERITDSFIELD)
260                 pure_flags |= SKBEDIT_F_INHERITDSFIELD;
261         if (pure_flags != 0 &&
262             nla_put(skb, TCA_SKBEDIT_FLAGS, sizeof(pure_flags), &pure_flags))
263                 goto nla_put_failure;
264
265         tcf_tm_dump(&t, &d->tcf_tm);
266         if (nla_put_64bit(skb, TCA_SKBEDIT_TM, sizeof(t), &t, TCA_SKBEDIT_PAD))
267                 goto nla_put_failure;
268         spin_unlock_bh(&d->tcf_lock);
269
270         return skb->len;
271
272 nla_put_failure:
273         spin_unlock_bh(&d->tcf_lock);
274         nlmsg_trim(skb, b);
275         return -1;
276 }
277
278 static void tcf_skbedit_cleanup(struct tc_action *a)
279 {
280         struct tcf_skbedit *d = to_skbedit(a);
281         struct tcf_skbedit_params *params;
282
283         params = rcu_dereference_protected(d->params, 1);
284         if (params)
285                 kfree_rcu(params, rcu);
286 }
287
288 static int tcf_skbedit_walker(struct net *net, struct sk_buff *skb,
289                               struct netlink_callback *cb, int type,
290                               const struct tc_action_ops *ops,
291                               struct netlink_ext_ack *extack)
292 {
293         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
294
295         return tcf_generic_walker(tn, skb, cb, type, ops, extack);
296 }
297
298 static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index)
299 {
300         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
301
302         return tcf_idr_search(tn, a, index);
303 }
304
305 static struct tc_action_ops act_skbedit_ops = {
306         .kind           =       "skbedit",
307         .id             =       TCA_ID_SKBEDIT,
308         .owner          =       THIS_MODULE,
309         .act            =       tcf_skbedit_act,
310         .dump           =       tcf_skbedit_dump,
311         .init           =       tcf_skbedit_init,
312         .cleanup        =       tcf_skbedit_cleanup,
313         .walk           =       tcf_skbedit_walker,
314         .lookup         =       tcf_skbedit_search,
315         .size           =       sizeof(struct tcf_skbedit),
316 };
317
318 static __net_init int skbedit_init_net(struct net *net)
319 {
320         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
321
322         return tc_action_net_init(tn, &act_skbedit_ops);
323 }
324
325 static void __net_exit skbedit_exit_net(struct list_head *net_list)
326 {
327         tc_action_net_exit(net_list, skbedit_net_id);
328 }
329
330 static struct pernet_operations skbedit_net_ops = {
331         .init = skbedit_init_net,
332         .exit_batch = skbedit_exit_net,
333         .id   = &skbedit_net_id,
334         .size = sizeof(struct tc_action_net),
335 };
336
337 MODULE_AUTHOR("Alexander Duyck, <alexander.h.duyck@intel.com>");
338 MODULE_DESCRIPTION("SKB Editing");
339 MODULE_LICENSE("GPL");
340
341 static int __init skbedit_init_module(void)
342 {
343         return tcf_register_action(&act_skbedit_ops, &skbedit_net_ops);
344 }
345
346 static void __exit skbedit_cleanup_module(void)
347 {
348         tcf_unregister_action(&act_skbedit_ops, &skbedit_net_ops);
349 }
350
351 module_init(skbedit_init_module);
352 module_exit(skbedit_cleanup_module);