net/dccp/proto.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  net/dccp/proto.c
   4  *
   5  *  An implementation of the DCCP protocol
   6  *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
   7  */
   8
   9 #include <linux/dccp.h>
  10 #include <linux/module.h>
  11 #include <linux/types.h>
  12 #include <linux/sched.h>
  13 #include <linux/kernel.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/netdevice.h>
  16 #include <linux/in.h>
  17 #include <linux/if_arp.h>
  18 #include <linux/init.h>
  19 #include <linux/random.h>
  20 #include <linux/slab.h>
  21 #include <net/checksum.h>
  22
  23 #include <net/inet_sock.h>
  24 #include <net/inet_common.h>
  25 #include <net/sock.h>
  26 #include <net/xfrm.h>
  27
  28 #include <asm/ioctls.h>
  29 #include <linux/spinlock.h>
  30 #include <linux/timer.h>
  31 #include <linux/delay.h>
  32 #include <linux/poll.h>
  33
  34 #include "ccid.h"
  35 #include "dccp.h"
  36 #include "feat.h"
  37
  38 #define CREATE_TRACE_POINTS
  39 #include "trace.h"
  40
  41 DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
  42
  43 EXPORT_SYMBOL_GPL(dccp_statistics);
  44
  45 DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
  46 EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
  47
  48 struct inet_hashinfo dccp_hashinfo;
  49 EXPORT_SYMBOL_GPL(dccp_hashinfo);
  50
  51 /* the maximum queue length for tx in packets. 0 is no limit */
  52 int sysctl_dccp_tx_qlen __read_mostly = 5;
  53
  54 #ifdef CONFIG_IP_DCCP_DEBUG
  55 static const char *dccp_state_name(const int state)
  56 {
  57         static const char *const dccp_state_names[] = {
  58         [DCCP_OPEN]             = "OPEN",
  59         [DCCP_REQUESTING]       = "REQUESTING",
  60         [DCCP_PARTOPEN]         = "PARTOPEN",
  61         [DCCP_LISTEN]           = "LISTEN",
  62         [DCCP_RESPOND]          = "RESPOND",
  63         [DCCP_CLOSING]          = "CLOSING",
  64         [DCCP_ACTIVE_CLOSEREQ]  = "CLOSEREQ",
  65         [DCCP_PASSIVE_CLOSE]    = "PASSIVE_CLOSE",
  66         [DCCP_PASSIVE_CLOSEREQ] = "PASSIVE_CLOSEREQ",
  67         [DCCP_TIME_WAIT]        = "TIME_WAIT",
  68         [DCCP_CLOSED]           = "CLOSED",
  69         };
  70
  71         if (state >= DCCP_MAX_STATES)
  72                 return "INVALID STATE!";
  73         else
  74                 return dccp_state_names[state];
  75 }
  76 #endif
  77
  78 void dccp_set_state(struct sock *sk, const int state)
  79 {
  80         const int oldstate = sk->sk_state;
  81
  82         dccp_pr_debug("%s(%p)  %s  -->  %s\n", dccp_role(sk), sk,
  83                       dccp_state_name(oldstate), dccp_state_name(state));
  84         WARN_ON(state == oldstate);
  85
  86         switch (state) {
  87         case DCCP_OPEN:
  88                 if (oldstate != DCCP_OPEN)
  89                         DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
  90                 /* Client retransmits all Confirm options until entering OPEN */
  91                 if (oldstate == DCCP_PARTOPEN)
  92                         dccp_feat_list_purge(&dccp_sk(sk)->dccps_featneg);
  93                 break;
  94
  95         case DCCP_CLOSED:
  96                 if (oldstate == DCCP_OPEN || oldstate == DCCP_ACTIVE_CLOSEREQ ||
  97                     oldstate == DCCP_CLOSING)
  98                         DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
  99
 100                 sk->sk_prot->unhash(sk);
 101                 if (inet_csk(sk)->icsk_bind_hash != NULL &&
 102                     !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
 103                         inet_put_port(sk);
 104                 fallthrough;
 105         default:
 106                 if (oldstate == DCCP_OPEN)
 107                         DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
 108         }
 109
 110         /* Change state AFTER socket is unhashed to avoid closed
 111          * socket sitting in hash tables.
 112          */
 113         inet_sk_set_state(sk, state);
 114 }
 115
 116 EXPORT_SYMBOL_GPL(dccp_set_state);
 117
 118 static void dccp_finish_passive_close(struct sock *sk)
 119 {
 120         switch (sk->sk_state) {
 121         case DCCP_PASSIVE_CLOSE:
 122                 /* Node (client or server) has received Close packet. */
 123                 dccp_send_reset(sk, DCCP_RESET_CODE_CLOSED);
 124                 dccp_set_state(sk, DCCP_CLOSED);
 125                 break;
 126         case DCCP_PASSIVE_CLOSEREQ:
 127                 /*
 128                  * Client received CloseReq. We set the `active' flag so that
 129                  * dccp_send_close() retransmits the Close as per RFC 4340, 8.3.
