Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
1da177e4
LT
75#include <linux/init.h>
76#include <linux/poll.h>
77#include <linux/cache.h>
78#include <linux/module.h>
79#include <linux/highmem.h>
1da177e4
LT
80#include <linux/mount.h>
81#include <linux/security.h>
82#include <linux/syscalls.h>
83#include <linux/compat.h>
84#include <linux/kmod.h>
3ec3b2fb 85#include <linux/audit.h>
d86b5e0e 86#include <linux/wireless.h>
1b8d7ae4 87#include <linux/nsproxy.h>
1fd7317d 88#include <linux/magic.h>
5a0e3ad6 89#include <linux/slab.h>
600e1779 90#include <linux/xattr.h>
1da177e4
LT
91
92#include <asm/uaccess.h>
93#include <asm/unistd.h>
94
95#include <net/compat.h>
87de87d5 96#include <net/wext.h>
f8451725 97#include <net/cls_cgroup.h>
1da177e4
LT
98
99#include <net/sock.h>
100#include <linux/netfilter.h>
101
6b96018b
AB
102#include <linux/if_tun.h>
103#include <linux/ipv6_route.h>
104#include <linux/route.h>
6b96018b
AB
105#include <linux/sockios.h>
106#include <linux/atalk.h>
107
1da177e4 108static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
109static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
110 unsigned long nr_segs, loff_t pos);
111static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
112 unsigned long nr_segs, loff_t pos);
89bddce5 113static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
114
115static int sock_close(struct inode *inode, struct file *file);
116static unsigned int sock_poll(struct file *file,
117 struct poll_table_struct *wait);
89bddce5 118static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
119#ifdef CONFIG_COMPAT
120static long compat_sock_ioctl(struct file *file,
89bddce5 121 unsigned int cmd, unsigned long arg);
89bbfc95 122#endif
1da177e4 123static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
124static ssize_t sock_sendpage(struct file *file, struct page *page,
125 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 126static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 127 struct pipe_inode_info *pipe, size_t len,
9c55e01c 128 unsigned int flags);
1da177e4 129
1da177e4
LT
130/*
131 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
132 * in the operation structures but are done directly via the socketcall() multiplexor.
133 */
134
da7071d7 135static const struct file_operations socket_file_ops = {
1da177e4
LT
136 .owner = THIS_MODULE,
137 .llseek = no_llseek,
138 .aio_read = sock_aio_read,
139 .aio_write = sock_aio_write,
140 .poll = sock_poll,
141 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
142#ifdef CONFIG_COMPAT
143 .compat_ioctl = compat_sock_ioctl,
144#endif
1da177e4
LT
145 .mmap = sock_mmap,
146 .open = sock_no_open, /* special open code to disallow open via /proc */
147 .release = sock_close,
148 .fasync = sock_fasync,
5274f052
JA
149 .sendpage = sock_sendpage,
150 .splice_write = generic_splice_sendpage,
9c55e01c 151 .splice_read = sock_splice_read,
1da177e4
LT
152};
153
154/*
155 * The protocol list. Each protocol is registered in here.
156 */
157
1da177e4 158static DEFINE_SPINLOCK(net_family_lock);
190683a9 159static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 160
1da177e4
LT
161/*
162 * Statistics counters of the socket lists
163 */
164
c6d409cf 165static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
166
167/*
89bddce5
SH
168 * Support routines.
169 * Move socket addresses back and forth across the kernel/user
170 * divide and look after the messy bits.
1da177e4
LT
171 */
172
1da177e4
LT
173/**
174 * move_addr_to_kernel - copy a socket address into kernel space
175 * @uaddr: Address in user space
176 * @kaddr: Address in kernel space
177 * @ulen: Length in user space
178 *
179 * The address is copied into kernel space. If the provided address is
180 * too long an error code of -EINVAL is returned. If the copy gives
181 * invalid addresses -EFAULT is returned. On a success 0 is returned.
182 */
183
43db362d 184int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 185{
230b1839 186 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 187 return -EINVAL;
89bddce5 188 if (ulen == 0)
1da177e4 189 return 0;
89bddce5 190 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 191 return -EFAULT;
3ec3b2fb 192 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
193}
194
195/**
196 * move_addr_to_user - copy an address to user space
197 * @kaddr: kernel space address
198 * @klen: length of address in kernel
199 * @uaddr: user space address
200 * @ulen: pointer to user length field
201 *
202 * The value pointed to by ulen on entry is the buffer length available.
203 * This is overwritten with the buffer space used. -EINVAL is returned
204 * if an overlong buffer is specified or a negative buffer size. -EFAULT
205 * is returned if either the buffer or the length field are not
206 * accessible.
207 * After copying the data up to the limit the user specifies, the true
208 * length of the data is written over the length limit the user
209 * specified. Zero is returned for a success.
210 */
89bddce5 211
43db362d 212static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 213 void __user *uaddr, int __user *ulen)
1da177e4
LT
214{
215 int err;
216 int len;
217
89bddce5
SH
218 err = get_user(len, ulen);
219 if (err)
1da177e4 220 return err;
89bddce5
SH
221 if (len > klen)
222 len = klen;
230b1839 223 if (len < 0 || len > sizeof(struct sockaddr_storage))
1da177e4 224 return -EINVAL;
89bddce5 225 if (len) {
d6fe3945
SG
226 if (audit_sockaddr(klen, kaddr))
227 return -ENOMEM;
89bddce5 228 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
229 return -EFAULT;
230 }
231 /*
89bddce5
SH
232 * "fromlen shall refer to the value before truncation.."
233 * 1003.1g
1da177e4
LT
234 */
235 return __put_user(klen, ulen);
236}
237
e18b890b 238static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
239
240static struct inode *sock_alloc_inode(struct super_block *sb)
241{
242 struct socket_alloc *ei;
eaefd110 243 struct socket_wq *wq;
89bddce5 244
e94b1766 245 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
246 if (!ei)
247 return NULL;
eaefd110
ED
248 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
249 if (!wq) {
43815482
ED
250 kmem_cache_free(sock_inode_cachep, ei);
251 return NULL;
252 }
eaefd110
ED
253 init_waitqueue_head(&wq->wait);
254 wq->fasync_list = NULL;
255 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 256
1da177e4
LT
257 ei->socket.state = SS_UNCONNECTED;
258 ei->socket.flags = 0;
259 ei->socket.ops = NULL;
260 ei->socket.sk = NULL;
261 ei->socket.file = NULL;
1da177e4
LT
262
263 return &ei->vfs_inode;
264}
265
266static void sock_destroy_inode(struct inode *inode)
267{
43815482 268 struct socket_alloc *ei;
eaefd110 269 struct socket_wq *wq;
43815482
ED
270
271 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 272 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 273 kfree_rcu(wq, rcu);
43815482 274 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
275}
276
51cc5068 277static void init_once(void *foo)
1da177e4 278{
89bddce5 279 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 280
a35afb83 281 inode_init_once(&ei->vfs_inode);
1da177e4 282}
89bddce5 283
1da177e4
LT
284static int init_inodecache(void)
285{
286 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
287 sizeof(struct socket_alloc),
288 0,
289 (SLAB_HWCACHE_ALIGN |
290 SLAB_RECLAIM_ACCOUNT |
291 SLAB_MEM_SPREAD),
20c2df83 292 init_once);
1da177e4
LT
293 if (sock_inode_cachep == NULL)
294 return -ENOMEM;
295 return 0;
296}
297
b87221de 298static const struct super_operations sockfs_ops = {
c6d409cf
ED
299 .alloc_inode = sock_alloc_inode,
300 .destroy_inode = sock_destroy_inode,
301 .statfs = simple_statfs,
1da177e4
LT
302};
303
c23fbb6b
ED
304/*
305 * sockfs_dname() is called from d_path().
306 */
307static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
308{
309 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
310 dentry->d_inode->i_ino);
311}
312
3ba13d17 313static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 314 .d_dname = sockfs_dname,
1da177e4
LT
315};
316
c74a1cbb
AV
317static struct dentry *sockfs_mount(struct file_system_type *fs_type,
318 int flags, const char *dev_name, void *data)
319{
320 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
321 &sockfs_dentry_operations, SOCKFS_MAGIC);
322}
323
324static struct vfsmount *sock_mnt __read_mostly;
325
326static struct file_system_type sock_fs_type = {
327 .name = "sockfs",
328 .mount = sockfs_mount,
329 .kill_sb = kill_anon_super,
330};
331
1da177e4
LT
332/*
333 * Obtains the first available file descriptor and sets it up for use.
334 *
39d8c1b6
DM
335 * These functions create file structures and maps them to fd space
336 * of the current process. On success it returns file descriptor
1da177e4
LT
337 * and file struct implicitly stored in sock->file.
338 * Note that another thread may close file descriptor before we return
339 * from this function. We use the fact that now we do not refer
340 * to socket after mapping. If one day we will need it, this
341 * function will increment ref. count on file by 1.
342 *
343 * In any case returned fd MAY BE not valid!
344 * This race condition is unavoidable
345 * with shared fd spaces, we cannot solve it inside kernel,
346 * but we take care of internal coherence yet.
347 */
348
aab174f0 349struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 350{
7cbe66b6 351 struct qstr name = { .name = "" };
2c48b9c4 352 struct path path;
7cbe66b6 353 struct file *file;
1da177e4 354
600e1779
MY
355 if (dname) {
356 name.name = dname;
357 name.len = strlen(name.name);
358 } else if (sock->sk) {
359 name.name = sock->sk->sk_prot_creator->name;
360 name.len = strlen(name.name);
361 }
4b936885 362 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
363 if (unlikely(!path.dentry))
364 return ERR_PTR(-ENOMEM);
2c48b9c4 365 path.mnt = mntget(sock_mnt);
39d8c1b6 366
2c48b9c4 367 d_instantiate(path.dentry, SOCK_INODE(sock));
cc3808f8 368 SOCK_INODE(sock)->i_fop = &socket_file_ops;
39d8c1b6 369
2c48b9c4 370 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 371 &socket_file_ops);
39b65252 372 if (unlikely(IS_ERR(file))) {
cc3808f8 373 /* drop dentry, keep inode */
7de9c6ee 374 ihold(path.dentry->d_inode);
2c48b9c4 375 path_put(&path);
39b65252 376 return file;
cc3808f8
AV
377 }
378
379 sock->file = file;
77d27200 380 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 381 file->private_data = sock;
28407630 382 return file;
39d8c1b6 383}
56b31d1c 384EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 385
56b31d1c 386static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
387{
388 struct file *newfile;
28407630
AV
389 int fd = get_unused_fd_flags(flags);
390 if (unlikely(fd < 0))
391 return fd;
39d8c1b6 392
aab174f0 393 newfile = sock_alloc_file(sock, flags, NULL);
28407630 394 if (likely(!IS_ERR(newfile))) {
39d8c1b6 395 fd_install(fd, newfile);
28407630
AV
396 return fd;
397 }
7cbe66b6 398
28407630
AV
399 put_unused_fd(fd);
400 return PTR_ERR(newfile);
1da177e4
LT
401}
402
406a3c63 403struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 404{
6cb153ca
BL
405 if (file->f_op == &socket_file_ops)
406 return file->private_data; /* set in sock_map_fd */
407
23bb80d2
ED
408 *err = -ENOTSOCK;
409 return NULL;
6cb153ca 410}
406a3c63 411EXPORT_SYMBOL(sock_from_file);
6cb153ca 412
1da177e4 413/**
c6d409cf 414 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
415 * @fd: file handle
416 * @err: pointer to an error code return
417 *
418 * The file handle passed in is locked and the socket it is bound
419 * too is returned. If an error occurs the err pointer is overwritten
420 * with a negative errno code and NULL is returned. The function checks
421 * for both invalid handles and passing a handle which is not a socket.
422 *
423 * On a success the socket object pointer is returned.
424 */
425
426struct socket *sockfd_lookup(int fd, int *err)
427{
428 struct file *file;
1da177e4
LT
429 struct socket *sock;
430
89bddce5
SH
431 file = fget(fd);
432 if (!file) {
1da177e4
LT
433 *err = -EBADF;
434 return NULL;
435 }
89bddce5 436
6cb153ca
BL
437 sock = sock_from_file(file, err);
438 if (!sock)
1da177e4 439 fput(file);
6cb153ca
BL
440 return sock;
441}
c6d409cf 442EXPORT_SYMBOL(sockfd_lookup);
1da177e4 443
6cb153ca
BL
444static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
445{
446 struct file *file;
447 struct socket *sock;
448
3672558c 449 *err = -EBADF;
6cb153ca
BL
450 file = fget_light(fd, fput_needed);
451 if (file) {
452 sock = sock_from_file(file, err);
453 if (sock)
454 return sock;
455 fput_light(file, *fput_needed);
1da177e4 456 }
6cb153ca 457 return NULL;
1da177e4
LT
458}
459
600e1779
MY
460#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
461#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
462#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
463static ssize_t sockfs_getxattr(struct dentry *dentry,
464 const char *name, void *value, size_t size)
465{
466 const char *proto_name;
467 size_t proto_size;
468 int error;
469
470 error = -ENODATA;
471 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
472 proto_name = dentry->d_name.name;
473 proto_size = strlen(proto_name);
474
475 if (value) {
476 error = -ERANGE;
477 if (proto_size + 1 > size)
478 goto out;
479
480 strncpy(value, proto_name, proto_size + 1);
481 }
482 error = proto_size + 1;
483 }
484
485out:
486 return error;
487}
488
489static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
490 size_t size)
491{
492 ssize_t len;
493 ssize_t used = 0;
494
495 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
496 if (len < 0)
497 return len;
498 used += len;
499 if (buffer) {
500 if (size < used)
501 return -ERANGE;
502 buffer += len;
503 }
504
505 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
506 used += len;
507 if (buffer) {
508 if (size < used)
509 return -ERANGE;
510 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
511 buffer += len;
512 }
513
514 return used;
515}
516
517static const struct inode_operations sockfs_inode_ops = {
518 .getxattr = sockfs_getxattr,
519 .listxattr = sockfs_listxattr,
520};
521
1da177e4
LT
522/**
523 * sock_alloc - allocate a socket
89bddce5 524 *
1da177e4
LT
525 * Allocate a new inode and socket object. The two are bound together
526 * and initialised. The socket is then returned. If we are out of inodes
527 * NULL is returned.
