diag.c 7.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. #include <linux/types.h>
  3. #include <linux/spinlock.h>
  4. #include <linux/sock_diag.h>
  5. #include <linux/unix_diag.h>
  6. #include <linux/skbuff.h>
  7. #include <linux/module.h>
  8. #include <linux/uidgid.h>
  9. #include <net/netlink.h>
  10. #include <net/af_unix.h>
  11. #include <net/tcp_states.h>
  12. #include <net/sock.h>
  13. static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
  14. {
  15. /* might or might not have unix_table_lock */
  16. struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
  17. if (!addr)
  18. return 0;
  19. return nla_put(nlskb, UNIX_DIAG_NAME, addr->len - sizeof(short),
  20. addr->name->sun_path);
  21. }
  22. static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
  23. {
  24. struct dentry *dentry = unix_sk(sk)->path.dentry;
  25. if (dentry) {
  26. struct unix_diag_vfs uv = {
  27. .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
  28. .udiag_vfs_dev = dentry->d_sb->s_dev,
  29. };
  30. return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
  31. }
  32. return 0;
  33. }
  34. static int sk_diag_dump_peer(struct sock *sk, struct sk_buff *nlskb)
  35. {
  36. struct sock *peer;
  37. int ino;
  38. peer = unix_peer_get(sk);
  39. if (peer) {
  40. unix_state_lock(peer);
  41. ino = sock_i_ino(peer);
  42. unix_state_unlock(peer);
  43. sock_put(peer);
  44. return nla_put_u32(nlskb, UNIX_DIAG_PEER, ino);
  45. }
  46. return 0;
  47. }
  48. static int sk_diag_dump_icons(struct sock *sk, struct sk_buff *nlskb)
  49. {
  50. struct sk_buff *skb;
  51. struct nlattr *attr;
  52. u32 *buf;
  53. int i;
  54. if (sk->sk_state == TCP_LISTEN) {
  55. spin_lock(&sk->sk_receive_queue.lock);
  56. attr = nla_reserve(nlskb, UNIX_DIAG_ICONS,
  57. sk->sk_receive_queue.qlen * sizeof(u32));
  58. if (!attr)
  59. goto errout;
  60. buf = nla_data(attr);
  61. i = 0;
  62. skb_queue_walk(&sk->sk_receive_queue, skb) {
  63. struct sock *req, *peer;
  64. req = skb->sk;
  65. /*
  66. * The state lock is outer for the same sk's
  67. * queue lock. With the other's queue locked it's
  68. * OK to lock the state.
  69. */
  70. unix_state_lock_nested(req);
  71. peer = unix_sk(req)->peer;
  72. buf[i++] = (peer ? sock_i_ino(peer) : 0);
  73. unix_state_unlock(req);
  74. }
  75. spin_unlock(&sk->sk_receive_queue.lock);
  76. }
  77. return 0;
  78. errout:
  79. spin_unlock(&sk->sk_receive_queue.lock);
  80. return -EMSGSIZE;
  81. }
  82. static int sk_diag_show_rqlen(struct sock *sk, struct sk_buff *nlskb)
  83. {
  84. struct unix_diag_rqlen rql;
  85. if (sk->sk_state == TCP_LISTEN) {
  86. rql.udiag_rqueue = sk->sk_receive_queue.qlen;
  87. rql.udiag_wqueue = sk->sk_max_ack_backlog;
  88. } else {
  89. rql.udiag_rqueue = (u32) unix_inq_len(sk);
  90. rql.udiag_wqueue = (u32) unix_outq_len(sk);
  91. }
  92. return nla_put(nlskb, UNIX_DIAG_RQLEN, sizeof(rql), &rql);
  93. }
  94. static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb)
  95. {
  96. uid_t uid = from_kuid_munged(sk_user_ns(nlskb->sk), sock_i_uid(sk));
  97. return nla_put(nlskb, UNIX_DIAG_UID, sizeof(uid_t), &uid);
  98. }
  99. static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
  100. u32 portid, u32 seq, u32 flags, int sk_ino)
  101. {
  102. struct nlmsghdr *nlh;
  103. struct unix_diag_msg *rep;
  104. nlh = nlmsg_put(skb, portid, seq, SOCK_DIAG_BY_FAMILY, sizeof(*rep),
  105. flags);
  106. if (!nlh)
  107. return -EMSGSIZE;
  108. rep = nlmsg_data(nlh);
  109. rep->udiag_family = AF_UNIX;
  110. rep->udiag_type = sk->sk_type;
  111. rep->udiag_state = sk->sk_state;
  112. rep->pad = 0;
  113. rep->udiag_ino = sk_ino;
  114. sock_diag_save_cookie(sk, rep->udiag_cookie);
  115. if ((req->udiag_show & UDIAG_SHOW_NAME) &&
  116. sk_diag_dump_name(sk, skb))
  117. goto out_nlmsg_trim;
  118. if ((req->udiag_show & UDIAG_SHOW_VFS) &&
  119. sk_diag_dump_vfs(sk, skb))
  120. goto out_nlmsg_trim;
  121. if ((req->udiag_show & UDIAG_SHOW_PEER) &&
  122. sk_diag_dump_peer(sk, skb))
  123. goto out_nlmsg_trim;
  124. if ((req->udiag_show & UDIAG_SHOW_ICONS) &&
  125. sk_diag_dump_icons(sk, skb))
  126. goto out_nlmsg_trim;
  127. if ((req->udiag_show & UDIAG_SHOW_RQLEN) &&
  128. sk_diag_show_rqlen(sk, skb))
  129. goto out_nlmsg_trim;
  130. if ((req->udiag_show & UDIAG_SHOW_MEMINFO) &&
  131. sock_diag_put_meminfo(sk, skb, UNIX_DIAG_MEMINFO))
  132. goto out_nlmsg_trim;
  133. if (nla_put_u8(skb, UNIX_DIAG_SHUTDOWN, sk->sk_shutdown))
  134. goto out_nlmsg_trim;
  135. if ((req->udiag_show & UDIAG_SHOW_UID) &&
  136. sk_diag_dump_uid(sk, skb))
  137. goto out_nlmsg_trim;
  138. nlmsg_end(skb, nlh);
  139. return 0;
  140. out_nlmsg_trim:
  141. nlmsg_cancel(skb, nlh);
  142. return -EMSGSIZE;
  143. }
  144. static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
  145. u32 portid, u32 seq, u32 flags)
  146. {
  147. int sk_ino;
  148. unix_state_lock(sk);
  149. sk_ino = sock_i_ino(sk);
  150. unix_state_unlock(sk);
  151. if (!sk_ino)
  152. return 0;
  153. return sk_diag_fill(sk, skb, req, portid, seq, flags, sk_ino);
  154. }
  155. static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
  156. {
  157. struct unix_diag_req *req;
  158. int num, s_num, slot, s_slot;
  159. struct net *net = sock_net(skb->sk);
  160. req = nlmsg_data(cb->nlh);
  161. s_slot = cb->args[0];
  162. num = s_num = cb->args[1];
  163. spin_lock(&unix_table_lock);
  164. for (slot = s_slot;
  165. slot < ARRAY_SIZE(unix_socket_table);
  166. s_num = 0, slot++) {
  167. struct sock *sk;
  168. num = 0;
  169. sk_for_each(sk, &unix_socket_table[slot]) {
  170. if (!net_eq(sock_net(sk), net))
  171. continue;
  172. if (num < s_num)
  173. goto next;
  174. if (!(req->udiag_states & (1 << sk->sk_state)))
  175. goto next;
  176. if (sk_diag_dump(sk, skb, req,
  177. NETLINK_CB(cb->skb).portid,
  178. cb->nlh->nlmsg_seq,
  179. NLM_F_MULTI) < 0)
  180. goto done;
  181. next:
  182. num++;
  183. }
  184. }
  185. done:
  186. spin_unlock(&unix_table_lock);
  187. cb->args[0] = slot;
  188. cb->args[1] = num;
  189. return skb->len;
  190. }
  191. static struct sock *unix_lookup_by_ino(unsigned int ino)
  192. {
  193. int i;
  194. struct sock *sk;
  195. spin_lock(&unix_table_lock);
  196. for (i = 0; i < ARRAY_SIZE(unix_socket_table); i++) {
  197. sk_for_each(sk, &unix_socket_table[i])
  198. if (ino == sock_i_ino(sk)) {
  199. sock_hold(sk);
  200. spin_unlock(&unix_table_lock);
  201. return sk;
  202. }
  203. }
  204. spin_unlock(&unix_table_lock);
  205. return NULL;
  206. }
  207. static int unix_diag_get_exact(struct sk_buff *in_skb,
  208. const struct nlmsghdr *nlh,
  209. struct unix_diag_req *req)
  210. {
  211. int err = -EINVAL;
  212. struct sock *sk;
  213. struct sk_buff *rep;
  214. unsigned int extra_len;
  215. struct net *net = sock_net(in_skb->sk);
  216. if (req->udiag_ino == 0)
  217. goto out_nosk;
  218. sk = unix_lookup_by_ino(req->udiag_ino);
  219. err = -ENOENT;
  220. if (sk == NULL)
  221. goto out_nosk;
  222. if (!net_eq(sock_net(sk), net))
  223. goto out;
  224. err = sock_diag_check_cookie(sk, req->udiag_cookie);
  225. if (err)
  226. goto out;
  227. extra_len = 256;
  228. again:
  229. err = -ENOMEM;
  230. rep = nlmsg_new(sizeof(struct unix_diag_msg) + extra_len, GFP_KERNEL);
  231. if (!rep)
  232. goto out;
  233. err = sk_diag_fill(sk, rep, req, NETLINK_CB(in_skb).portid,
  234. nlh->nlmsg_seq, 0, req->udiag_ino);
  235. if (err < 0) {
  236. nlmsg_free(rep);
  237. extra_len += 256;
  238. if (extra_len >= PAGE_SIZE)
  239. goto out;
  240. goto again;
  241. }
  242. err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
  243. MSG_DONTWAIT);
  244. if (err > 0)
  245. err = 0;
  246. out:
  247. if (sk)
  248. sock_put(sk);
  249. out_nosk:
  250. return err;
  251. }
  252. static int unix_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
  253. {
  254. int hdrlen = sizeof(struct unix_diag_req);
  255. struct net *net = sock_net(skb->sk);
  256. if (nlmsg_len(h) < hdrlen)
  257. return -EINVAL;
  258. if (h->nlmsg_flags & NLM_F_DUMP) {
  259. struct netlink_dump_control c = {
  260. .dump = unix_diag_dump,
  261. };
  262. return netlink_dump_start(net->diag_nlsk, skb, h, &c);
  263. } else
  264. return unix_diag_get_exact(skb, h, nlmsg_data(h));
  265. }
  266. static const struct sock_diag_handler unix_diag_handler = {
  267. .family = AF_UNIX,
  268. .dump = unix_diag_handler_dump,
  269. };
  270. static int __init unix_diag_init(void)
  271. {
  272. return sock_diag_register(&unix_diag_handler);
  273. }
  274. static void __exit unix_diag_exit(void)
  275. {
  276. sock_diag_unregister(&unix_diag_handler);
  277. }
  278. module_init(unix_diag_init);
  279. module_exit(unix_diag_exit);
  280. MODULE_LICENSE("GPL");
  281. MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 1 /* AF_LOCAL */);