]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/socket.c
net: socket: add __sys_accept4() helper; remove in-kernel call to syscall
[mirror_ubuntu-jammy-kernel.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
408eccce 75#include <linux/ptp_classify.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
600e1779 91#include <linux/xattr.h>
1da177e4 92
7c0f6ba6 93#include <linux/uaccess.h>
1da177e4
LT
94#include <asm/unistd.h>
95
96#include <net/compat.h>
87de87d5 97#include <net/wext.h>
f8451725 98#include <net/cls_cgroup.h>
1da177e4
LT
99
100#include <net/sock.h>
101#include <linux/netfilter.h>
102
6b96018b
AB
103#include <linux/if_tun.h>
104#include <linux/ipv6_route.h>
105#include <linux/route.h>
6b96018b
AB
106#include <linux/sockios.h>
107#include <linux/atalk.h>
076bb0c8 108#include <net/busy_poll.h>
f24b9be5 109#include <linux/errqueue.h>
06021292 110
e0d1095a 111#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
112unsigned int sysctl_net_busy_read __read_mostly;
113unsigned int sysctl_net_busy_poll __read_mostly;
06021292 114#endif
6b96018b 115
8ae5e030
AV
116static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
117static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
89bddce5 118static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
119
120static int sock_close(struct inode *inode, struct file *file);
ade994f4 121static __poll_t sock_poll(struct file *file,
1da177e4 122 struct poll_table_struct *wait);
89bddce5 123static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
124#ifdef CONFIG_COMPAT
125static long compat_sock_ioctl(struct file *file,
89bddce5 126 unsigned int cmd, unsigned long arg);
89bbfc95 127#endif
1da177e4 128static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
129static ssize_t sock_sendpage(struct file *file, struct page *page,
130 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 131static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 132 struct pipe_inode_info *pipe, size_t len,
9c55e01c 133 unsigned int flags);
1da177e4 134
1da177e4
LT
135/*
136 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
137 * in the operation structures but are done directly via the socketcall() multiplexor.
138 */
139
da7071d7 140static const struct file_operations socket_file_ops = {
1da177e4
LT
141 .owner = THIS_MODULE,
142 .llseek = no_llseek,
8ae5e030
AV
143 .read_iter = sock_read_iter,
144 .write_iter = sock_write_iter,
1da177e4
LT
145 .poll = sock_poll,
146 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
147#ifdef CONFIG_COMPAT
148 .compat_ioctl = compat_sock_ioctl,
149#endif
1da177e4 150 .mmap = sock_mmap,
1da177e4
LT
151 .release = sock_close,
152 .fasync = sock_fasync,
5274f052
JA
153 .sendpage = sock_sendpage,
154 .splice_write = generic_splice_sendpage,
9c55e01c 155 .splice_read = sock_splice_read,
1da177e4
LT
156};
157
158/*
159 * The protocol list. Each protocol is registered in here.
160 */
161
1da177e4 162static DEFINE_SPINLOCK(net_family_lock);
190683a9 163static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 164
1da177e4 165/*
89bddce5
SH
166 * Support routines.
167 * Move socket addresses back and forth across the kernel/user
168 * divide and look after the messy bits.
1da177e4
LT
169 */
170
1da177e4
LT
171/**
172 * move_addr_to_kernel - copy a socket address into kernel space
173 * @uaddr: Address in user space
174 * @kaddr: Address in kernel space
175 * @ulen: Length in user space
176 *
177 * The address is copied into kernel space. If the provided address is
178 * too long an error code of -EINVAL is returned. If the copy gives
179 * invalid addresses -EFAULT is returned. On a success 0 is returned.
180 */
181
43db362d 182int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 183{
230b1839 184 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 185 return -EINVAL;
89bddce5 186 if (ulen == 0)
1da177e4 187 return 0;
89bddce5 188 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 189 return -EFAULT;
3ec3b2fb 190 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
191}
192
193/**
194 * move_addr_to_user - copy an address to user space
195 * @kaddr: kernel space address
196 * @klen: length of address in kernel
197 * @uaddr: user space address
198 * @ulen: pointer to user length field
199 *
200 * The value pointed to by ulen on entry is the buffer length available.
201 * This is overwritten with the buffer space used. -EINVAL is returned
202 * if an overlong buffer is specified or a negative buffer size. -EFAULT
203 * is returned if either the buffer or the length field are not
204 * accessible.
205 * After copying the data up to the limit the user specifies, the true
206 * length of the data is written over the length limit the user
207 * specified. Zero is returned for a success.
208 */
89bddce5 209
43db362d 210static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 211 void __user *uaddr, int __user *ulen)
1da177e4
LT
212{
213 int err;
214 int len;
215
68c6beb3 216 BUG_ON(klen > sizeof(struct sockaddr_storage));
89bddce5
SH
217 err = get_user(len, ulen);
218 if (err)
1da177e4 219 return err;
89bddce5
SH
220 if (len > klen)
221 len = klen;
68c6beb3 222 if (len < 0)
1da177e4 223 return -EINVAL;
89bddce5 224 if (len) {
d6fe3945
SG
225 if (audit_sockaddr(klen, kaddr))
226 return -ENOMEM;
89bddce5 227 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
228 return -EFAULT;
229 }
230 /*
89bddce5
SH
231 * "fromlen shall refer to the value before truncation.."
232 * 1003.1g
1da177e4
LT
233 */
234 return __put_user(klen, ulen);
235}
236
e18b890b 237static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
238
239static struct inode *sock_alloc_inode(struct super_block *sb)
240{
241 struct socket_alloc *ei;
eaefd110 242 struct socket_wq *wq;
89bddce5 243
e94b1766 244 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
245 if (!ei)
246 return NULL;
eaefd110
ED
247 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
248 if (!wq) {
43815482
ED
249 kmem_cache_free(sock_inode_cachep, ei);
250 return NULL;
251 }
eaefd110
ED
252 init_waitqueue_head(&wq->wait);
253 wq->fasync_list = NULL;
574aab1e 254 wq->flags = 0;
eaefd110 255 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 256
1da177e4
LT
257 ei->socket.state = SS_UNCONNECTED;
258 ei->socket.flags = 0;
259 ei->socket.ops = NULL;
260 ei->socket.sk = NULL;
261 ei->socket.file = NULL;
1da177e4
LT
262
263 return &ei->vfs_inode;
264}
265
266static void sock_destroy_inode(struct inode *inode)
267{
43815482 268 struct socket_alloc *ei;
eaefd110 269 struct socket_wq *wq;
43815482
ED
270
271 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 272 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 273 kfree_rcu(wq, rcu);
43815482 274 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
275}
276
51cc5068 277static void init_once(void *foo)
1da177e4 278{
89bddce5 279 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 280
a35afb83 281 inode_init_once(&ei->vfs_inode);
1da177e4 282}
89bddce5 283
1e911632 284static void init_inodecache(void)
1da177e4
LT
285{
286 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
287 sizeof(struct socket_alloc),
288 0,
289 (SLAB_HWCACHE_ALIGN |
290 SLAB_RECLAIM_ACCOUNT |
5d097056 291 SLAB_MEM_SPREAD | SLAB_ACCOUNT),
20c2df83 292 init_once);
1e911632 293 BUG_ON(sock_inode_cachep == NULL);
1da177e4
LT
294}
295
b87221de 296static const struct super_operations sockfs_ops = {
c6d409cf
ED
297 .alloc_inode = sock_alloc_inode,
298 .destroy_inode = sock_destroy_inode,
299 .statfs = simple_statfs,
1da177e4
LT
300};
301
c23fbb6b
ED
302/*
303 * sockfs_dname() is called from d_path().
304 */
305static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
306{
307 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
c5ef6035 308 d_inode(dentry)->i_ino);
c23fbb6b
ED
309}
310
3ba13d17 311static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 312 .d_dname = sockfs_dname,
1da177e4
LT
313};
314
bba0bd31
AG
315static int sockfs_xattr_get(const struct xattr_handler *handler,
316 struct dentry *dentry, struct inode *inode,
317 const char *suffix, void *value, size_t size)
318{
319 if (value) {
320 if (dentry->d_name.len + 1 > size)
321 return -ERANGE;
322 memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
323 }
324 return dentry->d_name.len + 1;
325}
326
327#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
328#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
329#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
330
331static const struct xattr_handler sockfs_xattr_handler = {
332 .name = XATTR_NAME_SOCKPROTONAME,
333 .get = sockfs_xattr_get,
334};
335
4a590153
AG
336static int sockfs_security_xattr_set(const struct xattr_handler *handler,
337 struct dentry *dentry, struct inode *inode,
338 const char *suffix, const void *value,
339 size_t size, int flags)
340{
341 /* Handled by LSM. */
342 return -EAGAIN;
343}
344
345static const struct xattr_handler sockfs_security_xattr_handler = {
346 .prefix = XATTR_SECURITY_PREFIX,
347 .set = sockfs_security_xattr_set,
348};
349
bba0bd31
AG
350static const struct xattr_handler *sockfs_xattr_handlers[] = {
351 &sockfs_xattr_handler,
4a590153 352 &sockfs_security_xattr_handler,
bba0bd31
AG
353 NULL
354};
355
c74a1cbb
AV
356static struct dentry *sockfs_mount(struct file_system_type *fs_type,
357 int flags, const char *dev_name, void *data)
358{
bba0bd31
AG
359 return mount_pseudo_xattr(fs_type, "socket:", &sockfs_ops,
360 sockfs_xattr_handlers,
361 &sockfs_dentry_operations, SOCKFS_MAGIC);
c74a1cbb
AV
362}
363
364static struct vfsmount *sock_mnt __read_mostly;
365
366static struct file_system_type sock_fs_type = {
367 .name = "sockfs",
368 .mount = sockfs_mount,
369 .kill_sb = kill_anon_super,
370};
371
1da177e4
LT
372/*
373 * Obtains the first available file descriptor and sets it up for use.
374 *
39d8c1b6
DM
375 * These functions create file structures and maps them to fd space
376 * of the current process. On success it returns file descriptor
1da177e4
LT
377 * and file struct implicitly stored in sock->file.
378 * Note that another thread may close file descriptor before we return
379 * from this function. We use the fact that now we do not refer
380 * to socket after mapping. If one day we will need it, this
381 * function will increment ref. count on file by 1.
382 *
383 * In any case returned fd MAY BE not valid!
384 * This race condition is unavoidable
385 * with shared fd spaces, we cannot solve it inside kernel,
386 * but we take care of internal coherence yet.
387 */
388
aab174f0 389struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 390{
7cbe66b6 391 struct qstr name = { .name = "" };
2c48b9c4 392 struct path path;
7cbe66b6 393 struct file *file;
1da177e4 394
600e1779
MY
395 if (dname) {
396 name.name = dname;
397 name.len = strlen(name.name);
398 } else if (sock->sk) {
399 name.name = sock->sk->sk_prot_creator->name;
400 name.len = strlen(name.name);
401 }
4b936885 402 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
8e1611e2
AV
403 if (unlikely(!path.dentry)) {
404 sock_release(sock);
28407630 405 return ERR_PTR(-ENOMEM);
8e1611e2 406 }
2c48b9c4 407 path.mnt = mntget(sock_mnt);
39d8c1b6 408
2c48b9c4 409 d_instantiate(path.dentry, SOCK_INODE(sock));
39d8c1b6 410
2c48b9c4 411 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 412 &socket_file_ops);
b5ffe634 413 if (IS_ERR(file)) {
8e1611e2 414 /* drop dentry, keep inode for a bit */
c5ef6035 415 ihold(d_inode(path.dentry));
2c48b9c4 416 path_put(&path);
8e1611e2
AV
417 /* ... and now kill it properly */
418 sock_release(sock);
39b65252 419 return file;
cc3808f8
AV
420 }
421
422 sock->file = file;
77d27200 423 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 424 file->private_data = sock;
28407630 425 return file;
39d8c1b6 426}
56b31d1c 427EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 428
56b31d1c 429static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
430{
431 struct file *newfile;
28407630 432 int fd = get_unused_fd_flags(flags);
ce4bb04c
AV
433 if (unlikely(fd < 0)) {
434 sock_release(sock);
28407630 435 return fd;
ce4bb04c 436 }
39d8c1b6 437
aab174f0 438 newfile = sock_alloc_file(sock, flags, NULL);
28407630 439 if (likely(!IS_ERR(newfile))) {
39d8c1b6 440 fd_install(fd, newfile);
28407630
AV
441 return fd;
442 }
7cbe66b6 443
28407630
AV
444 put_unused_fd(fd);
445 return PTR_ERR(newfile);
1da177e4
LT
446}
447
406a3c63 448struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 449{
6cb153ca
BL
450 if (file->f_op == &socket_file_ops)
451 return file->private_data; /* set in sock_map_fd */
452
23bb80d2
ED
453 *err = -ENOTSOCK;
454 return NULL;
6cb153ca 455}
406a3c63 456EXPORT_SYMBOL(sock_from_file);
6cb153ca 457
1da177e4 458/**
c6d409cf 459 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
460 * @fd: file handle
461 * @err: pointer to an error code return
462 *
463 * The file handle passed in is locked and the socket it is bound
241c4667 464 * to is returned. If an error occurs the err pointer is overwritten
1da177e4
LT
465 * with a negative errno code and NULL is returned. The function checks
466 * for both invalid handles and passing a handle which is not a socket.
467 *
468 * On a success the socket object pointer is returned.