528 */
529
530static struct socket *sock_alloc(void)
531{
89bddce5
SH
532 struct inode *inode;
533 struct socket *sock;
1da177e4 534
a209dfc7 535 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
536 if (!inode)
537 return NULL;
538
539 sock = SOCKET_I(inode);
540
29a020d3 541 kmemcheck_annotate_bitfield(sock, type);
85fe4025 542 inode->i_ino = get_next_ino();
89bddce5 543 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
544 inode->i_uid = current_fsuid();
545 inode->i_gid = current_fsgid();
600e1779 546 inode->i_op = &sockfs_inode_ops;
1da177e4 547
19e8d69c 548 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
549 return sock;
550}
551
552/*
553 * In theory you can't get an open on this inode, but /proc provides
554 * a back door. Remember to keep it shut otherwise you'll let the
555 * creepy crawlies in.
556 */
89bddce5 557
1da177e4
LT
558static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
559{
560 return -ENXIO;
561}
562
4b6f5d20 563const struct file_operations bad_sock_fops = {
1da177e4
LT
564 .owner = THIS_MODULE,
565 .open = sock_no_open,
6038f373 566 .llseek = noop_llseek,
1da177e4
LT
567};
568
569/**
570 * sock_release - close a socket
571 * @sock: socket to close
572 *
573 * The socket is released from the protocol stack if it has a release
574 * callback, and the inode is then released if the socket is bound to
89bddce5 575 * an inode not a file.
1da177e4 576 */
89bddce5 577
1da177e4
LT
578void sock_release(struct socket *sock)
579{
580 if (sock->ops) {
581 struct module *owner = sock->ops->owner;
582
583 sock->ops->release(sock);
584 sock->ops = NULL;
585 module_put(owner);
586 }
587
eaefd110 588 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
1da177e4
LT
589 printk(KERN_ERR "sock_release: fasync list not empty!\n");
590
b09e786b
MP
591 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
592 return;
593
19e8d69c 594 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
595 if (!sock->file) {
596 iput(SOCK_INODE(sock));
597 return;
598 }
89bddce5 599 sock->file = NULL;
1da177e4 600}
c6d409cf 601EXPORT_SYMBOL(sock_release);
1da177e4 602
bf84a010 603void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
20d49473 604{
2244d07b 605 *tx_flags = 0;
20d49473 606 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
2244d07b 607 *tx_flags |= SKBTX_HW_TSTAMP;
20d49473 608 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
2244d07b 609 *tx_flags |= SKBTX_SW_TSTAMP;
6e3e939f
JB
610 if (sock_flag(sk, SOCK_WIFI_STATUS))
611 *tx_flags |= SKBTX_WIFI_STATUS;
20d49473
PO
612}
613EXPORT_SYMBOL(sock_tx_timestamp);
614
228e548e
AB
615static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
616 struct msghdr *msg, size_t size)
1da177e4
LT
617{
618 struct sock_iocb *si = kiocb_to_siocb(iocb);
1da177e4
LT
619
620 si->sock = sock;
621 si->scm = NULL;
622 si->msg = msg;
623 si->size = size;
624
1da177e4
LT
625 return sock->ops->sendmsg(iocb, sock, msg, size);
626}
627
228e548e
AB
628static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
629 struct msghdr *msg, size_t size)
630{
631 int err = security_socket_sendmsg(sock, msg, size);
632
633 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
634}
635
1da177e4
LT
636int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
637{
638 struct kiocb iocb;
639 struct sock_iocb siocb;
640 int ret;
641
642 init_sync_kiocb(&iocb, NULL);
643 iocb.private = &siocb;
644 ret = __sock_sendmsg(&iocb, sock, msg, size);
645 if (-EIOCBQUEUED == ret)
646 ret = wait_on_sync_kiocb(&iocb);
647 return ret;
648}
c6d409cf 649EXPORT_SYMBOL(sock_sendmsg);
1da177e4 650
894dc24c 651static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
652{
653 struct kiocb iocb;
654 struct sock_iocb siocb;
655 int ret;
656
657 init_sync_kiocb(&iocb, NULL);
658 iocb.private = &siocb;
659 ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
660 if (-EIOCBQUEUED == ret)
661 ret = wait_on_sync_kiocb(&iocb);
662 return ret;
663}
664
1da177e4
LT
665int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
666 struct kvec *vec, size_t num, size_t size)
667{
668 mm_segment_t oldfs = get_fs();
669 int result;
670
671 set_fs(KERNEL_DS);
672 /*
673 * the following is safe, since for compiler definitions of kvec and
674 * iovec are identical, yielding the same in-core layout and alignment
675 */
89bddce5 676 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
677 msg->msg_iovlen = num;
678 result = sock_sendmsg(sock, msg, size);
679 set_fs(oldfs);
680 return result;
681}
c6d409cf 682EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 683
92f37fd2
ED
684/*
685 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
686 */
687void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
688 struct sk_buff *skb)
689{
20d49473
PO
690 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
691 struct timespec ts[3];
692 int empty = 1;
693 struct skb_shared_hwtstamps *shhwtstamps =
694 skb_hwtstamps(skb);
695
696 /* Race occurred between timestamp enabling and packet
697 receiving. Fill in the current time for now. */
698 if (need_software_tstamp && skb->tstamp.tv64 == 0)
699 __net_timestamp(skb);
700
701 if (need_software_tstamp) {
702 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
703 struct timeval tv;
704 skb_get_timestamp(skb, &tv);
705 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
706 sizeof(tv), &tv);
707 } else {
842509b8 708 skb_get_timestampns(skb, &ts[0]);
20d49473 709 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
842509b8 710 sizeof(ts[0]), &ts[0]);
20d49473
PO
711 }
712 }
713
714
715 memset(ts, 0, sizeof(ts));
6e94d1ef
DB
716 if (sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE) &&
717 ktime_to_timespec_cond(skb->tstamp, ts + 0))
20d49473 718 empty = 0;
20d49473
PO
719 if (shhwtstamps) {
720 if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
6e94d1ef 721 ktime_to_timespec_cond(shhwtstamps->syststamp, ts + 1))
20d49473
PO
722 empty = 0;
723 if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
6e94d1ef 724 ktime_to_timespec_cond(shhwtstamps->hwtstamp, ts + 2))
20d49473 725 empty = 0;
92f37fd2 726 }
20d49473
PO
727 if (!empty)
728 put_cmsg(msg, SOL_SOCKET,
729 SCM_TIMESTAMPING, sizeof(ts), &ts);
92f37fd2 730}
7c81fd8b
ACM
731EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
732
6e3e939f
JB
733void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
734 struct sk_buff *skb)
735{
736 int ack;
737
738 if (!sock_flag(sk, SOCK_WIFI_STATUS))
739 return;
740 if (!skb->wifi_acked_valid)
741 return;
742
743 ack = skb->wifi_acked;
744
745 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
746}
747EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
748
11165f14 749static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
750 struct sk_buff *skb)
3b885787
NH
751{
752 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
753 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
754 sizeof(__u32), &skb->dropcount);
755}
756
767dd033 757void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
758 struct sk_buff *skb)
759{
760 sock_recv_timestamp(msg, sk, skb);
761 sock_recv_drops(msg, sk, skb);
762}
767dd033 763EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 764
a2e27255
ACM
765static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
766 struct msghdr *msg, size_t size, int flags)
1da177e4 767{
1da177e4
LT
768 struct sock_iocb *si = kiocb_to_siocb(iocb);
769
770 si->sock = sock;
771 si->scm = NULL;
772 si->msg = msg;
773 si->size = size;
774 si->flags = flags;
775
1da177e4
LT
776 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
777}
778
a2e27255
ACM
779static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
780 struct msghdr *msg, size_t size, int flags)
781{
782 int err = security_socket_recvmsg(sock, msg, size, flags);
783
784 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
785}
786
89bddce5 787int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
788 size_t size, int flags)
789{
790 struct kiocb iocb;
791 struct sock_iocb siocb;
792 int ret;
793
89bddce5 794 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
795 iocb.private = &siocb;
796 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
797 if (-EIOCBQUEUED == ret)
798 ret = wait_on_sync_kiocb(&iocb);
799 return ret;
800}
c6d409cf 801EXPORT_SYMBOL(sock_recvmsg);
1da177e4 802
a2e27255
ACM
803static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
804 size_t size, int flags)
805{
806 struct kiocb iocb;
807 struct sock_iocb siocb;
808 int ret;
809
810 init_sync_kiocb(&iocb, NULL);
811 iocb.private = &siocb;
812 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
813 if (-EIOCBQUEUED == ret)
814 ret = wait_on_sync_kiocb(&iocb);
815 return ret;
816}
817
c1249c0a
ML
818/**
819 * kernel_recvmsg - Receive a message from a socket (kernel space)
820 * @sock: The socket to receive the message from
821 * @msg: Received message
822 * @vec: Input s/g array for message data
823 * @num: Size of input s/g array
824 * @size: Number of bytes to read
825 * @flags: Message flags (MSG_DONTWAIT, etc...)
826 *
827 * On return the msg structure contains the scatter/gather array passed in the
828 * vec argument. The array is modified so that it consists of the unfilled
829 * portion of the original array.
830 *
831 * The returned value is the total number of bytes received, or an error.
832 */
89bddce5
SH
833int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
834 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
835{
836 mm_segment_t oldfs = get_fs();
837 int result;
838
839 set_fs(KERNEL_DS);
840 /*
841 * the following is safe, since for compiler definitions of kvec and
842 * iovec are identical, yielding the same in-core layout and alignment
843 */
89bddce5 844 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
845 result = sock_recvmsg(sock, msg, size, flags);
846 set_fs(oldfs);
847 return result;
848}
c6d409cf 849EXPORT_SYMBOL(kernel_recvmsg);
1da177e4
LT
850
851static void sock_aio_dtor(struct kiocb *iocb)
852{
853 kfree(iocb->private);
854}
855
ce1d4d3e
CH
856static ssize_t sock_sendpage(struct file *file, struct page *page,
857 int offset, size_t size, loff_t *ppos, int more)
1da177e4 858{
1da177e4
LT
859 struct socket *sock;
860 int flags;
861
ce1d4d3e
CH
862 sock = file->private_data;
863
35f9c09f
ED
864 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
865 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
866 flags |= more;
ce1d4d3e 867
e6949583 868 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 869}
1da177e4 870
9c55e01c 871static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 872 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
873 unsigned int flags)
874{
875 struct socket *sock = file->private_data;
876
997b37da
RDC
877 if (unlikely(!sock->ops->splice_read))
878 return -EINVAL;
879
9c55e01c
JA
880 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
881}
882
ce1d4d3e 883static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 884 struct sock_iocb *siocb)
ce1d4d3e
CH
885{
886 if (!is_sync_kiocb(iocb)) {
887 siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
888 if (!siocb)
889 return NULL;
1da177e4
LT
890 iocb->ki_dtor = sock_aio_dtor;
891 }
1da177e4 892
ce1d4d3e 893 siocb->kiocb = iocb;
ce1d4d3e
CH
894 iocb->private = siocb;
895 return siocb;
1da177e4
LT
896}
897
ce1d4d3e 898static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
899 struct file *file, const struct iovec *iov,
900 unsigned long nr_segs)
ce1d4d3e
CH
901{
902 struct socket *sock = file->private_data;
903 size_t size = 0;
904 int i;
1da177e4 905
89bddce5
SH
906 for (i = 0; i < nr_segs; i++)
907 size += iov[i].iov_len;
1da177e4 908
ce1d4d3e
CH
909 msg->msg_name = NULL;
910 msg->msg_namelen = 0;
911 msg->msg_control = NULL;
912 msg->msg_controllen = 0;
89bddce5 913 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
914 msg->msg_iovlen = nr_segs;
915 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
916
917 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
918}
919
027445c3
BP
920static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
921 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
922{
923 struct sock_iocb siocb, *x;
924
1da177e4
LT
925 if (pos != 0)
926 return -ESPIPE;
027445c3
BP
927
928 if (iocb->ki_left == 0) /* Match SYS5 behaviour */
1da177e4
LT
929 return 0;
930
027445c3
BP
931
932 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
933 if (!x)
934 return -ENOMEM;
027445c3 935 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
936}
937
ce1d4d3e 938static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
939 struct file *file, const struct iovec *iov,
940 unsigned long nr_segs)
1da177e4 941{
ce1d4d3e
CH
942 struct socket *sock = file->private_data;
943 size_t size = 0;
944 int i;
1da177e4 945
89bddce5
SH
946 for (i = 0; i < nr_segs; i++)
947 size += iov[i].iov_len;
1da177e4 948
ce1d4d3e
CH
949 msg->msg_name = NULL;
950 msg->msg_namelen = 0;
951 msg->msg_control = NULL;
952 msg->msg_controllen = 0;
89bddce5 953 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
954 msg->msg_iovlen = nr_segs;
955 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
956 if (sock->type == SOCK_SEQPACKET)
957 msg->msg_flags |= MSG_EOR;
1da177e4 958
ce1d4d3e 959 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
960}
961
027445c3
BP
962static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
963 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
964{
965 struct sock_iocb siocb, *x;
1da177e4 966
ce1d4d3e
CH
967 if (pos != 0)
968 return -ESPIPE;
027445c3 969
027445c3 970 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
971 if (!x)
972 return -ENOMEM;
1da177e4 973
027445c3 974 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
975}
976
1da177e4
LT
977/*
978 * Atomic setting of ioctl hooks to avoid race
979 * with module unload.
