2 * NET An implementation of the SOCKET network access protocol.
4 * Version: @(#)socket.c 1.1.93 18/02/95
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
45 * Tigran Aivazian : Made listen(2) backlog sanity checks
46 * protocol-independent
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
55 * This module is effectively the top level interface to the BSD socket
58 * Based upon Swansea University Computer Society NET3.039
62 #include <linux/socket.h>
63 #include <linux/file.h>
64 #include <linux/net.h>
65 #include <linux/interrupt.h>
66 #include <linux/thread_info.h>
67 #include <linux/rcupdate.h>
68 #include <linux/netdevice.h>
69 #include <linux/proc_fs.h>
70 #include <linux/seq_file.h>
71 #include <linux/mutex.h>
72 #include <linux/if_bridge.h>
73 #include <linux/if_frad.h>
74 #include <linux/if_vlan.h>
75 #include <linux/ptp_classify.h>
76 #include <linux/init.h>
77 #include <linux/poll.h>
78 #include <linux/cache.h>
79 #include <linux/module.h>
80 #include <linux/highmem.h>
81 #include <linux/mount.h>
82 #include <linux/security.h>
83 #include <linux/syscalls.h>
84 #include <linux/compat.h>
85 #include <linux/kmod.h>
86 #include <linux/audit.h>
87 #include <linux/wireless.h>
88 #include <linux/nsproxy.h>
89 #include <linux/magic.h>
90 #include <linux/slab.h>
91 #include <linux/xattr.h>
93 #include <linux/uaccess.h>
94 #include <asm/unistd.h>
96 #include <net/compat.h>
98 #include <net/cls_cgroup.h>
100 #include <net/sock.h>
101 #include <linux/netfilter.h>
103 #include <linux/if_tun.h>
104 #include <linux/ipv6_route.h>
105 #include <linux/route.h>
106 #include <linux/sockios.h>
107 #include <linux/atalk.h>
108 #include <net/busy_poll.h>
109 #include <linux/errqueue.h>
111 #ifdef CONFIG_NET_RX_BUSY_POLL
112 unsigned int sysctl_net_busy_read __read_mostly
;
113 unsigned int sysctl_net_busy_poll __read_mostly
;
116 static ssize_t
sock_read_iter(struct kiocb
*iocb
, struct iov_iter
*to
);
117 static ssize_t
sock_write_iter(struct kiocb
*iocb
, struct iov_iter
*from
);
118 static int sock_mmap(struct file
*file
, struct vm_area_struct
*vma
);
120 static int sock_close(struct inode
*inode
, struct file
*file
);
121 static __poll_t
sock_poll(struct file
*file
,
122 struct poll_table_struct
*wait
);
123 static long sock_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
);
125 static long compat_sock_ioctl(struct file
*file
,
126 unsigned int cmd
, unsigned long arg
);
128 static int sock_fasync(int fd
, struct file
*filp
, int on
);
129 static ssize_t
sock_sendpage(struct file
*file
, struct page
*page
,
130 int offset
, size_t size
, loff_t
*ppos
, int more
);
131 static ssize_t
sock_splice_read(struct file
*file
, loff_t
*ppos
,
132 struct pipe_inode_info
*pipe
, size_t len
,
136 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
137 * in the operation structures but are done directly via the socketcall() multiplexor.
140 static const struct file_operations socket_file_ops
= {
141 .owner
= THIS_MODULE
,
143 .read_iter
= sock_read_iter
,
144 .write_iter
= sock_write_iter
,
146 .unlocked_ioctl
= sock_ioctl
,
148 .compat_ioctl
= compat_sock_ioctl
,
151 .release
= sock_close
,
152 .fasync
= sock_fasync
,
153 .sendpage
= sock_sendpage
,
154 .splice_write
= generic_splice_sendpage
,
155 .splice_read
= sock_splice_read
,
159 * The protocol list. Each protocol is registered in here.
162 static DEFINE_SPINLOCK(net_family_lock
);
163 static const struct net_proto_family __rcu
*net_families
[NPROTO
] __read_mostly
;
167 * Move socket addresses back and forth across the kernel/user
168 * divide and look after the messy bits.
172 * move_addr_to_kernel - copy a socket address into kernel space
173 * @uaddr: Address in user space
174 * @kaddr: Address in kernel space
175 * @ulen: Length in user space
177 * The address is copied into kernel space. If the provided address is
178 * too long an error code of -EINVAL is returned. If the copy gives
179 * invalid addresses -EFAULT is returned. On a success 0 is returned.
182 int move_addr_to_kernel(void __user
*uaddr
, int ulen
, struct sockaddr_storage
*kaddr
)
184 if (ulen
< 0 || ulen
> sizeof(struct sockaddr_storage
))
188 if (copy_from_user(kaddr
, uaddr
, ulen
))
190 return audit_sockaddr(ulen
, kaddr
);
194 * move_addr_to_user - copy an address to user space
195 * @kaddr: kernel space address
196 * @klen: length of address in kernel
197 * @uaddr: user space address
198 * @ulen: pointer to user length field
200 * The value pointed to by ulen on entry is the buffer length available.
201 * This is overwritten with the buffer space used. -EINVAL is returned
202 * if an overlong buffer is specified or a negative buffer size. -EFAULT
203 * is returned if either the buffer or the length field are not
205 * After copying the data up to the limit the user specifies, the true
206 * length of the data is written over the length limit the user
207 * specified. Zero is returned for a success.
210 static int move_addr_to_user(struct sockaddr_storage
*kaddr
, int klen
,
211 void __user
*uaddr
, int __user
*ulen
)
216 BUG_ON(klen
> sizeof(struct sockaddr_storage
));
217 err
= get_user(len
, ulen
);
225 if (audit_sockaddr(klen
, kaddr
))
227 if (copy_to_user(uaddr
, kaddr
, len
))
231 * "fromlen shall refer to the value before truncation.."
234 return __put_user(klen
, ulen
);
237 static struct kmem_cache
*sock_inode_cachep __read_mostly
;
239 static struct inode
*sock_alloc_inode(struct super_block
*sb
)
241 struct socket_alloc
*ei
;
242 struct socket_wq
*wq
;
244 ei
= kmem_cache_alloc(sock_inode_cachep
, GFP_KERNEL
);
247 wq
= kmalloc(sizeof(*wq
), GFP_KERNEL
);
249 kmem_cache_free(sock_inode_cachep
, ei
);
252 init_waitqueue_head(&wq
->wait
);
253 wq
->fasync_list
= NULL
;
255 RCU_INIT_POINTER(ei
->socket
.wq
, wq
);
257 ei
->socket
.state
= SS_UNCONNECTED
;
258 ei
->socket
.flags
= 0;
259 ei
->socket
.ops
= NULL
;
260 ei
->socket
.sk
= NULL
;
261 ei
->socket
.file
= NULL
;
263 return &ei
->vfs_inode
;
266 static void sock_destroy_inode(struct inode
*inode
)
268 struct socket_alloc
*ei
;
269 struct socket_wq
*wq
;
271 ei
= container_of(inode
, struct socket_alloc
, vfs_inode
);
272 wq
= rcu_dereference_protected(ei
->socket
.wq
, 1);
274 kmem_cache_free(sock_inode_cachep
, ei
);
277 static void init_once(void *foo
)
279 struct socket_alloc
*ei
= (struct socket_alloc
*)foo
;
281 inode_init_once(&ei
->vfs_inode
);
284 static void init_inodecache(void)
286 sock_inode_cachep
= kmem_cache_create("sock_inode_cache",
287 sizeof(struct socket_alloc
),
289 (SLAB_HWCACHE_ALIGN
|
290 SLAB_RECLAIM_ACCOUNT
|
291 SLAB_MEM_SPREAD
| SLAB_ACCOUNT
),
293 BUG_ON(sock_inode_cachep
== NULL
);
296 static const struct super_operations sockfs_ops
= {
297 .alloc_inode
= sock_alloc_inode
,
298 .destroy_inode
= sock_destroy_inode
,
299 .statfs
= simple_statfs
,
303 * sockfs_dname() is called from d_path().
305 static char *sockfs_dname(struct dentry
*dentry
, char *buffer
, int buflen
)
307 return dynamic_dname(dentry
, buffer
, buflen
, "socket:[%lu]",
308 d_inode(dentry
)->i_ino
);
311 static const struct dentry_operations sockfs_dentry_operations
= {
312 .d_dname
= sockfs_dname
,
315 static int sockfs_xattr_get(const struct xattr_handler
*handler
,
316 struct dentry
*dentry
, struct inode
*inode
,
317 const char *suffix
, void *value
, size_t size
)
320 if (dentry
->d_name
.len
+ 1 > size
)
322 memcpy(value
, dentry
->d_name
.name
, dentry
->d_name
.len
+ 1);
324 return dentry
->d_name
.len
+ 1;
327 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
328 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
329 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
331 static const struct xattr_handler sockfs_xattr_handler
= {
332 .name
= XATTR_NAME_SOCKPROTONAME
,
333 .get
= sockfs_xattr_get
,
336 static int sockfs_security_xattr_set(const struct xattr_handler
*handler
,
337 struct dentry
*dentry
, struct inode
*inode
,
338 const char *suffix
, const void *value
,
339 size_t size
, int flags
)
341 /* Handled by LSM. */
345 static const struct xattr_handler sockfs_security_xattr_handler
= {
346 .prefix
= XATTR_SECURITY_PREFIX
,
347 .set
= sockfs_security_xattr_set
,
350 static const struct xattr_handler
*sockfs_xattr_handlers
[] = {
351 &sockfs_xattr_handler
,
352 &sockfs_security_xattr_handler
,
356 static struct dentry
*sockfs_mount(struct file_system_type
*fs_type
,
357 int flags
, const char *dev_name
, void *data
)
359 return mount_pseudo_xattr(fs_type
, "socket:", &sockfs_ops
,
360 sockfs_xattr_handlers
,
361 &sockfs_dentry_operations
, SOCKFS_MAGIC
);
364 static struct vfsmount
*sock_mnt __read_mostly
;
366 static struct file_system_type sock_fs_type
= {
368 .mount
= sockfs_mount
,
369 .kill_sb
= kill_anon_super
,
373 * Obtains the first available file descriptor and sets it up for use.
375 * These functions create file structures and maps them to fd space
376 * of the current process. On success it returns file descriptor
377 * and file struct implicitly stored in sock->file.
378 * Note that another thread may close file descriptor before we return
379 * from this function. We use the fact that now we do not refer
380 * to socket after mapping. If one day we will need it, this
381 * function will increment ref. count on file by 1.
383 * In any case returned fd MAY BE not valid!
384 * This race condition is unavoidable
385 * with shared fd spaces, we cannot solve it inside kernel,
386 * but we take care of internal coherence yet.
389 struct file
*sock_alloc_file(struct socket
*sock
, int flags
, const char *dname
)
391 struct qstr name
= { .name
= "" };
397 name
.len
= strlen(name
.name
);
398 } else if (sock
->sk
) {
399 name
.name
= sock
->sk
->sk_prot_creator
->name
;
400 name
.len
= strlen(name
.name
);
402 path
.dentry
= d_alloc_pseudo(sock_mnt
->mnt_sb
, &name
);
403 if (unlikely(!path
.dentry
)) {
405 return ERR_PTR(-ENOMEM
);
407 path
.mnt
= mntget(sock_mnt
);
409 d_instantiate(path
.dentry
, SOCK_INODE(sock
));
411 file
= alloc_file(&path
, FMODE_READ
| FMODE_WRITE
,
414 /* drop dentry, keep inode for a bit */
415 ihold(d_inode(path
.dentry
));
417 /* ... and now kill it properly */
423 file
->f_flags
= O_RDWR
| (flags
& O_NONBLOCK
);
424 file
->private_data
= sock
;
427 EXPORT_SYMBOL(sock_alloc_file
);
429 static int sock_map_fd(struct socket
*sock
, int flags
)
431 struct file
*newfile
;
432 int fd
= get_unused_fd_flags(flags
);
433 if (unlikely(fd
< 0)) {
438 newfile
= sock_alloc_file(sock
, flags
, NULL
);
439 if (likely(!IS_ERR(newfile
))) {
440 fd_install(fd
, newfile
);
445 return PTR_ERR(newfile
);
448 struct socket
*sock_from_file(struct file
*file
, int *err
)
450 if (file
->f_op
== &socket_file_ops
)
451 return file
->private_data
; /* set in sock_map_fd */
456 EXPORT_SYMBOL(sock_from_file
);
459 * sockfd_lookup - Go from a file number to its socket slot
461 * @err: pointer to an error code return
463 * The file handle passed in is locked and the socket it is bound
464 * to is returned. If an error occurs the err pointer is overwritten
465 * with a negative errno code and NULL is returned. The function checks
466 * for both invalid handles and passing a handle which is not a socket.
