drivers: net: cpsw: fix error return code
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
408eccce 75#include <linux/ptp_classify.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
600e1779 91#include <linux/xattr.h>
1da177e4
LT
92
93#include <asm/uaccess.h>
94#include <asm/unistd.h>
95
96#include <net/compat.h>
87de87d5 97#include <net/wext.h>
f8451725 98#include <net/cls_cgroup.h>
1da177e4
LT
99
100#include <net/sock.h>
101#include <linux/netfilter.h>
102
6b96018b
AB
103#include <linux/if_tun.h>
104#include <linux/ipv6_route.h>
105#include <linux/route.h>
6b96018b
AB
106#include <linux/sockios.h>
107#include <linux/atalk.h>
076bb0c8 108#include <net/busy_poll.h>
f24b9be5 109#include <linux/errqueue.h>
06021292 110
e0d1095a 111#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
112unsigned int sysctl_net_busy_read __read_mostly;
113unsigned int sysctl_net_busy_poll __read_mostly;
06021292 114#endif
6b96018b 115
8ae5e030
AV
116static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
117static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
89bddce5 118static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
119
120static int sock_close(struct inode *inode, struct file *file);
121static unsigned int sock_poll(struct file *file,
122 struct poll_table_struct *wait);
89bddce5 123static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
124#ifdef CONFIG_COMPAT
125static long compat_sock_ioctl(struct file *file,
89bddce5 126 unsigned int cmd, unsigned long arg);
89bbfc95 127#endif
1da177e4 128static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
129static ssize_t sock_sendpage(struct file *file, struct page *page,
130 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 131static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 132 struct pipe_inode_info *pipe, size_t len,
9c55e01c 133 unsigned int flags);
1da177e4 134
1da177e4
LT
135/*
136 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
137 * in the operation structures but are done directly via the socketcall() multiplexor.
138 */
139
da7071d7 140static const struct file_operations socket_file_ops = {
1da177e4
LT
141 .owner = THIS_MODULE,
142 .llseek = no_llseek,
8ae5e030
AV
143 .read_iter = sock_read_iter,
144 .write_iter = sock_write_iter,
1da177e4
LT
145 .poll = sock_poll,
146 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
147#ifdef CONFIG_COMPAT
148 .compat_ioctl = compat_sock_ioctl,
149#endif
1da177e4 150 .mmap = sock_mmap,
1da177e4
LT
151 .release = sock_close,
152 .fasync = sock_fasync,
5274f052
JA
153 .sendpage = sock_sendpage,
154 .splice_write = generic_splice_sendpage,
9c55e01c 155 .splice_read = sock_splice_read,
1da177e4
LT
156};
157
158/*
159 * The protocol list. Each protocol is registered in here.
160 */
161
1da177e4 162static DEFINE_SPINLOCK(net_family_lock);
190683a9 163static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 164
1da177e4
LT
165/*
166 * Statistics counters of the socket lists
167 */
168
c6d409cf 169static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
170
171/*
89bddce5
SH
172 * Support routines.
173 * Move socket addresses back and forth across the kernel/user
174 * divide and look after the messy bits.
1da177e4
LT
175 */
176
1da177e4
LT
177/**
178 * move_addr_to_kernel - copy a socket address into kernel space
179 * @uaddr: Address in user space
180 * @kaddr: Address in kernel space
181 * @ulen: Length in user space
182 *
183 * The address is copied into kernel space. If the provided address is
184 * too long an error code of -EINVAL is returned. If the copy gives
185 * invalid addresses -EFAULT is returned. On a success 0 is returned.
186 */
187
43db362d 188int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 189{
230b1839 190 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 191 return -EINVAL;
89bddce5 192 if (ulen == 0)
1da177e4 193 return 0;
89bddce5 194 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 195 return -EFAULT;
3ec3b2fb 196 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
197}
198
199/**
200 * move_addr_to_user - copy an address to user space
201 * @kaddr: kernel space address
202 * @klen: length of address in kernel
203 * @uaddr: user space address
204 * @ulen: pointer to user length field
205 *
206 * The value pointed to by ulen on entry is the buffer length available.
207 * This is overwritten with the buffer space used. -EINVAL is returned
208 * if an overlong buffer is specified or a negative buffer size. -EFAULT
209 * is returned if either the buffer or the length field are not
210 * accessible.
211 * After copying the data up to the limit the user specifies, the true
212 * length of the data is written over the length limit the user
213 * specified. Zero is returned for a success.
214 */
89bddce5 215
43db362d 216static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 217 void __user *uaddr, int __user *ulen)
1da177e4
LT
218{
219 int err;
220 int len;
221
68c6beb3 222 BUG_ON(klen > sizeof(struct sockaddr_storage));
89bddce5
SH
223 err = get_user(len, ulen);
224 if (err)
1da177e4 225 return err;
89bddce5
SH
226 if (len > klen)
227 len = klen;
68c6beb3 228 if (len < 0)
1da177e4 229 return -EINVAL;
89bddce5 230 if (len) {
d6fe3945
SG
231 if (audit_sockaddr(klen, kaddr))
232 return -ENOMEM;
89bddce5 233 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
234 return -EFAULT;
235 }
236 /*
89bddce5
SH
237 * "fromlen shall refer to the value before truncation.."
238 * 1003.1g
1da177e4
LT
239 */
240 return __put_user(klen, ulen);
241}
242
e18b890b 243static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
244
245static struct inode *sock_alloc_inode(struct super_block *sb)
246{
247 struct socket_alloc *ei;
eaefd110 248 struct socket_wq *wq;
89bddce5 249
e94b1766 250 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
251 if (!ei)
252 return NULL;
eaefd110
ED
253 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
254 if (!wq) {
43815482
ED
255 kmem_cache_free(sock_inode_cachep, ei);
256 return NULL;
257 }
eaefd110
ED
258 init_waitqueue_head(&wq->wait);
259 wq->fasync_list = NULL;
260 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 261
1da177e4
LT
262 ei->socket.state = SS_UNCONNECTED;
263 ei->socket.flags = 0;
264 ei->socket.ops = NULL;
265 ei->socket.sk = NULL;
266 ei->socket.file = NULL;
1da177e4
LT
267
268 return &ei->vfs_inode;
269}
270
271static void sock_destroy_inode(struct inode *inode)
272{
43815482 273 struct socket_alloc *ei;
eaefd110 274 struct socket_wq *wq;
43815482
ED
275
276 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 277 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 278 kfree_rcu(wq, rcu);
43815482 279 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
280}
281
51cc5068 282static void init_once(void *foo)
1da177e4 283{
89bddce5 284 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 285
a35afb83 286 inode_init_once(&ei->vfs_inode);
1da177e4 287}
89bddce5 288
1da177e4
LT
289static int init_inodecache(void)
290{
291 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
292 sizeof(struct socket_alloc),
293 0,
294 (SLAB_HWCACHE_ALIGN |
295 SLAB_RECLAIM_ACCOUNT |
296 SLAB_MEM_SPREAD),
20c2df83 297 init_once);
1da177e4
LT
298 if (sock_inode_cachep == NULL)
299 return -ENOMEM;
300 return 0;
301}
302
b87221de 303static const struct super_operations sockfs_ops = {
c6d409cf
ED
304 .alloc_inode = sock_alloc_inode,
305 .destroy_inode = sock_destroy_inode,
306 .statfs = simple_statfs,
1da177e4
LT
307};
308
c23fbb6b
ED
309/*
310 * sockfs_dname() is called from d_path().
311 */
312static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
313{
314 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
c5ef6035 315 d_inode(dentry)->i_ino);
c23fbb6b
ED
316}
317
3ba13d17 318static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 319 .d_dname = sockfs_dname,
1da177e4
LT
320};
321
c74a1cbb
AV
322static struct dentry *sockfs_mount(struct file_system_type *fs_type,
323 int flags, const char *dev_name, void *data)
324{
325 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
326 &sockfs_dentry_operations, SOCKFS_MAGIC);
327}
328
329static struct vfsmount *sock_mnt __read_mostly;
330
331static struct file_system_type sock_fs_type = {
332 .name = "sockfs",
333 .mount = sockfs_mount,
334 .kill_sb = kill_anon_super,
335};
336
1da177e4
LT
337/*
338 * Obtains the first available file descriptor and sets it up for use.
339 *
39d8c1b6
DM
340 * These functions create file structures and maps them to fd space
341 * of the current process. On success it returns file descriptor
1da177e4
LT
342 * and file struct implicitly stored in sock->file.
343 * Note that another thread may close file descriptor before we return
344 * from this function. We use the fact that now we do not refer
345 * to socket after mapping. If one day we will need it, this
346 * function will increment ref. count on file by 1.
347 *
348 * In any case returned fd MAY BE not valid!
349 * This race condition is unavoidable
350 * with shared fd spaces, we cannot solve it inside kernel,
351 * but we take care of internal coherence yet.
352 */
353
aab174f0 354struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 355{
7cbe66b6 356 struct qstr name = { .name = "" };
2c48b9c4 357 struct path path;
7cbe66b6 358 struct file *file;
1da177e4 359
600e1779
MY
360 if (dname) {
361 name.name = dname;
362 name.len = strlen(name.name);
363 } else if (sock->sk) {
364 name.name = sock->sk->sk_prot_creator->name;
365 name.len = strlen(name.name);
366 }
4b936885 367 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
368 if (unlikely(!path.dentry))
369 return ERR_PTR(-ENOMEM);
2c48b9c4 370 path.mnt = mntget(sock_mnt);
39d8c1b6 371
2c48b9c4 372 d_instantiate(path.dentry, SOCK_INODE(sock));
39d8c1b6 373
2c48b9c4 374 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 375 &socket_file_ops);
b5ffe634 376 if (IS_ERR(file)) {
cc3808f8 377 /* drop dentry, keep inode */
c5ef6035 378 ihold(d_inode(path.dentry));
2c48b9c4 379 path_put(&path);
39b65252 380 return file;
cc3808f8
AV
381 }
382
383 sock->file = file;
77d27200 384 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 385 file->private_data = sock;
28407630 386 return file;
39d8c1b6 387}
56b31d1c 388EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 389
56b31d1c 390static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
391{
392 struct file *newfile;
28407630
AV
393 int fd = get_unused_fd_flags(flags);
394 if (unlikely(fd < 0))
395 return fd;
39d8c1b6 396
aab174f0 397 newfile = sock_alloc_file(sock, flags, NULL);
28407630 398 if (likely(!IS_ERR(newfile))) {
39d8c1b6 399 fd_install(fd, newfile);
28407630
AV
400 return fd;
401 }
7cbe66b6 402
28407630
AV
403 put_unused_fd(fd);
404 return PTR_ERR(newfile);
1da177e4
LT
405}
406
406a3c63 407struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 408{
6cb153ca
BL
409 if (file->f_op == &socket_file_ops)
410 return file->private_data; /* set in sock_map_fd */
411
23bb80d2
ED
412 *err = -ENOTSOCK;
413 return NULL;
6cb153ca 414}
406a3c63 415EXPORT_SYMBOL(sock_from_file);
6cb153ca 416
1da177e4 417/**
c6d409cf 418 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
419 * @fd: file handle
420 * @err: pointer to an error code return
421 *
422 * The file handle passed in is locked and the socket it is bound
423 * too is returned. If an error occurs the err pointer is overwritten
424 * with a negative errno code and NULL is returned. The function checks
425 * for both invalid handles and passing a handle which is not a socket.
426 *
427 * On a success the socket object pointer is returned.
428 */
429
430struct socket *sockfd_lookup(int fd, int *err)
431{
432 struct file *file;
1da177e4
LT
433 struct socket *sock;
434
89bddce5
SH
435 file = fget(fd);
436 if (!file) {
1da177e4
LT
437 *err = -EBADF;
438 return NULL;
439 }
89bddce5 440
6cb153ca
BL
441 sock = sock_from_file(file, err);
442 if (!sock)
1da177e4 443 fput(file);
6cb153ca
BL
444 return sock;
445}
c6d409cf 446EXPORT_SYMBOL(sockfd_lookup);
1da177e4 447
6cb153ca
BL
448static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
449{
00e188ef 450 struct fd f = fdget(fd);
6cb153ca
BL
451 struct socket *sock;
452
3672558c 453 *err = -EBADF;
00e188ef
AV
454 if (f.file) {
455 sock = sock_from_file(f.file, err);
456 if (likely(sock)) {
457 *fput_needed = f.flags;
6cb153ca 458 return sock;
00e188ef
AV
459 }
460 fdput(f);
1da177e4 461 }
6cb153ca 462 return NULL;
1da177e4
LT
463}
464
600e1779
MY
465#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
466#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
467#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
468static ssize_t sockfs_getxattr(struct dentry *dentry,
469 const char *name, void *value, size_t size)
470{
471 const char *proto_name;
472 size_t proto_size;
473 int error;
474
475 error = -ENODATA;
476 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
477 proto_name = dentry->d_name.name;
478 proto_size = strlen(proto_name);
479
480 if (value) {
481 error = -ERANGE;
482 if (proto_size + 1 > size)
483 goto out;
484
485 strncpy(value, proto_name, proto_size + 1);
486 }
487 error = proto_size + 1;
488 }
489
490out:
491 return error;
492}
493
494static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
495 size_t size)
496{
497 ssize_t len;
498 ssize_t used = 0;
499
c5ef6035 500 len = security_inode_listsecurity(d_inode(dentry), buffer, size);
600e1779
MY
501 if (len < 0)
502 return len;
503 used += len;
504 if (buffer) {
505 if (size < used)
506 return -ERANGE;
507 buffer += len;
508 }
509
510 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
511 used += len;
512 if (buffer) {
513 if (size < used)
514 return -ERANGE;
515 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
516 buffer += len;
517 }
518
519 return used;
520}
521
522static const struct inode_operations sockfs_inode_ops = {
523 .getxattr = sockfs_getxattr,
524 .listxattr = sockfs_listxattr,
525};
526
1da177e4
LT
527/**
528 * sock_alloc - allocate a socket
89bddce5 529 *
1da177e4
LT
530 * Allocate a new inode and socket object. The two are bound together
531 * and initialised. The socket is then returned. If we are out of inodes
532 * NULL is returned.
533 */
534
535static struct socket *sock_alloc(void)
536{
89bddce5
SH
537 struct inode *inode;
538 struct socket *sock;
1da177e4 539
a209dfc7 540 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
541 if (!inode)
542 return NULL;
543
544 sock = SOCKET_I(inode);
545
29a020d3 546 kmemcheck_annotate_bitfield(sock, type);
85fe4025 547 inode->i_ino = get_next_ino();
89bddce5 548 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
549 inode->i_uid = current_fsuid();
550 inode->i_gid = current_fsgid();
600e1779 551 inode->i_op = &sockfs_inode_ops;
1da177e4 552
19e8d69c 553 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
554 return sock;
555}
556
1da177e4
LT
557/**
558 * sock_release - close a socket
559 * @sock: socket to close
560 *
561 * The socket is released from the protocol stack if it has a release
562 * callback, and the inode is then released if the socket is bound to
89bddce5 563 * an inode not a file.
1da177e4 564 */
89bddce5 565
1da177e4
LT
566void sock_release(struct socket *sock)
567{
568 if (sock->ops) {
569 struct module *owner = sock->ops->owner;
570
571 sock->ops->release(sock);
572 sock->ops = NULL;
573 module_put(owner);
574 }
575
eaefd110 576 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
3410f22e 577 pr_err("%s: fasync list not empty!\n", __func__);
1da177e4 578
19e8d69c 579 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
580 if (!sock->file) {
581 iput(SOCK_INODE(sock));
582 return;
583 }
89bddce5 584 sock->file = NULL;
1da177e4 585}
c6d409cf 586EXPORT_SYMBOL(sock_release);
1da177e4 587
67cc0d40 588void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags)
20d49473 589{
140c55d4
ED
590 u8 flags = *tx_flags;
591
b9f40e21 592 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
140c55d4
ED
593 flags |= SKBTX_HW_TSTAMP;
594
b9f40e21 595 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
140c55d4
ED
596 flags |= SKBTX_SW_TSTAMP;
597
e7fd2885 598 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)
140c55d4
ED
599 flags |= SKBTX_SCHED_TSTAMP;
600
e1c8a607 601 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)
140c55d4 602 flags |= SKBTX_ACK_TSTAMP;
e7fd2885 603
140c55d4 604 *tx_flags = flags;
20d49473 605}
67cc0d40 606EXPORT_SYMBOL(__sock_tx_timestamp);
20d49473 607
d8725c86 608static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
1da177e4 609{
01e97e65 610 int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
d8725c86
AV
611 BUG_ON(ret == -EIOCBQUEUED);
612 return ret;
1da177e4
LT
613}
614
d8725c86 615int sock_sendmsg(struct socket *sock, struct msghdr *msg)
228e548e 616{
d8725c86 617 int err = security_socket_sendmsg(sock, msg,
01e97e65 618 msg_data_left(msg));
228e548e 619
d8725c86 620 return err ?: sock_sendmsg_nosec(sock, msg);
0cf00c6f 621}
c6d409cf 622EXPORT_SYMBOL(sock_sendmsg);
1da177e4
LT
623
624int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
625 struct kvec *vec, size_t num, size_t size)
626{
6aa24814 627 iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
d8725c86 628 return sock_sendmsg(sock, msg);
1da177e4 629}
c6d409cf 630EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 631
92f37fd2
ED
632/*
633 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
634 */
635void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
636 struct sk_buff *skb)
637{
20d49473 638 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
f24b9be5 639 struct scm_timestamping tss;
20d49473
PO
640 int empty = 1;
641 struct skb_shared_hwtstamps *shhwtstamps =
642 skb_hwtstamps(skb);
643
644 /* Race occurred between timestamp enabling and packet
645 receiving. Fill in the current time for now. */
646 if (need_software_tstamp && skb->tstamp.tv64 == 0)
647 __net_timestamp(skb);
648
649 if (need_software_tstamp) {
650 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
651 struct timeval tv;
652 skb_get_timestamp(skb, &tv);
653 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
654 sizeof(tv), &tv);
655 } else {
f24b9be5
WB
656 struct timespec ts;
657 skb_get_timestampns(skb, &ts);
20d49473 658 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
f24b9be5 659 sizeof(ts), &ts);
20d49473
PO
660 }
661 }
662
f24b9be5 663 memset(&tss, 0, sizeof(tss));
c199105d 664 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
f24b9be5 665 ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
20d49473 666 empty = 0;
4d276eb6 667 if (shhwtstamps &&
b9f40e21 668 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
f24b9be5 669 ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
4d276eb6 670 empty = 0;
20d49473
PO
671 if (!empty)
672 put_cmsg(msg, SOL_SOCKET,
f24b9be5 673 SCM_TIMESTAMPING, sizeof(tss), &tss);
92f37fd2 674}
7c81fd8b
ACM
675EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
676
6e3e939f
JB
677void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
678 struct sk_buff *skb)
679{
680 int ack;
681
682 if (!sock_flag(sk, SOCK_WIFI_STATUS))
683 return;
684 if (!skb->wifi_acked_valid)
685 return;
686
687 ack = skb->wifi_acked;
688
689 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
690}
691EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
692
11165f14 693static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
694 struct sk_buff *skb)
3b885787 695{
744d5a3e 696 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
3b885787 697 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
744d5a3e 698 sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
3b885787
NH
699}
700
767dd033 701void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
702 struct sk_buff *skb)
703{
704 sock_recv_timestamp(msg, sk, skb);
705 sock_recv_drops(msg, sk, skb);
706}
767dd033 707EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 708
1b784140
YX
709static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
710 size_t size, int flags)
1da177e4 711{
1b784140 712 return sock->ops->recvmsg(sock, msg, size, flags);
1da177e4
LT
713}
714
1b784140
YX
715int sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
716 int flags)
a2e27255
ACM
717{
718 int err = security_socket_recvmsg(sock, msg, size, flags);
719
1b784140 720 return err ?: sock_recvmsg_nosec(sock, msg, size, flags);
1da177e4 721}
c6d409cf 722EXPORT_SYMBOL(sock_recvmsg);
1da177e4 723
c1249c0a
ML
724/**
725 * kernel_recvmsg - Receive a message from a socket (kernel space)
726 * @sock: The socket to receive the message from
727 * @msg: Received message
728 * @vec: Input s/g array for message data
729 * @num: Size of input s/g array
730 * @size: Number of bytes to read
731 * @flags: Message flags (MSG_DONTWAIT, etc...)
732 *
733 * On return the msg structure contains the scatter/gather array passed in the
734 * vec argument. The array is modified so that it consists of the unfilled
735 * portion of the original array.
736 *
737 * The returned value is the total number of bytes received, or an error.
738 */
89bddce5
SH
739int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
740 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
741{
742 mm_segment_t oldfs = get_fs();
743 int result;
744
6aa24814 745 iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
1da177e4 746 set_fs(KERNEL_DS);
1da177e4
LT
747 result = sock_recvmsg(sock, msg, size, flags);
748 set_fs(oldfs);
749 return result;
750}
c6d409cf 751EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 752
ce1d4d3e
CH
753static ssize_t sock_sendpage(struct file *file, struct page *page,
754 int offset, size_t size, loff_t *ppos, int more)
1da177e4 755{
1da177e4
LT
756 struct socket *sock;
757 int flags;
758
ce1d4d3e
CH
759 sock = file->private_data;
760
35f9c09f
ED
761 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
762 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
763 flags |= more;
ce1d4d3e 764
e6949583 765 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 766}
1da177e4 767
9c55e01c 768static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 769 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
770 unsigned int flags)
771{
772 struct socket *sock = file->private_data;
773
997b37da
RDC
774 if (unlikely(!sock->ops->splice_read))
775 return -EINVAL;
776
9c55e01c
JA
777 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
778}
779
8ae5e030 780static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
ce1d4d3e 781{
6d652330
AV
782 struct file *file = iocb->ki_filp;
783 struct socket *sock = file->private_data;
0345f931 784 struct msghdr msg = {.msg_iter = *to,
785 .msg_iocb = iocb};
8ae5e030 786 ssize_t res;
ce1d4d3e 787
8ae5e030
AV
788 if (file->f_flags & O_NONBLOCK)
789 msg.msg_flags = MSG_DONTWAIT;
790
791 if (iocb->ki_pos != 0)
1da177e4 792 return -ESPIPE;
027445c3 793
66ee59af 794 if (!iov_iter_count(to)) /* Match SYS5 behaviour */
1da177e4
LT
795 return 0;
796
237dae88 797 res = sock_recvmsg(sock, &msg, iov_iter_count(to), msg.msg_flags);
8ae5e030
AV
798 *to = msg.msg_iter;
799 return res;
1da177e4
LT
800}
801
8ae5e030 802static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
ce1d4d3e 803{
6d652330
AV
804 struct file *file = iocb->ki_filp;
805 struct socket *sock = file->private_data;
0345f931 806 struct msghdr msg = {.msg_iter = *from,
807 .msg_iocb = iocb};
8ae5e030 808 ssize_t res;
1da177e4 809
8ae5e030 810 if (iocb->ki_pos != 0)
ce1d4d3e 811 return -ESPIPE;
027445c3 812
8ae5e030
AV
813 if (file->f_flags & O_NONBLOCK)
814 msg.msg_flags = MSG_DONTWAIT;
815
6d652330
AV
816 if (sock->type == SOCK_SEQPACKET)
817 msg.msg_flags |= MSG_EOR;
818
d8725c86 819 res = sock_sendmsg(sock, &msg);
8ae5e030
AV
820 *from = msg.msg_iter;
821 return res;
1da177e4
LT
822}
823
1da177e4
LT
824/*
825 * Atomic setting of ioctl hooks to avoid race
826 * with module unload.
827 */
828
4a3e2f71 829static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 830static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 831
881d966b 832void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 833{
4a3e2f71 834 mutex_lock(&br_ioctl_mutex);
1da177e4 835 br_ioctl_hook = hook;
4a3e2f71 836 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
837}
838EXPORT_SYMBOL(brioctl_set);
839
4a3e2f71 840static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 841static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 842
881d966b 843void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 844{
4a3e2f71 845 mutex_lock(&vlan_ioctl_mutex);
1da177e4 846 vlan_ioctl_hook = hook;
4a3e2f71 847 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
848}
849EXPORT_SYMBOL(vlan_ioctl_set);
850
4a3e2f71 851static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 852static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 853
89bddce5 854void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 855{
4a3e2f71 856 mutex_lock(&dlci_ioctl_mutex);
1da177e4 857 dlci_ioctl_hook = hook;
4a3e2f71 858 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
859}
860EXPORT_SYMBOL(dlci_ioctl_set);
861
6b96018b
AB
862static long sock_do_ioctl(struct net *net, struct socket *sock,
863 unsigned int cmd, unsigned long arg)
864{
865 int err;
866 void __user *argp = (void __user *)arg;
867
868 err = sock->ops->ioctl(sock, cmd, arg);
869
870 /*
871 * If this ioctl is unknown try to hand it down
872 * to the NIC driver.
873 */
874 if (err == -ENOIOCTLCMD)
875 err = dev_ioctl(net, cmd, argp);
876
877 return err;
878}
879
1da177e4
LT
880/*
881 * With an ioctl, arg may well be a user mode pointer, but we don't know
882 * what to do with it - that's up to the protocol still.
883 */
884
885static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
886{
887 struct socket *sock;
881d966b 888 struct sock *sk;
1da177e4
LT
889 void __user *argp = (void __user *)arg;
890 int pid, err;
881d966b 891 struct net *net;
1da177e4 892
b69aee04 893 sock = file->private_data;
881d966b 894 sk = sock->sk;
3b1e0a65 895 net = sock_net(sk);
1da177e4 896 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 897 err = dev_ioctl(net, cmd, argp);
1da177e4 898 } else
3d23e349 899#ifdef CONFIG_WEXT_CORE
1da177e4 900 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 901 err = dev_ioctl(net, cmd, argp);
1da177e4 902 } else
3d23e349 903#endif
89bddce5 904 switch (cmd) {
1da177e4
LT
905 case FIOSETOWN:
906 case SIOCSPGRP:
907 err = -EFAULT;
908 if (get_user(pid, (int __user *)argp))
909 break;
e0b93edd
JL
910 f_setown(sock->file, pid, 1);
911 err = 0;
1da177e4
LT
912 break;
913 case FIOGETOWN:
914 case SIOCGPGRP:
609d7fa9 915 err = put_user(f_getown(sock->file),
89bddce5 916 (int __user *)argp);
1da177e4
LT
917 break;
918 case SIOCGIFBR:
919 case SIOCSIFBR:
920 case SIOCBRADDBR:
921 case SIOCBRDELBR:
922 err = -ENOPKG;
923 if (!br_ioctl_hook)
924 request_module("bridge");
925
4a3e2f71 926 mutex_lock(&br_ioctl_mutex);
89bddce5 927 if (br_ioctl_hook)
881d966b 928 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 929 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
930 break;
931 case SIOCGIFVLAN:
932 case SIOCSIFVLAN:
933 err = -ENOPKG;
934 if (!vlan_ioctl_hook)
935 request_module("8021q");
936
4a3e2f71 937 mutex_lock(&vlan_ioctl_mutex);
1da177e4 938 if (vlan_ioctl_hook)
881d966b 939 err = vlan_ioctl_hook(net, argp);
4a3e2f71 940 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 941 break;
1da177e4
LT
942 case SIOCADDDLCI:
943 case SIOCDELDLCI:
944 err = -ENOPKG;
945 if (!dlci_ioctl_hook)
946 request_module("dlci");
947
7512cbf6
PE
948 mutex_lock(&dlci_ioctl_mutex);
949 if (dlci_ioctl_hook)
1da177e4 950 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 951 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
952 break;
953 default:
6b96018b 954 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 955 break;
89bddce5 956 }
1da177e4
LT
957 return err;
958}
959
960int sock_create_lite(int family, int type, int protocol, struct socket **res)
961{
962 int err;
963 struct socket *sock = NULL;
89bddce5 964
1da177e4
LT
965 err = security_socket_create(family, type, protocol, 1);
966 if (err)
967 goto out;
968
969 sock = sock_alloc();
970 if (!sock) {
971 err = -ENOMEM;
972 goto out;
973 }
974
1da177e4 975 sock->type = type;
7420ed23
VY
976 err = security_socket_post_create(sock, family, type, protocol, 1);
977 if (err)
978 goto out_release;
979
1da177e4
LT
980out:
981 *res = sock;
982 return err;
7420ed23
VY
983out_release:
984 sock_release(sock);
985 sock = NULL;
986 goto out;
1da177e4 987}
c6d409cf 988EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
989
990/* No kernel lock held - perfect */
89bddce5 991static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 992{
cbf55001 993 unsigned int busy_flag = 0;
1da177e4
LT
994 struct socket *sock;
995
996 /*
89bddce5 997 * We can't return errors to poll, so it's either yes or no.
1da177e4 998 */
b69aee04 999 sock = file->private_data;
2d48d67f 1000
cbf55001 1001 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1002 /* this socket can poll_ll so tell the system call */
cbf55001 1003 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1004
1005 /* once, only if requested by syscall */
cbf55001
ET
1006 if (wait && (wait->_key & POLL_BUSY_LOOP))
1007 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1008 }
1009
cbf55001 1010 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1011}
1012
89bddce5 1013static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1014{
b69aee04 1015 struct socket *sock = file->private_data;
1da177e4
LT
1016
1017 return sock->ops->mmap(file, sock, vma);
1018}
1019
20380731 1020static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1021{
1da177e4
LT
1022 sock_release(SOCKET_I(inode));
1023 return 0;
1024}
1025
1026/*
1027 * Update the socket async list
1028 *
1029 * Fasync_list locking strategy.
1030 *
1031 * 1. fasync_list is modified only under process context socket lock
1032 * i.e. under semaphore.
1033 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1034 * or under socket lock
1da177e4
LT
1035 */
1036
1037static int sock_fasync(int fd, struct file *filp, int on)
1038{
989a2979
ED
1039 struct socket *sock = filp->private_data;
1040 struct sock *sk = sock->sk;
eaefd110 1041 struct socket_wq *wq;
1da177e4 1042
989a2979 1043 if (sk == NULL)
1da177e4 1044 return -EINVAL;
1da177e4
LT
1045
1046 lock_sock(sk);
eaefd110
ED
1047 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1048 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1049
eaefd110 1050 if (!wq->fasync_list)
989a2979
ED
1051 sock_reset_flag(sk, SOCK_FASYNC);
1052 else
bcdce719 1053 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1054
989a2979 1055 release_sock(sk);
1da177e4
LT
1056 return 0;
1057}
1058
ceb5d58b 1059/* This function may be called only under rcu_lock */
1da177e4 1060
ceb5d58b 1061int sock_wake_async(struct socket_wq *wq, int how, int band)
1da177e4 1062{
ceb5d58b 1063 if (!wq || !wq->fasync_list)
1da177e4 1064 return -1;
ceb5d58b 1065
89bddce5 1066 switch (how) {
8d8ad9d7 1067 case SOCK_WAKE_WAITD:
ceb5d58b 1068 if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1da177e4
LT
1069 break;
1070 goto call_kill;
8d8ad9d7 1071 case SOCK_WAKE_SPACE:
ceb5d58b 1072 if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1da177e4
LT
1073 break;
1074 /* fall through */
8d8ad9d7 1075 case SOCK_WAKE_IO:
89bddce5 1076call_kill:
43815482 1077 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1078 break;
8d8ad9d7 1079 case SOCK_WAKE_URG:
43815482 1080 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1081 }
ceb5d58b 1082
1da177e4
LT
1083 return 0;
1084}
c6d409cf 1085EXPORT_SYMBOL(sock_wake_async);
1da177e4 1086
721db93a 1087int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1088 struct socket **res, int kern)
1da177e4
LT
1089{
1090 int err;
1091 struct socket *sock;
55737fda 1092 const struct net_proto_family *pf;
1da177e4
LT
1093
1094 /*
89bddce5 1095 * Check protocol is in range
1da177e4
LT
1096 */
1097 if (family < 0 || family >= NPROTO)
1098 return -EAFNOSUPPORT;
1099 if (type < 0 || type >= SOCK_MAX)
1100 return -EINVAL;
1101
1102 /* Compatibility.
1103
1104 This uglymoron is moved from INET layer to here to avoid
1105 deadlock in module load.
1106 */
1107 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1108 static int warned;
1da177e4
LT
1109 if (!warned) {
1110 warned = 1;
3410f22e
YY
1111 pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1112 current->comm);
1da177e4
LT
1113 }
1114 family = PF_PACKET;
1115 }
1116
1117 err = security_socket_create(family, type, protocol, kern);
1118 if (err)
1119 return err;
89bddce5 1120
55737fda
SH
1121 /*
1122 * Allocate the socket and allow the family to set things up. if
1123 * the protocol is 0, the family is instructed to select an appropriate
1124 * default.
1125 */
1126 sock = sock_alloc();
1127 if (!sock) {
e87cc472 1128 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1129 return -ENFILE; /* Not exactly a match, but its the
1130 closest posix thing */
1131 }
1132
1133 sock->type = type;
1134
95a5afca 1135#ifdef CONFIG_MODULES
89bddce5
SH
1136 /* Attempt to load a protocol module if the find failed.
1137 *
1138 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1139 * requested real, full-featured networking support upon configuration.
1140 * Otherwise module support will break!
1141 */
190683a9 1142 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1143 request_module("net-pf-%d", family);
1da177e4
LT
1144#endif
1145
55737fda
SH
1146 rcu_read_lock();
1147 pf = rcu_dereference(net_families[family]);
1148 err = -EAFNOSUPPORT;
1149 if (!pf)
1150 goto out_release;
1da177e4
LT
1151
1152 /*
1153 * We will call the ->create function, that possibly is in a loadable
1154 * module, so we have to bump that loadable module refcnt first.
1155 */
55737fda 1156 if (!try_module_get(pf->owner))
1da177e4
LT
1157 goto out_release;
1158
55737fda
SH
1159 /* Now protected by module ref count */
1160 rcu_read_unlock();
1161
3f378b68 1162 err = pf->create(net, sock, protocol, kern);
55737fda 1163 if (err < 0)
1da177e4 1164 goto out_module_put;
a79af59e 1165
1da177e4
LT
1166 /*
1167 * Now to bump the refcnt of the [loadable] module that owns this
1168 * socket at sock_release time we decrement its refcnt.
1169 */
55737fda
SH
1170 if (!try_module_get(sock->ops->owner))
1171 goto out_module_busy;
1172
1da177e4
LT
1173 /*
1174 * Now that we're done with the ->create function, the [loadable]
1175 * module can have its refcnt decremented
1176 */
55737fda 1177 module_put(pf->owner);
7420ed23
VY
1178 err = security_socket_post_create(sock, family, type, protocol, kern);
1179 if (err)
3b185525 1180 goto out_sock_release;
55737fda 1181 *res = sock;
1da177e4 1182
55737fda
SH
1183 return 0;
1184
1185out_module_busy:
1186 err = -EAFNOSUPPORT;
1da177e4 1187out_module_put:
55737fda
SH
1188 sock->ops = NULL;
1189 module_put(pf->owner);
1190out_sock_release:
1da177e4 1191 sock_release(sock);
55737fda
SH
1192 return err;
1193
1194out_release:
1195 rcu_read_unlock();
1196 goto out_sock_release;
1da177e4 1197}
721db93a 1198EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1199
1200int sock_create(int family, int type, int protocol, struct socket **res)
1201{
1b8d7ae4 1202 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1203}
c6d409cf 1204EXPORT_SYMBOL(sock_create);
1da177e4 1205
eeb1bd5c 1206int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1da177e4 1207{
eeb1bd5c 1208 return __sock_create(net, family, type, protocol, res, 1);
1da177e4 1209}
c6d409cf 1210EXPORT_SYMBOL(sock_create_kern);
1da177e4 1211
3e0fa65f 1212SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1213{
1214 int retval;
1215 struct socket *sock;
a677a039
UD
1216 int flags;
1217
e38b36f3
UD
1218 /* Check the SOCK_* constants for consistency. */
1219 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1220 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1221 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1222 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1223
a677a039 1224 flags = type & ~SOCK_TYPE_MASK;
77d27200 1225 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1226 return -EINVAL;
1227 type &= SOCK_TYPE_MASK;
1da177e4 1228
aaca0bdc
UD
1229 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1230 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1231
1da177e4
LT
1232 retval = sock_create(family, type, protocol, &sock);
1233 if (retval < 0)
1234 goto out;
1235
77d27200 1236 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1237 if (retval < 0)
1238 goto out_release;
1239
1240out:
1241 /* It may be already another descriptor 8) Not kernel problem. */
1242 return retval;
1243
1244out_release:
1245 sock_release(sock);
1246 return retval;
1247}
1248
1249/*
1250 * Create a pair of connected sockets.
1251 */
1252
3e0fa65f
HC
1253SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1254 int __user *, usockvec)
1da177e4
LT
1255{
1256 struct socket *sock1, *sock2;
1257 int fd1, fd2, err;
db349509 1258 struct file *newfile1, *newfile2;
a677a039
UD
1259 int flags;
1260
1261 flags = type & ~SOCK_TYPE_MASK;
77d27200 1262 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1263 return -EINVAL;
1264 type &= SOCK_TYPE_MASK;
1da177e4 1265
aaca0bdc
UD
1266 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1267 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1268
1da177e4
LT
1269 /*
1270 * Obtain the first socket and check if the underlying protocol
1271 * supports the socketpair call.
