l2tp: add udp encap socket destroy handler
[linux-3.10.git] / net / l2tp / l2tp_core.c
index 2ac884d..ee726a7 100644 (file)
@@ -101,6 +101,7 @@ struct l2tp_skb_cb {
 
 static atomic_t l2tp_tunnel_count;
 static atomic_t l2tp_session_count;
+static struct workqueue_struct *l2tp_wq;
 
 /* per-net private data for this module */
 static unsigned int l2tp_net_id;
@@ -122,7 +123,6 @@ static inline struct l2tp_net *l2tp_pernet(struct net *net)
        return net_generic(net, l2tp_net_id);
 }
 
-
 /* Tunnel reference counts. Incremented per session that is added to
  * the tunnel.
  */
@@ -221,10 +221,9 @@ static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
        struct hlist_head *session_list =
                l2tp_session_id_hash_2(pn, session_id);
        struct l2tp_session *session;
-       struct hlist_node *walk;
 
        rcu_read_lock_bh();
-       hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
+       hlist_for_each_entry_rcu(session, session_list, global_hlist) {
                if (session->session_id == session_id) {
                        rcu_read_unlock_bh();
                        return session;
@@ -253,7 +252,6 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 {
        struct hlist_head *session_list;
        struct l2tp_session *session;
-       struct hlist_node *walk;
 
        /* In L2TPv3, session_ids are unique over all tunnels and we
         * sometimes need to look them up before we know the
@@ -264,7 +262,7 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 
        session_list = l2tp_session_id_hash(tunnel, session_id);
        read_lock_bh(&tunnel->hlist_lock);
-       hlist_for_each_entry(session, walk, session_list, hlist) {
+       hlist_for_each_entry(session, session_list, hlist) {
                if (session->session_id == session_id) {
                        read_unlock_bh(&tunnel->hlist_lock);
                        return session;
@@ -279,13 +277,12 @@ EXPORT_SYMBOL_GPL(l2tp_session_find);
 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 {
        int hash;
-       struct hlist_node *walk;
        struct l2tp_session *session;
        int count = 0;
 
        read_lock_bh(&tunnel->hlist_lock);
        for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
-               hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
+               hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                        if (++count > nth) {
                                read_unlock_bh(&tunnel->hlist_lock);
                                return session;
@@ -306,12 +303,11 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
 {
        struct l2tp_net *pn = l2tp_pernet(net);
        int hash;
-       struct hlist_node *walk;
        struct l2tp_session *session;
 
        rcu_read_lock_bh();
        for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
-               hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) {
+               hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                        if (!strcmp(session->ifname, ifname)) {
                                rcu_read_unlock_bh();
                                return session;
@@ -1271,6 +1267,7 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
        struct l2tp_tunnel *tunnel;
+       struct l2tp_net *pn;
 
        tunnel = sk->sk_user_data;
        if (tunnel == NULL)
@@ -1278,31 +1275,37 @@ static void l2tp_tunnel_destruct(struct sock *sk)
 
        l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
 
-       /* Close all sessions */
-       l2tp_tunnel_closeall(tunnel);
 
+       /* Disable udp encapsulation */
        switch (tunnel->encap) {
        case L2TP_ENCAPTYPE_UDP:
                /* No longer an encapsulation socket. See net/ipv4/udp.c */
                (udp_sk(sk))->encap_type = 0;
                (udp_sk(sk))->encap_rcv = NULL;
+               (udp_sk(sk))->encap_destroy = NULL;
                break;
        case L2TP_ENCAPTYPE_IP:
                break;
        }
 
        /* Remove hooks into tunnel socket */
-       tunnel->sock = NULL;
        sk->sk_destruct = tunnel->old_sk_destruct;
        sk->sk_user_data = NULL;
+       tunnel->sock = NULL;
 
-       /* Call the original destructor */
-       if (sk->sk_destruct)
-               (*sk->sk_destruct)(sk);
+       /* Remove the tunnel struct from the tunnel list */
+       pn = l2tp_pernet(tunnel->l2tp_net);
+       spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+       list_del_rcu(&tunnel->list);
+       spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+       atomic_dec(&l2tp_tunnel_count);
 
-       /* We're finished with the socket */
+       l2tp_tunnel_closeall(tunnel);
        l2tp_tunnel_dec_refcount(tunnel);
 
+       /* Call the original destructor */
+       if (sk->sk_destruct)
+               (*sk->sk_destruct)(sk);
 end:
        return;
 }
@@ -1358,6 +1361,8 @@ again:
                        if (session->deref != NULL)
                                (*session->deref)(session);
 
+                       l2tp_session_dec_refcount(session);
+
                        write_lock_bh(&tunnel->hlist_lock);
 
                        /* Now restart from the beginning of this hash
@@ -1371,53 +1376,92 @@ again:
        write_unlock_bh(&tunnel->hlist_lock);
 }
 