469 */
470
471struct socket *sockfd_lookup(int fd, int *err)
472{
473 struct file *file;
1da177e4
LT
474 struct socket *sock;
475
89bddce5
SH
476 file = fget(fd);
477 if (!file) {
1da177e4
LT
478 *err = -EBADF;
479 return NULL;
480 }
89bddce5 481
6cb153ca
BL
482 sock = sock_from_file(file, err);
483 if (!sock)
1da177e4 484 fput(file);
6cb153ca
BL
485 return sock;
486}
c6d409cf 487EXPORT_SYMBOL(sockfd_lookup);
1da177e4 488
6cb153ca
BL
489static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
490{
00e188ef 491 struct fd f = fdget(fd);
6cb153ca
BL
492 struct socket *sock;
493
3672558c 494 *err = -EBADF;
00e188ef
AV
495 if (f.file) {
496 sock = sock_from_file(f.file, err);
497 if (likely(sock)) {
498 *fput_needed = f.flags;
6cb153ca 499 return sock;
00e188ef
AV
500 }
501 fdput(f);
1da177e4 502 }
6cb153ca 503 return NULL;
1da177e4
LT
504}
505
600e1779
MY
506static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
507 size_t size)
508{
509 ssize_t len;
510 ssize_t used = 0;
511
c5ef6035 512 len = security_inode_listsecurity(d_inode(dentry), buffer, size);
600e1779
MY
513 if (len < 0)
514 return len;
515 used += len;
516 if (buffer) {
517 if (size < used)
518 return -ERANGE;
519 buffer += len;
520 }
521
522 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
523 used += len;
524 if (buffer) {
525 if (size < used)
526 return -ERANGE;
527 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
528 buffer += len;
529 }
530
531 return used;
532}
533
dc647ec8 534static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
86741ec2
LC
535{
536 int err = simple_setattr(dentry, iattr);
537
e1a3a60a 538 if (!err && (iattr->ia_valid & ATTR_UID)) {
86741ec2
LC
539 struct socket *sock = SOCKET_I(d_inode(dentry));
540
541 sock->sk->sk_uid = iattr->ia_uid;
542 }
543
544 return err;
545}
546
600e1779 547static const struct inode_operations sockfs_inode_ops = {
600e1779 548 .listxattr = sockfs_listxattr,
86741ec2 549 .setattr = sockfs_setattr,
600e1779
MY
550};
551
1da177e4
LT
552/**
553 * sock_alloc - allocate a socket
89bddce5 554 *
1da177e4
LT
555 * Allocate a new inode and socket object. The two are bound together
556 * and initialised. The socket is then returned. If we are out of inodes
557 * NULL is returned.
558 */
559
f4a00aac 560struct socket *sock_alloc(void)
1da177e4 561{
89bddce5
SH
562 struct inode *inode;
563 struct socket *sock;
1da177e4 564
a209dfc7 565 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
566 if (!inode)
567 return NULL;
568
569 sock = SOCKET_I(inode);
570
85fe4025 571 inode->i_ino = get_next_ino();
89bddce5 572 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
573 inode->i_uid = current_fsuid();
574 inode->i_gid = current_fsgid();
600e1779 575 inode->i_op = &sockfs_inode_ops;
1da177e4 576
1da177e4
LT
577 return sock;
578}
f4a00aac 579EXPORT_SYMBOL(sock_alloc);
1da177e4 580
1da177e4
LT
581/**
582 * sock_release - close a socket
583 * @sock: socket to close
584 *
585 * The socket is released from the protocol stack if it has a release
586 * callback, and the inode is then released if the socket is bound to
89bddce5 587 * an inode not a file.
1da177e4 588 */
89bddce5 589
1da177e4
LT
590void sock_release(struct socket *sock)
591{
592 if (sock->ops) {
593 struct module *owner = sock->ops->owner;
594
595 sock->ops->release(sock);
596 sock->ops = NULL;
597 module_put(owner);
598 }
599
eaefd110 600 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
3410f22e 601 pr_err("%s: fasync list not empty!\n", __func__);
1da177e4 602
1da177e4
LT
603 if (!sock->file) {
604 iput(SOCK_INODE(sock));
605 return;
606 }
89bddce5 607 sock->file = NULL;
1da177e4 608}
c6d409cf 609EXPORT_SYMBOL(sock_release);
1da177e4 610
c14ac945 611void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
20d49473 612{
140c55d4
ED
613 u8 flags = *tx_flags;
614
c14ac945 615 if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
140c55d4
ED
616 flags |= SKBTX_HW_TSTAMP;
617
c14ac945 618 if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
140c55d4
ED
619 flags |= SKBTX_SW_TSTAMP;
620
c14ac945 621 if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
140c55d4
ED
622 flags |= SKBTX_SCHED_TSTAMP;
623
140c55d4 624 *tx_flags = flags;
20d49473 625}
67cc0d40 626EXPORT_SYMBOL(__sock_tx_timestamp);
20d49473 627
d8725c86 628static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
1da177e4 629{
01e97e65 630 int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
d8725c86
AV
631 BUG_ON(ret == -EIOCBQUEUED);
632 return ret;
1da177e4
LT
633}
634
d8725c86 635int sock_sendmsg(struct socket *sock, struct msghdr *msg)
228e548e 636{
d8725c86 637 int err = security_socket_sendmsg(sock, msg,
01e97e65 638 msg_data_left(msg));
228e548e 639
d8725c86 640 return err ?: sock_sendmsg_nosec(sock, msg);
0cf00c6f 641}
c6d409cf 642EXPORT_SYMBOL(sock_sendmsg);
1da177e4
LT
643
644int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
645 struct kvec *vec, size_t num, size_t size)
646{
6aa24814 647 iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
d8725c86 648 return sock_sendmsg(sock, msg);
1da177e4 649}
c6d409cf 650EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 651
306b13eb
TH
652int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
653 struct kvec *vec, size_t num, size_t size)
654{
655 struct socket *sock = sk->sk_socket;
656
657 if (!sock->ops->sendmsg_locked)
db5980d8 658 return sock_no_sendmsg_locked(sk, msg, size);
306b13eb
TH
659
660 iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
661
662 return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg));
663}
664EXPORT_SYMBOL(kernel_sendmsg_locked);
665
8605330a
SHY
666static bool skb_is_err_queue(const struct sk_buff *skb)
667{
668 /* pkt_type of skbs enqueued on the error queue are set to
669 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
670 * in recvmsg, since skbs received on a local socket will never
671 * have a pkt_type of PACKET_OUTGOING.
672 */
673 return skb->pkt_type == PACKET_OUTGOING;
674}
675
b50a5c70
ML
676/* On transmit, software and hardware timestamps are returned independently.
677 * As the two skb clones share the hardware timestamp, which may be updated
678 * before the software timestamp is received, a hardware TX timestamp may be
679 * returned only if there is no software TX timestamp. Ignore false software
680 * timestamps, which may be made in the __sock_recv_timestamp() call when the
681 * option SO_TIMESTAMP(NS) is enabled on the socket, even when the skb has a
682 * hardware timestamp.
683 */
684static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp)
685{
686 return skb->tstamp && !false_tstamp && skb_is_err_queue(skb);
687}
688
aad9c8c4
ML
689static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb)
690{
691 struct scm_ts_pktinfo ts_pktinfo;
692 struct net_device *orig_dev;
693
694 if (!skb_mac_header_was_set(skb))
695 return;
696
697 memset(&ts_pktinfo, 0, sizeof(ts_pktinfo));
698
699 rcu_read_lock();
700 orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
701 if (orig_dev)
702 ts_pktinfo.if_index = orig_dev->ifindex;
703 rcu_read_unlock();
704
705 ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb);
706 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
707 sizeof(ts_pktinfo), &ts_pktinfo);
708}
709
92f37fd2
ED
710/*
711 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
712 */
713void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
714 struct sk_buff *skb)
715{
20d49473 716 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
f24b9be5 717 struct scm_timestamping tss;
b50a5c70 718 int empty = 1, false_tstamp = 0;
20d49473
PO
719 struct skb_shared_hwtstamps *shhwtstamps =
720 skb_hwtstamps(skb);
721
722 /* Race occurred between timestamp enabling and packet
723 receiving. Fill in the current time for now. */
b50a5c70 724 if (need_software_tstamp && skb->tstamp == 0) {
20d49473 725 __net_timestamp(skb);
b50a5c70
ML
726 false_tstamp = 1;
727 }
20d49473
PO
728
729 if (need_software_tstamp) {
730 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
731 struct timeval tv;
732 skb_get_timestamp(skb, &tv);
733 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
734 sizeof(tv), &tv);
735 } else {
f24b9be5
WB
736 struct timespec ts;
737 skb_get_timestampns(skb, &ts);
20d49473 738 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
f24b9be5 739 sizeof(ts), &ts);
20d49473
PO
740 }
741 }
742
f24b9be5 743 memset(&tss, 0, sizeof(tss));
c199105d 744 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
f24b9be5 745 ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
20d49473 746 empty = 0;
4d276eb6 747 if (shhwtstamps &&
b9f40e21 748 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
b50a5c70 749 !skb_is_swtx_tstamp(skb, false_tstamp) &&
aad9c8c4 750 ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2)) {
4d276eb6 751 empty = 0;
aad9c8c4
ML
752 if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) &&
753 !skb_is_err_queue(skb))
754 put_ts_pktinfo(msg, skb);
755 }
1c885808 756 if (!empty) {
20d49473 757 put_cmsg(msg, SOL_SOCKET,
f24b9be5 758 SCM_TIMESTAMPING, sizeof(tss), &tss);
1c885808 759
8605330a 760 if (skb_is_err_queue(skb) && skb->len &&
4ef1b286 761 SKB_EXT_ERR(skb)->opt_stats)
1c885808
FY
762 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
763 skb->len, skb->data);
764 }
92f37fd2 765}
7c81fd8b
ACM
766EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
767
6e3e939f
JB
768void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
769 struct sk_buff *skb)
770{
771 int ack;
772
773 if (!sock_flag(sk, SOCK_WIFI_STATUS))
774 return;
775 if (!skb->wifi_acked_valid)
776 return;
777
778 ack = skb->wifi_acked;
779
780 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
781}
782EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
783
11165f14 784static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
785 struct sk_buff *skb)
3b885787 786{
744d5a3e 787 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
3b885787 788 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
744d5a3e 789 sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
3b885787
NH
790}
791
767dd033 792void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
793 struct sk_buff *skb)
794{
795 sock_recv_timestamp(msg, sk, skb);
796 sock_recv_drops(msg, sk, skb);
797}
767dd033 798EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 799
1b784140 800static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
2da62906 801 int flags)
1da177e4 802{
2da62906 803 return sock->ops->recvmsg(sock, msg, msg_data_left(msg), flags);
1da177e4
LT
804}
805
2da62906 806int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
a2e27255 807{
2da62906 808 int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
a2e27255 809
2da62906 810 return err ?: sock_recvmsg_nosec(sock, msg, flags);
1da177e4 811}
c6d409cf 812EXPORT_SYMBOL(sock_recvmsg);
1da177e4 813
c1249c0a
ML
814/**
815 * kernel_recvmsg - Receive a message from a socket (kernel space)
816 * @sock: The socket to receive the message from
817 * @msg: Received message
818 * @vec: Input s/g array for message data
819 * @num: Size of input s/g array
820 * @size: Number of bytes to read
821 * @flags: Message flags (MSG_DONTWAIT, etc...)
822 *
823 * On return the msg structure contains the scatter/gather array passed in the
824 * vec argument. The array is modified so that it consists of the unfilled
825 * portion of the original array.
826 *
827 * The returned value is the total number of bytes received, or an error.
828 */
89bddce5
SH
829int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
830 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
831{
832 mm_segment_t oldfs = get_fs();
833 int result;
834
6aa24814 835 iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
1da177e4 836 set_fs(KERNEL_DS);
2da62906 837 result = sock_recvmsg(sock, msg, flags);
1da177e4
LT
838 set_fs(oldfs);
839 return result;
840}
c6d409cf 841EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 842
ce1d4d3e
CH
843static ssize_t sock_sendpage(struct file *file, struct page *page,
844 int offset, size_t size, loff_t *ppos, int more)
1da177e4 845{
1da177e4
LT
846 struct socket *sock;
847 int flags;
848
ce1d4d3e
CH
849 sock = file->private_data;
850
35f9c09f
ED
851 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
852 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
853 flags |= more;
ce1d4d3e 854
e6949583 855 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 856}
1da177e4 857
9c55e01c 858static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 859 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
860 unsigned int flags)
861{
862 struct socket *sock = file->private_data;
863
997b37da
RDC
864 if (unlikely(!sock->ops->splice_read))
865 return -EINVAL;
866
9c55e01c
JA
867 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
868}
869
8ae5e030 870static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
ce1d4d3e 871{
6d652330
AV
872 struct file *file = iocb->ki_filp;
873 struct socket *sock = file->private_data;
0345f931 874 struct msghdr msg = {.msg_iter = *to,
875 .msg_iocb = iocb};
8ae5e030 876 ssize_t res;
ce1d4d3e 877
8ae5e030
AV
878 if (file->f_flags & O_NONBLOCK)
879 msg.msg_flags = MSG_DONTWAIT;
880
881 if (iocb->ki_pos != 0)
1da177e4 882 return -ESPIPE;
027445c3 883
66ee59af 884 if (!iov_iter_count(to)) /* Match SYS5 behaviour */
1da177e4
LT
885 return 0;
886
2da62906 887 res = sock_recvmsg(sock, &msg, msg.msg_flags);
8ae5e030
AV
888 *to = msg.msg_iter;
889 return res;
1da177e4
LT
890}
891
8ae5e030 892static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
ce1d4d3e 893{
6d652330
AV
894 struct file *file = iocb->ki_filp;
895 struct socket *sock = file->private_data;
0345f931 896 struct msghdr msg = {.msg_iter = *from,
897 .msg_iocb = iocb};
8ae5e030 898 ssize_t res;
1da177e4 899
8ae5e030 900 if (iocb->ki_pos != 0)
ce1d4d3e 901 return -ESPIPE;
027445c3 902
8ae5e030
AV
903 if (file->f_flags & O_NONBLOCK)
904 msg.msg_flags = MSG_DONTWAIT;
905
6d652330
AV
906 if (sock->type == SOCK_SEQPACKET)
907 msg.msg_flags |= MSG_EOR;
908
d8725c86 909 res = sock_sendmsg(sock, &msg);
8ae5e030
AV
910 *from = msg.msg_iter;
911 return res;
1da177e4
LT
912}
913
1da177e4
LT
914/*
915 * Atomic setting of ioctl hooks to avoid race
916 * with module unload.
