]>
Commit | Line | Data |
---|---|---|
b4d0d230 | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
7877a4a4 DH |
2 | /* Service connection management |
3 | * | |
4 | * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. | |
5 | * Written by David Howells (dhowells@redhat.com) | |
7877a4a4 DH |
6 | */ |
7 | ||
8 | #include <linux/slab.h> | |
9 | #include "ar-internal.h" | |
10 | ||
245500d8 | 11 | static struct rxrpc_bundle rxrpc_service_dummy_bundle = { |
a0575429 | 12 | .ref = REFCOUNT_INIT(1), |
245500d8 DH |
13 | .debug_id = UINT_MAX, |
14 | .channel_lock = __SPIN_LOCK_UNLOCKED(&rxrpc_service_dummy_bundle.channel_lock), | |
15 | }; | |
16 | ||
8496af50 DH |
17 | /* |
18 | * Find a service connection under RCU conditions. | |
19 | * | |
20 | * We could use a hash table, but that is subject to bucket stuffing by an | |
21 | * attacker as the client gets to pick the epoch and cid values and would know | |
22 | * the hash function. So, instead, we use a hash table for the peer and from | |
23 | * that an rbtree to find the service connection. Under ordinary circumstances | |
24 | * it might be slower than a large hash table, but it is at least limited in | |
25 | * depth. | |
26 | */ | |
27 | struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer, | |
28 | struct sk_buff *skb) | |
29 | { | |
30 | struct rxrpc_connection *conn = NULL; | |
31 | struct rxrpc_conn_proto k; | |
32 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); | |
33 | struct rb_node *p; | |
34 | unsigned int seq = 0; | |
35 | ||
36 | k.epoch = sp->hdr.epoch; | |
37 | k.cid = sp->hdr.cid & RXRPC_CIDMASK; | |
38 | ||
39 | do { | |
40 | /* Unfortunately, rbtree walking doesn't give reliable results | |
41 | * under just the RCU read lock, so we have to check for | |
42 | * changes. | |
43 | */ | |
44 | read_seqbegin_or_lock(&peer->service_conn_lock, &seq); | |
45 | ||
46 | p = rcu_dereference_raw(peer->service_conns.rb_node); | |
47 | while (p) { | |
48 | conn = rb_entry(p, struct rxrpc_connection, service_node); | |
49 | ||
50 | if (conn->proto.index_key < k.index_key) | |
51 | p = rcu_dereference_raw(p->rb_left); | |
52 | else if (conn->proto.index_key > k.index_key) | |
53 | p = rcu_dereference_raw(p->rb_right); | |
54 | else | |
fdade4f6 | 55 | break; |
8496af50 DH |
56 | conn = NULL; |
57 | } | |
58 | } while (need_seqretry(&peer->service_conn_lock, seq)); | |
59 | ||
8496af50 DH |
60 | done_seqretry(&peer->service_conn_lock, seq); |
61 | _leave(" = %d", conn ? conn->debug_id : -1); | |
62 | return conn; | |
63 | } | |
64 | ||
65 | /* | |
66 | * Insert a service connection into a peer's tree, thereby making it a target | |
67 | * for incoming packets. | |
68 | */ | |
248f219c DH |
69 | static void rxrpc_publish_service_conn(struct rxrpc_peer *peer, |
70 | struct rxrpc_connection *conn) | |
8496af50 DH |
71 | { |
72 | struct rxrpc_connection *cursor = NULL; | |
73 | struct rxrpc_conn_proto k = conn->proto; | |
74 | struct rb_node **pp, *parent; | |
75 | ||
76 | write_seqlock_bh(&peer->service_conn_lock); | |
77 | ||
78 | pp = &peer->service_conns.rb_node; | |
79 | parent = NULL; | |
80 | while (*pp) { | |
81 | parent = *pp; | |
82 | cursor = rb_entry(parent, | |
83 | struct rxrpc_connection, service_node); | |
84 | ||
85 | if (cursor->proto.index_key < k.index_key) | |
86 | pp = &(*pp)->rb_left; | |
87 | else if (cursor->proto.index_key > k.index_key) | |
88 | pp = &(*pp)->rb_right; | |
89 | else | |
90 | goto found_extant_conn; | |
91 | } | |
92 | ||
93 | rb_link_node_rcu(&conn->service_node, parent, pp); | |
94 | rb_insert_color(&conn->service_node, &peer->service_conns); | |
95 | conn_published: | |
96 | set_bit(RXRPC_CONN_IN_SERVICE_CONNS, &conn->flags); | |
97 | write_sequnlock_bh(&peer->service_conn_lock); | |
98 | _leave(" = %d [new]", conn->debug_id); | |
248f219c | 99 | return; |
8496af50 DH |
100 | |
101 | found_extant_conn: | |
a0575429 | 102 | if (refcount_read(&cursor->ref) == 0) |
8496af50 DH |
103 | goto replace_old_connection; |
104 | write_sequnlock_bh(&peer->service_conn_lock); | |
105 | /* We should not be able to get here. rxrpc_incoming_connection() is | |
106 | * called in a non-reentrant context, so there can't be a race to | |