 130                  */
 131                 dccp_send_close(sk, 1);
 132                 dccp_set_state(sk, DCCP_CLOSING);
 133         }
 134 }
 135
 136 void dccp_done(struct sock *sk)
 137 {
 138         dccp_set_state(sk, DCCP_CLOSED);
 139         dccp_clear_xmit_timers(sk);
 140
 141         sk->sk_shutdown = SHUTDOWN_MASK;
 142
 143         if (!sock_flag(sk, SOCK_DEAD))
 144                 sk->sk_state_change(sk);
 145         else
 146                 inet_csk_destroy_sock(sk);
 147 }
 148
 149 EXPORT_SYMBOL_GPL(dccp_done);
 150
 151 const char *dccp_packet_name(const int type)
 152 {
 153         static const char *const dccp_packet_names[] = {
 154                 [DCCP_PKT_REQUEST]  = "REQUEST",
 155                 [DCCP_PKT_RESPONSE] = "RESPONSE",
 156                 [DCCP_PKT_DATA]     = "DATA",
 157                 [DCCP_PKT_ACK]      = "ACK",
 158                 [DCCP_PKT_DATAACK]  = "DATAACK",
 159                 [DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
 160                 [DCCP_PKT_CLOSE]    = "CLOSE",
 161                 [DCCP_PKT_RESET]    = "RESET",
 162                 [DCCP_PKT_SYNC]     = "SYNC",
 163                 [DCCP_PKT_SYNCACK]  = "SYNCACK",
 164         };
 165
 166         if (type >= DCCP_NR_PKT_TYPES)
 167                 return "INVALID";
 168         else
 169                 return dccp_packet_names[type];
 170 }
 171
 172 EXPORT_SYMBOL_GPL(dccp_packet_name);
 173
 174 void dccp_destruct_common(struct sock *sk)
 175 {
 176         struct dccp_sock *dp = dccp_sk(sk);
 177
 178         ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
 179         dp->dccps_hc_tx_ccid = NULL;
 180 }
 181 EXPORT_SYMBOL_GPL(dccp_destruct_common);
 182
 183 static void dccp_sk_destruct(struct sock *sk)
 184 {
 185         dccp_destruct_common(sk);
 186         inet_sock_destruct(sk);
 187 }
 188
 189 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 190 {
 191         struct dccp_sock *dp = dccp_sk(sk);
 192         struct inet_connection_sock *icsk = inet_csk(sk);
 193
 194         icsk->icsk_rto          = DCCP_TIMEOUT_INIT;
 195         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
 196         sk->sk_state            = DCCP_CLOSED;
 197         sk->sk_write_space      = dccp_write_space;
 198         sk->sk_destruct         = dccp_sk_destruct;
 199         icsk->icsk_sync_mss     = dccp_sync_mss;
 200         dp->dccps_mss_cache     = 536;
 201         dp->dccps_rate_last     = jiffies;
 202         dp->dccps_role          = DCCP_ROLE_UNDEFINED;
 203         dp->dccps_service       = DCCP_SERVICE_CODE_IS_ABSENT;
 204         dp->dccps_tx_qlen       = sysctl_dccp_tx_qlen;
 205
 206         dccp_init_xmit_timers(sk);
 207
 208         INIT_LIST_HEAD(&dp->dccps_featneg);
 209         /* control socket doesn't need feat nego */
 210         if (likely(ctl_sock_initialized))
 211                 return dccp_feat_init(sk);
 212         return 0;
 213 }
 214
 215 EXPORT_SYMBOL_GPL(dccp_init_sock);
 216
 217 void dccp_destroy_sock(struct sock *sk)
 218 {
 219         struct dccp_sock *dp = dccp_sk(sk);
 220
 221         __skb_queue_purge(&sk->sk_write_queue);
 222         if (sk->sk_send_head != NULL) {
 223                 kfree_skb(sk->sk_send_head);
 224                 sk->sk_send_head = NULL;
 225         }
 226
 227         /* Clean up a referenced DCCP bind bucket. */
 228         if (inet_csk(sk)->icsk_bind_hash != NULL)
 229                 inet_put_port(sk);
 230
 231         kfree(dp->dccps_service_list);
 232         dp->dccps_service_list = NULL;
 233
 234         if (dp->dccps_hc_rx_ackvec != NULL) {
 235                 dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
 236                 dp->dccps_hc_rx_ackvec = NULL;
 237         }
 238         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 239         dp->dccps_hc_rx_ccid = NULL;
 240
 241         /* clean up feature negotiation state */
 242         dccp_feat_list_purge(&dp->dccps_featneg);
 243 }
 244
 245 EXPORT_SYMBOL_GPL(dccp_destroy_sock);
 246
 247 static inline int dccp_need_reset(int state)
 248 {
 249         return state != DCCP_CLOSED && state != DCCP_LISTEN &&
 250                state != DCCP_REQUESTING;
 251 }
 252
 253 int dccp_disconnect(struct sock *sk, int flags)
 254 {
 255         struct inet_connection_sock *icsk = inet_csk(sk);
 256         struct inet_sock *inet = inet_sk(sk);
 257         struct dccp_sock *dp = dccp_sk(sk);
 258         const int old_state = sk->sk_state;
 259
 260         if (old_state != DCCP_CLOSED)
 261                 dccp_set_state(sk, DCCP_CLOSED);
 262
 263         /*
 264          * This corresponds to the ABORT function of RFC793, sec. 3.8
 265          * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted".
 266          */
 267         if (old_state == DCCP_LISTEN) {
 268                 inet_csk_listen_stop(sk);
 269         } else if (dccp_need_reset(old_state)) {
 270                 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
 271                 sk->sk_err = ECONNRESET;
 272         } else if (old_state == DCCP_REQUESTING)
 273                 sk->sk_err = ECONNRESET;
 274
 275         dccp_clear_xmit_timers(sk);
 276         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 277         dp->dccps_hc_rx_ccid = NULL;
 278
 279         __skb_queue_purge(&sk->sk_receive_queue);
 280         __skb_queue_purge(&sk->sk_write_queue);
 281         if (sk->sk_send_head != NULL) {
 282                 __kfree_skb(sk->sk_send_head);
 283                 sk->sk_send_head = NULL;
 284         }
 285
 286         inet->inet_dport = 0;
 287
 288         inet_bhash2_reset_saddr(sk);
 289
 290         sk->sk_shutdown = 0;
 291         sock_reset_flag(sk, SOCK_DONE);
 292
 293         icsk->icsk_backoff = 0;
 294         inet_csk_delack_init(sk);
 295         __sk_dst_reset(sk);
 296
 297         WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 298
 299         sk_error_report(sk);
 300         return 0;
 301 }
 302
 303 EXPORT_SYMBOL_GPL(dccp_disconnect);
 304
 305 /*
 306  *      Wait for a DCCP event.
