1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* SCTP kernel implementation
3  * (C) Copyright IBM Corp. 2001, 2004
4  * Copyright (c) 1999-2000 Cisco, Inc.
5  * Copyright (c) 1999-2001 Motorola, Inc.
6  * Copyright (c) 2001 Intel Corp.
7  * Copyright (c) 2001 Nokia, Inc.
8  * Copyright (c) 2001 La Monte H.P. Yarroll
9  *
10  * These functions manipulate an sctp event.   The struct ulpevent is used
11  * to carry notifications and data to the ULP (sockets).
12  *
13  * Please send any bug reports or fixes you make to the
14  * email address(es):
15  *    lksctp developers <linux-sctp@vger.kernel.org>
16  *
17  * Written or modified by:
18  *    Jon Grimm             <jgrimm@us.ibm.com>
19  *    La Monte H.P. Yarroll <piggy@acm.org>
20  *    Ardelle Fan	    <ardelle.fan@intel.com>
21  *    Sridhar Samudrala     <sri@us.ibm.com>
22  */
23 
24 #include <linux/slab.h>
25 #include <linux/types.h>
26 #include <linux/skbuff.h>
27 #include <net/sctp/structs.h>
28 #include <net/sctp/sctp.h>
29 #include <net/sctp/sm.h>
30 
31 static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
32 				       struct sctp_association *asoc);
33 static void sctp_ulpevent_release_data(struct sctp_ulpevent *event);
34 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
35 
36 
37 /* Initialize an ULP event from an given skb.  */
sctp_ulpevent_init(struct sctp_ulpevent * event,__u16 msg_flags,unsigned int len)38 static void sctp_ulpevent_init(struct sctp_ulpevent *event,
39 			       __u16 msg_flags,
40 			       unsigned int len)
41 {
42 	memset(event, 0, sizeof(struct sctp_ulpevent));
43 	event->msg_flags = msg_flags;
44 	event->rmem_len = len;
45 }
46 
47 /* Create a new sctp_ulpevent.  */
sctp_ulpevent_new(int size,__u16 msg_flags,gfp_t gfp)48 static struct sctp_ulpevent *sctp_ulpevent_new(int size, __u16 msg_flags,
49 					       gfp_t gfp)
50 {
51 	struct sctp_ulpevent *event;
52 	struct sk_buff *skb;
53 
54 	skb = alloc_skb(size, gfp);
55 	if (!skb)
56 		goto fail;
57 
58 	event = sctp_skb2event(skb);
59 	sctp_ulpevent_init(event, msg_flags, skb->truesize);
60 
61 	return event;
62 
63 fail:
64 	return NULL;
65 }
66 
67 /* Is this a MSG_NOTIFICATION?  */
sctp_ulpevent_is_notification(const struct sctp_ulpevent * event)68 int sctp_ulpevent_is_notification(const struct sctp_ulpevent *event)
69 {
70 	return MSG_NOTIFICATION == (event->msg_flags & MSG_NOTIFICATION);
71 }
72 
73 /* Hold the association in case the msg_name needs read out of
74  * the association.
75  */
sctp_ulpevent_set_owner(struct sctp_ulpevent * event,const struct sctp_association * asoc)76 static inline void sctp_ulpevent_set_owner(struct sctp_ulpevent *event,
77 					   const struct sctp_association *asoc)
78 {
79 	struct sctp_chunk *chunk = event->chunk;
80 	struct sk_buff *skb;
81 
82 	/* Cast away the const, as we are just wanting to
83 	 * bump the reference count.
84 	 */
85 	sctp_association_hold((struct sctp_association *)asoc);
86 	skb = sctp_event2skb(event);
87 	event->asoc = (struct sctp_association *)asoc;
88 	atomic_add(event->rmem_len, &event->asoc->rmem_alloc);
89 	sctp_skb_set_owner_r(skb, asoc->base.sk);
90 	if (chunk && chunk->head_skb && !chunk->head_skb->sk)
91 		chunk->head_skb->sk = asoc->base.sk;
92 }
93 
94 /* A simple destructor to give up the reference to the association. */
sctp_ulpevent_release_owner(struct sctp_ulpevent * event)95 static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
96 {
97 	struct sctp_association *asoc = event->asoc;
98 
99 	atomic_sub(event->rmem_len, &asoc->rmem_alloc);
100 	sctp_association_put(asoc);
101 }
102 
103 /* Create and initialize an SCTP_ASSOC_CHANGE event.
104  *
105  * 5.3.1.1 SCTP_ASSOC_CHANGE
106  *
107  * Communication notifications inform the ULP that an SCTP association
108  * has either begun or ended. The identifier for a new association is
109  * provided by this notification.
110  *
111  * Note: There is no field checking here.  If a field is unused it will be
112  * zero'd out.
113  */
sctp_ulpevent_make_assoc_change(const struct sctp_association * asoc,__u16 flags,__u16 state,__u16 error,__u16 outbound,__u16 inbound,struct sctp_chunk * chunk,gfp_t gfp)114 struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
115 	const struct sctp_association *asoc,
116 	__u16 flags, __u16 state, __u16 error, __u16 outbound,
117 	__u16 inbound, struct sctp_chunk *chunk, gfp_t gfp)
118 {
119 	struct sctp_ulpevent *event;
120 	struct sctp_assoc_change *sac;
121 	struct sk_buff *skb;
122 
123 	/* If the lower layer passed in the chunk, it will be
124 	 * an ABORT, so we need to include it in the sac_info.
125 	 */
126 	if (chunk) {
127 		/* Copy the chunk data to a new skb and reserve enough
128 		 * head room to use as notification.
129 		 */
130 		skb = skb_copy_expand(chunk->skb,
131 				      sizeof(struct sctp_assoc_change), 0, gfp);
132 
133 		if (!skb)
134 			goto fail;
135 
136 		/* Embed the event fields inside the cloned skb.  */
137 		event = sctp_skb2event(skb);
138 		sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
139 
140 		/* Include the notification structure */
141 		sac = skb_push(skb, sizeof(struct sctp_assoc_change));
142 
143 		/* Trim the buffer to the right length.  */
144 		skb_trim(skb, sizeof(struct sctp_assoc_change) +
145 			 ntohs(chunk->chunk_hdr->length) -
146 			 sizeof(struct sctp_chunkhdr));
147 	} else {
148 		event = sctp_ulpevent_new(sizeof(struct sctp_assoc_change),
149 				  MSG_NOTIFICATION, gfp);
150 		if (!event)
151 			goto fail;
152 
153 		skb = sctp_event2skb(event);
154 		sac = skb_put(skb, sizeof(struct sctp_assoc_change));
155 	}
156 
157 	/* Socket Extensions for SCTP
158 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
159 	 *
160 	 * sac_type:
161 	 * It should be SCTP_ASSOC_CHANGE.
