pppoe.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/** -*- linux-c -*- ***********************************************************
   3 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets
   4 *
   5 * PPPoX --- Generic PPP encapsulation socket family
   6 * PPPoE --- PPP over Ethernet (RFC 2516)
   7 *
   8 * Version:	0.7.0
   9 *
  10 * 070228 :	Fix to allow multiple sessions with same remote MAC and same
  11 *		session id by including the local device ifindex in the
  12 *		tuple identifying a session. This also ensures packets can't
  13 *		be injected into a session from interfaces other than the one
  14 *		specified by userspace. Florian Zumbiehl <florz@florz.de>
  15 *		(Oh, BTW, this one is YYMMDD, in case you were wondering ...)
  16 * 220102 :	Fix module use count on failure in pppoe_create, pppox_sk -acme
  17 * 030700 :	Fixed connect logic to allow for disconnect.
  18 * 270700 :	Fixed potential SMP problems; we must protect against
  19 *		simultaneous invocation of ppp_input
  20 *		and ppp_unregister_channel.
  21 * 040800 :	Respect reference count mechanisms on net-devices.
  22 * 200800 :	fix kfree(skb) in pppoe_rcv (acme)
  23 *		Module reference count is decremented in the right spot now,
  24 *		guards against sock_put not actually freeing the sk
  25 *		in pppoe_release.
  26 * 051000 :	Initialization cleanup.
  27 * 111100 :	Fix recvmsg.
  28 * 050101 :	Fix PADT processing.
  29 * 140501 :	Use pppoe_rcv_core to handle all backlog. (Alexey)
  30 * 170701 :	Do not lock_sock with rwlock held. (DaveM)
  31 *		Ignore discovery frames if user has socket
  32 *		locked. (DaveM)
  33 *		Ignore return value of dev_queue_xmit in __pppoe_xmit
  34 *		or else we may kfree an SKB twice. (DaveM)
  35 * 190701 :	When doing copies of skb's in __pppoe_xmit, always delete
  36 *		the original skb that was passed in on success, never on
  37 *		failure.  Delete the copy of the skb on failure to avoid
  38 *		a memory leak.
  39 * 081001 :	Misc. cleanup (licence string, non-blocking, prevent
  40 *		reference of device on close).
  41 * 121301 :	New ppp channels interface; cannot unregister a channel
  42 *		from interrupts.  Thus, we mark the socket as a ZOMBIE
  43 *		and do the unregistration later.
  44 * 081002 :	seq_file support for proc stuff -acme
  45 * 111602 :	Merge all 2.4 fixes into 2.5/2.6 tree.  Label 2.5/2.6
  46 *		as version 0.7.  Spacing cleanup.
  47 * Author:	Michal Ostrowski <mostrows@speakeasy.net>
  48 * Contributors:
  49 * 		Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  50 *		David S. Miller (davem@redhat.com)
  51 *
  52 * License:
  53 */
  54
  55#include <linux/string.h>
  56#include <linux/module.h>
  57#include <linux/kernel.h>
  58#include <linux/slab.h>
  59#include <linux/errno.h>
  60#include <linux/netdevice.h>
  61#include <linux/net.h>
  62#include <linux/inetdevice.h>
  63#include <linux/etherdevice.h>
  64#include <linux/skbuff.h>
  65#include <linux/init.h>
  66#include <linux/if_ether.h>
  67#include <linux/if_pppox.h>
  68#include <linux/ppp_channel.h>
  69#include <linux/ppp_defs.h>
  70#include <linux/ppp-ioctl.h>
  71#include <linux/notifier.h>
  72#include <linux/file.h>
  73#include <linux/proc_fs.h>
  74#include <linux/seq_file.h>
  75
  76#include <linux/nsproxy.h>
  77#include <net/net_namespace.h>
  78#include <net/netns/generic.h>
  79#include <net/sock.h>
  80
  81#include <linux/uaccess.h>
  82
  83#define PPPOE_HASH_BITS CONFIG_PPPOE_HASH_BITS
  84#define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS)
  85#define PPPOE_HASH_MASK	(PPPOE_HASH_SIZE - 1)
  86
  87static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
  88
  89static const struct proto_ops pppoe_ops;
  90static const struct ppp_channel_ops pppoe_chan_ops;
  91
  92/* per-net private data for this module */
  93static unsigned int pppoe_net_id __read_mostly;
  94struct pppoe_net {
  95	/*
  96	 * we could use _single_ hash table for all
  97	 * nets by injecting net id into the hash but
  98	 * it would increase hash chains and add
  99	 * a few additional math comparisons messy
 100	 * as well, moreover in case of SMP less locking
 101	 * controversy here
 102	 */
 103	struct pppox_sock __rcu *hash_table[PPPOE_HASH_SIZE];
 104	spinlock_t hash_lock;
 105};
 106
 107/*
 108 * PPPoE could be in the following stages:
 109 * 1) Discovery stage (to obtain remote MAC and Session ID)
 110 * 2) Session stage (MAC and SID are known)
 111 *
 112 * Ethernet frames have a special tag for this but
 113 * we use simpler approach based on session id
