net/rxrpc/ar-input.c

   1 /* RxRPC packet reception
   2  *
   3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/net.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/errqueue.h>
  16 #include <linux/udp.h>
  17 #include <linux/in.h>
  18 #include <linux/in6.h>
  19 #include <linux/icmp.h>
  20 #include <linux/gfp.h>
  21 #include <net/sock.h>
  22 #include <net/af_rxrpc.h>
  23 #include <net/ip.h>
  24 #include <net/udp.h>
  25 #include <net/net_namespace.h>
  26 #include "ar-internal.h"
  27
  28 unsigned long rxrpc_ack_timeout = 1;
  29
  30 const char *rxrpc_pkts[] = {
  31         "?00",
  32         "DATA", "ACK", "BUSY", "ABORT", "ACKALL", "CHALL", "RESP", "DEBUG",
  33         "?09", "?10", "?11", "?12", "?13", "?14", "?15"
  34 };
  35
  36 /*
  37  * queue a packet for recvmsg to pass to userspace
  38  * - the caller must hold a lock on call->lock
  39  * - must not be called with interrupts disabled (sk_filter() disables BH's)
  40  * - eats the packet whether successful or not
  41  * - there must be just one reference to the packet, which the caller passes to
  42  *   this function
  43  */
  44 int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
  45                         bool force, bool terminal)
  46 {
  47         struct rxrpc_skb_priv *sp;
  48         struct rxrpc_sock *rx = call->socket;
  49         struct sock *sk;
  50         int skb_len, ret;
  51
  52         _enter(",,%d,%d", force, terminal);
  53
  54         ASSERT(!irqs_disabled());
  55
  56         sp = rxrpc_skb(skb);
  57         ASSERTCMP(sp->call, ==, call);
  58
  59         /* if we've already posted the terminal message for a call, then we
  60          * don't post any more */
  61         if (test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
  62                 _debug("already terminated");
  63                 ASSERTCMP(call->state, >=, RXRPC_CALL_COMPLETE);
  64                 skb->destructor = NULL;
  65                 sp->call = NULL;
  66                 rxrpc_put_call(call);
  67                 rxrpc_free_skb(skb);
  68                 return 0;
  69         }
  70
  71         sk = &rx->sk;
  72
  73         if (!force) {
  74                 /* cast skb->rcvbuf to unsigned...  It's pointless, but
  75                  * reduces number of warnings when compiling with -W
  76                  * --ANK */
  77 //              ret = -ENOBUFS;
  78 //              if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
  79 //                  (unsigned) sk->sk_rcvbuf)
  80 //                      goto out;
  81
  82                 ret = sk_filter(sk, skb);
  83                 if (ret < 0)
  84                         goto out;
  85         }
  86
  87         spin_lock_bh(&sk->sk_receive_queue.lock);
  88         if (!test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags) &&
  89             !test_bit(RXRPC_CALL_RELEASED, &call->flags) &&
  90             call->socket->sk.sk_state != RXRPC_CLOSE) {
  91                 skb->destructor = rxrpc_packet_destructor;
  92                 skb->dev = NULL;
  93                 skb->sk = sk;
  94                 atomic_add(skb->truesize, &sk->sk_rmem_alloc);
  95
  96                 if (terminal) {
  97                         _debug("<<<< TERMINAL MESSAGE >>>>");
  98                         set_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags);
  99                 }
 100
 101                 /* allow interception by a kernel service */
 102                 if (rx->interceptor) {
 103                         rx->interceptor(sk, call->user_call_ID, skb);
 104                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 105                 } else {
 106
 107                         /* Cache the SKB length before we tack it onto the
