net/netlink/genetlink.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * NETLINK      Generic Netlink Family
   4  *
   5  *              Authors:        Jamal Hadi Salim
   6  *                              Thomas Graf <[email protected]>
   7  *                              Johannes Berg <[email protected]>
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/kernel.h>
  12 #include <linux/slab.h>
  13 #include <linux/errno.h>
  14 #include <linux/types.h>
  15 #include <linux/socket.h>
  16 #include <linux/string.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/mutex.h>
  19 #include <linux/bitmap.h>
  20 #include <linux/rwsem.h>
  21 #include <linux/idr.h>
  22 #include <net/sock.h>
  23 #include <net/genetlink.h>
  24
  25 static DEFINE_MUTEX(genl_mutex); /* serialization of message processing */
  26 static DECLARE_RWSEM(cb_lock);
  27
  28 atomic_t genl_sk_destructing_cnt = ATOMIC_INIT(0);
  29 DECLARE_WAIT_QUEUE_HEAD(genl_sk_destructing_waitq);
  30
  31 void genl_lock(void)
  32 {
  33         mutex_lock(&genl_mutex);
  34 }
  35 EXPORT_SYMBOL(genl_lock);
  36
  37 void genl_unlock(void)
  38 {
  39         mutex_unlock(&genl_mutex);
  40 }
  41 EXPORT_SYMBOL(genl_unlock);
  42
  43 #ifdef CONFIG_LOCKDEP
  44 bool lockdep_genl_is_held(void)
  45 {
  46         return lockdep_is_held(&genl_mutex);
  47 }
  48 EXPORT_SYMBOL(lockdep_genl_is_held);
  49 #endif
  50
  51 static void genl_lock_all(void)
  52 {
  53         down_write(&cb_lock);
  54         genl_lock();
  55 }
  56
  57 static void genl_unlock_all(void)
  58 {
  59         genl_unlock();
  60         up_write(&cb_lock);
  61 }
  62
  63 static DEFINE_IDR(genl_fam_idr);
  64
  65 /*
  66  * Bitmap of multicast groups that are currently in use.
  67  *
  68  * To avoid an allocation at boot of just one unsigned long,
  69  * declare it global instead.
  70  * Bit 0 is marked as already used since group 0 is invalid.
  71  * Bit 1 is marked as already used since the drop-monitor code
  72  * abuses the API and thinks it can statically use group 1.
  73  * That group will typically conflict with other groups that
  74  * any proper users use.
  75  * Bit 16 is marked as used since it's used for generic netlink
  76  * and the code no longer marks pre-reserved IDs as used.
  77  * Bit 17 is marked as already used since the VFS quota code
  78  * also abused this API and relied on family == group ID, we
  79  * cater to that by giving it a static family and group ID.
  80  * Bit 18 is marked as already used since the PMCRAID driver
  81  * did the same thing as the VFS quota code (maybe copied?)
  82  */
  83 static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
  84                                       BIT(GENL_ID_VFS_DQUOT) |
  85                                       BIT(GENL_ID_PMCRAID);
  86 static unsigned long *mc_groups = &mc_group_start;
  87 static unsigned long mc_groups_longs = 1;
  88
  89 static int genl_ctrl_event(int event, const struct genl_family *family,
  90                            const struct genl_multicast_group *grp,
  91                            int grp_id);
  92
  93 static const struct genl_family *genl_family_find_byid(unsigned int id)
  94 {
  95         return idr_find(&genl_fam_idr, id);
  96 }
  97
  98 static const struct genl_family *genl_family_find_byname(char *name)
  99 {
 100         const struct genl_family *family;
 101         unsigned int id;
 102
 103         idr_for_each_entry(&genl_fam_idr, family, id)
 104                 if (strcmp(family->name, name) == 0)
 105                         return family;
 106
 107         return NULL;
 108 }
 109
 110 static const struct genl_ops *genl_get_cmd(u8 cmd,
 111                                            const struct genl_family *family)
 112 {
 113         int i;
 114
 115         for (i = 0; i < family->n_ops; i++)
 116                 if (family->ops[i].cmd == cmd)
 117                         return &family->ops[i];
 118
 119         return NULL;
 120 }
 121
 122 static int genl_allocate_reserve_groups(int n_groups, int *first_id)
 123 {
 124         unsigned long *new_groups;
 125         int start = 0;
 126         int i;
 127         int id;
 128         bool fits;
 129
 130         do {
 131                 if (start == 0)
 132                         id = find_first_zero_bit(mc_groups,
 133                                                  mc_groups_longs *
 134                                                  BITS_PER_LONG);
 135                 else
 136                         id = find_next_zero_bit(mc_groups,
 137                                                 mc_groups_longs * BITS_PER_LONG,
 138                                                 start);
 139
 140                 fits = true;
 141                 for (i = id;
 142                      i < min_t(int, id + n_groups,
 143                                mc_groups_longs * BITS_PER_LONG);
 144                      i++) {
 145                         if (test_bit(i, mc_groups)) {
 146                                 start = i;
 147                                 fits = false;
 148                                 break;
 149                         }
 150                 }
 151
 152                 if (id + n_groups > mc_groups_longs * BITS_PER_LONG) {
 153                         unsigned long new_longs = mc_groups_longs +
 154                                                   BITS_TO_LONGS(n_groups);
 155                         size_t nlen = new_longs * sizeof(unsigned long);
 156
 157                         if (mc_groups == &mc_group_start) {
 158                                 new_groups = kzalloc(nlen, GFP_KERNEL);
 159                                 if (!new_groups)
 160                                         return -ENOMEM;
 161                                 mc_groups = new_groups;
 162                                 *mc_groups = mc_group_start;
 163                         } else {
