* [PATCH net 0/6] rxrpc: Miscellaneous fixes
@ 2020-10-05 16:18 David Howells
2020-10-05 16:18 ` [PATCH net 1/6] rxrpc: Fix rxkad token xdr encoding David Howells
` (7 more replies)
0 siblings, 8 replies; 13+ messages in thread
From: David Howells @ 2020-10-05 16:18 UTC (permalink / raw)
To: netdev; +Cc: Marc Dionne, dhowells, linux-afs, linux-kernel
Here are some miscellaneous rxrpc fixes:
(1) Fix the xdr encoding of the contents read from an rxrpc key.
(2) Fix a BUG() for a unsupported encoding type.
(3) Fix missing _bh lock annotations.
(4) Fix acceptance handling for an incoming call where the incoming call
is encrypted.
(5) The server token keyring isn't network namespaced - it belongs to the
server, so there's no need. Namespacing it means that request_key()
fails to find it.
(6) Fix a leak of the server keyring.
The patches are tagged here:
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git
rxrpc-fixes-20201005.txt
and can also be found on the following branch:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes
David
---
David Howells (5):
rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()
rxrpc: Fix some missing _bh annotations on locking conn->state_lock
rxrpc: Fix accept on a connection that need securing
rxrpc: The server keyring isn't network-namespaced
rxrpc: Fix server keyring leak
Marc Dionne (1):
rxrpc: Fix rxkad token xdr encoding
include/uapi/linux/rxrpc.h | 2 +-
net/rxrpc/ar-internal.h | 7 +-
net/rxrpc/call_accept.c | 263 ++++++-------------------------------
net/rxrpc/call_object.c | 5 +-
net/rxrpc/conn_event.c | 8 +-
net/rxrpc/key.c | 8 +-
net/rxrpc/recvmsg.c | 36 +----
net/rxrpc/sendmsg.c | 15 +--
8 files changed, 56 insertions(+), 288 deletions(-)
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH net 1/6] rxrpc: Fix rxkad token xdr encoding 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells @ 2020-10-05 16:18 ` David Howells 2020-10-05 16:18 ` [PATCH net 2/6] rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() David Howells ` (6 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-05 16:18 UTC (permalink / raw) To: netdev; +Cc: Marc Dionne, dhowells, linux-afs, linux-kernel From: Marc Dionne <marc.dionne@auristor.com> The session key should be encoded with just the 8 data bytes and no length; ENCODE_DATA precedes it with a 4 byte length, which confuses some existing tools that try to parse this format. Add an ENCODE_BYTES macro that does not include a length, and use it for the key. Also adjust the expected length. Note that commit 774521f353e1d ("rxrpc: Fix an assertion in rxrpc_read()") had fixed a BUG by changing the length rather than fixing the encoding. The original length was correct. Fixes: 99455153d067 ("RxRPC: Parse security index 5 keys (Kerberos 5)") Signed-off-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> --- net/rxrpc/key.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index 94c3df392651..8f7d7a6187db 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -1072,7 +1072,7 @@ static long rxrpc_read(const struct key *key, switch (token->security_index) { case RXRPC_SECURITY_RXKAD: - toksize += 9 * 4; /* viceid, kvno, key*2 + len, begin, + toksize += 8 * 4; /* viceid, kvno, key*2, begin, * end, primary, tktlen */ toksize += RND(token->kad->ticket_len); break; @@ -1138,6 +1138,14 @@ static long rxrpc_read(const struct key *key, memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \ xdr += (_l + 3) >> 2; \ } while(0) +#define ENCODE_BYTES(l, s) \ + do { \ + u32 _l = (l); \ + memcpy(xdr, (s), _l); \ + if (_l & 3) \ + memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \ + xdr += (_l + 3) >> 2; \ + } while(0) #define ENCODE64(x) \ do { \ __be64 y = cpu_to_be64(x); \ @@ -1165,7 +1173,7 @@ static long rxrpc_read(const struct key *key, case RXRPC_SECURITY_RXKAD: ENCODE(token->kad->vice_id); ENCODE(token->kad->kvno); - ENCODE_DATA(8, token->kad->session_key); + ENCODE_BYTES(8, token->kad->session_key); ENCODE(token->kad->start); ENCODE(token->kad->expiry); ENCODE(token->kad->primary_flag); ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 2/6] rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells 2020-10-05 16:18 ` [PATCH net 1/6] rxrpc: Fix rxkad token xdr encoding David Howells @ 2020-10-05 16:18 ` David Howells 2020-10-05 16:19 ` [PATCH net 3/6] rxrpc: Fix some missing _bh annotations on locking conn->state_lock David Howells ` (5 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-05 16:18 UTC (permalink / raw) To: netdev; +Cc: dhowells, linux-afs, linux-kernel If rxrpc_read() (which allows