Drivers: hv: utils: fix crash when device is removed from host side
[cascardo/linux.git] / drivers / hv / hv_utils_transport.c
1 /*
2  * Kernel/userspace transport abstraction for Hyper-V util driver.
3  *
4  * Copyright (C) 2015, Vitaly Kuznetsov <vkuznets@redhat.com>
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms of the GNU General Public License version 2 as published
8  * by the Free Software Foundation.
9  *
10  * This program is distributed in the hope that it will be useful, but
11  * WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
13  * NON INFRINGEMENT.  See the GNU General Public License for more
14  * details.
15  *
16  */
17
18 #include <linux/slab.h>
19 #include <linux/fs.h>
20 #include <linux/poll.h>
21
22 #include "hyperv_vmbus.h"
23 #include "hv_utils_transport.h"
24
25 static DEFINE_SPINLOCK(hvt_list_lock);
26 static struct list_head hvt_list = LIST_HEAD_INIT(hvt_list);
27
28 static void hvt_reset(struct hvutil_transport *hvt)
29 {
30         kfree(hvt->outmsg);
31         hvt->outmsg = NULL;
32         hvt->outmsg_len = 0;
33         if (hvt->on_reset)
34                 hvt->on_reset();
35 }
36
37 static ssize_t hvt_op_read(struct file *file, char __user *buf,
38                            size_t count, loff_t *ppos)
39 {
40         struct hvutil_transport *hvt;
41         int ret;
42
43         hvt = container_of(file->f_op, struct hvutil_transport, fops);
44
45         if (wait_event_interruptible(hvt->outmsg_q, hvt->outmsg_len > 0 ||
46                                      hvt->mode != HVUTIL_TRANSPORT_CHARDEV))
47                 return -EINTR;
48
49         mutex_lock(&hvt->lock);
50
51         if (hvt->mode == HVUTIL_TRANSPORT_DESTROY) {
52                 ret = -EBADF;
53                 goto out_unlock;
54         }
55
56         if (!hvt->outmsg) {
57                 ret = -EAGAIN;
58                 goto out_unlock;
59         }
60
61         if (count < hvt->outmsg_len) {
62                 ret = -EINVAL;
63                 goto out_unlock;
64         }
65
66         if (!copy_to_user(buf, hvt->outmsg, hvt->outmsg_len))
67                 ret = hvt->outmsg_len;
68         else
69                 ret = -EFAULT;
70
71         kfree(hvt->outmsg);
72         hvt->outmsg = NULL;
73         hvt->outmsg_len = 0;
74
75 out_unlock:
76         mutex_unlock(&hvt->lock);
77         return ret;
78 }
79
80 static ssize_t hvt_op_write(struct file *file, const char __user *buf,
81                             size_t count, loff_t *ppos)
82 {
83         struct hvutil_transport *hvt;
84         u8 *inmsg;
85         int ret;
86
87         hvt = container_of(file->f_op, struct hvutil_transport, fops);
88
89         inmsg = memdup_user(buf, count);
90         if (IS_ERR(inmsg))
91                 return PTR_ERR(inmsg);
92
93         if (hvt->mode == HVUTIL_TRANSPORT_DESTROY)
94                 ret = -EBADF;
95         else
96                 ret = hvt->on_msg(inmsg, count);
97
98         kfree(inmsg);
99
100         return ret ? ret : count;
101 }
102
103 static unsigned int hvt_op_poll(struct file *file, poll_table *wait)
104 {
105         struct hvutil_transport *hvt;
106
107         hvt = container_of(file->f_op, struct hvutil_transport, fops);
108
109         poll_wait(file, &hvt->outmsg_q, wait);
110
111         if (hvt->mode == HVUTIL_TRANSPORT_DESTROY)
112                 return -EBADF;
113
114         if (hvt->outmsg_len > 0)
115                 return POLLIN | POLLRDNORM;
116
117         return 0;
118 }
119
120 static int hvt_op_open(struct inode *inode, struct file *file)
121 {
122         struct hvutil_transport *hvt;
123         int ret = 0;
124         bool issue_reset = false;
125
126         hvt = container_of(file->f_op, struct hvutil_transport, fops);
127
128         mutex_lock(&hvt->lock);
129
130         if (hvt->mode == HVUTIL_TRANSPORT_DESTROY) {
131                 ret = -EBADF;
132         } else if (hvt->mode == HVUTIL_TRANSPORT_INIT) {
133                 /*
134                  * Switching to CHARDEV mode. We switch bach to INIT when
135                  * device gets released.
