1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2017 - 2018 Covalent IO, Inc. http://covalent.io */
3 
4 #include <linux/skmsg.h>
5 #include <linux/skbuff.h>
6 #include <linux/scatterlist.h>
7 
8 #include <net/sock.h>
9 #include <net/tcp.h>
10 #include <net/tls.h>
11 
sk_msg_try_coalesce_ok(struct sk_msg * msg,int elem_first_coalesce)12 static bool sk_msg_try_coalesce_ok(struct sk_msg *msg, int elem_first_coalesce)
13 {
14 	if (msg->sg.end > msg->sg.start &&
15 	    elem_first_coalesce < msg->sg.end)
16 		return true;
17 
18 	if (msg->sg.end < msg->sg.start &&
19 	    (elem_first_coalesce > msg->sg.start ||
20 	     elem_first_coalesce < msg->sg.end))
21 		return true;
22 
23 	return false;
24 }
25 
sk_msg_alloc(struct sock * sk,struct sk_msg * msg,int len,int elem_first_coalesce)26 int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
27 		 int elem_first_coalesce)
28 {
29 	struct page_frag *pfrag = sk_page_frag(sk);
30 	u32 osize = msg->sg.size;
31 	int ret = 0;
32 
33 	len -= msg->sg.size;
34 	while (len > 0) {
35 		struct scatterlist *sge;
36 		u32 orig_offset;
37 		int use, i;
38 
39 		if (!sk_page_frag_refill(sk, pfrag)) {
40 			ret = -ENOMEM;
41 			goto msg_trim;
42 		}
43 
44 		orig_offset = pfrag->offset;
45 		use = min_t(int, len, pfrag->size - orig_offset);
46 		if (!sk_wmem_schedule(sk, use)) {
47 			ret = -ENOMEM;
48 			goto msg_trim;
49 		}
50 
51 		i = msg->sg.end;
52 		sk_msg_iter_var_prev(i);
53 		sge = &msg->sg.data[i];
54 
55 		if (sk_msg_try_coalesce_ok(msg, elem_first_coalesce) &&
56 		    sg_page(sge) == pfrag->page &&
57 		    sge->offset + sge->length == orig_offset) {
58 			sge->length += use;
59 		} else {
60 			if (sk_msg_full(msg)) {
61 				ret = -ENOSPC;
62 				break;
63 			}
64 
65 			sge = &msg->sg.data[msg->sg.end];
66 			sg_unmark_end(sge);
67 			sg_set_page(sge, pfrag->page, use, orig_offset);
68 			get_page(pfrag->page);
69 			sk_msg_iter_next(msg, end);
70 		}
71 
72 		sk_mem_charge(sk, use);
73 		msg->sg.size += use;
74 		pfrag->offset += use;
75 		len -= use;
76 	}
77 
78 	return ret;
79 
80 msg_trim:
81 	sk_msg_trim(sk, msg, osize);
82 	return ret;
83 }
84 EXPORT_SYMBOL_GPL(sk_msg_alloc);
85 
sk_msg_clone(struct sock * sk,struct sk_msg * dst,struct sk_msg * src,u32 off,u32 len)86 int sk_msg_clone(struct sock *sk, struct sk_msg *dst, struct sk_msg *src,
87 		 u32 off, u32 len)
88 {
89 	int i = src->sg.start;
90 	struct scatterlist *sge = sk_msg_elem(src, i);
91 	struct scatterlist *sgd = NULL;
92 	u32 sge_len, sge_off;
93 
94 	while (off) {
95 		if (sge->length > off)
96 			break;
97 		off -= sge->length;
98 		sk_msg_iter_var_next(i);
99 		if (i == src->sg.end && off)
100 			return -ENOSPC;
101 		sge = sk_msg_elem(src, i);
102 	}
103 
104 	while (len) {
105 		sge_len = sge->length - off;
106 		if (sge_len > len)
107 			sge_len = len;
108 
109 		if (dst->sg.end)
110 			sgd = sk_msg_elem(dst, dst->sg.end - 1);
111 
112 		if (sgd &&
113 		    (sg_page(sge) == sg_page(sgd)) &&
114 		    (sg_virt(sge) + off == sg_virt(sgd) + sgd->length)) {
115 			sgd->length += sge_len;
116 			dst->sg.size += sge_len;
117 		} else if (!sk_msg_full(dst)) {
118 			sge_off = sge->offset + off;
119 			sk_msg_page_add(dst, sg_page(sge), sge_len, sge_off);
120 		} else {
121 			return -ENOSPC;
122 		}
123 
124 		off = 0;
125 		len -= sge_len;
126 		sk_mem_charge(sk, sge_len);
127 		sk_msg_iter_var_next(i);
128 		if (i == src->sg.end && len)
129 			return -ENOSPC;
130 		sge = sk_msg_elem(src, i);
131 	}
132 
133 	return 0;
134 }
135 EXPORT_SYMBOL_GPL(sk_msg_clone);
136 
sk_msg_return_zero(struct sock * sk,struct sk_msg * msg,int bytes)137 void sk_msg_return_zero(struct sock *sk, struct sk_msg *msg, int bytes)
138 {
139 	int i = msg->sg.start;
140 
141 	do {
142 		struct scatterlist *sge = sk_msg_elem(msg, i);
143 
144 		if (bytes < sge->length) {
145 			sge->length -= bytes;
146 			sge->offset += bytes;
147 			sk_mem_uncharge(sk, bytes);
148 			break;
149 		}
150 
151 		sk_mem_uncharge(sk, sge->length);
152 		bytes -= sge->length;
153 		sge->length = 0;
154 		sge->offset = 0;
155 		sk_msg_iter_var_next(i);
156 	} while (bytes && i != msg->sg.end);
157 	msg->sg.start = i;
158 }
159 EXPORT_SYMBOL_GPL(sk_msg_return_zero);
160 
sk_msg_return(struct sock * sk,struct sk_msg * msg,int bytes)161 void sk_msg_return(struct sock *sk, struct sk_msg *msg, int bytes)