980 */
981
4a3e2f71 982static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 983static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 984
881d966b 985void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 986{
4a3e2f71 987 mutex_lock(&br_ioctl_mutex);
1da177e4 988 br_ioctl_hook = hook;
4a3e2f71 989 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
990}
991EXPORT_SYMBOL(brioctl_set);
992
4a3e2f71 993static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 994static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 995
881d966b 996void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 997{
4a3e2f71 998 mutex_lock(&vlan_ioctl_mutex);
1da177e4 999 vlan_ioctl_hook = hook;
4a3e2f71 1000 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
1001}
1002EXPORT_SYMBOL(vlan_ioctl_set);
1003
4a3e2f71 1004static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 1005static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 1006
89bddce5 1007void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 1008{
4a3e2f71 1009 mutex_lock(&dlci_ioctl_mutex);
1da177e4 1010 dlci_ioctl_hook = hook;
4a3e2f71 1011 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1012}
1013EXPORT_SYMBOL(dlci_ioctl_set);
1014
6b96018b
AB
1015static long sock_do_ioctl(struct net *net, struct socket *sock,
1016 unsigned int cmd, unsigned long arg)
1017{
1018 int err;
1019 void __user *argp = (void __user *)arg;
1020
1021 err = sock->ops->ioctl(sock, cmd, arg);
1022
1023 /*
1024 * If this ioctl is unknown try to hand it down
1025 * to the NIC driver.
1026 */
1027 if (err == -ENOIOCTLCMD)
1028 err = dev_ioctl(net, cmd, argp);
1029
1030 return err;
1031}
1032
1da177e4
LT
1033/*
1034 * With an ioctl, arg may well be a user mode pointer, but we don't know
1035 * what to do with it - that's up to the protocol still.
1036 */
1037
1038static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1039{
1040 struct socket *sock;
881d966b 1041 struct sock *sk;
1da177e4
LT
1042 void __user *argp = (void __user *)arg;
1043 int pid, err;
881d966b 1044 struct net *net;
1da177e4 1045
b69aee04 1046 sock = file->private_data;
881d966b 1047 sk = sock->sk;
3b1e0a65 1048 net = sock_net(sk);
1da177e4 1049 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 1050 err = dev_ioctl(net, cmd, argp);
1da177e4 1051 } else
3d23e349 1052#ifdef CONFIG_WEXT_CORE
1da177e4 1053 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 1054 err = dev_ioctl(net, cmd, argp);
1da177e4 1055 } else
3d23e349 1056#endif
89bddce5 1057 switch (cmd) {
1da177e4
LT
1058 case FIOSETOWN:
1059 case SIOCSPGRP:
1060 err = -EFAULT;
1061 if (get_user(pid, (int __user *)argp))
1062 break;
1063 err = f_setown(sock->file, pid, 1);
1064 break;
1065 case FIOGETOWN:
1066 case SIOCGPGRP:
609d7fa9 1067 err = put_user(f_getown(sock->file),
89bddce5 1068 (int __user *)argp);
1da177e4
LT
1069 break;
1070 case SIOCGIFBR:
1071 case SIOCSIFBR:
1072 case SIOCBRADDBR:
1073 case SIOCBRDELBR:
1074 err = -ENOPKG;
1075 if (!br_ioctl_hook)
1076 request_module("bridge");
1077
4a3e2f71 1078 mutex_lock(&br_ioctl_mutex);
89bddce5 1079 if (br_ioctl_hook)
881d966b 1080 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1081 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1082 break;
1083 case SIOCGIFVLAN:
1084 case SIOCSIFVLAN:
1085 err = -ENOPKG;
1086 if (!vlan_ioctl_hook)
1087 request_module("8021q");
1088
4a3e2f71 1089 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1090 if (vlan_ioctl_hook)
881d966b 1091 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1092 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1093 break;
1da177e4
LT
1094 case SIOCADDDLCI:
1095 case SIOCDELDLCI:
1096 err = -ENOPKG;
1097 if (!dlci_ioctl_hook)
1098 request_module("dlci");
1099
7512cbf6
PE
1100 mutex_lock(&dlci_ioctl_mutex);
1101 if (dlci_ioctl_hook)
1da177e4 1102 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1103 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1104 break;
1105 default:
6b96018b 1106 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1107 break;
89bddce5 1108 }
1da177e4
LT
1109 return err;
1110}
1111
1112int sock_create_lite(int family, int type, int protocol, struct socket **res)
1113{
1114 int err;
1115 struct socket *sock = NULL;
89bddce5 1116
1da177e4
LT
1117 err = security_socket_create(family, type, protocol, 1);
1118 if (err)
1119 goto out;
1120
1121 sock = sock_alloc();
1122 if (!sock) {
1123 err = -ENOMEM;
1124 goto out;
1125 }
1126
1da177e4 1127 sock->type = type;
7420ed23
VY
1128 err = security_socket_post_create(sock, family, type, protocol, 1);
1129 if (err)
1130 goto out_release;
1131
1da177e4
LT
1132out:
1133 *res = sock;
1134 return err;
7420ed23
VY
1135out_release:
1136 sock_release(sock);
1137 sock = NULL;
1138 goto out;
1da177e4 1139}
c6d409cf 1140EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1141
1142/* No kernel lock held - perfect */
89bddce5 1143static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4
LT
1144{
1145 struct socket *sock;
1146
1147 /*
89bddce5 1148 * We can't return errors to poll, so it's either yes or no.
1da177e4 1149 */
b69aee04 1150 sock = file->private_data;
1da177e4
LT
1151 return sock->ops->poll(file, sock, wait);
1152}
1153
89bddce5 1154static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1155{
b69aee04 1156 struct socket *sock = file->private_data;
1da177e4
LT
1157
1158 return sock->ops->mmap(file, sock, vma);
1159}
1160
20380731 1161static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1162{
1da177e4
LT
1163 sock_release(SOCKET_I(inode));
1164 return 0;
1165}
1166
1167/*
1168 * Update the socket async list
1169 *
1170 * Fasync_list locking strategy.
1171 *
1172 * 1. fasync_list is modified only under process context socket lock
1173 * i.e. under semaphore.
1174 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1175 * or under socket lock
1da177e4
LT
1176 */
1177
1178static int sock_fasync(int fd, struct file *filp, int on)
1179{
989a2979
ED
1180 struct socket *sock = filp->private_data;
1181 struct sock *sk = sock->sk;
eaefd110 1182 struct socket_wq *wq;
1da177e4 1183
989a2979 1184 if (sk == NULL)
1da177e4 1185 return -EINVAL;
1da177e4
LT
1186
1187 lock_sock(sk);
eaefd110
ED
1188 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1189 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1190
eaefd110 1191 if (!wq->fasync_list)
989a2979
ED
1192 sock_reset_flag(sk, SOCK_FASYNC);
1193 else
bcdce719 1194 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1195
989a2979 1196 release_sock(sk);
1da177e4
LT
1197 return 0;
1198}
1199
43815482 1200/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1201
1202int sock_wake_async(struct socket *sock, int how, int band)
1203{
43815482
ED
1204 struct socket_wq *wq;
1205
1206 if (!sock)
1207 return -1;
1208 rcu_read_lock();
1209 wq = rcu_dereference(sock->wq);
1210 if (!wq || !wq->fasync_list) {
1211 rcu_read_unlock();
1da177e4 1212 return -1;
43815482 1213 }
89bddce5 1214 switch (how) {
8d8ad9d7 1215 case SOCK_WAKE_WAITD:
1da177e4
LT
1216 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1217 break;
1218 goto call_kill;
8d8ad9d7 1219 case SOCK_WAKE_SPACE:
1da177e4
LT
1220 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1221 break;
1222 /* fall through */
8d8ad9d7 1223 case SOCK_WAKE_IO:
89bddce5 1224call_kill:
43815482 1225 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1226 break;
8d8ad9d7 1227 case SOCK_WAKE_URG:
43815482 1228 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1229 }
43815482 1230 rcu_read_unlock();
1da177e4
LT
1231 return 0;
1232}
c6d409cf 1233EXPORT_SYMBOL(sock_wake_async);
1da177e4 1234
721db93a 1235int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1236 struct socket **res, int kern)
1da177e4
LT
1237{
1238 int err;
1239 struct socket *sock;
55737fda 1240 const struct net_proto_family *pf;
1da177e4
LT
1241
1242 /*
89bddce5 1243 * Check protocol is in range
1da177e4
LT
1244 */
1245 if (family < 0 || family >= NPROTO)
1246 return -EAFNOSUPPORT;
1247 if (type < 0 || type >= SOCK_MAX)
1248 return -EINVAL;
1249
1250 /* Compatibility.
1251
1252 This uglymoron is moved from INET layer to here to avoid
1253 deadlock in module load.
1254 */
1255 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1256 static int warned;
1da177e4
LT
1257 if (!warned) {
1258 warned = 1;
89bddce5
SH
1259 printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1260 current->comm);
1da177e4
LT
1261 }
1262 family = PF_PACKET;
1263 }
1264
1265 err = security_socket_create(family, type, protocol, kern);
1266 if (err)
1267 return err;
89bddce5 1268
55737fda
SH
1269 /*
1270 * Allocate the socket and allow the family to set things up. if
1271 * the protocol is 0, the family is instructed to select an appropriate
1272 * default.
1273 */
1274 sock = sock_alloc();
1275 if (!sock) {
e87cc472 1276 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1277 return -ENFILE; /* Not exactly a match, but its the
1278 closest posix thing */
1279 }
1280
1281 sock->type = type;
1282
95a5afca 1283#ifdef CONFIG_MODULES
89bddce5
SH
1284 /* Attempt to load a protocol module if the find failed.
1285 *
1286 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1287 * requested real, full-featured networking support upon configuration.
1288 * Otherwise module support will break!
1289 */
190683a9 1290 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1291 request_module("net-pf-%d", family);
1da177e4
LT
1292#endif
1293
55737fda
SH
1294 rcu_read_lock();
1295 pf = rcu_dereference(net_families[family]);
1296 err = -EAFNOSUPPORT;
1297 if (!pf)
1298 goto out_release;
1da177e4
LT
1299
1300 /*
1301 * We will call the ->create function, that possibly is in a loadable
1302 * module, so we have to bump that loadable module refcnt first.
1303 */
55737fda 1304 if (!try_module_get(pf->owner))
1da177e4
LT
1305 goto out_release;
1306
55737fda
SH
1307 /* Now protected by module ref count */
1308 rcu_read_unlock();
1309
3f378b68 1310 err = pf->create(net, sock, protocol, kern);
55737fda 1311 if (err < 0)
1da177e4 1312 goto out_module_put;
a79af59e 1313
1da177e4
LT
1314 /*
1315 * Now to bump the refcnt of the [loadable] module that owns this
1316 * socket at sock_release time we decrement its refcnt.