 164                                 new_groups = krealloc(mc_groups, nlen,
 165                                                       GFP_KERNEL);
 166                                 if (!new_groups)
 167                                         return -ENOMEM;
 168                                 mc_groups = new_groups;
 169                                 for (i = 0; i < BITS_TO_LONGS(n_groups); i++)
 170                                         mc_groups[mc_groups_longs + i] = 0;
 171                         }
 172                         mc_groups_longs = new_longs;
 173                 }
 174         } while (!fits);
 175
 176         for (i = id; i < id + n_groups; i++)
 177                 set_bit(i, mc_groups);
 178         *first_id = id;
 179         return 0;
 180 }
 181
 182 static struct genl_family genl_ctrl;
 183
 184 static int genl_validate_assign_mc_groups(struct genl_family *family)
 185 {
 186         int first_id;
 187         int n_groups = family->n_mcgrps;
 188         int err = 0, i;
 189         bool groups_allocated = false;
 190
 191         if (!n_groups)
 192                 return 0;
 193
 194         for (i = 0; i < n_groups; i++) {
 195                 const struct genl_multicast_group *grp = &family->mcgrps[i];
 196
 197                 if (WARN_ON(grp->name[0] == '\0'))
 198                         return -EINVAL;
 199                 if (WARN_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL))
 200                         return -EINVAL;
 201         }
 202
 203         /* special-case our own group and hacks */
 204         if (family == &genl_ctrl) {
 205                 first_id = GENL_ID_CTRL;
 206                 BUG_ON(n_groups != 1);
 207         } else if (strcmp(family->name, "NET_DM") == 0) {
 208                 first_id = 1;
 209                 BUG_ON(n_groups != 1);
 210         } else if (family->id == GENL_ID_VFS_DQUOT) {
 211                 first_id = GENL_ID_VFS_DQUOT;
 212                 BUG_ON(n_groups != 1);
 213         } else if (family->id == GENL_ID_PMCRAID) {
 214                 first_id = GENL_ID_PMCRAID;
 215                 BUG_ON(n_groups != 1);
 216         } else {
 217                 groups_allocated = true;
 218                 err = genl_allocate_reserve_groups(n_groups, &first_id);
 219                 if (err)
 220                         return err;
 221         }
 222
 223         family->mcgrp_offset = first_id;
 224
 225         /* if still initializing, can't and don't need to to realloc bitmaps */
 226         if (!init_net.genl_sock)
 227                 return 0;
 228
 229         if (family->netnsok) {
 230                 struct net *net;
 231
 232                 netlink_table_grab();
 233                 rcu_read_lock();
 234                 for_each_net_rcu(net) {
 235                         err = __netlink_change_ngroups(net->genl_sock,
 236                                         mc_groups_longs * BITS_PER_LONG);
 237                         if (err) {
 238                                 /*
 239                                  * No need to roll back, can only fail if
 240                                  * memory allocation fails and then the
 241                                  * number of _possible_ groups has been
 242                                  * increased on some sockets which is ok.
 243                                  */
 244                                 break;
 245                         }
 246                 }
 247                 rcu_read_unlock();
 248                 netlink_table_ungrab();
 249         } else {
 250                 err = netlink_change_ngroups(init_net.genl_sock,
 251                                              mc_groups_longs * BITS_PER_LONG);
 252         }
 253
 254         if (groups_allocated && err) {
 255                 for (i = 0; i < family->n_mcgrps; i++)
 256                         clear_bit(family->mcgrp_offset + i, mc_groups);
 257         }
 258
 259         return err;
 260 }
 261
 262 static void genl_unregister_mc_groups(const struct genl_family *family)
 263 {
 264         struct net *net;
 265         int i;
 266
 267         netlink_table_grab();
 268         rcu_read_lock();
 269         for_each_net_rcu(net) {
 270                 for (i = 0; i < family->n_mcgrps; i++)
 271                         __netlink_clear_multicast_users(
 272                                 net->genl_sock, family->mcgrp_offset + i);
 273         }
 274         rcu_read_unlock();
 275         netlink_table_ungrab();
 276
 277         for (i = 0; i < family->n_mcgrps; i++) {
 278                 int grp_id = family->mcgrp_offset + i;
 279
 280                 if (grp_id != 1)
 281                         clear_bit(grp_id, mc_groups);
 282                 genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, family,
 283                                 &family->mcgrps[i], grp_id);
 284         }
 285 }
 286
 287 static int genl_validate_ops(const struct genl_family *family)
 288 {
 289         const struct genl_ops *ops = family->ops;
 290         unsigned int n_ops = family->n_ops;
 291         int i, j;
 292
 293         if (WARN_ON(n_ops && !ops))
 294                 return -EINVAL;
 295
 296         if (!n_ops)
 297                 return 0;
 298
 299         for (i = 0; i < n_ops; i++) {
 300                 if (ops[i].dumpit == NULL && ops[i].doit == NULL)
 301                         return -EINVAL;
 302                 for (j = i + 1; j < n_ops; j++)
 303                         if (ops[i].cmd == ops[j].cmd)
 304                                 return -EINVAL;
 305         }
 306
 307         return 0;
 308 }
 309
 310 /**
 311  * genl_register_family - register a generic netlink family
 312  * @family: generic netlink family
 313  *
 314  * Registers the specified family after validating it first. Only one
 315  * family may be registered with the same family name or identifier.
