take descriptor handling from sock_alloc_file() to callers
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4
LT
72#include <linux/wanrouter.h>
73#include <linux/if_bridge.h>
20380731
ACM
74#include <linux/if_frad.h>
75#include <linux/if_vlan.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
1da177e4
LT
91
92#include <asm/uaccess.h>
93#include <asm/unistd.h>
94
95#include <net/compat.h>
87de87d5 96#include <net/wext.h>
f8451725 97#include <net/cls_cgroup.h>
1da177e4
LT
98
99#include <net/sock.h>
100#include <linux/netfilter.h>
101
6b96018b
AB
102#include <linux/if_tun.h>
103#include <linux/ipv6_route.h>
104#include <linux/route.h>
6b96018b
AB
105#include <linux/sockios.h>
106#include <linux/atalk.h>
107
1da177e4 108static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
109static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
110 unsigned long nr_segs, loff_t pos);
111static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
112 unsigned long nr_segs, loff_t pos);
89bddce5 113static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
114
115static int sock_close(struct inode *inode, struct file *file);
116static unsigned int sock_poll(struct file *file,
117 struct poll_table_struct *wait);
89bddce5 118static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
119#ifdef CONFIG_COMPAT
120static long compat_sock_ioctl(struct file *file,
89bddce5 121 unsigned int cmd, unsigned long arg);
89bbfc95 122#endif
1da177e4 123static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
124static ssize_t sock_sendpage(struct file *file, struct page *page,
125 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 126static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 127 struct pipe_inode_info *pipe, size_t len,
9c55e01c 128 unsigned int flags);
1da177e4 129
1da177e4
LT
130/*
131 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
132 * in the operation structures but are done directly via the socketcall() multiplexor.
133 */
134
da7071d7 135static const struct file_operations socket_file_ops = {
1da177e4
LT
136 .owner = THIS_MODULE,
137 .llseek = no_llseek,
138 .aio_read = sock_aio_read,
139 .aio_write = sock_aio_write,
140 .poll = sock_poll,
141 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
142#ifdef CONFIG_COMPAT
143 .compat_ioctl = compat_sock_ioctl,
144#endif
1da177e4
LT
145 .mmap = sock_mmap,
146 .open = sock_no_open, /* special open code to disallow open via /proc */
147 .release = sock_close,
148 .fasync = sock_fasync,
5274f052
JA
149 .sendpage = sock_sendpage,
150 .splice_write = generic_splice_sendpage,
9c55e01c 151 .splice_read = sock_splice_read,
1da177e4
LT
152};
153
154/*
155 * The protocol list. Each protocol is registered in here.
156 */
157
1da177e4 158static DEFINE_SPINLOCK(net_family_lock);
190683a9 159static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 160
1da177e4
LT
161/*
162 * Statistics counters of the socket lists
163 */
164
c6d409cf 165static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
166
167/*
89bddce5
SH
168 * Support routines.
169 * Move socket addresses back and forth across the kernel/user
170 * divide and look after the messy bits.
1da177e4
LT
171 */
172
1da177e4
LT
173/**
174 * move_addr_to_kernel - copy a socket address into kernel space
175 * @uaddr: Address in user space
176 * @kaddr: Address in kernel space
177 * @ulen: Length in user space
178 *
179 * The address is copied into kernel space. If the provided address is
180 * too long an error code of -EINVAL is returned. If the copy gives
181 * invalid addresses -EFAULT is returned. On a success 0 is returned.
182 */
183
43db362d 184int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 185{
230b1839 186 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 187 return -EINVAL;
89bddce5 188 if (ulen == 0)
1da177e4 189 return 0;
89bddce5 190 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 191 return -EFAULT;
3ec3b2fb 192 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
193}
194
195/**
196 * move_addr_to_user - copy an address to user space
197 * @kaddr: kernel space address
198 * @klen: length of address in kernel
199 * @uaddr: user space address
200 * @ulen: pointer to user length field
201 *
202 * The value pointed to by ulen on entry is the buffer length available.
203 * This is overwritten with the buffer space used. -EINVAL is returned
204 * if an overlong buffer is specified or a negative buffer size. -EFAULT
205 * is returned if either the buffer or the length field are not
206 * accessible.
207 * After copying the data up to the limit the user specifies, the true
208 * length of the data is written over the length limit the user
209 * specified. Zero is returned for a success.
210 */
89bddce5 211
43db362d 212static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 213 void __user *uaddr, int __user *ulen)
1da177e4
LT
214{
215 int err;
216 int len;
217
89bddce5
SH
218 err = get_user(len, ulen);
219 if (err)
1da177e4 220 return err;
89bddce5
SH
221 if (len > klen)
222 len = klen;
230b1839 223 if (len < 0 || len > sizeof(struct sockaddr_storage))
1da177e4 224 return -EINVAL;
89bddce5 225 if (len) {
d6fe3945
SG
226 if (audit_sockaddr(klen, kaddr))
227 return -ENOMEM;
89bddce5 228 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
229 return -EFAULT;
230 }
231 /*
89bddce5
SH
232 * "fromlen shall refer to the value before truncation.."
233 * 1003.1g
1da177e4
LT
234 */
235 return __put_user(klen, ulen);
236}
237
e18b890b 238static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
239
240static struct inode *sock_alloc_inode(struct super_block *sb)
241{
242 struct socket_alloc *ei;
eaefd110 243 struct socket_wq *wq;
89bddce5 244
e94b1766 245 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
246 if (!ei)
247 return NULL;
eaefd110
ED
248 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
249 if (!wq) {
43815482
ED
250 kmem_cache_free(sock_inode_cachep, ei);
251 return NULL;
252 }
eaefd110
ED
253 init_waitqueue_head(&wq->wait);
254 wq->fasync_list = NULL;
255 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 256
1da177e4
LT
257 ei->socket.state = SS_UNCONNECTED;
258 ei->socket.flags = 0;
259 ei->socket.ops = NULL;
260 ei->socket.sk = NULL;
261 ei->socket.file = NULL;
1da177e4
LT
262
263 return &ei->vfs_inode;
264}
265
266static void sock_destroy_inode(struct inode *inode)
267{
43815482 268 struct socket_alloc *ei;
eaefd110 269 struct socket_wq *wq;
43815482
ED
270
271 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 272 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 273 kfree_rcu(wq, rcu);
43815482 274 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
275}
276
51cc5068 277static void init_once(void *foo)
1da177e4 278{
89bddce5 279 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 280
a35afb83 281 inode_init_once(&ei->vfs_inode);
1da177e4 282}
89bddce5 283
1da177e4
LT
284static int init_inodecache(void)
285{
286 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
287 sizeof(struct socket_alloc),
288 0,
289 (SLAB_HWCACHE_ALIGN |
290 SLAB_RECLAIM_ACCOUNT |
291 SLAB_MEM_SPREAD),
20c2df83 292 init_once);
1da177e4
LT
293 if (sock_inode_cachep == NULL)
294 return -ENOMEM;
295 return 0;
296}
297
b87221de 298static const struct super_operations sockfs_ops = {
c6d409cf
ED
299 .alloc_inode = sock_alloc_inode,
300 .destroy_inode = sock_destroy_inode,
301 .statfs = simple_statfs,
1da177e4
LT
302};
303
c23fbb6b
ED
304/*
305 * sockfs_dname() is called from d_path().
306 */
307static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
308{
309 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
310 dentry->d_inode->i_ino);
311}
312
3ba13d17 313static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 314 .d_dname = sockfs_dname,
1da177e4
LT
315};
316
c74a1cbb
AV
317static struct dentry *sockfs_mount(struct file_system_type *fs_type,
318 int flags, const char *dev_name, void *data)
319{
320 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
321 &sockfs_dentry_operations, SOCKFS_MAGIC);
322}
323
324static struct vfsmount *sock_mnt __read_mostly;
325
326static struct file_system_type sock_fs_type = {
327 .name = "sockfs",
328 .mount = sockfs_mount,
329 .kill_sb = kill_anon_super,
330};
331
1da177e4
LT
332/*
333 * Obtains the first available file descriptor and sets it up for use.
334 *
39d8c1b6
DM
335 * These functions create file structures and maps them to fd space
336 * of the current process. On success it returns file descriptor
1da177e4
LT
337 * and file struct implicitly stored in sock->file.
338 * Note that another thread may close file descriptor before we return
339 * from this function. We use the fact that now we do not refer
340 * to socket after mapping. If one day we will need it, this
341 * function will increment ref. count on file by 1.
342 *
343 * In any case returned fd MAY BE not valid!
344 * This race condition is unavoidable
345 * with shared fd spaces, we cannot solve it inside kernel,
346 * but we take care of internal coherence yet.
347 */
348
28407630 349static struct file *sock_alloc_file(struct socket *sock, int flags)
1da177e4 350{
7cbe66b6 351 struct qstr name = { .name = "" };
2c48b9c4 352 struct path path;
7cbe66b6 353 struct file *file;
1da177e4 354
4b936885 355 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
356 if (unlikely(!path.dentry))
357 return ERR_PTR(-ENOMEM);
2c48b9c4 358 path.mnt = mntget(sock_mnt);
39d8c1b6 359
2c48b9c4 360 d_instantiate(path.dentry, SOCK_INODE(sock));
cc3808f8 361 SOCK_INODE(sock)->i_fop = &socket_file_ops;
39d8c1b6 362
2c48b9c4 363 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 364 &socket_file_ops);
cc3808f8
AV
365 if (unlikely(!file)) {
366 /* drop dentry, keep inode */
7de9c6ee 367 ihold(path.dentry->d_inode);
2c48b9c4 368 path_put(&path);
28407630 369 return ERR_PTR(-ENFILE);
cc3808f8
AV
370 }
371
372 sock->file = file;
77d27200 373 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6
DM
374 file->f_pos = 0;
375 file->private_data = sock;
28407630 376 return file;
39d8c1b6
DM
377}
378
a677a039 379int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
380{
381 struct file *newfile;
28407630
AV
382 int fd = get_unused_fd_flags(flags);
383 if (unlikely(fd < 0))
384 return fd;
39d8c1b6 385
28407630
AV
386 newfile = sock_alloc_file(sock, flags);
387 if (likely(!IS_ERR(newfile))) {
39d8c1b6 388 fd_install(fd, newfile);
28407630
AV
389 return fd;
390 }
7cbe66b6 391
28407630
AV
392 put_unused_fd(fd);
393 return PTR_ERR(newfile);
1da177e4 394}
c6d409cf 395EXPORT_SYMBOL(sock_map_fd);
1da177e4 396
406a3c63 397struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 398{
6cb153ca
BL
399 if (file->f_op == &socket_file_ops)
400 return file->private_data; /* set in sock_map_fd */
401
23bb80d2
ED
402 *err = -ENOTSOCK;
403 return NULL;
6cb153ca 404}
406a3c63 405EXPORT_SYMBOL(sock_from_file);
6cb153ca 406
1da177e4 407/**
c6d409cf 408 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
409 * @fd: file handle
410 * @err: pointer to an error code return
411 *
412 * The file handle passed in is locked and the socket it is bound
413 * too is returned. If an error occurs the err pointer is overwritten
414 * with a negative errno code and NULL is returned. The function checks
415 * for both invalid handles and passing a handle which is not a socket.
416 *
417 * On a success the socket object pointer is returned.
418 */
419
420struct socket *sockfd_lookup(int fd, int *err)
421{
422 struct file *file;
1da177e4
LT
423 struct socket *sock;
424
89bddce5
SH
425 file = fget(fd);
426 if (!file) {
1da177e4
LT
427 *err = -EBADF;
428 return NULL;
429 }
89bddce5 430
6cb153ca
BL
431 sock = sock_from_file(file, err);
432 if (!sock)
1da177e4 433 fput(file);
6cb153ca
BL
434 return sock;
435}
c6d409cf 436EXPORT_SYMBOL(sockfd_lookup);
1da177e4 437
6cb153ca
BL
438static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
439{
440 struct file *file;
441 struct socket *sock;
442
3672558c 443 *err = -EBADF;
6cb153ca
BL
444 file = fget_light(fd, fput_needed);
445 if (file) {
446 sock = sock_from_file(file, err);
447 if (sock)
448 return sock;
449 fput_light(file, *fput_needed);
1da177e4 450 }
6cb153ca 451 return NULL;
1da177e4
LT
452}
453
454/**
455 * sock_alloc - allocate a socket
89bddce5 456 *
1da177e4
LT
457 * Allocate a new inode and socket object. The two are bound together
458 * and initialised. The socket is then returned. If we are out of inodes
459 * NULL is returned.
460 */
461
462static struct socket *sock_alloc(void)
463{
89bddce5
SH
464 struct inode *inode;
465 struct socket *sock;
1da177e4 466
a209dfc7 467 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
468 if (!inode)
469 return NULL;
470
471 sock = SOCKET_I(inode);
472
29a020d3 473 kmemcheck_annotate_bitfield(sock, type);
85fe4025 474 inode->i_ino = get_next_ino();
89bddce5 475 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
476 inode->i_uid = current_fsuid();
477 inode->i_gid = current_fsgid();
1da177e4 478
19e8d69c 479 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
480 return sock;
481}
482
483/*
484 * In theory you can't get an open on this inode, but /proc provides
485 * a back door. Remember to keep it shut otherwise you'll let the
486 * creepy crawlies in.
