sanitize audit_mq_open()
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4
LT
72#include <linux/wanrouter.h>
73#include <linux/if_bridge.h>
20380731
ACM
74#include <linux/if_frad.h>
75#include <linux/if_vlan.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1da177e4
LT
89
90#include <asm/uaccess.h>
91#include <asm/unistd.h>
92
93#include <net/compat.h>
87de87d5 94#include <net/wext.h>
1da177e4
LT
95
96#include <net/sock.h>
97#include <linux/netfilter.h>
98
99static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
100static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
101 unsigned long nr_segs, loff_t pos);
102static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
103 unsigned long nr_segs, loff_t pos);
89bddce5 104static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
105
106static int sock_close(struct inode *inode, struct file *file);
107static unsigned int sock_poll(struct file *file,
108 struct poll_table_struct *wait);
89bddce5 109static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
110#ifdef CONFIG_COMPAT
111static long compat_sock_ioctl(struct file *file,
89bddce5 112 unsigned int cmd, unsigned long arg);
89bbfc95 113#endif
1da177e4 114static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
115static ssize_t sock_sendpage(struct file *file, struct page *page,
116 int offset, size_t size, loff_t *ppos, int more);
9c55e01c
JA
117static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
118 struct pipe_inode_info *pipe, size_t len,
119 unsigned int flags);
1da177e4 120
1da177e4
LT
121/*
122 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
123 * in the operation structures but are done directly via the socketcall() multiplexor.
124 */
125
da7071d7 126static const struct file_operations socket_file_ops = {
1da177e4
LT
127 .owner = THIS_MODULE,
128 .llseek = no_llseek,
129 .aio_read = sock_aio_read,
130 .aio_write = sock_aio_write,
131 .poll = sock_poll,
132 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
133#ifdef CONFIG_COMPAT
134 .compat_ioctl = compat_sock_ioctl,
135#endif
1da177e4
LT
136 .mmap = sock_mmap,
137 .open = sock_no_open, /* special open code to disallow open via /proc */
138 .release = sock_close,
139 .fasync = sock_fasync,
5274f052
JA
140 .sendpage = sock_sendpage,
141 .splice_write = generic_splice_sendpage,
9c55e01c 142 .splice_read = sock_splice_read,
1da177e4
LT
143};
144
145/*
146 * The protocol list. Each protocol is registered in here.
147 */
148
1da177e4 149static DEFINE_SPINLOCK(net_family_lock);
f0fd27d4 150static const struct net_proto_family *net_families[NPROTO] __read_mostly;
1da177e4 151
1da177e4
LT
152/*
153 * Statistics counters of the socket lists
154 */
155
156static DEFINE_PER_CPU(int, sockets_in_use) = 0;
157
158/*
89bddce5
SH
159 * Support routines.
160 * Move socket addresses back and forth across the kernel/user
161 * divide and look after the messy bits.
1da177e4
LT
162 */
163
89bddce5 164#define MAX_SOCK_ADDR 128 /* 108 for Unix domain -
1da177e4
LT
165 16 for IP, 16 for IPX,
166 24 for IPv6,
89bddce5 167 about 80 for AX.25
1da177e4
LT
168 must be at least one bigger than
169 the AF_UNIX size (see net/unix/af_unix.c
89bddce5 170 :unix_mkname()).
1da177e4 171 */
89bddce5 172
1da177e4
LT
173/**
174 * move_addr_to_kernel - copy a socket address into kernel space
175 * @uaddr: Address in user space
176 * @kaddr: Address in kernel space
177 * @ulen: Length in user space
178 *
179 * The address is copied into kernel space. If the provided address is
180 * too long an error code of -EINVAL is returned. If the copy gives
181 * invalid addresses -EFAULT is returned. On a success 0 is returned.
182 */
183
230b1839 184int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr *kaddr)
1da177e4 185{
230b1839 186 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 187 return -EINVAL;
89bddce5 188 if (ulen == 0)
1da177e4 189 return 0;
89bddce5 190 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 191 return -EFAULT;
3ec3b2fb 192 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
193}
194
195/**
196 * move_addr_to_user - copy an address to user space
197 * @kaddr: kernel space address
198 * @klen: length of address in kernel
199 * @uaddr: user space address
200 * @ulen: pointer to user length field
201 *
202 * The value pointed to by ulen on entry is the buffer length available.
203 * This is overwritten with the buffer space used. -EINVAL is returned
204 * if an overlong buffer is specified or a negative buffer size. -EFAULT
205 * is returned if either the buffer or the length field are not
206 * accessible.
207 * After copying the data up to the limit the user specifies, the true
208 * length of the data is written over the length limit the user
209 * specified. Zero is returned for a success.
210 */
89bddce5 211
230b1839 212int move_addr_to_user(struct sockaddr *kaddr, int klen, void __user *uaddr,
89bddce5 213 int __user *ulen)
1da177e4
LT
214{
215 int err;
216 int len;
217
89bddce5
SH
218 err = get_user(len, ulen);
219 if (err)
1da177e4 220 return err;
89bddce5
SH
221 if (len > klen)
222 len = klen;
230b1839 223 if (len < 0 || len > sizeof(struct sockaddr_storage))
1da177e4 224 return -EINVAL;
89bddce5 225 if (len) {
d6fe3945
SG
226 if (audit_sockaddr(klen, kaddr))
227 return -ENOMEM;
89bddce5 228 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
229 return -EFAULT;
230 }
231 /*
89bddce5
SH
232 * "fromlen shall refer to the value before truncation.."
233 * 1003.1g
1da177e4
LT
234 */
235 return __put_user(klen, ulen);
236}
237
238#define SOCKFS_MAGIC 0x534F434B
239
e18b890b 240static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
241
242static struct inode *sock_alloc_inode(struct super_block *sb)
243{
244 struct socket_alloc *ei;
89bddce5 245
e94b1766 246 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
247 if (!ei)
248 return NULL;
249 init_waitqueue_head(&ei->socket.wait);
89bddce5 250
1da177e4
LT
251 ei->socket.fasync_list = NULL;
252 ei->socket.state = SS_UNCONNECTED;
253 ei->socket.flags = 0;
254 ei->socket.ops = NULL;
255 ei->socket.sk = NULL;
256 ei->socket.file = NULL;
1da177e4
LT
257
258 return &ei->vfs_inode;
259}
260
261static void sock_destroy_inode(struct inode *inode)
262{
263 kmem_cache_free(sock_inode_cachep,
264 container_of(inode, struct socket_alloc, vfs_inode));
265}
266
51cc5068 267static void init_once(void *foo)
1da177e4 268{
89bddce5 269 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 270
a35afb83 271 inode_init_once(&ei->vfs_inode);
1da177e4 272}
89bddce5 273
1da177e4
LT
274static int init_inodecache(void)
275{
276 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
277 sizeof(struct socket_alloc),
278 0,
279 (SLAB_HWCACHE_ALIGN |
280 SLAB_RECLAIM_ACCOUNT |
281 SLAB_MEM_SPREAD),
20c2df83 282 init_once);
1da177e4
LT
283 if (sock_inode_cachep == NULL)
284 return -ENOMEM;
285 return 0;
286}
287
288static struct super_operations sockfs_ops = {
289 .alloc_inode = sock_alloc_inode,
290 .destroy_inode =sock_destroy_inode,
291 .statfs = simple_statfs,
292};
293
454e2398 294static int sockfs_get_sb(struct file_system_type *fs_type,
89bddce5
SH
295 int flags, const char *dev_name, void *data,
296 struct vfsmount *mnt)
1da177e4 297{
454e2398
DH
298 return get_sb_pseudo(fs_type, "socket:", &sockfs_ops, SOCKFS_MAGIC,
299 mnt);
1da177e4
LT
300}
301
ba89966c 302static struct vfsmount *sock_mnt __read_mostly;
1da177e4
LT
303
304static struct file_system_type sock_fs_type = {
305 .name = "sockfs",
306 .get_sb = sockfs_get_sb,
307 .kill_sb = kill_anon_super,
308};
89bddce5 309
1da177e4
LT
310static int sockfs_delete_dentry(struct dentry *dentry)
311{
304e61e6
ED
312 /*
313 * At creation time, we pretended this dentry was hashed
314 * (by clearing DCACHE_UNHASHED bit in d_flags)
315 * At delete time, we restore the truth : not hashed.
316 * (so that dput() can proceed correctly)
317 */
318 dentry->d_flags |= DCACHE_UNHASHED;
319 return 0;
1da177e4 320}
c23fbb6b
ED
321
322/*
323 * sockfs_dname() is called from d_path().
324 */
325static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
326{
327 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
328 dentry->d_inode->i_ino);
329}
330
1da177e4 331static struct dentry_operations sockfs_dentry_operations = {
89bddce5 332 .d_delete = sockfs_delete_dentry,
c23fbb6b 333 .d_dname = sockfs_dname,
1da177e4
LT
334};
335
336/*
337 * Obtains the first available file descriptor and sets it up for use.
338 *
39d8c1b6
DM
339 * These functions create file structures and maps them to fd space
340 * of the current process. On success it returns file descriptor
1da177e4
LT
341 * and file struct implicitly stored in sock->file.
342 * Note that another thread may close file descriptor before we return
343 * from this function. We use the fact that now we do not refer
344 * to socket after mapping. If one day we will need it, this
345 * function will increment ref. count on file by 1.
346 *
347 * In any case returned fd MAY BE not valid!
348 * This race condition is unavoidable
349 * with shared fd spaces, we cannot solve it inside kernel,
350 * but we take care of internal coherence yet.