162 	 */
163 	sac->sac_type = SCTP_ASSOC_CHANGE;
164 
165 	/* Socket Extensions for SCTP
166 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
167 	 *
168 	 * sac_state: 32 bits (signed integer)
169 	 * This field holds one of a number of values that communicate the
170 	 * event that happened to the association.
171 	 */
172 	sac->sac_state = state;
173 
174 	/* Socket Extensions for SCTP
175 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
176 	 *
177 	 * sac_flags: 16 bits (unsigned integer)
178 	 * Currently unused.
179 	 */
180 	sac->sac_flags = 0;
181 
182 	/* Socket Extensions for SCTP
183 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
184 	 *
185 	 * sac_length: sizeof (__u32)
186 	 * This field is the total length of the notification data, including
187 	 * the notification header.
188 	 */
189 	sac->sac_length = skb->len;
190 
191 	/* Socket Extensions for SCTP
192 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
193 	 *
194 	 * sac_error:  32 bits (signed integer)
195 	 *
196 	 * If the state was reached due to a error condition (e.g.
197 	 * COMMUNICATION_LOST) any relevant error information is available in
198 	 * this field. This corresponds to the protocol error codes defined in
199 	 * [SCTP].
200 	 */
201 	sac->sac_error = error;
202 
203 	/* Socket Extensions for SCTP
204 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
205 	 *
206 	 * sac_outbound_streams:  16 bits (unsigned integer)
207 	 * sac_inbound_streams:  16 bits (unsigned integer)
208 	 *
209 	 * The maximum number of streams allowed in each direction are
210 	 * available in sac_outbound_streams and sac_inbound streams.
211 	 */
212 	sac->sac_outbound_streams = outbound;
213 	sac->sac_inbound_streams = inbound;
214 
215 	/* Socket Extensions for SCTP
216 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
217 	 *
218 	 * sac_assoc_id: sizeof (sctp_assoc_t)
219 	 *
220 	 * The association id field, holds the identifier for the association.
221 	 * All notifications for a given association have the same association
222 	 * identifier.  For TCP style socket, this field is ignored.
223 	 */
224 	sctp_ulpevent_set_owner(event, asoc);
225 	sac->sac_assoc_id = sctp_assoc2id(asoc);
226 
227 	return event;
228 
229 fail:
230 	return NULL;
231 }
232 
233 /* Create and initialize an SCTP_PEER_ADDR_CHANGE event.
234  *
235  * Socket Extensions for SCTP - draft-01
236  * 5.3.1.2 SCTP_PEER_ADDR_CHANGE
237  *
238  * When a destination address on a multi-homed peer encounters a change
239  * an interface details event is sent.
240  */
sctp_ulpevent_make_peer_addr_change(const struct sctp_association * asoc,const struct sockaddr_storage * aaddr,int flags,int state,int error,gfp_t gfp)241 static struct sctp_ulpevent *sctp_ulpevent_make_peer_addr_change(
242 	const struct sctp_association *asoc,
243 	const struct sockaddr_storage *aaddr,
244 	int flags, int state, int error, gfp_t gfp)
245 {
246 	struct sctp_ulpevent *event;
247 	struct sctp_paddr_change  *spc;
248 	struct sk_buff *skb;
249 
250 	event = sctp_ulpevent_new(sizeof(struct sctp_paddr_change),
251 				  MSG_NOTIFICATION, gfp);
252 	if (!event)
253 		goto fail;
254 
255 	skb = sctp_event2skb(event);
256 	spc = skb_put(skb, sizeof(struct sctp_paddr_change));
257 
258 	/* Sockets API Extensions for SCTP
259 	 * Section 5.3.1.2 SCTP_PEER_ADDR_CHANGE
260 	 *
261 	 * spc_type:
262 	 *
263 	 *    It should be SCTP_PEER_ADDR_CHANGE.
264 	 */
265 	spc->spc_type = SCTP_PEER_ADDR_CHANGE;
266 
267 	/* Sockets API Extensions for SCTP
268 	 * Section 5.3.1.2 SCTP_PEER_ADDR_CHANGE
269 	 *
270 	 * spc_length: sizeof (__u32)
271 	 *
272 	 * This field is the total length of the notification data, including
273 	 * the notification header.
274 	 */
275 	spc->spc_length = sizeof(struct sctp_paddr_change);
276 
277 	/* Sockets API Extensions for SCTP
278 	 * Section 5.3.1.2 SCTP_PEER_ADDR_CHANGE
279 	 *
280 	 * spc_flags: 16 bits (unsigned integer)
281 	 * Currently unused.
282 	 */
283 	spc->spc_flags = 0;
284 
285 	/* Sockets API Extensions for SCTP
286 	 * Section 5.3.1.2 SCTP_PEER_ADDR_CHANGE
287 	 *
288 	 * spc_state:  32 bits (signed integer)
289 	 *
290 	 * This field holds one of a number of values that communicate the
291 	 * event that happened to the address.
292 	 */
293 	spc->spc_state = state;
294 
295 	/* Sockets API Extensions for SCTP
296 	 * Section 5.3.1.2 SCTP_PEER_ADDR_CHANGE
297 	 *
298 	 * spc_error:  32 bits (signed integer)
299 	 *
300 	 * If the state was reached due to any error condition (e.g.
301 	 * ADDRESS_UNREACHABLE) any relevant error information is available in
302 	 * this field.
303 	 */
304 	spc->spc_error = error;
305 
306 	/* Socket Extensions for SCTP
307 	 * 5.3.1.1 SCTP_ASSOC_CHANGE
308 	 *
309 	 * spc_assoc_id: sizeof (sctp_assoc_t)
310 	 *
311 	 * The association id field, holds the identifier for the association.
312 	 * All notifications for a given association have the same association
313 	 * identifier.  For TCP style socket, this field is ignored.