162 {
163 	int i = msg->sg.start;
164 
165 	do {
166 		struct scatterlist *sge = &msg->sg.data[i];
167 		int uncharge = (bytes < sge->length) ? bytes : sge->length;
168 
169 		sk_mem_uncharge(sk, uncharge);
170 		bytes -= uncharge;
171 		sk_msg_iter_var_next(i);
172 	} while (i != msg->sg.end);
173 }
174 EXPORT_SYMBOL_GPL(sk_msg_return);
175 
sk_msg_free_elem(struct sock * sk,struct sk_msg * msg,u32 i,bool charge)176 static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
177 			    bool charge)
178 {
179 	struct scatterlist *sge = sk_msg_elem(msg, i);
180 	u32 len = sge->length;
181 
182 	/* When the skb owns the memory we free it from consume_skb path. */
183 	if (!msg->skb) {
184 		if (charge)
185 			sk_mem_uncharge(sk, len);
186 		put_page(sg_page(sge));
187 	}
188 	memset(sge, 0, sizeof(*sge));
189 	return len;
190 }
191 
__sk_msg_free(struct sock * sk,struct sk_msg * msg,u32 i,bool charge)192 static int __sk_msg_free(struct sock *sk, struct sk_msg *msg, u32 i,
193 			 bool charge)
194 {
195 	struct scatterlist *sge = sk_msg_elem(msg, i);
196 	int freed = 0;
197 
198 	while (msg->sg.size) {
199 		msg->sg.size -= sge->length;
200 		freed += sk_msg_free_elem(sk, msg, i, charge);
201 		sk_msg_iter_var_next(i);
202 		sk_msg_check_to_free(msg, i, msg->sg.size);
203 		sge = sk_msg_elem(msg, i);
204 	}
205 	consume_skb(msg->skb);
206 	sk_msg_init(msg);
207 	return freed;
208 }
209 
sk_msg_free_nocharge(struct sock * sk,struct sk_msg * msg)210 int sk_msg_free_nocharge(struct sock *sk, struct sk_msg *msg)
211 {
212 	return __sk_msg_free(sk, msg, msg->sg.start, false);
213 }
214 EXPORT_SYMBOL_GPL(sk_msg_free_nocharge);
215 
sk_msg_free(struct sock * sk,struct sk_msg * msg)216 int sk_msg_free(struct sock *sk, struct sk_msg *msg)
217 {
218 	return __sk_msg_free(sk, msg, msg->sg.start, true);
219 }
220 EXPORT_SYMBOL_GPL(sk_msg_free);
221 
__sk_msg_free_partial(struct sock * sk,struct sk_msg * msg,u32 bytes,bool charge)222 static void __sk_msg_free_partial(struct sock *sk, struct sk_msg *msg,
223 				  u32 bytes, bool charge)
224 {
225 	struct scatterlist *sge;
226 	u32 i = msg->sg.start;
227 
228 	while (bytes) {
229 		sge = sk_msg_elem(msg, i);
230 		if (!sge->length)
231 			break;
232 		if (bytes < sge->length) {
233 			if (charge)
234 				sk_mem_uncharge(sk, bytes);
235 			sge->length -= bytes;
236 			sge->offset += bytes;
237 			msg->sg.size -= bytes;
238 			break;
239 		}
240 
241 		msg->sg.size -= sge->length;
242 		bytes -= sge->length;
243 		sk_msg_free_elem(sk, msg, i, charge);
244 		sk_msg_iter_var_next(i);
245 		sk_msg_check_to_free(msg, i, bytes);
246 	}
247 	msg->sg.start = i;
248 }
249 
sk_msg_free_partial(struct sock * sk,struct sk_msg * msg,u32 bytes)250 void sk_msg_free_partial(struct sock *sk, struct sk_msg *msg, u32 bytes)
251 {
252 	__sk_msg_free_partial(sk, msg, bytes, true);
253 }
254 EXPORT_SYMBOL_GPL(sk_msg_free_partial);
255 
sk_msg_free_partial_nocharge(struct sock * sk,struct sk_msg * msg,u32 bytes)256 void sk_msg_free_partial_nocharge(struct sock *sk, struct sk_msg *msg,
257 				  u32 bytes)
258 {
259 	__sk_msg_free_partial(sk, msg, bytes, false);
260 }
261 
sk_msg_trim(struct sock * sk,struct sk_msg * msg,int len)262 void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
263 {
264 	int trim = msg->sg.size - len;
265 	u32 i = msg->sg.end;
266 
267 	if (trim <= 0) {
268 		WARN_ON(trim < 0);
269 		return;
270 	}
271 
272 	sk_msg_iter_var_prev(i);
273 	msg->sg.size = len;
274 	while (msg->sg.data[i].length &&
275 	       trim >= msg->sg.data[i].length) {
276 		trim -= msg->sg.data[i].length;
277 		sk_msg_free_elem(sk, msg, i, true);
278 		sk_msg_iter_var_prev(i);
279 		if (!trim)
280 			goto out;
281 	}
282 
283 	msg->sg.data[i].length -= trim;
284 	sk_mem_uncharge(sk, trim);
285 	/* Adjust copybreak if it falls into the trimmed part of last buf */
286 	if (msg->sg.curr == i && msg->sg.copybreak > msg->sg.data[i].length)
287 		msg->sg.copybreak = msg->sg.data[i].length;
288 out:
289 	sk_msg_iter_var_next(i);
290 	msg->sg.end = i;
291 
292 	/* If we trim data a full sg elem before curr pointer update
293 	 * copybreak and current so that any future copy operations
294 	 * start at new copy location.
295 	 * However trimed data that has not yet been used in a copy op
296 	 * does not require an update.