107 | * insert a new connection. | |
108 | */ | |
109 | BUG(); | |
110 | ||
111 | replace_old_connection: | |
112 | /* The old connection is from an outdated epoch. */ | |
113 | _debug("replace conn"); | |
114 | rb_replace_node_rcu(&cursor->service_node, | |
115 | &conn->service_node, | |
116 | &peer->service_conns); | |
117 | clear_bit(RXRPC_CONN_IN_SERVICE_CONNS, &cursor->flags); | |
118 | goto conn_published; | |
119 | } | |
120 | ||
00e90712 DH |
121 | /* |
122 | * Preallocate a service connection. The connection is placed on the proc and | |
123 | * reap lists so that we don't have to get the lock from BH context. | |
124 | */ | |
2baec2c3 DH |
125 | struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *rxnet, |
126 | gfp_t gfp) | |
00e90712 DH |
127 | { |
128 | struct rxrpc_connection *conn = rxrpc_alloc_connection(gfp); | |
129 | ||
130 | if (conn) { | |
131 | /* We maintain an extra ref on the connection whilst it is on | |
132 | * the rxrpc_connections list. | |
133 | */ | |
134 | conn->state = RXRPC_CONN_SERVICE_PREALLOC; | |
a0575429 | 135 | refcount_set(&conn->ref, 2); |
245500d8 | 136 | conn->bundle = rxrpc_get_bundle(&rxrpc_service_dummy_bundle); |
00e90712 | 137 | |
31f5f9a1 | 138 | atomic_inc(&rxnet->nr_conns); |
2baec2c3 DH |
139 | write_lock(&rxnet->conn_lock); |
140 | list_add_tail(&conn->link, &rxnet->service_conns); | |
141 | list_add_tail(&conn->proc_link, &rxnet->conn_proc_list); | |
142 | write_unlock(&rxnet->conn_lock); | |
363deeab | 143 | |
4c1295dc | 144 | trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service, |
a0575429 | 145 | refcount_read(&conn->ref), |
363deeab | 146 | __builtin_return_address(0)); |
00e90712 DH |
147 | } |
148 | ||
149 | return conn; | |
150 | } | |
151 | ||
7877a4a4 | 152 | /* |
248f219c DH |
153 | * Set up an incoming connection. This is called in BH context with the RCU |
154 | * read lock held. | |
7877a4a4 | 155 | */ |
4722974d DH |
156 | void rxrpc_new_incoming_connection(struct rxrpc_sock *rx, |
157 | struct rxrpc_connection *conn, | |
063c60d3 | 158 | const struct rxrpc_security *sec, |
248f219c | 159 | struct sk_buff *skb) |
7877a4a4 | 160 | { |
7877a4a4 | 161 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
7877a4a4 DH |
162 | |
163 | _enter(""); | |
164 | ||
8496af50 DH |
165 | conn->proto.epoch = sp->hdr.epoch; |
166 | conn->proto.cid = sp->hdr.cid & RXRPC_CIDMASK; | |
8496af50 | 167 | conn->params.service_id = sp->hdr.serviceId; |
68d6d1ae | 168 | conn->service_id = sp->hdr.serviceId; |
8496af50 DH |
169 | conn->security_ix = sp->hdr.securityIndex; |
170 | conn->out_clientflag = 0; | |
063c60d3 | 171 | conn->security = sec; |
248f219c | 172 | if (conn->security_ix) |
8496af50 | 173 | conn->state = RXRPC_CONN_SERVICE_UNSECURED; |
248f219c DH |
174 | else |
175 | conn->state = RXRPC_CONN_SERVICE; | |
7877a4a4 | 176 | |
4722974d DH |
177 | /* See if we should upgrade the service. This can only happen on the |
178 | * first packet on a new connection. Once done, it applies to all | |
179 | * subsequent calls on that connection. | |
180 | */ | |
181 | if (sp->hdr.userStatus == RXRPC_USERSTATUS_SERVICE_UPGRADE && | |
182 | conn->service_id == rx->service_upgrade.from) | |
183 | conn->service_id = rx->service_upgrade.to; | |
184 | ||
8496af50 | 185 | /* Make the connection a target for incoming packets. */ |
248f219c | 186 | rxrpc_publish_service_conn(conn->params.peer, conn); |
8496af50 | 187 | |
248f219c | 188 | _net("CONNECTION new %d {%x}", conn->debug_id, conn->proto.cid); |
7877a4a4 | 189 | } |
001c1122 DH |
190 | |
191 | /* | |
192 | * Remove the service connection from the peer's tree, thereby removing it as a | |
193 | * target for incoming packets. | |
194 | */ | |
195 | void rxrpc_unpublish_service_conn(struct rxrpc_connection *conn) | |
196 | { | |
197 | struct rxrpc_peer *peer = conn->params.peer; | |
198 | ||
8496af50 | 199 | write_seqlock_bh(&peer->service_conn_lock); |
001c1122 DH |
200 | if (test_and_clear_bit(RXRPC_CONN_IN_SERVICE_CONNS, &conn->flags)) |
201 | rb_erase(&conn->service_node, &peer->service_conns); | |
8496af50 | 202 | write_sequnlock_bh(&peer->service_conn_lock); |
001c1122 | 203 | } |