 114 */
 115static inline bool stage_session(__be16 sid)
 116{
 117	return sid != 0;
 118}
 119
 120static inline struct pppoe_net *pppoe_pernet(struct net *net)
 121{
 122	return net_generic(net, pppoe_net_id);
 123}
 124
 125static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b)
 126{
 127	return a->sid == b->sid && ether_addr_equal(a->remote, b->remote);
 128}
 129
 130static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr)
 131{
 132	return a->sid == sid && ether_addr_equal(a->remote, addr);
 133}
 134
 135#if 8 % PPPOE_HASH_BITS
 136#error 8 must be a multiple of PPPOE_HASH_BITS
 137#endif
 138
 139static int hash_item(__be16 sid, unsigned char *addr)
 140{
 141	unsigned char hash = 0;
 142	unsigned int i;
 143
 144	for (i = 0; i < ETH_ALEN; i++)
 145		hash ^= addr[i];
 146	for (i = 0; i < sizeof(sid_t) * 8; i += 8)
 147		hash ^= (__force __u32)sid >> i;
 148	for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;)
 149		hash ^= hash >> i;
 150
 151	return hash & PPPOE_HASH_MASK;
 152}
 153
 154/**********************************************************************
 155 *
 156 *  Set/get/delete/rehash items  (internal versions)
 157 *
 158 **********************************************************************/
 159static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid,
 160				unsigned char *addr, int ifindex)
 161{
 162	int hash = hash_item(sid, addr);
 163	struct pppox_sock *ret;
 164
 165	ret = rcu_dereference(pn->hash_table[hash]);
 166	while (ret) {
 167		if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
 168		    ret->pppoe_ifindex == ifindex)
 169			return ret;
 170
 171		ret = rcu_dereference(ret->next);
 172	}
 173
 174	return NULL;
 175}
 176
 177static int __set_item(struct pppoe_net *pn, struct pppox_sock *po)
 178{
 179	int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
 180	struct pppox_sock *ret, *first;
 181
 182	first = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock));
 183	ret = first;
 184	while (ret) {
 185		if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) &&
 186		    ret->pppoe_ifindex == po->pppoe_ifindex)
 187			return -EALREADY;
 188
 189		ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock));
 190	}
 191
 192	RCU_INIT_POINTER(po->next, first);
 193	rcu_assign_pointer(pn->hash_table[hash], po);
 194
 195	return 0;
 196}
 197
 198static void __delete_item(struct pppoe_net *pn, __be16 sid,
 199					char *addr, int ifindex)
 200{
 201	int hash = hash_item(sid, addr);
 202	struct pppox_sock *ret, __rcu **src;
 203
 204	ret = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock));
 205	src = &pn->hash_table[hash];
 206
 207	while (ret) {
 208		if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
 209		    ret->pppoe_ifindex == ifindex) {
 210			struct pppox_sock *next;
 211
 212			next = rcu_dereference_protected(ret->next,
 213							 lockdep_is_held(&pn->hash_lock));
 214			rcu_assign_pointer(*src, next);
 215			break;
 216		}
 217
 218		src = &ret->next;
 219		ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock));
 220	}
 221}
 222
 223/**********************************************************************
 224 *
 225 *  Set/get/delete/rehash items
 226 *
 227 **********************************************************************/
 228static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
 229					unsigned char *addr, int ifindex)
 230{
 231	struct pppox_sock *po;
 232
 233	po = __get_item(pn, sid, addr, ifindex);
 234	if (po && !refcount_inc_not_zero(&sk_pppox(po)->sk_refcnt))
 235		po = NULL;
 236
 237	return po;
 238}
 239
 240static inline struct pppox_sock *__get_item_by_addr(struct net *net,
 241						    struct sockaddr_pppox *sp)
 242{
 243	struct net_device *dev;
 244	struct pppoe_net *pn;
 245	struct pppox_sock *pppox_sock = NULL;
 246
 247	int ifindex;
 248
 249	dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev);
 250	if (dev) {
 251		ifindex = dev->ifindex;
 252		pn = pppoe_pernet(net);
 253		pppox_sock = __get_item(pn, sp->sa_addr.pppoe.sid,
 254					sp->sa_addr.pppoe.remote, ifindex);
 255	}
 256	return pppox_sock;
 257}
 258
 259static inline void delete_item(struct pppoe_net *pn, __be16 sid,
 260					char *addr, int ifindex)
 261{
 262	spin_lock(&pn->hash_lock);
 263	__delete_item(pn, sid, addr, ifindex);
 264	spin_unlock(&pn->hash_lock);
 265}
 266
 267/***************************************************************************
 268 *
 269 *  Handler for device events.
 270 *  Certain device events require that sockets be unconnected.