KEYCTL_READ to read a key), sees a token of a type it doesn't recognise, it can BUG in a couple of places, which is unnecessary as it can easily get back to userspace. Fix this to print an error message instead. Fixes: 99455153d067 ("RxRPC: Parse security index 5 keys (Kerberos 5)") Signed-off-by: David Howells <dhowells@redhat.com> --- net/rxrpc/key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index 8f7d7a6187db..c668e4b7dbff 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -1107,7 +1107,8 @@ static long rxrpc_read(const struct key *key, break; default: /* we have a ticket we can't encode */ - BUG(); + pr_err("Unsupported key token type (%u)\n", + token->security_index); continue; } @@ -1223,7 +1224,6 @@ static long rxrpc_read(const struct key *key, break; default: - BUG(); break; } ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 3/6] rxrpc: Fix some missing _bh annotations on locking conn->state_lock 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells 2020-10-05 16:18 ` [PATCH net 1/6] rxrpc: Fix rxkad token xdr encoding David Howells 2020-10-05 16:18 ` [PATCH net 2/6] rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() David Howells @ 2020-10-05 16:19 ` David Howells 2020-10-05 16:19 ` [PATCH net 4/6] rxrpc: Fix accept on a connection that need securing David Howells ` (4 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-05 16:19 UTC (permalink / raw) To: netdev; +Cc: dhowells, linux-afs, linux-kernel conn->state_lock may be taken in softirq mode, but a previous patch replaced an outer lock in the response-packet event handling code, and lost the _bh from that when doing so. Fix this by applying the _bh annotation to the state_lock locking. Fixes: a1399f8bb033 ("rxrpc: Call channels should have separate call number spaces") Signed-off-by: David Howells <dhowells@redhat.com> --- net/rxrpc/conn_event.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c index 447f55ca6886..6e972b4823ef 100644 --- a/net/rxrpc/conn_event.c +++ b/net/rxrpc/conn_event.c @@ -340,18 +340,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn, return ret; spin_lock(&conn->channel_lock); - spin_lock(&conn->state_lock); + spin_lock_bh(&conn->state_lock); if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { conn->state = RXRPC_CONN_SERVICE; - spin_unlock(&conn->state_lock); + spin_unlock_bh(&conn->state_lock); for (loop = 0; loop < RXRPC_MAXCALLS; loop++) rxrpc_call_is_secure( rcu_dereference_protected( conn->channels[loop].call, lockdep_is_held(&conn->channel_lock))); } else { - spin_unlock(&conn->state_lock); + spin_unlock_bh(&conn->state_lock); } spin_unlock(&conn->channel_lock); ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 4/6] rxrpc: Fix accept on a connection that need securing 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells ` (2 preceding siblings ...) 2020-10-05 16:19 ` [PATCH net 3/6] rxrpc: Fix some missing _bh annotations on locking conn->state_lock David Howells @ 2020-10-05 16:19 ` David Howells 2020-10-05 16:19 ` [PATCH net 5/6] rxrpc: The server keyring isn't network-namespaced David Howells ` (3 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-05 16:19 UTC (permalink / raw) To: netdev; +Cc: dhowells, linux-afs, linux-kernel When a new incoming call arrives at an userspace rxrpc socket on a new connection that has a security class set, the code currently pushes it onto the accept queue to hold a ref on it for the socket. This doesn't work, however, as recvmsg() pops it off, notices that it's in the SERVER_SECURING state and discards the ref. This means that the call runs out of refs too early and the kernel oopses. By contrast, a kernel rxrpc socket manually pre-charges the incoming call pool with calls that already have user call IDs assigned, so they are ref'd by the call tree on the socket. Change the mode of operation for userspace rxrpc server sockets to work like this too. Although this is a UAPI change, server sockets aren't currently functional. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells <dhowells@redhat.com> --- include/uapi/linux/rxrpc.h | 2 net/rxrpc/ar-internal.h | 7 - net/rxrpc/call_accept.c | 263 ++++++-------------------------------------- net/rxrpc/call_object.c | 5 - net/rxrpc/conn_event.c | 2 net/rxrpc/recvmsg.c | 36 ------ net/rxrpc/sendmsg.c | 15 +-- 7 files changed, 49 insertions(+), 281 deletions(-) diff --git a/include/uapi/linux/rxrpc.h b/include/uapi/linux/rxrpc.h index 4accfa7e266d..8f8dc7a937a4 100644 --- a/include/uapi/linux/rxrpc.h +++ b/include/uapi/linux/rxrpc.h @@ -51,11 +51,11 @@ enum rxrpc_cmsg_type { RXRPC_BUSY = 6, /* -r: server busy received [terminal] */ RXRPC_LOCAL_ERROR = 7, /* -r: local error generated [terminal] */ RXRPC_NEW_CALL = 8, /* -r: [Service] new incoming call notification */ - RXRPC_ACCEPT = 9, /* s-: [Service] accept request */ RXRPC_EXCLUSIVE_CALL = 10, /* s-: Call should be on exclusive connection */ RXRPC_UPGRADE_SERVICE = 11, /* s-: Request service upgrade for client call */ RXRPC_TX_LENGTH = 12, /* s-: Total length of Tx data */ RXRPC_SET_CALL_TIMEOUT = 13, /* s-: Set one or more call timeouts */ + RXRPC_CHARGE_ACCEPT = 14, /* s-: Charge the accept pool with a user call ID */ RXRPC__SUPPORTED }; diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h index 884cff7bb169..97aebb5d19db 100644 --- a/net/rxrpc/ar-internal.h +++ b/net/rxrpc/ar-internal.h @@ -518,7 +518,6 @@ enum rxrpc_call_state { RXRPC_CALL_CLIENT_RECV_REPLY, /* - client receiving reply phase */ RXRPC_CALL_SERVER_PREALLOC, /* - service preallocation */ RXRPC_CALL_SERVER_SECURING, /* - server securing request connection */ - RXRPC_CALL_SERVER_ACCEPTING, /* - server accepting request */ RXRPC_CALL_SERVER_RECV_REQUEST, /* - server receiving request */ RXRPC_CALL_SERVER_ACK_REQUEST, /* - server pending ACK of request */ RXRPC_CALL_SERVER_SEND_REPLY, /* - server sending reply */ @@ -714,8 +713,8 @@ struct rxrpc_ack_summary { enum rxrpc_command { RXRPC_CMD_SEND_DATA, /* send data message */ RXRPC_CMD_SEND_ABORT, /* request abort generation */ - RXRPC_CMD_ACCEPT, /* [server] accept incoming call */ RXRPC_CMD_REJECT_BUSY, /* [server] reject a call as busy */ + RXRPC_CMD_CHARGE_ACCEPT, /* [server] charge accept preallocation */ }; struct rxrpc_call_params { @@ -755,9 +754,7 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *, struct rxrpc_sock *, struct sk_buff *); void rxrpc_accept_incoming_calls(struct rxrpc_local *); -struct rxrpc_call *rxrpc_accept_call(struct rxrpc_sock *, unsigned long, - rxrpc_notify_rx_t); -int rxrpc_reject_call(struct rxrpc_sock *); +int rxrpc_user_charge_accept(struct rxrpc_sock *, unsigned long); /* * call_event.c diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c index ef160566aa9a..8df1964db333 100644 --- a/net/rxrpc/call_accept.c +++ b/net/rxrpc/call_accept.c @@ -39,8 +39,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, unsigned int debug_id) { const void *here = __builtin_return_address(0); - struct rxrpc_call *call; + struct rxrpc_call *call, *xcall; struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk)); + struct rb_node *parent, **pp; int max, tmp; unsigned int size = RXRPC_BACKLOG_MAX; unsigned int head, tail, call_head, call_tail; @@ -94,7 +95,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, } /* Now it gets complicated, because calls get registered with the - * socket here, particularly if a user ID is preassigned by the user. + * socket here, with a user ID preassigned by the user. */ call = rxrpc_alloc_call(rx, gfp, debug_id); if (!call) @@ -107,34 +108,33 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, here, (const void *)user_call_ID); write_lock(&rx->call_lock); - if (user_attach_call) { - struct rxrpc_call *xcall; - struct rb_node *parent, **pp; - - /* Check the user ID isn't already in use */ - pp = &rx->calls.rb_node; - parent = NULL; - while (*pp) { - parent = *pp; - xcall = rb_entry(parent, struct rxrpc_call, sock_node); - if (user_call_ID < xcall->user_call_ID) - pp = &(*pp)->rb_left; - else if (user_call_ID > xcall->user_call_ID) - pp = &(*pp)->rb_right; - else - goto id_in_use; - } - call->user_call_ID = user_call_ID; - call->notify_rx = notify_rx; + /* Check the user ID isn't already in use */ + pp = &rx->calls.rb_node; + parent = NULL; + while (*pp) { + parent = *pp; + xcall = rb_entry(parent, struct rxrpc_call, sock_node); + if (user_call_ID < xcall->user_call_ID) + pp = &(*pp)->rb_left; + else if (user_call_ID > xcall->user_call_ID) + pp = &(*pp)->rb_right; + else + goto id_in_use; + } + + call->user_call_ID = user_call_ID; + call->notify_rx = notify_rx; + if (user_attach_call) { rxrpc_get_call(call, rxrpc_call_got_kernel); user_attach_call(call, user_call_ID); - rxrpc_get_call(call, rxrpc_call_got_userid); - rb_link_node(&call->sock_node, parent, pp); - rb_insert_color(&call->sock_node, &rx->calls); - set_bit(RXRPC_CALL_HAS_USERID, &call->flags); } + rxrpc_get_call(call, rxrpc_call_got_userid); + rb_link_node(&call->sock_node, parent, pp); + rb_insert_color(&call->sock_node, &rx->calls); + set_bit(RXRPC_CALL_HAS_USERID, &call->flags); + list_add(&call->sock_link, &rx->sock_calls); write_unlock(&rx->call_lock); @@ -157,11 +157,8 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, } /* - * Preallocate sufficient service connections, calls and peers to cover the - * entire backlog of a socket. When a new call comes in, if we don't have - * sufficient of each available, the call gets rejected as busy or ignored. - * - * The backlog is replenished when a connection is accepted or rejected. + * Allocate the preallocation buffers for incoming service calls. These must + * be charged manually. */ int rxrpc_service_prealloc(struct rxrpc_sock *rx, gfp_t gfp) { @@ -174,13 +171,6 @@ int rxrpc_service_prealloc(struct rxrpc_sock *rx, gfp_t gfp) rx->backlog = b; } - if (rx->discard_new_call) - return 0; - - while (rxrpc_service_prealloc_one(rx, b, NULL, NULL, 0, gfp, - atomic_inc_return(&rxrpc_debug_id)) == 0) - ; - return 0; } @@ -333,6 +323,7 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx, rxrpc_see_call(call); call->conn = conn; call->security = conn->security; + call->security_ix = conn->security_ix; call->peer = rxrpc_get_peer(conn->params.peer); call->cong_cwnd = call->peer->cong_cwnd; return call; @@ -402,8 +393,6 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, if (rx->notify_new_call) rx->notify_new_call(&rx->sk, call, call->user_call_ID); - else - sk_acceptq_added(&rx->sk); spin_lock(&conn->state_lock); switch (conn->state) { @@ -415,12 +404,8 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, case RXRPC_CONN_SERVICE: write_lock(&call->state_lock); - if (call->state < RXRPC_CALL_COMPLETE) { - if (rx->discard_new_call) - call->state = RXRPC_CALL_SERVER_RECV_REQUEST; - else - call->state = RXRPC_CALL_SERVER_ACCEPTING; - } + if (call->state < RXRPC_CALL_COMPLETE) + call->state = RXRPC_CALL_SERVER_RECV_REQUEST; write_unlock(&call->state_lock); break; @@ -440,9 +425,6 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, rxrpc_send_ping(call, skb); - if (call->state == RXRPC_CALL_SERVER_ACCEPTING) - rxrpc_notify_socket(call); - /* We have to discard the prealloc queue's ref here and rely on a * combination of the RCU read lock and refs held either by the socket * (recvmsg queue, to-be-accepted queue or user ID tree) or the kernel @@ -460,187 +442,18 @@ struct rxrpc_call *rxrpc_new_incoming_call(struct rxrpc_local *local, } /* - * handle acceptance of a call by userspace - * - assign the user call ID to the call at the front of the queue - * - called with the socket locked. + * Charge up socket with preallocated calls, attaching user call IDs. */ -struct rxrpc_call *rxrpc_accept_call(struct rxrpc_sock *rx, - unsigned long user_call_ID, - rxrpc_notify_rx_t notify_rx) - __releases(&rx->sk.sk_lock.slock) - __acquires(call->user_mutex) +int rxrpc_user_charge_accept(struct rxrpc_sock *rx, unsigned long user_call_ID) { - struct rxrpc_call *call; - struct rb_node *parent, **pp; - int ret; - - _enter(",%lx", user_call_ID); - - ASSERT(!irqs_disabled()); - - write_lock(&rx->call_lock); - - if (list_empty(&rx->to_be_accepted)) { - write_unlock(&rx->call_lock); - release_sock(&rx->sk); - kleave(" = -ENODATA [empty]"); - return ERR_PTR(-ENODATA); - } - - /* check the user ID isn't already in use */ - pp = &rx->calls.rb_node; - parent = NULL; - while (*pp) { - parent = *pp; - call = rb_entry(parent, struct rxrpc_call, sock_node); - - if (user_call_ID < call->user_call_ID) - pp = &(*pp)->rb_left; - else if (user_call_ID > call->user_call_ID) - pp = &(*pp)->rb_right; - else - goto id_in_use; - } - - /* Dequeue the first call and check it's still valid. We gain - * responsibility for the queue's reference. - */ - call = list_entry(rx->to_be_accepted.next, - struct rxrpc_call, accept_link); - write_unlock(&rx->call_lock); - - /* We need to gain the mutex from the interrupt handler without - * upsetting lockdep, so we have to release it there and take it here. - * We are, however, still holding the socket lock, so other accepts - * must wait for us and no one can add the user ID behind our backs. - */ - if (mutex_lock_interruptible(&call->user_mutex) < 0) { - release_sock(&rx->sk); - kleave(" = -ERESTARTSYS"); - return ERR_PTR(-ERESTARTSYS); - } - - write_lock(&rx->call_lock); - list_del_init(&call->accept_link); - sk_acceptq_removed(&rx->sk); - rxrpc_see_call(call); - - /* Find the user ID insertion point. */ - pp = &rx->calls.rb_node; - parent = NULL; - while (*pp) { - parent = *pp; - call = rb_entry(parent, struct rxrpc_call, sock_node); - - if (user_call_ID < call->user_call_ID) - pp = &(*pp)->rb_left; - else if (user_call_ID > call->user_call_ID) - pp = &(*pp)->rb_right; - else - BUG(); - } - - write_lock_bh(&call->state_lock); - switch (call->state) { - case RXRPC_CALL_SERVER_ACCEPTING: - call->state = RXRPC_CALL_SERVER_RECV_REQUEST; - break; - case RXRPC_CALL_COMPLETE: - ret = call->error; - goto out_release; - default: - BUG(); - } - - /* formalise the acceptance */ - call->notify_rx = notify_rx; - call->user_call_ID = user_call_ID; - rxrpc_get_call(call, rxrpc_call_got_userid); - rb_link_node(&call->sock_node, parent, pp); - rb_insert_color(&call->sock_node, &rx->calls); - if (test_and_set_bit(RXRPC_CALL_HAS_USERID, &call->flags)) - BUG(); - - write_unlock_bh(&call->state_lock); - write_unlock(&rx->call_lock); - rxrpc_notify_socket(call); - rxrpc_service_prealloc(rx, GFP_KERNEL); - release_sock(&rx->sk); - _leave(" = %p{%d}", call, call->debug_id); - return call; - -out_release: - _debug("release %p", call); - write_unlock_bh(&call->state_lock); - write_unlock(&rx->call_lock); - rxrpc_release_call(rx, call); - rxrpc_put_call(call, rxrpc_call_put); - goto out; - -id_in_use: - ret = -EBADSLT; - write_unlock(&rx->call_lock); -out: - rxrpc_service_prealloc(rx, GFP_KERNEL); - release_sock(&rx->sk); - _leave(" = %d", ret); - return ERR_PTR(ret); -} - -/* - * Handle rejection of a call by userspace - * - reject the call at the front of the queue - */ -int rxrpc_reject_call(struct rxrpc_sock *rx) -{ - struct rxrpc_call *call; - bool abort = false; - int ret; - - _enter(""); - - ASSERT(!irqs_disabled()); - - write_lock(&rx->call_lock); - - if (list_empty(&rx->to_be_accepted)) { - write_unlock(&rx->call_lock); - return -ENODATA; - } - - /* Dequeue the first call and check it's still valid. We gain - * responsibility for the queue's reference. - */ - call = list_entry(rx->to_be_accepted.next, - struct rxrpc_call, accept_link); - list_del_init(&call->accept_link); - sk_acceptq_removed(&rx->sk); - rxrpc_see_call(call); + struct rxrpc_backlog *b = rx->backlog; - write_lock_bh(&call->state_lock); - switch (call->state) { - case RXRPC_CALL_SERVER_ACCEPTING: - __rxrpc_abort_call("REJ", call, 1, RX_USER_ABORT, -ECONNABORTED); - abort = true; - fallthrough; - case RXRPC_CALL_COMPLETE: - ret = call->error; - goto out_discard; - default: - BUG(); - } + if (rx->sk.sk_state == RXRPC_CLOSE) + return -ESHUTDOWN; -out_discard: - write_unlock_bh(&call->state_lock); - write_unlock(&rx->call_lock); - if (abort) { - rxrpc_send_abort_packet(call); - rxrpc_release_call(rx, call); - rxrpc_put_call(call, rxrpc_call_put); - } - rxrpc_service_prealloc(rx, GFP_KERNEL); - _leave(" = %d", ret); - return ret; + return rxrpc_service_prealloc_one(rx, b, NULL, NULL, user_call_ID, + GFP_KERNEL, + atomic_inc_return(&rxrpc_debug_id)); } /* diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c index a40fae013942..ed49769b459d 100644 --- a/net/rxrpc/call_object.c +++ b/net/rxrpc/call_object.c @@ -23,7 +23,6 @@ const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = { [RXRPC_CALL_CLIENT_RECV_REPLY] = "ClRcvRpl", [RXRPC_CALL_SERVER_PREALLOC] = "SvPrealc", [RXRPC_CALL_SERVER_SECURING] = "SvSecure", - [RXRPC_CALL_SERVER_ACCEPTING] = "SvAccept", [RXRPC_CALL_SERVER_RECV_REQUEST] = "SvRcvReq", [RXRPC_CALL_SERVER_ACK_REQUEST] = "SvAckReq", [RXRPC_CALL_SERVER_SEND_REPLY] = "SvSndRpl", @@ -352,9 +351,7 @@ void rxrpc_incoming_call(struct rxrpc_sock *rx, call->call_id = sp->hdr.callNumber; call->service_id = sp->hdr.serviceId; call->cid = sp->hdr.cid; - call->state = RXRPC_CALL_SERVER_ACCEPTING; - if (sp->hdr.securityIndex > 0) - call->state = RXRPC_CALL_SERVER_SECURING; + call->state = RXRPC_CALL_SERVER_SECURING; call->cong_tstamp = skb->tstamp; /* Set the channel for this call. We don't get channel_lock as we're diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c index 6e972b4823ef..64ace2960ecc 100644 --- a/net/rxrpc/conn_event.c +++ b/net/rxrpc/conn_event.c @@ -269,7 +269,7 @@ static void rxrpc_call_is_secure(struct rxrpc_call *call) if (call) { write_lock_bh(&call->state_lock); if (call->state == RXRPC_CALL_SERVER_SECURING) { - call->state = RXRPC_CALL_SERVER_ACCEPTING; + call->state = RXRPC_CALL_SERVER_RECV_REQUEST; rxrpc_notify_socket(call); } write_unlock_bh(&call->state_lock); diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index c4684dde1f16..2c842851d72e 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -178,37 +178,6 @@ static int rxrpc_recvmsg_term(struct rxrpc_call *call, struct msghdr *msg) return ret; } -/* - * Pass back notification of a new call. The call is added to the - * to-be-accepted list. This means that the next call to be accepted might not - * be the last call seen awaiting acceptance, but unless we leave this on the - * front of the queue and block all other messages until someone gives us a - * user_ID for it, there's not a lot we can do. - */ -static int rxrpc_recvmsg_new_call(struct rxrpc_sock *rx, - struct rxrpc_call *call, - struct msghdr *msg, int flags) -{ - int tmp = 0, ret; - - ret = put_cmsg(msg, SOL_RXRPC, RXRPC_NEW_CALL, 0, &tmp); - - if (ret == 0 && !