crypto: switch af_alg_make_sg() to iov_iter
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
408eccce 75#include <linux/ptp_classify.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
600e1779 91#include <linux/xattr.h>
1da177e4
LT
92
93#include <asm/uaccess.h>
94#include <asm/unistd.h>
95
96#include <net/compat.h>
87de87d5 97#include <net/wext.h>
f8451725 98#include <net/cls_cgroup.h>
1da177e4
LT
99
100#include <net/sock.h>
101#include <linux/netfilter.h>
102
6b96018b
AB
103#include <linux/if_tun.h>
104#include <linux/ipv6_route.h>
105#include <linux/route.h>
6b96018b
AB
106#include <linux/sockios.h>
107#include <linux/atalk.h>
076bb0c8 108#include <net/busy_poll.h>
f24b9be5 109#include <linux/errqueue.h>
06021292 110
e0d1095a 111#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
112unsigned int sysctl_net_busy_read __read_mostly;
113unsigned int sysctl_net_busy_poll __read_mostly;
06021292 114#endif
6b96018b 115
027445c3
BP
116static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
117 unsigned long nr_segs, loff_t pos);
118static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
119 unsigned long nr_segs, loff_t pos);
89bddce5 120static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
121
122static int sock_close(struct inode *inode, struct file *file);
123static unsigned int sock_poll(struct file *file,
124 struct poll_table_struct *wait);
89bddce5 125static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
126#ifdef CONFIG_COMPAT
127static long compat_sock_ioctl(struct file *file,
89bddce5 128 unsigned int cmd, unsigned long arg);
89bbfc95 129#endif
1da177e4 130static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
131static ssize_t sock_sendpage(struct file *file, struct page *page,
132 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 133static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 134 struct pipe_inode_info *pipe, size_t len,
9c55e01c 135 unsigned int flags);
1da177e4 136
1da177e4
LT
137/*
138 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
139 * in the operation structures but are done directly via the socketcall() multiplexor.
140 */
141
da7071d7 142static const struct file_operations socket_file_ops = {
1da177e4
LT
143 .owner = THIS_MODULE,
144 .llseek = no_llseek,
145 .aio_read = sock_aio_read,
146 .aio_write = sock_aio_write,
147 .poll = sock_poll,
148 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
149#ifdef CONFIG_COMPAT
150 .compat_ioctl = compat_sock_ioctl,
151#endif
1da177e4 152 .mmap = sock_mmap,
1da177e4
LT
153 .release = sock_close,
154 .fasync = sock_fasync,
5274f052
JA
155 .sendpage = sock_sendpage,
156 .splice_write = generic_splice_sendpage,
9c55e01c 157 .splice_read = sock_splice_read,
1da177e4
LT
158};
159
160/*
161 * The protocol list. Each protocol is registered in here.
162 */
163
1da177e4 164static DEFINE_SPINLOCK(net_family_lock);
190683a9 165static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 166
1da177e4
LT
167/*
168 * Statistics counters of the socket lists
169 */
170
c6d409cf 171static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
172
173/*
89bddce5
SH
174 * Support routines.
175 * Move socket addresses back and forth across the kernel/user
176 * divide and look after the messy bits.
1da177e4
LT
177 */
178
1da177e4
LT
179/**
180 * move_addr_to_kernel - copy a socket address into kernel space
181 * @uaddr: Address in user space
182 * @kaddr: Address in kernel space
183 * @ulen: Length in user space
184 *
185 * The address is copied into kernel space. If the provided address is
186 * too long an error code of -EINVAL is returned. If the copy gives
187 * invalid addresses -EFAULT is returned. On a success 0 is returned.
188 */
189
43db362d 190int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 191{
230b1839 192 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 193 return -EINVAL;
89bddce5 194 if (ulen == 0)
1da177e4 195 return 0;
89bddce5 196 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 197 return -EFAULT;
3ec3b2fb 198 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
199}
200
201/**
202 * move_addr_to_user - copy an address to user space
203 * @kaddr: kernel space address
204 * @klen: length of address in kernel
205 * @uaddr: user space address
206 * @ulen: pointer to user length field
207 *
208 * The value pointed to by ulen on entry is the buffer length available.
209 * This is overwritten with the buffer space used. -EINVAL is returned
210 * if an overlong buffer is specified or a negative buffer size. -EFAULT
211 * is returned if either the buffer or the length field are not
212 * accessible.
213 * After copying the data up to the limit the user specifies, the true
214 * length of the data is written over the length limit the user
215 * specified. Zero is returned for a success.
216 */
89bddce5 217
43db362d 218static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 219 void __user *uaddr, int __user *ulen)
1da177e4
LT
220{
221 int err;
222 int len;
223
68c6beb3 224 BUG_ON(klen > sizeof(struct sockaddr_storage));
89bddce5
SH
225 err = get_user(len, ulen);
226 if (err)
1da177e4 227 return err;
89bddce5
SH
228 if (len > klen)
229 len = klen;
68c6beb3 230 if (len < 0)
1da177e4 231 return -EINVAL;
89bddce5 232 if (len) {
d6fe3945
SG
233 if (audit_sockaddr(klen, kaddr))
234 return -ENOMEM;
89bddce5 235 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
236 return -EFAULT;
237 }
238 /*
89bddce5
SH
239 * "fromlen shall refer to the value before truncation.."
240 * 1003.1g
1da177e4
LT
241 */
242 return __put_user(klen, ulen);
243}
244
e18b890b 245static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
246
247static struct inode *sock_alloc_inode(struct super_block *sb)
248{
249 struct socket_alloc *ei;
eaefd110 250 struct socket_wq *wq;
89bddce5 251
e94b1766 252 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
253 if (!ei)
254 return NULL;
eaefd110
ED
255 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
256 if (!wq) {
43815482
ED
257 kmem_cache_free(sock_inode_cachep, ei);
258 return NULL;
259 }
eaefd110
ED
260 init_waitqueue_head(&wq->wait);
261 wq->fasync_list = NULL;
262 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 263
1da177e4
LT
264 ei->socket.state = SS_UNCONNECTED;
265 ei->socket.flags = 0;
266 ei->socket.ops = NULL;
267 ei->socket.sk = NULL;
268 ei->socket.file = NULL;
1da177e4
LT
269
270 return &ei->vfs_inode;
271}
272
273static void sock_destroy_inode(struct inode *inode)
274{
43815482 275 struct socket_alloc *ei;
eaefd110 276 struct socket_wq *wq;
43815482
ED
277
278 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 279 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 280 kfree_rcu(wq, rcu);
43815482 281 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
282}
283
51cc5068 284static void init_once(void *foo)
1da177e4 285{
89bddce5 286 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 287
a35afb83 288 inode_init_once(&ei->vfs_inode);
1da177e4 289}
89bddce5 290
1da177e4
LT
291static int init_inodecache(void)
292{
293 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
294 sizeof(struct socket_alloc),
295 0,
296 (SLAB_HWCACHE_ALIGN |
297 SLAB_RECLAIM_ACCOUNT |
298 SLAB_MEM_SPREAD),
20c2df83 299 init_once);
1da177e4
LT
300 if (sock_inode_cachep == NULL)
301 return -ENOMEM;
302 return 0;
303}
304
b87221de 305static const struct super_operations sockfs_ops = {
c6d409cf
ED
306 .alloc_inode = sock_alloc_inode,
307 .destroy_inode = sock_destroy_inode,
308 .statfs = simple_statfs,
1da177e4
LT
309};
310
c23fbb6b
ED
311/*
312 * sockfs_dname() is called from d_path().
313 */
314static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
315{
316 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
317 dentry->d_inode->i_ino);
318}
319
3ba13d17 320static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 321 .d_dname = sockfs_dname,
1da177e4
LT
322};
323
c74a1cbb
AV
324static struct dentry *sockfs_mount(struct file_system_type *fs_type,
325 int flags, const char *dev_name, void *data)
326{
327 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
328 &sockfs_dentry_operations, SOCKFS_MAGIC);
329}
330
331static struct vfsmount *sock_mnt __read_mostly;
332
333static struct file_system_type sock_fs_type = {
334 .name = "sockfs",
335 .mount = sockfs_mount,
336 .kill_sb = kill_anon_super,
337};
338
1da177e4
LT
339/*
340 * Obtains the first available file descriptor and sets it up for use.
341 *
39d8c1b6
DM
342 * These functions create file structures and maps them to fd space
343 * of the current process. On success it returns file descriptor
1da177e4
LT
344 * and file struct implicitly stored in sock->file.
345 * Note that another thread may close file descriptor before we return
346 * from this function. We use the fact that now we do not refer
347 * to socket after mapping. If one day we will need it, this
348 * function will increment ref. count on file by 1.
349 *
350 * In any case returned fd MAY BE not valid!
351 * This race condition is unavoidable
352 * with shared fd spaces, we cannot solve it inside kernel,
353 * but we take care of internal coherence yet.
354 */
355
aab174f0 356struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 357{
7cbe66b6 358 struct qstr name = { .name = "" };
2c48b9c4 359 struct path path;
7cbe66b6 360 struct file *file;
1da177e4 361
600e1779
MY
362 if (dname) {
363 name.name = dname;
364 name.len = strlen(name.name);
365 } else if (sock->sk) {
366 name.name = sock->sk->sk_prot_creator->name;
367 name.len = strlen(name.name);
368 }
4b936885 369 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
370 if (unlikely(!path.dentry))
371 return ERR_PTR(-ENOMEM);
2c48b9c4 372 path.mnt = mntget(sock_mnt);
39d8c1b6 373
2c48b9c4 374 d_instantiate(path.dentry, SOCK_INODE(sock));
39d8c1b6 375
2c48b9c4 376 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 377 &socket_file_ops);
39b65252 378 if (unlikely(IS_ERR(file))) {
cc3808f8 379 /* drop dentry, keep inode */
7de9c6ee 380 ihold(path.dentry->d_inode);
2c48b9c4 381 path_put(&path);
39b65252 382 return file;
cc3808f8
AV
383 }
384
385 sock->file = file;
77d27200 386 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 387 file->private_data = sock;
28407630 388 return file;
39d8c1b6 389}
56b31d1c 390EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 391
56b31d1c 392static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
393{
394 struct file *newfile;
28407630
AV
395 int fd = get_unused_fd_flags(flags);
396 if (unlikely(fd < 0))
397 return fd;
39d8c1b6 398
aab174f0 399 newfile = sock_alloc_file(sock, flags, NULL);
28407630 400 if (likely(!IS_ERR(newfile))) {
39d8c1b6 401 fd_install(fd, newfile);
28407630
AV
402 return fd;
403 }
7cbe66b6 404
28407630
AV
405 put_unused_fd(fd);
406 return PTR_ERR(newfile);
1da177e4
LT
407}
408
406a3c63 409struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 410{
6cb153ca
BL
411 if (file->f_op == &socket_file_ops)
412 return file->private_data; /* set in sock_map_fd */
413
23bb80d2
ED
414 *err = -ENOTSOCK;
415 return NULL;
6cb153ca 416}
406a3c63 417EXPORT_SYMBOL(sock_from_file);
6cb153ca 418
1da177e4 419/**
c6d409cf 420 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
421 * @fd: file handle
422 * @err: pointer to an error code return
423 *
424 * The file handle passed in is locked and the socket it is bound
425 * too is returned. If an error occurs the err pointer is overwritten
426 * with a negative errno code and NULL is returned. The function checks
427 * for both invalid handles and passing a handle which is not a socket.
428 *
429 * On a success the socket object pointer is returned.
430 */
431
432struct socket *sockfd_lookup(int fd, int *err)
433{
434 struct file *file;
1da177e4
LT
435 struct socket *sock;
436
89bddce5
SH
437 file = fget(fd);
438 if (!file) {
1da177e4
LT
439 *err = -EBADF;
440 return NULL;
441 }
89bddce5 442
6cb153ca
BL
443 sock = sock_from_file(file, err);
444 if (!sock)
1da177e4 445 fput(file);
6cb153ca
BL
446 return sock;
447}
c6d409cf 448EXPORT_SYMBOL(sockfd_lookup);
1da177e4 449
6cb153ca
BL
450static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
451{
00e188ef 452 struct fd f = fdget(fd);
6cb153ca
BL
453 struct socket *sock;
454
3672558c 455 *err = -EBADF;
00e188ef
AV
456 if (f.file) {
457 sock = sock_from_file(f.file, err);
458 if (likely(sock)) {
459 *fput_needed = f.flags;
6cb153ca 460 return sock;
00e188ef
AV
461 }
462 fdput(f);
1da177e4 463 }
6cb153ca 464 return NULL;
1da177e4
LT
465}
466
600e1779
MY
467#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
468#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
469#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
470static ssize_t sockfs_getxattr(struct dentry *dentry,
471 const char *name, void *value, size_t size)
472{
473 const char *proto_name;
474 size_t proto_size;
475 int error;
476
477 error = -ENODATA;
478 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
479 proto_name = dentry->d_name.name;
480 proto_size = strlen(proto_name);
481
482 if (value) {
483 error = -ERANGE;
484 if (proto_size + 1 > size)
485 goto out;
486
487 strncpy(value, proto_name, proto_size + 1);
488 }
489 error = proto_size + 1;
490 }
491
492out:
493 return error;
494}
495
496static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
497 size_t size)
498{
499 ssize_t len;
500 ssize_t used = 0;
501
502 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
503 if (len < 0)
504 return len;
505 used += len;
506 if (buffer) {
507 if (size < used)
508 return -ERANGE;
509 buffer += len;
510 }
511
512 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
513 used += len;
514 if (buffer) {
515 if (size < used)
516 return -ERANGE;
517 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
518 buffer += len;
519 }
520
521 return used;
522}
523
524static const struct inode_operations sockfs_inode_ops = {
525 .getxattr = sockfs_getxattr,
526 .listxattr = sockfs_listxattr,
527};
528
1da177e4
LT
529/**
530 * sock_alloc - allocate a socket
89bddce5 531 *
1da177e4
LT
532 * Allocate a new inode and socket object. The two are bound together
533 * and initialised. The socket is then returned. If we are out of inodes
534 * NULL is returned.