 271 *
 272 **************************************************************************/
 273
 274static void pppoe_flush_dev(struct net_device *dev)
 275{
 276	struct pppoe_net *pn;
 277	int i;
 278
 279	pn = pppoe_pernet(dev_net(dev));
 280	spin_lock(&pn->hash_lock);
 281	for (i = 0; i < PPPOE_HASH_SIZE; i++) {
 282		struct pppox_sock *po = rcu_dereference_protected(pn->hash_table[i],
 283								  lockdep_is_held(&pn->hash_lock));
 284		struct sock *sk;
 285
 286		while (po) {
 287			while (po && po->pppoe_dev != dev) {
 288				po = rcu_dereference_protected(po->next,
 289							       lockdep_is_held(&pn->hash_lock));
 290			}
 291
 292			if (!po)
 293				break;
 294
 295			sk = sk_pppox(po);
 296
 297			/* We always grab the socket lock, followed by the
 298			 * hash_lock, in that order.  Since we should hold the
 299			 * sock lock while doing any unbinding, we need to
 300			 * release the lock we're holding.  Hold a reference to
 301			 * the sock so it doesn't disappear as we're jumping
 302			 * between locks.
 303			 */
 304
 305			sock_hold(sk);
 306			spin_unlock(&pn->hash_lock);
 307			lock_sock(sk);
 308
 309			if (po->pppoe_dev == dev &&
 310			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
 311				pppox_unbind_sock(sk);
 312				sk->sk_state_change(sk);
 313				po->pppoe_dev = NULL;
 314				dev_put(dev);
 315			}
 316
 317			release_sock(sk);
 318			sock_put(sk);
 319
 320			/* Restart the process from the start of the current
 321			 * hash chain. We dropped locks so the world may have
 322			 * change from underneath us.
 323			 */
 324
 325			BUG_ON(pppoe_pernet(dev_net(dev)) == NULL);
 326			spin_lock(&pn->hash_lock);
 327			po = rcu_dereference_protected(pn->hash_table[i],
 328						       lockdep_is_held(&pn->hash_lock));
 329		}
 330	}
 331	spin_unlock(&pn->hash_lock);
 332}
 333
 334static int pppoe_device_event(struct notifier_block *this,
 335			      unsigned long event, void *ptr)
 336{
 337	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 338
 339	/* Only look at sockets that are using this specific device. */
 340	switch (event) {
 341	case NETDEV_CHANGEADDR:
 342	case NETDEV_CHANGEMTU:
 343		/* A change in mtu or address is a bad thing, requiring
 344		 * LCP re-negotiation.
 345		 */
 346
 347	case NETDEV_GOING_DOWN:
 348	case NETDEV_DOWN:
 349		/* Find every socket on this device and kill it. */
 350		pppoe_flush_dev(dev);
 351		break;
 352
 353	default:
 354		break;
 355	}
 356
 357	return NOTIFY_DONE;
 358}
 359
 360static struct notifier_block pppoe_notifier = {
 361	.notifier_call = pppoe_device_event,
 362};
 363
 364/************************************************************************
 365 *
 366 * Do the real work of receiving a PPPoE Session frame.
 367 *
 368 ***********************************************************************/
 369static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 370{
 371	struct pppox_sock *po = pppox_sk(sk);
 372	struct pppox_sock *relay_po;
 373
 374	/* Backlog receive. Semantics of backlog rcv preclude any code from
 375	 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state
 376	 * can't change.
 377	 */
 378
 379	if (sk->sk_state & PPPOX_BOUND) {
 380		ppp_input(&po->chan, skb);
 381	} else if (sk->sk_state & PPPOX_RELAY) {
 382		relay_po = __get_item_by_addr(sock_net(sk),
 383					      &po->pppoe_relay);
 384		if (relay_po == NULL)
 385			goto abort_kfree;
 386
 387		if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
 388			goto abort_kfree;
 389
 390		if (!__pppoe_xmit(sk_pppox(relay_po), skb))
 391			goto abort_kfree;
 392	} else {
 393		if (sock_queue_rcv_skb(sk, skb))
 394			goto abort_kfree;
 395	}
 396
 397	return NET_RX_SUCCESS;
 398
 399abort_kfree:
 400	kfree_skb(skb);
 401	return NET_RX_DROP;
 402}
 403
 404/************************************************************************
 405 *
 406 * Receive wrapper called in BH context.