(flags & MSG_PEEK)) { - _debug("to be accepted"); - write_lock_bh(&rx->recvmsg_lock); - list_del_init(&call->recvmsg_link); - write_unlock_bh(&rx->recvmsg_lock); - - rxrpc_get_call(call, rxrpc_call_got); - write_lock(&rx->call_lock); - list_add_tail(&call->accept_link, &rx->to_be_accepted); - write_unlock(&rx->call_lock); - } - - trace_rxrpc_recvmsg(call, rxrpc_recvmsg_to_be_accepted, 1, 0, 0, ret); - return ret; -} - /* * End the packet reception phase. */ @@ -630,9 +599,6 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, } switch (READ_ONCE(call->state)) { - case RXRPC_CALL_SERVER_ACCEPTING: - ret = rxrpc_recvmsg_new_call(rx, call, msg, flags); - break; case RXRPC_CALL_CLIENT_RECV_REPLY: case RXRPC_CALL_SERVER_RECV_REQUEST: case RXRPC_CALL_SERVER_ACK_REQUEST: @@ -728,7 +694,7 @@ int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call, call->debug_id, rxrpc_call_states[call->state], iov_iter_count(iter), want_more); - ASSERTCMP(call->state, !=, RXRPC_CALL_SERVER_ACCEPTING); + ASSERTCMP(call->state, !=, RXRPC_CALL_SERVER_SECURING); mutex_lock(&call->user_mutex); diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 0824e103d037..d27140c836cc 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -530,10 +530,10 @@ static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p) return -EINVAL; break; - case RXRPC_ACCEPT: + case RXRPC_CHARGE_ACCEPT: if (p->command != RXRPC_CMD_SEND_DATA) return -EINVAL; - p->command = RXRPC_CMD_ACCEPT; + p->command = RXRPC_CMD_CHARGE_ACCEPT; if (len != 0) return -EINVAL; break; @@ -659,16 +659,12 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) if (ret < 0) goto error_release_sock; - if (p.command == RXRPC_CMD_ACCEPT) { + if (p.command == RXRPC_CMD_CHARGE_ACCEPT) { ret = -EINVAL; if (rx->sk.sk_state != RXRPC_SERVER_LISTENING) goto error_release_sock; - call = rxrpc_accept_call(rx, p.call.user_call_ID, NULL); - /* The socket is now unlocked. */ - if (IS_ERR(call)) - return PTR_ERR(call); - ret = 0; - goto out_put_unlock; + ret = rxrpc_user_charge_accept(rx, p.call.user_call_ID); + goto error_release_sock; } call = rxrpc_find_call_by_user_ID(rx, p.call.user_call_ID); @@ -690,7 +686,6 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) case RXRPC_CALL_CLIENT_AWAIT_CONN: case RXRPC_CALL_SERVER_PREALLOC: case RXRPC_CALL_SERVER_SECURING: - case RXRPC_CALL_SERVER_ACCEPTING: rxrpc_put_call(call, rxrpc_call_put); ret = -EBUSY; goto error_release_sock; ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 5/6] rxrpc: The server keyring isn't network-namespaced 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells ` (3 preceding siblings ...) 2020-10-05 16:19 ` [PATCH net 4/6] rxrpc: Fix accept on a connection that need securing David Howells @ 2020-10-05 16:19 ` David Howells 2020-10-05 16:19 ` [PATCH net 6/6] rxrpc: Fix server keyring leak David Howells ` (2 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-05 16:19 UTC (permalink / raw) To: netdev; +Cc: dhowells, linux-afs, linux-kernel The keyring containing the server's tokens isn't network-namespaced, so it shouldn't be looked up with a network namespace. It is expected to be owned specifically by the server, so namespacing is unnecessary. Fixes: a58946c158a0 ("keys: Pass the network namespace into request_key mechanism") Signed-off-by: David Howells <dhowells@redhat.com> --- net/rxrpc/key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index c668e4b7dbff..75e84ed4fa63 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -940,7 +940,7 @@ int rxrpc_server_keyring(struct rxrpc_sock *rx, sockptr_t optval, int optlen) if (IS_ERR(description)) return PTR_ERR(description); - key = request_key_net(&key_type_keyring, description, sock_net(&rx->sk), NULL); + key = request_key(&key_type_keyring, description, NULL); if (IS_ERR(key)) { kfree(description); _leave(" = %ld", PTR_ERR(key)); ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 6/6] rxrpc: Fix server keyring leak 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells ` (4 preceding siblings ...) 