net_sched: fix a resource leak in tcindex_set_parms()
[linux-2.6-microblaze.git] / net / sched / cls_tcindex.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * net/sched/cls_tcindex.c      Packet classifier for skb->tc_index
4  *
5  * Written 1998,1999 by Werner Almesberger, EPFL ICA
6  */
7
8 #include <linux/module.h>
9 #include <linux/types.h>
10 #include <linux/kernel.h>
11 #include <linux/skbuff.h>
12 #include <linux/errno.h>
13 #include <linux/slab.h>
14 #include <net/act_api.h>
15 #include <net/netlink.h>
16 #include <net/pkt_cls.h>
17 #include <net/sch_generic.h>
18
19 /*
20  * Passing parameters to the root seems to be done more awkwardly than really
21  * necessary. At least, u32 doesn't seem to use such dirty hacks. To be
22  * verified. FIXME.
23  */
24
25 #define PERFECT_HASH_THRESHOLD  64      /* use perfect hash if not bigger */
26 #define DEFAULT_HASH_SIZE       64      /* optimized for diffserv */
27
28
29 struct tcindex_filter_result {
30         struct tcf_exts         exts;
31         struct tcf_result       res;
32         struct rcu_work         rwork;
33 };
34
35 struct tcindex_filter {
36         u16 key;
37         struct tcindex_filter_result result;
38         struct tcindex_filter __rcu *next;
39         struct rcu_work rwork;
40 };
41
42
43 struct tcindex_data {
44         struct tcindex_filter_result *perfect; /* perfect hash; NULL if none */
45         struct tcindex_filter __rcu **h; /* imperfect hash; */
46         struct tcf_proto *tp;
47         u16 mask;               /* AND key with mask */
48         u32 shift;              /* shift ANDed key to the right */
49         u32 hash;               /* hash table size; 0 if undefined */
50         u32 alloc_hash;         /* allocated size */
51         u32 fall_through;       /* 0: only classify if explicit match */
52         struct rcu_work rwork;
53 };
54
55 static inline int tcindex_filter_is_set(struct tcindex_filter_result *r)
56 {
57         return tcf_exts_has_actions(&r->exts) || r->res.classid;
58 }
59
60 static struct tcindex_filter_result *tcindex_lookup(struct tcindex_data *p,
61                                                     u16 key)
62 {
63         if (p->perfect) {
64                 struct tcindex_filter_result *f = p->perfect + key;
65
66                 return tcindex_filter_is_set(f) ? f : NULL;
67         } else if (p->h) {
68                 struct tcindex_filter __rcu **fp;
69                 struct tcindex_filter *f;
70
71                 fp = &p->h[key % p->hash];
72                 for (f = rcu_dereference_bh_rtnl(*fp);
73                      f;
74                      fp = &f->next, f = rcu_dereference_bh_rtnl(*fp))
75                         if (f->key == key)
76                                 return &f->result;
77         }
78
79         return NULL;
80 }
81
82
83 static int tcindex_classify(struct sk_buff *skb, const struct tcf_proto *tp,
84                             struct tcf_result *res)
85 {
86         struct tcindex_data *p = rcu_dereference_bh(tp->root);
87         struct tcindex_filter_result *f;
88         int key = (skb->tc_index & p->mask) >> p->shift;
89
90         pr_debug("tcindex_classify(skb %p,tp %p,res %p),p %p\n",
91                  skb, tp, res, p);
92
93         f = tcindex_lookup(p, key);
94         if (!f) {
95                 struct Qdisc *q = tcf_block_q(tp->chain->block);
96
97                 if (!p->fall_through)
98                         return -1;
99                 res->classid = TC_H_MAKE(TC_H_MAJ(q->handle), key);
100                 res->class = 0;
101                 pr_debug("alg 0x%x\n", res->classid);
102                 return 0;
103         }
104         *res = f->res;
105         pr_debug("map 0x%x\n", res->classid);
106
107         return tcf_exts_exec(skb, &f->exts, res);
108 }
109
110
111 static void *tcindex_get(struct tcf_proto *tp, u32 handle)
112 {
113         struct tcindex_data *p = rtnl_dereference(tp->root);
114         struct tcindex_filter_result *r;
115
116         pr_debug("tcindex_get(tp %p,handle 0x%08x)\n", tp, handle);
117         if (p->perfect && handle >= p->alloc_hash)