 407 *
 408 ***********************************************************************/
 409static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
 410		     struct packet_type *pt, struct net_device *orig_dev)
 411{
 412	struct pppoe_hdr *ph;
 413	struct pppox_sock *po;
 414	struct pppoe_net *pn;
 415	int len;
 416
 417	if (skb->pkt_type == PACKET_OTHERHOST)
 418		goto drop;
 419
 420	skb = skb_share_check(skb, GFP_ATOMIC);
 421	if (!skb)
 422		goto out;
 423
 424	if (skb_mac_header_len(skb) < ETH_HLEN)
 425		goto drop;
 426
 427	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 428		goto drop;
 429
 430	ph = pppoe_hdr(skb);
 431	len = ntohs(ph->length);
 432
 433	skb_pull_rcsum(skb, sizeof(*ph));
 434	if (skb->len < len)
 435		goto drop;
 436
 437	if (pskb_trim_rcsum(skb, len))
 438		goto drop;
 439
 440	ph = pppoe_hdr(skb);
 441	pn = pppoe_pernet(dev_net(dev));
 442
 443	po = __get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
 444	if (!po)
 445		goto drop;
 446
 447	return __sk_receive_skb(sk_pppox(po), skb, 0, 1, false);
 448
 449drop:
 450	kfree_skb(skb);
 451out:
 452	return NET_RX_DROP;
 453}
 454
 455static void pppoe_unbind_sock_work(struct work_struct *work)
 456{
 457	struct pppox_sock *po = container_of(work, struct pppox_sock,
 458					     proto.pppoe.padt_work);
 459	struct sock *sk = sk_pppox(po);
 460
 461	lock_sock(sk);
 462	if (po->pppoe_dev) {
 463		dev_put(po->pppoe_dev);
 464		po->pppoe_dev = NULL;
 465	}
 466	pppox_unbind_sock(sk);
 467	release_sock(sk);
 468	sock_put(sk);
 469}
 470
 471/************************************************************************
 472 *
 473 * Receive a PPPoE Discovery frame.
 474 * This is solely for detection of PADT frames
 475 *
 476 ***********************************************************************/
 477static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
 478			  struct packet_type *pt, struct net_device *orig_dev)
 479
 480{
 481	struct pppoe_hdr *ph;
 482	struct pppox_sock *po;
 483	struct pppoe_net *pn;
 484
 485	skb = skb_share_check(skb, GFP_ATOMIC);
 486	if (!skb)
 487		goto out;
 488
 489	if (skb->pkt_type != PACKET_HOST)
 490		goto abort;
 491
 492	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 493		goto abort;
 494
 495	ph = pppoe_hdr(skb);
 496	if (ph->code != PADT_CODE)
 497		goto abort;
 498
 499	pn = pppoe_pernet(dev_net(dev));
 500	po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
 501	if (po)
 502		if (!schedule_work(&po->proto.pppoe.padt_work))
 503			sock_put(sk_pppox(po));
 504
 505abort:
 506	kfree_skb(skb);
 507out:
 508	return NET_RX_SUCCESS; /* Lies... :-) */
 509}
 510
 511static struct packet_type pppoes_ptype __read_mostly = {
 512	.type	= cpu_to_be16(ETH_P_PPP_SES),
 513	.func	= pppoe_rcv,
 514};
 515
 516static struct packet_type pppoed_ptype __read_mostly = {
 517	.type	= cpu_to_be16(ETH_P_PPP_DISC),
 518	.func	= pppoe_disc_rcv,
 519};
 520
 521static struct proto pppoe_sk_proto __read_mostly = {
 522	.name	  = "PPPOE",
 523	.owner	  = THIS_MODULE,
 524	.obj_size = sizeof(struct pppox_sock),
 525};
 526
 527static void pppoe_destruct(struct sock *sk)
 528{
 529	skb_queue_purge(&sk->sk_receive_queue);
 530}
 531
 532/***********************************************************************
 533 *
 534 * Initialize a new struct sock.
 535 *
 536 **********************************************************************/
 537static int pppoe_create(struct net *net, struct socket *sock, int kern)
 538{
 539	struct sock *sk;
 540
 541	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern);
 542	if (!sk)
 543		return -ENOMEM;
 544
 545	sock_init_data(sock, sk);
 546	sock_set_flag(sk, SOCK_RCU_FREE);
 547
 548	sock->state	= SS_UNCONNECTED;
 549	sock->ops	= &pppoe_ops;
 550
 551	sk->sk_backlog_rcv	= pppoe_rcv_core;
 552	sk->sk_destruct		= pppoe_destruct;
 553	sk->sk_state		= PPPOX_NONE;
 554	sk->sk_type		= SOCK_STREAM;
 555	sk->sk_family		= PF_PPPOX;
 556	sk->sk_protocol		= PX_PROTO_OE;
 557
 558	INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
 559		  pppoe_unbind_sock_work);
 560
 561	return 0;
 562}
 563
 564static int pppoe_release(struct socket *sock)
 565{
 566	struct sock *sk = sock->sk;
