bridge: fix some kernel warning in multicast timer
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
1da177e4
LT
75#include <linux/init.h>
76#include <linux/poll.h>
77#include <linux/cache.h>
78#include <linux/module.h>
79#include <linux/highmem.h>
1da177e4
LT
80#include <linux/mount.h>
81#include <linux/security.h>
82#include <linux/syscalls.h>
83#include <linux/compat.h>
84#include <linux/kmod.h>
3ec3b2fb 85#include <linux/audit.h>
d86b5e0e 86#include <linux/wireless.h>
1b8d7ae4 87#include <linux/nsproxy.h>
1fd7317d 88#include <linux/magic.h>
5a0e3ad6 89#include <linux/slab.h>
600e1779 90#include <linux/xattr.h>
1da177e4
LT
91
92#include <asm/uaccess.h>
93#include <asm/unistd.h>
94
95#include <net/compat.h>
87de87d5 96#include <net/wext.h>
f8451725 97#include <net/cls_cgroup.h>
1da177e4
LT
98
99#include <net/sock.h>
100#include <linux/netfilter.h>
101
6b96018b
AB
102#include <linux/if_tun.h>
103#include <linux/ipv6_route.h>
104#include <linux/route.h>
6b96018b
AB
105#include <linux/sockios.h>
106#include <linux/atalk.h>
06021292
ET
107#include <net/ll_poll.h>
108
109#ifdef CONFIG_NET_LL_RX_POLL
2d48d67f 110unsigned int sysctl_net_ll_read __read_mostly;
eb6db622 111unsigned int sysctl_net_ll_poll __read_mostly;
06021292 112#endif
6b96018b 113
1da177e4 114static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
115static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
116 unsigned long nr_segs, loff_t pos);
117static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
118 unsigned long nr_segs, loff_t pos);
89bddce5 119static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
120
121static int sock_close(struct inode *inode, struct file *file);
122static unsigned int sock_poll(struct file *file,
123 struct poll_table_struct *wait);
89bddce5 124static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
125#ifdef CONFIG_COMPAT
126static long compat_sock_ioctl(struct file *file,
89bddce5 127 unsigned int cmd, unsigned long arg);
89bbfc95 128#endif
1da177e4 129static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
130static ssize_t sock_sendpage(struct file *file, struct page *page,
131 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 132static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 133 struct pipe_inode_info *pipe, size_t len,
9c55e01c 134 unsigned int flags);
1da177e4 135
1da177e4
LT
136/*
137 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
138 * in the operation structures but are done directly via the socketcall() multiplexor.
139 */
140
da7071d7 141static const struct file_operations socket_file_ops = {
1da177e4
LT
142 .owner = THIS_MODULE,
143 .llseek = no_llseek,
144 .aio_read = sock_aio_read,
145 .aio_write = sock_aio_write,
146 .poll = sock_poll,
147 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
148#ifdef CONFIG_COMPAT
149 .compat_ioctl = compat_sock_ioctl,
150#endif
1da177e4
LT
151 .mmap = sock_mmap,
152 .open = sock_no_open, /* special open code to disallow open via /proc */
153 .release = sock_close,
154 .fasync = sock_fasync,
5274f052
JA
155 .sendpage = sock_sendpage,
156 .splice_write = generic_splice_sendpage,
9c55e01c 157 .splice_read = sock_splice_read,
1da177e4
LT
158};
159
160/*
161 * The protocol list. Each protocol is registered in here.
162 */
163
1da177e4 164static DEFINE_SPINLOCK(net_family_lock);
190683a9 165static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 166
1da177e4
LT
167/*
168 * Statistics counters of the socket lists
169 */
170
c6d409cf 171static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
172
173/*
89bddce5
SH
174 * Support routines.
175 * Move socket addresses back and forth across the kernel/user
176 * divide and look after the messy bits.
1da177e4
LT
177 */
178
1da177e4
LT
179/**
180 * move_addr_to_kernel - copy a socket address into kernel space
181 * @uaddr: Address in user space
182 * @kaddr: Address in kernel space
183 * @ulen: Length in user space
184 *
185 * The address is copied into kernel space. If the provided address is
186 * too long an error code of -EINVAL is returned. If the copy gives
187 * invalid addresses -EFAULT is returned. On a success 0 is returned.