1317 */
55737fda
SH
1318 if (!try_module_get(sock->ops->owner))
1319 goto out_module_busy;
1320
1da177e4
LT
1321 /*
1322 * Now that we're done with the ->create function, the [loadable]
1323 * module can have its refcnt decremented
1324 */
55737fda 1325 module_put(pf->owner);
7420ed23
VY
1326 err = security_socket_post_create(sock, family, type, protocol, kern);
1327 if (err)
3b185525 1328 goto out_sock_release;
55737fda 1329 *res = sock;
1da177e4 1330
55737fda
SH
1331 return 0;
1332
1333out_module_busy:
1334 err = -EAFNOSUPPORT;
1da177e4 1335out_module_put:
55737fda
SH
1336 sock->ops = NULL;
1337 module_put(pf->owner);
1338out_sock_release:
1da177e4 1339 sock_release(sock);
55737fda
SH
1340 return err;
1341
1342out_release:
1343 rcu_read_unlock();
1344 goto out_sock_release;
1da177e4 1345}
721db93a 1346EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1347
1348int sock_create(int family, int type, int protocol, struct socket **res)
1349{
1b8d7ae4 1350 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1351}
c6d409cf 1352EXPORT_SYMBOL(sock_create);
1da177e4
LT
1353
1354int sock_create_kern(int family, int type, int protocol, struct socket **res)
1355{
1b8d7ae4 1356 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1357}
c6d409cf 1358EXPORT_SYMBOL(sock_create_kern);
1da177e4 1359
3e0fa65f 1360SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1361{
1362 int retval;
1363 struct socket *sock;
a677a039
UD
1364 int flags;
1365
e38b36f3
UD
1366 /* Check the SOCK_* constants for consistency. */
1367 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1368 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1369 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1370 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1371
a677a039 1372 flags = type & ~SOCK_TYPE_MASK;
77d27200 1373 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1374 return -EINVAL;
1375 type &= SOCK_TYPE_MASK;
1da177e4 1376
aaca0bdc
UD
1377 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1378 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1379
1da177e4
LT
1380 retval = sock_create(family, type, protocol, &sock);
1381 if (retval < 0)
1382 goto out;
1383
77d27200 1384 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1385 if (retval < 0)
1386 goto out_release;
1387
1388out:
1389 /* It may be already another descriptor 8) Not kernel problem. */
1390 return retval;
1391
1392out_release:
1393 sock_release(sock);
1394 return retval;
1395}
1396
1397/*
1398 * Create a pair of connected sockets.
1399 */
1400
3e0fa65f
HC
1401SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1402 int __user *, usockvec)
1da177e4
LT
1403{
1404 struct socket *sock1, *sock2;
1405 int fd1, fd2, err;
db349509 1406 struct file *newfile1, *newfile2;
a677a039
UD
1407 int flags;
1408
1409 flags = type & ~SOCK_TYPE_MASK;
77d27200 1410 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1411 return -EINVAL;
1412 type &= SOCK_TYPE_MASK;
1da177e4 1413
aaca0bdc
UD
1414 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1415 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1416
1da177e4
LT
1417 /*
1418 * Obtain the first socket and check if the underlying protocol
1419 * supports the socketpair call.
1420 */
1421
1422 err = sock_create(family, type, protocol, &sock1);
1423 if (err < 0)
1424 goto out;
1425
1426 err = sock_create(family, type, protocol, &sock2);
1427 if (err < 0)
1428 goto out_release_1;
1429
1430 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1431 if (err < 0)
1da177e4
LT
1432 goto out_release_both;
1433
28407630 1434 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1435 if (unlikely(fd1 < 0)) {
1436 err = fd1;
db349509 1437 goto out_release_both;
bf3c23d1 1438 }
28407630 1439 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1440 if (unlikely(fd2 < 0)) {
1441 err = fd2;
28407630
AV
1442 put_unused_fd(fd1);
1443 goto out_release_both;
1444 }
1445
aab174f0 1446 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1447 if (unlikely(IS_ERR(newfile1))) {
1448 err = PTR_ERR(newfile1);
1449 put_unused_fd(fd1);
1450 put_unused_fd(fd2);
1451 goto out_release_both;
1452 }
1453
aab174f0 1454 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1455 if (IS_ERR(newfile2)) {
1456 err = PTR_ERR(newfile2);
198de4d7
AV
1457 fput(newfile1);
1458 put_unused_fd(fd1);
28407630 1459 put_unused_fd(fd2);
198de4d7
AV
1460 sock_release(sock2);
1461 goto out;
db349509
AV
1462 }
1463
157cf649 1464 audit_fd_pair(fd1, fd2);
db349509
AV
1465 fd_install(fd1, newfile1);
1466 fd_install(fd2, newfile2);
1da177e4
LT
1467 /* fd1 and fd2 may be already another descriptors.
1468 * Not kernel problem.
1469 */
1470
89bddce5 1471 err = put_user(fd1, &usockvec[0]);
1da177e4
LT
1472 if (!err)
1473 err = put_user(fd2, &usockvec[1]);
1474 if (!err)
1475 return 0;
1476
1477 sys_close(fd2);
1478 sys_close(fd1);
1479 return err;
1480
1da177e4 1481out_release_both:
89bddce5 1482 sock_release(sock2);
1da177e4 1483out_release_1:
89bddce5 1484 sock_release(sock1);
1da177e4
LT
1485out:
1486 return err;
1487}
1488
1da177e4
LT
1489/*
1490 * Bind a name to a socket. Nothing much to do here since it's
1491 * the protocol's responsibility to handle the local address.
1492 *
1493 * We move the socket address to kernel space before we call
1494 * the protocol layer (having also checked the address is ok).
1495 */
1496
20f37034 1497SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1498{
1499 struct socket *sock;
230b1839 1500 struct sockaddr_storage address;
6cb153ca 1501 int err, fput_needed;
1da177e4 1502
89bddce5 1503 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1504 if (sock) {
43db362d 1505 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1506 if (err >= 0) {
1507 err = security_socket_bind(sock,
230b1839 1508 (struct sockaddr *)&address,
89bddce5 1509 addrlen);
6cb153ca
BL
1510 if (!err)
1511 err = sock->ops->bind(sock,
89bddce5 1512 (struct sockaddr *)
230b1839 1513 &address, addrlen);
1da177e4 1514 }
6cb153ca 1515 fput_light(sock->file, fput_needed);
89bddce5 1516 }
1da177e4
LT
1517 return err;
1518}
1519
1da177e4
LT
1520/*
1521 * Perform a listen. Basically, we allow the protocol to do anything
1522 * necessary for a listen, and if that works, we mark the socket as
1523 * ready for listening.
1524 */
1525
3e0fa65f 1526SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1527{
1528 struct socket *sock;
6cb153ca 1529 int err, fput_needed;
b8e1f9b5 1530 int somaxconn;
89bddce5
SH
1531
1532 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1533 if (sock) {
8efa6e93 1534 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1535 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1536 backlog = somaxconn;
1da177e4
LT
1537
1538 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1539 if (!err)
1540 err = sock->ops->listen(sock, backlog);
1da177e4 1541
6cb153ca 1542 fput_light(sock->file, fput_needed);
1da177e4
LT
1543 }
1544 return err;
1545}
1546
1da177e4
LT
1547/*
1548 * For accept, we attempt to create a new socket, set up the link
1549 * with the client, wake up the client, then return the new
1550 * connected fd. We collect the address of the connector in kernel
1551 * space and move it to user at the very end. This is unclean because
1552 * we open the socket then return an error.
1553 *
1554 * 1003.1g adds the ability to recvmsg() to query connection pending
1555 * status to recvmsg. We need to add that support in a way thats
1556 * clean when we restucture accept also.
1557 */
1558
20f37034
HC
1559SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1560 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1561{
1562 struct socket *sock, *newsock;
39d8c1b6 1563 struct file *newfile;
6cb153ca 1564 int err, len, newfd, fput_needed;
230b1839 1565 struct sockaddr_storage address;
1da177e4 1566
77d27200 1567 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1568 return -EINVAL;
1569
1570 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1571 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1572
6cb153ca 1573 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1574 if (!sock)
1575 goto out;
1576
1577 err = -ENFILE;
c6d409cf
ED
1578 newsock = sock_alloc();
1579 if (!newsock)
1da177e4
LT
1580 goto out_put;
1581
1582 newsock->type = sock->type;
1583 newsock->ops = sock->ops;
1584
1da177e4
LT
1585 /*
1586 * We don't need try_module_get here, as the listening socket (sock)
1587 * has the protocol module (sock->ops->owner) held.
1588 */
1589 __module_get(newsock->ops->owner);
1590
28407630 1591 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1592 if (unlikely(newfd < 0)) {
1593 err = newfd;
9a1875e6
DM
1594 sock_release(newsock);
1595 goto out_put;
39d8c1b6 1596 }
aab174f0 1597 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1598 if (unlikely(IS_ERR(newfile))) {
1599 err = PTR_ERR(newfile);
1600 put_unused_fd(newfd);
1601 sock_release(newsock);
1602 goto out_put;
1603 }
39d8c1b6 1604
a79af59e
FF
1605 err = security_socket_accept(sock, newsock);
1606 if (err)
39d8c1b6 1607 goto out_fd;
a79af59e 1608
1da177e4
LT
1609 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1610 if (err < 0)
39d8c1b6 1611 goto out_fd;
1da177e4
LT
1612
1613 if (upeer_sockaddr) {
230b1839 1614 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1615 &len, 2) < 0) {
1da177e4 1616 err = -ECONNABORTED;
39d8c1b6 1617 goto out_fd;
1da177e4 1618 }
43db362d 1619 err = move_addr_to_user(&address,
230b1839 1620 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1621 if (err < 0)
39d8c1b6 1622 goto out_fd;
1da177e4
LT
1623 }
1624
1625 /* File flags are not inherited via accept() unlike another OSes. */
1626
39d8c1b6
DM
1627 fd_install(newfd, newfile);
1628 err = newfd;
1da177e4 1629
1da177e4 1630out_put:
6cb153ca 1631 fput_light(sock->file, fput_needed);
1da177e4
LT
1632out:
1633 return err;
39d8c1b6 1634out_fd:
9606a216 1635 fput(newfile);
39d8c1b6 1636 put_unused_fd(newfd);
1da177e4
LT
1637 goto out_put;
1638}
1639
20f37034
HC
1640SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1641 int __user *, upeer_addrlen)
aaca0bdc 1642{
de11defe 1643 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1644}
1645
1da177e4
LT
1646/*
1647 * Attempt to connect to a socket with the server address. The address
1648 * is in user space so we verify it is OK and move it to kernel space.
1649 *
1650 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1651 * break bindings
1652 *
1653 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1654 * other SEQPACKET protocols that take time to connect() as it doesn't
1655 * include the -EINPROGRESS status for such sockets.
1656 */
1657
20f37034
HC
1658SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1659 int, addrlen)
1da177e4
LT
1660{
1661 struct socket *sock;
230b1839 1662 struct sockaddr_storage address;
6cb153ca 1663 int err, fput_needed;
1da177e4 1664
6cb153ca 1665 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1666 if (!sock)
1667 goto out;
43db362d 1668 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1669 if (err < 0)
1670 goto out_put;
1671
89bddce5 1672 err =
230b1839 1673 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1674 if (err)
1675 goto out_put;
1676
230b1839 1677 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1678 sock->file->f_flags);
1679out_put:
6cb153ca 1680 fput_light(sock->file, fput_needed);
1da177e4
LT
1681out:
1682 return err;
1683}
1684
1685/*
1686 * Get the local address ('name') of a socket object. Move the obtained
1687 * name to user space.
1688 */
1689
20f37034
HC
1690SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1691 int __user *, usockaddr_len)
1da177e4
LT
1692{
1693 struct socket *sock;
230b1839 1694 struct sockaddr_storage address;
6cb153ca 1695 int len, err, fput_needed;
89bddce5 1696
6cb153ca 1697 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1698 if (!sock)
1699 goto out;
1700
1701 err = security_socket_getsockname(sock);
1702 if (err)
1703 goto out_put;
1704
230b1839 1705 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1706 if (err)
1707 goto out_put;
43db362d 1708 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1709
1710out_put:
6cb153ca 1711 fput_light(sock->file, fput_needed);
1da177e4
LT
1712out:
1713 return err;
1714}
1715
1716/*
1717 * Get the remote address ('name') of a socket object. Move the obtained
1718 * name to user space.
1719 */
1720
20f37034
HC
1721SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1722 int __user *, usockaddr_len)
1da177e4
LT
1723{
1724 struct socket *sock;
230b1839 1725 struct sockaddr_storage address;
6cb153ca 1726 int len, err, fput_needed;
1da177e4 1727
89bddce5
SH
1728 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1729 if (sock != NULL) {
1da177e4
LT
1730 err = security_socket_getpeername(sock);
1731 if (err) {
6cb153ca 1732 fput_light(sock->file, fput_needed);
1da177e4
LT
1733 return err;
1734 }
1735
89bddce5 1736 err =
230b1839 1737 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1738 1);
1da177e4 1739 if (!err)
43db362d 1740 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1741 usockaddr_len);
6cb153ca 1742 fput_light(sock->file, fput_needed);
1da177e4
LT
1743 }
1744 return err;
1745}
1746
1747/*
1748 * Send a datagram to a given address. We move the address into kernel
1749 * space and check the user space data area is readable before invoking
1750 * the protocol.