 567	struct pppox_sock *po;
 568	struct pppoe_net *pn;
 569	struct net *net = NULL;
 570
 571	if (!sk)
 572		return 0;
 573
 574	lock_sock(sk);
 575	if (sock_flag(sk, SOCK_DEAD)) {
 576		release_sock(sk);
 577		return -EBADF;
 578	}
 579
 580	po = pppox_sk(sk);
 581
 582	if (po->pppoe_dev) {
 583		dev_put(po->pppoe_dev);
 584		po->pppoe_dev = NULL;
 585	}
 586
 587	pppox_unbind_sock(sk);
 588
 589	/* Signal the death of the socket. */
 590	sk->sk_state = PPPOX_DEAD;
 591
 592	net = sock_net(sk);
 593	pn = pppoe_pernet(net);
 594
 595	/*
 596	 * protect "po" from concurrent updates
 597	 * on pppoe_flush_dev
 598	 */
 599	delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote,
 600		    po->pppoe_ifindex);
 601
 602	sock_orphan(sk);
 603	sock->sk = NULL;
 604
 605	release_sock(sk);
 606	sock_put(sk);
 607
 608	return 0;
 609}
 610
 611static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr,
 612			 int sockaddr_len, int flags)
 613{
 614	struct sock *sk = sock->sk;
 615	struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr;
 616	struct pppox_sock *po = pppox_sk(sk);
 617	struct net_device *dev = NULL;
 618	struct pppoe_net *pn;
 619	struct net *net = NULL;
 620	int error;
 621
 622	lock_sock(sk);
 623
 624	error = -EINVAL;
 625
 626	if (sockaddr_len != sizeof(struct sockaddr_pppox))
 627		goto end;
 628
 629	if (sp->sa_protocol != PX_PROTO_OE)
 630		goto end;
 631
 632	/* Check for already bound sockets */
 633	error = -EBUSY;
 634	if ((sk->sk_state & PPPOX_CONNECTED) &&
 635	     stage_session(sp->sa_addr.pppoe.sid))
 636		goto end;
 637
 638	/* Check for already disconnected sockets, on attempts to disconnect */
 639	error = -EALREADY;
 640	if ((sk->sk_state & PPPOX_DEAD) &&
 641	     !stage_session(sp->sa_addr.pppoe.sid))
 642		goto end;
 643
 644	error = 0;
 645
 646	/* Delete the old binding */
 647	if (stage_session(po->pppoe_pa.sid)) {
 648		pppox_unbind_sock(sk);
 649		pn = pppoe_pernet(sock_net(sk));
 650		delete_item(pn, po->pppoe_pa.sid,
 651			    po->pppoe_pa.remote, po->pppoe_ifindex);
 652		if (po->pppoe_dev) {
 653			dev_put(po->pppoe_dev);
 654			po->pppoe_dev = NULL;
 655		}
 656
 657		po->pppoe_ifindex = 0;
 658		memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
 659		memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
 660		memset(&po->chan, 0, sizeof(po->chan));
 661		po->next = NULL;
 662		po->num = 0;
 663
 664		sk->sk_state = PPPOX_NONE;
 665	}
 666
 667	/* Re-bind in session stage only */
 668	if (stage_session(sp->sa_addr.pppoe.sid)) {
 669		error = -ENODEV;
 670		net = sock_net(sk);
 671		dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
 672		if (!dev)
 673			goto err_put;
 674
 675		po->pppoe_dev = dev;
 676		po->pppoe_ifindex = dev->ifindex;
 677		pn = pppoe_pernet(net);
 678		if (!(dev->flags & IFF_UP)) {
 679			goto err_put;
 680		}
 681
 682		memcpy(&po->pppoe_pa,
 683		       &sp->sa_addr.pppoe,
 684		       sizeof(struct pppoe_addr));
 685
 686		spin_lock(&pn->hash_lock);
 687		error = __set_item(pn, po);
 688		spin_unlock(&pn->hash_lock);
 689		if (error < 0)
 690			goto err_put;
 691
 692		po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
 693				   dev->hard_header_len);
 694
 695		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
 696		po->chan.private = sk;
 697		po->chan.ops = &pppoe_chan_ops;
 698		po->chan.direct_xmit = true;
 699
 700		error = ppp_register_net_channel(dev_net(dev), &po->chan);
 701		if (error) {
 702			delete_item(pn, po->pppoe_pa.sid,
 703				    po->pppoe_pa.remote, po->pppoe_ifindex);
 704			goto err_put;
 705		}
 706
 707		sk->sk_state = PPPOX_CONNECTED;
 708	}
 709
 710	po->num = sp->sa_addr.pppoe.sid;
 711
 712end:
 713	release_sock(sk);
 714	return error;
 715err_put:
 716	if (po->pppoe_dev) {
 717		dev_put(po->pppoe_dev);
 718		po->pppoe_dev = NULL;
 719	}
 720	goto end;
 721}
 722
 723static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
 724		  int peer)
 725{
 726	int len = sizeof(struct sockaddr_pppox);
 727	struct sockaddr_pppox sp;
 728
 729	sp.sa_family	= AF_PPPOX;
 730	sp.sa_protocol	= PX_PROTO_OE;
 731	memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
 732	       sizeof(struct pppoe_addr));