 307  *
 308  *      Note that we don't need to lock the socket, as the upper poll layers
 309  *      take care of normal races (between the test and the event) and we don't
 310  *      go look at any of the socket buffers directly.
 311  */
 312 __poll_t dccp_poll(struct file *file, struct socket *sock,
 313                        poll_table *wait)
 314 {
 315         struct sock *sk = sock->sk;
 316         __poll_t mask;
 317         u8 shutdown;
 318         int state;
 319
 320         sock_poll_wait(file, sock, wait);
 321
 322         state = inet_sk_state_load(sk);
 323         if (state == DCCP_LISTEN)
 324                 return inet_csk_listen_poll(sk);
 325
 326         /* Socket is not locked. We are protected from async events
 327            by poll logic and correct handling of state changes
 328            made by another threads is impossible in any case.
 329          */
 330
 331         mask = 0;
 332         if (READ_ONCE(sk->sk_err))
 333                 mask = EPOLLERR;
 334         shutdown = READ_ONCE(sk->sk_shutdown);
 335
 336         if (shutdown == SHUTDOWN_MASK || state == DCCP_CLOSED)
 337                 mask |= EPOLLHUP;
 338         if (shutdown & RCV_SHUTDOWN)
 339                 mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
 340
 341         /* Connected? */
 342         if ((1 << state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
 343                 if (atomic_read(&sk->sk_rmem_alloc) > 0)
 344                         mask |= EPOLLIN | EPOLLRDNORM;
 345
 346                 if (!(shutdown & SEND_SHUTDOWN)) {
 347                         if (sk_stream_is_writeable(sk)) {
 348                                 mask |= EPOLLOUT | EPOLLWRNORM;
 349                         } else {  /* send SIGIO later */
 350                                 sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 351                                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 352
 353                                 /* Race breaker. If space is freed after
 354                                  * wspace test but before the flags are set,
 355                                  * IO signal will be lost.
 356                                  */
 357                                 if (sk_stream_is_writeable(sk))
 358                                         mask |= EPOLLOUT | EPOLLWRNORM;
 359                         }
 360                 }
 361         }
 362         return mask;
 363 }
 364 EXPORT_SYMBOL_GPL(dccp_poll);
 365
 366 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 367 {
 368         int rc = -ENOTCONN;
 369
 370         lock_sock(sk);
 371
 372         if (sk->sk_state == DCCP_LISTEN)
 373                 goto out;
 374
 375         switch (cmd) {
 376         case SIOCOUTQ: {
 377                 int amount = sk_wmem_alloc_get(sk);
 378                 /* Using sk_wmem_alloc here because sk_wmem_queued is not used by DCCP and
 379                  * always 0, comparably to UDP.
 380                  */
 381
 382                 rc = put_user(amount, (int __user *)arg);
 383         }
 384                 break;
 385         case SIOCINQ: {
 386                 struct sk_buff *skb;
 387                 unsigned long amount = 0;
 388
 389                 skb = skb_peek(&sk->sk_receive_queue);
 390                 if (skb != NULL) {
 391                         /*
 392                          * We will only return the amount of this packet since
 393                          * that is all that will be read.
 394                          */
 395                         amount = skb->len;
 396                 }
 397                 rc = put_user(amount, (int __user *)arg);
 398         }
 399                 break;
 400         default:
 401                 rc = -ENOIOCTLCMD;
 402                 break;
 403         }
 404 out:
 405         release_sock(sk);
 406         return rc;
 407 }
 408
 409 EXPORT_SYMBOL_GPL(dccp_ioctl);
 410
 411 static int dccp_setsockopt_service(struct sock *sk, const __be32 service,
 412                                    sockptr_t optval, unsigned int optlen)
 413 {
 414         struct dccp_sock *dp = dccp_sk(sk);
 415         struct dccp_service_list *sl = NULL;
 416
 417         if (service == DCCP_SERVICE_INVALID_VALUE ||
 418             optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
 419                 return -EINVAL;
 420
 421         if (optlen > sizeof(service)) {
 422                 sl = kmalloc(optlen, GFP_KERNEL);
 423                 if (sl == NULL)
 424                         return -ENOMEM;
 425
 426                 sl->dccpsl_nr = optlen / sizeof(u32) - 1;
 427                 if (copy_from_sockptr_offset(sl->dccpsl_list, optval,
 428                                 sizeof(service), optlen - sizeof(service)) ||
 429                     dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
 430                         kfree(sl);
 431                         return -EFAULT;
 432                 }
 433         }
 434
 435         lock_sock(sk);
 436         dp->dccps_service = service;
 437
 438         kfree(dp->dccps_service_list);
 439
 440         dp->dccps_service_list = sl;
 441         release_sock(sk);
 442         return 0;
 443 }
 444
 445 static int dccp_setsockopt_cscov(struct sock *sk, int cscov, bool rx)
 446 {
 447         u8 *list, len;
 448         int i, rc;
 449
 450         if (cscov < 0 || cscov > 15)
 451                 return -EINVAL;
 452         /*
 453          * Populate a list of permissible values, in the range cscov...15. This
 454          * is necessary since feature negotiation of single values only works if
 455          * both sides incidentally choose the same value. Since the list starts
 456          * lowest-value first, negotiation will pick the smallest shared value.