188 */
189
43db362d 190int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 191{
230b1839 192 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 193 return -EINVAL;
89bddce5 194 if (ulen == 0)
1da177e4 195 return 0;
89bddce5 196 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 197 return -EFAULT;
3ec3b2fb 198 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
199}
200
201/**
202 * move_addr_to_user - copy an address to user space
203 * @kaddr: kernel space address
204 * @klen: length of address in kernel
205 * @uaddr: user space address
206 * @ulen: pointer to user length field
207 *
208 * The value pointed to by ulen on entry is the buffer length available.
209 * This is overwritten with the buffer space used. -EINVAL is returned
210 * if an overlong buffer is specified or a negative buffer size. -EFAULT
211 * is returned if either the buffer or the length field are not
212 * accessible.
213 * After copying the data up to the limit the user specifies, the true
214 * length of the data is written over the length limit the user
215 * specified. Zero is returned for a success.
216 */
89bddce5 217
43db362d 218static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 219 void __user *uaddr, int __user *ulen)
1da177e4
LT
220{
221 int err;
222 int len;
223
89bddce5
SH
224 err = get_user(len, ulen);
225 if (err)
1da177e4 226 return err;
89bddce5
SH
227 if (len > klen)
228 len = klen;
230b1839 229 if (len < 0 || len > sizeof(struct sockaddr_storage))
1da177e4 230 return -EINVAL;
89bddce5 231 if (len) {
d6fe3945
SG
232 if (audit_sockaddr(klen, kaddr))
233 return -ENOMEM;
89bddce5 234 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
235 return -EFAULT;
236 }
237 /*
89bddce5
SH
238 * "fromlen shall refer to the value before truncation.."
239 * 1003.1g
1da177e4
LT
240 */
241 return __put_user(klen, ulen);
242}
243
e18b890b 244static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
245
246static struct inode *sock_alloc_inode(struct super_block *sb)
247{
248 struct socket_alloc *ei;
eaefd110 249 struct socket_wq *wq;
89bddce5 250
e94b1766 251 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
252 if (!ei)
253 return NULL;
eaefd110
ED
254 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
255 if (!wq) {
43815482
ED
256 kmem_cache_free(sock_inode_cachep, ei);
257 return NULL;
258 }
eaefd110
ED
259 init_waitqueue_head(&wq->wait);
260 wq->fasync_list = NULL;
261 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 262
1da177e4
LT
263 ei->socket.state = SS_UNCONNECTED;
264 ei->socket.flags = 0;
265 ei->socket.ops = NULL;
266 ei->socket.sk = NULL;
267 ei->socket.file = NULL;
1da177e4
LT
268
269 return &ei->vfs_inode;
270}
271
272static void sock_destroy_inode(struct inode *inode)
273{
43815482 274 struct socket_alloc *ei;
eaefd110 275 struct socket_wq *wq;
43815482
ED
276
277 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 278 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 279 kfree_rcu(wq, rcu);
43815482 280 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
281}
282
51cc5068 283static void init_once(void *foo)
1da177e4 284{
89bddce5 285 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 286
a35afb83 287 inode_init_once(&ei->vfs_inode);
1da177e4 288}
89bddce5 289
1da177e4
LT
290static int init_inodecache(void)
291{
292 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
293 sizeof(struct socket_alloc),
294 0,
295 (SLAB_HWCACHE_ALIGN |
296 SLAB_RECLAIM_ACCOUNT |
297 SLAB_MEM_SPREAD),
20c2df83 298 init_once);
1da177e4
LT
299 if (sock_inode_cachep == NULL)
300 return -ENOMEM;
301 return 0;
302}
303
b87221de 304static const struct super_operations sockfs_ops = {
c6d409cf
ED
305 .alloc_inode = sock_alloc_inode,
306 .destroy_inode = sock_destroy_inode,
307 .statfs = simple_statfs,
1da177e4
LT
308};
309
c23fbb6b
ED
310/*
311 * sockfs_dname() is called from d_path().
312 */
313static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
314{
315 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
316 dentry->d_inode->i_ino);
317}
318
3ba13d17 319static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 320 .d_dname = sockfs_dname,
1da177e4
LT
321};
322
c74a1cbb
AV
323static struct dentry *sockfs_mount(struct file_system_type *fs_type,
324 int flags, const char *dev_name, void *data)
325{
326 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
327 &sockfs_dentry_operations, SOCKFS_MAGIC);
328}
329
330static struct vfsmount *sock_mnt __read_mostly;
331
332static struct file_system_type sock_fs_type = {
333 .name = "sockfs",
334 .mount = sockfs_mount,
335 .kill_sb = kill_anon_super,
336};
337
1da177e4
LT
338/*
339 * Obtains the first available file descriptor and sets it up for use.