 108                          * receive queue.  Once it is added it no longer
 109                          * belongs to us and may be freed by other threads of
 110                          * control pulling packets from the queue */
 111                         skb_len = skb->len;
 112
 113                         _net("post skb %p", skb);
 114                         __skb_queue_tail(&sk->sk_receive_queue, skb);
 115                         spin_unlock_bh(&sk->sk_receive_queue.lock);
 116
 117                         if (!sock_flag(sk, SOCK_DEAD))
 118                                 sk->sk_data_ready(sk, skb_len);
 119                 }
 120                 skb = NULL;
 121         } else {
 122                 spin_unlock_bh(&sk->sk_receive_queue.lock);
 123         }
 124         ret = 0;
 125
 126 out:
 127         /* release the socket buffer */
 128         if (skb) {
 129                 skb->destructor = NULL;
 130                 sp->call = NULL;
 131                 rxrpc_put_call(call);
 132                 rxrpc_free_skb(skb);
 133         }
 134
 135         _leave(" = %d", ret);
 136         return ret;
 137 }
 138
 139 /*
 140  * process a DATA packet, posting the packet to the appropriate queue
 141  * - eats the packet if successful
 142  */
 143 static int rxrpc_fast_process_data(struct rxrpc_call *call,
 144                                    struct sk_buff *skb, u32 seq)
 145 {
 146         struct rxrpc_skb_priv *sp;
 147         bool terminal;
 148         int ret, ackbit, ack;
 149
 150         _enter("{%u,%u},,{%u}", call->rx_data_post, call->rx_first_oos, seq);
 151
 152         sp = rxrpc_skb(skb);
 153         ASSERTCMP(sp->call, ==, NULL);
 154
 155         spin_lock(&call->lock);
 156
 157         if (call->state > RXRPC_CALL_COMPLETE)
 158                 goto discard;
 159
 160         ASSERTCMP(call->rx_data_expect, >=, call->rx_data_post);
 161         ASSERTCMP(call->rx_data_post, >=, call->rx_data_recv);
 162         ASSERTCMP(call->rx_data_recv, >=, call->rx_data_eaten);
 163
 164         if (seq < call->rx_data_post) {
 165                 _debug("dup #%u [-%u]", seq, call->rx_data_post);
 166                 ack = RXRPC_ACK_DUPLICATE;
 167                 ret = -ENOBUFS;
 168                 goto discard_and_ack;
 169         }
 170
 171         /* we may already have the packet in the out of sequence queue */
 172         ackbit = seq - (call->rx_data_eaten + 1);
 173         ASSERTCMP(ackbit, >=, 0);
 174         if (__test_and_set_bit(ackbit, call->ackr_window)) {
 175                 _debug("dup oos #%u [%u,%u]",
 176                        seq, call->rx_data_eaten, call->rx_data_post);
 177                 ack = RXRPC_ACK_DUPLICATE;
 178                 goto discard_and_ack;
 179         }
 180
 181         if (seq >= call->ackr_win_top) {
 182                 _debug("exceed #%u [%u]", seq, call->ackr_win_top);
 183                 __clear_bit(ackbit, call->ackr_window);
 184                 ack = RXRPC_ACK_EXCEEDS_WINDOW;
 185                 goto discard_and_ack;
 186         }
 187
 188         if (seq == call->rx_data_expect) {
 189                 clear_bit(RXRPC_CALL_EXPECT_OOS, &call->flags);
 190                 call->rx_data_expect++;
 191         } else if (seq > call->rx_data_expect) {
 192                 _debug("oos #%u [%u]", seq, call->rx_data_expect);
 193                 call->rx_data_expect = seq + 1;
 194                 if (test_and_set_bit(RXRPC_CALL_EXPECT_OOS, &call->flags)) {
 195                         ack = RXRPC_ACK_OUT_OF_SEQUENCE;
 196                         goto enqueue_and_ack;
 197                 }
 198                 goto enqueue_packet;
 199         }
 200
 201         if (seq != call->rx_data_post) {
 202                 _debug("ahead #%u [%u]", seq, call->rx_data_post);