 457          */
 458         if (cscov == 0)
 459                 return 0;
 460         len = 16 - cscov;
 461
 462         list = kmalloc(len, GFP_KERNEL);
 463         if (list == NULL)
 464                 return -ENOBUFS;
 465
 466         for (i = 0; i < len; i++)
 467                 list[i] = cscov++;
 468
 469         rc = dccp_feat_register_sp(sk, DCCPF_MIN_CSUM_COVER, rx, list, len);
 470
 471         if (rc == 0) {
 472                 if (rx)
 473                         dccp_sk(sk)->dccps_pcrlen = cscov;
 474                 else
 475                         dccp_sk(sk)->dccps_pcslen = cscov;
 476         }
 477         kfree(list);
 478         return rc;
 479 }
 480
 481 static int dccp_setsockopt_ccid(struct sock *sk, int type,
 482                                 sockptr_t optval, unsigned int optlen)
 483 {
 484         u8 *val;
 485         int rc = 0;
 486
 487         if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS)
 488                 return -EINVAL;
 489
 490         val = memdup_sockptr(optval, optlen);
 491         if (IS_ERR(val))
 492                 return PTR_ERR(val);
 493
 494         lock_sock(sk);
 495         if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID)
 496                 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
 497
 498         if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID))
 499                 rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
 500         release_sock(sk);
 501
 502         kfree(val);
 503         return rc;
 504 }
 505
 506 static int do_dccp_setsockopt(struct sock *sk, int level, int optname,
 507                 sockptr_t optval, unsigned int optlen)
 508 {
 509         struct dccp_sock *dp = dccp_sk(sk);
 510         int val, err = 0;
 511
 512         switch (optname) {
 513         case DCCP_SOCKOPT_PACKET_SIZE:
 514                 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 515                 return 0;
 516         case DCCP_SOCKOPT_CHANGE_L:
 517         case DCCP_SOCKOPT_CHANGE_R:
 518                 DCCP_WARN("sockopt(CHANGE_L/R) is deprecated: fix your app\n");
 519                 return 0;
 520         case DCCP_SOCKOPT_CCID:
 521         case DCCP_SOCKOPT_RX_CCID:
 522         case DCCP_SOCKOPT_TX_CCID:
 523                 return dccp_setsockopt_ccid(sk, optname, optval, optlen);
 524         }
 525
 526         if (optlen < (int)sizeof(int))
 527                 return -EINVAL;
 528
 529         if (copy_from_sockptr(&val, optval, sizeof(int)))
 530                 return -EFAULT;
 531
 532         if (optname == DCCP_SOCKOPT_SERVICE)
 533                 return dccp_setsockopt_service(sk, val, optval, optlen);
 534
 535         lock_sock(sk);
 536         switch (optname) {
 537         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 538                 if (dp->dccps_role != DCCP_ROLE_SERVER)
 539                         err = -EOPNOTSUPP;
 540                 else
 541                         dp->dccps_server_timewait = (val != 0);
 542                 break;
 543         case DCCP_SOCKOPT_SEND_CSCOV:
 544                 err = dccp_setsockopt_cscov(sk, val, false);
 545                 break;
 546         case DCCP_SOCKOPT_RECV_CSCOV:
 547                 err = dccp_setsockopt_cscov(sk, val, true);
 548                 break;
 549         case DCCP_SOCKOPT_QPOLICY_ID:
 550                 if (sk->sk_state != DCCP_CLOSED)
 551                         err = -EISCONN;
 552                 else if (val < 0 || val >= DCCPQ_POLICY_MAX)
 553                         err = -EINVAL;
 554                 else
 555                         dp->dccps_qpolicy = val;
 556                 break;
 557         case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 558                 if (val < 0)
 559                         err = -EINVAL;
 560                 else
 561                         dp->dccps_tx_qlen = val;
 562                 break;
 563         default:
 564                 err = -ENOPROTOOPT;
 565                 break;
 566         }
 567         release_sock(sk);
 568
 569         return err;
 570 }
 571
 572 int dccp_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
 573                     unsigned int optlen)
 574 {
 575         if (level != SOL_DCCP)
 576                 return inet_csk(sk)->icsk_af_ops->setsockopt(sk, level,
 577                                                              optname, optval,
 578                                                              optlen);
 579         return do_dccp_setsockopt(sk, level, optname, optval, optlen);
 580 }
 581
 582 EXPORT_SYMBOL_GPL(dccp_setsockopt);
 583
 584 static int dccp_getsockopt_service(struct sock *sk, int len,
 585                                    __be32 __user *optval,
 586                                    int __user *optlen)
 587 {
 588         const struct dccp_sock *dp = dccp_sk(sk);
 589         const struct dccp_service_list *sl;
 590         int err = -ENOENT, slen = 0, total_len = sizeof(u32);
 591
 592         lock_sock(sk);
 593         if ((sl = dp->dccps_service_list) != NULL) {
 594                 slen = sl->dccpsl_nr * sizeof(u32);
 595                 total_len += slen;
 596         }
 597
 598         err = -EINVAL;
 599         if (total_len > len)
 600                 goto out;
 601
 602         err = 0;
 603         if (put_user(total_len, optlen) ||
 604             put_user(dp->dccps_service, optval) ||
 605             (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
 606                 err = -EFAULT;
 607 out:
 608         release_sock(sk);
 609         return err;
 610 }
 611
 612 static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
 613                     char __user *optval, int __user *optlen)
 614 {
 615         struct dccp_sock *dp;
 616         int val, len;
 617
 618         if (get_user(len, optlen))
 619                 return -EFAULT;
 620
 621         if (len < (int)sizeof(int))
 622                 return -EINVAL;
 623
 624         dp = dccp_sk(sk);
 625
 626         switch (optname) {
 627         case DCCP_SOCKOPT_PACKET_SIZE:
 628                 DCCP_WARN("sockopt(PACKET_SIZE) is deprecated: fix your app\n");
 629                 return 0;
 630         case DCCP_SOCKOPT_SERVICE:
 631                 return dccp_getsockopt_service(sk, len,
 632                                                (__be32 __user *)optval, optlen);
 633         case DCCP_SOCKOPT_GET_CUR_MPS:
 634                 val = READ_ONCE(dp->dccps_mss_cache);
 635                 break;
 636         case DCCP_SOCKOPT_AVAILABLE_CCIDS:
 637                 return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
 638         case DCCP_SOCKOPT_TX_CCID:
 639                 val = ccid_get_current_tx_ccid(dp);
 640                 if (val < 0)
 641                         return -ENOPROTOOPT;
 642                 break;
 643         case DCCP_SOCKOPT_RX_CCID:
 644                 val = ccid_get_current_rx_ccid(dp);
 645                 if (val < 0)
 646                         return -ENOPROTOOPT;
 647                 break;
 648         case DCCP_SOCKOPT_SERVER_TIMEWAIT:
 649                 val = dp->dccps_server_timewait;
 650                 break;
 651         case DCCP_SOCKOPT_SEND_CSCOV:
 652                 val = dp->dccps_pcslen;
 653                 break;
 654         case DCCP_SOCKOPT_RECV_CSCOV:
 655                 val = dp->dccps_pcrlen;
 656                 break;
 657         case DCCP_SOCKOPT_QPOLICY_ID:
 658                 val = dp->dccps_qpolicy;
 659                 break;
 660         case DCCP_SOCKOPT_QPOLICY_TXQLEN:
 661                 val = dp->dccps_tx_qlen;
 662                 break;
 663         case 128 ... 191:
 664                 return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
 665                                              len, (u32 __user *)optval, optlen);
 666         case 192 ... 255:
 667                 return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
 668                                              len, (u32 __user *)optval, optlen);
 669         default:
 670                 return -ENOPROTOOPT;
 671         }
 672
 673         len = sizeof(val);
 674         if (put_user(len, optlen) || copy_to_user(optval, &val, len))
 675                 return -EFAULT;
 676
 677         return 0;
 678 }
 679
 680 int dccp_getsockopt(struct sock *sk, int level, int optname,
 681                     char __user *optval, int __user *optlen)
 682 {
 683         if (level != SOL_DCCP)
 684                 return inet_csk(sk)->icsk_af_ops->getsockopt(sk, level,
 685                                                              optname, optval,
 686                                                              optlen);
 687         return do_dccp_getsockopt(sk, level, optname, optval, optlen);
 688 }
 689
 690 EXPORT_SYMBOL_GPL(dccp_getsockopt);
 691
 692 static int dccp_msghdr_parse(struct msghdr *msg, struct sk_buff *skb)
 693 {
 694         struct cmsghdr *cmsg;
 695
 696         /*
 697          * Assign an (opaque) qpolicy priority value to skb->priority.
 698          *
 699          * We are overloading this skb field for use with the qpolicy subystem.
 700          * The skb->priority is normally used for the SO_PRIORITY option, which
 701          * is initialised from sk_priority. Since the assignment of sk_priority
 702          * to skb->priority happens later (on layer 3), we overload this field
 703          * for use with queueing priorities as long as the skb is on layer 4.
 704          * The default priority value (if nothing is set) is 0.
 705          */
 706         skb->priority = 0;
 707
 708         for_each_cmsghdr(cmsg, msg) {
 709                 if (!CMSG_OK(msg, cmsg))
 710                         return -EINVAL;
 711
 712                 if (cmsg->cmsg_level != SOL_DCCP)
 713                         continue;
 714
 715                 if (cmsg->cmsg_type <= DCCP_SCM_QPOLICY_MAX &&
 716                     !dccp_qpolicy_param_ok(skb->sk, cmsg->cmsg_type))
 717                         return -EINVAL;
 718
 719                 switch (cmsg->cmsg_type) {
 720                 case DCCP_SCM_PRIORITY:
 721                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(__u32)))
 722                                 return -EINVAL;
 723                         skb->priority = *(__u32 *)CMSG_DATA(cmsg);
 724                         break;
 725                 default:
 726                         return -EINVAL;
 727                 }
 728         }
 729         return 0;
 730 }
 731
 732 int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 733 {
 734         const struct dccp_sock *dp = dccp_sk(sk);
 735         const int flags = msg->msg_flags;
 736         const int noblock = flags & MSG_DONTWAIT;
 737         struct sk_buff *skb;
 738         int rc, size;
 739         long timeo;
 740
 741         trace_dccp_probe(sk, len);
 742
 743         if (len > READ_ONCE(dp->dccps_mss_cache))
 744                 return -EMSGSIZE;
 745
 746         lock_sock(sk);
 747
 748         timeo = sock_sndtimeo(sk, noblock);
 749
 750         /*
 751          * We have to use sk_stream_wait_connect here to set sk_write_pending,
 752          * so that the trick in dccp_rcv_request_sent_state_process.
 753          */
 754         /* Wait for a connection to finish. */
 755         if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))
 756                 if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
 757                         goto out_release;
 758
 759         size = sk->sk_prot->max_header + len;
 760         release_sock(sk);
 761         skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 762         lock_sock(sk);
 763         if (skb == NULL)
 764                 goto out_release;
 765
 766         if (dccp_qpolicy_full(sk)) {
 767                 rc = -EAGAIN;
 768                 goto out_discard;
 769         }
 770
 771         if (sk->sk_state == DCCP_CLOSED) {
 772                 rc = -ENOTCONN;
 773                 goto out_discard;
 774         }
 775
 776         /* We need to check dccps_mss_cache after socket is locked. */
 777         if (len > dp->dccps_mss_cache) {
 778                 rc = -EMSGSIZE;
 779                 goto out_discard;
 780         }
 781
 782         skb_reserve(skb, sk->sk_prot->max_header);
 783         rc = memcpy_from_msg(skb_put(skb, len), msg, len);
 784         if (rc != 0)
 785                 goto out_discard;
 786
 787         rc = dccp_msghdr_parse(msg, skb);
 788         if (rc != 0)
 789                 goto out_discard;
 790
 791         dccp_qpolicy_push(sk, skb);
 792         /*
 793          * The xmit_timer is set if the TX CCID is rate-based and will expire
 794          * when congestion control permits to release further packets into the
 795          * network. Window-based CCIDs do not use this timer.