1272 */
1273
1274 err = sock_create(family, type, protocol, &sock1);
1275 if (err < 0)
1276 goto out;
1277
1278 err = sock_create(family, type, protocol, &sock2);
1279 if (err < 0)
1280 goto out_release_1;
1281
1282 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1283 if (err < 0)
1da177e4
LT
1284 goto out_release_both;
1285
28407630 1286 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1287 if (unlikely(fd1 < 0)) {
1288 err = fd1;
db349509 1289 goto out_release_both;
bf3c23d1 1290 }
d73aa286 1291
28407630 1292 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1293 if (unlikely(fd2 < 0)) {
1294 err = fd2;
d73aa286 1295 goto out_put_unused_1;
28407630
AV
1296 }
1297
aab174f0 1298 newfile1 = sock_alloc_file(sock1, flags, NULL);
b5ffe634 1299 if (IS_ERR(newfile1)) {
28407630 1300 err = PTR_ERR(newfile1);
d73aa286 1301 goto out_put_unused_both;
28407630
AV
1302 }
1303
aab174f0 1304 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1305 if (IS_ERR(newfile2)) {
1306 err = PTR_ERR(newfile2);
d73aa286 1307 goto out_fput_1;
db349509
AV
1308 }
1309
d73aa286
YD
1310 err = put_user(fd1, &usockvec[0]);
1311 if (err)
1312 goto out_fput_both;
1313
1314 err = put_user(fd2, &usockvec[1]);
1315 if (err)
1316 goto out_fput_both;
1317
157cf649 1318 audit_fd_pair(fd1, fd2);
d73aa286 1319
db349509
AV
1320 fd_install(fd1, newfile1);
1321 fd_install(fd2, newfile2);
1da177e4
LT
1322 /* fd1 and fd2 may be already another descriptors.
1323 * Not kernel problem.
1324 */
1325
d73aa286 1326 return 0;
1da177e4 1327
d73aa286
YD
1328out_fput_both:
1329 fput(newfile2);
1330 fput(newfile1);
1331 put_unused_fd(fd2);
1332 put_unused_fd(fd1);
1333 goto out;
1334
1335out_fput_1:
1336 fput(newfile1);
1337 put_unused_fd(fd2);
1338 put_unused_fd(fd1);
1339 sock_release(sock2);
1340 goto out;
1da177e4 1341
d73aa286
YD
1342out_put_unused_both:
1343 put_unused_fd(fd2);
1344out_put_unused_1:
1345 put_unused_fd(fd1);
1da177e4 1346out_release_both:
89bddce5 1347 sock_release(sock2);
1da177e4 1348out_release_1:
89bddce5 1349 sock_release(sock1);
1da177e4
LT
1350out:
1351 return err;
1352}
1353
1da177e4
LT
1354/*
1355 * Bind a name to a socket. Nothing much to do here since it's
1356 * the protocol's responsibility to handle the local address.
1357 *
1358 * We move the socket address to kernel space before we call
1359 * the protocol layer (having also checked the address is ok).
1360 */
1361
20f37034 1362SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1363{
1364 struct socket *sock;
230b1839 1365 struct sockaddr_storage address;
6cb153ca 1366 int err, fput_needed;
1da177e4 1367
89bddce5 1368 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1369 if (sock) {
43db362d 1370 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1371 if (err >= 0) {
1372 err = security_socket_bind(sock,
230b1839 1373 (struct sockaddr *)&address,
89bddce5 1374 addrlen);
6cb153ca
BL
1375 if (!err)
1376 err = sock->ops->bind(sock,
89bddce5 1377 (struct sockaddr *)
230b1839 1378 &address, addrlen);
1da177e4 1379 }
6cb153ca 1380 fput_light(sock->file, fput_needed);
89bddce5 1381 }
1da177e4
LT
1382 return err;
1383}
1384
1da177e4
LT
1385/*
1386 * Perform a listen. Basically, we allow the protocol to do anything
1387 * necessary for a listen, and if that works, we mark the socket as
1388 * ready for listening.
1389 */
1390
3e0fa65f 1391SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1392{
1393 struct socket *sock;
6cb153ca 1394 int err, fput_needed;
b8e1f9b5 1395 int somaxconn;
89bddce5
SH
1396
1397 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1398 if (sock) {
8efa6e93 1399 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1400 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1401 backlog = somaxconn;
1da177e4
LT
1402
1403 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1404 if (!err)
1405 err = sock->ops->listen(sock, backlog);
1da177e4 1406
6cb153ca 1407 fput_light(sock->file, fput_needed);
1da177e4
LT
1408 }
1409 return err;
1410}
1411
1da177e4
LT
1412/*
1413 * For accept, we attempt to create a new socket, set up the link
1414 * with the client, wake up the client, then return the new
1415 * connected fd. We collect the address of the connector in kernel
1416 * space and move it to user at the very end. This is unclean because
1417 * we open the socket then return an error.
1418 *
1419 * 1003.1g adds the ability to recvmsg() to query connection pending
1420 * status to recvmsg. We need to add that support in a way thats
1421 * clean when we restucture accept also.
1422 */
1423
20f37034
HC
1424SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1425 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1426{
1427 struct socket *sock, *newsock;
39d8c1b6 1428 struct file *newfile;
6cb153ca 1429 int err, len, newfd, fput_needed;
230b1839 1430 struct sockaddr_storage address;
1da177e4 1431
77d27200 1432 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1433 return -EINVAL;
1434
1435 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1436 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1437
6cb153ca 1438 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1439 if (!sock)
1440 goto out;
1441
1442 err = -ENFILE;
c6d409cf
ED
1443 newsock = sock_alloc();
1444 if (!newsock)
1da177e4
LT
1445 goto out_put;
1446
1447 newsock->type = sock->type;
1448 newsock->ops = sock->ops;
1449
1da177e4
LT
1450 /*
1451 * We don't need try_module_get here, as the listening socket (sock)
1452 * has the protocol module (sock->ops->owner) held.
1453 */
1454 __module_get(newsock->ops->owner);
1455
28407630 1456 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1457 if (unlikely(newfd < 0)) {
1458 err = newfd;
9a1875e6
DM
1459 sock_release(newsock);
1460 goto out_put;
39d8c1b6 1461 }
aab174f0 1462 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
b5ffe634 1463 if (IS_ERR(newfile)) {
28407630
AV
1464 err = PTR_ERR(newfile);
1465 put_unused_fd(newfd);
1466 sock_release(newsock);
1467 goto out_put;
1468 }
39d8c1b6 1469
a79af59e
FF
1470 err = security_socket_accept(sock, newsock);
1471 if (err)
39d8c1b6 1472 goto out_fd;
a79af59e 1473
1da177e4
LT
1474 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1475 if (err < 0)
39d8c1b6 1476 goto out_fd;
1da177e4
LT
1477
1478 if (upeer_sockaddr) {
230b1839 1479 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1480 &len, 2) < 0) {
1da177e4 1481 err = -ECONNABORTED;
39d8c1b6 1482 goto out_fd;
1da177e4 1483 }
43db362d 1484 err = move_addr_to_user(&address,
230b1839 1485 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1486 if (err < 0)
39d8c1b6 1487 goto out_fd;
1da177e4
LT
1488 }
1489
1490 /* File flags are not inherited via accept() unlike another OSes. */
1491
39d8c1b6
DM
1492 fd_install(newfd, newfile);
1493 err = newfd;
1da177e4 1494
1da177e4 1495out_put:
6cb153ca 1496 fput_light(sock->file, fput_needed);
1da177e4
LT
1497out:
1498 return err;
39d8c1b6 1499out_fd:
9606a216 1500 fput(newfile);
39d8c1b6 1501 put_unused_fd(newfd);
1da177e4
LT
1502 goto out_put;
1503}
1504
20f37034
HC
1505SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1506 int __user *, upeer_addrlen)
aaca0bdc 1507{
de11defe 1508 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1509}
1510
1da177e4
LT
1511/*
1512 * Attempt to connect to a socket with the server address. The address
1513 * is in user space so we verify it is OK and move it to kernel space.
1514 *
1515 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1516 * break bindings
1517 *
1518 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1519 * other SEQPACKET protocols that take time to connect() as it doesn't
1520 * include the -EINPROGRESS status for such sockets.
1521 */
1522
20f37034
HC
1523SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1524 int, addrlen)
1da177e4
LT
1525{
1526 struct socket *sock;
230b1839 1527 struct sockaddr_storage address;
6cb153ca 1528 int err, fput_needed;
1da177e4 1529
6cb153ca 1530 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1531 if (!sock)
1532 goto out;
43db362d 1533 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1534 if (err < 0)
1535 goto out_put;
1536
89bddce5 1537 err =
230b1839 1538 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1539 if (err)
1540 goto out_put;
1541
230b1839 1542 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1543 sock->file->f_flags);
1544out_put:
6cb153ca 1545 fput_light(sock->file, fput_needed);
1da177e4
LT
1546out:
1547 return err;
1548}
1549
1550/*
1551 * Get the local address ('name') of a socket object. Move the obtained
1552 * name to user space.
1553 */
1554
20f37034
HC
1555SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1556 int __user *, usockaddr_len)
1da177e4
LT
1557{
1558 struct socket *sock;
230b1839 1559 struct sockaddr_storage address;
6cb153ca 1560 int len, err, fput_needed;
89bddce5 1561
6cb153ca 1562 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1563 if (!sock)
1564 goto out;
1565
1566 err = security_socket_getsockname(sock);
1567 if (err)
1568 goto out_put;
1569
230b1839 1570 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1571 if (err)
1572 goto out_put;
43db362d 1573 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1574
1575out_put:
6cb153ca 1576 fput_light(sock->file, fput_needed);
1da177e4
LT
1577out:
1578 return err;
1579}
1580
1581/*
1582 * Get the remote address ('name') of a socket object. Move the obtained
1583 * name to user space.
1584 */
1585
20f37034
HC
1586SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1587 int __user *, usockaddr_len)
1da177e4
LT
1588{
1589 struct socket *sock;
230b1839 1590 struct sockaddr_storage address;
6cb153ca 1591 int len, err, fput_needed;
1da177e4 1592
89bddce5
SH
1593 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1594 if (sock != NULL) {
1da177e4
LT
1595 err = security_socket_getpeername(sock);
1596 if (err) {
6cb153ca 1597 fput_light(sock->file, fput_needed);
1da177e4
LT
1598 return err;
1599 }
1600
89bddce5 1601 err =
230b1839 1602 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1603 1);
1da177e4 1604 if (!err)
43db362d 1605 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1606 usockaddr_len);
6cb153ca 1607 fput_light(sock->file, fput_needed);
1da177e4
LT
1608 }
1609 return err;
1610}
1611
1612/*
1613 * Send a datagram to a given address. We move the address into kernel
1614 * space and check the user space data area is readable before invoking
1615 * the protocol.
1616 */
1617
3e0fa65f 1618SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1619 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1620 int, addr_len)
1da177e4
LT
1621{
1622 struct socket *sock;
230b1839 1623 struct sockaddr_storage address;
1da177e4
LT
1624 int err;
1625 struct msghdr msg;
1626 struct iovec iov;
6cb153ca 1627 int fput_needed;
6cb153ca 1628
602bd0e9
AV
1629 err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1630 if (unlikely(err))
1631 return err;
de0fa95c
PE
1632 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1633 if (!sock)
4387ff75 1634 goto out;
6cb153ca 1635
89bddce5 1636 msg.msg_name = NULL;
89bddce5
SH
1637 msg.msg_control = NULL;
1638 msg.msg_controllen = 0;
1639 msg.msg_namelen = 0;
6cb153ca 1640 if (addr) {
43db362d 1641 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1642 if (err < 0)
1643 goto out_put;
230b1839 1644 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1645 msg.msg_namelen = addr_len;
1da177e4
LT
1646 }
1647 if (sock->file->f_flags & O_NONBLOCK)
1648 flags |= MSG_DONTWAIT;
1649 msg.msg_flags = flags;
d8725c86 1650 err = sock_sendmsg(sock, &msg);
1da177e4 1651
89bddce5 1652out_put:
de0fa95c 1653 fput_light(sock->file, fput_needed);
4387ff75 1654out:
1da177e4
LT
1655 return err;
1656}
1657
1658/*
89bddce5 1659 * Send a datagram down a socket.
1da177e4
LT
1660 */
1661
3e0fa65f 1662SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1663 unsigned int, flags)
1da177e4
LT
1664{
1665 return sys_sendto(fd, buff, len, flags, NULL, 0);
1666}
1667
1668/*
89bddce5 1669 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1670 * sender. We verify the buffers are writable and if needed move the
1671 * sender address from kernel to user space.
1672 */
1673
3e0fa65f 1674SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1675 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1676 int __user *, addr_len)
1da177e4
LT
1677{
1678 struct socket *sock;
1679 struct iovec iov;
1680 struct msghdr msg;
230b1839 1681 struct sockaddr_storage address;
89bddce5 1682 int err, err2;
6cb153ca
BL
1683 int fput_needed;
1684
602bd0e9
AV
1685 err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1686 if (unlikely(err))
1687 return err;
de0fa95c 1688 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1689 if (!sock)
de0fa95c 1690 goto out;
1da177e4 1691
89bddce5
SH
1692 msg.msg_control = NULL;
1693 msg.msg_controllen = 0;
f3d33426
HFS
1694 /* Save some cycles and don't copy the address if not needed */
1695 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1696 /* We assume all kernel code knows the size of sockaddr_storage */
1697 msg.msg_namelen = 0;
130ed5d1 1698 msg.msg_iocb = NULL;
1da177e4
LT
1699 if (sock->file->f_flags & O_NONBLOCK)
1700 flags |= MSG_DONTWAIT;
602bd0e9 1701 err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
1da177e4 1702
89bddce5 1703 if (err >= 0 && addr != NULL) {
43db362d 1704 err2 = move_addr_to_user(&address,
230b1839 1705 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1706 if (err2 < 0)
1707 err = err2;
1da177e4 1708 }
de0fa95c
PE
1709
1710 fput_light(sock->file, fput_needed);
4387ff75 1711out:
1da177e4
LT
1712 return err;
1713}
1714
1715/*
89bddce5 1716 * Receive a datagram from a socket.
1da177e4
LT
1717 */
1718
b7c0ddf5
JG
1719SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1720 unsigned int, flags)
1da177e4
LT
1721{
1722 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1723}
1724
1725/*
1726 * Set a socket option. Because we don't know the option lengths we have
1727 * to pass the user mode parameter for the protocols to sort out.
1728 */
1729
20f37034
HC
1730SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1731 char __user *, optval, int, optlen)
1da177e4 1732{
6cb153ca 1733 int err, fput_needed;
1da177e4
LT
1734 struct socket *sock;
1735
1736 if (optlen < 0)
1737 return -EINVAL;
89bddce5
SH
1738
1739 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1740 if (sock != NULL) {
1741 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1742 if (err)
1743 goto out_put;
1da177e4
LT
1744
1745 if (level == SOL_SOCKET)
89bddce5
SH
1746 err =
1747 sock_setsockopt(sock, level, optname, optval,
1748 optlen);
1da177e4 1749 else
89bddce5
SH
1750 err =
1751 sock->ops->setsockopt(sock, level, optname, optval,
1752 optlen);
6cb153ca
BL
1753out_put:
1754 fput_light(sock->file, fput_needed);
1da177e4
LT
1755 }
1756 return err;
1757}
1758
1759/*
1760 * Get a socket option. Because we don't know the option lengths we have
1761 * to pass a user mode parameter for the protocols to sort out.
1762 */
1763
20f37034
HC
1764SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1765 char __user *, optval, int __user *, optlen)
1da177e4 1766{
6cb153ca 1767 int err, fput_needed;
1da177e4
LT
1768 struct socket *sock;
1769
89bddce5
SH
1770 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1771 if (sock != NULL) {
6cb153ca
BL
1772 err = security_socket_getsockopt(sock, level, optname);
1773 if (err)
1774 goto out_put;
1da177e4
LT
1775
1776 if (level == SOL_SOCKET)
89bddce5
SH
1777 err =
1778 sock_getsockopt(sock, level, optname, optval,
1779 optlen);
1da177e4 1780 else
89bddce5
SH
1781 err =
1782 sock->ops->getsockopt(sock, level, optname, optval,
1783 optlen);
6cb153ca
BL
1784out_put:
1785 fput_light(sock->file, fput_needed);
1da177e4
LT
1786 }
1787 return err;
1788}
1789
1da177e4
LT
1790/*
1791 * Shutdown a socket.
1792 */
1793
754fe8d2 1794SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1795{
6cb153ca 1796 int err, fput_needed;
1da177e4
LT
1797 struct socket *sock;
1798
89bddce5
SH
1799 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1800 if (sock != NULL) {
1da177e4 1801 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1802 if (!err)
1803 err = sock->ops->shutdown(sock, how);
1804 fput_light(sock->file, fput_needed);
1da177e4
LT
1805 }
1806 return err;
1807}
1808
89bddce5 1809/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1810 * fields which are the same type (int / unsigned) on our platforms.
1811 */
1812#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1813#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1814#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1815
c71d8ebe
TH
1816struct used_address {
1817 struct sockaddr_storage name;
1818 unsigned int name_len;
1819};
1820
da184284
AV
1821static int copy_msghdr_from_user(struct msghdr *kmsg,
1822 struct user_msghdr __user *umsg,
1823 struct sockaddr __user **save_addr,
1824 struct iovec **iov)
1661bf36 1825{
08adb7da
AV
1826 struct sockaddr __user *uaddr;
1827 struct iovec __user *uiov;
c0371da6 1828 size_t nr_segs;
08adb7da
AV
1829 ssize_t err;
1830
1831 if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1832 __get_user(uaddr, &umsg->msg_name) ||
1833 __get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1834 __get_user(uiov, &umsg->msg_iov) ||
c0371da6 1835 __get_user(nr_segs, &umsg->msg_iovlen) ||
08adb7da
AV
1836 __get_user(kmsg->msg_control, &umsg->msg_control) ||
1837 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1838 __get_user(kmsg->msg_flags, &umsg->msg_flags))
1661bf36 1839 return -EFAULT;
dbb490b9 1840
08adb7da 1841 if (!uaddr)
6a2a2b3a
AS
1842 kmsg->msg_namelen = 0;
1843
dbb490b9
ML
1844 if (kmsg->msg_namelen < 0)
1845 return -EINVAL;
1846
1661bf36 1847 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
db31c55a 1848 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
08adb7da
AV
1849
1850 if (save_addr)
1851 *save_addr = uaddr;
1852
1853 if (uaddr && kmsg->msg_namelen) {
1854 if (!save_addr) {
1855 err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1856 kmsg->msg_name);
1857 if (err < 0)
1858 return err;
1859 }
1860 } else {
1861 kmsg->msg_name = NULL;
1862 kmsg->msg_namelen = 0;
1863 }
1864
c0371da6 1865 if (nr_segs > UIO_MAXIOV)
08adb7da
AV
1866 return -EMSGSIZE;
1867
0345f931 1868 kmsg->msg_iocb = NULL;
1869
da184284
AV
1870 return import_iovec(save_addr ? READ : WRITE, uiov, nr_segs,
1871 UIO_FASTIOV, iov, &kmsg->msg_iter);
1661bf36
DC
1872}
1873
666547ff 1874static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 1875 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1876 struct used_address *used_address)
1da177e4 1877{
89bddce5
SH
1878 struct compat_msghdr __user *msg_compat =
1879 (struct compat_msghdr __user *)msg;
230b1839 1880 struct sockaddr_storage address;
1da177e4 1881 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1882 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1883 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1884 /* 20 is size of ipv6_pktinfo */
1da177e4 1885 unsigned char *ctl_buf = ctl;
d8725c86 1886 int ctl_len;
08adb7da 1887 ssize_t err;
89bddce5 1888
08adb7da 1889 msg_sys->msg_name = &address;
1da177e4 1890
08449320 1891 if (MSG_CMSG_COMPAT & flags)
08adb7da 1892 err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
08449320 1893 else
08adb7da 1894 err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
89bddce5 1895 if (err < 0)
da184284 1896 return err;
1da177e4
LT
1897
1898 err = -ENOBUFS;
1899
228e548e 1900 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 1901 goto out_freeiov;
228e548e 1902 ctl_len = msg_sys->msg_controllen;
1da177e4 1903 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 1904 err =
228e548e 1905 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 1906 sizeof(ctl));
1da177e4
LT
1907 if (err)
1908 goto out_freeiov;
228e548e
AB
1909 ctl_buf = msg_sys->msg_control;
1910 ctl_len = msg_sys->msg_controllen;
1da177e4 1911 } else if (ctl_len) {
89bddce5 1912 if (ctl_len > sizeof(ctl)) {
1da177e4 1913 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 1914 if (ctl_buf == NULL)
1da177e4
LT
1915 goto out_freeiov;
1916 }
1917 err = -EFAULT;
1918 /*
228e548e 1919 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
1920 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1921 * checking falls down on this.
1922 */
fb8621bb 1923 if (copy_from_user(ctl_buf,
228e548e 1924 (void __user __force *)msg_sys->msg_control,
89bddce5 1925 ctl_len))
1da177e4 1926 goto out_freectl;
228e548e 1927 msg_sys->msg_control = ctl_buf;
1da177e4 1928 }
228e548e 1929 msg_sys->msg_flags = flags;
1da177e4
LT
1930
1931 if (sock->file->f_flags & O_NONBLOCK)
228e548e 1932 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
1933 /*
1934 * If this is sendmmsg() and current destination address is same as
1935 * previously succeeded address, omit asking LSM's decision.
1936 * used_address->name_len is initialized to UINT_MAX so that the first
1937 * destination address never matches.
1938 */
bc909d9d
MD
1939 if (used_address && msg_sys->msg_name &&
1940 used_address->name_len == msg_sys->msg_namelen &&
1941 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe 1942 used_address->name_len)) {
d8725c86 1943 err = sock_sendmsg_nosec(sock, msg_sys);
c71d8ebe
TH
1944 goto out_freectl;
1945 }
d8725c86 1946 err = sock_sendmsg(sock, msg_sys);
c71d8ebe
TH
1947 /*
1948 * If this is sendmmsg() and sending to current destination address was
1949 * successful, remember it.
1950 */
1951 if (used_address && err >= 0) {
1952 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
1953 if (msg_sys->msg_name)
1954 memcpy(&used_address->name, msg_sys->msg_name,
1955 used_address->name_len);
c71d8ebe 1956 }
1da177e4
LT
1957
1958out_freectl:
89bddce5 1959 if (ctl_buf != ctl)
1da177e4
LT
1960 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1961out_freeiov:
da184284 1962 kfree(iov);
228e548e
AB
1963 return err;
1964}
1965
1966/*
1967 * BSD sendmsg interface
1968 */
1969
666547ff 1970long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
228e548e
AB
1971{
1972 int fput_needed, err;
1973 struct msghdr msg_sys;
1be374a0
AL
1974 struct socket *sock;
1975
1be374a0 1976 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
1977 if (!sock)
1978 goto out;
1979
a7526eb5 1980 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 1981
6cb153ca 1982 fput_light(sock->file, fput_needed);
89bddce5 1983out:
1da177e4
LT
1984 return err;
1985}
1986
666547ff 1987SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
a7526eb5
AL
1988{
1989 if (flags & MSG_CMSG_COMPAT)
1990 return -EINVAL;
1991 return __sys_sendmsg(fd, msg, flags);
1992}
1993
228e548e
AB
1994/*
1995 * Linux sendmmsg interface
1996 */
1997
1998int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
1999 unsigned int flags)
2000{
2001 int fput_needed, err, datagrams;
2002 struct socket *sock;
2003 struct mmsghdr __user *entry;
2004 struct compat_mmsghdr __user *compat_entry;
2005 struct msghdr msg_sys;
c71d8ebe 2006 struct used_address used_address;
228e548e 2007
98382f41
AB
2008 if (vlen > UIO_MAXIOV)
2009 vlen = UIO_MAXIOV;
228e548e
AB
2010
2011 datagrams = 0;
2012
2013 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2014 if (!sock)
2015 return err;
2016
c71d8ebe 2017 used_address.name_len = UINT_MAX;
228e548e
AB
2018 entry = mmsg;
2019 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2020 err = 0;
228e548e
AB
2021
2022 while (datagrams < vlen) {
228e548e 2023 if (MSG_CMSG_COMPAT & flags) {
666547ff 2024 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5 2025 &msg_sys, flags, &used_address);
228e548e
AB
2026 if (err < 0)
2027 break;
2028 err = __put_user(err, &compat_entry->msg_len);
2029 ++compat_entry;
2030 } else {
a7526eb5 2031 err = ___sys_sendmsg(sock,
666547ff 2032 (struct user_msghdr __user *)entry,
a7526eb5 2033 &msg_sys, flags, &used_address);
228e548e
AB
2034 if (err < 0)
2035 break;
2036 err = put_user(err, &entry->msg_len);
2037 ++entry;
2038 }
2039
2040 if (err)
2041 break;
2042 ++datagrams;
2043 }
2044
228e548e
AB
2045 fput_light(sock->file, fput_needed);
2046
728ffb86
AB
2047 /* We only return an error if no datagrams were able to be sent */
2048 if (datagrams != 0)
228e548e
AB
2049 return datagrams;
2050
228e548e
AB
2051 return err;
2052}
2053
2054SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2055 unsigned int, vlen, unsigned int, flags)
2056{
1be374a0
AL
2057 if (flags & MSG_CMSG_COMPAT)
2058 return -EINVAL;
228e548e
AB
2059 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2060}
2061
666547ff 2062static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2063 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2064{
89bddce5
SH
2065 struct compat_msghdr __user *msg_compat =
2066 (struct compat_msghdr __user *)msg;
1da177e4 2067 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2068 struct iovec *iov = iovstack;
1da177e4 2069 unsigned long cmsg_ptr;
08adb7da
AV
2070 int total_len, len;
2071 ssize_t err;
1da177e4
LT
2072
2073 /* kernel mode address */
230b1839 2074 struct sockaddr_storage addr;
1da177e4
LT
2075
2076 /* user mode address pointers */
2077 struct sockaddr __user *uaddr;
08adb7da 2078 int __user *uaddr_len = COMPAT_NAMELEN(msg);
89bddce5 2079
08adb7da 2080 msg_sys->msg_name = &addr;
1da177e4 2081
f3d33426 2082 if (MSG_CMSG_COMPAT & flags)
08adb7da 2083 err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
f3d33426 2084 else
08adb7da 2085 err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
1da177e4 2086 if (err < 0)
da184284
AV
2087 return err;
2088 total_len = iov_iter_count(&msg_sys->msg_iter);
1da177e4 2089
a2e27255
ACM
2090 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2091 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2092
f3d33426
HFS
2093 /* We assume all kernel code knows the size of sockaddr_storage */
2094 msg_sys->msg_namelen = 0;
2095
1da177e4
LT
2096 if (sock->file->f_flags & O_NONBLOCK)
2097 flags |= MSG_DONTWAIT;
a2e27255
ACM
2098 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2099 total_len, flags);
1da177e4
LT
2100 if (err < 0)
2101 goto out_freeiov;
2102 len = err;
2103
2104 if (uaddr != NULL) {
43db362d 2105 err = move_addr_to_user(&addr,
a2e27255 2106 msg_sys->msg_namelen, uaddr,
89bddce5 2107 uaddr_len);
1da177e4
LT
2108 if (err < 0)
2109 goto out_freeiov;
2110 }
a2e27255 2111 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2112 COMPAT_FLAGS(msg));
1da177e4
LT
2113 if (err)
2114 goto out_freeiov;
2115 if (MSG_CMSG_COMPAT & flags)
a2e27255 2116 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2117 &msg_compat->msg_controllen);
2118 else
a2e27255 2119 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2120 &msg->msg_controllen);
2121 if (err)
2122 goto out_freeiov;
2123 err = len;
2124
2125out_freeiov:
da184284 2126 kfree(iov);
a2e27255
ACM
2127 return err;
2128}
2129
2130/*
2131 * BSD recvmsg interface
2132 */
2133
666547ff 2134long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
a2e27255
ACM
2135{
2136 int fput_needed, err;
2137 struct msghdr msg_sys;
1be374a0
AL
2138 struct socket *sock;
2139
1be374a0 2140 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2141 if (!sock)
2142 goto out;
2143
a7526eb5 2144 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2145
6cb153ca 2146 fput_light(sock->file, fput_needed);
1da177e4
LT
2147out:
2148 return err;
2149}
2150
666547ff 2151SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
a7526eb5
AL
2152 unsigned int, flags)
2153{
2154 if (flags & MSG_CMSG_COMPAT)
2155 return -EINVAL;
2156 return __sys_recvmsg(fd, msg, flags);
2157}
2158
a2e27255
ACM
2159/*
2160 * Linux recvmmsg interface
2161 */
2162
2163int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2164 unsigned int flags, struct timespec *timeout)
2165{
2166 int fput_needed, err, datagrams;
2167 struct socket *sock;
2168 struct mmsghdr __user *entry;
d7256d0e 2169 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2170 struct msghdr msg_sys;
2171 struct timespec end_time;
2172
2173 if (timeout &&
2174 poll_select_set_timeout(&end_time, timeout->tv_sec,
2175 timeout->tv_nsec))
2176 return -EINVAL;
2177
2178 datagrams = 0;
2179
2180 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2181 if (!sock)
2182 return err;
2183
2184 err = sock_error(sock->sk);
2185 if (err)
2186 goto out_put;
2187
2188 entry = mmsg;
d7256d0e 2189 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2190
2191 while (datagrams < vlen) {
2192 /*
2193 * No need to ask LSM for more than the first datagram.
2194 */
d7256d0e 2195 if (MSG_CMSG_COMPAT & flags) {
666547ff 2196 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5
AL
2197 &msg_sys, flags & ~MSG_WAITFORONE,
2198 datagrams);
d7256d0e
JMG
2199 if (err < 0)
2200 break;
2201 err = __put_user(err, &compat_entry->msg_len);
2202 ++compat_entry;
2203 } else {
a7526eb5 2204 err = ___sys_recvmsg(sock,
666547ff 2205 (struct user_msghdr __user *)entry,
a7526eb5
AL
2206 &msg_sys, flags & ~MSG_WAITFORONE,
2207 datagrams);
d7256d0e
JMG
2208 if (err < 0)
2209 break;
2210 err = put_user(err, &entry->msg_len);
2211 ++entry;
2212 }
2213
a2e27255
ACM
2214 if (err)
2215 break;
a2e27255
ACM
2216 ++datagrams;
2217
71c5c159
BB
2218 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2219 if (flags & MSG_WAITFORONE)
2220 flags |= MSG_DONTWAIT;
2221
a2e27255
ACM
2222 if (timeout) {
2223 ktime_get_ts(timeout);
2224 *timeout = timespec_sub(end_time, *timeout);
2225 if (timeout->tv_sec < 0) {
2226 timeout->tv_sec = timeout->tv_nsec = 0;
2227 break;
2228 }
2229
2230 /* Timeout, return less than vlen datagrams */
2231 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2232 break;
2233 }
2234
2235 /* Out of band data, return right away */
2236 if (msg_sys.msg_flags & MSG_OOB)
2237 break;
2238 }
2239
2240out_put:
2241 fput_light(sock->file, fput_needed);
1da177e4 2242
a2e27255
ACM
2243 if (err == 0)
2244 return datagrams;
2245
2246 if (datagrams != 0) {
2247 /*
2248 * We may return less entries than requested (vlen) if the
2249 * sock is non block and there aren't enough datagrams...
2250 */
2251 if (err != -EAGAIN) {
2252 /*
2253 * ... or if recvmsg returns an error after we
2254 * received some datagrams, where we record the
2255 * error to return on the next call or if the
2256 * app asks about it using getsockopt(SO_ERROR).
2257 */
2258 sock->sk->sk_err = -err;
2259 }
2260
2261 return datagrams;
2262 }
2263
2264 return err;
2265}
2266
2267SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2268 unsigned int, vlen, unsigned int, flags,
2269 struct timespec __user *, timeout)
2270{
2271 int datagrams;
2272 struct timespec timeout_sys;
2273
1be374a0
AL
2274 if (flags & MSG_CMSG_COMPAT)
2275 return -EINVAL;
2276
a2e27255
ACM
2277 if (!timeout)
2278 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2279
2280 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2281 return -EFAULT;
2282
2283 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2284
2285 if (datagrams > 0 &&
2286 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2287 datagrams = -EFAULT;
2288
2289 return datagrams;
2290}
2291
2292#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2293/* Argument list sizes for sys_socketcall */
2294#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2295static const unsigned char nargs[21] = {
c6d409cf
ED
2296 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2297 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2298 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2299 AL(4), AL(5), AL(4)
89bddce5
SH
2300};
2301
1da177e4
LT
2302#undef AL
2303
2304/*
89bddce5 2305 * System call vectors.
1da177e4
LT
2306 *
2307 * Argument checking cleaned up. Saved 20% in size.
2308 * This function doesn't need to set the kernel lock because
89bddce5 2309 * it is set by the callees.
1da177e4
LT
2310 */
2311
3e0fa65f 2312SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2313{
2950fa9d 2314 unsigned long a[AUDITSC_ARGS];
89bddce5 2315 unsigned long a0, a1;
1da177e4 2316 int err;
47379052 2317 unsigned int len;
1da177e4 2318
228e548e 2319 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2320 return -EINVAL;
2321
47379052
AV
2322 len = nargs[call];
2323 if (len > sizeof(a))
2324 return -EINVAL;
2325
1da177e4 2326 /* copy_from_user should be SMP safe. */
47379052 2327 if (copy_from_user(a, args, len))
1da177e4 2328 return -EFAULT;
3ec3b2fb 2329
2950fa9d
CG
2330 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2331 if (err)
2332 return err;
3ec3b2fb 2333
89bddce5
SH
2334 a0 = a[0];
2335 a1 = a[1];
2336
2337 switch (call) {
2338 case SYS_SOCKET:
2339 err = sys_socket(a0, a1, a[2]);
2340 break;
2341 case SYS_BIND:
2342 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2343 break;
2344 case SYS_CONNECT:
2345 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2346 break;
2347 case SYS_LISTEN:
2348 err = sys_listen(a0, a1);
2349 break;
2350 case SYS_ACCEPT:
de11defe
UD
2351 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2352 (int __user *)a[2], 0);
89bddce5
SH
2353 break;
2354 case SYS_GETSOCKNAME:
2355 err =
2356 sys_getsockname(a0, (struct sockaddr __user *)a1,
2357 (int __user *)a[2]);
2358 break;
2359 case SYS_GETPEERNAME:
2360 err =
2361 sys_getpeername(a0, (struct sockaddr __user *)a1,
2362 (int __user *)a[2]);
2363 break;
2364 case SYS_SOCKETPAIR:
2365 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2366 break;
2367 case SYS_SEND:
2368 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2369 break;
2370 case SYS_SENDTO:
2371 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2372 (struct sockaddr __user *)a[4], a[5]);
2373 break;
2374 case SYS_RECV:
2375 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2376 break;
2377 case SYS_RECVFROM:
2378 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2379 (struct sockaddr __user *)a[4],
2380 (int __user *)a[5]);
2381 break;
2382 case SYS_SHUTDOWN:
2383 err = sys_shutdown(a0, a1);
2384 break;
2385 case SYS_SETSOCKOPT:
2386 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2387 break;
2388 case SYS_GETSOCKOPT:
2389 err =
2390 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2391 (int __user *)a[4]);
2392 break;
2393 case SYS_SENDMSG:
666547ff 2394 err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2395 break;
228e548e
AB
2396 case SYS_SENDMMSG:
2397 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2398 break;
89bddce5 2399 case SYS_RECVMSG:
666547ff 2400 err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2401 break;
a2e27255
ACM
2402 case SYS_RECVMMSG:
2403 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2404 (struct timespec __user *)a[4]);
2405 break;
de11defe
UD
2406 case SYS_ACCEPT4:
2407 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2408 (int __user *)a[2], a[3]);
aaca0bdc 2409 break;
89bddce5
SH
2410 default:
2411 err = -EINVAL;
2412 break;
1da177e4
LT
2413 }
2414 return err;
2415}
2416
89bddce5 2417#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2418
55737fda
SH
2419/**
2420 * sock_register - add a socket protocol handler
2421 * @ops: description of protocol
2422 *
1da177e4
LT
2423 * This function is called by a protocol handler that wants to
2424 * advertise its address family, and have it linked into the
e793c0f7 2425 * socket interface. The value ops->family corresponds to the
55737fda 2426 * socket system call protocol family.
1da177e4 2427 */
f0fd27d4 2428int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2429{
2430 int err;
2431
2432 if (ops->family >= NPROTO) {
3410f22e 2433 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
1da177e4
LT
2434 return -ENOBUFS;
2435 }
55737fda
SH
2436
2437 spin_lock(&net_family_lock);
190683a9
ED
2438 if (rcu_dereference_protected(net_families[ops->family],
2439 lockdep_is_held(&net_family_lock)))
55737fda
SH
2440 err = -EEXIST;
2441 else {
cf778b00 2442 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2443 err = 0;
2444 }
55737fda
SH
2445 spin_unlock(&net_family_lock);
2446
3410f22e 2447 pr_info("NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2448 return err;
2449}
c6d409cf 2450EXPORT_SYMBOL(sock_register);
1da177e4 2451
55737fda
SH
2452/**
2453 * sock_unregister - remove a protocol handler
2454 * @family: protocol family to remove
2455 *
1da177e4
LT
2456 * This function is called by a protocol handler that wants to
2457 * remove its address family, and have it unlinked from the
55737fda
SH
2458 * new socket creation.
2459 *
2460 * If protocol handler is a module, then it can use module reference
2461 * counts to protect against new references. If protocol handler is not
2462 * a module then it needs to provide its own protection in
2463 * the ops->create routine.