351 */
352
a677a039 353static int sock_alloc_fd(struct file **filep, int flags)
1da177e4
LT
354{
355 int fd;
1da177e4 356
a677a039 357 fd = get_unused_fd_flags(flags);
39d8c1b6 358 if (likely(fd >= 0)) {
1da177e4
LT
359 struct file *file = get_empty_filp();
360
39d8c1b6
DM
361 *filep = file;
362 if (unlikely(!file)) {
1da177e4 363 put_unused_fd(fd);
39d8c1b6 364 return -ENFILE;
1da177e4 365 }
39d8c1b6
DM
366 } else
367 *filep = NULL;
368 return fd;
369}
1da177e4 370
77d27200 371static int sock_attach_fd(struct socket *sock, struct file *file, int flags)
39d8c1b6 372{
ce8d2cdf 373 struct dentry *dentry;
c23fbb6b 374 struct qstr name = { .name = "" };
39d8c1b6 375
ce8d2cdf
DH
376 dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
377 if (unlikely(!dentry))
39d8c1b6
DM
378 return -ENOMEM;
379
ce8d2cdf 380 dentry->d_op = &sockfs_dentry_operations;
304e61e6
ED
381 /*
382 * We dont want to push this dentry into global dentry hash table.
383 * We pretend dentry is already hashed, by unsetting DCACHE_UNHASHED
384 * This permits a working /proc/$pid/fd/XXX on sockets
385 */
ce8d2cdf
DH
386 dentry->d_flags &= ~DCACHE_UNHASHED;
387 d_instantiate(dentry, SOCK_INODE(sock));
39d8c1b6
DM
388
389 sock->file = file;
ce8d2cdf
DH
390 init_file(file, sock_mnt, dentry, FMODE_READ | FMODE_WRITE,
391 &socket_file_ops);
392 SOCK_INODE(sock)->i_fop = &socket_file_ops;
77d27200 393 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6
DM
394 file->f_pos = 0;
395 file->private_data = sock;
1da177e4 396
39d8c1b6
DM
397 return 0;
398}
399
a677a039 400int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
401{
402 struct file *newfile;
a677a039 403 int fd = sock_alloc_fd(&newfile, flags);
39d8c1b6
DM
404
405 if (likely(fd >= 0)) {
77d27200 406 int err = sock_attach_fd(sock, newfile, flags);
39d8c1b6
DM
407
408 if (unlikely(err < 0)) {
409 put_filp(newfile);
1da177e4 410 put_unused_fd(fd);
39d8c1b6 411 return err;
1da177e4 412 }
39d8c1b6 413 fd_install(fd, newfile);
1da177e4 414 }
1da177e4
LT
415 return fd;
416}
417
6cb153ca
BL
418static struct socket *sock_from_file(struct file *file, int *err)
419{
6cb153ca
BL
420 if (file->f_op == &socket_file_ops)
421 return file->private_data; /* set in sock_map_fd */
422
23bb80d2
ED
423 *err = -ENOTSOCK;
424 return NULL;
6cb153ca
BL
425}
426
1da177e4
LT
427/**
428 * sockfd_lookup - Go from a file number to its socket slot
429 * @fd: file handle
430 * @err: pointer to an error code return
431 *
432 * The file handle passed in is locked and the socket it is bound
433 * too is returned. If an error occurs the err pointer is overwritten
434 * with a negative errno code and NULL is returned. The function checks
435 * for both invalid handles and passing a handle which is not a socket.
436 *
437 * On a success the socket object pointer is returned.
438 */
439
440struct socket *sockfd_lookup(int fd, int *err)
441{
442 struct file *file;
1da177e4
LT
443 struct socket *sock;
444
89bddce5
SH
445 file = fget(fd);
446 if (!file) {
1da177e4
LT
447 *err = -EBADF;
448 return NULL;
449 }
89bddce5 450
6cb153ca
BL
451 sock = sock_from_file(file, err);
452 if (!sock)
1da177e4 453 fput(file);
6cb153ca
BL
454 return sock;
455}
1da177e4 456
6cb153ca
BL
457static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
458{
459 struct file *file;
460 struct socket *sock;
461
3672558c 462 *err = -EBADF;
6cb153ca
BL
463 file = fget_light(fd, fput_needed);
464 if (file) {
465 sock = sock_from_file(file, err);
466 if (sock)
467 return sock;
468 fput_light(file, *fput_needed);
1da177e4 469 }
6cb153ca 470 return NULL;
1da177e4
LT
471}
472
473/**
474 * sock_alloc - allocate a socket
89bddce5 475 *
1da177e4
LT
476 * Allocate a new inode and socket object. The two are bound together
477 * and initialised. The socket is then returned. If we are out of inodes
478 * NULL is returned.
479 */
480
481static struct socket *sock_alloc(void)
482{
89bddce5
SH
483 struct inode *inode;
484 struct socket *sock;
1da177e4
LT
485
486 inode = new_inode(sock_mnt->mnt_sb);
487 if (!inode)
488 return NULL;
489
490 sock = SOCKET_I(inode);
491
89bddce5 492 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
493 inode->i_uid = current_fsuid();
494 inode->i_gid = current_fsgid();
1da177e4
LT
495
496 get_cpu_var(sockets_in_use)++;
497 put_cpu_var(sockets_in_use);
498 return sock;
499}
500
501/*
502 * In theory you can't get an open on this inode, but /proc provides
503 * a back door. Remember to keep it shut otherwise you'll let the
504 * creepy crawlies in.
505 */
89bddce5 506
1da177e4
LT
507static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
508{
509 return -ENXIO;
510}
511
4b6f5d20 512const struct file_operations bad_sock_fops = {
1da177e4
LT
513 .owner = THIS_MODULE,
514 .open = sock_no_open,
515};
516
517/**
518 * sock_release - close a socket
519 * @sock: socket to close
520 *
521 * The socket is released from the protocol stack if it has a release
522 * callback, and the inode is then released if the socket is bound to
89bddce5 523 * an inode not a file.
1da177e4 524 */
89bddce5 525
1da177e4
LT
526void sock_release(struct socket *sock)
527{
528 if (sock->ops) {
529 struct module *owner = sock->ops->owner;
530
531 sock->ops->release(sock);
532 sock->ops = NULL;
533 module_put(owner);
534 }
535
536 if (sock->fasync_list)
537 printk(KERN_ERR "sock_release: fasync list not empty!\n");
538
539 get_cpu_var(sockets_in_use)--;
540 put_cpu_var(sockets_in_use);
541 if (!sock->file) {
542 iput(SOCK_INODE(sock));
543 return;
544 }
89bddce5 545 sock->file = NULL;
1da177e4
LT
546}
547
89bddce5 548static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
1da177e4
LT
549 struct msghdr *msg, size_t size)
550{
551 struct sock_iocb *si = kiocb_to_siocb(iocb);
552 int err;
553
554 si->sock = sock;
555 si->scm = NULL;
556 si->msg = msg;
557 si->size = size;
558
559 err = security_socket_sendmsg(sock, msg, size);
560 if (err)
561 return err;
562
563 return sock->ops->sendmsg(iocb, sock, msg, size);
564}
565
566int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
567{
568 struct kiocb iocb;
569 struct sock_iocb siocb;
570 int ret;
571
572 init_sync_kiocb(&iocb, NULL);
573 iocb.private = &siocb;
574 ret = __sock_sendmsg(&iocb, sock, msg, size);
575 if (-EIOCBQUEUED == ret)
576 ret = wait_on_sync_kiocb(&iocb);
577 return ret;
578}
579
580int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
581 struct kvec *vec, size_t num, size_t size)
582{
583 mm_segment_t oldfs = get_fs();
584 int result;
585
586 set_fs(KERNEL_DS);
587 /*
588 * the following is safe, since for compiler definitions of kvec and
589 * iovec are identical, yielding the same in-core layout and alignment
590 */
89bddce5 591 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
592 msg->msg_iovlen = num;
593 result = sock_sendmsg(sock, msg, size);
594 set_fs(oldfs);
595 return result;
596}
597
92f37fd2
ED
598/*
599 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
600 */
601void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
602 struct sk_buff *skb)
603{
604 ktime_t kt = skb->tstamp;
605
606 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
607 struct timeval tv;
608 /* Race occurred between timestamp enabling and packet
609 receiving. Fill in the current time for now. */
610 if (kt.tv64 == 0)
611 kt = ktime_get_real();
612 skb->tstamp = kt;
613 tv = ktime_to_timeval(kt);
614 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP, sizeof(tv), &tv);
615 } else {
616 struct timespec ts;
617 /* Race occurred between timestamp enabling and packet
618 receiving. Fill in the current time for now. */
619 if (kt.tv64 == 0)
620 kt = ktime_get_real();
621 skb->tstamp = kt;
622 ts = ktime_to_timespec(kt);
623 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS, sizeof(ts), &ts);
624 }
625}
626
7c81fd8b
ACM
627EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
628
89bddce5 629static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
1da177e4
LT
630 struct msghdr *msg, size_t size, int flags)
631{
632 int err;
633 struct sock_iocb *si = kiocb_to_siocb(iocb);
634
635 si->sock = sock;
636 si->scm = NULL;
637 si->msg = msg;
638 si->size = size;
639 si->flags = flags;
640
641 err = security_socket_recvmsg(sock, msg, size, flags);
642 if (err)
643 return err;
644
645 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
646}
647
89bddce5 648int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
649 size_t size, int flags)
650{
651 struct kiocb iocb;
652 struct sock_iocb siocb;
653 int ret;
654
89bddce5 655 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
656 iocb.private = &siocb;
657 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
658 if (-EIOCBQUEUED == ret)
659 ret = wait_on_sync_kiocb(&iocb);
660 return ret;
661}
662
89bddce5
SH
663int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
664 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
665{
666 mm_segment_t oldfs = get_fs();
667 int result;
668
669 set_fs(KERNEL_DS);
670 /*
671 * the following is safe, since for compiler definitions of kvec and
672 * iovec are identical, yielding the same in-core layout and alignment
673 */
89bddce5 674 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
675 result = sock_recvmsg(sock, msg, size, flags);
676 set_fs(oldfs);
677 return result;
678}
679