917 */
918
4a3e2f71 919static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 920static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 921
881d966b 922void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 923{
4a3e2f71 924 mutex_lock(&br_ioctl_mutex);
1da177e4 925 br_ioctl_hook = hook;
4a3e2f71 926 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
927}
928EXPORT_SYMBOL(brioctl_set);
929
4a3e2f71 930static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 931static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 932
881d966b 933void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 934{
4a3e2f71 935 mutex_lock(&vlan_ioctl_mutex);
1da177e4 936 vlan_ioctl_hook = hook;
4a3e2f71 937 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
938}
939EXPORT_SYMBOL(vlan_ioctl_set);
940
4a3e2f71 941static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 942static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 943
89bddce5 944void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 945{
4a3e2f71 946 mutex_lock(&dlci_ioctl_mutex);
1da177e4 947 dlci_ioctl_hook = hook;
4a3e2f71 948 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
949}
950EXPORT_SYMBOL(dlci_ioctl_set);
951
6b96018b
AB
952static long sock_do_ioctl(struct net *net, struct socket *sock,
953 unsigned int cmd, unsigned long arg)
954{
955 int err;
956 void __user *argp = (void __user *)arg;
957
958 err = sock->ops->ioctl(sock, cmd, arg);
959
960 /*
961 * If this ioctl is unknown try to hand it down
962 * to the NIC driver.
963 */
36fd633e
AV
964 if (err != -ENOIOCTLCMD)
965 return err;
6b96018b 966
36fd633e
AV
967 if (cmd == SIOCGIFCONF) {
968 struct ifconf ifc;
969 if (copy_from_user(&ifc, argp, sizeof(struct ifconf)))
970 return -EFAULT;
971 rtnl_lock();
972 err = dev_ifconf(net, &ifc, sizeof(struct ifreq));
973 rtnl_unlock();
974 if (!err && copy_to_user(argp, &ifc, sizeof(struct ifconf)))
975 err = -EFAULT;
44c02a2c
AV
976 } else {
977 struct ifreq ifr;
978 bool need_copyout;
979 if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
980 return -EFAULT;
981 err = dev_ioctl(net, cmd, &ifr, &need_copyout);
982 if (!err && need_copyout)
983 if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
984 return -EFAULT;
36fd633e 985 }
6b96018b
AB
986 return err;
987}
988
1da177e4
LT
989/*
990 * With an ioctl, arg may well be a user mode pointer, but we don't know
991 * what to do with it - that's up to the protocol still.
992 */
993
c62cce2c
AV
994static struct ns_common *get_net_ns(struct ns_common *ns)
995{
996 return &get_net(container_of(ns, struct net, ns))->ns;
997}
998
1da177e4
LT
999static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1000{
1001 struct socket *sock;
881d966b 1002 struct sock *sk;
1da177e4
LT
1003 void __user *argp = (void __user *)arg;
1004 int pid, err;
881d966b 1005 struct net *net;
1da177e4 1006
b69aee04 1007 sock = file->private_data;
881d966b 1008 sk = sock->sk;
3b1e0a65 1009 net = sock_net(sk);
44c02a2c
AV
1010 if (unlikely(cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))) {
1011 struct ifreq ifr;
1012 bool need_copyout;
1013 if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
1014 return -EFAULT;
1015 err = dev_ioctl(net, cmd, &ifr, &need_copyout);
1016 if (!err && need_copyout)
1017 if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
1018 return -EFAULT;
1da177e4 1019 } else
3d23e349 1020#ifdef CONFIG_WEXT_CORE
1da177e4 1021 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
b1b0c245 1022 err = wext_handle_ioctl(net, cmd, argp);
1da177e4 1023 } else
3d23e349 1024#endif
89bddce5 1025 switch (cmd) {
1da177e4
LT
1026 case FIOSETOWN:
1027 case SIOCSPGRP:
1028 err = -EFAULT;
1029 if (get_user(pid, (int __user *)argp))
1030 break;
393cc3f5 1031 err = f_setown(sock->file, pid, 1);
1da177e4
LT
1032 break;
1033 case FIOGETOWN:
1034 case SIOCGPGRP:
609d7fa9 1035 err = put_user(f_getown(sock->file),
89bddce5 1036 (int __user *)argp);
1da177e4
LT
1037 break;
1038 case SIOCGIFBR:
1039 case SIOCSIFBR:
1040 case SIOCBRADDBR:
1041 case SIOCBRDELBR:
1042 err = -ENOPKG;
1043 if (!br_ioctl_hook)
1044 request_module("bridge");
1045
4a3e2f71 1046 mutex_lock(&br_ioctl_mutex);
89bddce5 1047 if (br_ioctl_hook)
881d966b 1048 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1049 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1050 break;
1051 case SIOCGIFVLAN:
1052 case SIOCSIFVLAN:
1053 err = -ENOPKG;
1054 if (!vlan_ioctl_hook)
1055 request_module("8021q");
1056
4a3e2f71 1057 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1058 if (vlan_ioctl_hook)
881d966b 1059 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1060 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1061 break;
1da177e4
LT
1062 case SIOCADDDLCI:
1063 case SIOCDELDLCI:
1064 err = -ENOPKG;
1065 if (!dlci_ioctl_hook)
1066 request_module("dlci");
1067
7512cbf6
PE
1068 mutex_lock(&dlci_ioctl_mutex);
1069 if (dlci_ioctl_hook)
1da177e4 1070 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1071 mutex_unlock(&dlci_ioctl_mutex);
1da177e4 1072 break;
c62cce2c
AV
1073 case SIOCGSKNS:
1074 err = -EPERM;
1075 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1076 break;
1077
1078 err = open_related_ns(&net->ns, get_net_ns);
1079 break;
1da177e4 1080 default:
6b96018b 1081 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1082 break;
89bddce5 1083 }
1da177e4
LT
1084 return err;
1085}
1086
1087int sock_create_lite(int family, int type, int protocol, struct socket **res)
1088{
1089 int err;
1090 struct socket *sock = NULL;
89bddce5 1091
1da177e4
LT
1092 err = security_socket_create(family, type, protocol, 1);
1093 if (err)
1094 goto out;
1095
1096 sock = sock_alloc();
1097 if (!sock) {
1098 err = -ENOMEM;
1099 goto out;
1100 }
1101
1da177e4 1102 sock->type = type;
7420ed23
VY
1103 err = security_socket_post_create(sock, family, type, protocol, 1);
1104 if (err)
1105 goto out_release;
1106
1da177e4
LT
1107out:
1108 *res = sock;
1109 return err;
7420ed23
VY
1110out_release:
1111 sock_release(sock);
1112 sock = NULL;
1113 goto out;
1da177e4 1114}
c6d409cf 1115EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1116
1117/* No kernel lock held - perfect */
ade994f4 1118static __poll_t sock_poll(struct file *file, poll_table *wait)
1da177e4 1119{
e6c8adca 1120 __poll_t busy_flag = 0;
1da177e4
LT
1121 struct socket *sock;
1122
1123 /*
89bddce5 1124 * We can't return errors to poll, so it's either yes or no.
1da177e4 1125 */
b69aee04 1126 sock = file->private_data;
2d48d67f 1127
cbf55001 1128 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1129 /* this socket can poll_ll so tell the system call */
cbf55001 1130 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1131
1132 /* once, only if requested by syscall */
cbf55001
ET
1133 if (wait && (wait->_key & POLL_BUSY_LOOP))
1134 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1135 }
1136
cbf55001 1137 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1138}
1139
89bddce5 1140static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1141{
b69aee04 1142 struct socket *sock = file->private_data;
1da177e4
LT
1143
1144 return sock->ops->mmap(file, sock, vma);
1145}
1146
20380731 1147static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1148{
1da177e4
LT
1149 sock_release(SOCKET_I(inode));
1150 return 0;
1151}
1152
1153/*
1154 * Update the socket async list
1155 *
1156 * Fasync_list locking strategy.
1157 *
1158 * 1. fasync_list is modified only under process context socket lock
1159 * i.e. under semaphore.
1160 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1161 * or under socket lock
1da177e4
LT
1162 */
1163
1164static int sock_fasync(int fd, struct file *filp, int on)
1165{
989a2979
ED
1166 struct socket *sock = filp->private_data;
1167 struct sock *sk = sock->sk;
eaefd110 1168 struct socket_wq *wq;
1da177e4 1169
989a2979 1170 if (sk == NULL)
1da177e4 1171 return -EINVAL;
1da177e4
LT
1172
1173 lock_sock(sk);
1e1d04e6 1174 wq = rcu_dereference_protected(sock->wq, lockdep_sock_is_held(sk));
eaefd110 1175 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1176
eaefd110 1177 if (!wq->fasync_list)
989a2979
ED
1178 sock_reset_flag(sk, SOCK_FASYNC);
1179 else
bcdce719 1180 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1181
989a2979 1182 release_sock(sk);
1da177e4
LT
1183 return 0;
1184}
1185
ceb5d58b 1186/* This function may be called only under rcu_lock */
1da177e4 1187
ceb5d58b 1188int sock_wake_async(struct socket_wq *wq, int how, int band)
1da177e4 1189{
ceb5d58b 1190 if (!wq || !wq->fasync_list)
1da177e4 1191 return -1;
ceb5d58b 1192
89bddce5 1193 switch (how) {
8d8ad9d7 1194 case SOCK_WAKE_WAITD:
ceb5d58b 1195 if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1da177e4
LT
1196 break;
1197 goto call_kill;
8d8ad9d7 1198 case SOCK_WAKE_SPACE:
ceb5d58b 1199 if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1da177e4
LT
1200 break;
1201 /* fall through */
8d8ad9d7 1202 case SOCK_WAKE_IO:
89bddce5 1203call_kill:
43815482 1204 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1205 break;
8d8ad9d7 1206 case SOCK_WAKE_URG:
43815482 1207 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1208 }
ceb5d58b 1209
1da177e4
LT
1210 return 0;
1211}
c6d409cf 1212EXPORT_SYMBOL(sock_wake_async);
1da177e4 1213
721db93a 1214int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1215 struct socket **res, int kern)
1da177e4
LT
1216{
1217 int err;
1218 struct socket *sock;
55737fda 1219 const struct net_proto_family *pf;
1da177e4
LT
1220
1221 /*
89bddce5 1222 * Check protocol is in range
1da177e4
LT
1223 */
1224 if (family < 0 || family >= NPROTO)
1225 return -EAFNOSUPPORT;
1226 if (type < 0 || type >= SOCK_MAX)
1227 return -EINVAL;
1228
1229 /* Compatibility.
1230
1231 This uglymoron is moved from INET layer to here to avoid
1232 deadlock in module load.
1233 */
1234 if (family == PF_INET && type == SOCK_PACKET) {
f3c98690 1235 pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1236 current->comm);
1da177e4
LT
1237 family = PF_PACKET;
1238 }
1239
1240 err = security_socket_create(family, type, protocol, kern);
1241 if (err)
1242 return err;
89bddce5 1243
55737fda
SH
1244 /*
1245 * Allocate the socket and allow the family to set things up. if
1246 * the protocol is 0, the family is instructed to select an appropriate
1247 * default.
1248 */
1249 sock = sock_alloc();
1250 if (!sock) {
e87cc472 1251 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1252 return -ENFILE; /* Not exactly a match, but its the
1253 closest posix thing */
1254 }
1255
1256 sock->type = type;
1257
95a5afca 1258#ifdef CONFIG_MODULES
89bddce5
SH
1259 /* Attempt to load a protocol module if the find failed.
1260 *
1261 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1262 * requested real, full-featured networking support upon configuration.
1263 * Otherwise module support will break!
1264 */
190683a9 1265 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1266 request_module("net-pf-%d", family);
1da177e4
LT
1267#endif
1268
55737fda
SH
1269 rcu_read_lock();
1270 pf = rcu_dereference(net_families[family]);
1271 err = -EAFNOSUPPORT;
1272 if (!pf)
1273 goto out_release;
1da177e4
LT
1274
1275 /*
1276 * We will call the ->create function, that possibly is in a loadable
1277 * module, so we have to bump that loadable module refcnt first.
1278 */
55737fda 1279 if (!try_module_get(pf->owner))
1da177e4
LT
1280 goto out_release;
1281
55737fda
SH
1282 /* Now protected by module ref count */
1283 rcu_read_unlock();
1284
3f378b68 1285 err = pf->create(net, sock, protocol, kern);
55737fda 1286 if (err < 0)
1da177e4 1287 goto out_module_put;
a79af59e 1288
1da177e4
LT
1289 /*
1290 * Now to bump the refcnt of the [loadable] module that owns this
1291 * socket at sock_release time we decrement its refcnt.