297 	 */
298 	if (!msg->sg.size) {
299 		msg->sg.curr = msg->sg.start;
300 		msg->sg.copybreak = 0;
301 	} else if (sk_msg_iter_dist(msg->sg.start, msg->sg.curr) >=
302 		   sk_msg_iter_dist(msg->sg.start, msg->sg.end)) {
303 		sk_msg_iter_var_prev(i);
304 		msg->sg.curr = i;
305 		msg->sg.copybreak = msg->sg.data[i].length;
306 	}
307 }
308 EXPORT_SYMBOL_GPL(sk_msg_trim);
309 
sk_msg_zerocopy_from_iter(struct sock * sk,struct iov_iter * from,struct sk_msg * msg,u32 bytes)310 int sk_msg_zerocopy_from_iter(struct sock *sk, struct iov_iter *from,
311 			      struct sk_msg *msg, u32 bytes)
312 {
313 	int i, maxpages, ret = 0, num_elems = sk_msg_elem_used(msg);
314 	const int to_max_pages = MAX_MSG_FRAGS;
315 	struct page *pages[MAX_MSG_FRAGS];
316 	ssize_t orig, copied, use, offset;
317 
318 	orig = msg->sg.size;
319 	while (bytes > 0) {
320 		i = 0;
321 		maxpages = to_max_pages - num_elems;
322 		if (maxpages == 0) {
323 			ret = -EFAULT;
324 			goto out;
325 		}
326 
327 		copied = iov_iter_get_pages(from, pages, bytes, maxpages,
328 					    &offset);
329 		if (copied <= 0) {
330 			ret = -EFAULT;
331 			goto out;
332 		}
333 
334 		iov_iter_advance(from, copied);
335 		bytes -= copied;
336 		msg->sg.size += copied;
337 
338 		while (copied) {
339 			use = min_t(int, copied, PAGE_SIZE - offset);
340 			sg_set_page(&msg->sg.data[msg->sg.end],
341 				    pages[i], use, offset);
342 			sg_unmark_end(&msg->sg.data[msg->sg.end]);
343 			sk_mem_charge(sk, use);
344 
345 			offset = 0;
346 			copied -= use;
347 			sk_msg_iter_next(msg, end);
348 			num_elems++;
349 			i++;
350 		}
351 		/* When zerocopy is mixed with sk_msg_*copy* operations we
352 		 * may have a copybreak set in this case clear and prefer
353 		 * zerocopy remainder when possible.
354 		 */
355 		msg->sg.copybreak = 0;
356 		msg->sg.curr = msg->sg.end;
357 	}
358 out:
359 	/* Revert iov_iter updates, msg will need to use 'trim' later if it
360 	 * also needs to be cleared.
361 	 */
362 	if (ret)
363 		iov_iter_revert(from, msg->sg.size - orig);
364 	return ret;
365 }
366 EXPORT_SYMBOL_GPL(sk_msg_zerocopy_from_iter);
367 
sk_msg_memcopy_from_iter(struct sock * sk,struct iov_iter * from,struct sk_msg * msg,u32 bytes)368 int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from,
369 			     struct sk_msg *msg, u32 bytes)
370 {
371 	int ret = -ENOSPC, i = msg->sg.curr;
372 	struct scatterlist *sge;
373 	u32 copy, buf_size;
374 	void *to;
375 
376 	do {
377 		sge = sk_msg_elem(msg, i);
378 		/* This is possible if a trim operation shrunk the buffer */
379 		if (msg->sg.copybreak >= sge->length) {
380 			msg->sg.copybreak = 0;
381 			sk_msg_iter_var_next(i);
382 			if (i == msg->sg.end)
383 				break;
384 			sge = sk_msg_elem(msg, i);
385 		}
386 
387 		buf_size = sge->length - msg->sg.copybreak;
388 		copy = (buf_size > bytes) ? bytes : buf_size;
389 		to = sg_virt(sge) + msg->sg.copybreak;
390 		msg->sg.copybreak += copy;
391 		if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY)
392 			ret = copy_from_iter_nocache(to, copy, from);
393 		else
394 			ret = copy_from_iter(to, copy, from);
395 		if (ret != copy) {
396 			ret = -EFAULT;
397 			goto out;
398 		}
399 		bytes -= copy;
400 		if (!bytes)
401 			break;
402 		msg->sg.copybreak = 0;
403 		sk_msg_iter_var_next(i);
404 	} while (i != msg->sg.end);
405 out:
406 	msg->sg.curr = i;
407 	return ret;
408 }
409 EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
410 
411 /* Receive sk_msg from psock->ingress_msg to @msg. */
sk_msg_recvmsg(struct sock * sk,struct sk_psock * psock,struct msghdr * msg,int len,int flags)412 int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
413 		   int len, int flags)
414 {
415 	struct iov_iter *iter = &msg->msg_iter;
416 	int peek = flags & MSG_PEEK;
417 	struct sk_msg *msg_rx;
418 	int i, copied = 0;
419 
420 	msg_rx = sk_psock_peek_msg(psock);
421 	while (copied != len) {
422 		struct scatterlist *sge;
423 
424 		if (unlikely(!msg_rx))
425 			break;
426 
427 		i = msg_rx->sg.start;
428 		do {
429 			struct page *page;
430 			int copy;
431 
432 			sge = sk_msg_elem(msg_rx, i);
433 			copy = sge->length;
434 			page = sg_page(sge);
435 			if (copied + copy > len)
436 				copy = len - copied;
437 			copy = copy_page_to_iter(page, sge->offset, copy, iter);
438 			if (!copy)
439 				return copied ? copied : -EFAULT;
440 
441 			copied += copy;
442 			if (likely(!peek)) {
443 				sge->offset += copy;
444 				sge->length -= copy;
445 				if (!msg_rx->skb)
446 					sk_mem_uncharge(sk, copy);
447 				msg_rx->sg.size -= copy;
448 
449 				if (!sge->length) {
450 					sk_msg_iter_var_next(i);
451 					if (!msg_rx->skb)
452 						put_page(page);
453 				}
454 			} else {
455 				/* Lets not optimize peek case if copy_page_to_iter
456 				 * didn't copy the entire length lets just break.