468 * On a success the socket object pointer is returned.
471 struct socket
*sockfd_lookup(int fd
, int *err
)
482 sock
= sock_from_file(file
, err
);
487 EXPORT_SYMBOL(sockfd_lookup
);
489 static struct socket
*sockfd_lookup_light(int fd
, int *err
, int *fput_needed
)
491 struct fd f
= fdget(fd
);
496 sock
= sock_from_file(f
.file
, err
);
498 *fput_needed
= f
.flags
;
506 static ssize_t
sockfs_listxattr(struct dentry
*dentry
, char *buffer
,
512 len
= security_inode_listsecurity(d_inode(dentry
), buffer
, size
);
522 len
= (XATTR_NAME_SOCKPROTONAME_LEN
+ 1);
527 memcpy(buffer
, XATTR_NAME_SOCKPROTONAME
, len
);
534 static int sockfs_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
536 int err
= simple_setattr(dentry
, iattr
);
538 if (!err
&& (iattr
->ia_valid
& ATTR_UID
)) {
539 struct socket
*sock
= SOCKET_I(d_inode(dentry
));
541 sock
->sk
->sk_uid
= iattr
->ia_uid
;
547 static const struct inode_operations sockfs_inode_ops
= {
548 .listxattr
= sockfs_listxattr
,
549 .setattr
= sockfs_setattr
,
553 * sock_alloc - allocate a socket
555 * Allocate a new inode and socket object. The two are bound together
556 * and initialised. The socket is then returned. If we are out of inodes
560 struct socket
*sock_alloc(void)
565 inode
= new_inode_pseudo(sock_mnt
->mnt_sb
);
569 sock
= SOCKET_I(inode
);
571 inode
->i_ino
= get_next_ino();
572 inode
->i_mode
= S_IFSOCK
| S_IRWXUGO
;
573 inode
->i_uid
= current_fsuid();
574 inode
->i_gid
= current_fsgid();
575 inode
->i_op
= &sockfs_inode_ops
;
579 EXPORT_SYMBOL(sock_alloc
);
582 * sock_release - close a socket
583 * @sock: socket to close
585 * The socket is released from the protocol stack if it has a release
586 * callback, and the inode is then released if the socket is bound to
587 * an inode not a file.
590 void sock_release(struct socket
*sock
)
593 struct module
*owner
= sock
->ops
->owner
;
595 sock
->ops
->release(sock
);
600 if (rcu_dereference_protected(sock
->wq
, 1)->fasync_list
)
601 pr_err("%s: fasync list not empty!\n", __func__
);
604 iput(SOCK_INODE(sock
));
609 EXPORT_SYMBOL(sock_release
);
611 void __sock_tx_timestamp(__u16 tsflags
, __u8
*tx_flags
)
613 u8 flags
= *tx_flags
;
615 if (tsflags
& SOF_TIMESTAMPING_TX_HARDWARE
)
616 flags
|= SKBTX_HW_TSTAMP
;
618 if (tsflags
& SOF_TIMESTAMPING_TX_SOFTWARE
)
619 flags
|= SKBTX_SW_TSTAMP
;
621 if (tsflags
& SOF_TIMESTAMPING_TX_SCHED
)
622 flags
|= SKBTX_SCHED_TSTAMP
;
626 EXPORT_SYMBOL(__sock_tx_timestamp
);
628 static inline int sock_sendmsg_nosec(struct socket
*sock
, struct msghdr
*msg
)
630 int ret
= sock
->ops
->sendmsg(sock
, msg
, msg_data_left(msg
));
631 BUG_ON(ret
== -EIOCBQUEUED
);
635 int sock_sendmsg(struct socket
*sock
, struct msghdr
*msg
)
637 int err
= security_socket_sendmsg(sock
, msg
,
640 return err
?: sock_sendmsg_nosec(sock
, msg
);
642 EXPORT_SYMBOL(sock_sendmsg
);
644 int kernel_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
645 struct kvec
*vec
, size_t num
, size_t size
)
647 iov_iter_kvec(&msg
->msg_iter
, WRITE
| ITER_KVEC
, vec
, num
, size
);
648 return sock_sendmsg(sock
, msg
);
650 EXPORT_SYMBOL(kernel_sendmsg
);
652 int kernel_sendmsg_locked(struct sock
*sk
, struct msghdr
*msg
,
653 struct kvec
*vec
, size_t num
, size_t size
)
655 struct socket
*sock
= sk
->sk_socket
;
657 if (!sock
->ops
->sendmsg_locked
)
658 return sock_no_sendmsg_locked(sk
, msg
, size
);
660 iov_iter_kvec(&msg
->msg_iter
, WRITE
| ITER_KVEC
, vec
, num
, size
);
662 return sock
->ops
->sendmsg_locked(sk
, msg
, msg_data_left(msg
));
664 EXPORT_SYMBOL(kernel_sendmsg_locked
);
666 static bool skb_is_err_queue(const struct sk_buff
*skb
)
668 /* pkt_type of skbs enqueued on the error queue are set to
669 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
670 * in recvmsg, since skbs received on a local socket will never
671 * have a pkt_type of PACKET_OUTGOING.
673 return skb
->pkt_type
== PACKET_OUTGOING
;
676 /* On transmit, software and hardware timestamps are returned independently.
677 * As the two skb clones share the hardware timestamp, which may be updated
678 * before the software timestamp is received, a hardware TX timestamp may be
679 * returned only if there is no software TX timestamp. Ignore false software
680 * timestamps, which may be made in the __sock_recv_timestamp() call when the
681 * option SO_TIMESTAMP(NS) is enabled on the socket, even when the skb has a
682 * hardware timestamp.
684 static bool skb_is_swtx_tstamp(const struct sk_buff
*skb
, int false_tstamp
)
686 return skb
->tstamp
&& !false_tstamp
&& skb_is_err_queue(skb
);
689 static void put_ts_pktinfo(struct msghdr
*msg
, struct sk_buff
*skb
)
691 struct scm_ts_pktinfo ts_pktinfo
;
692 struct net_device
*orig_dev
;
694 if (!skb_mac_header_was_set(skb
))
697 memset(&ts_pktinfo
, 0, sizeof(ts_pktinfo
));
700 orig_dev
= dev_get_by_napi_id(skb_napi_id(skb
));
702 ts_pktinfo
.if_index
= orig_dev
->ifindex
;
705 ts_pktinfo
.pkt_length
= skb
->len
- skb_mac_offset(skb
);
706 put_cmsg(msg
, SOL_SOCKET
, SCM_TIMESTAMPING_PKTINFO
,
707 sizeof(ts_pktinfo
), &ts_pktinfo
);
711 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
713 void __sock_recv_timestamp(struct msghdr
*msg
, struct sock
*sk
,
716 int need_software_tstamp
= sock_flag(sk
, SOCK_RCVTSTAMP
);
717 struct scm_timestamping tss
;
718 int empty
= 1, false_tstamp
= 0;
719 struct skb_shared_hwtstamps
*shhwtstamps
=
722 /* Race occurred between timestamp enabling and packet
723 receiving. Fill in the current time for now. */
724 if (need_software_tstamp
&& skb
->tstamp
== 0) {
725 __net_timestamp(skb
);
729 if (need_software_tstamp
) {
730 if (!sock_flag(sk
, SOCK_RCVTSTAMPNS
)) {
732 skb_get_timestamp(skb
, &tv
);
733 put_cmsg(msg
, SOL_SOCKET
, SCM_TIMESTAMP
,
737 skb_get_timestampns(skb
, &ts
);
738 put_cmsg(msg
, SOL_SOCKET
, SCM_TIMESTAMPNS
,
743 memset(&tss
, 0, sizeof(tss
));
744 if ((sk
->sk_tsflags
& SOF_TIMESTAMPING_SOFTWARE
) &&
745 ktime_to_timespec_cond(skb
->tstamp
, tss
.ts
+ 0))
748 (sk
->sk_tsflags
& SOF_TIMESTAMPING_RAW_HARDWARE
) &&
749 !skb_is_swtx_tstamp(skb
, false_tstamp
) &&
750 ktime_to_timespec_cond(shhwtstamps
->hwtstamp
, tss
.ts
+ 2)) {
752 if ((sk
->sk_tsflags
& SOF_TIMESTAMPING_OPT_PKTINFO
) &&
753 !skb_is_err_queue(skb
))
754 put_ts_pktinfo(msg
, skb
);
757 put_cmsg(msg
, SOL_SOCKET
,
758 SCM_TIMESTAMPING
, sizeof(tss
), &tss
);
760 if (skb_is_err_queue(skb
) && skb
->len
&&
761 SKB_EXT_ERR(skb
)->opt_stats
)
762 put_cmsg(msg
, SOL_SOCKET
, SCM_TIMESTAMPING_OPT_STATS
,
763 skb
->len
, skb
->data
);
766 EXPORT_SYMBOL_GPL(__sock_recv_timestamp
);
768 void __sock_recv_wifi_status(struct msghdr
*msg
, struct sock
*sk
,
773 if (!sock_flag(sk
, SOCK_WIFI_STATUS
))
775 if (!skb
->wifi_acked_valid
)
778 ack
= skb
->wifi_acked
;
780 put_cmsg(msg
, SOL_SOCKET
, SCM_WIFI_STATUS
, sizeof(ack
), &ack
);
782 EXPORT_SYMBOL_GPL(__sock_recv_wifi_status
);
784 static inline void sock_recv_drops(struct msghdr
*msg
, struct sock
*sk
,
787 if (sock_flag(sk
, SOCK_RXQ_OVFL
) && skb
&& SOCK_SKB_CB(skb
)->dropcount
)
788 put_cmsg(msg
, SOL_SOCKET
, SO_RXQ_OVFL
,
789 sizeof(__u32
), &SOCK_SKB_CB(skb
)->dropcount
);
792 void __sock_recv_ts_and_drops(struct msghdr
*msg
, struct sock
*sk
,
795 sock_recv_timestamp(msg
, sk
, skb
);
796 sock_recv_drops(msg
, sk
, skb
);
798 EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops
);
800 static inline int sock_recvmsg_nosec(struct socket
*sock
, struct msghdr
*msg
,
803 return sock
->ops
->recvmsg(sock
, msg
, msg_data_left(msg
), flags
);
806 int sock_recvmsg(struct socket
*sock
, struct msghdr
*msg
, int flags
)
808 int err
= security_socket_recvmsg(sock
, msg
, msg_data_left(msg
), flags
);
810 return err
?: sock_recvmsg_nosec(sock
, msg
, flags
);
812 EXPORT_SYMBOL(sock_recvmsg
);
815 * kernel_recvmsg - Receive a message from a socket (kernel space)
816 * @sock: The socket to receive the message from
817 * @msg: Received message
818 * @vec: Input s/g array for message data
819 * @num: Size of input s/g array
820 * @size: Number of bytes to read
821 * @flags: Message flags (MSG_DONTWAIT, etc...)