1da177e4 2464 */
f0fd27d4 2465void sock_unregister(int family)
1da177e4 2466{
f0fd27d4 2467 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2468
55737fda 2469 spin_lock(&net_family_lock);
a9b3cd7f 2470 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2471 spin_unlock(&net_family_lock);
2472
2473 synchronize_rcu();
2474
3410f22e 2475 pr_info("NET: Unregistered protocol family %d\n", family);
1da177e4 2476}
c6d409cf 2477EXPORT_SYMBOL(sock_unregister);
1da177e4 2478
77d76ea3 2479static int __init sock_init(void)
1da177e4 2480{
b3e19d92 2481 int err;
2ca794e5
EB
2482 /*
2483 * Initialize the network sysctl infrastructure.
2484 */
2485 err = net_sysctl_init();
2486 if (err)
2487 goto out;
b3e19d92 2488
1da177e4 2489 /*
89bddce5 2490 * Initialize skbuff SLAB cache
1da177e4
LT
2491 */
2492 skb_init();
1da177e4
LT
2493
2494 /*
89bddce5 2495 * Initialize the protocols module.
1da177e4
LT
2496 */
2497
2498 init_inodecache();
b3e19d92
NP
2499
2500 err = register_filesystem(&sock_fs_type);
2501 if (err)
2502 goto out_fs;
1da177e4 2503 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2504 if (IS_ERR(sock_mnt)) {
2505 err = PTR_ERR(sock_mnt);
2506 goto out_mount;
2507 }
77d76ea3
AK
2508
2509 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2510 */
2511
2512#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2513 err = netfilter_init();
2514 if (err)
2515 goto out;
1da177e4 2516#endif
cbeb321a 2517
408eccce 2518 ptp_classifier_init();
c1f19b51 2519
b3e19d92
NP
2520out:
2521 return err;
2522
2523out_mount:
2524 unregister_filesystem(&sock_fs_type);
2525out_fs:
2526 goto out;
1da177e4
LT
2527}
2528
77d76ea3
AK
2529core_initcall(sock_init); /* early initcall */
2530
1da177e4
LT
2531#ifdef CONFIG_PROC_FS
2532void socket_seq_show(struct seq_file *seq)
2533{
2534 int cpu;
2535 int counter = 0;
2536
6f912042 2537 for_each_possible_cpu(cpu)
89bddce5 2538 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2539
2540 /* It can be negative, by the way. 8) */
2541 if (counter < 0)
2542 counter = 0;
2543
2544 seq_printf(seq, "sockets: used %d\n", counter);
2545}
89bddce5 2546#endif /* CONFIG_PROC_FS */
1da177e4 2547
89bbfc95 2548#ifdef CONFIG_COMPAT
6b96018b 2549static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2550 unsigned int cmd, void __user *up)
7a229387 2551{
7a229387
AB
2552 mm_segment_t old_fs = get_fs();
2553 struct timeval ktv;
2554 int err;
2555
2556 set_fs(KERNEL_DS);
6b96018b 2557 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2558 set_fs(old_fs);
644595f8 2559 if (!err)
ed6fe9d6 2560 err = compat_put_timeval(&ktv, up);
644595f8 2561
7a229387
AB
2562 return err;
2563}
2564
6b96018b 2565static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2566 unsigned int cmd, void __user *up)
7a229387 2567{
7a229387
AB
2568 mm_segment_t old_fs = get_fs();
2569 struct timespec kts;
2570 int err;
2571
2572 set_fs(KERNEL_DS);
6b96018b 2573 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2574 set_fs(old_fs);
644595f8 2575 if (!err)
ed6fe9d6 2576 err = compat_put_timespec(&kts, up);
644595f8 2577
7a229387
AB
2578 return err;
2579}
2580
6b96018b 2581static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2582{
2583 struct ifreq __user *uifr;
2584 int err;
2585
2586 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2587 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2588 return -EFAULT;
2589
6b96018b 2590 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2591 if (err)
2592 return err;
2593
6b96018b 2594 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2595 return -EFAULT;
2596
2597 return 0;
2598}
2599
6b96018b 2600static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2601{
6b96018b 2602 struct compat_ifconf ifc32;
7a229387
AB
2603 struct ifconf ifc;
2604 struct ifconf __user *uifc;
6b96018b 2605 struct compat_ifreq __user *ifr32;
7a229387
AB
2606 struct ifreq __user *ifr;
2607 unsigned int i, j;
2608 int err;
2609
6b96018b 2610 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2611 return -EFAULT;
2612
43da5f2e 2613 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2614 if (ifc32.ifcbuf == 0) {
2615 ifc32.ifc_len = 0;
2616 ifc.ifc_len = 0;
2617 ifc.ifc_req = NULL;
2618 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2619 } else {
c6d409cf
ED
2620 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2621 sizeof(struct ifreq);
7a229387
AB
2622 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2623 ifc.ifc_len = len;
2624 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2625 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2626 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2627 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2628 return -EFAULT;
2629 ifr++;
2630 ifr32++;
2631 }
2632 }
2633 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2634 return -EFAULT;
2635
6b96018b 2636 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2637 if (err)
2638 return err;
2639
2640 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2641 return -EFAULT;
2642
2643 ifr = ifc.ifc_req;
2644 ifr32 = compat_ptr(ifc32.ifcbuf);
2645 for (i = 0, j = 0;
c6d409cf
ED
2646 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2647 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2648 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2649 return -EFAULT;
2650 ifr32++;
2651 ifr++;
2652 }
2653
2654 if (ifc32.ifcbuf == 0) {
2655 /* Translate from 64-bit structure multiple to
2656 * a 32-bit one.
2657 */
2658 i = ifc.ifc_len;
6b96018b 2659 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2660 ifc32.ifc_len = i;
2661 } else {
2662 ifc32.ifc_len = i;
2663 }
6b96018b 2664 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2665 return -EFAULT;
2666
2667 return 0;
2668}
2669
6b96018b 2670static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2671{
3a7da39d
BH
2672 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2673 bool convert_in = false, convert_out = false;
2674 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2675 struct ethtool_rxnfc __user *rxnfc;
7a229387 2676 struct ifreq __user *ifr;
3a7da39d
BH
2677 u32 rule_cnt = 0, actual_rule_cnt;
2678 u32 ethcmd;
7a229387 2679 u32 data;
3a7da39d 2680 int ret;
7a229387 2681
3a7da39d
BH
2682 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2683 return -EFAULT;
7a229387 2684
3a7da39d
BH
2685 compat_rxnfc = compat_ptr(data);
2686
2687 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2688 return -EFAULT;
2689
3a7da39d
BH
2690 /* Most ethtool structures are defined without padding.
2691 * Unfortunately struct ethtool_rxnfc is an exception.
2692 */
2693 switch (ethcmd) {
2694 default:
2695 break;
2696 case ETHTOOL_GRXCLSRLALL:
2697 /* Buffer size is variable */
2698 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2699 return -EFAULT;
2700 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2701 return -ENOMEM;
2702 buf_size += rule_cnt * sizeof(u32);
2703 /* fall through */
2704 case ETHTOOL_GRXRINGS:
2705 case ETHTOOL_GRXCLSRLCNT:
2706 case ETHTOOL_GRXCLSRULE:
55664f32 2707 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2708 convert_out = true;
2709 /* fall through */
2710 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2711 buf_size += sizeof(struct ethtool_rxnfc);
2712 convert_in = true;
2713 break;
2714 }
2715
2716 ifr = compat_alloc_user_space(buf_size);
954b1244 2717 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2718
2719 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2720 return -EFAULT;
2721
3a7da39d
BH
2722 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2723 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2724 return -EFAULT;
2725
3a7da39d 2726 if (convert_in) {
127fe533 2727 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2728 * fs.ring_cookie and at the end of fs, but nowhere else.
2729 */
127fe533
AD
2730 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2731 sizeof(compat_rxnfc->fs.m_ext) !=
2732 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2733 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2734 BUILD_BUG_ON(
2735 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2736 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2737 offsetof(struct ethtool_rxnfc, fs.location) -
2738 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2739
2740 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2741 (void __user *)(&rxnfc->fs.m_ext + 1) -
2742 (void __user *)rxnfc) ||
3a7da39d
BH
2743 copy_in_user(&rxnfc->fs.ring_cookie,
2744 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2745 (void __user *)(&rxnfc->fs.location + 1) -
2746 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2747 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2748 sizeof(rxnfc->rule_cnt)))
2749 return -EFAULT;
2750 }
2751
2752 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2753 if (ret)
2754 return ret;
2755
2756 if (convert_out) {
2757 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2758 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2759 (const void __user *)rxnfc) ||
3a7da39d
BH
2760 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2761 &rxnfc->fs.ring_cookie,
954b1244
SH
2762 (const void __user *)(&rxnfc->fs.location + 1) -
2763 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2764 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2765 sizeof(rxnfc->rule_cnt)))
2766 return -EFAULT;
2767
2768 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2769 /* As an optimisation, we only copy the actual
2770 * number of rules that the underlying
2771 * function returned. Since Mallory might
2772 * change the rule count in user memory, we
2773 * check that it is less than the rule count
2774 * originally given (as the user buffer size),
2775 * which has been range-checked.