457 				 */
458 				if (copy != sge->length)
459 					return copied;
460 				sk_msg_iter_var_next(i);
461 			}
462 
463 			if (copied == len)
464 				break;
465 		} while ((i != msg_rx->sg.end) && !sg_is_last(sge));
466 
467 		if (unlikely(peek)) {
468 			msg_rx = sk_psock_next_msg(psock, msg_rx);
469 			if (!msg_rx)
470 				break;
471 			continue;
472 		}
473 
474 		msg_rx->sg.start = i;
475 		if (!sge->length && (i == msg_rx->sg.end || sg_is_last(sge))) {
476 			msg_rx = sk_psock_dequeue_msg(psock);
477 			kfree_sk_msg(msg_rx);
478 		}
479 		msg_rx = sk_psock_peek_msg(psock);
480 	}
481 
482 	return copied;
483 }
484 EXPORT_SYMBOL_GPL(sk_msg_recvmsg);
485 
sk_msg_is_readable(struct sock * sk)486 bool sk_msg_is_readable(struct sock *sk)
487 {
488 	struct sk_psock *psock;
489 	bool empty = true;
490 
491 	rcu_read_lock();
492 	psock = sk_psock(sk);
493 	if (likely(psock))
494 		empty = list_empty(&psock->ingress_msg);
495 	rcu_read_unlock();
496 	return !empty;
497 }
498 EXPORT_SYMBOL_GPL(sk_msg_is_readable);
499 
sk_psock_create_ingress_msg(struct sock * sk,struct sk_buff * skb)500 static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
501 						  struct sk_buff *skb)
502 {
503 	struct sk_msg *msg;
504 
505 	if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
506 		return NULL;
507 
508 	if (!sk_rmem_schedule(sk, skb, skb->truesize))
509 		return NULL;
510 
511 	msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_KERNEL);
512 	if (unlikely(!msg))
513 		return NULL;
514 
515 	sk_msg_init(msg);
516 	return msg;
517 }
518 
sk_psock_skb_ingress_enqueue(struct sk_buff * skb,u32 off,u32 len,struct sk_psock * psock,struct sock * sk,struct sk_msg * msg)519 static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
520 					u32 off, u32 len,
521 					struct sk_psock *psock,
522 					struct sock *sk,
523 					struct sk_msg *msg)
524 {
525 	int num_sge, copied;
526 
527 	num_sge = skb_to_sgvec(skb, msg->sg.data, off, len);
528 	if (num_sge < 0) {
529 		/* skb linearize may fail with ENOMEM, but lets simply try again
530 		 * later if this happens. Under memory pressure we don't want to
531 		 * drop the skb. We need to linearize the skb so that the mapping
532 		 * in skb_to_sgvec can not error.
533 		 */
534 		if (skb_linearize(skb))
535 			return -EAGAIN;
536 
537 		num_sge = skb_to_sgvec(skb, msg->sg.data, off, len);
538 		if (unlikely(num_sge < 0))
539 			return num_sge;
540 	}
541 
542 	copied = len;
543 	msg->sg.start = 0;
544 	msg->sg.size = copied;
545 	msg->sg.end = num_sge;
546 	msg->skb = skb;
547 
548 	sk_psock_queue_msg(psock, msg);
549 	sk_psock_data_ready(sk, psock);
550 	return copied;
551 }
552 
553 static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb,
554 				     u32 off, u32 len);
555 
sk_psock_skb_ingress(struct sk_psock * psock,struct sk_buff * skb,u32 off,u32 len)556 static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb,
557 				u32 off, u32 len)
558 {
559 	struct sock *sk = psock->sk;
560 	struct sk_msg *msg;
561 	int err;
562 
563 	/* If we are receiving on the same sock skb->sk is already assigned,
564 	 * skip memory accounting and owner transition seeing it already set
565 	 * correctly.
566 	 */
567 	if (unlikely(skb->sk == sk))
568 		return sk_psock_skb_ingress_self(psock, skb, off, len);
569 	msg = sk_psock_create_ingress_msg(sk, skb);
570 	if (!msg)
571 		return -EAGAIN;
572 
573 	/* This will transition ownership of the data from the socket where
574 	 * the BPF program was run initiating the redirect to the socket
575 	 * we will eventually receive this data on. The data will be released
576 	 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
577 	 * into user buffers.
578 	 */
579 	skb_set_owner_r(skb, sk);
580 	err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg);
581 	if (err < 0)
582 		kfree(msg);
583 	return err;
584 }
585 
586 /* Puts an skb on the ingress queue of the socket already assigned to the
587  * skb. In this case we do not need to check memory limits or skb_set_owner_r
588  * because the skb is already accounted for here.