 316  *
 317  * The family's ops, multicast groups and module pointer must already
 318  * be assigned.
 319  *
 320  * Return 0 on success or a negative error code.
 321  */
 322 int genl_register_family(struct genl_family *family)
 323 {
 324         int err, i;
 325         int start = GENL_START_ALLOC, end = GENL_MAX_ID;
 326
 327         err = genl_validate_ops(family);
 328         if (err)
 329                 return err;
 330
 331         genl_lock_all();
 332
 333         if (genl_family_find_byname(family->name)) {
 334                 err = -EEXIST;
 335                 goto errout_locked;
 336         }
 337
 338         /*
 339          * Sadly, a few cases need to be special-cased
 340          * due to them having previously abused the API
 341          * and having used their family ID also as their
 342          * multicast group ID, so we use reserved IDs
 343          * for both to be sure we can do that mapping.
 344          */
 345         if (family == &genl_ctrl) {
 346                 /* and this needs to be special for initial family lookups */
 347                 start = end = GENL_ID_CTRL;
 348         } else if (strcmp(family->name, "pmcraid") == 0) {
 349                 start = end = GENL_ID_PMCRAID;
 350         } else if (strcmp(family->name, "VFS_DQUOT") == 0) {
 351                 start = end = GENL_ID_VFS_DQUOT;
 352         }
 353
 354         if (family->maxattr && !family->parallel_ops) {
 355                 family->attrbuf = kmalloc_array(family->maxattr + 1,
 356                                                 sizeof(struct nlattr *),
 357                                                 GFP_KERNEL);
 358                 if (family->attrbuf == NULL) {
 359                         err = -ENOMEM;
 360                         goto errout_locked;
 361                 }
 362         } else
 363                 family->attrbuf = NULL;
 364
 365         family->id = idr_alloc_cyclic(&genl_fam_idr, family,
 366                                       start, end + 1, GFP_KERNEL);
 367         if (family->id < 0) {
 368                 err = family->id;
 369                 goto errout_free;
 370         }
 371
 372         err = genl_validate_assign_mc_groups(family);
 373         if (err)
 374                 goto errout_remove;
 375
 376         genl_unlock_all();
 377
 378         /* send all events */
 379         genl_ctrl_event(CTRL_CMD_NEWFAMILY, family, NULL, 0);
 380         for (i = 0; i < family->n_mcgrps; i++)
 381                 genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, family,
 382                                 &family->mcgrps[i], family->mcgrp_offset + i);
 383
 384         return 0;
 385
 386 errout_remove:
 387         idr_remove(&genl_fam_idr, family->id);
 388 errout_free:
 389         kfree(family->attrbuf);
 390 errout_locked:
 391         genl_unlock_all();
 392         return err;
 393 }
 394 EXPORT_SYMBOL(genl_register_family);
 395
 396 /**
 397  * genl_unregister_family - unregister generic netlink family
 398  * @family: generic netlink family
 399  *
 400  * Unregisters the specified family.
 401  *
 402  * Returns 0 on success or a negative error code.
 403  */
 404 int genl_unregister_family(const struct genl_family *family)
 405 {
 406         genl_lock_all();
 407
 408         if (!genl_family_find_byid(family->id)) {
 409                 genl_unlock_all();
 410                 return -ENOENT;
 411         }
 412
 413         genl_unregister_mc_groups(family);
 414
 415         idr_remove(&genl_fam_idr, family->id);
 416
 417         up_write(&cb_lock);
 418         wait_event(genl_sk_destructing_waitq,
 419                    atomic_read(&genl_sk_destructing_cnt) == 0);
 420         genl_unlock();
 421
 422         kfree(family->attrbuf);
 423
 424         genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
 425
 426         return 0;
 427 }
 428 EXPORT_SYMBOL(genl_unregister_family);
 429
 430 /**
 431  * genlmsg_put - Add generic netlink header to netlink message
 432  * @skb: socket buffer holding the message
 433  * @portid: netlink portid the message is addressed to
 434  * @seq: sequence number (usually the one of the sender)
 435  * @family: generic netlink family
 436  * @flags: netlink message flags
 437  * @cmd: generic netlink command
 438  *
 439  * Returns pointer to user specific header
 440  */
 441 void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
 442                   const struct genl_family *family, int flags, u8 cmd)
 443 {
 444         struct nlmsghdr *nlh;
 445         struct genlmsghdr *hdr;
 446
 447         nlh = nlmsg_put(skb, portid, seq, family->id, GENL_HDRLEN +
 448                         family->hdrsize, flags);
 449         if (nlh == NULL)
 450                 return NULL;
 451
 452         hdr = nlmsg_data(nlh);
 453         hdr->cmd = cmd;
 454         hdr->version = family->version;
 455         hdr->reserved = 0;
 456
 457         return (char *) hdr + GENL_HDRLEN;
 458 }
 459 EXPORT_SYMBOL(genlmsg_put);
 460
 461 static struct genl_dumpit_info *genl_dumpit_info_alloc(void)
 462 {
 463         return kmalloc(sizeof(struct genl_dumpit_info), GFP_KERNEL);
 464 }
 465
 466 static void genl_dumpit_info_free(const struct genl_dumpit_info *info)
 467 {
 468         kfree(info);
 469 }
 470
 471 static struct nlattr **
 472 genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
 473                                 struct nlmsghdr *nlh,
 474                                 struct netlink_ext_ack *extack,
 475                                 const struct genl_ops *ops,
 476                                 int hdrlen,
 477                                 enum genl_validate_flags no_strict_flag,
 478                                 bool parallel)
 479 {
 480         enum netlink_validation validate = ops->validate & no_strict_flag ?