314 	 */
315 	sctp_ulpevent_set_owner(event, asoc);
316 	spc->spc_assoc_id = sctp_assoc2id(asoc);
317 
318 	/* Sockets API Extensions for SCTP
319 	 * Section 5.3.1.2 SCTP_PEER_ADDR_CHANGE
320 	 *
321 	 * spc_aaddr: sizeof (struct sockaddr_storage)
322 	 *
323 	 * The affected address field, holds the remote peer's address that is
324 	 * encountering the change of state.
325 	 */
326 	memcpy(&spc->spc_aaddr, aaddr, sizeof(struct sockaddr_storage));
327 
328 	/* Map ipv4 address into v4-mapped-on-v6 address.  */
329 	sctp_get_pf_specific(asoc->base.sk->sk_family)->addr_to_user(
330 					sctp_sk(asoc->base.sk),
331 					(union sctp_addr *)&spc->spc_aaddr);
332 
333 	return event;
334 
335 fail:
336 	return NULL;
337 }
338 
sctp_ulpevent_notify_peer_addr_change(struct sctp_transport * transport,int state,int error)339 void sctp_ulpevent_notify_peer_addr_change(struct sctp_transport *transport,
340 					   int state, int error)
341 {
342 	struct sctp_association *asoc = transport->asoc;
343 	struct sockaddr_storage addr;
344 	struct sctp_ulpevent *event;
345 
346 	if (asoc->state < SCTP_STATE_ESTABLISHED)
347 		return;
348 
349 	memset(&addr, 0, sizeof(struct sockaddr_storage));
350 	memcpy(&addr, &transport->ipaddr, transport->af_specific->sockaddr_len);
351 
352 	event = sctp_ulpevent_make_peer_addr_change(asoc, &addr, 0, state,
353 						    error, GFP_ATOMIC);
354 	if (event)
355 		asoc->stream.si->enqueue_event(&asoc->ulpq, event);
356 }
357 
358 /* Create and initialize an SCTP_REMOTE_ERROR notification.
359  *
360  * Note: This assumes that the chunk->skb->data already points to the
361  * operation error payload.
362  *
363  * Socket Extensions for SCTP - draft-01
364  * 5.3.1.3 SCTP_REMOTE_ERROR
365  *
366  * A remote peer may send an Operational Error message to its peer.
367  * This message indicates a variety of error conditions on an
368  * association. The entire error TLV as it appears on the wire is
369  * included in a SCTP_REMOTE_ERROR event.  Please refer to the SCTP
370  * specification [SCTP] and any extensions for a list of possible
371  * error formats.
372  */
373 struct sctp_ulpevent *
sctp_ulpevent_make_remote_error(const struct sctp_association * asoc,struct sctp_chunk * chunk,__u16 flags,gfp_t gfp)374 sctp_ulpevent_make_remote_error(const struct sctp_association *asoc,
375 				struct sctp_chunk *chunk, __u16 flags,
376 				gfp_t gfp)
377 {
378 	struct sctp_remote_error *sre;
379 	struct sctp_ulpevent *event;
380 	struct sctp_errhdr *ch;
381 	struct sk_buff *skb;
382 	__be16 cause;
383 	int elen;
384 
385 	ch = (struct sctp_errhdr *)(chunk->skb->data);
386 	cause = ch->cause;
387 	elen = SCTP_PAD4(ntohs(ch->length)) - sizeof(*ch);
388 
389 	/* Pull off the ERROR header.  */
390 	skb_pull(chunk->skb, sizeof(*ch));
391 
392 	/* Copy the skb to a new skb with room for us to prepend
393 	 * notification with.
394 	 */
395 	skb = skb_copy_expand(chunk->skb, sizeof(*sre), 0, gfp);
396 
397 	/* Pull off the rest of the cause TLV from the chunk.  */
398 	skb_pull(chunk->skb, elen);
399 	if (!skb)
400 		goto fail;
401 
402 	/* Embed the event fields inside the cloned skb.  */
403 	event = sctp_skb2event(skb);
404 	sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
405 
406 	sre = skb_push(skb, sizeof(*sre));
407 
408 	/* Trim the buffer to the right length.  */
409 	skb_trim(skb, sizeof(*sre) + elen);
410 
411 	/* RFC6458, Section 6.1.3. SCTP_REMOTE_ERROR */
412 	memset(sre, 0, sizeof(*sre));
413 	sre->sre_type = SCTP_REMOTE_ERROR;
414 	sre->sre_flags = 0;
415 	sre->sre_length = skb->len;
416 	sre->sre_error = cause;
417 	sctp_ulpevent_set_owner(event, asoc);
418 	sre->sre_assoc_id = sctp_assoc2id(asoc);
419 
420 	return event;
421 fail:
422 	return NULL;
423 }
424 
425 /* Create and initialize a SCTP_SEND_FAILED notification.
426  *
427  * Socket Extensions for SCTP - draft-01
428  * 5.3.1.4 SCTP_SEND_FAILED
429  */
sctp_ulpevent_make_send_failed(const struct sctp_association * asoc,struct sctp_chunk * chunk,__u16 flags,__u32 error,gfp_t gfp)430 struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
431 	const struct sctp_association *asoc, struct sctp_chunk *chunk,
432 	__u16 flags, __u32 error, gfp_t gfp)
433 {
434 	struct sctp_ulpevent *event;
435 	struct sctp_send_failed *ssf;
436 	struct sk_buff *skb;
437 
438 	/* Pull off any padding. */
439 	int len = ntohs(chunk->chunk_hdr->length);
440 
441 	/* Make skb with more room so we can prepend notification.  */
442 	skb = skb_copy_expand(chunk->skb,
443 			      sizeof(struct sctp_send_failed), /* headroom */
444 			      0,                               /* tailroom */
445 			      gfp);
446 	if (!skb)
447 		goto fail;
448 
449 	/* Pull off the common chunk header and DATA header.  */
450 	skb_pull(skb, sctp_datachk_len(&asoc->stream));
451 	len -= sctp_datachk_len(&asoc->stream);
452 
453 	/* Embed the event fields inside the cloned skb.  */
454 	event = sctp_skb2event(skb);
455 	sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
456 
457 	ssf = skb_push(skb, sizeof(struct sctp_send_failed));
458 
459 	/* Socket Extensions for SCTP
460 	 * 5.3.1.4 SCTP_SEND_FAILED
461 	 *
462 	 * ssf_type:
463 	 * It should be SCTP_SEND_FAILED.