+/* Tunnel socket destroy hook for UDP encapsulation */
+static void l2tp_udp_encap_destroy(struct sock *sk)
+{
+       struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+       if (tunnel) {
+               l2tp_tunnel_closeall(tunnel);
+               sock_put(sk);
+       }
+}
+
 /* Really kill the tunnel.
  * Come here only when all sessions have been cleared from the tunnel.
  */
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
 {
-       struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
        BUG_ON(atomic_read(&tunnel->ref_count) != 0);
        BUG_ON(tunnel->sock != NULL);
-
        l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
-
-       /* Remove from tunnel list */
-       spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-       list_del_rcu(&tunnel->list);
        kfree_rcu(tunnel, rcu);
-       spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+}
 
-       atomic_dec(&l2tp_tunnel_count);
+/* Workqueue tunnel deletion function */
+static void l2tp_tunnel_del_work(struct work_struct *work)
+{
+       struct l2tp_tunnel *tunnel = NULL;
+       struct socket *sock = NULL;
+       struct sock *sk = NULL;
+
+       tunnel = container_of(work, struct l2tp_tunnel, del_work);
+       sk = l2tp_tunnel_sock_lookup(tunnel);
+       if (!sk)
+               return;
+
+       sock = sk->sk_socket;
+       BUG_ON(!sock);
+
+       /* If the tunnel socket was created directly by the kernel, use the
+        * sk_* API to release the socket now.  Otherwise go through the
+        * inet_* layer to shut the socket down, and let userspace close it.
+        * In either case the tunnel resources are freed in the socket
+        * destructor when the tunnel socket goes away.
+        */
+       if (sock->file == NULL) {
+               kernel_sock_shutdown(sock, SHUT_RDWR);
+               sk_release_kernel(sk);
+       } else {
+               inet_shutdown(sock, 2);
+       }
+
+       l2tp_tunnel_sock_put(sk);
 }
 
 /* Create a socket for the tunnel, if one isn't set up by
  * userspace. This is used for static tunnels where there is no
  * managing L2TP daemon.
+ *
+ * Since we don't want these sockets to keep a namespace alive by
+ * themselves, we drop the socket's namespace refcount after creation.
+ * These sockets are freed when the namespace exits using the pernet
+ * exit hook.
  */
-static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp)
+static int l2tp_tunnel_sock_create(struct net *net,
+                               u32 tunnel_id,
+                               u32 peer_tunnel_id,
+                               struct l2tp_tunnel_cfg *cfg,
+                               struct socket **sockp)
 {
        int err = -EINVAL;
-       struct sockaddr_in udp_addr;
+       struct socket *sock = NULL;
+       struct sockaddr_in udp_addr = {0};
+       struct sockaddr_l2tpip ip_addr = {0};
 #if IS_ENABLED(CONFIG_IPV6)
-       struct sockaddr_in6 udp6_addr;
-       struct sockaddr_l2tpip6 ip6_addr;
+       struct sockaddr_in6 udp6_addr = {0};
+       struct sockaddr_l2tpip6 ip6_addr = {0};
 #endif
-       struct sockaddr_l2tpip ip_addr;
-       struct socket *sock = NULL;
 
        switch (cfg->encap) {
        case L2TP_ENCAPTYPE_UDP:
 #if IS_ENABLED(CONFIG_IPV6)
                if (cfg->local_ip6 && cfg->peer_ip6) {
-                       err = sock_create(AF_INET6, SOCK_DGRAM, 0, sockp);
+                       err = sock_create_kern(AF_INET6, SOCK_DGRAM, 0, &sock);
                        if (err < 0)
                                goto out;
 
-                       sock = *sockp;
+                       sk_change_net(sock->sk, net);
 
-                       memset(&udp6_addr, 0, sizeof(udp6_addr));
                        udp6_addr.sin6_family = AF_INET6;
                        memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
                               sizeof(udp6_addr.sin6_addr));
@@ -1439,13 +1483,12 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                } else
 #endif
                {
-                       err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
+                       err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock);
                        if (err < 0)
                                goto out;
 
-                       sock = *sockp;
+                       sk_change_net(sock->sk, net);
 
-                       memset(&udp_addr, 0, sizeof(udp_addr));
                        udp_addr.sin_family = AF_INET;
                        udp_addr.sin_addr = cfg->local_ip;
                        udp_addr.sin_port = htons(cfg->local_udp_port);
@@ -1472,14 +1515,13 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
        case L2TP_ENCAPTYPE_IP:
 #if IS_ENABLED(CONFIG_IPV6)
                if (cfg->local_ip6 && cfg->peer_ip6) {
-                       err = sock_create(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP,
-                                         sockp);
+                       err = sock_create_kern(AF_INET6, SOCK_DGRAM,
+                                         IPPROTO_L2TP, &sock);
                        if (err < 0)
                                goto out;
 