2020-10-05 16:19 ` [PATCH net 5/6] rxrpc: The server keyring isn't network-namespaced David Howells @ 2020-10-05 16:19 ` David Howells 2020-10-06 13:19 ` [PATCH net 0/6] rxrpc: Miscellaneous fixes David Miller 2020-10-06 13:40 ` David Howells 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-05 16:19 UTC (permalink / raw) To: netdev; +Cc: dhowells, linux-afs, linux-kernel If someone calls setsockopt() twice to set a server key keyring, the first keyring is leaked. Fix it to return an error instead if the server key keyring is already set. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Signed-off-by: David Howells <dhowells@redhat.com> --- net/rxrpc/key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index 75e84ed4fa63..2e8bd3b97301 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -903,7 +903,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, sockptr_t optval, int optlen) _enter(""); - if (optlen <= 0 || optlen > PAGE_SIZE - 1) + if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities) return -EINVAL; description = memdup_sockptr_nul(optval, optlen); ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH net 0/6] rxrpc: Miscellaneous fixes 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells ` (5 preceding siblings ...) 2020-10-05 16:19 ` [PATCH net 6/6] rxrpc: Fix server keyring leak David Howells @ 2020-10-06 13:19 ` David Miller 2020-10-06 13:40 ` David Howells 7 siblings, 0 replies; 13+ messages in thread From: David Miller @ 2020-10-06 13:19 UTC (permalink / raw) To: dhowells; +Cc: netdev, marc.dionne, linux-afs, linux-kernel From: David Howells <dhowells@redhat.com> Date: Mon, 05 Oct 2020 17:18:44 +0100 > The patches are tagged here: > > git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git > rxrpc-fixes-20201005.txt I think the ".txt" at the end of the branch name is a mistake. It's really hard to send a clean working pull request isn't it? :-) Pulled, thanks David. ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH net 0/6] rxrpc: Miscellaneous fixes 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells ` (6 preceding siblings ...) 2020-10-06 13:19 ` [PATCH net 0/6] rxrpc: Miscellaneous fixes David Miller @ 2020-10-06 13:40 ` David Howells 7 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2020-10-06 13:40 UTC (permalink / raw) To: David Miller; +Cc: dhowells, netdev, marc.dionne, linux-afs, linux-kernel David Miller <davem@davemloft.net> wrote: > I think the ".txt" at the end of the branch name is a mistake. Sigh. That's the name of the file with the cover message in it (named for the tag). I need to adjust my script yet more to check not only that the tag name is in there, but that it also doesn't have any bits on the end. David ^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH net 0/6] rxrpc: Miscellaneous fixes
@ 2022-09-01 8:07 David Howells
2022-09-01 10:23 ` David Howells
0 siblings, 1 reply; 13+ messages in thread
From: David Howells @ 2022-09-01 8:07 UTC (permalink / raw)
To: netdev
Cc: Marc Dionne, linux-afs, Jeffrey E Altman, dhowells, linux-afs,
linux-kernel
Here are some fixes for AF_RXRPC:
(1) Fix the handling of ICMP/ICMP6 packets. This is a problem due to
rxrpc being switched to acting as a UDP tunnel, thereby allowing it to
steal the packets before they go through the UDP Rx queue. UDP
tunnels can't get ICMP/ICMP6 packets, however. This patch adds an
additional encap hook so that they can.
(2) Fix the encryption routines in rxkad to handle packets that have more
than three parts correctly. The problem is that ->nr_frags doesn't
count the initial fragment, so the sglist ends up too short.
(3) Fix a problem with destruction of the local endpoint potentially
getting repeated.
(4) Fix the calculation of the time at which to resend.
jiffies_to_usecs() gives microseconds, not nanoseconds.
(5) Fix AFS to work out when callback promises and locks expire based on
the time an op was issued rather than the time the first reply packet
arrives. We don't know how long the server took between calculating
the expiry interval and transmitting the reply.
(6) Given (5), rxrpc_get_reply_time() is no longer used, so remove it.
The patches are tagged here:
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git
rxrpc-fixes-20220831
and can also be found on the following branch:
https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes
Changes
=======
ver #2)
- Added some missing cpp-conditionals for rxrpc IPV6 support.
- Replaced the callback promise time calculation patch with one that used
the time of op issue rather than time of first reply packet as a base.
- Added an additional patch to remove the rxrpc function to retrieve the
time of first reply.