340 *
39d8c1b6
DM
341 * These functions create file structures and maps them to fd space
342 * of the current process. On success it returns file descriptor
1da177e4
LT
343 * and file struct implicitly stored in sock->file.
344 * Note that another thread may close file descriptor before we return
345 * from this function. We use the fact that now we do not refer
346 * to socket after mapping. If one day we will need it, this
347 * function will increment ref. count on file by 1.
348 *
349 * In any case returned fd MAY BE not valid!
350 * This race condition is unavoidable
351 * with shared fd spaces, we cannot solve it inside kernel,
352 * but we take care of internal coherence yet.
353 */
354
aab174f0 355struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 356{
7cbe66b6 357 struct qstr name = { .name = "" };
2c48b9c4 358 struct path path;
7cbe66b6 359 struct file *file;
1da177e4 360
600e1779
MY
361 if (dname) {
362 name.name = dname;
363 name.len = strlen(name.name);
364 } else if (sock->sk) {
365 name.name = sock->sk->sk_prot_creator->name;
366 name.len = strlen(name.name);
367 }
4b936885 368 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
369 if (unlikely(!path.dentry))
370 return ERR_PTR(-ENOMEM);
2c48b9c4 371 path.mnt = mntget(sock_mnt);
39d8c1b6 372
2c48b9c4 373 d_instantiate(path.dentry, SOCK_INODE(sock));
cc3808f8 374 SOCK_INODE(sock)->i_fop = &socket_file_ops;
39d8c1b6 375
2c48b9c4 376 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 377 &socket_file_ops);
39b65252 378 if (unlikely(IS_ERR(file))) {
cc3808f8 379 /* drop dentry, keep inode */
7de9c6ee 380 ihold(path.dentry->d_inode);
2c48b9c4 381 path_put(&path);
39b65252 382 return file;
cc3808f8
AV
383 }
384
385 sock->file = file;
77d27200 386 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 387 file->private_data = sock;
28407630 388 return file;
39d8c1b6 389}
56b31d1c 390EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 391
56b31d1c 392static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
393{
394 struct file *newfile;
28407630
AV
395 int fd = get_unused_fd_flags(flags);
396 if (unlikely(fd < 0))
397 return fd;
39d8c1b6 398
aab174f0 399 newfile = sock_alloc_file(sock, flags, NULL);
28407630 400 if (likely(!IS_ERR(newfile))) {
39d8c1b6 401 fd_install(fd, newfile);
28407630
AV
402 return fd;
403 }
7cbe66b6 404
28407630
AV
405 put_unused_fd(fd);
406 return PTR_ERR(newfile);
1da177e4
LT
407}
408
406a3c63 409struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 410{
6cb153ca
BL
411 if (file->f_op == &socket_file_ops)
412 return file->private_data; /* set in sock_map_fd */
413
23bb80d2
ED
414 *err = -ENOTSOCK;
415 return NULL;
6cb153ca 416}
406a3c63 417EXPORT_SYMBOL(sock_from_file);
6cb153ca 418
1da177e4 419/**
c6d409cf 420 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
421 * @fd: file handle
422 * @err: pointer to an error code return
423 *
424 * The file handle passed in is locked and the socket it is bound
425 * too is returned. If an error occurs the err pointer is overwritten
426 * with a negative errno code and NULL is returned. The function checks
427 * for both invalid handles and passing a handle which is not a socket.
428 *
429 * On a success the socket object pointer is returned.
