rxrpc: Don't expose skbs to in-kernel users [ver #2]
[cascardo/linux.git] / fs / afs / rxrpc.c
index 7b0d189..244896b 100644 (file)
 struct socket *afs_socket; /* my RxRPC socket */
 static struct workqueue_struct *afs_async_calls;
 static atomic_t afs_outstanding_calls;
-static atomic_t afs_outstanding_skbs;
 
-static void afs_wake_up_call_waiter(struct afs_call *);
+static void afs_free_call(struct afs_call *);
+static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
 static int afs_wait_for_call_to_complete(struct afs_call *);
-static void afs_wake_up_async_call(struct afs_call *);
+static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
 static int afs_dont_wait_for_call_to_complete(struct afs_call *);
-static void afs_process_async_call(struct afs_call *);
-static void afs_rx_interceptor(struct sock *, unsigned long, struct sk_buff *);
-static int afs_deliver_cm_op_id(struct afs_call *, struct sk_buff *, bool);
+static void afs_process_async_call(struct work_struct *);
+static void afs_rx_new_call(struct sock *);
+static int afs_deliver_cm_op_id(struct afs_call *);
 
 /* synchronous call management */
 const struct afs_wait_mode afs_sync_call = {
-       .rx_wakeup      = afs_wake_up_call_waiter,
+       .notify_rx      = afs_wake_up_call_waiter,
        .wait           = afs_wait_for_call_to_complete,
 };
 
 /* asynchronous call management */
 const struct afs_wait_mode afs_async_call = {
-       .rx_wakeup      = afs_wake_up_async_call,
+       .notify_rx      = afs_wake_up_async_call,
        .wait           = afs_dont_wait_for_call_to_complete,
 };
 
 /* asynchronous incoming call management */
 static const struct afs_wait_mode afs_async_incoming_call = {
-       .rx_wakeup      = afs_wake_up_async_call,
+       .notify_rx      = afs_wake_up_async_call,
 };
 
 /* asynchronous incoming call initial processing */
@@ -55,16 +55,8 @@ static const struct afs_call_type afs_RXCMxxxx = {
 
 static void afs_collect_incoming_call(struct work_struct *);
 
-static struct sk_buff_head afs_incoming_calls;
 static DECLARE_WORK(afs_collect_incoming_call_work, afs_collect_incoming_call);
 
-static void afs_async_workfn(struct work_struct *work)
-{
-       struct afs_call *call = container_of(work, struct afs_call, async_work);
-
-       call->async_workfn(call);
-}
-
 static int afs_wait_atomic_t(atomic_t *p)
 {
        schedule();
@@ -83,8 +75,6 @@ int afs_open_socket(void)
 
        _enter("");
 
-       skb_queue_head_init(&afs_incoming_calls);
-
        ret = -ENOMEM;
        afs_async_calls = create_singlethread_workqueue("kafsd");
        if (!afs_async_calls)
@@ -110,12 +100,12 @@ int afs_open_socket(void)
        if (ret < 0)
                goto error_2;
 
+       rxrpc_kernel_new_call_notification(socket, afs_rx_new_call);
+
        ret = kernel_listen(socket, INT_MAX);
        if (ret < 0)
                goto error_2;
 
-       rxrpc_kernel_intercept_rx_messages(socket, afs_rx_interceptor);
-
        afs_socket = socket;
        _leave(" = 0");
        return 0;
@@ -136,51 +126,19 @@ void afs_close_socket(void)
 {
        _enter("");
 
+       _debug("outstanding %u", atomic_read(&afs_outstanding_calls));
        wait_on_atomic_t(&afs_outstanding_calls, afs_wait_atomic_t,
                         TASK_UNINTERRUPTIBLE);
        _debug("no outstanding calls");
 
+       flush_workqueue(afs_async_calls);
        sock_release(afs_socket);
 
        _debug("dework");
        destroy_workqueue(afs_async_calls);
-
-       ASSERTCMP(atomic_read(&afs_outstanding_skbs), ==, 0);
        _leave("");
 }
 
-/*
- * Note that the data in a socket buffer is now consumed.
- */
-void afs_data_consumed(struct afs_call *call, struct sk_buff *skb)
-{
-       if (!skb) {
-               _debug("DLVR NULL [%d]", atomic_read(&afs_outstanding_skbs));
-               dump_stack();
-       } else {
-               _debug("DLVR %p{%u} [%d]",
-                      skb, skb->mark, atomic_read(&afs_outstanding_skbs));
-               rxrpc_kernel_data_consumed(call->rxcall, skb);
-       }
-}
-
-/*
- * free a socket buffer
- */
-static void afs_free_skb(struct sk_buff *skb)
-{
-       if (!skb) {
-               _debug("FREE NULL [%d]", atomic_read(&afs_outstanding_skbs));
-               dump_stack();
-       } else {
-               _debug("FREE %p{%u} [%d]",
-                      skb, skb->mark, atomic_read(&afs_outstanding_skbs));
-               if (atomic_dec_return(&afs_outstanding_skbs) == -1)
-                       BUG();
-               rxrpc_kernel_free_skb(skb);
-       }
-}
-
 /*
  * free a call
  */
@@ -191,7 +149,6 @@ static void afs_free_call(struct afs_call *call)
 
        ASSERTCMP(call->rxcall, ==, NULL);
        ASSERT(!work_pending(&call->async_work));
-       ASSERT(skb_queue_empty(&call->rx_queue));
        ASSERT(call->type->name != NULL);
 
        kfree(call->request);
@@ -227,7 +184,7 @@ static void afs_end_call(struct afs_call *call)
  * allocate a call with flat request and reply buffers
  */
 struct afs_call *afs_alloc_flat_call(const struct afs_call_type *type,
-                                    size_t request_size, size_t reply_size)
+                                    size_t request_size, size_t reply_max)
 {
        struct afs_call *call;
 
@@ -241,7 +198,7 @@ struct afs_call *afs_alloc_flat_call(const struct afs_call_type *type,
 
        call->type = type;
        call->request_size = request_size;
-       call->reply_max = reply_size;
+       call->reply_max = reply_max;
 
        if (request_size) {
                call->request = kmalloc(request_size, GFP_NOFS);
@@ -249,14 +206,13 @@ struct afs_call *afs_alloc_flat_call(const struct afs_call_type *type,
                        goto nomem_free;
        }
 
-       if (reply_size) {
-               call->buffer = kmalloc(reply_size, GFP_NOFS);
+       if (reply_max) {
+               call->buffer = kmalloc(reply_max, GFP_NOFS);
                if (!call->buffer)
                        goto nomem_free;
        }
 
        init_waitqueue_head(&call->waitq);
-       skb_queue_head_init(&call->rx_queue);
        return call;
 
 nomem_free:
@@ -354,7 +310,6 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
        struct msghdr msg;
        struct kvec iov[1];
        int ret;
-       struct sk_buff *skb;
 
        _enter("%x,{%d},", addr->s_addr, ntohs(call->port));
 
@@ -366,8 +321,7 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
               atomic_read(&afs_outstanding_calls));
 
        call->wait_mode = wait_mode;
-       call->async_workfn = afs_process_async_call;
-       INIT_WORK(&call->async_work, afs_async_workfn);
+       INIT_WORK(&call->async_work, afs_process_async_call);
 
        memset(&srx, 0, sizeof(srx));
        srx.srx_family = AF_RXRPC;
@@ -380,7 +334,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
 
        /* create a call */
        rxcall = rxrpc_kernel_begin_call(afs_socket, &srx, call->key,
-                                        (unsigned long) call, gfp);
+                                        (unsigned long) call, gfp,
+                                        wait_mode->notify_rx);
        call->key = NULL;
        if (IS_ERR(rxcall)) {
                ret = PTR_ERR(rxcall);
@@ -423,150 +378,84 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
 
 error_do_abort:
        rxrpc_kernel_abort_call(afs_socket, rxcall, RX_USER_ABORT);
-       while ((skb = skb_dequeue(&call->rx_queue)))
-               afs_free_skb(skb);
 error_kill_call:
        afs_end_call(call);
        _leave(" = %d", ret);
        return ret;
 }
 
-/*
- * Handles intercepted messages that were arriving in the socket's Rx queue.
- *
- * Called from the AF_RXRPC call processor in waitqueue process context.  For
- * each call, it is guaranteed this will be called in order of packet to be
- * delivered.
- */
-static void afs_rx_interceptor(struct sock *sk, unsigned long user_call_ID,
-                              struct sk_buff *skb)
-{
-       struct afs_call *call = (struct afs_call *) user_call_ID;
-
-       _enter("%p,,%u", call, skb->mark);
-
-       _debug("ICPT %p{%u} [%d]",
-              skb, skb->mark, atomic_read(&afs_outstanding_skbs));
-
-       ASSERTCMP(sk, ==, afs_socket->sk);
-       atomic_inc(&afs_outstanding_skbs);
-
-       if (!call) {
-               /* its an incoming call for our callback service */
-               skb_queue_tail(&afs_incoming_calls, skb);
-               queue_work(afs_wq, &afs_collect_incoming_call_work);
-       } else {
-               /* route the messages directly to the appropriate call */
-               skb_queue_tail(&call->rx_queue, skb);
-               call->wait_mode->rx_wakeup(call);
-       }
-
-       _leave("");
-}
-
 /*
  * deliver messages to a call
  */
 static void afs_deliver_to_call(struct afs_call *call)
 {
-       struct sk_buff *skb;
-       bool last;
        u32 abort_code;
        int ret;
 
-       _enter("");
-
-       while ((call->state == AFS_CALL_AWAIT_REPLY ||
-               call->state == AFS_CALL_AWAIT_OP_ID ||
-               call->state == AFS_CALL_AWAIT_REQUEST ||
-               call->state == AFS_CALL_AWAIT_ACK) &&
-              (skb = skb_dequeue(&call->rx_queue))) {
-               switch (skb->mark) {
-               case RXRPC_SKB_MARK_DATA:
-                       _debug("Rcv DATA");
-                       last = rxrpc_kernel_is_data_last(skb);
-                       ret = call->type->deliver(call, skb, last);
-                       switch (ret) {
-                       case -EAGAIN:
-                               if (last) {
-                                       _debug("short data");
-                                       goto unmarshal_error;
-                               }
-                               break;
-                       case 0:
-                               ASSERT(last);
-                               if (call->state == AFS_CALL_AWAIT_REPLY)
-                                       call->state = AFS_CALL_COMPLETE;
-                               break;
-                       case -ENOTCONN:
-                               abort_code = RX_CALL_DEAD;
-                               goto do_abort;
-                       case -ENOTSUPP:
-                               abort_code = RX_INVALID_OPERATION;
-                               goto do_abort;
-                       default:
-                       unmarshal_error:
-                               abort_code = RXGEN_CC_UNMARSHAL;
-                               if (call->state != AFS_CALL_AWAIT_REPLY)
-                                       abort_code = RXGEN_SS_UNMARSHAL;
-                       do_abort:
-                               rxrpc_kernel_abort_call(afs_socket,
-                                                       call->rxcall,
-                                                       abort_code);
-                               call->error = ret;
-                               call->state = AFS_CALL_ERROR;
-                               break;
+       _enter("%s", call->type->name);
+
+       while (call->state == AFS_CALL_AWAIT_REPLY ||
+              call->state == AFS_CALL_AWAIT_OP_ID ||
+              call->state == AFS_CALL_AWAIT_REQUEST ||
+              call->state == AFS_CALL_AWAIT_ACK
+              ) {
+               if (call->state == AFS_CALL_AWAIT_ACK) {
+                       size_t offset = 0;
+                       ret = rxrpc_kernel_recv_data(afs_socket, call->rxcall,
+                                                    NULL, 0, &offset, false,
+                                                    &call->abort_code);
+                       if (ret == -EINPROGRESS || ret == -EAGAIN)
+                               return;
+                       if (ret == 1) {
+                               call->state = AFS_CALL_COMPLETE;
+                               goto done;
                        }
-                       break;
-               case RXRPC_SKB_MARK_FINAL_ACK:
-                       _debug("Rcv ACK");
-                       call->state = AFS_CALL_COMPLETE;
-                       break;
-               case RXRPC_SKB_MARK_BUSY:
-                       _debug("Rcv BUSY");
-                       call->error = -EBUSY;
-                       call->state = AFS_CALL_BUSY;
-                       break;
-               case RXRPC_SKB_MARK_REMOTE_ABORT:
-                       abort_code = rxrpc_kernel_get_abort_code(skb);
-                       call->error = call->type->abort_to_error(abort_code);
-                       call->state = AFS_CALL_ABORTED;
-                       _debug("Rcv ABORT %u -> %d", abort_code, call->error);
-                       break;
-               case RXRPC_SKB_MARK_LOCAL_ABORT:
-                       abort_code = rxrpc_kernel_get_abort_code(skb);
-                       call->error = call->type->abort_to_error(abort_code);
-                       call->state = AFS_CALL_ABORTED;
-                       _debug("Loc ABORT %u -> %d", abort_code, call->error);
-                       break;
-               case RXRPC_SKB_MARK_NET_ERROR:
-                       call->error = -rxrpc_kernel_get_error_number(skb);
-                       call->state = AFS_CALL_ERROR;
-                       _debug("Rcv NET ERROR %d", call->error);
-                       break;
-               case RXRPC_SKB_MARK_LOCAL_ERROR:
-                       call->error = -rxrpc_kernel_get_error_number(skb);
-                       call->state = AFS_CALL_ERROR;
-                       _debug("Rcv LOCAL ERROR %d", call->error);
-                       break;
-               default:
-                       BUG();
-                       break;
+                       return;
                }
 
-               afs_free_skb(skb);
-       }
-
-       /* make sure the queue is empty if the call is done with (we might have
-        * aborted the call early because of an unmarshalling error) */
-       if (call->state >= AFS_CALL_COMPLETE) {
-               while ((skb = skb_dequeue(&call->rx_queue)))
-                       afs_free_skb(skb);
-               if (call->incoming)
-                       afs_end_call(call);
+               ret = call->type->deliver(call);
+               switch (ret) {
+               case 0:
+                       if (call->state == AFS_CALL_AWAIT_REPLY)
+                               call->state = AFS_CALL_COMPLETE;
+                       goto done;
+               case -EINPROGRESS:
+               case -EAGAIN:
+                       goto out;
+               case -ENOTCONN:
+                       abort_code = RX_CALL_DEAD;
+                       rxrpc_kernel_abort_call(afs_socket, call->rxcall,
+                                               abort_code);
+                       goto do_abort;
+               case -ENOTSUPP:
+                       abort_code = RX_INVALID_OPERATION;
+                       rxrpc_kernel_abort_call(afs_socket, call->rxcall,
+                                               abort_code);
+                       goto do_abort;
+               case -ENODATA:
+               case -EBADMSG:
+               case -EMSGSIZE:
+               default:
+                       abort_code = RXGEN_CC_UNMARSHAL;
+                       if (call->state != AFS_CALL_AWAIT_REPLY)
+                               abort_code = RXGEN_SS_UNMARSHAL;
+                       rxrpc_kernel_abort_call(afs_socket, call->rxcall,
+                                               abort_code);
+                       goto do_abort;
+               }
        }
 
+done:
+       if (call->state == AFS_CALL_COMPLETE && call->incoming)
+               afs_end_call(call);
+out:
        _leave("");
+       return;
+
+do_abort:
+       call->error = ret;
+       call->state = AFS_CALL_COMPLETE;
+       goto done;
 }
 
 /*
@@ -574,7 +463,6 @@ static void afs_deliver_to_call(struct afs_call *call)
  */
 static int afs_wait_for_call_to_complete(struct afs_call *call)
 {
-       struct sk_buff *skb;
        int ret;
 
        DECLARE_WAITQUEUE(myself, current);
@@ -586,14 +474,15 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
                set_current_state(TASK_INTERRUPTIBLE);
 
                /* deliver any messages that are in the queue */
-               if (!skb_queue_empty(&call->rx_queue)) {
+               if (call->state < AFS_CALL_COMPLETE && call->need_attention) {
+                       call->need_attention = false;
                        __set_current_state(TASK_RUNNING);
                        afs_deliver_to_call(call);
                        continue;
                }
 
                ret = call->error;
-               if (call->state >= AFS_CALL_COMPLETE)
+               if (call->state == AFS_CALL_COMPLETE)
                        break;
                ret = -EINTR;
                if (signal_pending(current))
@@ -607,9 +496,8 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
        /* kill the call */
        if (call->state < AFS_CALL_COMPLETE) {
                _debug("call incomplete");
-               rxrpc_kernel_abort_call(afs_socket, call->rxcall, RX_CALL_DEAD);
-               while ((skb = skb_dequeue(&call->rx_queue)))
-                       afs_free_skb(skb);
+               rxrpc_kernel_abort_call(afs_socket, call->rxcall,
+                                       RX_CALL_DEAD);
        }
 
        _debug("call complete");
@@ -621,17 +509,24 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
 /*
  * wake up a waiting call
  */
-static void afs_wake_up_call_waiter(struct afs_call *call)
+static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall,
+                                   unsigned long call_user_ID)
 {
+       struct afs_call *call = (struct afs_call *)call_user_ID;
+
+       call->need_attention = true;
        wake_up(&call->waitq);
 }
 
 /*
  * wake up an asynchronous call
  */
-static void afs_wake_up_async_call(struct afs_call *call)
+static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
+                                  unsigned long call_user_ID)
 {
-       _enter("");
+       struct afs_call *call = (struct afs_call *)call_user_ID;
+
+       call->need_attention = true;
        queue_work(afs_async_calls, &call->async_work);
 }
 
@@ -649,8 +544,10 @@ static int afs_dont_wait_for_call_to_complete(struct afs_call *call)
 /*
  * delete an asynchronous call
  */
-static void afs_delete_async_call(struct afs_call *call)
+static void afs_delete_async_call(struct work_struct *work)
 {
+       struct afs_call *call = container_of(work, struct afs_call, async_work);
+
        _enter("");
 
        afs_free_call(call);
@@ -660,17 +557,19 @@ static void afs_delete_async_call(struct afs_call *call)
 
 /*
  * perform processing on an asynchronous call
- * - on a multiple-thread workqueue this work item may try to run on several
- *   CPUs at the same time
  */
-static void afs_process_async_call(struct afs_call *call)
+static void afs_process_async_call(struct work_struct *work)
 {
+       struct afs_call *call = container_of(work, struct afs_call, async_work);
+
        _enter("");
 
-       if (!skb_queue_empty(&call->rx_queue))
+       if (call->state < AFS_CALL_COMPLETE && call->need_attention) {
+               call->need_attention = false;
                afs_deliver_to_call(call);
+       }
 
-       if (call->state >= AFS_CALL_COMPLETE && call->wait_mode) {
+       if (call->state == AFS_CALL_COMPLETE && call->wait_mode) {
                if (call->wait_mode->async_complete)
                        call->wait_mode->async_complete(call->reply,
                                                        call->error);
@@ -681,45 +580,13 @@ static void afs_process_async_call(struct afs_call *call)
 
                /* we can't just delete the call because the work item may be
                 * queued */
-               call->async_workfn = afs_delete_async_call;
+               call->async_work.func = afs_delete_async_call;
                queue_work(afs_async_calls, &call->async_work);
        }
 
        _leave("");
 }
 
-/*
- * Empty a socket buffer into a flat reply buffer.
- */
-int afs_transfer_reply(struct afs_call *call, struct sk_buff *skb, bool last)
-{
-       size_t len = skb->len;
-
-       if (len > call->reply_max - call->reply_size) {
-               _leave(" = -EBADMSG [%zu > %u]",
-                      len, call->reply_max - call->reply_size);
-               return -EBADMSG;
-       }
-
-       if (len > 0) {
-               if (skb_copy_bits(skb, 0, call->buffer + call->reply_size,
-                                 len) < 0)
-                       BUG();
-               call->reply_size += len;
-       }
-
-       afs_data_consumed(call, skb);
-       if (!last)
-               return -EAGAIN;
-
-       if (call->reply_size != call->reply_max) {
-               _leave(" = -EBADMSG [%u != %u]",
-                      call->reply_size, call->reply_max);
-               return -EBADMSG;
-       }
-       return 0;
-}
-
 /*
  * accept the backlog of incoming calls
  */
@@ -727,14 +594,10 @@ static void afs_collect_incoming_call(struct work_struct *work)
 {
        struct rxrpc_call *rxcall;
        struct afs_call *call = NULL;
-       struct sk_buff *skb;
-
-       while ((skb = skb_dequeue(&afs_incoming_calls))) {
-               _debug("new call");
 
-               /* don't need the notification */
-               afs_free_skb(skb);
+       _enter("");
 
+       do {
                if (!call) {
                        call = kzalloc(sizeof(struct afs_call), GFP_KERNEL);
                        if (!call) {
@@ -742,12 +605,10 @@ static void afs_collect_incoming_call(struct work_struct *work)
                                return;
                        }
 
-                       call->async_workfn = afs_process_async_call;
-                       INIT_WORK(&call->async_work, afs_async_workfn);
+                       INIT_WORK(&call->async_work, afs_process_async_call);
                        call->wait_mode = &afs_async_incoming_call;
                        call->type = &afs_RXCMxxxx;
                        init_waitqueue_head(&call->waitq);
-                       skb_queue_head_init(&call->rx_queue);
                        call->state = AFS_CALL_AWAIT_OP_ID;
 