 203                 goto enqueue_packet;
 204         }
 205
 206         if (test_bit(RXRPC_CALL_RCVD_LAST, &call->flags))
 207                 goto protocol_error;
 208
 209         /* if the packet need security things doing to it, then it goes down
 210          * the slow path */
 211         if (call->conn->security)
 212                 goto enqueue_packet;
 213
 214         sp->call = call;
 215         rxrpc_get_call(call);
 216         terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
 217                     !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
 218         ret = rxrpc_queue_rcv_skb(call, skb, false, terminal);
 219         if (ret < 0) {
 220                 if (ret == -ENOMEM || ret == -ENOBUFS) {
 221                         __clear_bit(ackbit, call->ackr_window);
 222                         ack = RXRPC_ACK_NOSPACE;
 223                         goto discard_and_ack;
 224                 }
 225                 goto out;
 226         }
 227
 228         skb = NULL;
 229
 230         _debug("post #%u", seq);
 231         ASSERTCMP(call->rx_data_post, ==, seq);
 232         call->rx_data_post++;
 233
 234         if (sp->hdr.flags & RXRPC_LAST_PACKET)
 235                 set_bit(RXRPC_CALL_RCVD_LAST, &call->flags);
 236
 237         /* if we've reached an out of sequence packet then we need to drain
 238          * that queue into the socket Rx queue now */
 239         if (call->rx_data_post == call->rx_first_oos) {
 240                 _debug("drain rx oos now");
 241                 read_lock(&call->state_lock);
 242                 if (call->state < RXRPC_CALL_COMPLETE &&
 243                     !test_and_set_bit(RXRPC_CALL_DRAIN_RX_OOS, &call->events))
 244                         rxrpc_queue_call(call);
 245                 read_unlock(&call->state_lock);
 246         }
 247
 248         spin_unlock(&call->lock);
 249         atomic_inc(&call->ackr_not_idle);
 250         rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, sp->hdr.serial, false);
 251         _leave(" = 0 [posted]");
 252         return 0;
 253
 254 protocol_error:
 255         ret = -EBADMSG;
 256 out:
 257         spin_unlock(&call->lock);
 258         _leave(" = %d", ret);
 259         return ret;
 260
 261 discard_and_ack:
 262         _debug("discard and ACK packet %p", skb);
 263         __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
 264 discard:
 265         spin_unlock(&call->lock);
 266         rxrpc_free_skb(skb);
 267         _leave(" = 0 [discarded]");
 268         return 0;
 269
 270 enqueue_and_ack:
 271         __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
 272 enqueue_packet:
 273         _net("defer skb %p", skb);
 274         spin_unlock(&call->lock);
 275         skb_queue_tail(&call->rx_queue, skb);
 276         atomic_inc(&call->ackr_not_idle);
 277         read_lock(&call->state_lock);
 278         if (call->state < RXRPC_CALL_DEAD)
 279                 rxrpc_queue_call(call);
 280         read_unlock(&call->state_lock);
 281         _leave(" = 0 [queued]");
 282         return 0;
 283 }
 284
 285 /*
 286  * assume an implicit ACKALL of the transmission phase of a client socket upon
 287  * reception of the first reply packet
 288  */
 289 static void rxrpc_assume_implicit_ackall(struct rxrpc_call *call, u32 serial)
 290 {
 291         write_lock_bh(&call->state_lock);
 292
 293         switch (call->state) {
 294         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
 295                 call->state = RXRPC_CALL_CLIENT_RECV_REPLY;
 296                 call->acks_latest = serial;
 297
 298                 _debug("implicit ACKALL %%%u", call->acks_latest);
 299                 set_bit(RXRPC_CALL_RCVD_ACKALL, &call->events);
 300                 write_unlock_bh(&call->state_lock);