2776 */
2777 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2778 return -EFAULT;
2779 if (actual_rule_cnt < rule_cnt)
2780 rule_cnt = actual_rule_cnt;
2781 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2782 &rxnfc->rule_locs[0],
2783 rule_cnt * sizeof(u32)))
2784 return -EFAULT;
2785 }
2786 }
2787
2788 return 0;
7a229387
AB
2789}
2790
7a50a240
AB
2791static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2792{
2793 void __user *uptr;
2794 compat_uptr_t uptr32;
2795 struct ifreq __user *uifr;
2796
c6d409cf 2797 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2798 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2799 return -EFAULT;
2800
2801 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2802 return -EFAULT;
2803
2804 uptr = compat_ptr(uptr32);
2805
2806 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2807 return -EFAULT;
2808
2809 return dev_ioctl(net, SIOCWANDEV, uifr);
2810}
2811
6b96018b
AB
2812static int bond_ioctl(struct net *net, unsigned int cmd,
2813 struct compat_ifreq __user *ifr32)
7a229387
AB
2814{
2815 struct ifreq kifr;
7a229387
AB
2816 mm_segment_t old_fs;
2817 int err;
7a229387
AB
2818
2819 switch (cmd) {
2820 case SIOCBONDENSLAVE:
2821 case SIOCBONDRELEASE:
2822 case SIOCBONDSETHWADDR:
2823 case SIOCBONDCHANGEACTIVE:
6b96018b 2824 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2825 return -EFAULT;
2826
2827 old_fs = get_fs();
c6d409cf 2828 set_fs(KERNEL_DS);
c3f52ae6 2829 err = dev_ioctl(net, cmd,
2830 (struct ifreq __user __force *) &kifr);
c6d409cf 2831 set_fs(old_fs);
7a229387
AB
2832
2833 return err;
7a229387 2834 default:
07d106d0 2835 return -ENOIOCTLCMD;
ccbd6a5a 2836 }
7a229387
AB
2837}
2838
590d4693
BH
2839/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2840static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 2841 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2842{
2843 struct ifreq __user *u_ifreq64;
7a229387
AB
2844 char tmp_buf[IFNAMSIZ];
2845 void __user *data64;
2846 u32 data32;
2847
2848 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2849 IFNAMSIZ))
2850 return -EFAULT;
417c3522 2851 if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
7a229387
AB
2852 return -EFAULT;
2853 data64 = compat_ptr(data32);
2854
2855 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2856
7a229387
AB
2857 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2858 IFNAMSIZ))
2859 return -EFAULT;
417c3522 2860 if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
7a229387
AB
2861 return -EFAULT;
2862
6b96018b 2863 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
2864}
2865
6b96018b
AB
2866static int dev_ifsioc(struct net *net, struct socket *sock,
2867 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 2868{
a2116ed2 2869 struct ifreq __user *uifr;
7a229387
AB
2870 int err;
2871
a2116ed2
AB
2872 uifr = compat_alloc_user_space(sizeof(*uifr));
2873 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2874 return -EFAULT;
2875
2876 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2877
7a229387
AB
2878 if (!err) {
2879 switch (cmd) {
2880 case SIOCGIFFLAGS:
2881 case SIOCGIFMETRIC:
2882 case SIOCGIFMTU:
2883 case SIOCGIFMEM:
2884 case SIOCGIFHWADDR:
2885 case SIOCGIFINDEX:
2886 case SIOCGIFADDR:
2887 case SIOCGIFBRDADDR:
2888 case SIOCGIFDSTADDR:
2889 case SIOCGIFNETMASK:
fab2532b 2890 case SIOCGIFPFLAGS:
7a229387 2891 case SIOCGIFTXQLEN:
fab2532b
AB
2892 case SIOCGMIIPHY:
2893 case SIOCGMIIREG:
a2116ed2 2894 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
2895 err = -EFAULT;
2896 break;
2897 }
2898 }
2899 return err;
2900}
2901
a2116ed2
AB
2902static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2903 struct compat_ifreq __user *uifr32)
2904{
2905 struct ifreq ifr;
2906 struct compat_ifmap __user *uifmap32;
2907 mm_segment_t old_fs;
2908 int err;
2909
2910 uifmap32 = &uifr32->ifr_ifru.ifru_map;
2911 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
2912 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2913 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2914 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2915 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2916 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2917 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2918 if (err)
2919 return -EFAULT;
2920
2921 old_fs = get_fs();
c6d409cf 2922 set_fs(KERNEL_DS);
c3f52ae6 2923 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 2924 set_fs(old_fs);
a2116ed2
AB
2925
2926 if (cmd == SIOCGIFMAP && !err) {
2927 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
2928 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2929 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2930 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2931 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2932 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2933 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2934 if (err)
2935 err = -EFAULT;
2936 }
2937 return err;
2938}
2939
7a229387 2940struct rtentry32 {
c6d409cf 2941 u32 rt_pad1;
7a229387
AB
2942 struct sockaddr rt_dst; /* target address */
2943 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
2944 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
2945 unsigned short rt_flags;
2946 short rt_pad2;
2947 u32 rt_pad3;
2948 unsigned char rt_tos;
2949 unsigned char rt_class;
2950 short rt_pad4;
2951 short rt_metric; /* +1 for binary compatibility! */
7a229387 2952 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
2953 u32 rt_mtu; /* per route MTU/Window */
2954 u32 rt_window; /* Window clamping */
7a229387
AB
2955 unsigned short rt_irtt; /* Initial RTT */
2956};
2957
2958struct in6_rtmsg32 {
2959 struct in6_addr rtmsg_dst;
2960 struct in6_addr rtmsg_src;
2961 struct in6_addr rtmsg_gateway;
2962 u32 rtmsg_type;
2963 u16 rtmsg_dst_len;
2964 u16 rtmsg_src_len;
2965 u32 rtmsg_metric;
2966 u32 rtmsg_info;
2967 u32 rtmsg_flags;
2968 s32 rtmsg_ifindex;
2969};
2970
6b96018b
AB
2971static int routing_ioctl(struct net *net, struct socket *sock,
2972 unsigned int cmd, void __user *argp)
7a229387
AB
2973{
2974 int ret;
2975 void *r = NULL;
2976 struct in6_rtmsg r6;
2977 struct rtentry r4;
2978 char devname[16];
2979 u32 rtdev;
2980 mm_segment_t old_fs = get_fs();
2981
6b96018b
AB
2982 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
2983 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 2984 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 2985 3 * sizeof(struct in6_addr));
3ddc5b46
MD
2986 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
2987 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
2988 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
2989 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
2990 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
2991 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
2992 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
2993
2994 r = (void *) &r6;
2995 } else { /* ipv4 */
6b96018b 2996 struct rtentry32 __user *ur4 = argp;
c6d409cf 2997 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 2998 3 * sizeof(struct sockaddr));
3ddc5b46
MD
2999 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3000 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3001 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3002 ret |= get_user(r4.rt_window, &(ur4->rt_window));
3003 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3004 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 3005 if (rtdev) {
c6d409cf 3006 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3007 r4.rt_dev = (char __user __force *)devname;
3008 devname[15] = 0;
7a229387
AB
3009 } else
3010 r4.rt_dev = NULL;
3011
3012 r = (void *) &r4;
3013 }
3014
3015 if (ret) {
3016 ret = -EFAULT;
3017 goto out;
3018 }
3019
c6d409cf 3020 set_fs(KERNEL_DS);
6b96018b 3021 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3022 set_fs(old_fs);
7a229387
AB
3023
3024out:
7a229387
AB
3025 return ret;
3026}
3027
3028/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3029 * for some operations; this forces use of the newer bridge-utils that
25985edc 3030 * use compatible ioctls
7a229387 3031 */
6b96018b 3032static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3033{
6b96018b 3034 compat_ulong_t tmp;
7a229387 3035
6b96018b 3036 if (get_user(tmp, argp))
7a229387
AB
3037 return -EFAULT;
3038 if (tmp == BRCTL_GET_VERSION)
3039 return BRCTL_VERSION + 1;
3040 return -EINVAL;
3041}
3042
6b96018b
AB
3043static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3044 unsigned int cmd, unsigned long arg)
3045{
3046 void __user *argp = compat_ptr(arg);
3047 struct sock *sk = sock->sk;
3048 struct net *net = sock_net(sk);
7a229387 3049
6b96018b 3050 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3051 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3052
3053 switch (cmd) {
3054 case SIOCSIFBR:
3055 case SIOCGIFBR:
3056 return old_bridge_ioctl(argp);
3057 case SIOCGIFNAME:
3058 return dev_ifname32(net, argp);
3059 case SIOCGIFCONF:
3060 return dev_ifconf(net, argp);
3061 case SIOCETHTOOL:
3062 return ethtool_ioctl(net, argp);
7a50a240
AB
3063 case SIOCWANDEV:
3064 return compat_siocwandev(net, argp);
a2116ed2
AB
3065 case SIOCGIFMAP:
3066 case SIOCSIFMAP:
3067 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3068 case SIOCBONDENSLAVE:
3069 case SIOCBONDRELEASE:
3070 case SIOCBONDSETHWADDR:
6b96018b
AB
3071 case SIOCBONDCHANGEACTIVE:
3072 return bond_ioctl(net, cmd, argp);
3073 case SIOCADDRT:
3074 case SIOCDELRT:
3075 return routing_ioctl(net, sock, cmd, argp);
3076 case SIOCGSTAMP:
3077 return do_siocgstamp(net, sock, cmd, argp);
3078 case SIOCGSTAMPNS:
3079 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3080 case SIOCBONDSLAVEINFOQUERY:
3081 case SIOCBONDINFOQUERY:
a2116ed2 3082 case SIOCSHWTSTAMP:
fd468c74 3083 case SIOCGHWTSTAMP:
590d4693 3084 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3085
3086 case FIOSETOWN:
3087 case SIOCSPGRP:
3088 case FIOGETOWN:
3089 case SIOCGPGRP:
3090 case SIOCBRADDBR:
3091 case SIOCBRDELBR:
3092 case SIOCGIFVLAN:
3093 case SIOCSIFVLAN:
3094 case SIOCADDDLCI:
3095 case SIOCDELDLCI:
3096 return sock_ioctl(file, cmd, arg);
3097
3098 case SIOCGIFFLAGS:
3099 case SIOCSIFFLAGS:
3100 case SIOCGIFMETRIC:
3101 case SIOCSIFMETRIC:
3102 case SIOCGIFMTU:
3103 case SIOCSIFMTU:
3104 case SIOCGIFMEM:
3105 case SIOCSIFMEM:
3106 case SIOCGIFHWADDR:
3107 case SIOCSIFHWADDR:
3108 case SIOCADDMULTI:
3109 case SIOCDELMULTI:
3110 case SIOCGIFINDEX:
6b96018b
AB
3111 case SIOCGIFADDR:
3112 case SIOCSIFADDR:
3113 case SIOCSIFHWBROADCAST:
6b96018b 3114 case SIOCDIFADDR:
6b96018b
AB
3115 case SIOCGIFBRDADDR:
3116 case SIOCSIFBRDADDR:
3117 case SIOCGIFDSTADDR:
3118 case SIOCSIFDSTADDR:
3119 case SIOCGIFNETMASK:
3120 case SIOCSIFNETMASK:
3121 case SIOCSIFPFLAGS:
3122 case SIOCGIFPFLAGS:
3123 case SIOCGIFTXQLEN:
3124 case SIOCSIFTXQLEN:
3125 case SIOCBRADDIF:
3126 case SIOCBRDELIF:
9177efd3
AB
3127 case SIOCSIFNAME:
3128 case SIOCGMIIPHY:
3129 case SIOCGMIIREG:
3130 case SIOCSMIIREG:
6b96018b 3131 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3132
6b96018b
AB
3133 case SIOCSARP:
3134 case SIOCGARP:
3135 case SIOCDARP:
6b96018b 3136 case SIOCATMARK:
9177efd3
AB
3137 return sock_do_ioctl(net, sock, cmd, arg);
3138 }
3139
6b96018b
AB
3140 return -ENOIOCTLCMD;
3141}
7a229387 3142
95c96174 3143static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3144 unsigned long arg)
89bbfc95
SP
3145{
3146 struct socket *sock = file->private_data;
3147 int ret = -ENOIOCTLCMD;
87de87d5
DM
3148 struct sock *sk;
3149 struct net *net;
3150
3151 sk = sock->sk;
3152 net = sock_net(sk);
89bbfc95
SP
3153
3154 if (sock->ops->compat_ioctl)
3155 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3156
87de87d5
DM
3157 if (ret == -ENOIOCTLCMD &&
3158 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3159 ret = compat_wext_handle_ioctl(net, cmd, arg);
3160
6b96018b
AB
3161 if (ret == -ENOIOCTLCMD)
3162 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3163
89bbfc95
SP
3164 return ret;
3165}
3166#endif
3167
ac5a488e
SS
3168int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3169{
3170 return sock->ops->bind(sock, addr, addrlen);
3171}
c6d409cf 3172EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3173
3174int kernel_listen(struct socket *sock, int backlog)
3175{
3176 return sock->ops->listen(sock, backlog);
3177}
c6d409cf 3178EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3179
3180int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3181{
3182 struct sock *sk = sock->sk;
3183 int err;
3184
3185 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3186 newsock);
3187 if (err < 0)
3188 goto done;
3189
3190 err = sock->ops->accept(sock, *newsock, flags);
3191 if (err < 0) {
3192 sock_release(*newsock);
fa8705b0 3193 *newsock = NULL;
ac5a488e
SS
3194 goto done;
3195 }
3196
3197 (*newsock)->ops = sock->ops;
1b08534e 3198 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3199
3200done:
3201 return err;
3202}
c6d409cf 3203EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3204
3205int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3206 int flags)
ac5a488e
SS
3207{
3208 return sock->ops->connect(sock, addr, addrlen, flags);
3209}
c6d409cf 3210EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3211
3212int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3213 int *addrlen)
3214{
3215 return sock->ops->getname(sock, addr, addrlen, 0);
3216}
c6d409cf 3217EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3218
3219int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3220 int *addrlen)
3221{
3222 return sock->ops->getname(sock, addr, addrlen, 1);
3223}
c6d409cf 3224EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3225
3226int kernel_getsockopt(struct socket *sock, int level, int optname,
3227 char *optval, int *optlen)
3228{
3229 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3230 char __user *uoptval;
3231 int __user *uoptlen;
ac5a488e
SS
3232 int err;
3233
fb8621bb
NK
3234 uoptval = (char __user __force *) optval;
3235 uoptlen = (int __user __force *) optlen;
3236
ac5a488e
SS
3237 set_fs(KERNEL_DS);
3238 if (level == SOL_SOCKET)
fb8621bb 3239 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3240 else
fb8621bb
NK
3241 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3242 uoptlen);
ac5a488e
SS
3243 set_fs(oldfs);
3244 return err;
3245}
c6d409cf 3246EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3247
3248int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3249 char *optval, unsigned int optlen)
ac5a488e
SS
3250{
3251 mm_segment_t oldfs = get_fs();
fb8621bb 3252 char __user *uoptval;
ac5a488e
SS
3253 int err;
3254
fb8621bb
NK
3255 uoptval = (char __user __force *) optval;
3256
ac5a488e
SS
3257 set_fs(KERNEL_DS);
3258 if (level == SOL_SOCKET)
fb8621bb 3259 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3260 else
fb8621bb 3261 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3262 optlen);
3263 set_fs(oldfs);
3264 return err;
3265}
c6d409cf 3266EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3267
3268int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3269 size_t size, int flags)
3270{
3271 if (sock->ops->sendpage)
3272 return sock->ops->sendpage(sock, page, offset, size, flags);
3273
3274 return sock_no_sendpage(sock, page, offset, size, flags);
3275}
c6d409cf 3276EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3277
3278int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3279{
3280 mm_segment_t oldfs = get_fs();
3281 int err;
3282
3283 set_fs(KERNEL_DS);
3284 err = sock->ops->ioctl(sock, cmd, arg);
3285 set_fs(oldfs);
3286
3287 return err;
3288}
c6d409cf 3289EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3290
91cf45f0
TM
3291int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3292{
3293 return sock->ops->shutdown(sock, how);
3294}
91cf45f0 3295EXPORT_SYMBOL(kernel_sock_shutdown);