                        _debug("CALL %p{%s} [%d]",
@@ -757,46 +618,47 @@ static void afs_collect_incoming_call(struct work_struct *work)
                }
 
                rxcall = rxrpc_kernel_accept_call(afs_socket,
-                                                 (unsigned long) call);
+                                                 (unsigned long)call,
+                                                 afs_wake_up_async_call);
                if (!IS_ERR(rxcall)) {
                        call->rxcall = rxcall;
+                       call->need_attention = true;
+                       queue_work(afs_async_calls, &call->async_work);
                        call = NULL;
                }
-       }
+       } while (!call);
 
        if (call)
                afs_free_call(call);
 }
 
+/*
+ * Notification of an incoming call.
+ */
+static void afs_rx_new_call(struct sock *sk)
+{
+       queue_work(afs_wq, &afs_collect_incoming_call_work);
+}
+
 /*
  * Grab the operation ID from an incoming cache manager call.  The socket
  * buffer is discarded on error or if we don't yet have sufficient data.
  */
-static int afs_deliver_cm_op_id(struct afs_call *call, struct sk_buff *skb,
-                               bool last)
+static int afs_deliver_cm_op_id(struct afs_call *call)
 {
-       size_t len = skb->len;
-       void *oibuf = (void *) &call->operation_ID;
+       int ret;
 
-       _enter("{%u},{%zu},%d", call->offset, len, last);
+       _enter("{%zu}", call->offset);
 
        ASSERTCMP(call->offset, <, 4);
 
        /* the operation ID forms the first four bytes of the request data */
-       len = min_t(size_t, len, 4 - call->offset);
-       if (skb_copy_bits(skb, 0, oibuf + call->offset, len) < 0)
-               BUG();
-       if (!pskb_pull(skb, len))
-               BUG();
-       call->offset += len;
-
-       if (call->offset < 4) {
-               afs_data_consumed(call, skb);
-               _leave(" = -EAGAIN");
-               return -EAGAIN;
-       }
+       ret = afs_extract_data(call, &call->operation_ID, 4, true);
+       if (ret < 0)
+               return ret;
 
        call->state = AFS_CALL_AWAIT_REQUEST;
+       call->offset = 0;
 
        /* ask the cache manager to route the call (it'll change the call type
         * if successful) */
@@ -805,7 +667,7 @@ static int afs_deliver_cm_op_id(struct afs_call *call, struct sk_buff *skb,
 
        /* pass responsibility for the remainer of this message off to the
         * cache manager op */
-       return call->type->deliver(call, skb, last);
+       return call->type->deliver(call);
 }
 
 /*
@@ -881,25 +743,40 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
 /*
  * Extract a piece of data from the received data socket buffers.
  */
-int afs_extract_data(struct afs_call *call, struct sk_buff *skb,
-                    bool last, void *buf, size_t count)
+int afs_extract_data(struct afs_call *call, void *buf, size_t count,
+                    bool want_more)
 {
-       size_t len = skb->len;
+       int ret;
 
-       _enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count);
+       _enter("{%s,%zu},,%zu,%d",
+              call->type->name, call->offset, count, want_more);
 
-       ASSERTCMP(call->offset, <, count);
+       ASSERTCMP(call->offset, <=, count);
 
-       len = min_t(size_t, len, count - call->offset);
-       if (skb_copy_bits(skb, 0, buf + call->offset, len) < 0 ||
-           !pskb_pull(skb, len))
-               BUG();
-       call->offset += len;
+       ret = rxrpc_kernel_recv_data(afs_socket, call->rxcall,
+                                    buf, count, &call->offset,
+                                    want_more, &call->abort_code);
+       if (ret == 0 || ret == -EAGAIN)
+               return ret;
 
-       if (call->offset < count) {
-               afs_data_consumed(call, skb);
-               _leave(" = -EAGAIN");
-               return -EAGAIN;
+       if (ret == 1) {
+               switch (call->state) {
+               case AFS_CALL_AWAIT_REPLY:
+                       call->state = AFS_CALL_COMPLETE;
+                       break;
+               case AFS_CALL_AWAIT_REQUEST:
+                       call->state = AFS_CALL_REPLYING;
+                       break;
+               default:
+                       break;
+               }
+               return 0;
        }
-       return 0;
+
+       if (ret == -ECONNABORTED)
+               call->error = call->type->abort_to_error(call->abort_code);
+       else
+               call->error = ret;
+       call->state = AFS_CALL_COMPLETE;
+       return ret;
 }