Link: http://lists.infradead.org/pipermail/linux-afs/2022-August/005547.html # v1
Link: http://lists.infradead.org/pipermail/linux-afs/2022-August/005552.html # v2
David
---
David Howells (6):
rxrpc: Fix ICMP/ICMP6 error handling
rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
rxrpc: Fix local destruction being repeated
rxrpc: Fix calc of resend age
afs: Use the operation issue time instead of the reply time for callbacks
rxrpc: Remove rxrpc_get_reply_time() which is no longer used
Documentation/networking/rxrpc.rst | 11 --
fs/afs/flock.c | 2 +-
fs/afs/fsclient.c | 2 +-
fs/afs/internal.h | 3 +-
fs/afs/rxrpc.c | 7 +-
fs/afs/yfsclient.c | 3 +-
include/linux/udp.h | 1 +
include/net/af_rxrpc.h | 2 -
include/net/udp_tunnel.h | 4 +
net/ipv4/udp.c | 2 +
net/ipv4/udp_tunnel_core.c | 1 +
net/ipv6/udp.c | 5 +-
net/rxrpc/ar-internal.h | 1 +
net/rxrpc/call_event.c | 2 +-
net/rxrpc/local_object.c | 4 +
net/rxrpc/peer_event.c | 291 +++++++++++++++++++++++++----
net/rxrpc/recvmsg.c | 43 -----
net/rxrpc/rxkad.c | 2 +-
18 files changed, 279 insertions(+), 107 deletions(-)
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH net 0/6] rxrpc: Miscellaneous fixes 2022-09-01 8:07 David Howells @ 2022-09-01 10:23 ` David Howells 0 siblings, 0 replies; 13+ messages in thread From: David Howells @ 2022-09-01 10:23 UTC (permalink / raw) To: netdev; +Cc: dhowells, Marc Dionne, linux-afs, Jeffrey E Altman, linux-kernel Please don't pull this. The kernel test robot spotted a bug in it. David ^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH net 0/6] rxrpc: Miscellaneous fixes
@ 2016-08-09 16:33 David Howells
2016-08-09 19:57 ` David Miller
0 siblings, 1 reply; 13+ messages in thread
From: David Howells @ 2016-08-09 16:33 UTC (permalink / raw)
To: netdev; +Cc: dhowells, linux-afs, linux-kernel
Hi Dave,
Here are a bunch of miscellaneous fixes to AF_RXRPC:
(*) Fix an uninitialised pointer.
(*) Fix error handling when we fail to connect a call.
(*) Fix a NULL pointer dereference.
(*) Fix two occasions where a packet is accessed again after being queued
for someone else to deal with.
(*) Fix a missing skb free.
---
The patches can be found here also:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes
Tagged thusly:
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git
rxrpc-fixes-20160809
David
---
Arnd Bergmann (1):
rxrpc: fix uninitialized pointer dereference in debug code
David Howells (5):
rxrpc: Need to flag call as being released on connect failure
rxrpc: Don't access connection from call if pointer is NULL
rxrpc: Once packet posted in data_ready, don't retry posting
rxrpc: Fix a use-after-push in data_ready handler
rxrpc: Free packets discarded in data_ready
net/rxrpc/call_event.c | 4 ++++
net/rxrpc/call_object.c | 3 +++
net/rxrpc/input.c | 27 ++++++++++++++++-----------
3 files changed, 23 insertions(+), 11 deletions(-)
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH net 0/6] rxrpc: Miscellaneous fixes 2016-08-09 16:33 David Howells @ 2016-08-09 19:57 ` David Miller 0 siblings, 0 replies; 13+ messages in thread From: David Miller @ 2016-08-09 19:57 UTC (permalink / raw) To: dhowells; +Cc: netdev, linux-afs, linux-kernel From: David Howells <dhowells@redhat.com> Date: Tue, 09 Aug 2016 17:33:12 +0100 > Here are a bunch of miscellaneous fixes to AF_RXRPC: > > (*) Fix an uninitialised pointer. > > (*) Fix error handling when we fail to connect a call. > > (*) Fix a NULL pointer dereference. > > (*) Fix two occasions where a packet is accessed again after being queued > for someone else to deal with. > > (*) Fix a missing skb free. > > --- > The patches can be found here also: > > http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes > > Tagged thusly: > > git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git > rxrpc-fixes-20160809 Pulled, thanks David. ^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2022-09-01 10:23 UTC | newest] Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-10-05 16:18 [PATCH net 0/6] rxrpc: Miscellaneous fixes David Howells 2020-10-05 16:18 ` [PATCH net 1/6] rxrpc: Fix rxkad token xdr encoding David Howells 2020-10-05 16:18 ` [PATCH net 2/6] rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() David Howells 2020-10-05 16:19 ` [PATCH net 3/6] rxrpc: Fix some missing _bh annotations on locking conn->state_lock David Howells 2020-10-05 16:19 ` [PATCH net 4/6] rxrpc: Fix accept on a connection that need securing David Howells 2020-10-05 16:19 ` [PATCH net 5/6] rxrpc: The server keyring isn't network-namespaced David Howells 2020-10-05 16:19 ` [PATCH net 6/6] rxrpc: Fix server keyring leak David Howells 2020-10-06 13:19 ` [PATCH net 0/6] rxrpc: Miscellaneous fixes David Miller 2020-10-06 13:40 ` David Howells -- strict thread matches above, loose matches on Subject: below -- 2022-09-01 8:07 David Howells 2022-09-01 10:23 ` David Howells 2016-08-09 16:33 David Howells 2016-08-09 19:57 ` David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).