430 */
431
432struct socket *sockfd_lookup(int fd, int *err)
433{
434 struct file *file;
1da177e4
LT
435 struct socket *sock;
436
89bddce5
SH
437 file = fget(fd);
438 if (!file) {
1da177e4
LT
439 *err = -EBADF;
440 return NULL;
441 }
89bddce5 442
6cb153ca
BL
443 sock = sock_from_file(file, err);
444 if (!sock)
1da177e4 445 fput(file);
6cb153ca
BL
446 return sock;
447}
c6d409cf 448EXPORT_SYMBOL(sockfd_lookup);
1da177e4 449
6cb153ca
BL
450static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
451{
452 struct file *file;
453 struct socket *sock;
454
3672558c 455 *err = -EBADF;
6cb153ca
BL
456 file = fget_light(fd, fput_needed);
457 if (file) {
458 sock = sock_from_file(file, err);
459 if (sock)
460 return sock;
461 fput_light(file, *fput_needed);
1da177e4 462 }
6cb153ca 463 return NULL;
1da177e4
LT
464}
465
600e1779
MY
466#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
467#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
468#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
469static ssize_t sockfs_getxattr(struct dentry *dentry,
470 const char *name, void *value, size_t size)
471{
472 const char *proto_name;
473 size_t proto_size;
474 int error;
475
476 error = -ENODATA;
477 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
478 proto_name = dentry->d_name.name;
479 proto_size = strlen(proto_name);
480
481 if (value) {
482 error = -ERANGE;
483 if (proto_size + 1 > size)
484 goto out;
485
486 strncpy(value, proto_name, proto_size + 1);
487 }
488 error = proto_size + 1;
489 }
490
491out:
492 return error;
493}
494
495static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
496 size_t size)
497{
498 ssize_t len;
499 ssize_t used = 0;
500
501 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
502 if (len < 0)
503 return len;
504 used += len;
505 if (buffer) {
506 if (size < used)
507 return -ERANGE;
508 buffer += len;
509 }
510
511 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
512 used += len;
513 if (buffer) {
514 if (size < used)
515 return -ERANGE;
516 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
517 buffer += len;
518 }
519
520 return used;
521}
522
523static const struct inode_operations sockfs_inode_ops = {
524 .getxattr = sockfs_getxattr,
525 .listxattr = sockfs_listxattr,
526};
527
1da177e4
LT
528/**
529 * sock_alloc - allocate a socket
89bddce5 530 *
1da177e4
LT
531 * Allocate a new inode and socket object. The two are bound together
532 * and initialised. The socket is then returned. If we are out of inodes
533 * NULL is returned.
534 */
535
536static struct socket *sock_alloc(void)
537{
89bddce5
SH
538 struct inode *inode;
539 struct socket *sock;
1da177e4 540
a209dfc7 541 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
542 if (!inode)
543 return NULL;
544
545 sock = SOCKET_I(inode);
546
29a020d3 547 kmemcheck_annotate_bitfield(sock, type);
85fe4025 548 inode->i_ino = get_next_ino();
89bddce5 549 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
550 inode->i_uid = current_fsuid();
551 inode->i_gid = current_fsgid();
600e1779 552 inode->i_op = &sockfs_inode_ops;
1da177e4 553
19e8d69c 554 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
555 return sock;
556}
557
558/*
559 * In theory you can't get an open on this inode, but /proc provides
560 * a back door. Remember to keep it shut otherwise you'll let the
561 * creepy crawlies in.
562 */
89bddce5 563
1da177e4
LT
564static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
565{
566 return -ENXIO;
567}
568
4b6f5d20 569const struct file_operations bad_sock_fops = {
1da177e4
LT
570 .owner = THIS_MODULE,
571 .open = sock_no_open,
6038f373 572 .llseek = noop_llseek,
1da177e4
LT
573};
574
575/**
576 * sock_release - close a socket
577 * @sock: socket to close
578 *
579 * The socket is released from the protocol stack if it has a release
580 * callback, and the inode is then released if the socket is bound to
89bddce5 581 * an inode not a file.