487 */
89bddce5 488
1da177e4
LT
489static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
490{
491 return -ENXIO;
492}
493
4b6f5d20 494const struct file_operations bad_sock_fops = {
1da177e4
LT
495 .owner = THIS_MODULE,
496 .open = sock_no_open,
6038f373 497 .llseek = noop_llseek,
1da177e4
LT
498};
499
500/**
501 * sock_release - close a socket
502 * @sock: socket to close
503 *
504 * The socket is released from the protocol stack if it has a release
505 * callback, and the inode is then released if the socket is bound to
89bddce5 506 * an inode not a file.
1da177e4 507 */
89bddce5 508
1da177e4
LT
509void sock_release(struct socket *sock)
510{
511 if (sock->ops) {
512 struct module *owner = sock->ops->owner;
513
514 sock->ops->release(sock);
515 sock->ops = NULL;
516 module_put(owner);
517 }
518
eaefd110 519 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
1da177e4
LT
520 printk(KERN_ERR "sock_release: fasync list not empty!\n");
521
b09e786b
MP
522 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
523 return;
524
19e8d69c 525 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
526 if (!sock->file) {
527 iput(SOCK_INODE(sock));
528 return;
529 }
89bddce5 530 sock->file = NULL;
1da177e4 531}
c6d409cf 532EXPORT_SYMBOL(sock_release);
1da177e4 533
2244d07b 534int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
20d49473 535{
2244d07b 536 *tx_flags = 0;
20d49473 537 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
2244d07b 538 *tx_flags |= SKBTX_HW_TSTAMP;
20d49473 539 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
2244d07b 540 *tx_flags |= SKBTX_SW_TSTAMP;
6e3e939f
JB
541 if (sock_flag(sk, SOCK_WIFI_STATUS))
542 *tx_flags |= SKBTX_WIFI_STATUS;
20d49473
PO
543 return 0;
544}
545EXPORT_SYMBOL(sock_tx_timestamp);
546
228e548e
AB
547static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
548 struct msghdr *msg, size_t size)
1da177e4
LT
549{
550 struct sock_iocb *si = kiocb_to_siocb(iocb);
1da177e4 551
f8451725
HX
552 sock_update_classid(sock->sk);
553
1da177e4
LT
554 si->sock = sock;
555 si->scm = NULL;
556 si->msg = msg;
557 si->size = size;
558
1da177e4
LT
559 return sock->ops->sendmsg(iocb, sock, msg, size);
560}
561
228e548e
AB
562static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
563 struct msghdr *msg, size_t size)
564{
565 int err = security_socket_sendmsg(sock, msg, size);
566
567 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
568}
569
1da177e4
LT
570int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
571{
572 struct kiocb iocb;
573 struct sock_iocb siocb;
574 int ret;
575
576 init_sync_kiocb(&iocb, NULL);
577 iocb.private = &siocb;
578 ret = __sock_sendmsg(&iocb, sock, msg, size);
579 if (-EIOCBQUEUED == ret)
580 ret = wait_on_sync_kiocb(&iocb);
581 return ret;
582}
c6d409cf 583EXPORT_SYMBOL(sock_sendmsg);
1da177e4 584
894dc24c 585static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
586{
587 struct kiocb iocb;
588 struct sock_iocb siocb;
589 int ret;
590
591 init_sync_kiocb(&iocb, NULL);
592 iocb.private = &siocb;
593 ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
594 if (-EIOCBQUEUED == ret)
595 ret = wait_on_sync_kiocb(&iocb);
596 return ret;
597}
598
1da177e4
LT
599int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
600 struct kvec *vec, size_t num, size_t size)
601{
602 mm_segment_t oldfs = get_fs();
603 int result;
604
605 set_fs(KERNEL_DS);
606 /*
607 * the following is safe, since for compiler definitions of kvec and
608 * iovec are identical, yielding the same in-core layout and alignment
609 */
89bddce5 610 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
611 msg->msg_iovlen = num;
612 result = sock_sendmsg(sock, msg, size);
613 set_fs(oldfs);
614 return result;
615}
c6d409cf 616EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 617
20d49473
PO
618static int ktime2ts(ktime_t kt, struct timespec *ts)
619{
620 if (kt.tv64) {
621 *ts = ktime_to_timespec(kt);
622 return 1;
623 } else {
624 return 0;
625 }
626}
627
92f37fd2
ED
628/*
629 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
630 */
631void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
632 struct sk_buff *skb)
633{
20d49473
PO
634 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
635 struct timespec ts[3];
636 int empty = 1;
637 struct skb_shared_hwtstamps *shhwtstamps =
638 skb_hwtstamps(skb);
639
640 /* Race occurred between timestamp enabling and packet
641 receiving. Fill in the current time for now. */
642 if (need_software_tstamp && skb->tstamp.tv64 == 0)
643 __net_timestamp(skb);
644
645 if (need_software_tstamp) {
646 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
647 struct timeval tv;
648 skb_get_timestamp(skb, &tv);
649 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
650 sizeof(tv), &tv);
651 } else {
842509b8 652 skb_get_timestampns(skb, &ts[0]);
20d49473 653 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
842509b8 654 sizeof(ts[0]), &ts[0]);
20d49473
PO
655 }
656 }
657
658
659 memset(ts, 0, sizeof(ts));
660 if (skb->tstamp.tv64 &&
661 sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE)) {
662 skb_get_timestampns(skb, ts + 0);
663 empty = 0;
664 }
665 if (shhwtstamps) {
666 if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
667 ktime2ts(shhwtstamps->syststamp, ts + 1))
668 empty = 0;
669 if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
670 ktime2ts(shhwtstamps->hwtstamp, ts + 2))
671 empty = 0;
92f37fd2 672 }
20d49473
PO
673 if (!empty)
674 put_cmsg(msg, SOL_SOCKET,
675 SCM_TIMESTAMPING, sizeof(ts), &ts);
92f37fd2 676}
7c81fd8b
ACM
677EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
678
6e3e939f
JB
679void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
680 struct sk_buff *skb)
681{
682 int ack;
683
684 if (!sock_flag(sk, SOCK_WIFI_STATUS))
685 return;
686 if (!skb->wifi_acked_valid)
687 return;
688
689 ack = skb->wifi_acked;
690
691 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
692}
693EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
694
11165f14 695static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
696 struct sk_buff *skb)
3b885787
NH
697{
698 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
699 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
700 sizeof(__u32), &skb->dropcount);
701}
702
767dd033 703void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
704 struct sk_buff *skb)
705{
706 sock_recv_timestamp(msg, sk, skb);
707 sock_recv_drops(msg, sk, skb);
708}
767dd033 709EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 710
a2e27255
ACM
711static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
712 struct msghdr *msg, size_t size, int flags)
1da177e4 713{
1da177e4
LT
714 struct sock_iocb *si = kiocb_to_siocb(iocb);
715
f8451725
HX
716 sock_update_classid(sock->sk);
717
1da177e4
LT
718 si->sock = sock;
719 si->scm = NULL;
720 si->msg = msg;
721 si->size = size;
722 si->flags = flags;
723
1da177e4
LT
724 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
725}
726
a2e27255
ACM
727static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
728 struct msghdr *msg, size_t size, int flags)
729{
730 int err = security_socket_recvmsg(sock, msg, size, flags);
731
732 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
733}
734
89bddce5 735int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
736 size_t size, int flags)
737{
738 struct kiocb iocb;
739 struct sock_iocb siocb;
740 int ret;
741
89bddce5 742 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
743 iocb.private = &siocb;
744 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
745 if (-EIOCBQUEUED == ret)
746 ret = wait_on_sync_kiocb(&iocb);
747 return ret;
748}
c6d409cf 749EXPORT_SYMBOL(sock_recvmsg);
1da177e4 750
a2e27255
ACM
751static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
752 size_t size, int flags)
753{
754 struct kiocb iocb;
755 struct sock_iocb siocb;
756 int ret;
757
758 init_sync_kiocb(&iocb, NULL);
759 iocb.private = &siocb;
760 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
761 if (-EIOCBQUEUED == ret)
762 ret = wait_on_sync_kiocb(&iocb);
763 return ret;
764}
765
c1249c0a
ML
766/**
767 * kernel_recvmsg - Receive a message from a socket (kernel space)
768 * @sock: The socket to receive the message from
769 * @msg: Received message
770 * @vec: Input s/g array for message data
771 * @num: Size of input s/g array
772 * @size: Number of bytes to read
773 * @flags: Message flags (MSG_DONTWAIT, etc...)
774 *
775 * On return the msg structure contains the scatter/gather array passed in the
776 * vec argument. The array is modified so that it consists of the unfilled
777 * portion of the original array.
778 *
779 * The returned value is the total number of bytes received, or an error.
780 */
89bddce5
SH
781int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
782 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
783{
784 mm_segment_t oldfs = get_fs();
785 int result;
786
787 set_fs(KERNEL_DS);
788 /*
789 * the following is safe, since for compiler definitions of kvec and
790 * iovec are identical, yielding the same in-core layout and alignment
791 */
89bddce5 792 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
793 result = sock_recvmsg(sock, msg, size, flags);
794 set_fs(oldfs);
795 return result;
796}
c6d409cf 797EXPORT_SYMBOL(kernel_recvmsg);
1da177e4
LT
798
799static void sock_aio_dtor(struct kiocb *iocb)
800{
801 kfree(iocb->private);
802}
803
ce1d4d3e
CH
804static ssize_t sock_sendpage(struct file *file, struct page *page,
805 int offset, size_t size, loff_t *ppos, int more)
1da177e4 806{
1da177e4
LT
807 struct socket *sock;
808 int flags;
809
ce1d4d3e
CH
810 sock = file->private_data;
811
35f9c09f
ED
812 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
813 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
814 flags |= more;
ce1d4d3e 815
e6949583 816 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 817}
1da177e4 818
9c55e01c 819static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 820 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
821 unsigned int flags)
822{
823 struct socket *sock = file->private_data;
824
997b37da
RDC
825 if (unlikely(!sock->ops->splice_read))
826 return -EINVAL;
827
f8451725
HX
828 sock_update_classid(sock->sk);
829
9c55e01c
JA
830 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
831}
832
ce1d4d3e 833static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 834 struct sock_iocb *siocb)
ce1d4d3e
CH
835{
836 if (!is_sync_kiocb(iocb)) {
837 siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
838 if (!siocb)
839 return NULL;
1da177e4
LT
840 iocb->ki_dtor = sock_aio_dtor;
841 }
1da177e4 842
ce1d4d3e 843 siocb->kiocb = iocb;
ce1d4d3e
CH
844 iocb->private = siocb;
845 return siocb;
1da177e4
LT
846}
847
ce1d4d3e 848static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
849 struct file *file, const struct iovec *iov,
850 unsigned long nr_segs)
ce1d4d3e
CH
851{
852 struct socket *sock = file->private_data;
853 size_t size = 0;
854 int i;
1da177e4 855
89bddce5
SH
856 for (i = 0; i < nr_segs; i++)
857 size += iov[i].iov_len;
1da177e4 858
ce1d4d3e
CH
859 msg->msg_name = NULL;
860 msg->msg_namelen = 0;
861 msg->msg_control = NULL;
862 msg->msg_controllen = 0;
89bddce5 863 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
864 msg->msg_iovlen = nr_segs;
865 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
866
867 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
868}
869
027445c3
BP
870static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
871 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
872{
873 struct sock_iocb siocb, *x;
874
1da177e4
LT
875 if (pos != 0)
876 return -ESPIPE;
027445c3
BP
877
878 if (iocb->ki_left == 0) /* Match SYS5 behaviour */
1da177e4
LT
879 return 0;
880
027445c3
BP
881
882 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
883 if (!x)
884 return -ENOMEM;
027445c3 885 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
886}
887
ce1d4d3e 888static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
889 struct file *file, const struct iovec *iov,
890 unsigned long nr_segs)
1da177e4 891{
ce1d4d3e
CH
892 struct socket *sock = file->private_data;
893 size_t size = 0;
894 int i;
1da177e4 895
89bddce5
SH
896 for (i = 0; i < nr_segs; i++)
897 size += iov[i].iov_len;
1da177e4 898
ce1d4d3e
CH
899 msg->msg_name = NULL;
900 msg->msg_namelen = 0;
901 msg->msg_control = NULL;
902 msg->msg_controllen = 0;
89bddce5 903 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
904 msg->msg_iovlen = nr_segs;
905 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
906 if (sock->type == SOCK_SEQPACKET)
907 msg->msg_flags |= MSG_EOR;
1da177e4 908
ce1d4d3e 909 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
910}
911
027445c3
BP
912static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
913 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
914{
915 struct sock_iocb siocb, *x;
1da177e4 916
ce1d4d3e
CH
917 if (pos != 0)
918 return -ESPIPE;
027445c3 919
027445c3 920 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
921 if (!x)
922 return -ENOMEM;
1da177e4 923
027445c3 924 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
925}
926
1da177e4
LT
927/*
928 * Atomic setting of ioctl hooks to avoid race
929 * with module unload.
930 */
931
4a3e2f71 932static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 933static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 934
881d966b 935void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 936{
4a3e2f71 937 mutex_lock(&br_ioctl_mutex);
1da177e4 938 br_ioctl_hook = hook;
4a3e2f71 939 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
940}
941EXPORT_SYMBOL(brioctl_set);
942
4a3e2f71 943static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 944static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 945
881d966b 946void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 947{
4a3e2f71 948 mutex_lock(&vlan_ioctl_mutex);
1da177e4 949 vlan_ioctl_hook = hook;
4a3e2f71 950 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
951}
952EXPORT_SYMBOL(vlan_ioctl_set);
953
4a3e2f71 954static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 955static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 956
89bddce5 957void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 958{
4a3e2f71 959 mutex_lock(&dlci_ioctl_mutex);
1da177e4 960 dlci_ioctl_hook = hook;
4a3e2f71 961 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
962}
963EXPORT_SYMBOL(dlci_ioctl_set);
964
6b96018b
AB
965static long sock_do_ioctl(struct net *net, struct socket *sock,
966 unsigned int cmd, unsigned long arg)
967{
968 int err;
969 void __user *argp = (void __user *)arg;
970
971 err = sock->ops->ioctl(sock, cmd, arg);
972
973 /*
974 * If this ioctl is unknown try to hand it down
975 * to the NIC driver.
976 */
977 if (err == -ENOIOCTLCMD)
978 err = dev_ioctl(net, cmd, argp);
979
980 return err;
981}
982
1da177e4
LT
983/*
984 * With an ioctl, arg may well be a user mode pointer, but we don't know
985 * what to do with it - that's up to the protocol still.
986 */
987
988static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
989{
990 struct socket *sock;
881d966b 991 struct sock *sk;
1da177e4
LT
992 void __user *argp = (void __user *)arg;
993 int pid, err;
881d966b 994 struct net *net;
1da177e4 995
b69aee04 996 sock = file->private_data;
881d966b 997 sk = sock->sk;
3b1e0a65 998 net = sock_net(sk);
1da177e4 999 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 1000 err = dev_ioctl(net, cmd, argp);
1da177e4 1001 } else
3d23e349 1002#ifdef CONFIG_WEXT_CORE
1da177e4 1003 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 1004 err = dev_ioctl(net, cmd, argp);
1da177e4 1005 } else
3d23e349 1006#endif
89bddce5 1007 switch (cmd) {
1da177e4
LT
1008 case FIOSETOWN:
1009 case SIOCSPGRP:
1010 err = -EFAULT;
1011 if (get_user(pid, (int __user *)argp))
1012 break;
1013 err = f_setown(sock->file, pid, 1);
1014 break;
1015 case FIOGETOWN:
1016 case SIOCGPGRP:
609d7fa9 1017 err = put_user(f_getown(sock->file),
89bddce5 1018 (int __user *)argp);
1da177e4
LT
1019 break;
1020 case SIOCGIFBR:
1021 case SIOCSIFBR:
1022 case SIOCBRADDBR:
1023 case SIOCBRDELBR:
1024 err = -ENOPKG;
1025 if (!br_ioctl_hook)
1026 request_module("bridge");
1027
4a3e2f71 1028 mutex_lock(&br_ioctl_mutex);
89bddce5 1029 if (br_ioctl_hook)
881d966b 1030 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1031 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1032 break;
1033 case SIOCGIFVLAN:
1034 case SIOCSIFVLAN:
1035 err = -ENOPKG;
1036 if (!vlan_ioctl_hook)
1037 request_module("8021q");
1038
4a3e2f71 1039 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1040 if (vlan_ioctl_hook)
881d966b 1041 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1042 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1043 break;
1da177e4
LT
1044 case SIOCADDDLCI:
1045 case SIOCDELDLCI:
1046 err = -ENOPKG;
1047 if (!dlci_ioctl_hook)
1048 request_module("dlci");
1049
7512cbf6
PE
1050 mutex_lock(&dlci_ioctl_mutex);
1051 if (dlci_ioctl_hook)
1da177e4 1052 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1053 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1054 break;
1055 default:
6b96018b 1056 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1057 break;
89bddce5 1058 }
1da177e4
LT
1059 return err;
1060}
1061
1062int sock_create_lite(int family, int type, int protocol, struct socket **res)
1063{
1064 int err;
1065 struct socket *sock = NULL;
89bddce5 1066
1da177e4
LT
1067 err = security_socket_create(family, type, protocol, 1);
1068 if (err)
1069 goto out;
1070
1071 sock = sock_alloc();
1072 if (!sock) {
1073 err = -ENOMEM;
1074 goto out;
1075 }
1076
1da177e4 1077 sock->type = type;
7420ed23
VY
1078 err = security_socket_post_create(sock, family, type, protocol, 1);
1079 if (err)
1080 goto out_release;
1081
1da177e4
LT
1082out:
1083 *res = sock;
1084 return err;
7420ed23
VY
1085out_release:
1086 sock_release(sock);
1087 sock = NULL;
1088 goto out;
1da177e4 1089}
c6d409cf 1090EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1091
1092/* No kernel lock held - perfect */
89bddce5 1093static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4
LT
1094{
1095 struct socket *sock;
1096
1097 /*
89bddce5 1098 * We can't return errors to poll, so it's either yes or no.
1da177e4 1099 */
b69aee04 1100 sock = file->private_data;
1da177e4
LT
1101 return sock->ops->poll(file, sock, wait);
1102}
1103
89bddce5 1104static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1105{
b69aee04 1106 struct socket *sock = file->private_data;
1da177e4
LT
1107
1108 return sock->ops->mmap(file, sock, vma);
1109}
1110
20380731 1111static int sock_close(struct inode *inode, struct file *filp)
1da177e4
LT
1112{
1113 /*
89bddce5
SH
1114 * It was possible the inode is NULL we were
1115 * closing an unfinished socket.
1da177e4
LT
1116 */
1117
89bddce5 1118 if (!inode) {
1da177e4
LT
1119 printk(KERN_DEBUG "sock_close: NULL inode\n");
1120 return 0;
1121 }
1da177e4
LT
1122 sock_release(SOCKET_I(inode));
1123 return 0;
1124}
1125
1126/*
1127 * Update the socket async list
1128 *
1129 * Fasync_list locking strategy.
1130 *
1131 * 1. fasync_list is modified only under process context socket lock
1132 * i.e. under semaphore.
1133 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1134 * or under socket lock
1da177e4
LT
1135 */
1136
1137static int sock_fasync(int fd, struct file *filp, int on)
1138{
989a2979
ED
1139 struct socket *sock = filp->private_data;
1140 struct sock *sk = sock->sk;
eaefd110 1141 struct socket_wq *wq;
1da177e4 1142
989a2979 1143 if (sk == NULL)
1da177e4 1144 return -EINVAL;
1da177e4
LT
1145
1146 lock_sock(sk);
eaefd110
ED
1147 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1148 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1149
eaefd110 1150 if (!wq->fasync_list)
989a2979
ED
1151 sock_reset_flag(sk, SOCK_FASYNC);
1152 else
bcdce719 1153 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1154
989a2979 1155 release_sock(sk);
1da177e4
LT
1156 return 0;
1157}
1158
43815482 1159/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1160
1161int sock_wake_async(struct socket *sock, int how, int band)
1162{
43815482
ED
1163 struct socket_wq *wq;
1164
1165 if (!sock)
1166 return -1;
1167 rcu_read_lock();
1168 wq = rcu_dereference(sock->wq);
1169 if (!wq || !wq->fasync_list) {
1170 rcu_read_unlock();
1da177e4 1171 return -1;
43815482 1172 }
89bddce5 1173 switch (how) {
8d8ad9d7 1174 case SOCK_WAKE_WAITD:
1da177e4
LT
1175 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1176 break;
1177 goto call_kill;
8d8ad9d7 1178 case SOCK_WAKE_SPACE:
1da177e4
LT
1179 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1180 break;
1181 /* fall through */
8d8ad9d7 1182 case SOCK_WAKE_IO:
89bddce5 1183call_kill:
43815482 1184 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1185 break;
8d8ad9d7 1186 case SOCK_WAKE_URG:
43815482 1187 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1188 }
43815482 1189 rcu_read_unlock();
1da177e4
LT
1190 return 0;
1191}
c6d409cf 1192EXPORT_SYMBOL(sock_wake_async);
1da177e4 1193
721db93a 1194int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1195 struct socket **res, int kern)
1da177e4
LT
1196{
1197 int err;
1198 struct socket *sock;
55737fda 1199 const struct net_proto_family *pf;
1da177e4
LT
1200
1201 /*
89bddce5 1202 * Check protocol is in range
1da177e4
LT
1203 */
1204 if (family < 0 || family >= NPROTO)
1205 return -EAFNOSUPPORT;
1206 if (type < 0 || type >= SOCK_MAX)
1207 return -EINVAL;
1208
1209 /* Compatibility.
1210
1211 This uglymoron is moved from INET layer to here to avoid
1212 deadlock in module load.
1213 */
1214 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1215 static int warned;
1da177e4
LT
1216 if (!warned) {
1217 warned = 1;
89bddce5
SH
1218 printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1219 current->comm);
1da177e4
LT
1220 }
1221 family = PF_PACKET;
1222 }
1223
1224 err = security_socket_create(family, type, protocol, kern);
1225 if (err)
1226 return err;
89bddce5 1227
55737fda
SH
1228 /*
1229 * Allocate the socket and allow the family to set things up. if
1230 * the protocol is 0, the family is instructed to select an appropriate
1231 * default.
1232 */
1233 sock = sock_alloc();
1234 if (!sock) {
e87cc472 1235 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1236 return -ENFILE; /* Not exactly a match, but its the
1237 closest posix thing */
1238 }
1239
1240 sock->type = type;
1241
95a5afca 1242#ifdef CONFIG_MODULES
89bddce5
SH
1243 /* Attempt to load a protocol module if the find failed.
1244 *
1245 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1246 * requested real, full-featured networking support upon configuration.
1247 * Otherwise module support will break!
1248 */
190683a9 1249 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1250 request_module("net-pf-%d", family);
1da177e4
LT
1251#endif
1252
55737fda
SH
1253 rcu_read_lock();
1254 pf = rcu_dereference(net_families[family]);
1255 err = -EAFNOSUPPORT;
1256 if (!pf)
1257 goto out_release;
1da177e4
LT
1258
1259 /*
1260 * We will call the ->create function, that possibly is in a loadable
1261 * module, so we have to bump that loadable module refcnt first.
1262 */
55737fda 1263 if (!try_module_get(pf->owner))
1da177e4
LT
1264 goto out_release;
1265
55737fda
SH
1266 /* Now protected by module ref count */
1267 rcu_read_unlock();
1268
3f378b68 1269 err = pf->create(net, sock, protocol, kern);
55737fda 1270 if (err < 0)
1da177e4 1271 goto out_module_put;
a79af59e 1272
1da177e4
LT
1273 /*
1274 * Now to bump the refcnt of the [loadable] module that owns this
1275 * socket at sock_release time we decrement its refcnt.
1276 */
55737fda
SH
1277 if (!try_module_get(sock->ops->owner))
1278 goto out_module_busy;
1279
1da177e4
LT
1280 /*
1281 * Now that we're done with the ->create function, the [loadable]
1282 * module can have its refcnt decremented
1283 */
55737fda 1284 module_put(pf->owner);
7420ed23
VY
1285 err = security_socket_post_create(sock, family, type, protocol, kern);
1286 if (err)
3b185525 1287 goto out_sock_release;
55737fda 1288 *res = sock;
1da177e4 1289
55737fda
SH
1290 return 0;
1291
1292out_module_busy:
1293 err = -EAFNOSUPPORT;
1da177e4 1294out_module_put:
55737fda
SH
1295 sock->ops = NULL;
1296 module_put(pf->owner);
1297out_sock_release:
1da177e4 1298 sock_release(sock);
55737fda
SH
1299 return err;
1300
1301out_release:
1302 rcu_read_unlock();
1303 goto out_sock_release;
1da177e4 1304}
721db93a 1305EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1306
1307int sock_create(int family, int type, int protocol, struct socket **res)
1308{
1b8d7ae4 1309 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1310}
c6d409cf 1311EXPORT_SYMBOL(sock_create);
1da177e4
LT
1312
1313int sock_create_kern(int family, int type, int protocol, struct socket **res)
1314{
1b8d7ae4 1315 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1316}
c6d409cf 1317EXPORT_SYMBOL(sock_create_kern);
1da177e4 1318
3e0fa65f 1319SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1320{
1321 int retval;
1322 struct socket *sock;
a677a039
UD
1323 int flags;
1324
e38b36f3
UD
1325 /* Check the SOCK_* constants for consistency. */
1326 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1327 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1328 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1329 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1330
a677a039 1331 flags = type & ~SOCK_TYPE_MASK;
77d27200 1332 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1333 return -EINVAL;
1334 type &= SOCK_TYPE_MASK;
1da177e4 1335
aaca0bdc
UD
1336 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1337 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1338
1da177e4
LT
1339 retval = sock_create(family, type, protocol, &sock);
1340 if (retval < 0)
1341 goto out;
1342
77d27200 1343 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1344 if (retval < 0)
1345 goto out_release;
1346
1347out:
1348 /* It may be already another descriptor 8) Not kernel problem. */
1349 return retval;
1350
1351out_release:
1352 sock_release(sock);
1353 return retval;
1354}
1355
1356/*
1357 * Create a pair of connected sockets.
1358 */
1359
3e0fa65f
HC
1360SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1361 int __user *, usockvec)
1da177e4
LT
1362{
1363 struct socket *sock1, *sock2;
1364 int fd1, fd2, err;
db349509 1365 struct file *newfile1, *newfile2;
a677a039
UD
1366 int flags;
1367
1368 flags = type & ~SOCK_TYPE_MASK;
77d27200 1369 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1370 return -EINVAL;
1371 type &= SOCK_TYPE_MASK;
1da177e4 1372
aaca0bdc
UD
1373 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1374 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1375
1da177e4
LT
1376 /*
1377 * Obtain the first socket and check if the underlying protocol
1378 * supports the socketpair call.
1379 */
1380
1381 err = sock_create(family, type, protocol, &sock1);
1382 if (err < 0)
1383 goto out;
1384
1385 err = sock_create(family, type, protocol, &sock2);
1386 if (err < 0)
1387 goto out_release_1;
1388
1389 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1390 if (err < 0)
1da177e4
LT
1391 goto out_release_both;
1392
28407630 1393 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1394 if (unlikely(fd1 < 0)) {
1395 err = fd1;
db349509 1396 goto out_release_both;
bf3c23d1 1397 }
28407630 1398 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1399 if (unlikely(fd2 < 0)) {
1400 err = fd2;
28407630
AV
1401 put_unused_fd(fd1);
1402 goto out_release_both;
1403 }
1404
1405 newfile1 = sock_alloc_file(sock1, flags);
1406 if (unlikely(IS_ERR(newfile1))) {
1407 err = PTR_ERR(newfile1);
1408 put_unused_fd(fd1);
1409 put_unused_fd(fd2);
1410 goto out_release_both;
1411 }
1412
1413 newfile2 = sock_alloc_file(sock2, flags);
1414 if (IS_ERR(newfile2)) {
1415 err = PTR_ERR(newfile2);
198de4d7
AV
1416 fput(newfile1);
1417 put_unused_fd(fd1);
28407630 1418 put_unused_fd(fd2);
198de4d7
AV
1419 sock_release(sock2);
1420 goto out;
db349509
AV
1421 }
1422
157cf649 1423 audit_fd_pair(fd1, fd2);
db349509
AV
1424 fd_install(fd1, newfile1);
1425 fd_install(fd2, newfile2);
1da177e4
LT
1426 /* fd1 and fd2 may be already another descriptors.
1427 * Not kernel problem.
1428 */
1429
89bddce5 1430 err = put_user(fd1, &usockvec[0]);
1da177e4
LT
1431 if (!err)
1432 err = put_user(fd2, &usockvec[1]);
1433 if (!err)
1434 return 0;
1435
1436 sys_close(fd2);
1437 sys_close(fd1);
1438 return err;
1439
1da177e4 1440out_release_both:
89bddce5 1441 sock_release(sock2);
1da177e4 1442out_release_1:
89bddce5 1443 sock_release(sock1);
1da177e4
LT
1444out:
1445 return err;
1446}
1447
1da177e4
LT
1448/*
1449 * Bind a name to a socket. Nothing much to do here since it's
1450 * the protocol's responsibility to handle the local address.
1451 *
1452 * We move the socket address to kernel space before we call
1453 * the protocol layer (having also checked the address is ok).
1454 */
1455
20f37034 1456SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1457{
1458 struct socket *sock;
230b1839 1459 struct sockaddr_storage address;
6cb153ca 1460 int err, fput_needed;
1da177e4 1461
89bddce5 1462 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1463 if (sock) {
43db362d 1464 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1465 if (err >= 0) {
1466 err = security_socket_bind(sock,
230b1839 1467 (struct sockaddr *)&address,
89bddce5 1468 addrlen);
6cb153ca
BL
1469 if (!err)
1470 err = sock->ops->bind(sock,
89bddce5 1471 (struct sockaddr *)
230b1839 1472 &address, addrlen);
1da177e4 1473 }
6cb153ca 1474 fput_light(sock->file, fput_needed);
89bddce5 1475 }
1da177e4
LT
1476 return err;
1477}
1478
1da177e4
LT
1479/*
1480 * Perform a listen. Basically, we allow the protocol to do anything
1481 * necessary for a listen, and if that works, we mark the socket as
1482 * ready for listening.
1483 */
1484
3e0fa65f 1485SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1486{
1487 struct socket *sock;
6cb153ca 1488 int err, fput_needed;
b8e1f9b5 1489 int somaxconn;
89bddce5
SH
1490
1491 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1492 if (sock) {
8efa6e93 1493 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1494 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1495 backlog = somaxconn;
1da177e4
LT
1496
1497 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1498 if (!err)
1499 err = sock->ops->listen(sock, backlog);
1da177e4 1500
6cb153ca 1501 fput_light(sock->file, fput_needed);
1da177e4
LT
1502 }
1503 return err;
1504}
1505
1da177e4
LT
1506/*
1507 * For accept, we attempt to create a new socket, set up the link
1508 * with the client, wake up the client, then return the new
1509 * connected fd. We collect the address of the connector in kernel
1510 * space and move it to user at the very end. This is unclean because
1511 * we open the socket then return an error.
1512 *
1513 * 1003.1g adds the ability to recvmsg() to query connection pending
1514 * status to recvmsg. We need to add that support in a way thats
1515 * clean when we restucture accept also.
1516 */
1517
20f37034
HC
1518SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1519 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1520{
1521 struct socket *sock, *newsock;
39d8c1b6 1522 struct file *newfile;
6cb153ca 1523 int err, len, newfd, fput_needed;
230b1839 1524 struct sockaddr_storage address;
1da177e4 1525
77d27200 1526 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1527 return -EINVAL;
1528
1529 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1530 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1531
6cb153ca 1532 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1533 if (!sock)
1534 goto out;
1535
1536 err = -ENFILE;
c6d409cf
ED
1537 newsock = sock_alloc();
1538 if (!newsock)
1da177e4
LT
1539 goto out_put;
1540
1541 newsock->type = sock->type;
1542 newsock->ops = sock->ops;
1543
1da177e4
LT
1544 /*
1545 * We don't need try_module_get here, as the listening socket (sock)
1546 * has the protocol module (sock->ops->owner) held.
1547 */
1548 __module_get(newsock->ops->owner);
1549
28407630 1550 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1551 if (unlikely(newfd < 0)) {
1552 err = newfd;
9a1875e6
DM
1553 sock_release(newsock);
1554 goto out_put;
39d8c1b6 1555 }
28407630
AV
1556 newfile = sock_alloc_file(newsock, flags);
1557 if (unlikely(IS_ERR(newfile))) {
1558 err = PTR_ERR(newfile);
1559 put_unused_fd(newfd);
1560 sock_release(newsock);
1561 goto out_put;
1562 }
39d8c1b6 1563
a79af59e
FF
1564 err = security_socket_accept(sock, newsock);
1565 if (err)
39d8c1b6 1566 goto out_fd;
a79af59e 1567
1da177e4
LT
1568 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1569 if (err < 0)
39d8c1b6 1570 goto out_fd;
1da177e4
LT
1571
1572 if (upeer_sockaddr) {
230b1839 1573 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1574 &len, 2) < 0) {
1da177e4 1575 err = -ECONNABORTED;
39d8c1b6 1576 goto out_fd;
1da177e4 1577 }
43db362d 1578 err = move_addr_to_user(&address,
230b1839 1579 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1580 if (err < 0)
39d8c1b6 1581 goto out_fd;
1da177e4
LT
1582 }
1583
1584 /* File flags are not inherited via accept() unlike another OSes. */
1585
39d8c1b6
DM
1586 fd_install(newfd, newfile);
1587 err = newfd;
1da177e4 1588
1da177e4 1589out_put:
6cb153ca 1590 fput_light(sock->file, fput_needed);
1da177e4
LT
1591out:
1592 return err;
39d8c1b6 1593out_fd:
9606a216 1594 fput(newfile);
39d8c1b6 1595 put_unused_fd(newfd);
1da177e4
LT
1596 goto out_put;
1597}
1598
20f37034
HC
1599SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1600 int __user *, upeer_addrlen)
aaca0bdc 1601{
de11defe 1602 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1603}
1604
1da177e4
LT
1605/*
1606 * Attempt to connect to a socket with the server address. The address
1607 * is in user space so we verify it is OK and move it to kernel space.
1608 *
1609 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1610 * break bindings
1611 *
1612 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1613 * other SEQPACKET protocols that take time to connect() as it doesn't
1614 * include the -EINPROGRESS status for such sockets.
1615 */
1616
20f37034
HC
1617SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1618 int, addrlen)
1da177e4
LT
1619{
1620 struct socket *sock;
230b1839 1621 struct sockaddr_storage address;
6cb153ca 1622 int err, fput_needed;
1da177e4 1623
6cb153ca 1624 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1625 if (!sock)
1626 goto out;
43db362d 1627 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1628 if (err < 0)
1629 goto out_put;
1630
89bddce5 1631 err =
230b1839 1632 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1633 if (err)
1634 goto out_put;
1635
230b1839 1636 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1637 sock->file->f_flags);
1638out_put:
6cb153ca 1639 fput_light(sock->file, fput_needed);
1da177e4
LT
1640out:
1641 return err;
1642}
1643
1644/*
1645 * Get the local address ('name') of a socket object. Move the obtained
1646 * name to user space.
1647 */
1648
20f37034
HC
1649SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1650 int __user *, usockaddr_len)
1da177e4
LT
1651{
1652 struct socket *sock;
230b1839 1653 struct sockaddr_storage address;
6cb153ca 1654 int len, err, fput_needed;
89bddce5 1655
6cb153ca 1656 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1657 if (!sock)
1658 goto out;
1659
1660 err = security_socket_getsockname(sock);
1661 if (err)
1662 goto out_put;
1663
230b1839 1664 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1665 if (err)
1666 goto out_put;
43db362d 1667 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1668
1669out_put:
6cb153ca 1670 fput_light(sock->file, fput_needed);
1da177e4
LT
1671out:
1672 return err;
1673}
1674
1675/*
1676 * Get the remote address ('name') of a socket object. Move the obtained
1677 * name to user space.
1678 */
1679
20f37034
HC
1680SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1681 int __user *, usockaddr_len)
1da177e4
LT
1682{
1683 struct socket *sock;
230b1839 1684 struct sockaddr_storage address;
6cb153ca 1685 int len, err, fput_needed;
1da177e4 1686
89bddce5
SH
1687 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1688 if (sock != NULL) {
1da177e4
LT
1689 err = security_socket_getpeername(sock);
1690 if (err) {
6cb153ca 1691 fput_light(sock->file, fput_needed);
1da177e4
LT
1692 return err;
1693 }
1694
89bddce5 1695 err =
230b1839 1696 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1697 1);
1da177e4 1698 if (!err)
43db362d 1699 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1700 usockaddr_len);
6cb153ca 1701 fput_light(sock->file, fput_needed);
1da177e4
LT
1702 }
1703 return err;
1704}
1705
1706/*
1707 * Send a datagram to a given address. We move the address into kernel
1708 * space and check the user space data area is readable before invoking
1709 * the protocol.
1710 */
1711
3e0fa65f 1712SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1713 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1714 int, addr_len)
1da177e4
LT
1715{
1716 struct socket *sock;
230b1839 1717 struct sockaddr_storage address;
1da177e4
LT
1718 int err;
1719 struct msghdr msg;
1720 struct iovec iov;
6cb153ca 1721 int fput_needed;
6cb153ca 1722
253eacc0
LT
1723 if (len > INT_MAX)
1724 len = INT_MAX;
de0fa95c
PE
1725 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1726 if (!sock)
4387ff75 1727 goto out;
6cb153ca 1728
89bddce5
SH
1729 iov.iov_base = buff;
1730 iov.iov_len = len;
1731 msg.msg_name = NULL;
1732 msg.msg_iov = &iov;
1733 msg.msg_iovlen = 1;
1734 msg.msg_control = NULL;
1735 msg.msg_controllen = 0;
1736 msg.msg_namelen = 0;
6cb153ca 1737 if (addr) {
43db362d 1738 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1739 if (err < 0)
1740 goto out_put;
230b1839 1741 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1742 msg.msg_namelen = addr_len;
1da177e4
LT
1743 }
1744 if (sock->file->f_flags & O_NONBLOCK)
1745 flags |= MSG_DONTWAIT;
1746 msg.msg_flags = flags;
1747 err = sock_sendmsg(sock, &msg, len);
1748
89bddce5 1749out_put:
de0fa95c 1750 fput_light(sock->file, fput_needed);
4387ff75 1751out:
1da177e4
LT
1752 return err;
1753}
1754
1755/*
89bddce5 1756 * Send a datagram down a socket.
1da177e4
LT
1757 */
1758
3e0fa65f 1759SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1760 unsigned int, flags)
1da177e4
LT
1761{
1762 return sys_sendto(fd, buff, len, flags, NULL, 0);
1763}
1764
1765/*
89bddce5 1766 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1767 * sender. We verify the buffers are writable and if needed move the
1768 * sender address from kernel to user space.
1769 */
1770
3e0fa65f 1771SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1772 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1773 int __user *, addr_len)
1da177e4
LT
1774{
1775 struct socket *sock;
1776 struct iovec iov;
1777 struct msghdr msg;
230b1839 1778 struct sockaddr_storage address;
89bddce5 1779 int err, err2;
6cb153ca
BL
1780 int fput_needed;
1781
253eacc0
LT
1782 if (size > INT_MAX)
1783 size = INT_MAX;
de0fa95c 1784 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1785 if (!sock)
de0fa95c 1786 goto out;
1da177e4 1787
89bddce5
SH
1788 msg.msg_control = NULL;
1789 msg.msg_controllen = 0;
1790 msg.msg_iovlen = 1;
1791 msg.msg_iov = &iov;
1792 iov.iov_len = size;
1793 iov.iov_base = ubuf;
230b1839
YH
1794 msg.msg_name = (struct sockaddr *)&address;
1795 msg.msg_namelen = sizeof(address);
1da177e4
LT
1796 if (sock->file->f_flags & O_NONBLOCK)
1797 flags |= MSG_DONTWAIT;
89bddce5 1798 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1799
89bddce5 1800 if (err >= 0 && addr != NULL) {
43db362d 1801 err2 = move_addr_to_user(&address,
230b1839 1802 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1803 if (err2 < 0)
1804 err = err2;
1da177e4 1805 }
de0fa95c
PE
1806
1807 fput_light(sock->file, fput_needed);
4387ff75 1808out:
1da177e4
LT
1809 return err;
1810}
1811
1812/*
89bddce5 1813 * Receive a datagram from a socket.
1da177e4
LT
1814 */
1815
89bddce5 1816asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
95c96174 1817 unsigned int flags)
1da177e4
LT
1818{
1819 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1820}
1821
1822/*
1823 * Set a socket option. Because we don't know the option lengths we have
1824 * to pass the user mode parameter for the protocols to sort out.
1825 */
1826
20f37034
HC
1827SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1828 char __user *, optval, int, optlen)
1da177e4 1829{
6cb153ca 1830 int err, fput_needed;
1da177e4
LT
1831 struct socket *sock;
1832
1833 if (optlen < 0)
1834 return -EINVAL;
89bddce5
SH
1835
1836 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1837 if (sock != NULL) {
1838 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1839 if (err)
1840 goto out_put;
1da177e4
LT
1841
1842 if (level == SOL_SOCKET)
89bddce5
SH
1843 err =
1844 sock_setsockopt(sock, level, optname, optval,
1845 optlen);
1da177e4 1846 else
89bddce5
SH
1847 err =
1848 sock->ops->setsockopt(sock, level, optname, optval,
1849 optlen);
6cb153ca
BL
1850out_put:
1851 fput_light(sock->file, fput_needed);
1da177e4
LT
1852 }
1853 return err;
1854}
1855
1856/*
1857 * Get a socket option. Because we don't know the option lengths we have
1858 * to pass a user mode parameter for the protocols to sort out.
1859 */
1860
20f37034
HC
1861SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1862 char __user *, optval, int __user *, optlen)
1da177e4 1863{
6cb153ca 1864 int err, fput_needed;
1da177e4
LT
1865 struct socket *sock;
1866
89bddce5
SH
1867 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1868 if (sock != NULL) {
6cb153ca
BL
1869 err = security_socket_getsockopt(sock, level, optname);
1870 if (err)
1871 goto out_put;
1da177e4
LT
1872
1873 if (level == SOL_SOCKET)
89bddce5
SH
1874 err =
1875 sock_getsockopt(sock, level, optname, optval,
1876 optlen);
1da177e4 1877 else
89bddce5
SH
1878 err =
1879 sock->ops->getsockopt(sock, level, optname, optval,
1880 optlen);
6cb153ca
BL
1881out_put:
1882 fput_light(sock->file, fput_needed);
1da177e4
LT
1883 }
1884 return err;
1885}
1886
1da177e4
LT
1887/*
1888 * Shutdown a socket.
1889 */
1890
754fe8d2 1891SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1892{
6cb153ca 1893 int err, fput_needed;
1da177e4
LT
1894 struct socket *sock;
1895
89bddce5
SH
1896 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1897 if (sock != NULL) {
1da177e4 1898 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1899 if (!err)
1900 err = sock->ops->shutdown(sock, how);
1901 fput_light(sock->file, fput_needed);
1da177e4
LT
1902 }
1903 return err;
1904}
1905
89bddce5 1906/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1907 * fields which are the same type (int / unsigned) on our platforms.
1908 */
1909#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1910#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1911#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1912
c71d8ebe
TH
1913struct used_address {
1914 struct sockaddr_storage name;
1915 unsigned int name_len;
1916};
1917
228e548e 1918static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 1919 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1920 struct used_address *used_address)
1da177e4 1921{
89bddce5
SH
1922 struct compat_msghdr __user *msg_compat =
1923 (struct compat_msghdr __user *)msg;
230b1839 1924 struct sockaddr_storage address;
1da177e4 1925 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1926 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1927 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1928 /* 20 is size of ipv6_pktinfo */
1da177e4 1929 unsigned char *ctl_buf = ctl;
a74e9106 1930 int err, ctl_len, total_len;
89bddce5 1931
1da177e4
LT
1932 err = -EFAULT;
1933 if (MSG_CMSG_COMPAT & flags) {
228e548e 1934 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 1935 return -EFAULT;
228e548e 1936 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
1da177e4
LT
1937 return -EFAULT;
1938
228e548e 1939 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
1940 err = -EMSGSIZE;
1941 if (msg_sys->msg_iovlen > UIO_MAXIOV)
1942 goto out;
1943 err = -ENOMEM;
1944 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
1945 GFP_KERNEL);
1da177e4 1946 if (!iov)
228e548e 1947 goto out;
1da177e4
LT
1948 }
1949
1950 /* This will also move the address data into kernel space */
1951 if (MSG_CMSG_COMPAT & flags) {
43db362d 1952 err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
1da177e4 1953 } else
43db362d 1954 err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
89bddce5 1955 if (err < 0)
1da177e4
LT
1956 goto out_freeiov;
1957 total_len = err;
1958
1959 err = -ENOBUFS;
1960
228e548e 1961 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 1962 goto out_freeiov;
228e548e 1963 ctl_len = msg_sys->msg_controllen;
1da177e4 1964 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 1965 err =
228e548e 1966 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 1967 sizeof(ctl));
1da177e4
LT
1968 if (err)
1969 goto out_freeiov;
228e548e
AB
1970 ctl_buf = msg_sys->msg_control;
1971 ctl_len = msg_sys->msg_controllen;
1da177e4 1972 } else if (ctl_len) {
89bddce5 1973 if (ctl_len > sizeof(ctl)) {
1da177e4 1974 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 1975 if (ctl_buf == NULL)
1da177e4
LT
1976 goto out_freeiov;
1977 }
1978 err = -EFAULT;
1979 /*
228e548e 1980 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
1981 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1982 * checking falls down on this.
1983 */
fb8621bb 1984 if (copy_from_user(ctl_buf,
228e548e 1985 (void __user __force *)msg_sys->msg_control,
89bddce5 1986 ctl_len))
1da177e4 1987 goto out_freectl;
228e548e 1988 msg_sys->msg_control = ctl_buf;
1da177e4 1989 }
228e548e 1990 msg_sys->msg_flags = flags;
1da177e4
LT
1991
1992 if (sock->file->f_flags & O_NONBLOCK)
228e548e 1993 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
1994 /*
1995 * If this is sendmmsg() and current destination address is same as
1996 * previously succeeded address, omit asking LSM's decision.
1997 * used_address->name_len is initialized to UINT_MAX so that the first
1998 * destination address never matches.
1999 */
bc909d9d
MD
2000 if (used_address && msg_sys->msg_name &&
2001 used_address->name_len == msg_sys->msg_namelen &&
2002 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2003 used_address->name_len)) {
2004 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2005 goto out_freectl;
2006 }
2007 err = sock_sendmsg(sock, msg_sys, total_len);
2008 /*
2009 * If this is sendmmsg() and sending to current destination address was
2010 * successful, remember it.
2011 */
2012 if (used_address && err >= 0) {
2013 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2014 if (msg_sys->msg_name)
2015 memcpy(&used_address->name, msg_sys->msg_name,
2016 used_address->name_len);
c71d8ebe 2017 }
1da177e4
LT
2018
2019out_freectl:
89bddce5 2020 if (ctl_buf != ctl)
1da177e4
LT
2021 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2022out_freeiov:
2023 if (iov != iovstack)
a74e9106 2024 kfree(iov);
228e548e
AB
2025out:
2026 return err;
2027}
2028
2029/*
2030 * BSD sendmsg interface
2031 */
2032
95c96174 2033SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
228e548e
AB
2034{
2035 int fput_needed, err;
2036 struct msghdr msg_sys;
2037 struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2038
2039 if (!sock)
2040 goto out;
2041
c71d8ebe 2042 err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2043
6cb153ca 2044 fput_light(sock->file, fput_needed);
89bddce5 2045out:
1da177e4
LT
2046 return err;
2047}
2048
228e548e
AB
2049/*
2050 * Linux sendmmsg interface
2051 */
2052
2053int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2054 unsigned int flags)
2055{
2056 int fput_needed, err, datagrams;
2057 struct socket *sock;
2058 struct mmsghdr __user *entry;
2059 struct compat_mmsghdr __user *compat_entry;
2060 struct msghdr msg_sys;
c71d8ebe 2061 struct used_address used_address;
228e548e 2062
98382f41
AB
2063 if (vlen > UIO_MAXIOV)
2064 vlen = UIO_MAXIOV;
228e548e
AB
2065
2066 datagrams = 0;
2067
2068 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2069 if (!sock)
2070 return err;
2071
c71d8ebe 2072 used_address.name_len = UINT_MAX;
228e548e
AB
2073 entry = mmsg;
2074 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2075 err = 0;
228e548e
AB
2076
2077 while (datagrams < vlen) {
228e548e
AB
2078 if (MSG_CMSG_COMPAT & flags) {
2079 err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
c71d8ebe 2080 &msg_sys, flags, &used_address);
228e548e
AB
2081 if (err < 0)
2082 break;
2083 err = __put_user(err, &compat_entry->msg_len);
2084 ++compat_entry;
2085 } else {
2086 err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
c71d8ebe 2087 &msg_sys, flags, &used_address);
228e548e
AB
2088 if (err < 0)
2089 break;
2090 err = put_user(err, &entry->msg_len);
2091 ++entry;
2092 }
2093
2094 if (err)
2095 break;
2096 ++datagrams;
2097 }
2098
228e548e
AB
2099 fput_light(sock->file, fput_needed);
2100
728ffb86
AB
2101 /* We only return an error if no datagrams were able to be sent */
2102 if (datagrams != 0)
228e548e
AB
2103 return datagrams;
2104
228e548e
AB
2105 return err;
2106}
2107
2108SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2109 unsigned int, vlen, unsigned int, flags)
2110{
2111 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2112}
2113
a2e27255 2114static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 2115 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2116{
89bddce5
SH
2117 struct compat_msghdr __user *msg_compat =
2118 (struct compat_msghdr __user *)msg;
1da177e4 2119 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2120 struct iovec *iov = iovstack;
1da177e4 2121 unsigned long cmsg_ptr;
a74e9106 2122 int err, total_len, len;
1da177e4
LT
2123
2124 /* kernel mode address */
230b1839 2125 struct sockaddr_storage addr;
1da177e4
LT
2126
2127 /* user mode address pointers */
2128 struct sockaddr __user *uaddr;
2129 int __user *uaddr_len;
89bddce5 2130
1da177e4 2131 if (MSG_CMSG_COMPAT & flags) {
a2e27255 2132 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2133 return -EFAULT;
c6d409cf 2134 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
89bddce5 2135 return -EFAULT;
1da177e4 2136
a2e27255 2137 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
2138 err = -EMSGSIZE;
2139 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2140 goto out;
2141 err = -ENOMEM;
2142 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2143 GFP_KERNEL);
1da177e4 2144 if (!iov)
a2e27255 2145 goto out;
1da177e4
LT
2146 }
2147
2148 /*
89bddce5
SH
2149 * Save the user-mode address (verify_iovec will change the
2150 * kernel msghdr to use the kernel address space)
1da177e4 2151 */
89bddce5 2152
a2e27255 2153 uaddr = (__force void __user *)msg_sys->msg_name;
1da177e4
LT
2154 uaddr_len = COMPAT_NAMELEN(msg);
2155 if (MSG_CMSG_COMPAT & flags) {
43db362d 2156 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4 2157 } else
43db362d 2158 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4
LT
2159 if (err < 0)
2160 goto out_freeiov;
89bddce5 2161 total_len = err;
1da177e4 2162
a2e27255
ACM
2163 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2164 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2165
1da177e4
LT
2166 if (sock->file->f_flags & O_NONBLOCK)
2167 flags |= MSG_DONTWAIT;
a2e27255
ACM
2168 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2169 total_len, flags);
1da177e4
LT
2170 if (err < 0)
2171 goto out_freeiov;
2172 len = err;
2173
2174 if (uaddr != NULL) {
43db362d 2175 err = move_addr_to_user(&addr,
a2e27255 2176 msg_sys->msg_namelen, uaddr,
89bddce5 2177 uaddr_len);
1da177e4
LT
2178 if (err < 0)
2179 goto out_freeiov;
2180 }
a2e27255 2181 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2182 COMPAT_FLAGS(msg));
1da177e4
LT
2183 if (err)
2184 goto out_freeiov;
2185 if (MSG_CMSG_COMPAT & flags)
a2e27255 2186 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2187 &msg_compat->msg_controllen);
2188 else
a2e27255 2189 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2190 &msg->msg_controllen);
2191 if (err)
2192 goto out_freeiov;
2193 err = len;
2194
2195out_freeiov:
2196 if (iov != iovstack)
a74e9106 2197 kfree(iov);
a2e27255
ACM
2198out:
2199 return err;
2200}
2201
2202/*
2203 * BSD recvmsg interface
2204 */
2205
2206SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2207 unsigned int, flags)
2208{
2209 int fput_needed, err;
2210 struct msghdr msg_sys;
2211 struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2212
2213 if (!sock)
2214 goto out;
2215
2216 err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2217
6cb153ca 2218 fput_light(sock->file, fput_needed);
1da177e4
LT
2219out:
2220 return err;
2221}
2222
a2e27255
ACM
2223/*
2224 * Linux recvmmsg interface
2225 */
2226
2227int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2228 unsigned int flags, struct timespec *timeout)
2229{
2230 int fput_needed, err, datagrams;
2231 struct socket *sock;
2232 struct mmsghdr __user *entry;
d7256d0e 2233 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2234 struct msghdr msg_sys;
2235 struct timespec end_time;
2236
2237 if (timeout &&
2238 poll_select_set_timeout(&end_time, timeout->tv_sec,
2239 timeout->tv_nsec))
2240 return -EINVAL;
2241
2242 datagrams = 0;
2243
2244 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2245 if (!sock)
2246 return err;
2247
2248 err = sock_error(sock->sk);
2249 if (err)
2250 goto out_put;
2251
2252 entry = mmsg;
d7256d0e 2253 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2254
2255 while (datagrams < vlen) {
2256 /*
2257 * No need to ask LSM for more than the first datagram.
2258 */
d7256d0e
JMG
2259 if (MSG_CMSG_COMPAT & flags) {
2260 err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
b9eb8b87
AB
2261 &msg_sys, flags & ~MSG_WAITFORONE,
2262 datagrams);
d7256d0e
JMG
2263 if (err < 0)
2264 break;
2265 err = __put_user(err, &compat_entry->msg_len);
2266 ++compat_entry;
2267 } else {
2268 err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
b9eb8b87
AB
2269 &msg_sys, flags & ~MSG_WAITFORONE,
2270 datagrams);
d7256d0e
JMG
2271 if (err < 0)
2272 break;
2273 err = put_user(err, &entry->msg_len);
2274 ++entry;
2275 }
2276
a2e27255
ACM
2277 if (err)
2278 break;
a2e27255
ACM
2279 ++datagrams;
2280
71c5c159
BB
2281 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2282 if (flags & MSG_WAITFORONE)
2283 flags |= MSG_DONTWAIT;
2284
a2e27255
ACM
2285 if (timeout) {
2286 ktime_get_ts(timeout);
2287 *timeout = timespec_sub(end_time, *timeout);
2288 if (timeout->tv_sec < 0) {
2289 timeout->tv_sec = timeout->tv_nsec = 0;
2290 break;
2291 }
2292
2293 /* Timeout, return less than vlen datagrams */
2294 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2295 break;
2296 }
2297
2298 /* Out of band data, return right away */
2299 if (msg_sys.msg_flags & MSG_OOB)
2300 break;
2301 }
2302
2303out_put:
2304 fput_light(sock->file, fput_needed);
1da177e4 2305
a2e27255
ACM
2306 if (err == 0)
2307 return datagrams;
2308
2309 if (datagrams != 0) {
2310 /*
2311 * We may return less entries than requested (vlen) if the
2312 * sock is non block and there aren't enough datagrams...
2313 */
2314 if (err != -EAGAIN) {
2315 /*
2316 * ... or if recvmsg returns an error after we
2317 * received some datagrams, where we record the
2318 * error to return on the next call or if the
2319 * app asks about it using getsockopt(SO_ERROR).
2320 */
2321 sock->sk->sk_err = -err;
2322 }
2323
2324 return datagrams;
2325 }
2326
2327 return err;
2328}
2329
2330SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2331 unsigned int, vlen, unsigned int, flags,
2332 struct timespec __user *, timeout)
2333{
2334 int datagrams;
2335 struct timespec timeout_sys;
2336
2337 if (!timeout)
2338 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2339
2340 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2341 return -EFAULT;
2342
2343 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2344
2345 if (datagrams > 0 &&
2346 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2347 datagrams = -EFAULT;
2348
2349 return datagrams;
2350}
2351
2352#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2353/* Argument list sizes for sys_socketcall */
2354#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2355static const unsigned char nargs[21] = {
c6d409cf
ED
2356 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2357 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2358 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2359 AL(4), AL(5), AL(4)
89bddce5
SH
2360};
2361
1da177e4
LT
2362#undef AL
2363
2364/*
89bddce5 2365 * System call vectors.
1da177e4
LT
2366 *
2367 * Argument checking cleaned up. Saved 20% in size.
2368 * This function doesn't need to set the kernel lock because
89bddce5 2369 * it is set by the callees.
1da177e4
LT
2370 */
2371
3e0fa65f 2372SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4
LT
2373{
2374 unsigned long a[6];
89bddce5 2375 unsigned long a0, a1;
1da177e4 2376 int err;
47379052 2377 unsigned int len;
1da177e4 2378
228e548e 2379 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2380 return -EINVAL;
2381
47379052
AV
2382 len = nargs[call];
2383 if (len > sizeof(a))
2384 return -EINVAL;
2385
1da177e4 2386 /* copy_from_user should be SMP safe. */
47379052 2387 if (copy_from_user(a, args, len))
1da177e4 2388 return -EFAULT;
3ec3b2fb 2389
f3298dc4 2390 audit_socketcall(nargs[call] / sizeof(unsigned long), a);
3ec3b2fb 2391
89bddce5
SH
2392 a0 = a[0];
2393 a1 = a[1];
2394
2395 switch (call) {
2396 case SYS_SOCKET:
2397 err = sys_socket(a0, a1, a[2]);
2398 break;
2399 case SYS_BIND:
2400 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2401 break;
2402 case SYS_CONNECT:
2403 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2404 break;
2405 case SYS_LISTEN:
2406 err = sys_listen(a0, a1);
2407 break;
2408 case SYS_ACCEPT:
de11defe
UD
2409 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2410 (int __user *)a[2], 0);
89bddce5
SH
2411 break;
2412 case SYS_GETSOCKNAME:
2413 err =
2414 sys_getsockname(a0, (struct sockaddr __user *)a1,
2415 (int __user *)a[2]);
2416 break;
2417 case SYS_GETPEERNAME:
2418 err =
2419 sys_getpeername(a0, (struct sockaddr __user *)a1,
2420 (int __user *)a[2]);
2421 break;
2422 case SYS_SOCKETPAIR:
2423 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2424 break;
2425 case SYS_SEND:
2426 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2427 break;
2428 case SYS_SENDTO:
2429 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2430 (struct sockaddr __user *)a[4], a[5]);
2431 break;
2432 case SYS_RECV:
2433 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2434 break;
2435 case SYS_RECVFROM:
2436 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2437 (struct sockaddr __user *)a[4],
2438 (int __user *)a[5]);
2439 break;
2440 case SYS_SHUTDOWN:
2441 err = sys_shutdown(a0, a1);
2442 break;
2443 case SYS_SETSOCKOPT:
2444 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2445 break;
2446 case SYS_GETSOCKOPT:
2447 err =
2448 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2449 (int __user *)a[4]);
2450 break;
2451 case SYS_SENDMSG:
2452 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2453 break;
228e548e
AB
2454 case SYS_SENDMMSG:
2455 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2456 break;
89bddce5
SH
2457 case SYS_RECVMSG:
2458 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2459 break;
a2e27255
ACM
2460 case SYS_RECVMMSG:
2461 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2462 (struct timespec __user *)a[4]);
2463 break;
de11defe
UD
2464 case SYS_ACCEPT4:
2465 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2466 (int __user *)a[2], a[3]);
aaca0bdc 2467 break;
89bddce5
SH
2468 default:
2469 err = -EINVAL;
2470 break;
1da177e4
LT
2471 }
2472 return err;
2473}
2474
89bddce5 2475#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2476
55737fda
SH
2477/**
2478 * sock_register - add a socket protocol handler
2479 * @ops: description of protocol
2480 *
1da177e4
LT
2481 * This function is called by a protocol handler that wants to
2482 * advertise its address family, and have it linked into the
55737fda
SH
2483 * socket interface. The value ops->family coresponds to the
2484 * socket system call protocol family.
1da177e4 2485 */
f0fd27d4 2486int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2487{
2488 int err;
2489
2490 if (ops->family >= NPROTO) {
89bddce5
SH
2491 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2492 NPROTO);
1da177e4
LT
2493 return -ENOBUFS;
2494 }
55737fda
SH
2495
2496 spin_lock(&net_family_lock);
190683a9
ED
2497 if (rcu_dereference_protected(net_families[ops->family],
2498 lockdep_is_held(&net_family_lock)))
55737fda
SH
2499 err = -EEXIST;
2500 else {
cf778b00 2501 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2502 err = 0;
2503 }
55737fda
SH
2504 spin_unlock(&net_family_lock);
2505
89bddce5 2506 printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2507 return err;
2508}
c6d409cf 2509EXPORT_SYMBOL(sock_register);
1da177e4 2510
55737fda
SH
2511/**
2512 * sock_unregister - remove a protocol handler
2513 * @family: protocol family to remove
2514 *
1da177e4
LT
2515 * This function is called by a protocol handler that wants to
2516 * remove its address family, and have it unlinked from the
55737fda
SH
2517 * new socket creation.
2518 *
2519 * If protocol handler is a module, then it can use module reference
2520 * counts to protect against new references. If protocol handler is not
2521 * a module then it needs to provide its own protection in
2522 * the ops->create routine.
1da177e4 2523 */
f0fd27d4 2524void sock_unregister(int family)
1da177e4 2525{
f0fd27d4 2526 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2527
55737fda 2528 spin_lock(&net_family_lock);
a9b3cd7f 2529 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2530 spin_unlock(&net_family_lock);
2531
2532 synchronize_rcu();
2533
89bddce5 2534 printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
1da177e4 2535}
c6d409cf 2536EXPORT_SYMBOL(sock_unregister);
1da177e4 2537
77d76ea3 2538static int __init sock_init(void)
1da177e4 2539{
b3e19d92 2540 int err;
2ca794e5
EB
2541 /*
2542 * Initialize the network sysctl infrastructure.
2543 */
2544 err = net_sysctl_init();
2545 if (err)
2546 goto out;
b3e19d92 2547
1da177e4 2548 /*
89bddce5 2549 * Initialize sock SLAB cache.
1da177e4 2550 */
89bddce5 2551
1da177e4
LT
2552 sk_init();
2553
1da177e4 2554 /*
89bddce5 2555 * Initialize skbuff SLAB cache
1da177e4
LT
2556 */
2557 skb_init();
1da177e4
LT
2558
2559 /*
89bddce5 2560 * Initialize the protocols module.
1da177e4
LT
2561 */
2562
2563 init_inodecache();
b3e19d92
NP
2564
2565 err = register_filesystem(&sock_fs_type);
2566 if (err)
2567 goto out_fs;
1da177e4 2568 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2569 if (IS_ERR(sock_mnt)) {
2570 err = PTR_ERR(sock_mnt);
2571 goto out_mount;
2572 }
77d76ea3
AK
2573
2574 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2575 */
2576
2577#ifdef CONFIG_NETFILTER
2578 netfilter_init();
2579#endif
cbeb321a 2580
c1f19b51
RC
2581#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2582 skb_timestamping_init();
2583#endif
2584
b3e19d92
NP
2585out:
2586 return err;
2587
2588out_mount:
2589 unregister_filesystem(&sock_fs_type);
2590out_fs:
2591 goto out;
1da177e4
LT
2592}
2593
77d76ea3
AK
2594core_initcall(sock_init); /* early initcall */
2595
1da177e4
LT
2596#ifdef CONFIG_PROC_FS
2597void socket_seq_show(struct seq_file *seq)
2598{
2599 int cpu;
2600 int counter = 0;
2601
6f912042 2602 for_each_possible_cpu(cpu)
89bddce5 2603 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2604
2605 /* It can be negative, by the way. 8) */
2606 if (counter < 0)
2607 counter = 0;
2608
2609 seq_printf(seq, "sockets: used %d\n", counter);
2610}
89bddce5 2611#endif /* CONFIG_PROC_FS */
1da177e4 2612
89bbfc95 2613#ifdef CONFIG_COMPAT
6b96018b 2614static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2615 unsigned int cmd, void __user *up)
7a229387 2616{
7a229387
AB
2617 mm_segment_t old_fs = get_fs();
2618 struct timeval ktv;
2619 int err;
2620
2621 set_fs(KERNEL_DS);
6b96018b 2622 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2623 set_fs(old_fs);
644595f8 2624 if (!err)
ed6fe9d6 2625 err = compat_put_timeval(&ktv, up);
644595f8 2626
7a229387
AB
2627 return err;
2628}
2629
6b96018b 2630static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2631 unsigned int cmd, void __user *up)
7a229387 2632{
7a229387
AB
2633 mm_segment_t old_fs = get_fs();
2634 struct timespec kts;
2635 int err;
2636
2637 set_fs(KERNEL_DS);
6b96018b 2638 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2639 set_fs(old_fs);
644595f8 2640 if (!err)
ed6fe9d6 2641 err = compat_put_timespec(&kts, up);
644595f8 2642
7a229387
AB
2643 return err;
2644}
2645
6b96018b 2646static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2647{
2648 struct ifreq __user *uifr;
2649 int err;
2650
2651 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2652 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2653 return -EFAULT;
2654
6b96018b 2655 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2656 if (err)
2657 return err;
2658
6b96018b 2659 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2660 return -EFAULT;
2661
2662 return 0;
2663}
2664
6b96018b 2665static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2666{
6b96018b 2667 struct compat_ifconf ifc32;
7a229387
AB
2668 struct ifconf ifc;
2669 struct ifconf __user *uifc;
6b96018b 2670 struct compat_ifreq __user *ifr32;
7a229387
AB
2671 struct ifreq __user *ifr;
2672 unsigned int i, j;
2673 int err;
2674
6b96018b 2675 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2676 return -EFAULT;
2677
43da5f2e 2678 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2679 if (ifc32.ifcbuf == 0) {
2680 ifc32.ifc_len = 0;
2681 ifc.ifc_len = 0;
2682 ifc.ifc_req = NULL;
2683 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2684 } else {
c6d409cf
ED
2685 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2686 sizeof(struct ifreq);
7a229387
AB
2687 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2688 ifc.ifc_len = len;
2689 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2690 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2691 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2692 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2693 return -EFAULT;
2694 ifr++;
2695 ifr32++;
2696 }
2697 }
2698 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2699 return -EFAULT;
2700
6b96018b 2701 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2702 if (err)
2703 return err;
2704
2705 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2706 return -EFAULT;
2707
2708 ifr = ifc.ifc_req;
2709 ifr32 = compat_ptr(ifc32.ifcbuf);
2710 for (i = 0, j = 0;
c6d409cf
ED
2711 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2712 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2713 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2714 return -EFAULT;
2715 ifr32++;
2716 ifr++;
2717 }
2718
2719 if (ifc32.ifcbuf == 0) {
2720 /* Translate from 64-bit structure multiple to
2721 * a 32-bit one.
2722 */
2723 i = ifc.ifc_len;
6b96018b 2724 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2725 ifc32.ifc_len = i;
2726 } else {
2727 ifc32.ifc_len = i;
2728 }
6b96018b 2729 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2730 return -EFAULT;
2731
2732 return 0;
2733}
2734
6b96018b 2735static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2736{
3a7da39d
BH
2737 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2738 bool convert_in = false, convert_out = false;
2739 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2740 struct ethtool_rxnfc __user *rxnfc;
7a229387 2741 struct ifreq __user *ifr;
3a7da39d
BH
2742 u32 rule_cnt = 0, actual_rule_cnt;
2743 u32 ethcmd;
7a229387 2744 u32 data;
3a7da39d 2745 int ret;
7a229387 2746
3a7da39d
BH
2747 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2748 return -EFAULT;
7a229387 2749
3a7da39d
BH
2750 compat_rxnfc = compat_ptr(data);
2751
2752 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2753 return -EFAULT;
2754
3a7da39d
BH
2755 /* Most ethtool structures are defined without padding.
2756 * Unfortunately struct ethtool_rxnfc is an exception.
2757 */
2758 switch (ethcmd) {
2759 default:
2760 break;
2761 case ETHTOOL_GRXCLSRLALL:
2762 /* Buffer size is variable */
2763 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2764 return -EFAULT;
2765 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2766 return -ENOMEM;
2767 buf_size += rule_cnt * sizeof(u32);
2768 /* fall through */
2769 case ETHTOOL_GRXRINGS:
2770 case ETHTOOL_GRXCLSRLCNT:
2771 case ETHTOOL_GRXCLSRULE:
55664f32 2772 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2773 convert_out = true;
2774 /* fall through */
2775 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2776 buf_size += sizeof(struct ethtool_rxnfc);
2777 convert_in = true;
2778 break;
2779 }
2780
2781 ifr = compat_alloc_user_space(buf_size);
2782 rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
2783
2784 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2785 return -EFAULT;
2786
3a7da39d
BH
2787 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2788 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2789 return -EFAULT;
2790
3a7da39d 2791 if (convert_in) {
127fe533 2792 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2793 * fs.ring_cookie and at the end of fs, but nowhere else.
2794 */
127fe533
AD
2795 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2796 sizeof(compat_rxnfc->fs.m_ext) !=
2797 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2798 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2799 BUILD_BUG_ON(
2800 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2801 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2802 offsetof(struct ethtool_rxnfc, fs.location) -
2803 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2804
2805 if (copy_in_user(rxnfc, compat_rxnfc,
127fe533 2806 (void *)(&rxnfc->fs.m_ext + 1) -
3a7da39d
BH
2807 (void *)rxnfc) ||
2808 copy_in_user(&rxnfc->fs.ring_cookie,
2809 &compat_rxnfc->fs.ring_cookie,
2810 (void *)(&rxnfc->fs.location + 1) -
2811 (void *)&rxnfc->fs.ring_cookie) ||
2812 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2813 sizeof(rxnfc->rule_cnt)))
2814 return -EFAULT;
2815 }
2816
2817 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2818 if (ret)
2819 return ret;
2820
2821 if (convert_out) {
2822 if (copy_in_user(compat_rxnfc, rxnfc,
127fe533 2823 (const void *)(&rxnfc->fs.m_ext + 1) -
3a7da39d
BH
2824 (const void *)rxnfc) ||
2825 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2826 &rxnfc->fs.ring_cookie,
2827 (const void *)(&rxnfc->fs.location + 1) -
2828 (const void *)&rxnfc->fs.ring_cookie) ||
2829 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2830 sizeof(rxnfc->rule_cnt)))
2831 return -EFAULT;
2832
2833 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2834 /* As an optimisation, we only copy the actual
2835 * number of rules that the underlying
2836 * function returned. Since Mallory might
2837 * change the rule count in user memory, we
2838 * check that it is less than the rule count
2839 * originally given (as the user buffer size),
2840 * which has been range-checked.
2841 */
2842 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2843 return -EFAULT;
2844 if (actual_rule_cnt < rule_cnt)
2845 rule_cnt = actual_rule_cnt;
2846 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2847 &rxnfc->rule_locs[0],
2848 rule_cnt * sizeof(u32)))
2849 return -EFAULT;
2850 }
2851 }
2852
2853 return 0;
7a229387
AB
2854}
2855
7a50a240
AB
2856static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2857{
2858 void __user *uptr;
2859 compat_uptr_t uptr32;
2860 struct ifreq __user *uifr;
2861
c6d409cf 2862 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2863 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2864 return -EFAULT;
2865
2866 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2867 return -EFAULT;
2868
2869 uptr = compat_ptr(uptr32);
2870
2871 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2872 return -EFAULT;
2873
2874 return dev_ioctl(net, SIOCWANDEV, uifr);
2875}
2876
6b96018b
AB
2877static int bond_ioctl(struct net *net, unsigned int cmd,
2878 struct compat_ifreq __user *ifr32)
7a229387
AB
2879{
2880 struct ifreq kifr;
2881 struct ifreq __user *uifr;
7a229387
AB
2882 mm_segment_t old_fs;
2883 int err;
2884 u32 data;
2885 void __user *datap;
2886
2887 switch (cmd) {
2888 case SIOCBONDENSLAVE:
2889 case SIOCBONDRELEASE:
2890 case SIOCBONDSETHWADDR:
2891 case SIOCBONDCHANGEACTIVE:
6b96018b 2892 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2893 return -EFAULT;
2894
2895 old_fs = get_fs();
c6d409cf 2896 set_fs(KERNEL_DS);
c3f52ae6 2897 err = dev_ioctl(net, cmd,
2898 (struct ifreq __user __force *) &kifr);
c6d409cf 2899 set_fs(old_fs);
7a229387
AB
2900
2901 return err;
2902 case SIOCBONDSLAVEINFOQUERY:
2903 case SIOCBONDINFOQUERY:
2904 uifr = compat_alloc_user_space(sizeof(*uifr));
2905 if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2906 return -EFAULT;
2907
2908 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2909 return -EFAULT;
2910
2911 datap = compat_ptr(data);
2912 if (put_user(datap, &uifr->ifr_ifru.ifru_data))
2913 return -EFAULT;
2914
6b96018b 2915 return dev_ioctl(net, cmd, uifr);
7a229387 2916 default:
07d106d0 2917 return -ENOIOCTLCMD;
ccbd6a5a 2918 }
7a229387
AB
2919}
2920
6b96018b
AB
2921static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
2922 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2923{
2924 struct ifreq __user *u_ifreq64;
7a229387
AB
2925 char tmp_buf[IFNAMSIZ];
2926 void __user *data64;
2927 u32 data32;
2928
2929 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2930 IFNAMSIZ))
2931 return -EFAULT;
2932 if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2933 return -EFAULT;
2934 data64 = compat_ptr(data32);
2935
2936 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2937
2938 /* Don't check these user accesses, just let that get trapped
2939 * in the ioctl handler instead.
2940 */
2941 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2942 IFNAMSIZ))
2943 return -EFAULT;
2944 if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2945 return -EFAULT;
2946
6b96018b 2947 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
2948}
2949
6b96018b
AB
2950static int dev_ifsioc(struct net *net, struct socket *sock,
2951 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 2952{
a2116ed2 2953 struct ifreq __user *uifr;
7a229387
AB
2954 int err;
2955
a2116ed2
AB
2956 uifr = compat_alloc_user_space(sizeof(*uifr));
2957 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2958 return -EFAULT;
2959
2960 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2961
7a229387
AB
2962 if (!err) {
2963 switch (cmd) {
2964 case SIOCGIFFLAGS:
2965 case SIOCGIFMETRIC:
2966 case SIOCGIFMTU:
2967 case SIOCGIFMEM:
2968 case SIOCGIFHWADDR:
2969 case SIOCGIFINDEX:
2970 case SIOCGIFADDR:
2971 case SIOCGIFBRDADDR:
2972 case SIOCGIFDSTADDR:
2973 case SIOCGIFNETMASK:
fab2532b 2974 case SIOCGIFPFLAGS:
7a229387 2975 case SIOCGIFTXQLEN:
fab2532b
AB
2976 case SIOCGMIIPHY:
2977 case SIOCGMIIREG:
a2116ed2 2978 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
2979 err = -EFAULT;
2980 break;
2981 }
2982 }
2983 return err;
2984}
2985
a2116ed2
AB
2986static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2987 struct compat_ifreq __user *uifr32)
2988{
2989 struct ifreq ifr;
2990 struct compat_ifmap __user *uifmap32;
2991 mm_segment_t old_fs;
2992 int err;
2993
2994 uifmap32 = &uifr32->ifr_ifru.ifru_map;
2995 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
2996 err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2997 err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2998 err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2999 err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
3000 err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
3001 err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
3002 if (err)
3003 return -EFAULT;
3004
3005 old_fs = get_fs();
c6d409cf 3006 set_fs(KERNEL_DS);
c3f52ae6 3007 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3008 set_fs(old_fs);
a2116ed2
AB
3009
3010 if (cmd == SIOCGIFMAP && !err) {
3011 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3012 err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3013 err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3014 err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3015 err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
3016 err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
3017 err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
3018 if (err)
3019 err = -EFAULT;
3020 }
3021 return err;
3022}
3023
3024static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
3025{
3026 void __user *uptr;
3027 compat_uptr_t uptr32;
3028 struct ifreq __user *uifr;
3029
c6d409cf 3030 uifr = compat_alloc_user_space(sizeof(*uifr));
a2116ed2
AB
3031 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
3032 return -EFAULT;
3033
3034 if (get_user(uptr32, &uifr32->ifr_data))
3035 return -EFAULT;
3036
3037 uptr = compat_ptr(uptr32);
3038
3039 if (put_user(uptr, &uifr->ifr_data))
3040 return -EFAULT;
3041
3042 return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
3043}
3044
7a229387 3045struct rtentry32 {
c6d409cf 3046 u32 rt_pad1;
7a229387
AB
3047 struct sockaddr rt_dst; /* target address */
3048 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3049 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3050 unsigned short rt_flags;
3051 short rt_pad2;
3052 u32 rt_pad3;
3053 unsigned char rt_tos;
3054 unsigned char rt_class;
3055 short rt_pad4;
3056 short rt_metric; /* +1 for binary compatibility! */
7a229387 3057 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3058 u32 rt_mtu; /* per route MTU/Window */
3059 u32 rt_window; /* Window clamping */
7a229387
AB
3060 unsigned short rt_irtt; /* Initial RTT */
3061};
3062
3063struct in6_rtmsg32 {
3064 struct in6_addr rtmsg_dst;
3065 struct in6_addr rtmsg_src;
3066 struct in6_addr rtmsg_gateway;
3067 u32 rtmsg_type;
3068 u16 rtmsg_dst_len;
3069 u16 rtmsg_src_len;
3070 u32 rtmsg_metric;
3071 u32 rtmsg_info;
3072 u32 rtmsg_flags;
3073 s32 rtmsg_ifindex;
3074};
3075
6b96018b
AB
3076static int routing_ioctl(struct net *net, struct socket *sock,
3077 unsigned int cmd, void __user *argp)
7a229387
AB
3078{
3079 int ret;
3080 void *r = NULL;
3081 struct in6_rtmsg r6;
3082 struct rtentry r4;
3083 char devname[16];
3084 u32 rtdev;
3085 mm_segment_t old_fs = get_fs();
3086
6b96018b
AB
3087 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3088 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3089 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3090 3 * sizeof(struct in6_addr));
c6d409cf
ED
3091 ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3092 ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3093 ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3094 ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3095 ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3096 ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3097 ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3098
3099 r = (void *) &r6;
3100 } else { /* ipv4 */
6b96018b 3101 struct rtentry32 __user *ur4 = argp;
c6d409cf 3102 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3103 3 * sizeof(struct sockaddr));
c6d409cf
ED
3104 ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
3105 ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
3106 ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
3107 ret |= __get_user(r4.rt_window, &(ur4->rt_window));
3108 ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
3109 ret |= __get_user(rtdev, &(ur4->rt_dev));
7a229387 3110 if (rtdev) {
c6d409cf 3111 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3112 r4.rt_dev = (char __user __force *)devname;
3113 devname[15] = 0;
7a229387
AB
3114 } else
3115 r4.rt_dev = NULL;
3116
3117 r = (void *) &r4;
3118 }
3119
3120 if (ret) {
3121 ret = -EFAULT;
3122 goto out;
3123 }
3124
c6d409cf 3125 set_fs(KERNEL_DS);
6b96018b 3126 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3127 set_fs(old_fs);
7a229387
AB
3128
3129out:
7a229387
AB
3130 return ret;
3131}
3132
3133/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3134 * for some operations; this forces use of the newer bridge-utils that
25985edc 3135 * use compatible ioctls
7a229387 3136 */
6b96018b 3137static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3138{
6b96018b 3139 compat_ulong_t tmp;
7a229387 3140
6b96018b 3141 if (get_user(tmp, argp))
7a229387
AB
3142 return -EFAULT;
3143 if (tmp == BRCTL_GET_VERSION)
3144 return BRCTL_VERSION + 1;
3145 return -EINVAL;
3146}
3147
6b96018b
AB
3148static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3149 unsigned int cmd, unsigned long arg)
3150{
3151 void __user *argp = compat_ptr(arg);
3152 struct sock *sk = sock->sk;
3153 struct net *net = sock_net(sk);
7a229387 3154
6b96018b
AB
3155 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3156 return siocdevprivate_ioctl(net, cmd, argp);
3157
3158 switch (cmd) {
3159 case SIOCSIFBR:
3160 case SIOCGIFBR:
3161 return old_bridge_ioctl(argp);
3162 case SIOCGIFNAME:
3163 return dev_ifname32(net, argp);
3164 case SIOCGIFCONF:
3165 return dev_ifconf(net, argp);
3166 case SIOCETHTOOL:
3167 return ethtool_ioctl(net, argp);
7a50a240
AB
3168 case SIOCWANDEV:
3169 return compat_siocwandev(net, argp);
a2116ed2
AB
3170 case SIOCGIFMAP:
3171 case SIOCSIFMAP:
3172 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3173 case SIOCBONDENSLAVE:
3174 case SIOCBONDRELEASE:
3175 case SIOCBONDSETHWADDR:
3176 case SIOCBONDSLAVEINFOQUERY:
3177 case SIOCBONDINFOQUERY:
3178 case SIOCBONDCHANGEACTIVE:
3179 return bond_ioctl(net, cmd, argp);
3180 case SIOCADDRT:
3181 case SIOCDELRT:
3182 return routing_ioctl(net, sock, cmd, argp);
3183 case SIOCGSTAMP:
3184 return do_siocgstamp(net, sock, cmd, argp);
3185 case SIOCGSTAMPNS:
3186 return do_siocgstampns(net, sock, cmd, argp);
a2116ed2
AB
3187 case SIOCSHWTSTAMP:
3188 return compat_siocshwtstamp(net, argp);
6b96018b
AB
3189
3190 case FIOSETOWN:
3191 case SIOCSPGRP:
3192 case FIOGETOWN:
3193 case SIOCGPGRP:
3194 case SIOCBRADDBR:
3195 case SIOCBRDELBR:
3196 case SIOCGIFVLAN:
3197 case SIOCSIFVLAN:
3198 case SIOCADDDLCI:
3199 case SIOCDELDLCI:
3200 return sock_ioctl(file, cmd, arg);
3201
3202 case SIOCGIFFLAGS:
3203 case SIOCSIFFLAGS:
3204 case SIOCGIFMETRIC:
3205 case SIOCSIFMETRIC:
3206 case SIOCGIFMTU:
3207 case SIOCSIFMTU:
3208 case SIOCGIFMEM:
3209 case SIOCSIFMEM:
3210 case SIOCGIFHWADDR:
3211 case SIOCSIFHWADDR:
3212 case SIOCADDMULTI:
3213 case SIOCDELMULTI:
3214 case SIOCGIFINDEX:
6b96018b
AB
3215 case SIOCGIFADDR:
3216 case SIOCSIFADDR:
3217 case SIOCSIFHWBROADCAST:
6b96018b 3218 case SIOCDIFADDR:
6b96018b
AB
3219 case SIOCGIFBRDADDR:
3220 case SIOCSIFBRDADDR:
3221 case SIOCGIFDSTADDR:
3222 case SIOCSIFDSTADDR:
3223 case SIOCGIFNETMASK:
3224 case SIOCSIFNETMASK:
3225 case SIOCSIFPFLAGS:
3226 case SIOCGIFPFLAGS:
3227 case SIOCGIFTXQLEN:
3228 case SIOCSIFTXQLEN:
3229 case SIOCBRADDIF:
3230 case SIOCBRDELIF:
9177efd3
AB
3231 case SIOCSIFNAME:
3232 case SIOCGMIIPHY:
3233 case SIOCGMIIREG:
3234 case SIOCSMIIREG:
6b96018b 3235 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3236
6b96018b
AB
3237 case SIOCSARP:
3238 case SIOCGARP:
3239 case SIOCDARP:
6b96018b 3240 case SIOCATMARK:
9177efd3
AB
3241 return sock_do_ioctl(net, sock, cmd, arg);
3242 }
3243
6b96018b
AB
3244 return -ENOIOCTLCMD;
3245}
7a229387 3246
95c96174 3247static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3248 unsigned long arg)
89bbfc95
SP
3249{
3250 struct socket *sock = file->private_data;
3251 int ret = -ENOIOCTLCMD;
87de87d5
DM
3252 struct sock *sk;
3253 struct net *net;
3254
3255 sk = sock->sk;
3256 net = sock_net(sk);
89bbfc95
SP
3257
3258 if (sock->ops->compat_ioctl)
3259 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3260
87de87d5
DM
3261 if (ret == -ENOIOCTLCMD &&
3262 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3263 ret = compat_wext_handle_ioctl(net, cmd, arg);
3264
6b96018b
AB
3265 if (ret == -ENOIOCTLCMD)
3266 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3267
89bbfc95
SP
3268 return ret;
3269}
3270#endif
3271
ac5a488e
SS
3272int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3273{
3274 return sock->ops->bind(sock, addr, addrlen);
3275}
c6d409cf 3276EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3277
3278int kernel_listen(struct socket *sock, int backlog)
3279{
3280 return sock->ops->listen(sock, backlog);
3281}
c6d409cf 3282EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3283
3284int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3285{
3286 struct sock *sk = sock->sk;
3287 int err;
3288
3289 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3290 newsock);
3291 if (err < 0)
3292 goto done;
3293
3294 err = sock->ops->accept(sock, *newsock, flags);
3295 if (err < 0) {
3296 sock_release(*newsock);
fa8705b0 3297 *newsock = NULL;
ac5a488e
SS
3298 goto done;
3299 }
3300
3301 (*newsock)->ops = sock->ops;
1b08534e 3302 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3303
3304done:
3305 return err;
3306}
c6d409cf 3307EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3308
3309int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3310 int flags)
ac5a488e
SS
3311{
3312 return sock->ops->connect(sock, addr, addrlen, flags);
3313}
c6d409cf 3314EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3315
3316int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3317 int *addrlen)
3318{
3319 return sock->ops->getname(sock, addr, addrlen, 0);
3320}
c6d409cf 3321EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3322
3323int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3324 int *addrlen)
3325{
3326 return sock->ops->getname(sock, addr, addrlen, 1);
3327}
c6d409cf 3328EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3329
3330int kernel_getsockopt(struct socket *sock, int level, int optname,
3331 char *optval, int *optlen)
3332{
3333 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3334 char __user *uoptval;
3335 int __user *uoptlen;
ac5a488e
SS
3336 int err;
3337
fb8621bb
NK
3338 uoptval = (char __user __force *) optval;
3339 uoptlen = (int __user __force *) optlen;
3340
ac5a488e
SS
3341 set_fs(KERNEL_DS);
3342 if (level == SOL_SOCKET)
fb8621bb 3343 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3344 else
fb8621bb
NK
3345 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3346 uoptlen);
ac5a488e
SS
3347 set_fs(oldfs);
3348 return err;
3349}
c6d409cf 3350EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3351
3352int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3353 char *optval, unsigned int optlen)
ac5a488e
SS
3354{
3355 mm_segment_t oldfs = get_fs();
fb8621bb 3356 char __user *uoptval;
ac5a488e
SS
3357 int err;
3358
fb8621bb
NK
3359 uoptval = (char __user __force *) optval;
3360
ac5a488e
SS
3361 set_fs(KERNEL_DS);
3362 if (level == SOL_SOCKET)
fb8621bb 3363 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3364 else
fb8621bb 3365 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3366 optlen);
3367 set_fs(oldfs);
3368 return err;
3369}
c6d409cf 3370EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3371
3372int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3373 size_t size, int flags)
3374{
f8451725
HX
3375 sock_update_classid(sock->sk);
3376
ac5a488e
SS
3377 if (sock->ops->sendpage)
3378 return sock->ops->sendpage(sock, page, offset, size, flags);
3379
3380 return sock_no_sendpage(sock, page, offset, size, flags);
3381}
c6d409cf 3382EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3383
3384int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3385{
3386 mm_segment_t oldfs = get_fs();
3387 int err;
3388
3389 set_fs(KERNEL_DS);
3390 err = sock->ops->ioctl(sock, cmd, arg);
3391 set_fs(oldfs);
3392
3393 return err;
3394}
c6d409cf 3395EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3396
91cf45f0
TM
3397int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3398{
3399 return sock->ops->shutdown(sock, how);
3400}
91cf45f0 3401EXPORT_SYMBOL(kernel_sock_shutdown);