| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 1 Oct 2008 11:22:35 +0300
From: Remi Denis-Courmont <remi.denis-courmont@...ia.com>
To: netdev@...r.kernel.org
Cc: Rémi Denis-Courmont
<remi.denis-courmont@...ia.com>
Subject: [PATCH 2/4] Phonet: receive pipe control request as out-of-band data
From: Rémi Denis-Courmont <remi.denis-courmont@...ia.com>
Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@...ia.com>
---
include/net/phonet/pep.h | 2 +
net/phonet/pep.c | 68 +++++++++++++++++++++++++++++++++-------------
net/phonet/socket.c | 4 ++-
3 files changed, 54 insertions(+), 20 deletions(-)
diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
index 6b89d12..b06852b 100644
--- a/include/net/phonet/pep.h
+++ b/include/net/phonet/pep.h
@@ -33,6 +33,8 @@ struct pep_sock {
/* Connected socket stuff: */
struct sock *listener;
+ struct sk_buff_head ctrlreq_queue;
+#define PNPIPE_CTRLREQ_MAX 10
u16 peer_type; /* peer type/subtype */
u8 pipe_handle;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 1588bb3..6bf3d0b 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -142,14 +142,15 @@ static int pep_reject_conn(struct sock *sk, struct sk_buff *skb, u8 code)
/* Control requests are not sent by the pipe service and have a specific
* message format. */
-static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code)
+static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
+ gfp_t priority)
{
const struct pnpipehdr *oph = pnp_hdr(oskb);
struct sk_buff *skb;
struct pnpipehdr *ph;
struct sockaddr_pn dst;
- skb = alloc_skb(MAX_PNPIPE_HEADER + 4, GFP_ATOMIC);
+ skb = alloc_skb(MAX_PNPIPE_HEADER + 4, priority);
if (!skb)
return -ENOMEM;
skb_set_owner_w(skb, sk);
@@ -308,6 +309,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
{
struct pep_sock *pn = pep_sk(sk);
struct pnpipehdr *hdr = pnp_hdr(skb);
+ struct sk_buff_head *queue;
int err = 0;
BUG_ON(sk->sk_state == TCP_CLOSE_WAIT);
@@ -349,10 +351,12 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
pep_reply(sk, skb, PN_PIPE_NO_ERROR, NULL, 0, GFP_ATOMIC);
break;
- case PNS_PEP_CTRL_REQ: /* TODO: but how so? */
- printk(KERN_DEBUG"pipe ignoring control request (TODO)\n");
- pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR);
- break;
+ case PNS_PEP_CTRL_REQ:
+ if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX)
+ break;
+ __skb_pull(skb, 4);
+ queue = &pn->ctrlreq_queue;
+ goto queue;
case PNS_PIPE_DATA:
__skb_pull(skb, 3); /* Pipe data header */
@@ -368,13 +372,8 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
break;
}
pn->rx_credits--;
- skb->dev = NULL;
- skb_set_owner_r(skb, sk);
- err = skb->len;
- skb_queue_tail(&sk->sk_receive_queue, skb);
- if (!sock_flag(sk, SOCK_DEAD))
- sk->sk_data_ready(sk, err);
- return 0;
+ queue = &sk->sk_receive_queue;
+ goto queue;
case PNS_PEP_STATUS_IND:
pipe_rcv_status(sk, skb);
@@ -418,12 +417,24 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
out:
kfree_skb(skb);
return err;
+
+queue:
+ skb->dev = NULL;
+ skb_set_owner_r(skb, sk);
+ err = skb->len;
+ skb_queue_tail(queue, skb);
+ if (!sock_flag(sk, SOCK_DEAD))
+ sk->sk_data_ready(sk, err);
+ return 0;
}