1751 */
1752
3e0fa65f 1753SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1754 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1755 int, addr_len)
1da177e4
LT
1756{
1757 struct socket *sock;
230b1839 1758 struct sockaddr_storage address;
1da177e4
LT
1759 int err;
1760 struct msghdr msg;
1761 struct iovec iov;
6cb153ca 1762 int fput_needed;
6cb153ca 1763
253eacc0
LT
1764 if (len > INT_MAX)
1765 len = INT_MAX;
de0fa95c
PE
1766 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1767 if (!sock)
4387ff75 1768 goto out;
6cb153ca 1769
89bddce5
SH
1770 iov.iov_base = buff;
1771 iov.iov_len = len;
1772 msg.msg_name = NULL;
1773 msg.msg_iov = &iov;
1774 msg.msg_iovlen = 1;
1775 msg.msg_control = NULL;
1776 msg.msg_controllen = 0;
1777 msg.msg_namelen = 0;
6cb153ca 1778 if (addr) {
43db362d 1779 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1780 if (err < 0)
1781 goto out_put;
230b1839 1782 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1783 msg.msg_namelen = addr_len;
1da177e4
LT
1784 }
1785 if (sock->file->f_flags & O_NONBLOCK)
1786 flags |= MSG_DONTWAIT;
1787 msg.msg_flags = flags;
1788 err = sock_sendmsg(sock, &msg, len);
1789
89bddce5 1790out_put:
de0fa95c 1791 fput_light(sock->file, fput_needed);
4387ff75 1792out:
1da177e4
LT
1793 return err;
1794}
1795
1796/*
89bddce5 1797 * Send a datagram down a socket.
1da177e4
LT
1798 */
1799
3e0fa65f 1800SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1801 unsigned int, flags)
1da177e4
LT
1802{
1803 return sys_sendto(fd, buff, len, flags, NULL, 0);
1804}
1805
1806/*
89bddce5 1807 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1808 * sender. We verify the buffers are writable and if needed move the
1809 * sender address from kernel to user space.
1810 */
1811
3e0fa65f 1812SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1813 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1814 int __user *, addr_len)
1da177e4
LT
1815{
1816 struct socket *sock;
1817 struct iovec iov;
1818 struct msghdr msg;
230b1839 1819 struct sockaddr_storage address;
89bddce5 1820 int err, err2;
6cb153ca
BL
1821 int fput_needed;
1822
253eacc0
LT
1823 if (size > INT_MAX)
1824 size = INT_MAX;
de0fa95c 1825 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1826 if (!sock)
de0fa95c 1827 goto out;
1da177e4 1828
89bddce5
SH
1829 msg.msg_control = NULL;
1830 msg.msg_controllen = 0;
1831 msg.msg_iovlen = 1;
1832 msg.msg_iov = &iov;
1833 iov.iov_len = size;
1834 iov.iov_base = ubuf;
230b1839
YH
1835 msg.msg_name = (struct sockaddr *)&address;
1836 msg.msg_namelen = sizeof(address);
1da177e4
LT
1837 if (sock->file->f_flags & O_NONBLOCK)
1838 flags |= MSG_DONTWAIT;
89bddce5 1839 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1840
89bddce5 1841 if (err >= 0 && addr != NULL) {
43db362d 1842 err2 = move_addr_to_user(&address,
230b1839 1843 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1844 if (err2 < 0)
1845 err = err2;
1da177e4 1846 }
de0fa95c
PE
1847
1848 fput_light(sock->file, fput_needed);
4387ff75 1849out:
1da177e4
LT
1850 return err;
1851}
1852
1853/*
89bddce5 1854 * Receive a datagram from a socket.
1da177e4
LT
1855 */
1856
89bddce5 1857asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
95c96174 1858 unsigned int flags)
1da177e4
LT
1859{
1860 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1861}
1862
1863/*
1864 * Set a socket option. Because we don't know the option lengths we have
1865 * to pass the user mode parameter for the protocols to sort out.
1866 */
1867
20f37034
HC
1868SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1869 char __user *, optval, int, optlen)
1da177e4 1870{
6cb153ca 1871 int err, fput_needed;
1da177e4
LT
1872 struct socket *sock;
1873
1874 if (optlen < 0)
1875 return -EINVAL;
89bddce5
SH
1876
1877 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1878 if (sock != NULL) {
1879 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1880 if (err)
1881 goto out_put;
1da177e4
LT
1882
1883 if (level == SOL_SOCKET)
89bddce5
SH
1884 err =
1885 sock_setsockopt(sock, level, optname, optval,
1886 optlen);
1da177e4 1887 else
89bddce5
SH
1888 err =
1889 sock->ops->setsockopt(sock, level, optname, optval,
1890 optlen);
6cb153ca
BL
1891out_put:
1892 fput_light(sock->file, fput_needed);
1da177e4
LT
1893 }
1894 return err;
1895}
1896
1897/*
1898 * Get a socket option. Because we don't know the option lengths we have
1899 * to pass a user mode parameter for the protocols to sort out.
1900 */
1901
20f37034
HC
1902SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1903 char __user *, optval, int __user *, optlen)
1da177e4 1904{
6cb153ca 1905 int err, fput_needed;
1da177e4
LT
1906 struct socket *sock;
1907
89bddce5
SH
1908 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1909 if (sock != NULL) {
6cb153ca
BL
1910 err = security_socket_getsockopt(sock, level, optname);
1911 if (err)
1912 goto out_put;
1da177e4
LT
1913
1914 if (level == SOL_SOCKET)
89bddce5
SH
1915 err =
1916 sock_getsockopt(sock, level, optname, optval,
1917 optlen);
1da177e4 1918 else
89bddce5
SH
1919 err =
1920 sock->ops->getsockopt(sock, level, optname, optval,
1921 optlen);
6cb153ca
BL
1922out_put:
1923 fput_light(sock->file, fput_needed);
1da177e4
LT
1924 }
1925 return err;
1926}
1927
1da177e4
LT
1928/*
1929 * Shutdown a socket.
1930 */
1931
754fe8d2 1932SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1933{
6cb153ca 1934 int err, fput_needed;
1da177e4
LT
1935 struct socket *sock;
1936
89bddce5
SH
1937 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1938 if (sock != NULL) {
1da177e4 1939 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1940 if (!err)
1941 err = sock->ops->shutdown(sock, how);
1942 fput_light(sock->file, fput_needed);
1da177e4
LT
1943 }
1944 return err;
1945}
1946
89bddce5 1947/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1948 * fields which are the same type (int / unsigned) on our platforms.
1949 */
1950#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1951#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1952#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1953
c71d8ebe
TH
1954struct used_address {
1955 struct sockaddr_storage name;
1956 unsigned int name_len;
1957};
1958
228e548e 1959static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 1960 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1961 struct used_address *used_address)
1da177e4 1962{
89bddce5
SH
1963 struct compat_msghdr __user *msg_compat =
1964 (struct compat_msghdr __user *)msg;
230b1839 1965 struct sockaddr_storage address;
1da177e4 1966 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1967 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1968 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1969 /* 20 is size of ipv6_pktinfo */
1da177e4 1970 unsigned char *ctl_buf = ctl;
a74e9106 1971 int err, ctl_len, total_len;
89bddce5 1972
1da177e4
LT
1973 err = -EFAULT;
1974 if (MSG_CMSG_COMPAT & flags) {
228e548e 1975 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 1976 return -EFAULT;
228e548e 1977 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
1da177e4
LT
1978 return -EFAULT;
1979
228e548e 1980 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
1981 err = -EMSGSIZE;
1982 if (msg_sys->msg_iovlen > UIO_MAXIOV)
1983 goto out;
1984 err = -ENOMEM;
1985 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
1986 GFP_KERNEL);
1da177e4 1987 if (!iov)
228e548e 1988 goto out;
1da177e4
LT
1989 }
1990
1991 /* This will also move the address data into kernel space */
1992 if (MSG_CMSG_COMPAT & flags) {
43db362d 1993 err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
1da177e4 1994 } else
43db362d 1995 err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
89bddce5 1996 if (err < 0)
1da177e4
LT
1997 goto out_freeiov;
1998 total_len = err;
1999
2000 err = -ENOBUFS;
2001
228e548e 2002 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 2003 goto out_freeiov;
228e548e 2004 ctl_len = msg_sys->msg_controllen;
1da177e4 2005 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2006 err =
228e548e 2007 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2008 sizeof(ctl));
1da177e4
LT
2009 if (err)
2010 goto out_freeiov;
228e548e
AB
2011 ctl_buf = msg_sys->msg_control;
2012 ctl_len = msg_sys->msg_controllen;
1da177e4 2013 } else if (ctl_len) {
89bddce5 2014 if (ctl_len > sizeof(ctl)) {
1da177e4 2015 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2016 if (ctl_buf == NULL)
1da177e4
LT
2017 goto out_freeiov;
2018 }
2019 err = -EFAULT;
2020 /*
228e548e 2021 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2022 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2023 * checking falls down on this.
2024 */
fb8621bb 2025 if (copy_from_user(ctl_buf,
228e548e 2026 (void __user __force *)msg_sys->msg_control,
89bddce5 2027 ctl_len))
1da177e4 2028 goto out_freectl;
228e548e 2029 msg_sys->msg_control = ctl_buf;
1da177e4 2030 }
228e548e 2031 msg_sys->msg_flags = flags;
1da177e4
LT
2032
2033 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2034 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2035 /*
2036 * If this is sendmmsg() and current destination address is same as
2037 * previously succeeded address, omit asking LSM's decision.
2038 * used_address->name_len is initialized to UINT_MAX so that the first
2039 * destination address never matches.
2040 */
bc909d9d
MD
2041 if (used_address && msg_sys->msg_name &&
2042 used_address->name_len == msg_sys->msg_namelen &&
2043 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2044 used_address->name_len)) {
2045 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2046 goto out_freectl;
2047 }
2048 err = sock_sendmsg(sock, msg_sys, total_len);
2049 /*
2050 * If this is sendmmsg() and sending to current destination address was
2051 * successful, remember it.
2052 */
2053 if (used_address && err >= 0) {
2054 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2055 if (msg_sys->msg_name)
2056 memcpy(&used_address->name, msg_sys->msg_name,
2057 used_address->name_len);
c71d8ebe 2058 }
1da177e4
LT
2059
2060out_freectl:
89bddce5 2061 if (ctl_buf != ctl)
1da177e4
LT
2062 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2063out_freeiov:
2064 if (iov != iovstack)
a74e9106 2065 kfree(iov);
228e548e
AB
2066out:
2067 return err;
2068}
2069
2070/*
2071 * BSD sendmsg interface
2072 */
2073
95c96174 2074SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
228e548e
AB
2075{
2076 int fput_needed, err;
2077 struct msghdr msg_sys;
1be374a0
AL
2078 struct socket *sock;
2079
2080 if (flags & MSG_CMSG_COMPAT)
2081 return -EINVAL;
228e548e 2082
1be374a0 2083 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2084 if (!sock)
2085 goto out;
2086
c71d8ebe 2087 err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2088
6cb153ca 2089 fput_light(sock->file, fput_needed);
89bddce5 2090out:
1da177e4
LT
2091 return err;
2092}
2093
228e548e
AB
2094/*
2095 * Linux sendmmsg interface
2096 */
2097
2098int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2099 unsigned int flags)
2100{
2101 int fput_needed, err, datagrams;
2102 struct socket *sock;
2103 struct mmsghdr __user *entry;
2104 struct compat_mmsghdr __user *compat_entry;
2105 struct msghdr msg_sys;
c71d8ebe 2106 struct used_address used_address;
228e548e 2107
98382f41
AB
2108 if (vlen > UIO_MAXIOV)
2109 vlen = UIO_MAXIOV;
228e548e
AB
2110
2111 datagrams = 0;
2112
2113 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2114 if (!sock)
2115 return err;
2116
c71d8ebe 2117 used_address.name_len = UINT_MAX;
228e548e
AB
2118 entry = mmsg;
2119 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2120 err = 0;
228e548e
AB
2121
2122 while (datagrams < vlen) {
228e548e
AB
2123 if (MSG_CMSG_COMPAT & flags) {
2124 err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
c71d8ebe 2125 &msg_sys, flags, &used_address);
228e548e
AB
2126 if (err < 0)
2127 break;
2128 err = __put_user(err, &compat_entry->msg_len);
2129 ++compat_entry;
2130 } else {
2131 err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
c71d8ebe 2132 &msg_sys, flags, &used_address);
228e548e
AB
2133 if (err < 0)
2134 break;
2135 err = put_user(err, &entry->msg_len);
2136 ++entry;
2137 }
2138
2139 if (err)
2140 break;
2141 ++datagrams;
2142 }
2143
228e548e
AB
2144 fput_light(sock->file, fput_needed);
2145
728ffb86
AB
2146 /* We only return an error if no datagrams were able to be sent */
2147 if (datagrams != 0)
228e548e
AB
2148 return datagrams;
2149
228e548e
AB
2150 return err;
2151}
2152
2153SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2154 unsigned int, vlen, unsigned int, flags)
2155{
1be374a0
AL
2156 if (flags & MSG_CMSG_COMPAT)
2157 return -EINVAL;
228e548e
AB
2158 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2159}
2160
a2e27255 2161static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 2162 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2163{
89bddce5
SH
2164 struct compat_msghdr __user *msg_compat =
2165 (struct compat_msghdr __user *)msg;
1da177e4 2166 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2167 struct iovec *iov = iovstack;
1da177e4 2168 unsigned long cmsg_ptr;
a74e9106 2169 int err, total_len, len;
1da177e4
LT
2170
2171 /* kernel mode address */
230b1839 2172 struct sockaddr_storage addr;
1da177e4
LT
2173
2174 /* user mode address pointers */
2175 struct sockaddr __user *uaddr;
2176 int __user *uaddr_len;
89bddce5 2177
1da177e4 2178 if (MSG_CMSG_COMPAT & flags) {
a2e27255 2179 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2180 return -EFAULT;
c6d409cf 2181 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
89bddce5 2182 return -EFAULT;
1da177e4 2183
a2e27255 2184 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
2185 err = -EMSGSIZE;
2186 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2187 goto out;
2188 err = -ENOMEM;
2189 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2190 GFP_KERNEL);
1da177e4 2191 if (!iov)
a2e27255 2192 goto out;
1da177e4
LT
2193 }
2194
2195 /*
89bddce5
SH
2196 * Save the user-mode address (verify_iovec will change the
2197 * kernel msghdr to use the kernel address space)
1da177e4 2198 */
89bddce5 2199
a2e27255 2200 uaddr = (__force void __user *)msg_sys->msg_name;
1da177e4
LT
2201 uaddr_len = COMPAT_NAMELEN(msg);
2202 if (MSG_CMSG_COMPAT & flags) {
43db362d 2203 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4 2204 } else
43db362d 2205 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4
LT
2206 if (err < 0)
2207 goto out_freeiov;
89bddce5 2208 total_len = err;
1da177e4 2209
a2e27255
ACM
2210 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2211 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2212
1da177e4
LT
2213 if (sock->file->f_flags & O_NONBLOCK)
2214 flags |= MSG_DONTWAIT;
a2e27255
ACM
2215 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2216 total_len, flags);
1da177e4
LT
2217 if (err < 0)
2218 goto out_freeiov;
2219 len = err;
2220
2221 if (uaddr != NULL) {
43db362d 2222 err = move_addr_to_user(&addr,
a2e27255 2223 msg_sys->msg_namelen, uaddr,
89bddce5 2224 uaddr_len);
1da177e4
LT
2225 if (err < 0)
2226 goto out_freeiov;
2227 }
a2e27255 2228 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2229 COMPAT_FLAGS(msg));
1da177e4
LT
2230 if (err)
2231 goto out_freeiov;
2232 if (MSG_CMSG_COMPAT & flags)
a2e27255 2233 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2234 &msg_compat->msg_controllen);
2235 else
a2e27255 2236 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2237 &msg->msg_controllen);
2238 if (err)
2239 goto out_freeiov;
2240 err = len;
2241
2242out_freeiov:
2243 if (iov != iovstack)
a74e9106 2244 kfree(iov);
a2e27255
ACM
2245out:
2246 return err;
2247}
2248
2249/*
2250 * BSD recvmsg interface
2251 */
2252
2253SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2254 unsigned int, flags)
2255{
2256 int fput_needed, err;
2257 struct msghdr msg_sys;
1be374a0
AL
2258 struct socket *sock;
2259
2260 if (flags & MSG_CMSG_COMPAT)
2261 return -EINVAL;
a2e27255 2262
1be374a0 2263 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2264 if (!sock)
2265 goto out;
2266
2267 err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2268
6cb153ca 2269 fput_light(sock->file, fput_needed);
1da177e4
LT
2270out:
2271 return err;
2272}
2273
a2e27255
ACM
2274/*
2275 * Linux recvmmsg interface
2276 */
2277
2278int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2279 unsigned int flags, struct timespec *timeout)
2280{
2281 int fput_needed, err, datagrams;
2282 struct socket *sock;
2283 struct mmsghdr __user *entry;
d7256d0e 2284 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2285 struct msghdr msg_sys;
2286 struct timespec end_time;
2287
2288 if (timeout &&
2289 poll_select_set_timeout(&end_time, timeout->tv_sec,
2290 timeout->tv_nsec))
2291 return -EINVAL;
2292
2293 datagrams = 0;
2294
2295 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2296 if (!sock)
2297 return err;
2298
2299 err = sock_error(sock->sk);
2300 if (err)
2301 goto out_put;
2302
2303 entry = mmsg;
d7256d0e 2304 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2305
2306 while (datagrams < vlen) {
2307 /*
2308 * No need to ask LSM for more than the first datagram.