1292 */
55737fda
SH
1293 if (!try_module_get(sock->ops->owner))
1294 goto out_module_busy;
1295
1da177e4
LT
1296 /*
1297 * Now that we're done with the ->create function, the [loadable]
1298 * module can have its refcnt decremented
1299 */
55737fda 1300 module_put(pf->owner);
7420ed23
VY
1301 err = security_socket_post_create(sock, family, type, protocol, kern);
1302 if (err)
3b185525 1303 goto out_sock_release;
55737fda 1304 *res = sock;
1da177e4 1305
55737fda
SH
1306 return 0;
1307
1308out_module_busy:
1309 err = -EAFNOSUPPORT;
1da177e4 1310out_module_put:
55737fda
SH
1311 sock->ops = NULL;
1312 module_put(pf->owner);
1313out_sock_release:
1da177e4 1314 sock_release(sock);
55737fda
SH
1315 return err;
1316
1317out_release:
1318 rcu_read_unlock();
1319 goto out_sock_release;
1da177e4 1320}
721db93a 1321EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1322
1323int sock_create(int family, int type, int protocol, struct socket **res)
1324{
1b8d7ae4 1325 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1326}
c6d409cf 1327EXPORT_SYMBOL(sock_create);
1da177e4 1328
eeb1bd5c 1329int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1da177e4 1330{
eeb1bd5c 1331 return __sock_create(net, family, type, protocol, res, 1);
1da177e4 1332}
c6d409cf 1333EXPORT_SYMBOL(sock_create_kern);
1da177e4 1334
3e0fa65f 1335SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1336{
1337 int retval;
1338 struct socket *sock;
a677a039
UD
1339 int flags;
1340
e38b36f3
UD
1341 /* Check the SOCK_* constants for consistency. */
1342 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1343 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1344 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1345 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1346
a677a039 1347 flags = type & ~SOCK_TYPE_MASK;
77d27200 1348 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1349 return -EINVAL;
1350 type &= SOCK_TYPE_MASK;
1da177e4 1351
aaca0bdc
UD
1352 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1353 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1354
1da177e4
LT
1355 retval = sock_create(family, type, protocol, &sock);
1356 if (retval < 0)
8e1611e2 1357 return retval;
1da177e4 1358
8e1611e2 1359 return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1360}
1361
1362/*
1363 * Create a pair of connected sockets.
1364 */
1365
3e0fa65f
HC
1366SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1367 int __user *, usockvec)
1da177e4
LT
1368{
1369 struct socket *sock1, *sock2;
1370 int fd1, fd2, err;
db349509 1371 struct file *newfile1, *newfile2;
a677a039
UD
1372 int flags;
1373
1374 flags = type & ~SOCK_TYPE_MASK;
77d27200 1375 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1376 return -EINVAL;
1377 type &= SOCK_TYPE_MASK;
1da177e4 1378
aaca0bdc
UD
1379 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1380 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1381
016a266b
AV
1382 /*
1383 * reserve descriptors and make sure we won't fail
1384 * to return them to userland.
1385 */
1386 fd1 = get_unused_fd_flags(flags);
1387 if (unlikely(fd1 < 0))
1388 return fd1;
1389
1390 fd2 = get_unused_fd_flags(flags);
1391 if (unlikely(fd2 < 0)) {
1392 put_unused_fd(fd1);
1393 return fd2;
1394 }
1395
1396 err = put_user(fd1, &usockvec[0]);
1397 if (err)
1398 goto out;
1399
1400 err = put_user(fd2, &usockvec[1]);
1401 if (err)
1402 goto out;
1403
1da177e4
LT
1404 /*
1405 * Obtain the first socket and check if the underlying protocol
1406 * supports the socketpair call.
1407 */
1408
1409 err = sock_create(family, type, protocol, &sock1);
016a266b 1410 if (unlikely(err < 0))
1da177e4
LT
1411 goto out;
1412
1413 err = sock_create(family, type, protocol, &sock2);
016a266b
AV
1414 if (unlikely(err < 0)) {
1415 sock_release(sock1);
1416 goto out;
bf3c23d1 1417 }
d73aa286 1418
016a266b
AV
1419 err = sock1->ops->socketpair(sock1, sock2);
1420 if (unlikely(err < 0)) {
1421 sock_release(sock2);
1422 sock_release(sock1);
1423 goto out;
28407630
AV
1424 }
1425
aab174f0 1426 newfile1 = sock_alloc_file(sock1, flags, NULL);
b5ffe634 1427 if (IS_ERR(newfile1)) {
28407630 1428 err = PTR_ERR(newfile1);
016a266b
AV
1429 sock_release(sock2);
1430 goto out;
28407630
AV
1431 }
1432
aab174f0 1433 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1434 if (IS_ERR(newfile2)) {
1435 err = PTR_ERR(newfile2);
016a266b
AV
1436 fput(newfile1);
1437 goto out;
db349509
AV
1438 }
1439
157cf649 1440 audit_fd_pair(fd1, fd2);
d73aa286 1441
db349509
AV
1442 fd_install(fd1, newfile1);
1443 fd_install(fd2, newfile2);
d73aa286 1444 return 0;
1da177e4 1445
016a266b 1446out:
d73aa286 1447 put_unused_fd(fd2);
d73aa286 1448 put_unused_fd(fd1);
1da177e4
LT
1449 return err;
1450}
1451
1da177e4
LT
1452/*
1453 * Bind a name to a socket. Nothing much to do here since it's
1454 * the protocol's responsibility to handle the local address.
1455 *
1456 * We move the socket address to kernel space before we call
1457 * the protocol layer (having also checked the address is ok).
1458 */
1459
20f37034 1460SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1461{
1462 struct socket *sock;
230b1839 1463 struct sockaddr_storage address;
6cb153ca 1464 int err, fput_needed;
1da177e4 1465
89bddce5 1466 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1467 if (sock) {
43db362d 1468 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1469 if (err >= 0) {
1470 err = security_socket_bind(sock,
230b1839 1471 (struct sockaddr *)&address,
89bddce5 1472 addrlen);
6cb153ca
BL
1473 if (!err)
1474 err = sock->ops->bind(sock,
89bddce5 1475 (struct sockaddr *)
230b1839 1476 &address, addrlen);
1da177e4 1477 }
6cb153ca 1478 fput_light(sock->file, fput_needed);
89bddce5 1479 }
1da177e4
LT
1480 return err;
1481}
1482
1da177e4
LT
1483/*
1484 * Perform a listen. Basically, we allow the protocol to do anything
1485 * necessary for a listen, and if that works, we mark the socket as
1486 * ready for listening.
1487 */
1488
3e0fa65f 1489SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1490{
1491 struct socket *sock;
6cb153ca 1492 int err, fput_needed;
b8e1f9b5 1493 int somaxconn;
89bddce5
SH
1494
1495 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1496 if (sock) {
8efa6e93 1497 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1498 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1499 backlog = somaxconn;
1da177e4
LT
1500
1501 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1502 if (!err)
1503 err = sock->ops->listen(sock, backlog);
1da177e4 1504
6cb153ca 1505 fput_light(sock->file, fput_needed);
1da177e4
LT
1506 }
1507 return err;
1508}
1509
1da177e4
LT
1510/*
1511 * For accept, we attempt to create a new socket, set up the link
1512 * with the client, wake up the client, then return the new
1513 * connected fd. We collect the address of the connector in kernel
1514 * space and move it to user at the very end. This is unclean because
1515 * we open the socket then return an error.
1516 *
1517 * 1003.1g adds the ability to recvmsg() to query connection pending
1518 * status to recvmsg. We need to add that support in a way thats
1519 * clean when we restucture accept also.
1520 */
1521
4541e805
DB
1522int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
1523 int __user *upeer_addrlen, int flags)
1da177e4
LT
1524{
1525 struct socket *sock, *newsock;
39d8c1b6 1526 struct file *newfile;
6cb153ca 1527 int err, len, newfd, fput_needed;
230b1839 1528 struct sockaddr_storage address;
1da177e4 1529
77d27200 1530 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1531 return -EINVAL;
1532
1533 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1534 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1535
6cb153ca 1536 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1537 if (!sock)
1538 goto out;
1539
1540 err = -ENFILE;
c6d409cf
ED
1541 newsock = sock_alloc();
1542 if (!newsock)
1da177e4
LT
1543 goto out_put;
1544
1545 newsock->type = sock->type;
1546 newsock->ops = sock->ops;
1547
1da177e4
LT
1548 /*
1549 * We don't need try_module_get here, as the listening socket (sock)
1550 * has the protocol module (sock->ops->owner) held.
1551 */
1552 __module_get(newsock->ops->owner);
1553
28407630 1554 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1555 if (unlikely(newfd < 0)) {
1556 err = newfd;
9a1875e6
DM
1557 sock_release(newsock);
1558 goto out_put;
39d8c1b6 1559 }
aab174f0 1560 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
b5ffe634 1561 if (IS_ERR(newfile)) {
28407630
AV
1562 err = PTR_ERR(newfile);
1563 put_unused_fd(newfd);
28407630
AV
1564 goto out_put;
1565 }
39d8c1b6 1566
a79af59e
FF
1567 err = security_socket_accept(sock, newsock);
1568 if (err)
39d8c1b6 1569 goto out_fd;
a79af59e 1570
cdfbabfb 1571 err = sock->ops->accept(sock, newsock, sock->file->f_flags, false);
1da177e4 1572 if (err < 0)
39d8c1b6 1573 goto out_fd;
1da177e4
LT
1574
1575 if (upeer_sockaddr) {
230b1839 1576 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1577 &len, 2) < 0) {
1da177e4 1578 err = -ECONNABORTED;
39d8c1b6 1579 goto out_fd;
1da177e4 1580 }
43db362d 1581 err = move_addr_to_user(&address,
230b1839 1582 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1583 if (err < 0)
39d8c1b6 1584 goto out_fd;
1da177e4
LT
1585 }
1586
1587 /* File flags are not inherited via accept() unlike another OSes. */
1588
39d8c1b6
DM
1589 fd_install(newfd, newfile);
1590 err = newfd;
1da177e4 1591
1da177e4 1592out_put:
6cb153ca 1593 fput_light(sock->file, fput_needed);
1da177e4
LT
1594out:
1595 return err;
39d8c1b6 1596out_fd:
9606a216 1597 fput(newfile);
39d8c1b6 1598 put_unused_fd(newfd);
1da177e4
LT
1599 goto out_put;
1600}
1601
4541e805
DB
1602SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1603 int __user *, upeer_addrlen, int, flags)
1604{
1605 return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags);
1606}
1607
20f37034
HC
1608SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1609 int __user *, upeer_addrlen)
aaca0bdc 1610{
4541e805 1611 return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1612}
1613
1da177e4
LT
1614/*
1615 * Attempt to connect to a socket with the server address. The address
1616 * is in user space so we verify it is OK and move it to kernel space.
1617 *
1618 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1619 * break bindings
1620 *
1621 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1622 * other SEQPACKET protocols that take time to connect() as it doesn't
1623 * include the -EINPROGRESS status for such sockets.
1624 */
1625
20f37034
HC
1626SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1627 int, addrlen)
1da177e4
LT
1628{
1629 struct socket *sock;
230b1839 1630 struct sockaddr_storage address;
6cb153ca 1631 int err, fput_needed;
1da177e4 1632
6cb153ca 1633 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1634 if (!sock)
1635 goto out;
43db362d 1636 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1637 if (err < 0)
1638 goto out_put;
1639
89bddce5 1640 err =
230b1839 1641 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1642 if (err)
1643 goto out_put;
1644
230b1839 1645 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1646 sock->file->f_flags);
1647out_put:
6cb153ca 1648 fput_light(sock->file, fput_needed);
1da177e4
LT
1649out:
1650 return err;
1651}
1652
1653/*
1654 * Get the local address ('name') of a socket object. Move the obtained
1655 * name to user space.
1656 */
1657
20f37034
HC
1658SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1659 int __user *, usockaddr_len)
1da177e4
LT
1660{
1661 struct socket *sock;
230b1839 1662 struct sockaddr_storage address;
6cb153ca 1663 int len, err, fput_needed;
89bddce5 1664
6cb153ca 1665 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1666 if (!sock)
1667 goto out;
1668
1669 err = security_socket_getsockname(sock);
1670 if (err)
1671 goto out_put;
1672
230b1839 1673 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1674 if (err)
1675 goto out_put;
43db362d 1676 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1677
1678out_put:
6cb153ca 1679 fput_light(sock->file, fput_needed);
1da177e4
LT
1680out:
1681 return err;
1682}
1683
1684/*
1685 * Get the remote address ('name') of a socket object. Move the obtained
1686 * name to user space.
1687 */
1688
20f37034
HC
1689SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1690 int __user *, usockaddr_len)
1da177e4
LT
1691{
1692 struct socket *sock;
230b1839 1693 struct sockaddr_storage address;
6cb153ca 1694 int len, err, fput_needed;
1da177e4 1695
89bddce5
SH
1696 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1697 if (sock != NULL) {
1da177e4
LT
1698 err = security_socket_getpeername(sock);
1699 if (err) {
6cb153ca 1700 fput_light(sock->file, fput_needed);
1da177e4
LT
1701 return err;
1702 }
1703
89bddce5 1704 err =
230b1839 1705 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1706 1);
1da177e4 1707 if (!err)
43db362d 1708 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1709 usockaddr_len);
6cb153ca 1710 fput_light(sock->file, fput_needed);
1da177e4
LT
1711 }
1712 return err;
1713}
1714
1715/*
1716 * Send a datagram to a given address. We move the address into kernel
1717 * space and check the user space data area is readable before invoking
1718 * the protocol.