823 * On return the msg structure contains the scatter/gather array passed in the
824 * vec argument. The array is modified so that it consists of the unfilled
825 * portion of the original array.
827 * The returned value is the total number of bytes received, or an error.
829 int kernel_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
830 struct kvec
*vec
, size_t num
, size_t size
, int flags
)
832 mm_segment_t oldfs
= get_fs();
835 iov_iter_kvec(&msg
->msg_iter
, READ
| ITER_KVEC
, vec
, num
, size
);
837 result
= sock_recvmsg(sock
, msg
, flags
);
841 EXPORT_SYMBOL(kernel_recvmsg
);
843 static ssize_t
sock_sendpage(struct file
*file
, struct page
*page
,
844 int offset
, size_t size
, loff_t
*ppos
, int more
)
849 sock
= file
->private_data
;
851 flags
= (file
->f_flags
& O_NONBLOCK
) ? MSG_DONTWAIT
: 0;
852 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
855 return kernel_sendpage(sock
, page
, offset
, size
, flags
);
858 static ssize_t
sock_splice_read(struct file
*file
, loff_t
*ppos
,
859 struct pipe_inode_info
*pipe
, size_t len
,
862 struct socket
*sock
= file
->private_data
;
864 if (unlikely(!sock
->ops
->splice_read
))
867 return sock
->ops
->splice_read(sock
, ppos
, pipe
, len
, flags
);
870 static ssize_t
sock_read_iter(struct kiocb
*iocb
, struct iov_iter
*to
)
872 struct file
*file
= iocb
->ki_filp
;
873 struct socket
*sock
= file
->private_data
;
874 struct msghdr msg
= {.msg_iter
= *to
,
878 if (file
->f_flags
& O_NONBLOCK
)
879 msg
.msg_flags
= MSG_DONTWAIT
;
881 if (iocb
->ki_pos
!= 0)
884 if (!iov_iter_count(to
)) /* Match SYS5 behaviour */
887 res
= sock_recvmsg(sock
, &msg
, msg
.msg_flags
);
892 static ssize_t
sock_write_iter(struct kiocb
*iocb
, struct iov_iter
*from
)
894 struct file
*file
= iocb
->ki_filp
;
895 struct socket
*sock
= file
->private_data
;
896 struct msghdr msg
= {.msg_iter
= *from
,
900 if (iocb
->ki_pos
!= 0)
903 if (file
->f_flags
& O_NONBLOCK
)
904 msg
.msg_flags
= MSG_DONTWAIT
;
906 if (sock
->type
== SOCK_SEQPACKET
)
907 msg
.msg_flags
|= MSG_EOR
;
909 res
= sock_sendmsg(sock
, &msg
);
910 *from
= msg
.msg_iter
;
915 * Atomic setting of ioctl hooks to avoid race
916 * with module unload.
919 static DEFINE_MUTEX(br_ioctl_mutex
);
920 static int (*br_ioctl_hook
) (struct net
*, unsigned int cmd
, void __user
*arg
);
922 void brioctl_set(int (*hook
) (struct net
*, unsigned int, void __user
*))
924 mutex_lock(&br_ioctl_mutex
);
925 br_ioctl_hook
= hook
;
926 mutex_unlock(&br_ioctl_mutex
);
928 EXPORT_SYMBOL(brioctl_set
);
930 static DEFINE_MUTEX(vlan_ioctl_mutex
);
931 static int (*vlan_ioctl_hook
) (struct net
*, void __user
*arg
);
933 void vlan_ioctl_set(int (*hook
) (struct net
*, void __user
*))
935 mutex_lock(&vlan_ioctl_mutex
);
936 vlan_ioctl_hook
= hook
;
937 mutex_unlock(&vlan_ioctl_mutex
);
939 EXPORT_SYMBOL(vlan_ioctl_set
);
941 static DEFINE_MUTEX(dlci_ioctl_mutex
);
942 static int (*dlci_ioctl_hook
) (unsigned int, void __user
*);
944 void dlci_ioctl_set(int (*hook
) (unsigned int, void __user
*))
946 mutex_lock(&dlci_ioctl_mutex
);
947 dlci_ioctl_hook
= hook
;
948 mutex_unlock(&dlci_ioctl_mutex
);
950 EXPORT_SYMBOL(dlci_ioctl_set
);
952 static long sock_do_ioctl(struct net
*net
, struct socket
*sock
,
953 unsigned int cmd
, unsigned long arg
)
956 void __user
*argp
= (void __user
*)arg
;
958 err
= sock
->ops
->ioctl(sock
, cmd
, arg
);
961 * If this ioctl is unknown try to hand it down
964 if (err
!= -ENOIOCTLCMD
)
967 if (cmd
== SIOCGIFCONF
) {
969 if (copy_from_user(&ifc
, argp
, sizeof(struct ifconf
)))
972 err
= dev_ifconf(net
, &ifc
, sizeof(struct ifreq
));
974 if (!err
&& copy_to_user(argp
, &ifc
, sizeof(struct ifconf
)))
979 if (copy_from_user(&ifr
, argp
, sizeof(struct ifreq
)))
981 err
= dev_ioctl(net
, cmd
, &ifr
, &need_copyout
);
982 if (!err
&& need_copyout
)
983 if (copy_to_user(argp
, &ifr
, sizeof(struct ifreq
)))
990 * With an ioctl, arg may well be a user mode pointer, but we don't know
991 * what to do with it - that's up to the protocol still.
994 static struct ns_common
*get_net_ns(struct ns_common
*ns
)
996 return &get_net(container_of(ns
, struct net
, ns
))->ns
;
999 static long sock_ioctl(struct file
*file
, unsigned cmd
, unsigned long arg
)
1001 struct socket
*sock
;
1003 void __user
*argp
= (void __user
*)arg
;
1007 sock
= file
->private_data
;
1010 if (unlikely(cmd
>= SIOCDEVPRIVATE
&& cmd
<= (SIOCDEVPRIVATE
+ 15))) {
1013 if (copy_from_user(&ifr
, argp
, sizeof(struct ifreq
)))
1015 err
= dev_ioctl(net
, cmd
, &ifr
, &need_copyout
);
1016 if (!err
&& need_copyout
)
1017 if (copy_to_user(argp
, &ifr
, sizeof(struct ifreq
)))
1020 #ifdef CONFIG_WEXT_CORE
1021 if (cmd
>= SIOCIWFIRST
&& cmd
<= SIOCIWLAST
) {
1022 err
= wext_handle_ioctl(net
, cmd
, argp
);
1029 if (get_user(pid
, (int __user
*)argp
))
1031 err
= f_setown(sock
->file
, pid
, 1);
1035 err
= put_user(f_getown(sock
->file
),
1036 (int __user
*)argp
);
1044 request_module("bridge");
1046 mutex_lock(&br_ioctl_mutex
);
1048 err
= br_ioctl_hook(net
, cmd
, argp
);
1049 mutex_unlock(&br_ioctl_mutex
);
1054 if (!vlan_ioctl_hook
)
1055 request_module("8021q");
1057 mutex_lock(&vlan_ioctl_mutex
);
1058 if (vlan_ioctl_hook
)
1059 err
= vlan_ioctl_hook(net
, argp
);
1060 mutex_unlock(&vlan_ioctl_mutex
);
1065 if (!dlci_ioctl_hook
)
1066 request_module("dlci");
1068 mutex_lock(&dlci_ioctl_mutex
);
1069 if (dlci_ioctl_hook
)
1070 err
= dlci_ioctl_hook(cmd
, argp
);
1071 mutex_unlock(&dlci_ioctl_mutex
);
1075 if (!ns_capable(net
->user_ns
, CAP_NET_ADMIN
))
1078 err
= open_related_ns(&net
->ns
, get_net_ns
);
1081 err
= sock_do_ioctl(net
, sock
, cmd
, arg
);
1087 int sock_create_lite(int family
, int type
, int protocol
, struct socket
**res
)
1090 struct socket
*sock
= NULL
;
1092 err
= security_socket_create(family
, type
, protocol
, 1);
1096 sock
= sock_alloc();
1103 err
= security_socket_post_create(sock
, family
, type
, protocol
, 1);
1115 EXPORT_SYMBOL(sock_create_lite
);
1117 /* No kernel lock held - perfect */
1118 static __poll_t
sock_poll(struct file
*file
, poll_table
*wait
)
1120 __poll_t busy_flag
= 0;
1121 struct socket
*sock
;
1124 * We can't return errors to poll, so it's either yes or no.
1126 sock
= file
->private_data
;
1128 if (sk_can_busy_loop(sock
->sk
)) {
1129 /* this socket can poll_ll so tell the system call */
1130 busy_flag
= POLL_BUSY_LOOP
;
1132 /* once, only if requested by syscall */
1133 if (wait
&& (wait
->_key
& POLL_BUSY_LOOP
))
1134 sk_busy_loop(sock
->sk
, 1);
1137 return busy_flag
| sock
->ops
->poll(file
, sock
, wait
);
1140 static int sock_mmap(struct file
*file
, struct vm_area_struct
*vma
)
1142 struct socket
*sock
= file
->private_data
;
1144 return sock
->ops
->mmap(file
, sock
, vma
);
1147 static int sock_close(struct inode
*inode
, struct file
*filp
)
1149 sock_release(SOCKET_I(inode
));
1154 * Update the socket async list
1156 * Fasync_list locking strategy.
1158 * 1. fasync_list is modified only under process context socket lock
1159 * i.e. under semaphore.
1160 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1161 * or under socket lock
1164 static int sock_fasync(int fd
, struct file
*filp
, int on
)
1166 struct socket
*sock
= filp
->private_data
;
1167 struct sock
*sk
= sock
->sk
;
1168 struct socket_wq
*wq
;
1174 wq
= rcu_dereference_protected(sock
->wq
, lockdep_sock_is_held(sk
));
1175 fasync_helper(fd
, filp
, on
, &wq
->fasync_list
);
1177 if (!wq
->fasync_list
)
1178 sock_reset_flag(sk
, SOCK_FASYNC
);
1180 sock_set_flag(sk
, SOCK_FASYNC
);
1186 /* This function may be called only under rcu_lock */
1188 int sock_wake_async(struct socket_wq
*wq
, int how
, int band
)
1190 if (!wq
|| !wq
->fasync_list
)
1194 case SOCK_WAKE_WAITD
:
1195 if (test_bit(SOCKWQ_ASYNC_WAITDATA
, &wq
->flags
))
1198 case SOCK_WAKE_SPACE
:
1199 if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE
, &wq
->flags
))
1204 kill_fasync(&wq
->fasync_list
, SIGIO
, band
);
1207 kill_fasync(&wq
->fasync_list
, SIGURG
, band
);
1212 EXPORT_SYMBOL(sock_wake_async
);
1214 int __sock_create(struct net
*net
, int family
, int type
, int protocol
,
1215 struct socket
**res
, int kern
)
1218 struct socket
*sock
;
1219 const struct net_proto_family
*pf
;
1222 * Check protocol is in range
1224 if (family
< 0 || family
>= NPROTO
)
1225 return -EAFNOSUPPORT
;
1226 if (type
< 0 || type
>= SOCK_MAX
)
1231 This uglymoron is moved from INET layer to here to avoid
1232 deadlock in module load.
1234 if (family
== PF_INET
&& type
== SOCK_PACKET
) {
1235 pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1240 err
= security_socket_create(family
, type
, protocol
, kern
);
1245 * Allocate the socket and allow the family to set things up. if
1246 * the protocol is 0, the family is instructed to select an appropriate
1249 sock
= sock_alloc();
1251 net_warn_ratelimited("socket: no more sockets\n");
1252 return -ENFILE
; /* Not exactly a match, but its the
1253 closest posix thing */
1258 #ifdef CONFIG_MODULES
1259 /* Attempt to load a protocol module if the find failed.