 733
 734	memcpy(uaddr, &sp, len);
 735
 736	return len;
 737}
 738
 739static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
 740		unsigned long arg)
 741{
 742	struct sock *sk = sock->sk;
 743	struct pppox_sock *po = pppox_sk(sk);
 744	int val;
 745	int err;
 746
 747	switch (cmd) {
 748	case PPPIOCGMRU:
 749		err = -ENXIO;
 750		if (!(sk->sk_state & PPPOX_CONNECTED))
 751			break;
 752
 753		err = -EFAULT;
 754		if (put_user(po->pppoe_dev->mtu -
 755			     sizeof(struct pppoe_hdr) -
 756			     PPP_HDRLEN,
 757			     (int __user *)arg))
 758			break;
 759		err = 0;
 760		break;
 761
 762	case PPPIOCSMRU:
 763		err = -ENXIO;
 764		if (!(sk->sk_state & PPPOX_CONNECTED))
 765			break;
 766
 767		err = -EFAULT;
 768		if (get_user(val, (int __user *)arg))
 769			break;
 770
 771		if (val < (po->pppoe_dev->mtu
 772			   - sizeof(struct pppoe_hdr)
 773			   - PPP_HDRLEN))
 774			err = 0;
 775		else
 776			err = -EINVAL;
 777		break;
 778
 779	case PPPIOCSFLAGS:
 780		err = -EFAULT;
 781		if (get_user(val, (int __user *)arg))
 782			break;
 783		err = 0;
 784		break;
 785
 786	case PPPOEIOCSFWD:
 787	{
 788		struct pppox_sock *relay_po;
 789
 790		err = -EBUSY;
 791		if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD))
 792			break;
 793
 794		err = -ENOTCONN;
 795		if (!(sk->sk_state & PPPOX_CONNECTED))
 796			break;
 797
 798		/* PPPoE address from the user specifies an outbound
 799		   PPPoE address which frames are forwarded to */
 800		err = -EFAULT;
 801		if (copy_from_user(&po->pppoe_relay,
 802				   (void __user *)arg,
 803				   sizeof(struct sockaddr_pppox)))
 804			break;
 805
 806		err = -EINVAL;
 807		if (po->pppoe_relay.sa_family != AF_PPPOX ||
 808		    po->pppoe_relay.sa_protocol != PX_PROTO_OE)
 809			break;
 810
 811		/* Check that the socket referenced by the address
 812		   actually exists. */
 813		rcu_read_lock();
 814		relay_po = __get_item_by_addr(sock_net(sk), &po->pppoe_relay);
 815		rcu_read_unlock();
 816		if (!relay_po)
 817			break;
 818
 819		sk->sk_state |= PPPOX_RELAY;
 820		err = 0;
 821		break;
 822	}
 823
 824	case PPPOEIOCDFWD:
 825		err = -EALREADY;
 826		if (!(sk->sk_state & PPPOX_RELAY))
 827			break;
 828
 829		sk->sk_state &= ~PPPOX_RELAY;
 830		err = 0;
 831		break;
 832
 833	default:
 834		err = -ENOTTY;
 835	}
 836
 837	return err;
 838}
 839
 840static int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
 841			 size_t total_len)
 842{
 843	struct sk_buff *skb;
 844	struct sock *sk = sock->sk;
 845	struct pppox_sock *po = pppox_sk(sk);
 846	int error;
 847	struct pppoe_hdr hdr;
 848	struct pppoe_hdr *ph;
 849	struct net_device *dev;
 850	char *start;
 851	int hlen;
 852
 853	lock_sock(sk);
 854	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) {
 855		error = -ENOTCONN;
 856		goto end;
 857	}
 858
 859	hdr.ver = 1;
 860	hdr.type = 1;
 861	hdr.code = 0;
 862	hdr.sid = po->num;
 863
 864	dev = po->pppoe_dev;
 865
 866	error = -EMSGSIZE;
 867	if (total_len > (dev->mtu + dev->hard_header_len))
 868		goto end;
 869
 870	hlen = LL_RESERVED_SPACE(dev);
 871	skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len +
 872			   dev->needed_tailroom, 0, GFP_KERNEL);
 873	if (!skb) {
 874		error = -ENOMEM;
 875		goto end;
 876	}
 877
 878	/* Reserve space for headers. */
 879	skb_reserve(skb, hlen);
 880	skb_reset_network_header(skb);
 881
 882	skb->dev = dev;
 883
 884	skb->priority = READ_ONCE(sk->sk_priority);
 885	skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
 886
 887	ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr));
 888	start = (char *)&ph->tag[0];
 889
 890	error = memcpy_from_msg(start, m, total_len);
 891	if (error < 0) {
 892		kfree_skb(skb);
 893		goto end;
 894	}
 895
 896	error = total_len;
 897	dev_hard_header(skb, dev, ETH_P_PPP_SES,
 898			po->pppoe_pa.remote, NULL, total_len);
 899
 900	memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
 901
 902	ph->length = htons(total_len);
 903
 904	dev_queue_xmit(skb);
 905
 906end:
 907	release_sock(sk);
 908	return error;
 909}
 910
 911/************************************************************************
 912 *
 913 * xmit function for internal use.