2309 */
d7256d0e
JMG
2310 if (MSG_CMSG_COMPAT & flags) {
2311 err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
b9eb8b87
AB
2312 &msg_sys, flags & ~MSG_WAITFORONE,
2313 datagrams);
d7256d0e
JMG
2314 if (err < 0)
2315 break;
2316 err = __put_user(err, &compat_entry->msg_len);
2317 ++compat_entry;
2318 } else {
2319 err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
b9eb8b87
AB
2320 &msg_sys, flags & ~MSG_WAITFORONE,
2321 datagrams);
d7256d0e
JMG
2322 if (err < 0)
2323 break;
2324 err = put_user(err, &entry->msg_len);
2325 ++entry;
2326 }
2327
a2e27255
ACM
2328 if (err)
2329 break;
a2e27255
ACM
2330 ++datagrams;
2331
71c5c159
BB
2332 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2333 if (flags & MSG_WAITFORONE)
2334 flags |= MSG_DONTWAIT;
2335
a2e27255
ACM
2336 if (timeout) {
2337 ktime_get_ts(timeout);
2338 *timeout = timespec_sub(end_time, *timeout);
2339 if (timeout->tv_sec < 0) {
2340 timeout->tv_sec = timeout->tv_nsec = 0;
2341 break;
2342 }
2343
2344 /* Timeout, return less than vlen datagrams */
2345 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2346 break;
2347 }
2348
2349 /* Out of band data, return right away */
2350 if (msg_sys.msg_flags & MSG_OOB)
2351 break;
2352 }
2353
2354out_put:
2355 fput_light(sock->file, fput_needed);
1da177e4 2356
a2e27255
ACM
2357 if (err == 0)
2358 return datagrams;
2359
2360 if (datagrams != 0) {
2361 /*
2362 * We may return less entries than requested (vlen) if the
2363 * sock is non block and there aren't enough datagrams...
2364 */
2365 if (err != -EAGAIN) {
2366 /*
2367 * ... or if recvmsg returns an error after we
2368 * received some datagrams, where we record the
2369 * error to return on the next call or if the
2370 * app asks about it using getsockopt(SO_ERROR).
2371 */
2372 sock->sk->sk_err = -err;
2373 }
2374
2375 return datagrams;
2376 }
2377
2378 return err;
2379}
2380
2381SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2382 unsigned int, vlen, unsigned int, flags,
2383 struct timespec __user *, timeout)
2384{
2385 int datagrams;
2386 struct timespec timeout_sys;
2387
1be374a0
AL
2388 if (flags & MSG_CMSG_COMPAT)
2389 return -EINVAL;
2390
a2e27255
ACM
2391 if (!timeout)
2392 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2393
2394 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2395 return -EFAULT;
2396
2397 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2398
2399 if (datagrams > 0 &&
2400 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2401 datagrams = -EFAULT;
2402
2403 return datagrams;
2404}
2405
2406#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2407/* Argument list sizes for sys_socketcall */
2408#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2409static const unsigned char nargs[21] = {
c6d409cf
ED
2410 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2411 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2412 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2413 AL(4), AL(5), AL(4)
89bddce5
SH
2414};
2415
1da177e4
LT
2416#undef AL
2417
2418/*
89bddce5 2419 * System call vectors.
1da177e4
LT
2420 *
2421 * Argument checking cleaned up. Saved 20% in size.
2422 * This function doesn't need to set the kernel lock because
89bddce5 2423 * it is set by the callees.
1da177e4
LT
2424 */
2425
3e0fa65f 2426SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2427{
2950fa9d 2428 unsigned long a[AUDITSC_ARGS];
89bddce5 2429 unsigned long a0, a1;
1da177e4 2430 int err;
47379052 2431 unsigned int len;
1da177e4 2432
228e548e 2433 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2434 return -EINVAL;
2435
47379052
AV
2436 len = nargs[call];
2437 if (len > sizeof(a))
2438 return -EINVAL;
2439
1da177e4 2440 /* copy_from_user should be SMP safe. */
47379052 2441 if (copy_from_user(a, args, len))
1da177e4 2442 return -EFAULT;
3ec3b2fb 2443
2950fa9d
CG
2444 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2445 if (err)
2446 return err;
3ec3b2fb 2447
89bddce5
SH
2448 a0 = a[0];
2449 a1 = a[1];
2450
2451 switch (call) {
2452 case SYS_SOCKET:
2453 err = sys_socket(a0, a1, a[2]);
2454 break;
2455 case SYS_BIND:
2456 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2457 break;
2458 case SYS_CONNECT:
2459 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2460 break;
2461 case SYS_LISTEN:
2462 err = sys_listen(a0, a1);
2463 break;
2464 case SYS_ACCEPT:
de11defe
UD
2465 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2466 (int __user *)a[2], 0);
89bddce5
SH
2467 break;
2468 case SYS_GETSOCKNAME:
2469 err =
2470 sys_getsockname(a0, (struct sockaddr __user *)a1,
2471 (int __user *)a[2]);
2472 break;
2473 case SYS_GETPEERNAME:
2474 err =
2475 sys_getpeername(a0, (struct sockaddr __user *)a1,
2476 (int __user *)a[2]);
2477 break;
2478 case SYS_SOCKETPAIR:
2479 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2480 break;
2481 case SYS_SEND:
2482 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2483 break;
2484 case SYS_SENDTO:
2485 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2486 (struct sockaddr __user *)a[4], a[5]);
2487 break;
2488 case SYS_RECV:
2489 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2490 break;
2491 case SYS_RECVFROM:
2492 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2493 (struct sockaddr __user *)a[4],
2494 (int __user *)a[5]);
2495 break;
2496 case SYS_SHUTDOWN:
2497 err = sys_shutdown(a0, a1);
2498 break;
2499 case SYS_SETSOCKOPT:
2500 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2501 break;
2502 case SYS_GETSOCKOPT:
2503 err =
2504 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2505 (int __user *)a[4]);
2506 break;
2507 case SYS_SENDMSG:
1be374a0
AL
2508 if (a[2] & MSG_CMSG_COMPAT) {
2509 err = -EINVAL;
2510 break;
2511 }
89bddce5
SH
2512 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2513 break;
228e548e 2514 case SYS_SENDMMSG:
1be374a0
AL
2515 if (a[3] & MSG_CMSG_COMPAT) {
2516 err = -EINVAL;
2517 break;
2518 }
228e548e
AB
2519 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2520 break;
89bddce5 2521 case SYS_RECVMSG:
1be374a0
AL
2522 if (a[2] & MSG_CMSG_COMPAT) {
2523 err = -EINVAL;
2524 break;
2525 }
89bddce5
SH
2526 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2527 break;
a2e27255 2528 case SYS_RECVMMSG:
1be374a0
AL
2529 if (a[3] & MSG_CMSG_COMPAT) {
2530 err = -EINVAL;
2531 break;
2532 }
a2e27255
ACM
2533 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2534 (struct timespec __user *)a[4]);
2535 break;
de11defe
UD
2536 case SYS_ACCEPT4:
2537 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2538 (int __user *)a[2], a[3]);
aaca0bdc 2539 break;
89bddce5
SH
2540 default:
2541 err = -EINVAL;
2542 break;
1da177e4
LT
2543 }
2544 return err;
2545}
2546
89bddce5 2547#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2548
55737fda
SH
2549/**
2550 * sock_register - add a socket protocol handler
2551 * @ops: description of protocol
2552 *
1da177e4
LT
2553 * This function is called by a protocol handler that wants to
2554 * advertise its address family, and have it linked into the
55737fda
SH
2555 * socket interface. The value ops->family coresponds to the
2556 * socket system call protocol family.
1da177e4 2557 */
f0fd27d4 2558int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2559{
2560 int err;
2561
2562 if (ops->family >= NPROTO) {
89bddce5
SH
2563 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2564 NPROTO);
1da177e4
LT
2565 return -ENOBUFS;
2566 }
55737fda
SH
2567
2568 spin_lock(&net_family_lock);
190683a9
ED
2569 if (rcu_dereference_protected(net_families[ops->family],
2570 lockdep_is_held(&net_family_lock)))
55737fda
SH
2571 err = -EEXIST;
2572 else {
cf778b00 2573 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2574 err = 0;
2575 }
55737fda
SH
2576 spin_unlock(&net_family_lock);
2577
89bddce5 2578 printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2579 return err;
2580}
c6d409cf 2581EXPORT_SYMBOL(sock_register);
1da177e4 2582
55737fda
SH
2583/**
2584 * sock_unregister - remove a protocol handler
2585 * @family: protocol family to remove
2586 *
1da177e4
LT
2587 * This function is called by a protocol handler that wants to
2588 * remove its address family, and have it unlinked from the
55737fda
SH
2589 * new socket creation.
2590 *
2591 * If protocol handler is a module, then it can use module reference
2592 * counts to protect against new references. If protocol handler is not
2593 * a module then it needs to provide its own protection in
2594 * the ops->create routine.
1da177e4 2595 */
f0fd27d4 2596void sock_unregister(int family)
1da177e4 2597{
f0fd27d4 2598 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2599
55737fda 2600 spin_lock(&net_family_lock);
a9b3cd7f 2601 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2602 spin_unlock(&net_family_lock);
2603
2604 synchronize_rcu();
2605
89bddce5 2606 printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
1da177e4 2607}
c6d409cf 2608EXPORT_SYMBOL(sock_unregister);
1da177e4 2609
77d76ea3 2610static int __init sock_init(void)
1da177e4 2611{
b3e19d92 2612 int err;
2ca794e5
EB
2613 /*
2614 * Initialize the network sysctl infrastructure.
2615 */
2616 err = net_sysctl_init();
2617 if (err)
2618 goto out;
b3e19d92 2619
1da177e4 2620 /*
89bddce5 2621 * Initialize skbuff SLAB cache
1da177e4
LT
2622 */
2623 skb_init();
1da177e4
LT
2624
2625 /*
89bddce5 2626 * Initialize the protocols module.
1da177e4
LT
2627 */
2628
2629 init_inodecache();
b3e19d92
NP
2630
2631 err = register_filesystem(&sock_fs_type);
2632 if (err)
2633 goto out_fs;
1da177e4 2634 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2635 if (IS_ERR(sock_mnt)) {
2636 err = PTR_ERR(sock_mnt);
2637 goto out_mount;
2638 }
77d76ea3
AK
2639
2640 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2641 */
2642
2643#ifdef CONFIG_NETFILTER
2644 netfilter_init();
2645#endif
cbeb321a 2646
c1f19b51
RC
2647#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2648 skb_timestamping_init();
2649#endif
2650
b3e19d92
NP
2651out:
2652 return err;
2653
2654out_mount:
2655 unregister_filesystem(&sock_fs_type);
2656out_fs:
2657 goto out;
1da177e4
LT
2658}
2659
77d76ea3
AK
2660core_initcall(sock_init); /* early initcall */
2661
1da177e4
LT
2662#ifdef CONFIG_PROC_FS
2663void socket_seq_show(struct seq_file *seq)
2664{
2665 int cpu;
2666 int counter = 0;
2667
6f912042 2668 for_each_possible_cpu(cpu)
89bddce5 2669 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2670
2671 /* It can be negative, by the way. 8) */
2672 if (counter < 0)
2673 counter = 0;
2674
2675 seq_printf(seq, "sockets: used %d\n", counter);
2676}
89bddce5 2677#endif /* CONFIG_PROC_FS */
1da177e4 2678
89bbfc95 2679#ifdef CONFIG_COMPAT
6b96018b 2680static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2681 unsigned int cmd, void __user *up)
7a229387 2682{
7a229387
AB
2683 mm_segment_t old_fs = get_fs();
2684 struct timeval ktv;
2685 int err;
2686
2687 set_fs(KERNEL_DS);
6b96018b 2688 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2689 set_fs(old_fs);
644595f8 2690 if (!err)
ed6fe9d6 2691 err = compat_put_timeval(&ktv, up);
644595f8 2692
7a229387
AB
2693 return err;
2694}
2695
6b96018b 2696static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2697 unsigned int cmd, void __user *up)
7a229387 2698{
7a229387
AB
2699 mm_segment_t old_fs = get_fs();
2700 struct timespec kts;
2701 int err;
2702
2703 set_fs(KERNEL_DS);
6b96018b 2704 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2705 set_fs(old_fs);
644595f8 2706 if (!err)
ed6fe9d6 2707 err = compat_put_timespec(&kts, up);
644595f8 2708
7a229387
AB
2709 return err;
2710}
2711
6b96018b 2712static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2713{
2714 struct ifreq __user *uifr;
2715 int err;
2716
2717 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2718 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2719 return -EFAULT;
2720
6b96018b 2721 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2722 if (err)
2723 return err;
2724
6b96018b 2725 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2726 return -EFAULT;
2727
2728 return 0;
2729}
2730
6b96018b 2731static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2732{
6b96018b 2733 struct compat_ifconf ifc32;
7a229387
AB
2734 struct ifconf ifc;
2735 struct ifconf __user *uifc;
6b96018b 2736 struct compat_ifreq __user *ifr32;
7a229387
AB
2737 struct ifreq __user *ifr;
2738 unsigned int i, j;
2739 int err;
2740
6b96018b 2741 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2742 return -EFAULT;
2743
43da5f2e 2744 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2745 if (ifc32.ifcbuf == 0) {
2746 ifc32.ifc_len = 0;
2747 ifc.ifc_len = 0;
2748 ifc.ifc_req = NULL;
2749 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2750 } else {
c6d409cf
ED
2751 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2752 sizeof(struct ifreq);
7a229387
AB
2753 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2754 ifc.ifc_len = len;
2755 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2756 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2757 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2758 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2759 return -EFAULT;
2760 ifr++;
2761 ifr32++;
2762 }
2763 }
2764 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2765 return -EFAULT;
2766
6b96018b 2767 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2768 if (err)
2769 return err;
2770
2771 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2772 return -EFAULT;
2773
2774 ifr = ifc.ifc_req;
2775 ifr32 = compat_ptr(ifc32.ifcbuf);
2776 for (i = 0, j = 0;
c6d409cf
ED
2777 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2778 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2779 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2780 return -EFAULT;
2781 ifr32++;
2782 ifr++;
2783 }
2784
2785 if (ifc32.ifcbuf == 0) {
2786 /* Translate from 64-bit structure multiple to
2787 * a 32-bit one.
2788 */
2789 i = ifc.ifc_len;
6b96018b 2790 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2791 ifc32.ifc_len = i;
2792 } else {
2793 ifc32.ifc_len = i;
2794 }
6b96018b 2795 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2796 return -EFAULT;
2797
2798 return 0;
2799}
2800
6b96018b 2801static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2802{
3a7da39d
BH
2803 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2804 bool convert_in = false, convert_out = false;
2805 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2806 struct ethtool_rxnfc __user *rxnfc;
7a229387 2807 struct ifreq __user *ifr;
3a7da39d
BH
2808 u32 rule_cnt = 0, actual_rule_cnt;
2809 u32 ethcmd;
7a229387 2810 u32 data;
3a7da39d 2811 int ret;
7a229387 2812
3a7da39d
BH
2813 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2814 return -EFAULT;
7a229387 2815
3a7da39d
BH
2816 compat_rxnfc = compat_ptr(data);
2817
2818 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2819 return -EFAULT;
2820
3a7da39d
BH
2821 /* Most ethtool structures are defined without padding.
2822 * Unfortunately struct ethtool_rxnfc is an exception.
2823 */
2824 switch (ethcmd) {
2825 default:
2826 break;
2827 case ETHTOOL_GRXCLSRLALL:
2828 /* Buffer size is variable */
2829 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2830 return -EFAULT;
2831 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2832 return -ENOMEM;
2833 buf_size += rule_cnt * sizeof(u32);
2834 /* fall through */
2835 case ETHTOOL_GRXRINGS:
2836 case ETHTOOL_GRXCLSRLCNT:
2837 case ETHTOOL_GRXCLSRULE:
55664f32 2838 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2839 convert_out = true;
2840 /* fall through */
2841 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2842 buf_size += sizeof(struct ethtool_rxnfc);
2843 convert_in = true;
2844 break;
2845 }
2846
2847 ifr = compat_alloc_user_space(buf_size);
954b1244 2848 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2849
2850 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2851 return -EFAULT;
2852
3a7da39d
BH
2853 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2854 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2855 return -EFAULT;
2856
3a7da39d 2857 if (convert_in) {
127fe533 2858 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2859 * fs.ring_cookie and at the end of fs, but nowhere else.
2860 */
127fe533
AD
2861 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2862 sizeof(compat_rxnfc->fs.m_ext) !=
2863 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2864 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2865 BUILD_BUG_ON(
2866 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2867 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2868 offsetof(struct ethtool_rxnfc, fs.location) -
2869 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2870
2871 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2872 (void __user *)(&rxnfc->fs.m_ext + 1) -
2873 (void __user *)rxnfc) ||
3a7da39d
BH
2874 copy_in_user(&rxnfc->fs.ring_cookie,
2875 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2876 (void __user *)(&rxnfc->fs.location + 1) -
2877 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2878 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2879 sizeof(rxnfc->rule_cnt)))
2880 return -EFAULT;
2881 }
2882
2883 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2884 if (ret)
2885 return ret;
2886
2887 if (convert_out) {
2888 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2889 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2890 (const void __user *)rxnfc) ||
3a7da39d
BH
2891 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2892 &rxnfc->fs.ring_cookie,
954b1244
SH
2893 (const void __user *)(&rxnfc->fs.location + 1) -
2894 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2895 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2896 sizeof(rxnfc->rule_cnt)))
2897 return -EFAULT;
2898
2899 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2900 /* As an optimisation, we only copy the actual
2901 * number of rules that the underlying
2902 * function returned. Since Mallory might
2903 * change the rule count in user memory, we
2904 * check that it is less than the rule count
2905 * originally given (as the user buffer size),
2906 * which has been range-checked.
2907 */
2908 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2909 return -EFAULT;
2910 if (actual_rule_cnt < rule_cnt)
2911 rule_cnt = actual_rule_cnt;
2912 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2913 &rxnfc->rule_locs[0],
2914 rule_cnt * sizeof(u32)))
2915 return -EFAULT;
2916 }
2917 }
2918
2919 return 0;
7a229387
AB
2920}
2921
7a50a240
AB
2922static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2923{
2924 void __user *uptr;
2925 compat_uptr_t uptr32;
2926 struct ifreq __user *uifr;
2927
c6d409cf 2928 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2929 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2930 return -EFAULT;
2931
2932 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2933 return -EFAULT;
2934
2935 uptr = compat_ptr(uptr32);
2936
2937 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2938 return -EFAULT;
2939
2940 return dev_ioctl(net, SIOCWANDEV, uifr);
2941}
2942
6b96018b
AB
2943static int bond_ioctl(struct net *net, unsigned int cmd,
2944 struct compat_ifreq __user *ifr32)
7a229387
AB
2945{
2946 struct ifreq kifr;
2947 struct ifreq __user *uifr;
7a229387
AB
2948 mm_segment_t old_fs;
2949 int err;
2950 u32 data;
2951 void __user *datap;
2952
2953 switch (cmd) {
2954 case SIOCBONDENSLAVE:
2955 case SIOCBONDRELEASE:
2956 case SIOCBONDSETHWADDR:
2957 case SIOCBONDCHANGEACTIVE:
6b96018b 2958 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2959 return -EFAULT;
2960
2961 old_fs = get_fs();
c6d409cf 2962 set_fs(KERNEL_DS);
c3f52ae6 2963 err = dev_ioctl(net, cmd,
2964 (struct ifreq __user __force *) &kifr);
c6d409cf 2965 set_fs(old_fs);
7a229387
AB
2966
2967 return err;
2968 case SIOCBONDSLAVEINFOQUERY:
2969 case SIOCBONDINFOQUERY:
2970 uifr = compat_alloc_user_space(sizeof(*uifr));
2971 if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2972 return -EFAULT;
2973
2974 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2975 return -EFAULT;
2976
2977 datap = compat_ptr(data);
2978 if (put_user(datap, &uifr->ifr_ifru.ifru_data))
2979 return -EFAULT;
2980
6b96018b 2981 return dev_ioctl(net, cmd, uifr);
7a229387 2982 default:
07d106d0 2983 return -ENOIOCTLCMD;
ccbd6a5a 2984 }
7a229387
AB
2985}
2986
6b96018b
AB
2987static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
2988 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2989{
2990 struct ifreq __user *u_ifreq64;
7a229387
AB
2991 char tmp_buf[IFNAMSIZ];
2992 void __user *data64;
2993 u32 data32;
2994
2995 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2996 IFNAMSIZ))
2997 return -EFAULT;
2998 if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2999 return -EFAULT;
3000 data64 = compat_ptr(data32);
3001
3002 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
3003
3004 /* Don't check these user accesses, just let that get trapped
3005 * in the ioctl handler instead.