1261 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1262 * requested real, full-featured networking support upon configuration.
1263 * Otherwise module support will break!
1265 if (rcu_access_pointer(net_families
[family
]) == NULL
)
1266 request_module("net-pf-%d", family
);
1270 pf
= rcu_dereference(net_families
[family
]);
1271 err
= -EAFNOSUPPORT
;
1276 * We will call the ->create function, that possibly is in a loadable
1277 * module, so we have to bump that loadable module refcnt first.
1279 if (!try_module_get(pf
->owner
))
1282 /* Now protected by module ref count */
1285 err
= pf
->create(net
, sock
, protocol
, kern
);
1287 goto out_module_put
;
1290 * Now to bump the refcnt of the [loadable] module that owns this
1291 * socket at sock_release time we decrement its refcnt.
1293 if (!try_module_get(sock
->ops
->owner
))
1294 goto out_module_busy
;
1297 * Now that we're done with the ->create function, the [loadable]
1298 * module can have its refcnt decremented
1300 module_put(pf
->owner
);
1301 err
= security_socket_post_create(sock
, family
, type
, protocol
, kern
);
1303 goto out_sock_release
;
1309 err
= -EAFNOSUPPORT
;
1312 module_put(pf
->owner
);
1319 goto out_sock_release
;
1321 EXPORT_SYMBOL(__sock_create
);
1323 int sock_create(int family
, int type
, int protocol
, struct socket
**res
)
1325 return __sock_create(current
->nsproxy
->net_ns
, family
, type
, protocol
, res
, 0);
1327 EXPORT_SYMBOL(sock_create
);
1329 int sock_create_kern(struct net
*net
, int family
, int type
, int protocol
, struct socket
**res
)
1331 return __sock_create(net
, family
, type
, protocol
, res
, 1);
1333 EXPORT_SYMBOL(sock_create_kern
);
1335 SYSCALL_DEFINE3(socket
, int, family
, int, type
, int, protocol
)
1338 struct socket
*sock
;
1341 /* Check the SOCK_* constants for consistency. */
1342 BUILD_BUG_ON(SOCK_CLOEXEC
!= O_CLOEXEC
);
1343 BUILD_BUG_ON((SOCK_MAX
| SOCK_TYPE_MASK
) != SOCK_TYPE_MASK
);
1344 BUILD_BUG_ON(SOCK_CLOEXEC
& SOCK_TYPE_MASK
);
1345 BUILD_BUG_ON(SOCK_NONBLOCK
& SOCK_TYPE_MASK
);
1347 flags
= type
& ~SOCK_TYPE_MASK
;
1348 if (flags
& ~(SOCK_CLOEXEC
| SOCK_NONBLOCK
))
1350 type
&= SOCK_TYPE_MASK
;
1352 if (SOCK_NONBLOCK
!= O_NONBLOCK
&& (flags
& SOCK_NONBLOCK
))
1353 flags
= (flags
& ~SOCK_NONBLOCK
) | O_NONBLOCK
;
1355 retval
= sock_create(family
, type
, protocol
, &sock
);
1359 return sock_map_fd(sock
, flags
& (O_CLOEXEC
| O_NONBLOCK
));
1363 * Create a pair of connected sockets.
1366 SYSCALL_DEFINE4(socketpair
, int, family
, int, type
, int, protocol
,
1367 int __user
*, usockvec
)
1369 struct socket
*sock1
, *sock2
;
1371 struct file
*newfile1
, *newfile2
;
1374 flags
= type
& ~SOCK_TYPE_MASK
;
1375 if (flags
& ~(SOCK_CLOEXEC
| SOCK_NONBLOCK
))
1377 type
&= SOCK_TYPE_MASK
;
1379 if (SOCK_NONBLOCK
!= O_NONBLOCK
&& (flags
& SOCK_NONBLOCK
))
1380 flags
= (flags
& ~SOCK_NONBLOCK
) | O_NONBLOCK
;
1383 * reserve descriptors and make sure we won't fail
1384 * to return them to userland.
1386 fd1
= get_unused_fd_flags(flags
);
1387 if (unlikely(fd1
< 0))
1390 fd2
= get_unused_fd_flags(flags
);
1391 if (unlikely(fd2
< 0)) {
1396 err
= put_user(fd1
, &usockvec
[0]);
1400 err
= put_user(fd2
, &usockvec
[1]);
1405 * Obtain the first socket and check if the underlying protocol
1406 * supports the socketpair call.
1409 err
= sock_create(family
, type
, protocol
, &sock1
);
1410 if (unlikely(err
< 0))
1413 err
= sock_create(family
, type
, protocol
, &sock2
);
1414 if (unlikely(err
< 0)) {
1415 sock_release(sock1
);
1419 err
= sock1
->ops
->socketpair(sock1
, sock2
);
1420 if (unlikely(err
< 0)) {
1421 sock_release(sock2
);
1422 sock_release(sock1
);
1426 newfile1
= sock_alloc_file(sock1
, flags
, NULL
);
1427 if (IS_ERR(newfile1
)) {
1428 err
= PTR_ERR(newfile1
);
1429 sock_release(sock2
);
1433 newfile2
= sock_alloc_file(sock2
, flags
, NULL
);
1434 if (IS_ERR(newfile2
)) {
1435 err
= PTR_ERR(newfile2
);
1440 audit_fd_pair(fd1
, fd2
);
1442 fd_install(fd1
, newfile1
);
1443 fd_install(fd2
, newfile2
);
1453 * Bind a name to a socket. Nothing much to do here since it's
1454 * the protocol's responsibility to handle the local address.
1456 * We move the socket address to kernel space before we call
1457 * the protocol layer (having also checked the address is ok).
1460 SYSCALL_DEFINE3(bind
, int, fd
, struct sockaddr __user
*, umyaddr
, int, addrlen
)
1462 struct socket
*sock
;
1463 struct sockaddr_storage address
;
1464 int err
, fput_needed
;
1466 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1468 err
= move_addr_to_kernel(umyaddr
, addrlen
, &address
);
1470 err
= security_socket_bind(sock
,
1471 (struct sockaddr
*)&address
,
1474 err
= sock
->ops
->bind(sock
,
1478 fput_light(sock
->file
, fput_needed
);
1484 * Perform a listen. Basically, we allow the protocol to do anything
1485 * necessary for a listen, and if that works, we mark the socket as
1486 * ready for listening.
1489 SYSCALL_DEFINE2(listen
, int, fd
, int, backlog
)
1491 struct socket
*sock
;
1492 int err
, fput_needed
;
1495 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1497 somaxconn
= sock_net(sock
->sk
)->core
.sysctl_somaxconn
;
1498 if ((unsigned int)backlog
> somaxconn
)
1499 backlog
= somaxconn
;
1501 err
= security_socket_listen(sock
, backlog
);
1503 err
= sock
->ops
->listen(sock
, backlog
);
1505 fput_light(sock
->file
, fput_needed
);
1511 * For accept, we attempt to create a new socket, set up the link
1512 * with the client, wake up the client, then return the new
1513 * connected fd. We collect the address of the connector in kernel
1514 * space and move it to user at the very end. This is unclean because
1515 * we open the socket then return an error.
1517 * 1003.1g adds the ability to recvmsg() to query connection pending
1518 * status to recvmsg. We need to add that support in a way thats
1519 * clean when we restucture accept also.
1522 SYSCALL_DEFINE4(accept4
, int, fd
, struct sockaddr __user
*, upeer_sockaddr
,
1523 int __user
*, upeer_addrlen
, int, flags
)
1525 struct socket
*sock
, *newsock
;
1526 struct file
*newfile
;
1527 int err
, len
, newfd
, fput_needed
;
1528 struct sockaddr_storage address
;
1530 if (flags
& ~(SOCK_CLOEXEC
| SOCK_NONBLOCK
))
1533 if (SOCK_NONBLOCK
!= O_NONBLOCK
&& (flags
& SOCK_NONBLOCK
))
1534 flags
= (flags
& ~SOCK_NONBLOCK
) | O_NONBLOCK
;
1536 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1541 newsock
= sock_alloc();
1545 newsock
->type
= sock
->type
;
1546 newsock
->ops
= sock
->ops
;
1549 * We don't need try_module_get here, as the listening socket (sock)
1550 * has the protocol module (sock->ops->owner) held.
1552 __module_get(newsock
->ops
->owner
);
1554 newfd
= get_unused_fd_flags(flags
);
1555 if (unlikely(newfd
< 0)) {
1557 sock_release(newsock
);
1560 newfile
= sock_alloc_file(newsock
, flags
, sock
->sk
->sk_prot_creator
->name
);
1561 if (IS_ERR(newfile
)) {
1562 err
= PTR_ERR(newfile
);
1563 put_unused_fd(newfd
);
1567 err
= security_socket_accept(sock
, newsock
);
1571 err
= sock
->ops
->accept(sock
, newsock
, sock
->file
->f_flags
, false);
1575 if (upeer_sockaddr
) {
1576 len
= newsock
->ops
->getname(newsock
,
1577 (struct sockaddr
*)&address
, 2);
1579 err
= -ECONNABORTED
;
1582 err
= move_addr_to_user(&address
,
1583 len
, upeer_sockaddr
, upeer_addrlen
);
1588 /* File flags are not inherited via accept() unlike another OSes. */
1590 fd_install(newfd
, newfile
);
1594 fput_light(sock
->file
, fput_needed
);
1599 put_unused_fd(newfd
);
1603 SYSCALL_DEFINE3(accept
, int, fd
, struct sockaddr __user
*, upeer_sockaddr
,
1604 int __user
*, upeer_addrlen
)
1606 return sys_accept4(fd
, upeer_sockaddr
, upeer_addrlen
, 0);
1610 * Attempt to connect to a socket with the server address. The address
1611 * is in user space so we verify it is OK and move it to kernel space.
1613 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1616 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1617 * other SEQPACKET protocols that take time to connect() as it doesn't
1618 * include the -EINPROGRESS status for such sockets.
1621 SYSCALL_DEFINE3(connect
, int, fd
, struct sockaddr __user
*, uservaddr
,
1624 struct socket
*sock
;
1625 struct sockaddr_storage address
;
1626 int err
, fput_needed
;
1628 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1631 err
= move_addr_to_kernel(uservaddr
, addrlen
, &address
);
1636 security_socket_connect(sock
, (struct sockaddr
*)&address
, addrlen
);
1640 err
= sock
->ops
->connect(sock
, (struct sockaddr
*)&address
, addrlen
,
1641 sock
->file
->f_flags
);
1643 fput_light(sock
->file
, fput_needed
);
1649 * Get the local address ('name') of a socket object. Move the obtained
1650 * name to user space.
1653 SYSCALL_DEFINE3(getsockname
, int, fd
, struct sockaddr __user
*, usockaddr
,
1654 int __user
*, usockaddr_len
)
1656 struct socket
*sock
;
1657 struct sockaddr_storage address
;
1658 int err
, fput_needed
;
1660 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1664 err
= security_socket_getsockname(sock
);
1668 err
= sock
->ops
->getname(sock
, (struct sockaddr
*)&address
, 0);
1671 /* "err" is actually length in this case */
1672 err
= move_addr_to_user(&address
, err
, usockaddr
, usockaddr_len
);
1675 fput_light(sock
->file
, fput_needed
);
1681 * Get the remote address ('name') of a socket object. Move the obtained
1682 * name to user space.
