1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  net/dccp/proto.c
4  *
5  *  An implementation of the DCCP protocol
6  *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
7  */
8 
9 #include <linux/dccp.h>
10 #include <linux/module.h>
11 #include <linux/types.h>
12 #include <linux/sched.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/in.h>
17 #include <linux/if_arp.h>
18 #include <linux/init.h>
19 #include <linux/random.h>
20 #include <linux/slab.h>
21 #include <net/checksum.h>
22 
23 #include <net/inet_sock.h>
24 #include <net/inet_common.h>
25 #include <net/sock.h>
26 #include <net/xfrm.h>
27 
28 #include <asm/ioctls.h>
29 #include <linux/spinlock.h>
30 #include <linux/timer.h>
31 #include <linux/delay.h>
32 #include <linux/poll.h>
33 
34 #include "ccid.h"
35 #include "dccp.h"
36 #include "feat.h"
37 
38 #define CREATE_TRACE_POINTS
39 #include "trace.h"
40 
41 DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
42 
43 EXPORT_SYMBOL_GPL(dccp_statistics);
44 
45 DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
46 EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
47 
48 struct inet_hashinfo dccp_hashinfo;
49 EXPORT_SYMBOL_GPL(dccp_hashinfo);
50 
51 /* the maximum queue length for tx in packets. 0 is no limit */
52 int sysctl_dccp_tx_qlen __read_mostly = 5;
53 
54 #ifdef CONFIG_IP_DCCP_DEBUG
dccp_state_name(const int state)55 static const char *dccp_state_name(const int state)
56 {
57 	static const char *const dccp_state_names[] = {
58 	[DCCP_OPEN]		= "OPEN",
59 	[DCCP_REQUESTING]	= "REQUESTING",
60 	[DCCP_PARTOPEN]		= "PARTOPEN",
61 	[DCCP_LISTEN]		= "LISTEN",
62 	[DCCP_RESPOND]		= "RESPOND",
63 	[DCCP_CLOSING]		= "CLOSING",
64 	[DCCP_ACTIVE_CLOSEREQ]	= "CLOSEREQ",
65 	[DCCP_PASSIVE_CLOSE]	= "PASSIVE_CLOSE",
66 	[DCCP_PASSIVE_CLOSEREQ]	= "PASSIVE_CLOSEREQ",
67 	[DCCP_TIME_WAIT]	= "TIME_WAIT",
68 	[DCCP_CLOSED]		= "CLOSED",
69 	};
70 
71 	if (state >= DCCP_MAX_STATES)
72 		return "INVALID STATE!";
73 	else
74 		return dccp_state_names[state];
75 }
76 #endif
77 
dccp_set_state(struct sock * sk,const int state)78 void dccp_set_state(struct sock *sk, const int state)
79 {
80 	const int oldstate = sk->sk_state;
81 
82 	dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
83 		      dccp_state_name(oldstate), dccp_state_name(state));
84 	WARN_ON(state == oldstate);
85 
86 	switch (state) {
87 	case DCCP_OPEN:
88 		if (oldstate != DCCP_OPEN)
89 			DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
90 		/* Client retransmits all Confirm options until entering OPEN */
91 		if (oldstate == DCCP_PARTOPEN)
92 			dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
93 		break;
94 
95 	case DCCP_CLOSED:
96 		if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
97 		    oldstate == DCCP_CLOSING)
98 			DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
99 
100 		sk->sk_prot->unhash(sk);
101 		if (inet_csk(sk)->icsk_bind_hash != NULL &&
102 		    !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
103 			inet_put_port(sk);
104 		fallthrough;
105 	default:
106 		if (oldstate == DCCP_OPEN)
107 			DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
108 	}
109 
110 	/* Change state AFTER socket is unhashed to avoid closed
111 	 * socket sitting in hash tables.
112 	 */
113 	inet_sk_set_state(sk, state);
114 }
115 
116 EXPORT_SYMBOL_GPL(dccp_set_state);
117 
dccp_finish_passive_close(struct sock * sk)118 static void dccp_finish_passive_close(struct sock *sk)
119 {
120 	switch (sk->sk_state) {
121 	case DCCP_PASSIVE_CLOSE:
122 		/* Node (client or server) has received Close packet. */
123 		dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
124 		dccp_set_state(sk, DCCP_CLOSED);
125 		break;
126 	case DCCP_PASSIVE_CLOSEREQ:
127 		/*
128 		 * Client received CloseReq. We set the `active' flag so that
129 		 * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
130 		 */
131 		dccp_send_close(sk, 1);
132 		dccp_set_state(sk, DCCP_CLOSING);
133 	}
134 }
135 
dccp_done(struct sock * sk)136 void dccp_done(struct sock *sk)
137 {
138 	dccp_set_state(sk, DCCP_CLOSED);
139 	dccp_clear_xmit_timers(sk);
140 
141 	sk->sk_shutdown = SHUTDOWN_MASK;
142 
143 	if (!sock_flag(sk, SOCK_DEAD))
144 		sk->sk_state_change(sk);
145 	else
146 		inet_csk_destroy_sock(sk);
147 }
148 
149 EXPORT_SYMBOL_GPL(dccp_done);
150 
dccp_packet_name(const int type)151 const char *dccp_packet_name(const int type)
152 {
153 	static const char *const dccp_packet_names[] = {
154 		[DCCP_PKT_REQUEST]  = "REQUEST",
155 		[DCCP_PKT_RESPONSE] = "RESPONSE",
156 		[DCCP_PKT_DATA]	    = "DATA",
157 		[DCCP_PKT_ACK]	    = "ACK",
158 		[DCCP_PKT_DATAACK]  = "DATAACK",
159 		[DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
160 		[DCCP_PKT_CLOSE]    = "CLOSE",
161 		[DCCP_PKT_RESET]    = "RESET",
162 		[DCCP_PKT_SYNC]	    = "SYNC",
163 		[DCCP_PKT_SYNCACK]  = "SYNCACK",
164 	};
165 
166 	if (type >= DCCP_NR_PKT_TYPES)
167 		return "INVALID";
168 	else
169 		return dccp_packet_names[type];
170 }
171 
172 EXPORT_SYMBOL_GPL(dccp_packet_name);
173 
dccp_destruct_common(struct sock * sk)174 void dccp_destruct_common(struct sock *sk)
175 {
176 	struct dccp_sock *dp = dccp_sk(sk);
177 
178 	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
179 	dp->dccps_hc_tx_ccid = NULL;
180 }
181 EXPORT_SYMBOL_GPL(dccp_destruct_common);
182 
dccp_sk_destruct(struct sock * sk)183 static void dccp_sk_destruct(struct sock *sk)
184 {
185 	dccp_destruct_common(sk);
186 	inet_sock_destruct(sk);
187 }
188 
dccp_init_sock(struct sock * sk,const __u8 ctl_sock_initialized)189 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
190 {
191 	struct dccp_sock *dp = dccp_sk(sk);
192 	struct inet_connection_sock *icsk = inet_csk(sk);
193 
194 	pr_warn_once("DCCP is deprecated and scheduled to be removed in 2025, "
195 		     "please contact the netdev mailing list\n");
196 
197 	icsk->icsk_rto		= DCCP_TIMEOUT_INIT;
198 	icsk->icsk_syn_retries	= sysctl_dccp_request_retries;
199 	sk->sk_state		= DCCP_CLOSED;
200 	sk->sk_write_space	= dccp_write_space;
201 	sk->sk_destruct		= dccp_sk_destruct;
202 	icsk->icsk_sync_mss	= dccp_sync_mss;
203 	dp->dccps_mss_cache	= 536;
204 	dp->dccps_rate_last	= jiffies;
205 	dp->dccps_role		= DCCP_ROLE_UNDEFINED;
206 	dp->dccps_service	= DCCP_SERVICE_CODE_IS_ABSENT;
207 	dp->dccps_tx_qlen	= sysctl_dccp_tx_qlen;
208 
209 	dccp_init_xmit_timers(sk);
210 
211 	INIT_LIST_HEAD(&dp->dccps_featneg);
212 	/* control socket doesn't need feat nego */
213 	if (likely(ctl_sock_initialized))
214 		return dccp_feat_init(sk);
215 	return 0;
216 }
217 
218 EXPORT_SYMBOL_GPL(dccp_init_sock);
219 
dccp_destroy_sock(struct sock * sk)220 void dccp_destroy_sock(struct sock *sk)
221 {
222 	struct dccp_sock *dp = dccp_sk(sk);
223 
224 	__skb_queue_purge(&sk->sk_write_queue);
225 	if (sk->sk_send_head != NULL) {
226 		kfree_skb(sk->sk_send_head);
227 		sk->sk_send_head = NULL;
228 	}
229 
230 	/* Clean up a referenced DCCP bind bucket. */
231 	if (inet_csk(sk)->icsk_bind_hash != NULL)
232 		inet_put_port(sk);
233 
234 	kfree(dp->dccps_service_list);
235 	dp->dccps_service_list = NULL;
236 
237 	if (dp->dccps_hc_rx_ackvec != NULL) {
238 		dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
239 		dp->dccps_hc_rx_ackvec = NULL;
240 	}
241 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
242 	dp->dccps_hc_rx_ccid = NULL;
243 
244 	/* clean up feature negotiation state */
245 	dccp_feat_list_purge(&dp->dccps_featneg);
246 }
247 
248 EXPORT_SYMBOL_GPL(dccp_destroy_sock);
249 
dccp_need_reset(int state)250 static inline int dccp_need_reset(int state)
251 {
252 	return state != DCCP_CLOSED && state != DCCP_LISTEN &&
253 	       state != DCCP_REQUESTING;
254 }
255 
dccp_disconnect(struct sock * sk,int flags)256 int dccp_disconnect(struct sock *sk, int flags)
257 {
258 	struct inet_connection_sock *icsk = inet_csk(sk);
259 	struct inet_sock *inet = inet_sk(sk);
260 	struct dccp_sock *dp = dccp_sk(sk);
261 	const int old_state = sk->sk_state;
262 
263 	if (old_state != DCCP_CLOSED)
264 		dccp_set_state(sk, DCCP_CLOSED);
265 
266 	/*
267 	 * This corresponds to the ABORT function of RFC793, sec. 3.8
268 	 * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
269 	 */
270 	if (old_state == DCCP_LISTEN) {
271 		inet_csk_listen_stop(sk);
272 	} else if (dccp_need_reset(old_state)) {
273 		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
274 		sk->sk_err = ECONNRESET;
275 	} else if (old_state == DCCP_REQUESTING)
276 		sk->sk_err = ECONNRESET;
277 
278 	dccp_clear_xmit_timers(sk);
279 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
280 	dp->dccps_hc_rx_ccid = NULL;
281 
282 	__skb_queue_purge(&sk->sk_receive_queue);
283 	__skb_queue_purge(&sk->sk_write_queue);
284 	if (sk->sk_send_head != NULL) {
285 		__kfree_skb(sk->sk_send_head);
286 		sk->sk_send_head = NULL;
287 	}
288 
289 	inet->inet_dport = 0;
290 
291 	inet_bhash2_reset_saddr(sk);
292 
293 	sk->sk_shutdown = 0;
294 	sock_reset_flag(sk, SOCK_DONE);
295 
296 	icsk->icsk_backoff = 0;
297 	inet_csk_delack_init(sk);
298 	__sk_dst_reset(sk);
299 
300 	WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
301 
302 	sk_error_report(sk);
303 	return 0;
304 }
305 
306 EXPORT_SYMBOL_GPL(dccp_disconnect);
307 
308 /*
309  *	Wait for a DCCP event.