 796          */
 797         if (!timer_pending(&dp->dccps_xmit_timer))
 798                 dccp_write_xmit(sk);
 799 out_release:
 800         release_sock(sk);
 801         return rc ? : len;
 802 out_discard:
 803         kfree_skb(skb);
 804         goto out_release;
 805 }
 806
 807 EXPORT_SYMBOL_GPL(dccp_sendmsg);
 808
 809 int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
 810                  int *addr_len)
 811 {
 812         const struct dccp_hdr *dh;
 813         long timeo;
 814
 815         lock_sock(sk);
 816
 817         if (sk->sk_state == DCCP_LISTEN) {
 818                 len = -ENOTCONN;
 819                 goto out;
 820         }
 821
 822         timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 823
 824         do {
 825                 struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 826
 827                 if (skb == NULL)
 828                         goto verify_sock_status;
 829
 830                 dh = dccp_hdr(skb);
 831
 832                 switch (dh->dccph_type) {
 833                 case DCCP_PKT_DATA:
 834                 case DCCP_PKT_DATAACK:
 835                         goto found_ok_skb;
 836
 837                 case DCCP_PKT_CLOSE:
 838                 case DCCP_PKT_CLOSEREQ:
 839                         if (!(flags & MSG_PEEK))
 840                                 dccp_finish_passive_close(sk);
 841                         fallthrough;
 842                 case DCCP_PKT_RESET:
 843                         dccp_pr_debug("found fin (%s) ok!\n",
 844                                       dccp_packet_name(dh->dccph_type));
 845                         len = 0;
 846                         goto found_fin_ok;
 847                 default:
 848                         dccp_pr_debug("packet_type=%s\n",
 849                                       dccp_packet_name(dh->dccph_type));
 850                         sk_eat_skb(sk, skb);
 851                 }
 852 verify_sock_status:
 853                 if (sock_flag(sk, SOCK_DONE)) {
 854                         len = 0;
 855                         break;
 856                 }
 857
 858                 if (sk->sk_err) {
 859                         len = sock_error(sk);
 860                         break;
 861                 }
 862
 863                 if (sk->sk_shutdown & RCV_SHUTDOWN) {
 864                         len = 0;
 865                         break;
 866                 }
 867
 868                 if (sk->sk_state == DCCP_CLOSED) {
 869                         if (!sock_flag(sk, SOCK_DONE)) {
 870                                 /* This occurs when user tries to read
 871                                  * from never connected socket.
 872                                  */
 873                                 len = -ENOTCONN;
 874                                 break;
 875                         }
 876                         len = 0;
 877                         break;
 878                 }
 879
 880                 if (!timeo) {
 881                         len = -EAGAIN;
 882                         break;
 883                 }
 884
 885                 if (signal_pending(current)) {
 886                         len = sock_intr_errno(timeo);
 887                         break;
 888                 }
 889
 890                 sk_wait_data(sk, &timeo, NULL);
 891                 continue;
 892         found_ok_skb:
 893                 if (len > skb->len)
 894                         len = skb->len;
 895                 else if (len < skb->len)
 896                         msg->msg_flags |= MSG_TRUNC;
 897
 898                 if (skb_copy_datagram_msg(skb, 0, msg, len)) {
 899                         /* Exception. Bailout! */
 900                         len = -EFAULT;
 901                         break;
 902                 }
 903                 if (flags & MSG_TRUNC)
 904                         len = skb->len;
 905         found_fin_ok:
 906                 if (!(flags & MSG_PEEK))
 907                         sk_eat_skb(sk, skb);
 908                 break;
 909         } while (1);
 910 out:
 911         release_sock(sk);
 912         return len;
 913 }
 914
 915 EXPORT_SYMBOL_GPL(dccp_recvmsg);
 916
 917 int inet_dccp_listen(struct socket *sock, int backlog)
 918 {
 919         struct sock *sk = sock->sk;
 920         unsigned char old_state;
 921         int err;
 922
 923         lock_sock(sk);
 924
 925         err = -EINVAL;
 926         if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
 927                 goto out;
 928
 929         old_state = sk->sk_state;
 930         if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
 931                 goto out;
 932
 933         WRITE_ONCE(sk->sk_max_ack_backlog, backlog);
 934         /* Really, if the socket is already in listen state
 935          * we can only allow the backlog to be adjusted.