589  */
sk_psock_skb_ingress_self(struct sk_psock * psock,struct sk_buff * skb,u32 off,u32 len)590 static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb,
591 				     u32 off, u32 len)
592 {
593 	struct sk_msg *msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
594 	struct sock *sk = psock->sk;
595 	int err;
596 
597 	if (unlikely(!msg))
598 		return -EAGAIN;
599 	sk_msg_init(msg);
600 	skb_set_owner_r(skb, sk);
601 	err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg);
602 	if (err < 0)
603 		kfree(msg);
604 	return err;
605 }
606 
sk_psock_handle_skb(struct sk_psock * psock,struct sk_buff * skb,u32 off,u32 len,bool ingress)607 static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
608 			       u32 off, u32 len, bool ingress)
609 {
610 	if (!ingress) {
611 		if (!sock_writeable(psock->sk))
612 			return -EAGAIN;
613 		return skb_send_sock(psock->sk, skb, off, len);
614 	}
615 	return sk_psock_skb_ingress(psock, skb, off, len);
616 }
617 
sk_psock_skb_state(struct sk_psock * psock,struct sk_psock_work_state * state,struct sk_buff * skb,int len,int off)618 static void sk_psock_skb_state(struct sk_psock *psock,
619 			       struct sk_psock_work_state *state,
620 			       struct sk_buff *skb,
621 			       int len, int off)
622 {
623 	spin_lock_bh(&psock->ingress_lock);
624 	if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
625 		state->skb = skb;
626 		state->len = len;
627 		state->off = off;
628 	} else {
629 		sock_drop(psock->sk, skb);
630 	}
631 	spin_unlock_bh(&psock->ingress_lock);
632 }
633 
sk_psock_backlog(struct work_struct * work)634 static void sk_psock_backlog(struct work_struct *work)
635 {
636 	struct sk_psock *psock = container_of(work, struct sk_psock, work);
637 	struct sk_psock_work_state *state = &psock->work_state;
638 	struct sk_buff *skb = NULL;
639 	bool ingress;
640 	u32 len, off;
641 	int ret;
642 
643 	mutex_lock(&psock->work_mutex);
644 	if (unlikely(state->skb)) {
645 		spin_lock_bh(&psock->ingress_lock);
646 		skb = state->skb;
647 		len = state->len;
648 		off = state->off;
649 		state->skb = NULL;
650 		spin_unlock_bh(&psock->ingress_lock);
651 	}
652 	if (skb)
653 		goto start;
654 
655 	while ((skb = skb_dequeue(&psock->ingress_skb))) {
656 		len = skb->len;
657 		off = 0;
658 		if (skb_bpf_strparser(skb)) {
659 			struct strp_msg *stm = strp_msg(skb);
660 
661 			off = stm->offset;
662 			len = stm->full_len;
663 		}
664 start:
665 		ingress = skb_bpf_ingress(skb);
666 		skb_bpf_redirect_clear(skb);
667 		do {
668 			ret = -EIO;
669 			if (!sock_flag(psock->sk, SOCK_DEAD))
670 				ret = sk_psock_handle_skb(psock, skb, off,
671 							  len, ingress);
672 			if (ret <= 0) {
673 				if (ret == -EAGAIN) {
674 					sk_psock_skb_state(psock, state, skb,
675 							   len, off);
676 					goto end;
677 				}
678 				/* Hard errors break pipe and stop xmit. */
679 				sk_psock_report_error(psock, ret ? -ret : EPIPE);
680 				sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
681 				sock_drop(psock->sk, skb);
682 				goto end;
683 			}
684 			off += ret;
685 			len -= ret;
686 		} while (len);
687 
688 		if (!ingress)
689 			kfree_skb(skb);
690 	}
691 end:
692 	mutex_unlock(&psock->work_mutex);
693 }
694 
sk_psock_init(struct sock * sk,int node)695 struct sk_psock *sk_psock_init(struct sock *sk, int node)
696 {
697 	struct sk_psock *psock;
698 	struct proto *prot;
699 
700 	write_lock_bh(&sk->sk_callback_lock);
701 
702 	if (sk_is_inet(sk) && inet_csk_has_ulp(sk)) {
703 		psock = ERR_PTR(-EINVAL);
704 		goto out;
705 	}
706 
707 	if (sk->sk_user_data) {
708 		psock = ERR_PTR(-EBUSY);
709 		goto out;
710 	}
711 
712 	psock = kzalloc_node(sizeof(*psock), GFP_ATOMIC | __GFP_NOWARN, node);
713 	if (!psock) {
714 		psock = ERR_PTR(-ENOMEM);
715 		goto out;
716 	}
717 
718 	prot = READ_ONCE(sk->sk_prot);
719 	psock->sk = sk;
720 	psock->eval = __SK_NONE;
721 	psock->sk_proto = prot;
722 	psock->saved_unhash = prot->unhash;
723 	psock->saved_close = prot->close;
724 	psock->saved_write_space = sk->sk_write_space;
725 
726 	INIT_LIST_HEAD(&psock->link);
727 	spin_lock_init(&psock->link_lock);
728 
729 	INIT_WORK(&psock->work, sk_psock_backlog);
730 	mutex_init(&psock->work_mutex);
731 	INIT_LIST_HEAD(&psock->ingress_msg);
732 	spin_lock_init(&psock->ingress_lock);
733 	skb_queue_head_init(&psock->ingress_skb);
734 
735 	sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
736 	refcount_set(&psock->refcnt, 1);
737 
738 	__rcu_assign_sk_user_data_with_flags(sk, psock,
739 					     SK_USER_DATA_NOCOPY |
740 					     SK_USER_DATA_PSOCK);
741 	sock_hold(sk);
742 
743 out:
744 	write_unlock_bh(&sk->sk_callback_lock);
745 	return psock;
746 }
747 EXPORT_SYMBOL_GPL(sk_psock_init);
748 
sk_psock_link_pop(struct sk_psock * psock)749 struct sk_psock_link *sk_psock_link_pop(struct sk_psock *psock)
750 {
751 	struct sk_psock_link *link;
752 
753 	spin_lock_bh(&psock->link_lock);
754 	link = list_first_entry_or_null(&psock->link, struct sk_psock_link,
755 					list);
756 	if (link)
757 		list_del(&link->list);
758 	spin_unlock_bh(&psock->link_lock);
759 	return link;
760 }
761 
__sk_psock_purge_ingress_msg(struct sk_psock * psock)762 static void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
763 {
764 	struct sk_msg *msg, *tmp;
765 
766 	list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
767 		list_del(&msg->list);
768 		sk_msg_free(psock->sk, msg);
769 		kfree(msg);
770 	}
771 }
772 
__sk_psock_zap_ingress(struct sk_psock * psock)773 static void __sk_psock_zap_ingress(struct sk_psock *psock)
774 {
775 	struct sk_buff *skb;
776 
777 	while ((skb = skb_dequeue(&psock->ingress_skb)) != NULL) {
778 		skb_bpf_redirect_clear(skb);
779 		sock_drop(psock->sk, skb);
780 	}
781 	kfree_skb(psock->work_state.skb);
782 	/* We null the skb here to ensure that calls to sk_psock_backlog
783 	 * do not pick up the free'd skb.