118                 return NULL;
119         r = tcindex_lookup(p, handle);
120         return r && tcindex_filter_is_set(r) ? r : NULL;
121 }
122
123 static int tcindex_init(struct tcf_proto *tp)
124 {
125         struct tcindex_data *p;
126
127         pr_debug("tcindex_init(tp %p)\n", tp);
128         p = kzalloc(sizeof(struct tcindex_data), GFP_KERNEL);
129         if (!p)
130                 return -ENOMEM;
131
132         p->mask = 0xffff;
133         p->hash = DEFAULT_HASH_SIZE;
134         p->fall_through = 1;
135
136         rcu_assign_pointer(tp->root, p);
137         return 0;
138 }
139
140 static void __tcindex_destroy_rexts(struct tcindex_filter_result *r)
141 {
142         tcf_exts_destroy(&r->exts);
143         tcf_exts_put_net(&r->exts);
144 }
145
146 static void tcindex_destroy_rexts_work(struct work_struct *work)
147 {
148         struct tcindex_filter_result *r;
149
150         r = container_of(to_rcu_work(work),
151                          struct tcindex_filter_result,
152                          rwork);
153         rtnl_lock();
154         __tcindex_destroy_rexts(r);
155         rtnl_unlock();
156 }
157
158 static void __tcindex_destroy_fexts(struct tcindex_filter *f)
159 {
160         tcf_exts_destroy(&f->result.exts);
161         tcf_exts_put_net(&f->result.exts);
162         kfree(f);
163 }
164
165 static void tcindex_destroy_fexts_work(struct work_struct *work)
166 {
167         struct tcindex_filter *f = container_of(to_rcu_work(work),
168                                                 struct tcindex_filter,
169                                                 rwork);
170
171         rtnl_lock();
172         __tcindex_destroy_fexts(f);
173         rtnl_unlock();
174 }
175
176 static int tcindex_delete(struct tcf_proto *tp, void *arg, bool *last,
177                           bool rtnl_held, struct netlink_ext_ack *extack)
178 {
179         struct tcindex_data *p = rtnl_dereference(tp->root);
180         struct tcindex_filter_result *r = arg;
181         struct tcindex_filter __rcu **walk;
182         struct tcindex_filter *f = NULL;
183
184         pr_debug("tcindex_delete(tp %p,arg %p),p %p\n", tp, arg, p);
185         if (p->perfect) {
186                 if (!r->res.class)
187                         return -ENOENT;
188         } else {
189                 int i;
190
191                 for (i = 0; i < p->hash; i++) {
192                         walk = p->h + i;
193                         for (f = rtnl_dereference(*walk); f;
194                              walk = &f->next, f = rtnl_dereference(*walk)) {
195                                 if (&f->result == r)
196                                         goto found;
197                         }
198                 }
199                 return -ENOENT;
200
201 found:
202                 rcu_assign_pointer(*walk, rtnl_dereference(f->next));
203         }
204         tcf_unbind_filter(tp, &r->res);
205         /* all classifiers are required to call tcf_exts_destroy() after rcu
206          * grace period, since converted-to-rcu actions are relying on that
207          * in cleanup() callback
208          */
209         if (f) {
210                 if (tcf_exts_get_net(&f->result.exts))
211                         tcf_queue_work(&f->rwork, tcindex_destroy_fexts_work);
212                 else
213                         __tcindex_destroy_fexts(f);
214         } else {
215                 if (tcf_exts_get_net(&r->exts))
216                         tcf_queue_work(&r->rwork, tcindex_destroy_rexts_work);
217                 else
218                         __tcindex_destroy_rexts(r);
219         }
220
221         *last = false;
222         return 0;
223 }
224
225 static void tcindex_destroy_work(struct work_struct *work)
226 {
227         struct tcindex_data *p = container_of(to_rcu_work(work),
228                                               struct tcindex_data,
229                                               rwork);
230
231         kfree(p->perfect);
232         kfree(p->h);
233         kfree(p);
234 }
235
236 static inline int
237 valid_perfect_hash(struct tcindex_data *p)