310  *
311  *	Note that we don't need to lock the socket, as the upper poll layers
312  *	take care of normal races (between the test and the event) and we don't
313  *	go look at any of the socket buffers directly.
314  */
dccp_poll(struct file * file,struct socket * sock,poll_table * wait)315 __poll_t dccp_poll(struct file *file, struct socket *sock,
316 		       poll_table *wait)
317 {
318 	struct sock *sk = sock->sk;
319 	__poll_t mask;
320 	u8 shutdown;
321 	int state;
322 
323 	sock_poll_wait(file, sock, wait);
324 
325 	state = inet_sk_state_load(sk);
326 	if (state == DCCP_LISTEN)
327 		return inet_csk_listen_poll(sk);
328 
329 	/* Socket is not locked. We are protected from async events
330 	   by poll logic and correct handling of state changes
331 	   made by another threads is impossible in any case.
332 	 */
333 
334 	mask = 0;
335 	if (READ_ONCE(sk->sk_err))
336 		mask = EPOLLERR;
337 	shutdown = READ_ONCE(sk->sk_shutdown);
338 
339 	if (shutdown == SHUTDOWN_MASK || state == DCCP_CLOSED)
340 		mask |= EPOLLHUP;
341 	if (shutdown & RCV_SHUTDOWN)
342 		mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
343 
344 	/* Connected? */
345 	if ((1 << state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
346 		if (atomic_read(&sk->sk_rmem_alloc) > 0)
347 			mask |= EPOLLIN | EPOLLRDNORM;
348 
349 		if (!(shutdown & SEND_SHUTDOWN)) {
350 			if (sk_stream_is_writeable(sk)) {
351 				mask |= EPOLLOUT | EPOLLWRNORM;
352 			} else {  /* send SIGIO later */
353 				sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
354 				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
355 
356 				/* Race breaker. If space is freed after
357 				 * wspace test but before the flags are set,
358 				 * IO signal will be lost.
359 				 */
360 				if (sk_stream_is_writeable(sk))
361 					mask |= EPOLLOUT | EPOLLWRNORM;
362 			}
363 		}
364 	}
365 	return mask;
366 }
367 EXPORT_SYMBOL_GPL(dccp_poll);
368 
dccp_ioctl(struct sock * sk,int cmd,int * karg)369 int dccp_ioctl(struct sock *sk, int cmd, int *karg)
370 {
371 	int rc = -ENOTCONN;
372 
373 	lock_sock(sk);
374 
375 	if (sk->sk_state == DCCP_LISTEN)
376 		goto out;
377 
378 	switch (cmd) {
379 	case SIOCOUTQ: {
380 		*karg = sk_wmem_alloc_get(sk);
381 		/* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and
382 		 * always 0, comparably to UDP.
383 		 */
384 
385 		rc = 0;
386 	}
387 		break;
388 	case SIOCINQ: {
389 		struct sk_buff *skb;
390 		*karg = 0;
391 
392 		skb = skb_peek(&sk->sk_receive_queue);
393 		if (skb != NULL) {
394 			/*
395 			 * We will only return the amount of this packet since
396 			 * that is all that will be read.
397 			 */
398 			*karg = skb->len;
399 		}
400 		rc = 0;
401 	}
402 		break;
403 	default:
404 		rc = -ENOIOCTLCMD;
405 		break;
406 	}
407 out:
408 	release_sock(sk);
409 	return rc;
410 }
411 
412 EXPORT_SYMBOL_GPL(dccp_ioctl);
413 
dccp_setsockopt_service(struct sock * sk,const __be32 service,sockptr_t optval,unsigned int optlen)414 static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
415 				   sockptr_t optval, unsigned int optlen)
416 {
417 	struct dccp_sock *dp = dccp_sk(sk);
418 	struct dccp_service_list *sl = NULL;
419 
420 	if (service == DCCP_SERVICE_INVALID_VALUE ||
421 	    optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
422 		return -EINVAL;
423 
424 	if (optlen > sizeof(service)) {
425 		sl = kmalloc(optlen, GFP_KERNEL);
426 		if (sl == NULL)
427 			return -ENOMEM;
428 
429 		sl->dccpsl_nr = optlen / sizeof(u32) - 1;
430 		if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
431 				sizeof(service), optlen - sizeof(service)) ||
432 		    dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
433 			kfree(sl);
434 			return -EFAULT;
435 		}
436 	}
437 
438 	lock_sock(sk);
439 	dp->dccps_service = service;
440 
441 	kfree(dp->dccps_service_list);
442 
443 	dp->dccps_service_list = sl;
444 	release_sock(sk);
445 	return 0;
446 }
447 
dccp_setsockopt_cscov(struct sock * sk,int cscov,bool rx)448 static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
449 {
450 	u8 *list, len;
451 	int i, rc;
452 
453 	if (cscov < 0 || cscov > 15)
454 		return -EINVAL;
455 	/*
456 	 * Populate a list of permissible values, in the range cscov...15. This
457 	 * is necessary since feature negotiation of single values only works if
458 	 * both sides incidentally choose the same value. Since the list starts
459 	 * lowest-value first, negotiation will pick the smallest shared value.
460 	 */
461 	if (cscov == 0)
462 		return 0;
463 	len = 16 - cscov;
464 
465 	list = kmalloc(len, GFP_KERNEL);
466 	if (list == NULL)
467 		return -ENOBUFS;
468 
469 	for (i = 0; i < len; i++)
470 		list[i] = cscov++;
471 
472 	rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
473 
474 	if (rc == 0) {
475 		if (rx)
476 			dccp_sk(sk)->dccps_pcrlen = cscov;
477 		else
478 			dccp_sk(sk)->dccps_pcslen = cscov;
479 	}
480 	kfree(list);
481 	return rc;
482 }
483 
dccp_setsockopt_ccid(struct sock * sk,int type,sockptr_t optval,unsigned int optlen)484 static int dccp_setsockopt_ccid(struct sock *sk, int type,
485 				sockptr_t optval, unsigned int optlen)
486 {
487 	u8 *val;
488 	int rc = 0;
489 
490 	if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
491 		return -EINVAL;
492 
493 	val = memdup_sockptr(optval, optlen);
494 	if (IS_ERR(val))
495 		return PTR_ERR(val);
496 
497 	lock_sock(sk);
498 	if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
499 		rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
500 
501 	if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
502 		rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
503 	release_sock(sk);
504 
505 	kfree(val);
506 	return rc;
507 }
508 
do_dccp_setsockopt(struct sock * sk,int level,int optname,sockptr_t optval,unsigned int optlen)509 static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
510 		sockptr_t optval, unsigned int optlen)
511 {
512 	struct dccp_sock *dp = dccp_sk(sk);
513 	int val, err = 0;
514 
515 	switch (optname) {
516 	case DCCP_SOCKOPT_PACKET_SIZE:
517 		DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
518 		return 0;
519 	case DCCP_SOCKOPT_CHANGE_L:
520 	case DCCP_SOCKOPT_CHANGE_R:
521 		DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
522 		return 0;
523 	case DCCP_SOCKOPT_CCID:
524 	case DCCP_SOCKOPT_RX_CCID:
525 	case DCCP_SOCKOPT_TX_CCID:
526 		return dccp_setsockopt_ccid(sk, optname, optval, optlen);
527 	}
528 
529 	if (optlen < (int)sizeof(int))
530 		return -EINVAL;
531 
532 	if (copy_from_sockptr(&val, optval, sizeof(int)))
533 		return -EFAULT;
534 
535 	if (optname == DCCP_SOCKOPT_SERVICE)
536 		return dccp_setsockopt_service(sk, val, optval, optlen);
537 
538 	lock_sock(sk);
539 	switch (optname) {
540 	case DCCP_SOCKOPT_SERVER_TIMEWAIT:
541 		if (dp->dccps_role != DCCP_ROLE_SERVER)
542 			err = -EOPNOTSUPP;
543 		else
544 			dp->dccps_server_timewait = (val != 0);
545 		break;
546 	case DCCP_SOCKOPT_SEND_CSCOV:
547 		err = dccp_setsockopt_cscov(sk, val, false);
548 		break;
549 	case DCCP_SOCKOPT_RECV_CSCOV:
550 		err = dccp_setsockopt_cscov(sk, val, true);
551 		break;
552 	case DCCP_SOCKOPT_QPOLICY_ID:
553 		if (sk->sk_state != DCCP_CLOSED)
554 			err = -EISCONN;
555 		else if (val < 0 || val >= DCCPQ_POLICY_MAX)
556 			err = -EINVAL;
557 		else
558 			dp->dccps_qpolicy = val;
559 		break;
560 	case DCCP_SOCKOPT_QPOLICY_TXQLEN:
561 		if (val < 0)
562 			err = -EINVAL;
563 		else
564 			dp->dccps_tx_qlen = val;
565 		break;
566 	default:
567 		err = -ENOPROTOOPT;
568 		break;
569 	}
570 	release_sock(sk);
571 
572 	return err;
573 }
574 
dccp_setsockopt(struct sock * sk,int level,int optname,sockptr_t optval,unsigned int optlen)575 int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
576 		    unsigned int optlen)
577 {
578 	if (level != SOL_DCCP)
579 		return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
580 							     optname, optval,
581 							     optlen);
582 	return do_dccp_setsockopt(sk, level, optname, optval, optlen);
583 }
584 
585 EXPORT_SYMBOL_GPL(dccp_setsockopt);
586 
dccp_getsockopt_service(struct sock * sk,int len,__be32 __user * optval,int __user * optlen)587 static int dccp_getsockopt_service(struct sock *sk, int len,
588 				   __be32 __user *optval,
589 				   int __user *optlen)
590 {
591 	const struct dccp_sock *dp = dccp_sk(sk);
592 	const struct dccp_service_list *sl;
593 	int err = -ENOENT, slen = 0, total_len = sizeof(u32);
594 
595 	lock_sock(sk);
596 	if ((sl = dp->dccps_service_list) != NULL) {
597 		slen = sl->dccpsl_nr * sizeof(u32);
598 		total_len += slen;
599 	}
600 
601 	err = -EINVAL;
602 	if (total_len > len)
603 		goto out;
604 
605 	err = 0;
606 	if (put_user(total_len, optlen) ||
607 	    put_user(dp->dccps_service, optval) ||
608 	    (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
609 		err = -EFAULT;
610 out:
611 	release_sock(sk);
612 	return err;
613 }
614 
do_dccp_getsockopt(struct sock * sk,int level,int optname,char __user * optval,int __user * optlen)615 static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
616 		    char __user *optval, int __user *optlen)
617 {
618 	struct dccp_sock *dp;
619 	int val, len;
620 
621 	if (get_user(len, optlen))
622 		return -EFAULT;
623 
624 	if (len < (int)sizeof(int))
625 		return -EINVAL;
626 
627 	dp = dccp_sk(sk);
628 
629 	switch (optname) {
630 	case DCCP_SOCKOPT_PACKET_SIZE:
631 		DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
632 		return 0;
633 	case DCCP_SOCKOPT_SERVICE:
634 		return dccp_getsockopt_service(sk, len,
635 					       (__be32 __user *)optval, optlen);
636 	case DCCP_SOCKOPT_GET_CUR_MPS:
637 		val = READ_ONCE(dp->dccps_mss_cache);
638 		break;
639 	case DCCP_SOCKOPT_AVAILABLE_CCIDS:
640 		return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
641 	case DCCP_SOCKOPT_TX_CCID:
642 		val = ccid_get_current_tx_ccid(dp);
643 		if (val < 0)
644 			return -ENOPROTOOPT;
645 		break;
646 	case DCCP_SOCKOPT_RX_CCID:
647 		val = ccid_get_current_rx_ccid(dp);
648 		if (val < 0)
649 			return -ENOPROTOOPT;
650 		break;
651 	case DCCP_SOCKOPT_SERVER_TIMEWAIT:
652 		val = dp->dccps_server_timewait;
653 		break;
654 	case DCCP_SOCKOPT_SEND_CSCOV:
655 		val = dp->dccps_pcslen;
656 		break;
657 	case DCCP_SOCKOPT_RECV_CSCOV:
658 		val = dp->dccps_pcrlen;
659 		break;
660 	case DCCP_SOCKOPT_QPOLICY_ID:
661 		val = dp->dccps_qpolicy;
662 		break;
663 	case DCCP_SOCKOPT_QPOLICY_TXQLEN:
664 		val = dp->dccps_tx_qlen;
665 		break;
666 	case 128 ... 191:
667 		return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
668 					     len, (u32 __user *)optval, optlen);
669 	case 192 ... 255:
670 		return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
671 					     len, (u32 __user *)optval, optlen);
672 	default:
673 		return -ENOPROTOOPT;
674 	}
675 
676 	len = sizeof(val);
677 	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
678 		return -EFAULT;
679 
680 	return 0;
681 }
682 
dccp_getsockopt(struct sock * sk,int level,int optname,char __user * optval,int __user * optlen)683 int dccp_getsockopt(struct sock *sk, int level, int optname,
684 		    char __user *optval, int __user *optlen)
685 {
686 	if (level != SOL_DCCP)
687 		return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
688 							     optname, optval,
689 							     optlen);
690 	return do_dccp_getsockopt(sk, level, optname, optval, optlen);
691 }
692 
693 EXPORT_SYMBOL_GPL(dccp_getsockopt);
694 
dccp_msghdr_parse(struct msghdr * msg,struct sk_buff * skb)695 static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
696 {
697 	struct cmsghdr *cmsg;
698 
699 	/*
700 	 * Assign an (opaque) qpolicy priority value to skb->priority.
701 	 *
702 	 * We are overloading this skb field for use with the qpolicy subystem.
703 	 * The skb->priority is normally used for the SO_PRIORITY option, which
704 	 * is initialised from sk_priority. Since the assignment of sk_priority
705 	 * to skb->priority happens later (on layer 3), we overload this field
706 	 * for use with queueing priorities as long as the skb is on layer 4.
707 	 * The default priority value (if nothing is set) is 0.
708 	 */
709 	skb->priority = 0;
710 
711 	for_each_cmsghdr(cmsg, msg) {
712 		if (!CMSG_OK(msg, cmsg))
713 			return -EINVAL;
714 
715 		if (cmsg->cmsg_level != SOL_DCCP)
716 			continue;
717 
718 		if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
719 		    !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
720 			return -EINVAL;
721 
722 		switch (cmsg->cmsg_type) {
723 		case DCCP_SCM_PRIORITY:
724 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
725 				return -EINVAL;
726 			skb->priority = *(__u32 *)CMSG_DATA(cmsg);
727 			break;
728 		default:
729 			return -EINVAL;
730 		}
731 	}
732 	return 0;
733 }
734 
dccp_sendmsg(struct sock * sk,struct msghdr * msg,size_t len)735 int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
736 {
737 	const struct dccp_sock *dp = dccp_sk(sk);
738 	const int flags = msg->msg_flags;
739 	const int noblock = flags & MSG_DONTWAIT;
740 	struct sk_buff *skb;
741 	int rc, size;
742 	long timeo;
743 
744 	trace_dccp_probe(sk, len);
745 
746 	if (len > READ_ONCE(dp->dccps_mss_cache))
747 		return -EMSGSIZE;
748 
749 	lock_sock(sk);
750 
751 	timeo = sock_sndtimeo(sk, noblock);
752 
753 	/*
754 	 * We have to use sk_stream_wait_connect here to set sk_write_pending,
755 	 * so that the trick in dccp_rcv_request_sent_state_process.
756 	 */
757 	/* Wait for a connection to finish. */
758 	if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
759 		if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
760 			goto out_release;
761 
762 	size = sk->sk_prot->max_header + len;
763 	release_sock(sk);
764 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
765 	lock_sock(sk);
766 	if (skb == NULL)
767 		goto out_release;
768 
769 	if (dccp_qpolicy_full(sk)) {
770 		rc = -EAGAIN;
771 		goto out_discard;
772 	}
773 
774 	if (sk->sk_state == DCCP_CLOSED) {
775 		rc = -ENOTCONN;
776 		goto out_discard;
777 	}
778 
779 	/* We need to check dccps_mss_cache after socket is locked. */
780 	if (len > dp->dccps_mss_cache) {
781 		rc = -EMSGSIZE;
782 		goto out_discard;
783 	}
784 
785 	skb_reserve(skb, sk->sk_prot->max_header);
786 	rc = memcpy_from_msg(skb_put(skb, len), msg, len);
787 	if (rc != 0)
788 		goto out_discard;
789 
790 	rc = dccp_msghdr_parse(msg, skb);
791 	if (rc != 0)
792 		goto out_discard;
793 
794 	dccp_qpolicy_push(sk, skb);
795 	/*
796 	 * The xmit_timer is set if the TX CCID is rate-based and will expire
797 	 * when congestion control permits to release further packets into the
798 	 * network. Window-based CCIDs do not use this timer.
799 	 */
800 	if (!timer_pending(&dp->dccps_xmit_timer))
801 		dccp_write_xmit(sk);
802 out_release:
803 	release_sock(sk);
804 	return rc ? : len;
805 out_discard:
806 	kfree_skb(skb);
807 	goto out_release;
808 }
809 
810 EXPORT_SYMBOL_GPL(dccp_sendmsg);
811 
dccp_recvmsg(struct sock * sk,struct msghdr * msg,size_t len,int flags,int * addr_len)812 int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
813 		 int *addr_len)
814 {
815 	const struct dccp_hdr *dh;
816 	long timeo;
817 
818 	lock_sock(sk);
819 
820 	if (sk->sk_state == DCCP_LISTEN) {
821 		len = -ENOTCONN;
822 		goto out;
823 	}
824 
825 	timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
826 
827 	do {
828 		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
829 
830 		if (skb == NULL)
831 			goto verify_sock_status;
832 
833 		dh = dccp_hdr(skb);
834 
835 		switch (dh->dccph_type) {
836 		case DCCP_PKT_DATA:
837 		case DCCP_PKT_DATAACK:
838 			goto found_ok_skb;
839 
840 		case DCCP_PKT_CLOSE:
841 		case DCCP_PKT_CLOSEREQ:
842 			if (!(flags & MSG_PEEK))
843 				dccp_finish_passive_close(sk);
844 			fallthrough;
845 		case DCCP_PKT_RESET:
846 			dccp_pr_debug("found fin (%s) ok!\n",
847 				      dccp_packet_name(dh->dccph_type));
848 			len = 0;
849 			goto found_fin_ok;
850 		default:
851 			dccp_pr_debug("packet_type=%s\n",
852 				      dccp_packet_name(dh->dccph_type));
853 			sk_eat_skb(sk, skb);
854 		}
855 verify_sock_status:
856 		if (sock_flag(sk, SOCK_DONE)) {
857 			len = 0;
858 			break;
859 		}
860 
861 		if (sk->sk_err) {
862 			len = sock_error(sk);
863 			break;
864 		}
865 
866 		if (sk->sk_shutdown & RCV_SHUTDOWN) {
867 			len = 0;
868 			break;
869 		}
870 
871 		if (sk->sk_state == DCCP_CLOSED) {
872 			if (!sock_flag(sk, SOCK_DONE)) {
873 				/* This occurs when user tries to read
874 				 * from never connected socket.
875 				 */
876 				len = -ENOTCONN;
877 				break;
878 			}
879 			len = 0;
880 			break;
881 		}
882 
883 		if (!timeo) {
884 			len = -EAGAIN;
885 			break;
886 		}
887 
888 		if (signal_pending(current)) {
889 			len = sock_intr_errno(timeo);
890 			break;
891 		}
892 
893 		sk_wait_data(sk, &timeo, NULL);
894 		continue;
895 	found_ok_skb:
896 		if (len > skb->len)
897 			len = skb->len;
898 		else if (len < skb->len)
899 			msg->msg_flags |= MSG_TRUNC;
900 
901 		if (skb_copy_datagram_msg(skb, 0, msg, len)) {
902 			/* Exception. Bailout! */
903 			len = -EFAULT;
904 			break;
905 		}
906 		if (flags & MSG_TRUNC)
907 			len = skb->len;
908 	found_fin_ok:
909 		if (!(flags & MSG_PEEK))
910 			sk_eat_skb(sk, skb);
911 		break;
912 	} while (1);
913 out:
914 	release_sock(sk);
915 	return len;
916 }
917 
918 EXPORT_SYMBOL_GPL(dccp_recvmsg);
919 
inet_dccp_listen(struct socket * sock,int backlog)920 int inet_dccp_listen(struct socket *sock, int backlog)
921 {
922 	struct sock *sk = sock->sk;
923 	unsigned char old_state;
924 	int err;
925 
926 	lock_sock(sk);
927 
928 	err = -EINVAL;
929 	if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
930 		goto out;
931 
932 	old_state = sk->sk_state;
933 	if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
934 		goto out;
935 
936 	WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
937 	/* Really, if the socket is already in listen state
938 	 * we can only allow the backlog to be adjusted.
939 	 */
940 	if (old_state != DCCP_LISTEN) {
941 		struct dccp_sock *dp = dccp_sk(sk);
942 
943 		dp->dccps_role = DCCP_ROLE_LISTEN;
944 
945 		/* do not start to listen if feature negotiation setup fails */
946 		if (dccp_feat_finalise_settings(dp)) {
947 			err = -EPROTO;
948 			goto out;
949 		}
950 
951 		err = inet_csk_listen_start(sk);
952 		if (err)
953 			goto out;
954 	}
955 	err = 0;
956 
957 out:
958 	release_sock(sk);
959 	return err;
960 }
961 
962 EXPORT_SYMBOL_GPL(inet_dccp_listen);
963 
dccp_terminate_connection(struct sock * sk)964 static void dccp_terminate_connection(struct sock *sk)
965 {
966 	u8 next_state = DCCP_CLOSED;
967 
968 	switch (sk->sk_state) {
969 	case DCCP_PASSIVE_CLOSE:
970 	case DCCP_PASSIVE_CLOSEREQ:
971 		dccp_finish_passive_close(sk);
972 		break;
973 	case DCCP_PARTOPEN:
974 		dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
975 		inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
976 		fallthrough;
977 	case DCCP_OPEN:
978 		dccp_send_close(sk, 1);
979 
980 		if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
981 		    !dccp_sk(sk)->dccps_server_timewait)
982 			next_state = DCCP_ACTIVE_CLOSEREQ;
983 		else
984 			next_state = DCCP_CLOSING;
985 		fallthrough;
986 	default:
987 		dccp_set_state(sk, next_state);
988 	}
989 }
990 
dccp_close(struct sock * sk,long timeout)991 void dccp_close(struct sock *sk, long timeout)
992 {
993 	struct dccp_sock *dp = dccp_sk(sk);
994 	struct sk_buff *skb;
995 	u32 data_was_unread = 0;
996 	int state;
997 
998 	lock_sock(sk);
999 
1000 	sk->sk_shutdown = SHUTDOWN_MASK;
1001 
1002 	if (sk->sk_state == DCCP_LISTEN) {
1003 		dccp_set_state(sk, DCCP_CLOSED);
1004 
1005 		/* Special case. */
1006 		inet_csk_listen_stop(sk);
1007 
1008 		goto adjudge_to_death;
1009 	}
1010 
1011 	sk_stop_timer(sk, &dp->dccps_xmit_timer);
1012 
1013 	/*
1014 	 * We need to flush the recv. buffs.  We do this only on the
1015 	 * descriptor close, not protocol-sourced closes, because the
1016 	  *reader process may not have drained the data yet!