 914 *
 915 ***********************************************************************/
 916static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 917{
 918	struct pppox_sock *po = pppox_sk(sk);
 919	struct net_device *dev = po->pppoe_dev;
 920	struct pppoe_hdr *ph;
 921	int data_len = skb->len;
 922
 923	/* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP
 924	 * xmit operations conclude prior to an unregistration call.  Thus
 925	 * sk->sk_state cannot change, so we don't need to do lock_sock().
 926	 * But, we also can't do a lock_sock since that introduces a potential
 927	 * deadlock as we'd reverse the lock ordering used when calling
 928	 * ppp_unregister_channel().
 929	 */
 930
 931	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
 932		goto abort;
 933
 934	if (!dev)
 935		goto abort;
 936
 937	/* Copy the data if there is no space for the header or if it's
 938	 * read-only.
 939	 */
 940	if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph)))
 941		goto abort;
 942
 943	__skb_push(skb, sizeof(*ph));
 944	skb_reset_network_header(skb);
 945
 946	ph = pppoe_hdr(skb);
 947	ph->ver	= 1;
 948	ph->type = 1;
 949	ph->code = 0;
 950	ph->sid	= po->num;
 951	ph->length = htons(data_len);
 952
 953	skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
 954	skb->dev = dev;
 955
 956	dev_hard_header(skb, dev, ETH_P_PPP_SES,
 957			po->pppoe_pa.remote, NULL, data_len);
 958
 959	dev_queue_xmit(skb);
 960	return 1;
 961
 962abort:
 963	kfree_skb(skb);
 964	return 1;
 965}
 966
 967/************************************************************************
 968 *
 969 * xmit function called by generic PPP driver
 970 * sends PPP frame over PPPoE socket
 971 *
 972 ***********************************************************************/
 973static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 974{
 975	struct sock *sk = chan->private;
 976	return __pppoe_xmit(sk, skb);
 977}
 978
 979static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx,
 980				   struct net_device_path *path,
 981				   const struct ppp_channel *chan)
 982{
 983	struct sock *sk = chan->private;
 984	struct pppox_sock *po = pppox_sk(sk);
 985	struct net_device *dev = po->pppoe_dev;
 986
 987	if (sock_flag(sk, SOCK_DEAD) ||
 988	    !(sk->sk_state & PPPOX_CONNECTED) || !dev)
 989		return -1;
 990
 991	path->type = DEV_PATH_PPPOE;
 992	path->encap.proto = htons(ETH_P_PPP_SES);
 993	path->encap.id = be16_to_cpu(po->num);
 994	memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN);
 995	memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN);
 996	path->dev = ctx->dev;
 997	ctx->dev = dev;
 998
 999	return 0;
1000}
1001
1002static const struct ppp_channel_ops pppoe_chan_ops = {
1003	.start_xmit = pppoe_xmit,
1004	.fill_forward_path = pppoe_fill_forward_path,
1005};
1006
1007static int pppoe_recvmsg(struct socket *sock, struct msghdr *m,
1008			 size_t total_len, int flags)
1009{
1010	struct sock *sk = sock->sk;
1011	struct sk_buff *skb;
1012	int error = 0;
1013
1014	if (sk->sk_state & PPPOX_BOUND)
1015		return -EIO;
1016
1017	skb = skb_recv_datagram(sk, flags, &error);
1018	if (!skb)
1019		return error;
1020
1021	total_len = min_t(size_t, total_len, skb->len);
1022	error = skb_copy_datagram_msg(skb, 0, m, total_len);
1023	if (error == 0) {
1024		consume_skb(skb);
1025		return total_len;
1026	}
1027
1028	kfree_skb(skb);
1029	return error;
1030}
1031
1032#ifdef CONFIG_PROC_FS
1033static int pppoe_seq_show(struct seq_file *seq, void *v)
1034{
1035	struct pppox_sock *po;
1036	char *dev_name;
1037
1038	if (v == SEQ_START_TOKEN) {
1039		seq_puts(seq, "Id       Address              Device\n");
1040		goto out;
1041	}
1042
1043	po = v;
1044	dev_name = po->pppoe_pa.dev;
1045
1046	seq_printf(seq, "%08X %pM %8s\n",
1047		po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name);
1048out:
1049	return 0;
1050}
1051
1052static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos)
1053{
1054	struct pppox_sock *po;
1055	int i;
1056
1057	for (i = 0; i < PPPOE_HASH_SIZE; i++) {
1058		po = rcu_dereference(pn->hash_table[i]);
1059		while (po) {
1060			if (!pos--)