238 {
239         return  p->hash > (p->mask >> p->shift);
240 }
241
242 static const struct nla_policy tcindex_policy[TCA_TCINDEX_MAX + 1] = {
243         [TCA_TCINDEX_HASH]              = { .type = NLA_U32 },
244         [TCA_TCINDEX_MASK]              = { .type = NLA_U16 },
245         [TCA_TCINDEX_SHIFT]             = { .type = NLA_U32 },
246         [TCA_TCINDEX_FALL_THROUGH]      = { .type = NLA_U32 },
247         [TCA_TCINDEX_CLASSID]           = { .type = NLA_U32 },
248 };
249
250 static int tcindex_filter_result_init(struct tcindex_filter_result *r,
251                                       struct net *net)
252 {
253         memset(r, 0, sizeof(*r));
254         return tcf_exts_init(&r->exts, net, TCA_TCINDEX_ACT,
255                              TCA_TCINDEX_POLICE);
256 }
257
258 static void tcindex_partial_destroy_work(struct work_struct *work)
259 {
260         struct tcindex_data *p = container_of(to_rcu_work(work),
261                                               struct tcindex_data,
262                                               rwork);
263
264         kfree(p->perfect);
265         kfree(p);
266 }
267
268 static void tcindex_free_perfect_hash(struct tcindex_data *cp)
269 {
270         int i;
271
272         for (i = 0; i < cp->hash; i++)
273                 tcf_exts_destroy(&cp->perfect[i].exts);
274         kfree(cp->perfect);
275 }
276
277 static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
278 {
279         int i, err = 0;
280
281         cp->perfect = kcalloc(cp->hash, sizeof(struct tcindex_filter_result),
282                               GFP_KERNEL);
283         if (!cp->perfect)
284                 return -ENOMEM;
285
286         for (i = 0; i < cp->hash; i++) {
287                 err = tcf_exts_init(&cp->perfect[i].exts, net,
288                                     TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
289                 if (err < 0)
290                         goto errout;
291         }
292
293         return 0;
294
295 errout:
296         tcindex_free_perfect_hash(cp);
297         return err;
298 }
299
300 static int
301 tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
302                   u32 handle, struct tcindex_data *p,
303                   struct tcindex_filter_result *r, struct nlattr **tb,
304                   struct nlattr *est, bool ovr, struct netlink_ext_ack *extack)
305 {
306         struct tcindex_filter_result new_filter_result, *old_r = r;
307         struct tcindex_data *cp = NULL, *oldp;
308         struct tcindex_filter *f = NULL; /* make gcc behave */
309         struct tcf_result cr = {};
310         int err, balloc = 0;
311         struct tcf_exts e;
312
313         err = tcf_exts_init(&e, net, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
314         if (err < 0)
315                 return err;
316         err = tcf_exts_validate(net, tp, tb, est, &e, ovr, true, extack);
317         if (err < 0)
318                 goto errout;
319
320         err = -ENOMEM;
321         /* tcindex_data attributes must look atomic to classifier/lookup so
322          * allocate new tcindex data and RCU assign it onto root. Keeping
323          * perfect hash and hash pointers from old data.
324          */
325         cp = kzalloc(sizeof(*cp), GFP_KERNEL);
326         if (!cp)
327                 goto errout;
328
329         cp->mask = p->mask;
330         cp->shift = p->shift;
331         cp->hash = p->hash;
332         cp->alloc_hash = p->alloc_hash;
333         cp->fall_through = p->fall_through;
334         cp->tp = tp;
335
336         if (tb[TCA_TCINDEX_HASH])
337                 cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
338
339         if (tb[TCA_TCINDEX_MASK])
340                 cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
341
342         if (tb[TCA_TCINDEX_SHIFT])
343                 cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
344
345         if (!cp->hash) {
346                 /* Hash not specified, use perfect hash if the upper limit
347                  * of the hashing index is below the threshold.
348                  */
349                 if ((cp->mask >> cp->shift) < PERFECT_HASH_THRESHOLD)
350                         cp->hash = (cp->mask >> cp->shift) + 1;
351                 else
352                         cp->hash = DEFAULT_HASH_SIZE;
353         }
354
355         if (p->perfect) {
356                 int i;
357
358                 if (tcindex_alloc_perfect_hash(net, cp) < 0)
359                         goto errout;
360                 for (i = 0; i < min(cp->hash, p->hash); i++)
361                         cp->perfect[i].res = p->perfect[i].res;
362                 balloc = 1;
363         }
364         cp->h = p->h;
365
366         err = tcindex_filter_result_init(&new_filter_result, net);
367         if (err < 0)
368                 goto errout_alloc;
369         if (old_r)
370                 cr = r->res;
371
372         err = -EBUSY;
373
374         /* Hash already allocated, make sure that we still meet the
375          * requirements for the allocated hash.
376          */
377         if (cp->perfect) {
378                 if (!valid_perfect_hash(cp) ||
379                     cp->hash > cp->alloc_hash)
380                         goto errout_alloc;
381         } else if (cp->h && cp->hash != cp->alloc_hash) {
382                 goto errout_alloc;
383         }
384
385         err = -EINVAL;
386         if (tb[TCA_TCINDEX_FALL_THROUGH])
387                 cp->fall_through = nla_get_u32(tb[TCA_TCINDEX_FALL_THROUGH]);
388
389         if (!cp->perfect && !cp->h)
390                 cp->alloc_hash = cp->hash;
391
392         /* Note: this could be as restrictive as if (handle & ~(mask >> shift))
393          * but then, we'd fail handles that may become valid after some future
394          * mask change. While this is extremely unlikely to ever matter,
395          * the check below is safer (and also more backwards-compatible).
396          */
397         if (cp->perfect || valid_perfect_hash(cp))
398                 if (handle >= cp->alloc_hash)
399                         goto errout_alloc;
400
401
402         err = -ENOMEM;
403         if (!cp->perfect && !cp->h) {
404                 if (valid_perfect_hash(cp)) {
405                         if (tcindex_alloc_perfect_hash(net, cp) < 0)
406                                 goto errout_alloc;
407                         balloc = 1;
408                 } else {
409                         struct tcindex_filter __rcu **hash;
410
411                         hash = kcalloc(cp->hash,
412                                        sizeof(struct tcindex_filter *),
413                                        GFP_KERNEL);
414
415                         if (!hash)
416                                 goto errout_alloc;
417
418                         cp->h = hash;
419                         balloc = 2;
420                 }
421         }
422
423         if (cp->perfect)
424                 r = cp->perfect + handle;
425         else
426                 r = tcindex_lookup(cp, handle) ? : &new_filter_result;
427
428         if (r == &new_filter_result) {
429                 f = kzalloc(sizeof(*f), GFP_KERNEL);
430                 if (!f)
431                         goto errout_alloc;
432                 f->key = handle;
433                 f->next = NULL;
434                 err = tcindex_filter_result_init(&f->result, net);
435                 if (err < 0) {
436                         kfree(f);
437                         goto errout_alloc;
438                 }
439         }
440
441         if (tb[TCA_TCINDEX_CLASSID]) {
442                 cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
443                 tcf_bind_filter(tp, &cr, base);
444         }
445
446         if (old_r && old_r != r) {
447                 err = tcindex_filter_result_init(old_r, net);
448                 if (err < 0) {
449                         kfree(f);
450                         goto errout_alloc;
451                 }
452         }
453
454         oldp = p;
455         r->res = cr;
456         tcf_exts_change(&r->exts, &e);
457
458         rcu_assign_pointer(tp->root, cp);
459
460         if (r == &new_filter_result) {
461                 struct tcindex_filter *nfp;
462                 struct tcindex_filter __rcu **fp;
463
464                 f->result.res = r->res;
465                 tcf_exts_change(&f->result.exts, &r->exts);
466
467                 fp = cp->h + (handle % cp->hash);
468                 for (nfp = rtnl_dereference(*fp);
469                      nfp;
470                      fp = &nfp->next, nfp = rtnl_dereference(*fp))
471                                 ; /* nothing */
472
473                 rcu_assign_pointer(*fp, f);
474         } else {
475                 tcf_exts_destroy(&new_filter_result.exts);
476         }
477
478         if (oldp)
479                 tcf_queue_work(&oldp->rwork, tcindex_partial_destroy_work);
480         return 0;
481
482 errout_alloc:
483         if (balloc == 1)
484                 tcindex_free_perfect_hash(cp);
485         else if (balloc == 2)
486                 kfree(cp->h);
487         tcf_exts_destroy(&new_filter_result.exts);
488 errout:
489         kfree(cp);
490         tcf_exts_destroy(&e);
491         return err;
492 }
493
494 static int
495 tcindex_change(struct net *net, struct sk_buff *in_skb,
496                struct tcf_proto *tp, unsigned long base, u32 handle,
497                struct nlattr **tca, void **arg, bool ovr,
498                bool rtnl_held, struct netlink_ext_ack *extack)
499 {
500         struct nlattr *opt = tca[TCA_OPTIONS];
501         struct nlattr *tb[TCA_TCINDEX_MAX + 1];
502         struct tcindex_data *p = rtnl_dereference(tp->root);
503         struct tcindex_filter_result *r = *arg;
504         int err;
505
506         pr_debug("tcindex_change(tp %p,handle 0x%08x,tca %p,arg %p),opt %p,"
507             "p %p,r %p,*arg %p\n",
508             tp, handle, tca, arg, opt, p, r, arg ? *arg : NULL);
509
510         if (!opt)
511                 return 0;
512
513         err = nla_parse_nested_deprecated(tb, TCA_TCINDEX_MAX, opt,
514                                           tcindex_policy, NULL);
515         if (err < 0)
516                 return err;
517
518         return tcindex_set_parms(net, tp, base, handle, p, r, tb,
519                                  tca[TCA_RATE], ovr, extack);
520 }
521
522 static void tcindex_walk(struct tcf_proto *tp, struct tcf_walker *walker,
523                          bool rtnl_held)
524 {
525         struct tcindex_data *p = rtnl_dereference(tp->root);
526         struct tcindex_filter *f, *next;
527         int i;
528
529         pr_debug("tcindex_walk(tp %p,walker %p),p %p\n", tp, walker, p);
530         if (p->perfect) {
531                 for (i = 0; i < p->hash; i++) {
532                         if (!p->perfect[i].res.class)
533                                 continue;
534                         if (walker->count >= walker->skip) {
535                                 if (walker->fn(tp, p->perfect + i, walker) < 0) {
536                                         walker->stop = 1;
537                                         return;
538                                 }
539                         }
540                         walker->count++;
541                 }
542         }
543         if (!p->h)
544                 return;
545         for (i = 0; i < p->hash; i++) {
546                 for (f = rtnl_dereference(p->h[i]); f; f = next) {
547                         next = rtnl_dereference(f->next);
548                         if (walker->count >= walker->skip) {
549                                 if (walker->fn(tp, &f->result, walker) < 0) {
550                                         walker->stop = 1;
551                                         return;
552                                 }
553                         }
554                         walker->count++;
555                 }
556         }
557 }
558
559 static void tcindex_destroy(struct tcf_proto *tp, bool rtnl_held,
560                             struct netlink_ext_ack *extack)
561 {
562         struct tcindex_data *p = rtnl_dereference(tp->root);
563         int i;
564
565         pr_debug("tcindex_destroy(tp %p),p %p\n", tp, p);
566
567         if (p->perfect) {
568                 for (i = 0; i < p->hash; i++) {
569                         struct tcindex_filter_result *r = p->perfect + i;
570
571                         tcf_unbind_filter(tp, &r->res);
572                         if (tcf_exts_get_net(&r->exts))
573                                 tcf_queue_work(&r->rwork,
574                                                tcindex_destroy_rexts_work);
575                         else
576                                 __tcindex_destroy_rexts(r);
577                 }
578         }
579
580         for (i = 0; p->h && i < p->hash; i++) {
581                 struct tcindex_filter *f, *next;
582                 bool last;
583
584                 for (f = rtnl_dereference(p->h[i]); f; f = next) {
585                         next = rtnl_dereference(f->next);
586                         tcindex_delete(tp, &f->result, &last, rtnl_held, NULL);
587                 }
588         }
589
590         tcf_queue_work(&p->rwork, tcindex_destroy_work);
591 }
592
593
594 static int tcindex_dump(struct net *net, struct tcf_proto *tp, void *fh,
595                         struct sk_buff *skb, struct tcmsg *t, bool rtnl_held)
596 {
597         struct tcindex_data *p = rtnl_dereference(tp->root);
598         struct tcindex_filter_result *r = fh;
599         struct nlattr *nest;
600
601         pr_debug("tcindex_dump(tp %p,fh %p,skb %p,t %p),p %p,r %p\n",
602                  tp, fh, skb, t, p, r);
603         pr_debug("p->perfect %p p->h %p\n", p->perfect, p->h);
604
605         nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
606         if (nest == NULL)
607                 goto nla_put_failure;
608
609         if (!fh) {
610                 t->tcm_handle = ~0; /* whatever ... */
611                 if (nla_put_u32(skb, TCA_TCINDEX_HASH, p->hash) ||
612                     nla_put_u16(skb, TCA_TCINDEX_MASK, p->mask) ||
613                     nla_put_u32(skb, TCA_TCINDEX_SHIFT, p->shift) ||
614                     nla_put_u32(skb, TCA_TCINDEX_FALL_THROUGH, p->fall_through))
615                         goto nla_put_failure;
616                 nla_nest_end(skb, nest);
617         } else {
618                 if (p->perfect) {
619                         t->tcm_handle = r - p->perfect;
620                 } else {
621                         struct tcindex_filter *f;
622                         struct tcindex_filter __rcu **fp;
623                         int i;
624
625                         t->tcm_handle = 0;
626                         for (i = 0; !t->tcm_handle && i < p->hash; i++) {
627                                 fp = &p->h[i];
628                                 for (f = rtnl_dereference(*fp);
629                                      !t->tcm_handle && f;
630                                      fp = &f->next, f = rtnl_dereference(*fp)) {
631                                         if (&f->result == r)
632                                                 t->tcm_handle = f->key;
633                                 }
634                         }
635                 }
636                 pr_debug("handle = %d\n", t->tcm_handle);
637                 if (r->res.class &&
638                     nla_put_u32(skb, TCA_TCINDEX_CLASSID, r->res.classid))
639                         goto nla_put_failure;
640
641                 if (tcf_exts_dump(skb, &r->exts) < 0)
642                         goto nla_put_failure;
643                 nla_nest_end(skb, nest);
644
645                 if (tcf_exts_dump_stats(skb, &r->exts) < 0)
646                         goto nla_put_failure;
647         }
648
649         return skb->len;
650
651 nla_put_failure:
652         nla_nest_cancel(skb, nest);
653         return -1;
654 }
655
656 static void tcindex_bind_class(void *fh, u32 classid, unsigned long cl,
657                                void *q, unsigned long base)
658 {
659         struct tcindex_filter_result *r = fh;
660
661         if (r && r->res.classid == classid) {
662                 if (cl)
663                         __tcf_bind_filter(q, &r->res, base);
664                 else
665                         __tcf_unbind_filter(q, &r->res);
666         }
667 }
668
669 static struct tcf_proto_ops cls_tcindex_ops __read_mostly = {
670         .kind           =       "tcindex",
671         .classify       =       tcindex_classify,
672         .init           =       tcindex_init,
673         .destroy        =       tcindex_destroy,
674         .get            =       tcindex_get,
675         .change         =       tcindex_change,
676         .delete         =       tcindex_delete,
677         .walk           =       tcindex_walk,
678         .dump           =       tcindex_dump,
679         .bind_class     =       tcindex_bind_class,
680         .owner          =       THIS_MODULE,
681 };
682
683 static int __init init_tcindex(void)
684 {
685         return register_tcf_proto_ops(&cls_tcindex_ops);
686 }
687
688 static void __exit exit_tcindex(void)
689 {
690         unregister_tcf_proto_ops(&cls_tcindex_ops);
691 }
692
693 module_init(init_tcindex)
694 module_exit(exit_tcindex)
695 MODULE_LICENSE("GPL");