 481                                            NL_VALIDATE_LIBERAL :
 482                                            NL_VALIDATE_STRICT;
 483         struct nlattr **attrbuf;
 484         int err;
 485
 486         if (!family->maxattr)
 487                 return NULL;
 488
 489         if (parallel) {
 490                 attrbuf = kmalloc_array(family->maxattr + 1,
 491                                         sizeof(struct nlattr *), GFP_KERNEL);
 492                 if (!attrbuf)
 493                         return ERR_PTR(-ENOMEM);
 494         } else {
 495                 attrbuf = family->attrbuf;
 496         }
 497
 498         err = __nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr,
 499                             family->policy, validate, extack);
 500         if (err) {
 501                 if (parallel)
 502                         kfree(attrbuf);
 503                 return ERR_PTR(err);
 504         }
 505         return attrbuf;
 506 }
 507
 508 static void genl_family_rcv_msg_attrs_free(const struct genl_family *family,
 509                                            struct nlattr **attrbuf,
 510                                            bool parallel)
 511 {
 512         if (parallel)
 513                 kfree(attrbuf);
 514 }
 515
 516 static int genl_lock_start(struct netlink_callback *cb)
 517 {
 518         const struct genl_ops *ops = genl_dumpit_info(cb)->ops;
 519         int rc = 0;
 520
 521         if (ops->start) {
 522                 genl_lock();
 523                 rc = ops->start(cb);
 524                 genl_unlock();
 525         }
 526         return rc;
 527 }
 528
 529 static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 530 {
 531         const struct genl_ops *ops = genl_dumpit_info(cb)->ops;
 532         int rc;
 533
 534         genl_lock();
 535         rc = ops->dumpit(skb, cb);
 536         genl_unlock();
 537         return rc;
 538 }
 539
 540 static int genl_lock_done(struct netlink_callback *cb)
 541 {
 542         const struct genl_dumpit_info *info = genl_dumpit_info(cb);
 543         const struct genl_ops *ops = info->ops;
 544         int rc = 0;
 545
 546         if (ops->done) {
 547                 genl_lock();
 548                 rc = ops->done(cb);
 549                 genl_unlock();
 550         }
 551         genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
 552         genl_dumpit_info_free(info);
 553         return rc;
 554 }
 555
 556 static int genl_parallel_done(struct netlink_callback *cb)
 557 {
 558         const struct genl_dumpit_info *info = genl_dumpit_info(cb);
 559         const struct genl_ops *ops = info->ops;
 560         int rc = 0;
 561
 562         if (ops->done)
 563                 rc = ops->done(cb);
 564         genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
 565         genl_dumpit_info_free(info);
 566         return rc;
 567 }
 568
 569 static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
 570                                       struct sk_buff *skb,
 571                                       struct nlmsghdr *nlh,
 572                                       struct netlink_ext_ack *extack,
 573                                       const struct genl_ops *ops,
 574                                       int hdrlen, struct net *net)
 575 {
 576         struct genl_dumpit_info *info;
 577         struct nlattr **attrs = NULL;
 578         int err;
 579
 580         if (!ops->dumpit)
 581                 return -EOPNOTSUPP;
 582
 583         if (ops->validate & GENL_DONT_VALIDATE_DUMP)
 584                 goto no_attrs;
 585
 586         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
 587                 return -EINVAL;
 588
 589         attrs = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
 590                                                 ops, hdrlen,
 591                                                 GENL_DONT_VALIDATE_DUMP_STRICT,
 592                                                 true);
 593         if (IS_ERR(attrs))
 594                 return PTR_ERR(attrs);
 595
 596 no_attrs:
 597         /* Allocate dumpit info. It is going to be freed by done() callback. */
 598         info = genl_dumpit_info_alloc();
 599         if (!info) {
 600                 genl_family_rcv_msg_attrs_free(family, attrs, true);
 601                 return -ENOMEM;
 602         }
 603
 604         info->family = family;
 605         info->ops = ops;
 606         info->attrs = attrs;
 607
 608         if (!family->parallel_ops) {
 609                 struct netlink_dump_control c = {
 610                         .module = family->module,
 611                         .data = info,
 612                         .start = genl_lock_start,
 613                         .dump = genl_lock_dumpit,
 614                         .done = genl_lock_done,
 615                 };
 616
 617                 genl_unlock();
 618                 err = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
 619                 genl_lock();
 620
 621         } else {
 622                 struct netlink_dump_control c = {
 623                         .module = family->module,
 624                         .data = info,
 625                         .start = ops->start,
 626                         .dump = ops->dumpit,
 627                         .done = genl_parallel_done,
 628                 };
 629
 630                 err = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