1685 SYSCALL_DEFINE3(getpeername
, int, fd
, struct sockaddr __user
*, usockaddr
,
1686 int __user
*, usockaddr_len
)
1688 struct socket
*sock
;
1689 struct sockaddr_storage address
;
1690 int err
, fput_needed
;
1692 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1694 err
= security_socket_getpeername(sock
);
1696 fput_light(sock
->file
, fput_needed
);
1700 err
= sock
->ops
->getname(sock
, (struct sockaddr
*)&address
, 1);
1702 /* "err" is actually length in this case */
1703 err
= move_addr_to_user(&address
, err
, usockaddr
,
1705 fput_light(sock
->file
, fput_needed
);
1711 * Send a datagram to a given address. We move the address into kernel
1712 * space and check the user space data area is readable before invoking
1716 SYSCALL_DEFINE6(sendto
, int, fd
, void __user
*, buff
, size_t, len
,
1717 unsigned int, flags
, struct sockaddr __user
*, addr
,
1720 struct socket
*sock
;
1721 struct sockaddr_storage address
;
1727 err
= import_single_range(WRITE
, buff
, len
, &iov
, &msg
.msg_iter
);
1730 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1734 msg
.msg_name
= NULL
;
1735 msg
.msg_control
= NULL
;
1736 msg
.msg_controllen
= 0;
1737 msg
.msg_namelen
= 0;
1739 err
= move_addr_to_kernel(addr
, addr_len
, &address
);
1742 msg
.msg_name
= (struct sockaddr
*)&address
;
1743 msg
.msg_namelen
= addr_len
;
1745 if (sock
->file
->f_flags
& O_NONBLOCK
)
1746 flags
|= MSG_DONTWAIT
;
1747 msg
.msg_flags
= flags
;
1748 err
= sock_sendmsg(sock
, &msg
);
1751 fput_light(sock
->file
, fput_needed
);
1757 * Send a datagram down a socket.
1760 SYSCALL_DEFINE4(send
, int, fd
, void __user
*, buff
, size_t, len
,
1761 unsigned int, flags
)
1763 return sys_sendto(fd
, buff
, len
, flags
, NULL
, 0);
1767 * Receive a frame from the socket and optionally record the address of the
1768 * sender. We verify the buffers are writable and if needed move the
1769 * sender address from kernel to user space.
1772 SYSCALL_DEFINE6(recvfrom
, int, fd
, void __user
*, ubuf
, size_t, size
,
1773 unsigned int, flags
, struct sockaddr __user
*, addr
,
1774 int __user
*, addr_len
)
1776 struct socket
*sock
;
1779 struct sockaddr_storage address
;
1783 err
= import_single_range(READ
, ubuf
, size
, &iov
, &msg
.msg_iter
);
1786 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1790 msg
.msg_control
= NULL
;
1791 msg
.msg_controllen
= 0;
1792 /* Save some cycles and don't copy the address if not needed */
1793 msg
.msg_name
= addr
? (struct sockaddr
*)&address
: NULL
;
1794 /* We assume all kernel code knows the size of sockaddr_storage */
1795 msg
.msg_namelen
= 0;
1796 msg
.msg_iocb
= NULL
;
1798 if (sock
->file
->f_flags
& O_NONBLOCK
)
1799 flags
|= MSG_DONTWAIT
;
1800 err
= sock_recvmsg(sock
, &msg
, flags
);
1802 if (err
>= 0 && addr
!= NULL
) {
1803 err2
= move_addr_to_user(&address
,
1804 msg
.msg_namelen
, addr
, addr_len
);
1809 fput_light(sock
->file
, fput_needed
);
1815 * Receive a datagram from a socket.
1818 SYSCALL_DEFINE4(recv
, int, fd
, void __user
*, ubuf
, size_t, size
,
1819 unsigned int, flags
)
1821 return sys_recvfrom(fd
, ubuf
, size
, flags
, NULL
, NULL
);
1825 * Set a socket option. Because we don't know the option lengths we have
1826 * to pass the user mode parameter for the protocols to sort out.
1829 SYSCALL_DEFINE5(setsockopt
, int, fd
, int, level
, int, optname
,
1830 char __user
*, optval
, int, optlen
)
1832 int err
, fput_needed
;
1833 struct socket
*sock
;
1838 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1840 err
= security_socket_setsockopt(sock
, level
, optname
);
1844 if (level
== SOL_SOCKET
)
1846 sock_setsockopt(sock
, level
, optname
, optval
,
1850 sock
->ops
->setsockopt(sock
, level
, optname
, optval
,
1853 fput_light(sock
->file
, fput_needed
);
1859 * Get a socket option. Because we don't know the option lengths we have
1860 * to pass a user mode parameter for the protocols to sort out.
1863 SYSCALL_DEFINE5(getsockopt
, int, fd
, int, level
, int, optname
,
1864 char __user
*, optval
, int __user
*, optlen
)
1866 int err
, fput_needed
;
1867 struct socket
*sock
;
1869 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1871 err
= security_socket_getsockopt(sock
, level
, optname
);
1875 if (level
== SOL_SOCKET
)
1877 sock_getsockopt(sock
, level
, optname
, optval
,
1881 sock
->ops
->getsockopt(sock
, level
, optname
, optval
,
1884 fput_light(sock
->file
, fput_needed
);
1890 * Shutdown a socket.
1893 SYSCALL_DEFINE2(shutdown
, int, fd
, int, how
)
1895 int err
, fput_needed
;
1896 struct socket
*sock
;
1898 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
1900 err
= security_socket_shutdown(sock
, how
);
1902 err
= sock
->ops
->shutdown(sock
, how
);
1903 fput_light(sock
->file
, fput_needed
);
1908 /* A couple of helpful macros for getting the address of the 32/64 bit
1909 * fields which are the same type (int / unsigned) on our platforms.
1911 #define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1912 #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1913 #define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1915 struct used_address
{
1916 struct sockaddr_storage name
;
1917 unsigned int name_len
;
1920 static int copy_msghdr_from_user(struct msghdr
*kmsg
,
1921 struct user_msghdr __user
*umsg
,
1922 struct sockaddr __user
**save_addr
,
1925 struct user_msghdr msg
;
1928 if (copy_from_user(&msg
, umsg
, sizeof(*umsg
)))
1931 kmsg
->msg_control
= (void __force
*)msg
.msg_control
;
1932 kmsg
->msg_controllen
= msg
.msg_controllen
;
1933 kmsg
->msg_flags
= msg
.msg_flags
;
1935 kmsg
->msg_namelen
= msg
.msg_namelen
;
1937 kmsg
->msg_namelen
= 0;
1939 if (kmsg
->msg_namelen
< 0)
1942 if (kmsg
->msg_namelen
> sizeof(struct sockaddr_storage
))
1943 kmsg
->msg_namelen
= sizeof(struct sockaddr_storage
);
1946 *save_addr
= msg
.msg_name
;
1948 if (msg
.msg_name
&& kmsg
->msg_namelen
) {
1950 err
= move_addr_to_kernel(msg
.msg_name
,
1957 kmsg
->msg_name
= NULL
;
1958 kmsg
->msg_namelen
= 0;
1961 if (msg
.msg_iovlen
> UIO_MAXIOV
)
1964 kmsg
->msg_iocb
= NULL
;
1966 return import_iovec(save_addr
? READ
: WRITE
,
1967 msg
.msg_iov
, msg
.msg_iovlen
,
1968 UIO_FASTIOV
, iov
, &kmsg
->msg_iter
);
1971 static int ___sys_sendmsg(struct socket
*sock
, struct user_msghdr __user
*msg
,
1972 struct msghdr
*msg_sys
, unsigned int flags
,
1973 struct used_address
*used_address
,
1974 unsigned int allowed_msghdr_flags
)
1976 struct compat_msghdr __user
*msg_compat
=
1977 (struct compat_msghdr __user
*)msg
;
1978 struct sockaddr_storage address
;
1979 struct iovec iovstack
[UIO_FASTIOV
], *iov
= iovstack
;
1980 unsigned char ctl
[sizeof(struct cmsghdr
) + 20]
1981 __aligned(sizeof(__kernel_size_t
));
1982 /* 20 is size of ipv6_pktinfo */
1983 unsigned char *ctl_buf
= ctl
;
1987 msg_sys
->msg_name
= &address
;
1989 if (MSG_CMSG_COMPAT
& flags
)
1990 err
= get_compat_msghdr(msg_sys
, msg_compat
, NULL
, &iov
);
1992 err
= copy_msghdr_from_user(msg_sys
, msg
, NULL
, &iov
);
1998 if (msg_sys
->msg_controllen
> INT_MAX
)
2000 flags
|= (msg_sys
->msg_flags
& allowed_msghdr_flags
);
2001 ctl_len
= msg_sys
->msg_controllen
;
2002 if ((MSG_CMSG_COMPAT
& flags
) && ctl_len
) {
2004 cmsghdr_from_user_compat_to_kern(msg_sys
, sock
->sk
, ctl
,
2008 ctl_buf
= msg_sys
->msg_control
;
2009 ctl_len
= msg_sys
->msg_controllen
;
2010 } else if (ctl_len
) {
2011 BUILD_BUG_ON(sizeof(struct cmsghdr
) !=
2012 CMSG_ALIGN(sizeof(struct cmsghdr
)));
2013 if (ctl_len
> sizeof(ctl
)) {
2014 ctl_buf
= sock_kmalloc(sock
->sk
, ctl_len
, GFP_KERNEL
);
2015 if (ctl_buf
== NULL
)
2020 * Careful! Before this, msg_sys->msg_control contains a user pointer.
2021 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2022 * checking falls down on this.
2024 if (copy_from_user(ctl_buf
,
2025 (void __user __force
*)msg_sys
->msg_control
,
2028 msg_sys
->msg_control
= ctl_buf
;
2030 msg_sys
->msg_flags
= flags
;
2032 if (sock
->file
->f_flags
& O_NONBLOCK
)
2033 msg_sys
->msg_flags
|= MSG_DONTWAIT
;
2035 * If this is sendmmsg() and current destination address is same as
2036 * previously succeeded address, omit asking LSM's decision.
2037 * used_address->name_len is initialized to UINT_MAX so that the first
2038 * destination address never matches.
2040 if (used_address
&& msg_sys
->msg_name
&&
2041 used_address
->name_len
== msg_sys
->msg_namelen
&&
2042 !memcmp(&used_address
->name
, msg_sys
->msg_name
,
2043 used_address
->name_len
)) {
2044 err
= sock_sendmsg_nosec(sock
, msg_sys
);
2047 err
= sock_sendmsg(sock
, msg_sys
);
2049 * If this is sendmmsg() and sending to current destination address was
2050 * successful, remember it.
2052 if (used_address
&& err
>= 0) {
2053 used_address
->name_len
= msg_sys
->msg_namelen
;
2054 if (msg_sys
->msg_name
)
2055 memcpy(&used_address
->name
, msg_sys
->msg_name
,
2056 used_address
->name_len
);
2061 sock_kfree_s(sock
->sk
, ctl_buf
, ctl_len
);
2068 * BSD sendmsg interface
2071 long __sys_sendmsg(int fd
, struct user_msghdr __user
*msg
, unsigned flags
)
2073 int fput_needed
, err
;
2074 struct msghdr msg_sys
;
2075 struct socket
*sock
;
2077 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
2081 err
= ___sys_sendmsg(sock
, msg
, &msg_sys
, flags
, NULL
, 0);
2083 fput_light(sock
->file
, fput_needed
);
2088 SYSCALL_DEFINE3(sendmsg
, int, fd
, struct user_msghdr __user
*, msg
, unsigned int, flags
)
2090 if (flags
& MSG_CMSG_COMPAT
)
2092 return __sys_sendmsg(fd
, msg
, flags
);
2096 * Linux sendmmsg interface
2099 int __sys_sendmmsg(int fd
, struct mmsghdr __user
*mmsg
, unsigned int vlen
,
2102 int fput_needed
, err
, datagrams
;
2103 struct socket
*sock
;
2104 struct mmsghdr __user
*entry
;
2105 struct compat_mmsghdr __user
*compat_entry
;
2106 struct msghdr msg_sys
;
2107 struct used_address used_address
;
2108 unsigned int oflags
= flags
;
2110 if (vlen
> UIO_MAXIOV
)
2115 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
2119 used_address
.name_len
= UINT_MAX
;
2121 compat_entry
= (struct compat_mmsghdr __user
*)mmsg
;
2125 while (datagrams
< vlen
) {
2126 if (datagrams
== vlen
- 1)
2129 if (MSG_CMSG_COMPAT
& flags
) {
2130 err
= ___sys_sendmsg(sock
, (struct user_msghdr __user
*)compat_entry
,
2131 &msg_sys
, flags
, &used_address
, MSG_EOR
);
2134 err
= __put_user(err
, &compat_entry
->msg_len
);
2137 err
= ___sys_sendmsg(sock
,
2138 (struct user_msghdr __user
*)entry
,
2139 &msg_sys
, flags
, &used_address
, MSG_EOR
);
2142 err
= put_user(err
, &entry
->msg_len
);
2149 if (msg_data_left(&msg_sys
))
2154 fput_light(sock
->file
, fput_needed
);
2156 /* We only return an error if no datagrams were able to be sent */
2163 SYSCALL_DEFINE4(sendmmsg
, int, fd
, struct mmsghdr __user
*, mmsg
,
2164 unsigned int, vlen
, unsigned int, flags
)
2166 if (flags
& MSG_CMSG_COMPAT
)
2168 return __sys_sendmmsg(fd
, mmsg
, vlen
, flags
);
2171 static int ___sys_recvmsg(struct socket
*sock
, struct user_msghdr __user
*msg
,
2172 struct msghdr
*msg_sys
, unsigned int flags
, int nosec
)
2174 struct compat_msghdr __user
*msg_compat
=
2175 (struct compat_msghdr __user
*)msg
;
2176 struct iovec iovstack
[UIO_FASTIOV
];
2177 struct iovec
*iov
= iovstack
;
2178 unsigned long cmsg_ptr
;
2182 /* kernel mode address */
2183 struct sockaddr_storage addr
;
2185 /* user mode address pointers */
2186 struct sockaddr __user
*uaddr
;
2187 int __user
*uaddr_len
= COMPAT_NAMELEN(msg
);
2189 msg_sys
->msg_name
= &addr
;
2191 if (MSG_CMSG_COMPAT
& flags
)
2192 err
= get_compat_msghdr(msg_sys
, msg_compat
, &uaddr
, &iov
);
2194 err
= copy_msghdr_from_user(msg_sys
, msg
, &uaddr
, &iov
);
2198 cmsg_ptr
= (unsigned long)msg_sys
->msg_control
;
2199 msg_sys
->msg_flags
= flags
& (MSG_CMSG_CLOEXEC
|MSG_CMSG_COMPAT
);
2201 /* We assume all kernel code knows the size of sockaddr_storage */
2202 msg_sys
->msg_namelen
= 0;
2204 if (sock
->file
->f_flags
& O_NONBLOCK
)
2205 flags
|= MSG_DONTWAIT
;
2206 err
= (nosec
? sock_recvmsg_nosec
: sock_recvmsg
)(sock
, msg_sys
, flags
);
2211 if (uaddr
!= NULL
) {
2212 err
= move_addr_to_user(&addr
,
2213 msg_sys
->msg_namelen
, uaddr
,
2218 err
= __put_user((msg_sys
->msg_flags
& ~MSG_CMSG_COMPAT
),
2222 if (MSG_CMSG_COMPAT
& flags
)
2223 err
= __put_user((unsigned long)msg_sys
->msg_control
- cmsg_ptr
,
2224 &msg_compat
->msg_controllen
);
2226 err
= __put_user((unsigned long)msg_sys
->msg_control
- cmsg_ptr
,
2227 &msg
->msg_controllen
);
2238 * BSD recvmsg interface
2241 long __sys_recvmsg(int fd
, struct user_msghdr __user
*msg
, unsigned flags
)
2243 int fput_needed
, err
;
2244 struct msghdr msg_sys
;
2245 struct socket
*sock
;
2247 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
2251 err
= ___sys_recvmsg(sock
, msg
, &msg_sys
, flags
, 0);
2253 fput_light(sock
->file
, fput_needed
);
2258 SYSCALL_DEFINE3(recvmsg
, int, fd
, struct user_msghdr __user
*, msg
,
2259 unsigned int, flags
)
2261 if (flags
& MSG_CMSG_COMPAT
)
2263 return __sys_recvmsg(fd
, msg
, flags
);
2267 * Linux recvmmsg interface
2270 int __sys_recvmmsg(int fd
, struct mmsghdr __user
*mmsg
, unsigned int vlen
,
2271 unsigned int flags
, struct timespec
*timeout
)
2273 int fput_needed
, err
, datagrams
;
2274 struct socket
*sock
;
2275 struct mmsghdr __user
*entry
;
2276 struct compat_mmsghdr __user
*compat_entry
;
2277 struct msghdr msg_sys
;
2278 struct timespec64 end_time
;
2279 struct timespec64 timeout64
;
2282 poll_select_set_timeout(&end_time
, timeout
->tv_sec
,
2288 sock
= sockfd_lookup_light(fd
, &err
, &fput_needed
);
2292 err
= sock_error(sock
->sk
);
2299 compat_entry
= (struct compat_mmsghdr __user
*)mmsg
;
2301 while (datagrams
< vlen
) {
2303 * No need to ask LSM for more than the first datagram.
2305 if (MSG_CMSG_COMPAT
& flags
) {
2306 err
= ___sys_recvmsg(sock
, (struct user_msghdr __user
*)compat_entry
,
2307 &msg_sys
, flags
& ~MSG_WAITFORONE
,
2311 err
= __put_user(err
, &compat_entry
->msg_len
);
2314 err
= ___sys_recvmsg(sock
,
2315 (struct user_msghdr __user
*)entry
,
2316 &msg_sys
, flags
& ~MSG_WAITFORONE
,
2320 err
= put_user(err
, &entry
->msg_len
);
2328 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2329 if (flags
& MSG_WAITFORONE
)
2330 flags
|= MSG_DONTWAIT
;
2333 ktime_get_ts64(&timeout64
);
2334 *timeout
= timespec64_to_timespec(
2335 timespec64_sub(end_time
, timeout64
));
2336 if (timeout
->tv_sec
< 0) {
2337 timeout
->tv_sec
= timeout
->tv_nsec
= 0;
2341 /* Timeout, return less than vlen datagrams */
2342 if (timeout
->tv_nsec
== 0 && timeout
->tv_sec
== 0)
2346 /* Out of band data, return right away */
2347 if (msg_sys
.msg_flags
& MSG_OOB
)
2355 if (datagrams
== 0) {
2361 * We may return less entries than requested (vlen) if the
2362 * sock is non block and there aren't enough datagrams...
2364 if (err
!= -EAGAIN
) {
2366 * ... or if recvmsg returns an error after we
2367 * received some datagrams, where we record the
2368 * error to return on the next call or if the
2369 * app asks about it using getsockopt(SO_ERROR).
2371 sock
->sk
->sk_err
= -err
;
2374 fput_light(sock
->file
, fput_needed
);
2379 SYSCALL_DEFINE5(recvmmsg
, int, fd
, struct mmsghdr __user
*, mmsg
,
2380 unsigned int, vlen
, unsigned int, flags
,
2381 struct timespec __user
*, timeout
)
2384 struct timespec timeout_sys
;
2386 if (flags
& MSG_CMSG_COMPAT
)
2390 return __sys_recvmmsg(fd
, mmsg
, vlen
, flags
, NULL
);
2392 if (copy_from_user(&timeout_sys
, timeout
, sizeof(timeout_sys
)))
2395 datagrams
= __sys_recvmmsg(fd
, mmsg
, vlen
, flags
, &timeout_sys
);
2397 if (datagrams
> 0 &&
2398 copy_to_user(timeout
, &timeout_sys
, sizeof(timeout_sys
)))
2399 datagrams
= -EFAULT
;
2404 #ifdef __ARCH_WANT_SYS_SOCKETCALL
2405 /* Argument list sizes for sys_socketcall */
2406 #define AL(x) ((x) * sizeof(unsigned long))
2407 static const unsigned char nargs
[21] = {
2408 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2409 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2410 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2417 * System call vectors.
2419 * Argument checking cleaned up. Saved 20% in size.
2420 * This function doesn't need to set the kernel lock because
2421 * it is set by the callees.
2424 SYSCALL_DEFINE2(socketcall
, int, call
, unsigned long __user
*, args
)
2426 unsigned long a
[AUDITSC_ARGS
];
2427 unsigned long a0
, a1
;
2431 if (call
< 1 || call
> SYS_SENDMMSG
)
2435 if (len
> sizeof(a
))
2438 /* copy_from_user should be SMP safe. */
2439 if (copy_from_user(a
, args
, len
))
2442 err
= audit_socketcall(nargs
[call
] / sizeof(unsigned long), a
);
2451 err
= sys_socket(a0
, a1
, a
[2]);
2454 err
= sys_bind(a0
, (struct sockaddr __user
*)a1
, a
[2]);
2457 err
= sys_connect(a0
, (struct sockaddr __user
*)a1
, a
[2]);
2460 err
= sys_listen(a0
, a1
);
2463 err
= sys_accept4(a0
, (struct sockaddr __user
*)a1
,
2464 (int __user
*)a
[2], 0);
2466 case SYS_GETSOCKNAME
:
2468 sys_getsockname(a0
, (struct sockaddr __user
*)a1
,
2469 (int __user
*)a
[2]);
2471 case SYS_GETPEERNAME
:
2473 sys_getpeername(a0
, (struct sockaddr __user
*)a1
,
2474 (int __user
*)a
[2]);
2476 case SYS_SOCKETPAIR
:
2477 err
= sys_socketpair(a0
, a1
, a
[2], (int __user
*)a
[3]);
2480 err
= sys_send(a0
, (void __user
*)a1
, a
[2], a
[3]);
2483 err
= sys_sendto(a0
, (void __user
*)a1
, a
[2], a
[3],
2484 (struct sockaddr __user
*)a
[4], a
[5]);
2487 err
= sys_recv(a0
, (void __user
*)a1
, a
[2], a
[3]);
2490 err
= sys_recvfrom(a0
, (void __user
*)a1
, a
[2], a
[3],
2491 (struct sockaddr __user
*)a
[4],
2492 (int __user
*)a
[5]);
2495 err
= sys_shutdown(a0
, a1
);
2497 case SYS_SETSOCKOPT
:
2498 err
= sys_setsockopt(a0
, a1
, a
[2], (char __user
*)a
[3], a
[4]);
2500 case SYS_GETSOCKOPT
:
2502 sys_getsockopt(a0
, a1
, a
[2], (char __user
*)a
[3],
2503 (int __user
*)a
[4]);
2506 err
= sys_sendmsg(a0
, (struct user_msghdr __user
*)a1
, a
[2]);
2509 err
= sys_sendmmsg(a0
, (struct mmsghdr __user
*)a1
, a
[2], a
[3]);
2512 err
= sys_recvmsg(a0
, (struct user_msghdr __user
*)a1
, a
[2]);
2515 err
= sys_recvmmsg(a0
, (struct mmsghdr __user
*)a1
, a
[2], a
[3],
2516 (struct timespec __user
*)a
[4]);
2519 err
= sys_accept4(a0
, (struct sockaddr __user
*)a1
,
2520 (int __user
*)a
[2], a
[3]);
2529 #endif /* __ARCH_WANT_SYS_SOCKETCALL */
2532 * sock_register - add a socket protocol handler
2533 * @ops: description of protocol
2535 * This function is called by a protocol handler that wants to
2536 * advertise its address family, and have it linked into the
2537 * socket interface. The value ops->family corresponds to the
2538 * socket system call protocol family.
2540 int sock_register(const struct net_proto_family
*ops
)
2544 if (ops
->family
>= NPROTO
) {
2545 pr_crit("protocol %d >= NPROTO(%d)\n", ops
->family
, NPROTO
);
2549 spin_lock(&net_family_lock
);
2550 if (rcu_dereference_protected(net_families
[ops
->family
],
2551 lockdep_is_held(&net_family_lock
)))
2554 rcu_assign_pointer(net_families
[ops
->family
], ops
);
2557 spin_unlock(&net_family_lock
);
2559 pr_info("NET: Registered protocol family %d\n", ops
->family
);
2562 EXPORT_SYMBOL(sock_register
);
2565 * sock_unregister - remove a protocol handler
2566 * @family: protocol family to remove
2568 * This function is called by a protocol handler that wants to
2569 * remove its address family, and have it unlinked from the
2570 * new socket creation.
2572 * If protocol handler is a module, then it can use module reference
2573 * counts to protect against new references. If protocol handler is not
2574 * a module then it needs to provide its own protection in
2575 * the ops->create routine.
2577 void sock_unregister(int family
)
2579 BUG_ON(family
< 0 || family
>= NPROTO
);
2581 spin_lock(&net_family_lock
);
2582 RCU_INIT_POINTER(net_families
[family
], NULL
);
2583 spin_unlock(&net_family_lock
);
2587 pr_info("NET: Unregistered protocol family %d\n", family
);
2589 EXPORT_SYMBOL(sock_unregister
);
2591 static int __init
sock_init(void)
2595 * Initialize the network sysctl infrastructure.
2597 err
= net_sysctl_init();
2602 * Initialize skbuff SLAB cache
2607 * Initialize the protocols module.
2612 err
= register_filesystem(&sock_fs_type
);
2615 sock_mnt
= kern_mount(&sock_fs_type
);
2616 if (IS_ERR(sock_mnt
)) {
2617 err
= PTR_ERR(sock_mnt
);
2621 /* The real protocol initialization is performed in later initcalls.
2624 #ifdef CONFIG_NETFILTER
2625 err
= netfilter_init();
2630 ptp_classifier_init();
2636 unregister_filesystem(&sock_fs_type
);
2641 core_initcall(sock_init
); /* early initcall */
2643 #ifdef CONFIG_PROC_FS
2644 void socket_seq_show(struct seq_file
*seq
)
2646 seq_printf(seq
, "sockets: used %d\n",
2647 sock_inuse_get(seq
->private));
2649 #endif /* CONFIG_PROC_FS */
2651 #ifdef CONFIG_COMPAT
2652 static int do_siocgstamp(struct net
*net
, struct socket
*sock
,
2653 unsigned int cmd
, void __user
*up
)
2655 mm_segment_t old_fs
= get_fs();
2660 err
= sock_do_ioctl(net
, sock
, cmd
, (unsigned long)&ktv
);
2663 err
= compat_put_timeval(&ktv
, up
);
2668 static int do_siocgstampns(struct net
*net
, struct socket
*sock
,
2669 unsigned int cmd
, void __user
*up
)
2671 mm_segment_t old_fs
= get_fs();
2672 struct timespec kts
;
2676 err
= sock_do_ioctl(net
, sock
, cmd
, (unsigned long)&kts
);
2679 err
= compat_put_timespec(&kts
, up
);
2684 static int compat_dev_ifconf(struct net
*net
, struct compat_ifconf __user
*uifc32
)
2686 struct compat_ifconf ifc32
;
2690 if (copy_from_user(&ifc32
, uifc32
, sizeof(struct compat_ifconf
)))
2693 ifc
.ifc_len
= ifc32
.ifc_len
;
2694 ifc
.ifc_req
= compat_ptr(ifc32
.ifcbuf
);
2697 err
= dev_ifconf(net
, &ifc
, sizeof(struct compat_ifreq
));
2702 ifc32
.ifc_len
= ifc
.ifc_len
;
2703 if (copy_to_user(uifc32
, &ifc32
, sizeof(struct compat_ifconf
)))
2709 static int ethtool_ioctl(struct net
*net
, struct compat_ifreq __user
*ifr32
)
2711 struct compat_ethtool_rxnfc __user
*compat_rxnfc
;
2712 bool convert_in
= false, convert_out
= false;
2713 size_t buf_size
= 0;
2714 struct ethtool_rxnfc __user
*rxnfc
= NULL
;
2716 u32 rule_cnt
= 0, actual_rule_cnt
;
2721 if (get_user(data
, &ifr32
->ifr_ifru
.ifru_data
))
2724 compat_rxnfc
= compat_ptr(data
);
2726 if (get_user(ethcmd
, &compat_rxnfc
->cmd
))
2729 /* Most ethtool structures are defined without padding.
2730 * Unfortunately struct ethtool_rxnfc is an exception.
2735 case ETHTOOL_GRXCLSRLALL
:
2736 /* Buffer size is variable */
2737 if (get_user(rule_cnt
, &compat_rxnfc
->rule_cnt
))
2739 if (rule_cnt
> KMALLOC_MAX_SIZE
/ sizeof(u32
))
2741 buf_size
+= rule_cnt
* sizeof(u32
);
2743 case ETHTOOL_GRXRINGS
:
2744 case ETHTOOL_GRXCLSRLCNT
:
2745 case ETHTOOL_GRXCLSRULE
:
2746 case ETHTOOL_SRXCLSRLINS
:
2749 case ETHTOOL_SRXCLSRLDEL
:
2750 buf_size
+= sizeof(struct ethtool_rxnfc
);
2752 rxnfc
= compat_alloc_user_space(buf_size
);
2756 if (copy_from_user(&ifr
.ifr_name
, &ifr32
->ifr_name
, IFNAMSIZ
))
2759 ifr
.ifr_data
= convert_in
? rxnfc
: (void __user
*)compat_rxnfc
;
2762 /* We expect there to be holes between fs.m_ext and
2763 * fs.ring_cookie and at the end of fs, but nowhere else.
2765 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc
, fs
.m_ext
) +
2766 sizeof(compat_rxnfc
->fs
.m_ext
) !=
2767 offsetof(struct ethtool_rxnfc
, fs
.m_ext
) +
2768 sizeof(rxnfc
->fs
.m_ext
));
2770 offsetof(struct compat_ethtool_rxnfc
, fs
.location
) -
2771 offsetof(struct compat_ethtool_rxnfc
, fs
.ring_cookie
) !=
2772 offsetof(struct ethtool_rxnfc
, fs
.location
) -
2773 offsetof(struct ethtool_rxnfc
, fs
.ring_cookie
));
2775 if (copy_in_user(rxnfc
, compat_rxnfc
,
2776 (void __user
*)(&rxnfc
->fs
.m_ext
+ 1) -
2777 (void __user
*)rxnfc
) ||
2778 copy_in_user(&rxnfc
->fs
.ring_cookie
,
2779 &compat_rxnfc
->fs
.ring_cookie
,
2780 (void __user
*)(&rxnfc
->fs
.location
+ 1) -
2781 (void __user
*)&rxnfc
->fs
.ring_cookie
) ||
2782 copy_in_user(&rxnfc
->rule_cnt
, &compat_rxnfc
->rule_cnt
,
2783 sizeof(rxnfc
->rule_cnt
)))
2787 ret
= dev_ioctl(net
, SIOCETHTOOL
, &ifr
, NULL
);
2792 if (copy_in_user(compat_rxnfc
, rxnfc
,
2793 (const void __user
*)(&rxnfc
->fs
.m_ext
+ 1) -
2794 (const void __user
*)rxnfc
) ||
2795 copy_in_user(&compat_rxnfc
->fs
.ring_cookie
,
2796 &rxnfc
->fs
.ring_cookie
,
2797 (const void __user
*)(&rxnfc
->fs
.location
+ 1) -
2798 (const void __user
*)&rxnfc
->fs
.ring_cookie
) ||
2799 copy_in_user(&compat_rxnfc
->rule_cnt
, &rxnfc
->rule_cnt
,
2800 sizeof(rxnfc
->rule_cnt
)))
2803 if (ethcmd
== ETHTOOL_GRXCLSRLALL
) {
2804 /* As an optimisation, we only copy the actual
2805 * number of rules that the underlying
2806 * function returned. Since Mallory might
2807 * change the rule count in user memory, we
2808 * check that it is less than the rule count
2809 * originally given (as the user buffer size),
2810 * which has been range-checked.
2812 if (get_user(actual_rule_cnt
, &rxnfc
->rule_cnt
))
2814 if (actual_rule_cnt
< rule_cnt
)
2815 rule_cnt
= actual_rule_cnt
;
2816 if (copy_in_user(&compat_rxnfc
->rule_locs
[0],
2817 &rxnfc
->rule_locs
[0],
2818 rule_cnt
* sizeof(u32
)))
2826 static int compat_siocwandev(struct net
*net
, struct compat_ifreq __user
*uifr32
)
2828 compat_uptr_t uptr32
;
2833 if (copy_from_user(&ifr
, uifr32
, sizeof(struct compat_ifreq
)))
2836 if (get_user(uptr32
, &uifr32
->ifr_settings
.ifs_ifsu
))
2839 saved
= ifr
.ifr_settings
.ifs_ifsu
.raw_hdlc
;
2840 ifr
.ifr_settings
.ifs_ifsu
.raw_hdlc
= compat_ptr(uptr32
);
2842 err
= dev_ioctl(net
, SIOCWANDEV
, &ifr
, NULL
);
2844 ifr
.ifr_settings
.ifs_ifsu
.raw_hdlc
= saved
;
2845 if (copy_to_user(uifr32
, &ifr
, sizeof(struct compat_ifreq
)))
2851 /* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2852 static int compat_ifr_data_ioctl(struct net
*net
, unsigned int cmd
,
2853 struct compat_ifreq __user
*u_ifreq32
)
2858 if (copy_from_user(ifreq
.ifr_name
, u_ifreq32
->ifr_name
, IFNAMSIZ
))
2860 if (get_user(data32
, &u_ifreq32
->ifr_data
))
2862 ifreq
.ifr_data
= compat_ptr(data32
);
2864 return dev_ioctl(net
, cmd
, &ifreq
, NULL
);
2867 static int compat_sioc_ifmap(struct net
*net
, unsigned int cmd
,
2868 struct compat_ifreq __user
*uifr32
)
2871 struct compat_ifmap __user
*uifmap32
;
2874 uifmap32
= &uifr32
->ifr_ifru
.ifru_map
;
2875 err
= copy_from_user(&ifr
, uifr32
, sizeof(ifr
.ifr_name
));
2876 err
|= get_user(ifr
.ifr_map
.mem_start
, &uifmap32
->mem_start
);
2877 err
|= get_user(ifr
.ifr_map
.mem_end
, &uifmap32
->mem_end
);
2878 err
|= get_user(ifr
.ifr_map
.base_addr
, &uifmap32
->base_addr
);
2879 err
|= get_user(ifr
.ifr_map
.irq
, &uifmap32
->irq
);
2880 err
|= get_user(ifr
.ifr_map
.dma
, &uifmap32
->dma
);
2881 err
|= get_user(ifr
.ifr_map
.port
, &uifmap32
->port
);
2885 err
= dev_ioctl(net
, cmd
, &ifr
, NULL
);
2887 if (cmd
== SIOCGIFMAP
&& !err
) {
2888 err
= copy_to_user(uifr32
, &ifr
, sizeof(ifr
.ifr_name
));
2889 err
|= put_user(ifr
.ifr_map
.mem_start
, &uifmap32
->mem_start
);
2890 err
|= put_user(ifr
.ifr_map
.mem_end
, &uifmap32
->mem_end
);
2891 err
|= put_user(ifr
.ifr_map
.base_addr
, &uifmap32
->base_addr
);
2892 err
|= put_user(ifr
.ifr_map
.irq
, &uifmap32
->irq
);
2893 err
|= put_user(ifr
.ifr_map
.dma
, &uifmap32
->dma
);
2894 err
|= put_user(ifr
.ifr_map
.port
, &uifmap32
->port
);
2903 struct sockaddr rt_dst
; /* target address */
2904 struct sockaddr rt_gateway
; /* gateway addr (RTF_GATEWAY) */
2905 struct sockaddr rt_genmask
; /* target network mask (IP) */
2906 unsigned short rt_flags
;
2909 unsigned char rt_tos
;
2910 unsigned char rt_class
;
2912 short rt_metric
; /* +1 for binary compatibility! */
2913 /* char * */ u32 rt_dev
; /* forcing the device at add */
2914 u32 rt_mtu
; /* per route MTU/Window */
2915 u32 rt_window
; /* Window clamping */
2916 unsigned short rt_irtt
; /* Initial RTT */
2919 struct in6_rtmsg32
{
2920 struct in6_addr rtmsg_dst
;
2921 struct in6_addr rtmsg_src
;
2922 struct in6_addr rtmsg_gateway
;
2932 static int routing_ioctl(struct net
*net
, struct socket
*sock
,
2933 unsigned int cmd
, void __user
*argp
)
2937 struct in6_rtmsg r6
;
2941 mm_segment_t old_fs
= get_fs();
2943 if (sock
&& sock
->sk
&& sock
->sk
->sk_family
== AF_INET6
) { /* ipv6 */
2944 struct in6_rtmsg32 __user
*ur6
= argp
;
2945 ret
= copy_from_user(&r6
.rtmsg_dst
, &(ur6
->rtmsg_dst
),
2946 3 * sizeof(struct in6_addr
));
2947 ret
|= get_user(r6
.rtmsg_type
, &(ur6
->rtmsg_type
));
2948 ret
|= get_user(r6
.rtmsg_dst_len
, &(ur6
->rtmsg_dst_len
));
2949 ret
|= get_user(r6
.rtmsg_src_len
, &(ur6
->rtmsg_src_len
));
2950 ret
|= get_user(r6
.rtmsg_metric
, &(ur6
->rtmsg_metric
));
2951 ret
|= get_user(r6
.rtmsg_info
, &(ur6
->rtmsg_info
));
2952 ret
|= get_user(r6
.rtmsg_flags
, &(ur6
->rtmsg_flags
));
2953 ret
|= get_user(r6
.rtmsg_ifindex
, &(ur6
->rtmsg_ifindex
));
2957 struct rtentry32 __user
*ur4
= argp
;
2958 ret
= copy_from_user(&r4
.rt_dst
, &(ur4
->rt_dst
),
2959 3 * sizeof(struct sockaddr
));
2960 ret
|= get_user(r4
.rt_flags
, &(ur4
->rt_flags
));
2961 ret
|= get_user(r4
.rt_metric
, &(ur4
->rt_metric
));
2962 ret
|= get_user(r4
.rt_mtu
, &(ur4
->rt_mtu
));
2963 ret
|= get_user(r4
.rt_window
, &(ur4
->rt_window
));
2964 ret
|= get_user(r4
.rt_irtt
, &(ur4
->rt_irtt
));
2965 ret
|= get_user(rtdev
, &(ur4
->rt_dev
));
2967 ret
|= copy_from_user(devname
, compat_ptr(rtdev
), 15);
2968 r4
.rt_dev
= (char __user __force
*)devname
;
2982 ret
= sock_do_ioctl(net
, sock
, cmd
, (unsigned long) r
);
2989 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
2990 * for some operations; this forces use of the newer bridge-utils that
2991 * use compatible ioctls
2993 static int old_bridge_ioctl(compat_ulong_t __user
*argp
)
2997 if (get_user(tmp
, argp
))
2999 if (tmp
== BRCTL_GET_VERSION
)
3000 return BRCTL_VERSION
+ 1;
3004 static int compat_sock_ioctl_trans(struct file
*file
, struct socket
*sock
,
3005 unsigned int cmd
, unsigned long arg
)
3007 void __user
*argp
= compat_ptr(arg
);
3008 struct sock
*sk
= sock
->sk
;
3009 struct net
*net
= sock_net(sk
);
3011 if (cmd
>= SIOCDEVPRIVATE
&& cmd
<= (SIOCDEVPRIVATE
+ 15))
3012 return compat_ifr_data_ioctl(net
, cmd
, argp
);
3017 return old_bridge_ioctl(argp
);
3019 return compat_dev_ifconf(net
, argp
);
3021 return ethtool_ioctl(net
, argp
);
3023 return compat_siocwandev(net
, argp
);
3026 return compat_sioc_ifmap(net
, cmd
, argp
);
3029 return routing_ioctl(net
, sock
, cmd
, argp
);
3031 return do_siocgstamp(net
, sock
, cmd
, argp
);
3033 return do_siocgstampns(net
, sock
, cmd
, argp
);
3034 case SIOCBONDSLAVEINFOQUERY
:
3035 case SIOCBONDINFOQUERY
:
3038 return compat_ifr_data_ioctl(net
, cmd
, argp
);
3051 return sock_ioctl(file
, cmd
, arg
);
3068 case SIOCSIFHWBROADCAST
:
3070 case SIOCGIFBRDADDR
:
3071 case SIOCSIFBRDADDR
:
3072 case SIOCGIFDSTADDR
:
3073 case SIOCSIFDSTADDR
:
3074 case SIOCGIFNETMASK
:
3075 case SIOCSIFNETMASK
:
3090 case SIOCBONDENSLAVE
:
3091 case SIOCBONDRELEASE
:
3092 case SIOCBONDSETHWADDR
:
3093 case SIOCBONDCHANGEACTIVE
:
3095 return sock_do_ioctl(net
, sock
, cmd
, arg
);
3098 return -ENOIOCTLCMD
;
3101 static long compat_sock_ioctl(struct file
*file
, unsigned int cmd
,
3104 struct socket
*sock
= file
->private_data
;
3105 int ret
= -ENOIOCTLCMD
;
3112 if (sock
->ops
->compat_ioctl
)
3113 ret
= sock
->ops
->compat_ioctl(sock
, cmd
, arg
);
3115 if (ret
== -ENOIOCTLCMD
&&
3116 (cmd
>= SIOCIWFIRST
&& cmd
<= SIOCIWLAST
))
3117 ret
= compat_wext_handle_ioctl(net
, cmd
, arg
);
3119 if (ret
== -ENOIOCTLCMD
)
3120 ret
= compat_sock_ioctl_trans(file
, sock
, cmd
, arg
);
3126 int kernel_bind(struct socket
*sock
, struct sockaddr
*addr
, int addrlen
)
3128 return sock
->ops
->bind(sock
, addr
, addrlen
);
3130 EXPORT_SYMBOL(kernel_bind
);
3132 int kernel_listen(struct socket
*sock
, int backlog
)
3134 return sock
->ops
->listen(sock
, backlog
);
3136 EXPORT_SYMBOL(kernel_listen
);
3138 int kernel_accept(struct socket
*sock
, struct socket
**newsock
, int flags
)
3140 struct sock
*sk
= sock
->sk
;
3143 err
= sock_create_lite(sk
->sk_family
, sk
->sk_type
, sk
->sk_protocol
,
3148 err
= sock
->ops
->accept(sock
, *newsock
, flags
, true);
3150 sock_release(*newsock
);
3155 (*newsock
)->ops
= sock
->ops
;
3156 __module_get((*newsock
)->ops
->owner
);
3161 EXPORT_SYMBOL(kernel_accept
);
3163 int kernel_connect(struct socket
*sock
, struct sockaddr
*addr
, int addrlen
,
3166 return sock
->ops
->connect(sock
, addr
, addrlen
, flags
);
3168 EXPORT_SYMBOL(kernel_connect
);
3170 int kernel_getsockname(struct socket
*sock
, struct sockaddr
*addr
)
3172 return sock
->ops
->getname(sock
, addr
, 0);
3174 EXPORT_SYMBOL(kernel_getsockname
);
3176 int kernel_getpeername(struct socket
*sock
, struct sockaddr
*addr
)
3178 return sock
->ops
->getname(sock
, addr
, 1);
3180 EXPORT_SYMBOL(kernel_getpeername
);
3182 int kernel_getsockopt(struct socket
*sock
, int level
, int optname
,
3183 char *optval
, int *optlen
)
3185 mm_segment_t oldfs
= get_fs();
3186 char __user
*uoptval
;
3187 int __user
*uoptlen
;
3190 uoptval
= (char __user __force
*) optval
;
3191 uoptlen
= (int __user __force
*) optlen
;
3194 if (level
== SOL_SOCKET
)
3195 err
= sock_getsockopt(sock
, level
, optname
, uoptval
, uoptlen
);
3197 err
= sock
->ops
->getsockopt(sock
, level
, optname
, uoptval
,
3202 EXPORT_SYMBOL(kernel_getsockopt
);
3204 int kernel_setsockopt(struct socket
*sock
, int level
, int optname
,
3205 char *optval
, unsigned int optlen
)
3207 mm_segment_t oldfs
= get_fs();
3208 char __user
*uoptval
;
3211 uoptval
= (char __user __force
*) optval
;
3214 if (level
== SOL_SOCKET
)
3215 err
= sock_setsockopt(sock
, level
, optname
, uoptval
, optlen
);
3217 err
= sock
->ops
->setsockopt(sock
, level
, optname
, uoptval
,
3222 EXPORT_SYMBOL(kernel_setsockopt
);
3224 int kernel_sendpage(struct socket
*sock
, struct page
*page
, int offset
,
3225 size_t size
, int flags
)
3227 if (sock
->ops
->sendpage
)
3228 return sock
->ops
->sendpage(sock
, page
, offset
, size
, flags
);
3230 return sock_no_sendpage(sock
, page
, offset
, size
, flags
);
3232 EXPORT_SYMBOL(kernel_sendpage
);
3234 int kernel_sendpage_locked(struct sock
*sk
, struct page
*page
, int offset
,
3235 size_t size
, int flags
)
3237 struct socket
*sock
= sk
->sk_socket
;
3239 if (sock
->ops
->sendpage_locked
)
3240 return sock
->ops
->sendpage_locked(sk
, page
, offset
, size
,
3243 return sock_no_sendpage_locked(sk
, page
, offset
, size
, flags
);
3245 EXPORT_SYMBOL(kernel_sendpage_locked
);
3247 int kernel_sock_shutdown(struct socket
*sock
, enum sock_shutdown_cmd how
)
3249 return sock
->ops
->shutdown(sock
, how
);
3251 EXPORT_SYMBOL(kernel_sock_shutdown
);
3253 /* This routine returns the IP overhead imposed by a socket i.e.
3254 * the length of the underlying IP header, depending on whether
3255 * this is an IPv4 or IPv6 socket and the length from IP options turned
3256 * on at the socket. Assumes that the caller has a lock on the socket.
3258 u32
kernel_sock_ip_overhead(struct sock
*sk
)
3260 struct inet_sock
*inet
;
3261 struct ip_options_rcu
*opt
;
3263 #if IS_ENABLED(CONFIG_IPV6)
3264 struct ipv6_pinfo
*np
;
3265 struct ipv6_txoptions
*optv6
= NULL
;
3266 #endif /* IS_ENABLED(CONFIG_IPV6) */
3271 switch (sk
->sk_family
) {
3274 overhead
+= sizeof(struct iphdr
);
3275 opt
= rcu_dereference_protected(inet
->inet_opt
,
3276 sock_owned_by_user(sk
));
3278 overhead
+= opt
->opt
.optlen
;
3280 #if IS_ENABLED(CONFIG_IPV6)
3283 overhead
+= sizeof(struct ipv6hdr
);
3285 optv6
= rcu_dereference_protected(np
->opt
,
3286 sock_owned_by_user(sk
));
3288 overhead
+= (optv6
->opt_flen
+ optv6
->opt_nflen
);
3290 #endif /* IS_ENABLED(CONFIG_IPV6) */
3291 default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
3295 EXPORT_SYMBOL(kernel_sock_ip_overhead
);