680static void sock_aio_dtor(struct kiocb *iocb)
681{
682 kfree(iocb->private);
683}
684
ce1d4d3e
CH
685static ssize_t sock_sendpage(struct file *file, struct page *page,
686 int offset, size_t size, loff_t *ppos, int more)
1da177e4 687{
1da177e4
LT
688 struct socket *sock;
689 int flags;
690
ce1d4d3e
CH
691 sock = file->private_data;
692
693 flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
694 if (more)
695 flags |= MSG_MORE;
696
697 return sock->ops->sendpage(sock, page, offset, size, flags);
698}
1da177e4 699
9c55e01c
JA
700static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
701 struct pipe_inode_info *pipe, size_t len,
702 unsigned int flags)
703{
704 struct socket *sock = file->private_data;
705
997b37da
RDC
706 if (unlikely(!sock->ops->splice_read))
707 return -EINVAL;
708
9c55e01c
JA
709 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
710}
711
ce1d4d3e 712static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 713 struct sock_iocb *siocb)
ce1d4d3e
CH
714{
715 if (!is_sync_kiocb(iocb)) {
716 siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
717 if (!siocb)
718 return NULL;
1da177e4
LT
719 iocb->ki_dtor = sock_aio_dtor;
720 }
1da177e4 721
ce1d4d3e 722 siocb->kiocb = iocb;
ce1d4d3e
CH
723 iocb->private = siocb;
724 return siocb;
1da177e4
LT
725}
726
ce1d4d3e 727static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
728 struct file *file, const struct iovec *iov,
729 unsigned long nr_segs)
ce1d4d3e
CH
730{
731 struct socket *sock = file->private_data;
732 size_t size = 0;
733 int i;
1da177e4 734
89bddce5
SH
735 for (i = 0; i < nr_segs; i++)
736 size += iov[i].iov_len;
1da177e4 737
ce1d4d3e
CH
738 msg->msg_name = NULL;
739 msg->msg_namelen = 0;
740 msg->msg_control = NULL;
741 msg->msg_controllen = 0;
89bddce5 742 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
743 msg->msg_iovlen = nr_segs;
744 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
745
746 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
747}
748
027445c3
BP
749static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
750 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
751{
752 struct sock_iocb siocb, *x;
753
1da177e4
LT
754 if (pos != 0)
755 return -ESPIPE;
027445c3
BP
756
757 if (iocb->ki_left == 0) /* Match SYS5 behaviour */
1da177e4
LT
758 return 0;
759
027445c3
BP
760
761 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
762 if (!x)
763 return -ENOMEM;
027445c3 764 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
765}
766
ce1d4d3e 767static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
768 struct file *file, const struct iovec *iov,
769 unsigned long nr_segs)
1da177e4 770{
ce1d4d3e
CH
771 struct socket *sock = file->private_data;
772 size_t size = 0;
773 int i;
1da177e4 774
89bddce5
SH
775 for (i = 0; i < nr_segs; i++)
776 size += iov[i].iov_len;
1da177e4 777
ce1d4d3e
CH
778 msg->msg_name = NULL;
779 msg->msg_namelen = 0;
780 msg->msg_control = NULL;
781 msg->msg_controllen = 0;
89bddce5 782 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
783 msg->msg_iovlen = nr_segs;
784 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
785 if (sock->type == SOCK_SEQPACKET)
786 msg->msg_flags |= MSG_EOR;
1da177e4 787
ce1d4d3e 788 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
789}
790
027445c3
BP
791static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
792 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
793{
794 struct sock_iocb siocb, *x;
1da177e4 795
ce1d4d3e
CH
796 if (pos != 0)
797 return -ESPIPE;
027445c3 798
027445c3 799 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
800 if (!x)
801 return -ENOMEM;
1da177e4 802
027445c3 803 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
804}
805
1da177e4
LT
806/*
807 * Atomic setting of ioctl hooks to avoid race
808 * with module unload.
809 */
810
4a3e2f71 811static DEFINE_MUTEX(br_ioctl_mutex);
881d966b 812static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg) = NULL;
1da177e4 813
881d966b 814void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 815{
4a3e2f71 816 mutex_lock(&br_ioctl_mutex);
1da177e4 817 br_ioctl_hook = hook;
4a3e2f71 818 mutex_unlock(&br_ioctl_mutex);
1da177e4 819}
89bddce5 820
1da177e4
LT
821EXPORT_SYMBOL(brioctl_set);
822
4a3e2f71 823static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 824static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 825
881d966b 826void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 827{
4a3e2f71 828 mutex_lock(&vlan_ioctl_mutex);
1da177e4 829 vlan_ioctl_hook = hook;
4a3e2f71 830 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 831}
89bddce5 832
1da177e4
LT
833EXPORT_SYMBOL(vlan_ioctl_set);
834
4a3e2f71 835static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 836static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 837
89bddce5 838void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 839{
4a3e2f71 840 mutex_lock(&dlci_ioctl_mutex);
1da177e4 841 dlci_ioctl_hook = hook;
4a3e2f71 842 mutex_unlock(&dlci_ioctl_mutex);
1da177e4 843}
89bddce5 844
1da177e4
LT
845EXPORT_SYMBOL(dlci_ioctl_set);
846
847/*
848 * With an ioctl, arg may well be a user mode pointer, but we don't know
849 * what to do with it - that's up to the protocol still.
850 */
851
852static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
853{
854 struct socket *sock;
881d966b 855 struct sock *sk;
1da177e4
LT
856 void __user *argp = (void __user *)arg;
857 int pid, err;
881d966b 858 struct net *net;
1da177e4 859
b69aee04 860 sock = file->private_data;
881d966b 861 sk = sock->sk;
3b1e0a65 862 net = sock_net(sk);
1da177e4 863 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 864 err = dev_ioctl(net, cmd, argp);
1da177e4 865 } else
d86b5e0e 866#ifdef CONFIG_WIRELESS_EXT
1da177e4 867 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 868 err = dev_ioctl(net, cmd, argp);
1da177e4 869 } else
89bddce5
SH
870#endif /* CONFIG_WIRELESS_EXT */
871 switch (cmd) {
1da177e4
LT
872 case FIOSETOWN:
873 case SIOCSPGRP:
874 err = -EFAULT;
875 if (get_user(pid, (int __user *)argp))
876 break;
877 err = f_setown(sock->file, pid, 1);
878 break;
879 case FIOGETOWN:
880 case SIOCGPGRP:
609d7fa9 881 err = put_user(f_getown(sock->file),
89bddce5 882 (int __user *)argp);
1da177e4
LT
883 break;
884 case SIOCGIFBR:
885 case SIOCSIFBR:
886 case SIOCBRADDBR:
887 case SIOCBRDELBR:
888 err = -ENOPKG;
889 if (!br_ioctl_hook)
890 request_module("bridge");
891
4a3e2f71 892 mutex_lock(&br_ioctl_mutex);
89bddce5 893 if (br_ioctl_hook)
881d966b 894 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 895 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
896 break;
897 case SIOCGIFVLAN:
898 case SIOCSIFVLAN:
899 err = -ENOPKG;
900 if (!vlan_ioctl_hook)
901 request_module("8021q");
902
4a3e2f71 903 mutex_lock(&vlan_ioctl_mutex);
1da177e4 904 if (vlan_ioctl_hook)
881d966b 905 err = vlan_ioctl_hook(net, argp);
4a3e2f71 906 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 907 break;
1da177e4
LT
908 case SIOCADDDLCI:
909 case SIOCDELDLCI:
910 err = -ENOPKG;
911 if (!dlci_ioctl_hook)
912 request_module("dlci");
913
7512cbf6
PE
914 mutex_lock(&dlci_ioctl_mutex);
915 if (dlci_ioctl_hook)
1da177e4 916 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 917 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
918 break;
919 default:
920 err = sock->ops->ioctl(sock, cmd, arg);
b5e5fa5e
CH
921
922 /*
923 * If this ioctl is unknown try to hand it down
924 * to the NIC driver.
925 */
926 if (err == -ENOIOCTLCMD)
881d966b 927 err = dev_ioctl(net, cmd, argp);
1da177e4 928 break;
89bddce5 929 }
1da177e4
LT
930 return err;
931}
932
933int sock_create_lite(int family, int type, int protocol, struct socket **res)
934{
935 int err;
936 struct socket *sock = NULL;
89bddce5 937
1da177e4
LT
938 err = security_socket_create(family, type, protocol, 1);
939 if (err)
940 goto out;
941
942 sock = sock_alloc();
943 if (!sock) {
944 err = -ENOMEM;
945 goto out;
946 }
947
1da177e4 948 sock->type = type;
7420ed23
VY
949 err = security_socket_post_create(sock, family, type, protocol, 1);
950 if (err)
951 goto out_release;
952
1da177e4
LT
953out:
954 *res = sock;
955 return err;
7420ed23
VY
956out_release:
957 sock_release(sock);
958 sock = NULL;
959 goto out;
1da177e4
LT
960}
961
962/* No kernel lock held - perfect */
89bddce5 963static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4
LT
964{
965 struct socket *sock;
966
967 /*
89bddce5 968 * We can't return errors to poll, so it's either yes or no.
1da177e4 969 */
b69aee04 970 sock = file->private_data;
1da177e4
LT
971 return sock->ops->poll(file, sock, wait);
972}
973
89bddce5 974static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 975{
b69aee04 976 struct socket *sock = file->private_data;
1da177e4
LT
977
978 return sock->ops->mmap(file, sock, vma);
979}
980
20380731 981static int sock_close(struct inode *inode, struct file *filp)
1da177e4
LT
982{
983 /*
89bddce5
SH
984 * It was possible the inode is NULL we were
985 * closing an unfinished socket.
1da177e4
LT
986 */
987
89bddce5 988 if (!inode) {
1da177e4
LT
989 printk(KERN_DEBUG "sock_close: NULL inode\n");
990 return 0;
991 }
1da177e4
LT
992 sock_release(SOCKET_I(inode));
993 return 0;
994}
995
996/*
997 * Update the socket async list
998 *
999 * Fasync_list locking strategy.