464 	 */
465 	ssf->ssf_type = SCTP_SEND_FAILED;
466 
467 	/* Socket Extensions for SCTP
468 	 * 5.3.1.4 SCTP_SEND_FAILED
469 	 *
470 	 * ssf_flags: 16 bits (unsigned integer)
471 	 * The flag value will take one of the following values
472 	 *
473 	 * SCTP_DATA_UNSENT - Indicates that the data was never put on
474 	 *                    the wire.
475 	 *
476 	 * SCTP_DATA_SENT   - Indicates that the data was put on the wire.
477 	 *                    Note that this does not necessarily mean that the
478 	 *                    data was (or was not) successfully delivered.
479 	 */
480 	ssf->ssf_flags = flags;
481 
482 	/* Socket Extensions for SCTP
483 	 * 5.3.1.4 SCTP_SEND_FAILED
484 	 *
485 	 * ssf_length: sizeof (__u32)
486 	 * This field is the total length of the notification data, including
487 	 * the notification header.
488 	 */
489 	ssf->ssf_length = sizeof(struct sctp_send_failed) + len;
490 	skb_trim(skb, ssf->ssf_length);
491 
492 	/* Socket Extensions for SCTP
493 	 * 5.3.1.4 SCTP_SEND_FAILED
494 	 *
495 	 * ssf_error: 16 bits (unsigned integer)
496 	 * This value represents the reason why the send failed, and if set,
497 	 * will be a SCTP protocol error code as defined in [SCTP] section
498 	 * 3.3.10.
499 	 */
500 	ssf->ssf_error = error;
501 
502 	/* Socket Extensions for SCTP
503 	 * 5.3.1.4 SCTP_SEND_FAILED
504 	 *
505 	 * ssf_info: sizeof (struct sctp_sndrcvinfo)
506 	 * The original send information associated with the undelivered
507 	 * message.
508 	 */
509 	memcpy(&ssf->ssf_info, &chunk->sinfo, sizeof(struct sctp_sndrcvinfo));
510 
511 	/* Per TSVWG discussion with Randy. Allow the application to
512 	 * reassemble a fragmented message.
513 	 */
514 	ssf->ssf_info.sinfo_flags = chunk->chunk_hdr->flags;
515 
516 	/* Socket Extensions for SCTP
517 	 * 5.3.1.4 SCTP_SEND_FAILED
518 	 *
519 	 * ssf_assoc_id: sizeof (sctp_assoc_t)
520 	 * The association id field, sf_assoc_id, holds the identifier for the
521 	 * association.  All notifications for a given association have the
522 	 * same association identifier.  For TCP style socket, this field is
523 	 * ignored.
524 	 */
525 	sctp_ulpevent_set_owner(event, asoc);
526 	ssf->ssf_assoc_id = sctp_assoc2id(asoc);
527 	return event;
528 
529 fail:
530 	return NULL;
531 }
532 
sctp_ulpevent_make_send_failed_event(const struct sctp_association * asoc,struct sctp_chunk * chunk,__u16 flags,__u32 error,gfp_t gfp)533 struct sctp_ulpevent *sctp_ulpevent_make_send_failed_event(
534 	const struct sctp_association *asoc, struct sctp_chunk *chunk,
535 	__u16 flags, __u32 error, gfp_t gfp)
536 {
537 	struct sctp_send_failed_event *ssf;
538 	struct sctp_ulpevent *event;
539 	struct sk_buff *skb;
540 	int len;
541 
542 	skb = skb_copy_expand(chunk->skb, sizeof(*ssf), 0, gfp);
543 	if (!skb)
544 		return NULL;
545 
546 	len = ntohs(chunk->chunk_hdr->length);
547 	len -= sctp_datachk_len(&asoc->stream);
548 
549 	skb_pull(skb, sctp_datachk_len(&asoc->stream));
550 	event = sctp_skb2event(skb);
551 	sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
552 
553 	ssf = skb_push(skb, sizeof(*ssf));
554 	ssf->ssf_type = SCTP_SEND_FAILED_EVENT;
555 	ssf->ssf_flags = flags;
556 	ssf->ssf_length = sizeof(*ssf) + len;
557 	skb_trim(skb, ssf->ssf_length);
558 	ssf->ssf_error = error;
559 
560 	ssf->ssfe_info.snd_sid = chunk->sinfo.sinfo_stream;
561 	ssf->ssfe_info.snd_ppid = chunk->sinfo.sinfo_ppid;
562 	ssf->ssfe_info.snd_context = chunk->sinfo.sinfo_context;
563 	ssf->ssfe_info.snd_assoc_id = chunk->sinfo.sinfo_assoc_id;
564 	ssf->ssfe_info.snd_flags = chunk->chunk_hdr->flags;
565 
566 	sctp_ulpevent_set_owner(event, asoc);
567 	ssf->ssf_assoc_id = sctp_assoc2id(asoc);
568 
569 	return event;
570 }
571 
572 /* Create and initialize a SCTP_SHUTDOWN_EVENT notification.
573  *
574  * Socket Extensions for SCTP - draft-01
575  * 5.3.1.5 SCTP_SHUTDOWN_EVENT
576  */
sctp_ulpevent_make_shutdown_event(const struct sctp_association * asoc,__u16 flags,gfp_t gfp)577 struct sctp_ulpevent *sctp_ulpevent_make_shutdown_event(
578 	const struct sctp_association *asoc,
579 	__u16 flags, gfp_t gfp)
580 {
581 	struct sctp_ulpevent *event;
582 	struct sctp_shutdown_event *sse;
583 	struct sk_buff *skb;
584 
585 	event = sctp_ulpevent_new(sizeof(struct sctp_shutdown_event),
586 				  MSG_NOTIFICATION, gfp);
587 	if (!event)
588 		goto fail;
589 
590 	skb = sctp_event2skb(event);
591 	sse = skb_put(skb, sizeof(struct sctp_shutdown_event));
592 
593 	/* Socket Extensions for SCTP
594 	 * 5.3.1.5 SCTP_SHUTDOWN_EVENT
595 	 *
596 	 * sse_type
597 	 * It should be SCTP_SHUTDOWN_EVENT
598 	 */
599 	sse->sse_type = SCTP_SHUTDOWN_EVENT;
600 
601 	/* Socket Extensions for SCTP
602 	 * 5.3.1.5 SCTP_SHUTDOWN_EVENT
603 	 *
604 	 * sse_flags: 16 bits (unsigned integer)
605 	 * Currently unused.