 301
 302                 if (try_to_del_timer_sync(&call->resend_timer) >= 0) {
 303                         clear_bit(RXRPC_CALL_RESEND_TIMER, &call->events);
 304                         clear_bit(RXRPC_CALL_RESEND, &call->events);
 305                         clear_bit(RXRPC_CALL_RUN_RTIMER, &call->flags);
 306                 }
 307                 break;
 308
 309         default:
 310                 write_unlock_bh(&call->state_lock);
 311                 break;
 312         }
 313 }
 314
 315 /*
 316  * post an incoming packet to the nominated call to deal with
 317  * - must get rid of the sk_buff, either by freeing it or by queuing it
 318  */
 319 void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
 320 {
 321         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 322         __be32 _abort_code;
 323         u32 serial, hi_serial, seq, abort_code;
 324
 325         _enter("%p,%p", call, skb);
 326
 327         ASSERT(!irqs_disabled());
 328
 329 #if 0 // INJECT RX ERROR
 330         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA) {
 331                 static int skip = 0;
 332                 if (++skip == 3) {
 333                         printk("DROPPED 3RD PACKET!!!!!!!!!!!!!\n");
 334                         skip = 0;
 335                         goto free_packet;
 336                 }
 337         }
 338 #endif
 339
 340         /* track the latest serial number on this connection for ACK packet
 341          * information */
 342         serial = ntohl(sp->hdr.serial);
 343         hi_serial = atomic_read(&call->conn->hi_serial);
 344         while (serial > hi_serial)
 345                 hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
 346                                            serial);
 347
 348         /* request ACK generation for any ACK or DATA packet that requests
 349          * it */
 350         if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
 351                 _proto("ACK Requested on %%%u", serial);
 352                 rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, sp->hdr.serial,
 353                                   !(sp->hdr.flags & RXRPC_MORE_PACKETS));
 354         }
 355
 356         switch (sp->hdr.type) {
 357         case RXRPC_PACKET_TYPE_ABORT:
 358                 _debug("abort");
 359
 360                 if (skb_copy_bits(skb, 0, &_abort_code,
 361                                   sizeof(_abort_code)) < 0)
 362                         goto protocol_error;
 363
 364                 abort_code = ntohl(_abort_code);
 365                 _proto("Rx ABORT %%%u { %x }", serial, abort_code);
 366
 367                 write_lock_bh(&call->state_lock);
 368                 if (call->state < RXRPC_CALL_COMPLETE) {
 369                         call->state = RXRPC_CALL_REMOTELY_ABORTED;
 370                         call->abort_code = abort_code;
 371                         set_bit(RXRPC_CALL_RCVD_ABORT, &call->events);
 372                         rxrpc_queue_call(call);
 373                 }
 374                 goto free_packet_unlock;
 375
 376         case RXRPC_PACKET_TYPE_BUSY:
 377                 _proto("Rx BUSY %%%u", serial);
 378
 379                 if (call->conn->out_clientflag)
 380                         goto protocol_error;
 381
 382                 write_lock_bh(&call->state_lock);
 383                 switch (call->state) {
 384                 case RXRPC_CALL_CLIENT_SEND_REQUEST:
 385                         call->state = RXRPC_CALL_SERVER_BUSY;
 386                         set_bit(RXRPC_CALL_RCVD_BUSY, &call->events);
 387                         rxrpc_queue_call(call);
 388                 case RXRPC_CALL_SERVER_BUSY:
 389                         goto free_packet_unlock;
 390                 default:
 391                         goto protocol_error_locked;
 392                 }
 393
 394         default:
 395                 _proto("Rx %s %%%u", rxrpc_pkts[sp->hdr.type], serial);
 396                 goto protocol_error;
 397
 398         case RXRPC_PACKET_TYPE_DATA:
 399                 seq = ntohl(sp->hdr.seq);
 400
 401                 _proto("Rx DATA %%%u { #%u }", serial, seq);
 402
 403                 if (seq == 0)
 404                         goto protocol_error;
 405
 406                 call->ackr_prev_seq = sp->hdr.seq;
 407
 408                 /* received data implicitly ACKs all of the request packets we
 409                  * sent when we're acting as a client */
 410                 if (call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY)
 411                         rxrpc_assume_implicit_ackall(call, serial);
 412
 413                 switch (rxrpc_fast_process_data(call, skb, seq)) {
 414                 case 0:
 415                         skb = NULL;
 416                         goto done;
 417
 418                 default:
 419                         BUG();
 420
 421                         /* data packet received beyond the last packet */
 422                 case -EBADMSG:
 423                         goto protocol_error;
 424                 }
 425
 426         case RXRPC_PACKET_TYPE_ACK:
 427                 /* ACK processing is done in process context */
 428                 read_lock_bh(&call->state_lock);
 429                 if (call->state < RXRPC_CALL_DEAD) {
 430                         skb_queue_tail(&call->rx_queue, skb);
 431                         rxrpc_queue_call(call);
 432                         skb = NULL;
 433                 }
 434                 read_unlock_bh(&call->state_lock);
 435                 goto free_packet;
 436         }
 437
 438 protocol_error:
 439         _debug("protocol error");
 440         write_lock_bh(&call->state_lock);
 441 protocol_error_locked:
 442         if (call->state <= RXRPC_CALL_COMPLETE) {
 443                 call->state = RXRPC_CALL_LOCALLY_ABORTED;
 444                 call->abort_code = RX_PROTOCOL_ERROR;
 445                 set_bit(RXRPC_CALL_ABORT, &call->events);
 446                 rxrpc_queue_call(call);
 447         }
 448 free_packet_unlock:
 449         write_unlock_bh(&call->state_lock);
 450 free_packet:
 451         rxrpc_free_skb(skb);
 452 done:
 453         _leave("");
 454 }
 455
 456 /*
 457  * split up a jumbo data packet
 458  */
 459 static void rxrpc_process_jumbo_packet(struct rxrpc_call *call,
 460                                        struct sk_buff *jumbo)
 461 {
 462         struct rxrpc_jumbo_header jhdr;
 463         struct rxrpc_skb_priv *sp;
 464         struct sk_buff *part;
 465
 466         _enter(",{%u,%u}", jumbo->data_len, jumbo->len);
 467
 468         sp = rxrpc_skb(jumbo);
 469
 470         do {
 471                 sp->hdr.flags &= ~RXRPC_JUMBO_PACKET;
 472
 473                 /* make a clone to represent the first subpacket in what's left
 474                  * of the jumbo packet */
 475                 part = skb_clone(jumbo, GFP_ATOMIC);
 476                 if (!part) {
 477                         /* simply ditch the tail in the event of ENOMEM */
 478                         pskb_trim(jumbo, RXRPC_JUMBO_DATALEN);
 479                         break;
 480                 }
 481                 rxrpc_new_skb(part);
 482
 483                 pskb_trim(part, RXRPC_JUMBO_DATALEN);
 484
 485                 if (!pskb_pull(jumbo, RXRPC_JUMBO_DATALEN))
 486                         goto protocol_error;
 487
 488                 if (skb_copy_bits(jumbo, 0, &jhdr, sizeof(jhdr)) < 0)
 489                         goto protocol_error;
 490                 if (!pskb_pull(jumbo, sizeof(jhdr)))