 936          */
 937         if (old_state != DCCP_LISTEN) {
 938                 struct dccp_sock *dp = dccp_sk(sk);
 939
 940                 dp->dccps_role = DCCP_ROLE_LISTEN;
 941
 942                 /* do not start to listen if feature negotiation setup fails */
 943                 if (dccp_feat_finalise_settings(dp)) {
 944                         err = -EPROTO;
 945                         goto out;
 946                 }
 947
 948                 err = inet_csk_listen_start(sk);
 949                 if (err)
 950                         goto out;
 951         }
 952         err = 0;
 953
 954 out:
 955         release_sock(sk);
 956         return err;
 957 }
 958
 959 EXPORT_SYMBOL_GPL(inet_dccp_listen);
 960
 961 static void dccp_terminate_connection(struct sock *sk)
 962 {
 963         u8 next_state = DCCP_CLOSED;
 964
 965         switch (sk->sk_state) {
 966         case DCCP_PASSIVE_CLOSE:
 967         case DCCP_PASSIVE_CLOSEREQ:
 968                 dccp_finish_passive_close(sk);
 969                 break;
 970         case DCCP_PARTOPEN:
 971                 dccp_pr_debug("Stop PARTOPEN timer (%p)\n", sk);
 972                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 973                 fallthrough;
 974         case DCCP_OPEN:
 975                 dccp_send_close(sk, 1);
 976
 977                 if (dccp_sk(sk)->dccps_role == DCCP_ROLE_SERVER &&
 978                     !dccp_sk(sk)->dccps_server_timewait)
 979                         next_state = DCCP_ACTIVE_CLOSEREQ;
 980                 else
 981                         next_state = DCCP_CLOSING;
 982                 fallthrough;
 983         default:
 984                 dccp_set_state(sk, next_state);
 985         }
 986 }
 987
 988 void dccp_close(struct sock *sk, long timeout)
 989 {
 990         struct dccp_sock *dp = dccp_sk(sk);
 991         struct sk_buff *skb;
 992         u32 data_was_unread = 0;
 993         int state;
 994
 995         lock_sock(sk);
 996
 997         sk->sk_shutdown = SHUTDOWN_MASK;
 998
 999         if (sk->sk_state == DCCP_LISTEN) {
1000                 dccp_set_state(sk, DCCP_CLOSED);
1001
1002                 /* Special case. */
1003                 inet_csk_listen_stop(sk);
1004
1005                 goto adjudge_to_death;
1006         }
1007
1008         sk_stop_timer(sk, &dp->dccps_xmit_timer);
1009
1010         /*
1011          * We need to flush the recv. buffs.  We do this only on the
1012          * descriptor close, not protocol-sourced closes, because the
1013           *reader process may not have drained the data yet!
1014          */
1015         while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
1016                 data_was_unread += skb->len;
1017                 __kfree_skb(skb);
1018         }
1019
1020         /* If socket has been already reset kill it. */
1021         if (sk->sk_state == DCCP_CLOSED)
1022                 goto adjudge_to_death;
1023
1024         if (data_was_unread) {
1025                 /* Unread data was tossed, send an appropriate Reset Code */
1026                 DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
1027                 dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED);
1028                 dccp_set_state(sk, DCCP_CLOSED);
1029         } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
1030                 /* Check zero linger _after_ checking for unread data. */
1031                 sk->sk_prot->disconnect(sk, 0);
1032         } else if (sk->sk_state != DCCP_CLOSED) {
1033                 /*
1034                  * Normal connection termination. May need to wait if there are
1035                  * still packets in the TX queue that are delayed by the CCID.
1036                  */
1037                 dccp_flush_write_queue(sk, &timeout);
1038                 dccp_terminate_connection(sk);
1039         }
1040
1041         /*
1042          * Flush write queue. This may be necessary in several cases:
1043          * - we have been closed by the peer but still have application data;
1044          * - abortive termination (unread data or zero linger time),
1045          * - normal termination but queue could not be flushed within time limit
1046          */
1047         __skb_queue_purge(&sk->sk_write_queue);
1048
1049         sk_stream_wait_close(sk, timeout);
1050
1051 adjudge_to_death:
1052         state = sk->sk_state;
1053         sock_hold(sk);
1054         sock_orphan(sk);
1055
1056         /*
1057          * It is the last release_sock in its life. It will remove backlog.
1058          */
1059         release_sock(sk);
1060         /*
1061          * Now socket is owned by kernel and we acquire BH lock
1062          * to finish close. No need to check for user refs.
1063          */
1064         local_bh_disable();
1065         bh_lock_sock(sk);
1066         WARN_ON(sock_owned_by_user(sk));
1067
1068         this_cpu_inc(dccp_orphan_count);
1069
1070         /* Have we already been destroyed by a softirq or backlog? */
1071         if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
1072                 goto out;
1073
1074         if (sk->sk_state == DCCP_CLOSED)
1075                 inet_csk_destroy_sock(sk);
1076
1077         /* Otherwise, socket is reprieved until protocol close. */
1078
1079 out:
1080         bh_unlock_sock(sk);
1081         local_bh_enable();
1082         sock_put(sk);
1083 }
1084
1085 EXPORT_SYMBOL_GPL(dccp_close);
1086
1087 void dccp_shutdown(struct sock *sk, int how)
1088 {
1089         dccp_pr_debug("called shutdown(%x)\n", how);
1090 }
1091
1092 EXPORT_SYMBOL_GPL(dccp_shutdown);
1093
1094 static inline int __init dccp_mib_init(void)
1095 {
1096         dccp_statistics = alloc_percpu(struct dccp_mib);
1097         if (!dccp_statistics)
1098                 return -ENOMEM;
1099         return 0;
1100 }
1101
1102 static inline void dccp_mib_exit(void)
1103 {
1104         free_percpu(dccp_statistics);
1105 }
1106
1107 static int thash_entries;
1108 module_param(thash_entries, int, 0444);
1109 MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
1110
1111 #ifdef CONFIG_IP_DCCP_DEBUG
1112 bool dccp_debug;
1113 module_param(dccp_debug, bool, 0644);
1114 MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
1115
1116 EXPORT_SYMBOL_GPL(dccp_debug);
1117 #endif
1118
1119 static int __init dccp_init(void)
1120 {
1121         unsigned long goal;
1122         unsigned long nr_pages = totalram_pages();
1123         int ehash_order, bhash_order, i;
1124         int rc;
1125
1126         BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1127                      sizeof_field(struct sk_buff, cb));
1128         rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
1129         if (rc)
1130                 goto out_fail;
1131         rc = -ENOBUFS;
1132         dccp_hashinfo.bind_bucket_cachep =
1133                 kmem_cache_create("dccp_bind_bucket",
1134                                   sizeof(struct inet_bind_bucket), 0,
1135                                   SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1136         if (!dccp_hashinfo.bind_bucket_cachep)
1137                 goto out_free_hashinfo2;
1138         dccp_hashinfo.bind2_bucket_cachep =
1139                 kmem_cache_create("dccp_bind2_bucket",
1140                                   sizeof(struct inet_bind2_bucket), 0,
1141                                   SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
1142         if (!dccp_hashinfo.bind2_bucket_cachep)
1143                 goto out_free_bind_bucket_cachep;
1144
1145         /*
1146          * Size and allocate the main established and bind bucket
1147          * hash tables.
1148          *
1149          * The methodology is similar to that of the buffer cache.
1150          */
1151         if (nr_pages >= (128 * 1024))
1152                 goal = nr_pages >> (21 - PAGE_SHIFT);
1153         else
1154                 goal = nr_pages >> (23 - PAGE_SHIFT);
1155
1156         if (thash_entries)
1157                 goal = (thash_entries *
1158                         sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
1159         for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
1160                 ;
1161         do {
1162                 unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
1163                                         sizeof(struct inet_ehash_bucket);
1164
1165                 while (hash_size & (hash_size - 1))
1166                         hash_size--;
1167                 dccp_hashinfo.ehash_mask = hash_size - 1;
1168                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1169                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1170         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
1171
1172         if (!dccp_hashinfo.ehash) {
1173                 DCCP_CRIT("Failed to allocate DCCP established hash table");
1174                 goto out_free_bind2_bucket_cachep;
1175         }
1176
1177         for (i = 0; i <= dccp_hashinfo.ehash_mask; i++)
1178                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
1179
1180         if (inet_ehash_locks_alloc(&dccp_hashinfo))
1181                         goto out_free_dccp_ehash;
1182
1183         bhash_order = ehash_order;
1184
1185         do {
1186                 dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
1187                                         sizeof(struct inet_bind_hashbucket);
1188                 if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
1189                     bhash_order > 0)
1190                         continue;
1191                 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1192                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1193         } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1194
1195         if (!dccp_hashinfo.bhash) {
1196                 DCCP_CRIT("Failed to allocate DCCP bind hash table");
1197                 goto out_free_dccp_locks;
1198         }
1199
1200         dccp_hashinfo.bhash2 = (struct inet_bind_hashbucket *)
1201                 __get_free_pages(GFP_ATOMIC | __GFP_NOWARN, bhash_order);
1202
1203         if (!dccp_hashinfo.bhash2) {
1204                 DCCP_CRIT("Failed to allocate DCCP bind2 hash table");
1205                 goto out_free_dccp_bhash;
1206         }
1207
1208         for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
1209                 spin_lock_init(&dccp_hashinfo.bhash[i].lock);
1210                 INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
1211                 spin_lock_init(&dccp_hashinfo.bhash2[i].lock);
1212                 INIT_HLIST_HEAD(&dccp_hashinfo.bhash2[i].chain);
1213         }
1214
1215         dccp_hashinfo.pernet = false;
1216
1217         rc = dccp_mib_init();
1218         if (rc)
1219                 goto out_free_dccp_bhash2;
1220
1221         rc = dccp_ackvec_init();
1222         if (rc)
1223                 goto out_free_dccp_mib;
1224
1225         rc = dccp_sysctl_init();
1226         if (rc)
1227                 goto out_ackvec_exit;
1228
1229         rc = ccid_initialize_builtins();
1230         if (rc)
1231                 goto out_sysctl_exit;
1232
1233         dccp_timestamping_init();
1234
1235         return 0;
1236
1237 out_sysctl_exit:
1238         dccp_sysctl_exit();
1239 out_ackvec_exit:
1240         dccp_ackvec_exit();
1241 out_free_dccp_mib:
1242         dccp_mib_exit();
1243 out_free_dccp_bhash2:
1244         free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1245 out_free_dccp_bhash:
1246         free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1247 out_free_dccp_locks:
1248         inet_ehash_locks_free(&dccp_hashinfo);
1249 out_free_dccp_ehash:
1250         free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
1251 out_free_bind2_bucket_cachep:
1252         kmem_cache_destroy(dccp_hashinfo.bind2_bucket_cachep);
1253 out_free_bind_bucket_cachep:
1254         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1255 out_free_hashinfo2:
1256         inet_hashinfo2_free_mod(&dccp_hashinfo);
1257 out_fail:
1258         dccp_hashinfo.bhash = NULL;
1259         dccp_hashinfo.bhash2 = NULL;
1260         dccp_hashinfo.ehash = NULL;
1261         dccp_hashinfo.bind_bucket_cachep = NULL;
1262         dccp_hashinfo.bind2_bucket_cachep = NULL;
1263         return rc;
1264 }
1265
1266 static void __exit dccp_fini(void)
1267 {
1268         int bhash_order = get_order(dccp_hashinfo.bhash_size *
1269                                     sizeof(struct inet_bind_hashbucket));
1270
1271         ccid_cleanup_builtins();
1272         dccp_mib_exit();
1273         free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
1274         free_pages((unsigned long)dccp_hashinfo.bhash2, bhash_order);
1275         free_pages((unsigned long)dccp_hashinfo.ehash,
1276                    get_order((dccp_hashinfo.ehash_mask + 1) *
1277                              sizeof(struct inet_ehash_bucket)));
1278         inet_ehash_locks_free(&dccp_hashinfo);
1279         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1280         dccp_ackvec_exit();
1281         dccp_sysctl_exit();
1282         inet_hashinfo2_free_mod(&dccp_hashinfo);
1283 }
1284
1285 module_init(dccp_init);
1286 module_exit(dccp_fini);
1287
1288 MODULE_LICENSE("GPL");
1289 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
1290 MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");