1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* RxRPC individual remote procedure call handling |
3 | * |
4 | * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved. |
5 | * Written by David Howells (dhowells@redhat.com) |
6 | */ |
7 | |
8 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
9 | |
10 | #include <linux/slab.h> |
11 | #include <linux/module.h> |
12 | #include <linux/circ_buf.h> |
13 | #include <linux/spinlock_types.h> |
14 | #include <net/sock.h> |
15 | #include <net/af_rxrpc.h> |
16 | #include "ar-internal.h" |
17 | |
18 | const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = { |
19 | [RXRPC_CALL_UNINITIALISED] = "Uninit " , |
20 | [RXRPC_CALL_CLIENT_AWAIT_CONN] = "ClWtConn" , |
21 | [RXRPC_CALL_CLIENT_SEND_REQUEST] = "ClSndReq" , |
22 | [RXRPC_CALL_CLIENT_AWAIT_REPLY] = "ClAwtRpl" , |
23 | [RXRPC_CALL_CLIENT_RECV_REPLY] = "ClRcvRpl" , |
24 | [RXRPC_CALL_SERVER_PREALLOC] = "SvPrealc" , |
25 | [RXRPC_CALL_SERVER_SECURING] = "SvSecure" , |
26 | [RXRPC_CALL_SERVER_RECV_REQUEST] = "SvRcvReq" , |
27 | [RXRPC_CALL_SERVER_ACK_REQUEST] = "SvAckReq" , |
28 | [RXRPC_CALL_SERVER_SEND_REPLY] = "SvSndRpl" , |
29 | [RXRPC_CALL_SERVER_AWAIT_ACK] = "SvAwtACK" , |
30 | [RXRPC_CALL_COMPLETE] = "Complete" , |
31 | }; |
32 | |
33 | const char *const rxrpc_call_completions[NR__RXRPC_CALL_COMPLETIONS] = { |
34 | [RXRPC_CALL_SUCCEEDED] = "Complete" , |
35 | [RXRPC_CALL_REMOTELY_ABORTED] = "RmtAbort" , |
36 | [RXRPC_CALL_LOCALLY_ABORTED] = "LocAbort" , |
37 | [RXRPC_CALL_LOCAL_ERROR] = "LocError" , |
38 | [RXRPC_CALL_NETWORK_ERROR] = "NetError" , |
39 | }; |
40 | |
41 | struct kmem_cache *rxrpc_call_jar; |
42 | |
43 | static DEFINE_SEMAPHORE(rxrpc_call_limiter, 1000); |
44 | static DEFINE_SEMAPHORE(rxrpc_kernel_call_limiter, 1000); |
45 | |
46 | void rxrpc_poke_call(struct rxrpc_call *call, enum rxrpc_call_poke_trace what) |
47 | { |
48 | struct rxrpc_local *local = call->local; |
49 | bool busy; |
50 | |
51 | if (!test_bit(RXRPC_CALL_DISCONNECTED, &call->flags)) { |
52 | spin_lock_bh(lock: &local->lock); |
53 | busy = !list_empty(head: &call->attend_link); |
54 | trace_rxrpc_poke_call(call, busy, what); |
55 | if (!busy && !rxrpc_try_get_call(call, rxrpc_call_get_poke)) |
56 | busy = true; |
57 | if (!busy) { |
58 | list_add_tail(new: &call->attend_link, head: &local->call_attend_q); |
59 | } |
60 | spin_unlock_bh(lock: &local->lock); |
61 | if (!busy) |
62 | rxrpc_wake_up_io_thread(local); |
63 | } |
64 | } |
65 | |
66 | static void rxrpc_call_timer_expired(struct timer_list *t) |
67 | { |
68 | struct rxrpc_call *call = from_timer(call, t, timer); |
69 | |
70 | _enter("%d" , call->debug_id); |
71 | |
72 | if (!__rxrpc_call_is_complete(call)) { |
73 | trace_rxrpc_timer_expired(call); |
74 | rxrpc_poke_call(call, what: rxrpc_call_poke_timer); |
75 | } |
76 | } |
77 | |
78 | static struct lock_class_key rxrpc_call_user_mutex_lock_class_key; |
79 | |
80 | static void rxrpc_destroy_call(struct work_struct *); |
81 | |
82 | /* |
83 | * find an extant server call |
84 | * - called in process context with IRQs enabled |
85 | */ |
86 | struct rxrpc_call *rxrpc_find_call_by_user_ID(struct rxrpc_sock *rx, |
87 | unsigned long user_call_ID) |
88 | { |
89 | struct rxrpc_call *call; |
90 | struct rb_node *p; |
91 | |
92 | _enter("%p,%lx" , rx, user_call_ID); |
93 | |
94 | read_lock(&rx->call_lock); |
95 | |
96 | p = rx->calls.rb_node; |
97 | while (p) { |
98 | call = rb_entry(p, struct rxrpc_call, sock_node); |
99 | |
100 | if (user_call_ID < call->user_call_ID) |
101 | p = p->rb_left; |
102 | else if (user_call_ID > call->user_call_ID) |
103 | p = p->rb_right; |
104 | else |
105 | goto found_extant_call; |
106 | } |
107 | |
108 | read_unlock(&rx->call_lock); |
109 | _leave(" = NULL" ); |
110 | return NULL; |
111 | |
112 | found_extant_call: |
113 | rxrpc_get_call(call, rxrpc_call_get_sendmsg); |
114 | read_unlock(&rx->call_lock); |
115 | _leave(" = %p [%d]" , call, refcount_read(&call->ref)); |
116 | return call; |
117 | } |
118 | |
119 | /* |
120 | * allocate a new call |
121 | */ |
122 | struct rxrpc_call *rxrpc_alloc_call(struct rxrpc_sock *rx, gfp_t gfp, |
123 | unsigned int debug_id) |
124 | { |
125 | struct rxrpc_call *call; |
126 | struct rxrpc_net *rxnet = rxrpc_net(net: sock_net(sk: &rx->sk)); |
127 | |
128 | call = kmem_cache_zalloc(k: rxrpc_call_jar, flags: gfp); |
129 | if (!call) |
130 | return NULL; |
131 | |
132 | mutex_init(&call->user_mutex); |
133 | |
134 | /* Prevent lockdep reporting a deadlock false positive between the afs |
135 | * filesystem and sys_sendmsg() via the mmap sem. |
136 | */ |
137 | if (rx->sk.sk_kern_sock) |
138 | lockdep_set_class(&call->user_mutex, |
139 | &rxrpc_call_user_mutex_lock_class_key); |
140 | |
141 | timer_setup(&call->timer, rxrpc_call_timer_expired, 0); |
142 | INIT_WORK(&call->destroyer, rxrpc_destroy_call); |
143 | INIT_LIST_HEAD(list: &call->link); |
144 | INIT_LIST_HEAD(list: &call->wait_link); |
145 | INIT_LIST_HEAD(list: &call->accept_link); |
146 | INIT_LIST_HEAD(list: &call->recvmsg_link); |
147 | INIT_LIST_HEAD(list: &call->sock_link); |
148 | INIT_LIST_HEAD(list: &call->attend_link); |
149 | INIT_LIST_HEAD(list: &call->tx_sendmsg); |
150 | INIT_LIST_HEAD(list: &call->tx_buffer); |
151 | skb_queue_head_init(list: &call->recvmsg_queue); |
152 | skb_queue_head_init(list: &call->rx_oos_queue); |
153 | init_waitqueue_head(&call->waitq); |
154 | spin_lock_init(&call->notify_lock); |
155 | spin_lock_init(&call->tx_lock); |
156 | refcount_set(r: &call->ref, n: 1); |
157 | call->debug_id = debug_id; |
158 | call->tx_total_len = -1; |
159 | call->next_rx_timo = 20 * HZ; |
160 | call->next_req_timo = 1 * HZ; |
161 | call->ackr_window = 1; |
162 | call->ackr_wtop = 1; |
163 | call->delay_ack_at = KTIME_MAX; |
164 | call->ack_lost_at = KTIME_MAX; |
165 | call->resend_at = KTIME_MAX; |
166 | call->ping_at = KTIME_MAX; |
167 | call->keepalive_at = KTIME_MAX; |
168 | call->expect_rx_by = KTIME_MAX; |
169 | call->expect_req_by = KTIME_MAX; |
170 | call->expect_term_by = KTIME_MAX; |
171 | |
172 | memset(&call->sock_node, 0xed, sizeof(call->sock_node)); |
173 | |
174 | call->rx_winsize = rxrpc_rx_window_size; |
175 | call->tx_winsize = 16; |
176 | |
177 | if (RXRPC_TX_SMSS > 2190) |
178 | call->cong_cwnd = 2; |
179 | else if (RXRPC_TX_SMSS > 1095) |
180 | call->cong_cwnd = 3; |
181 | else |
182 | call->cong_cwnd = 4; |
183 | call->cong_ssthresh = RXRPC_TX_MAX_WINDOW; |
184 | |
185 | call->rxnet = rxnet; |
186 | call->rtt_avail = RXRPC_CALL_RTT_AVAIL_MASK; |
187 | atomic_inc(v: &rxnet->nr_calls); |
188 | return call; |
189 | } |
190 | |
191 | /* |
192 | * Allocate a new client call. |
193 | */ |
194 | static struct rxrpc_call *rxrpc_alloc_client_call(struct rxrpc_sock *rx, |
195 | struct rxrpc_conn_parameters *cp, |
196 | struct rxrpc_call_params *p, |
197 | gfp_t gfp, |
198 | unsigned int debug_id) |
199 | { |
200 | struct rxrpc_call *call; |
201 | ktime_t now; |
202 | int ret; |
203 | |
204 | _enter("" ); |
205 | |
206 | call = rxrpc_alloc_call(rx, gfp, debug_id); |
207 | if (!call) |
208 | return ERR_PTR(error: -ENOMEM); |
209 | now = ktime_get_real(); |
210 | call->acks_latest_ts = now; |
211 | call->cong_tstamp = now; |
212 | call->dest_srx = cp->peer->srx; |
213 | call->dest_srx.srx_service = cp->service_id; |
214 | call->interruptibility = p->interruptibility; |
215 | call->tx_total_len = p->tx_total_len; |
216 | call->key = key_get(key: cp->key); |
217 | call->peer = rxrpc_get_peer(cp->peer, rxrpc_peer_get_call); |
218 | call->local = rxrpc_get_local(cp->local, rxrpc_local_get_call); |
219 | call->security_level = cp->security_level; |
220 | if (p->kernel) |
221 | __set_bit(RXRPC_CALL_KERNEL, &call->flags); |
222 | if (cp->upgrade) |
223 | __set_bit(RXRPC_CALL_UPGRADE, &call->flags); |
224 | if (cp->exclusive) |
225 | __set_bit(RXRPC_CALL_EXCLUSIVE, &call->flags); |
226 | |
227 | if (p->timeouts.normal) |
228 | call->next_rx_timo = min(p->timeouts.normal, 1); |
229 | if (p->timeouts.idle) |
230 | call->next_req_timo = min(p->timeouts.idle, 1); |
231 | if (p->timeouts.hard) |
232 | call->hard_timo = p->timeouts.hard; |
233 | |
234 | ret = rxrpc_init_client_call_security(call); |
235 | if (ret < 0) { |
236 | rxrpc_prefail_call(call, compl: RXRPC_CALL_LOCAL_ERROR, error: ret); |
237 | rxrpc_put_call(call, rxrpc_call_put_discard_error); |
238 | return ERR_PTR(error: ret); |
239 | } |
240 | |
241 | rxrpc_set_call_state(call, state: RXRPC_CALL_CLIENT_AWAIT_CONN); |
242 | |
243 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: refcount_read(r: &call->ref), |
244 | aux: p->user_call_ID, why: rxrpc_call_new_client); |
245 | |
246 | _leave(" = %p" , call); |
247 | return call; |
248 | } |
249 | |
250 | /* |
251 | * Initiate the call ack/resend/expiry timer. |
252 | */ |
253 | void rxrpc_start_call_timer(struct rxrpc_call *call) |
254 | { |
255 | if (call->hard_timo) { |
256 | ktime_t delay = ms_to_ktime(ms: call->hard_timo * 1000); |
257 | |
258 | call->expect_term_by = ktime_add(ktime_get_real(), delay); |
259 | trace_rxrpc_timer_set(call, delay, why: rxrpc_timer_trace_hard); |
260 | } |
261 | call->timer.expires = jiffies; |
262 | } |
263 | |
264 | /* |
265 | * Wait for a call slot to become available. |
266 | */ |
267 | static struct semaphore *rxrpc_get_call_slot(struct rxrpc_call_params *p, gfp_t gfp) |
268 | { |
269 | struct semaphore *limiter = &rxrpc_call_limiter; |
270 | |
271 | if (p->kernel) |
272 | limiter = &rxrpc_kernel_call_limiter; |
273 | if (p->interruptibility == RXRPC_UNINTERRUPTIBLE) { |
274 | down(sem: limiter); |
275 | return limiter; |
276 | } |
277 | return down_interruptible(sem: limiter) < 0 ? NULL : limiter; |
278 | } |
279 | |
280 | /* |
281 | * Release a call slot. |
282 | */ |
283 | static void rxrpc_put_call_slot(struct rxrpc_call *call) |
284 | { |
285 | struct semaphore *limiter = &rxrpc_call_limiter; |
286 | |
287 | if (test_bit(RXRPC_CALL_KERNEL, &call->flags)) |
288 | limiter = &rxrpc_kernel_call_limiter; |
289 | up(sem: limiter); |
290 | } |
291 | |
292 | /* |
293 | * Start the process of connecting a call. We obtain a peer and a connection |
294 | * bundle, but the actual association of a call with a connection is offloaded |
295 | * to the I/O thread to simplify locking. |
296 | */ |
297 | static int rxrpc_connect_call(struct rxrpc_call *call, gfp_t gfp) |
298 | { |
299 | struct rxrpc_local *local = call->local; |
300 | int ret = -ENOMEM; |
301 | |
302 | _enter("{%d,%lx}," , call->debug_id, call->user_call_ID); |
303 | |
304 | ret = rxrpc_look_up_bundle(call, gfp); |
305 | if (ret < 0) |
306 | goto error; |
307 | |
308 | trace_rxrpc_client(NULL, channel: -1, op: rxrpc_client_queue_new_call); |
309 | rxrpc_get_call(call, rxrpc_call_get_io_thread); |
310 | spin_lock(lock: &local->client_call_lock); |
311 | list_add_tail(new: &call->wait_link, head: &local->new_client_calls); |
312 | spin_unlock(lock: &local->client_call_lock); |
313 | rxrpc_wake_up_io_thread(local); |
314 | return 0; |
315 | |
316 | error: |
317 | __set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); |
318 | return ret; |
319 | } |
320 | |
321 | /* |
322 | * Set up a call for the given parameters. |
323 | * - Called with the socket lock held, which it must release. |
324 | * - If it returns a call, the call's lock will need releasing by the caller. |
325 | */ |
326 | struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx, |
327 | struct rxrpc_conn_parameters *cp, |
328 | struct rxrpc_call_params *p, |
329 | gfp_t gfp, |
330 | unsigned int debug_id) |
331 | __releases(&rx->sk.sk_lock.slock) |
332 | __acquires(&call->user_mutex) |
333 | { |
334 | struct rxrpc_call *call, *xcall; |
335 | struct rxrpc_net *rxnet; |
336 | struct semaphore *limiter; |
337 | struct rb_node *parent, **pp; |
338 | int ret; |
339 | |
340 | _enter("%p,%lx" , rx, p->user_call_ID); |
341 | |
342 | if (WARN_ON_ONCE(!cp->peer)) { |
343 | release_sock(sk: &rx->sk); |
344 | return ERR_PTR(error: -EIO); |
345 | } |
346 | |
347 | limiter = rxrpc_get_call_slot(p, gfp); |
348 | if (!limiter) { |
349 | release_sock(sk: &rx->sk); |
350 | return ERR_PTR(error: -ERESTARTSYS); |
351 | } |
352 | |
353 | call = rxrpc_alloc_client_call(rx, cp, p, gfp, debug_id); |
354 | if (IS_ERR(ptr: call)) { |
355 | release_sock(sk: &rx->sk); |
356 | up(sem: limiter); |
357 | _leave(" = %ld" , PTR_ERR(call)); |
358 | return call; |
359 | } |
360 | |
361 | /* We need to protect a partially set up call against the user as we |
362 | * will be acting outside the socket lock. |
363 | */ |
364 | mutex_lock(&call->user_mutex); |
365 | |
366 | /* Publish the call, even though it is incompletely set up as yet */ |
367 | write_lock(&rx->call_lock); |
368 | |
369 | pp = &rx->calls.rb_node; |
370 | parent = NULL; |
371 | while (*pp) { |
372 | parent = *pp; |
373 | xcall = rb_entry(parent, struct rxrpc_call, sock_node); |
374 | |
375 | if (p->user_call_ID < xcall->user_call_ID) |
376 | pp = &(*pp)->rb_left; |
377 | else if (p->user_call_ID > xcall->user_call_ID) |
378 | pp = &(*pp)->rb_right; |
379 | else |
380 | goto error_dup_user_ID; |
381 | } |
382 | |
383 | rcu_assign_pointer(call->socket, rx); |
384 | call->user_call_ID = p->user_call_ID; |
385 | __set_bit(RXRPC_CALL_HAS_USERID, &call->flags); |
386 | rxrpc_get_call(call, rxrpc_call_get_userid); |
387 | rb_link_node(node: &call->sock_node, parent, rb_link: pp); |
388 | rb_insert_color(&call->sock_node, &rx->calls); |
389 | list_add(new: &call->sock_link, head: &rx->sock_calls); |
390 | |
391 | write_unlock(&rx->call_lock); |
392 | |
393 | rxnet = call->rxnet; |
394 | spin_lock(lock: &rxnet->call_lock); |
395 | list_add_tail_rcu(new: &call->link, head: &rxnet->calls); |
396 | spin_unlock(lock: &rxnet->call_lock); |
397 | |
398 | /* From this point on, the call is protected by its own lock. */ |
399 | release_sock(sk: &rx->sk); |
400 | |
401 | /* Set up or get a connection record and set the protocol parameters, |
402 | * including channel number and call ID. |
403 | */ |
404 | ret = rxrpc_connect_call(call, gfp); |
405 | if (ret < 0) |
406 | goto error_attached_to_socket; |
407 | |
408 | _leave(" = %p [new]" , call); |
409 | return call; |
410 | |
411 | /* We unexpectedly found the user ID in the list after taking |
412 | * the call_lock. This shouldn't happen unless the user races |
413 | * with itself and tries to add the same user ID twice at the |
414 | * same time in different threads. |
415 | */ |
416 | error_dup_user_ID: |
417 | write_unlock(&rx->call_lock); |
418 | release_sock(sk: &rx->sk); |
419 | rxrpc_prefail_call(call, compl: RXRPC_CALL_LOCAL_ERROR, error: -EEXIST); |
420 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: refcount_read(r: &call->ref), aux: 0, |
421 | why: rxrpc_call_see_userid_exists); |
422 | mutex_unlock(lock: &call->user_mutex); |
423 | rxrpc_put_call(call, rxrpc_call_put_userid_exists); |
424 | _leave(" = -EEXIST" ); |
425 | return ERR_PTR(error: -EEXIST); |
426 | |
427 | /* We got an error, but the call is attached to the socket and is in |
428 | * need of release. However, we might now race with recvmsg() when it |
429 | * completion notifies the socket. Return 0 from sys_sendmsg() and |
430 | * leave the error to recvmsg() to deal with. |
431 | */ |
432 | error_attached_to_socket: |
433 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: refcount_read(r: &call->ref), aux: ret, |
434 | why: rxrpc_call_see_connect_failed); |
435 | rxrpc_set_call_completion(call, compl: RXRPC_CALL_LOCAL_ERROR, abort_code: 0, error: ret); |
436 | _leave(" = c=%08x [err]" , call->debug_id); |
437 | return call; |
438 | } |
439 | |
440 | /* |
441 | * Set up an incoming call. call->conn points to the connection. |
442 | * This is called in BH context and isn't allowed to fail. |
443 | */ |
444 | void rxrpc_incoming_call(struct rxrpc_sock *rx, |
445 | struct rxrpc_call *call, |
446 | struct sk_buff *skb) |
447 | { |
448 | struct rxrpc_connection *conn = call->conn; |
449 | struct rxrpc_skb_priv *sp = rxrpc_skb(skb); |
450 | u32 chan; |
451 | |
452 | _enter(",%d" , call->conn->debug_id); |
453 | |
454 | rcu_assign_pointer(call->socket, rx); |
455 | call->call_id = sp->hdr.callNumber; |
456 | call->dest_srx.srx_service = sp->hdr.serviceId; |
457 | call->cid = sp->hdr.cid; |
458 | call->cong_tstamp = skb->tstamp; |
459 | |
460 | __set_bit(RXRPC_CALL_EXPOSED, &call->flags); |
461 | rxrpc_set_call_state(call, state: RXRPC_CALL_SERVER_SECURING); |
462 | |
463 | spin_lock(lock: &conn->state_lock); |
464 | |
465 | switch (conn->state) { |
466 | case RXRPC_CONN_SERVICE_UNSECURED: |
467 | case RXRPC_CONN_SERVICE_CHALLENGING: |
468 | rxrpc_set_call_state(call, state: RXRPC_CALL_SERVER_SECURING); |
469 | break; |
470 | case RXRPC_CONN_SERVICE: |
471 | rxrpc_set_call_state(call, state: RXRPC_CALL_SERVER_RECV_REQUEST); |
472 | break; |
473 | |
474 | case RXRPC_CONN_ABORTED: |
475 | rxrpc_set_call_completion(call, compl: conn->completion, |
476 | abort_code: conn->abort_code, error: conn->error); |
477 | break; |
478 | default: |
479 | BUG(); |
480 | } |
481 | |
482 | rxrpc_get_call(call, rxrpc_call_get_io_thread); |
483 | |
484 | /* Set the channel for this call. We don't get channel_lock as we're |
485 | * only defending against the data_ready handler (which we're called |
486 | * from) and the RESPONSE packet parser (which is only really |
487 | * interested in call_counter and can cope with a disagreement with the |
488 | * call pointer). |
489 | */ |
490 | chan = sp->hdr.cid & RXRPC_CHANNELMASK; |
491 | conn->channels[chan].call_counter = call->call_id; |
492 | conn->channels[chan].call_id = call->call_id; |
493 | conn->channels[chan].call = call; |
494 | spin_unlock(lock: &conn->state_lock); |
495 | |
496 | spin_lock(lock: &conn->peer->lock); |
497 | hlist_add_head(n: &call->error_link, h: &conn->peer->error_targets); |
498 | spin_unlock(lock: &conn->peer->lock); |
499 | |
500 | rxrpc_start_call_timer(call); |
501 | _leave("" ); |
502 | } |
503 | |
504 | /* |
505 | * Note the re-emergence of a call. |
506 | */ |
507 | void rxrpc_see_call(struct rxrpc_call *call, enum rxrpc_call_trace why) |
508 | { |
509 | if (call) { |
510 | int r = refcount_read(r: &call->ref); |
511 | |
512 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: r, aux: 0, why); |
513 | } |
514 | } |
515 | |
516 | struct rxrpc_call *rxrpc_try_get_call(struct rxrpc_call *call, |
517 | enum rxrpc_call_trace why) |
518 | { |
519 | int r; |
520 | |
521 | if (!call || !__refcount_inc_not_zero(r: &call->ref, oldp: &r)) |
522 | return NULL; |
523 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: r + 1, aux: 0, why); |
524 | return call; |
525 | } |
526 | |
527 | /* |
528 | * Note the addition of a ref on a call. |
529 | */ |
530 | void rxrpc_get_call(struct rxrpc_call *call, enum rxrpc_call_trace why) |
531 | { |
532 | int r; |
533 | |
534 | __refcount_inc(r: &call->ref, oldp: &r); |
535 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: r + 1, aux: 0, why); |
536 | } |
537 | |
538 | /* |
539 | * Clean up the Rx skb ring. |
540 | */ |
541 | static void rxrpc_cleanup_ring(struct rxrpc_call *call) |
542 | { |
543 | rxrpc_purge_queue(&call->recvmsg_queue); |
544 | rxrpc_purge_queue(&call->rx_oos_queue); |
545 | } |
546 | |
547 | /* |
548 | * Detach a call from its owning socket. |
549 | */ |
550 | void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call) |
551 | { |
552 | struct rxrpc_connection *conn = call->conn; |
553 | bool put = false, putu = false; |
554 | |
555 | _enter("{%d,%d}" , call->debug_id, refcount_read(&call->ref)); |
556 | |
557 | trace_rxrpc_call(call_debug_id: call->debug_id, ref: refcount_read(r: &call->ref), |
558 | aux: call->flags, why: rxrpc_call_see_release); |
559 | |
560 | if (test_and_set_bit(nr: RXRPC_CALL_RELEASED, addr: &call->flags)) |
561 | BUG(); |
562 | |
563 | rxrpc_put_call_slot(call); |
564 | |
565 | /* Make sure we don't get any more notifications */ |
566 | spin_lock(lock: &rx->recvmsg_lock); |
567 | |
568 | if (!list_empty(head: &call->recvmsg_link)) { |
569 | _debug("unlinking once-pending call %p { e=%lx f=%lx }" , |
570 | call, call->events, call->flags); |
571 | list_del(entry: &call->recvmsg_link); |
572 | put = true; |
573 | } |
574 | |
575 | /* list_empty() must return false in rxrpc_notify_socket() */ |
576 | call->recvmsg_link.next = NULL; |
577 | call->recvmsg_link.prev = NULL; |
578 | |
579 | spin_unlock(lock: &rx->recvmsg_lock); |
580 | if (put) |
581 | rxrpc_put_call(call, rxrpc_call_put_unnotify); |
582 | |
583 | write_lock(&rx->call_lock); |
584 | |
585 | if (test_and_clear_bit(nr: RXRPC_CALL_HAS_USERID, addr: &call->flags)) { |
586 | rb_erase(&call->sock_node, &rx->calls); |
587 | memset(&call->sock_node, 0xdd, sizeof(call->sock_node)); |
588 | putu = true; |
589 | } |
590 | |
591 | list_del(entry: &call->sock_link); |
592 | write_unlock(&rx->call_lock); |
593 | |
594 | _debug("RELEASE CALL %p (%d CONN %p)" , call, call->debug_id, conn); |
595 | |
596 | if (putu) |
597 | rxrpc_put_call(call, rxrpc_call_put_userid); |
598 | |
599 | _leave("" ); |
600 | } |
601 | |
602 | /* |
603 | * release all the calls associated with a socket |
604 | */ |
605 | void rxrpc_release_calls_on_socket(struct rxrpc_sock *rx) |
606 | { |
607 | struct rxrpc_call *call; |
608 | |
609 | _enter("%p" , rx); |
610 | |
611 | while (!list_empty(head: &rx->to_be_accepted)) { |
612 | call = list_entry(rx->to_be_accepted.next, |
613 | struct rxrpc_call, accept_link); |
614 | list_del(entry: &call->accept_link); |
615 | rxrpc_propose_abort(call, RX_CALL_DEAD, error: -ECONNRESET, |
616 | why: rxrpc_abort_call_sock_release_tba); |
617 | rxrpc_put_call(call, rxrpc_call_put_release_sock_tba); |
618 | } |
619 | |
620 | while (!list_empty(head: &rx->sock_calls)) { |
621 | call = list_entry(rx->sock_calls.next, |
622 | struct rxrpc_call, sock_link); |
623 | rxrpc_get_call(call, why: rxrpc_call_get_release_sock); |
624 | rxrpc_propose_abort(call, RX_CALL_DEAD, error: -ECONNRESET, |
625 | why: rxrpc_abort_call_sock_release); |
626 | rxrpc_release_call(rx, call); |
627 | rxrpc_put_call(call, rxrpc_call_put_release_sock); |
628 | } |
629 | |
630 | _leave("" ); |
631 | } |
632 | |
633 | /* |
634 | * release a call |
635 | */ |
636 | void rxrpc_put_call(struct rxrpc_call *call, enum rxrpc_call_trace why) |
637 | { |
638 | struct rxrpc_net *rxnet = call->rxnet; |
639 | unsigned int debug_id = call->debug_id; |
640 | bool dead; |
641 | int r; |
642 | |
643 | ASSERT(call != NULL); |
644 | |
645 | dead = __refcount_dec_and_test(r: &call->ref, oldp: &r); |
646 | trace_rxrpc_call(call_debug_id: debug_id, ref: r - 1, aux: 0, why); |
647 | if (dead) { |
648 | ASSERTCMP(__rxrpc_call_state(call), ==, RXRPC_CALL_COMPLETE); |
649 | |
650 | if (!list_empty(head: &call->link)) { |
651 | spin_lock(lock: &rxnet->call_lock); |
652 | list_del_init(entry: &call->link); |
653 | spin_unlock(lock: &rxnet->call_lock); |
654 | } |
655 | |
656 | rxrpc_cleanup_call(call); |
657 | } |
658 | } |
659 | |
660 | /* |
661 | * Free up the call under RCU. |
662 | */ |
663 | static void rxrpc_rcu_free_call(struct rcu_head *rcu) |
664 | { |
665 | struct rxrpc_call *call = container_of(rcu, struct rxrpc_call, rcu); |
666 | struct rxrpc_net *rxnet = READ_ONCE(call->rxnet); |
667 | |
668 | kmem_cache_free(s: rxrpc_call_jar, objp: call); |
669 | if (atomic_dec_and_test(v: &rxnet->nr_calls)) |
670 | wake_up_var(var: &rxnet->nr_calls); |
671 | } |
672 | |
673 | /* |
674 | * Final call destruction - but must be done in process context. |
675 | */ |
676 | static void rxrpc_destroy_call(struct work_struct *work) |
677 | { |
678 | struct rxrpc_call *call = container_of(work, struct rxrpc_call, destroyer); |
679 | struct rxrpc_txbuf *txb; |
680 | |
681 | del_timer_sync(timer: &call->timer); |
682 | |
683 | rxrpc_free_skb(call->cong_last_nack, rxrpc_skb_put_last_nack); |
684 | rxrpc_cleanup_ring(call); |
685 | while ((txb = list_first_entry_or_null(&call->tx_sendmsg, |
686 | struct rxrpc_txbuf, call_link))) { |
687 | list_del(entry: &txb->call_link); |
688 | rxrpc_put_txbuf(txb, what: rxrpc_txbuf_put_cleaned); |
689 | } |
690 | while ((txb = list_first_entry_or_null(&call->tx_buffer, |
691 | struct rxrpc_txbuf, call_link))) { |
692 | list_del(entry: &txb->call_link); |
693 | rxrpc_put_txbuf(txb, what: rxrpc_txbuf_put_cleaned); |
694 | } |
695 | |
696 | rxrpc_put_txbuf(txb: call->tx_pending, what: rxrpc_txbuf_put_cleaned); |
697 | rxrpc_put_connection(call->conn, rxrpc_conn_put_call); |
698 | rxrpc_deactivate_bundle(bundle: call->bundle); |
699 | rxrpc_put_bundle(call->bundle, rxrpc_bundle_put_call); |
700 | rxrpc_put_peer(call->peer, rxrpc_peer_put_call); |
701 | rxrpc_put_local(call->local, rxrpc_local_put_call); |
702 | call_rcu(head: &call->rcu, func: rxrpc_rcu_free_call); |
703 | } |
704 | |
705 | /* |
706 | * clean up a call |
707 | */ |
708 | void rxrpc_cleanup_call(struct rxrpc_call *call) |
709 | { |
710 | memset(&call->sock_node, 0xcd, sizeof(call->sock_node)); |
711 | |
712 | ASSERTCMP(__rxrpc_call_state(call), ==, RXRPC_CALL_COMPLETE); |
713 | ASSERT(test_bit(RXRPC_CALL_RELEASED, &call->flags)); |
714 | |
715 | del_timer(timer: &call->timer); |
716 | |
717 | if (rcu_read_lock_held()) |
718 | /* Can't use the rxrpc workqueue as we need to cancel/flush |
719 | * something that may be running/waiting there. |
720 | */ |
721 | schedule_work(work: &call->destroyer); |
722 | else |
723 | rxrpc_destroy_call(work: &call->destroyer); |
724 | } |
725 | |
726 | /* |
727 | * Make sure that all calls are gone from a network namespace. To reach this |
728 | * point, any open UDP sockets in that namespace must have been closed, so any |
729 | * outstanding calls cannot be doing I/O. |
730 | */ |
731 | void rxrpc_destroy_all_calls(struct rxrpc_net *rxnet) |
732 | { |
733 | struct rxrpc_call *call; |
734 | |
735 | _enter("" ); |
736 | |
737 | if (!list_empty(head: &rxnet->calls)) { |
738 | spin_lock(lock: &rxnet->call_lock); |
739 | |
740 | while (!list_empty(head: &rxnet->calls)) { |
741 | call = list_entry(rxnet->calls.next, |
742 | struct rxrpc_call, link); |
743 | _debug("Zapping call %p" , call); |
744 | |
745 | rxrpc_see_call(call, why: rxrpc_call_see_zap); |
746 | list_del_init(entry: &call->link); |
747 | |
748 | pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n" , |
749 | call, refcount_read(&call->ref), |
750 | rxrpc_call_states[__rxrpc_call_state(call)], |
751 | call->flags, call->events); |
752 | |
753 | spin_unlock(lock: &rxnet->call_lock); |
754 | cond_resched(); |
755 | spin_lock(lock: &rxnet->call_lock); |
756 | } |
757 | |
758 | spin_unlock(lock: &rxnet->call_lock); |
759 | } |
760 | |
761 | atomic_dec(v: &rxnet->nr_calls); |
762 | wait_var_event(&rxnet->nr_calls, !atomic_read(&rxnet->nr_calls)); |
763 | } |
764 | |