Merge remote-tracking branch 'dh/afs' into for-davem
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
408eccce 75#include <linux/ptp_classify.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
600e1779 91#include <linux/xattr.h>
1da177e4
LT
92
93#include <asm/uaccess.h>
94#include <asm/unistd.h>
95
96#include <net/compat.h>
87de87d5 97#include <net/wext.h>
f8451725 98#include <net/cls_cgroup.h>
1da177e4
LT
99
100#include <net/sock.h>
101#include <linux/netfilter.h>
102
6b96018b
AB
103#include <linux/if_tun.h>
104#include <linux/ipv6_route.h>
105#include <linux/route.h>
6b96018b
AB
106#include <linux/sockios.h>
107#include <linux/atalk.h>
076bb0c8 108#include <net/busy_poll.h>
f24b9be5 109#include <linux/errqueue.h>
06021292 110
e0d1095a 111#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
112unsigned int sysctl_net_busy_read __read_mostly;
113unsigned int sysctl_net_busy_poll __read_mostly;
06021292 114#endif
6b96018b 115
8ae5e030
AV
116static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
117static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
89bddce5 118static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
119
120static int sock_close(struct inode *inode, struct file *file);
121static unsigned int sock_poll(struct file *file,
122 struct poll_table_struct *wait);
89bddce5 123static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
124#ifdef CONFIG_COMPAT
125static long compat_sock_ioctl(struct file *file,
89bddce5 126 unsigned int cmd, unsigned long arg);
89bbfc95 127#endif
1da177e4 128static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
129static ssize_t sock_sendpage(struct file *file, struct page *page,
130 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 131static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 132 struct pipe_inode_info *pipe, size_t len,
9c55e01c 133 unsigned int flags);
1da177e4 134
1da177e4
LT
135/*
136 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
137 * in the operation structures but are done directly via the socketcall() multiplexor.
138 */
139
da7071d7 140static const struct file_operations socket_file_ops = {
1da177e4
LT
141 .owner = THIS_MODULE,
142 .llseek = no_llseek,
8ae5e030
AV
143 .read = new_sync_read,
144 .write = new_sync_write,
145 .read_iter = sock_read_iter,
146 .write_iter = sock_write_iter,
1da177e4
LT
147 .poll = sock_poll,
148 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
149#ifdef CONFIG_COMPAT
150 .compat_ioctl = compat_sock_ioctl,
151#endif
1da177e4 152 .mmap = sock_mmap,
1da177e4
LT
153 .release = sock_close,
154 .fasync = sock_fasync,
5274f052
JA
155 .sendpage = sock_sendpage,
156 .splice_write = generic_splice_sendpage,
9c55e01c 157 .splice_read = sock_splice_read,
1da177e4
LT
158};
159
160/*
161 * The protocol list. Each protocol is registered in here.
162 */
163
1da177e4 164static DEFINE_SPINLOCK(net_family_lock);
190683a9 165static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 166
1da177e4
LT
167/*
168 * Statistics counters of the socket lists
169 */
170
c6d409cf 171static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
172
173/*
89bddce5
SH
174 * Support routines.
175 * Move socket addresses back and forth across the kernel/user
176 * divide and look after the messy bits.
1da177e4
LT
177 */
178
1da177e4
LT
179/**
180 * move_addr_to_kernel - copy a socket address into kernel space
181 * @uaddr: Address in user space
182 * @kaddr: Address in kernel space
183 * @ulen: Length in user space
184 *
185 * The address is copied into kernel space. If the provided address is
186 * too long an error code of -EINVAL is returned. If the copy gives
187 * invalid addresses -EFAULT is returned. On a success 0 is returned.
188 */
189
43db362d 190int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 191{
230b1839 192 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 193 return -EINVAL;
89bddce5 194 if (ulen == 0)
1da177e4 195 return 0;
89bddce5 196 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 197 return -EFAULT;
3ec3b2fb 198 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
199}
200
201/**
202 * move_addr_to_user - copy an address to user space
203 * @kaddr: kernel space address
204 * @klen: length of address in kernel
205 * @uaddr: user space address
206 * @ulen: pointer to user length field
207 *
208 * The value pointed to by ulen on entry is the buffer length available.
209 * This is overwritten with the buffer space used. -EINVAL is returned
210 * if an overlong buffer is specified or a negative buffer size. -EFAULT
211 * is returned if either the buffer or the length field are not
212 * accessible.
213 * After copying the data up to the limit the user specifies, the true
214 * length of the data is written over the length limit the user
215 * specified. Zero is returned for a success.
216 */
89bddce5 217
43db362d 218static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 219 void __user *uaddr, int __user *ulen)
1da177e4
LT
220{
221 int err;
222 int len;
223
68c6beb3 224 BUG_ON(klen > sizeof(struct sockaddr_storage));
89bddce5
SH
225 err = get_user(len, ulen);
226 if (err)
1da177e4 227 return err;
89bddce5
SH
228 if (len > klen)
229 len = klen;
68c6beb3 230 if (len < 0)
1da177e4 231 return -EINVAL;
89bddce5 232 if (len) {
d6fe3945
SG
233 if (audit_sockaddr(klen, kaddr))
234 return -ENOMEM;
89bddce5 235 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
236 return -EFAULT;
237 }
238 /*
89bddce5
SH
239 * "fromlen shall refer to the value before truncation.."
240 * 1003.1g
1da177e4
LT
241 */
242 return __put_user(klen, ulen);
243}
244
e18b890b 245static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
246
247static struct inode *sock_alloc_inode(struct super_block *sb)
248{
249 struct socket_alloc *ei;
eaefd110 250 struct socket_wq *wq;
89bddce5 251
e94b1766 252 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
253 if (!ei)
254 return NULL;
eaefd110
ED
255 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
256 if (!wq) {
43815482
ED
257 kmem_cache_free(sock_inode_cachep, ei);
258 return NULL;
259 }
eaefd110
ED
260 init_waitqueue_head(&wq->wait);
261 wq->fasync_list = NULL;
262 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 263
1da177e4
LT
264 ei->socket.state = SS_UNCONNECTED;
265 ei->socket.flags = 0;
266 ei->socket.ops = NULL;
267 ei->socket.sk = NULL;
268 ei->socket.file = NULL;
1da177e4
LT
269
270 return &ei->vfs_inode;
271}
272
273static void sock_destroy_inode(struct inode *inode)
274{
43815482 275 struct socket_alloc *ei;
eaefd110 276 struct socket_wq *wq;
43815482
ED
277
278 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 279 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 280 kfree_rcu(wq, rcu);
43815482 281 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
282}
283
51cc5068 284static void init_once(void *foo)
1da177e4 285{
89bddce5 286 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 287
a35afb83 288 inode_init_once(&ei->vfs_inode);
1da177e4 289}
89bddce5 290
1da177e4
LT
291static int init_inodecache(void)
292{
293 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
294 sizeof(struct socket_alloc),
295 0,
296 (SLAB_HWCACHE_ALIGN |
297 SLAB_RECLAIM_ACCOUNT |
298 SLAB_MEM_SPREAD),
20c2df83 299 init_once);
1da177e4
LT
300 if (sock_inode_cachep == NULL)
301 return -ENOMEM;
302 return 0;
303}
304
b87221de 305static const struct super_operations sockfs_ops = {
c6d409cf
ED
306 .alloc_inode = sock_alloc_inode,
307 .destroy_inode = sock_destroy_inode,
308 .statfs = simple_statfs,
1da177e4
LT
309};
310
c23fbb6b
ED
311/*
312 * sockfs_dname() is called from d_path().
313 */
314static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
315{
316 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
317 dentry->d_inode->i_ino);
318}
319
3ba13d17 320static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 321 .d_dname = sockfs_dname,
1da177e4
LT
322};
323
c74a1cbb
AV
324static struct dentry *sockfs_mount(struct file_system_type *fs_type,
325 int flags, const char *dev_name, void *data)
326{
327 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
328 &sockfs_dentry_operations, SOCKFS_MAGIC);
329}
330
331static struct vfsmount *sock_mnt __read_mostly;
332
333static struct file_system_type sock_fs_type = {
334 .name = "sockfs",
335 .mount = sockfs_mount,
336 .kill_sb = kill_anon_super,
337};
338
1da177e4
LT
339/*
340 * Obtains the first available file descriptor and sets it up for use.
341 *
39d8c1b6
DM
342 * These functions create file structures and maps them to fd space
343 * of the current process. On success it returns file descriptor
1da177e4
LT
344 * and file struct implicitly stored in sock->file.
345 * Note that another thread may close file descriptor before we return
346 * from this function. We use the fact that now we do not refer
347 * to socket after mapping. If one day we will need it, this
348 * function will increment ref. count on file by 1.
349 *
350 * In any case returned fd MAY BE not valid!
351 * This race condition is unavoidable
352 * with shared fd spaces, we cannot solve it inside kernel,
353 * but we take care of internal coherence yet.
354 */
355
aab174f0 356struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 357{
7cbe66b6 358 struct qstr name = { .name = "" };
2c48b9c4 359 struct path path;
7cbe66b6 360 struct file *file;
1da177e4 361
600e1779
MY
362 if (dname) {
363 name.name = dname;
364 name.len = strlen(name.name);
365 } else if (sock->sk) {
366 name.name = sock->sk->sk_prot_creator->name;
367 name.len = strlen(name.name);
368 }
4b936885 369 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
370 if (unlikely(!path.dentry))
371 return ERR_PTR(-ENOMEM);
2c48b9c4 372 path.mnt = mntget(sock_mnt);
39d8c1b6 373
2c48b9c4 374 d_instantiate(path.dentry, SOCK_INODE(sock));
39d8c1b6 375
2c48b9c4 376 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 377 &socket_file_ops);
39b65252 378 if (unlikely(IS_ERR(file))) {
cc3808f8 379 /* drop dentry, keep inode */
7de9c6ee 380 ihold(path.dentry->d_inode);
2c48b9c4 381 path_put(&path);
39b65252 382 return file;
cc3808f8
AV
383 }
384
385 sock->file = file;
77d27200 386 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 387 file->private_data = sock;
28407630 388 return file;
39d8c1b6 389}
56b31d1c 390EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 391
56b31d1c 392static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
393{
394 struct file *newfile;
28407630
AV
395 int fd = get_unused_fd_flags(flags);
396 if (unlikely(fd < 0))
397 return fd;
39d8c1b6 398
aab174f0 399 newfile = sock_alloc_file(sock, flags, NULL);
28407630 400 if (likely(!IS_ERR(newfile))) {
39d8c1b6 401 fd_install(fd, newfile);
28407630
AV
402 return fd;
403 }
7cbe66b6 404
28407630
AV
405 put_unused_fd(fd);
406 return PTR_ERR(newfile);
1da177e4
LT
407}
408
406a3c63 409struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 410{
6cb153ca
BL
411 if (file->f_op == &socket_file_ops)
412 return file->private_data; /* set in sock_map_fd */
413
23bb80d2
ED
414 *err = -ENOTSOCK;
415 return NULL;
6cb153ca 416}
406a3c63 417EXPORT_SYMBOL(sock_from_file);
6cb153ca 418
1da177e4 419/**
c6d409cf 420 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
421 * @fd: file handle
422 * @err: pointer to an error code return
423 *
424 * The file handle passed in is locked and the socket it is bound
425 * too is returned. If an error occurs the err pointer is overwritten
426 * with a negative errno code and NULL is returned. The function checks
427 * for both invalid handles and passing a handle which is not a socket.
428 *
429 * On a success the socket object pointer is returned.
430 */
431
432struct socket *sockfd_lookup(int fd, int *err)
433{
434 struct file *file;
1da177e4
LT
435 struct socket *sock;
436
89bddce5
SH
437 file = fget(fd);
438 if (!file) {
1da177e4
LT
439 *err = -EBADF;
440 return NULL;
441 }
89bddce5 442
6cb153ca
BL
443 sock = sock_from_file(file, err);
444 if (!sock)
1da177e4 445 fput(file);
6cb153ca
BL
446 return sock;
447}
c6d409cf 448EXPORT_SYMBOL(sockfd_lookup);
1da177e4 449
6cb153ca
BL
450static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
451{
00e188ef 452 struct fd f = fdget(fd);
6cb153ca
BL
453 struct socket *sock;
454
3672558c 455 *err = -EBADF;
00e188ef
AV
456 if (f.file) {
457 sock = sock_from_file(f.file, err);
458 if (likely(sock)) {
459 *fput_needed = f.flags;
6cb153ca 460 return sock;
00e188ef
AV
461 }
462 fdput(f);
1da177e4 463 }
6cb153ca 464 return NULL;
1da177e4
LT
465}
466
600e1779
MY
467#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
468#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
469#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
470static ssize_t sockfs_getxattr(struct dentry *dentry,
471 const char *name, void *value, size_t size)
472{
473 const char *proto_name;
474 size_t proto_size;
475 int error;
476
477 error = -ENODATA;
478 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
479 proto_name = dentry->d_name.name;
480 proto_size = strlen(proto_name);
481
482 if (value) {
483 error = -ERANGE;
484 if (proto_size + 1 > size)
485 goto out;
486
487 strncpy(value, proto_name, proto_size + 1);
488 }
489 error = proto_size + 1;
490 }
491
492out:
493 return error;
494}
495
496static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
497 size_t size)
498{
499 ssize_t len;
500 ssize_t used = 0;
501
502 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
503 if (len < 0)
504 return len;
505 used += len;
506 if (buffer) {
507 if (size < used)
508 return -ERANGE;
509 buffer += len;
510 }
511
512 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
513 used += len;
514 if (buffer) {
515 if (size < used)
516 return -ERANGE;
517 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
518 buffer += len;
519 }
520
521 return used;
522}
523
524static const struct inode_operations sockfs_inode_ops = {
525 .getxattr = sockfs_getxattr,
526 .listxattr = sockfs_listxattr,
527};
528
1da177e4
LT
529/**
530 * sock_alloc - allocate a socket
89bddce5 531 *
1da177e4
LT
532 * Allocate a new inode and socket object. The two are bound together
533 * and initialised. The socket is then returned. If we are out of inodes
534 * NULL is returned.
535 */
536
537static struct socket *sock_alloc(void)
538{
89bddce5
SH
539 struct inode *inode;
540 struct socket *sock;
1da177e4 541
a209dfc7 542 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
543 if (!inode)
544 return NULL;
545
546 sock = SOCKET_I(inode);
547
29a020d3 548 kmemcheck_annotate_bitfield(sock, type);
85fe4025 549 inode->i_ino = get_next_ino();
89bddce5 550 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
551 inode->i_uid = current_fsuid();
552 inode->i_gid = current_fsgid();
600e1779 553 inode->i_op = &sockfs_inode_ops;
1da177e4 554
19e8d69c 555 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
556 return sock;
557}
558
1da177e4
LT
559/**
560 * sock_release - close a socket
561 * @sock: socket to close
562 *
563 * The socket is released from the protocol stack if it has a release
564 * callback, and the inode is then released if the socket is bound to
89bddce5 565 * an inode not a file.
1da177e4 566 */
89bddce5 567
1da177e4
LT
568void sock_release(struct socket *sock)
569{
570 if (sock->ops) {
571 struct module *owner = sock->ops->owner;
572
573 sock->ops->release(sock);
574 sock->ops = NULL;
575 module_put(owner);
576 }
577
eaefd110 578 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
3410f22e 579 pr_err("%s: fasync list not empty!\n", __func__);
1da177e4 580
b09e786b
MP
581 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
582 return;
583
19e8d69c 584 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
585 if (!sock->file) {
586 iput(SOCK_INODE(sock));
587 return;
588 }
89bddce5 589 sock->file = NULL;
1da177e4 590}
c6d409cf 591EXPORT_SYMBOL(sock_release);
1da177e4 592
67cc0d40 593void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags)
20d49473 594{
140c55d4
ED
595 u8 flags = *tx_flags;
596
b9f40e21 597 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
140c55d4
ED
598 flags |= SKBTX_HW_TSTAMP;
599
b9f40e21 600 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
140c55d4
ED
601 flags |= SKBTX_SW_TSTAMP;
602
e7fd2885 603 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)
140c55d4
ED
604 flags |= SKBTX_SCHED_TSTAMP;
605
e1c8a607 606 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)
140c55d4 607 flags |= SKBTX_ACK_TSTAMP;
e7fd2885 608
140c55d4 609 *tx_flags = flags;
20d49473 610}
67cc0d40 611EXPORT_SYMBOL(__sock_tx_timestamp);
20d49473 612
d8725c86 613static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
1da177e4 614{
d8725c86
AV
615 int ret = sock->ops->sendmsg(sock, msg, iov_iter_count(&msg->msg_iter));
616 BUG_ON(ret == -EIOCBQUEUED);
617 return ret;
1da177e4
LT
618}
619
d8725c86 620int sock_sendmsg(struct socket *sock, struct msghdr *msg)
228e548e 621{
d8725c86
AV
622 int err = security_socket_sendmsg(sock, msg,
623 iov_iter_count(&msg->msg_iter));
228e548e 624
d8725c86 625 return err ?: sock_sendmsg_nosec(sock, msg);
0cf00c6f 626}
c6d409cf 627EXPORT_SYMBOL(sock_sendmsg);
1da177e4
LT
628
629int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
630 struct kvec *vec, size_t num, size_t size)
631{
6aa24814 632 iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
d8725c86 633 return sock_sendmsg(sock, msg);
1da177e4 634}
c6d409cf 635EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 636
92f37fd2
ED
637/*
638 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
639 */
640void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
641 struct sk_buff *skb)
642{
20d49473 643 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
f24b9be5 644 struct scm_timestamping tss;
20d49473
PO
645 int empty = 1;
646 struct skb_shared_hwtstamps *shhwtstamps =
647 skb_hwtstamps(skb);
648
649 /* Race occurred between timestamp enabling and packet
650 receiving. Fill in the current time for now. */
651 if (need_software_tstamp && skb->tstamp.tv64 == 0)
652 __net_timestamp(skb);
653
654 if (need_software_tstamp) {
655 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
656 struct timeval tv;
657 skb_get_timestamp(skb, &tv);
658 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
659 sizeof(tv), &tv);
660 } else {
f24b9be5
WB
661 struct timespec ts;
662 skb_get_timestampns(skb, &ts);
20d49473 663 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
f24b9be5 664 sizeof(ts), &ts);
20d49473
PO
665 }
666 }
667
f24b9be5 668 memset(&tss, 0, sizeof(tss));
c199105d 669 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
f24b9be5 670 ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
20d49473 671 empty = 0;
4d276eb6 672 if (shhwtstamps &&
b9f40e21 673 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
f24b9be5 674 ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
4d276eb6 675 empty = 0;
20d49473
PO
676 if (!empty)
677 put_cmsg(msg, SOL_SOCKET,
f24b9be5 678 SCM_TIMESTAMPING, sizeof(tss), &tss);
92f37fd2 679}
7c81fd8b
ACM
680EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
681
6e3e939f
JB
682void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
683 struct sk_buff *skb)
684{
685 int ack;
686
687 if (!sock_flag(sk, SOCK_WIFI_STATUS))
688 return;
689 if (!skb->wifi_acked_valid)
690 return;
691
692 ack = skb->wifi_acked;
693
694 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
695}
696EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
697
11165f14 698static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
699 struct sk_buff *skb)
3b885787 700{
744d5a3e 701 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
3b885787 702 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
744d5a3e 703 sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
3b885787
NH
704}
705
767dd033 706void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
707 struct sk_buff *skb)
708{
709 sock_recv_timestamp(msg, sk, skb);
710 sock_recv_drops(msg, sk, skb);
711}
767dd033 712EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 713
1b784140
YX
714static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
715 size_t size, int flags)
1da177e4 716{
1b784140 717 return sock->ops->recvmsg(sock, msg, size, flags);
1da177e4
LT
718}
719
1b784140
YX
720int sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
721 int flags)
a2e27255
ACM
722{
723 int err = security_socket_recvmsg(sock, msg, size, flags);
724
1b784140 725 return err ?: sock_recvmsg_nosec(sock, msg, size, flags);
1da177e4 726}
c6d409cf 727EXPORT_SYMBOL(sock_recvmsg);
1da177e4 728
c1249c0a
ML
729/**
730 * kernel_recvmsg - Receive a message from a socket (kernel space)
731 * @sock: The socket to receive the message from
732 * @msg: Received message
733 * @vec: Input s/g array for message data
734 * @num: Size of input s/g array
735 * @size: Number of bytes to read
736 * @flags: Message flags (MSG_DONTWAIT, etc...)
737 *
738 * On return the msg structure contains the scatter/gather array passed in the
739 * vec argument. The array is modified so that it consists of the unfilled
740 * portion of the original array.
741 *
742 * The returned value is the total number of bytes received, or an error.
743 */
89bddce5
SH
744int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
745 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
746{
747 mm_segment_t oldfs = get_fs();
748 int result;
749
6aa24814 750 iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
1da177e4 751 set_fs(KERNEL_DS);
1da177e4
LT
752 result = sock_recvmsg(sock, msg, size, flags);
753 set_fs(oldfs);
754 return result;
755}
c6d409cf 756EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 757
ce1d4d3e
CH
758static ssize_t sock_sendpage(struct file *file, struct page *page,
759 int offset, size_t size, loff_t *ppos, int more)
1da177e4 760{
1da177e4
LT
761 struct socket *sock;
762 int flags;
763
ce1d4d3e
CH
764 sock = file->private_data;
765
35f9c09f
ED
766 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
767 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
768 flags |= more;
ce1d4d3e 769
e6949583 770 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 771}
1da177e4 772
9c55e01c 773static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 774 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
775 unsigned int flags)
776{
777 struct socket *sock = file->private_data;
778
997b37da
RDC
779 if (unlikely(!sock->ops->splice_read))
780 return -EINVAL;
781
9c55e01c
JA
782 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
783}
784
8ae5e030 785static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
ce1d4d3e 786{
6d652330
AV
787 struct file *file = iocb->ki_filp;
788 struct socket *sock = file->private_data;
0345f931 789 struct msghdr msg = {.msg_iter = *to,
790 .msg_iocb = iocb};
8ae5e030 791 ssize_t res;
ce1d4d3e 792
8ae5e030
AV
793 if (file->f_flags & O_NONBLOCK)
794 msg.msg_flags = MSG_DONTWAIT;
795
796 if (iocb->ki_pos != 0)
1da177e4 797 return -ESPIPE;
027445c3 798
66ee59af 799 if (!iov_iter_count(to)) /* Match SYS5 behaviour */
1da177e4
LT
800 return 0;
801
237dae88 802 res = sock_recvmsg(sock, &msg, iov_iter_count(to), msg.msg_flags);
8ae5e030
AV
803 *to = msg.msg_iter;
804 return res;
1da177e4
LT
805}
806
8ae5e030 807static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
ce1d4d3e 808{
6d652330
AV
809 struct file *file = iocb->ki_filp;
810 struct socket *sock = file->private_data;
0345f931 811 struct msghdr msg = {.msg_iter = *from,
812 .msg_iocb = iocb};
8ae5e030 813 ssize_t res;
1da177e4 814
8ae5e030 815 if (iocb->ki_pos != 0)
ce1d4d3e 816 return -ESPIPE;
027445c3 817
8ae5e030
AV
818 if (file->f_flags & O_NONBLOCK)
819 msg.msg_flags = MSG_DONTWAIT;
820
6d652330
AV
821 if (sock->type == SOCK_SEQPACKET)
822 msg.msg_flags |= MSG_EOR;
823
d8725c86 824 res = sock_sendmsg(sock, &msg);
8ae5e030
AV
825 *from = msg.msg_iter;
826 return res;
1da177e4
LT
827}
828
1da177e4
LT
829/*
830 * Atomic setting of ioctl hooks to avoid race
831 * with module unload.
832 */
833
4a3e2f71 834static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 835static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 836
881d966b 837void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 838{
4a3e2f71 839 mutex_lock(&br_ioctl_mutex);
1da177e4 840 br_ioctl_hook = hook;
4a3e2f71 841 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
842}
843EXPORT_SYMBOL(brioctl_set);
844
4a3e2f71 845static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 846static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 847
881d966b 848void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 849{
4a3e2f71 850 mutex_lock(&vlan_ioctl_mutex);
1da177e4 851 vlan_ioctl_hook = hook;
4a3e2f71 852 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
853}
854EXPORT_SYMBOL(vlan_ioctl_set);
855
4a3e2f71 856static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 857static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 858
89bddce5 859void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 860{
4a3e2f71 861 mutex_lock(&dlci_ioctl_mutex);
1da177e4 862 dlci_ioctl_hook = hook;
4a3e2f71 863 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
864}
865EXPORT_SYMBOL(dlci_ioctl_set);
866
6b96018b
AB
867static long sock_do_ioctl(struct net *net, struct socket *sock,
868 unsigned int cmd, unsigned long arg)
869{
870 int err;
871 void __user *argp = (void __user *)arg;
872
873 err = sock->ops->ioctl(sock, cmd, arg);
874
875 /*
876 * If this ioctl is unknown try to hand it down
877 * to the NIC driver.
878 */
879 if (err == -ENOIOCTLCMD)
880 err = dev_ioctl(net, cmd, argp);
881
882 return err;
883}
884
1da177e4
LT
885/*
886 * With an ioctl, arg may well be a user mode pointer, but we don't know
887 * what to do with it - that's up to the protocol still.
888 */
889
890static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
891{
892 struct socket *sock;
881d966b 893 struct sock *sk;
1da177e4
LT
894 void __user *argp = (void __user *)arg;
895 int pid, err;
881d966b 896 struct net *net;
1da177e4 897
b69aee04 898 sock = file->private_data;
881d966b 899 sk = sock->sk;
3b1e0a65 900 net = sock_net(sk);
1da177e4 901 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 902 err = dev_ioctl(net, cmd, argp);
1da177e4 903 } else
3d23e349 904#ifdef CONFIG_WEXT_CORE
1da177e4 905 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 906 err = dev_ioctl(net, cmd, argp);
1da177e4 907 } else
3d23e349 908#endif
89bddce5 909 switch (cmd) {
1da177e4
LT
910 case FIOSETOWN:
911 case SIOCSPGRP:
912 err = -EFAULT;
913 if (get_user(pid, (int __user *)argp))
914 break;
e0b93edd
JL
915 f_setown(sock->file, pid, 1);
916 err = 0;
1da177e4
LT
917 break;
918 case FIOGETOWN:
919 case SIOCGPGRP:
609d7fa9 920 err = put_user(f_getown(sock->file),
89bddce5 921 (int __user *)argp);
1da177e4
LT
922 break;
923 case SIOCGIFBR:
924 case SIOCSIFBR:
925 case SIOCBRADDBR:
926 case SIOCBRDELBR:
927 err = -ENOPKG;
928 if (!br_ioctl_hook)
929 request_module("bridge");
930
4a3e2f71 931 mutex_lock(&br_ioctl_mutex);
89bddce5 932 if (br_ioctl_hook)
881d966b 933 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 934 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
935 break;
936 case SIOCGIFVLAN:
937 case SIOCSIFVLAN:
938 err = -ENOPKG;
939 if (!vlan_ioctl_hook)
940 request_module("8021q");
941
4a3e2f71 942 mutex_lock(&vlan_ioctl_mutex);
1da177e4 943 if (vlan_ioctl_hook)
881d966b 944 err = vlan_ioctl_hook(net, argp);
4a3e2f71 945 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 946 break;
1da177e4
LT
947 case SIOCADDDLCI:
948 case SIOCDELDLCI:
949 err = -ENOPKG;
950 if (!dlci_ioctl_hook)
951 request_module("dlci");
952
7512cbf6
PE
953 mutex_lock(&dlci_ioctl_mutex);
954 if (dlci_ioctl_hook)
1da177e4 955 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 956 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
957 break;
958 default:
6b96018b 959 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 960 break;
89bddce5 961 }
1da177e4
LT
962 return err;
963}
964
965int sock_create_lite(int family, int type, int protocol, struct socket **res)
966{
967 int err;
968 struct socket *sock = NULL;
89bddce5 969
1da177e4
LT
970 err = security_socket_create(family, type, protocol, 1);
971 if (err)
972 goto out;
973
974 sock = sock_alloc();
975 if (!sock) {
976 err = -ENOMEM;
977 goto out;
978 }
979
1da177e4 980 sock->type = type;
7420ed23
VY
981 err = security_socket_post_create(sock, family, type, protocol, 1);
982 if (err)
983 goto out_release;
984
1da177e4
LT
985out:
986 *res = sock;
987 return err;
7420ed23
VY
988out_release:
989 sock_release(sock);
990 sock = NULL;
991 goto out;
1da177e4 992}
c6d409cf 993EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
994
995/* No kernel lock held - perfect */
89bddce5 996static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 997{
cbf55001 998 unsigned int busy_flag = 0;
1da177e4
LT
999 struct socket *sock;
1000
1001 /*
89bddce5 1002 * We can't return errors to poll, so it's either yes or no.
1da177e4 1003 */
b69aee04 1004 sock = file->private_data;
2d48d67f 1005
cbf55001 1006 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1007 /* this socket can poll_ll so tell the system call */
cbf55001 1008 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1009
1010 /* once, only if requested by syscall */
cbf55001
ET
1011 if (wait && (wait->_key & POLL_BUSY_LOOP))
1012 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1013 }
1014
cbf55001 1015 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1016}
1017
89bddce5 1018static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1019{
b69aee04 1020 struct socket *sock = file->private_data;
1da177e4
LT
1021
1022 return sock->ops->mmap(file, sock, vma);
1023}
1024
20380731 1025static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1026{
1da177e4
LT
1027 sock_release(SOCKET_I(inode));
1028 return 0;
1029}
1030
1031/*
1032 * Update the socket async list
1033 *
1034 * Fasync_list locking strategy.
1035 *
1036 * 1. fasync_list is modified only under process context socket lock
1037 * i.e. under semaphore.
1038 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1039 * or under socket lock
1da177e4
LT
1040 */
1041
1042static int sock_fasync(int fd, struct file *filp, int on)
1043{
989a2979
ED
1044 struct socket *sock = filp->private_data;
1045 struct sock *sk = sock->sk;
eaefd110 1046 struct socket_wq *wq;
1da177e4 1047
989a2979 1048 if (sk == NULL)
1da177e4 1049 return -EINVAL;
1da177e4
LT
1050
1051 lock_sock(sk);
eaefd110
ED
1052 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1053 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1054
eaefd110 1055 if (!wq->fasync_list)
989a2979
ED
1056 sock_reset_flag(sk, SOCK_FASYNC);
1057 else
bcdce719 1058 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1059
989a2979 1060 release_sock(sk);
1da177e4
LT
1061 return 0;
1062}
1063
43815482 1064/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1065
1066int sock_wake_async(struct socket *sock, int how, int band)
1067{
43815482
ED
1068 struct socket_wq *wq;
1069
1070 if (!sock)
1071 return -1;
1072 rcu_read_lock();
1073 wq = rcu_dereference(sock->wq);
1074 if (!wq || !wq->fasync_list) {
1075 rcu_read_unlock();
1da177e4 1076 return -1;
43815482 1077 }
89bddce5 1078 switch (how) {
8d8ad9d7 1079 case SOCK_WAKE_WAITD:
1da177e4
LT
1080 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1081 break;
1082 goto call_kill;
8d8ad9d7 1083 case SOCK_WAKE_SPACE:
1da177e4
LT
1084 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1085 break;
1086 /* fall through */
8d8ad9d7 1087 case SOCK_WAKE_IO:
89bddce5 1088call_kill:
43815482 1089 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1090 break;
8d8ad9d7 1091 case SOCK_WAKE_URG:
43815482 1092 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1093 }
43815482 1094 rcu_read_unlock();
1da177e4
LT
1095 return 0;
1096}
c6d409cf 1097EXPORT_SYMBOL(sock_wake_async);
1da177e4 1098
721db93a 1099int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1100 struct socket **res, int kern)
1da177e4
LT
1101{
1102 int err;
1103 struct socket *sock;
55737fda 1104 const struct net_proto_family *pf;
1da177e4
LT
1105
1106 /*
89bddce5 1107 * Check protocol is in range
1da177e4
LT
1108 */
1109 if (family < 0 || family >= NPROTO)
1110 return -EAFNOSUPPORT;
1111 if (type < 0 || type >= SOCK_MAX)
1112 return -EINVAL;
1113
1114 /* Compatibility.
1115
1116 This uglymoron is moved from INET layer to here to avoid
1117 deadlock in module load.
1118 */
1119 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1120 static int warned;
1da177e4
LT
1121 if (!warned) {
1122 warned = 1;
3410f22e
YY
1123 pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1124 current->comm);
1da177e4
LT
1125 }
1126 family = PF_PACKET;
1127 }
1128
1129 err = security_socket_create(family, type, protocol, kern);
1130 if (err)
1131 return err;
89bddce5 1132
55737fda
SH
1133 /*
1134 * Allocate the socket and allow the family to set things up. if
1135 * the protocol is 0, the family is instructed to select an appropriate
1136 * default.
1137 */
1138 sock = sock_alloc();
1139 if (!sock) {
e87cc472 1140 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1141 return -ENFILE; /* Not exactly a match, but its the
1142 closest posix thing */
1143 }
1144
1145 sock->type = type;
1146
95a5afca 1147#ifdef CONFIG_MODULES
89bddce5
SH
1148 /* Attempt to load a protocol module if the find failed.
1149 *
1150 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1151 * requested real, full-featured networking support upon configuration.
1152 * Otherwise module support will break!
1153 */
190683a9 1154 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1155 request_module("net-pf-%d", family);
1da177e4
LT
1156#endif
1157
55737fda
SH
1158 rcu_read_lock();
1159 pf = rcu_dereference(net_families[family]);
1160 err = -EAFNOSUPPORT;
1161 if (!pf)
1162 goto out_release;
1da177e4
LT
1163
1164 /*
1165 * We will call the ->create function, that possibly is in a loadable
1166 * module, so we have to bump that loadable module refcnt first.
1167 */
55737fda 1168 if (!try_module_get(pf->owner))
1da177e4
LT
1169 goto out_release;
1170
55737fda
SH
1171 /* Now protected by module ref count */
1172 rcu_read_unlock();
1173
3f378b68 1174 err = pf->create(net, sock, protocol, kern);
55737fda 1175 if (err < 0)
1da177e4 1176 goto out_module_put;
a79af59e 1177
1da177e4
LT
1178 /*
1179 * Now to bump the refcnt of the [loadable] module that owns this
1180 * socket at sock_release time we decrement its refcnt.
1181 */
55737fda
SH
1182 if (!try_module_get(sock->ops->owner))
1183 goto out_module_busy;
1184
1da177e4
LT
1185 /*
1186 * Now that we're done with the ->create function, the [loadable]
1187 * module can have its refcnt decremented
1188 */
55737fda 1189 module_put(pf->owner);
7420ed23
VY
1190 err = security_socket_post_create(sock, family, type, protocol, kern);
1191 if (err)
3b185525 1192 goto out_sock_release;
55737fda 1193 *res = sock;
1da177e4 1194
55737fda
SH
1195 return 0;
1196
1197out_module_busy:
1198 err = -EAFNOSUPPORT;
1da177e4 1199out_module_put:
55737fda
SH
1200 sock->ops = NULL;
1201 module_put(pf->owner);
1202out_sock_release:
1da177e4 1203 sock_release(sock);
55737fda
SH
1204 return err;
1205
1206out_release:
1207 rcu_read_unlock();
1208 goto out_sock_release;
1da177e4 1209}
721db93a 1210EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1211
1212int sock_create(int family, int type, int protocol, struct socket **res)
1213{
1b8d7ae4 1214 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1215}
c6d409cf 1216EXPORT_SYMBOL(sock_create);
1da177e4
LT
1217
1218int sock_create_kern(int family, int type, int protocol, struct socket **res)
1219{
1b8d7ae4 1220 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1221}
c6d409cf 1222EXPORT_SYMBOL(sock_create_kern);
1da177e4 1223
3e0fa65f 1224SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1225{
1226 int retval;
1227 struct socket *sock;
a677a039
UD
1228 int flags;
1229
e38b36f3
UD
1230 /* Check the SOCK_* constants for consistency. */
1231 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1232 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1233 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1234 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1235
a677a039 1236 flags = type & ~SOCK_TYPE_MASK;
77d27200 1237 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1238 return -EINVAL;
1239 type &= SOCK_TYPE_MASK;
1da177e4 1240
aaca0bdc
UD
1241 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1242 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1243
1da177e4
LT
1244 retval = sock_create(family, type, protocol, &sock);
1245 if (retval < 0)
1246 goto out;
1247
77d27200 1248 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1249 if (retval < 0)
1250 goto out_release;
1251
1252out:
1253 /* It may be already another descriptor 8) Not kernel problem. */
1254 return retval;
1255
1256out_release:
1257 sock_release(sock);
1258 return retval;
1259}
1260
1261/*
1262 * Create a pair of connected sockets.
1263 */
1264
3e0fa65f
HC
1265SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1266 int __user *, usockvec)
1da177e4
LT
1267{
1268 struct socket *sock1, *sock2;
1269 int fd1, fd2, err;
db349509 1270 struct file *newfile1, *newfile2;
a677a039
UD
1271 int flags;
1272
1273 flags = type & ~SOCK_TYPE_MASK;
77d27200 1274 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1275 return -EINVAL;
1276 type &= SOCK_TYPE_MASK;
1da177e4 1277
aaca0bdc
UD
1278 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1279 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1280
1da177e4
LT
1281 /*
1282 * Obtain the first socket and check if the underlying protocol
1283 * supports the socketpair call.
1284 */
1285
1286 err = sock_create(family, type, protocol, &sock1);
1287 if (err < 0)
1288 goto out;
1289
1290 err = sock_create(family, type, protocol, &sock2);
1291 if (err < 0)
1292 goto out_release_1;
1293
1294 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1295 if (err < 0)
1da177e4
LT
1296 goto out_release_both;
1297
28407630 1298 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1299 if (unlikely(fd1 < 0)) {
1300 err = fd1;
db349509 1301 goto out_release_both;
bf3c23d1 1302 }
d73aa286 1303
28407630 1304 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1305 if (unlikely(fd2 < 0)) {
1306 err = fd2;
d73aa286 1307 goto out_put_unused_1;
28407630
AV
1308 }
1309
aab174f0 1310 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1311 if (unlikely(IS_ERR(newfile1))) {
1312 err = PTR_ERR(newfile1);
d73aa286 1313 goto out_put_unused_both;
28407630
AV
1314 }
1315
aab174f0 1316 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1317 if (IS_ERR(newfile2)) {
1318 err = PTR_ERR(newfile2);
d73aa286 1319 goto out_fput_1;
db349509
AV
1320 }
1321
d73aa286
YD
1322 err = put_user(fd1, &usockvec[0]);
1323 if (err)
1324 goto out_fput_both;
1325
1326 err = put_user(fd2, &usockvec[1]);
1327 if (err)
1328 goto out_fput_both;
1329
157cf649 1330 audit_fd_pair(fd1, fd2);
d73aa286 1331
db349509
AV
1332 fd_install(fd1, newfile1);
1333 fd_install(fd2, newfile2);
1da177e4
LT
1334 /* fd1 and fd2 may be already another descriptors.
1335 * Not kernel problem.
1336 */
1337
d73aa286 1338 return 0;
1da177e4 1339
d73aa286
YD
1340out_fput_both:
1341 fput(newfile2);
1342 fput(newfile1);
1343 put_unused_fd(fd2);
1344 put_unused_fd(fd1);
1345 goto out;
1346
1347out_fput_1:
1348 fput(newfile1);
1349 put_unused_fd(fd2);
1350 put_unused_fd(fd1);
1351 sock_release(sock2);
1352 goto out;
1da177e4 1353
d73aa286
YD
1354out_put_unused_both:
1355 put_unused_fd(fd2);
1356out_put_unused_1:
1357 put_unused_fd(fd1);
1da177e4 1358out_release_both:
89bddce5 1359 sock_release(sock2);
1da177e4 1360out_release_1:
89bddce5 1361 sock_release(sock1);
1da177e4
LT
1362out:
1363 return err;
1364}
1365
1da177e4
LT
1366/*
1367 * Bind a name to a socket. Nothing much to do here since it's
1368 * the protocol's responsibility to handle the local address.
1369 *
1370 * We move the socket address to kernel space before we call
1371 * the protocol layer (having also checked the address is ok).
1372 */
1373
20f37034 1374SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1375{
1376 struct socket *sock;
230b1839 1377 struct sockaddr_storage address;
6cb153ca 1378 int err, fput_needed;
1da177e4 1379
89bddce5 1380 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1381 if (sock) {
43db362d 1382 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1383 if (err >= 0) {
1384 err = security_socket_bind(sock,
230b1839 1385 (struct sockaddr *)&address,
89bddce5 1386 addrlen);
6cb153ca
BL
1387 if (!err)
1388 err = sock->ops->bind(sock,
89bddce5 1389 (struct sockaddr *)
230b1839 1390 &address, addrlen);
1da177e4 1391 }
6cb153ca 1392 fput_light(sock->file, fput_needed);
89bddce5 1393 }
1da177e4
LT
1394 return err;
1395}
1396
1da177e4
LT
1397/*
1398 * Perform a listen. Basically, we allow the protocol to do anything
1399 * necessary for a listen, and if that works, we mark the socket as
1400 * ready for listening.
1401 */
1402
3e0fa65f 1403SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1404{
1405 struct socket *sock;
6cb153ca 1406 int err, fput_needed;
b8e1f9b5 1407 int somaxconn;
89bddce5
SH
1408
1409 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1410 if (sock) {
8efa6e93 1411 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1412 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1413 backlog = somaxconn;
1da177e4
LT
1414
1415 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1416 if (!err)
1417 err = sock->ops->listen(sock, backlog);
1da177e4 1418
6cb153ca 1419 fput_light(sock->file, fput_needed);
1da177e4
LT
1420 }
1421 return err;
1422}
1423
1da177e4
LT
1424/*
1425 * For accept, we attempt to create a new socket, set up the link
1426 * with the client, wake up the client, then return the new
1427 * connected fd. We collect the address of the connector in kernel
1428 * space and move it to user at the very end. This is unclean because
1429 * we open the socket then return an error.
1430 *
1431 * 1003.1g adds the ability to recvmsg() to query connection pending
1432 * status to recvmsg. We need to add that support in a way thats
1433 * clean when we restucture accept also.
1434 */
1435
20f37034
HC
1436SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1437 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1438{
1439 struct socket *sock, *newsock;
39d8c1b6 1440 struct file *newfile;
6cb153ca 1441 int err, len, newfd, fput_needed;
230b1839 1442 struct sockaddr_storage address;
1da177e4 1443
77d27200 1444 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1445 return -EINVAL;
1446
1447 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1448 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1449
6cb153ca 1450 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1451 if (!sock)
1452 goto out;
1453
1454 err = -ENFILE;
c6d409cf
ED
1455 newsock = sock_alloc();
1456 if (!newsock)
1da177e4
LT
1457 goto out_put;
1458
1459 newsock->type = sock->type;
1460 newsock->ops = sock->ops;
1461
1da177e4
LT
1462 /*
1463 * We don't need try_module_get here, as the listening socket (sock)
1464 * has the protocol module (sock->ops->owner) held.
1465 */
1466 __module_get(newsock->ops->owner);
1467
28407630 1468 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1469 if (unlikely(newfd < 0)) {
1470 err = newfd;
9a1875e6
DM
1471 sock_release(newsock);
1472 goto out_put;
39d8c1b6 1473 }
aab174f0 1474 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1475 if (unlikely(IS_ERR(newfile))) {
1476 err = PTR_ERR(newfile);
1477 put_unused_fd(newfd);
1478 sock_release(newsock);
1479 goto out_put;
1480 }
39d8c1b6 1481
a79af59e
FF
1482 err = security_socket_accept(sock, newsock);
1483 if (err)
39d8c1b6 1484 goto out_fd;
a79af59e 1485
1da177e4
LT
1486 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1487 if (err < 0)
39d8c1b6 1488 goto out_fd;
1da177e4
LT
1489
1490 if (upeer_sockaddr) {
230b1839 1491 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1492 &len, 2) < 0) {
1da177e4 1493 err = -ECONNABORTED;
39d8c1b6 1494 goto out_fd;
1da177e4 1495 }
43db362d 1496 err = move_addr_to_user(&address,
230b1839 1497 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1498 if (err < 0)
39d8c1b6 1499 goto out_fd;
1da177e4
LT
1500 }
1501
1502 /* File flags are not inherited via accept() unlike another OSes. */
1503
39d8c1b6
DM
1504 fd_install(newfd, newfile);
1505 err = newfd;
1da177e4 1506
1da177e4 1507out_put:
6cb153ca 1508 fput_light(sock->file, fput_needed);
1da177e4
LT
1509out:
1510 return err;
39d8c1b6 1511out_fd:
9606a216 1512 fput(newfile);
39d8c1b6 1513 put_unused_fd(newfd);
1da177e4
LT
1514 goto out_put;
1515}
1516
20f37034
HC
1517SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1518 int __user *, upeer_addrlen)
aaca0bdc 1519{
de11defe 1520 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1521}
1522
1da177e4
LT
1523/*
1524 * Attempt to connect to a socket with the server address. The address
1525 * is in user space so we verify it is OK and move it to kernel space.
1526 *
1527 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1528 * break bindings
1529 *
1530 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1531 * other SEQPACKET protocols that take time to connect() as it doesn't
1532 * include the -EINPROGRESS status for such sockets.
1533 */
1534
20f37034
HC
1535SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1536 int, addrlen)
1da177e4
LT
1537{
1538 struct socket *sock;
230b1839 1539 struct sockaddr_storage address;
6cb153ca 1540 int err, fput_needed;
1da177e4 1541
6cb153ca 1542 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1543 if (!sock)
1544 goto out;
43db362d 1545 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1546 if (err < 0)
1547 goto out_put;
1548
89bddce5 1549 err =
230b1839 1550 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1551 if (err)
1552 goto out_put;
1553
230b1839 1554 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1555 sock->file->f_flags);
1556out_put:
6cb153ca 1557 fput_light(sock->file, fput_needed);
1da177e4
LT
1558out:
1559 return err;
1560}
1561
1562/*
1563 * Get the local address ('name') of a socket object. Move the obtained
1564 * name to user space.
1565 */
1566
20f37034
HC
1567SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1568 int __user *, usockaddr_len)
1da177e4
LT
1569{
1570 struct socket *sock;
230b1839 1571 struct sockaddr_storage address;
6cb153ca 1572 int len, err, fput_needed;
89bddce5 1573
6cb153ca 1574 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1575 if (!sock)
1576 goto out;
1577
1578 err = security_socket_getsockname(sock);
1579 if (err)
1580 goto out_put;
1581
230b1839 1582 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1583 if (err)
1584 goto out_put;
43db362d 1585 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1586
1587out_put:
6cb153ca 1588 fput_light(sock->file, fput_needed);
1da177e4
LT
1589out:
1590 return err;
1591}
1592
1593/*
1594 * Get the remote address ('name') of a socket object. Move the obtained
1595 * name to user space.
1596 */
1597
20f37034
HC
1598SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1599 int __user *, usockaddr_len)
1da177e4
LT
1600{
1601 struct socket *sock;
230b1839 1602 struct sockaddr_storage address;
6cb153ca 1603 int len, err, fput_needed;
1da177e4 1604
89bddce5
SH
1605 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1606 if (sock != NULL) {
1da177e4
LT
1607 err = security_socket_getpeername(sock);
1608 if (err) {
6cb153ca 1609 fput_light(sock->file, fput_needed);
1da177e4
LT
1610 return err;
1611 }
1612
89bddce5 1613 err =
230b1839 1614 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1615 1);
1da177e4 1616 if (!err)
43db362d 1617 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1618 usockaddr_len);
6cb153ca 1619 fput_light(sock->file, fput_needed);
1da177e4
LT
1620 }
1621 return err;
1622}
1623
1624/*
1625 * Send a datagram to a given address. We move the address into kernel
1626 * space and check the user space data area is readable before invoking
1627 * the protocol.
1628 */
1629
3e0fa65f 1630SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1631 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1632 int, addr_len)
1da177e4
LT
1633{
1634 struct socket *sock;
230b1839 1635 struct sockaddr_storage address;
1da177e4
LT
1636 int err;
1637 struct msghdr msg;
1638 struct iovec iov;
6cb153ca 1639 int fput_needed;
6cb153ca 1640
602bd0e9
AV
1641 err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1642 if (unlikely(err))
1643 return err;
de0fa95c
PE
1644 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1645 if (!sock)
4387ff75 1646 goto out;
6cb153ca 1647
89bddce5 1648 msg.msg_name = NULL;
89bddce5
SH
1649 msg.msg_control = NULL;
1650 msg.msg_controllen = 0;
1651 msg.msg_namelen = 0;
6cb153ca 1652 if (addr) {
43db362d 1653 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1654 if (err < 0)
1655 goto out_put;
230b1839 1656 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1657 msg.msg_namelen = addr_len;
1da177e4
LT
1658 }
1659 if (sock->file->f_flags & O_NONBLOCK)
1660 flags |= MSG_DONTWAIT;
1661 msg.msg_flags = flags;
d8725c86 1662 err = sock_sendmsg(sock, &msg);
1da177e4 1663
89bddce5 1664out_put:
de0fa95c 1665 fput_light(sock->file, fput_needed);
4387ff75 1666out:
1da177e4
LT
1667 return err;
1668}
1669
1670/*
89bddce5 1671 * Send a datagram down a socket.
1da177e4
LT
1672 */
1673
3e0fa65f 1674SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1675 unsigned int, flags)
1da177e4
LT
1676{
1677 return sys_sendto(fd, buff, len, flags, NULL, 0);
1678}
1679
1680/*
89bddce5 1681 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1682 * sender. We verify the buffers are writable and if needed move the
1683 * sender address from kernel to user space.
1684 */
1685
3e0fa65f 1686SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1687 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1688 int __user *, addr_len)
1da177e4
LT
1689{
1690 struct socket *sock;
1691 struct iovec iov;
1692 struct msghdr msg;
230b1839 1693 struct sockaddr_storage address;
89bddce5 1694 int err, err2;
6cb153ca
BL
1695 int fput_needed;
1696
602bd0e9
AV
1697 err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1698 if (unlikely(err))
1699 return err;
de0fa95c 1700 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1701 if (!sock)
de0fa95c 1702 goto out;
1da177e4 1703
89bddce5
SH
1704 msg.msg_control = NULL;
1705 msg.msg_controllen = 0;
f3d33426
HFS
1706 /* Save some cycles and don't copy the address if not needed */
1707 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1708 /* We assume all kernel code knows the size of sockaddr_storage */
1709 msg.msg_namelen = 0;
1da177e4
LT
1710 if (sock->file->f_flags & O_NONBLOCK)
1711 flags |= MSG_DONTWAIT;
602bd0e9 1712 err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
1da177e4 1713
89bddce5 1714 if (err >= 0 && addr != NULL) {
43db362d 1715 err2 = move_addr_to_user(&address,
230b1839 1716 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1717 if (err2 < 0)
1718 err = err2;
1da177e4 1719 }
de0fa95c
PE
1720
1721 fput_light(sock->file, fput_needed);
4387ff75 1722out:
1da177e4
LT
1723 return err;
1724}
1725
1726/*
89bddce5 1727 * Receive a datagram from a socket.
1da177e4
LT
1728 */
1729
b7c0ddf5
JG
1730SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1731 unsigned int, flags)
1da177e4
LT
1732{
1733 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1734}
1735
1736/*
1737 * Set a socket option. Because we don't know the option lengths we have
1738 * to pass the user mode parameter for the protocols to sort out.
1739 */
1740
20f37034
HC
1741SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1742 char __user *, optval, int, optlen)
1da177e4 1743{
6cb153ca 1744 int err, fput_needed;
1da177e4
LT
1745 struct socket *sock;
1746
1747 if (optlen < 0)
1748 return -EINVAL;
89bddce5
SH
1749
1750 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1751 if (sock != NULL) {
1752 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1753 if (err)
1754 goto out_put;
1da177e4
LT
1755
1756 if (level == SOL_SOCKET)
89bddce5
SH
1757 err =
1758 sock_setsockopt(sock, level, optname, optval,
1759 optlen);
1da177e4 1760 else
89bddce5
SH
1761 err =
1762 sock->ops->setsockopt(sock, level, optname, optval,
1763 optlen);
6cb153ca
BL
1764out_put:
1765 fput_light(sock->file, fput_needed);
1da177e4
LT
1766 }
1767 return err;
1768}
1769
1770/*
1771 * Get a socket option. Because we don't know the option lengths we have
1772 * to pass a user mode parameter for the protocols to sort out.
1773 */
1774
20f37034
HC
1775SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1776 char __user *, optval, int __user *, optlen)
1da177e4 1777{
6cb153ca 1778 int err, fput_needed;
1da177e4
LT
1779 struct socket *sock;
1780
89bddce5
SH
1781 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1782 if (sock != NULL) {
6cb153ca
BL
1783 err = security_socket_getsockopt(sock, level, optname);
1784 if (err)
1785 goto out_put;
1da177e4
LT
1786
1787 if (level == SOL_SOCKET)
89bddce5
SH
1788 err =
1789 sock_getsockopt(sock, level, optname, optval,
1790 optlen);
1da177e4 1791 else
89bddce5
SH
1792 err =
1793 sock->ops->getsockopt(sock, level, optname, optval,
1794 optlen);
6cb153ca
BL
1795out_put:
1796 fput_light(sock->file, fput_needed);
1da177e4
LT
1797 }
1798 return err;
1799}
1800
1da177e4
LT
1801/*
1802 * Shutdown a socket.
1803 */
1804
754fe8d2 1805SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1806{
6cb153ca 1807 int err, fput_needed;
1da177e4
LT
1808 struct socket *sock;
1809
89bddce5
SH
1810 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1811 if (sock != NULL) {
1da177e4 1812 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1813 if (!err)
1814 err = sock->ops->shutdown(sock, how);
1815 fput_light(sock->file, fput_needed);
1da177e4
LT
1816 }
1817 return err;
1818}
1819
89bddce5 1820/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1821 * fields which are the same type (int / unsigned) on our platforms.
1822 */
1823#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1824#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1825#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1826
c71d8ebe
TH
1827struct used_address {
1828 struct sockaddr_storage name;
1829 unsigned int name_len;
1830};
1831
da184284
AV
1832static int copy_msghdr_from_user(struct msghdr *kmsg,
1833 struct user_msghdr __user *umsg,
1834 struct sockaddr __user **save_addr,
1835 struct iovec **iov)
1661bf36 1836{
08adb7da
AV
1837 struct sockaddr __user *uaddr;
1838 struct iovec __user *uiov;
c0371da6 1839 size_t nr_segs;
08adb7da
AV
1840 ssize_t err;
1841
1842 if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1843 __get_user(uaddr, &umsg->msg_name) ||
1844 __get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1845 __get_user(uiov, &umsg->msg_iov) ||
c0371da6 1846 __get_user(nr_segs, &umsg->msg_iovlen) ||
08adb7da
AV
1847 __get_user(kmsg->msg_control, &umsg->msg_control) ||
1848 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1849 __get_user(kmsg->msg_flags, &umsg->msg_flags))
1661bf36 1850 return -EFAULT;
dbb490b9 1851
08adb7da 1852 if (!uaddr)
6a2a2b3a
AS
1853 kmsg->msg_namelen = 0;
1854
dbb490b9
ML
1855 if (kmsg->msg_namelen < 0)
1856 return -EINVAL;
1857
1661bf36 1858 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
db31c55a 1859 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
08adb7da
AV
1860
1861 if (save_addr)
1862 *save_addr = uaddr;
1863
1864 if (uaddr && kmsg->msg_namelen) {
1865 if (!save_addr) {
1866 err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1867 kmsg->msg_name);
1868 if (err < 0)
1869 return err;
1870 }
1871 } else {
1872 kmsg->msg_name = NULL;
1873 kmsg->msg_namelen = 0;
1874 }
1875
c0371da6 1876 if (nr_segs > UIO_MAXIOV)
08adb7da
AV
1877 return -EMSGSIZE;
1878
0345f931 1879 kmsg->msg_iocb = NULL;
1880
da184284
AV
1881 return import_iovec(save_addr ? READ : WRITE, uiov, nr_segs,
1882 UIO_FASTIOV, iov, &kmsg->msg_iter);
1661bf36
DC
1883}
1884
666547ff 1885static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 1886 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1887 struct used_address *used_address)
1da177e4 1888{
89bddce5
SH
1889 struct compat_msghdr __user *msg_compat =
1890 (struct compat_msghdr __user *)msg;
230b1839 1891 struct sockaddr_storage address;
1da177e4 1892 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1893 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1894 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1895 /* 20 is size of ipv6_pktinfo */
1da177e4 1896 unsigned char *ctl_buf = ctl;
d8725c86 1897 int ctl_len;
08adb7da 1898 ssize_t err;
89bddce5 1899
08adb7da 1900 msg_sys->msg_name = &address;
1da177e4 1901
08449320 1902 if (MSG_CMSG_COMPAT & flags)
08adb7da 1903 err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
08449320 1904 else
08adb7da 1905 err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
89bddce5 1906 if (err < 0)
da184284 1907 return err;
1da177e4
LT
1908
1909 err = -ENOBUFS;
1910
228e548e 1911 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 1912 goto out_freeiov;
228e548e 1913 ctl_len = msg_sys->msg_controllen;
1da177e4 1914 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 1915 err =
228e548e 1916 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 1917 sizeof(ctl));
1da177e4
LT
1918 if (err)
1919 goto out_freeiov;
228e548e
AB
1920 ctl_buf = msg_sys->msg_control;
1921 ctl_len = msg_sys->msg_controllen;
1da177e4 1922 } else if (ctl_len) {
89bddce5 1923 if (ctl_len > sizeof(ctl)) {
1da177e4 1924 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 1925 if (ctl_buf == NULL)
1da177e4
LT
1926 goto out_freeiov;
1927 }
1928 err = -EFAULT;
1929 /*
228e548e 1930 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
1931 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1932 * checking falls down on this.
1933 */
fb8621bb 1934 if (copy_from_user(ctl_buf,
228e548e 1935 (void __user __force *)msg_sys->msg_control,
89bddce5 1936 ctl_len))
1da177e4 1937 goto out_freectl;
228e548e 1938 msg_sys->msg_control = ctl_buf;
1da177e4 1939 }
228e548e 1940 msg_sys->msg_flags = flags;
1da177e4
LT
1941
1942 if (sock->file->f_flags & O_NONBLOCK)
228e548e 1943 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
1944 /*
1945 * If this is sendmmsg() and current destination address is same as
1946 * previously succeeded address, omit asking LSM's decision.
1947 * used_address->name_len is initialized to UINT_MAX so that the first
1948 * destination address never matches.
1949 */
bc909d9d
MD
1950 if (used_address && msg_sys->msg_name &&
1951 used_address->name_len == msg_sys->msg_namelen &&
1952 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe 1953 used_address->name_len)) {
d8725c86 1954 err = sock_sendmsg_nosec(sock, msg_sys);
c71d8ebe
TH
1955 goto out_freectl;
1956 }
d8725c86 1957 err = sock_sendmsg(sock, msg_sys);
c71d8ebe
TH
1958 /*
1959 * If this is sendmmsg() and sending to current destination address was
1960 * successful, remember it.
1961 */
1962 if (used_address && err >= 0) {
1963 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
1964 if (msg_sys->msg_name)
1965 memcpy(&used_address->name, msg_sys->msg_name,
1966 used_address->name_len);
c71d8ebe 1967 }
1da177e4
LT
1968
1969out_freectl:
89bddce5 1970 if (ctl_buf != ctl)
1da177e4
LT
1971 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1972out_freeiov:
da184284 1973 kfree(iov);
228e548e
AB
1974 return err;
1975}
1976
1977/*
1978 * BSD sendmsg interface
1979 */
1980
666547ff 1981long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
228e548e
AB
1982{
1983 int fput_needed, err;
1984 struct msghdr msg_sys;
1be374a0
AL
1985 struct socket *sock;
1986
1be374a0 1987 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
1988 if (!sock)
1989 goto out;
1990
a7526eb5 1991 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 1992
6cb153ca 1993 fput_light(sock->file, fput_needed);
89bddce5 1994out:
1da177e4
LT
1995 return err;
1996}
1997
666547ff 1998SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
a7526eb5
AL
1999{
2000 if (flags & MSG_CMSG_COMPAT)
2001 return -EINVAL;
2002 return __sys_sendmsg(fd, msg, flags);
2003}
2004
228e548e
AB
2005/*
2006 * Linux sendmmsg interface
2007 */
2008
2009int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2010 unsigned int flags)
2011{
2012 int fput_needed, err, datagrams;
2013 struct socket *sock;
2014 struct mmsghdr __user *entry;
2015 struct compat_mmsghdr __user *compat_entry;
2016 struct msghdr msg_sys;
c71d8ebe 2017 struct used_address used_address;
228e548e 2018
98382f41
AB
2019 if (vlen > UIO_MAXIOV)
2020 vlen = UIO_MAXIOV;
228e548e
AB
2021
2022 datagrams = 0;
2023
2024 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2025 if (!sock)
2026 return err;
2027
c71d8ebe 2028 used_address.name_len = UINT_MAX;
228e548e
AB
2029 entry = mmsg;
2030 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2031 err = 0;
228e548e
AB
2032
2033 while (datagrams < vlen) {
228e548e 2034 if (MSG_CMSG_COMPAT & flags) {
666547ff 2035 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5 2036 &msg_sys, flags, &used_address);
228e548e
AB
2037 if (err < 0)
2038 break;
2039 err = __put_user(err, &compat_entry->msg_len);
2040 ++compat_entry;
2041 } else {
a7526eb5 2042 err = ___sys_sendmsg(sock,
666547ff 2043 (struct user_msghdr __user *)entry,
a7526eb5 2044 &msg_sys, flags, &used_address);
228e548e
AB
2045 if (err < 0)
2046 break;
2047 err = put_user(err, &entry->msg_len);
2048 ++entry;
2049 }
2050
2051 if (err)
2052 break;
2053 ++datagrams;
2054 }
2055
228e548e
AB
2056 fput_light(sock->file, fput_needed);
2057
728ffb86
AB
2058 /* We only return an error if no datagrams were able to be sent */
2059 if (datagrams != 0)
228e548e
AB
2060 return datagrams;
2061
228e548e
AB
2062 return err;
2063}
2064
2065SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2066 unsigned int, vlen, unsigned int, flags)
2067{
1be374a0
AL
2068 if (flags & MSG_CMSG_COMPAT)
2069 return -EINVAL;
228e548e
AB
2070 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2071}
2072
666547ff 2073static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2074 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2075{
89bddce5
SH
2076 struct compat_msghdr __user *msg_compat =
2077 (struct compat_msghdr __user *)msg;
1da177e4 2078 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2079 struct iovec *iov = iovstack;
1da177e4 2080 unsigned long cmsg_ptr;
08adb7da
AV
2081 int total_len, len;
2082 ssize_t err;
1da177e4
LT
2083
2084 /* kernel mode address */
230b1839 2085 struct sockaddr_storage addr;
1da177e4
LT
2086
2087 /* user mode address pointers */
2088 struct sockaddr __user *uaddr;
08adb7da 2089 int __user *uaddr_len = COMPAT_NAMELEN(msg);
89bddce5 2090
08adb7da 2091 msg_sys->msg_name = &addr;
1da177e4 2092
f3d33426 2093 if (MSG_CMSG_COMPAT & flags)
08adb7da 2094 err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
f3d33426 2095 else
08adb7da 2096 err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
1da177e4 2097 if (err < 0)
da184284
AV
2098 return err;
2099 total_len = iov_iter_count(&msg_sys->msg_iter);
1da177e4 2100
a2e27255
ACM
2101 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2102 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2103
f3d33426
HFS
2104 /* We assume all kernel code knows the size of sockaddr_storage */
2105 msg_sys->msg_namelen = 0;
2106
1da177e4
LT
2107 if (sock->file->f_flags & O_NONBLOCK)
2108 flags |= MSG_DONTWAIT;
a2e27255
ACM
2109 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2110 total_len, flags);
1da177e4
LT
2111 if (err < 0)
2112 goto out_freeiov;
2113 len = err;
2114
2115 if (uaddr != NULL) {
43db362d 2116 err = move_addr_to_user(&addr,
a2e27255 2117 msg_sys->msg_namelen, uaddr,
89bddce5 2118 uaddr_len);
1da177e4
LT
2119 if (err < 0)
2120 goto out_freeiov;
2121 }
a2e27255 2122 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2123 COMPAT_FLAGS(msg));
1da177e4
LT
2124 if (err)
2125 goto out_freeiov;
2126 if (MSG_CMSG_COMPAT & flags)
a2e27255 2127 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2128 &msg_compat->msg_controllen);
2129 else
a2e27255 2130 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2131 &msg->msg_controllen);
2132 if (err)
2133 goto out_freeiov;
2134 err = len;
2135
2136out_freeiov:
da184284 2137 kfree(iov);
a2e27255
ACM
2138 return err;
2139}
2140
2141/*
2142 * BSD recvmsg interface
2143 */
2144
666547ff 2145long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
a2e27255
ACM
2146{
2147 int fput_needed, err;
2148 struct msghdr msg_sys;
1be374a0
AL
2149 struct socket *sock;
2150
1be374a0 2151 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2152 if (!sock)
2153 goto out;
2154
a7526eb5 2155 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2156
6cb153ca 2157 fput_light(sock->file, fput_needed);
1da177e4
LT
2158out:
2159 return err;
2160}
2161
666547ff 2162SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
a7526eb5
AL
2163 unsigned int, flags)
2164{
2165 if (flags & MSG_CMSG_COMPAT)
2166 return -EINVAL;
2167 return __sys_recvmsg(fd, msg, flags);
2168}
2169
a2e27255
ACM
2170/*
2171 * Linux recvmmsg interface
2172 */
2173
2174int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2175 unsigned int flags, struct timespec *timeout)
2176{
2177 int fput_needed, err, datagrams;
2178 struct socket *sock;
2179 struct mmsghdr __user *entry;
d7256d0e 2180 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2181 struct msghdr msg_sys;
2182 struct timespec end_time;
2183
2184 if (timeout &&
2185 poll_select_set_timeout(&end_time, timeout->tv_sec,
2186 timeout->tv_nsec))
2187 return -EINVAL;
2188
2189 datagrams = 0;
2190
2191 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2192 if (!sock)
2193 return err;
2194
2195 err = sock_error(sock->sk);
2196 if (err)
2197 goto out_put;
2198
2199 entry = mmsg;
d7256d0e 2200 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2201
2202 while (datagrams < vlen) {
2203 /*
2204 * No need to ask LSM for more than the first datagram.
2205 */
d7256d0e 2206 if (MSG_CMSG_COMPAT & flags) {
666547ff 2207 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5
AL
2208 &msg_sys, flags & ~MSG_WAITFORONE,
2209 datagrams);
d7256d0e
JMG
2210 if (err < 0)
2211 break;
2212 err = __put_user(err, &compat_entry->msg_len);
2213 ++compat_entry;
2214 } else {
a7526eb5 2215 err = ___sys_recvmsg(sock,
666547ff 2216 (struct user_msghdr __user *)entry,
a7526eb5
AL
2217 &msg_sys, flags & ~MSG_WAITFORONE,
2218 datagrams);
d7256d0e
JMG
2219 if (err < 0)
2220 break;
2221 err = put_user(err, &entry->msg_len);
2222 ++entry;
2223 }
2224
a2e27255
ACM
2225 if (err)
2226 break;
a2e27255
ACM
2227 ++datagrams;
2228
71c5c159
BB
2229 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2230 if (flags & MSG_WAITFORONE)
2231 flags |= MSG_DONTWAIT;
2232
a2e27255
ACM
2233 if (timeout) {
2234 ktime_get_ts(timeout);
2235 *timeout = timespec_sub(end_time, *timeout);
2236 if (timeout->tv_sec < 0) {
2237 timeout->tv_sec = timeout->tv_nsec = 0;
2238 break;
2239 }
2240
2241 /* Timeout, return less than vlen datagrams */
2242 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2243 break;
2244 }
2245
2246 /* Out of band data, return right away */
2247 if (msg_sys.msg_flags & MSG_OOB)
2248 break;
2249 }
2250
2251out_put:
2252 fput_light(sock->file, fput_needed);
1da177e4 2253
a2e27255
ACM
2254 if (err == 0)
2255 return datagrams;
2256
2257 if (datagrams != 0) {
2258 /*
2259 * We may return less entries than requested (vlen) if the
2260 * sock is non block and there aren't enough datagrams...
2261 */
2262 if (err != -EAGAIN) {
2263 /*
2264 * ... or if recvmsg returns an error after we
2265 * received some datagrams, where we record the
2266 * error to return on the next call or if the
2267 * app asks about it using getsockopt(SO_ERROR).
2268 */
2269 sock->sk->sk_err = -err;
2270 }
2271
2272 return datagrams;
2273 }
2274
2275 return err;
2276}
2277
2278SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2279 unsigned int, vlen, unsigned int, flags,
2280 struct timespec __user *, timeout)
2281{
2282 int datagrams;
2283 struct timespec timeout_sys;
2284
1be374a0
AL
2285 if (flags & MSG_CMSG_COMPAT)
2286 return -EINVAL;
2287
a2e27255
ACM
2288 if (!timeout)
2289 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2290
2291 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2292 return -EFAULT;
2293
2294 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2295
2296 if (datagrams > 0 &&
2297 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2298 datagrams = -EFAULT;
2299
2300 return datagrams;
2301}
2302
2303#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2304/* Argument list sizes for sys_socketcall */
2305#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2306static const unsigned char nargs[21] = {
c6d409cf
ED
2307 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2308 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2309 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2310 AL(4), AL(5), AL(4)
89bddce5
SH
2311};
2312
1da177e4
LT
2313#undef AL
2314
2315/*
89bddce5 2316 * System call vectors.
1da177e4
LT
2317 *
2318 * Argument checking cleaned up. Saved 20% in size.
2319 * This function doesn't need to set the kernel lock because
89bddce5 2320 * it is set by the callees.
1da177e4
LT
2321 */
2322
3e0fa65f 2323SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2324{
2950fa9d 2325 unsigned long a[AUDITSC_ARGS];
89bddce5 2326 unsigned long a0, a1;
1da177e4 2327 int err;
47379052 2328 unsigned int len;
1da177e4 2329
228e548e 2330 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2331 return -EINVAL;
2332
47379052
AV
2333 len = nargs[call];
2334 if (len > sizeof(a))
2335 return -EINVAL;
2336
1da177e4 2337 /* copy_from_user should be SMP safe. */
47379052 2338 if (copy_from_user(a, args, len))
1da177e4 2339 return -EFAULT;
3ec3b2fb 2340
2950fa9d
CG
2341 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2342 if (err)
2343 return err;
3ec3b2fb 2344
89bddce5
SH
2345 a0 = a[0];
2346 a1 = a[1];
2347
2348 switch (call) {
2349 case SYS_SOCKET:
2350 err = sys_socket(a0, a1, a[2]);
2351 break;
2352 case SYS_BIND:
2353 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2354 break;
2355 case SYS_CONNECT:
2356 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2357 break;
2358 case SYS_LISTEN:
2359 err = sys_listen(a0, a1);
2360 break;
2361 case SYS_ACCEPT:
de11defe
UD
2362 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2363 (int __user *)a[2], 0);
89bddce5
SH
2364 break;
2365 case SYS_GETSOCKNAME:
2366 err =
2367 sys_getsockname(a0, (struct sockaddr __user *)a1,
2368 (int __user *)a[2]);
2369 break;
2370 case SYS_GETPEERNAME:
2371 err =
2372 sys_getpeername(a0, (struct sockaddr __user *)a1,
2373 (int __user *)a[2]);
2374 break;
2375 case SYS_SOCKETPAIR:
2376 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2377 break;
2378 case SYS_SEND:
2379 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2380 break;
2381 case SYS_SENDTO:
2382 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2383 (struct sockaddr __user *)a[4], a[5]);
2384 break;
2385 case SYS_RECV:
2386 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2387 break;
2388 case SYS_RECVFROM:
2389 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2390 (struct sockaddr __user *)a[4],
2391 (int __user *)a[5]);
2392 break;
2393 case SYS_SHUTDOWN:
2394 err = sys_shutdown(a0, a1);
2395 break;
2396 case SYS_SETSOCKOPT:
2397 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2398 break;
2399 case SYS_GETSOCKOPT:
2400 err =
2401 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2402 (int __user *)a[4]);
2403 break;
2404 case SYS_SENDMSG:
666547ff 2405 err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2406 break;
228e548e
AB
2407 case SYS_SENDMMSG:
2408 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2409 break;
89bddce5 2410 case SYS_RECVMSG:
666547ff 2411 err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2412 break;
a2e27255
ACM
2413 case SYS_RECVMMSG:
2414 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2415 (struct timespec __user *)a[4]);
2416 break;
de11defe
UD
2417 case SYS_ACCEPT4:
2418 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2419 (int __user *)a[2], a[3]);
aaca0bdc 2420 break;
89bddce5
SH
2421 default:
2422 err = -EINVAL;
2423 break;
1da177e4
LT
2424 }
2425 return err;
2426}
2427
89bddce5 2428#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2429
55737fda
SH
2430/**
2431 * sock_register - add a socket protocol handler
2432 * @ops: description of protocol
2433 *
1da177e4
LT
2434 * This function is called by a protocol handler that wants to
2435 * advertise its address family, and have it linked into the
e793c0f7 2436 * socket interface. The value ops->family corresponds to the
55737fda 2437 * socket system call protocol family.
1da177e4 2438 */
f0fd27d4 2439int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2440{
2441 int err;
2442
2443 if (ops->family >= NPROTO) {
3410f22e 2444 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
1da177e4
LT
2445 return -ENOBUFS;
2446 }
55737fda
SH
2447
2448 spin_lock(&net_family_lock);
190683a9
ED
2449 if (rcu_dereference_protected(net_families[ops->family],
2450 lockdep_is_held(&net_family_lock)))
55737fda
SH
2451 err = -EEXIST;
2452 else {
cf778b00 2453 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2454 err = 0;
2455 }
55737fda
SH
2456 spin_unlock(&net_family_lock);
2457
3410f22e 2458 pr_info("NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2459 return err;
2460}
c6d409cf 2461EXPORT_SYMBOL(sock_register);
1da177e4 2462
55737fda
SH
2463/**
2464 * sock_unregister - remove a protocol handler
2465 * @family: protocol family to remove
2466 *
1da177e4
LT
2467 * This function is called by a protocol handler that wants to
2468 * remove its address family, and have it unlinked from the
55737fda
SH
2469 * new socket creation.
2470 *
2471 * If protocol handler is a module, then it can use module reference
2472 * counts to protect against new references. If protocol handler is not
2473 * a module then it needs to provide its own protection in
2474 * the ops->create routine.
1da177e4 2475 */
f0fd27d4 2476void sock_unregister(int family)
1da177e4 2477{
f0fd27d4 2478 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2479
55737fda 2480 spin_lock(&net_family_lock);
a9b3cd7f 2481 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2482 spin_unlock(&net_family_lock);
2483
2484 synchronize_rcu();
2485
3410f22e 2486 pr_info("NET: Unregistered protocol family %d\n", family);
1da177e4 2487}
c6d409cf 2488EXPORT_SYMBOL(sock_unregister);
1da177e4 2489
77d76ea3 2490static int __init sock_init(void)
1da177e4 2491{
b3e19d92 2492 int err;
2ca794e5
EB
2493 /*
2494 * Initialize the network sysctl infrastructure.
2495 */
2496 err = net_sysctl_init();
2497 if (err)
2498 goto out;
b3e19d92 2499
1da177e4 2500 /*
89bddce5 2501 * Initialize skbuff SLAB cache
1da177e4
LT
2502 */
2503 skb_init();
1da177e4
LT
2504
2505 /*
89bddce5 2506 * Initialize the protocols module.
1da177e4
LT
2507 */
2508
2509 init_inodecache();
b3e19d92
NP
2510
2511 err = register_filesystem(&sock_fs_type);
2512 if (err)
2513 goto out_fs;
1da177e4 2514 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2515 if (IS_ERR(sock_mnt)) {
2516 err = PTR_ERR(sock_mnt);
2517 goto out_mount;
2518 }
77d76ea3
AK
2519
2520 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2521 */
2522
2523#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2524 err = netfilter_init();
2525 if (err)
2526 goto out;
1da177e4 2527#endif
cbeb321a 2528
408eccce 2529 ptp_classifier_init();
c1f19b51 2530
b3e19d92
NP
2531out:
2532 return err;
2533
2534out_mount:
2535 unregister_filesystem(&sock_fs_type);
2536out_fs:
2537 goto out;
1da177e4
LT
2538}
2539
77d76ea3
AK
2540core_initcall(sock_init); /* early initcall */
2541
1da177e4
LT
2542#ifdef CONFIG_PROC_FS
2543void socket_seq_show(struct seq_file *seq)
2544{
2545 int cpu;
2546 int counter = 0;
2547
6f912042 2548 for_each_possible_cpu(cpu)
89bddce5 2549 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2550
2551 /* It can be negative, by the way. 8) */
2552 if (counter < 0)
2553 counter = 0;
2554
2555 seq_printf(seq, "sockets: used %d\n", counter);
2556}
89bddce5 2557#endif /* CONFIG_PROC_FS */
1da177e4 2558
89bbfc95 2559#ifdef CONFIG_COMPAT
6b96018b 2560static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2561 unsigned int cmd, void __user *up)
7a229387 2562{
7a229387
AB
2563 mm_segment_t old_fs = get_fs();
2564 struct timeval ktv;
2565 int err;
2566
2567 set_fs(KERNEL_DS);
6b96018b 2568 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2569 set_fs(old_fs);
644595f8 2570 if (!err)
ed6fe9d6 2571 err = compat_put_timeval(&ktv, up);
644595f8 2572
7a229387
AB
2573 return err;
2574}
2575
6b96018b 2576static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2577 unsigned int cmd, void __user *up)
7a229387 2578{
7a229387
AB
2579 mm_segment_t old_fs = get_fs();
2580 struct timespec kts;
2581 int err;
2582
2583 set_fs(KERNEL_DS);
6b96018b 2584 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2585 set_fs(old_fs);
644595f8 2586 if (!err)
ed6fe9d6 2587 err = compat_put_timespec(&kts, up);
644595f8 2588
7a229387
AB
2589 return err;
2590}
2591
6b96018b 2592static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2593{
2594 struct ifreq __user *uifr;
2595 int err;
2596
2597 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2598 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2599 return -EFAULT;
2600
6b96018b 2601 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2602 if (err)
2603 return err;
2604
6b96018b 2605 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2606 return -EFAULT;
2607
2608 return 0;
2609}
2610
6b96018b 2611static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2612{
6b96018b 2613 struct compat_ifconf ifc32;
7a229387
AB
2614 struct ifconf ifc;
2615 struct ifconf __user *uifc;
6b96018b 2616 struct compat_ifreq __user *ifr32;
7a229387
AB
2617 struct ifreq __user *ifr;
2618 unsigned int i, j;
2619 int err;
2620
6b96018b 2621 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2622 return -EFAULT;
2623
43da5f2e 2624 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2625 if (ifc32.ifcbuf == 0) {
2626 ifc32.ifc_len = 0;
2627 ifc.ifc_len = 0;
2628 ifc.ifc_req = NULL;
2629 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2630 } else {
c6d409cf
ED
2631 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2632 sizeof(struct ifreq);
7a229387
AB
2633 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2634 ifc.ifc_len = len;
2635 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2636 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2637 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2638 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2639 return -EFAULT;
2640 ifr++;
2641 ifr32++;
2642 }
2643 }
2644 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2645 return -EFAULT;
2646
6b96018b 2647 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2648 if (err)
2649 return err;
2650
2651 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2652 return -EFAULT;
2653
2654 ifr = ifc.ifc_req;
2655 ifr32 = compat_ptr(ifc32.ifcbuf);
2656 for (i = 0, j = 0;
c6d409cf
ED
2657 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2658 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2659 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2660 return -EFAULT;
2661 ifr32++;
2662 ifr++;
2663 }
2664
2665 if (ifc32.ifcbuf == 0) {
2666 /* Translate from 64-bit structure multiple to
2667 * a 32-bit one.
2668 */
2669 i = ifc.ifc_len;
6b96018b 2670 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2671 ifc32.ifc_len = i;
2672 } else {
2673 ifc32.ifc_len = i;
2674 }
6b96018b 2675 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2676 return -EFAULT;
2677
2678 return 0;
2679}
2680
6b96018b 2681static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2682{
3a7da39d
BH
2683 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2684 bool convert_in = false, convert_out = false;
2685 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2686 struct ethtool_rxnfc __user *rxnfc;
7a229387 2687 struct ifreq __user *ifr;
3a7da39d
BH
2688 u32 rule_cnt = 0, actual_rule_cnt;
2689 u32 ethcmd;
7a229387 2690 u32 data;
3a7da39d 2691 int ret;
7a229387 2692
3a7da39d
BH
2693 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2694 return -EFAULT;
7a229387 2695
3a7da39d
BH
2696 compat_rxnfc = compat_ptr(data);
2697
2698 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2699 return -EFAULT;
2700
3a7da39d
BH
2701 /* Most ethtool structures are defined without padding.
2702 * Unfortunately struct ethtool_rxnfc is an exception.
2703 */
2704 switch (ethcmd) {
2705 default:
2706 break;
2707 case ETHTOOL_GRXCLSRLALL:
2708 /* Buffer size is variable */
2709 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2710 return -EFAULT;
2711 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2712 return -ENOMEM;
2713 buf_size += rule_cnt * sizeof(u32);
2714 /* fall through */
2715 case ETHTOOL_GRXRINGS:
2716 case ETHTOOL_GRXCLSRLCNT:
2717 case ETHTOOL_GRXCLSRULE:
55664f32 2718 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2719 convert_out = true;
2720 /* fall through */
2721 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2722 buf_size += sizeof(struct ethtool_rxnfc);
2723 convert_in = true;
2724 break;
2725 }
2726
2727 ifr = compat_alloc_user_space(buf_size);
954b1244 2728 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2729
2730 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2731 return -EFAULT;
2732
3a7da39d
BH
2733 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2734 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2735 return -EFAULT;
2736
3a7da39d 2737 if (convert_in) {
127fe533 2738 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2739 * fs.ring_cookie and at the end of fs, but nowhere else.
2740 */
127fe533
AD
2741 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2742 sizeof(compat_rxnfc->fs.m_ext) !=
2743 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2744 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2745 BUILD_BUG_ON(
2746 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2747 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2748 offsetof(struct ethtool_rxnfc, fs.location) -
2749 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2750
2751 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2752 (void __user *)(&rxnfc->fs.m_ext + 1) -
2753 (void __user *)rxnfc) ||
3a7da39d
BH
2754 copy_in_user(&rxnfc->fs.ring_cookie,
2755 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2756 (void __user *)(&rxnfc->fs.location + 1) -
2757 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2758 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2759 sizeof(rxnfc->rule_cnt)))
2760 return -EFAULT;
2761 }
2762
2763 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2764 if (ret)
2765 return ret;
2766
2767 if (convert_out) {
2768 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2769 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2770 (const void __user *)rxnfc) ||
3a7da39d
BH
2771 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2772 &rxnfc->fs.ring_cookie,
954b1244
SH
2773 (const void __user *)(&rxnfc->fs.location + 1) -
2774 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2775 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2776 sizeof(rxnfc->rule_cnt)))
2777 return -EFAULT;
2778
2779 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2780 /* As an optimisation, we only copy the actual
2781 * number of rules that the underlying
2782 * function returned. Since Mallory might
2783 * change the rule count in user memory, we
2784 * check that it is less than the rule count
2785 * originally given (as the user buffer size),
2786 * which has been range-checked.
2787 */
2788 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2789 return -EFAULT;
2790 if (actual_rule_cnt < rule_cnt)
2791 rule_cnt = actual_rule_cnt;
2792 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2793 &rxnfc->rule_locs[0],
2794 rule_cnt * sizeof(u32)))
2795 return -EFAULT;
2796 }
2797 }
2798
2799 return 0;
7a229387
AB
2800}
2801
7a50a240
AB
2802static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2803{
2804 void __user *uptr;
2805 compat_uptr_t uptr32;
2806 struct ifreq __user *uifr;
2807
c6d409cf 2808 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2809 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2810 return -EFAULT;
2811
2812 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2813 return -EFAULT;
2814
2815 uptr = compat_ptr(uptr32);
2816
2817 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2818 return -EFAULT;
2819
2820 return dev_ioctl(net, SIOCWANDEV, uifr);
2821}
2822
6b96018b
AB
2823static int bond_ioctl(struct net *net, unsigned int cmd,
2824 struct compat_ifreq __user *ifr32)
7a229387
AB
2825{
2826 struct ifreq kifr;
7a229387
AB
2827 mm_segment_t old_fs;
2828 int err;
7a229387
AB
2829
2830 switch (cmd) {
2831 case SIOCBONDENSLAVE:
2832 case SIOCBONDRELEASE:
2833 case SIOCBONDSETHWADDR:
2834 case SIOCBONDCHANGEACTIVE:
6b96018b 2835 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2836 return -EFAULT;
2837
2838 old_fs = get_fs();
c6d409cf 2839 set_fs(KERNEL_DS);
c3f52ae6 2840 err = dev_ioctl(net, cmd,
2841 (struct ifreq __user __force *) &kifr);
c6d409cf 2842 set_fs(old_fs);
7a229387
AB
2843
2844 return err;
7a229387 2845 default:
07d106d0 2846 return -ENOIOCTLCMD;
ccbd6a5a 2847 }
7a229387
AB
2848}
2849
590d4693
BH
2850/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2851static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 2852 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2853{
2854 struct ifreq __user *u_ifreq64;
7a229387
AB
2855 char tmp_buf[IFNAMSIZ];
2856 void __user *data64;
2857 u32 data32;
2858
2859 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2860 IFNAMSIZ))
2861 return -EFAULT;
417c3522 2862 if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
7a229387
AB
2863 return -EFAULT;
2864 data64 = compat_ptr(data32);
2865
2866 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2867
7a229387
AB
2868 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2869 IFNAMSIZ))
2870 return -EFAULT;
417c3522 2871 if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
7a229387
AB
2872 return -EFAULT;
2873
6b96018b 2874 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
2875}
2876
6b96018b
AB
2877static int dev_ifsioc(struct net *net, struct socket *sock,
2878 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 2879{
a2116ed2 2880 struct ifreq __user *uifr;
7a229387
AB
2881 int err;
2882
a2116ed2
AB
2883 uifr = compat_alloc_user_space(sizeof(*uifr));
2884 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2885 return -EFAULT;
2886
2887 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2888
7a229387
AB
2889 if (!err) {
2890 switch (cmd) {
2891 case SIOCGIFFLAGS:
2892 case SIOCGIFMETRIC:
2893 case SIOCGIFMTU:
2894 case SIOCGIFMEM:
2895 case SIOCGIFHWADDR:
2896 case SIOCGIFINDEX:
2897 case SIOCGIFADDR:
2898 case SIOCGIFBRDADDR:
2899 case SIOCGIFDSTADDR:
2900 case SIOCGIFNETMASK:
fab2532b 2901 case SIOCGIFPFLAGS:
7a229387 2902 case SIOCGIFTXQLEN:
fab2532b
AB
2903 case SIOCGMIIPHY:
2904 case SIOCGMIIREG:
a2116ed2 2905 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
2906 err = -EFAULT;
2907 break;
2908 }
2909 }
2910 return err;
2911}
2912
a2116ed2
AB
2913static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2914 struct compat_ifreq __user *uifr32)
2915{
2916 struct ifreq ifr;
2917 struct compat_ifmap __user *uifmap32;
2918 mm_segment_t old_fs;
2919 int err;
2920
2921 uifmap32 = &uifr32->ifr_ifru.ifru_map;
2922 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
2923 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2924 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2925 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2926 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2927 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2928 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2929 if (err)
2930 return -EFAULT;
2931
2932 old_fs = get_fs();
c6d409cf 2933 set_fs(KERNEL_DS);
c3f52ae6 2934 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 2935 set_fs(old_fs);
a2116ed2
AB
2936
2937 if (cmd == SIOCGIFMAP && !err) {
2938 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
2939 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2940 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2941 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2942 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2943 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2944 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2945 if (err)
2946 err = -EFAULT;
2947 }
2948 return err;
2949}
2950
7a229387 2951struct rtentry32 {
c6d409cf 2952 u32 rt_pad1;
7a229387
AB
2953 struct sockaddr rt_dst; /* target address */
2954 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
2955 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
2956 unsigned short rt_flags;
2957 short rt_pad2;
2958 u32 rt_pad3;
2959 unsigned char rt_tos;
2960 unsigned char rt_class;
2961 short rt_pad4;
2962 short rt_metric; /* +1 for binary compatibility! */
7a229387 2963 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
2964 u32 rt_mtu; /* per route MTU/Window */
2965 u32 rt_window; /* Window clamping */
7a229387
AB
2966 unsigned short rt_irtt; /* Initial RTT */
2967};
2968
2969struct in6_rtmsg32 {
2970 struct in6_addr rtmsg_dst;
2971 struct in6_addr rtmsg_src;
2972 struct in6_addr rtmsg_gateway;
2973 u32 rtmsg_type;
2974 u16 rtmsg_dst_len;
2975 u16 rtmsg_src_len;
2976 u32 rtmsg_metric;
2977 u32 rtmsg_info;
2978 u32 rtmsg_flags;
2979 s32 rtmsg_ifindex;
2980};
2981
6b96018b
AB
2982static int routing_ioctl(struct net *net, struct socket *sock,
2983 unsigned int cmd, void __user *argp)
7a229387
AB
2984{
2985 int ret;
2986 void *r = NULL;
2987 struct in6_rtmsg r6;
2988 struct rtentry r4;
2989 char devname[16];
2990 u32 rtdev;
2991 mm_segment_t old_fs = get_fs();
2992
6b96018b
AB
2993 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
2994 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 2995 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 2996 3 * sizeof(struct in6_addr));
3ddc5b46
MD
2997 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
2998 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
2999 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3000 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3001 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3002 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3003 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3004
3005 r = (void *) &r6;
3006 } else { /* ipv4 */
6b96018b 3007 struct rtentry32 __user *ur4 = argp;
c6d409cf 3008 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3009 3 * sizeof(struct sockaddr));
3ddc5b46
MD
3010 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3011 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3012 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3013 ret |= get_user(r4.rt_window, &(ur4->rt_window));
3014 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3015 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 3016 if (rtdev) {
c6d409cf 3017 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3018 r4.rt_dev = (char __user __force *)devname;
3019 devname[15] = 0;
7a229387
AB
3020 } else
3021 r4.rt_dev = NULL;
3022
3023 r = (void *) &r4;
3024 }
3025
3026 if (ret) {
3027 ret = -EFAULT;
3028 goto out;
3029 }
3030
c6d409cf 3031 set_fs(KERNEL_DS);
6b96018b 3032 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3033 set_fs(old_fs);
7a229387
AB
3034
3035out:
7a229387
AB
3036 return ret;
3037}
3038
3039/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3040 * for some operations; this forces use of the newer bridge-utils that
25985edc 3041 * use compatible ioctls
7a229387 3042 */
6b96018b 3043static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3044{
6b96018b 3045 compat_ulong_t tmp;
7a229387 3046
6b96018b 3047 if (get_user(tmp, argp))
7a229387
AB
3048 return -EFAULT;
3049 if (tmp == BRCTL_GET_VERSION)
3050 return BRCTL_VERSION + 1;
3051 return -EINVAL;
3052}
3053
6b96018b
AB
3054static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3055 unsigned int cmd, unsigned long arg)
3056{
3057 void __user *argp = compat_ptr(arg);
3058 struct sock *sk = sock->sk;
3059 struct net *net = sock_net(sk);
7a229387 3060
6b96018b 3061 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3062 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3063
3064 switch (cmd) {
3065 case SIOCSIFBR:
3066 case SIOCGIFBR:
3067 return old_bridge_ioctl(argp);
3068 case SIOCGIFNAME:
3069 return dev_ifname32(net, argp);
3070 case SIOCGIFCONF:
3071 return dev_ifconf(net, argp);
3072 case SIOCETHTOOL:
3073 return ethtool_ioctl(net, argp);
7a50a240
AB
3074 case SIOCWANDEV:
3075 return compat_siocwandev(net, argp);
a2116ed2
AB
3076 case SIOCGIFMAP:
3077 case SIOCSIFMAP:
3078 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3079 case SIOCBONDENSLAVE:
3080 case SIOCBONDRELEASE:
3081 case SIOCBONDSETHWADDR:
6b96018b
AB
3082 case SIOCBONDCHANGEACTIVE:
3083 return bond_ioctl(net, cmd, argp);
3084 case SIOCADDRT:
3085 case SIOCDELRT:
3086 return routing_ioctl(net, sock, cmd, argp);
3087 case SIOCGSTAMP:
3088 return do_siocgstamp(net, sock, cmd, argp);
3089 case SIOCGSTAMPNS:
3090 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3091 case SIOCBONDSLAVEINFOQUERY:
3092 case SIOCBONDINFOQUERY:
a2116ed2 3093 case SIOCSHWTSTAMP:
fd468c74 3094 case SIOCGHWTSTAMP:
590d4693 3095 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3096
3097 case FIOSETOWN:
3098 case SIOCSPGRP:
3099 case FIOGETOWN:
3100 case SIOCGPGRP:
3101 case SIOCBRADDBR:
3102 case SIOCBRDELBR:
3103 case SIOCGIFVLAN:
3104 case SIOCSIFVLAN:
3105 case SIOCADDDLCI:
3106 case SIOCDELDLCI:
3107 return sock_ioctl(file, cmd, arg);
3108
3109 case SIOCGIFFLAGS:
3110 case SIOCSIFFLAGS:
3111 case SIOCGIFMETRIC:
3112 case SIOCSIFMETRIC:
3113 case SIOCGIFMTU:
3114 case SIOCSIFMTU:
3115 case SIOCGIFMEM:
3116 case SIOCSIFMEM:
3117 case SIOCGIFHWADDR:
3118 case SIOCSIFHWADDR:
3119 case SIOCADDMULTI:
3120 case SIOCDELMULTI:
3121 case SIOCGIFINDEX:
6b96018b
AB
3122 case SIOCGIFADDR:
3123 case SIOCSIFADDR:
3124 case SIOCSIFHWBROADCAST:
6b96018b 3125 case SIOCDIFADDR:
6b96018b
AB
3126 case SIOCGIFBRDADDR:
3127 case SIOCSIFBRDADDR:
3128 case SIOCGIFDSTADDR:
3129 case SIOCSIFDSTADDR:
3130 case SIOCGIFNETMASK:
3131 case SIOCSIFNETMASK:
3132 case SIOCSIFPFLAGS:
3133 case SIOCGIFPFLAGS:
3134 case SIOCGIFTXQLEN:
3135 case SIOCSIFTXQLEN:
3136 case SIOCBRADDIF:
3137 case SIOCBRDELIF:
9177efd3
AB
3138 case SIOCSIFNAME:
3139 case SIOCGMIIPHY:
3140 case SIOCGMIIREG:
3141 case SIOCSMIIREG:
6b96018b 3142 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3143
6b96018b
AB
3144 case SIOCSARP:
3145 case SIOCGARP:
3146 case SIOCDARP:
6b96018b 3147 case SIOCATMARK:
9177efd3
AB
3148 return sock_do_ioctl(net, sock, cmd, arg);
3149 }
3150
6b96018b
AB
3151 return -ENOIOCTLCMD;
3152}
7a229387 3153
95c96174 3154static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3155 unsigned long arg)
89bbfc95
SP
3156{
3157 struct socket *sock = file->private_data;
3158 int ret = -ENOIOCTLCMD;
87de87d5
DM
3159 struct sock *sk;
3160 struct net *net;
3161
3162 sk = sock->sk;
3163 net = sock_net(sk);
89bbfc95
SP
3164
3165 if (sock->ops->compat_ioctl)
3166 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3167
87de87d5
DM
3168 if (ret == -ENOIOCTLCMD &&
3169 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3170 ret = compat_wext_handle_ioctl(net, cmd, arg);
3171
6b96018b
AB
3172 if (ret == -ENOIOCTLCMD)
3173 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3174
89bbfc95
SP
3175 return ret;
3176}
3177#endif
3178
ac5a488e
SS
3179int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3180{
3181 return sock->ops->bind(sock, addr, addrlen);
3182}
c6d409cf 3183EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3184
3185int kernel_listen(struct socket *sock, int backlog)
3186{
3187 return sock->ops->listen(sock, backlog);
3188}
c6d409cf 3189EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3190
3191int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3192{
3193 struct sock *sk = sock->sk;
3194 int err;
3195
3196 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3197 newsock);
3198 if (err < 0)
3199 goto done;
3200
3201 err = sock->ops->accept(sock, *newsock, flags);
3202 if (err < 0) {
3203 sock_release(*newsock);
fa8705b0 3204 *newsock = NULL;
ac5a488e
SS
3205 goto done;
3206 }
3207
3208 (*newsock)->ops = sock->ops;
1b08534e 3209 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3210
3211done:
3212 return err;
3213}
c6d409cf 3214EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3215
3216int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3217 int flags)
ac5a488e
SS
3218{
3219 return sock->ops->connect(sock, addr, addrlen, flags);
3220}
c6d409cf 3221EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3222
3223int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3224 int *addrlen)
3225{
3226 return sock->ops->getname(sock, addr, addrlen, 0);
3227}
c6d409cf 3228EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3229
3230int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3231 int *addrlen)
3232{
3233 return sock->ops->getname(sock, addr, addrlen, 1);
3234}
c6d409cf 3235EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3236
3237int kernel_getsockopt(struct socket *sock, int level, int optname,
3238 char *optval, int *optlen)
3239{
3240 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3241 char __user *uoptval;
3242 int __user *uoptlen;
ac5a488e
SS
3243 int err;
3244
fb8621bb
NK
3245 uoptval = (char __user __force *) optval;
3246 uoptlen = (int __user __force *) optlen;
3247
ac5a488e
SS
3248 set_fs(KERNEL_DS);
3249 if (level == SOL_SOCKET)
fb8621bb 3250 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3251 else
fb8621bb
NK
3252 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3253 uoptlen);
ac5a488e
SS
3254 set_fs(oldfs);
3255 return err;
3256}
c6d409cf 3257EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3258
3259int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3260 char *optval, unsigned int optlen)
ac5a488e
SS
3261{
3262 mm_segment_t oldfs = get_fs();
fb8621bb 3263 char __user *uoptval;
ac5a488e
SS
3264 int err;
3265
fb8621bb
NK
3266 uoptval = (char __user __force *) optval;
3267
ac5a488e
SS
3268 set_fs(KERNEL_DS);
3269 if (level == SOL_SOCKET)
fb8621bb 3270 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3271 else
fb8621bb 3272 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3273 optlen);
3274 set_fs(oldfs);
3275 return err;
3276}
c6d409cf 3277EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3278
3279int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3280 size_t size, int flags)
3281{
3282 if (sock->ops->sendpage)
3283 return sock->ops->sendpage(sock, page, offset, size, flags);
3284
3285 return sock_no_sendpage(sock, page, offset, size, flags);
3286}
c6d409cf 3287EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3288
3289int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3290{
3291 mm_segment_t oldfs = get_fs();
3292 int err;
3293
3294 set_fs(KERNEL_DS);
3295 err = sock->ops->ioctl(sock, cmd, arg);
3296 set_fs(oldfs);
3297
3298 return err;
3299}
c6d409cf 3300EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3301
91cf45f0
TM
3302int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3303{
3304 return sock->ops->shutdown(sock, how);
3305}
91cf45f0 3306EXPORT_SYMBOL(kernel_sock_shutdown);