 491                         BUG();
 492
 493                 sp->hdr.seq     = htonl(ntohl(sp->hdr.seq) + 1);
 494                 sp->hdr.serial  = htonl(ntohl(sp->hdr.serial) + 1);
 495                 sp->hdr.flags   = jhdr.flags;
 496                 sp->hdr._rsvd   = jhdr._rsvd;
 497
 498                 _proto("Rx DATA Jumbo %%%u", ntohl(sp->hdr.serial) - 1);
 499
 500                 rxrpc_fast_process_packet(call, part);
 501                 part = NULL;
 502
 503         } while (sp->hdr.flags & RXRPC_JUMBO_PACKET);
 504
 505         rxrpc_fast_process_packet(call, jumbo);
 506         _leave("");
 507         return;
 508
 509 protocol_error:
 510         _debug("protocol error");
 511         rxrpc_free_skb(part);
 512         rxrpc_free_skb(jumbo);
 513         write_lock_bh(&call->state_lock);
 514         if (call->state <= RXRPC_CALL_COMPLETE) {
 515                 call->state = RXRPC_CALL_LOCALLY_ABORTED;
 516                 call->abort_code = RX_PROTOCOL_ERROR;
 517                 set_bit(RXRPC_CALL_ABORT, &call->events);
 518                 rxrpc_queue_call(call);
 519         }
 520         write_unlock_bh(&call->state_lock);
 521         _leave("");
 522 }
 523
 524 /*
 525  * post an incoming packet to the appropriate call/socket to deal with
 526  * - must get rid of the sk_buff, either by freeing it or by queuing it
 527  */
 528 static void rxrpc_post_packet_to_call(struct rxrpc_connection *conn,
 529                                       struct sk_buff *skb)
 530 {
 531         struct rxrpc_skb_priv *sp;
 532         struct rxrpc_call *call;
 533         struct rb_node *p;
 534         __be32 call_id;
 535
 536         _enter("%p,%p", conn, skb);
 537
 538         read_lock_bh(&conn->lock);
 539
 540         sp = rxrpc_skb(skb);
 541
 542         /* look at extant calls by channel number first */
 543         call = conn->channels[ntohl(sp->hdr.cid) & RXRPC_CHANNELMASK];
 544         if (!call || call->call_id != sp->hdr.callNumber)
 545                 goto call_not_extant;
 546
 547         _debug("extant call [%d]", call->state);
 548         ASSERTCMP(call->conn, ==, conn);
 549
 550         read_lock(&call->state_lock);
 551         switch (call->state) {
 552         case RXRPC_CALL_LOCALLY_ABORTED:
 553                 if (!test_and_set_bit(RXRPC_CALL_ABORT, &call->events))
 554                         rxrpc_queue_call(call);
 555         case RXRPC_CALL_REMOTELY_ABORTED:
 556         case RXRPC_CALL_NETWORK_ERROR:
 557         case RXRPC_CALL_DEAD:
 558                 goto free_unlock;
 559         default:
 560                 break;
 561         }
 562
 563         read_unlock(&call->state_lock);
 564         rxrpc_get_call(call);
 565         read_unlock_bh(&conn->lock);
 566
 567         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 568             sp->hdr.flags & RXRPC_JUMBO_PACKET)
 569                 rxrpc_process_jumbo_packet(call, skb);
 570         else
 571                 rxrpc_fast_process_packet(call, skb);
 572
 573         rxrpc_put_call(call);
 574         goto done;
 575
 576 call_not_extant:
 577         /* search the completed calls in case what we're dealing with is
 578          * there */
 579         _debug("call not extant");
 580
 581         call_id = sp->hdr.callNumber;
 582         p = conn->calls.rb_node;
 583         while (p) {
 584                 call = rb_entry(p, struct rxrpc_call, conn_node);
 585
 586                 if (call_id < call->call_id)
 587                         p = p->rb_left;
 588                 else if (call_id > call->call_id)
 589                         p = p->rb_right;
 590                 else
 591                         goto found_completed_call;
 592         }
 593
 594 dead_call:
 595         /* it's a either a really old call that we no longer remember or its a
 596          * new incoming call */
 597         read_unlock_bh(&conn->lock);
 598
 599         if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
 600             sp->hdr.seq == cpu_to_be32(1)) {
 601                 _debug("incoming call");
 602                 skb_queue_tail(&conn->trans->local->accept_queue, skb);
 603                 rxrpc_queue_work(&conn->trans->local->acceptor);
 604                 goto done;
 605         }
 606
 607         _debug("dead call");
 608         skb->priority = RX_CALL_DEAD;
 609         rxrpc_reject_packet(conn->trans->local, skb);
 610         goto done;
 611
 612         /* resend last packet of a completed call
 613          * - client calls may have been aborted or ACK'd
 614          * - server calls may have been aborted
 615          */
 616 found_completed_call:
 617         _debug("completed call");
 618
 619         if (atomic_read(&call->usage) == 0)
 620                 goto dead_call;
 621
 622         /* synchronise any state changes */
 623         read_lock(&call->state_lock);
 624         ASSERTIFCMP(call->state != RXRPC_CALL_CLIENT_FINAL_ACK,
 625                     call->state, >=, RXRPC_CALL_COMPLETE);
 626
 627         if (call->state == RXRPC_CALL_LOCALLY_ABORTED ||
 628             call->state == RXRPC_CALL_REMOTELY_ABORTED ||
 629             call->state == RXRPC_CALL_DEAD) {
 630                 read_unlock(&call->state_lock);
 631                 goto dead_call;
 632         }
 633
 634         if (call->conn->in_clientflag) {
 635                 read_unlock(&call->state_lock);
 636                 goto dead_call; /* complete server call */
 637         }
 638
 639         _debug("final ack again");
 640         rxrpc_get_call(call);
 641         set_bit(RXRPC_CALL_ACK_FINAL, &call->events);
 642         rxrpc_queue_call(call);
 643
 644 free_unlock:
 645         read_unlock(&call->state_lock);
 646         read_unlock_bh(&conn->lock);
 647         rxrpc_free_skb(skb);
 648 done:
 649         _leave("");
 650 }
 651
 652 /*
 653  * post connection-level events to the connection
 654  * - this includes challenges, responses and some aborts
 655  */
 656 static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
 657                                       struct sk_buff *skb)
 658 {
 659         _enter("%p,%p", conn, skb);
 660
 661         atomic_inc(&conn->usage);
 662         skb_queue_tail(&conn->rx_queue, skb);
 663         rxrpc_queue_conn(conn);
 664 }
 665
 666 /*
 667  * handle data received on the local endpoint
 668  * - may be called in interrupt context
 669  */
 670 void rxrpc_data_ready(struct sock *sk, int count)
 671 {
 672         struct rxrpc_connection *conn;
 673         struct rxrpc_transport *trans;
 674         struct rxrpc_skb_priv *sp;
 675         struct rxrpc_local *local;
 676         struct rxrpc_peer *peer;
 677         struct sk_buff *skb;
 678         int ret;
 679
 680         _enter("%p, %d", sk, count);
 681
 682         ASSERT(!irqs_disabled());
 683
 684         read_lock_bh(&rxrpc_local_lock);
 685         local = sk->sk_user_data;
 686         if (local && atomic_read(&local->usage) > 0)
 687                 rxrpc_get_local(local);
 688         else
 689                 local = NULL;
 690         read_unlock_bh(&rxrpc_local_lock);
 691         if (!local) {
 692                 _leave(" [local dead]");
 693                 return;
 694         }
 695
 696         skb = skb_recv_datagram(sk, 0, 1, &ret);
 697         if (!skb) {
 698                 rxrpc_put_local(local);
 699                 if (ret == -EAGAIN)
 700                         return;
 701                 _debug("UDP socket error %d", ret);
 702                 return;
 703         }
 704
 705         rxrpc_new_skb(skb);