1000 *
1001 * 1. fasync_list is modified only under process context socket lock
1002 * i.e. under semaphore.
1003 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1004 * or under socket lock.
1005 * 3. fasync_list can be used from softirq context, so that
1006 * modification under socket lock have to be enhanced with
1007 * write_lock_bh(&sk->sk_callback_lock).
1008 * --ANK (990710)
1009 */
1010
1011static int sock_fasync(int fd, struct file *filp, int on)
1012{
89bddce5 1013 struct fasync_struct *fa, *fna = NULL, **prev;
1da177e4
LT
1014 struct socket *sock;
1015 struct sock *sk;
1016
89bddce5 1017 if (on) {
8b3a7005 1018 fna = kmalloc(sizeof(struct fasync_struct), GFP_KERNEL);
89bddce5 1019 if (fna == NULL)
1da177e4
LT
1020 return -ENOMEM;
1021 }
1022
b69aee04 1023 sock = filp->private_data;
1da177e4 1024
89bddce5
SH
1025 sk = sock->sk;
1026 if (sk == NULL) {
1da177e4
LT
1027 kfree(fna);
1028 return -EINVAL;
1029 }
1030
1031 lock_sock(sk);
1032
89bddce5 1033 prev = &(sock->fasync_list);
1da177e4 1034
89bddce5
SH
1035 for (fa = *prev; fa != NULL; prev = &fa->fa_next, fa = *prev)
1036 if (fa->fa_file == filp)
1da177e4
LT
1037 break;
1038
89bddce5
SH
1039 if (on) {
1040 if (fa != NULL) {
1da177e4 1041 write_lock_bh(&sk->sk_callback_lock);
89bddce5 1042 fa->fa_fd = fd;
1da177e4
LT
1043 write_unlock_bh(&sk->sk_callback_lock);
1044
1045 kfree(fna);
1046 goto out;
1047 }
89bddce5
SH
1048 fna->fa_file = filp;
1049 fna->fa_fd = fd;
1050 fna->magic = FASYNC_MAGIC;
1051 fna->fa_next = sock->fasync_list;
1da177e4 1052 write_lock_bh(&sk->sk_callback_lock);
89bddce5 1053 sock->fasync_list = fna;
1da177e4 1054 write_unlock_bh(&sk->sk_callback_lock);
89bddce5
SH
1055 } else {
1056 if (fa != NULL) {
1da177e4 1057 write_lock_bh(&sk->sk_callback_lock);
89bddce5 1058 *prev = fa->fa_next;
1da177e4
LT
1059 write_unlock_bh(&sk->sk_callback_lock);
1060 kfree(fa);
1061 }
1062 }
1063
1064out:
1065 release_sock(sock->sk);
1066 return 0;
1067}
1068
1069/* This function may be called only under socket lock or callback_lock */
1070
1071int sock_wake_async(struct socket *sock, int how, int band)
1072{
1073 if (!sock || !sock->fasync_list)
1074 return -1;
89bddce5 1075 switch (how) {
8d8ad9d7 1076 case SOCK_WAKE_WAITD:
1da177e4
LT
1077 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1078 break;
1079 goto call_kill;
8d8ad9d7 1080 case SOCK_WAKE_SPACE:
1da177e4
LT
1081 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1082 break;
1083 /* fall through */
8d8ad9d7 1084 case SOCK_WAKE_IO:
89bddce5 1085call_kill:
1da177e4
LT
1086 __kill_fasync(sock->fasync_list, SIGIO, band);
1087 break;
8d8ad9d7 1088 case SOCK_WAKE_URG:
1da177e4
LT
1089 __kill_fasync(sock->fasync_list, SIGURG, band);
1090 }
1091 return 0;
1092}
1093
1b8d7ae4 1094static int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1095 struct socket **res, int kern)
1da177e4
LT
1096{
1097 int err;
1098 struct socket *sock;
55737fda 1099 const struct net_proto_family *pf;
1da177e4
LT
1100
1101 /*
89bddce5 1102 * Check protocol is in range
1da177e4
LT
1103 */
1104 if (family < 0 || family >= NPROTO)
1105 return -EAFNOSUPPORT;
1106 if (type < 0 || type >= SOCK_MAX)
1107 return -EINVAL;
1108
1109 /* Compatibility.
1110
1111 This uglymoron is moved from INET layer to here to avoid
1112 deadlock in module load.
1113 */
1114 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1115 static int warned;
1da177e4
LT
1116 if (!warned) {
1117 warned = 1;
89bddce5
SH
1118 printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1119 current->comm);
1da177e4
LT
1120 }
1121 family = PF_PACKET;
1122 }
1123
1124 err = security_socket_create(family, type, protocol, kern);
1125 if (err)
1126 return err;
89bddce5 1127
55737fda
SH
1128 /*
1129 * Allocate the socket and allow the family to set things up. if
1130 * the protocol is 0, the family is instructed to select an appropriate
1131 * default.
1132 */
1133 sock = sock_alloc();
1134 if (!sock) {
1135 if (net_ratelimit())
1136 printk(KERN_WARNING "socket: no more sockets\n");
1137 return -ENFILE; /* Not exactly a match, but its the
1138 closest posix thing */
1139 }
1140
1141 sock->type = type;
1142
95a5afca 1143#ifdef CONFIG_MODULES
89bddce5
SH
1144 /* Attempt to load a protocol module if the find failed.
1145 *
1146 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1147 * requested real, full-featured networking support upon configuration.
1148 * Otherwise module support will break!
1149 */
55737fda 1150 if (net_families[family] == NULL)
89bddce5 1151 request_module("net-pf-%d", family);
1da177e4
LT
1152#endif
1153
55737fda
SH
1154 rcu_read_lock();
1155 pf = rcu_dereference(net_families[family]);
1156 err = -EAFNOSUPPORT;
1157 if (!pf)
1158 goto out_release;
1da177e4
LT
1159
1160 /*
1161 * We will call the ->create function, that possibly is in a loadable
1162 * module, so we have to bump that loadable module refcnt first.
1163 */
55737fda 1164 if (!try_module_get(pf->owner))
1da177e4
LT
1165 goto out_release;
1166
55737fda
SH
1167 /* Now protected by module ref count */
1168 rcu_read_unlock();
1169
1b8d7ae4 1170 err = pf->create(net, sock, protocol);
55737fda 1171 if (err < 0)
1da177e4 1172 goto out_module_put;
a79af59e 1173
1da177e4
LT
1174 /*
1175 * Now to bump the refcnt of the [loadable] module that owns this
1176 * socket at sock_release time we decrement its refcnt.
1177 */
55737fda
SH
1178 if (!try_module_get(sock->ops->owner))
1179 goto out_module_busy;
1180
1da177e4
LT
1181 /*
1182 * Now that we're done with the ->create function, the [loadable]
1183 * module can have its refcnt decremented
1184 */
55737fda 1185 module_put(pf->owner);
7420ed23
VY
1186 err = security_socket_post_create(sock, family, type, protocol, kern);
1187 if (err)
3b185525 1188 goto out_sock_release;
55737fda 1189 *res = sock;
1da177e4 1190
55737fda
SH
1191 return 0;
1192
1193out_module_busy:
1194 err = -EAFNOSUPPORT;
1da177e4 1195out_module_put:
55737fda
SH
1196 sock->ops = NULL;
1197 module_put(pf->owner);
1198out_sock_release:
1da177e4 1199 sock_release(sock);
55737fda
SH
1200 return err;
1201
1202out_release:
1203 rcu_read_unlock();
1204 goto out_sock_release;
1da177e4
LT
1205}
1206
1207int sock_create(int family, int type, int protocol, struct socket **res)
1208{
1b8d7ae4 1209 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4
LT
1210}
1211
1212int sock_create_kern(int family, int type, int protocol, struct socket **res)
1213{
1b8d7ae4 1214 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4
LT
1215}
1216
1217asmlinkage long sys_socket(int family, int type, int protocol)
1218{
1219 int retval;
1220 struct socket *sock;
a677a039
UD
1221 int flags;
1222
e38b36f3
UD
1223 /* Check the SOCK_* constants for consistency. */
1224 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1225 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1226 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1227 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1228
a677a039 1229 flags = type & ~SOCK_TYPE_MASK;
77d27200 1230 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1231 return -EINVAL;
1232 type &= SOCK_TYPE_MASK;
1da177e4 1233
aaca0bdc
UD
1234 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1235 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1236
1da177e4
LT
1237 retval = sock_create(family, type, protocol, &sock);
1238 if (retval < 0)
1239 goto out;
1240
77d27200 1241 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1242 if (retval < 0)
1243 goto out_release;
1244
1245out:
1246 /* It may be already another descriptor 8) Not kernel problem. */
1247 return retval;
1248
1249out_release:
1250 sock_release(sock);
1251 return retval;
1252}
1253
1254/*
1255 * Create a pair of connected sockets.
1256 */
1257
89bddce5
SH
1258asmlinkage long sys_socketpair(int family, int type, int protocol,
1259 int __user *usockvec)
1da177e4
LT
1260{
1261 struct socket *sock1, *sock2;
1262 int fd1, fd2, err;
db349509 1263 struct file *newfile1, *newfile2;
a677a039
UD
1264 int flags;
1265
1266 flags = type & ~SOCK_TYPE_MASK;
77d27200 1267 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1268 return -EINVAL;
1269 type &= SOCK_TYPE_MASK;
1da177e4 1270
aaca0bdc
UD
1271 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1272 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1273
1da177e4
LT
1274 /*
1275 * Obtain the first socket and check if the underlying protocol
1276 * supports the socketpair call.