-                       sock = *sockp;
+                       sk_change_net(sock->sk, net);
 
-                       memset(&ip6_addr, 0, sizeof(ip6_addr));
                        ip6_addr.l2tp_family = AF_INET6;
                        memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
                               sizeof(ip6_addr.l2tp_addr));
@@ -1501,14 +1543,13 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                } else
 #endif
                {
-                       err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP,
-                                         sockp);
+                       err = sock_create_kern(AF_INET, SOCK_DGRAM,
+                                         IPPROTO_L2TP, &sock);
                        if (err < 0)
                                goto out;
 
-                       sock = *sockp;
+                       sk_change_net(sock->sk, net);
 
-                       memset(&ip_addr, 0, sizeof(ip_addr));
                        ip_addr.l2tp_family = AF_INET;
                        ip_addr.l2tp_addr = cfg->local_ip;
                        ip_addr.l2tp_conn_id = tunnel_id;
@@ -1532,8 +1573,10 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
        }
 
 out:
+       *sockp = sock;
        if ((err < 0) && sock) {
-               sock_release(sock);
+               kernel_sock_shutdown(sock, SHUT_RDWR);
+               sk_release_kernel(sock->sk);
                *sockp = NULL;
        }
 
@@ -1556,15 +1599,23 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         * kernel socket.
         */
        if (fd < 0) {
-               err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock);
+               err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
+                               cfg, &sock);
                if (err < 0)
                        goto err;
        } else {
-               err = -EBADF;
                sock = sockfd_lookup(fd, &err);
                if (!sock) {
-                       pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
+                       pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
                               tunnel_id, fd, err);
+                       err = -EBADF;
+                       goto err;
+               }
+
+               /* Reject namespace mismatches */
+               if (!net_eq(sock_net(sock->sk), net)) {
+                       pr_err("tunl %u: netns mismatch\n", tunnel_id);
+                       err = -EINVAL;
                        goto err;
                }
        }
@@ -1630,6 +1681,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
                udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
                udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
+               udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
 #if IS_ENABLED(CONFIG_IPV6)
                if (sk->sk_family == PF_INET6)
                        udpv6_encap_enable();
@@ -1651,6 +1703,9 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
 
        sk->sk_allocation = GFP_ATOMIC;
 
+       /* Init delete workqueue struct */
+       INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
+
        /* Add tunnel to our list */
        INIT_LIST_HEAD(&tunnel->list);
        atomic_inc(&l2tp_tunnel_count);
@@ -1682,33 +1737,7 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-       int err = -EBADF;
-       struct socket *sock = NULL;
-       struct sock *sk = NULL;
-
-       sk = l2tp_tunnel_sock_lookup(tunnel);
-       if (!sk)
-               goto out;
-
-       sock = sk->sk_socket;
-       BUG_ON(!sock);
-
-       /* Force the tunnel socket to close. This will eventually
-        * cause the tunnel to be deleted via the normal socket close
-        * mechanisms when userspace closes the tunnel socket.
-        */
-       err = inet_shutdown(sock, 2);
-
-       /* If the tunnel's socket was created by the kernel,
-        * close the socket here since the socket was not
-        * created by userspace.
-        */
-       if (sock->file == NULL)
-               err = inet_release(sock);
-
-       l2tp_tunnel_sock_put(sk);
-out:
-       return err;
+       return (false == queue_work(l2tp_wq, &tunnel->del_work));
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
 
@@ -1892,8 +1921,21 @@ static __net_init int l2tp_init_net(struct net *net)
        return 0;
 }
 
+static __net_exit void l2tp_exit_net(struct net *net)
+{
+       struct l2tp_net *pn = l2tp_pernet(net);
+       struct l2tp_tunnel *tunnel = NULL;
+
+       rcu_read_lock_bh();
+       list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+               (void)l2tp_tunnel_delete(tunnel);
+       }
+       rcu_read_unlock_bh();
+}
+
 static struct pernet_operations l2tp_net_ops = {
        .init = l2tp_init_net,
+       .exit = l2tp_exit_net,
        .id   = &l2tp_net_id,
        .size = sizeof(struct l2tp_net),
 };
@@ -1906,6 +1948,13 @@ static int __init l2tp_init(void)
        if (rc)
                goto out;
 
+       l2tp_wq = alloc_workqueue("l2tp", WQ_NON_REENTRANT | WQ_UNBOUND, 0);
+       if (!l2tp_wq) {
+               pr_err("alloc_workqueue failed\n");
+               rc = -ENOMEM;
+               goto out;
+       }
+
        pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
 
 out:
@@ -1915,6 +1964,10 @@ out:
 static void __exit l2tp_exit(void)
 {
        unregister_pernet_device(&l2tp_net_ops);
+       if (l2tp_wq) {
+               destroy_workqueue(l2tp_wq);
+               l2tp_wq = NULL;
+       }
 }
 
 module_init(l2tp_init);