784 	 */
785 	psock->work_state.skb = NULL;
786 	__sk_psock_purge_ingress_msg(psock);
787 }
788 
sk_psock_link_destroy(struct sk_psock * psock)789 static void sk_psock_link_destroy(struct sk_psock *psock)
790 {
791 	struct sk_psock_link *link, *tmp;
792 
793 	list_for_each_entry_safe(link, tmp, &psock->link, list) {
794 		list_del(&link->list);
795 		sk_psock_free_link(link);
796 	}
797 }
798 
sk_psock_stop(struct sk_psock * psock,bool wait)799 void sk_psock_stop(struct sk_psock *psock, bool wait)
800 {
801 	spin_lock_bh(&psock->ingress_lock);
802 	sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
803 	sk_psock_cork_free(psock);
804 	__sk_psock_zap_ingress(psock);
805 	spin_unlock_bh(&psock->ingress_lock);
806 
807 	if (wait)
808 		cancel_work_sync(&psock->work);
809 }
810 
811 static void sk_psock_done_strp(struct sk_psock *psock);
812 
sk_psock_destroy(struct work_struct * work)813 static void sk_psock_destroy(struct work_struct *work)
814 {
815 	struct sk_psock *psock = container_of(to_rcu_work(work),
816 					      struct sk_psock, rwork);
817 	/* No sk_callback_lock since already detached. */
818 
819 	sk_psock_done_strp(psock);
820 
821 	cancel_work_sync(&psock->work);
822 	mutex_destroy(&psock->work_mutex);
823 
824 	psock_progs_drop(&psock->progs);
825 
826 	sk_psock_link_destroy(psock);
827 	sk_psock_cork_free(psock);
828 
829 	if (psock->sk_redir)
830 		sock_put(psock->sk_redir);
831 	sock_put(psock->sk);
832 	kfree(psock);
833 }
834 
sk_psock_drop(struct sock * sk,struct sk_psock * psock)835 void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
836 {
837 	write_lock_bh(&sk->sk_callback_lock);
838 	sk_psock_restore_proto(sk, psock);
839 	rcu_assign_sk_user_data(sk, NULL);
840 	if (psock->progs.stream_parser)
841 		sk_psock_stop_strp(sk, psock);
842 	else if (psock->progs.stream_verdict || psock->progs.skb_verdict)
843 		sk_psock_stop_verdict(sk, psock);
844 	write_unlock_bh(&sk->sk_callback_lock);
845 
846 	sk_psock_stop(psock, false);
847 
848 	INIT_RCU_WORK(&psock->rwork, sk_psock_destroy);
849 	queue_rcu_work(system_wq, &psock->rwork);
850 }
851 EXPORT_SYMBOL_GPL(sk_psock_drop);
852 
sk_psock_map_verd(int verdict,bool redir)853 static int sk_psock_map_verd(int verdict, bool redir)
854 {
855 	switch (verdict) {
856 	case SK_PASS:
857 		return redir ? __SK_REDIRECT : __SK_PASS;
858 	case SK_DROP:
859 	default:
860 		break;
861 	}
862 
863 	return __SK_DROP;
864 }
865 
sk_psock_msg_verdict(struct sock * sk,struct sk_psock * psock,struct sk_msg * msg)866 int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
867 			 struct sk_msg *msg)
868 {
869 	struct bpf_prog *prog;
870 	int ret;
871 
872 	rcu_read_lock();
873 	prog = READ_ONCE(psock->progs.msg_parser);
874 	if (unlikely(!prog)) {
875 		ret = __SK_PASS;
876 		goto out;
877 	}
878 
879 	sk_msg_compute_data_pointers(msg);
880 	msg->sk = sk;
881 	ret = bpf_prog_run_pin_on_cpu(prog, msg);
882 	ret = sk_psock_map_verd(ret, msg->sk_redir);
883 	psock->apply_bytes = msg->apply_bytes;
884 	if (ret == __SK_REDIRECT) {
885 		if (psock->sk_redir)
886 			sock_put(psock->sk_redir);
887 		psock->sk_redir = msg->sk_redir;
888 		if (!psock->sk_redir) {
889 			ret = __SK_DROP;
890 			goto out;
891 		}
892 		sock_hold(psock->sk_redir);
893 	}
894 out:
895 	rcu_read_unlock();
896 	return ret;
897 }
898 EXPORT_SYMBOL_GPL(sk_psock_msg_verdict);
899 
sk_psock_skb_redirect(struct sk_psock * from,struct sk_buff * skb)900 static int sk_psock_skb_redirect(struct sk_psock *from, struct sk_buff *skb)
901 {
902 	struct sk_psock *psock_other;
903 	struct sock *sk_other;
904 
905 	sk_other = skb_bpf_redirect_fetch(skb);
906 	/* This error is a buggy BPF program, it returned a redirect
907 	 * return code, but then didn't set a redirect interface.
908 	 */
909 	if (unlikely(!sk_other)) {
910 		skb_bpf_redirect_clear(skb);
911 		sock_drop(from->sk, skb);
912 		return -EIO;
913 	}
914 	psock_other = sk_psock(sk_other);
915 	/* This error indicates the socket is being torn down or had another
916 	 * error that caused the pipe to break. We can't send a packet on
917 	 * a socket that is in this state so we drop the skb.