1277 */
1278
1279 err = sock_create(family, type, protocol, &sock1);
1280 if (err < 0)
1281 goto out;
1282
1283 err = sock_create(family, type, protocol, &sock2);
1284 if (err < 0)
1285 goto out_release_1;
1286
1287 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1288 if (err < 0)
1da177e4
LT
1289 goto out_release_both;
1290
a677a039 1291 fd1 = sock_alloc_fd(&newfile1, flags & O_CLOEXEC);
bf3c23d1
DM
1292 if (unlikely(fd1 < 0)) {
1293 err = fd1;
db349509 1294 goto out_release_both;
bf3c23d1 1295 }
1da177e4 1296
a677a039 1297 fd2 = sock_alloc_fd(&newfile2, flags & O_CLOEXEC);
db349509 1298 if (unlikely(fd2 < 0)) {
bf3c23d1 1299 err = fd2;
db349509
AV
1300 put_filp(newfile1);
1301 put_unused_fd(fd1);
1da177e4 1302 goto out_release_both;
db349509 1303 }
1da177e4 1304
77d27200 1305 err = sock_attach_fd(sock1, newfile1, flags & O_NONBLOCK);
db349509
AV
1306 if (unlikely(err < 0)) {
1307 goto out_fd2;
1308 }
1309
77d27200 1310 err = sock_attach_fd(sock2, newfile2, flags & O_NONBLOCK);
db349509
AV
1311 if (unlikely(err < 0)) {
1312 fput(newfile1);
1313 goto out_fd1;
1314 }
1315
1316 err = audit_fd_pair(fd1, fd2);
1317 if (err < 0) {
1318 fput(newfile1);
1319 fput(newfile2);
1320 goto out_fd;
1321 }
1da177e4 1322
db349509
AV
1323 fd_install(fd1, newfile1);
1324 fd_install(fd2, newfile2);
1da177e4
LT
1325 /* fd1 and fd2 may be already another descriptors.
1326 * Not kernel problem.
1327 */
1328
89bddce5 1329 err = put_user(fd1, &usockvec[0]);
1da177e4
LT
1330 if (!err)
1331 err = put_user(fd2, &usockvec[1]);
1332 if (!err)
1333 return 0;
1334
1335 sys_close(fd2);
1336 sys_close(fd1);
1337 return err;
1338
1da177e4 1339out_release_both:
89bddce5 1340 sock_release(sock2);
1da177e4 1341out_release_1:
89bddce5 1342 sock_release(sock1);
1da177e4
LT
1343out:
1344 return err;
db349509
AV
1345
1346out_fd2:
1347 put_filp(newfile1);
1348 sock_release(sock1);
1349out_fd1:
1350 put_filp(newfile2);
1351 sock_release(sock2);
1352out_fd:
1353 put_unused_fd(fd1);
1354 put_unused_fd(fd2);
1355 goto out;
1da177e4
LT
1356}
1357
1da177e4
LT
1358/*
1359 * Bind a name to a socket. Nothing much to do here since it's
1360 * the protocol's responsibility to handle the local address.
1361 *
1362 * We move the socket address to kernel space before we call
1363 * the protocol layer (having also checked the address is ok).
1364 */
1365
1366asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
1367{
1368 struct socket *sock;
230b1839 1369 struct sockaddr_storage address;
6cb153ca 1370 int err, fput_needed;
1da177e4 1371
89bddce5 1372 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1373 if (sock) {
230b1839 1374 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
89bddce5
SH
1375 if (err >= 0) {
1376 err = security_socket_bind(sock,
230b1839 1377 (struct sockaddr *)&address,
89bddce5 1378 addrlen);
6cb153ca
BL
1379 if (!err)
1380 err = sock->ops->bind(sock,
89bddce5 1381 (struct sockaddr *)
230b1839 1382 &address, addrlen);
1da177e4 1383 }
6cb153ca 1384 fput_light(sock->file, fput_needed);
89bddce5 1385 }
1da177e4
LT
1386 return err;
1387}
1388
1da177e4
LT
1389/*
1390 * Perform a listen. Basically, we allow the protocol to do anything
1391 * necessary for a listen, and if that works, we mark the socket as
1392 * ready for listening.
1393 */
1394
1da177e4
LT
1395asmlinkage long sys_listen(int fd, int backlog)
1396{
1397 struct socket *sock;
6cb153ca 1398 int err, fput_needed;
b8e1f9b5 1399 int somaxconn;
89bddce5
SH
1400
1401 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1402 if (sock) {
8efa6e93 1403 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
b8e1f9b5
PE
1404 if ((unsigned)backlog > somaxconn)
1405 backlog = somaxconn;
1da177e4
LT
1406
1407 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1408 if (!err)
1409 err = sock->ops->listen(sock, backlog);
1da177e4 1410
6cb153ca 1411 fput_light(sock->file, fput_needed);
1da177e4
LT
1412 }
1413 return err;
1414}
1415
1da177e4
LT
1416/*
1417 * For accept, we attempt to create a new socket, set up the link
1418 * with the client, wake up the client, then return the new
1419 * connected fd. We collect the address of the connector in kernel
1420 * space and move it to user at the very end. This is unclean because
1421 * we open the socket then return an error.
1422 *
1423 * 1003.1g adds the ability to recvmsg() to query connection pending
1424 * status to recvmsg. We need to add that support in a way thats
1425 * clean when we restucture accept also.
1426 */
1427
de11defe
UD
1428asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
1429 int __user *upeer_addrlen, int flags)
1da177e4
LT
1430{
1431 struct socket *sock, *newsock;
39d8c1b6 1432 struct file *newfile;
6cb153ca 1433 int err, len, newfd, fput_needed;
230b1839 1434 struct sockaddr_storage address;
1da177e4 1435
77d27200 1436 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1437 return -EINVAL;
1438
1439 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1440 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1441
6cb153ca 1442 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1443 if (!sock)
1444 goto out;
1445
1446 err = -ENFILE;
89bddce5 1447 if (!(newsock = sock_alloc()))
1da177e4
LT
1448 goto out_put;
1449
1450 newsock->type = sock->type;
1451 newsock->ops = sock->ops;
1452
1da177e4
LT
1453 /*
1454 * We don't need try_module_get here, as the listening socket (sock)
1455 * has the protocol module (sock->ops->owner) held.
1456 */
1457 __module_get(newsock->ops->owner);
1458
aaca0bdc 1459 newfd = sock_alloc_fd(&newfile, flags & O_CLOEXEC);
39d8c1b6
DM
1460 if (unlikely(newfd < 0)) {
1461 err = newfd;
9a1875e6
DM
1462 sock_release(newsock);
1463 goto out_put;
39d8c1b6
DM
1464 }
1465
77d27200 1466 err = sock_attach_fd(newsock, newfile, flags & O_NONBLOCK);
39d8c1b6 1467 if (err < 0)
79f4f642 1468 goto out_fd_simple;
39d8c1b6 1469
a79af59e
FF
1470 err = security_socket_accept(sock, newsock);
1471 if (err)
39d8c1b6 1472 goto out_fd;
a79af59e 1473
1da177e4
LT
1474 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1475 if (err < 0)
39d8c1b6 1476 goto out_fd;
1da177e4
LT
1477
1478 if (upeer_sockaddr) {
230b1839 1479 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1480 &len, 2) < 0) {
1da177e4 1481 err = -ECONNABORTED;
39d8c1b6 1482 goto out_fd;
1da177e4 1483 }
230b1839
YH
1484 err = move_addr_to_user((struct sockaddr *)&address,
1485 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1486 if (err < 0)
39d8c1b6 1487 goto out_fd;
1da177e4
LT
1488 }
1489
1490 /* File flags are not inherited via accept() unlike another OSes. */
1491
39d8c1b6
DM
1492 fd_install(newfd, newfile);
1493 err = newfd;
1da177e4
LT
1494
1495 security_socket_post_accept(sock, newsock);
1496
1497out_put:
6cb153ca 1498 fput_light(sock->file, fput_needed);
1da177e4
LT
1499out:
1500 return err;
79f4f642
AD
1501out_fd_simple:
1502 sock_release(newsock);
1503 put_filp(newfile);
1504 put_unused_fd(newfd);
1505 goto out_put;
39d8c1b6 1506out_fd:
9606a216 1507 fput(newfile);
39d8c1b6 1508 put_unused_fd(newfd);
1da177e4
LT
1509 goto out_put;
1510}
1511
aaca0bdc
UD
1512asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
1513 int __user *upeer_addrlen)
1514{
de11defe 1515 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1516}
1517
1da177e4
LT
1518/*
1519 * Attempt to connect to a socket with the server address. The address
1520 * is in user space so we verify it is OK and move it to kernel space.
1521 *
1522 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1523 * break bindings
1524 *
1525 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1526 * other SEQPACKET protocols that take time to connect() as it doesn't
1527 * include the -EINPROGRESS status for such sockets.
1528 */
1529
89bddce5
SH
1530asmlinkage long sys_connect(int fd, struct sockaddr __user *uservaddr,
1531 int addrlen)
1da177e4
LT
1532{
1533 struct socket *sock;
230b1839 1534 struct sockaddr_storage address;
6cb153ca 1535 int err, fput_needed;
1da177e4 1536
6cb153ca 1537 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1538 if (!sock)
1539 goto out;
230b1839 1540 err = move_addr_to_kernel(uservaddr, addrlen, (struct sockaddr *)&address);
1da177e4
LT
1541 if (err < 0)
1542 goto out_put;
1543
89bddce5 1544 err =
230b1839 1545 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1546 if (err)
1547 goto out_put;
1548
230b1839 1549 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1550 sock->file->f_flags);
1551out_put:
6cb153ca 1552 fput_light(sock->file, fput_needed);
1da177e4
LT
1553out:
1554 return err;
1555}
1556
1557/*
1558 * Get the local address ('name') of a socket object. Move the obtained
1559 * name to user space.
1560 */
1561
89bddce5
SH
1562asmlinkage long sys_getsockname(int fd, struct sockaddr __user *usockaddr,
1563 int __user *usockaddr_len)
1da177e4
LT
1564{
1565 struct socket *sock;
230b1839 1566 struct sockaddr_storage address;
6cb153ca 1567 int len, err, fput_needed;
89bddce5 1568
6cb153ca 1569 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1570 if (!sock)
1571 goto out;
1572
1573 err = security_socket_getsockname(sock);
1574 if (err)
1575 goto out_put;
1576
230b1839 1577 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1578 if (err)
1579 goto out_put;
230b1839 1580 err = move_addr_to_user((struct sockaddr *)&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1581
1582out_put:
6cb153ca 1583 fput_light(sock->file, fput_needed);
1da177e4
LT
1584out:
1585 return err;
1586}
1587
1588/*
1589 * Get the remote address ('name') of a socket object. Move the obtained
1590 * name to user space.
1591 */
1592
89bddce5
SH
1593asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
1594 int __user *usockaddr_len)
1da177e4
LT
1595{
1596 struct socket *sock;
230b1839 1597 struct sockaddr_storage address;
6cb153ca 1598 int len, err, fput_needed;
1da177e4 1599
89bddce5
SH
1600 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1601 if (sock != NULL) {
1da177e4
LT
1602 err = security_socket_getpeername(sock);
1603 if (err) {
6cb153ca 1604 fput_light(sock->file, fput_needed);
1da177e4
LT
1605 return err;
1606 }
1607
89bddce5 1608 err =
230b1839 1609 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1610 1);
1da177e4 1611 if (!err)
230b1839 1612 err = move_addr_to_user((struct sockaddr *)&address, len, usockaddr,
89bddce5 1613 usockaddr_len);
6cb153ca 1614 fput_light(sock->file, fput_needed);
1da177e4
LT
1615 }
1616 return err;
1617}
1618
1619/*
1620 * Send a datagram to a given address. We move the address into kernel
1621 * space and check the user space data area is readable before invoking
1622 * the protocol.
1623 */
1624
89bddce5
SH
1625asmlinkage long sys_sendto(int fd, void __user *buff, size_t len,
1626 unsigned flags, struct sockaddr __user *addr,
1627 int addr_len)
1da177e4
LT
1628{
1629 struct socket *sock;
230b1839 1630 struct sockaddr_storage address;
1da177e4
LT
1631 int err;
1632 struct msghdr msg;
1633 struct iovec iov;
6cb153ca 1634 int fput_needed;
6cb153ca 1635
de0fa95c
PE
1636 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1637 if (!sock)
4387ff75 1638 goto out;
6cb153ca 1639
89bddce5
SH
1640 iov.iov_base = buff;
1641 iov.iov_len = len;
1642 msg.msg_name = NULL;
1643 msg.msg_iov = &iov;
1644 msg.msg_iovlen = 1;
1645 msg.msg_control = NULL;
1646 msg.msg_controllen = 0;
1647 msg.msg_namelen = 0;
6cb153ca 1648 if (addr) {
230b1839 1649 err = move_addr_to_kernel(addr, addr_len, (struct sockaddr *)&address);
1da177e4
LT
1650 if (err < 0)
1651 goto out_put;
230b1839 1652 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1653 msg.msg_namelen = addr_len;
1da177e4
LT
1654 }
1655 if (sock->file->f_flags & O_NONBLOCK)
1656 flags |= MSG_DONTWAIT;
1657 msg.msg_flags = flags;
1658 err = sock_sendmsg(sock, &msg, len);
1659
89bddce5 1660out_put:
de0fa95c 1661 fput_light(sock->file, fput_needed);
4387ff75 1662out:
1da177e4
LT
1663 return err;
1664}
1665
1666/*
89bddce5 1667 * Send a datagram down a socket.
1da177e4
LT
1668 */
1669
89bddce5 1670asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
1da177e4
LT
1671{
1672 return sys_sendto(fd, buff, len, flags, NULL, 0);
1673}
1674
1675/*
89bddce5 1676 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1677 * sender. We verify the buffers are writable and if needed move the
1678 * sender address from kernel to user space.
1679 */
1680
89bddce5
SH
1681asmlinkage long sys_recvfrom(int fd, void __user *ubuf, size_t size,
1682 unsigned flags, struct sockaddr __user *addr,
1683 int __user *addr_len)
1da177e4
LT
1684{
1685 struct socket *sock;
1686 struct iovec iov;
1687 struct msghdr msg;
230b1839 1688 struct sockaddr_storage address;
89bddce5 1689 int err, err2;
6cb153ca
BL
1690 int fput_needed;
1691
de0fa95c 1692 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1693 if (!sock)
de0fa95c 1694 goto out;
1da177e4 1695
89bddce5
SH
1696 msg.msg_control = NULL;
1697 msg.msg_controllen = 0;
1698 msg.msg_iovlen = 1;
1699 msg.msg_iov = &iov;
1700 iov.iov_len = size;
1701 iov.iov_base = ubuf;
230b1839
YH
1702 msg.msg_name = (struct sockaddr *)&address;
1703 msg.msg_namelen = sizeof(address);
1da177e4
LT
1704 if (sock->file->f_flags & O_NONBLOCK)
1705 flags |= MSG_DONTWAIT;
89bddce5 1706 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1707
89bddce5 1708 if (err >= 0 && addr != NULL) {
230b1839
YH
1709 err2 = move_addr_to_user((struct sockaddr *)&address,
1710 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1711 if (err2 < 0)
1712 err = err2;
1da177e4 1713 }
de0fa95c
PE
1714
1715 fput_light(sock->file, fput_needed);
4387ff75 1716out:
1da177e4
LT
1717 return err;
1718}
1719
1720/*
89bddce5 1721 * Receive a datagram from a socket.
1da177e4
LT
1722 */
1723
89bddce5
SH
1724asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
1725 unsigned flags)
1da177e4
LT
1726{
1727 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1728}
1729
1730/*
1731 * Set a socket option. Because we don't know the option lengths we have
1732 * to pass the user mode parameter for the protocols to sort out.
1733 */
1734
89bddce5
SH
1735asmlinkage long sys_setsockopt(int fd, int level, int optname,
1736 char __user *optval, int optlen)
1da177e4 1737{
6cb153ca 1738 int err, fput_needed;
1da177e4
LT
1739 struct socket *sock;
1740
1741 if (optlen < 0)
1742 return -EINVAL;
89bddce5
SH
1743
1744 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1745 if (sock != NULL) {
1746 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1747 if (err)
1748 goto out_put;
1da177e4
LT
1749
1750 if (level == SOL_SOCKET)
89bddce5
SH
1751 err =
1752 sock_setsockopt(sock, level, optname, optval,
1753 optlen);
1da177e4 1754 else
89bddce5
SH
1755 err =
1756 sock->ops->setsockopt(sock, level, optname, optval,
1757 optlen);
6cb153ca
BL
1758out_put:
1759 fput_light(sock->file, fput_needed);
1da177e4
LT
1760 }
1761 return err;
1762}
1763
1764/*
1765 * Get a socket option. Because we don't know the option lengths we have
1766 * to pass a user mode parameter for the protocols to sort out.
1767 */
1768
89bddce5
SH
1769asmlinkage long sys_getsockopt(int fd, int level, int optname,
1770 char __user *optval, int __user *optlen)
1da177e4 1771{
6cb153ca 1772 int err, fput_needed;
1da177e4
LT
1773 struct socket *sock;
1774
89bddce5
SH
1775 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1776 if (sock != NULL) {
6cb153ca
BL
1777 err = security_socket_getsockopt(sock, level, optname);
1778 if (err)
1779 goto out_put;
1da177e4
LT
1780
1781 if (level == SOL_SOCKET)
89bddce5
SH
1782 err =
1783 sock_getsockopt(sock, level, optname, optval,
1784 optlen);
1da177e4 1785 else
89bddce5
SH
1786 err =
1787 sock->ops->getsockopt(sock, level, optname, optval,
1788 optlen);
6cb153ca
BL
1789out_put:
1790 fput_light(sock->file, fput_needed);
1da177e4
LT
1791 }
1792 return err;
1793}
1794
1da177e4
LT
1795/*
1796 * Shutdown a socket.
1797 */
1798
1799asmlinkage long sys_shutdown(int fd, int how)
1800{
6cb153ca 1801 int err, fput_needed;
1da177e4
LT
1802 struct socket *sock;
1803
89bddce5
SH
1804 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1805 if (sock != NULL) {
1da177e4 1806 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1807 if (!err)
1808 err = sock->ops->shutdown(sock, how);
1809 fput_light(sock->file, fput_needed);
1da177e4
LT
1810 }
1811 return err;
1812}
1813
89bddce5 1814/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1815 * fields which are the same type (int / unsigned) on our platforms.