136                  */
137                 hvt->mode = HVUTIL_TRANSPORT_CHARDEV;
138         }
139         else if (hvt->mode == HVUTIL_TRANSPORT_NETLINK) {
140                 /*
141                  * We're switching from netlink communication to using char
142                  * device. Issue the reset first.
143                  */
144                 issue_reset = true;
145                 hvt->mode = HVUTIL_TRANSPORT_CHARDEV;
146         } else {
147                 ret = -EBUSY;
148         }
149
150         if (issue_reset)
151                 hvt_reset(hvt);
152
153         mutex_unlock(&hvt->lock);
154
155         return ret;
156 }
157
158 static void hvt_transport_free(struct hvutil_transport *hvt)
159 {
160         misc_deregister(&hvt->mdev);
161         kfree(hvt->outmsg);
162         kfree(hvt);
163 }
164
165 static int hvt_op_release(struct inode *inode, struct file *file)
166 {
167         struct hvutil_transport *hvt;
168         int mode_old;
169
170         hvt = container_of(file->f_op, struct hvutil_transport, fops);
171
172         mutex_lock(&hvt->lock);
173         mode_old = hvt->mode;
174         if (hvt->mode != HVUTIL_TRANSPORT_DESTROY)
175                 hvt->mode = HVUTIL_TRANSPORT_INIT;
176         /*
177          * Cleanup message buffers to avoid spurious messages when the daemon
178          * connects back.
179          */
180         hvt_reset(hvt);
181         mutex_unlock(&hvt->lock);
182
183         if (mode_old == HVUTIL_TRANSPORT_DESTROY)
184                 hvt_transport_free(hvt);
185
186         return 0;
187 }
188
189 static void hvt_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
190 {
191         struct hvutil_transport *hvt, *hvt_found = NULL;
192
193         spin_lock(&hvt_list_lock);
194         list_for_each_entry(hvt, &hvt_list, list) {
195                 if (hvt->cn_id.idx == msg->id.idx &&
196                     hvt->cn_id.val == msg->id.val) {
197                         hvt_found = hvt;
198                         break;
199                 }
200         }
201         spin_unlock(&hvt_list_lock);
202         if (!hvt_found) {
203                 pr_warn("hvt_cn_callback: spurious message received!\n");
204                 return;
205         }
206
207         /*
208          * Switching to NETLINK mode. Switching to CHARDEV happens when someone
209          * opens the device.