606 	 */
607 	sse->sse_flags = 0;
608 
609 	/* Socket Extensions for SCTP
610 	 * 5.3.1.5 SCTP_SHUTDOWN_EVENT
611 	 *
612 	 * sse_length: sizeof (__u32)
613 	 * This field is the total length of the notification data, including
614 	 * the notification header.
615 	 */
616 	sse->sse_length = sizeof(struct sctp_shutdown_event);
617 
618 	/* Socket Extensions for SCTP
619 	 * 5.3.1.5 SCTP_SHUTDOWN_EVENT
620 	 *
621 	 * sse_assoc_id: sizeof (sctp_assoc_t)
622 	 * The association id field, holds the identifier for the association.
623 	 * All notifications for a given association have the same association
624 	 * identifier.  For TCP style socket, this field is ignored.
625 	 */
626 	sctp_ulpevent_set_owner(event, asoc);
627 	sse->sse_assoc_id = sctp_assoc2id(asoc);
628 
629 	return event;
630 
631 fail:
632 	return NULL;
633 }
634 
635 /* Create and initialize a SCTP_ADAPTATION_INDICATION notification.
636  *
637  * Socket Extensions for SCTP
638  * 5.3.1.6 SCTP_ADAPTATION_INDICATION
639  */
sctp_ulpevent_make_adaptation_indication(const struct sctp_association * asoc,gfp_t gfp)640 struct sctp_ulpevent *sctp_ulpevent_make_adaptation_indication(
641 	const struct sctp_association *asoc, gfp_t gfp)
642 {
643 	struct sctp_ulpevent *event;
644 	struct sctp_adaptation_event *sai;
645 	struct sk_buff *skb;
646 
647 	event = sctp_ulpevent_new(sizeof(struct sctp_adaptation_event),
648 				  MSG_NOTIFICATION, gfp);
649 	if (!event)
650 		goto fail;
651 
652 	skb = sctp_event2skb(event);
653 	sai = skb_put(skb, sizeof(struct sctp_adaptation_event));
654 
655 	sai->sai_type = SCTP_ADAPTATION_INDICATION;
656 	sai->sai_flags = 0;
657 	sai->sai_length = sizeof(struct sctp_adaptation_event);
658 	sai->sai_adaptation_ind = asoc->peer.adaptation_ind;
659 	sctp_ulpevent_set_owner(event, asoc);
660 	sai->sai_assoc_id = sctp_assoc2id(asoc);
661 
662 	return event;
663 
664 fail:
665 	return NULL;
666 }
667 
668 /* A message has been received.  Package this message as a notification
669  * to pass it to the upper layers.  Go ahead and calculate the sndrcvinfo
670  * even if filtered out later.
671  *
672  * Socket Extensions for SCTP
673  * 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
674  */
sctp_ulpevent_make_rcvmsg(struct sctp_association * asoc,struct sctp_chunk * chunk,gfp_t gfp)675 struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
676 						struct sctp_chunk *chunk,
677 						gfp_t gfp)
678 {
679 	struct sctp_ulpevent *event = NULL;
680 	struct sk_buff *skb = chunk->skb;
681 	struct sock *sk = asoc->base.sk;
682 	size_t padding, datalen;
683 	int rx_count;
684 
685 	/*
686 	 * check to see if we need to make space for this
687 	 * new skb, expand the rcvbuffer if needed, or drop
688 	 * the frame
689 	 */
690 	if (asoc->ep->rcvbuf_policy)
691 		rx_count = atomic_read(&asoc->rmem_alloc);
692 	else
693 		rx_count = atomic_read(&sk->sk_rmem_alloc);
694 
695 	datalen = ntohs(chunk->chunk_hdr->length);
696 
697 	if (rx_count >= sk->sk_rcvbuf || !sk_rmem_schedule(sk, skb, datalen))
698 		goto fail;
699 
700 	/* Clone the original skb, sharing the data.  */
701 	skb = skb_clone(chunk->skb, gfp);
702 	if (!skb)
703 		goto fail;
704 
705 	/* Now that all memory allocations for this chunk succeeded, we
706 	 * can mark it as received so the tsn_map is updated correctly.
707 	 */
708 	if (sctp_tsnmap_mark(&asoc->peer.tsn_map,
709 			     ntohl(chunk->subh.data_hdr->tsn),
710 			     chunk->transport))
711 		goto fail_mark;
712 
713 	/* First calculate the padding, so we don't inadvertently
714 	 * pass up the wrong length to the user.
715 	 *
716 	 * RFC 2960 - Section 3.2  Chunk Field Descriptions
717 	 *
718 	 * The total length of a chunk(including Type, Length and Value fields)
719 	 * MUST be a multiple of 4 bytes.  If the length of the chunk is not a
720 	 * multiple of 4 bytes, the sender MUST pad the chunk with all zero
721 	 * bytes and this padding is not included in the chunk length field.
722 	 * The sender should never pad with more than 3 bytes.  The receiver
723 	 * MUST ignore the padding bytes.
724 	 */
725 	padding = SCTP_PAD4(datalen) - datalen;
726 
727 	/* Fixup cloned skb with just this chunks data.  */
728 	skb_trim(skb, chunk->chunk_end - padding - skb->data);
729 
730 	/* Embed the event fields inside the cloned skb.  */
731 	event = sctp_skb2event(skb);
732 
733 	/* Initialize event with flags 0  and correct length
734 	 * Since this is a clone of the original skb, only account for
735 	 * the data of this chunk as other chunks will be accounted separately.
736 	 */
737 	sctp_ulpevent_init(event, 0, skb->len + sizeof(struct sk_buff));
738 
739 	/* And hold the chunk as we need it for getting the IP headers
740 	 * later in recvmsg
741 	 */
742 	sctp_chunk_hold(chunk);
743 	event->chunk = chunk;
744 
745 	sctp_ulpevent_receive_data(event, asoc);
746 
747 	event->stream = ntohs(chunk->subh.data_hdr->stream);
748 	if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED) {
749 		event->flags |= SCTP_UNORDERED;
750 		event->cumtsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
751 	}
752 	event->tsn = ntohl(chunk->subh.data_hdr->tsn);
753 	event->msg_flags |= chunk->chunk_hdr->flags;
754 
755 	return event;
756 
757 fail_mark:
758 	kfree_skb(skb);
759 fail:
760 	return NULL;
761 }
762 
763 /* Create a partial delivery related event.