1816 */
1817#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1818#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1819#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1820
1da177e4
LT
1821/*
1822 * BSD sendmsg interface
1823 */
1824
1825asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
1826{
89bddce5
SH
1827 struct compat_msghdr __user *msg_compat =
1828 (struct compat_msghdr __user *)msg;
1da177e4 1829 struct socket *sock;
230b1839 1830 struct sockaddr_storage address;
1da177e4 1831 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1832 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1833 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1834 /* 20 is size of ipv6_pktinfo */
1da177e4
LT
1835 unsigned char *ctl_buf = ctl;
1836 struct msghdr msg_sys;
1837 int err, ctl_len, iov_size, total_len;
6cb153ca 1838 int fput_needed;
89bddce5 1839
1da177e4
LT
1840 err = -EFAULT;
1841 if (MSG_CMSG_COMPAT & flags) {
1842 if (get_compat_msghdr(&msg_sys, msg_compat))
1843 return -EFAULT;
89bddce5
SH
1844 }
1845 else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))
1da177e4
LT
1846 return -EFAULT;
1847
6cb153ca 1848 sock = sockfd_lookup_light(fd, &err, &fput_needed);
89bddce5 1849 if (!sock)
1da177e4
LT
1850 goto out;
1851
1852 /* do not move before msg_sys is valid */
1853 err = -EMSGSIZE;
1854 if (msg_sys.msg_iovlen > UIO_MAXIOV)
1855 goto out_put;
1856
89bddce5 1857 /* Check whether to allocate the iovec area */
1da177e4
LT
1858 err = -ENOMEM;
1859 iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
1860 if (msg_sys.msg_iovlen > UIO_FASTIOV) {
1861 iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
1862 if (!iov)
1863 goto out_put;
1864 }
1865
1866 /* This will also move the address data into kernel space */
1867 if (MSG_CMSG_COMPAT & flags) {
230b1839
YH
1868 err = verify_compat_iovec(&msg_sys, iov,
1869 (struct sockaddr *)&address,
1870 VERIFY_READ);
1da177e4 1871 } else
230b1839
YH
1872 err = verify_iovec(&msg_sys, iov,
1873 (struct sockaddr *)&address,
1874 VERIFY_READ);
89bddce5 1875 if (err < 0)
1da177e4
LT
1876 goto out_freeiov;
1877 total_len = err;
1878
1879 err = -ENOBUFS;
1880
1881 if (msg_sys.msg_controllen > INT_MAX)
1882 goto out_freeiov;
89bddce5 1883 ctl_len = msg_sys.msg_controllen;
1da177e4 1884 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5
SH
1885 err =
1886 cmsghdr_from_user_compat_to_kern(&msg_sys, sock->sk, ctl,
1887 sizeof(ctl));
1da177e4
LT
1888 if (err)
1889 goto out_freeiov;
1890 ctl_buf = msg_sys.msg_control;
8920e8f9 1891 ctl_len = msg_sys.msg_controllen;
1da177e4 1892 } else if (ctl_len) {
89bddce5 1893 if (ctl_len > sizeof(ctl)) {
1da177e4 1894 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 1895 if (ctl_buf == NULL)
1da177e4
LT
1896 goto out_freeiov;
1897 }
1898 err = -EFAULT;
1899 /*
1900 * Careful! Before this, msg_sys.msg_control contains a user pointer.
1901 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1902 * checking falls down on this.
1903 */
89bddce5
SH
1904 if (copy_from_user(ctl_buf, (void __user *)msg_sys.msg_control,
1905 ctl_len))
1da177e4
LT
1906 goto out_freectl;
1907 msg_sys.msg_control = ctl_buf;
1908 }
1909 msg_sys.msg_flags = flags;
1910
1911 if (sock->file->f_flags & O_NONBLOCK)
1912 msg_sys.msg_flags |= MSG_DONTWAIT;
1913 err = sock_sendmsg(sock, &msg_sys, total_len);
1914
1915out_freectl:
89bddce5 1916 if (ctl_buf != ctl)
1da177e4
LT
1917 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1918out_freeiov:
1919 if (iov != iovstack)
1920 sock_kfree_s(sock->sk, iov, iov_size);
1921out_put:
6cb153ca 1922 fput_light(sock->file, fput_needed);
89bddce5 1923out:
1da177e4
LT
1924 return err;
1925}
1926
1927/*
1928 * BSD recvmsg interface
1929 */
1930
89bddce5
SH
1931asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg,
1932 unsigned int flags)
1da177e4 1933{
89bddce5
SH
1934 struct compat_msghdr __user *msg_compat =
1935 (struct compat_msghdr __user *)msg;
1da177e4
LT
1936 struct socket *sock;
1937 struct iovec iovstack[UIO_FASTIOV];
89bddce5 1938 struct iovec *iov = iovstack;
1da177e4
LT
1939 struct msghdr msg_sys;
1940 unsigned long cmsg_ptr;
1941 int err, iov_size, total_len, len;
6cb153ca 1942 int fput_needed;
1da177e4
LT
1943
1944 /* kernel mode address */
230b1839 1945 struct sockaddr_storage addr;
1da177e4
LT
1946
1947 /* user mode address pointers */
1948 struct sockaddr __user *uaddr;
1949 int __user *uaddr_len;
89bddce5 1950
1da177e4
LT
1951 if (MSG_CMSG_COMPAT & flags) {
1952 if (get_compat_msghdr(&msg_sys, msg_compat))
1953 return -EFAULT;
89bddce5
SH
1954 }
1955 else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))
1956 return -EFAULT;
1da177e4 1957
6cb153ca 1958 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1959 if (!sock)
1960 goto out;
1961
1962 err = -EMSGSIZE;
1963 if (msg_sys.msg_iovlen > UIO_MAXIOV)
1964 goto out_put;
89bddce5
SH
1965
1966 /* Check whether to allocate the iovec area */
1da177e4
LT
1967 err = -ENOMEM;
1968 iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
1969 if (msg_sys.msg_iovlen > UIO_FASTIOV) {
1970 iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
1971 if (!iov)
1972 goto out_put;
1973 }
1974
1975 /*
89bddce5
SH
1976 * Save the user-mode address (verify_iovec will change the
1977 * kernel msghdr to use the kernel address space)
1da177e4 1978 */
89bddce5 1979
cfcabdcc 1980 uaddr = (__force void __user *)msg_sys.msg_name;
1da177e4
LT
1981 uaddr_len = COMPAT_NAMELEN(msg);
1982 if (MSG_CMSG_COMPAT & flags) {
230b1839
YH
1983 err = verify_compat_iovec(&msg_sys, iov,
1984 (struct sockaddr *)&addr,
1985 VERIFY_WRITE);
1da177e4 1986 } else
230b1839
YH
1987 err = verify_iovec(&msg_sys, iov,
1988 (struct sockaddr *)&addr,
1989 VERIFY_WRITE);
1da177e4
LT
1990 if (err < 0)
1991 goto out_freeiov;
89bddce5 1992 total_len = err;
1da177e4
LT
1993
1994 cmsg_ptr = (unsigned long)msg_sys.msg_control;
4a19542e 1995 msg_sys.msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 1996
1da177e4
LT
1997 if (sock->file->f_flags & O_NONBLOCK)
1998 flags |= MSG_DONTWAIT;
1999 err = sock_recvmsg(sock, &msg_sys, total_len, flags);
2000 if (err < 0)
2001 goto out_freeiov;
2002 len = err;
2003
2004 if (uaddr != NULL) {
230b1839
YH
2005 err = move_addr_to_user((struct sockaddr *)&addr,
2006 msg_sys.msg_namelen, uaddr,
89bddce5 2007 uaddr_len);
1da177e4
LT
2008 if (err < 0)
2009 goto out_freeiov;
2010 }
37f7f421
DM
2011 err = __put_user((msg_sys.msg_flags & ~MSG_CMSG_COMPAT),
2012 COMPAT_FLAGS(msg));
1da177e4
LT
2013 if (err)
2014 goto out_freeiov;
2015 if (MSG_CMSG_COMPAT & flags)
89bddce5 2016 err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
1da177e4
LT
2017 &msg_compat->msg_controllen);
2018 else
89bddce5 2019 err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
1da177e4
LT
2020 &msg->msg_controllen);
2021 if (err)
2022 goto out_freeiov;
2023 err = len;
2024
2025out_freeiov:
2026 if (iov != iovstack)
2027 sock_kfree_s(sock->sk, iov, iov_size);
2028out_put:
6cb153ca 2029 fput_light(sock->file, fput_needed);
1da177e4
LT
2030out:
2031 return err;
2032}
2033
2034#ifdef __ARCH_WANT_SYS_SOCKETCALL
2035
2036/* Argument list sizes for sys_socketcall */
2037#define AL(x) ((x) * sizeof(unsigned long))
aaca0bdc 2038static const unsigned char nargs[19]={
89bddce5
SH
2039 AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
2040 AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
aaca0bdc 2041 AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
de11defe 2042 AL(4)
89bddce5
SH
2043};
2044
1da177e4
LT
2045#undef AL
2046
2047/*
89bddce5 2048 * System call vectors.
1da177e4
LT
2049 *
2050 * Argument checking cleaned up. Saved 20% in size.
2051 * This function doesn't need to set the kernel lock because
89bddce5 2052 * it is set by the callees.
1da177e4
LT
2053 */
2054
2055asmlinkage long sys_socketcall(int call, unsigned long __user *args)
2056{
2057 unsigned long a[6];
89bddce5 2058 unsigned long a0, a1;
1da177e4
LT
2059 int err;
2060
de11defe 2061 if (call < 1 || call > SYS_ACCEPT4)
1da177e4
LT
2062 return -EINVAL;
2063
2064 /* copy_from_user should be SMP safe. */
2065 if (copy_from_user(a, args, nargs[call]))
2066 return -EFAULT;
3ec3b2fb 2067
f3298dc4 2068 audit_socketcall(nargs[call] / sizeof(unsigned long), a);
3ec3b2fb 2069
89bddce5
SH
2070 a0 = a[0];
2071 a1 = a[1];
2072
2073 switch (call) {
2074 case SYS_SOCKET:
2075 err = sys_socket(a0, a1, a[2]);
2076 break;
2077 case SYS_BIND:
2078 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2079 break;
2080 case SYS_CONNECT:
2081 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2082 break;
2083 case SYS_LISTEN:
2084 err = sys_listen(a0, a1);
2085 break;
2086 case SYS_ACCEPT:
de11defe
UD
2087 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2088 (int __user *)a[2], 0);
89bddce5
SH
2089 break;
2090 case SYS_GETSOCKNAME:
2091 err =
2092 sys_getsockname(a0, (struct sockaddr __user *)a1,
2093 (int __user *)a[2]);
2094 break;
2095 case SYS_GETPEERNAME:
2096 err =
2097 sys_getpeername(a0, (struct sockaddr __user *)a1,
2098 (int __user *)a[2]);
2099 break;
2100 case SYS_SOCKETPAIR:
2101 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2102 break;
2103 case SYS_SEND:
2104 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2105 break;
2106 case SYS_SENDTO:
2107 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2108 (struct sockaddr __user *)a[4], a[5]);
2109 break;
2110 case SYS_RECV:
2111 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2112 break;
2113 case SYS_RECVFROM:
2114 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2115 (struct sockaddr __user *)a[4],
2116 (int __user *)a[5]);
2117 break;
2118 case SYS_SHUTDOWN:
2119 err = sys_shutdown(a0, a1);
2120 break;
2121 case SYS_SETSOCKOPT:
2122 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2123 break;
2124 case SYS_GETSOCKOPT:
2125 err =
2126 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2127 (int __user *)a[4]);
2128 break;
2129 case SYS_SENDMSG:
2130 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2131 break;
2132 case SYS_RECVMSG:
2133 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2134 break;
de11defe
UD
2135 case SYS_ACCEPT4:
2136 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2137 (int __user *)a[2], a[3]);
aaca0bdc 2138 break;
89bddce5
SH
2139 default:
2140 err = -EINVAL;
2141 break;
1da177e4
LT
2142 }
2143 return err;
2144}
2145
89bddce5 2146#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2147
55737fda
SH
2148/**
2149 * sock_register - add a socket protocol handler
2150 * @ops: description of protocol
2151 *
1da177e4
LT
2152 * This function is called by a protocol handler that wants to
2153 * advertise its address family, and have it linked into the
55737fda
SH
2154 * socket interface. The value ops->family coresponds to the
2155 * socket system call protocol family.