210          */
211         mutex_lock(&hvt->lock);
212         if (hvt->mode == HVUTIL_TRANSPORT_INIT)
213                 hvt->mode = HVUTIL_TRANSPORT_NETLINK;
214
215         if (hvt->mode == HVUTIL_TRANSPORT_NETLINK)
216                 hvt_found->on_msg(msg->data, msg->len);
217         else
218                 pr_warn("hvt_cn_callback: unexpected netlink message!\n");
219         mutex_unlock(&hvt->lock);
220 }
221
222 int hvutil_transport_send(struct hvutil_transport *hvt, void *msg, int len)
223 {
224         struct cn_msg *cn_msg;
225         int ret = 0;
226
227         if (hvt->mode == HVUTIL_TRANSPORT_INIT ||
228             hvt->mode == HVUTIL_TRANSPORT_DESTROY) {
229                 return -EINVAL;
230         } else if (hvt->mode == HVUTIL_TRANSPORT_NETLINK) {
231                 cn_msg = kzalloc(sizeof(*cn_msg) + len, GFP_ATOMIC);
232                 if (!cn_msg)
233                         return -ENOMEM;
234                 cn_msg->id.idx = hvt->cn_id.idx;
235                 cn_msg->id.val = hvt->cn_id.val;
236                 cn_msg->len = len;
237                 memcpy(cn_msg->data, msg, len);
238                 ret = cn_netlink_send(cn_msg, 0, 0, GFP_ATOMIC);
239                 kfree(cn_msg);
240                 return ret;
241         }
242         /* HVUTIL_TRANSPORT_CHARDEV */
243         mutex_lock(&hvt->lock);
244         if (hvt->mode != HVUTIL_TRANSPORT_CHARDEV) {
245                 ret = -EINVAL;
246                 goto out_unlock;
247         }
248
249         if (hvt->outmsg) {
250                 /* Previous message wasn't received */
251                 ret = -EFAULT;
252                 goto out_unlock;
253         }
254         hvt->outmsg = kzalloc(len, GFP_KERNEL);
255         if (hvt->outmsg) {
256                 memcpy(hvt->outmsg, msg, len);
257                 hvt->outmsg_len = len;
258                 wake_up_interruptible(&hvt->outmsg_q);
259         } else
260                 ret = -ENOMEM;
261 out_unlock:
262         mutex_unlock(&hvt->lock);
263         return ret;
264 }
265
266 struct hvutil_transport *hvutil_transport_init(const char *name,
267                                                u32 cn_idx, u32 cn_val,
268                                                int (*on_msg)(void *, int),
269                                                void (*on_reset)(void))
270 {
271         struct hvutil_transport *hvt;
272
273         hvt = kzalloc(sizeof(*hvt), GFP_KERNEL);
274         if (!hvt)
275                 return NULL;
276
277         hvt->cn_id.idx = cn_idx;
278         hvt->cn_id.val = cn_val;
279
280         hvt->mdev.minor = MISC_DYNAMIC_MINOR;
281         hvt->mdev.name = name;
282
283         hvt->fops.owner = THIS_MODULE;
284         hvt->fops.read = hvt_op_read;
285         hvt->fops.write = hvt_op_write;
286         hvt->fops.poll = hvt_op_poll;
287         hvt->fops.open = hvt_op_open;
288         hvt->fops.release = hvt_op_release;
289
290         hvt->mdev.fops = &hvt->fops;
291
292         init_waitqueue_head(&hvt->outmsg_q);
293         mutex_init(&hvt->lock);
294
295         spin_lock(&hvt_list_lock);
296         list_add(&hvt->list, &hvt_list);
297         spin_unlock(&hvt_list_lock);
298
299         hvt->on_msg = on_msg;
300         hvt->on_reset = on_reset;
301
302         if (misc_register(&hvt->mdev))
303                 goto err_free_hvt;
304
305         /* Use cn_id.idx/cn_id.val to determine if we need to setup netlink */
306         if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0 &&
307             cn_add_callback(&hvt->cn_id, name, hvt_cn_callback))
308                 goto err_free_hvt;
309
310         return hvt;
311
312 err_free_hvt:
313         kfree(hvt);
314         return NULL;
315 }
316
317 void hvutil_transport_destroy(struct hvutil_transport *hvt)
318 {
319         int mode_old;
320
321         mutex_lock(&hvt->lock);
322         mode_old = hvt->mode;
323         hvt->mode = HVUTIL_TRANSPORT_DESTROY;
324         wake_up_interruptible(&hvt->outmsg_q);
325         mutex_unlock(&hvt->lock);
326
327         /*
328          * In case we were in 'chardev' mode we still have an open fd so we
329          * have to defer freeing the device. Netlink interface can be freed
330          * now.
331          */
332         spin_lock(&hvt_list_lock);
333         list_del(&hvt->list);
334         spin_unlock(&hvt_list_lock);
335         if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0)
336                 cn_del_callback(&hvt->cn_id);
337
338         if (mode_old != HVUTIL_TRANSPORT_CHARDEV)
339                 hvt_transport_free(hvt);
340 }