3006 */
3007 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
3008 IFNAMSIZ))
3009 return -EFAULT;
3010 if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
3011 return -EFAULT;
3012
6b96018b 3013 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
3014}
3015
6b96018b
AB
3016static int dev_ifsioc(struct net *net, struct socket *sock,
3017 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 3018{
a2116ed2 3019 struct ifreq __user *uifr;
7a229387
AB
3020 int err;
3021
a2116ed2
AB
3022 uifr = compat_alloc_user_space(sizeof(*uifr));
3023 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3024 return -EFAULT;
3025
3026 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3027
7a229387
AB
3028 if (!err) {
3029 switch (cmd) {
3030 case SIOCGIFFLAGS:
3031 case SIOCGIFMETRIC:
3032 case SIOCGIFMTU:
3033 case SIOCGIFMEM:
3034 case SIOCGIFHWADDR:
3035 case SIOCGIFINDEX:
3036 case SIOCGIFADDR:
3037 case SIOCGIFBRDADDR:
3038 case SIOCGIFDSTADDR:
3039 case SIOCGIFNETMASK:
fab2532b 3040 case SIOCGIFPFLAGS:
7a229387 3041 case SIOCGIFTXQLEN:
fab2532b
AB
3042 case SIOCGMIIPHY:
3043 case SIOCGMIIREG:
a2116ed2 3044 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
3045 err = -EFAULT;
3046 break;
3047 }
3048 }
3049 return err;
3050}
3051
a2116ed2
AB
3052static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3053 struct compat_ifreq __user *uifr32)
3054{
3055 struct ifreq ifr;
3056 struct compat_ifmap __user *uifmap32;
3057 mm_segment_t old_fs;
3058 int err;
3059
3060 uifmap32 = &uifr32->ifr_ifru.ifru_map;
3061 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3062 err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3063 err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3064 err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3065 err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
3066 err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
3067 err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
3068 if (err)
3069 return -EFAULT;
3070
3071 old_fs = get_fs();
c6d409cf 3072 set_fs(KERNEL_DS);
c3f52ae6 3073 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3074 set_fs(old_fs);
a2116ed2
AB
3075
3076 if (cmd == SIOCGIFMAP && !err) {
3077 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3078 err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3079 err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3080 err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3081 err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
3082 err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
3083 err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
3084 if (err)
3085 err = -EFAULT;
3086 }
3087 return err;
3088}
3089
3090static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
3091{
3092 void __user *uptr;
3093 compat_uptr_t uptr32;
3094 struct ifreq __user *uifr;
3095
c6d409cf 3096 uifr = compat_alloc_user_space(sizeof(*uifr));
a2116ed2
AB
3097 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
3098 return -EFAULT;
3099
3100 if (get_user(uptr32, &uifr32->ifr_data))
3101 return -EFAULT;
3102
3103 uptr = compat_ptr(uptr32);
3104
3105 if (put_user(uptr, &uifr->ifr_data))
3106 return -EFAULT;
3107
3108 return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
3109}
3110
7a229387 3111struct rtentry32 {
c6d409cf 3112 u32 rt_pad1;
7a229387
AB
3113 struct sockaddr rt_dst; /* target address */
3114 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3115 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3116 unsigned short rt_flags;
3117 short rt_pad2;
3118 u32 rt_pad3;
3119 unsigned char rt_tos;
3120 unsigned char rt_class;
3121 short rt_pad4;
3122 short rt_metric; /* +1 for binary compatibility! */
7a229387 3123 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3124 u32 rt_mtu; /* per route MTU/Window */
3125 u32 rt_window; /* Window clamping */
7a229387
AB
3126 unsigned short rt_irtt; /* Initial RTT */
3127};
3128
3129struct in6_rtmsg32 {
3130 struct in6_addr rtmsg_dst;
3131 struct in6_addr rtmsg_src;
3132 struct in6_addr rtmsg_gateway;
3133 u32 rtmsg_type;
3134 u16 rtmsg_dst_len;
3135 u16 rtmsg_src_len;
3136 u32 rtmsg_metric;
3137 u32 rtmsg_info;
3138 u32 rtmsg_flags;
3139 s32 rtmsg_ifindex;
3140};
3141
6b96018b
AB
3142static int routing_ioctl(struct net *net, struct socket *sock,
3143 unsigned int cmd, void __user *argp)
7a229387
AB
3144{
3145 int ret;
3146 void *r = NULL;
3147 struct in6_rtmsg r6;
3148 struct rtentry r4;
3149 char devname[16];
3150 u32 rtdev;
3151 mm_segment_t old_fs = get_fs();
3152
6b96018b
AB
3153 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3154 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3155 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3156 3 * sizeof(struct in6_addr));
c6d409cf
ED
3157 ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3158 ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3159 ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3160 ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3161 ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3162 ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3163 ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3164
3165 r = (void *) &r6;
3166 } else { /* ipv4 */
6b96018b 3167 struct rtentry32 __user *ur4 = argp;
c6d409cf 3168 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3169 3 * sizeof(struct sockaddr));
c6d409cf
ED
3170 ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
3171 ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
3172 ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
3173 ret |= __get_user(r4.rt_window, &(ur4->rt_window));
3174 ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
3175 ret |= __get_user(rtdev, &(ur4->rt_dev));
7a229387 3176 if (rtdev) {
c6d409cf 3177 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3178 r4.rt_dev = (char __user __force *)devname;
3179 devname[15] = 0;
7a229387
AB
3180 } else
3181 r4.rt_dev = NULL;
3182
3183 r = (void *) &r4;
3184 }
3185
3186 if (ret) {
3187 ret = -EFAULT;
3188 goto out;
3189 }
3190
c6d409cf 3191 set_fs(KERNEL_DS);
6b96018b 3192 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3193 set_fs(old_fs);
7a229387
AB
3194
3195out:
7a229387
AB
3196 return ret;
3197}
3198
3199/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3200 * for some operations; this forces use of the newer bridge-utils that
25985edc 3201 * use compatible ioctls
7a229387 3202 */
6b96018b 3203static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3204{
6b96018b 3205 compat_ulong_t tmp;
7a229387 3206
6b96018b 3207 if (get_user(tmp, argp))
7a229387
AB
3208 return -EFAULT;
3209 if (tmp == BRCTL_GET_VERSION)
3210 return BRCTL_VERSION + 1;
3211 return -EINVAL;
3212}
3213
6b96018b
AB
3214static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3215 unsigned int cmd, unsigned long arg)
3216{
3217 void __user *argp = compat_ptr(arg);
3218 struct sock *sk = sock->sk;
3219 struct net *net = sock_net(sk);
7a229387 3220
6b96018b
AB
3221 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3222 return siocdevprivate_ioctl(net, cmd, argp);
3223
3224 switch (cmd) {
3225 case SIOCSIFBR:
3226 case SIOCGIFBR:
3227 return old_bridge_ioctl(argp);
3228 case SIOCGIFNAME:
3229 return dev_ifname32(net, argp);
3230 case SIOCGIFCONF:
3231 return dev_ifconf(net, argp);
3232 case SIOCETHTOOL:
3233 return ethtool_ioctl(net, argp);
7a50a240
AB
3234 case SIOCWANDEV:
3235 return compat_siocwandev(net, argp);
a2116ed2
AB
3236 case SIOCGIFMAP:
3237 case SIOCSIFMAP:
3238 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3239 case SIOCBONDENSLAVE:
3240 case SIOCBONDRELEASE:
3241 case SIOCBONDSETHWADDR:
3242 case SIOCBONDSLAVEINFOQUERY:
3243 case SIOCBONDINFOQUERY:
3244 case SIOCBONDCHANGEACTIVE:
3245 return bond_ioctl(net, cmd, argp);
3246 case SIOCADDRT:
3247 case SIOCDELRT:
3248 return routing_ioctl(net, sock, cmd, argp);
3249 case SIOCGSTAMP:
3250 return do_siocgstamp(net, sock, cmd, argp);
3251 case SIOCGSTAMPNS:
3252 return do_siocgstampns(net, sock, cmd, argp);
a2116ed2
AB
3253 case SIOCSHWTSTAMP:
3254 return compat_siocshwtstamp(net, argp);
6b96018b
AB
3255
3256 case FIOSETOWN:
3257 case SIOCSPGRP:
3258 case FIOGETOWN:
3259 case SIOCGPGRP:
3260 case SIOCBRADDBR:
3261 case SIOCBRDELBR:
3262 case SIOCGIFVLAN:
3263 case SIOCSIFVLAN:
3264 case SIOCADDDLCI:
3265 case SIOCDELDLCI:
3266 return sock_ioctl(file, cmd, arg);
3267
3268 case SIOCGIFFLAGS:
3269 case SIOCSIFFLAGS:
3270 case SIOCGIFMETRIC:
3271 case SIOCSIFMETRIC:
3272 case SIOCGIFMTU:
3273 case SIOCSIFMTU:
3274 case SIOCGIFMEM:
3275 case SIOCSIFMEM:
3276 case SIOCGIFHWADDR:
3277 case SIOCSIFHWADDR:
3278 case SIOCADDMULTI:
3279 case SIOCDELMULTI:
3280 case SIOCGIFINDEX:
6b96018b
AB
3281 case SIOCGIFADDR:
3282 case SIOCSIFADDR:
3283 case SIOCSIFHWBROADCAST:
6b96018b 3284 case SIOCDIFADDR:
6b96018b
AB
3285 case SIOCGIFBRDADDR:
3286 case SIOCSIFBRDADDR:
3287 case SIOCGIFDSTADDR:
3288 case SIOCSIFDSTADDR:
3289 case SIOCGIFNETMASK:
3290 case SIOCSIFNETMASK:
3291 case SIOCSIFPFLAGS:
3292 case SIOCGIFPFLAGS:
3293 case SIOCGIFTXQLEN:
3294 case SIOCSIFTXQLEN:
3295 case SIOCBRADDIF:
3296 case SIOCBRDELIF:
9177efd3
AB
3297 case SIOCSIFNAME:
3298 case SIOCGMIIPHY:
3299 case SIOCGMIIREG:
3300 case SIOCSMIIREG:
6b96018b 3301 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3302
6b96018b
AB
3303 case SIOCSARP:
3304 case SIOCGARP:
3305 case SIOCDARP:
6b96018b 3306 case SIOCATMARK:
9177efd3
AB
3307 return sock_do_ioctl(net, sock, cmd, arg);
3308 }
3309
6b96018b
AB
3310 return -ENOIOCTLCMD;
3311}
7a229387 3312
95c96174 3313static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3314 unsigned long arg)
89bbfc95
SP
3315{
3316 struct socket *sock = file->private_data;
3317 int ret = -ENOIOCTLCMD;
87de87d5
DM
3318 struct sock *sk;
3319 struct net *net;
3320
3321 sk = sock->sk;
3322 net = sock_net(sk);
89bbfc95
SP
3323
3324 if (sock->ops->compat_ioctl)
3325 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3326
87de87d5
DM
3327 if (ret == -ENOIOCTLCMD &&
3328 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3329 ret = compat_wext_handle_ioctl(net, cmd, arg);
3330
6b96018b
AB
3331 if (ret == -ENOIOCTLCMD)
3332 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3333
89bbfc95
SP
3334 return ret;
3335}
3336#endif
3337
ac5a488e
SS
3338int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3339{
3340 return sock->ops->bind(sock, addr, addrlen);
3341}
c6d409cf 3342EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3343
3344int kernel_listen(struct socket *sock, int backlog)
3345{
3346 return sock->ops->listen(sock, backlog);
3347}
c6d409cf 3348EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3349
3350int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3351{
3352 struct sock *sk = sock->sk;
3353 int err;
3354
3355 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3356 newsock);
3357 if (err < 0)
3358 goto done;
3359
3360 err = sock->ops->accept(sock, *newsock, flags);
3361 if (err < 0) {
3362 sock_release(*newsock);
fa8705b0 3363 *newsock = NULL;
ac5a488e
SS
3364 goto done;
3365 }
3366
3367 (*newsock)->ops = sock->ops;
1b08534e 3368 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3369
3370done:
3371 return err;
3372}
c6d409cf 3373EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3374
3375int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3376 int flags)
ac5a488e
SS
3377{
3378 return sock->ops->connect(sock, addr, addrlen, flags);
3379}
c6d409cf 3380EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3381
3382int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3383 int *addrlen)
3384{
3385 return sock->ops->getname(sock, addr, addrlen, 0);
3386}
c6d409cf 3387EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3388
3389int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3390 int *addrlen)
3391{
3392 return sock->ops->getname(sock, addr, addrlen, 1);
3393}
c6d409cf 3394EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3395
3396int kernel_getsockopt(struct socket *sock, int level, int optname,
3397 char *optval, int *optlen)
3398{
3399 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3400 char __user *uoptval;
3401 int __user *uoptlen;
ac5a488e
SS
3402 int err;
3403
fb8621bb
NK
3404 uoptval = (char __user __force *) optval;
3405 uoptlen = (int __user __force *) optlen;
3406
ac5a488e
SS
3407 set_fs(KERNEL_DS);
3408 if (level == SOL_SOCKET)
fb8621bb 3409 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3410 else
fb8621bb
NK
3411 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3412 uoptlen);
ac5a488e
SS
3413 set_fs(oldfs);
3414 return err;
3415}
c6d409cf 3416EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3417
3418int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3419 char *optval, unsigned int optlen)
ac5a488e
SS
3420{
3421 mm_segment_t oldfs = get_fs();
fb8621bb 3422 char __user *uoptval;
ac5a488e
SS
3423 int err;
3424
fb8621bb
NK
3425 uoptval = (char __user __force *) optval;
3426
ac5a488e
SS
3427 set_fs(KERNEL_DS);
3428 if (level == SOL_SOCKET)
fb8621bb 3429 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3430 else
fb8621bb 3431 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3432 optlen);
3433 set_fs(oldfs);
3434 return err;
3435}
c6d409cf 3436EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3437
3438int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3439 size_t size, int flags)
3440{
3441 if (sock->ops->sendpage)
3442 return sock->ops->sendpage(sock, page, offset, size, flags);
3443
3444 return sock_no_sendpage(sock, page, offset, size, flags);
3445}
c6d409cf 3446EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3447
3448int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3449{
3450 mm_segment_t oldfs = get_fs();
3451 int err;
3452
3453 set_fs(KERNEL_DS);
3454 err = sock->ops->ioctl(sock, cmd, arg);
3455 set_fs(oldfs);
3456
3457 return err;
3458}
c6d409cf 3459EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3460
91cf45f0
TM
3461int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3462{
3463 return sock->ops->shutdown(sock, how);
3464}
91cf45f0 3465EXPORT_SYMBOL(kernel_sock_shutdown);