{compat_,}verify_iovec(): switch to generic copying of iovecs
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
408eccce 75#include <linux/ptp_classify.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
600e1779 91#include <linux/xattr.h>
1da177e4
LT
92
93#include <asm/uaccess.h>
94#include <asm/unistd.h>
95
96#include <net/compat.h>
87de87d5 97#include <net/wext.h>
f8451725 98#include <net/cls_cgroup.h>
1da177e4
LT
99
100#include <net/sock.h>
101#include <linux/netfilter.h>
102
6b96018b
AB
103#include <linux/if_tun.h>
104#include <linux/ipv6_route.h>
105#include <linux/route.h>
6b96018b
AB
106#include <linux/sockios.h>
107#include <linux/atalk.h>
076bb0c8 108#include <net/busy_poll.h>
f24b9be5 109#include <linux/errqueue.h>
06021292 110
e0d1095a 111#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
112unsigned int sysctl_net_busy_read __read_mostly;
113unsigned int sysctl_net_busy_poll __read_mostly;
06021292 114#endif
6b96018b 115
1da177e4 116static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
117static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
118 unsigned long nr_segs, loff_t pos);
119static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
120 unsigned long nr_segs, loff_t pos);
89bddce5 121static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
122
123static int sock_close(struct inode *inode, struct file *file);
124static unsigned int sock_poll(struct file *file,
125 struct poll_table_struct *wait);
89bddce5 126static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
127#ifdef CONFIG_COMPAT
128static long compat_sock_ioctl(struct file *file,
89bddce5 129 unsigned int cmd, unsigned long arg);
89bbfc95 130#endif
1da177e4 131static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
132static ssize_t sock_sendpage(struct file *file, struct page *page,
133 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 134static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 135 struct pipe_inode_info *pipe, size_t len,
9c55e01c 136 unsigned int flags);
1da177e4 137
1da177e4
LT
138/*
139 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
140 * in the operation structures but are done directly via the socketcall() multiplexor.
141 */
142
da7071d7 143static const struct file_operations socket_file_ops = {
1da177e4
LT
144 .owner = THIS_MODULE,
145 .llseek = no_llseek,
146 .aio_read = sock_aio_read,
147 .aio_write = sock_aio_write,
148 .poll = sock_poll,
149 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
150#ifdef CONFIG_COMPAT
151 .compat_ioctl = compat_sock_ioctl,
152#endif
1da177e4
LT
153 .mmap = sock_mmap,
154 .open = sock_no_open, /* special open code to disallow open via /proc */
155 .release = sock_close,
156 .fasync = sock_fasync,
5274f052
JA
157 .sendpage = sock_sendpage,
158 .splice_write = generic_splice_sendpage,
9c55e01c 159 .splice_read = sock_splice_read,
1da177e4
LT
160};
161
162/*
163 * The protocol list. Each protocol is registered in here.
164 */
165
1da177e4 166static DEFINE_SPINLOCK(net_family_lock);
190683a9 167static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 168
1da177e4
LT
169/*
170 * Statistics counters of the socket lists
171 */
172
c6d409cf 173static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
174
175/*
89bddce5
SH
176 * Support routines.
177 * Move socket addresses back and forth across the kernel/user
178 * divide and look after the messy bits.
1da177e4
LT
179 */
180
1da177e4
LT
181/**
182 * move_addr_to_kernel - copy a socket address into kernel space
183 * @uaddr: Address in user space
184 * @kaddr: Address in kernel space
185 * @ulen: Length in user space
186 *
187 * The address is copied into kernel space. If the provided address is
188 * too long an error code of -EINVAL is returned. If the copy gives
189 * invalid addresses -EFAULT is returned. On a success 0 is returned.
190 */
191
43db362d 192int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 193{
230b1839 194 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 195 return -EINVAL;
89bddce5 196 if (ulen == 0)
1da177e4 197 return 0;
89bddce5 198 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 199 return -EFAULT;
3ec3b2fb 200 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
201}
202
203/**
204 * move_addr_to_user - copy an address to user space
205 * @kaddr: kernel space address
206 * @klen: length of address in kernel
207 * @uaddr: user space address
208 * @ulen: pointer to user length field
209 *
210 * The value pointed to by ulen on entry is the buffer length available.
211 * This is overwritten with the buffer space used. -EINVAL is returned
212 * if an overlong buffer is specified or a negative buffer size. -EFAULT
213 * is returned if either the buffer or the length field are not
214 * accessible.
215 * After copying the data up to the limit the user specifies, the true
216 * length of the data is written over the length limit the user
217 * specified. Zero is returned for a success.
218 */
89bddce5 219
43db362d 220static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 221 void __user *uaddr, int __user *ulen)
1da177e4
LT
222{
223 int err;
224 int len;
225
68c6beb3 226 BUG_ON(klen > sizeof(struct sockaddr_storage));
89bddce5
SH
227 err = get_user(len, ulen);
228 if (err)
1da177e4 229 return err;
89bddce5
SH
230 if (len > klen)
231 len = klen;
68c6beb3 232 if (len < 0)
1da177e4 233 return -EINVAL;
89bddce5 234 if (len) {
d6fe3945
SG
235 if (audit_sockaddr(klen, kaddr))
236 return -ENOMEM;
89bddce5 237 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
238 return -EFAULT;
239 }
240 /*
89bddce5
SH
241 * "fromlen shall refer to the value before truncation.."
242 * 1003.1g
1da177e4
LT
243 */
244 return __put_user(klen, ulen);
245}
246
e18b890b 247static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
248
249static struct inode *sock_alloc_inode(struct super_block *sb)
250{
251 struct socket_alloc *ei;
eaefd110 252 struct socket_wq *wq;
89bddce5 253
e94b1766 254 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
255 if (!ei)
256 return NULL;
eaefd110
ED
257 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
258 if (!wq) {
43815482
ED
259 kmem_cache_free(sock_inode_cachep, ei);
260 return NULL;
261 }
eaefd110
ED
262 init_waitqueue_head(&wq->wait);
263 wq->fasync_list = NULL;
264 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 265
1da177e4
LT
266 ei->socket.state = SS_UNCONNECTED;
267 ei->socket.flags = 0;
268 ei->socket.ops = NULL;
269 ei->socket.sk = NULL;
270 ei->socket.file = NULL;
1da177e4
LT
271
272 return &ei->vfs_inode;
273}
274
275static void sock_destroy_inode(struct inode *inode)
276{
43815482 277 struct socket_alloc *ei;
eaefd110 278 struct socket_wq *wq;
43815482
ED
279
280 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 281 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 282 kfree_rcu(wq, rcu);
43815482 283 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
284}
285
51cc5068 286static void init_once(void *foo)
1da177e4 287{
89bddce5 288 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 289
a35afb83 290 inode_init_once(&ei->vfs_inode);
1da177e4 291}
89bddce5 292
1da177e4
LT
293static int init_inodecache(void)
294{
295 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
296 sizeof(struct socket_alloc),
297 0,
298 (SLAB_HWCACHE_ALIGN |
299 SLAB_RECLAIM_ACCOUNT |
300 SLAB_MEM_SPREAD),
20c2df83 301 init_once);
1da177e4
LT
302 if (sock_inode_cachep == NULL)
303 return -ENOMEM;
304 return 0;
305}
306
b87221de 307static const struct super_operations sockfs_ops = {
c6d409cf
ED
308 .alloc_inode = sock_alloc_inode,
309 .destroy_inode = sock_destroy_inode,
310 .statfs = simple_statfs,
1da177e4
LT
311};
312
c23fbb6b
ED
313/*
314 * sockfs_dname() is called from d_path().
315 */
316static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
317{
318 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
319 dentry->d_inode->i_ino);
320}
321
3ba13d17 322static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 323 .d_dname = sockfs_dname,
1da177e4
LT
324};
325
c74a1cbb
AV
326static struct dentry *sockfs_mount(struct file_system_type *fs_type,
327 int flags, const char *dev_name, void *data)
328{
329 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
330 &sockfs_dentry_operations, SOCKFS_MAGIC);
331}
332
333static struct vfsmount *sock_mnt __read_mostly;
334
335static struct file_system_type sock_fs_type = {
336 .name = "sockfs",
337 .mount = sockfs_mount,
338 .kill_sb = kill_anon_super,
339};
340
1da177e4
LT
341/*
342 * Obtains the first available file descriptor and sets it up for use.
343 *
39d8c1b6
DM
344 * These functions create file structures and maps them to fd space
345 * of the current process. On success it returns file descriptor
1da177e4
LT
346 * and file struct implicitly stored in sock->file.
347 * Note that another thread may close file descriptor before we return
348 * from this function. We use the fact that now we do not refer
349 * to socket after mapping. If one day we will need it, this
350 * function will increment ref. count on file by 1.
351 *
352 * In any case returned fd MAY BE not valid!
353 * This race condition is unavoidable
354 * with shared fd spaces, we cannot solve it inside kernel,
355 * but we take care of internal coherence yet.
356 */
357
aab174f0 358struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 359{
7cbe66b6 360 struct qstr name = { .name = "" };
2c48b9c4 361 struct path path;
7cbe66b6 362 struct file *file;
1da177e4 363
600e1779
MY
364 if (dname) {
365 name.name = dname;
366 name.len = strlen(name.name);
367 } else if (sock->sk) {
368 name.name = sock->sk->sk_prot_creator->name;
369 name.len = strlen(name.name);
370 }
4b936885 371 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
372 if (unlikely(!path.dentry))
373 return ERR_PTR(-ENOMEM);
2c48b9c4 374 path.mnt = mntget(sock_mnt);
39d8c1b6 375
2c48b9c4 376 d_instantiate(path.dentry, SOCK_INODE(sock));
cc3808f8 377 SOCK_INODE(sock)->i_fop = &socket_file_ops;
39d8c1b6 378
2c48b9c4 379 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 380 &socket_file_ops);
39b65252 381 if (unlikely(IS_ERR(file))) {
cc3808f8 382 /* drop dentry, keep inode */
7de9c6ee 383 ihold(path.dentry->d_inode);
2c48b9c4 384 path_put(&path);
39b65252 385 return file;
cc3808f8
AV
386 }
387
388 sock->file = file;
77d27200 389 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 390 file->private_data = sock;
28407630 391 return file;
39d8c1b6 392}
56b31d1c 393EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 394
56b31d1c 395static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
396{
397 struct file *newfile;
28407630
AV
398 int fd = get_unused_fd_flags(flags);
399 if (unlikely(fd < 0))
400 return fd;
39d8c1b6 401
aab174f0 402 newfile = sock_alloc_file(sock, flags, NULL);
28407630 403 if (likely(!IS_ERR(newfile))) {
39d8c1b6 404 fd_install(fd, newfile);
28407630
AV
405 return fd;
406 }
7cbe66b6 407
28407630
AV
408 put_unused_fd(fd);
409 return PTR_ERR(newfile);
1da177e4
LT
410}
411
406a3c63 412struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 413{
6cb153ca
BL
414 if (file->f_op == &socket_file_ops)
415 return file->private_data; /* set in sock_map_fd */
416
23bb80d2
ED
417 *err = -ENOTSOCK;
418 return NULL;
6cb153ca 419}
406a3c63 420EXPORT_SYMBOL(sock_from_file);
6cb153ca 421
1da177e4 422/**
c6d409cf 423 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
424 * @fd: file handle
425 * @err: pointer to an error code return
426 *
427 * The file handle passed in is locked and the socket it is bound
428 * too is returned. If an error occurs the err pointer is overwritten
429 * with a negative errno code and NULL is returned. The function checks
430 * for both invalid handles and passing a handle which is not a socket.
431 *
432 * On a success the socket object pointer is returned.
433 */
434
435struct socket *sockfd_lookup(int fd, int *err)
436{
437 struct file *file;
1da177e4
LT
438 struct socket *sock;
439
89bddce5
SH
440 file = fget(fd);
441 if (!file) {
1da177e4
LT
442 *err = -EBADF;
443 return NULL;
444 }
89bddce5 445
6cb153ca
BL
446 sock = sock_from_file(file, err);
447 if (!sock)
1da177e4 448 fput(file);
6cb153ca
BL
449 return sock;
450}
c6d409cf 451EXPORT_SYMBOL(sockfd_lookup);
1da177e4 452
6cb153ca
BL
453static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
454{
00e188ef 455 struct fd f = fdget(fd);
6cb153ca
BL
456 struct socket *sock;
457
3672558c 458 *err = -EBADF;
00e188ef
AV
459 if (f.file) {
460 sock = sock_from_file(f.file, err);
461 if (likely(sock)) {
462 *fput_needed = f.flags;
6cb153ca 463 return sock;
00e188ef
AV
464 }
465 fdput(f);
1da177e4 466 }
6cb153ca 467 return NULL;
1da177e4
LT
468}
469
600e1779
MY
470#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
471#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
472#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
473static ssize_t sockfs_getxattr(struct dentry *dentry,
474 const char *name, void *value, size_t size)
475{
476 const char *proto_name;
477 size_t proto_size;
478 int error;
479
480 error = -ENODATA;
481 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
482 proto_name = dentry->d_name.name;
483 proto_size = strlen(proto_name);
484
485 if (value) {
486 error = -ERANGE;
487 if (proto_size + 1 > size)
488 goto out;
489
490 strncpy(value, proto_name, proto_size + 1);
491 }
492 error = proto_size + 1;
493 }
494
495out:
496 return error;
497}
498
499static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
500 size_t size)
501{
502 ssize_t len;
503 ssize_t used = 0;
504
505 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
506 if (len < 0)
507 return len;
508 used += len;
509 if (buffer) {
510 if (size < used)
511 return -ERANGE;
512 buffer += len;
513 }
514
515 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
516 used += len;
517 if (buffer) {
518 if (size < used)
519 return -ERANGE;
520 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
521 buffer += len;
522 }
523
524 return used;
525}
526
527static const struct inode_operations sockfs_inode_ops = {
528 .getxattr = sockfs_getxattr,
529 .listxattr = sockfs_listxattr,
530};
531
1da177e4
LT
532/**
533 * sock_alloc - allocate a socket
89bddce5 534 *
1da177e4
LT
535 * Allocate a new inode and socket object. The two are bound together
536 * and initialised. The socket is then returned. If we are out of inodes
537 * NULL is returned.
538 */
539
540static struct socket *sock_alloc(void)
541{
89bddce5
SH
542 struct inode *inode;
543 struct socket *sock;
1da177e4 544
a209dfc7 545 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
546 if (!inode)
547 return NULL;
548
549 sock = SOCKET_I(inode);
550
29a020d3 551 kmemcheck_annotate_bitfield(sock, type);
85fe4025 552 inode->i_ino = get_next_ino();
89bddce5 553 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
554 inode->i_uid = current_fsuid();
555 inode->i_gid = current_fsgid();
600e1779 556 inode->i_op = &sockfs_inode_ops;
1da177e4 557
19e8d69c 558 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
559 return sock;
560}
561
562/*
563 * In theory you can't get an open on this inode, but /proc provides
564 * a back door. Remember to keep it shut otherwise you'll let the
565 * creepy crawlies in.
566 */
89bddce5 567
1da177e4
LT
568static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
569{
570 return -ENXIO;
571}
572
4b6f5d20 573const struct file_operations bad_sock_fops = {
1da177e4
LT
574 .owner = THIS_MODULE,
575 .open = sock_no_open,
6038f373 576 .llseek = noop_llseek,
1da177e4
LT
577};
578
579/**
580 * sock_release - close a socket
581 * @sock: socket to close
582 *
583 * The socket is released from the protocol stack if it has a release
584 * callback, and the inode is then released if the socket is bound to
89bddce5 585 * an inode not a file.
1da177e4 586 */
89bddce5 587
1da177e4
LT
588void sock_release(struct socket *sock)
589{
590 if (sock->ops) {
591 struct module *owner = sock->ops->owner;
592
593 sock->ops->release(sock);
594 sock->ops = NULL;
595 module_put(owner);
596 }
597
eaefd110 598 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
3410f22e 599 pr_err("%s: fasync list not empty!\n", __func__);
1da177e4 600
b09e786b
MP
601 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
602 return;
603
19e8d69c 604 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
605 if (!sock->file) {
606 iput(SOCK_INODE(sock));
607 return;
608 }
89bddce5 609 sock->file = NULL;
1da177e4 610}
c6d409cf 611EXPORT_SYMBOL(sock_release);
1da177e4 612
67cc0d40 613void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags)
20d49473 614{
140c55d4
ED
615 u8 flags = *tx_flags;
616
b9f40e21 617 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
140c55d4
ED
618 flags |= SKBTX_HW_TSTAMP;
619
b9f40e21 620 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
140c55d4
ED
621 flags |= SKBTX_SW_TSTAMP;
622
e7fd2885 623 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)
140c55d4
ED
624 flags |= SKBTX_SCHED_TSTAMP;
625
e1c8a607 626 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)
140c55d4 627 flags |= SKBTX_ACK_TSTAMP;
e7fd2885 628
140c55d4 629 *tx_flags = flags;
20d49473 630}
67cc0d40 631EXPORT_SYMBOL(__sock_tx_timestamp);
20d49473 632
228e548e
AB
633static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
634 struct msghdr *msg, size_t size)
1da177e4
LT
635{
636 struct sock_iocb *si = kiocb_to_siocb(iocb);
1da177e4
LT
637
638 si->sock = sock;
639 si->scm = NULL;
640 si->msg = msg;
641 si->size = size;
642
1da177e4
LT
643 return sock->ops->sendmsg(iocb, sock, msg, size);
644}
645
228e548e
AB
646static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
647 struct msghdr *msg, size_t size)
648{
649 int err = security_socket_sendmsg(sock, msg, size);
650
651 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
652}
653
1da177e4
LT
654int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
655{
656 struct kiocb iocb;
657 struct sock_iocb siocb;
658 int ret;
659
660 init_sync_kiocb(&iocb, NULL);
661 iocb.private = &siocb;
662 ret = __sock_sendmsg(&iocb, sock, msg, size);
663 if (-EIOCBQUEUED == ret)
664 ret = wait_on_sync_kiocb(&iocb);
665 return ret;
666}
c6d409cf 667EXPORT_SYMBOL(sock_sendmsg);
1da177e4 668
894dc24c 669static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
670{
671 struct kiocb iocb;
672 struct sock_iocb siocb;
673 int ret;
674
675 init_sync_kiocb(&iocb, NULL);
676 iocb.private = &siocb;
677 ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
678 if (-EIOCBQUEUED == ret)
679 ret = wait_on_sync_kiocb(&iocb);
680 return ret;
681}
682
1da177e4
LT
683int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
684 struct kvec *vec, size_t num, size_t size)
685{
686 mm_segment_t oldfs = get_fs();
687 int result;
688
689 set_fs(KERNEL_DS);
690 /*
691 * the following is safe, since for compiler definitions of kvec and
692 * iovec are identical, yielding the same in-core layout and alignment
693 */
89bddce5 694 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
695 msg->msg_iovlen = num;
696 result = sock_sendmsg(sock, msg, size);
697 set_fs(oldfs);
698 return result;
699}
c6d409cf 700EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 701
92f37fd2
ED
702/*
703 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
704 */
705void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
706 struct sk_buff *skb)
707{
20d49473 708 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
f24b9be5 709 struct scm_timestamping tss;
20d49473
PO
710 int empty = 1;
711 struct skb_shared_hwtstamps *shhwtstamps =
712 skb_hwtstamps(skb);
713
714 /* Race occurred between timestamp enabling and packet
715 receiving. Fill in the current time for now. */
716 if (need_software_tstamp && skb->tstamp.tv64 == 0)
717 __net_timestamp(skb);
718
719 if (need_software_tstamp) {
720 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
721 struct timeval tv;
722 skb_get_timestamp(skb, &tv);
723 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
724 sizeof(tv), &tv);
725 } else {
f24b9be5
WB
726 struct timespec ts;
727 skb_get_timestampns(skb, &ts);
20d49473 728 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
f24b9be5 729 sizeof(ts), &ts);
20d49473
PO
730 }
731 }
732
f24b9be5 733 memset(&tss, 0, sizeof(tss));
c199105d 734 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
f24b9be5 735 ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
20d49473 736 empty = 0;
4d276eb6 737 if (shhwtstamps &&
b9f40e21 738 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
f24b9be5 739 ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
4d276eb6 740 empty = 0;
20d49473
PO
741 if (!empty)
742 put_cmsg(msg, SOL_SOCKET,
f24b9be5 743 SCM_TIMESTAMPING, sizeof(tss), &tss);
92f37fd2 744}
7c81fd8b
ACM
745EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
746
6e3e939f
JB
747void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
748 struct sk_buff *skb)
749{
750 int ack;
751
752 if (!sock_flag(sk, SOCK_WIFI_STATUS))
753 return;
754 if (!skb->wifi_acked_valid)
755 return;
756
757 ack = skb->wifi_acked;
758
759 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
760}
761EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
762
11165f14 763static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
764 struct sk_buff *skb)
3b885787
NH
765{
766 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
767 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
768 sizeof(__u32), &skb->dropcount);
769}
770
767dd033 771void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
772 struct sk_buff *skb)
773{
774 sock_recv_timestamp(msg, sk, skb);
775 sock_recv_drops(msg, sk, skb);
776}
767dd033 777EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 778
a2e27255
ACM
779static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
780 struct msghdr *msg, size_t size, int flags)
1da177e4 781{
1da177e4
LT
782 struct sock_iocb *si = kiocb_to_siocb(iocb);
783
784 si->sock = sock;
785 si->scm = NULL;
786 si->msg = msg;
787 si->size = size;
788 si->flags = flags;
789
1da177e4
LT
790 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
791}
792
a2e27255
ACM
793static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
794 struct msghdr *msg, size_t size, int flags)
795{
796 int err = security_socket_recvmsg(sock, msg, size, flags);
797
798 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
799}
800
89bddce5 801int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
802 size_t size, int flags)
803{
804 struct kiocb iocb;
805 struct sock_iocb siocb;
806 int ret;
807
89bddce5 808 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
809 iocb.private = &siocb;
810 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
811 if (-EIOCBQUEUED == ret)
812 ret = wait_on_sync_kiocb(&iocb);
813 return ret;
814}
c6d409cf 815EXPORT_SYMBOL(sock_recvmsg);
1da177e4 816
a2e27255
ACM
817static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
818 size_t size, int flags)
819{
820 struct kiocb iocb;
821 struct sock_iocb siocb;
822 int ret;
823
824 init_sync_kiocb(&iocb, NULL);
825 iocb.private = &siocb;
826 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
827 if (-EIOCBQUEUED == ret)
828 ret = wait_on_sync_kiocb(&iocb);
829 return ret;
830}
831
c1249c0a
ML
832/**
833 * kernel_recvmsg - Receive a message from a socket (kernel space)
834 * @sock: The socket to receive the message from
835 * @msg: Received message
836 * @vec: Input s/g array for message data
837 * @num: Size of input s/g array
838 * @size: Number of bytes to read
839 * @flags: Message flags (MSG_DONTWAIT, etc...)
840 *
841 * On return the msg structure contains the scatter/gather array passed in the
842 * vec argument. The array is modified so that it consists of the unfilled
843 * portion of the original array.
844 *
845 * The returned value is the total number of bytes received, or an error.
846 */
89bddce5
SH
847int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
848 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
849{
850 mm_segment_t oldfs = get_fs();
851 int result;
852
853 set_fs(KERNEL_DS);
854 /*
855 * the following is safe, since for compiler definitions of kvec and
856 * iovec are identical, yielding the same in-core layout and alignment
857 */
89bddce5 858 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
859 result = sock_recvmsg(sock, msg, size, flags);
860 set_fs(oldfs);
861 return result;
862}
c6d409cf 863EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 864
ce1d4d3e
CH
865static ssize_t sock_sendpage(struct file *file, struct page *page,
866 int offset, size_t size, loff_t *ppos, int more)
1da177e4 867{
1da177e4
LT
868 struct socket *sock;
869 int flags;
870
ce1d4d3e
CH
871 sock = file->private_data;
872
35f9c09f
ED
873 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
874 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
875 flags |= more;
ce1d4d3e 876
e6949583 877 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 878}
1da177e4 879
9c55e01c 880static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 881 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
882 unsigned int flags)
883{
884 struct socket *sock = file->private_data;
885
997b37da
RDC
886 if (unlikely(!sock->ops->splice_read))
887 return -EINVAL;
888
9c55e01c
JA
889 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
890}
891
ce1d4d3e 892static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 893 struct sock_iocb *siocb)
ce1d4d3e 894{
d29c445b
KO
895 if (!is_sync_kiocb(iocb))
896 BUG();
1da177e4 897
ce1d4d3e 898 siocb->kiocb = iocb;
ce1d4d3e
CH
899 iocb->private = siocb;
900 return siocb;
1da177e4
LT
901}
902
ce1d4d3e 903static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
904 struct file *file, const struct iovec *iov,
905 unsigned long nr_segs)
ce1d4d3e
CH
906{
907 struct socket *sock = file->private_data;
908 size_t size = 0;
909 int i;
1da177e4 910
89bddce5
SH
911 for (i = 0; i < nr_segs; i++)
912 size += iov[i].iov_len;
1da177e4 913
ce1d4d3e
CH
914 msg->msg_name = NULL;
915 msg->msg_namelen = 0;
916 msg->msg_control = NULL;
917 msg->msg_controllen = 0;
89bddce5 918 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
919 msg->msg_iovlen = nr_segs;
920 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
921
922 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
923}
924
027445c3
BP
925static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
926 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
927{
928 struct sock_iocb siocb, *x;
929
1da177e4
LT
930 if (pos != 0)
931 return -ESPIPE;
027445c3 932
73a7075e 933 if (iocb->ki_nbytes == 0) /* Match SYS5 behaviour */
1da177e4
LT
934 return 0;
935
027445c3
BP
936
937 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
938 if (!x)
939 return -ENOMEM;
027445c3 940 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
941}
942
ce1d4d3e 943static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
944 struct file *file, const struct iovec *iov,
945 unsigned long nr_segs)
1da177e4 946{
ce1d4d3e
CH
947 struct socket *sock = file->private_data;
948 size_t size = 0;
949 int i;
1da177e4 950
89bddce5
SH
951 for (i = 0; i < nr_segs; i++)
952 size += iov[i].iov_len;
1da177e4 953
ce1d4d3e
CH
954 msg->msg_name = NULL;
955 msg->msg_namelen = 0;
956 msg->msg_control = NULL;
957 msg->msg_controllen = 0;
89bddce5 958 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
959 msg->msg_iovlen = nr_segs;
960 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
961 if (sock->type == SOCK_SEQPACKET)
962 msg->msg_flags |= MSG_EOR;
1da177e4 963
ce1d4d3e 964 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
965}
966
027445c3
BP
967static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
968 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
969{
970 struct sock_iocb siocb, *x;
1da177e4 971
ce1d4d3e
CH
972 if (pos != 0)
973 return -ESPIPE;
027445c3 974
027445c3 975 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
976 if (!x)
977 return -ENOMEM;
1da177e4 978
027445c3 979 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
980}
981
1da177e4
LT
982/*
983 * Atomic setting of ioctl hooks to avoid race
984 * with module unload.
985 */
986
4a3e2f71 987static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 988static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 989
881d966b 990void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 991{
4a3e2f71 992 mutex_lock(&br_ioctl_mutex);
1da177e4 993 br_ioctl_hook = hook;
4a3e2f71 994 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
995}
996EXPORT_SYMBOL(brioctl_set);
997
4a3e2f71 998static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 999static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 1000
881d966b 1001void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 1002{
4a3e2f71 1003 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1004 vlan_ioctl_hook = hook;
4a3e2f71 1005 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
1006}
1007EXPORT_SYMBOL(vlan_ioctl_set);
1008
4a3e2f71 1009static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 1010static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 1011
89bddce5 1012void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 1013{
4a3e2f71 1014 mutex_lock(&dlci_ioctl_mutex);
1da177e4 1015 dlci_ioctl_hook = hook;
4a3e2f71 1016 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1017}
1018EXPORT_SYMBOL(dlci_ioctl_set);
1019
6b96018b
AB
1020static long sock_do_ioctl(struct net *net, struct socket *sock,
1021 unsigned int cmd, unsigned long arg)
1022{
1023 int err;
1024 void __user *argp = (void __user *)arg;
1025
1026 err = sock->ops->ioctl(sock, cmd, arg);
1027
1028 /*
1029 * If this ioctl is unknown try to hand it down
1030 * to the NIC driver.
1031 */
1032 if (err == -ENOIOCTLCMD)
1033 err = dev_ioctl(net, cmd, argp);
1034
1035 return err;
1036}
1037
1da177e4
LT
1038/*
1039 * With an ioctl, arg may well be a user mode pointer, but we don't know
1040 * what to do with it - that's up to the protocol still.
1041 */
1042
1043static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1044{
1045 struct socket *sock;
881d966b 1046 struct sock *sk;
1da177e4
LT
1047 void __user *argp = (void __user *)arg;
1048 int pid, err;
881d966b 1049 struct net *net;
1da177e4 1050
b69aee04 1051 sock = file->private_data;
881d966b 1052 sk = sock->sk;
3b1e0a65 1053 net = sock_net(sk);
1da177e4 1054 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 1055 err = dev_ioctl(net, cmd, argp);
1da177e4 1056 } else
3d23e349 1057#ifdef CONFIG_WEXT_CORE
1da177e4 1058 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 1059 err = dev_ioctl(net, cmd, argp);
1da177e4 1060 } else
3d23e349 1061#endif
89bddce5 1062 switch (cmd) {
1da177e4
LT
1063 case FIOSETOWN:
1064 case SIOCSPGRP:
1065 err = -EFAULT;
1066 if (get_user(pid, (int __user *)argp))
1067 break;
e0b93edd
JL
1068 f_setown(sock->file, pid, 1);
1069 err = 0;
1da177e4
LT
1070 break;
1071 case FIOGETOWN:
1072 case SIOCGPGRP:
609d7fa9 1073 err = put_user(f_getown(sock->file),
89bddce5 1074 (int __user *)argp);
1da177e4
LT
1075 break;
1076 case SIOCGIFBR:
1077 case SIOCSIFBR:
1078 case SIOCBRADDBR:
1079 case SIOCBRDELBR:
1080 err = -ENOPKG;
1081 if (!br_ioctl_hook)
1082 request_module("bridge");
1083
4a3e2f71 1084 mutex_lock(&br_ioctl_mutex);
89bddce5 1085 if (br_ioctl_hook)
881d966b 1086 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1087 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1088 break;
1089 case SIOCGIFVLAN:
1090 case SIOCSIFVLAN:
1091 err = -ENOPKG;
1092 if (!vlan_ioctl_hook)
1093 request_module("8021q");
1094
4a3e2f71 1095 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1096 if (vlan_ioctl_hook)
881d966b 1097 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1098 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1099 break;
1da177e4
LT
1100 case SIOCADDDLCI:
1101 case SIOCDELDLCI:
1102 err = -ENOPKG;
1103 if (!dlci_ioctl_hook)
1104 request_module("dlci");
1105
7512cbf6
PE
1106 mutex_lock(&dlci_ioctl_mutex);
1107 if (dlci_ioctl_hook)
1da177e4 1108 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1109 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1110 break;
1111 default:
6b96018b 1112 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1113 break;
89bddce5 1114 }
1da177e4
LT
1115 return err;
1116}
1117
1118int sock_create_lite(int family, int type, int protocol, struct socket **res)
1119{
1120 int err;
1121 struct socket *sock = NULL;
89bddce5 1122
1da177e4
LT
1123 err = security_socket_create(family, type, protocol, 1);
1124 if (err)
1125 goto out;
1126
1127 sock = sock_alloc();
1128 if (!sock) {
1129 err = -ENOMEM;
1130 goto out;
1131 }
1132
1da177e4 1133 sock->type = type;
7420ed23
VY
1134 err = security_socket_post_create(sock, family, type, protocol, 1);
1135 if (err)
1136 goto out_release;
1137
1da177e4
LT
1138out:
1139 *res = sock;
1140 return err;
7420ed23
VY
1141out_release:
1142 sock_release(sock);
1143 sock = NULL;
1144 goto out;
1da177e4 1145}
c6d409cf 1146EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1147
1148/* No kernel lock held - perfect */
89bddce5 1149static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 1150{
cbf55001 1151 unsigned int busy_flag = 0;
1da177e4
LT
1152 struct socket *sock;
1153
1154 /*
89bddce5 1155 * We can't return errors to poll, so it's either yes or no.
1da177e4 1156 */
b69aee04 1157 sock = file->private_data;
2d48d67f 1158
cbf55001 1159 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1160 /* this socket can poll_ll so tell the system call */
cbf55001 1161 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1162
1163 /* once, only if requested by syscall */
cbf55001
ET
1164 if (wait && (wait->_key & POLL_BUSY_LOOP))
1165 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1166 }
1167
cbf55001 1168 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1169}
1170
89bddce5 1171static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1172{
b69aee04 1173 struct socket *sock = file->private_data;
1da177e4
LT
1174
1175 return sock->ops->mmap(file, sock, vma);
1176}
1177
20380731 1178static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1179{
1da177e4
LT
1180 sock_release(SOCKET_I(inode));
1181 return 0;
1182}
1183
1184/*
1185 * Update the socket async list
1186 *
1187 * Fasync_list locking strategy.
1188 *
1189 * 1. fasync_list is modified only under process context socket lock
1190 * i.e. under semaphore.
1191 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1192 * or under socket lock
1da177e4
LT
1193 */
1194
1195static int sock_fasync(int fd, struct file *filp, int on)
1196{
989a2979
ED
1197 struct socket *sock = filp->private_data;
1198 struct sock *sk = sock->sk;
eaefd110 1199 struct socket_wq *wq;
1da177e4 1200
989a2979 1201 if (sk == NULL)
1da177e4 1202 return -EINVAL;
1da177e4
LT
1203
1204 lock_sock(sk);
eaefd110
ED
1205 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1206 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1207
eaefd110 1208 if (!wq->fasync_list)
989a2979
ED
1209 sock_reset_flag(sk, SOCK_FASYNC);
1210 else
bcdce719 1211 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1212
989a2979 1213 release_sock(sk);
1da177e4
LT
1214 return 0;
1215}
1216
43815482 1217/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1218
1219int sock_wake_async(struct socket *sock, int how, int band)
1220{
43815482
ED
1221 struct socket_wq *wq;
1222
1223 if (!sock)
1224 return -1;
1225 rcu_read_lock();
1226 wq = rcu_dereference(sock->wq);
1227 if (!wq || !wq->fasync_list) {
1228 rcu_read_unlock();
1da177e4 1229 return -1;
43815482 1230 }
89bddce5 1231 switch (how) {
8d8ad9d7 1232 case SOCK_WAKE_WAITD:
1da177e4
LT
1233 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1234 break;
1235 goto call_kill;
8d8ad9d7 1236 case SOCK_WAKE_SPACE:
1da177e4
LT
1237 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1238 break;
1239 /* fall through */
8d8ad9d7 1240 case SOCK_WAKE_IO:
89bddce5 1241call_kill:
43815482 1242 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1243 break;
8d8ad9d7 1244 case SOCK_WAKE_URG:
43815482 1245 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1246 }
43815482 1247 rcu_read_unlock();
1da177e4
LT
1248 return 0;
1249}
c6d409cf 1250EXPORT_SYMBOL(sock_wake_async);
1da177e4 1251
721db93a 1252int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1253 struct socket **res, int kern)
1da177e4
LT
1254{
1255 int err;
1256 struct socket *sock;
55737fda 1257 const struct net_proto_family *pf;
1da177e4
LT
1258
1259 /*
89bddce5 1260 * Check protocol is in range
1da177e4
LT
1261 */
1262 if (family < 0 || family >= NPROTO)
1263 return -EAFNOSUPPORT;
1264 if (type < 0 || type >= SOCK_MAX)
1265 return -EINVAL;
1266
1267 /* Compatibility.
1268
1269 This uglymoron is moved from INET layer to here to avoid
1270 deadlock in module load.
1271 */
1272 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1273 static int warned;
1da177e4
LT
1274 if (!warned) {
1275 warned = 1;
3410f22e
YY
1276 pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1277 current->comm);
1da177e4
LT
1278 }
1279 family = PF_PACKET;
1280 }
1281
1282 err = security_socket_create(family, type, protocol, kern);
1283 if (err)
1284 return err;
89bddce5 1285
55737fda
SH
1286 /*
1287 * Allocate the socket and allow the family to set things up. if
1288 * the protocol is 0, the family is instructed to select an appropriate
1289 * default.
1290 */
1291 sock = sock_alloc();
1292 if (!sock) {
e87cc472 1293 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1294 return -ENFILE; /* Not exactly a match, but its the
1295 closest posix thing */
1296 }
1297
1298 sock->type = type;
1299
95a5afca 1300#ifdef CONFIG_MODULES
89bddce5
SH
1301 /* Attempt to load a protocol module if the find failed.
1302 *
1303 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1304 * requested real, full-featured networking support upon configuration.
1305 * Otherwise module support will break!
1306 */
190683a9 1307 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1308 request_module("net-pf-%d", family);
1da177e4
LT
1309#endif
1310
55737fda
SH
1311 rcu_read_lock();
1312 pf = rcu_dereference(net_families[family]);
1313 err = -EAFNOSUPPORT;
1314 if (!pf)
1315 goto out_release;
1da177e4
LT
1316
1317 /*
1318 * We will call the ->create function, that possibly is in a loadable
1319 * module, so we have to bump that loadable module refcnt first.
1320 */
55737fda 1321 if (!try_module_get(pf->owner))
1da177e4
LT
1322 goto out_release;
1323
55737fda
SH
1324 /* Now protected by module ref count */
1325 rcu_read_unlock();
1326
3f378b68 1327 err = pf->create(net, sock, protocol, kern);
55737fda 1328 if (err < 0)
1da177e4 1329 goto out_module_put;
a79af59e 1330
1da177e4
LT
1331 /*
1332 * Now to bump the refcnt of the [loadable] module that owns this
1333 * socket at sock_release time we decrement its refcnt.
1334 */
55737fda
SH
1335 if (!try_module_get(sock->ops->owner))
1336 goto out_module_busy;
1337
1da177e4
LT
1338 /*
1339 * Now that we're done with the ->create function, the [loadable]
1340 * module can have its refcnt decremented
1341 */
55737fda 1342 module_put(pf->owner);
7420ed23
VY
1343 err = security_socket_post_create(sock, family, type, protocol, kern);
1344 if (err)
3b185525 1345 goto out_sock_release;
55737fda 1346 *res = sock;
1da177e4 1347
55737fda
SH
1348 return 0;
1349
1350out_module_busy:
1351 err = -EAFNOSUPPORT;
1da177e4 1352out_module_put:
55737fda
SH
1353 sock->ops = NULL;
1354 module_put(pf->owner);
1355out_sock_release:
1da177e4 1356 sock_release(sock);
55737fda
SH
1357 return err;
1358
1359out_release:
1360 rcu_read_unlock();
1361 goto out_sock_release;
1da177e4 1362}
721db93a 1363EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1364
1365int sock_create(int family, int type, int protocol, struct socket **res)
1366{
1b8d7ae4 1367 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1368}
c6d409cf 1369EXPORT_SYMBOL(sock_create);
1da177e4
LT
1370
1371int sock_create_kern(int family, int type, int protocol, struct socket **res)
1372{
1b8d7ae4 1373 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1374}
c6d409cf 1375EXPORT_SYMBOL(sock_create_kern);
1da177e4 1376
3e0fa65f 1377SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1378{
1379 int retval;
1380 struct socket *sock;
a677a039
UD
1381 int flags;
1382
e38b36f3
UD
1383 /* Check the SOCK_* constants for consistency. */
1384 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1385 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1386 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1387 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1388
a677a039 1389 flags = type & ~SOCK_TYPE_MASK;
77d27200 1390 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1391 return -EINVAL;
1392 type &= SOCK_TYPE_MASK;
1da177e4 1393
aaca0bdc
UD
1394 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1395 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1396
1da177e4
LT
1397 retval = sock_create(family, type, protocol, &sock);
1398 if (retval < 0)
1399 goto out;
1400
77d27200 1401 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1402 if (retval < 0)
1403 goto out_release;
1404
1405out:
1406 /* It may be already another descriptor 8) Not kernel problem. */
1407 return retval;
1408
1409out_release:
1410 sock_release(sock);
1411 return retval;
1412}
1413
1414/*
1415 * Create a pair of connected sockets.
1416 */
1417
3e0fa65f
HC
1418SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1419 int __user *, usockvec)
1da177e4
LT
1420{
1421 struct socket *sock1, *sock2;
1422 int fd1, fd2, err;
db349509 1423 struct file *newfile1, *newfile2;
a677a039
UD
1424 int flags;
1425
1426 flags = type & ~SOCK_TYPE_MASK;
77d27200 1427 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1428 return -EINVAL;
1429 type &= SOCK_TYPE_MASK;
1da177e4 1430
aaca0bdc
UD
1431 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1432 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1433
1da177e4
LT
1434 /*
1435 * Obtain the first socket and check if the underlying protocol
1436 * supports the socketpair call.
1437 */
1438
1439 err = sock_create(family, type, protocol, &sock1);
1440 if (err < 0)
1441 goto out;
1442
1443 err = sock_create(family, type, protocol, &sock2);
1444 if (err < 0)
1445 goto out_release_1;
1446
1447 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1448 if (err < 0)
1da177e4
LT
1449 goto out_release_both;
1450
28407630 1451 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1452 if (unlikely(fd1 < 0)) {
1453 err = fd1;
db349509 1454 goto out_release_both;
bf3c23d1 1455 }
d73aa286 1456
28407630 1457 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1458 if (unlikely(fd2 < 0)) {
1459 err = fd2;
d73aa286 1460 goto out_put_unused_1;
28407630
AV
1461 }
1462
aab174f0 1463 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1464 if (unlikely(IS_ERR(newfile1))) {
1465 err = PTR_ERR(newfile1);
d73aa286 1466 goto out_put_unused_both;
28407630
AV
1467 }
1468
aab174f0 1469 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1470 if (IS_ERR(newfile2)) {
1471 err = PTR_ERR(newfile2);
d73aa286 1472 goto out_fput_1;
db349509
AV
1473 }
1474
d73aa286
YD
1475 err = put_user(fd1, &usockvec[0]);
1476 if (err)
1477 goto out_fput_both;
1478
1479 err = put_user(fd2, &usockvec[1]);
1480 if (err)
1481 goto out_fput_both;
1482
157cf649 1483 audit_fd_pair(fd1, fd2);
d73aa286 1484
db349509
AV
1485 fd_install(fd1, newfile1);
1486 fd_install(fd2, newfile2);
1da177e4
LT
1487 /* fd1 and fd2 may be already another descriptors.
1488 * Not kernel problem.
1489 */
1490
d73aa286 1491 return 0;
1da177e4 1492
d73aa286
YD
1493out_fput_both:
1494 fput(newfile2);
1495 fput(newfile1);
1496 put_unused_fd(fd2);
1497 put_unused_fd(fd1);
1498 goto out;
1499
1500out_fput_1:
1501 fput(newfile1);
1502 put_unused_fd(fd2);
1503 put_unused_fd(fd1);
1504 sock_release(sock2);
1505 goto out;
1da177e4 1506
d73aa286
YD
1507out_put_unused_both:
1508 put_unused_fd(fd2);
1509out_put_unused_1:
1510 put_unused_fd(fd1);
1da177e4 1511out_release_both:
89bddce5 1512 sock_release(sock2);
1da177e4 1513out_release_1:
89bddce5 1514 sock_release(sock1);
1da177e4
LT
1515out:
1516 return err;
1517}
1518
1da177e4
LT
1519/*
1520 * Bind a name to a socket. Nothing much to do here since it's
1521 * the protocol's responsibility to handle the local address.
1522 *
1523 * We move the socket address to kernel space before we call
1524 * the protocol layer (having also checked the address is ok).
1525 */
1526
20f37034 1527SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1528{
1529 struct socket *sock;
230b1839 1530 struct sockaddr_storage address;
6cb153ca 1531 int err, fput_needed;
1da177e4 1532
89bddce5 1533 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1534 if (sock) {
43db362d 1535 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1536 if (err >= 0) {
1537 err = security_socket_bind(sock,
230b1839 1538 (struct sockaddr *)&address,
89bddce5 1539 addrlen);
6cb153ca
BL
1540 if (!err)
1541 err = sock->ops->bind(sock,
89bddce5 1542 (struct sockaddr *)
230b1839 1543 &address, addrlen);
1da177e4 1544 }
6cb153ca 1545 fput_light(sock->file, fput_needed);
89bddce5 1546 }
1da177e4
LT
1547 return err;
1548}
1549
1da177e4
LT
1550/*
1551 * Perform a listen. Basically, we allow the protocol to do anything
1552 * necessary for a listen, and if that works, we mark the socket as
1553 * ready for listening.
1554 */
1555
3e0fa65f 1556SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1557{
1558 struct socket *sock;
6cb153ca 1559 int err, fput_needed;
b8e1f9b5 1560 int somaxconn;
89bddce5
SH
1561
1562 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1563 if (sock) {
8efa6e93 1564 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1565 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1566 backlog = somaxconn;
1da177e4
LT
1567
1568 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1569 if (!err)
1570 err = sock->ops->listen(sock, backlog);
1da177e4 1571
6cb153ca 1572 fput_light(sock->file, fput_needed);
1da177e4
LT
1573 }
1574 return err;
1575}
1576
1da177e4
LT
1577/*
1578 * For accept, we attempt to create a new socket, set up the link
1579 * with the client, wake up the client, then return the new
1580 * connected fd. We collect the address of the connector in kernel
1581 * space and move it to user at the very end. This is unclean because
1582 * we open the socket then return an error.
1583 *
1584 * 1003.1g adds the ability to recvmsg() to query connection pending
1585 * status to recvmsg. We need to add that support in a way thats
1586 * clean when we restucture accept also.
1587 */
1588
20f37034
HC
1589SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1590 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1591{
1592 struct socket *sock, *newsock;
39d8c1b6 1593 struct file *newfile;
6cb153ca 1594 int err, len, newfd, fput_needed;
230b1839 1595 struct sockaddr_storage address;
1da177e4 1596
77d27200 1597 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1598 return -EINVAL;
1599
1600 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1601 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1602
6cb153ca 1603 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1604 if (!sock)
1605 goto out;
1606
1607 err = -ENFILE;
c6d409cf
ED
1608 newsock = sock_alloc();
1609 if (!newsock)
1da177e4
LT
1610 goto out_put;
1611
1612 newsock->type = sock->type;
1613 newsock->ops = sock->ops;
1614
1da177e4
LT
1615 /*
1616 * We don't need try_module_get here, as the listening socket (sock)
1617 * has the protocol module (sock->ops->owner) held.
1618 */
1619 __module_get(newsock->ops->owner);
1620
28407630 1621 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1622 if (unlikely(newfd < 0)) {
1623 err = newfd;
9a1875e6
DM
1624 sock_release(newsock);
1625 goto out_put;
39d8c1b6 1626 }
aab174f0 1627 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1628 if (unlikely(IS_ERR(newfile))) {
1629 err = PTR_ERR(newfile);
1630 put_unused_fd(newfd);
1631 sock_release(newsock);
1632 goto out_put;
1633 }
39d8c1b6 1634
a79af59e
FF
1635 err = security_socket_accept(sock, newsock);
1636 if (err)
39d8c1b6 1637 goto out_fd;
a79af59e 1638
1da177e4
LT
1639 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1640 if (err < 0)
39d8c1b6 1641 goto out_fd;
1da177e4
LT
1642
1643 if (upeer_sockaddr) {
230b1839 1644 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1645 &len, 2) < 0) {
1da177e4 1646 err = -ECONNABORTED;
39d8c1b6 1647 goto out_fd;
1da177e4 1648 }
43db362d 1649 err = move_addr_to_user(&address,
230b1839 1650 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1651 if (err < 0)
39d8c1b6 1652 goto out_fd;
1da177e4
LT
1653 }
1654
1655 /* File flags are not inherited via accept() unlike another OSes. */
1656
39d8c1b6
DM
1657 fd_install(newfd, newfile);
1658 err = newfd;
1da177e4 1659
1da177e4 1660out_put:
6cb153ca 1661 fput_light(sock->file, fput_needed);
1da177e4
LT
1662out:
1663 return err;
39d8c1b6 1664out_fd:
9606a216 1665 fput(newfile);
39d8c1b6 1666 put_unused_fd(newfd);
1da177e4
LT
1667 goto out_put;
1668}
1669
20f37034
HC
1670SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1671 int __user *, upeer_addrlen)
aaca0bdc 1672{
de11defe 1673 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1674}
1675
1da177e4
LT
1676/*
1677 * Attempt to connect to a socket with the server address. The address
1678 * is in user space so we verify it is OK and move it to kernel space.
1679 *
1680 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1681 * break bindings
1682 *
1683 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1684 * other SEQPACKET protocols that take time to connect() as it doesn't
1685 * include the -EINPROGRESS status for such sockets.
1686 */
1687
20f37034
HC
1688SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1689 int, addrlen)
1da177e4
LT
1690{
1691 struct socket *sock;
230b1839 1692 struct sockaddr_storage address;
6cb153ca 1693 int err, fput_needed;
1da177e4 1694
6cb153ca 1695 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1696 if (!sock)
1697 goto out;
43db362d 1698 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1699 if (err < 0)
1700 goto out_put;
1701
89bddce5 1702 err =
230b1839 1703 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1704 if (err)
1705 goto out_put;
1706
230b1839 1707 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1708 sock->file->f_flags);
1709out_put:
6cb153ca 1710 fput_light(sock->file, fput_needed);
1da177e4
LT
1711out:
1712 return err;
1713}
1714
1715/*
1716 * Get the local address ('name') of a socket object. Move the obtained
1717 * name to user space.
1718 */
1719
20f37034
HC
1720SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1721 int __user *, usockaddr_len)
1da177e4
LT
1722{
1723 struct socket *sock;
230b1839 1724 struct sockaddr_storage address;
6cb153ca 1725 int len, err, fput_needed;
89bddce5 1726
6cb153ca 1727 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1728 if (!sock)
1729 goto out;
1730
1731 err = security_socket_getsockname(sock);
1732 if (err)
1733 goto out_put;
1734
230b1839 1735 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1736 if (err)
1737 goto out_put;
43db362d 1738 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1739
1740out_put:
6cb153ca 1741 fput_light(sock->file, fput_needed);
1da177e4
LT
1742out:
1743 return err;
1744}
1745
1746/*
1747 * Get the remote address ('name') of a socket object. Move the obtained
1748 * name to user space.
1749 */
1750
20f37034
HC
1751SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1752 int __user *, usockaddr_len)
1da177e4
LT
1753{
1754 struct socket *sock;
230b1839 1755 struct sockaddr_storage address;
6cb153ca 1756 int len, err, fput_needed;
1da177e4 1757
89bddce5
SH
1758 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1759 if (sock != NULL) {
1da177e4
LT
1760 err = security_socket_getpeername(sock);
1761 if (err) {
6cb153ca 1762 fput_light(sock->file, fput_needed);
1da177e4
LT
1763 return err;
1764 }
1765
89bddce5 1766 err =
230b1839 1767 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1768 1);
1da177e4 1769 if (!err)
43db362d 1770 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1771 usockaddr_len);
6cb153ca 1772 fput_light(sock->file, fput_needed);
1da177e4
LT
1773 }
1774 return err;
1775}
1776
1777/*
1778 * Send a datagram to a given address. We move the address into kernel
1779 * space and check the user space data area is readable before invoking
1780 * the protocol.
1781 */
1782
3e0fa65f 1783SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1784 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1785 int, addr_len)
1da177e4
LT
1786{
1787 struct socket *sock;
230b1839 1788 struct sockaddr_storage address;
1da177e4
LT
1789 int err;
1790 struct msghdr msg;
1791 struct iovec iov;
6cb153ca 1792 int fput_needed;
6cb153ca 1793
253eacc0
LT
1794 if (len > INT_MAX)
1795 len = INT_MAX;
de0fa95c
PE
1796 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1797 if (!sock)
4387ff75 1798 goto out;
6cb153ca 1799
89bddce5
SH
1800 iov.iov_base = buff;
1801 iov.iov_len = len;
1802 msg.msg_name = NULL;
1803 msg.msg_iov = &iov;
1804 msg.msg_iovlen = 1;
1805 msg.msg_control = NULL;
1806 msg.msg_controllen = 0;
1807 msg.msg_namelen = 0;
6cb153ca 1808 if (addr) {
43db362d 1809 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1810 if (err < 0)
1811 goto out_put;
230b1839 1812 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1813 msg.msg_namelen = addr_len;
1da177e4
LT
1814 }
1815 if (sock->file->f_flags & O_NONBLOCK)
1816 flags |= MSG_DONTWAIT;
1817 msg.msg_flags = flags;
1818 err = sock_sendmsg(sock, &msg, len);
1819
89bddce5 1820out_put:
de0fa95c 1821 fput_light(sock->file, fput_needed);
4387ff75 1822out:
1da177e4
LT
1823 return err;
1824}
1825
1826/*
89bddce5 1827 * Send a datagram down a socket.
1da177e4
LT
1828 */
1829
3e0fa65f 1830SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1831 unsigned int, flags)
1da177e4
LT
1832{
1833 return sys_sendto(fd, buff, len, flags, NULL, 0);
1834}
1835
1836/*
89bddce5 1837 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1838 * sender. We verify the buffers are writable and if needed move the
1839 * sender address from kernel to user space.
1840 */
1841
3e0fa65f 1842SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1843 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1844 int __user *, addr_len)
1da177e4
LT
1845{
1846 struct socket *sock;
1847 struct iovec iov;
1848 struct msghdr msg;
230b1839 1849 struct sockaddr_storage address;
89bddce5 1850 int err, err2;
6cb153ca
BL
1851 int fput_needed;
1852
253eacc0
LT
1853 if (size > INT_MAX)
1854 size = INT_MAX;
de0fa95c 1855 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1856 if (!sock)
de0fa95c 1857 goto out;
1da177e4 1858
89bddce5
SH
1859 msg.msg_control = NULL;
1860 msg.msg_controllen = 0;
1861 msg.msg_iovlen = 1;
1862 msg.msg_iov = &iov;
1863 iov.iov_len = size;
1864 iov.iov_base = ubuf;
f3d33426
HFS
1865 /* Save some cycles and don't copy the address if not needed */
1866 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1867 /* We assume all kernel code knows the size of sockaddr_storage */
1868 msg.msg_namelen = 0;
1da177e4
LT
1869 if (sock->file->f_flags & O_NONBLOCK)
1870 flags |= MSG_DONTWAIT;
89bddce5 1871 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1872
89bddce5 1873 if (err >= 0 && addr != NULL) {
43db362d 1874 err2 = move_addr_to_user(&address,
230b1839 1875 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1876 if (err2 < 0)
1877 err = err2;
1da177e4 1878 }
de0fa95c
PE
1879
1880 fput_light(sock->file, fput_needed);
4387ff75 1881out:
1da177e4
LT
1882 return err;
1883}
1884
1885/*
89bddce5 1886 * Receive a datagram from a socket.
1da177e4
LT
1887 */
1888
b7c0ddf5
JG
1889SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1890 unsigned int, flags)
1da177e4
LT
1891{
1892 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1893}
1894
1895/*
1896 * Set a socket option. Because we don't know the option lengths we have
1897 * to pass the user mode parameter for the protocols to sort out.
1898 */
1899
20f37034
HC
1900SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1901 char __user *, optval, int, optlen)
1da177e4 1902{
6cb153ca 1903 int err, fput_needed;
1da177e4
LT
1904 struct socket *sock;
1905
1906 if (optlen < 0)
1907 return -EINVAL;
89bddce5
SH
1908
1909 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1910 if (sock != NULL) {
1911 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1912 if (err)
1913 goto out_put;
1da177e4
LT
1914
1915 if (level == SOL_SOCKET)
89bddce5
SH
1916 err =
1917 sock_setsockopt(sock, level, optname, optval,
1918 optlen);
1da177e4 1919 else
89bddce5
SH
1920 err =
1921 sock->ops->setsockopt(sock, level, optname, optval,
1922 optlen);
6cb153ca
BL
1923out_put:
1924 fput_light(sock->file, fput_needed);
1da177e4
LT
1925 }
1926 return err;
1927}
1928
1929/*
1930 * Get a socket option. Because we don't know the option lengths we have
1931 * to pass a user mode parameter for the protocols to sort out.
1932 */
1933
20f37034
HC
1934SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1935 char __user *, optval, int __user *, optlen)
1da177e4 1936{
6cb153ca 1937 int err, fput_needed;
1da177e4
LT
1938 struct socket *sock;
1939
89bddce5
SH
1940 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1941 if (sock != NULL) {
6cb153ca
BL
1942 err = security_socket_getsockopt(sock, level, optname);
1943 if (err)
1944 goto out_put;
1da177e4
LT
1945
1946 if (level == SOL_SOCKET)
89bddce5
SH
1947 err =
1948 sock_getsockopt(sock, level, optname, optval,
1949 optlen);
1da177e4 1950 else
89bddce5
SH
1951 err =
1952 sock->ops->getsockopt(sock, level, optname, optval,
1953 optlen);
6cb153ca
BL
1954out_put:
1955 fput_light(sock->file, fput_needed);
1da177e4
LT
1956 }
1957 return err;
1958}
1959
1da177e4
LT
1960/*
1961 * Shutdown a socket.
1962 */
1963
754fe8d2 1964SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1965{
6cb153ca 1966 int err, fput_needed;
1da177e4
LT
1967 struct socket *sock;
1968
89bddce5
SH
1969 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1970 if (sock != NULL) {
1da177e4 1971 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1972 if (!err)
1973 err = sock->ops->shutdown(sock, how);
1974 fput_light(sock->file, fput_needed);
1da177e4
LT
1975 }
1976 return err;
1977}
1978
89bddce5 1979/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1980 * fields which are the same type (int / unsigned) on our platforms.
1981 */
1982#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1983#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1984#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1985
c71d8ebe
TH
1986struct used_address {
1987 struct sockaddr_storage name;
1988 unsigned int name_len;
1989};
1990
1661bf36 1991static int copy_msghdr_from_user(struct msghdr *kmsg,
666547ff 1992 struct user_msghdr __user *umsg)
1661bf36 1993{
666547ff
AV
1994 /* We are relying on the (currently) identical layouts. Once
1995 * the kernel-side changes, this place will need to be updated
1996 */
1661bf36
DC
1997 if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
1998 return -EFAULT;
dbb490b9 1999
6a2a2b3a
AS
2000 if (kmsg->msg_name == NULL)
2001 kmsg->msg_namelen = 0;
2002
dbb490b9
ML
2003 if (kmsg->msg_namelen < 0)
2004 return -EINVAL;
2005
1661bf36 2006 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
db31c55a 2007 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
1661bf36
DC
2008 return 0;
2009}
2010
666547ff 2011static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2012 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 2013 struct used_address *used_address)
1da177e4 2014{
89bddce5
SH
2015 struct compat_msghdr __user *msg_compat =
2016 (struct compat_msghdr __user *)msg;
230b1839 2017 struct sockaddr_storage address;
1da177e4 2018 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 2019 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
2020 __attribute__ ((aligned(sizeof(__kernel_size_t))));
2021 /* 20 is size of ipv6_pktinfo */
1da177e4 2022 unsigned char *ctl_buf = ctl;
a74e9106 2023 int err, ctl_len, total_len;
89bddce5 2024
1da177e4
LT
2025 err = -EFAULT;
2026 if (MSG_CMSG_COMPAT & flags) {
228e548e 2027 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2028 return -EFAULT;
1661bf36
DC
2029 } else {
2030 err = copy_msghdr_from_user(msg_sys, msg);
2031 if (err)
2032 return err;
2033 }
1da177e4 2034
1da177e4 2035 /* This will also move the address data into kernel space */
08449320
AV
2036 if (MSG_CMSG_COMPAT & flags)
2037 err = verify_compat_iovec(msg_sys, iovstack, &address, WRITE);
2038 else
2039 err = verify_iovec(msg_sys, iovstack, &address, WRITE);
89bddce5 2040 if (err < 0)
1da177e4 2041 goto out_freeiov;
08449320 2042 iov = msg_sys->msg_iov;
1da177e4
LT
2043 total_len = err;
2044
2045 err = -ENOBUFS;
2046
228e548e 2047 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 2048 goto out_freeiov;
228e548e 2049 ctl_len = msg_sys->msg_controllen;
1da177e4 2050 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2051 err =
228e548e 2052 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2053 sizeof(ctl));
1da177e4
LT
2054 if (err)
2055 goto out_freeiov;
228e548e
AB
2056 ctl_buf = msg_sys->msg_control;
2057 ctl_len = msg_sys->msg_controllen;
1da177e4 2058 } else if (ctl_len) {
89bddce5 2059 if (ctl_len > sizeof(ctl)) {
1da177e4 2060 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2061 if (ctl_buf == NULL)
1da177e4
LT
2062 goto out_freeiov;
2063 }
2064 err = -EFAULT;
2065 /*
228e548e 2066 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2067 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2068 * checking falls down on this.
2069 */
fb8621bb 2070 if (copy_from_user(ctl_buf,
228e548e 2071 (void __user __force *)msg_sys->msg_control,
89bddce5 2072 ctl_len))
1da177e4 2073 goto out_freectl;
228e548e 2074 msg_sys->msg_control = ctl_buf;
1da177e4 2075 }
228e548e 2076 msg_sys->msg_flags = flags;
1da177e4
LT
2077
2078 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2079 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2080 /*
2081 * If this is sendmmsg() and current destination address is same as
2082 * previously succeeded address, omit asking LSM's decision.
2083 * used_address->name_len is initialized to UINT_MAX so that the first
2084 * destination address never matches.
2085 */
bc909d9d
MD
2086 if (used_address && msg_sys->msg_name &&
2087 used_address->name_len == msg_sys->msg_namelen &&
2088 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2089 used_address->name_len)) {
2090 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2091 goto out_freectl;
2092 }
2093 err = sock_sendmsg(sock, msg_sys, total_len);
2094 /*
2095 * If this is sendmmsg() and sending to current destination address was
2096 * successful, remember it.
2097 */
2098 if (used_address && err >= 0) {
2099 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2100 if (msg_sys->msg_name)
2101 memcpy(&used_address->name, msg_sys->msg_name,
2102 used_address->name_len);
c71d8ebe 2103 }
1da177e4
LT
2104
2105out_freectl:
89bddce5 2106 if (ctl_buf != ctl)
1da177e4
LT
2107 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2108out_freeiov:
2109 if (iov != iovstack)
a74e9106 2110 kfree(iov);
228e548e
AB
2111 return err;
2112}
2113
2114/*
2115 * BSD sendmsg interface
2116 */
2117
666547ff 2118long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
228e548e
AB
2119{
2120 int fput_needed, err;
2121 struct msghdr msg_sys;
1be374a0
AL
2122 struct socket *sock;
2123
1be374a0 2124 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2125 if (!sock)
2126 goto out;
2127
a7526eb5 2128 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2129
6cb153ca 2130 fput_light(sock->file, fput_needed);
89bddce5 2131out:
1da177e4
LT
2132 return err;
2133}
2134
666547ff 2135SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
a7526eb5
AL
2136{
2137 if (flags & MSG_CMSG_COMPAT)
2138 return -EINVAL;
2139 return __sys_sendmsg(fd, msg, flags);
2140}
2141
228e548e
AB
2142/*
2143 * Linux sendmmsg interface
2144 */
2145
2146int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2147 unsigned int flags)
2148{
2149 int fput_needed, err, datagrams;
2150 struct socket *sock;
2151 struct mmsghdr __user *entry;
2152 struct compat_mmsghdr __user *compat_entry;
2153 struct msghdr msg_sys;
c71d8ebe 2154 struct used_address used_address;
228e548e 2155
98382f41
AB
2156 if (vlen > UIO_MAXIOV)
2157 vlen = UIO_MAXIOV;
228e548e
AB
2158
2159 datagrams = 0;
2160
2161 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2162 if (!sock)
2163 return err;
2164
c71d8ebe 2165 used_address.name_len = UINT_MAX;
228e548e
AB
2166 entry = mmsg;
2167 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2168 err = 0;
228e548e
AB
2169
2170 while (datagrams < vlen) {
228e548e 2171 if (MSG_CMSG_COMPAT & flags) {
666547ff 2172 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5 2173 &msg_sys, flags, &used_address);
228e548e
AB
2174 if (err < 0)
2175 break;
2176 err = __put_user(err, &compat_entry->msg_len);
2177 ++compat_entry;
2178 } else {
a7526eb5 2179 err = ___sys_sendmsg(sock,
666547ff 2180 (struct user_msghdr __user *)entry,
a7526eb5 2181 &msg_sys, flags, &used_address);
228e548e
AB
2182 if (err < 0)
2183 break;
2184 err = put_user(err, &entry->msg_len);
2185 ++entry;
2186 }
2187
2188 if (err)
2189 break;
2190 ++datagrams;
2191 }
2192
228e548e
AB
2193 fput_light(sock->file, fput_needed);
2194
728ffb86
AB
2195 /* We only return an error if no datagrams were able to be sent */
2196 if (datagrams != 0)
228e548e
AB
2197 return datagrams;
2198
228e548e
AB
2199 return err;
2200}
2201
2202SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2203 unsigned int, vlen, unsigned int, flags)
2204{
1be374a0
AL
2205 if (flags & MSG_CMSG_COMPAT)
2206 return -EINVAL;
228e548e
AB
2207 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2208}
2209
666547ff 2210static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2211 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2212{
89bddce5
SH
2213 struct compat_msghdr __user *msg_compat =
2214 (struct compat_msghdr __user *)msg;
1da177e4 2215 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2216 struct iovec *iov = iovstack;
1da177e4 2217 unsigned long cmsg_ptr;
a74e9106 2218 int err, total_len, len;
1da177e4
LT
2219
2220 /* kernel mode address */
230b1839 2221 struct sockaddr_storage addr;
1da177e4
LT
2222
2223 /* user mode address pointers */
2224 struct sockaddr __user *uaddr;
2225 int __user *uaddr_len;
89bddce5 2226
1da177e4 2227 if (MSG_CMSG_COMPAT & flags) {
a2e27255 2228 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2229 return -EFAULT;
1661bf36
DC
2230 } else {
2231 err = copy_msghdr_from_user(msg_sys, msg);
2232 if (err)
2233 return err;
2234 }
1da177e4 2235
f3d33426
HFS
2236 /* Save the user-mode address (verify_iovec will change the
2237 * kernel msghdr to use the kernel address space)
1da177e4 2238 */
a2e27255 2239 uaddr = (__force void __user *)msg_sys->msg_name;
1da177e4 2240 uaddr_len = COMPAT_NAMELEN(msg);
f3d33426 2241 if (MSG_CMSG_COMPAT & flags)
08449320 2242 err = verify_compat_iovec(msg_sys, iovstack, &addr, READ);
f3d33426 2243 else
08449320 2244 err = verify_iovec(msg_sys, iovstack, &addr, READ);
1da177e4
LT
2245 if (err < 0)
2246 goto out_freeiov;
08449320 2247 iov = msg_sys->msg_iov;
89bddce5 2248 total_len = err;
1da177e4 2249
a2e27255
ACM
2250 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2251 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2252
f3d33426
HFS
2253 /* We assume all kernel code knows the size of sockaddr_storage */
2254 msg_sys->msg_namelen = 0;
2255
1da177e4
LT
2256 if (sock->file->f_flags & O_NONBLOCK)
2257 flags |= MSG_DONTWAIT;
a2e27255
ACM
2258 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2259 total_len, flags);
1da177e4
LT
2260 if (err < 0)
2261 goto out_freeiov;
2262 len = err;
2263
2264 if (uaddr != NULL) {
43db362d 2265 err = move_addr_to_user(&addr,
a2e27255 2266 msg_sys->msg_namelen, uaddr,
89bddce5 2267 uaddr_len);
1da177e4
LT
2268 if (err < 0)
2269 goto out_freeiov;
2270 }
a2e27255 2271 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2272 COMPAT_FLAGS(msg));
1da177e4
LT
2273 if (err)
2274 goto out_freeiov;
2275 if (MSG_CMSG_COMPAT & flags)
a2e27255 2276 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2277 &msg_compat->msg_controllen);
2278 else
a2e27255 2279 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2280 &msg->msg_controllen);
2281 if (err)
2282 goto out_freeiov;
2283 err = len;
2284
2285out_freeiov:
2286 if (iov != iovstack)
a74e9106 2287 kfree(iov);
a2e27255
ACM
2288 return err;
2289}
2290
2291/*
2292 * BSD recvmsg interface
2293 */
2294
666547ff 2295long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
a2e27255
ACM
2296{
2297 int fput_needed, err;
2298 struct msghdr msg_sys;
1be374a0
AL
2299 struct socket *sock;
2300
1be374a0 2301 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2302 if (!sock)
2303 goto out;
2304
a7526eb5 2305 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2306
6cb153ca 2307 fput_light(sock->file, fput_needed);
1da177e4
LT
2308out:
2309 return err;
2310}
2311
666547ff 2312SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
a7526eb5
AL
2313 unsigned int, flags)
2314{
2315 if (flags & MSG_CMSG_COMPAT)
2316 return -EINVAL;
2317 return __sys_recvmsg(fd, msg, flags);
2318}
2319
a2e27255
ACM
2320/*
2321 * Linux recvmmsg interface
2322 */
2323
2324int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2325 unsigned int flags, struct timespec *timeout)
2326{
2327 int fput_needed, err, datagrams;
2328 struct socket *sock;
2329 struct mmsghdr __user *entry;
d7256d0e 2330 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2331 struct msghdr msg_sys;
2332 struct timespec end_time;
2333
2334 if (timeout &&
2335 poll_select_set_timeout(&end_time, timeout->tv_sec,
2336 timeout->tv_nsec))
2337 return -EINVAL;
2338
2339 datagrams = 0;
2340
2341 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2342 if (!sock)
2343 return err;
2344
2345 err = sock_error(sock->sk);
2346 if (err)
2347 goto out_put;
2348
2349 entry = mmsg;
d7256d0e 2350 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2351
2352 while (datagrams < vlen) {
2353 /*
2354 * No need to ask LSM for more than the first datagram.
2355 */
d7256d0e 2356 if (MSG_CMSG_COMPAT & flags) {
666547ff 2357 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5
AL
2358 &msg_sys, flags & ~MSG_WAITFORONE,
2359 datagrams);
d7256d0e
JMG
2360 if (err < 0)
2361 break;
2362 err = __put_user(err, &compat_entry->msg_len);
2363 ++compat_entry;
2364 } else {
a7526eb5 2365 err = ___sys_recvmsg(sock,
666547ff 2366 (struct user_msghdr __user *)entry,
a7526eb5
AL
2367 &msg_sys, flags & ~MSG_WAITFORONE,
2368 datagrams);
d7256d0e
JMG
2369 if (err < 0)
2370 break;
2371 err = put_user(err, &entry->msg_len);
2372 ++entry;
2373 }
2374
a2e27255
ACM
2375 if (err)
2376 break;
a2e27255
ACM
2377 ++datagrams;
2378
71c5c159
BB
2379 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2380 if (flags & MSG_WAITFORONE)
2381 flags |= MSG_DONTWAIT;
2382
a2e27255
ACM
2383 if (timeout) {
2384 ktime_get_ts(timeout);
2385 *timeout = timespec_sub(end_time, *timeout);
2386 if (timeout->tv_sec < 0) {
2387 timeout->tv_sec = timeout->tv_nsec = 0;
2388 break;
2389 }
2390
2391 /* Timeout, return less than vlen datagrams */
2392 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2393 break;
2394 }
2395
2396 /* Out of band data, return right away */
2397 if (msg_sys.msg_flags & MSG_OOB)
2398 break;
2399 }
2400
2401out_put:
2402 fput_light(sock->file, fput_needed);
1da177e4 2403
a2e27255
ACM
2404 if (err == 0)
2405 return datagrams;
2406
2407 if (datagrams != 0) {
2408 /*
2409 * We may return less entries than requested (vlen) if the
2410 * sock is non block and there aren't enough datagrams...
2411 */
2412 if (err != -EAGAIN) {
2413 /*
2414 * ... or if recvmsg returns an error after we
2415 * received some datagrams, where we record the
2416 * error to return on the next call or if the
2417 * app asks about it using getsockopt(SO_ERROR).
2418 */
2419 sock->sk->sk_err = -err;
2420 }
2421
2422 return datagrams;
2423 }
2424
2425 return err;
2426}
2427
2428SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2429 unsigned int, vlen, unsigned int, flags,
2430 struct timespec __user *, timeout)
2431{
2432 int datagrams;
2433 struct timespec timeout_sys;
2434
1be374a0
AL
2435 if (flags & MSG_CMSG_COMPAT)
2436 return -EINVAL;
2437
a2e27255
ACM
2438 if (!timeout)
2439 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2440
2441 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2442 return -EFAULT;
2443
2444 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2445
2446 if (datagrams > 0 &&
2447 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2448 datagrams = -EFAULT;
2449
2450 return datagrams;
2451}
2452
2453#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2454/* Argument list sizes for sys_socketcall */
2455#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2456static const unsigned char nargs[21] = {
c6d409cf
ED
2457 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2458 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2459 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2460 AL(4), AL(5), AL(4)
89bddce5
SH
2461};
2462
1da177e4
LT
2463#undef AL
2464
2465/*
89bddce5 2466 * System call vectors.
1da177e4
LT
2467 *
2468 * Argument checking cleaned up. Saved 20% in size.
2469 * This function doesn't need to set the kernel lock because
89bddce5 2470 * it is set by the callees.
1da177e4
LT
2471 */
2472
3e0fa65f 2473SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2474{
2950fa9d 2475 unsigned long a[AUDITSC_ARGS];
89bddce5 2476 unsigned long a0, a1;
1da177e4 2477 int err;
47379052 2478 unsigned int len;
1da177e4 2479
228e548e 2480 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2481 return -EINVAL;
2482
47379052
AV
2483 len = nargs[call];
2484 if (len > sizeof(a))
2485 return -EINVAL;
2486
1da177e4 2487 /* copy_from_user should be SMP safe. */
47379052 2488 if (copy_from_user(a, args, len))
1da177e4 2489 return -EFAULT;
3ec3b2fb 2490
2950fa9d
CG
2491 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2492 if (err)
2493 return err;
3ec3b2fb 2494
89bddce5
SH
2495 a0 = a[0];
2496 a1 = a[1];
2497
2498 switch (call) {
2499 case SYS_SOCKET:
2500 err = sys_socket(a0, a1, a[2]);
2501 break;
2502 case SYS_BIND:
2503 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2504 break;
2505 case SYS_CONNECT:
2506 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2507 break;
2508 case SYS_LISTEN:
2509 err = sys_listen(a0, a1);
2510 break;
2511 case SYS_ACCEPT:
de11defe
UD
2512 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2513 (int __user *)a[2], 0);
89bddce5
SH
2514 break;
2515 case SYS_GETSOCKNAME:
2516 err =
2517 sys_getsockname(a0, (struct sockaddr __user *)a1,
2518 (int __user *)a[2]);
2519 break;
2520 case SYS_GETPEERNAME:
2521 err =
2522 sys_getpeername(a0, (struct sockaddr __user *)a1,
2523 (int __user *)a[2]);
2524 break;
2525 case SYS_SOCKETPAIR:
2526 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2527 break;
2528 case SYS_SEND:
2529 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2530 break;
2531 case SYS_SENDTO:
2532 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2533 (struct sockaddr __user *)a[4], a[5]);
2534 break;
2535 case SYS_RECV:
2536 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2537 break;
2538 case SYS_RECVFROM:
2539 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2540 (struct sockaddr __user *)a[4],
2541 (int __user *)a[5]);
2542 break;
2543 case SYS_SHUTDOWN:
2544 err = sys_shutdown(a0, a1);
2545 break;
2546 case SYS_SETSOCKOPT:
2547 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2548 break;
2549 case SYS_GETSOCKOPT:
2550 err =
2551 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2552 (int __user *)a[4]);
2553 break;
2554 case SYS_SENDMSG:
666547ff 2555 err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2556 break;
228e548e
AB
2557 case SYS_SENDMMSG:
2558 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2559 break;
89bddce5 2560 case SYS_RECVMSG:
666547ff 2561 err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2562 break;
a2e27255
ACM
2563 case SYS_RECVMMSG:
2564 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2565 (struct timespec __user *)a[4]);
2566 break;
de11defe
UD
2567 case SYS_ACCEPT4:
2568 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2569 (int __user *)a[2], a[3]);
aaca0bdc 2570 break;
89bddce5
SH
2571 default:
2572 err = -EINVAL;
2573 break;
1da177e4
LT
2574 }
2575 return err;
2576}
2577
89bddce5 2578#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2579
55737fda
SH
2580/**
2581 * sock_register - add a socket protocol handler
2582 * @ops: description of protocol
2583 *
1da177e4
LT
2584 * This function is called by a protocol handler that wants to
2585 * advertise its address family, and have it linked into the
e793c0f7 2586 * socket interface. The value ops->family corresponds to the
55737fda 2587 * socket system call protocol family.
1da177e4 2588 */
f0fd27d4 2589int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2590{
2591 int err;
2592
2593 if (ops->family >= NPROTO) {
3410f22e 2594 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
1da177e4
LT
2595 return -ENOBUFS;
2596 }
55737fda
SH
2597
2598 spin_lock(&net_family_lock);
190683a9
ED
2599 if (rcu_dereference_protected(net_families[ops->family],
2600 lockdep_is_held(&net_family_lock)))
55737fda
SH
2601 err = -EEXIST;
2602 else {
cf778b00 2603 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2604 err = 0;
2605 }
55737fda
SH
2606 spin_unlock(&net_family_lock);
2607
3410f22e 2608 pr_info("NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2609 return err;
2610}
c6d409cf 2611EXPORT_SYMBOL(sock_register);
1da177e4 2612
55737fda
SH
2613/**
2614 * sock_unregister - remove a protocol handler
2615 * @family: protocol family to remove
2616 *
1da177e4
LT
2617 * This function is called by a protocol handler that wants to
2618 * remove its address family, and have it unlinked from the
55737fda
SH
2619 * new socket creation.
2620 *
2621 * If protocol handler is a module, then it can use module reference
2622 * counts to protect against new references. If protocol handler is not
2623 * a module then it needs to provide its own protection in
2624 * the ops->create routine.
1da177e4 2625 */
f0fd27d4 2626void sock_unregister(int family)
1da177e4 2627{
f0fd27d4 2628 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2629
55737fda 2630 spin_lock(&net_family_lock);
a9b3cd7f 2631 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2632 spin_unlock(&net_family_lock);
2633
2634 synchronize_rcu();
2635
3410f22e 2636 pr_info("NET: Unregistered protocol family %d\n", family);
1da177e4 2637}
c6d409cf 2638EXPORT_SYMBOL(sock_unregister);
1da177e4 2639
77d76ea3 2640static int __init sock_init(void)
1da177e4 2641{
b3e19d92 2642 int err;
2ca794e5
EB
2643 /*
2644 * Initialize the network sysctl infrastructure.
2645 */
2646 err = net_sysctl_init();
2647 if (err)
2648 goto out;
b3e19d92 2649
1da177e4 2650 /*
89bddce5 2651 * Initialize skbuff SLAB cache
1da177e4
LT
2652 */
2653 skb_init();
1da177e4
LT
2654
2655 /*
89bddce5 2656 * Initialize the protocols module.
1da177e4
LT
2657 */
2658
2659 init_inodecache();
b3e19d92
NP
2660
2661 err = register_filesystem(&sock_fs_type);
2662 if (err)
2663 goto out_fs;
1da177e4 2664 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2665 if (IS_ERR(sock_mnt)) {
2666 err = PTR_ERR(sock_mnt);
2667 goto out_mount;
2668 }
77d76ea3
AK
2669
2670 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2671 */
2672
2673#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2674 err = netfilter_init();
2675 if (err)
2676 goto out;
1da177e4 2677#endif
cbeb321a 2678
408eccce 2679 ptp_classifier_init();
c1f19b51 2680
b3e19d92
NP
2681out:
2682 return err;
2683
2684out_mount:
2685 unregister_filesystem(&sock_fs_type);
2686out_fs:
2687 goto out;
1da177e4
LT
2688}
2689
77d76ea3
AK
2690core_initcall(sock_init); /* early initcall */
2691
1da177e4
LT
2692#ifdef CONFIG_PROC_FS
2693void socket_seq_show(struct seq_file *seq)
2694{
2695 int cpu;
2696 int counter = 0;
2697
6f912042 2698 for_each_possible_cpu(cpu)
89bddce5 2699 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2700
2701 /* It can be negative, by the way. 8) */
2702 if (counter < 0)
2703 counter = 0;
2704
2705 seq_printf(seq, "sockets: used %d\n", counter);
2706}
89bddce5 2707#endif /* CONFIG_PROC_FS */
1da177e4 2708
89bbfc95 2709#ifdef CONFIG_COMPAT
6b96018b 2710static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2711 unsigned int cmd, void __user *up)
7a229387 2712{
7a229387
AB
2713 mm_segment_t old_fs = get_fs();
2714 struct timeval ktv;
2715 int err;
2716
2717 set_fs(KERNEL_DS);
6b96018b 2718 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2719 set_fs(old_fs);
644595f8 2720 if (!err)
ed6fe9d6 2721 err = compat_put_timeval(&ktv, up);
644595f8 2722
7a229387
AB
2723 return err;
2724}
2725
6b96018b 2726static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2727 unsigned int cmd, void __user *up)
7a229387 2728{
7a229387
AB
2729 mm_segment_t old_fs = get_fs();
2730 struct timespec kts;
2731 int err;
2732
2733 set_fs(KERNEL_DS);
6b96018b 2734 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2735 set_fs(old_fs);
644595f8 2736 if (!err)
ed6fe9d6 2737 err = compat_put_timespec(&kts, up);
644595f8 2738
7a229387
AB
2739 return err;
2740}
2741
6b96018b 2742static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2743{
2744 struct ifreq __user *uifr;
2745 int err;
2746
2747 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2748 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2749 return -EFAULT;
2750
6b96018b 2751 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2752 if (err)
2753 return err;
2754
6b96018b 2755 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2756 return -EFAULT;
2757
2758 return 0;
2759}
2760
6b96018b 2761static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2762{
6b96018b 2763 struct compat_ifconf ifc32;
7a229387
AB
2764 struct ifconf ifc;
2765 struct ifconf __user *uifc;
6b96018b 2766 struct compat_ifreq __user *ifr32;
7a229387
AB
2767 struct ifreq __user *ifr;
2768 unsigned int i, j;
2769 int err;
2770
6b96018b 2771 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2772 return -EFAULT;
2773
43da5f2e 2774 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2775 if (ifc32.ifcbuf == 0) {
2776 ifc32.ifc_len = 0;
2777 ifc.ifc_len = 0;
2778 ifc.ifc_req = NULL;
2779 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2780 } else {
c6d409cf
ED
2781 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2782 sizeof(struct ifreq);
7a229387
AB
2783 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2784 ifc.ifc_len = len;
2785 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2786 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2787 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2788 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2789 return -EFAULT;
2790 ifr++;
2791 ifr32++;
2792 }
2793 }
2794 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2795 return -EFAULT;
2796
6b96018b 2797 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2798 if (err)
2799 return err;
2800
2801 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2802 return -EFAULT;
2803
2804 ifr = ifc.ifc_req;
2805 ifr32 = compat_ptr(ifc32.ifcbuf);
2806 for (i = 0, j = 0;
c6d409cf
ED
2807 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2808 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2809 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2810 return -EFAULT;
2811 ifr32++;
2812 ifr++;
2813 }
2814
2815 if (ifc32.ifcbuf == 0) {
2816 /* Translate from 64-bit structure multiple to
2817 * a 32-bit one.
2818 */
2819 i = ifc.ifc_len;
6b96018b 2820 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2821 ifc32.ifc_len = i;
2822 } else {
2823 ifc32.ifc_len = i;
2824 }
6b96018b 2825 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2826 return -EFAULT;
2827
2828 return 0;
2829}
2830
6b96018b 2831static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2832{
3a7da39d
BH
2833 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2834 bool convert_in = false, convert_out = false;
2835 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2836 struct ethtool_rxnfc __user *rxnfc;
7a229387 2837 struct ifreq __user *ifr;
3a7da39d
BH
2838 u32 rule_cnt = 0, actual_rule_cnt;
2839 u32 ethcmd;
7a229387 2840 u32 data;
3a7da39d 2841 int ret;
7a229387 2842
3a7da39d
BH
2843 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2844 return -EFAULT;
7a229387 2845
3a7da39d
BH
2846 compat_rxnfc = compat_ptr(data);
2847
2848 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2849 return -EFAULT;
2850
3a7da39d
BH
2851 /* Most ethtool structures are defined without padding.
2852 * Unfortunately struct ethtool_rxnfc is an exception.
2853 */
2854 switch (ethcmd) {
2855 default:
2856 break;
2857 case ETHTOOL_GRXCLSRLALL:
2858 /* Buffer size is variable */
2859 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2860 return -EFAULT;
2861 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2862 return -ENOMEM;
2863 buf_size += rule_cnt * sizeof(u32);
2864 /* fall through */
2865 case ETHTOOL_GRXRINGS:
2866 case ETHTOOL_GRXCLSRLCNT:
2867 case ETHTOOL_GRXCLSRULE:
55664f32 2868 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2869 convert_out = true;
2870 /* fall through */
2871 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2872 buf_size += sizeof(struct ethtool_rxnfc);
2873 convert_in = true;
2874 break;
2875 }
2876
2877 ifr = compat_alloc_user_space(buf_size);
954b1244 2878 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2879
2880 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2881 return -EFAULT;
2882
3a7da39d
BH
2883 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2884 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2885 return -EFAULT;
2886
3a7da39d 2887 if (convert_in) {
127fe533 2888 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2889 * fs.ring_cookie and at the end of fs, but nowhere else.
2890 */
127fe533
AD
2891 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2892 sizeof(compat_rxnfc->fs.m_ext) !=
2893 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2894 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2895 BUILD_BUG_ON(
2896 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2897 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2898 offsetof(struct ethtool_rxnfc, fs.location) -
2899 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2900
2901 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2902 (void __user *)(&rxnfc->fs.m_ext + 1) -
2903 (void __user *)rxnfc) ||
3a7da39d
BH
2904 copy_in_user(&rxnfc->fs.ring_cookie,
2905 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2906 (void __user *)(&rxnfc->fs.location + 1) -
2907 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2908 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2909 sizeof(rxnfc->rule_cnt)))
2910 return -EFAULT;
2911 }
2912
2913 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2914 if (ret)
2915 return ret;
2916
2917 if (convert_out) {
2918 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2919 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2920 (const void __user *)rxnfc) ||
3a7da39d
BH
2921 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2922 &rxnfc->fs.ring_cookie,
954b1244
SH
2923 (const void __user *)(&rxnfc->fs.location + 1) -
2924 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2925 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2926 sizeof(rxnfc->rule_cnt)))
2927 return -EFAULT;
2928
2929 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2930 /* As an optimisation, we only copy the actual
2931 * number of rules that the underlying
2932 * function returned. Since Mallory might
2933 * change the rule count in user memory, we
2934 * check that it is less than the rule count
2935 * originally given (as the user buffer size),
2936 * which has been range-checked.
2937 */
2938 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2939 return -EFAULT;
2940 if (actual_rule_cnt < rule_cnt)
2941 rule_cnt = actual_rule_cnt;
2942 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2943 &rxnfc->rule_locs[0],
2944 rule_cnt * sizeof(u32)))
2945 return -EFAULT;
2946 }
2947 }
2948
2949 return 0;
7a229387
AB
2950}
2951
7a50a240
AB
2952static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2953{
2954 void __user *uptr;
2955 compat_uptr_t uptr32;
2956 struct ifreq __user *uifr;
2957
c6d409cf 2958 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2959 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2960 return -EFAULT;
2961
2962 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2963 return -EFAULT;
2964
2965 uptr = compat_ptr(uptr32);
2966
2967 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2968 return -EFAULT;
2969
2970 return dev_ioctl(net, SIOCWANDEV, uifr);
2971}
2972
6b96018b
AB
2973static int bond_ioctl(struct net *net, unsigned int cmd,
2974 struct compat_ifreq __user *ifr32)
7a229387
AB
2975{
2976 struct ifreq kifr;
7a229387
AB
2977 mm_segment_t old_fs;
2978 int err;
7a229387
AB
2979
2980 switch (cmd) {
2981 case SIOCBONDENSLAVE:
2982 case SIOCBONDRELEASE:
2983 case SIOCBONDSETHWADDR:
2984 case SIOCBONDCHANGEACTIVE:
6b96018b 2985 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2986 return -EFAULT;
2987
2988 old_fs = get_fs();
c6d409cf 2989 set_fs(KERNEL_DS);
c3f52ae6 2990 err = dev_ioctl(net, cmd,
2991 (struct ifreq __user __force *) &kifr);
c6d409cf 2992 set_fs(old_fs);
7a229387
AB
2993
2994 return err;
7a229387 2995 default:
07d106d0 2996 return -ENOIOCTLCMD;
ccbd6a5a 2997 }
7a229387
AB
2998}
2999
590d4693
BH
3000/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
3001static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 3002 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
3003{
3004 struct ifreq __user *u_ifreq64;
7a229387
AB
3005 char tmp_buf[IFNAMSIZ];
3006 void __user *data64;
3007 u32 data32;
3008
3009 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
3010 IFNAMSIZ))
3011 return -EFAULT;
417c3522 3012 if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
7a229387
AB
3013 return -EFAULT;
3014 data64 = compat_ptr(data32);
3015
3016 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
3017
7a229387
AB
3018 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
3019 IFNAMSIZ))
3020 return -EFAULT;
417c3522 3021 if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
7a229387
AB
3022 return -EFAULT;
3023
6b96018b 3024 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
3025}
3026
6b96018b
AB
3027static int dev_ifsioc(struct net *net, struct socket *sock,
3028 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 3029{
a2116ed2 3030 struct ifreq __user *uifr;
7a229387
AB
3031 int err;
3032
a2116ed2
AB
3033 uifr = compat_alloc_user_space(sizeof(*uifr));
3034 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3035 return -EFAULT;
3036
3037 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3038
7a229387
AB
3039 if (!err) {
3040 switch (cmd) {
3041 case SIOCGIFFLAGS:
3042 case SIOCGIFMETRIC:
3043 case SIOCGIFMTU:
3044 case SIOCGIFMEM:
3045 case SIOCGIFHWADDR:
3046 case SIOCGIFINDEX:
3047 case SIOCGIFADDR:
3048 case SIOCGIFBRDADDR:
3049 case SIOCGIFDSTADDR:
3050 case SIOCGIFNETMASK:
fab2532b 3051 case SIOCGIFPFLAGS:
7a229387 3052 case SIOCGIFTXQLEN:
fab2532b
AB
3053 case SIOCGMIIPHY:
3054 case SIOCGMIIREG:
a2116ed2 3055 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
3056 err = -EFAULT;
3057 break;
3058 }
3059 }
3060 return err;
3061}
3062
a2116ed2
AB
3063static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3064 struct compat_ifreq __user *uifr32)
3065{
3066 struct ifreq ifr;
3067 struct compat_ifmap __user *uifmap32;
3068 mm_segment_t old_fs;
3069 int err;
3070
3071 uifmap32 = &uifr32->ifr_ifru.ifru_map;
3072 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
3073 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3074 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3075 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3076 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
3077 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
3078 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
3079 if (err)
3080 return -EFAULT;
3081
3082 old_fs = get_fs();
c6d409cf 3083 set_fs(KERNEL_DS);
c3f52ae6 3084 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3085 set_fs(old_fs);
a2116ed2
AB
3086
3087 if (cmd == SIOCGIFMAP && !err) {
3088 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
3089 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3090 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3091 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3092 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
3093 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
3094 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
3095 if (err)
3096 err = -EFAULT;
3097 }
3098 return err;
3099}
3100
7a229387 3101struct rtentry32 {
c6d409cf 3102 u32 rt_pad1;
7a229387
AB
3103 struct sockaddr rt_dst; /* target address */
3104 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3105 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3106 unsigned short rt_flags;
3107 short rt_pad2;
3108 u32 rt_pad3;
3109 unsigned char rt_tos;
3110 unsigned char rt_class;
3111 short rt_pad4;
3112 short rt_metric; /* +1 for binary compatibility! */
7a229387 3113 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3114 u32 rt_mtu; /* per route MTU/Window */
3115 u32 rt_window; /* Window clamping */
7a229387
AB
3116 unsigned short rt_irtt; /* Initial RTT */
3117};
3118
3119struct in6_rtmsg32 {
3120 struct in6_addr rtmsg_dst;
3121 struct in6_addr rtmsg_src;
3122 struct in6_addr rtmsg_gateway;
3123 u32 rtmsg_type;
3124 u16 rtmsg_dst_len;
3125 u16 rtmsg_src_len;
3126 u32 rtmsg_metric;
3127 u32 rtmsg_info;
3128 u32 rtmsg_flags;
3129 s32 rtmsg_ifindex;
3130};
3131
6b96018b
AB
3132static int routing_ioctl(struct net *net, struct socket *sock,
3133 unsigned int cmd, void __user *argp)
7a229387
AB
3134{
3135 int ret;
3136 void *r = NULL;
3137 struct in6_rtmsg r6;
3138 struct rtentry r4;
3139 char devname[16];
3140 u32 rtdev;
3141 mm_segment_t old_fs = get_fs();
3142
6b96018b
AB
3143 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3144 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3145 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3146 3 * sizeof(struct in6_addr));
3ddc5b46
MD
3147 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3148 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3149 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3150 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3151 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3152 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3153 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3154
3155 r = (void *) &r6;
3156 } else { /* ipv4 */
6b96018b 3157 struct rtentry32 __user *ur4 = argp;
c6d409cf 3158 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3159 3 * sizeof(struct sockaddr));
3ddc5b46
MD
3160 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3161 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3162 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3163 ret |= get_user(r4.rt_window, &(ur4->rt_window));
3164 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3165 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 3166 if (rtdev) {
c6d409cf 3167 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3168 r4.rt_dev = (char __user __force *)devname;
3169 devname[15] = 0;
7a229387
AB
3170 } else
3171 r4.rt_dev = NULL;
3172
3173 r = (void *) &r4;
3174 }
3175
3176 if (ret) {
3177 ret = -EFAULT;
3178 goto out;
3179 }
3180
c6d409cf 3181 set_fs(KERNEL_DS);
6b96018b 3182 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3183 set_fs(old_fs);
7a229387
AB
3184
3185out:
7a229387
AB
3186 return ret;
3187}
3188
3189/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3190 * for some operations; this forces use of the newer bridge-utils that
25985edc 3191 * use compatible ioctls
7a229387 3192 */
6b96018b 3193static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3194{
6b96018b 3195 compat_ulong_t tmp;
7a229387 3196
6b96018b 3197 if (get_user(tmp, argp))
7a229387
AB
3198 return -EFAULT;
3199 if (tmp == BRCTL_GET_VERSION)
3200 return BRCTL_VERSION + 1;
3201 return -EINVAL;
3202}
3203
6b96018b
AB
3204static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3205 unsigned int cmd, unsigned long arg)
3206{
3207 void __user *argp = compat_ptr(arg);
3208 struct sock *sk = sock->sk;
3209 struct net *net = sock_net(sk);
7a229387 3210
6b96018b 3211 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3212 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3213
3214 switch (cmd) {
3215 case SIOCSIFBR:
3216 case SIOCGIFBR:
3217 return old_bridge_ioctl(argp);
3218 case SIOCGIFNAME:
3219 return dev_ifname32(net, argp);
3220 case SIOCGIFCONF:
3221 return dev_ifconf(net, argp);
3222 case SIOCETHTOOL:
3223 return ethtool_ioctl(net, argp);
7a50a240
AB
3224 case SIOCWANDEV:
3225 return compat_siocwandev(net, argp);
a2116ed2
AB
3226 case SIOCGIFMAP:
3227 case SIOCSIFMAP:
3228 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3229 case SIOCBONDENSLAVE:
3230 case SIOCBONDRELEASE:
3231 case SIOCBONDSETHWADDR:
6b96018b
AB
3232 case SIOCBONDCHANGEACTIVE:
3233 return bond_ioctl(net, cmd, argp);
3234 case SIOCADDRT:
3235 case SIOCDELRT:
3236 return routing_ioctl(net, sock, cmd, argp);
3237 case SIOCGSTAMP:
3238 return do_siocgstamp(net, sock, cmd, argp);
3239 case SIOCGSTAMPNS:
3240 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3241 case SIOCBONDSLAVEINFOQUERY:
3242 case SIOCBONDINFOQUERY:
a2116ed2 3243 case SIOCSHWTSTAMP:
fd468c74 3244 case SIOCGHWTSTAMP:
590d4693 3245 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3246
3247 case FIOSETOWN:
3248 case SIOCSPGRP:
3249 case FIOGETOWN:
3250 case SIOCGPGRP:
3251 case SIOCBRADDBR:
3252 case SIOCBRDELBR:
3253 case SIOCGIFVLAN:
3254 case SIOCSIFVLAN:
3255 case SIOCADDDLCI:
3256 case SIOCDELDLCI:
3257 return sock_ioctl(file, cmd, arg);
3258
3259 case SIOCGIFFLAGS:
3260 case SIOCSIFFLAGS:
3261 case SIOCGIFMETRIC:
3262 case SIOCSIFMETRIC:
3263 case SIOCGIFMTU:
3264 case SIOCSIFMTU:
3265 case SIOCGIFMEM:
3266 case SIOCSIFMEM:
3267 case SIOCGIFHWADDR:
3268 case SIOCSIFHWADDR:
3269 case SIOCADDMULTI:
3270 case SIOCDELMULTI:
3271 case SIOCGIFINDEX:
6b96018b
AB
3272 case SIOCGIFADDR:
3273 case SIOCSIFADDR:
3274 case SIOCSIFHWBROADCAST:
6b96018b 3275 case SIOCDIFADDR:
6b96018b
AB
3276 case SIOCGIFBRDADDR:
3277 case SIOCSIFBRDADDR:
3278 case SIOCGIFDSTADDR:
3279 case SIOCSIFDSTADDR:
3280 case SIOCGIFNETMASK:
3281 case SIOCSIFNETMASK:
3282 case SIOCSIFPFLAGS:
3283 case SIOCGIFPFLAGS:
3284 case SIOCGIFTXQLEN:
3285 case SIOCSIFTXQLEN:
3286 case SIOCBRADDIF:
3287 case SIOCBRDELIF:
9177efd3
AB
3288 case SIOCSIFNAME:
3289 case SIOCGMIIPHY:
3290 case SIOCGMIIREG:
3291 case SIOCSMIIREG:
6b96018b 3292 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3293
6b96018b
AB
3294 case SIOCSARP:
3295 case SIOCGARP:
3296 case SIOCDARP:
6b96018b 3297 case SIOCATMARK:
9177efd3
AB
3298 return sock_do_ioctl(net, sock, cmd, arg);
3299 }
3300
6b96018b
AB
3301 return -ENOIOCTLCMD;
3302}
7a229387 3303
95c96174 3304static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3305 unsigned long arg)
89bbfc95
SP
3306{
3307 struct socket *sock = file->private_data;
3308 int ret = -ENOIOCTLCMD;
87de87d5
DM
3309 struct sock *sk;
3310 struct net *net;
3311
3312 sk = sock->sk;
3313 net = sock_net(sk);
89bbfc95
SP
3314
3315 if (sock->ops->compat_ioctl)
3316 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3317
87de87d5
DM
3318 if (ret == -ENOIOCTLCMD &&
3319 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3320 ret = compat_wext_handle_ioctl(net, cmd, arg);
3321
6b96018b
AB
3322 if (ret == -ENOIOCTLCMD)
3323 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3324
89bbfc95
SP
3325 return ret;
3326}
3327#endif
3328
ac5a488e
SS
3329int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3330{
3331 return sock->ops->bind(sock, addr, addrlen);
3332}
c6d409cf 3333EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3334
3335int kernel_listen(struct socket *sock, int backlog)
3336{
3337 return sock->ops->listen(sock, backlog);
3338}
c6d409cf 3339EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3340
3341int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3342{
3343 struct sock *sk = sock->sk;
3344 int err;
3345
3346 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3347 newsock);
3348 if (err < 0)
3349 goto done;
3350
3351 err = sock->ops->accept(sock, *newsock, flags);
3352 if (err < 0) {
3353 sock_release(*newsock);
fa8705b0 3354 *newsock = NULL;
ac5a488e
SS
3355 goto done;
3356 }
3357
3358 (*newsock)->ops = sock->ops;
1b08534e 3359 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3360
3361done:
3362 return err;
3363}
c6d409cf 3364EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3365
3366int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3367 int flags)
ac5a488e
SS
3368{
3369 return sock->ops->connect(sock, addr, addrlen, flags);
3370}
c6d409cf 3371EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3372
3373int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3374 int *addrlen)
3375{
3376 return sock->ops->getname(sock, addr, addrlen, 0);
3377}
c6d409cf 3378EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3379
3380int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3381 int *addrlen)
3382{
3383 return sock->ops->getname(sock, addr, addrlen, 1);
3384}
c6d409cf 3385EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3386
3387int kernel_getsockopt(struct socket *sock, int level, int optname,
3388 char *optval, int *optlen)
3389{
3390 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3391 char __user *uoptval;
3392 int __user *uoptlen;
ac5a488e
SS
3393 int err;
3394
fb8621bb
NK
3395 uoptval = (char __user __force *) optval;
3396 uoptlen = (int __user __force *) optlen;
3397
ac5a488e
SS
3398 set_fs(KERNEL_DS);
3399 if (level == SOL_SOCKET)
fb8621bb 3400 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3401 else
fb8621bb
NK
3402 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3403 uoptlen);
ac5a488e
SS
3404 set_fs(oldfs);
3405 return err;
3406}
c6d409cf 3407EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3408
3409int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3410 char *optval, unsigned int optlen)
ac5a488e
SS
3411{
3412 mm_segment_t oldfs = get_fs();
fb8621bb 3413 char __user *uoptval;
ac5a488e
SS
3414 int err;
3415
fb8621bb
NK
3416 uoptval = (char __user __force *) optval;
3417
ac5a488e
SS
3418 set_fs(KERNEL_DS);
3419 if (level == SOL_SOCKET)
fb8621bb 3420 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3421 else
fb8621bb 3422 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3423 optlen);
3424 set_fs(oldfs);
3425 return err;
3426}
c6d409cf 3427EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3428
3429int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3430 size_t size, int flags)
3431{
3432 if (sock->ops->sendpage)
3433 return sock->ops->sendpage(sock, page, offset, size, flags);
3434
3435 return sock_no_sendpage(sock, page, offset, size, flags);
3436}
c6d409cf 3437EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3438
3439int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3440{
3441 mm_segment_t oldfs = get_fs();
3442 int err;
3443
3444 set_fs(KERNEL_DS);
3445 err = sock->ops->ioctl(sock, cmd, arg);
3446 set_fs(oldfs);
3447
3448 return err;
3449}
c6d409cf 3450EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3451
91cf45f0
TM
3452int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3453{
3454 return sock->ops->shutdown(sock, how);
3455}
91cf45f0 3456EXPORT_SYMBOL(kernel_sock_shutdown);