 706
 707         _net("recv skb %p", skb);
 708
 709         /* we'll probably need to checksum it (didn't call sock_recvmsg) */
 710         if (skb_checksum_complete(skb)) {
 711                 rxrpc_free_skb(skb);
 712                 rxrpc_put_local(local);
 713                 UDP_INC_STATS_BH(&init_net, UDP_MIB_INERRORS, 0);
 714                 _leave(" [CSUM failed]");
 715                 return;
 716         }
 717
 718         UDP_INC_STATS_BH(&init_net, UDP_MIB_INDATAGRAMS, 0);
 719
 720         /* the socket buffer we have is owned by UDP, with UDP's data all over
 721          * it, but we really want our own */
 722         skb_orphan(skb);
 723         sp = rxrpc_skb(skb);
 724         memset(sp, 0, sizeof(*sp));
 725
 726         _net("Rx UDP packet from %08x:%04hu",
 727              ntohl(ip_hdr(skb)->saddr), ntohs(udp_hdr(skb)->source));
 728
 729         /* dig out the RxRPC connection details */
 730         if (skb_copy_bits(skb, sizeof(struct udphdr), &sp->hdr,
 731                           sizeof(sp->hdr)) < 0)
 732                 goto bad_message;
 733         if (!pskb_pull(skb, sizeof(struct udphdr) + sizeof(sp->hdr)))
 734                 BUG();
 735
 736         _net("Rx RxRPC %s ep=%x call=%x:%x",
 737              sp->hdr.flags & RXRPC_CLIENT_INITIATED ? "ToServer" : "ToClient",
 738              ntohl(sp->hdr.epoch),
 739              ntohl(sp->hdr.cid),
 740              ntohl(sp->hdr.callNumber));
 741
 742         if (sp->hdr.type == 0 || sp->hdr.type >= RXRPC_N_PACKET_TYPES) {
 743                 _proto("Rx Bad Packet Type %u", sp->hdr.type);
 744                 goto bad_message;
 745         }
 746
 747         if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 748             (sp->hdr.callNumber == 0 || sp->hdr.seq == 0))
 749                 goto bad_message;
 750
 751         peer = rxrpc_find_peer(local, ip_hdr(skb)->saddr, udp_hdr(skb)->source);
 752         if (IS_ERR(peer))
 753                 goto cant_route_call;
 754
 755         trans = rxrpc_find_transport(local, peer);
 756         rxrpc_put_peer(peer);
 757         if (!trans)
 758                 goto cant_route_call;
 759
 760         conn = rxrpc_find_connection(trans, &sp->hdr);
 761         rxrpc_put_transport(trans);
 762         if (!conn)
 763                 goto cant_route_call;
 764
 765         _debug("CONN %p {%d}", conn, conn->debug_id);
 766
 767         if (sp->hdr.callNumber == 0)
 768                 rxrpc_post_packet_to_conn(conn, skb);
 769         else
 770                 rxrpc_post_packet_to_call(conn, skb);
 771         rxrpc_put_connection(conn);
 772         rxrpc_put_local(local);
 773         return;
 774
 775 cant_route_call:
 776         _debug("can't route call");
 777         if (sp->hdr.flags & RXRPC_CLIENT_INITIATED &&
 778             sp->hdr.type == RXRPC_PACKET_TYPE_DATA) {
 779                 if (sp->hdr.seq == cpu_to_be32(1)) {
 780                         _debug("first packet");
 781                         skb_queue_tail(&local->accept_queue, skb);
 782                         rxrpc_queue_work(&local->acceptor);
 783                         rxrpc_put_local(local);
 784                         _leave(" [incoming]");
 785                         return;
 786                 }
 787                 skb->priority = RX_INVALID_OPERATION;
 788         } else {
 789                 skb->priority = RX_CALL_DEAD;
 790         }
 791
 792         _debug("reject");
 793         rxrpc_reject_packet(local, skb);
 794         rxrpc_put_local(local);
 795         _leave(" [no call]");
 796         return;
 797
 798 bad_message:
 799         skb->priority = RX_PROTOCOL_ERROR;
 800         rxrpc_reject_packet(local, skb);
 801         rxrpc_put_local(local);
 802         _leave(" [badmsg]");
 803 }