 631         }
 632
 633         return err;
 634 }
 635
 636 static int genl_family_rcv_msg_doit(const struct genl_family *family,
 637                                     struct sk_buff *skb,
 638                                     struct nlmsghdr *nlh,
 639                                     struct netlink_ext_ack *extack,
 640                                     const struct genl_ops *ops,
 641                                     int hdrlen, struct net *net)
 642 {
 643         struct nlattr **attrbuf;
 644         struct genl_info info;
 645         int err;
 646
 647         if (!ops->doit)
 648                 return -EOPNOTSUPP;
 649
 650         attrbuf = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
 651                                                   ops, hdrlen,
 652                                                   GENL_DONT_VALIDATE_STRICT,
 653                                                   family->parallel_ops);
 654         if (IS_ERR(attrbuf))
 655                 return PTR_ERR(attrbuf);
 656
 657         info.snd_seq = nlh->nlmsg_seq;
 658         info.snd_portid = NETLINK_CB(skb).portid;
 659         info.nlhdr = nlh;
 660         info.genlhdr = nlmsg_data(nlh);
 661         info.userhdr = nlmsg_data(nlh) + GENL_HDRLEN;
 662         info.attrs = attrbuf;
 663         info.extack = extack;
 664         genl_info_net_set(&info, net);
 665         memset(&info.user_ptr, 0, sizeof(info.user_ptr));
 666
 667         if (family->pre_doit) {
 668                 err = family->pre_doit(ops, skb, &info);
 669                 if (err)
 670                         goto out;
 671         }
 672
 673         err = ops->doit(skb, &info);
 674
 675         if (family->post_doit)
 676                 family->post_doit(ops, skb, &info);
 677
 678 out:
 679         genl_family_rcv_msg_attrs_free(family, attrbuf, family->parallel_ops);
 680
 681         return err;
 682 }
 683
 684 static int genl_family_rcv_msg(const struct genl_family *family,
 685                                struct sk_buff *skb,
 686                                struct nlmsghdr *nlh,
 687                                struct netlink_ext_ack *extack)
 688 {
 689         const struct genl_ops *ops;
 690         struct net *net = sock_net(skb->sk);
 691         struct genlmsghdr *hdr = nlmsg_data(nlh);
 692         int hdrlen;
 693
 694         /* this family doesn't exist in this netns */
 695         if (!family->netnsok && !net_eq(net, &init_net))
 696                 return -ENOENT;
 697
 698         hdrlen = GENL_HDRLEN + family->hdrsize;
 699         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
 700                 return -EINVAL;
 701
 702         ops = genl_get_cmd(hdr->cmd, family);
 703         if (ops == NULL)
 704                 return -EOPNOTSUPP;
 705
 706         if ((ops->flags & GENL_ADMIN_PERM) &&
 707             !netlink_capable(skb, CAP_NET_ADMIN))
 708                 return -EPERM;
 709
 710         if ((ops->flags & GENL_UNS_ADMIN_PERM) &&
 711             !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
 712                 return -EPERM;
 713
 714         if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP)
 715                 return genl_family_rcv_msg_dumpit(family, skb, nlh, extack,
 716                                                   ops, hdrlen, net);
 717         else
 718                 return genl_family_rcv_msg_doit(family, skb, nlh, extack,
 719                                                 ops, hdrlen, net);
 720 }
 721
 722 static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 723                         struct netlink_ext_ack *extack)
 724 {
 725         const struct genl_family *family;
 726         int err;
 727
 728         family = genl_family_find_byid(nlh->nlmsg_type);
 729         if (family == NULL)
 730                 return -ENOENT;
 731
 732         if (!family->parallel_ops)
 733                 genl_lock();
 734
 735         err = genl_family_rcv_msg(family, skb, nlh, extack);
 736
 737         if (!family->parallel_ops)
 738                 genl_unlock();
 739
 740         return err;
 741 }
 742
 743 static void genl_rcv(struct sk_buff *skb)
 744 {
 745         down_read(&cb_lock);
 746         netlink_rcv_skb(skb, &genl_rcv_msg);
 747         up_read(&cb_lock);
 748 }
 749
 750 /**************************************************************************
 751  * Controller
 752  **************************************************************************/
 753
 754 static struct genl_family genl_ctrl;
 755
 756 static int ctrl_fill_info(const struct genl_family *family, u32 portid, u32 seq,
 757                           u32 flags, struct sk_buff *skb, u8 cmd)
 758 {
 759         void *hdr;
 760
 761         hdr = genlmsg_put(skb, portid, seq, &genl_ctrl, flags, cmd);
 762         if (hdr == NULL)
 763                 return -1;
 764
 765         if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
 766             nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id) ||
 767             nla_put_u32(skb, CTRL_ATTR_VERSION, family->version) ||
 768             nla_put_u32(skb, CTRL_ATTR_HDRSIZE, family->hdrsize) ||
 769             nla_put_u32(skb, CTRL_ATTR_MAXATTR, family->maxattr))
 770                 goto nla_put_failure;
 771
 772         if (family->n_ops) {
 773                 struct nlattr *nla_ops;
 774                 int i;
 775
 776                 nla_ops = nla_nest_start_noflag(skb, CTRL_ATTR_OPS);