/* Destroy connected sock. */
static void pipe_destruct(struct sock *sk)
{
+ struct pep_sock *pn = pep_sk(sk);
+
skb_queue_purge(&sk->sk_receive_queue);
+ skb_queue_purge(&pn->ctrlreq_queue);
}
static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
@@ -496,6 +507,7 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
pn_skb_get_dst_sockaddr(skb, &dst);
newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst);
newpn->pn_sk.resource = pn->pn_sk.resource;
+ skb_queue_head_init(&newpn->ctrlreq_queue);
newpn->pipe_handle = pipe_handle;
newpn->peer_type = peer_type;
newpn->rx_credits = newpn->tx_credits = 0;
@@ -586,7 +598,8 @@ static int pep_do_rcv(struct sock *sk, struct sk_buff *skb)
break;
case PNS_PEP_CTRL_REQ:
- pep_ctrlreq_error(sk, skb, PN_PIPE_INVALID_HANDLE);
+ pep_ctrlreq_error(sk, skb, PN_PIPE_INVALID_HANDLE,
+ GFP_ATOMIC);
break;
case PNS_PEP_RESET_REQ:
@@ -689,6 +702,7 @@ out:
static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
{
+ struct pep_sock *pn = pep_sk(sk);
int answ;
switch (cmd) {
@@ -697,7 +711,10 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
return -EINVAL;
lock_sock(sk);
- if (!skb_queue_empty(&sk->sk_receive_queue))
+ if (sock_flag(sk, SOCK_URGINLINE)
+ && !skb_queue_empty(&pn->ctrlreq_queue))
+ answ = skb_peek(&pn->ctrlreq_queue)->len;
+ else if (!skb_queue_empty(&sk->sk_receive_queue))
answ = skb_peek(&sk->sk_receive_queue)->len;
else
answ = 0;
@@ -714,6 +731,7 @@ static int pep_init(struct sock *sk)
INIT_HLIST_HEAD(&pn->ackq);
INIT_HLIST_HEAD(&pn->hlist);
+ skb_queue_head_init(&pn->ctrlreq_queue);
pn->pipe_handle = PN_PIPE_INVALID_HANDLE;
return 0;
}
@@ -814,11 +832,24 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
struct sk_buff *skb;
int err;
- if (unlikely(flags & MSG_OOB))
- return -EOPNOTSUPP;
if (unlikely(1 << sk->sk_state & (TCPF_LISTEN | TCPF_CLOSE)))
return -ENOTCONN;
+ if ((flags & MSG_OOB) || sock_flag(sk, SOCK_URGINLINE)) {
+ /* Dequeue and acknowledge control request */
+ struct pep_sock *pn = pep_sk(sk);
+
+ skb = skb_dequeue(&pn->ctrlreq_queue);
+ if (skb) {
+ pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR,
+ GFP_KERNEL);
+ msg->msg_flags |= MSG_OOB;
+ goto copy;
+ }
+ if (flags & MSG_OOB)
+ return -EINVAL;
+ }
+
skb = skb_recv_datagram(sk, flags, noblock, &err);
lock_sock(sk);
if (skb == NULL) {
@@ -831,9 +862,8 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
if (sk->sk_state == TCP_ESTABLISHED)
pipe_grant_credits(sk);
release_sock(sk);
-
+copy:
msg->msg_flags |= MSG_EOR;
-
if (skb->len > len)
msg->msg_flags |= MSG_TRUNC;
else
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index cea1136..a9c3d1f 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -220,7 +220,9 @@ static unsigned int pn_socket_poll(struct file *file, struct socket *sock,
if (!skb_queue_empty(&sk->sk_receive_queue))
mask |= POLLIN | POLLRDNORM;
- else if (sk->sk_state == TCP_CLOSE_WAIT)
+ if (!skb_queue_empty(&pn->ctrlreq_queue))
+ mask |= POLLPRI;
+ if (!mask && sk->sk_state == TCP_CLOSE_WAIT)
return POLLHUP;
if (sk->sk_state == TCP_ESTABLISHED && pn->tx_credits)
--
1.5.4.3
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists