LCOV - code coverage report
Current view: top level - net/ipv4 - inet_connection_sock.c (source / functions) Hit Total Coverage
Test: landlock.info Lines: 234 544 43.0 %
Date: 2021-04-22 12:43:58 Functions: 22 36 61.1 %

          Line data    Source code
       1             : // SPDX-License-Identifier: GPL-2.0-or-later
       2             : /*
       3             :  * INET         An implementation of the TCP/IP protocol suite for the LINUX
       4             :  *              operating system.  INET is implemented using the  BSD Socket
       5             :  *              interface as the means of communication with the user level.
       6             :  *
       7             :  *              Support for INET connection oriented protocols.
       8             :  *
       9             :  * Authors:     See the TCP sources
      10             :  */
      11             : 
      12             : #include <linux/module.h>
      13             : #include <linux/jhash.h>
      14             : 
      15             : #include <net/inet_connection_sock.h>
      16             : #include <net/inet_hashtables.h>
      17             : #include <net/inet_timewait_sock.h>
      18             : #include <net/ip.h>
      19             : #include <net/route.h>
      20             : #include <net/tcp_states.h>
      21             : #include <net/xfrm.h>
      22             : #include <net/tcp.h>
      23             : #include <net/sock_reuseport.h>
      24             : #include <net/addrconf.h>
      25             : 
      26             : #if IS_ENABLED(CONFIG_IPV6)
      27             : /* match_sk*_wildcard == true:  IPV6_ADDR_ANY equals to any IPv6 addresses
      28             :  *                              if IPv6 only, and any IPv4 addresses
      29             :  *                              if not IPv6 only
      30             :  * match_sk*_wildcard == false: addresses must be exactly the same, i.e.
      31             :  *                              IPV6_ADDR_ANY only equals to IPV6_ADDR_ANY,
      32             :  *                              and 0.0.0.0 equals to 0.0.0.0 only
      33             :  */
      34             : static bool ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
      35             :                                  const struct in6_addr *sk2_rcv_saddr6,
      36             :                                  __be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
      37             :                                  bool sk1_ipv6only, bool sk2_ipv6only,
      38             :                                  bool match_sk1_wildcard,
      39             :                                  bool match_sk2_wildcard)
      40             : {
      41             :         int addr_type = ipv6_addr_type(sk1_rcv_saddr6);
      42             :         int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
      43             : 
      44             :         /* if both are mapped, treat as IPv4 */
      45             :         if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED) {
      46             :                 if (!sk2_ipv6only) {
      47             :                         if (sk1_rcv_saddr == sk2_rcv_saddr)
      48             :                                 return true;
      49             :                         return (match_sk1_wildcard && !sk1_rcv_saddr) ||
      50             :                                 (match_sk2_wildcard && !sk2_rcv_saddr);
      51             :                 }
      52             :                 return false;
      53             :         }
      54             : 
      55             :         if (addr_type == IPV6_ADDR_ANY && addr_type2 == IPV6_ADDR_ANY)
      56             :                 return true;
      57             : 
      58             :         if (addr_type2 == IPV6_ADDR_ANY && match_sk2_wildcard &&
      59             :             !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
      60             :                 return true;
      61             : 
      62             :         if (addr_type == IPV6_ADDR_ANY && match_sk1_wildcard &&
      63             :             !(sk1_ipv6only && addr_type2 == IPV6_ADDR_MAPPED))
      64             :                 return true;
      65             : 
      66             :         if (sk2_rcv_saddr6 &&
      67             :             ipv6_addr_equal(sk1_rcv_saddr6, sk2_rcv_saddr6))
      68             :                 return true;
      69             : 
      70             :         return false;
      71             : }
      72             : #endif
      73             : 
      74             : /* match_sk*_wildcard == true:  0.0.0.0 equals to any IPv4 addresses
      75             :  * match_sk*_wildcard == false: addresses must be exactly the same, i.e.
      76             :  *                              0.0.0.0 only equals to 0.0.0.0
      77             :  */
      78           0 : static bool ipv4_rcv_saddr_equal(__be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
      79             :                                  bool sk2_ipv6only, bool match_sk1_wildcard,
      80             :                                  bool match_sk2_wildcard)
      81             : {
      82           0 :         if (!sk2_ipv6only) {
      83           0 :                 if (sk1_rcv_saddr == sk2_rcv_saddr)
      84             :                         return true;
      85           0 :                 return (match_sk1_wildcard && !sk1_rcv_saddr) ||
      86           0 :                         (match_sk2_wildcard && !sk2_rcv_saddr);
      87             :         }
      88             :         return false;
      89             : }
      90             : 
      91           0 : bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
      92             :                           bool match_wildcard)
      93             : {
      94             : #if IS_ENABLED(CONFIG_IPV6)
      95             :         if (sk->sk_family == AF_INET6)
      96             :                 return ipv6_rcv_saddr_equal(&sk->sk_v6_rcv_saddr,
      97             :                                             inet6_rcv_saddr(sk2),
      98             :                                             sk->sk_rcv_saddr,
      99             :                                             sk2->sk_rcv_saddr,
     100             :                                             ipv6_only_sock(sk),
     101             :                                             ipv6_only_sock(sk2),
     102             :                                             match_wildcard,
     103             :                                             match_wildcard);
     104             : #endif
     105           0 :         return ipv4_rcv_saddr_equal(sk->sk_rcv_saddr, sk2->sk_rcv_saddr,
     106             :                                     ipv6_only_sock(sk2), match_wildcard,
     107             :                                     match_wildcard);
     108             : }
     109             : EXPORT_SYMBOL(inet_rcv_saddr_equal);
     110             : 
     111           0 : bool inet_rcv_saddr_any(const struct sock *sk)
     112             : {
     113             : #if IS_ENABLED(CONFIG_IPV6)
     114             :         if (sk->sk_family == AF_INET6)
     115             :                 return ipv6_addr_any(&sk->sk_v6_rcv_saddr);
     116             : #endif
     117           0 :         return !sk->sk_rcv_saddr;
     118             : }
     119             : 
     120          33 : void inet_get_local_port_range(struct net *net, int *low, int *high)
     121             : {
     122          33 :         unsigned int seq;
     123             : 
     124          33 :         do {
     125          33 :                 seq = read_seqbegin(&net->ipv4.ip_local_ports.lock);
     126             : 
     127          33 :                 *low = net->ipv4.ip_local_ports.range[0];
     128          33 :                 *high = net->ipv4.ip_local_ports.range[1];
     129          33 :         } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq));
     130          33 : }
     131             : EXPORT_SYMBOL(inet_get_local_port_range);
     132             : 
     133           3 : static int inet_csk_bind_conflict(const struct sock *sk,
     134             :                                   const struct inet_bind_bucket *tb,
     135             :                                   bool relax, bool reuseport_ok)
     136             : {
     137           3 :         struct sock *sk2;
     138           3 :         bool reuse = sk->sk_reuse;
     139           3 :         bool reuseport = !!sk->sk_reuseport;
     140           3 :         kuid_t uid = sock_i_uid((struct sock *)sk);
     141             : 
     142             :         /*
     143             :          * Unlike other sk lookup places we do not check
     144             :          * for sk_net here, since _all_ the socks listed
     145             :          * in tb->owners list belong to the same net - the
     146             :          * one this bucket belongs to.
     147             :          */
     148             : 
     149           9 :         sk_for_each_bound(sk2, &tb->owners) {
     150           3 :                 if (sk != sk2 &&
     151           0 :                     (!sk->sk_bound_dev_if ||
     152           0 :                      !sk2->sk_bound_dev_if ||
     153             :                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
     154           0 :                         if (reuse && sk2->sk_reuse &&
     155           0 :                             sk2->sk_state != TCP_LISTEN) {
     156           0 :                                 if ((!relax ||
     157           0 :                                      (!reuseport_ok &&
     158           0 :                                       reuseport && sk2->sk_reuseport &&
     159           0 :                                       !rcu_access_pointer(sk->sk_reuseport_cb) &&
     160           0 :                                       (sk2->sk_state == TCP_TIME_WAIT ||
     161           0 :                                        uid_eq(uid, sock_i_uid(sk2))))) &&
     162           0 :                                     inet_rcv_saddr_equal(sk, sk2, true))
     163             :                                         break;
     164           0 :                         } else if (!reuseport_ok ||
     165           0 :                                    !reuseport || !sk2->sk_reuseport ||
     166           0 :                                    rcu_access_pointer(sk->sk_reuseport_cb) ||
     167           0 :                                    (sk2->sk_state != TCP_TIME_WAIT &&
     168           0 :                                     !uid_eq(uid, sock_i_uid(sk2)))) {
     169           0 :                                 if (inet_rcv_saddr_equal(sk, sk2, true))
     170             :                                         break;
     171             :                         }
     172             :                 }
     173             :         }
     174           3 :         return sk2 != NULL;
     175             : }
     176             : 
     177             : /*
     178             :  * Find an open port number for the socket.  Returns with the
     179             :  * inet_bind_hashbucket lock held.
     180             :  */
     181             : static struct inet_bind_hashbucket *
     182           0 : inet_csk_find_open_port(struct sock *sk, struct inet_bind_bucket **tb_ret, int *port_ret)
     183             : {
     184           0 :         struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo;
     185           0 :         int port = 0;
     186           0 :         struct inet_bind_hashbucket *head;
     187           0 :         struct net *net = sock_net(sk);
     188           0 :         bool relax = false;
     189           0 :         int i, low, high, attempt_half;
     190           0 :         struct inet_bind_bucket *tb;
     191           0 :         u32 remaining, offset;
     192           0 :         int l3mdev;
     193             : 
     194           0 :         l3mdev = inet_sk_bound_l3mdev(sk);
     195           0 : ports_exhausted:
     196           0 :         attempt_half = (sk->sk_reuse == SK_CAN_REUSE) ? 1 : 0;
     197           0 : other_half_scan:
     198           0 :         inet_get_local_port_range(net, &low, &high);
     199           0 :         high++; /* [32768, 60999] -> [32768, 61000[ */
     200           0 :         if (high - low < 4)
     201             :                 attempt_half = 0;
     202           0 :         if (attempt_half) {
     203           0 :                 int half = low + (((high - low) >> 2) << 1);
     204             : 
     205           0 :                 if (attempt_half == 1)
     206           0 :                         high = half;
     207             :                 else
     208           0 :                         low = half;
     209             :         }
     210           0 :         remaining = high - low;
     211           0 :         if (likely(remaining > 1))
     212           0 :                 remaining &= ~1U;
     213             : 
     214           0 :         offset = prandom_u32() % remaining;
     215             :         /* __inet_hash_connect() favors ports having @low parity
     216             :          * We do the opposite to not pollute connect() users.
     217             :          */
     218           0 :         offset |= 1U;
     219             : 
     220           0 : other_parity_scan:
     221           0 :         port = low + offset;
     222           0 :         for (i = 0; i < remaining; i += 2, port += 2) {
     223           0 :                 if (unlikely(port >= high))
     224           0 :                         port -= remaining;
     225           0 :                 if (inet_is_local_reserved_port(net, port))
     226           0 :                         continue;
     227           0 :                 head = &hinfo->bhash[inet_bhashfn(net, port,
     228             :                                                   hinfo->bhash_size)];
     229           0 :                 spin_lock_bh(&head->lock);
     230           0 :                 inet_bind_bucket_for_each(tb, &head->chain)
     231           0 :                         if (net_eq(ib_net(tb), net) && tb->l3mdev == l3mdev &&
     232           0 :                             tb->port == port) {
     233           0 :                                 if (!inet_csk_bind_conflict(sk, tb, relax, false))
     234           0 :                                         goto success;
     235           0 :                                 goto next_port;
     236             :                         }
     237           0 :                 tb = NULL;
     238           0 :                 goto success;
     239           0 : next_port:
     240           0 :                 spin_unlock_bh(&head->lock);
     241           0 :                 cond_resched();
     242             :         }
     243             : 
     244           0 :         offset--;
     245           0 :         if (!(offset & 1))
     246           0 :                 goto other_parity_scan;
     247             : 
     248           0 :         if (attempt_half == 1) {
     249             :                 /* OK we now try the upper half of the range */
     250           0 :                 attempt_half = 2;
     251           0 :                 goto other_half_scan;
     252             :         }
     253             : 
     254           0 :         if (net->ipv4.sysctl_ip_autobind_reuse && !relax) {
     255             :                 /* We still have a chance to connect to different destinations */
     256           0 :                 relax = true;
     257           0 :                 goto ports_exhausted;
     258             :         }
     259             :         return NULL;
     260           0 : success:
     261           0 :         *port_ret = port;
     262           0 :         *tb_ret = tb;
     263           0 :         return head;
     264             : }
     265             : 
     266           3 : static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
     267             :                                      struct sock *sk)
     268             : {
     269           3 :         kuid_t uid = sock_i_uid(sk);
     270             : 
     271           3 :         if (tb->fastreuseport <= 0)
     272             :                 return 0;
     273           0 :         if (!sk->sk_reuseport)
     274             :                 return 0;
     275           0 :         if (rcu_access_pointer(sk->sk_reuseport_cb))
     276             :                 return 0;
     277           0 :         if (!uid_eq(tb->fastuid, uid))
     278             :                 return 0;
     279             :         /* We only need to check the rcv_saddr if this tb was once marked
     280             :          * without fastreuseport and then was reset, as we can only know that
     281             :          * the fast_*rcv_saddr doesn't have any conflicts with the socks on the
     282             :          * owners list.
     283             :          */
     284           0 :         if (tb->fastreuseport == FASTREUSEPORT_ANY)
     285             :                 return 1;
     286             : #if IS_ENABLED(CONFIG_IPV6)
     287             :         if (tb->fast_sk_family == AF_INET6)
     288             :                 return ipv6_rcv_saddr_equal(&tb->fast_v6_rcv_saddr,
     289             :                                             inet6_rcv_saddr(sk),
     290             :                                             tb->fast_rcv_saddr,
     291             :                                             sk->sk_rcv_saddr,
     292             :                                             tb->fast_ipv6_only,
     293             :                                             ipv6_only_sock(sk), true, false);
     294             : #endif
     295           0 :         return ipv4_rcv_saddr_equal(tb->fast_rcv_saddr, sk->sk_rcv_saddr,
     296             :                                     ipv6_only_sock(sk), true, false);
     297             : }
     298             : 
     299           6 : void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
     300             :                                struct sock *sk)
     301             : {
     302           6 :         kuid_t uid = sock_i_uid(sk);
     303           6 :         bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;
     304             : 
     305           6 :         if (hlist_empty(&tb->owners)) {
     306           3 :                 tb->fastreuse = reuse;
     307           3 :                 if (sk->sk_reuseport) {
     308           0 :                         tb->fastreuseport = FASTREUSEPORT_ANY;
     309           0 :                         tb->fastuid = uid;
     310           0 :                         tb->fast_rcv_saddr = sk->sk_rcv_saddr;
     311           0 :                         tb->fast_ipv6_only = ipv6_only_sock(sk);
     312           0 :                         tb->fast_sk_family = sk->sk_family;
     313             : #if IS_ENABLED(CONFIG_IPV6)
     314             :                         tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
     315             : #endif
     316             :                 } else {
     317           3 :                         tb->fastreuseport = 0;
     318             :                 }
     319             :         } else {
     320           3 :                 if (!reuse)
     321           3 :                         tb->fastreuse = 0;
     322           3 :                 if (sk->sk_reuseport) {
     323             :                         /* We didn't match or we don't have fastreuseport set on
     324             :                          * the tb, but we have sk_reuseport set on this socket
     325             :                          * and we know that there are no bind conflicts with
     326             :                          * this socket in this tb, so reset our tb's reuseport
     327             :                          * settings so that any subsequent sockets that match
     328             :                          * our current socket will be put on the fast path.
     329             :                          *
     330             :                          * If we reset we need to set FASTREUSEPORT_STRICT so we
     331             :                          * do extra checking for all subsequent sk_reuseport
     332             :                          * socks.
     333             :                          */
     334           0 :                         if (!sk_reuseport_match(tb, sk)) {
     335           0 :                                 tb->fastreuseport = FASTREUSEPORT_STRICT;
     336           0 :                                 tb->fastuid = uid;
     337           0 :                                 tb->fast_rcv_saddr = sk->sk_rcv_saddr;
     338           0 :                                 tb->fast_ipv6_only = ipv6_only_sock(sk);
     339           0 :                                 tb->fast_sk_family = sk->sk_family;
     340             : #if IS_ENABLED(CONFIG_IPV6)
     341             :                                 tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
     342             : #endif
     343             :                         }
     344             :                 } else {
     345           3 :                         tb->fastreuseport = 0;
     346             :                 }
     347             :         }
     348           6 : }
     349             : 
     350             : /* Obtain a reference to a local port for the given sock,
     351             :  * if snum is zero it means select any available local port.
     352             :  * We try to allocate an odd port (and leave even ports for connect())
     353             :  */
     354           6 : int inet_csk_get_port(struct sock *sk, unsigned short snum)
     355             : {
     356           6 :         bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;
     357           6 :         struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo;
     358           6 :         int ret = 1, port = snum;
     359           6 :         struct inet_bind_hashbucket *head;
     360           6 :         struct net *net = sock_net(sk);
     361           6 :         struct inet_bind_bucket *tb = NULL;
     362           6 :         int l3mdev;
     363             : 
     364           6 :         l3mdev = inet_sk_bound_l3mdev(sk);
     365             : 
     366           6 :         if (!port) {
     367           0 :                 head = inet_csk_find_open_port(sk, &tb, &port);
     368           0 :                 if (!head)
     369             :                         return ret;
     370           0 :                 if (!tb)
     371           0 :                         goto tb_not_found;
     372           0 :                 goto success;
     373             :         }
     374           6 :         head = &hinfo->bhash[inet_bhashfn(net, port,
     375             :                                           hinfo->bhash_size)];
     376           6 :         spin_lock_bh(&head->lock);
     377           6 :         inet_bind_bucket_for_each(tb, &head->chain)
     378           3 :                 if (net_eq(ib_net(tb), net) && tb->l3mdev == l3mdev &&
     379           3 :                     tb->port == port)
     380           3 :                         goto tb_found;
     381           3 : tb_not_found:
     382           3 :         tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
     383             :                                      net, head, port, l3mdev);
     384           3 :         if (!tb)
     385           0 :                 goto fail_unlock;
     386           3 : tb_found:
     387           6 :         if (!hlist_empty(&tb->owners)) {
     388           3 :                 if (sk->sk_reuse == SK_FORCE_REUSE)
     389           0 :                         goto success;
     390             : 
     391           6 :                 if ((tb->fastreuse > 0 && reuse) ||
     392           3 :                     sk_reuseport_match(tb, sk))
     393           0 :                         goto success;
     394           3 :                 if (inet_csk_bind_conflict(sk, tb, true, true))
     395           0 :                         goto fail_unlock;
     396             :         }
     397           6 : success:
     398           6 :         inet_csk_update_fastreuse(tb, sk);
     399             : 
     400           6 :         if (!inet_csk(sk)->icsk_bind_hash)
     401           3 :                 inet_bind_hash(sk, tb, port);
     402           6 :         WARN_ON(inet_csk(sk)->icsk_bind_hash != tb);
     403             :         ret = 0;
     404             : 
     405           6 : fail_unlock:
     406           6 :         spin_unlock_bh(&head->lock);
     407           6 :         return ret;
     408             : }
     409             : EXPORT_SYMBOL_GPL(inet_csk_get_port);
     410             : 
     411             : /*
     412             :  * Wait for an incoming connection, avoid race conditions. This must be called
     413             :  * with the socket locked.
     414             :  */
     415           0 : static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
     416             : {
     417           0 :         struct inet_connection_sock *icsk = inet_csk(sk);
     418           0 :         DEFINE_WAIT(wait);
     419           0 :         int err;
     420             : 
     421             :         /*
     422             :          * True wake-one mechanism for incoming connections: only
     423             :          * one process gets woken up, not the 'whole herd'.
     424             :          * Since we do not 'race & poll' for established sockets
     425             :          * anymore, the common case will execute the loop only once.
     426             :          *
     427             :          * Subtle issue: "add_wait_queue_exclusive()" will be added
     428             :          * after any current non-exclusive waiters, and we know that
     429             :          * it will always _stay_ after any new non-exclusive waiters
     430             :          * because all non-exclusive waiters are added at the
     431             :          * beginning of the wait-queue. As such, it's ok to "drop"
     432             :          * our exclusiveness temporarily when we get woken up without
     433             :          * having to remove and re-insert us on the wait queue.
     434             :          */
     435           0 :         for (;;) {
     436           0 :                 prepare_to_wait_exclusive(sk_sleep(sk), &wait,
     437             :                                           TASK_INTERRUPTIBLE);
     438           0 :                 release_sock(sk);
     439           0 :                 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
     440           0 :                         timeo = schedule_timeout(timeo);
     441           0 :                 sched_annotate_sleep();
     442           0 :                 lock_sock(sk);
     443           0 :                 err = 0;
     444           0 :                 if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
     445             :                         break;
     446           0 :                 err = -EINVAL;
     447           0 :                 if (sk->sk_state != TCP_LISTEN)
     448             :                         break;
     449           0 :                 err = sock_intr_errno(timeo);
     450           0 :                 if (signal_pending(current))
     451             :                         break;
     452           0 :                 err = -EAGAIN;
     453           0 :                 if (!timeo)
     454             :                         break;
     455             :         }
     456           0 :         finish_wait(sk_sleep(sk), &wait);
     457           0 :         return err;
     458             : }
     459             : 
     460             : /*
     461             :  * This will accept the next outstanding connection.
     462             :  */
     463           4 : struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
     464             : {
     465           4 :         struct inet_connection_sock *icsk = inet_csk(sk);
     466           4 :         struct request_sock_queue *queue = &icsk->icsk_accept_queue;
     467           4 :         struct request_sock *req;
     468           4 :         struct sock *newsk;
     469           4 :         int error;
     470             : 
     471           4 :         lock_sock(sk);
     472             : 
     473             :         /* We need to make sure that this socket is listening,
     474             :          * and that it has something pending.
     475             :          */
     476           4 :         error = -EINVAL;
     477           4 :         if (sk->sk_state != TCP_LISTEN)
     478           0 :                 goto out_err;
     479             : 
     480             :         /* Find already established connection */
     481           4 :         if (reqsk_queue_empty(queue)) {
     482           0 :                 long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
     483             : 
     484             :                 /* If this is a non blocking socket don't sleep */
     485           0 :                 error = -EAGAIN;
     486           0 :                 if (!timeo)
     487           0 :                         goto out_err;
     488             : 
     489           0 :                 error = inet_csk_wait_for_connect(sk, timeo);
     490           0 :                 if (error)
     491           0 :                         goto out_err;
     492             :         }
     493           4 :         req = reqsk_queue_remove(queue, sk);
     494           4 :         newsk = req->sk;
     495             : 
     496           4 :         if (sk->sk_protocol == IPPROTO_TCP &&
     497           4 :             tcp_rsk(req)->tfo_listener) {
     498           0 :                 spin_lock_bh(&queue->fastopenq.lock);
     499           0 :                 if (tcp_rsk(req)->tfo_listener) {
     500             :                         /* We are still waiting for the final ACK from 3WHS
     501             :                          * so can't free req now. Instead, we set req->sk to
     502             :                          * NULL to signify that the child socket is taken
     503             :                          * so reqsk_fastopen_remove() will free the req
     504             :                          * when 3WHS finishes (or is aborted).
     505             :                          */
     506           0 :                         req->sk = NULL;
     507           0 :                         req = NULL;
     508             :                 }
     509           0 :                 spin_unlock_bh(&queue->fastopenq.lock);
     510             :         }
     511             : 
     512           4 : out:
     513           4 :         release_sock(sk);
     514           4 :         if (newsk && mem_cgroup_sockets_enabled) {
     515             :                 int amt;
     516             : 
     517             :                 /* atomically get the memory usage, set and charge the
     518             :                  * newsk->sk_memcg.
     519             :                  */
     520             :                 lock_sock(newsk);
     521             : 
     522             :                 /* The socket has not been accepted yet, no need to look at
     523             :                  * newsk->sk_wmem_queued.
     524             :                  */
     525             :                 amt = sk_mem_pages(newsk->sk_forward_alloc +
     526             :                                    atomic_read(&newsk->sk_rmem_alloc));
     527             :                 mem_cgroup_sk_alloc(newsk);
     528             :                 if (newsk->sk_memcg && amt)
     529             :                         mem_cgroup_charge_skmem(newsk->sk_memcg, amt);
     530             : 
     531             :                 release_sock(newsk);
     532             :         }
     533           4 :         if (req)
     534           4 :                 reqsk_put(req);
     535           4 :         return newsk;
     536           0 : out_err:
     537           0 :         newsk = NULL;
     538           0 :         req = NULL;
     539           0 :         *err = error;
     540           0 :         goto out;
     541             : }
     542             : EXPORT_SYMBOL(inet_csk_accept);
     543             : 
     544             : /*
     545             :  * Using different timers for retransmit, delayed acks and probes
     546             :  * We may wish use just one timer maintaining a list of expire jiffies
     547             :  * to optimize.
     548             :  */
     549           7 : void inet_csk_init_xmit_timers(struct sock *sk,
     550             :                                void (*retransmit_handler)(struct timer_list *t),
     551             :                                void (*delack_handler)(struct timer_list *t),
     552             :                                void (*keepalive_handler)(struct timer_list *t))
     553             : {
     554           7 :         struct inet_connection_sock *icsk = inet_csk(sk);
     555             : 
     556           7 :         timer_setup(&icsk->icsk_retransmit_timer, retransmit_handler, 0);
     557           7 :         timer_setup(&icsk->icsk_delack_timer, delack_handler, 0);
     558           7 :         timer_setup(&sk->sk_timer, keepalive_handler, 0);
     559           7 :         icsk->icsk_pending = icsk->icsk_ack.pending = 0;
     560           7 : }
     561             : EXPORT_SYMBOL(inet_csk_init_xmit_timers);
     562             : 
     563           7 : void inet_csk_clear_xmit_timers(struct sock *sk)
     564             : {
     565           7 :         struct inet_connection_sock *icsk = inet_csk(sk);
     566             : 
     567           7 :         icsk->icsk_pending = icsk->icsk_ack.pending = 0;
     568             : 
     569           7 :         sk_stop_timer(sk, &icsk->icsk_retransmit_timer);
     570           7 :         sk_stop_timer(sk, &icsk->icsk_delack_timer);
     571           7 :         sk_stop_timer(sk, &sk->sk_timer);
     572           7 : }
     573             : EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
     574             : 
     575           0 : void inet_csk_delete_keepalive_timer(struct sock *sk)
     576             : {
     577           0 :         sk_stop_timer(sk, &sk->sk_timer);
     578           0 : }
     579             : EXPORT_SYMBOL(inet_csk_delete_keepalive_timer);
     580             : 
     581           4 : void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len)
     582             : {
     583           4 :         sk_reset_timer(sk, &sk->sk_timer, jiffies + len);
     584           4 : }
     585             : EXPORT_SYMBOL(inet_csk_reset_keepalive_timer);
     586             : 
     587           4 : struct dst_entry *inet_csk_route_req(const struct sock *sk,
     588             :                                      struct flowi4 *fl4,
     589             :                                      const struct request_sock *req)
     590             : {
     591           4 :         const struct inet_request_sock *ireq = inet_rsk(req);
     592           4 :         struct net *net = read_pnet(&ireq->ireq_net);
     593           4 :         struct ip_options_rcu *opt;
     594           4 :         struct rtable *rt;
     595             : 
     596           4 :         rcu_read_lock();
     597           4 :         opt = rcu_dereference(ireq->ireq_opt);
     598             : 
     599           4 :         flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
     600           4 :                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
     601           4 :                            sk->sk_protocol, inet_sk_flowi_flags(sk),
     602           0 :                            (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
     603           4 :                            ireq->ir_loc_addr, ireq->ir_rmt_port,
     604           4 :                            htons(ireq->ir_num), sk->sk_uid);
     605           4 :         security_req_classify_flow(req, flowi4_to_flowi_common(fl4));
     606           4 :         rt = ip_route_output_flow(net, fl4, sk);
     607           4 :         if (IS_ERR(rt))
     608           0 :                 goto no_route;
     609           4 :         if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
     610           0 :                 goto route_err;
     611           4 :         rcu_read_unlock();
     612           4 :         return &rt->dst;
     613             : 
     614           0 : route_err:
     615           0 :         ip_rt_put(rt);
     616           0 : no_route:
     617           0 :         rcu_read_unlock();
     618           0 :         __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
     619           0 :         return NULL;
     620             : }
     621             : EXPORT_SYMBOL_GPL(inet_csk_route_req);
     622             : 
     623           4 : struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
     624             :                                             struct sock *newsk,
     625             :                                             const struct request_sock *req)
     626             : {
     627           4 :         const struct inet_request_sock *ireq = inet_rsk(req);
     628           4 :         struct net *net = read_pnet(&ireq->ireq_net);
     629           4 :         struct inet_sock *newinet = inet_sk(newsk);
     630           4 :         struct ip_options_rcu *opt;
     631           4 :         struct flowi4 *fl4;
     632           4 :         struct rtable *rt;
     633             : 
     634           4 :         opt = rcu_dereference(ireq->ireq_opt);
     635           4 :         fl4 = &newinet->cork.fl.u.ip4;
     636             : 
     637           4 :         flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
     638           4 :                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
     639           4 :                            sk->sk_protocol, inet_sk_flowi_flags(sk),
     640           0 :                            (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr,
     641           4 :                            ireq->ir_loc_addr, ireq->ir_rmt_port,
     642           4 :                            htons(ireq->ir_num), sk->sk_uid);
     643           4 :         security_req_classify_flow(req, flowi4_to_flowi_common(fl4));
     644           4 :         rt = ip_route_output_flow(net, fl4, sk);
     645           4 :         if (IS_ERR(rt))
     646           0 :                 goto no_route;
     647           4 :         if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
     648           0 :                 goto route_err;
     649           4 :         return &rt->dst;
     650             : 
     651           0 : route_err:
     652           0 :         ip_rt_put(rt);
     653           0 : no_route:
     654           0 :         __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
     655           0 :         return NULL;
     656             : }
     657             : EXPORT_SYMBOL_GPL(inet_csk_route_child_sock);
     658             : 
     659             : /* Decide when to expire the request and when to resend SYN-ACK */
     660           0 : static void syn_ack_recalc(struct request_sock *req,
     661             :                            const int max_syn_ack_retries,
     662             :                            const u8 rskq_defer_accept,
     663             :                            int *expire, int *resend)
     664             : {
     665           0 :         if (!rskq_defer_accept) {
     666           0 :                 *expire = req->num_timeout >= max_syn_ack_retries;
     667           0 :                 *resend = 1;
     668           0 :                 return;
     669             :         }
     670           0 :         *expire = req->num_timeout >= max_syn_ack_retries &&
     671           0 :                   (!inet_rsk(req)->acked || req->num_timeout >= rskq_defer_accept);
     672             :         /* Do not resend while waiting for data after ACK,
     673             :          * start to resend on end of deferring period to give
     674             :          * last chance for data or ACK to create established socket.
     675             :          */
     676           0 :         *resend = !inet_rsk(req)->acked ||
     677           0 :                   req->num_timeout >= rskq_defer_accept - 1;
     678             : }
     679             : 
     680           0 : int inet_rtx_syn_ack(const struct sock *parent, struct request_sock *req)
     681             : {
     682           0 :         int err = req->rsk_ops->rtx_syn_ack(parent, req);
     683             : 
     684           0 :         if (!err)
     685           0 :                 req->num_retrans++;
     686           0 :         return err;
     687             : }
     688             : EXPORT_SYMBOL(inet_rtx_syn_ack);
     689             : 
     690             : /* return true if req was found in the ehash table */
     691           4 : static bool reqsk_queue_unlink(struct request_sock *req)
     692             : {
     693           4 :         struct inet_hashinfo *hashinfo = req_to_sk(req)->sk_prot->h.hashinfo;
     694           4 :         bool found = false;
     695             : 
     696           4 :         if (sk_hashed(req_to_sk(req))) {
     697           0 :                 spinlock_t *lock = inet_ehash_lockp(hashinfo, req->rsk_hash);
     698             : 
     699           0 :                 spin_lock(lock);
     700           0 :                 found = __sk_nulls_del_node_init_rcu(req_to_sk(req));
     701           0 :                 spin_unlock(lock);
     702             :         }
     703           4 :         if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
     704           4 :                 reqsk_put(req);
     705           4 :         return found;
     706             : }
     707             : 
     708           4 : void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
     709             : {
     710           4 :         if (reqsk_queue_unlink(req)) {
     711           0 :                 reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
     712           0 :                 reqsk_put(req);
     713             :         }
     714           4 : }
     715             : EXPORT_SYMBOL(inet_csk_reqsk_queue_drop);
     716             : 
     717           0 : void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req)
     718             : {
     719           0 :         inet_csk_reqsk_queue_drop(sk, req);
     720           0 :         reqsk_put(req);
     721           0 : }
     722             : EXPORT_SYMBOL(inet_csk_reqsk_queue_drop_and_put);
     723             : 
     724           0 : static void reqsk_timer_handler(struct timer_list *t)
     725             : {
     726           0 :         struct request_sock *req = from_timer(req, t, rsk_timer);
     727           0 :         struct sock *sk_listener = req->rsk_listener;
     728           0 :         struct net *net = sock_net(sk_listener);
     729           0 :         struct inet_connection_sock *icsk = inet_csk(sk_listener);
     730           0 :         struct request_sock_queue *queue = &icsk->icsk_accept_queue;
     731           0 :         int max_syn_ack_retries, qlen, expire = 0, resend = 0;
     732             : 
     733           0 :         if (inet_sk_state_load(sk_listener) != TCP_LISTEN)
     734           0 :                 goto drop;
     735             : 
     736           0 :         max_syn_ack_retries = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_synack_retries;
     737             :         /* Normally all the openreqs are young and become mature
     738             :          * (i.e. converted to established socket) for first timeout.
     739             :          * If synack was not acknowledged for 1 second, it means
     740             :          * one of the following things: synack was lost, ack was lost,
     741             :          * rtt is high or nobody planned to ack (i.e. synflood).
     742             :          * When server is a bit loaded, queue is populated with old
     743             :          * open requests, reducing effective size of queue.
     744             :          * When server is well loaded, queue size reduces to zero
     745             :          * after several minutes of work. It is not synflood,
     746             :          * it is normal operation. The solution is pruning
     747             :          * too old entries overriding normal timeout, when
     748             :          * situation becomes dangerous.
     749             :          *
     750             :          * Essentially, we reserve half of room for young
     751             :          * embrions; and abort old ones without pity, if old
     752             :          * ones are about to clog our table.
     753             :          */
     754           0 :         qlen = reqsk_queue_len(queue);
     755           0 :         if ((qlen << 1) > max(8U, READ_ONCE(sk_listener->sk_max_ack_backlog))) {
     756           0 :                 int young = reqsk_queue_len_young(queue) << 1;
     757             : 
     758           0 :                 while (max_syn_ack_retries > 2) {
     759           0 :                         if (qlen < young)
     760             :                                 break;
     761           0 :                         max_syn_ack_retries--;
     762           0 :                         young <<= 1;
     763             :                 }
     764             :         }
     765           0 :         syn_ack_recalc(req, max_syn_ack_retries, READ_ONCE(queue->rskq_defer_accept),
     766             :                        &expire, &resend);
     767           0 :         req->rsk_ops->syn_ack_timeout(req);
     768           0 :         if (!expire &&
     769           0 :             (!resend ||
     770           0 :              !inet_rtx_syn_ack(sk_listener, req) ||
     771           0 :              inet_rsk(req)->acked)) {
     772           0 :                 unsigned long timeo;
     773             : 
     774           0 :                 if (req->num_timeout++ == 0)
     775           0 :                         atomic_dec(&queue->young);
     776           0 :                 timeo = min(TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX);
     777           0 :                 mod_timer(&req->rsk_timer, jiffies + timeo);
     778           0 :                 return;
     779             :         }
     780           0 : drop:
     781           0 :         inet_csk_reqsk_queue_drop_and_put(sk_listener, req);
     782             : }
     783             : 
     784           4 : static void reqsk_queue_hash_req(struct request_sock *req,
     785             :                                  unsigned long timeout)
     786             : {
     787           4 :         timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED);
     788           4 :         mod_timer(&req->rsk_timer, jiffies + timeout);
     789             : 
     790           4 :         inet_ehash_insert(req_to_sk(req), NULL, NULL);
     791             :         /* before letting lookups find us, make sure all req fields
     792             :          * are committed to memory and refcnt initialized.
     793             :          */
     794           4 :         smp_wmb();
     795           4 :         refcount_set(&req->rsk_refcnt, 2 + 1);
     796           4 : }
     797             : 
     798           4 : void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
     799             :                                    unsigned long timeout)
     800             : {
     801           4 :         reqsk_queue_hash_req(req, timeout);
     802           4 :         inet_csk_reqsk_queue_added(sk);
     803           4 : }
     804             : EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
     805             : 
     806           4 : static void inet_clone_ulp(const struct request_sock *req, struct sock *newsk,
     807             :                            const gfp_t priority)
     808             : {
     809           4 :         struct inet_connection_sock *icsk = inet_csk(newsk);
     810             : 
     811           4 :         if (!icsk->icsk_ulp_ops)
     812             :                 return;
     813             : 
     814           0 :         if (icsk->icsk_ulp_ops->clone)
     815           0 :                 icsk->icsk_ulp_ops->clone(req, newsk, priority);
     816             : }
     817             : 
     818             : /**
     819             :  *      inet_csk_clone_lock - clone an inet socket, and lock its clone
     820             :  *      @sk: the socket to clone
     821             :  *      @req: request_sock
     822             :  *      @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
     823             :  *
     824             :  *      Caller must unlock socket even in error path (bh_unlock_sock(newsk))
     825             :  */
     826           4 : struct sock *inet_csk_clone_lock(const struct sock *sk,
     827             :                                  const struct request_sock *req,
     828             :                                  const gfp_t priority)
     829             : {
     830           4 :         struct sock *newsk = sk_clone_lock(sk, priority);
     831             : 
     832           4 :         if (newsk) {
     833           4 :                 struct inet_connection_sock *newicsk = inet_csk(newsk);
     834             : 
     835           4 :                 inet_sk_set_state(newsk, TCP_SYN_RECV);
     836           4 :                 newicsk->icsk_bind_hash = NULL;
     837             : 
     838           4 :                 inet_sk(newsk)->inet_dport = inet_rsk(req)->ir_rmt_port;
     839           4 :                 inet_sk(newsk)->inet_num = inet_rsk(req)->ir_num;
     840           4 :                 inet_sk(newsk)->inet_sport = htons(inet_rsk(req)->ir_num);
     841             : 
     842             :                 /* listeners have SOCK_RCU_FREE, not the children */
     843           4 :                 sock_reset_flag(newsk, SOCK_RCU_FREE);
     844             : 
     845           4 :                 inet_sk(newsk)->mc_list = NULL;
     846             : 
     847           4 :                 newsk->sk_mark = inet_rsk(req)->ir_mark;
     848           4 :                 atomic64_set(&newsk->sk_cookie,
     849           4 :                              atomic64_read(&inet_rsk(req)->ir_cookie));
     850             : 
     851           4 :                 newicsk->icsk_retransmits = 0;
     852           4 :                 newicsk->icsk_backoff          = 0;
     853           4 :                 newicsk->icsk_probes_out  = 0;
     854           4 :                 newicsk->icsk_probes_tstamp = 0;
     855             : 
     856             :                 /* Deinitialize accept_queue to trap illegal accesses. */
     857           4 :                 memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue));
     858             : 
     859           4 :                 inet_clone_ulp(req, newsk, priority);
     860             : 
     861           4 :                 security_inet_csk_clone(newsk, req);
     862             :         }
     863           4 :         return newsk;
     864             : }
     865             : EXPORT_SYMBOL_GPL(inet_csk_clone_lock);
     866             : 
     867             : /*
     868             :  * At this point, there should be no process reference to this
     869             :  * socket, and thus no user references at all.  Therefore we
     870             :  * can assume the socket waitqueue is inactive and nobody will
     871             :  * try to jump onto it.
     872             :  */
     873           4 : void inet_csk_destroy_sock(struct sock *sk)
     874             : {
     875           4 :         WARN_ON(sk->sk_state != TCP_CLOSE);
     876           4 :         WARN_ON(!sock_flag(sk, SOCK_DEAD));
     877             : 
     878             :         /* It cannot be in hash table! */
     879           4 :         WARN_ON(!sk_unhashed(sk));
     880             : 
     881             :         /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
     882           5 :         WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
     883             : 
     884           4 :         sk->sk_prot->destroy(sk);
     885             : 
     886           4 :         sk_stream_kill_queues(sk);
     887             : 
     888           4 :         xfrm_sk_free_policy(sk);
     889             : 
     890           4 :         sk_refcnt_debug_release(sk);
     891             : 
     892           4 :         percpu_counter_dec(sk->sk_prot->orphan_count);
     893             : 
     894           4 :         sock_put(sk);
     895           4 : }
     896             : EXPORT_SYMBOL(inet_csk_destroy_sock);
     897             : 
     898             : /* This function allows to force a closure of a socket after the call to
     899             :  * tcp/dccp_create_openreq_child().
     900             :  */
     901           0 : void inet_csk_prepare_forced_close(struct sock *sk)
     902             :         __releases(&sk->sk_lock.slock)
     903             : {
     904             :         /* sk_clone_lock locked the socket and set refcnt to 2 */
     905           0 :         bh_unlock_sock(sk);
     906           0 :         sock_put(sk);
     907           0 :         inet_csk_prepare_for_destroy_sock(sk);
     908           0 :         inet_sk(sk)->inet_num = 0;
     909           0 : }
     910             : EXPORT_SYMBOL(inet_csk_prepare_forced_close);
     911             : 
     912           3 : int inet_csk_listen_start(struct sock *sk, int backlog)
     913             : {
     914           3 :         struct inet_connection_sock *icsk = inet_csk(sk);
     915           3 :         struct inet_sock *inet = inet_sk(sk);
     916           3 :         int err = -EADDRINUSE;
     917             : 
     918           3 :         reqsk_queue_alloc(&icsk->icsk_accept_queue);
     919             : 
     920           3 :         sk->sk_ack_backlog = 0;
     921           3 :         inet_csk_delack_init(sk);
     922             : 
     923             :         /* There is race window here: we announce ourselves listening,
     924             :          * but this transition is still not validated by get_port().
     925             :          * It is OK, because this socket enters to hash table only
     926             :          * after validation is complete.
     927             :          */
     928           3 :         inet_sk_state_store(sk, TCP_LISTEN);
     929           3 :         if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
     930           3 :                 inet->inet_sport = htons(inet->inet_num);
     931             : 
     932           3 :                 sk_dst_reset(sk);
     933           3 :                 err = sk->sk_prot->hash(sk);
     934             : 
     935           3 :                 if (likely(!err))
     936             :                         return 0;
     937             :         }
     938             : 
     939           0 :         inet_sk_set_state(sk, TCP_CLOSE);
     940           0 :         return err;
     941             : }
     942             : EXPORT_SYMBOL_GPL(inet_csk_listen_start);
     943             : 
     944           0 : static void inet_child_forget(struct sock *sk, struct request_sock *req,
     945             :                               struct sock *child)
     946             : {
     947           0 :         sk->sk_prot->disconnect(child, O_NONBLOCK);
     948             : 
     949           0 :         sock_orphan(child);
     950             : 
     951           0 :         percpu_counter_inc(sk->sk_prot->orphan_count);
     952             : 
     953           0 :         if (sk->sk_protocol == IPPROTO_TCP && tcp_rsk(req)->tfo_listener) {
     954           0 :                 BUG_ON(rcu_access_pointer(tcp_sk(child)->fastopen_rsk) != req);
     955           0 :                 BUG_ON(sk != req->rsk_listener);
     956             : 
     957             :                 /* Paranoid, to prevent race condition if
     958             :                  * an inbound pkt destined for child is
     959             :                  * blocked by sock lock in tcp_v4_rcv().
     960             :                  * Also to satisfy an assertion in
     961             :                  * tcp_v4_destroy_sock().
     962             :                  */
     963           0 :                 RCU_INIT_POINTER(tcp_sk(child)->fastopen_rsk, NULL);
     964             :         }
     965           0 :         inet_csk_destroy_sock(child);
     966           0 : }
     967             : 
     968           4 : struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
     969             :                                       struct request_sock *req,
     970             :                                       struct sock *child)
     971             : {
     972           4 :         struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
     973             : 
     974           4 :         spin_lock(&queue->rskq_lock);
     975           4 :         if (unlikely(sk->sk_state != TCP_LISTEN)) {
     976           0 :                 inet_child_forget(sk, req, child);
     977           0 :                 child = NULL;
     978             :         } else {
     979           4 :                 req->sk = child;
     980           4 :                 req->dl_next = NULL;
     981           4 :                 if (queue->rskq_accept_head == NULL)
     982           4 :                         WRITE_ONCE(queue->rskq_accept_head, req);
     983             :                 else
     984           0 :                         queue->rskq_accept_tail->dl_next = req;
     985           4 :                 queue->rskq_accept_tail = req;
     986           4 :                 sk_acceptq_added(sk);
     987             :         }
     988           4 :         spin_unlock(&queue->rskq_lock);
     989           4 :         return child;
     990             : }
     991             : EXPORT_SYMBOL(inet_csk_reqsk_queue_add);
     992             : 
     993           4 : struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
     994             :                                          struct request_sock *req, bool own_req)
     995             : {
     996           4 :         if (own_req) {
     997           4 :                 inet_csk_reqsk_queue_drop(sk, req);
     998           4 :                 reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
     999           4 :                 if (inet_csk_reqsk_queue_add(sk, req, child))
    1000             :                         return child;
    1001             :         }
    1002             :         /* Too bad, another child took ownership of the request, undo. */
    1003           0 :         bh_unlock_sock(child);
    1004           0 :         sock_put(child);
    1005           0 :         return NULL;
    1006             : }
    1007             : EXPORT_SYMBOL(inet_csk_complete_hashdance);
    1008             : 
    1009             : /*
    1010             :  *      This routine closes sockets which have been at least partially
    1011             :  *      opened, but not yet accepted.
    1012             :  */
    1013           1 : void inet_csk_listen_stop(struct sock *sk)
    1014             : {
    1015           1 :         struct inet_connection_sock *icsk = inet_csk(sk);
    1016           1 :         struct request_sock_queue *queue = &icsk->icsk_accept_queue;
    1017           1 :         struct request_sock *next, *req;
    1018             : 
    1019             :         /* Following specs, it would be better either to send FIN
    1020             :          * (and enter FIN-WAIT-1, it is normal close)
    1021             :          * or to send active reset (abort).
    1022             :          * Certainly, it is pretty dangerous while synflood, but it is
    1023             :          * bad justification for our negligence 8)
    1024             :          * To be honest, we are not able to make either
    1025             :          * of the variants now.                 --ANK
    1026             :          */
    1027           1 :         while ((req = reqsk_queue_remove(queue, sk)) != NULL) {
    1028           0 :                 struct sock *child = req->sk;
    1029             : 
    1030           0 :                 local_bh_disable();
    1031           0 :                 bh_lock_sock(child);
    1032           0 :                 WARN_ON(sock_owned_by_user(child));
    1033           0 :                 sock_hold(child);
    1034             : 
    1035           0 :                 inet_child_forget(sk, req, child);
    1036           0 :                 reqsk_put(req);
    1037           0 :                 bh_unlock_sock(child);
    1038           0 :                 local_bh_enable();
    1039           0 :                 sock_put(child);
    1040             : 
    1041           0 :                 cond_resched();
    1042             :         }
    1043           1 :         if (queue->fastopenq.rskq_rst_head) {
    1044             :                 /* Free all the reqs queued in rskq_rst_head. */
    1045           0 :                 spin_lock_bh(&queue->fastopenq.lock);
    1046           0 :                 req = queue->fastopenq.rskq_rst_head;
    1047           0 :                 queue->fastopenq.rskq_rst_head = NULL;
    1048           0 :                 spin_unlock_bh(&queue->fastopenq.lock);
    1049           0 :                 while (req != NULL) {
    1050           0 :                         next = req->dl_next;
    1051           0 :                         reqsk_put(req);
    1052           0 :                         req = next;
    1053             :                 }
    1054             :         }
    1055           1 :         WARN_ON_ONCE(sk->sk_ack_backlog);
    1056           1 : }
    1057             : EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
    1058             : 
    1059           0 : void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
    1060             : {
    1061           0 :         struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
    1062           0 :         const struct inet_sock *inet = inet_sk(sk);
    1063             : 
    1064           0 :         sin->sin_family              = AF_INET;
    1065           0 :         sin->sin_addr.s_addr = inet->inet_daddr;
    1066           0 :         sin->sin_port                = inet->inet_dport;
    1067           0 : }
    1068             : EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
    1069             : 
    1070           0 : static struct dst_entry *inet_csk_rebuild_route(struct sock *sk, struct flowi *fl)
    1071             : {
    1072           0 :         const struct inet_sock *inet = inet_sk(sk);
    1073           0 :         const struct ip_options_rcu *inet_opt;
    1074           0 :         __be32 daddr = inet->inet_daddr;
    1075           0 :         struct flowi4 *fl4;
    1076           0 :         struct rtable *rt;
    1077             : 
    1078           0 :         rcu_read_lock();
    1079           0 :         inet_opt = rcu_dereference(inet->inet_opt);
    1080           0 :         if (inet_opt && inet_opt->opt.srr)
    1081           0 :                 daddr = inet_opt->opt.faddr;
    1082           0 :         fl4 = &fl->u.ip4;
    1083           0 :         rt = ip_route_output_ports(sock_net(sk), fl4, sk, daddr,
    1084           0 :                                    inet->inet_saddr, inet->inet_dport,
    1085           0 :                                    inet->inet_sport, sk->sk_protocol,
    1086           0 :                                    RT_CONN_FLAGS(sk), sk->sk_bound_dev_if);
    1087           0 :         if (IS_ERR(rt))
    1088             :                 rt = NULL;
    1089           0 :         if (rt)
    1090           0 :                 sk_setup_caps(sk, &rt->dst);
    1091           0 :         rcu_read_unlock();
    1092             : 
    1093           0 :         return &rt->dst;
    1094             : }
    1095             : 
    1096           0 : struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu)
    1097             : {
    1098           0 :         struct dst_entry *dst = __sk_dst_check(sk, 0);
    1099           0 :         struct inet_sock *inet = inet_sk(sk);
    1100             : 
    1101           0 :         if (!dst) {
    1102           0 :                 dst = inet_csk_rebuild_route(sk, &inet->cork.fl);
    1103           0 :                 if (!dst)
    1104           0 :                         goto out;
    1105             :         }
    1106           0 :         dst->ops->update_pmtu(dst, sk, NULL, mtu, true);
    1107             : 
    1108           0 :         dst = __sk_dst_check(sk, 0);
    1109           0 :         if (!dst)
    1110           0 :                 dst = inet_csk_rebuild_route(sk, &inet->cork.fl);
    1111           0 : out:
    1112           0 :         return dst;
    1113             : }
    1114             : EXPORT_SYMBOL_GPL(inet_csk_update_pmtu);

Generated by: LCOV version 1.14