 777                 if (nla_ops == NULL)
 778                         goto nla_put_failure;
 779
 780                 for (i = 0; i < family->n_ops; i++) {
 781                         struct nlattr *nest;
 782                         const struct genl_ops *ops = &family->ops[i];
 783                         u32 op_flags = ops->flags;
 784
 785                         if (ops->dumpit)
 786                                 op_flags |= GENL_CMD_CAP_DUMP;
 787                         if (ops->doit)
 788                                 op_flags |= GENL_CMD_CAP_DO;
 789                         if (family->policy)
 790                                 op_flags |= GENL_CMD_CAP_HASPOL;
 791
 792                         nest = nla_nest_start_noflag(skb, i + 1);
 793                         if (nest == NULL)
 794                                 goto nla_put_failure;
 795
 796                         if (nla_put_u32(skb, CTRL_ATTR_OP_ID, ops->cmd) ||
 797                             nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, op_flags))
 798                                 goto nla_put_failure;
 799
 800                         nla_nest_end(skb, nest);
 801                 }
 802
 803                 nla_nest_end(skb, nla_ops);
 804         }
 805
 806         if (family->n_mcgrps) {
 807                 struct nlattr *nla_grps;
 808                 int i;
 809
 810                 nla_grps = nla_nest_start_noflag(skb, CTRL_ATTR_MCAST_GROUPS);
 811                 if (nla_grps == NULL)
 812                         goto nla_put_failure;
 813
 814                 for (i = 0; i < family->n_mcgrps; i++) {
 815                         struct nlattr *nest;
 816                         const struct genl_multicast_group *grp;
 817
 818                         grp = &family->mcgrps[i];
 819
 820                         nest = nla_nest_start_noflag(skb, i + 1);
 821                         if (nest == NULL)
 822                                 goto nla_put_failure;
 823
 824                         if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID,
 825                                         family->mcgrp_offset + i) ||
 826                             nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
 827                                            grp->name))
 828                                 goto nla_put_failure;
 829
 830                         nla_nest_end(skb, nest);
 831                 }
 832                 nla_nest_end(skb, nla_grps);
 833         }
 834
 835         genlmsg_end(skb, hdr);
 836         return 0;
 837
 838 nla_put_failure:
 839         genlmsg_cancel(skb, hdr);
 840         return -EMSGSIZE;
 841 }
 842
 843 static int ctrl_fill_mcgrp_info(const struct genl_family *family,
 844                                 const struct genl_multicast_group *grp,
 845                                 int grp_id, u32 portid, u32 seq, u32 flags,
 846                                 struct sk_buff *skb, u8 cmd)
 847 {
 848         void *hdr;
 849         struct nlattr *nla_grps;
 850         struct nlattr *nest;
 851
 852         hdr = genlmsg_put(skb, portid, seq, &genl_ctrl, flags, cmd);
 853         if (hdr == NULL)
 854                 return -1;
 855
 856         if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
 857             nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id))
 858                 goto nla_put_failure;
 859
 860         nla_grps = nla_nest_start_noflag(skb, CTRL_ATTR_MCAST_GROUPS);
 861         if (nla_grps == NULL)
 862                 goto nla_put_failure;
 863
 864         nest = nla_nest_start_noflag(skb, 1);
 865         if (nest == NULL)
 866                 goto nla_put_failure;
 867
 868         if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp_id) ||
 869             nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
 870                            grp->name))
 871                 goto nla_put_failure;
 872
 873         nla_nest_end(skb, nest);
 874         nla_nest_end(skb, nla_grps);
 875
 876         genlmsg_end(skb, hdr);
 877         return 0;
 878
 879 nla_put_failure:
 880         genlmsg_cancel(skb, hdr);
 881         return -EMSGSIZE;
 882 }
 883
 884 static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
 885 {
 886         int n = 0;
 887         struct genl_family *rt;
 888         struct net *net = sock_net(skb->sk);
 889         int fams_to_skip = cb->args[0];
 890         unsigned int id;
 891
 892         idr_for_each_entry(&genl_fam_idr, rt, id) {
 893                 if (!rt->netnsok && !net_eq(net, &init_net))
 894                         continue;
 895
 896                 if (n++ < fams_to_skip)
 897                         continue;
 898
 899                 if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).portid,
 900                                    cb->nlh->nlmsg_seq, NLM_F_MULTI,
 901                                    skb, CTRL_CMD_NEWFAMILY) < 0) {
 902                         n--;
 903                         break;
 904                 }
 905         }
 906
 907         cb->args[0] = n;
 908         return skb->len;
 909 }
 910
 911 static struct sk_buff *ctrl_build_family_msg(const struct genl_family *family,
 912                                              u32 portid, int seq, u8 cmd)
 913 {
 914         struct sk_buff *skb;
 915         int err;
 916
 917         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 918         if (skb == NULL)