1061				goto out;
1062			po = rcu_dereference(po->next);
1063		}
1064	}
1065
1066out:
1067	return po;
1068}
1069
1070static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos)
1071	__acquires(RCU)
1072{
1073	struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
1074	loff_t l = *pos;
1075
1076	rcu_read_lock();
1077	return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN;
1078}
1079
1080static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1081{
1082	struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
1083	struct pppox_sock *po, *next;
1084
1085	++*pos;
1086	if (v == SEQ_START_TOKEN) {
1087		po = pppoe_get_idx(pn, 0);
1088		goto out;
1089	}
1090	po = v;
1091	next = rcu_dereference(po->next);
1092	if (next)
1093		po = next;
1094	else {
1095		int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
1096
1097		po = NULL;
1098		while (++hash < PPPOE_HASH_SIZE) {
1099			po = rcu_dereference(pn->hash_table[hash]);
1100			if (po)
1101				break;
1102		}
1103	}
1104
1105out:
1106	return po;
1107}
1108
1109static void pppoe_seq_stop(struct seq_file *seq, void *v)
1110	__releases(RCU)
1111{
1112	rcu_read_unlock();
1113}
1114
1115static const struct seq_operations pppoe_seq_ops = {
1116	.start		= pppoe_seq_start,
1117	.next		= pppoe_seq_next,
1118	.stop		= pppoe_seq_stop,
1119	.show		= pppoe_seq_show,
1120};
1121#endif /* CONFIG_PROC_FS */
1122
1123static const struct proto_ops pppoe_ops = {
1124	.family		= AF_PPPOX,
1125	.owner		= THIS_MODULE,
1126	.release	= pppoe_release,
1127	.bind		= sock_no_bind,
1128	.connect	= pppoe_connect,
1129	.socketpair	= sock_no_socketpair,
1130	.accept		= sock_no_accept,
1131	.getname	= pppoe_getname,
1132	.poll		= datagram_poll,
1133	.listen		= sock_no_listen,
1134	.shutdown	= sock_no_shutdown,
1135	.sendmsg	= pppoe_sendmsg,
1136	.recvmsg	= pppoe_recvmsg,
1137	.mmap		= sock_no_mmap,
1138	.ioctl		= pppox_ioctl,
1139#ifdef CONFIG_COMPAT
1140	.compat_ioctl	= pppox_compat_ioctl,
1141#endif
1142};
1143
1144static const struct pppox_proto pppoe_proto = {
1145	.create	= pppoe_create,
1146	.ioctl	= pppoe_ioctl,
1147	.owner	= THIS_MODULE,
1148};
1149
1150static __net_init int pppoe_init_net(struct net *net)
1151{
1152	struct pppoe_net *pn = pppoe_pernet(net);
1153	struct proc_dir_entry *pde;
1154
1155	spin_lock_init(&pn->hash_lock);
1156
1157	pde = proc_create_net("pppoe", 0444, net->proc_net,
1158			&pppoe_seq_ops, sizeof(struct seq_net_private));
1159#ifdef CONFIG_PROC_FS
1160	if (!pde)
1161		return -ENOMEM;
1162#endif
1163
1164	return 0;
1165}
1166
1167static __net_exit void pppoe_exit_net(struct net *net)
1168{
1169	remove_proc_entry("pppoe", net->proc_net);
1170}
1171
1172static struct pernet_operations pppoe_net_ops = {
1173	.init = pppoe_init_net,
1174	.exit = pppoe_exit_net,
1175	.id   = &pppoe_net_id,
1176	.size = sizeof(struct pppoe_net),
1177};
1178
1179static int __init pppoe_init(void)
1180{
1181	int err;
1182
1183	err = register_pernet_device(&pppoe_net_ops);
1184	if (err)
1185		goto out;
1186
1187	err = proto_register(&pppoe_sk_proto, 0);
1188	if (err)
1189		goto out_unregister_net_ops;
1190
1191	err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto);
1192	if (err)
1193		goto out_unregister_pppoe_proto;
1194
1195	dev_add_pack(&pppoes_ptype);
1196	dev_add_pack(&pppoed_ptype);
1197	register_netdevice_notifier(&pppoe_notifier);
1198
1199	return 0;
1200
1201out_unregister_pppoe_proto:
1202	proto_unregister(&pppoe_sk_proto);
1203out_unregister_net_ops:
1204	unregister_pernet_device(&pppoe_net_ops);
1205out:
1206	return err;
1207}
1208
1209static void __exit pppoe_exit(void)
1210{
1211	unregister_netdevice_notifier(&pppoe_notifier);
1212	dev_remove_pack(&pppoed_ptype);
1213	dev_remove_pack(&pppoes_ptype);
1214	unregister_pppox_proto(PX_PROTO_OE);
1215	proto_unregister(&pppoe_sk_proto);
1216	unregister_pernet_device(&pppoe_net_ops);
1217}
1218
1219module_init(pppoe_init);
1220module_exit(pppoe_exit);
1221
1222MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>");
1223MODULE_DESCRIPTION("PPP over Ethernet driver");
1224MODULE_LICENSE("GPL");
1225MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE);