net/compat: Merge multiple implementations of ifreq::ifr_data conversion
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
1da177e4
LT
75#include <linux/init.h>
76#include <linux/poll.h>
77#include <linux/cache.h>
78#include <linux/module.h>
79#include <linux/highmem.h>
1da177e4
LT
80#include <linux/mount.h>
81#include <linux/security.h>
82#include <linux/syscalls.h>
83#include <linux/compat.h>
84#include <linux/kmod.h>
3ec3b2fb 85#include <linux/audit.h>
d86b5e0e 86#include <linux/wireless.h>
1b8d7ae4 87#include <linux/nsproxy.h>
1fd7317d 88#include <linux/magic.h>
5a0e3ad6 89#include <linux/slab.h>
600e1779 90#include <linux/xattr.h>
1da177e4
LT
91
92#include <asm/uaccess.h>
93#include <asm/unistd.h>
94
95#include <net/compat.h>
87de87d5 96#include <net/wext.h>
f8451725 97#include <net/cls_cgroup.h>
1da177e4
LT
98
99#include <net/sock.h>
100#include <linux/netfilter.h>
101
6b96018b
AB
102#include <linux/if_tun.h>
103#include <linux/ipv6_route.h>
104#include <linux/route.h>
6b96018b
AB
105#include <linux/sockios.h>
106#include <linux/atalk.h>
076bb0c8 107#include <net/busy_poll.h>
06021292 108
e0d1095a 109#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
110unsigned int sysctl_net_busy_read __read_mostly;
111unsigned int sysctl_net_busy_poll __read_mostly;
06021292 112#endif
6b96018b 113
1da177e4 114static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
115static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
116 unsigned long nr_segs, loff_t pos);
117static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
118 unsigned long nr_segs, loff_t pos);
89bddce5 119static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
120
121static int sock_close(struct inode *inode, struct file *file);
122static unsigned int sock_poll(struct file *file,
123 struct poll_table_struct *wait);
89bddce5 124static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
125#ifdef CONFIG_COMPAT
126static long compat_sock_ioctl(struct file *file,
89bddce5 127 unsigned int cmd, unsigned long arg);
89bbfc95 128#endif
1da177e4 129static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
130static ssize_t sock_sendpage(struct file *file, struct page *page,
131 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 132static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 133 struct pipe_inode_info *pipe, size_t len,
9c55e01c 134 unsigned int flags);
1da177e4 135
1da177e4
LT
136/*
137 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
138 * in the operation structures but are done directly via the socketcall() multiplexor.
139 */
140
da7071d7 141static const struct file_operations socket_file_ops = {
1da177e4
LT
142 .owner = THIS_MODULE,
143 .llseek = no_llseek,
144 .aio_read = sock_aio_read,
145 .aio_write = sock_aio_write,
146 .poll = sock_poll,
147 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
148#ifdef CONFIG_COMPAT
149 .compat_ioctl = compat_sock_ioctl,
150#endif
1da177e4
LT
151 .mmap = sock_mmap,
152 .open = sock_no_open, /* special open code to disallow open via /proc */
153 .release = sock_close,
154 .fasync = sock_fasync,
5274f052
JA
155 .sendpage = sock_sendpage,
156 .splice_write = generic_splice_sendpage,
9c55e01c 157 .splice_read = sock_splice_read,
1da177e4
LT
158};
159
160/*
161 * The protocol list. Each protocol is registered in here.
162 */
163
1da177e4 164static DEFINE_SPINLOCK(net_family_lock);
190683a9 165static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 166
1da177e4
LT
167/*
168 * Statistics counters of the socket lists
169 */
170
c6d409cf 171static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
172
173/*
89bddce5
SH
174 * Support routines.
175 * Move socket addresses back and forth across the kernel/user
176 * divide and look after the messy bits.
1da177e4
LT
177 */
178
1da177e4
LT
179/**
180 * move_addr_to_kernel - copy a socket address into kernel space
181 * @uaddr: Address in user space
182 * @kaddr: Address in kernel space
183 * @ulen: Length in user space
184 *
185 * The address is copied into kernel space. If the provided address is
186 * too long an error code of -EINVAL is returned. If the copy gives
187 * invalid addresses -EFAULT is returned. On a success 0 is returned.
188 */
189
43db362d 190int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 191{
230b1839 192 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 193 return -EINVAL;
89bddce5 194 if (ulen == 0)
1da177e4 195 return 0;
89bddce5 196 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 197 return -EFAULT;
3ec3b2fb 198 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
199}
200
201/**
202 * move_addr_to_user - copy an address to user space
203 * @kaddr: kernel space address
204 * @klen: length of address in kernel
205 * @uaddr: user space address
206 * @ulen: pointer to user length field
207 *
208 * The value pointed to by ulen on entry is the buffer length available.
209 * This is overwritten with the buffer space used. -EINVAL is returned
210 * if an overlong buffer is specified or a negative buffer size. -EFAULT
211 * is returned if either the buffer or the length field are not
212 * accessible.
213 * After copying the data up to the limit the user specifies, the true
214 * length of the data is written over the length limit the user
215 * specified. Zero is returned for a success.
216 */
89bddce5 217
43db362d 218static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 219 void __user *uaddr, int __user *ulen)
1da177e4
LT
220{
221 int err;
222 int len;
223
89bddce5
SH
224 err = get_user(len, ulen);
225 if (err)
1da177e4 226 return err;
89bddce5
SH
227 if (len > klen)
228 len = klen;
230b1839 229 if (len < 0 || len > sizeof(struct sockaddr_storage))
1da177e4 230 return -EINVAL;
89bddce5 231 if (len) {
d6fe3945
SG
232 if (audit_sockaddr(klen, kaddr))
233 return -ENOMEM;
89bddce5 234 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
235 return -EFAULT;
236 }
237 /*
89bddce5
SH
238 * "fromlen shall refer to the value before truncation.."
239 * 1003.1g
1da177e4
LT
240 */
241 return __put_user(klen, ulen);
242}
243
e18b890b 244static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
245
246static struct inode *sock_alloc_inode(struct super_block *sb)
247{
248 struct socket_alloc *ei;
eaefd110 249 struct socket_wq *wq;
89bddce5 250
e94b1766 251 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
252 if (!ei)
253 return NULL;
eaefd110
ED
254 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
255 if (!wq) {
43815482
ED
256 kmem_cache_free(sock_inode_cachep, ei);
257 return NULL;
258 }
eaefd110
ED
259 init_waitqueue_head(&wq->wait);
260 wq->fasync_list = NULL;
261 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 262
1da177e4
LT
263 ei->socket.state = SS_UNCONNECTED;
264 ei->socket.flags = 0;
265 ei->socket.ops = NULL;
266 ei->socket.sk = NULL;
267 ei->socket.file = NULL;
1da177e4
LT
268
269 return &ei->vfs_inode;
270}
271
272static void sock_destroy_inode(struct inode *inode)
273{
43815482 274 struct socket_alloc *ei;
eaefd110 275 struct socket_wq *wq;
43815482
ED
276
277 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 278 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 279 kfree_rcu(wq, rcu);
43815482 280 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
281}
282
51cc5068 283static void init_once(void *foo)
1da177e4 284{
89bddce5 285 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 286
a35afb83 287 inode_init_once(&ei->vfs_inode);
1da177e4 288}
89bddce5 289
1da177e4
LT
290static int init_inodecache(void)
291{
292 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
293 sizeof(struct socket_alloc),
294 0,
295 (SLAB_HWCACHE_ALIGN |
296 SLAB_RECLAIM_ACCOUNT |
297 SLAB_MEM_SPREAD),
20c2df83 298 init_once);
1da177e4
LT
299 if (sock_inode_cachep == NULL)
300 return -ENOMEM;
301 return 0;
302}
303
b87221de 304static const struct super_operations sockfs_ops = {
c6d409cf
ED
305 .alloc_inode = sock_alloc_inode,
306 .destroy_inode = sock_destroy_inode,
307 .statfs = simple_statfs,
1da177e4
LT
308};
309
c23fbb6b
ED
310/*
311 * sockfs_dname() is called from d_path().
312 */
313static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
314{
315 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
316 dentry->d_inode->i_ino);
317}
318
3ba13d17 319static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 320 .d_dname = sockfs_dname,
1da177e4
LT
321};
322
c74a1cbb
AV
323static struct dentry *sockfs_mount(struct file_system_type *fs_type,
324 int flags, const char *dev_name, void *data)
325{
326 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
327 &sockfs_dentry_operations, SOCKFS_MAGIC);
328}
329
330static struct vfsmount *sock_mnt __read_mostly;
331
332static struct file_system_type sock_fs_type = {
333 .name = "sockfs",
334 .mount = sockfs_mount,
335 .kill_sb = kill_anon_super,
336};
337
1da177e4
LT
338/*
339 * Obtains the first available file descriptor and sets it up for use.
340 *
39d8c1b6
DM
341 * These functions create file structures and maps them to fd space
342 * of the current process. On success it returns file descriptor
1da177e4
LT
343 * and file struct implicitly stored in sock->file.
344 * Note that another thread may close file descriptor before we return
345 * from this function. We use the fact that now we do not refer
346 * to socket after mapping. If one day we will need it, this
347 * function will increment ref. count on file by 1.
348 *
349 * In any case returned fd MAY BE not valid!
350 * This race condition is unavoidable
351 * with shared fd spaces, we cannot solve it inside kernel,
352 * but we take care of internal coherence yet.
353 */
354
aab174f0 355struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 356{
7cbe66b6 357 struct qstr name = { .name = "" };
2c48b9c4 358 struct path path;
7cbe66b6 359 struct file *file;
1da177e4 360
600e1779
MY
361 if (dname) {
362 name.name = dname;
363 name.len = strlen(name.name);
364 } else if (sock->sk) {
365 name.name = sock->sk->sk_prot_creator->name;
366 name.len = strlen(name.name);
367 }
4b936885 368 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
369 if (unlikely(!path.dentry))
370 return ERR_PTR(-ENOMEM);
2c48b9c4 371 path.mnt = mntget(sock_mnt);
39d8c1b6 372
2c48b9c4 373 d_instantiate(path.dentry, SOCK_INODE(sock));
cc3808f8 374 SOCK_INODE(sock)->i_fop = &socket_file_ops;
39d8c1b6 375
2c48b9c4 376 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 377 &socket_file_ops);
39b65252 378 if (unlikely(IS_ERR(file))) {
cc3808f8 379 /* drop dentry, keep inode */
7de9c6ee 380 ihold(path.dentry->d_inode);
2c48b9c4 381 path_put(&path);
39b65252 382 return file;
cc3808f8
AV
383 }
384
385 sock->file = file;
77d27200 386 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 387 file->private_data = sock;
28407630 388 return file;
39d8c1b6 389}
56b31d1c 390EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 391
56b31d1c 392static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
393{
394 struct file *newfile;
28407630
AV
395 int fd = get_unused_fd_flags(flags);
396 if (unlikely(fd < 0))
397 return fd;
39d8c1b6 398
aab174f0 399 newfile = sock_alloc_file(sock, flags, NULL);
28407630 400 if (likely(!IS_ERR(newfile))) {
39d8c1b6 401 fd_install(fd, newfile);
28407630
AV
402 return fd;
403 }
7cbe66b6 404
28407630
AV
405 put_unused_fd(fd);
406 return PTR_ERR(newfile);
1da177e4
LT
407}
408
406a3c63 409struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 410{
6cb153ca
BL
411 if (file->f_op == &socket_file_ops)
412 return file->private_data; /* set in sock_map_fd */
413
23bb80d2
ED
414 *err = -ENOTSOCK;
415 return NULL;
6cb153ca 416}
406a3c63 417EXPORT_SYMBOL(sock_from_file);
6cb153ca 418
1da177e4 419/**
c6d409cf 420 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
421 * @fd: file handle
422 * @err: pointer to an error code return
423 *
424 * The file handle passed in is locked and the socket it is bound
425 * too is returned. If an error occurs the err pointer is overwritten
426 * with a negative errno code and NULL is returned. The function checks
427 * for both invalid handles and passing a handle which is not a socket.
428 *
429 * On a success the socket object pointer is returned.
430 */
431
432struct socket *sockfd_lookup(int fd, int *err)
433{
434 struct file *file;
1da177e4
LT
435 struct socket *sock;
436
89bddce5
SH
437 file = fget(fd);
438 if (!file) {
1da177e4
LT
439 *err = -EBADF;
440 return NULL;
441 }
89bddce5 442
6cb153ca
BL
443 sock = sock_from_file(file, err);
444 if (!sock)
1da177e4 445 fput(file);
6cb153ca
BL
446 return sock;
447}
c6d409cf 448EXPORT_SYMBOL(sockfd_lookup);
1da177e4 449
6cb153ca
BL
450static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
451{
452 struct file *file;
453 struct socket *sock;
454
3672558c 455 *err = -EBADF;
6cb153ca
BL
456 file = fget_light(fd, fput_needed);
457 if (file) {
458 sock = sock_from_file(file, err);
459 if (sock)
460 return sock;
461 fput_light(file, *fput_needed);
1da177e4 462 }
6cb153ca 463 return NULL;
1da177e4
LT
464}
465
600e1779
MY
466#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
467#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
468#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
469static ssize_t sockfs_getxattr(struct dentry *dentry,
470 const char *name, void *value, size_t size)
471{
472 const char *proto_name;
473 size_t proto_size;
474 int error;
475
476 error = -ENODATA;
477 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
478 proto_name = dentry->d_name.name;
479 proto_size = strlen(proto_name);
480
481 if (value) {
482 error = -ERANGE;
483 if (proto_size + 1 > size)
484 goto out;
485
486 strncpy(value, proto_name, proto_size + 1);
487 }
488 error = proto_size + 1;
489 }
490
491out:
492 return error;
493}
494
495static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
496 size_t size)
497{
498 ssize_t len;
499 ssize_t used = 0;
500
501 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
502 if (len < 0)
503 return len;
504 used += len;
505 if (buffer) {
506 if (size < used)
507 return -ERANGE;
508 buffer += len;
509 }
510
511 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
512 used += len;
513 if (buffer) {
514 if (size < used)
515 return -ERANGE;
516 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
517 buffer += len;
518 }
519
520 return used;
521}
522
523static const struct inode_operations sockfs_inode_ops = {
524 .getxattr = sockfs_getxattr,
525 .listxattr = sockfs_listxattr,
526};
527
1da177e4
LT
528/**
529 * sock_alloc - allocate a socket
89bddce5 530 *
1da177e4
LT
531 * Allocate a new inode and socket object. The two are bound together
532 * and initialised. The socket is then returned. If we are out of inodes
533 * NULL is returned.
534 */
535
536static struct socket *sock_alloc(void)
537{
89bddce5
SH
538 struct inode *inode;
539 struct socket *sock;
1da177e4 540
a209dfc7 541 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
542 if (!inode)
543 return NULL;
544
545 sock = SOCKET_I(inode);
546
29a020d3 547 kmemcheck_annotate_bitfield(sock, type);
85fe4025 548 inode->i_ino = get_next_ino();
89bddce5 549 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
550 inode->i_uid = current_fsuid();
551 inode->i_gid = current_fsgid();
600e1779 552 inode->i_op = &sockfs_inode_ops;
1da177e4 553
19e8d69c 554 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
555 return sock;
556}
557
558/*
559 * In theory you can't get an open on this inode, but /proc provides
560 * a back door. Remember to keep it shut otherwise you'll let the
561 * creepy crawlies in.
562 */
89bddce5 563
1da177e4
LT
564static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
565{
566 return -ENXIO;
567}
568
4b6f5d20 569const struct file_operations bad_sock_fops = {
1da177e4
LT
570 .owner = THIS_MODULE,
571 .open = sock_no_open,
6038f373 572 .llseek = noop_llseek,
1da177e4
LT
573};
574
575/**
576 * sock_release - close a socket
577 * @sock: socket to close
578 *
579 * The socket is released from the protocol stack if it has a release
580 * callback, and the inode is then released if the socket is bound to
89bddce5 581 * an inode not a file.
1da177e4 582 */
89bddce5 583
1da177e4
LT
584void sock_release(struct socket *sock)
585{
586 if (sock->ops) {
587 struct module *owner = sock->ops->owner;
588
589 sock->ops->release(sock);
590 sock->ops = NULL;
591 module_put(owner);
592 }
593
eaefd110 594 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
1da177e4
LT
595 printk(KERN_ERR "sock_release: fasync list not empty!\n");
596
b09e786b
MP
597 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
598 return;
599
19e8d69c 600 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
601 if (!sock->file) {
602 iput(SOCK_INODE(sock));
603 return;
604 }
89bddce5 605 sock->file = NULL;
1da177e4 606}
c6d409cf 607EXPORT_SYMBOL(sock_release);
1da177e4 608
bf84a010 609void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
20d49473 610{
2244d07b 611 *tx_flags = 0;
20d49473 612 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
2244d07b 613 *tx_flags |= SKBTX_HW_TSTAMP;
20d49473 614 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
2244d07b 615 *tx_flags |= SKBTX_SW_TSTAMP;
6e3e939f
JB
616 if (sock_flag(sk, SOCK_WIFI_STATUS))
617 *tx_flags |= SKBTX_WIFI_STATUS;
20d49473
PO
618}
619EXPORT_SYMBOL(sock_tx_timestamp);
620
228e548e
AB
621static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
622 struct msghdr *msg, size_t size)
1da177e4
LT
623{
624 struct sock_iocb *si = kiocb_to_siocb(iocb);
1da177e4
LT
625
626 si->sock = sock;
627 si->scm = NULL;
628 si->msg = msg;
629 si->size = size;
630
1da177e4
LT
631 return sock->ops->sendmsg(iocb, sock, msg, size);
632}
633
228e548e
AB
634static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
635 struct msghdr *msg, size_t size)
636{
637 int err = security_socket_sendmsg(sock, msg, size);
638
639 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
640}
641
1da177e4
LT
642int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
643{
644 struct kiocb iocb;
645 struct sock_iocb siocb;
646 int ret;
647
648 init_sync_kiocb(&iocb, NULL);
649 iocb.private = &siocb;
650 ret = __sock_sendmsg(&iocb, sock, msg, size);
651 if (-EIOCBQUEUED == ret)
652 ret = wait_on_sync_kiocb(&iocb);
653 return ret;
654}
c6d409cf 655EXPORT_SYMBOL(sock_sendmsg);
1da177e4 656
894dc24c 657static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
658{
659 struct kiocb iocb;
660 struct sock_iocb siocb;
661 int ret;
662
663 init_sync_kiocb(&iocb, NULL);
664 iocb.private = &siocb;
665 ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
666 if (-EIOCBQUEUED == ret)
667 ret = wait_on_sync_kiocb(&iocb);
668 return ret;
669}
670
1da177e4
LT
671int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
672 struct kvec *vec, size_t num, size_t size)
673{
674 mm_segment_t oldfs = get_fs();
675 int result;
676
677 set_fs(KERNEL_DS);
678 /*
679 * the following is safe, since for compiler definitions of kvec and
680 * iovec are identical, yielding the same in-core layout and alignment
681 */
89bddce5 682 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
683 msg->msg_iovlen = num;
684 result = sock_sendmsg(sock, msg, size);
685 set_fs(oldfs);
686 return result;
687}
c6d409cf 688EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 689
92f37fd2
ED
690/*
691 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
692 */
693void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
694 struct sk_buff *skb)
695{
20d49473
PO
696 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
697 struct timespec ts[3];
698 int empty = 1;
699 struct skb_shared_hwtstamps *shhwtstamps =
700 skb_hwtstamps(skb);
701
702 /* Race occurred between timestamp enabling and packet
703 receiving. Fill in the current time for now. */
704 if (need_software_tstamp && skb->tstamp.tv64 == 0)
705 __net_timestamp(skb);
706
707 if (need_software_tstamp) {
708 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
709 struct timeval tv;
710 skb_get_timestamp(skb, &tv);
711 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
712 sizeof(tv), &tv);
713 } else {
842509b8 714 skb_get_timestampns(skb, &ts[0]);
20d49473 715 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
842509b8 716 sizeof(ts[0]), &ts[0]);
20d49473
PO
717 }
718 }
719
720
721 memset(ts, 0, sizeof(ts));
6e94d1ef
DB
722 if (sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE) &&
723 ktime_to_timespec_cond(skb->tstamp, ts + 0))
20d49473 724 empty = 0;
20d49473
PO
725 if (shhwtstamps) {
726 if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
6e94d1ef 727 ktime_to_timespec_cond(shhwtstamps->syststamp, ts + 1))
20d49473
PO
728 empty = 0;
729 if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
6e94d1ef 730 ktime_to_timespec_cond(shhwtstamps->hwtstamp, ts + 2))
20d49473 731 empty = 0;
92f37fd2 732 }
20d49473
PO
733 if (!empty)
734 put_cmsg(msg, SOL_SOCKET,
735 SCM_TIMESTAMPING, sizeof(ts), &ts);
92f37fd2 736}
7c81fd8b
ACM
737EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
738
6e3e939f
JB
739void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
740 struct sk_buff *skb)
741{
742 int ack;
743
744 if (!sock_flag(sk, SOCK_WIFI_STATUS))
745 return;
746 if (!skb->wifi_acked_valid)
747 return;
748
749 ack = skb->wifi_acked;
750
751 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
752}
753EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
754
11165f14 755static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
756 struct sk_buff *skb)
3b885787
NH
757{
758 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
759 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
760 sizeof(__u32), &skb->dropcount);
761}
762
767dd033 763void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
764 struct sk_buff *skb)
765{
766 sock_recv_timestamp(msg, sk, skb);
767 sock_recv_drops(msg, sk, skb);
768}
767dd033 769EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 770
a2e27255
ACM
771static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
772 struct msghdr *msg, size_t size, int flags)
1da177e4 773{
1da177e4
LT
774 struct sock_iocb *si = kiocb_to_siocb(iocb);
775
776 si->sock = sock;
777 si->scm = NULL;
778 si->msg = msg;
779 si->size = size;
780 si->flags = flags;
781
1da177e4
LT
782 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
783}
784
a2e27255
ACM
785static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
786 struct msghdr *msg, size_t size, int flags)
787{
788 int err = security_socket_recvmsg(sock, msg, size, flags);
789
790 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
791}
792
89bddce5 793int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
794 size_t size, int flags)
795{
796 struct kiocb iocb;
797 struct sock_iocb siocb;
798 int ret;
799
89bddce5 800 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
801 iocb.private = &siocb;
802 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
803 if (-EIOCBQUEUED == ret)
804 ret = wait_on_sync_kiocb(&iocb);
805 return ret;
806}
c6d409cf 807EXPORT_SYMBOL(sock_recvmsg);
1da177e4 808
a2e27255
ACM
809static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
810 size_t size, int flags)
811{
812 struct kiocb iocb;
813 struct sock_iocb siocb;
814 int ret;
815
816 init_sync_kiocb(&iocb, NULL);
817 iocb.private = &siocb;
818 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
819 if (-EIOCBQUEUED == ret)
820 ret = wait_on_sync_kiocb(&iocb);
821 return ret;
822}
823
c1249c0a
ML
824/**
825 * kernel_recvmsg - Receive a message from a socket (kernel space)
826 * @sock: The socket to receive the message from
827 * @msg: Received message
828 * @vec: Input s/g array for message data
829 * @num: Size of input s/g array
830 * @size: Number of bytes to read
831 * @flags: Message flags (MSG_DONTWAIT, etc...)
832 *
833 * On return the msg structure contains the scatter/gather array passed in the
834 * vec argument. The array is modified so that it consists of the unfilled
835 * portion of the original array.
836 *
837 * The returned value is the total number of bytes received, or an error.
838 */
89bddce5
SH
839int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
840 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
841{
842 mm_segment_t oldfs = get_fs();
843 int result;
844
845 set_fs(KERNEL_DS);
846 /*
847 * the following is safe, since for compiler definitions of kvec and
848 * iovec are identical, yielding the same in-core layout and alignment
849 */
89bddce5 850 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
851 result = sock_recvmsg(sock, msg, size, flags);
852 set_fs(oldfs);
853 return result;
854}
c6d409cf 855EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 856
ce1d4d3e
CH
857static ssize_t sock_sendpage(struct file *file, struct page *page,
858 int offset, size_t size, loff_t *ppos, int more)
1da177e4 859{
1da177e4
LT
860 struct socket *sock;
861 int flags;
862
ce1d4d3e
CH
863 sock = file->private_data;
864
35f9c09f
ED
865 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
866 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
867 flags |= more;
ce1d4d3e 868
e6949583 869 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 870}
1da177e4 871
9c55e01c 872static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 873 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
874 unsigned int flags)
875{
876 struct socket *sock = file->private_data;
877
997b37da
RDC
878 if (unlikely(!sock->ops->splice_read))
879 return -EINVAL;
880
9c55e01c
JA
881 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
882}
883
ce1d4d3e 884static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 885 struct sock_iocb *siocb)
ce1d4d3e 886{
d29c445b
KO
887 if (!is_sync_kiocb(iocb))
888 BUG();
1da177e4 889
ce1d4d3e 890 siocb->kiocb = iocb;
ce1d4d3e
CH
891 iocb->private = siocb;
892 return siocb;
1da177e4
LT
893}
894
ce1d4d3e 895static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
896 struct file *file, const struct iovec *iov,
897 unsigned long nr_segs)
ce1d4d3e
CH
898{
899 struct socket *sock = file->private_data;
900 size_t size = 0;
901 int i;
1da177e4 902
89bddce5
SH
903 for (i = 0; i < nr_segs; i++)
904 size += iov[i].iov_len;
1da177e4 905
ce1d4d3e
CH
906 msg->msg_name = NULL;
907 msg->msg_namelen = 0;
908 msg->msg_control = NULL;
909 msg->msg_controllen = 0;
89bddce5 910 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
911 msg->msg_iovlen = nr_segs;
912 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
913
914 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
915}
916
027445c3
BP
917static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
918 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
919{
920 struct sock_iocb siocb, *x;
921
1da177e4
LT
922 if (pos != 0)
923 return -ESPIPE;
027445c3 924
73a7075e 925 if (iocb->ki_nbytes == 0) /* Match SYS5 behaviour */
1da177e4
LT
926 return 0;
927
027445c3
BP
928
929 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
930 if (!x)
931 return -ENOMEM;
027445c3 932 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
933}
934
ce1d4d3e 935static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
936 struct file *file, const struct iovec *iov,
937 unsigned long nr_segs)
1da177e4 938{
ce1d4d3e
CH
939 struct socket *sock = file->private_data;
940 size_t size = 0;
941 int i;
1da177e4 942
89bddce5
SH
943 for (i = 0; i < nr_segs; i++)
944 size += iov[i].iov_len;
1da177e4 945
ce1d4d3e
CH
946 msg->msg_name = NULL;
947 msg->msg_namelen = 0;
948 msg->msg_control = NULL;
949 msg->msg_controllen = 0;
89bddce5 950 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
951 msg->msg_iovlen = nr_segs;
952 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
953 if (sock->type == SOCK_SEQPACKET)
954 msg->msg_flags |= MSG_EOR;
1da177e4 955
ce1d4d3e 956 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
957}
958
027445c3
BP
959static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
960 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
961{
962 struct sock_iocb siocb, *x;
1da177e4 963
ce1d4d3e
CH
964 if (pos != 0)
965 return -ESPIPE;
027445c3 966
027445c3 967 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
968 if (!x)
969 return -ENOMEM;
1da177e4 970
027445c3 971 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
972}
973
1da177e4
LT
974/*
975 * Atomic setting of ioctl hooks to avoid race
976 * with module unload.
977 */
978
4a3e2f71 979static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 980static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 981
881d966b 982void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 983{
4a3e2f71 984 mutex_lock(&br_ioctl_mutex);
1da177e4 985 br_ioctl_hook = hook;
4a3e2f71 986 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
987}
988EXPORT_SYMBOL(brioctl_set);
989
4a3e2f71 990static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 991static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 992
881d966b 993void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 994{
4a3e2f71 995 mutex_lock(&vlan_ioctl_mutex);
1da177e4 996 vlan_ioctl_hook = hook;
4a3e2f71 997 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
998}
999EXPORT_SYMBOL(vlan_ioctl_set);
1000
4a3e2f71 1001static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 1002static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 1003
89bddce5 1004void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 1005{
4a3e2f71 1006 mutex_lock(&dlci_ioctl_mutex);
1da177e4 1007 dlci_ioctl_hook = hook;
4a3e2f71 1008 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1009}
1010EXPORT_SYMBOL(dlci_ioctl_set);
1011
6b96018b
AB
1012static long sock_do_ioctl(struct net *net, struct socket *sock,
1013 unsigned int cmd, unsigned long arg)
1014{
1015 int err;
1016 void __user *argp = (void __user *)arg;
1017
1018 err = sock->ops->ioctl(sock, cmd, arg);
1019
1020 /*
1021 * If this ioctl is unknown try to hand it down
1022 * to the NIC driver.
1023 */
1024 if (err == -ENOIOCTLCMD)
1025 err = dev_ioctl(net, cmd, argp);
1026
1027 return err;
1028}
1029
1da177e4
LT
1030/*
1031 * With an ioctl, arg may well be a user mode pointer, but we don't know
1032 * what to do with it - that's up to the protocol still.
1033 */
1034
1035static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1036{
1037 struct socket *sock;
881d966b 1038 struct sock *sk;
1da177e4
LT
1039 void __user *argp = (void __user *)arg;
1040 int pid, err;
881d966b 1041 struct net *net;
1da177e4 1042
b69aee04 1043 sock = file->private_data;
881d966b 1044 sk = sock->sk;
3b1e0a65 1045 net = sock_net(sk);
1da177e4 1046 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 1047 err = dev_ioctl(net, cmd, argp);
1da177e4 1048 } else
3d23e349 1049#ifdef CONFIG_WEXT_CORE
1da177e4 1050 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 1051 err = dev_ioctl(net, cmd, argp);
1da177e4 1052 } else
3d23e349 1053#endif
89bddce5 1054 switch (cmd) {
1da177e4
LT
1055 case FIOSETOWN:
1056 case SIOCSPGRP:
1057 err = -EFAULT;
1058 if (get_user(pid, (int __user *)argp))
1059 break;
1060 err = f_setown(sock->file, pid, 1);
1061 break;
1062 case FIOGETOWN:
1063 case SIOCGPGRP:
609d7fa9 1064 err = put_user(f_getown(sock->file),
89bddce5 1065 (int __user *)argp);
1da177e4
LT
1066 break;
1067 case SIOCGIFBR:
1068 case SIOCSIFBR:
1069 case SIOCBRADDBR:
1070 case SIOCBRDELBR:
1071 err = -ENOPKG;
1072 if (!br_ioctl_hook)
1073 request_module("bridge");
1074
4a3e2f71 1075 mutex_lock(&br_ioctl_mutex);
89bddce5 1076 if (br_ioctl_hook)
881d966b 1077 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1078 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1079 break;
1080 case SIOCGIFVLAN:
1081 case SIOCSIFVLAN:
1082 err = -ENOPKG;
1083 if (!vlan_ioctl_hook)
1084 request_module("8021q");
1085
4a3e2f71 1086 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1087 if (vlan_ioctl_hook)
881d966b 1088 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1089 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1090 break;
1da177e4
LT
1091 case SIOCADDDLCI:
1092 case SIOCDELDLCI:
1093 err = -ENOPKG;
1094 if (!dlci_ioctl_hook)
1095 request_module("dlci");
1096
7512cbf6
PE
1097 mutex_lock(&dlci_ioctl_mutex);
1098 if (dlci_ioctl_hook)
1da177e4 1099 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1100 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1101 break;
1102 default:
6b96018b 1103 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1104 break;
89bddce5 1105 }
1da177e4
LT
1106 return err;
1107}
1108
1109int sock_create_lite(int family, int type, int protocol, struct socket **res)
1110{
1111 int err;
1112 struct socket *sock = NULL;
89bddce5 1113
1da177e4
LT
1114 err = security_socket_create(family, type, protocol, 1);
1115 if (err)
1116 goto out;
1117
1118 sock = sock_alloc();
1119 if (!sock) {
1120 err = -ENOMEM;
1121 goto out;
1122 }
1123
1da177e4 1124 sock->type = type;
7420ed23
VY
1125 err = security_socket_post_create(sock, family, type, protocol, 1);
1126 if (err)
1127 goto out_release;
1128
1da177e4
LT
1129out:
1130 *res = sock;
1131 return err;
7420ed23
VY
1132out_release:
1133 sock_release(sock);
1134 sock = NULL;
1135 goto out;
1da177e4 1136}
c6d409cf 1137EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1138
1139/* No kernel lock held - perfect */
89bddce5 1140static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 1141{
cbf55001 1142 unsigned int busy_flag = 0;
1da177e4
LT
1143 struct socket *sock;
1144
1145 /*
89bddce5 1146 * We can't return errors to poll, so it's either yes or no.
1da177e4 1147 */
b69aee04 1148 sock = file->private_data;
2d48d67f 1149
cbf55001 1150 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1151 /* this socket can poll_ll so tell the system call */
cbf55001 1152 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1153
1154 /* once, only if requested by syscall */
cbf55001
ET
1155 if (wait && (wait->_key & POLL_BUSY_LOOP))
1156 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1157 }
1158
cbf55001 1159 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1160}
1161
89bddce5 1162static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1163{
b69aee04 1164 struct socket *sock = file->private_data;
1da177e4
LT
1165
1166 return sock->ops->mmap(file, sock, vma);
1167}
1168
20380731 1169static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1170{
1da177e4
LT
1171 sock_release(SOCKET_I(inode));
1172 return 0;
1173}
1174
1175/*
1176 * Update the socket async list
1177 *
1178 * Fasync_list locking strategy.
1179 *
1180 * 1. fasync_list is modified only under process context socket lock
1181 * i.e. under semaphore.
1182 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1183 * or under socket lock
1da177e4
LT
1184 */
1185
1186static int sock_fasync(int fd, struct file *filp, int on)
1187{
989a2979
ED
1188 struct socket *sock = filp->private_data;
1189 struct sock *sk = sock->sk;
eaefd110 1190 struct socket_wq *wq;
1da177e4 1191
989a2979 1192 if (sk == NULL)
1da177e4 1193 return -EINVAL;
1da177e4
LT
1194
1195 lock_sock(sk);
eaefd110
ED
1196 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1197 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1198
eaefd110 1199 if (!wq->fasync_list)
989a2979
ED
1200 sock_reset_flag(sk, SOCK_FASYNC);
1201 else
bcdce719 1202 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1203
989a2979 1204 release_sock(sk);
1da177e4
LT
1205 return 0;
1206}
1207
43815482 1208/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1209
1210int sock_wake_async(struct socket *sock, int how, int band)
1211{
43815482
ED
1212 struct socket_wq *wq;
1213
1214 if (!sock)
1215 return -1;
1216 rcu_read_lock();
1217 wq = rcu_dereference(sock->wq);
1218 if (!wq || !wq->fasync_list) {
1219 rcu_read_unlock();
1da177e4 1220 return -1;
43815482 1221 }
89bddce5 1222 switch (how) {
8d8ad9d7 1223 case SOCK_WAKE_WAITD:
1da177e4
LT
1224 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1225 break;
1226 goto call_kill;
8d8ad9d7 1227 case SOCK_WAKE_SPACE:
1da177e4
LT
1228 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1229 break;
1230 /* fall through */
8d8ad9d7 1231 case SOCK_WAKE_IO:
89bddce5 1232call_kill:
43815482 1233 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1234 break;
8d8ad9d7 1235 case SOCK_WAKE_URG:
43815482 1236 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1237 }
43815482 1238 rcu_read_unlock();
1da177e4
LT
1239 return 0;
1240}
c6d409cf 1241EXPORT_SYMBOL(sock_wake_async);
1da177e4 1242
721db93a 1243int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1244 struct socket **res, int kern)
1da177e4
LT
1245{
1246 int err;
1247 struct socket *sock;
55737fda 1248 const struct net_proto_family *pf;
1da177e4
LT
1249
1250 /*
89bddce5 1251 * Check protocol is in range
1da177e4
LT
1252 */
1253 if (family < 0 || family >= NPROTO)
1254 return -EAFNOSUPPORT;
1255 if (type < 0 || type >= SOCK_MAX)
1256 return -EINVAL;
1257
1258 /* Compatibility.
1259
1260 This uglymoron is moved from INET layer to here to avoid
1261 deadlock in module load.
1262 */
1263 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1264 static int warned;
1da177e4
LT
1265 if (!warned) {
1266 warned = 1;
89bddce5
SH
1267 printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1268 current->comm);
1da177e4
LT
1269 }
1270 family = PF_PACKET;
1271 }
1272
1273 err = security_socket_create(family, type, protocol, kern);
1274 if (err)
1275 return err;
89bddce5 1276
55737fda
SH
1277 /*
1278 * Allocate the socket and allow the family to set things up. if
1279 * the protocol is 0, the family is instructed to select an appropriate
1280 * default.
1281 */
1282 sock = sock_alloc();
1283 if (!sock) {
e87cc472 1284 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1285 return -ENFILE; /* Not exactly a match, but its the
1286 closest posix thing */
1287 }
1288
1289 sock->type = type;
1290
95a5afca 1291#ifdef CONFIG_MODULES
89bddce5
SH
1292 /* Attempt to load a protocol module if the find failed.
1293 *
1294 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1295 * requested real, full-featured networking support upon configuration.
1296 * Otherwise module support will break!
1297 */
190683a9 1298 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1299 request_module("net-pf-%d", family);
1da177e4
LT
1300#endif
1301
55737fda
SH
1302 rcu_read_lock();
1303 pf = rcu_dereference(net_families[family]);
1304 err = -EAFNOSUPPORT;
1305 if (!pf)
1306 goto out_release;
1da177e4
LT
1307
1308 /*
1309 * We will call the ->create function, that possibly is in a loadable
1310 * module, so we have to bump that loadable module refcnt first.
1311 */
55737fda 1312 if (!try_module_get(pf->owner))
1da177e4
LT
1313 goto out_release;
1314
55737fda
SH
1315 /* Now protected by module ref count */
1316 rcu_read_unlock();
1317
3f378b68 1318 err = pf->create(net, sock, protocol, kern);
55737fda 1319 if (err < 0)
1da177e4 1320 goto out_module_put;
a79af59e 1321
1da177e4
LT
1322 /*
1323 * Now to bump the refcnt of the [loadable] module that owns this
1324 * socket at sock_release time we decrement its refcnt.
1325 */
55737fda
SH
1326 if (!try_module_get(sock->ops->owner))
1327 goto out_module_busy;
1328
1da177e4
LT
1329 /*
1330 * Now that we're done with the ->create function, the [loadable]
1331 * module can have its refcnt decremented
1332 */
55737fda 1333 module_put(pf->owner);
7420ed23
VY
1334 err = security_socket_post_create(sock, family, type, protocol, kern);
1335 if (err)
3b185525 1336 goto out_sock_release;
55737fda 1337 *res = sock;
1da177e4 1338
55737fda
SH
1339 return 0;
1340
1341out_module_busy:
1342 err = -EAFNOSUPPORT;
1da177e4 1343out_module_put:
55737fda
SH
1344 sock->ops = NULL;
1345 module_put(pf->owner);
1346out_sock_release:
1da177e4 1347 sock_release(sock);
55737fda
SH
1348 return err;
1349
1350out_release:
1351 rcu_read_unlock();
1352 goto out_sock_release;
1da177e4 1353}
721db93a 1354EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1355
1356int sock_create(int family, int type, int protocol, struct socket **res)
1357{
1b8d7ae4 1358 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1359}
c6d409cf 1360EXPORT_SYMBOL(sock_create);
1da177e4
LT
1361
1362int sock_create_kern(int family, int type, int protocol, struct socket **res)
1363{
1b8d7ae4 1364 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1365}
c6d409cf 1366EXPORT_SYMBOL(sock_create_kern);
1da177e4 1367
3e0fa65f 1368SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1369{
1370 int retval;
1371 struct socket *sock;
a677a039
UD
1372 int flags;
1373
e38b36f3
UD
1374 /* Check the SOCK_* constants for consistency. */
1375 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1376 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1377 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1378 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1379
a677a039 1380 flags = type & ~SOCK_TYPE_MASK;
77d27200 1381 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1382 return -EINVAL;
1383 type &= SOCK_TYPE_MASK;
1da177e4 1384
aaca0bdc
UD
1385 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1386 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1387
1da177e4
LT
1388 retval = sock_create(family, type, protocol, &sock);
1389 if (retval < 0)
1390 goto out;
1391
77d27200 1392 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1393 if (retval < 0)
1394 goto out_release;
1395
1396out:
1397 /* It may be already another descriptor 8) Not kernel problem. */
1398 return retval;
1399
1400out_release:
1401 sock_release(sock);
1402 return retval;
1403}
1404
1405/*
1406 * Create a pair of connected sockets.
1407 */
1408
3e0fa65f
HC
1409SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1410 int __user *, usockvec)
1da177e4
LT
1411{
1412 struct socket *sock1, *sock2;
1413 int fd1, fd2, err;
db349509 1414 struct file *newfile1, *newfile2;
a677a039
UD
1415 int flags;
1416
1417 flags = type & ~SOCK_TYPE_MASK;
77d27200 1418 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1419 return -EINVAL;
1420 type &= SOCK_TYPE_MASK;
1da177e4 1421
aaca0bdc
UD
1422 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1423 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1424
1da177e4
LT
1425 /*
1426 * Obtain the first socket and check if the underlying protocol
1427 * supports the socketpair call.
1428 */
1429
1430 err = sock_create(family, type, protocol, &sock1);
1431 if (err < 0)
1432 goto out;
1433
1434 err = sock_create(family, type, protocol, &sock2);
1435 if (err < 0)
1436 goto out_release_1;
1437
1438 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1439 if (err < 0)
1da177e4
LT
1440 goto out_release_both;
1441
28407630 1442 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1443 if (unlikely(fd1 < 0)) {
1444 err = fd1;
db349509 1445 goto out_release_both;
bf3c23d1 1446 }
28407630 1447 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1448 if (unlikely(fd2 < 0)) {
1449 err = fd2;
28407630
AV
1450 put_unused_fd(fd1);
1451 goto out_release_both;
1452 }
1453
aab174f0 1454 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1455 if (unlikely(IS_ERR(newfile1))) {
1456 err = PTR_ERR(newfile1);
1457 put_unused_fd(fd1);
1458 put_unused_fd(fd2);
1459 goto out_release_both;
1460 }
1461
aab174f0 1462 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1463 if (IS_ERR(newfile2)) {
1464 err = PTR_ERR(newfile2);
198de4d7
AV
1465 fput(newfile1);
1466 put_unused_fd(fd1);
28407630 1467 put_unused_fd(fd2);
198de4d7
AV
1468 sock_release(sock2);
1469 goto out;
db349509
AV
1470 }
1471
157cf649 1472 audit_fd_pair(fd1, fd2);
db349509
AV
1473 fd_install(fd1, newfile1);
1474 fd_install(fd2, newfile2);
1da177e4
LT
1475 /* fd1 and fd2 may be already another descriptors.
1476 * Not kernel problem.
1477 */
1478
89bddce5 1479 err = put_user(fd1, &usockvec[0]);
1da177e4
LT
1480 if (!err)
1481 err = put_user(fd2, &usockvec[1]);
1482 if (!err)
1483 return 0;
1484
1485 sys_close(fd2);
1486 sys_close(fd1);
1487 return err;
1488
1da177e4 1489out_release_both:
89bddce5 1490 sock_release(sock2);
1da177e4 1491out_release_1:
89bddce5 1492 sock_release(sock1);
1da177e4
LT
1493out:
1494 return err;
1495}
1496
1da177e4
LT
1497/*
1498 * Bind a name to a socket. Nothing much to do here since it's
1499 * the protocol's responsibility to handle the local address.
1500 *
1501 * We move the socket address to kernel space before we call
1502 * the protocol layer (having also checked the address is ok).
1503 */
1504
20f37034 1505SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1506{
1507 struct socket *sock;
230b1839 1508 struct sockaddr_storage address;
6cb153ca 1509 int err, fput_needed;
1da177e4 1510
89bddce5 1511 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1512 if (sock) {
43db362d 1513 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1514 if (err >= 0) {
1515 err = security_socket_bind(sock,
230b1839 1516 (struct sockaddr *)&address,
89bddce5 1517 addrlen);
6cb153ca
BL
1518 if (!err)
1519 err = sock->ops->bind(sock,
89bddce5 1520 (struct sockaddr *)
230b1839 1521 &address, addrlen);
1da177e4 1522 }
6cb153ca 1523 fput_light(sock->file, fput_needed);
89bddce5 1524 }
1da177e4
LT
1525 return err;
1526}
1527
1da177e4
LT
1528/*
1529 * Perform a listen. Basically, we allow the protocol to do anything
1530 * necessary for a listen, and if that works, we mark the socket as
1531 * ready for listening.
1532 */
1533
3e0fa65f 1534SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1535{
1536 struct socket *sock;
6cb153ca 1537 int err, fput_needed;
b8e1f9b5 1538 int somaxconn;
89bddce5
SH
1539
1540 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1541 if (sock) {
8efa6e93 1542 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1543 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1544 backlog = somaxconn;
1da177e4
LT
1545
1546 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1547 if (!err)
1548 err = sock->ops->listen(sock, backlog);
1da177e4 1549
6cb153ca 1550 fput_light(sock->file, fput_needed);
1da177e4
LT
1551 }
1552 return err;
1553}
1554
1da177e4
LT
1555/*
1556 * For accept, we attempt to create a new socket, set up the link
1557 * with the client, wake up the client, then return the new
1558 * connected fd. We collect the address of the connector in kernel
1559 * space and move it to user at the very end. This is unclean because
1560 * we open the socket then return an error.
1561 *
1562 * 1003.1g adds the ability to recvmsg() to query connection pending
1563 * status to recvmsg. We need to add that support in a way thats
1564 * clean when we restucture accept also.
1565 */
1566
20f37034
HC
1567SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1568 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1569{
1570 struct socket *sock, *newsock;
39d8c1b6 1571 struct file *newfile;
6cb153ca 1572 int err, len, newfd, fput_needed;
230b1839 1573 struct sockaddr_storage address;
1da177e4 1574
77d27200 1575 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1576 return -EINVAL;
1577
1578 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1579 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1580
6cb153ca 1581 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1582 if (!sock)
1583 goto out;
1584
1585 err = -ENFILE;
c6d409cf
ED
1586 newsock = sock_alloc();
1587 if (!newsock)
1da177e4
LT
1588 goto out_put;
1589
1590 newsock->type = sock->type;
1591 newsock->ops = sock->ops;
1592
1da177e4
LT
1593 /*
1594 * We don't need try_module_get here, as the listening socket (sock)
1595 * has the protocol module (sock->ops->owner) held.
1596 */
1597 __module_get(newsock->ops->owner);
1598
28407630 1599 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1600 if (unlikely(newfd < 0)) {
1601 err = newfd;
9a1875e6
DM
1602 sock_release(newsock);
1603 goto out_put;
39d8c1b6 1604 }
aab174f0 1605 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1606 if (unlikely(IS_ERR(newfile))) {
1607 err = PTR_ERR(newfile);
1608 put_unused_fd(newfd);
1609 sock_release(newsock);
1610 goto out_put;
1611 }
39d8c1b6 1612
a79af59e
FF
1613 err = security_socket_accept(sock, newsock);
1614 if (err)
39d8c1b6 1615 goto out_fd;
a79af59e 1616
1da177e4
LT
1617 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1618 if (err < 0)
39d8c1b6 1619 goto out_fd;
1da177e4
LT
1620
1621 if (upeer_sockaddr) {
230b1839 1622 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1623 &len, 2) < 0) {
1da177e4 1624 err = -ECONNABORTED;
39d8c1b6 1625 goto out_fd;
1da177e4 1626 }
43db362d 1627 err = move_addr_to_user(&address,
230b1839 1628 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1629 if (err < 0)
39d8c1b6 1630 goto out_fd;
1da177e4
LT
1631 }
1632
1633 /* File flags are not inherited via accept() unlike another OSes. */
1634
39d8c1b6
DM
1635 fd_install(newfd, newfile);
1636 err = newfd;
1da177e4 1637
1da177e4 1638out_put:
6cb153ca 1639 fput_light(sock->file, fput_needed);
1da177e4
LT
1640out:
1641 return err;
39d8c1b6 1642out_fd:
9606a216 1643 fput(newfile);
39d8c1b6 1644 put_unused_fd(newfd);
1da177e4
LT
1645 goto out_put;
1646}
1647
20f37034
HC
1648SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1649 int __user *, upeer_addrlen)
aaca0bdc 1650{
de11defe 1651 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1652}
1653
1da177e4
LT
1654/*
1655 * Attempt to connect to a socket with the server address. The address
1656 * is in user space so we verify it is OK and move it to kernel space.
1657 *
1658 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1659 * break bindings
1660 *
1661 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1662 * other SEQPACKET protocols that take time to connect() as it doesn't
1663 * include the -EINPROGRESS status for such sockets.
1664 */
1665
20f37034
HC
1666SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1667 int, addrlen)
1da177e4
LT
1668{
1669 struct socket *sock;
230b1839 1670 struct sockaddr_storage address;
6cb153ca 1671 int err, fput_needed;
1da177e4 1672
6cb153ca 1673 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1674 if (!sock)
1675 goto out;
43db362d 1676 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1677 if (err < 0)
1678 goto out_put;
1679
89bddce5 1680 err =
230b1839 1681 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1682 if (err)
1683 goto out_put;
1684
230b1839 1685 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1686 sock->file->f_flags);
1687out_put:
6cb153ca 1688 fput_light(sock->file, fput_needed);
1da177e4
LT
1689out:
1690 return err;
1691}
1692
1693/*
1694 * Get the local address ('name') of a socket object. Move the obtained
1695 * name to user space.
1696 */
1697
20f37034
HC
1698SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1699 int __user *, usockaddr_len)
1da177e4
LT
1700{
1701 struct socket *sock;
230b1839 1702 struct sockaddr_storage address;
6cb153ca 1703 int len, err, fput_needed;
89bddce5 1704
6cb153ca 1705 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1706 if (!sock)
1707 goto out;
1708
1709 err = security_socket_getsockname(sock);
1710 if (err)
1711 goto out_put;
1712
230b1839 1713 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1714 if (err)
1715 goto out_put;
43db362d 1716 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1717
1718out_put:
6cb153ca 1719 fput_light(sock->file, fput_needed);
1da177e4
LT
1720out:
1721 return err;
1722}
1723
1724/*
1725 * Get the remote address ('name') of a socket object. Move the obtained
1726 * name to user space.
1727 */
1728
20f37034
HC
1729SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1730 int __user *, usockaddr_len)
1da177e4
LT
1731{
1732 struct socket *sock;
230b1839 1733 struct sockaddr_storage address;
6cb153ca 1734 int len, err, fput_needed;
1da177e4 1735
89bddce5
SH
1736 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1737 if (sock != NULL) {
1da177e4
LT
1738 err = security_socket_getpeername(sock);
1739 if (err) {
6cb153ca 1740 fput_light(sock->file, fput_needed);
1da177e4
LT
1741 return err;
1742 }
1743
89bddce5 1744 err =
230b1839 1745 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1746 1);
1da177e4 1747 if (!err)
43db362d 1748 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1749 usockaddr_len);
6cb153ca 1750 fput_light(sock->file, fput_needed);
1da177e4
LT
1751 }
1752 return err;
1753}
1754
1755/*
1756 * Send a datagram to a given address. We move the address into kernel
1757 * space and check the user space data area is readable before invoking
1758 * the protocol.
1759 */
1760
3e0fa65f 1761SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1762 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1763 int, addr_len)
1da177e4
LT
1764{
1765 struct socket *sock;
230b1839 1766 struct sockaddr_storage address;
1da177e4
LT
1767 int err;
1768 struct msghdr msg;
1769 struct iovec iov;
6cb153ca 1770 int fput_needed;
6cb153ca 1771
253eacc0
LT
1772 if (len > INT_MAX)
1773 len = INT_MAX;
de0fa95c
PE
1774 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1775 if (!sock)
4387ff75 1776 goto out;
6cb153ca 1777
89bddce5
SH
1778 iov.iov_base = buff;
1779 iov.iov_len = len;
1780 msg.msg_name = NULL;
1781 msg.msg_iov = &iov;
1782 msg.msg_iovlen = 1;
1783 msg.msg_control = NULL;
1784 msg.msg_controllen = 0;
1785 msg.msg_namelen = 0;
6cb153ca 1786 if (addr) {
43db362d 1787 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1788 if (err < 0)
1789 goto out_put;
230b1839 1790 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1791 msg.msg_namelen = addr_len;
1da177e4
LT
1792 }
1793 if (sock->file->f_flags & O_NONBLOCK)
1794 flags |= MSG_DONTWAIT;
1795 msg.msg_flags = flags;
1796 err = sock_sendmsg(sock, &msg, len);
1797
89bddce5 1798out_put:
de0fa95c 1799 fput_light(sock->file, fput_needed);
4387ff75 1800out:
1da177e4
LT
1801 return err;
1802}
1803
1804/*
89bddce5 1805 * Send a datagram down a socket.
1da177e4
LT
1806 */
1807
3e0fa65f 1808SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1809 unsigned int, flags)
1da177e4
LT
1810{
1811 return sys_sendto(fd, buff, len, flags, NULL, 0);
1812}
1813
1814/*
89bddce5 1815 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1816 * sender. We verify the buffers are writable and if needed move the
1817 * sender address from kernel to user space.
1818 */
1819
3e0fa65f 1820SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1821 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1822 int __user *, addr_len)
1da177e4
LT
1823{
1824 struct socket *sock;
1825 struct iovec iov;
1826 struct msghdr msg;
230b1839 1827 struct sockaddr_storage address;
89bddce5 1828 int err, err2;
6cb153ca
BL
1829 int fput_needed;
1830
253eacc0
LT
1831 if (size > INT_MAX)
1832 size = INT_MAX;
de0fa95c 1833 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1834 if (!sock)
de0fa95c 1835 goto out;
1da177e4 1836
89bddce5
SH
1837 msg.msg_control = NULL;
1838 msg.msg_controllen = 0;
1839 msg.msg_iovlen = 1;
1840 msg.msg_iov = &iov;
1841 iov.iov_len = size;
1842 iov.iov_base = ubuf;
230b1839
YH
1843 msg.msg_name = (struct sockaddr *)&address;
1844 msg.msg_namelen = sizeof(address);
1da177e4
LT
1845 if (sock->file->f_flags & O_NONBLOCK)
1846 flags |= MSG_DONTWAIT;
89bddce5 1847 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1848
89bddce5 1849 if (err >= 0 && addr != NULL) {
43db362d 1850 err2 = move_addr_to_user(&address,
230b1839 1851 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1852 if (err2 < 0)
1853 err = err2;
1da177e4 1854 }
de0fa95c
PE
1855
1856 fput_light(sock->file, fput_needed);
4387ff75 1857out:
1da177e4
LT
1858 return err;
1859}
1860
1861/*
89bddce5 1862 * Receive a datagram from a socket.
1da177e4
LT
1863 */
1864
89bddce5 1865asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
95c96174 1866 unsigned int flags)
1da177e4
LT
1867{
1868 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1869}
1870
1871/*
1872 * Set a socket option. Because we don't know the option lengths we have
1873 * to pass the user mode parameter for the protocols to sort out.
1874 */
1875
20f37034
HC
1876SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1877 char __user *, optval, int, optlen)
1da177e4 1878{
6cb153ca 1879 int err, fput_needed;
1da177e4
LT
1880 struct socket *sock;
1881
1882 if (optlen < 0)
1883 return -EINVAL;
89bddce5
SH
1884
1885 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1886 if (sock != NULL) {
1887 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1888 if (err)
1889 goto out_put;
1da177e4
LT
1890
1891 if (level == SOL_SOCKET)
89bddce5
SH
1892 err =
1893 sock_setsockopt(sock, level, optname, optval,
1894 optlen);
1da177e4 1895 else
89bddce5
SH
1896 err =
1897 sock->ops->setsockopt(sock, level, optname, optval,
1898 optlen);
6cb153ca
BL
1899out_put:
1900 fput_light(sock->file, fput_needed);
1da177e4
LT
1901 }
1902 return err;
1903}
1904
1905/*
1906 * Get a socket option. Because we don't know the option lengths we have
1907 * to pass a user mode parameter for the protocols to sort out.
1908 */
1909
20f37034
HC
1910SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1911 char __user *, optval, int __user *, optlen)
1da177e4 1912{
6cb153ca 1913 int err, fput_needed;
1da177e4
LT
1914 struct socket *sock;
1915
89bddce5
SH
1916 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1917 if (sock != NULL) {
6cb153ca
BL
1918 err = security_socket_getsockopt(sock, level, optname);
1919 if (err)
1920 goto out_put;
1da177e4
LT
1921
1922 if (level == SOL_SOCKET)
89bddce5
SH
1923 err =
1924 sock_getsockopt(sock, level, optname, optval,
1925 optlen);
1da177e4 1926 else
89bddce5
SH
1927 err =
1928 sock->ops->getsockopt(sock, level, optname, optval,
1929 optlen);
6cb153ca
BL
1930out_put:
1931 fput_light(sock->file, fput_needed);
1da177e4
LT
1932 }
1933 return err;
1934}
1935
1da177e4
LT
1936/*
1937 * Shutdown a socket.
1938 */
1939
754fe8d2 1940SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1941{
6cb153ca 1942 int err, fput_needed;
1da177e4
LT
1943 struct socket *sock;
1944
89bddce5
SH
1945 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1946 if (sock != NULL) {
1da177e4 1947 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1948 if (!err)
1949 err = sock->ops->shutdown(sock, how);
1950 fput_light(sock->file, fput_needed);
1da177e4
LT
1951 }
1952 return err;
1953}
1954
89bddce5 1955/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1956 * fields which are the same type (int / unsigned) on our platforms.
1957 */
1958#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1959#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1960#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1961
c71d8ebe
TH
1962struct used_address {
1963 struct sockaddr_storage name;
1964 unsigned int name_len;
1965};
1966
1661bf36
DC
1967static int copy_msghdr_from_user(struct msghdr *kmsg,
1968 struct msghdr __user *umsg)
1969{
1970 if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
1971 return -EFAULT;
1972 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
1973 return -EINVAL;
1974 return 0;
1975}
1976
a7526eb5 1977static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 1978 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1979 struct used_address *used_address)
1da177e4 1980{
89bddce5
SH
1981 struct compat_msghdr __user *msg_compat =
1982 (struct compat_msghdr __user *)msg;
230b1839 1983 struct sockaddr_storage address;
1da177e4 1984 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1985 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1986 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1987 /* 20 is size of ipv6_pktinfo */
1da177e4 1988 unsigned char *ctl_buf = ctl;
a74e9106 1989 int err, ctl_len, total_len;
89bddce5 1990
1da177e4
LT
1991 err = -EFAULT;
1992 if (MSG_CMSG_COMPAT & flags) {
228e548e 1993 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 1994 return -EFAULT;
1661bf36
DC
1995 } else {
1996 err = copy_msghdr_from_user(msg_sys, msg);
1997 if (err)
1998 return err;
1999 }
1da177e4 2000
228e548e 2001 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
2002 err = -EMSGSIZE;
2003 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2004 goto out;
2005 err = -ENOMEM;
2006 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2007 GFP_KERNEL);
1da177e4 2008 if (!iov)
228e548e 2009 goto out;
1da177e4
LT
2010 }
2011
2012 /* This will also move the address data into kernel space */
2013 if (MSG_CMSG_COMPAT & flags) {
43db362d 2014 err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
1da177e4 2015 } else
43db362d 2016 err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
89bddce5 2017 if (err < 0)
1da177e4
LT
2018 goto out_freeiov;
2019 total_len = err;
2020
2021 err = -ENOBUFS;
2022
228e548e 2023 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 2024 goto out_freeiov;
228e548e 2025 ctl_len = msg_sys->msg_controllen;
1da177e4 2026 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2027 err =
228e548e 2028 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2029 sizeof(ctl));
1da177e4
LT
2030 if (err)
2031 goto out_freeiov;
228e548e
AB
2032 ctl_buf = msg_sys->msg_control;
2033 ctl_len = msg_sys->msg_controllen;
1da177e4 2034 } else if (ctl_len) {
89bddce5 2035 if (ctl_len > sizeof(ctl)) {
1da177e4 2036 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2037 if (ctl_buf == NULL)
1da177e4
LT
2038 goto out_freeiov;
2039 }
2040 err = -EFAULT;
2041 /*
228e548e 2042 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2043 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2044 * checking falls down on this.
2045 */
fb8621bb 2046 if (copy_from_user(ctl_buf,
228e548e 2047 (void __user __force *)msg_sys->msg_control,
89bddce5 2048 ctl_len))
1da177e4 2049 goto out_freectl;
228e548e 2050 msg_sys->msg_control = ctl_buf;
1da177e4 2051 }
228e548e 2052 msg_sys->msg_flags = flags;
1da177e4
LT
2053
2054 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2055 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2056 /*
2057 * If this is sendmmsg() and current destination address is same as
2058 * previously succeeded address, omit asking LSM's decision.
2059 * used_address->name_len is initialized to UINT_MAX so that the first
2060 * destination address never matches.
2061 */
bc909d9d
MD
2062 if (used_address && msg_sys->msg_name &&
2063 used_address->name_len == msg_sys->msg_namelen &&
2064 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2065 used_address->name_len)) {
2066 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2067 goto out_freectl;
2068 }
2069 err = sock_sendmsg(sock, msg_sys, total_len);
2070 /*
2071 * If this is sendmmsg() and sending to current destination address was
2072 * successful, remember it.
2073 */
2074 if (used_address && err >= 0) {
2075 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2076 if (msg_sys->msg_name)
2077 memcpy(&used_address->name, msg_sys->msg_name,
2078 used_address->name_len);
c71d8ebe 2079 }
1da177e4
LT
2080
2081out_freectl:
89bddce5 2082 if (ctl_buf != ctl)
1da177e4
LT
2083 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2084out_freeiov:
2085 if (iov != iovstack)
a74e9106 2086 kfree(iov);
228e548e
AB
2087out:
2088 return err;
2089}
2090
2091/*
2092 * BSD sendmsg interface
2093 */
2094
a7526eb5 2095long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
228e548e
AB
2096{
2097 int fput_needed, err;
2098 struct msghdr msg_sys;
1be374a0
AL
2099 struct socket *sock;
2100
1be374a0 2101 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2102 if (!sock)
2103 goto out;
2104
a7526eb5 2105 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2106
6cb153ca 2107 fput_light(sock->file, fput_needed);
89bddce5 2108out:
1da177e4
LT
2109 return err;
2110}
2111
a7526eb5
AL
2112SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
2113{
2114 if (flags & MSG_CMSG_COMPAT)
2115 return -EINVAL;
2116 return __sys_sendmsg(fd, msg, flags);
2117}
2118
228e548e
AB
2119/*
2120 * Linux sendmmsg interface
2121 */
2122
2123int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2124 unsigned int flags)
2125{
2126 int fput_needed, err, datagrams;
2127 struct socket *sock;
2128 struct mmsghdr __user *entry;
2129 struct compat_mmsghdr __user *compat_entry;
2130 struct msghdr msg_sys;
c71d8ebe 2131 struct used_address used_address;
228e548e 2132
98382f41
AB
2133 if (vlen > UIO_MAXIOV)
2134 vlen = UIO_MAXIOV;
228e548e
AB
2135
2136 datagrams = 0;
2137
2138 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2139 if (!sock)
2140 return err;
2141
c71d8ebe 2142 used_address.name_len = UINT_MAX;
228e548e
AB
2143 entry = mmsg;
2144 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2145 err = 0;
228e548e
AB
2146
2147 while (datagrams < vlen) {
228e548e 2148 if (MSG_CMSG_COMPAT & flags) {
a7526eb5
AL
2149 err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
2150 &msg_sys, flags, &used_address);
228e548e
AB
2151 if (err < 0)
2152 break;
2153 err = __put_user(err, &compat_entry->msg_len);
2154 ++compat_entry;
2155 } else {
a7526eb5
AL
2156 err = ___sys_sendmsg(sock,
2157 (struct msghdr __user *)entry,
2158 &msg_sys, flags, &used_address);
228e548e
AB
2159 if (err < 0)
2160 break;
2161 err = put_user(err, &entry->msg_len);
2162 ++entry;
2163 }
2164
2165 if (err)
2166 break;
2167 ++datagrams;
2168 }
2169
228e548e
AB
2170 fput_light(sock->file, fput_needed);
2171
728ffb86
AB
2172 /* We only return an error if no datagrams were able to be sent */
2173 if (datagrams != 0)
228e548e
AB
2174 return datagrams;
2175
228e548e
AB
2176 return err;
2177}
2178
2179SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2180 unsigned int, vlen, unsigned int, flags)
2181{
1be374a0
AL
2182 if (flags & MSG_CMSG_COMPAT)
2183 return -EINVAL;
228e548e
AB
2184 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2185}
2186
a7526eb5 2187static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 2188 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2189{
89bddce5
SH
2190 struct compat_msghdr __user *msg_compat =
2191 (struct compat_msghdr __user *)msg;
1da177e4 2192 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2193 struct iovec *iov = iovstack;
1da177e4 2194 unsigned long cmsg_ptr;
a74e9106 2195 int err, total_len, len;
1da177e4
LT
2196
2197 /* kernel mode address */
230b1839 2198 struct sockaddr_storage addr;
1da177e4
LT
2199
2200 /* user mode address pointers */
2201 struct sockaddr __user *uaddr;
2202 int __user *uaddr_len;
89bddce5 2203
1da177e4 2204 if (MSG_CMSG_COMPAT & flags) {
a2e27255 2205 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2206 return -EFAULT;
1661bf36
DC
2207 } else {
2208 err = copy_msghdr_from_user(msg_sys, msg);
2209 if (err)
2210 return err;
2211 }
1da177e4 2212
a2e27255 2213 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
2214 err = -EMSGSIZE;
2215 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2216 goto out;
2217 err = -ENOMEM;
2218 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2219 GFP_KERNEL);
1da177e4 2220 if (!iov)
a2e27255 2221 goto out;
1da177e4
LT
2222 }
2223
2224 /*
89bddce5
SH
2225 * Save the user-mode address (verify_iovec will change the
2226 * kernel msghdr to use the kernel address space)
1da177e4 2227 */
89bddce5 2228
a2e27255 2229 uaddr = (__force void __user *)msg_sys->msg_name;
1da177e4
LT
2230 uaddr_len = COMPAT_NAMELEN(msg);
2231 if (MSG_CMSG_COMPAT & flags) {
43db362d 2232 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4 2233 } else
43db362d 2234 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4
LT
2235 if (err < 0)
2236 goto out_freeiov;
89bddce5 2237 total_len = err;
1da177e4 2238
a2e27255
ACM
2239 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2240 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2241
1da177e4
LT
2242 if (sock->file->f_flags & O_NONBLOCK)
2243 flags |= MSG_DONTWAIT;
a2e27255
ACM
2244 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2245 total_len, flags);
1da177e4
LT
2246 if (err < 0)
2247 goto out_freeiov;
2248 len = err;
2249
2250 if (uaddr != NULL) {
43db362d 2251 err = move_addr_to_user(&addr,
a2e27255 2252 msg_sys->msg_namelen, uaddr,
89bddce5 2253 uaddr_len);
1da177e4
LT
2254 if (err < 0)
2255 goto out_freeiov;
2256 }
a2e27255 2257 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2258 COMPAT_FLAGS(msg));
1da177e4
LT
2259 if (err)
2260 goto out_freeiov;
2261 if (MSG_CMSG_COMPAT & flags)
a2e27255 2262 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2263 &msg_compat->msg_controllen);
2264 else
a2e27255 2265 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2266 &msg->msg_controllen);
2267 if (err)
2268 goto out_freeiov;
2269 err = len;
2270
2271out_freeiov:
2272 if (iov != iovstack)
a74e9106 2273 kfree(iov);
a2e27255
ACM
2274out:
2275 return err;
2276}
2277
2278/*
2279 * BSD recvmsg interface
2280 */
2281
a7526eb5 2282long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
a2e27255
ACM
2283{
2284 int fput_needed, err;
2285 struct msghdr msg_sys;
1be374a0
AL
2286 struct socket *sock;
2287
1be374a0 2288 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2289 if (!sock)
2290 goto out;
2291
a7526eb5 2292 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2293
6cb153ca 2294 fput_light(sock->file, fput_needed);
1da177e4
LT
2295out:
2296 return err;
2297}
2298
a7526eb5
AL
2299SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2300 unsigned int, flags)
2301{
2302 if (flags & MSG_CMSG_COMPAT)
2303 return -EINVAL;
2304 return __sys_recvmsg(fd, msg, flags);
2305}
2306
a2e27255
ACM
2307/*
2308 * Linux recvmmsg interface
2309 */
2310
2311int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2312 unsigned int flags, struct timespec *timeout)
2313{
2314 int fput_needed, err, datagrams;
2315 struct socket *sock;
2316 struct mmsghdr __user *entry;
d7256d0e 2317 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2318 struct msghdr msg_sys;
2319 struct timespec end_time;
2320
2321 if (timeout &&
2322 poll_select_set_timeout(&end_time, timeout->tv_sec,
2323 timeout->tv_nsec))
2324 return -EINVAL;
2325
2326 datagrams = 0;
2327
2328 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2329 if (!sock)
2330 return err;
2331
2332 err = sock_error(sock->sk);
2333 if (err)
2334 goto out_put;
2335
2336 entry = mmsg;
d7256d0e 2337 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2338
2339 while (datagrams < vlen) {
2340 /*
2341 * No need to ask LSM for more than the first datagram.
2342 */
d7256d0e 2343 if (MSG_CMSG_COMPAT & flags) {
a7526eb5
AL
2344 err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
2345 &msg_sys, flags & ~MSG_WAITFORONE,
2346 datagrams);
d7256d0e
JMG
2347 if (err < 0)
2348 break;
2349 err = __put_user(err, &compat_entry->msg_len);
2350 ++compat_entry;
2351 } else {
a7526eb5
AL
2352 err = ___sys_recvmsg(sock,
2353 (struct msghdr __user *)entry,
2354 &msg_sys, flags & ~MSG_WAITFORONE,
2355 datagrams);
d7256d0e
JMG
2356 if (err < 0)
2357 break;
2358 err = put_user(err, &entry->msg_len);
2359 ++entry;
2360 }
2361
a2e27255
ACM
2362 if (err)
2363 break;
a2e27255
ACM
2364 ++datagrams;
2365
71c5c159
BB
2366 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2367 if (flags & MSG_WAITFORONE)
2368 flags |= MSG_DONTWAIT;
2369
a2e27255
ACM
2370 if (timeout) {
2371 ktime_get_ts(timeout);
2372 *timeout = timespec_sub(end_time, *timeout);
2373 if (timeout->tv_sec < 0) {
2374 timeout->tv_sec = timeout->tv_nsec = 0;
2375 break;
2376 }
2377
2378 /* Timeout, return less than vlen datagrams */
2379 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2380 break;
2381 }
2382
2383 /* Out of band data, return right away */
2384 if (msg_sys.msg_flags & MSG_OOB)
2385 break;
2386 }
2387
2388out_put:
2389 fput_light(sock->file, fput_needed);
1da177e4 2390
a2e27255
ACM
2391 if (err == 0)
2392 return datagrams;
2393
2394 if (datagrams != 0) {
2395 /*
2396 * We may return less entries than requested (vlen) if the
2397 * sock is non block and there aren't enough datagrams...
2398 */
2399 if (err != -EAGAIN) {
2400 /*
2401 * ... or if recvmsg returns an error after we
2402 * received some datagrams, where we record the
2403 * error to return on the next call or if the
2404 * app asks about it using getsockopt(SO_ERROR).
2405 */
2406 sock->sk->sk_err = -err;
2407 }
2408
2409 return datagrams;
2410 }
2411
2412 return err;
2413}
2414
2415SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2416 unsigned int, vlen, unsigned int, flags,
2417 struct timespec __user *, timeout)
2418{
2419 int datagrams;
2420 struct timespec timeout_sys;
2421
1be374a0
AL
2422 if (flags & MSG_CMSG_COMPAT)
2423 return -EINVAL;
2424
a2e27255
ACM
2425 if (!timeout)
2426 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2427
2428 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2429 return -EFAULT;
2430
2431 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2432
2433 if (datagrams > 0 &&
2434 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2435 datagrams = -EFAULT;
2436
2437 return datagrams;
2438}
2439
2440#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2441/* Argument list sizes for sys_socketcall */
2442#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2443static const unsigned char nargs[21] = {
c6d409cf
ED
2444 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2445 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2446 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2447 AL(4), AL(5), AL(4)
89bddce5
SH
2448};
2449
1da177e4
LT
2450#undef AL
2451
2452/*
89bddce5 2453 * System call vectors.
1da177e4
LT
2454 *
2455 * Argument checking cleaned up. Saved 20% in size.
2456 * This function doesn't need to set the kernel lock because
89bddce5 2457 * it is set by the callees.
1da177e4
LT
2458 */
2459
3e0fa65f 2460SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2461{
2950fa9d 2462 unsigned long a[AUDITSC_ARGS];
89bddce5 2463 unsigned long a0, a1;
1da177e4 2464 int err;
47379052 2465 unsigned int len;
1da177e4 2466
228e548e 2467 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2468 return -EINVAL;
2469
47379052
AV
2470 len = nargs[call];
2471 if (len > sizeof(a))
2472 return -EINVAL;
2473
1da177e4 2474 /* copy_from_user should be SMP safe. */
47379052 2475 if (copy_from_user(a, args, len))
1da177e4 2476 return -EFAULT;
3ec3b2fb 2477
2950fa9d
CG
2478 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2479 if (err)
2480 return err;
3ec3b2fb 2481
89bddce5
SH
2482 a0 = a[0];
2483 a1 = a[1];
2484
2485 switch (call) {
2486 case SYS_SOCKET:
2487 err = sys_socket(a0, a1, a[2]);
2488 break;
2489 case SYS_BIND:
2490 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2491 break;
2492 case SYS_CONNECT:
2493 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2494 break;
2495 case SYS_LISTEN:
2496 err = sys_listen(a0, a1);
2497 break;
2498 case SYS_ACCEPT:
de11defe
UD
2499 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2500 (int __user *)a[2], 0);
89bddce5
SH
2501 break;
2502 case SYS_GETSOCKNAME:
2503 err =
2504 sys_getsockname(a0, (struct sockaddr __user *)a1,
2505 (int __user *)a[2]);
2506 break;
2507 case SYS_GETPEERNAME:
2508 err =
2509 sys_getpeername(a0, (struct sockaddr __user *)a1,
2510 (int __user *)a[2]);
2511 break;
2512 case SYS_SOCKETPAIR:
2513 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2514 break;
2515 case SYS_SEND:
2516 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2517 break;
2518 case SYS_SENDTO:
2519 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2520 (struct sockaddr __user *)a[4], a[5]);
2521 break;
2522 case SYS_RECV:
2523 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2524 break;
2525 case SYS_RECVFROM:
2526 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2527 (struct sockaddr __user *)a[4],
2528 (int __user *)a[5]);
2529 break;
2530 case SYS_SHUTDOWN:
2531 err = sys_shutdown(a0, a1);
2532 break;
2533 case SYS_SETSOCKOPT:
2534 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2535 break;
2536 case SYS_GETSOCKOPT:
2537 err =
2538 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2539 (int __user *)a[4]);
2540 break;
2541 case SYS_SENDMSG:
2542 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2543 break;
228e548e
AB
2544 case SYS_SENDMMSG:
2545 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2546 break;
89bddce5
SH
2547 case SYS_RECVMSG:
2548 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2549 break;
a2e27255
ACM
2550 case SYS_RECVMMSG:
2551 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2552 (struct timespec __user *)a[4]);
2553 break;
de11defe
UD
2554 case SYS_ACCEPT4:
2555 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2556 (int __user *)a[2], a[3]);
aaca0bdc 2557 break;
89bddce5
SH
2558 default:
2559 err = -EINVAL;
2560 break;
1da177e4
LT
2561 }
2562 return err;
2563}
2564
89bddce5 2565#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2566
55737fda
SH
2567/**
2568 * sock_register - add a socket protocol handler
2569 * @ops: description of protocol
2570 *
1da177e4
LT
2571 * This function is called by a protocol handler that wants to
2572 * advertise its address family, and have it linked into the
55737fda
SH
2573 * socket interface. The value ops->family coresponds to the
2574 * socket system call protocol family.
1da177e4 2575 */
f0fd27d4 2576int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2577{
2578 int err;
2579
2580 if (ops->family >= NPROTO) {
89bddce5
SH
2581 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2582 NPROTO);
1da177e4
LT
2583 return -ENOBUFS;
2584 }
55737fda
SH
2585
2586 spin_lock(&net_family_lock);
190683a9
ED
2587 if (rcu_dereference_protected(net_families[ops->family],
2588 lockdep_is_held(&net_family_lock)))
55737fda
SH
2589 err = -EEXIST;
2590 else {
cf778b00 2591 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2592 err = 0;
2593 }
55737fda
SH
2594 spin_unlock(&net_family_lock);
2595
89bddce5 2596 printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2597 return err;
2598}
c6d409cf 2599EXPORT_SYMBOL(sock_register);
1da177e4 2600
55737fda
SH
2601/**
2602 * sock_unregister - remove a protocol handler
2603 * @family: protocol family to remove
2604 *
1da177e4
LT
2605 * This function is called by a protocol handler that wants to
2606 * remove its address family, and have it unlinked from the
55737fda
SH
2607 * new socket creation.
2608 *
2609 * If protocol handler is a module, then it can use module reference
2610 * counts to protect against new references. If protocol handler is not
2611 * a module then it needs to provide its own protection in
2612 * the ops->create routine.
1da177e4 2613 */
f0fd27d4 2614void sock_unregister(int family)
1da177e4 2615{
f0fd27d4 2616 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2617
55737fda 2618 spin_lock(&net_family_lock);
a9b3cd7f 2619 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2620 spin_unlock(&net_family_lock);
2621
2622 synchronize_rcu();
2623
89bddce5 2624 printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
1da177e4 2625}
c6d409cf 2626EXPORT_SYMBOL(sock_unregister);
1da177e4 2627
77d76ea3 2628static int __init sock_init(void)
1da177e4 2629{
b3e19d92 2630 int err;
2ca794e5
EB
2631 /*
2632 * Initialize the network sysctl infrastructure.
2633 */
2634 err = net_sysctl_init();
2635 if (err)
2636 goto out;
b3e19d92 2637
1da177e4 2638 /*
89bddce5 2639 * Initialize skbuff SLAB cache
1da177e4
LT
2640 */
2641 skb_init();
1da177e4
LT
2642
2643 /*
89bddce5 2644 * Initialize the protocols module.
1da177e4
LT
2645 */
2646
2647 init_inodecache();
b3e19d92
NP
2648
2649 err = register_filesystem(&sock_fs_type);
2650 if (err)
2651 goto out_fs;
1da177e4 2652 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2653 if (IS_ERR(sock_mnt)) {
2654 err = PTR_ERR(sock_mnt);
2655 goto out_mount;
2656 }
77d76ea3
AK
2657
2658 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2659 */
2660
2661#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2662 err = netfilter_init();
2663 if (err)
2664 goto out;
1da177e4 2665#endif
cbeb321a 2666
c1f19b51
RC
2667#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2668 skb_timestamping_init();
2669#endif
2670
b3e19d92
NP
2671out:
2672 return err;
2673
2674out_mount:
2675 unregister_filesystem(&sock_fs_type);
2676out_fs:
2677 goto out;
1da177e4
LT
2678}
2679
77d76ea3
AK
2680core_initcall(sock_init); /* early initcall */
2681
1da177e4
LT
2682#ifdef CONFIG_PROC_FS
2683void socket_seq_show(struct seq_file *seq)
2684{
2685 int cpu;
2686 int counter = 0;
2687
6f912042 2688 for_each_possible_cpu(cpu)
89bddce5 2689 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2690
2691 /* It can be negative, by the way. 8) */
2692 if (counter < 0)
2693 counter = 0;
2694
2695 seq_printf(seq, "sockets: used %d\n", counter);
2696}
89bddce5 2697#endif /* CONFIG_PROC_FS */
1da177e4 2698
89bbfc95 2699#ifdef CONFIG_COMPAT
6b96018b 2700static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2701 unsigned int cmd, void __user *up)
7a229387 2702{
7a229387
AB
2703 mm_segment_t old_fs = get_fs();
2704 struct timeval ktv;
2705 int err;
2706
2707 set_fs(KERNEL_DS);
6b96018b 2708 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2709 set_fs(old_fs);
644595f8 2710 if (!err)
ed6fe9d6 2711 err = compat_put_timeval(&ktv, up);
644595f8 2712
7a229387
AB
2713 return err;
2714}
2715
6b96018b 2716static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2717 unsigned int cmd, void __user *up)
7a229387 2718{
7a229387
AB
2719 mm_segment_t old_fs = get_fs();
2720 struct timespec kts;
2721 int err;
2722
2723 set_fs(KERNEL_DS);
6b96018b 2724 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2725 set_fs(old_fs);
644595f8 2726 if (!err)
ed6fe9d6 2727 err = compat_put_timespec(&kts, up);
644595f8 2728
7a229387
AB
2729 return err;
2730}
2731
6b96018b 2732static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2733{
2734 struct ifreq __user *uifr;
2735 int err;
2736
2737 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2738 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2739 return -EFAULT;
2740
6b96018b 2741 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2742 if (err)
2743 return err;
2744
6b96018b 2745 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2746 return -EFAULT;
2747
2748 return 0;
2749}
2750
6b96018b 2751static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2752{
6b96018b 2753 struct compat_ifconf ifc32;
7a229387
AB
2754 struct ifconf ifc;
2755 struct ifconf __user *uifc;
6b96018b 2756 struct compat_ifreq __user *ifr32;
7a229387
AB
2757 struct ifreq __user *ifr;
2758 unsigned int i, j;
2759 int err;
2760
6b96018b 2761 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2762 return -EFAULT;
2763
43da5f2e 2764 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2765 if (ifc32.ifcbuf == 0) {
2766 ifc32.ifc_len = 0;
2767 ifc.ifc_len = 0;
2768 ifc.ifc_req = NULL;
2769 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2770 } else {
c6d409cf
ED
2771 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2772 sizeof(struct ifreq);
7a229387
AB
2773 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2774 ifc.ifc_len = len;
2775 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2776 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2777 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2778 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2779 return -EFAULT;
2780 ifr++;
2781 ifr32++;
2782 }
2783 }
2784 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2785 return -EFAULT;
2786
6b96018b 2787 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2788 if (err)
2789 return err;
2790
2791 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2792 return -EFAULT;
2793
2794 ifr = ifc.ifc_req;
2795 ifr32 = compat_ptr(ifc32.ifcbuf);
2796 for (i = 0, j = 0;
c6d409cf
ED
2797 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2798 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2799 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2800 return -EFAULT;
2801 ifr32++;
2802 ifr++;
2803 }
2804
2805 if (ifc32.ifcbuf == 0) {
2806 /* Translate from 64-bit structure multiple to
2807 * a 32-bit one.
2808 */
2809 i = ifc.ifc_len;
6b96018b 2810 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2811 ifc32.ifc_len = i;
2812 } else {
2813 ifc32.ifc_len = i;
2814 }
6b96018b 2815 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2816 return -EFAULT;
2817
2818 return 0;
2819}
2820
6b96018b 2821static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2822{
3a7da39d
BH
2823 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2824 bool convert_in = false, convert_out = false;
2825 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2826 struct ethtool_rxnfc __user *rxnfc;
7a229387 2827 struct ifreq __user *ifr;
3a7da39d
BH
2828 u32 rule_cnt = 0, actual_rule_cnt;
2829 u32 ethcmd;
7a229387 2830 u32 data;
3a7da39d 2831 int ret;
7a229387 2832
3a7da39d
BH
2833 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2834 return -EFAULT;
7a229387 2835
3a7da39d
BH
2836 compat_rxnfc = compat_ptr(data);
2837
2838 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2839 return -EFAULT;
2840
3a7da39d
BH
2841 /* Most ethtool structures are defined without padding.
2842 * Unfortunately struct ethtool_rxnfc is an exception.
2843 */
2844 switch (ethcmd) {
2845 default:
2846 break;
2847 case ETHTOOL_GRXCLSRLALL:
2848 /* Buffer size is variable */
2849 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2850 return -EFAULT;
2851 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2852 return -ENOMEM;
2853 buf_size += rule_cnt * sizeof(u32);
2854 /* fall through */
2855 case ETHTOOL_GRXRINGS:
2856 case ETHTOOL_GRXCLSRLCNT:
2857 case ETHTOOL_GRXCLSRULE:
55664f32 2858 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2859 convert_out = true;
2860 /* fall through */
2861 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2862 buf_size += sizeof(struct ethtool_rxnfc);
2863 convert_in = true;
2864 break;
2865 }
2866
2867 ifr = compat_alloc_user_space(buf_size);
954b1244 2868 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2869
2870 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2871 return -EFAULT;
2872
3a7da39d
BH
2873 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2874 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2875 return -EFAULT;
2876
3a7da39d 2877 if (convert_in) {
127fe533 2878 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2879 * fs.ring_cookie and at the end of fs, but nowhere else.
2880 */
127fe533
AD
2881 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2882 sizeof(compat_rxnfc->fs.m_ext) !=
2883 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2884 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2885 BUILD_BUG_ON(
2886 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2887 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2888 offsetof(struct ethtool_rxnfc, fs.location) -
2889 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2890
2891 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2892 (void __user *)(&rxnfc->fs.m_ext + 1) -
2893 (void __user *)rxnfc) ||
3a7da39d
BH
2894 copy_in_user(&rxnfc->fs.ring_cookie,
2895 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2896 (void __user *)(&rxnfc->fs.location + 1) -
2897 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2898 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2899 sizeof(rxnfc->rule_cnt)))
2900 return -EFAULT;
2901 }
2902
2903 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2904 if (ret)
2905 return ret;
2906
2907 if (convert_out) {
2908 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2909 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2910 (const void __user *)rxnfc) ||
3a7da39d
BH
2911 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2912 &rxnfc->fs.ring_cookie,
954b1244
SH
2913 (const void __user *)(&rxnfc->fs.location + 1) -
2914 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2915 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2916 sizeof(rxnfc->rule_cnt)))
2917 return -EFAULT;
2918
2919 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2920 /* As an optimisation, we only copy the actual
2921 * number of rules that the underlying
2922 * function returned. Since Mallory might
2923 * change the rule count in user memory, we
2924 * check that it is less than the rule count
2925 * originally given (as the user buffer size),
2926 * which has been range-checked.
2927 */
2928 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2929 return -EFAULT;
2930 if (actual_rule_cnt < rule_cnt)
2931 rule_cnt = actual_rule_cnt;
2932 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2933 &rxnfc->rule_locs[0],
2934 rule_cnt * sizeof(u32)))
2935 return -EFAULT;
2936 }
2937 }
2938
2939 return 0;
7a229387
AB
2940}
2941
7a50a240
AB
2942static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2943{
2944 void __user *uptr;
2945 compat_uptr_t uptr32;
2946 struct ifreq __user *uifr;
2947
c6d409cf 2948 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2949 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2950 return -EFAULT;
2951
2952 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2953 return -EFAULT;
2954
2955 uptr = compat_ptr(uptr32);
2956
2957 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2958 return -EFAULT;
2959
2960 return dev_ioctl(net, SIOCWANDEV, uifr);
2961}
2962
6b96018b
AB
2963static int bond_ioctl(struct net *net, unsigned int cmd,
2964 struct compat_ifreq __user *ifr32)
7a229387
AB
2965{
2966 struct ifreq kifr;
7a229387
AB
2967 mm_segment_t old_fs;
2968 int err;
7a229387
AB
2969
2970 switch (cmd) {
2971 case SIOCBONDENSLAVE:
2972 case SIOCBONDRELEASE:
2973 case SIOCBONDSETHWADDR:
2974 case SIOCBONDCHANGEACTIVE:
6b96018b 2975 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2976 return -EFAULT;
2977
2978 old_fs = get_fs();
c6d409cf 2979 set_fs(KERNEL_DS);
c3f52ae6 2980 err = dev_ioctl(net, cmd,
2981 (struct ifreq __user __force *) &kifr);
c6d409cf 2982 set_fs(old_fs);
7a229387
AB
2983
2984 return err;
7a229387 2985 default:
07d106d0 2986 return -ENOIOCTLCMD;
ccbd6a5a 2987 }
7a229387
AB
2988}
2989
590d4693
BH
2990/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2991static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 2992 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2993{
2994 struct ifreq __user *u_ifreq64;
7a229387
AB
2995 char tmp_buf[IFNAMSIZ];
2996 void __user *data64;
2997 u32 data32;
2998
2999 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
3000 IFNAMSIZ))
3001 return -EFAULT;
417c3522 3002 if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
7a229387
AB
3003 return -EFAULT;
3004 data64 = compat_ptr(data32);
3005
3006 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
3007
7a229387
AB
3008 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
3009 IFNAMSIZ))
3010 return -EFAULT;
417c3522 3011 if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
7a229387
AB
3012 return -EFAULT;
3013
6b96018b 3014 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
3015}
3016
6b96018b
AB
3017static int dev_ifsioc(struct net *net, struct socket *sock,
3018 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 3019{
a2116ed2 3020 struct ifreq __user *uifr;
7a229387
AB
3021 int err;
3022
a2116ed2
AB
3023 uifr = compat_alloc_user_space(sizeof(*uifr));
3024 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3025 return -EFAULT;
3026
3027 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3028
7a229387
AB
3029 if (!err) {
3030 switch (cmd) {
3031 case SIOCGIFFLAGS:
3032 case SIOCGIFMETRIC:
3033 case SIOCGIFMTU:
3034 case SIOCGIFMEM:
3035 case SIOCGIFHWADDR:
3036 case SIOCGIFINDEX:
3037 case SIOCGIFADDR:
3038 case SIOCGIFBRDADDR:
3039 case SIOCGIFDSTADDR:
3040 case SIOCGIFNETMASK:
fab2532b 3041 case SIOCGIFPFLAGS:
7a229387 3042 case SIOCGIFTXQLEN:
fab2532b
AB
3043 case SIOCGMIIPHY:
3044 case SIOCGMIIREG:
a2116ed2 3045 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
3046 err = -EFAULT;
3047 break;
3048 }
3049 }
3050 return err;
3051}
3052
a2116ed2
AB
3053static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3054 struct compat_ifreq __user *uifr32)
3055{
3056 struct ifreq ifr;
3057 struct compat_ifmap __user *uifmap32;
3058 mm_segment_t old_fs;
3059 int err;
3060
3061 uifmap32 = &uifr32->ifr_ifru.ifru_map;
3062 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
3063 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3064 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3065 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3066 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
3067 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
3068 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
3069 if (err)
3070 return -EFAULT;
3071
3072 old_fs = get_fs();
c6d409cf 3073 set_fs(KERNEL_DS);
c3f52ae6 3074 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3075 set_fs(old_fs);
a2116ed2
AB
3076
3077 if (cmd == SIOCGIFMAP && !err) {
3078 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
3079 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3080 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3081 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3082 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
3083 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
3084 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
3085 if (err)
3086 err = -EFAULT;
3087 }
3088 return err;
3089}
3090
7a229387 3091struct rtentry32 {
c6d409cf 3092 u32 rt_pad1;
7a229387
AB
3093 struct sockaddr rt_dst; /* target address */
3094 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3095 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3096 unsigned short rt_flags;
3097 short rt_pad2;
3098 u32 rt_pad3;
3099 unsigned char rt_tos;
3100 unsigned char rt_class;
3101 short rt_pad4;
3102 short rt_metric; /* +1 for binary compatibility! */
7a229387 3103 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3104 u32 rt_mtu; /* per route MTU/Window */
3105 u32 rt_window; /* Window clamping */
7a229387
AB
3106 unsigned short rt_irtt; /* Initial RTT */
3107};
3108
3109struct in6_rtmsg32 {
3110 struct in6_addr rtmsg_dst;
3111 struct in6_addr rtmsg_src;
3112 struct in6_addr rtmsg_gateway;
3113 u32 rtmsg_type;
3114 u16 rtmsg_dst_len;
3115 u16 rtmsg_src_len;
3116 u32 rtmsg_metric;
3117 u32 rtmsg_info;
3118 u32 rtmsg_flags;
3119 s32 rtmsg_ifindex;
3120};
3121
6b96018b
AB
3122static int routing_ioctl(struct net *net, struct socket *sock,
3123 unsigned int cmd, void __user *argp)
7a229387
AB
3124{
3125 int ret;
3126 void *r = NULL;
3127 struct in6_rtmsg r6;
3128 struct rtentry r4;
3129 char devname[16];
3130 u32 rtdev;
3131 mm_segment_t old_fs = get_fs();
3132
6b96018b
AB
3133 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3134 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3135 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3136 3 * sizeof(struct in6_addr));
3ddc5b46
MD
3137 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3138 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3139 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3140 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3141 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3142 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3143 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3144
3145 r = (void *) &r6;
3146 } else { /* ipv4 */
6b96018b 3147 struct rtentry32 __user *ur4 = argp;
c6d409cf 3148 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3149 3 * sizeof(struct sockaddr));
3ddc5b46
MD
3150 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3151 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3152 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3153 ret |= get_user(r4.rt_window, &(ur4->rt_window));
3154 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3155 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 3156 if (rtdev) {
c6d409cf 3157 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3158 r4.rt_dev = (char __user __force *)devname;
3159 devname[15] = 0;
7a229387
AB
3160 } else
3161 r4.rt_dev = NULL;
3162
3163 r = (void *) &r4;
3164 }
3165
3166 if (ret) {
3167 ret = -EFAULT;
3168 goto out;
3169 }
3170
c6d409cf 3171 set_fs(KERNEL_DS);
6b96018b 3172 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3173 set_fs(old_fs);
7a229387
AB
3174
3175out:
7a229387
AB
3176 return ret;
3177}
3178
3179/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3180 * for some operations; this forces use of the newer bridge-utils that
25985edc 3181 * use compatible ioctls
7a229387 3182 */
6b96018b 3183static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3184{
6b96018b 3185 compat_ulong_t tmp;
7a229387 3186
6b96018b 3187 if (get_user(tmp, argp))
7a229387
AB
3188 return -EFAULT;
3189 if (tmp == BRCTL_GET_VERSION)
3190 return BRCTL_VERSION + 1;
3191 return -EINVAL;
3192}
3193
6b96018b
AB
3194static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3195 unsigned int cmd, unsigned long arg)
3196{
3197 void __user *argp = compat_ptr(arg);
3198 struct sock *sk = sock->sk;
3199 struct net *net = sock_net(sk);
7a229387 3200
6b96018b 3201 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3202 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3203
3204 switch (cmd) {
3205 case SIOCSIFBR:
3206 case SIOCGIFBR:
3207 return old_bridge_ioctl(argp);
3208 case SIOCGIFNAME:
3209 return dev_ifname32(net, argp);
3210 case SIOCGIFCONF:
3211 return dev_ifconf(net, argp);
3212 case SIOCETHTOOL:
3213 return ethtool_ioctl(net, argp);
7a50a240
AB
3214 case SIOCWANDEV:
3215 return compat_siocwandev(net, argp);
a2116ed2
AB
3216 case SIOCGIFMAP:
3217 case SIOCSIFMAP:
3218 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3219 case SIOCBONDENSLAVE:
3220 case SIOCBONDRELEASE:
3221 case SIOCBONDSETHWADDR:
6b96018b
AB
3222 case SIOCBONDCHANGEACTIVE:
3223 return bond_ioctl(net, cmd, argp);
3224 case SIOCADDRT:
3225 case SIOCDELRT:
3226 return routing_ioctl(net, sock, cmd, argp);
3227 case SIOCGSTAMP:
3228 return do_siocgstamp(net, sock, cmd, argp);
3229 case SIOCGSTAMPNS:
3230 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3231 case SIOCBONDSLAVEINFOQUERY:
3232 case SIOCBONDINFOQUERY:
a2116ed2 3233 case SIOCSHWTSTAMP:
590d4693 3234 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3235
3236 case FIOSETOWN:
3237 case SIOCSPGRP:
3238 case FIOGETOWN:
3239 case SIOCGPGRP:
3240 case SIOCBRADDBR:
3241 case SIOCBRDELBR:
3242 case SIOCGIFVLAN:
3243 case SIOCSIFVLAN:
3244 case SIOCADDDLCI:
3245 case SIOCDELDLCI:
3246 return sock_ioctl(file, cmd, arg);
3247
3248 case SIOCGIFFLAGS:
3249 case SIOCSIFFLAGS:
3250 case SIOCGIFMETRIC:
3251 case SIOCSIFMETRIC:
3252 case SIOCGIFMTU:
3253 case SIOCSIFMTU:
3254 case SIOCGIFMEM:
3255 case SIOCSIFMEM:
3256 case SIOCGIFHWADDR:
3257 case SIOCSIFHWADDR:
3258 case SIOCADDMULTI:
3259 case SIOCDELMULTI:
3260 case SIOCGIFINDEX:
6b96018b
AB
3261 case SIOCGIFADDR:
3262 case SIOCSIFADDR:
3263 case SIOCSIFHWBROADCAST:
6b96018b 3264 case SIOCDIFADDR:
6b96018b
AB
3265 case SIOCGIFBRDADDR:
3266 case SIOCSIFBRDADDR:
3267 case SIOCGIFDSTADDR:
3268 case SIOCSIFDSTADDR:
3269 case SIOCGIFNETMASK:
3270 case SIOCSIFNETMASK:
3271 case SIOCSIFPFLAGS:
3272 case SIOCGIFPFLAGS:
3273 case SIOCGIFTXQLEN:
3274 case SIOCSIFTXQLEN:
3275 case SIOCBRADDIF:
3276 case SIOCBRDELIF:
9177efd3
AB
3277 case SIOCSIFNAME:
3278 case SIOCGMIIPHY:
3279 case SIOCGMIIREG:
3280 case SIOCSMIIREG:
6b96018b 3281 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3282
6b96018b
AB
3283 case SIOCSARP:
3284 case SIOCGARP:
3285 case SIOCDARP:
6b96018b 3286 case SIOCATMARK:
9177efd3
AB
3287 return sock_do_ioctl(net, sock, cmd, arg);
3288 }
3289
6b96018b
AB
3290 return -ENOIOCTLCMD;
3291}
7a229387 3292
95c96174 3293static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3294 unsigned long arg)
89bbfc95
SP
3295{
3296 struct socket *sock = file->private_data;
3297 int ret = -ENOIOCTLCMD;
87de87d5
DM
3298 struct sock *sk;
3299 struct net *net;
3300
3301 sk = sock->sk;
3302 net = sock_net(sk);
89bbfc95
SP
3303
3304 if (sock->ops->compat_ioctl)
3305 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3306
87de87d5
DM
3307 if (ret == -ENOIOCTLCMD &&
3308 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3309 ret = compat_wext_handle_ioctl(net, cmd, arg);
3310
6b96018b
AB
3311 if (ret == -ENOIOCTLCMD)
3312 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3313
89bbfc95
SP
3314 return ret;
3315}
3316#endif
3317
ac5a488e
SS
3318int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3319{
3320 return sock->ops->bind(sock, addr, addrlen);
3321}
c6d409cf 3322EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3323
3324int kernel_listen(struct socket *sock, int backlog)
3325{
3326 return sock->ops->listen(sock, backlog);
3327}
c6d409cf 3328EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3329
3330int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3331{
3332 struct sock *sk = sock->sk;
3333 int err;
3334
3335 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3336 newsock);
3337 if (err < 0)
3338 goto done;
3339
3340 err = sock->ops->accept(sock, *newsock, flags);
3341 if (err < 0) {
3342 sock_release(*newsock);
fa8705b0 3343 *newsock = NULL;
ac5a488e
SS
3344 goto done;
3345 }
3346
3347 (*newsock)->ops = sock->ops;
1b08534e 3348 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3349
3350done:
3351 return err;
3352}
c6d409cf 3353EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3354
3355int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3356 int flags)
ac5a488e
SS
3357{
3358 return sock->ops->connect(sock, addr, addrlen, flags);
3359}
c6d409cf 3360EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3361
3362int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3363 int *addrlen)
3364{
3365 return sock->ops->getname(sock, addr, addrlen, 0);
3366}
c6d409cf 3367EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3368
3369int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3370 int *addrlen)
3371{
3372 return sock->ops->getname(sock, addr, addrlen, 1);
3373}
c6d409cf 3374EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3375
3376int kernel_getsockopt(struct socket *sock, int level, int optname,
3377 char *optval, int *optlen)
3378{
3379 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3380 char __user *uoptval;
3381 int __user *uoptlen;
ac5a488e
SS
3382 int err;
3383
fb8621bb
NK
3384 uoptval = (char __user __force *) optval;
3385 uoptlen = (int __user __force *) optlen;
3386
ac5a488e
SS
3387 set_fs(KERNEL_DS);
3388 if (level == SOL_SOCKET)
fb8621bb 3389 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3390 else
fb8621bb
NK
3391 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3392 uoptlen);
ac5a488e
SS
3393 set_fs(oldfs);
3394 return err;
3395}
c6d409cf 3396EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3397
3398int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3399 char *optval, unsigned int optlen)
ac5a488e
SS
3400{
3401 mm_segment_t oldfs = get_fs();
fb8621bb 3402 char __user *uoptval;
ac5a488e
SS
3403 int err;
3404
fb8621bb
NK
3405 uoptval = (char __user __force *) optval;
3406
ac5a488e
SS
3407 set_fs(KERNEL_DS);
3408 if (level == SOL_SOCKET)
fb8621bb 3409 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3410 else
fb8621bb 3411 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3412 optlen);
3413 set_fs(oldfs);
3414 return err;
3415}
c6d409cf 3416EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3417
3418int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3419 size_t size, int flags)
3420{
3421 if (sock->ops->sendpage)
3422 return sock->ops->sendpage(sock, page, offset, size, flags);
3423
3424 return sock_no_sendpage(sock, page, offset, size, flags);
3425}
c6d409cf 3426EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3427
3428int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3429{
3430 mm_segment_t oldfs = get_fs();
3431 int err;
3432
3433 set_fs(KERNEL_DS);
3434 err = sock->ops->ioctl(sock, cmd, arg);
3435 set_fs(oldfs);
3436
3437 return err;
3438}
c6d409cf 3439EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3440
91cf45f0
TM
3441int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3442{
3443 return sock->ops->shutdown(sock, how);
3444}
91cf45f0 3445EXPORT_SYMBOL(kernel_sock_shutdown);