1017 	 */
1018 	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1019 		data_was_unread += skb->len;
1020 		__kfree_skb(skb);
1021 	}
1022 
1023 	/* If socket has been already reset kill it. */
1024 	if (sk->sk_state == DCCP_CLOSED)
1025 		goto adjudge_to_death;
1026 
1027 	if (data_was_unread) {
1028 		/* Unread data was tossed, send an appropriate Reset Code */
1029 		DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1030 		dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1031 		dccp_set_state(sk, DCCP_CLOSED);
1032 	} else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1033 		/* Check zero linger _after_ checking for unread data. */
1034 		sk->sk_prot->disconnect(sk, 0);
1035 	} else if (sk->sk_state != DCCP_CLOSED) {
1036 		/*
1037 		 * Normal connection termination. May need to wait if there are
1038 		 * still packets in the TX queue that are delayed by the CCID.
1039 		 */
1040 		dccp_flush_write_queue(sk, &timeout);
1041 		dccp_terminate_connection(sk);
1042 	}
1043 
1044 	/*
1045 	 * Flush write queue. This may be necessary in several cases:
1046 	 * - we have been closed by the peer but still have application data;
1047 	 * - abortive termination (unread data or zero linger time),
1048 	 * - normal termination but queue could not be flushed within time limit
1049 	 */
1050 	__skb_queue_purge(&sk->sk_write_queue);
1051 
1052 	sk_stream_wait_close(sk, timeout);
1053 
1054 adjudge_to_death:
1055 	state = sk->sk_state;
1056 	sock_hold(sk);
1057 	sock_orphan(sk);
1058 
1059 	/*
1060 	 * It is the last release_sock in its life. It will remove backlog.
1061 	 */
1062 	release_sock(sk);
1063 	/*
1064 	 * Now socket is owned by kernel and we acquire BH lock
1065 	 * to finish close. No need to check for user refs.
1066 	 */
1067 	local_bh_disable();
1068 	bh_lock_sock(sk);
1069 	WARN_ON(sock_owned_by_user(sk));
1070 
1071 	this_cpu_inc(dccp_orphan_count);
1072 
1073 	/* Have we already been destroyed by a softirq or backlog? */
1074 	if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1075 		goto out;
1076 
1077 	if (sk->sk_state == DCCP_CLOSED)
1078 		inet_csk_destroy_sock(sk);
1079 
1080 	/* Otherwise, socket is reprieved until protocol close. */
1081 
1082 out:
1083 	bh_unlock_sock(sk);
1084 	local_bh_enable();
1085 	sock_put(sk);
1086 }
1087 
1088 EXPORT_SYMBOL_GPL(dccp_close);
1089 
dccp_shutdown(struct sock * sk,int how)1090 void dccp_shutdown(struct sock *sk, int how)
1091 {
1092 	dccp_pr_debug("called shutdown(%x)\n", how);
1093 }
1094 
1095 EXPORT_SYMBOL_GPL(dccp_shutdown);
1096 
dccp_mib_init(void)1097 static inline int __init dccp_mib_init(void)
1098 {
1099 	dccp_statistics = alloc_percpu(struct dccp_mib);
1100 	if (!dccp_statistics)
1101 		return -ENOMEM;
1102 	return 0;
1103 }
1104 
dccp_mib_exit(void)1105 static inline void dccp_mib_exit(void)
1106 {
1107 	free_percpu(dccp_statistics);
1108 }
1109 
1110 static int thash_entries;
1111 module_param(thash_entries, int, 0444);
1112 MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1113 
1114 #ifdef CONFIG_IP_DCCP_DEBUG
1115 bool dccp_debug;
1116 module_param(dccp_debug, bool, 0644);
1117 MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1118 
1119 EXPORT_SYMBOL_GPL(dccp_debug);
1120 #endif
1121 
dccp_init(void)1122 static int __init dccp_init(void)
1123 {
1124 	unsigned long goal;
1125 	unsigned long nr_pages = totalram_pages();
1126 	int ehash_order, bhash_order, i;
1127 	int rc;
1128 
1129 	BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1130 		     sizeof_field(struct sk_buff, cb));
1131 	rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
1132 	if (rc)
1133 		goto out_fail;
1134 	rc = -ENOBUFS;
1135 	dccp_hashinfo.bind_bucket_cachep =
1136 		kmem_cache_create("dccp_bind_bucket",
1137 				  sizeof(struct inet_bind_bucket), 0,
1138 				  SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1139 	if (!dccp_hashinfo.bind_bucket_cachep)
1140 		goto out_free_hashinfo2;
1141 	dccp_hashinfo.bind2_bucket_cachep =
1142 		kmem_cache_create("dccp_bind2_bucket",
1143 				  sizeof(struct inet_bind2_bucket), 0,
1144 				  SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1145 	if (!dccp_hashinfo.bind2_bucket_cachep)
1146 		goto out_free_bind_bucket_cachep;
1147 
1148 	/*
1149 	 * Size and allocate the main established and bind bucket
1150 	 * hash tables.
1151 	 *
1152 	 * The methodology is similar to that of the buffer cache.
1153 	 */
1154 	if (nr_pages >= (128 * 1024))
1155 		goal = nr_pages >> (21 - PAGE_SHIFT);
1156 	else
1157 		goal = nr_pages >> (23 - PAGE_SHIFT);
1158 
1159 	if (thash_entries)
1160 		goal = (thash_entries *
1161 			sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1162 	for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1163 		;
1164 	do {
1165 		unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1166 					sizeof(struct inet_ehash_bucket);
1167 
1168 		while (hash_size & (hash_size - 1))
1169 			hash_size--;
1170 		dccp_hashinfo.ehash_mask = hash_size - 1;
1171 		dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1172 			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1173 	} while (!dccp_hashinfo.ehash && --ehash_order > 0);
1174 
1175 	if (!dccp_hashinfo.ehash) {
1176 		DCCP_CRIT("Failed to allocate DCCP established hash table");
1177 		goto out_free_bind2_bucket_cachep;
1178 	}
1179 
1180 	for (i = 0; i <= dccp_hashinfo.ehash_mask; i++)
1181 		INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1182 
1183 	if (inet_ehash_locks_alloc(&dccp_hashinfo))
1184 			goto out_free_dccp_ehash;
1185 
1186 	bhash_order = ehash_order;
1187 
1188 	do {
1189 		dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1190 					sizeof(struct inet_bind_hashbucket);
1191 		if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1192 		    bhash_order > 0)
1193 			continue;
1194 		dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1195 			__get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1196 	} while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1197 
1198 	if (!dccp_hashinfo.bhash) {
1199 		DCCP_CRIT("Failed to allocate DCCP bind hash table");
1200 		goto out_free_dccp_locks;
1201 	}
1202 
1203 	dccp_hashinfo.bhash2 = (struct inet_bind_hashbucket *)
1204 		__get_free_pages(GFP_ATOMIC | __GFP_NOWARN, bhash_order);
1205 
1206 	if (!dccp_hashinfo.bhash2) {
1207 		DCCP_CRIT("Failed to allocate DCCP bind2 hash table");
1208 		goto out_free_dccp_bhash;
1209 	}
1210 
1211 	for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1212 		spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1213 		INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1214 		spin_lock_init(&dccp_hashinfo.bhash2[i].lock);
1215 		INIT_HLIST_HEAD(&dccp_hashinfo.bhash2[i].chain);
1216 	}
1217 
1218 	dccp_hashinfo.pernet = false;
1219 
1220 	rc = dccp_mib_init();
1221 	if (rc)
1222 		goto out_free_dccp_bhash2;
1223 
1224 	rc = dccp_ackvec_init();
1225 	if (rc)
1226 		goto out_free_dccp_mib;
1227 
1228 	rc = dccp_sysctl_init();
1229 	if (rc)
1230 		goto out_ackvec_exit;
1231 
1232 	rc = ccid_initialize_builtins();
1233 	if (rc)
1234 		goto out_sysctl_exit;
1235 
1236 	dccp_timestamping_init();
1237 
1238 	return 0;
1239 
1240 out_sysctl_exit:
1241 	dccp_sysctl_exit();
1242 out_ackvec_exit:
1243 	dccp_ackvec_exit();
1244 out_free_dccp_mib:
1245 	dccp_mib_exit();
1246 out_free_dccp_bhash2:
1247 	free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1248 out_free_dccp_bhash:
1249 	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1250 out_free_dccp_locks:
1251 	inet_ehash_locks_free(&dccp_hashinfo);
1252 out_free_dccp_ehash:
1253 	free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1254 out_free_bind2_bucket_cachep:
1255 	kmem_cache_destroy(dccp_hashinfo.bind2_bucket_cachep);
1256 out_free_bind_bucket_cachep:
1257 	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1258 out_free_hashinfo2:
1259 	inet_hashinfo2_free_mod(&dccp_hashinfo);
1260 out_fail:
1261 	dccp_hashinfo.bhash = NULL;
1262 	dccp_hashinfo.bhash2 = NULL;
1263 	dccp_hashinfo.ehash = NULL;
1264 	dccp_hashinfo.bind_bucket_cachep = NULL;
1265 	dccp_hashinfo.bind2_bucket_cachep = NULL;
1266 	return rc;
1267 }
1268 
dccp_fini(void)1269 static void __exit dccp_fini(void)
1270 {
1271 	int bhash_order = get_order(dccp_hashinfo.bhash_size *
1272 				    sizeof(struct inet_bind_hashbucket));
1273 
1274 	ccid_cleanup_builtins();
1275 	dccp_mib_exit();
1276 	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1277 	free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1278 	free_pages((unsigned long)dccp_hashinfo.ehash,
1279 		   get_order((dccp_hashinfo.ehash_mask + 1) *
1280 			     sizeof(struct inet_ehash_bucket)));
1281 	inet_ehash_locks_free(&dccp_hashinfo);
1282 	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1283 	dccp_ackvec_exit();
1284 	dccp_sysctl_exit();
1285 	inet_hashinfo2_free_mod(&dccp_hashinfo);
1286 }
1287 
1288 module_init(dccp_init);
1289 module_exit(dccp_fini);
1290 
1291 MODULE_LICENSE("GPL");
1292 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1293 MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");
1294