918 	 */
919 	if (!psock_other || sock_flag(sk_other, SOCK_DEAD)) {
920 		skb_bpf_redirect_clear(skb);
921 		sock_drop(from->sk, skb);
922 		return -EIO;
923 	}
924 	spin_lock_bh(&psock_other->ingress_lock);
925 	if (!sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED)) {
926 		spin_unlock_bh(&psock_other->ingress_lock);
927 		skb_bpf_redirect_clear(skb);
928 		sock_drop(from->sk, skb);
929 		return -EIO;
930 	}
931 
932 	skb_queue_tail(&psock_other->ingress_skb, skb);
933 	schedule_work(&psock_other->work);
934 	spin_unlock_bh(&psock_other->ingress_lock);
935 	return 0;
936 }
937 
sk_psock_tls_verdict_apply(struct sk_buff * skb,struct sk_psock * from,int verdict)938 static void sk_psock_tls_verdict_apply(struct sk_buff *skb,
939 				       struct sk_psock *from, int verdict)
940 {
941 	switch (verdict) {
942 	case __SK_REDIRECT:
943 		sk_psock_skb_redirect(from, skb);
944 		break;
945 	case __SK_PASS:
946 	case __SK_DROP:
947 	default:
948 		break;
949 	}
950 }
951 
sk_psock_tls_strp_read(struct sk_psock * psock,struct sk_buff * skb)952 int sk_psock_tls_strp_read(struct sk_psock *psock, struct sk_buff *skb)
953 {
954 	struct bpf_prog *prog;
955 	int ret = __SK_PASS;
956 
957 	rcu_read_lock();
958 	prog = READ_ONCE(psock->progs.stream_verdict);
959 	if (likely(prog)) {
960 		skb->sk = psock->sk;
961 		skb_dst_drop(skb);
962 		skb_bpf_redirect_clear(skb);
963 		ret = bpf_prog_run_pin_on_cpu(prog, skb);
964 		ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
965 		skb->sk = NULL;
966 	}
967 	sk_psock_tls_verdict_apply(skb, psock, ret);
968 	rcu_read_unlock();
969 	return ret;
970 }
971 EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
972 
sk_psock_verdict_apply(struct sk_psock * psock,struct sk_buff * skb,int verdict)973 static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
974 				  int verdict)
975 {
976 	struct sock *sk_other;
977 	int err = 0;
978 	u32 len, off;
979 
980 	switch (verdict) {
981 	case __SK_PASS:
982 		err = -EIO;
983 		sk_other = psock->sk;
984 		if (sock_flag(sk_other, SOCK_DEAD) ||
985 		    !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
986 			skb_bpf_redirect_clear(skb);
987 			goto out_free;
988 		}
989 
990 		skb_bpf_set_ingress(skb);
991 
992 		/* If the queue is empty then we can submit directly
993 		 * into the msg queue. If its not empty we have to
994 		 * queue work otherwise we may get OOO data. Otherwise,
995 		 * if sk_psock_skb_ingress errors will be handled by
996 		 * retrying later from workqueue.
997 		 */
998 		if (skb_queue_empty(&psock->ingress_skb)) {
999 			len = skb->len;
1000 			off = 0;
1001 			if (skb_bpf_strparser(skb)) {
1002 				struct strp_msg *stm = strp_msg(skb);
1003 
1004 				off = stm->offset;
1005 				len = stm->full_len;
1006 			}
1007 			err = sk_psock_skb_ingress_self(psock, skb, off, len);
1008 		}
1009 		if (err < 0) {
1010 			spin_lock_bh(&psock->ingress_lock);
1011 			if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
1012 				skb_queue_tail(&psock->ingress_skb, skb);
1013 				schedule_work(&psock->work);
1014 				err = 0;
1015 			}
1016 			spin_unlock_bh(&psock->ingress_lock);
1017 			if (err < 0) {
1018 				skb_bpf_redirect_clear(skb);
1019 				goto out_free;
1020 			}
1021 		}
1022 		break;
1023 	case __SK_REDIRECT:
1024 		err = sk_psock_skb_redirect(psock, skb);
1025 		break;
1026 	case __SK_DROP:
1027 	default:
1028 out_free:
1029 		sock_drop(psock->sk, skb);
1030 	}
1031 
1032 	return err;
1033 }
1034 
sk_psock_write_space(struct sock * sk)1035 static void sk_psock_write_space(struct sock *sk)
1036 {
1037 	struct sk_psock *psock;
1038 	void (*write_space)(struct sock *sk) = NULL;
1039 
1040 	rcu_read_lock();
1041 	psock = sk_psock(sk);
1042 	if (likely(psock)) {
1043 		if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
1044 			schedule_work(&psock->work);
1045 		write_space = psock->saved_write_space;
1046 	}
1047 	rcu_read_unlock();
1048 	if (write_space)
1049 		write_space(sk);
1050 }
1051 
1052 #if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)
sk_psock_strp_read(struct strparser * strp,struct sk_buff * skb)1053 static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb)
1054 {
1055 	struct sk_psock *psock;
1056 	struct bpf_prog *prog;
1057 	int ret = __SK_DROP;
1058 	struct sock *sk;
1059 
1060 	rcu_read_lock();
1061 	sk = strp->sk;
1062 	psock = sk_psock(sk);
1063 	if (unlikely(!psock)) {
1064 		sock_drop(sk, skb);
1065 		goto out;
1066 	}
1067 	prog = READ_ONCE(psock->progs.stream_verdict);
1068 	if (likely(prog)) {
1069 		skb->sk = sk;
1070 		skb_dst_drop(skb);
1071 		skb_bpf_redirect_clear(skb);
1072 		ret = bpf_prog_run_pin_on_cpu(prog, skb);
1073 		if (ret == SK_PASS)
1074 			skb_bpf_set_strparser(skb);
1075 		ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
1076 		skb->sk = NULL;
1077 	}
1078 	sk_psock_verdict_apply(psock, skb, ret);
1079 out:
1080 	rcu_read_unlock();
1081 }
1082 
sk_psock_strp_read_done(struct strparser * strp,int err)1083 static int sk_psock_strp_read_done(struct strparser *strp, int err)
1084 {
1085 	return err;
1086 }
1087 