1719 */
211b634b
DB
1720int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
1721 struct sockaddr __user *addr, int addr_len)
1da177e4
LT
1722{
1723 struct socket *sock;
230b1839 1724 struct sockaddr_storage address;
1da177e4
LT
1725 int err;
1726 struct msghdr msg;
1727 struct iovec iov;
6cb153ca 1728 int fput_needed;
6cb153ca 1729
602bd0e9
AV
1730 err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1731 if (unlikely(err))
1732 return err;
de0fa95c
PE
1733 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1734 if (!sock)
4387ff75 1735 goto out;
6cb153ca 1736
89bddce5 1737 msg.msg_name = NULL;
89bddce5
SH
1738 msg.msg_control = NULL;
1739 msg.msg_controllen = 0;
1740 msg.msg_namelen = 0;
6cb153ca 1741 if (addr) {
43db362d 1742 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1743 if (err < 0)
1744 goto out_put;
230b1839 1745 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1746 msg.msg_namelen = addr_len;
1da177e4
LT
1747 }
1748 if (sock->file->f_flags & O_NONBLOCK)
1749 flags |= MSG_DONTWAIT;
1750 msg.msg_flags = flags;
d8725c86 1751 err = sock_sendmsg(sock, &msg);
1da177e4 1752
89bddce5 1753out_put:
de0fa95c 1754 fput_light(sock->file, fput_needed);
4387ff75 1755out:
1da177e4
LT
1756 return err;
1757}
1758
211b634b
DB
1759SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1760 unsigned int, flags, struct sockaddr __user *, addr,
1761 int, addr_len)
1762{
1763 return __sys_sendto(fd, buff, len, flags, addr, addr_len);
1764}
1765
1da177e4 1766/*
89bddce5 1767 * Send a datagram down a socket.
1da177e4
LT
1768 */
1769
3e0fa65f 1770SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1771 unsigned int, flags)
1da177e4 1772{
211b634b 1773 return __sys_sendto(fd, buff, len, flags, NULL, 0);
1da177e4
LT
1774}
1775
1776/*
89bddce5 1777 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1778 * sender. We verify the buffers are writable and if needed move the
1779 * sender address from kernel to user space.
1780 */
7a09e1eb
DB
1781int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
1782 struct sockaddr __user *addr, int __user *addr_len)
1da177e4
LT
1783{
1784 struct socket *sock;
1785 struct iovec iov;
1786 struct msghdr msg;
230b1839 1787 struct sockaddr_storage address;
89bddce5 1788 int err, err2;
6cb153ca
BL
1789 int fput_needed;
1790
602bd0e9
AV
1791 err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1792 if (unlikely(err))
1793 return err;
de0fa95c 1794 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1795 if (!sock)
de0fa95c 1796 goto out;
1da177e4 1797
89bddce5
SH
1798 msg.msg_control = NULL;
1799 msg.msg_controllen = 0;
f3d33426
HFS
1800 /* Save some cycles and don't copy the address if not needed */
1801 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1802 /* We assume all kernel code knows the size of sockaddr_storage */
1803 msg.msg_namelen = 0;
130ed5d1 1804 msg.msg_iocb = NULL;
9f138fa6 1805 msg.msg_flags = 0;
1da177e4
LT
1806 if (sock->file->f_flags & O_NONBLOCK)
1807 flags |= MSG_DONTWAIT;
2da62906 1808 err = sock_recvmsg(sock, &msg, flags);
1da177e4 1809
89bddce5 1810 if (err >= 0 && addr != NULL) {
43db362d 1811 err2 = move_addr_to_user(&address,
230b1839 1812 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1813 if (err2 < 0)
1814 err = err2;
1da177e4 1815 }
de0fa95c
PE
1816
1817 fput_light(sock->file, fput_needed);
4387ff75 1818out:
1da177e4
LT
1819 return err;
1820}
1821
7a09e1eb
DB
1822SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1823 unsigned int, flags, struct sockaddr __user *, addr,
1824 int __user *, addr_len)
1825{
1826 return __sys_recvfrom(fd, ubuf, size, flags, addr, addr_len);
1827}
1828
1da177e4 1829/*
89bddce5 1830 * Receive a datagram from a socket.
1da177e4
LT
1831 */
1832
b7c0ddf5
JG
1833SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1834 unsigned int, flags)
1da177e4 1835{
7a09e1eb 1836 return __sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1da177e4
LT
1837}
1838
1839/*
1840 * Set a socket option. Because we don't know the option lengths we have
1841 * to pass the user mode parameter for the protocols to sort out.
1842 */
1843
20f37034
HC
1844SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1845 char __user *, optval, int, optlen)
1da177e4 1846{
6cb153ca 1847 int err, fput_needed;
1da177e4
LT
1848 struct socket *sock;
1849
1850 if (optlen < 0)
1851 return -EINVAL;
89bddce5
SH
1852
1853 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1854 if (sock != NULL) {
1855 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1856 if (err)
1857 goto out_put;
1da177e4
LT
1858
1859 if (level == SOL_SOCKET)
89bddce5
SH
1860 err =
1861 sock_setsockopt(sock, level, optname, optval,
1862 optlen);
1da177e4 1863 else
89bddce5
SH
1864 err =
1865 sock->ops->setsockopt(sock, level, optname, optval,
1866 optlen);
6cb153ca
BL
1867out_put:
1868 fput_light(sock->file, fput_needed);
1da177e4
LT
1869 }
1870 return err;
1871}
1872
1873/*
1874 * Get a socket option. Because we don't know the option lengths we have
1875 * to pass a user mode parameter for the protocols to sort out.
1876 */
1877
20f37034
HC
1878SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1879 char __user *, optval, int __user *, optlen)
1da177e4 1880{
6cb153ca 1881 int err, fput_needed;
1da177e4
LT
1882 struct socket *sock;
1883
89bddce5
SH
1884 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1885 if (sock != NULL) {
6cb153ca
BL
1886 err = security_socket_getsockopt(sock, level, optname);
1887 if (err)
1888 goto out_put;
1da177e4
LT
1889
1890 if (level == SOL_SOCKET)
89bddce5
SH
1891 err =
1892 sock_getsockopt(sock, level, optname, optval,
1893 optlen);
1da177e4 1894 else
89bddce5
SH
1895 err =
1896 sock->ops->getsockopt(sock, level, optname, optval,
1897 optlen);
6cb153ca
BL
1898out_put:
1899 fput_light(sock->file, fput_needed);
1da177e4
LT
1900 }
1901 return err;
1902}
1903
1da177e4
LT
1904/*
1905 * Shutdown a socket.
1906 */
1907
754fe8d2 1908SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1909{
6cb153ca 1910 int err, fput_needed;
1da177e4
LT
1911 struct socket *sock;
1912
89bddce5
SH
1913 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1914 if (sock != NULL) {
1da177e4 1915 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1916 if (!err)
1917 err = sock->ops->shutdown(sock, how);
1918 fput_light(sock->file, fput_needed);
1da177e4
LT
1919 }
1920 return err;
1921}
1922
89bddce5 1923/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1924 * fields which are the same type (int / unsigned) on our platforms.
1925 */
1926#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1927#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1928#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1929
c71d8ebe
TH
1930struct used_address {
1931 struct sockaddr_storage name;
1932 unsigned int name_len;
1933};
1934
da184284
AV
1935static int copy_msghdr_from_user(struct msghdr *kmsg,
1936 struct user_msghdr __user *umsg,
1937 struct sockaddr __user **save_addr,
1938 struct iovec **iov)
1661bf36 1939{
ffb07550 1940 struct user_msghdr msg;
08adb7da
AV
1941 ssize_t err;
1942
ffb07550 1943 if (copy_from_user(&msg, umsg, sizeof(*umsg)))
1661bf36 1944 return -EFAULT;
dbb490b9 1945
864d9664 1946 kmsg->msg_control = (void __force *)msg.msg_control;
ffb07550
AV
1947 kmsg->msg_controllen = msg.msg_controllen;
1948 kmsg->msg_flags = msg.msg_flags;
1949
1950 kmsg->msg_namelen = msg.msg_namelen;
1951 if (!msg.msg_name)
6a2a2b3a
AS
1952 kmsg->msg_namelen = 0;
1953
dbb490b9
ML
1954 if (kmsg->msg_namelen < 0)
1955 return -EINVAL;
1956
1661bf36 1957 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
db31c55a 1958 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
08adb7da
AV
1959
1960 if (save_addr)
ffb07550 1961 *save_addr = msg.msg_name;
08adb7da 1962
ffb07550 1963 if (msg.msg_name && kmsg->msg_namelen) {
08adb7da 1964 if (!save_addr) {
864d9664
PA
1965 err = move_addr_to_kernel(msg.msg_name,
1966 kmsg->msg_namelen,
08adb7da
AV
1967 kmsg->msg_name);
1968 if (err < 0)
1969 return err;
1970 }
1971 } else {
1972 kmsg->msg_name = NULL;
1973 kmsg->msg_namelen = 0;
1974 }
1975
ffb07550 1976 if (msg.msg_iovlen > UIO_MAXIOV)
08adb7da
AV
1977 return -EMSGSIZE;
1978
0345f931 1979 kmsg->msg_iocb = NULL;
1980
ffb07550
AV
1981 return import_iovec(save_addr ? READ : WRITE,
1982 msg.msg_iov, msg.msg_iovlen,
da184284 1983 UIO_FASTIOV, iov, &kmsg->msg_iter);
1661bf36
DC
1984}
1985
666547ff 1986static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 1987 struct msghdr *msg_sys, unsigned int flags,
28a94d8f
TH
1988 struct used_address *used_address,
1989 unsigned int allowed_msghdr_flags)
1da177e4 1990{
89bddce5
SH
1991 struct compat_msghdr __user *msg_compat =
1992 (struct compat_msghdr __user *)msg;
230b1839 1993 struct sockaddr_storage address;
1da177e4 1994 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1995 unsigned char ctl[sizeof(struct cmsghdr) + 20]
846cc123 1996 __aligned(sizeof(__kernel_size_t));
89bddce5 1997 /* 20 is size of ipv6_pktinfo */
1da177e4 1998 unsigned char *ctl_buf = ctl;
d8725c86 1999 int ctl_len;
08adb7da 2000 ssize_t err;
89bddce5 2001
08adb7da 2002 msg_sys->msg_name = &address;
1da177e4 2003
08449320 2004 if (MSG_CMSG_COMPAT & flags)
08adb7da 2005 err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
08449320 2006 else
08adb7da 2007 err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
89bddce5 2008 if (err < 0)
da184284 2009 return err;
1da177e4
LT
2010
2011 err = -ENOBUFS;
2012
228e548e 2013 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 2014 goto out_freeiov;
28a94d8f 2015 flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
228e548e 2016 ctl_len = msg_sys->msg_controllen;
1da177e4 2017 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2018 err =
228e548e 2019 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2020 sizeof(ctl));
1da177e4
LT
2021 if (err)
2022 goto out_freeiov;
228e548e
AB
2023 ctl_buf = msg_sys->msg_control;
2024 ctl_len = msg_sys->msg_controllen;
1da177e4 2025 } else if (ctl_len) {
ac4340fc
DM
2026 BUILD_BUG_ON(sizeof(struct cmsghdr) !=
2027 CMSG_ALIGN(sizeof(struct cmsghdr)));
89bddce5 2028 if (ctl_len > sizeof(ctl)) {
1da177e4 2029 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2030 if (ctl_buf == NULL)
1da177e4
LT
2031 goto out_freeiov;
2032 }
2033 err = -EFAULT;
2034 /*
228e548e 2035 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2036 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2037 * checking falls down on this.
2038 */
fb8621bb 2039 if (copy_from_user(ctl_buf,
228e548e 2040 (void __user __force *)msg_sys->msg_control,
89bddce5 2041 ctl_len))
1da177e4 2042 goto out_freectl;
228e548e 2043 msg_sys->msg_control = ctl_buf;
1da177e4 2044 }
228e548e 2045 msg_sys->msg_flags = flags;
1da177e4
LT
2046
2047 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2048 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2049 /*
2050 * If this is sendmmsg() and current destination address is same as
2051 * previously succeeded address, omit asking LSM's decision.
2052 * used_address->name_len is initialized to UINT_MAX so that the first
2053 * destination address never matches.
2054 */
bc909d9d
MD
2055 if (used_address && msg_sys->msg_name &&
2056 used_address->name_len == msg_sys->msg_namelen &&
2057 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe 2058 used_address->name_len)) {
d8725c86 2059 err = sock_sendmsg_nosec(sock, msg_sys);
c71d8ebe
TH
2060 goto out_freectl;
2061 }
d8725c86 2062 err = sock_sendmsg(sock, msg_sys);
c71d8ebe
TH
2063 /*
2064 * If this is sendmmsg() and sending to current destination address was
2065 * successful, remember it.