535 */
536
537static struct socket *sock_alloc(void)
538{
89bddce5
SH
539 struct inode *inode;
540 struct socket *sock;
1da177e4 541
a209dfc7 542 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
543 if (!inode)
544 return NULL;
545
546 sock = SOCKET_I(inode);
547
29a020d3 548 kmemcheck_annotate_bitfield(sock, type);
85fe4025 549 inode->i_ino = get_next_ino();
89bddce5 550 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
551 inode->i_uid = current_fsuid();
552 inode->i_gid = current_fsgid();
600e1779 553 inode->i_op = &sockfs_inode_ops;
1da177e4 554
19e8d69c 555 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
556 return sock;
557}
558
1da177e4
LT
559/**
560 * sock_release - close a socket
561 * @sock: socket to close
562 *
563 * The socket is released from the protocol stack if it has a release
564 * callback, and the inode is then released if the socket is bound to
89bddce5 565 * an inode not a file.
1da177e4 566 */
89bddce5 567
1da177e4
LT
568void sock_release(struct socket *sock)
569{
570 if (sock->ops) {
571 struct module *owner = sock->ops->owner;
572
573 sock->ops->release(sock);
574 sock->ops = NULL;
575 module_put(owner);
576 }
577
eaefd110 578 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
3410f22e 579 pr_err("%s: fasync list not empty!\n", __func__);
1da177e4 580
b09e786b
MP
581 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
582 return;
583
19e8d69c 584 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
585 if (!sock->file) {
586 iput(SOCK_INODE(sock));
587 return;
588 }
89bddce5 589 sock->file = NULL;
1da177e4 590}
c6d409cf 591EXPORT_SYMBOL(sock_release);
1da177e4 592
67cc0d40 593void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags)
20d49473 594{
140c55d4
ED
595 u8 flags = *tx_flags;
596
b9f40e21 597 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
140c55d4
ED
598 flags |= SKBTX_HW_TSTAMP;
599
b9f40e21 600 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
140c55d4
ED
601 flags |= SKBTX_SW_TSTAMP;
602
e7fd2885 603 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)
140c55d4
ED
604 flags |= SKBTX_SCHED_TSTAMP;
605
e1c8a607 606 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)
140c55d4 607 flags |= SKBTX_ACK_TSTAMP;
e7fd2885 608
140c55d4 609 *tx_flags = flags;
20d49473 610}
67cc0d40 611EXPORT_SYMBOL(__sock_tx_timestamp);
20d49473 612
228e548e
AB
613static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
614 struct msghdr *msg, size_t size)
1da177e4 615{
1da177e4
LT
616 return sock->ops->sendmsg(iocb, sock, msg, size);
617}
618
228e548e
AB
619static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
620 struct msghdr *msg, size_t size)
621{
622 int err = security_socket_sendmsg(sock, msg, size);
623
624 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
625}
626
0cf00c6f
GZ
627static int do_sock_sendmsg(struct socket *sock, struct msghdr *msg,
628 size_t size, bool nosec)
1da177e4
LT
629{
630 struct kiocb iocb;
1da177e4
LT
631 int ret;
632
633 init_sync_kiocb(&iocb, NULL);
0cf00c6f
GZ
634 ret = nosec ? __sock_sendmsg_nosec(&iocb, sock, msg, size) :
635 __sock_sendmsg(&iocb, sock, msg, size);
1da177e4
LT
636 if (-EIOCBQUEUED == ret)
637 ret = wait_on_sync_kiocb(&iocb);
638 return ret;
639}
0cf00c6f
GZ
640
641int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
642{
643 return do_sock_sendmsg(sock, msg, size, false);
644}
c6d409cf 645EXPORT_SYMBOL(sock_sendmsg);
1da177e4 646
894dc24c 647static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e 648{
0cf00c6f 649 return do_sock_sendmsg(sock, msg, size, true);
228e548e
AB
650}
651
1da177e4
LT
652int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
653 struct kvec *vec, size_t num, size_t size)
654{
655 mm_segment_t oldfs = get_fs();
656 int result;
657
658 set_fs(KERNEL_DS);
659 /*
660 * the following is safe, since for compiler definitions of kvec and
661 * iovec are identical, yielding the same in-core layout and alignment
662 */
c0371da6 663 iov_iter_init(&msg->msg_iter, WRITE, (struct iovec *)vec, num, size);
1da177e4
LT
664 result = sock_sendmsg(sock, msg, size);
665 set_fs(oldfs);
666 return result;
667}
c6d409cf 668EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 669
92f37fd2
ED
670/*
671 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
672 */
673void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
674 struct sk_buff *skb)
675{
20d49473 676 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
f24b9be5 677 struct scm_timestamping tss;
20d49473
PO
678 int empty = 1;
679 struct skb_shared_hwtstamps *shhwtstamps =
680 skb_hwtstamps(skb);
681
682 /* Race occurred between timestamp enabling and packet
683 receiving. Fill in the current time for now. */
684 if (need_software_tstamp && skb->tstamp.tv64 == 0)
685 __net_timestamp(skb);
686
687 if (need_software_tstamp) {
688 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
689 struct timeval tv;
690 skb_get_timestamp(skb, &tv);
691 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
692 sizeof(tv), &tv);
693 } else {
f24b9be5
WB
694 struct timespec ts;
695 skb_get_timestampns(skb, &ts);
20d49473 696 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
f24b9be5 697 sizeof(ts), &ts);
20d49473
PO
698 }
699 }
700
f24b9be5 701 memset(&tss, 0, sizeof(tss));
c199105d 702 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
f24b9be5 703 ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
20d49473 704 empty = 0;
4d276eb6 705 if (shhwtstamps &&
b9f40e21 706 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
f24b9be5 707 ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
4d276eb6 708 empty = 0;
20d49473
PO
709 if (!empty)
710 put_cmsg(msg, SOL_SOCKET,
f24b9be5 711 SCM_TIMESTAMPING, sizeof(tss), &tss);
92f37fd2 712}
7c81fd8b
ACM
713EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
714
6e3e939f
JB
715void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
716 struct sk_buff *skb)
717{
718 int ack;
719
720 if (!sock_flag(sk, SOCK_WIFI_STATUS))
721 return;
722 if (!skb->wifi_acked_valid)
723 return;
724
725 ack = skb->wifi_acked;
726
727 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
728}
729EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
730
11165f14 731static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
732 struct sk_buff *skb)
3b885787
NH
733{
734 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
735 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
736 sizeof(__u32), &skb->dropcount);
737}
738
767dd033 739void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
740 struct sk_buff *skb)
741{
742 sock_recv_timestamp(msg, sk, skb);
743 sock_recv_drops(msg, sk, skb);
744}
767dd033 745EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 746
a2e27255
ACM
747static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
748 struct msghdr *msg, size_t size, int flags)
1da177e4 749{
1da177e4
LT
750 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
751}
752
a2e27255
ACM
753static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
754 struct msghdr *msg, size_t size, int flags)
755{
756 int err = security_socket_recvmsg(sock, msg, size, flags);
757
758 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
759}
760
89bddce5 761int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
762 size_t size, int flags)
763{
764 struct kiocb iocb;
1da177e4
LT
765 int ret;
766
89bddce5 767 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
768 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
769 if (-EIOCBQUEUED == ret)
770 ret = wait_on_sync_kiocb(&iocb);
771 return ret;
772}
c6d409cf 773EXPORT_SYMBOL(sock_recvmsg);
1da177e4 774
a2e27255
ACM
775static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
776 size_t size, int flags)
777{
778 struct kiocb iocb;
a2e27255
ACM
779 int ret;
780
781 init_sync_kiocb(&iocb, NULL);
a2e27255
ACM
782 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
783 if (-EIOCBQUEUED == ret)
784 ret = wait_on_sync_kiocb(&iocb);
785 return ret;
786}
787
c1249c0a
ML
788/**
789 * kernel_recvmsg - Receive a message from a socket (kernel space)
790 * @sock: The socket to receive the message from
791 * @msg: Received message
792 * @vec: Input s/g array for message data
793 * @num: Size of input s/g array
794 * @size: Number of bytes to read
795 * @flags: Message flags (MSG_DONTWAIT, etc...)
796 *
797 * On return the msg structure contains the scatter/gather array passed in the
798 * vec argument. The array is modified so that it consists of the unfilled
799 * portion of the original array.
800 *
801 * The returned value is the total number of bytes received, or an error.
802 */
89bddce5
SH
803int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
804 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
805{
806 mm_segment_t oldfs = get_fs();
807 int result;
808
809 set_fs(KERNEL_DS);
810 /*
811 * the following is safe, since for compiler definitions of kvec and
812 * iovec are identical, yielding the same in-core layout and alignment
813 */
c0371da6 814 iov_iter_init(&msg->msg_iter, READ, (struct iovec *)vec, num, size);
1da177e4
LT
815 result = sock_recvmsg(sock, msg, size, flags);
816 set_fs(oldfs);
817 return result;
818}
c6d409cf 819EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 820
ce1d4d3e
CH
821static ssize_t sock_sendpage(struct file *file, struct page *page,
822 int offset, size_t size, loff_t *ppos, int more)
1da177e4 823{
1da177e4
LT
824 struct socket *sock;
825 int flags;
826
ce1d4d3e
CH
827 sock = file->private_data;
828
35f9c09f
ED
829 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
830 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
831 flags |= more;
ce1d4d3e 832
e6949583 833 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 834}
1da177e4 835
9c55e01c 836static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 837 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
838 unsigned int flags)
839{
840 struct socket *sock = file->private_data;
841
997b37da
RDC
842 if (unlikely(!sock->ops->splice_read))
843 return -EINVAL;
844
9c55e01c
JA
845 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
846}
847
ce1d4d3e 848static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
849 struct file *file, const struct iovec *iov,
850 unsigned long nr_segs)
ce1d4d3e
CH
851{
852 struct socket *sock = file->private_data;
1da177e4 853
ce1d4d3e
CH
854 msg->msg_name = NULL;
855 msg->msg_namelen = 0;
856 msg->msg_control = NULL;
857 msg->msg_controllen = 0;
66c1a12c 858 iov_iter_init(&msg->msg_iter, READ, iov, nr_segs, iocb->ki_nbytes);
ce1d4d3e
CH
859 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
860
66c1a12c 861 return __sock_recvmsg(iocb, sock, msg, iocb->ki_nbytes, msg->msg_flags);
ce1d4d3e
CH
862}
863
027445c3
BP
864static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
865 unsigned long nr_segs, loff_t pos)
ce1d4d3e 866{
7cc05662 867 struct msghdr msg;
ce1d4d3e 868
1da177e4
LT
869 if (pos != 0)
870 return -ESPIPE;
027445c3 871
73a7075e 872 if (iocb->ki_nbytes == 0) /* Match SYS5 behaviour */
1da177e4
LT
873 return 0;
874
7cc05662 875 return do_sock_read(&msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
876}
877
ce1d4d3e 878static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
879 struct file *file, const struct iovec *iov,
880 unsigned long nr_segs)
1da177e4 881{
ce1d4d3e 882 struct socket *sock = file->private_data;
1da177e4 883
ce1d4d3e
CH
884 msg->msg_name = NULL;
885 msg->msg_namelen = 0;
886 msg->msg_control = NULL;
887 msg->msg_controllen = 0;
66c1a12c 888 iov_iter_init(&msg->msg_iter, WRITE, iov, nr_segs, iocb->ki_nbytes);
ce1d4d3e
CH
889 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
890 if (sock->type == SOCK_SEQPACKET)
891 msg->msg_flags |= MSG_EOR;
1da177e4 892
66c1a12c 893 return __sock_sendmsg(iocb, sock, msg, iocb->ki_nbytes);
1da177e4
LT
894}
895
027445c3
BP
896static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
897 unsigned long nr_segs, loff_t pos)
ce1d4d3e 898{
7cc05662 899 struct msghdr msg;
1da177e4 900
ce1d4d3e
CH
901 if (pos != 0)
902 return -ESPIPE;
027445c3 903
7cc05662 904 return do_sock_write(&msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
905}
906
1da177e4
LT
907/*
908 * Atomic setting of ioctl hooks to avoid race
909 * with module unload.