1da177e4 2156 */
f0fd27d4 2157int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2158{
2159 int err;
2160
2161 if (ops->family >= NPROTO) {
89bddce5
SH
2162 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2163 NPROTO);
1da177e4
LT
2164 return -ENOBUFS;
2165 }
55737fda
SH
2166
2167 spin_lock(&net_family_lock);
2168 if (net_families[ops->family])
2169 err = -EEXIST;
2170 else {
89bddce5 2171 net_families[ops->family] = ops;
1da177e4
LT
2172 err = 0;
2173 }
55737fda
SH
2174 spin_unlock(&net_family_lock);
2175
89bddce5 2176 printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2177 return err;
2178}
2179
55737fda
SH
2180/**
2181 * sock_unregister - remove a protocol handler
2182 * @family: protocol family to remove
2183 *
1da177e4
LT
2184 * This function is called by a protocol handler that wants to
2185 * remove its address family, and have it unlinked from the
55737fda
SH
2186 * new socket creation.
2187 *
2188 * If protocol handler is a module, then it can use module reference
2189 * counts to protect against new references. If protocol handler is not
2190 * a module then it needs to provide its own protection in
2191 * the ops->create routine.
1da177e4 2192 */
f0fd27d4 2193void sock_unregister(int family)
1da177e4 2194{
f0fd27d4 2195 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2196
55737fda 2197 spin_lock(&net_family_lock);
89bddce5 2198 net_families[family] = NULL;
55737fda
SH
2199 spin_unlock(&net_family_lock);
2200
2201 synchronize_rcu();
2202
89bddce5 2203 printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
1da177e4
LT
2204}
2205
77d76ea3 2206static int __init sock_init(void)
1da177e4
LT
2207{
2208 /*
89bddce5 2209 * Initialize sock SLAB cache.
1da177e4 2210 */
89bddce5 2211
1da177e4
LT
2212 sk_init();
2213
1da177e4 2214 /*
89bddce5 2215 * Initialize skbuff SLAB cache
1da177e4
LT
2216 */
2217 skb_init();
1da177e4
LT
2218
2219 /*
89bddce5 2220 * Initialize the protocols module.
1da177e4
LT
2221 */
2222
2223 init_inodecache();
2224 register_filesystem(&sock_fs_type);
2225 sock_mnt = kern_mount(&sock_fs_type);
77d76ea3
AK
2226
2227 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2228 */
2229
2230#ifdef CONFIG_NETFILTER
2231 netfilter_init();
2232#endif
cbeb321a
DM
2233
2234 return 0;
1da177e4
LT
2235}
2236
77d76ea3
AK
2237core_initcall(sock_init); /* early initcall */
2238
1da177e4
LT
2239#ifdef CONFIG_PROC_FS
2240void socket_seq_show(struct seq_file *seq)
2241{
2242 int cpu;
2243 int counter = 0;
2244
6f912042 2245 for_each_possible_cpu(cpu)
89bddce5 2246 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2247
2248 /* It can be negative, by the way. 8) */
2249 if (counter < 0)
2250 counter = 0;
2251
2252 seq_printf(seq, "sockets: used %d\n", counter);
2253}
89bddce5 2254#endif /* CONFIG_PROC_FS */
1da177e4 2255
89bbfc95
SP
2256#ifdef CONFIG_COMPAT
2257static long compat_sock_ioctl(struct file *file, unsigned cmd,
89bddce5 2258 unsigned long arg)
89bbfc95
SP
2259{
2260 struct socket *sock = file->private_data;
2261 int ret = -ENOIOCTLCMD;
87de87d5
DM
2262 struct sock *sk;
2263 struct net *net;
2264
2265 sk = sock->sk;
2266 net = sock_net(sk);
89bbfc95
SP
2267
2268 if (sock->ops->compat_ioctl)
2269 ret = sock->ops->compat_ioctl(sock, cmd, arg);
2270
87de87d5
DM
2271 if (ret == -ENOIOCTLCMD &&
2272 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
2273 ret = compat_wext_handle_ioctl(net, cmd, arg);
2274
89bbfc95
SP
2275 return ret;
2276}
2277#endif
2278
ac5a488e
SS
2279int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
2280{
2281 return sock->ops->bind(sock, addr, addrlen);
2282}
2283
2284int kernel_listen(struct socket *sock, int backlog)
2285{
2286 return sock->ops->listen(sock, backlog);
2287}
2288
2289int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
2290{
2291 struct sock *sk = sock->sk;
2292 int err;
2293
2294 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
2295 newsock);
2296 if (err < 0)
2297 goto done;
2298
2299 err = sock->ops->accept(sock, *newsock, flags);
2300 if (err < 0) {
2301 sock_release(*newsock);
fa8705b0 2302 *newsock = NULL;
ac5a488e
SS
2303 goto done;
2304 }
2305
2306 (*newsock)->ops = sock->ops;
1b08534e 2307 __module_get((*newsock)->ops->owner);
ac5a488e
SS
2308
2309done:
2310 return err;
2311}
2312
2313int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 2314 int flags)
ac5a488e
SS
2315{
2316 return sock->ops->connect(sock, addr, addrlen, flags);
2317}
2318
2319int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
2320 int *addrlen)
2321{
2322 return sock->ops->getname(sock, addr, addrlen, 0);
2323}
2324
2325int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
2326 int *addrlen)
2327{
2328 return sock->ops->getname(sock, addr, addrlen, 1);
2329}
2330
2331int kernel_getsockopt(struct socket *sock, int level, int optname,
2332 char *optval, int *optlen)
2333{
2334 mm_segment_t oldfs = get_fs();
2335 int err;
2336
2337 set_fs(KERNEL_DS);
2338 if (level == SOL_SOCKET)
2339 err = sock_getsockopt(sock, level, optname, optval, optlen);
2340 else
2341 err = sock->ops->getsockopt(sock, level, optname, optval,
2342 optlen);
2343 set_fs(oldfs);
2344 return err;
2345}
2346
2347int kernel_setsockopt(struct socket *sock, int level, int optname,
2348 char *optval, int optlen)
2349{
2350 mm_segment_t oldfs = get_fs();
2351 int err;
2352
2353 set_fs(KERNEL_DS);
2354 if (level == SOL_SOCKET)
2355 err = sock_setsockopt(sock, level, optname, optval, optlen);
2356 else
2357 err = sock->ops->setsockopt(sock, level, optname, optval,
2358 optlen);
2359 set_fs(oldfs);
2360 return err;
2361}
2362
2363int kernel_sendpage(struct socket *sock, struct page *page, int offset,
2364 size_t size, int flags)
2365{
2366 if (sock->ops->sendpage)
2367 return sock->ops->sendpage(sock, page, offset, size, flags);
2368
2369 return sock_no_sendpage(sock, page, offset, size, flags);
2370}
2371
2372int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
2373{
2374 mm_segment_t oldfs = get_fs();
2375 int err;
2376
2377 set_fs(KERNEL_DS);
2378 err = sock->ops->ioctl(sock, cmd, arg);
2379 set_fs(oldfs);
2380
2381 return err;
2382}
2383
91cf45f0
TM
2384int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
2385{
2386 return sock->ops->shutdown(sock, how);
2387}
2388
1da177e4
LT
2389EXPORT_SYMBOL(sock_create);
2390EXPORT_SYMBOL(sock_create_kern);
2391EXPORT_SYMBOL(sock_create_lite);
2392EXPORT_SYMBOL(sock_map_fd);
2393EXPORT_SYMBOL(sock_recvmsg);
2394EXPORT_SYMBOL(sock_register);
2395EXPORT_SYMBOL(sock_release);
2396EXPORT_SYMBOL(sock_sendmsg);
2397EXPORT_SYMBOL(sock_unregister);
2398EXPORT_SYMBOL(sock_wake_async);
2399EXPORT_SYMBOL(sockfd_lookup);
2400EXPORT_SYMBOL(kernel_sendmsg);
2401EXPORT_SYMBOL(kernel_recvmsg);
ac5a488e
SS
2402EXPORT_SYMBOL(kernel_bind);
2403EXPORT_SYMBOL(kernel_listen);
2404EXPORT_SYMBOL(kernel_accept);
2405EXPORT_SYMBOL(kernel_connect);
2406EXPORT_SYMBOL(kernel_getsockname);
2407EXPORT_SYMBOL(kernel_getpeername);
2408EXPORT_SYMBOL(kernel_getsockopt);
2409EXPORT_SYMBOL(kernel_setsockopt);
2410EXPORT_SYMBOL(kernel_sendpage);
2411EXPORT_SYMBOL(kernel_sock_ioctl);
91cf45f0 2412EXPORT_SYMBOL(kernel_sock_shutdown);