764  *
765  * 5.3.1.7 SCTP_PARTIAL_DELIVERY_EVENT
766  *
767  *   When a receiver is engaged in a partial delivery of a
768  *   message this notification will be used to indicate
769  *   various events.
770  */
sctp_ulpevent_make_pdapi(const struct sctp_association * asoc,__u32 indication,__u32 sid,__u32 seq,__u32 flags,gfp_t gfp)771 struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
772 					const struct sctp_association *asoc,
773 					__u32 indication, __u32 sid, __u32 seq,
774 					__u32 flags, gfp_t gfp)
775 {
776 	struct sctp_ulpevent *event;
777 	struct sctp_pdapi_event *pd;
778 	struct sk_buff *skb;
779 
780 	event = sctp_ulpevent_new(sizeof(struct sctp_pdapi_event),
781 				  MSG_NOTIFICATION, gfp);
782 	if (!event)
783 		goto fail;
784 
785 	skb = sctp_event2skb(event);
786 	pd = skb_put(skb, sizeof(struct sctp_pdapi_event));
787 
788 	/* pdapi_type
789 	 *   It should be SCTP_PARTIAL_DELIVERY_EVENT
790 	 *
791 	 * pdapi_flags: 16 bits (unsigned integer)
792 	 *   Currently unused.
793 	 */
794 	pd->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
795 	pd->pdapi_flags = flags;
796 	pd->pdapi_stream = sid;
797 	pd->pdapi_seq = seq;
798 
799 	/* pdapi_length: 32 bits (unsigned integer)
800 	 *
801 	 * This field is the total length of the notification data, including
802 	 * the notification header.  It will generally be sizeof (struct
803 	 * sctp_pdapi_event).
804 	 */
805 	pd->pdapi_length = sizeof(struct sctp_pdapi_event);
806 
807 	/*  pdapi_indication: 32 bits (unsigned integer)
808 	 *
809 	 * This field holds the indication being sent to the application.
810 	 */
811 	pd->pdapi_indication = indication;
812 
813 	/*  pdapi_assoc_id: sizeof (sctp_assoc_t)
814 	 *
815 	 * The association id field, holds the identifier for the association.
816 	 */
817 	sctp_ulpevent_set_owner(event, asoc);
818 	pd->pdapi_assoc_id = sctp_assoc2id(asoc);
819 
820 	return event;
821 fail:
822 	return NULL;
823 }
824 
sctp_ulpevent_make_authkey(const struct sctp_association * asoc,__u16 key_id,__u32 indication,gfp_t gfp)825 struct sctp_ulpevent *sctp_ulpevent_make_authkey(
826 	const struct sctp_association *asoc, __u16 key_id,
827 	__u32 indication, gfp_t gfp)
828 {
829 	struct sctp_ulpevent *event;
830 	struct sctp_authkey_event *ak;
831 	struct sk_buff *skb;
832 
833 	event = sctp_ulpevent_new(sizeof(struct sctp_authkey_event),
834 				  MSG_NOTIFICATION, gfp);
835 	if (!event)
836 		goto fail;
837 
838 	skb = sctp_event2skb(event);
839 	ak = skb_put(skb, sizeof(struct sctp_authkey_event));
840 
841 	ak->auth_type = SCTP_AUTHENTICATION_EVENT;
842 	ak->auth_flags = 0;
843 	ak->auth_length = sizeof(struct sctp_authkey_event);
844 
845 	ak->auth_keynumber = key_id;
846 	ak->auth_altkeynumber = 0;
847 	ak->auth_indication = indication;
848 
849 	/*
850 	 * The association id field, holds the identifier for the association.
851 	 */
852 	sctp_ulpevent_set_owner(event, asoc);
853 	ak->auth_assoc_id = sctp_assoc2id(asoc);
854 
855 	return event;
856 fail:
857 	return NULL;
858 }
859 
860 /*
861  * Socket Extensions for SCTP
862  * 6.3.10. SCTP_SENDER_DRY_EVENT
863  */
sctp_ulpevent_make_sender_dry_event(const struct sctp_association * asoc,gfp_t gfp)864 struct sctp_ulpevent *sctp_ulpevent_make_sender_dry_event(
865 	const struct sctp_association *asoc, gfp_t gfp)
866 {
867 	struct sctp_ulpevent *event;
868 	struct sctp_sender_dry_event *sdry;
869 	struct sk_buff *skb;
870 
871 	event = sctp_ulpevent_new(sizeof(struct sctp_sender_dry_event),
872 				  MSG_NOTIFICATION, gfp);
873 	if (!event)
874 		return NULL;
875 
876 	skb = sctp_event2skb(event);
877 	sdry = skb_put(skb, sizeof(struct sctp_sender_dry_event));
878 
879 	sdry->sender_dry_type = SCTP_SENDER_DRY_EVENT;
880 	sdry->sender_dry_flags = 0;
881 	sdry->sender_dry_length = sizeof(struct sctp_sender_dry_event);
882 	sctp_ulpevent_set_owner(event, asoc);
883 	sdry->sender_dry_assoc_id = sctp_assoc2id(asoc);
884 
885 	return event;
886 }
887 
sctp_ulpevent_make_stream_reset_event(const struct sctp_association * asoc,__u16 flags,__u16 stream_num,__be16 * stream_list,gfp_t gfp)888 struct sctp_ulpevent *sctp_ulpevent_make_stream_reset_event(
889 	const struct sctp_association *asoc, __u16 flags, __u16 stream_num,
890 	__be16 *stream_list, gfp_t gfp)
891 {
892 	struct sctp_stream_reset_event *sreset;
893 	struct sctp_ulpevent *event;
894 	struct sk_buff *skb;
895 	int length, i;
896 
897 	length = sizeof(struct sctp_stream_reset_event) + 2 * stream_num;
898 	event = sctp_ulpevent_new(length, MSG_NOTIFICATION, gfp);
899 	if (!event)
900 		return NULL;
901 
902 	skb = sctp_event2skb(event);
903 	sreset = skb_put(skb, length);
904 
905 	sreset->strreset_type = SCTP_STREAM_RESET_EVENT;
906 	sreset->strreset_flags = flags;
907 	sreset->strreset_length = length;
908 	sctp_ulpevent_set_owner(event, asoc);
909 	sreset->strreset_assoc_id = sctp_assoc2id(asoc);
910 
911 	for (i = 0; i < stream_num; i++)
912 		sreset->strreset_stream_list[i] = ntohs(stream_list[i]);
913 
914 	return event;
915 }
916 
sctp_ulpevent_make_assoc_reset_event(const struct sctp_association * asoc,__u16 flags,__u32 local_tsn,__u32 remote_tsn,gfp_t gfp)917 struct sctp_ulpevent *sctp_ulpevent_make_assoc_reset_event(
918 	const struct sctp_association *asoc, __u16 flags, __u32 local_tsn,
919 	__u32 remote_tsn, gfp_t gfp)
920 {
921 	struct sctp_assoc_reset_event *areset;
922 	struct sctp_ulpevent *event;
923 	struct sk_buff *skb;
924 
925 	event = sctp_ulpevent_new(sizeof(struct sctp_assoc_reset_event),
926 				  MSG_NOTIFICATION, gfp);
927 	if (!event)
928 		return NULL;
929 
930 	skb = sctp_event2skb(event);
931 	areset = skb_put(skb, sizeof(struct sctp_assoc_reset_event));
932 
933 	areset->assocreset_type = SCTP_ASSOC_RESET_EVENT;
934 	areset->assocreset_flags = flags;
935 	areset->assocreset_length = sizeof(struct sctp_assoc_reset_event);
936 	sctp_ulpevent_set_owner(event, asoc);
937 	areset->assocreset_assoc_id = sctp_assoc2id(asoc);
938 	areset->assocreset_local_tsn = local_tsn;
939 	areset->assocreset_remote_tsn = remote_tsn;
940 
941 	return event;
942 }
943 
sctp_ulpevent_make_stream_change_event(const struct sctp_association * asoc,__u16 flags,__u32 strchange_instrms,__u32 strchange_outstrms,gfp_t gfp)944 struct sctp_ulpevent *sctp_ulpevent_make_stream_change_event(
945 	const struct sctp_association *asoc, __u16 flags,
946 	__u32 strchange_instrms, __u32 strchange_outstrms, gfp_t gfp)
947 {
948 	struct sctp_stream_change_event *schange;
949 	struct sctp_ulpevent *event;
950 	struct sk_buff *skb;
951 
952 	event = sctp_ulpevent_new(sizeof(struct sctp_stream_change_event),
953 				  MSG_NOTIFICATION, gfp);
954 	if (!event)
955 		return NULL;
956 
957 	skb = sctp_event2skb(event);
958 	schange = skb_put(skb, sizeof(struct sctp_stream_change_event));
959 
960 	schange->strchange_type = SCTP_STREAM_CHANGE_EVENT;
961 	schange->strchange_flags = flags;
962 	schange->strchange_length = sizeof(struct sctp_stream_change_event);
963 	sctp_ulpevent_set_owner(event, asoc);
964 	schange->strchange_assoc_id = sctp_assoc2id(asoc);
965 	schange->strchange_instrms = strchange_instrms;
966 	schange->strchange_outstrms = strchange_outstrms;
967 
968 	return event;
969 }
970 
971 /* Return the notification type, assuming this is a notification
972  * event.
973  */
sctp_ulpevent_get_notification_type(const struct sctp_ulpevent * event)974 __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
975 {
976 	union sctp_notification *notification;
977 	struct sk_buff *skb;
978 
979 	skb = sctp_event2skb(event);
980 	notification = (union sctp_notification *) skb->data;
981 	return notification->sn_header.sn_type;
982 }
983 
984 /* RFC6458, Section 5.3.2. SCTP Header Information Structure
985  * (SCTP_SNDRCV, DEPRECATED)
986  */
sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent * event,struct msghdr * msghdr)987 void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
988 				   struct msghdr *msghdr)
989 {
990 	struct sctp_sndrcvinfo sinfo;
991 
992 	if (sctp_ulpevent_is_notification(event))
993 		return;
994 
995 	memset(&sinfo, 0, sizeof(sinfo));
996 	sinfo.sinfo_stream = event->stream;
997 	sinfo.sinfo_ssn = event->ssn;
998 	sinfo.sinfo_ppid = event->ppid;
999 	sinfo.sinfo_flags = event->flags;
1000 	sinfo.sinfo_tsn = event->tsn;
1001 	sinfo.sinfo_cumtsn = event->cumtsn;
1002 	sinfo.sinfo_assoc_id = sctp_assoc2id(event->asoc);
1003 	/* Context value that is set via SCTP_CONTEXT socket option. */
1004 	sinfo.sinfo_context = event->asoc->default_rcv_context;
1005 	/* These fields are not used while receiving. */
1006 	sinfo.sinfo_timetolive = 0;
1007 
1008 	put_cmsg(msghdr, IPPROTO_SCTP, SCTP_SNDRCV,
1009 		 sizeof(sinfo), &sinfo);
1010 }
1011 
1012 /* RFC6458, Section 5.3.5 SCTP Receive Information Structure
1013  * (SCTP_SNDRCV)
1014  */
sctp_ulpevent_read_rcvinfo(const struct sctp_ulpevent * event,struct msghdr * msghdr)1015 void sctp_ulpevent_read_rcvinfo(const struct sctp_ulpevent *event,
1016 				struct msghdr *msghdr)
1017 {
1018 	struct sctp_rcvinfo rinfo;
1019 
1020 	if (sctp_ulpevent_is_notification(event))
1021 		return;
1022 
1023 	memset(&rinfo, 0, sizeof(struct sctp_rcvinfo));
1024 	rinfo.rcv_sid = event->stream;
1025 	rinfo.rcv_ssn = event->ssn;
1026 	rinfo.rcv_ppid = event->ppid;
1027 	rinfo.rcv_flags = event->flags;
1028 	rinfo.rcv_tsn = event->tsn;
1029 	rinfo.rcv_cumtsn = event->cumtsn;
1030 	rinfo.rcv_assoc_id = sctp_assoc2id(event->asoc);
1031 	rinfo.rcv_context = event->asoc->default_rcv_context;
1032 
1033 	put_cmsg(msghdr, IPPROTO_SCTP, SCTP_RCVINFO,
1034 		 sizeof(rinfo), &rinfo);
1035 }
1036 
1037 /* RFC6458, Section 5.3.6. SCTP Next Receive Information Structure
1038  * (SCTP_NXTINFO)
1039  */
__sctp_ulpevent_read_nxtinfo(const struct sctp_ulpevent * event,struct msghdr * msghdr,const struct sk_buff * skb)1040 static void __sctp_ulpevent_read_nxtinfo(const struct sctp_ulpevent *event,
1041 					 struct msghdr *msghdr,
1042 					 const struct sk_buff *skb)
1043 {
1044 	struct sctp_nxtinfo nxtinfo;
1045 
1046 	memset(&nxtinfo, 0, sizeof(nxtinfo));
1047 	nxtinfo.nxt_sid = event->stream;
1048 	nxtinfo.nxt_ppid = event->ppid;
1049 	nxtinfo.nxt_flags = event->flags;
1050 	if (sctp_ulpevent_is_notification(event))
1051 		nxtinfo.nxt_flags |= SCTP_NOTIFICATION;
1052 	nxtinfo.nxt_length = skb->len;
1053 	nxtinfo.nxt_assoc_id = sctp_assoc2id(event->asoc);
1054 
1055 	put_cmsg(msghdr, IPPROTO_SCTP, SCTP_NXTINFO,
1056 		 sizeof(nxtinfo), &nxtinfo);
1057 }
1058 
sctp_ulpevent_read_nxtinfo(const struct sctp_ulpevent * event,struct msghdr * msghdr,struct sock * sk)1059 void sctp_ulpevent_read_nxtinfo(const struct sctp_ulpevent *event,
1060 				struct msghdr *msghdr,
1061 				struct sock *sk)
1062 {
1063 	struct sk_buff *skb;
1064 	int err;
1065 
1066 	skb = sctp_skb_recv_datagram(sk, MSG_PEEK | MSG_DONTWAIT, &err);
1067 	if (skb != NULL) {
1068 		__sctp_ulpevent_read_nxtinfo(sctp_skb2event(skb),
1069 					     msghdr, skb);
1070 		/* Just release refcount here. */
1071 		kfree_skb(skb);
1072 	}
1073 }
1074 
1075 /* Do accounting for bytes received and hold a reference to the association
1076  * for each skb.
1077  */
sctp_ulpevent_receive_data(struct sctp_ulpevent * event,struct sctp_association * asoc)1078 static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
1079 				       struct sctp_association *asoc)
1080 {
1081 	struct sk_buff *skb, *frag;
1082 
1083 	skb = sctp_event2skb(event);
1084 	/* Set the owner and charge rwnd for bytes received.  */
1085 	sctp_ulpevent_set_owner(event, asoc);
1086 	sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
1087 
1088 	if (!skb->data_len)
1089 		return;
1090 
1091 	/* Note:  Not clearing the entire event struct as this is just a
1092 	 * fragment of the real event.  However, we still need to do rwnd
1093 	 * accounting.
1094 	 * In general, the skb passed from IP can have only 1 level of
1095 	 * fragments. But we allow multiple levels of fragments.
1096 	 */
1097 	skb_walk_frags(skb, frag)
1098 		sctp_ulpevent_receive_data(sctp_skb2event(frag), asoc);
1099 }
1100 
1101 /* Do accounting for bytes just read by user and release the references to
1102  * the association.
1103  */
sctp_ulpevent_release_data(struct sctp_ulpevent * event)1104 static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
1105 {
1106 	struct sk_buff *skb, *frag;
1107 	unsigned int	len;
1108 
1109 	/* Current stack structures assume that the rcv buffer is
1110 	 * per socket.   For UDP style sockets this is not true as
1111 	 * multiple associations may be on a single UDP-style socket.
1112 	 * Use the local private area of the skb to track the owning
1113 	 * association.
1114 	 */
1115 
1116 	skb = sctp_event2skb(event);
1117 	len = skb->len;
1118 
1119 	if (!skb->data_len)
1120 		goto done;
1121 
1122 	/* Don't forget the fragments. */
1123 	skb_walk_frags(skb, frag) {
1124 		/* NOTE:  skb_shinfos are recursive. Although IP returns
1125 		 * skb's with only 1 level of fragments, SCTP reassembly can
1126 		 * increase the levels.
1127 		 */
1128 		sctp_ulpevent_release_frag_data(sctp_skb2event(frag));
1129 	}
1130 
1131 done:
1132 	sctp_assoc_rwnd_increase(event->asoc, len);
1133 	sctp_chunk_put(event->chunk);
1134 	sctp_ulpevent_release_owner(event);
1135 }
1136 
sctp_ulpevent_release_frag_data(struct sctp_ulpevent * event)1137 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
1138 {
1139 	struct sk_buff *skb, *frag;
1140 
1141 	skb = sctp_event2skb(event);
1142 
1143 	if (!skb->data_len)
1144 		goto done;
1145 
1146 	/* Don't forget the fragments. */
1147 	skb_walk_frags(skb, frag) {
1148 		/* NOTE:  skb_shinfos are recursive. Although IP returns
1149 		 * skb's with only 1 level of fragments, SCTP reassembly can
1150 		 * increase the levels.
1151 		 */
1152 		sctp_ulpevent_release_frag_data(sctp_skb2event(frag));
1153 	}
1154 
1155 done:
1156 	sctp_chunk_put(event->chunk);
1157 	sctp_ulpevent_release_owner(event);
1158 }
1159 
1160 /* Free a ulpevent that has an owner.  It includes releasing the reference
1161  * to the owner, updating the rwnd in case of a DATA event and freeing the
1162  * skb.
1163  */
sctp_ulpevent_free(struct sctp_ulpevent * event)1164 void sctp_ulpevent_free(struct sctp_ulpevent *event)
1165 {
1166 	if (sctp_ulpevent_is_notification(event))
1167 		sctp_ulpevent_release_owner(event);
1168 	else
1169 		sctp_ulpevent_release_data(event);
1170 
1171 	kfree_skb(sctp_event2skb(event));
1172 }
1173 
1174 /* Purge the skb lists holding ulpevents. */
sctp_queue_purge_ulpevents(struct sk_buff_head * list)1175 unsigned int sctp_queue_purge_ulpevents(struct sk_buff_head *list)
1176 {
1177 	struct sk_buff *skb;
1178 	unsigned int data_unread = 0;
1179 
1180 	while ((skb = skb_dequeue(list)) != NULL) {
1181 		struct sctp_ulpevent *event = sctp_skb2event(skb);
1182 
1183 		if (!sctp_ulpevent_is_notification(event))
1184 			data_unread += skb->len;
1185 
1186 		sctp_ulpevent_free(event);
1187 	}
1188 
1189 	return data_unread;
1190 }
1191