910 */
911
4a3e2f71 912static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 913static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 914
881d966b 915void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 916{
4a3e2f71 917 mutex_lock(&br_ioctl_mutex);
1da177e4 918 br_ioctl_hook = hook;
4a3e2f71 919 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
920}
921EXPORT_SYMBOL(brioctl_set);
922
4a3e2f71 923static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 924static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 925
881d966b 926void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 927{
4a3e2f71 928 mutex_lock(&vlan_ioctl_mutex);
1da177e4 929 vlan_ioctl_hook = hook;
4a3e2f71 930 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
931}
932EXPORT_SYMBOL(vlan_ioctl_set);
933
4a3e2f71 934static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 935static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 936
89bddce5 937void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 938{
4a3e2f71 939 mutex_lock(&dlci_ioctl_mutex);
1da177e4 940 dlci_ioctl_hook = hook;
4a3e2f71 941 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
942}
943EXPORT_SYMBOL(dlci_ioctl_set);
944
6b96018b
AB
945static long sock_do_ioctl(struct net *net, struct socket *sock,
946 unsigned int cmd, unsigned long arg)
947{
948 int err;
949 void __user *argp = (void __user *)arg;
950
951 err = sock->ops->ioctl(sock, cmd, arg);
952
953 /*
954 * If this ioctl is unknown try to hand it down
955 * to the NIC driver.
956 */
957 if (err == -ENOIOCTLCMD)
958 err = dev_ioctl(net, cmd, argp);
959
960 return err;
961}
962
1da177e4
LT
963/*
964 * With an ioctl, arg may well be a user mode pointer, but we don't know
965 * what to do with it - that's up to the protocol still.
966 */
967
968static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
969{
970 struct socket *sock;
881d966b 971 struct sock *sk;
1da177e4
LT
972 void __user *argp = (void __user *)arg;
973 int pid, err;
881d966b 974 struct net *net;
1da177e4 975
b69aee04 976 sock = file->private_data;
881d966b 977 sk = sock->sk;
3b1e0a65 978 net = sock_net(sk);
1da177e4 979 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 980 err = dev_ioctl(net, cmd, argp);
1da177e4 981 } else
3d23e349 982#ifdef CONFIG_WEXT_CORE
1da177e4 983 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 984 err = dev_ioctl(net, cmd, argp);
1da177e4 985 } else
3d23e349 986#endif
89bddce5 987 switch (cmd) {
1da177e4
LT
988 case FIOSETOWN:
989 case SIOCSPGRP:
990 err = -EFAULT;
991 if (get_user(pid, (int __user *)argp))
992 break;
e0b93edd
JL
993 f_setown(sock->file, pid, 1);
994 err = 0;
1da177e4
LT
995 break;
996 case FIOGETOWN:
997 case SIOCGPGRP:
609d7fa9 998 err = put_user(f_getown(sock->file),
89bddce5 999 (int __user *)argp);
1da177e4
LT
1000 break;
1001 case SIOCGIFBR:
1002 case SIOCSIFBR:
1003 case SIOCBRADDBR:
1004 case SIOCBRDELBR:
1005 err = -ENOPKG;
1006 if (!br_ioctl_hook)
1007 request_module("bridge");
1008
4a3e2f71 1009 mutex_lock(&br_ioctl_mutex);
89bddce5 1010 if (br_ioctl_hook)
881d966b 1011 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1012 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1013 break;
1014 case SIOCGIFVLAN:
1015 case SIOCSIFVLAN:
1016 err = -ENOPKG;
1017 if (!vlan_ioctl_hook)
1018 request_module("8021q");
1019
4a3e2f71 1020 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1021 if (vlan_ioctl_hook)
881d966b 1022 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1023 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1024 break;
1da177e4
LT
1025 case SIOCADDDLCI:
1026 case SIOCDELDLCI:
1027 err = -ENOPKG;
1028 if (!dlci_ioctl_hook)
1029 request_module("dlci");
1030
7512cbf6
PE
1031 mutex_lock(&dlci_ioctl_mutex);
1032 if (dlci_ioctl_hook)
1da177e4 1033 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1034 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1035 break;
1036 default:
6b96018b 1037 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1038 break;
89bddce5 1039 }
1da177e4
LT
1040 return err;
1041}
1042
1043int sock_create_lite(int family, int type, int protocol, struct socket **res)
1044{
1045 int err;
1046 struct socket *sock = NULL;
89bddce5 1047
1da177e4
LT
1048 err = security_socket_create(family, type, protocol, 1);
1049 if (err)
1050 goto out;
1051
1052 sock = sock_alloc();
1053 if (!sock) {
1054 err = -ENOMEM;
1055 goto out;
1056 }
1057
1da177e4 1058 sock->type = type;
7420ed23
VY
1059 err = security_socket_post_create(sock, family, type, protocol, 1);
1060 if (err)
1061 goto out_release;
1062
1da177e4
LT
1063out:
1064 *res = sock;
1065 return err;
7420ed23
VY
1066out_release:
1067 sock_release(sock);
1068 sock = NULL;
1069 goto out;
1da177e4 1070}
c6d409cf 1071EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1072
1073/* No kernel lock held - perfect */
89bddce5 1074static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 1075{
cbf55001 1076 unsigned int busy_flag = 0;
1da177e4
LT
1077 struct socket *sock;
1078
1079 /*
89bddce5 1080 * We can't return errors to poll, so it's either yes or no.
1da177e4 1081 */
b69aee04 1082 sock = file->private_data;
2d48d67f 1083
cbf55001 1084 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1085 /* this socket can poll_ll so tell the system call */
cbf55001 1086 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1087
1088 /* once, only if requested by syscall */
cbf55001
ET
1089 if (wait && (wait->_key & POLL_BUSY_LOOP))
1090 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1091 }
1092
cbf55001 1093 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1094}
1095
89bddce5 1096static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1097{
b69aee04 1098 struct socket *sock = file->private_data;
1da177e4
LT
1099
1100 return sock->ops->mmap(file, sock, vma);
1101}
1102
20380731 1103static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1104{
1da177e4
LT
1105 sock_release(SOCKET_I(inode));
1106 return 0;
1107}
1108
1109/*
1110 * Update the socket async list
1111 *
1112 * Fasync_list locking strategy.
1113 *
1114 * 1. fasync_list is modified only under process context socket lock
1115 * i.e. under semaphore.
1116 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1117 * or under socket lock
1da177e4
LT
1118 */
1119
1120static int sock_fasync(int fd, struct file *filp, int on)
1121{
989a2979
ED
1122 struct socket *sock = filp->private_data;
1123 struct sock *sk = sock->sk;
eaefd110 1124 struct socket_wq *wq;
1da177e4 1125
989a2979 1126 if (sk == NULL)
1da177e4 1127 return -EINVAL;
1da177e4
LT
1128
1129 lock_sock(sk);
eaefd110
ED
1130 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1131 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1132
eaefd110 1133 if (!wq->fasync_list)
989a2979
ED
1134 sock_reset_flag(sk, SOCK_FASYNC);
1135 else
bcdce719 1136 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1137
989a2979 1138 release_sock(sk);
1da177e4
LT
1139 return 0;
1140}
1141
43815482 1142/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1143
1144int sock_wake_async(struct socket *sock, int how, int band)
1145{
43815482
ED
1146 struct socket_wq *wq;
1147
1148 if (!sock)
1149 return -1;
1150 rcu_read_lock();
1151 wq = rcu_dereference(sock->wq);
1152 if (!wq || !wq->fasync_list) {
1153 rcu_read_unlock();
1da177e4 1154 return -1;
43815482 1155 }
89bddce5 1156 switch (how) {
8d8ad9d7 1157 case SOCK_WAKE_WAITD:
1da177e4
LT
1158 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1159 break;
1160 goto call_kill;
8d8ad9d7 1161 case SOCK_WAKE_SPACE:
1da177e4
LT
1162 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1163 break;
1164 /* fall through */
8d8ad9d7 1165 case SOCK_WAKE_IO:
89bddce5 1166call_kill:
43815482 1167 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1168 break;
8d8ad9d7 1169 case SOCK_WAKE_URG:
43815482 1170 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1171 }
43815482 1172 rcu_read_unlock();
1da177e4
LT
1173 return 0;
1174}
c6d409cf 1175EXPORT_SYMBOL(sock_wake_async);
1da177e4 1176
721db93a 1177int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1178 struct socket **res, int kern)
1da177e4
LT
1179{
1180 int err;
1181 struct socket *sock;
55737fda 1182 const struct net_proto_family *pf;
1da177e4
LT
1183
1184 /*
89bddce5 1185 * Check protocol is in range
1da177e4
LT
1186 */
1187 if (family < 0 || family >= NPROTO)
1188 return -EAFNOSUPPORT;
1189 if (type < 0 || type >= SOCK_MAX)
1190 return -EINVAL;
1191
1192 /* Compatibility.
1193
1194 This uglymoron is moved from INET layer to here to avoid
1195 deadlock in module load.
1196 */
1197 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1198 static int warned;
1da177e4
LT
1199 if (!warned) {
1200 warned = 1;
3410f22e
YY
1201 pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1202 current->comm);
1da177e4
LT
1203 }
1204 family = PF_PACKET;
1205 }
1206
1207 err = security_socket_create(family, type, protocol, kern);
1208 if (err)
1209 return err;
89bddce5 1210
55737fda
SH
1211 /*
1212 * Allocate the socket and allow the family to set things up. if
1213 * the protocol is 0, the family is instructed to select an appropriate
1214 * default.
1215 */
1216 sock = sock_alloc();
1217 if (!sock) {
e87cc472 1218 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1219 return -ENFILE; /* Not exactly a match, but its the
1220 closest posix thing */
1221 }
1222
1223 sock->type = type;
1224
95a5afca 1225#ifdef CONFIG_MODULES
89bddce5
SH
1226 /* Attempt to load a protocol module if the find failed.
1227 *
1228 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1229 * requested real, full-featured networking support upon configuration.
1230 * Otherwise module support will break!
1231 */
190683a9 1232 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1233 request_module("net-pf-%d", family);
1da177e4
LT
1234#endif
1235
55737fda
SH
1236 rcu_read_lock();
1237 pf = rcu_dereference(net_families[family]);
1238 err = -EAFNOSUPPORT;
1239 if (!pf)
1240 goto out_release;
1da177e4
LT
1241
1242 /*
1243 * We will call the ->create function, that possibly is in a loadable
1244 * module, so we have to bump that loadable module refcnt first.
1245 */
55737fda 1246 if (!try_module_get(pf->owner))
1da177e4
LT
1247 goto out_release;
1248
55737fda
SH
1249 /* Now protected by module ref count */
1250 rcu_read_unlock();
1251
3f378b68 1252 err = pf->create(net, sock, protocol, kern);
55737fda 1253 if (err < 0)
1da177e4 1254 goto out_module_put;
a79af59e 1255
1da177e4
LT
1256 /*
1257 * Now to bump the refcnt of the [loadable] module that owns this
1258 * socket at sock_release time we decrement its refcnt.
1259 */
55737fda
SH
1260 if (!try_module_get(sock->ops->owner))
1261 goto out_module_busy;
1262
1da177e4
LT
1263 /*
1264 * Now that we're done with the ->create function, the [loadable]
1265 * module can have its refcnt decremented
1266 */
55737fda 1267 module_put(pf->owner);
7420ed23
VY
1268 err = security_socket_post_create(sock, family, type, protocol, kern);
1269 if (err)
3b185525 1270 goto out_sock_release;
55737fda 1271 *res = sock;
1da177e4 1272
55737fda
SH
1273 return 0;
1274
1275out_module_busy:
1276 err = -EAFNOSUPPORT;
1da177e4 1277out_module_put:
55737fda
SH
1278 sock->ops = NULL;
1279 module_put(pf->owner);
1280out_sock_release:
1da177e4 1281 sock_release(sock);
55737fda
SH
1282 return err;
1283
1284out_release:
1285 rcu_read_unlock();
1286 goto out_sock_release;
1da177e4 1287}
721db93a 1288EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1289
1290int sock_create(int family, int type, int protocol, struct socket **res)
1291{
1b8d7ae4 1292 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1293}
c6d409cf 1294EXPORT_SYMBOL(sock_create);
1da177e4
LT
1295
1296int sock_create_kern(int family, int type, int protocol, struct socket **res)
1297{
1b8d7ae4 1298 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1299}
c6d409cf 1300EXPORT_SYMBOL(sock_create_kern);
1da177e4 1301
3e0fa65f 1302SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1303{
1304 int retval;
1305 struct socket *sock;
a677a039
UD
1306 int flags;
1307
e38b36f3
UD
1308 /* Check the SOCK_* constants for consistency. */
1309 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1310 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1311 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1312 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1313
a677a039 1314 flags = type & ~SOCK_TYPE_MASK;
77d27200 1315 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1316 return -EINVAL;
1317 type &= SOCK_TYPE_MASK;
1da177e4 1318
aaca0bdc
UD
1319 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1320 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1321
1da177e4
LT
1322 retval = sock_create(family, type, protocol, &sock);
1323 if (retval < 0)
1324 goto out;
1325
77d27200 1326 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1327 if (retval < 0)
1328 goto out_release;
1329
1330out:
1331 /* It may be already another descriptor 8) Not kernel problem. */
1332 return retval;
1333
1334out_release:
1335 sock_release(sock);
1336 return retval;
1337}
1338
1339/*
1340 * Create a pair of connected sockets.
1341 */
1342
3e0fa65f
HC
1343SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1344 int __user *, usockvec)
1da177e4
LT
1345{
1346 struct socket *sock1, *sock2;
1347 int fd1, fd2, err;
db349509 1348 struct file *newfile1, *newfile2;
a677a039
UD
1349 int flags;
1350
1351 flags = type & ~SOCK_TYPE_MASK;
77d27200 1352 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1353 return -EINVAL;
1354 type &= SOCK_TYPE_MASK;
1da177e4 1355
aaca0bdc
UD
1356 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1357 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1358
1da177e4
LT
1359 /*
1360 * Obtain the first socket and check if the underlying protocol
1361 * supports the socketpair call.
1362 */
1363
1364 err = sock_create(family, type, protocol, &sock1);
1365 if (err < 0)
1366 goto out;
1367
1368 err = sock_create(family, type, protocol, &sock2);
1369 if (err < 0)
1370 goto out_release_1;
1371
1372 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1373 if (err < 0)
1da177e4
LT
1374 goto out_release_both;
1375
28407630 1376 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1377 if (unlikely(fd1 < 0)) {
1378 err = fd1;
db349509 1379 goto out_release_both;
bf3c23d1 1380 }
d73aa286 1381
28407630 1382 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1383 if (unlikely(fd2 < 0)) {
1384 err = fd2;
d73aa286 1385 goto out_put_unused_1;
28407630
AV
1386 }
1387
aab174f0 1388 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1389 if (unlikely(IS_ERR(newfile1))) {
1390 err = PTR_ERR(newfile1);
d73aa286 1391 goto out_put_unused_both;
28407630
AV
1392 }
1393
aab174f0 1394 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1395 if (IS_ERR(newfile2)) {
1396 err = PTR_ERR(newfile2);
d73aa286 1397 goto out_fput_1;
db349509
AV
1398 }
1399
d73aa286
YD
1400 err = put_user(fd1, &usockvec[0]);
1401 if (err)
1402 goto out_fput_both;
1403
1404 err = put_user(fd2, &usockvec[1]);
1405 if (err)
1406 goto out_fput_both;
1407
157cf649 1408 audit_fd_pair(fd1, fd2);
d73aa286 1409
db349509
AV
1410 fd_install(fd1, newfile1);
1411 fd_install(fd2, newfile2);
1da177e4
LT
1412 /* fd1 and fd2 may be already another descriptors.
1413 * Not kernel problem.
1414 */
1415
d73aa286 1416 return 0;
1da177e4 1417
d73aa286
YD
1418out_fput_both:
1419 fput(newfile2);
1420 fput(newfile1);
1421 put_unused_fd(fd2);
1422 put_unused_fd(fd1);
1423 goto out;
1424
1425out_fput_1:
1426 fput(newfile1);
1427 put_unused_fd(fd2);
1428 put_unused_fd(fd1);
1429 sock_release(sock2);
1430 goto out;
1da177e4 1431
d73aa286
YD
1432out_put_unused_both:
1433 put_unused_fd(fd2);
1434out_put_unused_1:
1435 put_unused_fd(fd1);
1da177e4 1436out_release_both:
89bddce5 1437 sock_release(sock2);
1da177e4 1438out_release_1:
89bddce5 1439 sock_release(sock1);
1da177e4
LT
1440out:
1441 return err;
1442}
1443
1da177e4
LT
1444/*
1445 * Bind a name to a socket. Nothing much to do here since it's
1446 * the protocol's responsibility to handle the local address.
1447 *
1448 * We move the socket address to kernel space before we call
1449 * the protocol layer (having also checked the address is ok).
1450 */
1451
20f37034 1452SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1453{
1454 struct socket *sock;
230b1839 1455 struct sockaddr_storage address;
6cb153ca 1456 int err, fput_needed;
1da177e4 1457
89bddce5 1458 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1459 if (sock) {
43db362d 1460 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1461 if (err >= 0) {
1462 err = security_socket_bind(sock,
230b1839 1463 (struct sockaddr *)&address,
89bddce5 1464 addrlen);
6cb153ca
BL
1465 if (!err)
1466 err = sock->ops->bind(sock,
89bddce5 1467 (struct sockaddr *)
230b1839 1468 &address, addrlen);
1da177e4 1469 }
6cb153ca 1470 fput_light(sock->file, fput_needed);
89bddce5 1471 }
1da177e4
LT
1472 return err;
1473}
1474
1da177e4
LT
1475/*
1476 * Perform a listen. Basically, we allow the protocol to do anything
1477 * necessary for a listen, and if that works, we mark the socket as
1478 * ready for listening.
1479 */
1480
3e0fa65f 1481SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1482{
1483 struct socket *sock;
6cb153ca 1484 int err, fput_needed;
b8e1f9b5 1485 int somaxconn;
89bddce5
SH
1486
1487 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1488 if (sock) {
8efa6e93 1489 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1490 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1491 backlog = somaxconn;
1da177e4
LT
1492
1493 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1494 if (!err)
1495 err = sock->ops->listen(sock, backlog);
1da177e4 1496
6cb153ca 1497 fput_light(sock->file, fput_needed);
1da177e4
LT
1498 }
1499 return err;
1500}
1501
1da177e4
LT
1502/*
1503 * For accept, we attempt to create a new socket, set up the link
1504 * with the client, wake up the client, then return the new
1505 * connected fd. We collect the address of the connector in kernel
1506 * space and move it to user at the very end. This is unclean because
1507 * we open the socket then return an error.
1508 *
1509 * 1003.1g adds the ability to recvmsg() to query connection pending
1510 * status to recvmsg. We need to add that support in a way thats
1511 * clean when we restucture accept also.
1512 */
1513
20f37034
HC
1514SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1515 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1516{
1517 struct socket *sock, *newsock;
39d8c1b6 1518 struct file *newfile;
6cb153ca 1519 int err, len, newfd, fput_needed;
230b1839 1520 struct sockaddr_storage address;
1da177e4 1521
77d27200 1522 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1523 return -EINVAL;
1524
1525 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1526 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1527
6cb153ca 1528 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1529 if (!sock)
1530 goto out;
1531
1532 err = -ENFILE;
c6d409cf
ED
1533 newsock = sock_alloc();
1534 if (!newsock)
1da177e4
LT
1535 goto out_put;
1536
1537 newsock->type = sock->type;
1538 newsock->ops = sock->ops;
1539
1da177e4
LT
1540 /*
1541 * We don't need try_module_get here, as the listening socket (sock)
1542 * has the protocol module (sock->ops->owner) held.
1543 */
1544 __module_get(newsock->ops->owner);
1545
28407630 1546 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1547 if (unlikely(newfd < 0)) {
1548 err = newfd;
9a1875e6
DM
1549 sock_release(newsock);
1550 goto out_put;
39d8c1b6 1551 }
aab174f0 1552 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1553 if (unlikely(IS_ERR(newfile))) {
1554 err = PTR_ERR(newfile);
1555 put_unused_fd(newfd);
1556 sock_release(newsock);
1557 goto out_put;
1558 }
39d8c1b6 1559
a79af59e
FF
1560 err = security_socket_accept(sock, newsock);
1561 if (err)
39d8c1b6 1562 goto out_fd;
a79af59e 1563
1da177e4
LT
1564 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1565 if (err < 0)
39d8c1b6 1566 goto out_fd;
1da177e4
LT
1567
1568 if (upeer_sockaddr) {
230b1839 1569 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1570 &len, 2) < 0) {
1da177e4 1571 err = -ECONNABORTED;
39d8c1b6 1572 goto out_fd;
1da177e4 1573 }
43db362d 1574 err = move_addr_to_user(&address,
230b1839 1575 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1576 if (err < 0)
39d8c1b6 1577 goto out_fd;
1da177e4
LT
1578 }
1579
1580 /* File flags are not inherited via accept() unlike another OSes. */
1581
39d8c1b6
DM
1582 fd_install(newfd, newfile);
1583 err = newfd;
1da177e4 1584
1da177e4 1585out_put:
6cb153ca 1586 fput_light(sock->file, fput_needed);
1da177e4
LT
1587out:
1588 return err;
39d8c1b6 1589out_fd:
9606a216 1590 fput(newfile);
39d8c1b6 1591 put_unused_fd(newfd);
1da177e4
LT
1592 goto out_put;
1593}
1594
20f37034
HC
1595SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1596 int __user *, upeer_addrlen)
aaca0bdc 1597{
de11defe 1598 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1599}
1600
1da177e4
LT
1601/*
1602 * Attempt to connect to a socket with the server address. The address
1603 * is in user space so we verify it is OK and move it to kernel space.
1604 *
1605 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1606 * break bindings
1607 *
1608 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1609 * other SEQPACKET protocols that take time to connect() as it doesn't
1610 * include the -EINPROGRESS status for such sockets.
1611 */
1612
20f37034
HC
1613SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1614 int, addrlen)
1da177e4
LT
1615{
1616 struct socket *sock;
230b1839 1617 struct sockaddr_storage address;
6cb153ca 1618 int err, fput_needed;
1da177e4 1619
6cb153ca 1620 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1621 if (!sock)
1622 goto out;
43db362d 1623 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1624 if (err < 0)
1625 goto out_put;
1626
89bddce5 1627 err =
230b1839 1628 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1629 if (err)
1630 goto out_put;
1631
230b1839 1632 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1633 sock->file->f_flags);
1634out_put:
6cb153ca 1635 fput_light(sock->file, fput_needed);
1da177e4
LT
1636out:
1637 return err;
1638}
1639
1640/*
1641 * Get the local address ('name') of a socket object. Move the obtained
1642 * name to user space.
1643 */
1644
20f37034
HC
1645SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1646 int __user *, usockaddr_len)
1da177e4
LT
1647{
1648 struct socket *sock;
230b1839 1649 struct sockaddr_storage address;
6cb153ca 1650 int len, err, fput_needed;
89bddce5 1651
6cb153ca 1652 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1653 if (!sock)
1654 goto out;
1655
1656 err = security_socket_getsockname(sock);
1657 if (err)
1658 goto out_put;
1659
230b1839 1660 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1661 if (err)
1662 goto out_put;
43db362d 1663 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1664
1665out_put:
6cb153ca 1666 fput_light(sock->file, fput_needed);
1da177e4
LT
1667out:
1668 return err;
1669}
1670
1671/*
1672 * Get the remote address ('name') of a socket object. Move the obtained
1673 * name to user space.
1674 */
1675
20f37034
HC
1676SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1677 int __user *, usockaddr_len)
1da177e4
LT
1678{
1679 struct socket *sock;
230b1839 1680 struct sockaddr_storage address;
6cb153ca 1681 int len, err, fput_needed;
1da177e4 1682
89bddce5
SH
1683 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1684 if (sock != NULL) {
1da177e4
LT
1685 err = security_socket_getpeername(sock);
1686 if (err) {
6cb153ca 1687 fput_light(sock->file, fput_needed);
1da177e4
LT
1688 return err;
1689 }
1690
89bddce5 1691 err =
230b1839 1692 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1693 1);
1da177e4 1694 if (!err)
43db362d 1695 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1696 usockaddr_len);
6cb153ca 1697 fput_light(sock->file, fput_needed);
1da177e4
LT
1698 }
1699 return err;
1700}
1701
1702/*
1703 * Send a datagram to a given address. We move the address into kernel
1704 * space and check the user space data area is readable before invoking
1705 * the protocol.
1706 */
1707
3e0fa65f 1708SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1709 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1710 int, addr_len)
1da177e4
LT
1711{
1712 struct socket *sock;
230b1839 1713 struct sockaddr_storage address;
1da177e4
LT
1714 int err;
1715 struct msghdr msg;
1716 struct iovec iov;
6cb153ca 1717 int fput_needed;
6cb153ca 1718
253eacc0
LT
1719 if (len > INT_MAX)
1720 len = INT_MAX;
de0fa95c
PE
1721 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1722 if (!sock)
4387ff75 1723 goto out;
6cb153ca 1724
89bddce5
SH
1725 iov.iov_base = buff;
1726 iov.iov_len = len;
1727 msg.msg_name = NULL;
c0371da6 1728 iov_iter_init(&msg.msg_iter, WRITE, &iov, 1, len);
89bddce5
SH
1729 msg.msg_control = NULL;
1730 msg.msg_controllen = 0;
1731 msg.msg_namelen = 0;
6cb153ca 1732 if (addr) {
43db362d 1733 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1734 if (err < 0)
1735 goto out_put;
230b1839 1736 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1737 msg.msg_namelen = addr_len;
1da177e4
LT
1738 }
1739 if (sock->file->f_flags & O_NONBLOCK)
1740 flags |= MSG_DONTWAIT;
1741 msg.msg_flags = flags;
1742 err = sock_sendmsg(sock, &msg, len);
1743
89bddce5 1744out_put:
de0fa95c 1745 fput_light(sock->file, fput_needed);
4387ff75 1746out:
1da177e4
LT
1747 return err;
1748}
1749
1750/*
89bddce5 1751 * Send a datagram down a socket.
1da177e4
LT
1752 */
1753
3e0fa65f 1754SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1755 unsigned int, flags)
1da177e4
LT
1756{
1757 return sys_sendto(fd, buff, len, flags, NULL, 0);
1758}
1759
1760/*
89bddce5 1761 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1762 * sender. We verify the buffers are writable and if needed move the
1763 * sender address from kernel to user space.
1764 */
1765
3e0fa65f 1766SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1767 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1768 int __user *, addr_len)
1da177e4
LT
1769{
1770 struct socket *sock;
1771 struct iovec iov;
1772 struct msghdr msg;
230b1839 1773 struct sockaddr_storage address;
89bddce5 1774 int err, err2;
6cb153ca
BL
1775 int fput_needed;
1776
253eacc0
LT
1777 if (size > INT_MAX)
1778 size = INT_MAX;
de0fa95c 1779 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1780 if (!sock)
de0fa95c 1781 goto out;
1da177e4 1782
89bddce5
SH
1783 msg.msg_control = NULL;
1784 msg.msg_controllen = 0;
89bddce5
SH
1785 iov.iov_len = size;
1786 iov.iov_base = ubuf;
c0371da6 1787 iov_iter_init(&msg.msg_iter, READ, &iov, 1, size);
f3d33426
HFS
1788 /* Save some cycles and don't copy the address if not needed */
1789 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1790 /* We assume all kernel code knows the size of sockaddr_storage */
1791 msg.msg_namelen = 0;
1da177e4
LT
1792 if (sock->file->f_flags & O_NONBLOCK)
1793 flags |= MSG_DONTWAIT;
89bddce5 1794 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1795
89bddce5 1796 if (err >= 0 && addr != NULL) {
43db362d 1797 err2 = move_addr_to_user(&address,
230b1839 1798 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1799 if (err2 < 0)
1800 err = err2;
1da177e4 1801 }
de0fa95c
PE
1802
1803 fput_light(sock->file, fput_needed);
4387ff75 1804out:
1da177e4
LT
1805 return err;
1806}
1807
1808/*
89bddce5 1809 * Receive a datagram from a socket.
1da177e4
LT
1810 */
1811
b7c0ddf5
JG
1812SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1813 unsigned int, flags)
1da177e4
LT
1814{
1815 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1816}
1817
1818/*
1819 * Set a socket option. Because we don't know the option lengths we have
1820 * to pass the user mode parameter for the protocols to sort out.
1821 */
1822
20f37034
HC
1823SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1824 char __user *, optval, int, optlen)
1da177e4 1825{
6cb153ca 1826 int err, fput_needed;
1da177e4
LT
1827 struct socket *sock;
1828
1829 if (optlen < 0)
1830 return -EINVAL;
89bddce5
SH
1831
1832 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1833 if (sock != NULL) {
1834 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1835 if (err)
1836 goto out_put;
1da177e4
LT
1837
1838 if (level == SOL_SOCKET)
89bddce5
SH
1839 err =
1840 sock_setsockopt(sock, level, optname, optval,
1841 optlen);
1da177e4 1842 else
89bddce5
SH
1843 err =
1844 sock->ops->setsockopt(sock, level, optname, optval,
1845 optlen);
6cb153ca
BL
1846out_put:
1847 fput_light(sock->file, fput_needed);
1da177e4
LT
1848 }
1849 return err;
1850}
1851
1852/*
1853 * Get a socket option. Because we don't know the option lengths we have
1854 * to pass a user mode parameter for the protocols to sort out.
1855 */
1856
20f37034
HC
1857SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1858 char __user *, optval, int __user *, optlen)
1da177e4 1859{
6cb153ca 1860 int err, fput_needed;
1da177e4
LT
1861 struct socket *sock;
1862
89bddce5
SH
1863 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1864 if (sock != NULL) {
6cb153ca
BL
1865 err = security_socket_getsockopt(sock, level, optname);
1866 if (err)
1867 goto out_put;
1da177e4
LT
1868
1869 if (level == SOL_SOCKET)
89bddce5
SH
1870 err =
1871 sock_getsockopt(sock, level, optname, optval,
1872 optlen);
1da177e4 1873 else
89bddce5
SH
1874 err =
1875 sock->ops->getsockopt(sock, level, optname, optval,
1876 optlen);
6cb153ca
BL
1877out_put:
1878 fput_light(sock->file, fput_needed);
1da177e4
LT
1879 }
1880 return err;
1881}
1882
1da177e4
LT
1883/*
1884 * Shutdown a socket.
1885 */
1886
754fe8d2 1887SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1888{
6cb153ca 1889 int err, fput_needed;
1da177e4
LT
1890 struct socket *sock;
1891
89bddce5
SH
1892 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1893 if (sock != NULL) {
1da177e4 1894 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1895 if (!err)
1896 err = sock->ops->shutdown(sock, how);
1897 fput_light(sock->file, fput_needed);
1da177e4
LT
1898 }
1899 return err;
1900}
1901
89bddce5 1902/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1903 * fields which are the same type (int / unsigned) on our platforms.
1904 */
1905#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1906#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1907#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1908
c71d8ebe
TH
1909struct used_address {
1910 struct sockaddr_storage name;
1911 unsigned int name_len;
1912};
1913
08adb7da
AV
1914static ssize_t copy_msghdr_from_user(struct msghdr *kmsg,
1915 struct user_msghdr __user *umsg,
1916 struct sockaddr __user **save_addr,
1917 struct iovec **iov)
1661bf36 1918{
08adb7da
AV
1919 struct sockaddr __user *uaddr;
1920 struct iovec __user *uiov;
c0371da6 1921 size_t nr_segs;
08adb7da
AV
1922 ssize_t err;
1923
1924 if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1925 __get_user(uaddr, &umsg->msg_name) ||
1926 __get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1927 __get_user(uiov, &umsg->msg_iov) ||
c0371da6 1928 __get_user(nr_segs, &umsg->msg_iovlen) ||
08adb7da
AV
1929 __get_user(kmsg->msg_control, &umsg->msg_control) ||
1930 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1931 __get_user(kmsg->msg_flags, &umsg->msg_flags))
1661bf36 1932 return -EFAULT;
dbb490b9 1933
08adb7da 1934 if (!uaddr)
6a2a2b3a
AS
1935 kmsg->msg_namelen = 0;
1936
dbb490b9
ML
1937 if (kmsg->msg_namelen < 0)
1938 return -EINVAL;
1939
1661bf36 1940 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
db31c55a 1941 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
08adb7da
AV
1942
1943 if (save_addr)
1944 *save_addr = uaddr;
1945
1946 if (uaddr && kmsg->msg_namelen) {
1947 if (!save_addr) {
1948 err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1949 kmsg->msg_name);
1950 if (err < 0)
1951 return err;
1952 }
1953 } else {
1954 kmsg->msg_name = NULL;
1955 kmsg->msg_namelen = 0;
1956 }
1957
c0371da6 1958 if (nr_segs > UIO_MAXIOV)
08adb7da
AV
1959 return -EMSGSIZE;
1960
1961 err = rw_copy_check_uvector(save_addr ? READ : WRITE,
c0371da6 1962 uiov, nr_segs,
08adb7da
AV
1963 UIO_FASTIOV, *iov, iov);
1964 if (err >= 0)
c0371da6
AV
1965 iov_iter_init(&kmsg->msg_iter, save_addr ? READ : WRITE,
1966 *iov, nr_segs, err);
08adb7da 1967 return err;
1661bf36
DC
1968}
1969
666547ff 1970static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 1971 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1972 struct used_address *used_address)
1da177e4 1973{
89bddce5
SH
1974 struct compat_msghdr __user *msg_compat =
1975 (struct compat_msghdr __user *)msg;
230b1839 1976 struct sockaddr_storage address;
1da177e4 1977 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1978 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1979 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1980 /* 20 is size of ipv6_pktinfo */
1da177e4 1981 unsigned char *ctl_buf = ctl;
08adb7da
AV
1982 int ctl_len, total_len;
1983 ssize_t err;
89bddce5 1984
08adb7da 1985 msg_sys->msg_name = &address;
1da177e4 1986
08449320 1987 if (MSG_CMSG_COMPAT & flags)
08adb7da 1988 err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
08449320 1989 else
08adb7da 1990 err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
89bddce5 1991 if (err < 0)
1da177e4
LT
1992 goto out_freeiov;
1993 total_len = err;
1994
1995 err = -ENOBUFS;
1996
228e548e 1997 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 1998 goto out_freeiov;
228e548e 1999 ctl_len = msg_sys->msg_controllen;
1da177e4 2000 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2001 err =
228e548e 2002 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2003 sizeof(ctl));
1da177e4
LT
2004 if (err)
2005 goto out_freeiov;
228e548e
AB
2006 ctl_buf = msg_sys->msg_control;
2007 ctl_len = msg_sys->msg_controllen;
1da177e4 2008 } else if (ctl_len) {
89bddce5 2009 if (ctl_len > sizeof(ctl)) {
1da177e4 2010 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2011 if (ctl_buf == NULL)
1da177e4
LT
2012 goto out_freeiov;
2013 }
2014 err = -EFAULT;
2015 /*
228e548e 2016 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2017 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2018 * checking falls down on this.
2019 */
fb8621bb 2020 if (copy_from_user(ctl_buf,
228e548e 2021 (void __user __force *)msg_sys->msg_control,
89bddce5 2022 ctl_len))
1da177e4 2023 goto out_freectl;
228e548e 2024 msg_sys->msg_control = ctl_buf;
1da177e4 2025 }
228e548e 2026 msg_sys->msg_flags = flags;
1da177e4
LT
2027
2028 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2029 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2030 /*
2031 * If this is sendmmsg() and current destination address is same as
2032 * previously succeeded address, omit asking LSM's decision.
2033 * used_address->name_len is initialized to UINT_MAX so that the first
2034 * destination address never matches.
2035 */
bc909d9d
MD
2036 if (used_address && msg_sys->msg_name &&
2037 used_address->name_len == msg_sys->msg_namelen &&
2038 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2039 used_address->name_len)) {
2040 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2041 goto out_freectl;
2042 }
2043 err = sock_sendmsg(sock, msg_sys, total_len);
2044 /*
2045 * If this is sendmmsg() and sending to current destination address was
2046 * successful, remember it.
2047 */
2048 if (used_address && err >= 0) {
2049 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2050 if (msg_sys->msg_name)
2051 memcpy(&used_address->name, msg_sys->msg_name,
2052 used_address->name_len);
c71d8ebe 2053 }
1da177e4
LT
2054
2055out_freectl:
89bddce5 2056 if (ctl_buf != ctl)
1da177e4
LT
2057 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2058out_freeiov:
2059 if (iov != iovstack)
a74e9106 2060 kfree(iov);
228e548e
AB
2061 return err;
2062}
2063
2064/*
2065 * BSD sendmsg interface
2066 */
2067
666547ff 2068long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
228e548e
AB
2069{
2070 int fput_needed, err;
2071 struct msghdr msg_sys;
1be374a0
AL
2072 struct socket *sock;
2073
1be374a0 2074 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2075 if (!sock)
2076 goto out;
2077
a7526eb5 2078 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2079
6cb153ca 2080 fput_light(sock->file, fput_needed);
89bddce5 2081out:
1da177e4
LT
2082 return err;
2083}
2084
666547ff 2085SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
a7526eb5
AL
2086{
2087 if (flags & MSG_CMSG_COMPAT)
2088 return -EINVAL;
2089 return __sys_sendmsg(fd, msg, flags);
2090}
2091
228e548e
AB
2092/*
2093 * Linux sendmmsg interface
2094 */
2095
2096int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2097 unsigned int flags)
2098{
2099 int fput_needed, err, datagrams;
2100 struct socket *sock;
2101 struct mmsghdr __user *entry;
2102 struct compat_mmsghdr __user *compat_entry;
2103 struct msghdr msg_sys;
c71d8ebe 2104 struct used_address used_address;
228e548e 2105
98382f41
AB
2106 if (vlen > UIO_MAXIOV)
2107 vlen = UIO_MAXIOV;
228e548e
AB
2108
2109 datagrams = 0;
2110
2111 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2112 if (!sock)
2113 return err;
2114
c71d8ebe 2115 used_address.name_len = UINT_MAX;
228e548e
AB
2116 entry = mmsg;
2117 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2118 err = 0;
228e548e
AB
2119
2120 while (datagrams < vlen) {
228e548e 2121 if (MSG_CMSG_COMPAT & flags) {
666547ff 2122 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5 2123 &msg_sys, flags, &used_address);
228e548e
AB
2124 if (err < 0)
2125 break;
2126 err = __put_user(err, &compat_entry->msg_len);
2127 ++compat_entry;
2128 } else {
a7526eb5 2129 err = ___sys_sendmsg(sock,
666547ff 2130 (struct user_msghdr __user *)entry,
a7526eb5 2131 &msg_sys, flags, &used_address);
228e548e
AB
2132 if (err < 0)
2133 break;
2134 err = put_user(err, &entry->msg_len);
2135 ++entry;
2136 }
2137
2138 if (err)
2139 break;
2140 ++datagrams;
2141 }
2142
228e548e
AB
2143 fput_light(sock->file, fput_needed);
2144
728ffb86
AB
2145 /* We only return an error if no datagrams were able to be sent */
2146 if (datagrams != 0)
228e548e
AB
2147 return datagrams;
2148
228e548e
AB
2149 return err;
2150}
2151
2152SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2153 unsigned int, vlen, unsigned int, flags)
2154{
1be374a0
AL
2155 if (flags & MSG_CMSG_COMPAT)
2156 return -EINVAL;
228e548e
AB
2157 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2158}
2159
666547ff 2160static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2161 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2162{
89bddce5
SH
2163 struct compat_msghdr __user *msg_compat =
2164 (struct compat_msghdr __user *)msg;
1da177e4 2165 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2166 struct iovec *iov = iovstack;
1da177e4 2167 unsigned long cmsg_ptr;
08adb7da
AV
2168 int total_len, len;
2169 ssize_t err;
1da177e4
LT
2170
2171 /* kernel mode address */
230b1839 2172 struct sockaddr_storage addr;
1da177e4
LT
2173
2174 /* user mode address pointers */
2175 struct sockaddr __user *uaddr;
08adb7da 2176 int __user *uaddr_len = COMPAT_NAMELEN(msg);
89bddce5 2177
08adb7da 2178 msg_sys->msg_name = &addr;
1da177e4 2179
f3d33426 2180 if (MSG_CMSG_COMPAT & flags)
08adb7da 2181 err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
f3d33426 2182 else
08adb7da 2183 err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
1da177e4
LT
2184 if (err < 0)
2185 goto out_freeiov;
89bddce5 2186 total_len = err;
1da177e4 2187
a2e27255
ACM
2188 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2189 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2190
f3d33426
HFS
2191 /* We assume all kernel code knows the size of sockaddr_storage */
2192 msg_sys->msg_namelen = 0;
2193
1da177e4
LT
2194 if (sock->file->f_flags & O_NONBLOCK)
2195 flags |= MSG_DONTWAIT;
a2e27255
ACM
2196 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2197 total_len, flags);
1da177e4
LT
2198 if (err < 0)
2199 goto out_freeiov;
2200 len = err;
2201
2202 if (uaddr != NULL) {
43db362d 2203 err = move_addr_to_user(&addr,
a2e27255 2204 msg_sys->msg_namelen, uaddr,
89bddce5 2205 uaddr_len);
1da177e4
LT
2206 if (err < 0)
2207 goto out_freeiov;
2208 }
a2e27255 2209 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2210 COMPAT_FLAGS(msg));
1da177e4
LT
2211 if (err)
2212 goto out_freeiov;
2213 if (MSG_CMSG_COMPAT & flags)
a2e27255 2214 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2215 &msg_compat->msg_controllen);
2216 else
a2e27255 2217 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2218 &msg->msg_controllen);
2219 if (err)
2220 goto out_freeiov;
2221 err = len;
2222
2223out_freeiov:
2224 if (iov != iovstack)
a74e9106 2225 kfree(iov);
a2e27255
ACM
2226 return err;
2227}
2228
2229/*
2230 * BSD recvmsg interface
2231 */
2232
666547ff 2233long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
a2e27255
ACM
2234{
2235 int fput_needed, err;
2236 struct msghdr msg_sys;
1be374a0
AL
2237 struct socket *sock;
2238
1be374a0 2239 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2240 if (!sock)
2241 goto out;
2242
a7526eb5 2243 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2244
6cb153ca 2245 fput_light(sock->file, fput_needed);
1da177e4
LT
2246out:
2247 return err;
2248}
2249
666547ff 2250SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
a7526eb5
AL
2251 unsigned int, flags)
2252{
2253 if (flags & MSG_CMSG_COMPAT)
2254 return -EINVAL;
2255 return __sys_recvmsg(fd, msg, flags);
2256}
2257
a2e27255
ACM
2258/*
2259 * Linux recvmmsg interface
2260 */
2261
2262int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2263 unsigned int flags, struct timespec *timeout)
2264{
2265 int fput_needed, err, datagrams;
2266 struct socket *sock;
2267 struct mmsghdr __user *entry;
d7256d0e 2268 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2269 struct msghdr msg_sys;
2270 struct timespec end_time;
2271
2272 if (timeout &&
2273 poll_select_set_timeout(&end_time, timeout->tv_sec,
2274 timeout->tv_nsec))
2275 return -EINVAL;
2276
2277 datagrams = 0;
2278
2279 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2280 if (!sock)
2281 return err;
2282
2283 err = sock_error(sock->sk);
2284 if (err)
2285 goto out_put;
2286
2287 entry = mmsg;
d7256d0e 2288 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2289
2290 while (datagrams < vlen) {
2291 /*
2292 * No need to ask LSM for more than the first datagram.
2293 */
d7256d0e 2294 if (MSG_CMSG_COMPAT & flags) {
666547ff 2295 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5
AL
2296 &msg_sys, flags & ~MSG_WAITFORONE,
2297 datagrams);
d7256d0e
JMG
2298 if (err < 0)
2299 break;
2300 err = __put_user(err, &compat_entry->msg_len);
2301 ++compat_entry;
2302 } else {
a7526eb5 2303 err = ___sys_recvmsg(sock,
666547ff 2304 (struct user_msghdr __user *)entry,
a7526eb5
AL
2305 &msg_sys, flags & ~MSG_WAITFORONE,
2306 datagrams);
d7256d0e
JMG
2307 if (err < 0)
2308 break;
2309 err = put_user(err, &entry->msg_len);
2310 ++entry;
2311 }
2312
a2e27255
ACM
2313 if (err)
2314 break;
a2e27255
ACM
2315 ++datagrams;
2316
71c5c159
BB
2317 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2318 if (flags & MSG_WAITFORONE)
2319 flags |= MSG_DONTWAIT;
2320
a2e27255
ACM
2321 if (timeout) {
2322 ktime_get_ts(timeout);
2323 *timeout = timespec_sub(end_time, *timeout);
2324 if (timeout->tv_sec < 0) {
2325 timeout->tv_sec = timeout->tv_nsec = 0;
2326 break;
2327 }
2328
2329 /* Timeout, return less than vlen datagrams */
2330 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2331 break;
2332 }
2333
2334 /* Out of band data, return right away */
2335 if (msg_sys.msg_flags & MSG_OOB)
2336 break;
2337 }
2338
2339out_put:
2340 fput_light(sock->file, fput_needed);
1da177e4 2341
a2e27255
ACM
2342 if (err == 0)
2343 return datagrams;
2344
2345 if (datagrams != 0) {
2346 /*
2347 * We may return less entries than requested (vlen) if the
2348 * sock is non block and there aren't enough datagrams...
2349 */
2350 if (err != -EAGAIN) {
2351 /*
2352 * ... or if recvmsg returns an error after we
2353 * received some datagrams, where we record the
2354 * error to return on the next call or if the
2355 * app asks about it using getsockopt(SO_ERROR).
2356 */
2357 sock->sk->sk_err = -err;
2358 }
2359
2360 return datagrams;
2361 }
2362
2363 return err;
2364}
2365
2366SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2367 unsigned int, vlen, unsigned int, flags,
2368 struct timespec __user *, timeout)
2369{
2370 int datagrams;
2371 struct timespec timeout_sys;
2372
1be374a0
AL
2373 if (flags & MSG_CMSG_COMPAT)
2374 return -EINVAL;
2375
a2e27255
ACM
2376 if (!timeout)
2377 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2378
2379 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2380 return -EFAULT;
2381
2382 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2383
2384 if (datagrams > 0 &&
2385 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2386 datagrams = -EFAULT;
2387
2388 return datagrams;
2389}
2390
2391#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2392/* Argument list sizes for sys_socketcall */
2393#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2394static const unsigned char nargs[21] = {
c6d409cf
ED
2395 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2396 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2397 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2398 AL(4), AL(5), AL(4)
89bddce5
SH
2399};
2400
1da177e4
LT
2401#undef AL
2402
2403/*
89bddce5 2404 * System call vectors.
1da177e4
LT
2405 *
2406 * Argument checking cleaned up. Saved 20% in size.
2407 * This function doesn't need to set the kernel lock because
89bddce5 2408 * it is set by the callees.
1da177e4
LT
2409 */
2410
3e0fa65f 2411SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2412{
2950fa9d 2413 unsigned long a[AUDITSC_ARGS];
89bddce5 2414 unsigned long a0, a1;
1da177e4 2415 int err;
47379052 2416 unsigned int len;
1da177e4 2417
228e548e 2418 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2419 return -EINVAL;
2420
47379052
AV
2421 len = nargs[call];
2422 if (len > sizeof(a))
2423 return -EINVAL;
2424
1da177e4 2425 /* copy_from_user should be SMP safe. */
47379052 2426 if (copy_from_user(a, args, len))
1da177e4 2427 return -EFAULT;
3ec3b2fb 2428
2950fa9d
CG
2429 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2430 if (err)
2431 return err;
3ec3b2fb 2432
89bddce5
SH
2433 a0 = a[0];
2434 a1 = a[1];
2435
2436 switch (call) {
2437 case SYS_SOCKET:
2438 err = sys_socket(a0, a1, a[2]);
2439 break;
2440 case SYS_BIND:
2441 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2442 break;
2443 case SYS_CONNECT:
2444 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2445 break;
2446 case SYS_LISTEN:
2447 err = sys_listen(a0, a1);
2448 break;
2449 case SYS_ACCEPT:
de11defe
UD
2450 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2451 (int __user *)a[2], 0);
89bddce5
SH
2452 break;
2453 case SYS_GETSOCKNAME:
2454 err =
2455 sys_getsockname(a0, (struct sockaddr __user *)a1,
2456 (int __user *)a[2]);
2457 break;
2458 case SYS_GETPEERNAME:
2459 err =
2460 sys_getpeername(a0, (struct sockaddr __user *)a1,
2461 (int __user *)a[2]);
2462 break;
2463 case SYS_SOCKETPAIR:
2464 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2465 break;
2466 case SYS_SEND:
2467 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2468 break;
2469 case SYS_SENDTO:
2470 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2471 (struct sockaddr __user *)a[4], a[5]);
2472 break;
2473 case SYS_RECV:
2474 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2475 break;
2476 case SYS_RECVFROM:
2477 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2478 (struct sockaddr __user *)a[4],
2479 (int __user *)a[5]);
2480 break;
2481 case SYS_SHUTDOWN:
2482 err = sys_shutdown(a0, a1);
2483 break;
2484 case SYS_SETSOCKOPT:
2485 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2486 break;
2487 case SYS_GETSOCKOPT:
2488 err =
2489 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2490 (int __user *)a[4]);
2491 break;
2492 case SYS_SENDMSG:
666547ff 2493 err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2494 break;
228e548e
AB
2495 case SYS_SENDMMSG:
2496 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2497 break;
89bddce5 2498 case SYS_RECVMSG:
666547ff 2499 err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2500 break;
a2e27255
ACM
2501 case SYS_RECVMMSG:
2502 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2503 (struct timespec __user *)a[4]);
2504 break;
de11defe
UD
2505 case SYS_ACCEPT4:
2506 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2507 (int __user *)a[2], a[3]);
aaca0bdc 2508 break;
89bddce5
SH
2509 default:
2510 err = -EINVAL;
2511 break;
1da177e4
LT
2512 }
2513 return err;
2514}
2515
89bddce5 2516#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2517
55737fda
SH
2518/**
2519 * sock_register - add a socket protocol handler
2520 * @ops: description of protocol
2521 *
1da177e4
LT
2522 * This function is called by a protocol handler that wants to
2523 * advertise its address family, and have it linked into the
e793c0f7 2524 * socket interface. The value ops->family corresponds to the
55737fda 2525 * socket system call protocol family.
1da177e4 2526 */
f0fd27d4 2527int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2528{
2529 int err;
2530
2531 if (ops->family >= NPROTO) {
3410f22e 2532 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
1da177e4
LT
2533 return -ENOBUFS;
2534 }
55737fda
SH
2535
2536 spin_lock(&net_family_lock);
190683a9
ED
2537 if (rcu_dereference_protected(net_families[ops->family],
2538 lockdep_is_held(&net_family_lock)))
55737fda
SH
2539 err = -EEXIST;
2540 else {
cf778b00 2541 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2542 err = 0;
2543 }
55737fda
SH
2544 spin_unlock(&net_family_lock);
2545
3410f22e 2546 pr_info("NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2547 return err;
2548}
c6d409cf 2549EXPORT_SYMBOL(sock_register);
1da177e4 2550
55737fda
SH
2551/**
2552 * sock_unregister - remove a protocol handler
2553 * @family: protocol family to remove
2554 *
1da177e4
LT
2555 * This function is called by a protocol handler that wants to
2556 * remove its address family, and have it unlinked from the
55737fda
SH
2557 * new socket creation.
2558 *
2559 * If protocol handler is a module, then it can use module reference
2560 * counts to protect against new references. If protocol handler is not
2561 * a module then it needs to provide its own protection in
2562 * the ops->create routine.
1da177e4 2563 */
f0fd27d4 2564void sock_unregister(int family)
1da177e4 2565{
f0fd27d4 2566 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2567
55737fda 2568 spin_lock(&net_family_lock);
a9b3cd7f 2569 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2570 spin_unlock(&net_family_lock);
2571
2572 synchronize_rcu();
2573
3410f22e 2574 pr_info("NET: Unregistered protocol family %d\n", family);
1da177e4 2575}
c6d409cf 2576EXPORT_SYMBOL(sock_unregister);
1da177e4 2577
77d76ea3 2578static int __init sock_init(void)
1da177e4 2579{
b3e19d92 2580 int err;
2ca794e5
EB
2581 /*
2582 * Initialize the network sysctl infrastructure.
2583 */
2584 err = net_sysctl_init();
2585 if (err)
2586 goto out;
b3e19d92 2587
1da177e4 2588 /*
89bddce5 2589 * Initialize skbuff SLAB cache
1da177e4
LT
2590 */
2591 skb_init();
1da177e4
LT
2592
2593 /*
89bddce5 2594 * Initialize the protocols module.
1da177e4
LT
2595 */
2596
2597 init_inodecache();
b3e19d92
NP
2598
2599 err = register_filesystem(&sock_fs_type);
2600 if (err)
2601 goto out_fs;
1da177e4 2602 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2603 if (IS_ERR(sock_mnt)) {
2604 err = PTR_ERR(sock_mnt);
2605 goto out_mount;
2606 }
77d76ea3
AK
2607
2608 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2609 */
2610
2611#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2612 err = netfilter_init();
2613 if (err)
2614 goto out;
1da177e4 2615#endif
cbeb321a 2616
408eccce 2617 ptp_classifier_init();
c1f19b51 2618
b3e19d92
NP
2619out:
2620 return err;
2621
2622out_mount:
2623 unregister_filesystem(&sock_fs_type);
2624out_fs:
2625 goto out;
1da177e4
LT
2626}
2627
77d76ea3
AK
2628core_initcall(sock_init); /* early initcall */
2629
1da177e4
LT
2630#ifdef CONFIG_PROC_FS
2631void socket_seq_show(struct seq_file *seq)
2632{
2633 int cpu;
2634 int counter = 0;
2635
6f912042 2636 for_each_possible_cpu(cpu)
89bddce5 2637 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2638
2639 /* It can be negative, by the way. 8) */
2640 if (counter < 0)
2641 counter = 0;
2642
2643 seq_printf(seq, "sockets: used %d\n", counter);
2644}
89bddce5 2645#endif /* CONFIG_PROC_FS */
1da177e4 2646
89bbfc95 2647#ifdef CONFIG_COMPAT
6b96018b 2648static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2649 unsigned int cmd, void __user *up)
7a229387 2650{
7a229387
AB
2651 mm_segment_t old_fs = get_fs();
2652 struct timeval ktv;
2653 int err;
2654
2655 set_fs(KERNEL_DS);
6b96018b 2656 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2657 set_fs(old_fs);
644595f8 2658 if (!err)
ed6fe9d6 2659 err = compat_put_timeval(&ktv, up);
644595f8 2660
7a229387
AB
2661 return err;
2662}
2663
6b96018b 2664static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2665 unsigned int cmd, void __user *up)
7a229387 2666{
7a229387
AB
2667 mm_segment_t old_fs = get_fs();
2668 struct timespec kts;
2669 int err;
2670
2671 set_fs(KERNEL_DS);
6b96018b 2672 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2673 set_fs(old_fs);
644595f8 2674 if (!err)
ed6fe9d6 2675 err = compat_put_timespec(&kts, up);
644595f8 2676
7a229387
AB
2677 return err;
2678}
2679
6b96018b 2680static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2681{
2682 struct ifreq __user *uifr;
2683 int err;
2684
2685 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2686 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2687 return -EFAULT;
2688
6b96018b 2689 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2690 if (err)
2691 return err;
2692
6b96018b 2693 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2694 return -EFAULT;
2695
2696 return 0;
2697}
2698
6b96018b 2699static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2700{
6b96018b 2701 struct compat_ifconf ifc32;
7a229387
AB
2702 struct ifconf ifc;
2703 struct ifconf __user *uifc;
6b96018b 2704 struct compat_ifreq __user *ifr32;
7a229387
AB
2705 struct ifreq __user *ifr;
2706 unsigned int i, j;
2707 int err;
2708
6b96018b 2709 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2710 return -EFAULT;
2711
43da5f2e 2712 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2713 if (ifc32.ifcbuf == 0) {
2714 ifc32.ifc_len = 0;
2715 ifc.ifc_len = 0;
2716 ifc.ifc_req = NULL;
2717 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2718 } else {
c6d409cf
ED
2719 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2720 sizeof(struct ifreq);
7a229387
AB
2721 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2722 ifc.ifc_len = len;
2723 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2724 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2725 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2726 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2727 return -EFAULT;
2728 ifr++;
2729 ifr32++;
2730 }
2731 }
2732 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2733 return -EFAULT;
2734
6b96018b 2735 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2736 if (err)
2737 return err;
2738
2739 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2740 return -EFAULT;
2741
2742 ifr = ifc.ifc_req;
2743 ifr32 = compat_ptr(ifc32.ifcbuf);
2744 for (i = 0, j = 0;
c6d409cf
ED
2745 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2746 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2747 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2748 return -EFAULT;
2749 ifr32++;
2750 ifr++;
2751 }
2752
2753 if (ifc32.ifcbuf == 0) {
2754 /* Translate from 64-bit structure multiple to
2755 * a 32-bit one.
2756 */
2757 i = ifc.ifc_len;
6b96018b 2758 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2759 ifc32.ifc_len = i;
2760 } else {
2761 ifc32.ifc_len = i;
2762 }
6b96018b 2763 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2764 return -EFAULT;
2765
2766 return 0;
2767}
2768
6b96018b 2769static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2770{
3a7da39d
BH
2771 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2772 bool convert_in = false, convert_out = false;
2773 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2774 struct ethtool_rxnfc __user *rxnfc;
7a229387 2775 struct ifreq __user *ifr;
3a7da39d
BH
2776 u32 rule_cnt = 0, actual_rule_cnt;
2777 u32 ethcmd;
7a229387 2778 u32 data;
3a7da39d 2779 int ret;
7a229387 2780
3a7da39d
BH
2781 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2782 return -EFAULT;
7a229387 2783
3a7da39d
BH
2784 compat_rxnfc = compat_ptr(data);
2785
2786 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2787 return -EFAULT;
2788
3a7da39d
BH
2789 /* Most ethtool structures are defined without padding.
2790 * Unfortunately struct ethtool_rxnfc is an exception.
2791 */
2792 switch (ethcmd) {
2793 default:
2794 break;
2795 case ETHTOOL_GRXCLSRLALL:
2796 /* Buffer size is variable */
2797 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2798 return -EFAULT;
2799 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2800 return -ENOMEM;
2801 buf_size += rule_cnt * sizeof(u32);
2802 /* fall through */
2803 case ETHTOOL_GRXRINGS:
2804 case ETHTOOL_GRXCLSRLCNT:
2805 case ETHTOOL_GRXCLSRULE:
55664f32 2806 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2807 convert_out = true;
2808 /* fall through */
2809 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2810 buf_size += sizeof(struct ethtool_rxnfc);
2811 convert_in = true;
2812 break;
2813 }
2814
2815 ifr = compat_alloc_user_space(buf_size);
954b1244 2816 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2817
2818 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2819 return -EFAULT;
2820
3a7da39d
BH
2821 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2822 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2823 return -EFAULT;
2824
3a7da39d 2825 if (convert_in) {
127fe533 2826 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2827 * fs.ring_cookie and at the end of fs, but nowhere else.
2828 */
127fe533
AD
2829 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2830 sizeof(compat_rxnfc->fs.m_ext) !=
2831 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2832 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2833 BUILD_BUG_ON(
2834 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2835 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2836 offsetof(struct ethtool_rxnfc, fs.location) -
2837 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2838
2839 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2840 (void __user *)(&rxnfc->fs.m_ext + 1) -
2841 (void __user *)rxnfc) ||
3a7da39d
BH
2842 copy_in_user(&rxnfc->fs.ring_cookie,
2843 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2844 (void __user *)(&rxnfc->fs.location + 1) -
2845 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2846 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2847 sizeof(rxnfc->rule_cnt)))
2848 return -EFAULT;
2849 }
2850
2851 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2852 if (ret)
2853 return ret;
2854
2855 if (convert_out) {
2856 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2857 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2858 (const void __user *)rxnfc) ||
3a7da39d
BH
2859 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2860 &rxnfc->fs.ring_cookie,
954b1244
SH
2861 (const void __user *)(&rxnfc->fs.location + 1) -
2862 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2863 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2864 sizeof(rxnfc->rule_cnt)))
2865 return -EFAULT;
2866
2867 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2868 /* As an optimisation, we only copy the actual
2869 * number of rules that the underlying
2870 * function returned. Since Mallory might
2871 * change the rule count in user memory, we
2872 * check that it is less than the rule count
2873 * originally given (as the user buffer size),
2874 * which has been range-checked.
2875 */
2876 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2877 return -EFAULT;
2878 if (actual_rule_cnt < rule_cnt)
2879 rule_cnt = actual_rule_cnt;
2880 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2881 &rxnfc->rule_locs[0],
2882 rule_cnt * sizeof(u32)))
2883 return -EFAULT;
2884 }
2885 }
2886
2887 return 0;
7a229387
AB
2888}
2889
7a50a240
AB
2890static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2891{
2892 void __user *uptr;
2893 compat_uptr_t uptr32;
2894 struct ifreq __user *uifr;
2895
c6d409cf 2896 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2897 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2898 return -EFAULT;
2899
2900 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2901 return -EFAULT;
2902
2903 uptr = compat_ptr(uptr32);
2904
2905 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2906 return -EFAULT;
2907
2908 return dev_ioctl(net, SIOCWANDEV, uifr);
2909}
2910
6b96018b
AB
2911static int bond_ioctl(struct net *net, unsigned int cmd,
2912 struct compat_ifreq __user *ifr32)
7a229387
AB
2913{
2914 struct ifreq kifr;
7a229387
AB
2915 mm_segment_t old_fs;
2916 int err;
7a229387
AB
2917
2918 switch (cmd) {
2919 case SIOCBONDENSLAVE:
2920 case SIOCBONDRELEASE:
2921 case SIOCBONDSETHWADDR:
2922 case SIOCBONDCHANGEACTIVE:
6b96018b 2923 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2924 return -EFAULT;
2925
2926 old_fs = get_fs();
c6d409cf 2927 set_fs(KERNEL_DS);
c3f52ae6 2928 err = dev_ioctl(net, cmd,
2929 (struct ifreq __user __force *) &kifr);
c6d409cf 2930 set_fs(old_fs);
7a229387
AB
2931
2932 return err;
7a229387 2933 default:
07d106d0 2934 return -ENOIOCTLCMD;
ccbd6a5a 2935 }
7a229387
AB
2936}
2937
590d4693
BH
2938/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2939static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 2940 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2941{
2942 struct ifreq __user *u_ifreq64;
7a229387
AB
2943 char tmp_buf[IFNAMSIZ];
2944 void __user *data64;
2945 u32 data32;
2946
2947 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2948 IFNAMSIZ))
2949 return -EFAULT;
417c3522 2950 if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
7a229387
AB
2951 return -EFAULT;
2952 data64 = compat_ptr(data32);
2953
2954 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2955
7a229387
AB
2956 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2957 IFNAMSIZ))
2958 return -EFAULT;
417c3522 2959 if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
7a229387
AB
2960 return -EFAULT;
2961
6b96018b 2962 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
2963}
2964
6b96018b
AB
2965static int dev_ifsioc(struct net *net, struct socket *sock,
2966 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 2967{
a2116ed2 2968 struct ifreq __user *uifr;
7a229387
AB
2969 int err;
2970
a2116ed2
AB
2971 uifr = compat_alloc_user_space(sizeof(*uifr));
2972 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2973 return -EFAULT;
2974
2975 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2976
7a229387
AB
2977 if (!err) {
2978 switch (cmd) {
2979 case SIOCGIFFLAGS:
2980 case SIOCGIFMETRIC:
2981 case SIOCGIFMTU:
2982 case SIOCGIFMEM:
2983 case SIOCGIFHWADDR:
2984 case SIOCGIFINDEX:
2985 case SIOCGIFADDR:
2986 case SIOCGIFBRDADDR:
2987 case SIOCGIFDSTADDR:
2988 case SIOCGIFNETMASK:
fab2532b 2989 case SIOCGIFPFLAGS:
7a229387 2990 case SIOCGIFTXQLEN:
fab2532b
AB
2991 case SIOCGMIIPHY:
2992 case SIOCGMIIREG:
a2116ed2 2993 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
2994 err = -EFAULT;
2995 break;
2996 }
2997 }
2998 return err;
2999}
3000
a2116ed2
AB
3001static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3002 struct compat_ifreq __user *uifr32)
3003{
3004 struct ifreq ifr;
3005 struct compat_ifmap __user *uifmap32;
3006 mm_segment_t old_fs;
3007 int err;
3008
3009 uifmap32 = &uifr32->ifr_ifru.ifru_map;
3010 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
3011 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3012 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3013 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3014 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
3015 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
3016 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
3017 if (err)
3018 return -EFAULT;
3019
3020 old_fs = get_fs();
c6d409cf 3021 set_fs(KERNEL_DS);
c3f52ae6 3022 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3023 set_fs(old_fs);
a2116ed2
AB
3024
3025 if (cmd == SIOCGIFMAP && !err) {
3026 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
3027 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3028 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3029 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3030 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
3031 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
3032 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
3033 if (err)
3034 err = -EFAULT;
3035 }
3036 return err;
3037}
3038
7a229387 3039struct rtentry32 {
c6d409cf 3040 u32 rt_pad1;
7a229387
AB
3041 struct sockaddr rt_dst; /* target address */
3042 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3043 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3044 unsigned short rt_flags;
3045 short rt_pad2;
3046 u32 rt_pad3;
3047 unsigned char rt_tos;
3048 unsigned char rt_class;
3049 short rt_pad4;
3050 short rt_metric; /* +1 for binary compatibility! */
7a229387 3051 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3052 u32 rt_mtu; /* per route MTU/Window */
3053 u32 rt_window; /* Window clamping */
7a229387
AB
3054 unsigned short rt_irtt; /* Initial RTT */
3055};
3056
3057struct in6_rtmsg32 {
3058 struct in6_addr rtmsg_dst;
3059 struct in6_addr rtmsg_src;
3060 struct in6_addr rtmsg_gateway;
3061 u32 rtmsg_type;
3062 u16 rtmsg_dst_len;
3063 u16 rtmsg_src_len;
3064 u32 rtmsg_metric;
3065 u32 rtmsg_info;
3066 u32 rtmsg_flags;
3067 s32 rtmsg_ifindex;
3068};
3069
6b96018b
AB
3070static int routing_ioctl(struct net *net, struct socket *sock,
3071 unsigned int cmd, void __user *argp)
7a229387
AB
3072{
3073 int ret;
3074 void *r = NULL;
3075 struct in6_rtmsg r6;
3076 struct rtentry r4;
3077 char devname[16];
3078 u32 rtdev;
3079 mm_segment_t old_fs = get_fs();
3080
6b96018b
AB
3081 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3082 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3083 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3084 3 * sizeof(struct in6_addr));
3ddc5b46
MD
3085 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3086 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3087 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3088 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3089 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3090 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3091 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3092
3093 r = (void *) &r6;
3094 } else { /* ipv4 */
6b96018b 3095 struct rtentry32 __user *ur4 = argp;
c6d409cf 3096 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3097 3 * sizeof(struct sockaddr));
3ddc5b46
MD
3098 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3099 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3100 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3101 ret |= get_user(r4.rt_window, &(ur4->rt_window));
3102 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3103 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 3104 if (rtdev) {
c6d409cf 3105 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3106 r4.rt_dev = (char __user __force *)devname;
3107 devname[15] = 0;
7a229387
AB
3108 } else
3109 r4.rt_dev = NULL;
3110
3111 r = (void *) &r4;
3112 }
3113
3114 if (ret) {
3115 ret = -EFAULT;
3116 goto out;
3117 }
3118
c6d409cf 3119 set_fs(KERNEL_DS);
6b96018b 3120 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3121 set_fs(old_fs);
7a229387
AB
3122
3123out:
7a229387
AB
3124 return ret;
3125}
3126
3127/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3128 * for some operations; this forces use of the newer bridge-utils that
25985edc 3129 * use compatible ioctls
7a229387 3130 */
6b96018b 3131static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3132{
6b96018b 3133 compat_ulong_t tmp;
7a229387 3134
6b96018b 3135 if (get_user(tmp, argp))
7a229387
AB
3136 return -EFAULT;
3137 if (tmp == BRCTL_GET_VERSION)
3138 return BRCTL_VERSION + 1;
3139 return -EINVAL;
3140}
3141
6b96018b
AB
3142static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3143 unsigned int cmd, unsigned long arg)
3144{
3145 void __user *argp = compat_ptr(arg);
3146 struct sock *sk = sock->sk;
3147 struct net *net = sock_net(sk);
7a229387 3148
6b96018b 3149 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3150 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3151
3152 switch (cmd) {
3153 case SIOCSIFBR:
3154 case SIOCGIFBR:
3155 return old_bridge_ioctl(argp);
3156 case SIOCGIFNAME:
3157 return dev_ifname32(net, argp);
3158 case SIOCGIFCONF:
3159 return dev_ifconf(net, argp);
3160 case SIOCETHTOOL:
3161 return ethtool_ioctl(net, argp);
7a50a240
AB
3162 case SIOCWANDEV:
3163 return compat_siocwandev(net, argp);
a2116ed2
AB
3164 case SIOCGIFMAP:
3165 case SIOCSIFMAP:
3166 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3167 case SIOCBONDENSLAVE:
3168 case SIOCBONDRELEASE:
3169 case SIOCBONDSETHWADDR:
6b96018b
AB
3170 case SIOCBONDCHANGEACTIVE:
3171 return bond_ioctl(net, cmd, argp);
3172 case SIOCADDRT:
3173 case SIOCDELRT:
3174 return routing_ioctl(net, sock, cmd, argp);
3175 case SIOCGSTAMP:
3176 return do_siocgstamp(net, sock, cmd, argp);
3177 case SIOCGSTAMPNS:
3178 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3179 case SIOCBONDSLAVEINFOQUERY:
3180 case SIOCBONDINFOQUERY:
a2116ed2 3181 case SIOCSHWTSTAMP:
fd468c74 3182 case SIOCGHWTSTAMP:
590d4693 3183 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3184
3185 case FIOSETOWN:
3186 case SIOCSPGRP:
3187 case FIOGETOWN:
3188 case SIOCGPGRP:
3189 case SIOCBRADDBR:
3190 case SIOCBRDELBR:
3191 case SIOCGIFVLAN:
3192 case SIOCSIFVLAN:
3193 case SIOCADDDLCI:
3194 case SIOCDELDLCI:
3195 return sock_ioctl(file, cmd, arg);
3196
3197 case SIOCGIFFLAGS:
3198 case SIOCSIFFLAGS:
3199 case SIOCGIFMETRIC:
3200 case SIOCSIFMETRIC:
3201 case SIOCGIFMTU:
3202 case SIOCSIFMTU:
3203 case SIOCGIFMEM:
3204 case SIOCSIFMEM:
3205 case SIOCGIFHWADDR:
3206 case SIOCSIFHWADDR:
3207 case SIOCADDMULTI:
3208 case SIOCDELMULTI:
3209 case SIOCGIFINDEX:
6b96018b
AB
3210 case SIOCGIFADDR:
3211 case SIOCSIFADDR:
3212 case SIOCSIFHWBROADCAST:
6b96018b 3213 case SIOCDIFADDR:
6b96018b
AB
3214 case SIOCGIFBRDADDR:
3215 case SIOCSIFBRDADDR:
3216 case SIOCGIFDSTADDR:
3217 case SIOCSIFDSTADDR:
3218 case SIOCGIFNETMASK:
3219 case SIOCSIFNETMASK:
3220 case SIOCSIFPFLAGS:
3221 case SIOCGIFPFLAGS:
3222 case SIOCGIFTXQLEN:
3223 case SIOCSIFTXQLEN:
3224 case SIOCBRADDIF:
3225 case SIOCBRDELIF:
9177efd3
AB
3226 case SIOCSIFNAME:
3227 case SIOCGMIIPHY:
3228 case SIOCGMIIREG:
3229 case SIOCSMIIREG:
6b96018b 3230 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3231
6b96018b
AB
3232 case SIOCSARP:
3233 case SIOCGARP:
3234 case SIOCDARP:
6b96018b 3235 case SIOCATMARK:
9177efd3
AB
3236 return sock_do_ioctl(net, sock, cmd, arg);
3237 }
3238
6b96018b
AB
3239 return -ENOIOCTLCMD;
3240}
7a229387 3241
95c96174 3242static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3243 unsigned long arg)
89bbfc95
SP
3244{
3245 struct socket *sock = file->private_data;
3246 int ret = -ENOIOCTLCMD;
87de87d5
DM
3247 struct sock *sk;
3248 struct net *net;
3249
3250 sk = sock->sk;
3251 net = sock_net(sk);
89bbfc95
SP
3252
3253 if (sock->ops->compat_ioctl)
3254 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3255
87de87d5
DM
3256 if (ret == -ENOIOCTLCMD &&
3257 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3258 ret = compat_wext_handle_ioctl(net, cmd, arg);
3259
6b96018b
AB
3260 if (ret == -ENOIOCTLCMD)
3261 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3262
89bbfc95
SP
3263 return ret;
3264}
3265#endif
3266
ac5a488e
SS
3267int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3268{
3269 return sock->ops->bind(sock, addr, addrlen);
3270}
c6d409cf 3271EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3272
3273int kernel_listen(struct socket *sock, int backlog)
3274{
3275 return sock->ops->listen(sock, backlog);
3276}
c6d409cf 3277EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3278
3279int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3280{
3281 struct sock *sk = sock->sk;
3282 int err;
3283
3284 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3285 newsock);
3286 if (err < 0)
3287 goto done;
3288
3289 err = sock->ops->accept(sock, *newsock, flags);
3290 if (err < 0) {
3291 sock_release(*newsock);
fa8705b0 3292 *newsock = NULL;
ac5a488e
SS
3293 goto done;
3294 }
3295
3296 (*newsock)->ops = sock->ops;
1b08534e 3297 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3298
3299done:
3300 return err;
3301}
c6d409cf 3302EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3303
3304int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3305 int flags)
ac5a488e
SS
3306{
3307 return sock->ops->connect(sock, addr, addrlen, flags);
3308}
c6d409cf 3309EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3310
3311int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3312 int *addrlen)
3313{
3314 return sock->ops->getname(sock, addr, addrlen, 0);
3315}
c6d409cf 3316EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3317
3318int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3319 int *addrlen)
3320{
3321 return sock->ops->getname(sock, addr, addrlen, 1);
3322}
c6d409cf 3323EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3324
3325int kernel_getsockopt(struct socket *sock, int level, int optname,
3326 char *optval, int *optlen)
3327{
3328 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3329 char __user *uoptval;
3330 int __user *uoptlen;
ac5a488e
SS
3331 int err;
3332
fb8621bb
NK
3333 uoptval = (char __user __force *) optval;
3334 uoptlen = (int __user __force *) optlen;
3335
ac5a488e
SS
3336 set_fs(KERNEL_DS);
3337 if (level == SOL_SOCKET)
fb8621bb 3338 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3339 else
fb8621bb
NK
3340 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3341 uoptlen);
ac5a488e
SS
3342 set_fs(oldfs);
3343 return err;
3344}
c6d409cf 3345EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3346
3347int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3348 char *optval, unsigned int optlen)
ac5a488e
SS
3349{
3350 mm_segment_t oldfs = get_fs();
fb8621bb 3351 char __user *uoptval;
ac5a488e
SS
3352 int err;
3353
fb8621bb
NK
3354 uoptval = (char __user __force *) optval;
3355
ac5a488e
SS
3356 set_fs(KERNEL_DS);
3357 if (level == SOL_SOCKET)
fb8621bb 3358 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3359 else
fb8621bb 3360 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3361 optlen);
3362 set_fs(oldfs);
3363 return err;
3364}
c6d409cf 3365EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3366
3367int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3368 size_t size, int flags)
3369{
3370 if (sock->ops->sendpage)
3371 return sock->ops->sendpage(sock, page, offset, size, flags);
3372
3373 return sock_no_sendpage(sock, page, offset, size, flags);
3374}
c6d409cf 3375EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3376
3377int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3378{
3379 mm_segment_t oldfs = get_fs();
3380 int err;
3381
3382 set_fs(KERNEL_DS);
3383 err = sock->ops->ioctl(sock, cmd, arg);
3384 set_fs(oldfs);
3385
3386 return err;
3387}
c6d409cf 3388EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3389
91cf45f0
TM
3390int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3391{
3392 return sock->ops->shutdown(sock, how);
3393}
91cf45f0 3394EXPORT_SYMBOL(kernel_sock_shutdown);