 919                 return ERR_PTR(-ENOBUFS);
 920
 921         err = ctrl_fill_info(family, portid, seq, 0, skb, cmd);
 922         if (err < 0) {
 923                 nlmsg_free(skb);
 924                 return ERR_PTR(err);
 925         }
 926
 927         return skb;
 928 }
 929
 930 static struct sk_buff *
 931 ctrl_build_mcgrp_msg(const struct genl_family *family,
 932                      const struct genl_multicast_group *grp,
 933                      int grp_id, u32 portid, int seq, u8 cmd)
 934 {
 935         struct sk_buff *skb;
 936         int err;
 937
 938         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 939         if (skb == NULL)
 940                 return ERR_PTR(-ENOBUFS);
 941
 942         err = ctrl_fill_mcgrp_info(family, grp, grp_id, portid,
 943                                    seq, 0, skb, cmd);
 944         if (err < 0) {
 945                 nlmsg_free(skb);
 946                 return ERR_PTR(err);
 947         }
 948
 949         return skb;
 950 }
 951
 952 static const struct nla_policy ctrl_policy[CTRL_ATTR_MAX+1] = {
 953         [CTRL_ATTR_FAMILY_ID]   = { .type = NLA_U16 },
 954         [CTRL_ATTR_FAMILY_NAME] = { .type = NLA_NUL_STRING,
 955                                     .len = GENL_NAMSIZ - 1 },
 956 };
 957
 958 static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 959 {
 960         struct sk_buff *msg;
 961         const struct genl_family *res = NULL;
 962         int err = -EINVAL;
 963
 964         if (info->attrs[CTRL_ATTR_FAMILY_ID]) {
 965                 u16 id = nla_get_u16(info->attrs[CTRL_ATTR_FAMILY_ID]);
 966                 res = genl_family_find_byid(id);
 967                 err = -ENOENT;
 968         }
 969
 970         if (info->attrs[CTRL_ATTR_FAMILY_NAME]) {
 971                 char *name;
 972
 973                 name = nla_data(info->attrs[CTRL_ATTR_FAMILY_NAME]);
 974                 res = genl_family_find_byname(name);
 975 #ifdef CONFIG_MODULES
 976                 if (res == NULL) {
 977                         genl_unlock();
 978                         up_read(&cb_lock);
 979                         request_module("net-pf-%d-proto-%d-family-%s",
 980                                        PF_NETLINK, NETLINK_GENERIC, name);
 981                         down_read(&cb_lock);
 982                         genl_lock();
 983                         res = genl_family_find_byname(name);
 984                 }
 985 #endif
 986                 err = -ENOENT;
 987         }
 988
 989         if (res == NULL)
 990                 return err;
 991
 992         if (!res->netnsok && !net_eq(genl_info_net(info), &init_net)) {
 993                 /* family doesn't exist here */
 994                 return -ENOENT;
 995         }
 996
 997         msg = ctrl_build_family_msg(res, info->snd_portid, info->snd_seq,
 998                                     CTRL_CMD_NEWFAMILY);
 999         if (IS_ERR(msg))
1000                 return PTR_ERR(msg);
1001
1002         return genlmsg_reply(msg, info);
1003 }
1004
1005 static int genl_ctrl_event(int event, const struct genl_family *family,
1006                            const struct genl_multicast_group *grp,
1007                            int grp_id)
1008 {
1009         struct sk_buff *msg;
1010
1011         /* genl is still initialising */
1012         if (!init_net.genl_sock)
1013                 return 0;
1014
1015         switch (event) {
1016         case CTRL_CMD_NEWFAMILY:
1017         case CTRL_CMD_DELFAMILY:
1018                 WARN_ON(grp);
1019                 msg = ctrl_build_family_msg(family, 0, 0, event);
1020                 break;
1021         case CTRL_CMD_NEWMCAST_GRP:
1022         case CTRL_CMD_DELMCAST_GRP:
1023                 BUG_ON(!grp);
1024                 msg = ctrl_build_mcgrp_msg(family, grp, grp_id, 0, 0, event);
1025                 break;
1026         default:
1027                 return -EINVAL;
1028         }
1029
1030         if (IS_ERR(msg))
1031                 return PTR_ERR(msg);
1032
1033         if (!family->netnsok) {
1034                 genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
1035                                         0, GFP_KERNEL);
1036         } else {
1037                 rcu_read_lock();
1038                 genlmsg_multicast_allns(&genl_ctrl, msg, 0,
1039                                         0, GFP_ATOMIC);
1040                 rcu_read_unlock();
1041         }
1042
1043         return 0;
1044 }
1045
1046 static const struct genl_ops genl_ctrl_ops[] = {
1047         {
1048                 .cmd            = CTRL_CMD_GETFAMILY,
1049                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1050                 .doit           = ctrl_getfamily,
1051                 .dumpit         = ctrl_dumpfamily,
1052         },
1053 };
1054
1055 static const struct genl_multicast_group genl_ctrl_groups[] = {
1056         { .name = "notify", },
1057 };
1058
1059 static struct genl_family genl_ctrl __ro_after_init = {
1060         .module = THIS_MODULE,
1061         .ops = genl_ctrl_ops,
1062         .n_ops = ARRAY_SIZE(genl_ctrl_ops),
1063         .mcgrps = genl_ctrl_groups,
1064         .n_mcgrps = ARRAY_SIZE(genl_ctrl_groups),
1065         .id = GENL_ID_CTRL,
1066         .name = "nlctrl",
1067         .version = 0x2,
1068         .maxattr = CTRL_ATTR_MAX,
1069         .policy = ctrl_policy,
1070         .netnsok = true,
1071 };
1072
1073 static int genl_bind(struct net *net, int group)