sk_psock_strp_parse(struct strparser * strp,struct sk_buff * skb)1088 static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb)
1089 {
1090 	struct sk_psock *psock = container_of(strp, struct sk_psock, strp);
1091 	struct bpf_prog *prog;
1092 	int ret = skb->len;
1093 
1094 	rcu_read_lock();
1095 	prog = READ_ONCE(psock->progs.stream_parser);
1096 	if (likely(prog)) {
1097 		skb->sk = psock->sk;
1098 		ret = bpf_prog_run_pin_on_cpu(prog, skb);
1099 		skb->sk = NULL;
1100 	}
1101 	rcu_read_unlock();
1102 	return ret;
1103 }
1104 
1105 /* Called with socket lock held. */
sk_psock_strp_data_ready(struct sock * sk)1106 static void sk_psock_strp_data_ready(struct sock *sk)
1107 {
1108 	struct sk_psock *psock;
1109 
1110 	rcu_read_lock();
1111 	psock = sk_psock(sk);
1112 	if (likely(psock)) {
1113 		if (tls_sw_has_ctx_rx(sk)) {
1114 			psock->saved_data_ready(sk);
1115 		} else {
1116 			write_lock_bh(&sk->sk_callback_lock);
1117 			strp_data_ready(&psock->strp);
1118 			write_unlock_bh(&sk->sk_callback_lock);
1119 		}
1120 	}
1121 	rcu_read_unlock();
1122 }
1123 
sk_psock_init_strp(struct sock * sk,struct sk_psock * psock)1124 int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
1125 {
1126 	static const struct strp_callbacks cb = {
1127 		.rcv_msg	= sk_psock_strp_read,
1128 		.read_sock_done	= sk_psock_strp_read_done,
1129 		.parse_msg	= sk_psock_strp_parse,
1130 	};
1131 
1132 	return strp_init(&psock->strp, sk, &cb);
1133 }
1134 
sk_psock_start_strp(struct sock * sk,struct sk_psock * psock)1135 void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock)
1136 {
1137 	if (psock->saved_data_ready)
1138 		return;
1139 
1140 	psock->saved_data_ready = sk->sk_data_ready;
1141 	sk->sk_data_ready = sk_psock_strp_data_ready;
1142 	sk->sk_write_space = sk_psock_write_space;
1143 }
1144 
sk_psock_stop_strp(struct sock * sk,struct sk_psock * psock)1145 void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
1146 {
1147 	psock_set_prog(&psock->progs.stream_parser, NULL);
1148 
1149 	if (!psock->saved_data_ready)
1150 		return;
1151 
1152 	sk->sk_data_ready = psock->saved_data_ready;
1153 	psock->saved_data_ready = NULL;
1154 	strp_stop(&psock->strp);
1155 }
1156 
sk_psock_done_strp(struct sk_psock * psock)1157 static void sk_psock_done_strp(struct sk_psock *psock)
1158 {
1159 	/* Parser has been stopped */
1160 	if (psock->progs.stream_parser)
1161 		strp_done(&psock->strp);
1162 }
1163 #else
sk_psock_done_strp(struct sk_psock * psock)1164 static void sk_psock_done_strp(struct sk_psock *psock)
1165 {
1166 }
1167 #endif /* CONFIG_BPF_STREAM_PARSER */
1168 
sk_psock_verdict_recv(read_descriptor_t * desc,struct sk_buff * skb,unsigned int offset,size_t orig_len)1169 static int sk_psock_verdict_recv(read_descriptor_t *desc, struct sk_buff *skb,
1170 				 unsigned int offset, size_t orig_len)
1171 {
1172 	struct sock *sk = (struct sock *)desc->arg.data;
1173 	struct sk_psock *psock;
1174 	struct bpf_prog *prog;
1175 	int ret = __SK_DROP;
1176 	int len = orig_len;
1177 
1178 	/* clone here so sk_eat_skb() in tcp_read_sock does not drop our data */
1179 	skb = skb_clone(skb, GFP_ATOMIC);
1180 	if (!skb) {
1181 		desc->error = -ENOMEM;
1182 		return 0;
1183 	}
1184 
1185 	rcu_read_lock();
1186 	psock = sk_psock(sk);
1187 	if (unlikely(!psock)) {
1188 		len = 0;
1189 		sock_drop(sk, skb);
1190 		goto out;
1191 	}
1192 	prog = READ_ONCE(psock->progs.stream_verdict);
1193 	if (!prog)
1194 		prog = READ_ONCE(psock->progs.skb_verdict);
1195 	if (likely(prog)) {
1196 		skb->sk = sk;
1197 		skb_dst_drop(skb);
1198 		skb_bpf_redirect_clear(skb);
1199 		ret = bpf_prog_run_pin_on_cpu(prog, skb);
1200 		ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
1201 		skb->sk = NULL;
1202 	}
1203 	if (sk_psock_verdict_apply(psock, skb, ret) < 0)
1204 		len = 0;
1205 out:
1206 	rcu_read_unlock();
1207 	return len;
1208 }
1209 
sk_psock_verdict_data_ready(struct sock * sk)1210 static void sk_psock_verdict_data_ready(struct sock *sk)
1211 {
1212 	struct socket *sock = sk->sk_socket;
1213 	read_descriptor_t desc;
1214 
1215 	if (unlikely(!sock || !sock->ops || !sock->ops->read_sock))
1216 		return;
1217 
1218 	desc.arg.data = sk;
1219 	desc.error = 0;
1220 	desc.count = 1;
1221 
1222 	sock->ops->read_sock(sk, &desc, sk_psock_verdict_recv);
1223 }
1224 
sk_psock_start_verdict(struct sock * sk,struct sk_psock * psock)1225 void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock)
1226 {
1227 	if (psock->saved_data_ready)
1228 		return;
1229 
1230 	psock->saved_data_ready = sk->sk_data_ready;
1231 	sk->sk_data_ready = sk_psock_verdict_data_ready;
1232 	sk->sk_write_space = sk_psock_write_space;
1233 }
1234 
sk_psock_stop_verdict(struct sock * sk,struct sk_psock * psock)1235 void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock)
1236 {
1237 	psock_set_prog(&psock->progs.stream_verdict, NULL);
1238 	psock_set_prog(&psock->progs.skb_verdict, NULL);
1239 
1240 	if (!psock->saved_data_ready)
1241 		return;
1242 
1243 	sk->sk_data_ready = psock->saved_data_ready;
1244 	psock->saved_data_ready = NULL;
1245 }
1246