2066 */
2067 if (used_address && err >= 0) {
2068 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2069 if (msg_sys->msg_name)
2070 memcpy(&used_address->name, msg_sys->msg_name,
2071 used_address->name_len);
c71d8ebe 2072 }
1da177e4
LT
2073
2074out_freectl:
89bddce5 2075 if (ctl_buf != ctl)
1da177e4
LT
2076 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2077out_freeiov:
da184284 2078 kfree(iov);
228e548e
AB
2079 return err;
2080}
2081
2082/*
2083 * BSD sendmsg interface
2084 */
2085
666547ff 2086long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
228e548e
AB
2087{
2088 int fput_needed, err;
2089 struct msghdr msg_sys;
1be374a0
AL
2090 struct socket *sock;
2091
1be374a0 2092 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2093 if (!sock)
2094 goto out;
2095
28a94d8f 2096 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
228e548e 2097
6cb153ca 2098 fput_light(sock->file, fput_needed);
89bddce5 2099out:
1da177e4
LT
2100 return err;
2101}
2102
666547ff 2103SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
a7526eb5
AL
2104{
2105 if (flags & MSG_CMSG_COMPAT)
2106 return -EINVAL;
2107 return __sys_sendmsg(fd, msg, flags);
2108}
2109
228e548e
AB
2110/*
2111 * Linux sendmmsg interface
2112 */
2113
2114int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2115 unsigned int flags)
2116{
2117 int fput_needed, err, datagrams;
2118 struct socket *sock;
2119 struct mmsghdr __user *entry;
2120 struct compat_mmsghdr __user *compat_entry;
2121 struct msghdr msg_sys;
c71d8ebe 2122 struct used_address used_address;
f092276d 2123 unsigned int oflags = flags;
228e548e 2124
98382f41
AB
2125 if (vlen > UIO_MAXIOV)
2126 vlen = UIO_MAXIOV;
228e548e
AB
2127
2128 datagrams = 0;
2129
2130 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2131 if (!sock)
2132 return err;
2133
c71d8ebe 2134 used_address.name_len = UINT_MAX;
228e548e
AB
2135 entry = mmsg;
2136 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2137 err = 0;
f092276d 2138 flags |= MSG_BATCH;
228e548e
AB
2139
2140 while (datagrams < vlen) {
f092276d
TH
2141 if (datagrams == vlen - 1)
2142 flags = oflags;
2143
228e548e 2144 if (MSG_CMSG_COMPAT & flags) {
666547ff 2145 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
28a94d8f 2146 &msg_sys, flags, &used_address, MSG_EOR);
228e548e
AB
2147 if (err < 0)
2148 break;
2149 err = __put_user(err, &compat_entry->msg_len);
2150 ++compat_entry;
2151 } else {
a7526eb5 2152 err = ___sys_sendmsg(sock,
666547ff 2153 (struct user_msghdr __user *)entry,
28a94d8f 2154 &msg_sys, flags, &used_address, MSG_EOR);
228e548e
AB
2155 if (err < 0)
2156 break;
2157 err = put_user(err, &entry->msg_len);
2158 ++entry;
2159 }
2160
2161 if (err)
2162 break;
2163 ++datagrams;
3023898b
SHY
2164 if (msg_data_left(&msg_sys))
2165 break;
a78cb84c 2166 cond_resched();
228e548e
AB
2167 }
2168
228e548e
AB
2169 fput_light(sock->file, fput_needed);
2170
728ffb86
AB
2171 /* We only return an error if no datagrams were able to be sent */
2172 if (datagrams != 0)
228e548e
AB
2173 return datagrams;
2174
228e548e
AB
2175 return err;
2176}
2177
2178SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2179 unsigned int, vlen, unsigned int, flags)
2180{
1be374a0
AL
2181 if (flags & MSG_CMSG_COMPAT)
2182 return -EINVAL;
228e548e
AB
2183 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2184}
2185
666547ff 2186static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2187 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2188{
89bddce5
SH
2189 struct compat_msghdr __user *msg_compat =
2190 (struct compat_msghdr __user *)msg;
1da177e4 2191 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2192 struct iovec *iov = iovstack;
1da177e4 2193 unsigned long cmsg_ptr;
2da62906 2194 int len;
08adb7da 2195 ssize_t err;
1da177e4
LT
2196
2197 /* kernel mode address */
230b1839 2198 struct sockaddr_storage addr;
1da177e4
LT
2199
2200 /* user mode address pointers */
2201 struct sockaddr __user *uaddr;
08adb7da 2202 int __user *uaddr_len = COMPAT_NAMELEN(msg);
89bddce5 2203
08adb7da 2204 msg_sys->msg_name = &addr;
1da177e4 2205
f3d33426 2206 if (MSG_CMSG_COMPAT & flags)
08adb7da 2207 err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
f3d33426 2208 else
08adb7da 2209 err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
1da177e4 2210 if (err < 0)
da184284 2211 return err;
1da177e4 2212
a2e27255
ACM
2213 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2214 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2215
f3d33426
HFS
2216 /* We assume all kernel code knows the size of sockaddr_storage */
2217 msg_sys->msg_namelen = 0;
2218
1da177e4
LT
2219 if (sock->file->f_flags & O_NONBLOCK)
2220 flags |= MSG_DONTWAIT;
2da62906 2221 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys, flags);
1da177e4
LT
2222 if (err < 0)
2223 goto out_freeiov;
2224 len = err;
2225
2226 if (uaddr != NULL) {
43db362d 2227 err = move_addr_to_user(&addr,
a2e27255 2228 msg_sys->msg_namelen, uaddr,
89bddce5 2229 uaddr_len);
1da177e4
LT
2230 if (err < 0)
2231 goto out_freeiov;
2232 }
a2e27255 2233 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2234 COMPAT_FLAGS(msg));
1da177e4
LT
2235 if (err)
2236 goto out_freeiov;
2237 if (MSG_CMSG_COMPAT & flags)
a2e27255 2238 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2239 &msg_compat->msg_controllen);
2240 else
a2e27255 2241 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2242 &msg->msg_controllen);
2243 if (err)
2244 goto out_freeiov;
2245 err = len;
2246
2247out_freeiov:
da184284 2248 kfree(iov);
a2e27255
ACM
2249 return err;
2250}
2251
2252/*
2253 * BSD recvmsg interface
2254 */
2255
666547ff 2256long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
a2e27255
ACM
2257{
2258 int fput_needed, err;
2259 struct msghdr msg_sys;
1be374a0
AL
2260 struct socket *sock;
2261
1be374a0 2262 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2263 if (!sock)
2264 goto out;
2265
a7526eb5 2266 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2267
6cb153ca 2268 fput_light(sock->file, fput_needed);
1da177e4
LT
2269out:
2270 return err;
2271}
2272
666547ff 2273SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
a7526eb5
AL
2274 unsigned int, flags)
2275{
2276 if (flags & MSG_CMSG_COMPAT)
2277 return -EINVAL;
2278 return __sys_recvmsg(fd, msg, flags);
2279}
2280
a2e27255
ACM
2281/*
2282 * Linux recvmmsg interface
2283 */
2284
2285int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2286 unsigned int flags, struct timespec *timeout)
2287{
2288 int fput_needed, err, datagrams;
2289 struct socket *sock;
2290 struct mmsghdr __user *entry;
d7256d0e 2291 struct compat_mmsghdr __user *compat_entry;
a2e27255 2292 struct msghdr msg_sys;
766b9f92
DD
2293 struct timespec64 end_time;
2294 struct timespec64 timeout64;
a2e27255
ACM
2295
2296 if (timeout &&
2297 poll_select_set_timeout(&end_time, timeout->tv_sec,
2298 timeout->tv_nsec))
2299 return -EINVAL;
2300
2301 datagrams = 0;
2302
2303 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2304 if (!sock)
2305 return err;
2306
2307 err = sock_error(sock->sk);
e623a9e9
MJ
2308 if (err) {
2309 datagrams = err;
a2e27255 2310 goto out_put;
e623a9e9 2311 }
a2e27255
ACM
2312
2313 entry = mmsg;
d7256d0e 2314 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2315
2316 while (datagrams < vlen) {
2317 /*
2318 * No need to ask LSM for more than the first datagram.
2319 */
d7256d0e 2320 if (MSG_CMSG_COMPAT & flags) {
666547ff 2321 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5
AL
2322 &msg_sys, flags & ~MSG_WAITFORONE,
2323 datagrams);
d7256d0e
JMG
2324 if (err < 0)
2325 break;
2326 err = __put_user(err, &compat_entry->msg_len);
2327 ++compat_entry;
2328 } else {
a7526eb5 2329 err = ___sys_recvmsg(sock,
666547ff 2330 (struct user_msghdr __user *)entry,
a7526eb5
AL
2331 &msg_sys, flags & ~MSG_WAITFORONE,
2332 datagrams);
d7256d0e
JMG
2333 if (err < 0)
2334 break;
2335 err = put_user(err, &entry->msg_len);
2336 ++entry;
2337 }
2338
a2e27255
ACM
2339 if (err)
2340 break;
a2e27255
ACM
2341 ++datagrams;
2342
71c5c159
BB
2343 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2344 if (flags & MSG_WAITFORONE)
2345 flags |= MSG_DONTWAIT;
2346
a2e27255 2347 if (timeout) {
766b9f92
DD
2348 ktime_get_ts64(&timeout64);
2349 *timeout = timespec64_to_timespec(
2350 timespec64_sub(end_time, timeout64));
a2e27255
ACM
2351 if (timeout->tv_sec < 0) {
2352 timeout->tv_sec = timeout->tv_nsec = 0;
2353 break;
2354 }
2355
2356 /* Timeout, return less than vlen datagrams */
2357 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2358 break;
2359 }
2360
2361 /* Out of band data, return right away */
2362 if (msg_sys.msg_flags & MSG_OOB)
2363 break;
a78cb84c 2364 cond_resched();
a2e27255
ACM
2365 }
2366
a2e27255 2367 if (err == 0)
34b88a68
ACM
2368 goto out_put;
2369
2370 if (datagrams == 0) {
2371 datagrams = err;
2372 goto out_put;
2373 }
a2e27255 2374
34b88a68
ACM
2375 /*
2376 * We may return less entries than requested (vlen) if the
2377 * sock is non block and there aren't enough datagrams...
2378 */
2379 if (err != -EAGAIN) {
a2e27255 2380 /*
34b88a68
ACM
2381 * ... or if recvmsg returns an error after we
2382 * received some datagrams, where we record the
2383 * error to return on the next call or if the
2384 * app asks about it using getsockopt(SO_ERROR).
a2e27255 2385 */
34b88a68 2386 sock->sk->sk_err = -err;
a2e27255 2387 }
34b88a68
ACM
2388out_put:
2389 fput_light(sock->file, fput_needed);
a2e27255 2390
34b88a68 2391 return datagrams;
a2e27255
ACM
2392}
2393
2394SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2395 unsigned int, vlen, unsigned int, flags,
2396 struct timespec __user *, timeout)
2397{
2398 int datagrams;
2399 struct timespec timeout_sys;
2400
1be374a0
AL
2401 if (flags & MSG_CMSG_COMPAT)
2402 return -EINVAL;
2403
a2e27255
ACM
2404 if (!timeout)
2405 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2406
2407 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2408 return -EFAULT;
2409
2410 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2411
2412 if (datagrams > 0 &&
2413 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2414 datagrams = -EFAULT;
2415
2416 return datagrams;
2417}
2418
2419#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2420/* Argument list sizes for sys_socketcall */
2421#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2422static const unsigned char nargs[21] = {
c6d409cf
ED
2423 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2424 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2425 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2426 AL(4), AL(5), AL(4)
89bddce5
SH
2427};
2428
1da177e4
LT
2429#undef AL
2430
2431/*
89bddce5 2432 * System call vectors.
1da177e4
LT
2433 *
2434 * Argument checking cleaned up. Saved 20% in size.
2435 * This function doesn't need to set the kernel lock because
89bddce5 2436 * it is set by the callees.
1da177e4
LT
2437 */
2438
3e0fa65f 2439SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2440{
2950fa9d 2441 unsigned long a[AUDITSC_ARGS];
89bddce5 2442 unsigned long a0, a1;
1da177e4 2443 int err;
47379052 2444 unsigned int len;
1da177e4 2445
228e548e 2446 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2447 return -EINVAL;
2448
47379052
AV
2449 len = nargs[call];
2450 if (len > sizeof(a))
2451 return -EINVAL;
2452
1da177e4 2453 /* copy_from_user should be SMP safe. */
47379052 2454 if (copy_from_user(a, args, len))
1da177e4 2455 return -EFAULT;
3ec3b2fb 2456
2950fa9d
CG
2457 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2458 if (err)
2459 return err;
3ec3b2fb 2460
89bddce5
SH
2461 a0 = a[0];
2462 a1 = a[1];
2463
2464 switch (call) {
2465 case SYS_SOCKET:
2466 err = sys_socket(a0, a1, a[2]);
2467 break;
2468 case SYS_BIND:
2469 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2470 break;
2471 case SYS_CONNECT:
2472 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2473 break;
2474 case SYS_LISTEN:
2475 err = sys_listen(a0, a1);
2476 break;
2477 case SYS_ACCEPT:
4541e805
DB
2478 err = __sys_accept4(a0, (struct sockaddr __user *)a1,
2479 (int __user *)a[2], 0);
89bddce5
SH
2480 break;
2481 case SYS_GETSOCKNAME:
2482 err =
2483 sys_getsockname(a0, (struct sockaddr __user *)a1,
2484 (int __user *)a[2]);
2485 break;
2486 case SYS_GETPEERNAME:
2487 err =
2488 sys_getpeername(a0, (struct sockaddr __user *)a1,
2489 (int __user *)a[2]);
2490 break;
2491 case SYS_SOCKETPAIR:
2492 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2493 break;
2494 case SYS_SEND:
2495 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2496 break;
2497 case SYS_SENDTO:
211b634b
DB
2498 err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
2499 (struct sockaddr __user *)a[4], a[5]);
89bddce5
SH
2500 break;
2501 case SYS_RECV:
2502 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2503 break;
2504 case SYS_RECVFROM:
7a09e1eb
DB
2505 err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2506 (struct sockaddr __user *)a[4],
2507 (int __user *)a[5]);
89bddce5
SH
2508 break;
2509 case SYS_SHUTDOWN:
2510 err = sys_shutdown(a0, a1);
2511 break;
2512 case SYS_SETSOCKOPT:
2513 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2514 break;
2515 case SYS_GETSOCKOPT:
2516 err =
2517 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2518 (int __user *)a[4]);
2519 break;
2520 case SYS_SENDMSG:
666547ff 2521 err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2522 break;
228e548e
AB
2523 case SYS_SENDMMSG:
2524 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2525 break;
89bddce5 2526 case SYS_RECVMSG:
666547ff 2527 err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2528 break;
a2e27255
ACM
2529 case SYS_RECVMMSG:
2530 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2531 (struct timespec __user *)a[4]);
2532 break;
de11defe 2533 case SYS_ACCEPT4:
4541e805
DB
2534 err = __sys_accept4(a0, (struct sockaddr __user *)a1,
2535 (int __user *)a[2], a[3]);
aaca0bdc 2536 break;
89bddce5
SH
2537 default:
2538 err = -EINVAL;
2539 break;
1da177e4
LT
2540 }
2541 return err;
2542}
2543
89bddce5 2544#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2545
55737fda
SH
2546/**
2547 * sock_register - add a socket protocol handler
2548 * @ops: description of protocol
2549 *
1da177e4
LT
2550 * This function is called by a protocol handler that wants to
2551 * advertise its address family, and have it linked into the
e793c0f7 2552 * socket interface. The value ops->family corresponds to the
55737fda 2553 * socket system call protocol family.
1da177e4 2554 */
f0fd27d4 2555int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2556{
2557 int err;
2558
2559 if (ops->family >= NPROTO) {
3410f22e 2560 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
1da177e4
LT
2561 return -ENOBUFS;
2562 }
55737fda
SH
2563
2564 spin_lock(&net_family_lock);
190683a9
ED
2565 if (rcu_dereference_protected(net_families[ops->family],
2566 lockdep_is_held(&net_family_lock)))
55737fda
SH
2567 err = -EEXIST;
2568 else {
cf778b00 2569 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2570 err = 0;
2571 }
55737fda
SH
2572 spin_unlock(&net_family_lock);
2573
3410f22e 2574 pr_info("NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2575 return err;
2576}
c6d409cf 2577EXPORT_SYMBOL(sock_register);
1da177e4 2578
55737fda
SH
2579/**
2580 * sock_unregister - remove a protocol handler
2581 * @family: protocol family to remove
2582 *
1da177e4
LT
2583 * This function is called by a protocol handler that wants to
2584 * remove its address family, and have it unlinked from the
55737fda
SH
2585 * new socket creation.
2586 *
2587 * If protocol handler is a module, then it can use module reference
2588 * counts to protect against new references. If protocol handler is not
2589 * a module then it needs to provide its own protection in
2590 * the ops->create routine.
1da177e4 2591 */
f0fd27d4 2592void sock_unregister(int family)
1da177e4 2593{
f0fd27d4 2594 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2595
55737fda 2596 spin_lock(&net_family_lock);
a9b3cd7f 2597 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2598 spin_unlock(&net_family_lock);
2599
2600 synchronize_rcu();
2601
3410f22e 2602 pr_info("NET: Unregistered protocol family %d\n", family);
1da177e4 2603}
c6d409cf 2604EXPORT_SYMBOL(sock_unregister);
1da177e4 2605
77d76ea3 2606static int __init sock_init(void)
1da177e4 2607{
b3e19d92 2608 int err;
2ca794e5
EB
2609 /*
2610 * Initialize the network sysctl infrastructure.
2611 */
2612 err = net_sysctl_init();
2613 if (err)
2614 goto out;
b3e19d92 2615
1da177e4 2616 /*
89bddce5 2617 * Initialize skbuff SLAB cache
1da177e4
LT
2618 */
2619 skb_init();
1da177e4
LT
2620
2621 /*
89bddce5 2622 * Initialize the protocols module.
1da177e4
LT
2623 */
2624
2625 init_inodecache();
b3e19d92
NP
2626
2627 err = register_filesystem(&sock_fs_type);
2628 if (err)
2629 goto out_fs;
1da177e4 2630 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2631 if (IS_ERR(sock_mnt)) {
2632 err = PTR_ERR(sock_mnt);
2633 goto out_mount;
2634 }
77d76ea3
AK
2635
2636 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2637 */
2638
2639#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2640 err = netfilter_init();
2641 if (err)
2642 goto out;
1da177e4 2643#endif
cbeb321a 2644
408eccce 2645 ptp_classifier_init();
c1f19b51 2646
b3e19d92
NP
2647out:
2648 return err;
2649
2650out_mount:
2651 unregister_filesystem(&sock_fs_type);
2652out_fs:
2653 goto out;
1da177e4
LT
2654}
2655
77d76ea3
AK
2656core_initcall(sock_init); /* early initcall */
2657
1da177e4
LT
2658#ifdef CONFIG_PROC_FS
2659void socket_seq_show(struct seq_file *seq)
2660{
648845ab
TZ
2661 seq_printf(seq, "sockets: used %d\n",
2662 sock_inuse_get(seq->private));
1da177e4 2663}
89bddce5 2664#endif /* CONFIG_PROC_FS */
1da177e4 2665
89bbfc95 2666#ifdef CONFIG_COMPAT
6b96018b 2667static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2668 unsigned int cmd, void __user *up)
7a229387 2669{
7a229387
AB
2670 mm_segment_t old_fs = get_fs();
2671 struct timeval ktv;
2672 int err;
2673
2674 set_fs(KERNEL_DS);
6b96018b 2675 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2676 set_fs(old_fs);
644595f8 2677 if (!err)
ed6fe9d6 2678 err = compat_put_timeval(&ktv, up);
644595f8 2679
7a229387
AB
2680 return err;
2681}
2682
6b96018b 2683static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2684 unsigned int cmd, void __user *up)
7a229387 2685{
7a229387
AB
2686 mm_segment_t old_fs = get_fs();
2687 struct timespec kts;
2688 int err;
2689
2690 set_fs(KERNEL_DS);
6b96018b 2691 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2692 set_fs(old_fs);
644595f8 2693 if (!err)
ed6fe9d6 2694 err = compat_put_timespec(&kts, up);
644595f8 2695
7a229387
AB
2696 return err;
2697}
2698
36fd633e 2699static int compat_dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2700{
6b96018b 2701 struct compat_ifconf ifc32;
7a229387 2702 struct ifconf ifc;
7a229387
AB
2703 int err;
2704
6b96018b 2705 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2706 return -EFAULT;
2707
36fd633e
AV
2708 ifc.ifc_len = ifc32.ifc_len;
2709 ifc.ifc_req = compat_ptr(ifc32.ifcbuf);
7a229387 2710
36fd633e
AV
2711 rtnl_lock();
2712 err = dev_ifconf(net, &ifc, sizeof(struct compat_ifreq));
2713 rtnl_unlock();
7a229387
AB
2714 if (err)
2715 return err;
2716
36fd633e 2717 ifc32.ifc_len = ifc.ifc_len;
6b96018b 2718 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2719 return -EFAULT;
2720
2721 return 0;
2722}
2723
6b96018b 2724static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2725{
3a7da39d
BH
2726 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2727 bool convert_in = false, convert_out = false;
44c02a2c
AV
2728 size_t buf_size = 0;
2729 struct ethtool_rxnfc __user *rxnfc = NULL;
2730 struct ifreq ifr;
3a7da39d
BH
2731 u32 rule_cnt = 0, actual_rule_cnt;
2732 u32 ethcmd;
7a229387 2733 u32 data;
3a7da39d 2734 int ret;
7a229387 2735
3a7da39d
BH
2736 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2737 return -EFAULT;
7a229387 2738
3a7da39d
BH
2739 compat_rxnfc = compat_ptr(data);
2740
2741 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2742 return -EFAULT;
2743
3a7da39d
BH
2744 /* Most ethtool structures are defined without padding.
2745 * Unfortunately struct ethtool_rxnfc is an exception.
2746 */
2747 switch (ethcmd) {
2748 default:
2749 break;
2750 case ETHTOOL_GRXCLSRLALL:
2751 /* Buffer size is variable */
2752 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2753 return -EFAULT;
2754 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2755 return -ENOMEM;
2756 buf_size += rule_cnt * sizeof(u32);
2757 /* fall through */
2758 case ETHTOOL_GRXRINGS:
2759 case ETHTOOL_GRXCLSRLCNT:
2760 case ETHTOOL_GRXCLSRULE:
55664f32 2761 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2762 convert_out = true;
2763 /* fall through */
2764 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2765 buf_size += sizeof(struct ethtool_rxnfc);
2766 convert_in = true;
44c02a2c 2767 rxnfc = compat_alloc_user_space(buf_size);
3a7da39d
BH
2768 break;
2769 }
2770
44c02a2c 2771 if (copy_from_user(&ifr.ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2772 return -EFAULT;
2773
44c02a2c 2774 ifr.ifr_data = convert_in ? rxnfc : (void __user *)compat_rxnfc;
7a229387 2775
3a7da39d 2776 if (convert_in) {
127fe533 2777 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2778 * fs.ring_cookie and at the end of fs, but nowhere else.
2779 */
127fe533
AD
2780 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2781 sizeof(compat_rxnfc->fs.m_ext) !=
2782 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2783 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2784 BUILD_BUG_ON(
2785 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2786 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2787 offsetof(struct ethtool_rxnfc, fs.location) -
2788 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2789
2790 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2791 (void __user *)(&rxnfc->fs.m_ext + 1) -
2792 (void __user *)rxnfc) ||
3a7da39d
BH
2793 copy_in_user(&rxnfc->fs.ring_cookie,
2794 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2795 (void __user *)(&rxnfc->fs.location + 1) -
2796 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2797 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2798 sizeof(rxnfc->rule_cnt)))
2799 return -EFAULT;
2800 }
2801
44c02a2c 2802 ret = dev_ioctl(net, SIOCETHTOOL, &ifr, NULL);
3a7da39d
BH
2803 if (ret)
2804 return ret;
2805
2806 if (convert_out) {
2807 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2808 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2809 (const void __user *)rxnfc) ||
3a7da39d
BH
2810 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2811 &rxnfc->fs.ring_cookie,
954b1244
SH
2812 (const void __user *)(&rxnfc->fs.location + 1) -
2813 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2814 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2815 sizeof(rxnfc->rule_cnt)))
2816 return -EFAULT;
2817
2818 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2819 /* As an optimisation, we only copy the actual
2820 * number of rules that the underlying
2821 * function returned. Since Mallory might
2822 * change the rule count in user memory, we
2823 * check that it is less than the rule count
2824 * originally given (as the user buffer size),
2825 * which has been range-checked.
2826 */
2827 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2828 return -EFAULT;
2829 if (actual_rule_cnt < rule_cnt)
2830 rule_cnt = actual_rule_cnt;
2831 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2832 &rxnfc->rule_locs[0],
2833 rule_cnt * sizeof(u32)))
2834 return -EFAULT;
2835 }
2836 }
2837
2838 return 0;
7a229387
AB
2839}
2840
7a50a240
AB
2841static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2842{
7a50a240 2843 compat_uptr_t uptr32;
44c02a2c
AV
2844 struct ifreq ifr;
2845 void __user *saved;
2846 int err;
7a50a240 2847
44c02a2c 2848 if (copy_from_user(&ifr, uifr32, sizeof(struct compat_ifreq)))
7a50a240
AB
2849 return -EFAULT;
2850
2851 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2852 return -EFAULT;
2853
44c02a2c
AV
2854 saved = ifr.ifr_settings.ifs_ifsu.raw_hdlc;
2855 ifr.ifr_settings.ifs_ifsu.raw_hdlc = compat_ptr(uptr32);
7a229387 2856
44c02a2c
AV
2857 err = dev_ioctl(net, SIOCWANDEV, &ifr, NULL);
2858 if (!err) {
2859 ifr.ifr_settings.ifs_ifsu.raw_hdlc = saved;
2860 if (copy_to_user(uifr32, &ifr, sizeof(struct compat_ifreq)))
2861 err = -EFAULT;
ccbd6a5a 2862 }
44c02a2c 2863 return err;
7a229387
AB
2864}
2865
590d4693
BH
2866/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2867static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 2868 struct compat_ifreq __user *u_ifreq32)
7a229387 2869{
44c02a2c 2870 struct ifreq ifreq;
7a229387
AB
2871 u32 data32;
2872
44c02a2c 2873 if (copy_from_user(ifreq.ifr_name, u_ifreq32->ifr_name, IFNAMSIZ))
7a229387 2874 return -EFAULT;
44c02a2c 2875 if (get_user(data32, &u_ifreq32->ifr_data))
7a229387 2876 return -EFAULT;
44c02a2c 2877 ifreq.ifr_data = compat_ptr(data32);
7a229387 2878
44c02a2c 2879 return dev_ioctl(net, cmd, &ifreq, NULL);
7a229387
AB
2880}
2881
a2116ed2
AB
2882static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2883 struct compat_ifreq __user *uifr32)
2884{
2885 struct ifreq ifr;
2886 struct compat_ifmap __user *uifmap32;
a2116ed2
AB
2887 int err;
2888
2889 uifmap32 = &uifr32->ifr_ifru.ifru_map;
2890 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
2891 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2892 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2893 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2894 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2895 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2896 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2897 if (err)
2898 return -EFAULT;
2899
44c02a2c 2900 err = dev_ioctl(net, cmd, &ifr, NULL);
a2116ed2
AB
2901
2902 if (cmd == SIOCGIFMAP && !err) {
2903 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
2904 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2905 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2906 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2907 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2908 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2909 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2910 if (err)
2911 err = -EFAULT;
2912 }
2913 return err;
2914}
2915
7a229387 2916struct rtentry32 {
c6d409cf 2917 u32 rt_pad1;
7a229387
AB
2918 struct sockaddr rt_dst; /* target address */
2919 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
2920 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
2921 unsigned short rt_flags;
2922 short rt_pad2;
2923 u32 rt_pad3;
2924 unsigned char rt_tos;
2925 unsigned char rt_class;
2926 short rt_pad4;
2927 short rt_metric; /* +1 for binary compatibility! */
7a229387 2928 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
2929 u32 rt_mtu; /* per route MTU/Window */
2930 u32 rt_window; /* Window clamping */
7a229387
AB
2931 unsigned short rt_irtt; /* Initial RTT */
2932};
2933
2934struct in6_rtmsg32 {
2935 struct in6_addr rtmsg_dst;
2936 struct in6_addr rtmsg_src;
2937 struct in6_addr rtmsg_gateway;
2938 u32 rtmsg_type;
2939 u16 rtmsg_dst_len;
2940 u16 rtmsg_src_len;
2941 u32 rtmsg_metric;
2942 u32 rtmsg_info;
2943 u32 rtmsg_flags;
2944 s32 rtmsg_ifindex;
2945};
2946
6b96018b
AB
2947static int routing_ioctl(struct net *net, struct socket *sock,
2948 unsigned int cmd, void __user *argp)
7a229387
AB
2949{
2950 int ret;
2951 void *r = NULL;
2952 struct in6_rtmsg r6;
2953 struct rtentry r4;
2954 char devname[16];
2955 u32 rtdev;
2956 mm_segment_t old_fs = get_fs();
2957
6b96018b
AB
2958 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
2959 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 2960 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 2961 3 * sizeof(struct in6_addr));
3ddc5b46
MD
2962 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
2963 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
2964 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
2965 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
2966 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
2967 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
2968 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
2969
2970 r = (void *) &r6;
2971 } else { /* ipv4 */
6b96018b 2972 struct rtentry32 __user *ur4 = argp;
c6d409cf 2973 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 2974 3 * sizeof(struct sockaddr));
3ddc5b46
MD
2975 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
2976 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
2977 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
2978 ret |= get_user(r4.rt_window, &(ur4->rt_window));
2979 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
2980 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 2981 if (rtdev) {
c6d409cf 2982 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 2983 r4.rt_dev = (char __user __force *)devname;
2984 devname[15] = 0;
7a229387
AB
2985 } else
2986 r4.rt_dev = NULL;
2987
2988 r = (void *) &r4;
2989 }
2990
2991 if (ret) {
2992 ret = -EFAULT;
2993 goto out;
2994 }
2995
c6d409cf 2996 set_fs(KERNEL_DS);
6b96018b 2997 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 2998 set_fs(old_fs);
7a229387
AB
2999
3000out:
7a229387
AB
3001 return ret;
3002}
3003
3004/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3005 * for some operations; this forces use of the newer bridge-utils that
25985edc 3006 * use compatible ioctls
7a229387 3007 */
6b96018b 3008static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3009{
6b96018b 3010 compat_ulong_t tmp;
7a229387 3011
6b96018b 3012 if (get_user(tmp, argp))
7a229387
AB
3013 return -EFAULT;
3014 if (tmp == BRCTL_GET_VERSION)
3015 return BRCTL_VERSION + 1;
3016 return -EINVAL;
3017}
3018
6b96018b
AB
3019static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3020 unsigned int cmd, unsigned long arg)
3021{
3022 void __user *argp = compat_ptr(arg);
3023 struct sock *sk = sock->sk;
3024 struct net *net = sock_net(sk);
7a229387 3025
6b96018b 3026 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3027 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3028
3029 switch (cmd) {
3030 case SIOCSIFBR:
3031 case SIOCGIFBR:
3032 return old_bridge_ioctl(argp);
6b96018b 3033 case SIOCGIFCONF:
36fd633e 3034 return compat_dev_ifconf(net, argp);
6b96018b
AB
3035 case SIOCETHTOOL:
3036 return ethtool_ioctl(net, argp);
7a50a240
AB
3037 case SIOCWANDEV:
3038 return compat_siocwandev(net, argp);
a2116ed2
AB
3039 case SIOCGIFMAP:
3040 case SIOCSIFMAP:
3041 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3042 case SIOCADDRT:
3043 case SIOCDELRT:
3044 return routing_ioctl(net, sock, cmd, argp);
3045 case SIOCGSTAMP:
3046 return do_siocgstamp(net, sock, cmd, argp);
3047 case SIOCGSTAMPNS:
3048 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3049 case SIOCBONDSLAVEINFOQUERY:
3050 case SIOCBONDINFOQUERY:
a2116ed2 3051 case SIOCSHWTSTAMP:
fd468c74 3052 case SIOCGHWTSTAMP:
590d4693 3053 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3054
3055 case FIOSETOWN:
3056 case SIOCSPGRP:
3057 case FIOGETOWN:
3058 case SIOCGPGRP:
3059 case SIOCBRADDBR:
3060 case SIOCBRDELBR:
3061 case SIOCGIFVLAN:
3062 case SIOCSIFVLAN:
3063 case SIOCADDDLCI:
3064 case SIOCDELDLCI:
c62cce2c 3065 case SIOCGSKNS:
6b96018b
AB
3066 return sock_ioctl(file, cmd, arg);
3067
3068 case SIOCGIFFLAGS:
3069 case SIOCSIFFLAGS:
3070 case SIOCGIFMETRIC:
3071 case SIOCSIFMETRIC:
3072 case SIOCGIFMTU:
3073 case SIOCSIFMTU:
3074 case SIOCGIFMEM:
3075 case SIOCSIFMEM:
3076 case SIOCGIFHWADDR:
3077 case SIOCSIFHWADDR:
3078 case SIOCADDMULTI:
3079 case SIOCDELMULTI:
3080 case SIOCGIFINDEX:
6b96018b
AB
3081 case SIOCGIFADDR:
3082 case SIOCSIFADDR:
3083 case SIOCSIFHWBROADCAST:
6b96018b 3084 case SIOCDIFADDR:
6b96018b
AB
3085 case SIOCGIFBRDADDR:
3086 case SIOCSIFBRDADDR:
3087 case SIOCGIFDSTADDR:
3088 case SIOCSIFDSTADDR:
3089 case SIOCGIFNETMASK:
3090 case SIOCSIFNETMASK:
3091 case SIOCSIFPFLAGS:
3092 case SIOCGIFPFLAGS:
3093 case SIOCGIFTXQLEN:
3094 case SIOCSIFTXQLEN:
3095 case SIOCBRADDIF:
3096 case SIOCBRDELIF:
9177efd3
AB
3097 case SIOCSIFNAME:
3098 case SIOCGMIIPHY:
3099 case SIOCGMIIREG:
3100 case SIOCSMIIREG:
6b96018b
AB
3101 case SIOCSARP:
3102 case SIOCGARP:
3103 case SIOCDARP:
6b96018b 3104 case SIOCATMARK:
f92d4fc9
AV
3105 case SIOCBONDENSLAVE:
3106 case SIOCBONDRELEASE:
3107 case SIOCBONDSETHWADDR:
3108 case SIOCBONDCHANGEACTIVE:
4cf808e7 3109 case SIOCGIFNAME:
9177efd3
AB
3110 return sock_do_ioctl(net, sock, cmd, arg);
3111 }
3112
6b96018b
AB
3113 return -ENOIOCTLCMD;
3114}
7a229387 3115
95c96174 3116static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3117 unsigned long arg)
89bbfc95
SP
3118{
3119 struct socket *sock = file->private_data;
3120 int ret = -ENOIOCTLCMD;
87de87d5
DM
3121 struct sock *sk;
3122 struct net *net;
3123
3124 sk = sock->sk;
3125 net = sock_net(sk);
89bbfc95
SP
3126
3127 if (sock->ops->compat_ioctl)
3128 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3129
87de87d5
DM
3130 if (ret == -ENOIOCTLCMD &&
3131 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3132 ret = compat_wext_handle_ioctl(net, cmd, arg);
3133
6b96018b
AB
3134 if (ret == -ENOIOCTLCMD)
3135 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3136
89bbfc95
SP
3137 return ret;
3138}
3139#endif
3140
ac5a488e
SS
3141int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3142{
3143 return sock->ops->bind(sock, addr, addrlen);
3144}
c6d409cf 3145EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3146
3147int kernel_listen(struct socket *sock, int backlog)
3148{
3149 return sock->ops->listen(sock, backlog);
3150}
c6d409cf 3151EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3152
3153int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3154{
3155 struct sock *sk = sock->sk;
3156 int err;
3157
3158 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3159 newsock);
3160 if (err < 0)
3161 goto done;
3162
cdfbabfb 3163 err = sock->ops->accept(sock, *newsock, flags, true);
ac5a488e
SS
3164 if (err < 0) {
3165 sock_release(*newsock);
fa8705b0 3166 *newsock = NULL;
ac5a488e
SS
3167 goto done;
3168 }
3169
3170 (*newsock)->ops = sock->ops;
1b08534e 3171 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3172
3173done:
3174 return err;
3175}
c6d409cf 3176EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3177
3178int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3179 int flags)
ac5a488e
SS
3180{
3181 return sock->ops->connect(sock, addr, addrlen, flags);
3182}
c6d409cf 3183EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3184
3185int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3186 int *addrlen)
3187{
3188 return sock->ops->getname(sock, addr, addrlen, 0);
3189}
c6d409cf 3190EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3191
3192int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3193 int *addrlen)
3194{
3195 return sock->ops->getname(sock, addr, addrlen, 1);
3196}
c6d409cf 3197EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3198
3199int kernel_getsockopt(struct socket *sock, int level, int optname,
3200 char *optval, int *optlen)
3201{
3202 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3203 char __user *uoptval;
3204 int __user *uoptlen;
ac5a488e
SS
3205 int err;
3206
fb8621bb
NK
3207 uoptval = (char __user __force *) optval;
3208 uoptlen = (int __user __force *) optlen;
3209
ac5a488e
SS
3210 set_fs(KERNEL_DS);
3211 if (level == SOL_SOCKET)
fb8621bb 3212 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3213 else
fb8621bb
NK
3214 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3215 uoptlen);
ac5a488e
SS
3216 set_fs(oldfs);
3217 return err;
3218}
c6d409cf 3219EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3220
3221int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3222 char *optval, unsigned int optlen)
ac5a488e
SS
3223{
3224 mm_segment_t oldfs = get_fs();
fb8621bb 3225 char __user *uoptval;
ac5a488e
SS
3226 int err;
3227
fb8621bb
NK
3228 uoptval = (char __user __force *) optval;
3229
ac5a488e
SS
3230 set_fs(KERNEL_DS);
3231 if (level == SOL_SOCKET)
fb8621bb 3232 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3233 else
fb8621bb 3234 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3235 optlen);
3236 set_fs(oldfs);
3237 return err;
3238}
c6d409cf 3239EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3240
3241int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3242 size_t size, int flags)
3243{
3244 if (sock->ops->sendpage)
3245 return sock->ops->sendpage(sock, page, offset, size, flags);
3246
3247 return sock_no_sendpage(sock, page, offset, size, flags);
3248}
c6d409cf 3249EXPORT_SYMBOL(kernel_sendpage);
ac5a488e 3250
306b13eb
TH
3251int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset,
3252 size_t size, int flags)
3253{
3254 struct socket *sock = sk->sk_socket;
3255
3256 if (sock->ops->sendpage_locked)
3257 return sock->ops->sendpage_locked(sk, page, offset, size,
3258 flags);
3259
3260 return sock_no_sendpage_locked(sk, page, offset, size, flags);
3261}
3262EXPORT_SYMBOL(kernel_sendpage_locked);
3263
91cf45f0
TM
3264int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3265{
3266 return sock->ops->shutdown(sock, how);
3267}
91cf45f0 3268EXPORT_SYMBOL(kernel_sock_shutdown);
113c3075
P
3269
3270/* This routine returns the IP overhead imposed by a socket i.e.
3271 * the length of the underlying IP header, depending on whether
3272 * this is an IPv4 or IPv6 socket and the length from IP options turned
57240d00 3273 * on at the socket. Assumes that the caller has a lock on the socket.
113c3075
P
3274 */
3275u32 kernel_sock_ip_overhead(struct sock *sk)
3276{
3277 struct inet_sock *inet;
3278 struct ip_options_rcu *opt;
3279 u32 overhead = 0;
113c3075
P
3280#if IS_ENABLED(CONFIG_IPV6)
3281 struct ipv6_pinfo *np;
3282 struct ipv6_txoptions *optv6 = NULL;
3283#endif /* IS_ENABLED(CONFIG_IPV6) */
3284
3285 if (!sk)
3286 return overhead;
3287
113c3075
P
3288 switch (sk->sk_family) {
3289 case AF_INET:
3290 inet = inet_sk(sk);
3291 overhead += sizeof(struct iphdr);
3292 opt = rcu_dereference_protected(inet->inet_opt,
614d79c0 3293 sock_owned_by_user(sk));
113c3075
P
3294 if (opt)
3295 overhead += opt->opt.optlen;
3296 return overhead;
3297#if IS_ENABLED(CONFIG_IPV6)
3298 case AF_INET6:
3299 np = inet6_sk(sk);
3300 overhead += sizeof(struct ipv6hdr);
3301 if (np)
3302 optv6 = rcu_dereference_protected(np->opt,
614d79c0 3303 sock_owned_by_user(sk));
113c3075
P
3304 if (optv6)
3305 overhead += (optv6->opt_flen + optv6->opt_nflen);
3306 return overhead;
3307#endif /* IS_ENABLED(CONFIG_IPV6) */
3308 default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
3309 return overhead;
3310 }
3311}
3312EXPORT_SYMBOL(kernel_sock_ip_overhead);