1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31#include <linux/types.h>
32#include <linux/rcupdate.h>
33#include <linux/list.h>
34#include <linux/spinlock.h>
35
36#include "ibpkey.h"
37#include "objsec.h"
38
39#define SEL_PKEY_HASH_SIZE 256
40#define SEL_PKEY_HASH_BKT_LIMIT 16
41
42struct sel_ib_pkey_bkt {
43 int size;
44 struct list_head list;
45};
46
47struct sel_ib_pkey {
48 struct pkey_security_struct psec;
49 struct list_head list;
50 struct rcu_head rcu;
51};
52
53static LIST_HEAD(sel_ib_pkey_list);
54static DEFINE_SPINLOCK(sel_ib_pkey_lock);
55static struct sel_ib_pkey_bkt sel_ib_pkey_hash[SEL_PKEY_HASH_SIZE];
56
57
58
59
60
61
62
63
64
65
66static unsigned int sel_ib_pkey_hashfn(u16 pkey)
67{
68 return (pkey & (SEL_PKEY_HASH_SIZE - 1));
69}
70
71
72
73
74
75
76
77
78
79
80
81static struct sel_ib_pkey *sel_ib_pkey_find(u64 subnet_prefix, u16 pkey_num)
82{
83 unsigned int idx;
84 struct sel_ib_pkey *pkey;
85
86 idx = sel_ib_pkey_hashfn(pkey_num);
87 list_for_each_entry_rcu(pkey, &sel_ib_pkey_hash[idx].list, list) {
88 if (pkey->psec.pkey == pkey_num &&
89 pkey->psec.subnet_prefix == subnet_prefix)
90 return pkey;
91 }
92
93 return NULL;
94}
95
96
97
98
99
100
101
102
103
104static void sel_ib_pkey_insert(struct sel_ib_pkey *pkey)
105{
106 unsigned int idx;
107
108
109
110
111 idx = sel_ib_pkey_hashfn(pkey->psec.pkey);
112 list_add_rcu(&pkey->list, &sel_ib_pkey_hash[idx].list);
113 if (sel_ib_pkey_hash[idx].size == SEL_PKEY_HASH_BKT_LIMIT) {
114 struct sel_ib_pkey *tail;
115
116 tail = list_entry(
117 rcu_dereference_protected(
118 sel_ib_pkey_hash[idx].list.prev,
119 lockdep_is_held(&sel_ib_pkey_lock)),
120 struct sel_ib_pkey, list);
121 list_del_rcu(&tail->list);
122 kfree_rcu(tail, rcu);
123 } else {
124 sel_ib_pkey_hash[idx].size++;
125 }
126}
127
128
129
130
131
132
133
134
135
136
137
138
139
140static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
141{
142 int ret;
143 struct sel_ib_pkey *pkey;
144 struct sel_ib_pkey *new = NULL;
145 unsigned long flags;
146
147 spin_lock_irqsave(&sel_ib_pkey_lock, flags);
148 pkey = sel_ib_pkey_find(subnet_prefix, pkey_num);
149 if (pkey) {
150 *sid = pkey->psec.sid;
151 spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
152 return 0;
153 }
154
155 ret = security_ib_pkey_sid(&selinux_state, subnet_prefix, pkey_num,
156 sid);
157 if (ret)
158 goto out;
159
160
161
162
163 new = kzalloc(sizeof(*new), GFP_ATOMIC);
164 if (!new)
165 goto out;
166
167 new->psec.subnet_prefix = subnet_prefix;
168 new->psec.pkey = pkey_num;
169 new->psec.sid = *sid;
170 sel_ib_pkey_insert(new);
171
172out:
173 spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
174 return ret;
175}
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190int sel_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *sid)
191{
192 struct sel_ib_pkey *pkey;
193
194 rcu_read_lock();
195 pkey = sel_ib_pkey_find(subnet_prefix, pkey_num);
196 if (pkey) {
197 *sid = pkey->psec.sid;
198 rcu_read_unlock();
199 return 0;
200 }
201 rcu_read_unlock();
202
203 return sel_ib_pkey_sid_slow(subnet_prefix, pkey_num, sid);
204}
205
206
207
208
209
210
211
212
213void sel_ib_pkey_flush(void)
214{
215 unsigned int idx;
216 struct sel_ib_pkey *pkey, *pkey_tmp;
217 unsigned long flags;
218
219 spin_lock_irqsave(&sel_ib_pkey_lock, flags);
220 for (idx = 0; idx < SEL_PKEY_HASH_SIZE; idx++) {
221 list_for_each_entry_safe(pkey, pkey_tmp,
222 &sel_ib_pkey_hash[idx].list, list) {
223 list_del_rcu(&pkey->list);
224 kfree_rcu(pkey, rcu);
225 }
226 sel_ib_pkey_hash[idx].size = 0;
227 }
228 spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
229}
230
231static __init int sel_ib_pkey_init(void)
232{
233 int iter;
234
235 if (!selinux_enabled)
236 return 0;
237
238 for (iter = 0; iter < SEL_PKEY_HASH_SIZE; iter++) {
239 INIT_LIST_HEAD(&sel_ib_pkey_hash[iter].list);
240 sel_ib_pkey_hash[iter].size = 0;
241 }
242
243 return 0;
244}
245
246subsys_initcall(sel_ib_pkey_init);
247