1074 {
1075         struct genl_family *f;
1076         int err = -ENOENT;
1077         unsigned int id;
1078
1079         down_read(&cb_lock);
1080
1081         idr_for_each_entry(&genl_fam_idr, f, id) {
1082                 if (group >= f->mcgrp_offset &&
1083                     group < f->mcgrp_offset + f->n_mcgrps) {
1084                         int fam_grp = group - f->mcgrp_offset;
1085
1086                         if (!f->netnsok && net != &init_net)
1087                                 err = -ENOENT;
1088                         else if (f->mcast_bind)
1089                                 err = f->mcast_bind(net, fam_grp);
1090                         else
1091                                 err = 0;
1092                         break;
1093                 }
1094         }
1095         up_read(&cb_lock);
1096
1097         return err;
1098 }
1099
1100 static void genl_unbind(struct net *net, int group)
1101 {
1102         struct genl_family *f;
1103         unsigned int id;
1104
1105         down_read(&cb_lock);
1106
1107         idr_for_each_entry(&genl_fam_idr, f, id) {
1108                 if (group >= f->mcgrp_offset &&
1109                     group < f->mcgrp_offset + f->n_mcgrps) {
1110                         int fam_grp = group - f->mcgrp_offset;
1111
1112                         if (f->mcast_unbind)
1113                                 f->mcast_unbind(net, fam_grp);
1114                         break;
1115                 }
1116         }
1117         up_read(&cb_lock);
1118 }
1119
1120 static int __net_init genl_pernet_init(struct net *net)
1121 {
1122         struct netlink_kernel_cfg cfg = {
1123                 .input          = genl_rcv,
1124                 .flags          = NL_CFG_F_NONROOT_RECV,
1125                 .bind           = genl_bind,
1126                 .unbind         = genl_unbind,
1127         };
1128
1129         /* we'll bump the group number right afterwards */
1130         net->genl_sock = netlink_kernel_create(net, NETLINK_GENERIC, &cfg);
1131
1132         if (!net->genl_sock && net_eq(net, &init_net))
1133                 panic("GENL: Cannot initialize generic netlink\n");
1134
1135         if (!net->genl_sock)
1136                 return -ENOMEM;
1137
1138         return 0;
1139 }
1140
1141 static void __net_exit genl_pernet_exit(struct net *net)
1142 {
1143         netlink_kernel_release(net->genl_sock);
1144         net->genl_sock = NULL;
1145 }
1146
1147 static struct pernet_operations genl_pernet_ops = {
1148         .init = genl_pernet_init,
1149         .exit = genl_pernet_exit,
1150 };
1151
1152 static int __init genl_init(void)
1153 {
1154         int err;
1155
1156         err = genl_register_family(&genl_ctrl);
1157         if (err < 0)
1158                 goto problem;
1159
1160         err = register_pernet_subsys(&genl_pernet_ops);
1161         if (err)
1162                 goto problem;
1163
1164         return 0;
1165
1166 problem:
1167         panic("GENL: Cannot register controller: %d\n", err);
1168 }
1169
1170 subsys_initcall(genl_init);
1171
1172 static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
1173                          gfp_t flags)
1174 {
1175         struct sk_buff *tmp;
1176         struct net *net, *prev = NULL;
1177         bool delivered = false;
1178         int err;
1179
1180         for_each_net_rcu(net) {
1181                 if (prev) {
1182                         tmp = skb_clone(skb, flags);
1183                         if (!tmp) {
1184                                 err = -ENOMEM;
1185                                 goto error;
1186                         }
1187                         err = nlmsg_multicast(prev->genl_sock, tmp,
1188                                               portid, group, flags);
1189                         if (!err)
1190                                 delivered = true;
1191                         else if (err != -ESRCH)
1192                                 goto error;
1193                 }
1194
1195                 prev = net;
1196         }
1197
1198         err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
1199         if (!err)
1200                 delivered = true;
1201         else if (err != -ESRCH)
1202                 return err;
1203         return delivered ? 0 : -ESRCH;
1204  error:
1205         kfree_skb(skb);
1206         return err;
1207 }
1208
1209 int genlmsg_multicast_allns(const struct genl_family *family,
1210                             struct sk_buff *skb, u32 portid,
1211                             unsigned int group, gfp_t flags)
1212 {
1213         if (WARN_ON_ONCE(group >= family->n_mcgrps))
1214                 return -EINVAL;
1215         group = family->mcgrp_offset + group;
1216         return genlmsg_mcast(skb, portid, group, flags);
1217 }
1218 EXPORT_SYMBOL(genlmsg_multicast_allns);
1219
1220 void genl_notify(const struct genl_family *family, struct sk_buff *skb,
1221                  struct genl_info *info, u32 group, gfp_t flags)
1222 {
1223         struct net *net = genl_info_net(info);
1224         struct sock *sk = net->genl_sock;
1225         int report = 0;
1226
1227         if (info->nlhdr)
1228                 report = nlmsg_report(info->nlhdr);
1229
1230         if (WARN_ON_ONCE(group >= family->n_mcgrps))
1231                 return;
1232         group = family->mcgrp_offset + group;
1233         nlmsg_notify(sk, skb, info->snd_portid, group, report, flags);
1234 }
1235 EXPORT_SYMBOL(genl_notify);