1da177e4 582 */
89bddce5 583
1da177e4
LT
584void sock_release(struct socket *sock)
585{
586 if (sock->ops) {
587 struct module *owner = sock->ops->owner;
588
589 sock->ops->release(sock);
590 sock->ops = NULL;
591 module_put(owner);
592 }
593
eaefd110 594 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
1da177e4
LT
595 printk(KERN_ERR "sock_release: fasync list not empty!\n");
596
b09e786b
MP
597 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
598 return;
599
19e8d69c 600 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
601 if (!sock->file) {
602 iput(SOCK_INODE(sock));
603 return;
604 }
89bddce5 605 sock->file = NULL;
1da177e4 606}
c6d409cf 607EXPORT_SYMBOL(sock_release);
1da177e4 608
bf84a010 609void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
20d49473 610{
2244d07b 611 *tx_flags = 0;
20d49473 612 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
2244d07b 613 *tx_flags |= SKBTX_HW_TSTAMP;
20d49473 614 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
2244d07b 615 *tx_flags |= SKBTX_SW_TSTAMP;
6e3e939f
JB
616 if (sock_flag(sk, SOCK_WIFI_STATUS))
617 *tx_flags |= SKBTX_WIFI_STATUS;
20d49473
PO
618}
619EXPORT_SYMBOL(sock_tx_timestamp);
620
228e548e
AB
621static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
622 struct msghdr *msg, size_t size)
1da177e4
LT
623{
624 struct sock_iocb *si = kiocb_to_siocb(iocb);
1da177e4
LT
625
626 si->sock = sock;
627 si->scm = NULL;
628 si->msg = msg;
629 si->size = size;
630
1da177e4
LT
631 return sock->ops->sendmsg(iocb, sock, msg, size);
632}
633
228e548e
AB
634static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
635 struct msghdr *msg, size_t size)
636{
637 int err = security_socket_sendmsg(sock, msg, size);
638
639 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
640}
641
1da177e4
LT
642int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
643{
644 struct kiocb iocb;
645 struct sock_iocb siocb;
646 int ret;
647
648 init_sync_kiocb(&iocb, NULL);
649 iocb.private = &siocb;
650 ret = __sock_sendmsg(&iocb, sock, msg, size);
651 if (-EIOCBQUEUED == ret)
652 ret = wait_on_sync_kiocb(&iocb);
653 return ret;
654}
c6d409cf 655EXPORT_SYMBOL(sock_sendmsg);
1da177e4 656
894dc24c 657static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
658{
659 struct kiocb iocb;
660 struct sock_iocb siocb;
661 int ret;
662
663 init_sync_kiocb(&iocb, NULL);
664 iocb.private = &siocb;
665 ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
666 if (-EIOCBQUEUED == ret)
667 ret = wait_on_sync_kiocb(&iocb);
668 return ret;
669}
670
1da177e4
LT
671int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
672 struct kvec *vec, size_t num, size_t size)
673{
674 mm_segment_t oldfs = get_fs();
675 int result;
676
677 set_fs(KERNEL_DS);
678 /*
679 * the following is safe, since for compiler definitions of kvec and
680 * iovec are identical, yielding the same in-core layout and alignment
681 */
89bddce5 682 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
683 msg->msg_iovlen = num;
684 result = sock_sendmsg(sock, msg, size);
685 set_fs(oldfs);
686 return result;
687}
c6d409cf 688EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 689
92f37fd2
ED
690/*
691 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
692 */
693void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
694 struct sk_buff *skb)
695{
20d49473
PO
696 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
697 struct timespec ts[3];
698 int empty = 1;
699 struct skb_shared_hwtstamps *shhwtstamps =
700 skb_hwtstamps(skb);
701
702 /* Race occurred between timestamp enabling and packet
703 receiving. Fill in the current time for now. */
704 if (need_software_tstamp && skb->tstamp.tv64 == 0)
705 __net_timestamp(skb);
706
707 if (need_software_tstamp) {
708 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
709 struct timeval tv;
710 skb_get_timestamp(skb, &tv);
711 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
712 sizeof(tv), &tv);
713 } else {
842509b8 714 skb_get_timestampns(skb, &ts[0]);
20d49473 715 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
842509b8 716 sizeof(ts[0]), &ts[0]);
20d49473
PO
717 }
718 }
719
720
721 memset(ts, 0, sizeof(ts));
6e94d1ef
DB
722 if (sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE) &&
723 ktime_to_timespec_cond(skb->tstamp, ts + 0))
20d49473 724 empty = 0;
20d49473
PO
725 if (shhwtstamps) {
726 if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
6e94d1ef 727 ktime_to_timespec_cond(shhwtstamps->syststamp, ts + 1))
20d49473
PO
728 empty = 0;
729 if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
6e94d1ef 730 ktime_to_timespec_cond(shhwtstamps->hwtstamp, ts + 2))
20d49473 731 empty = 0;
92f37fd2 732 }
20d49473
PO
733 if (!empty)
734 put_cmsg(msg, SOL_SOCKET,
735 SCM_TIMESTAMPING, sizeof(ts), &ts);
92f37fd2 736}
7c81fd8b
ACM
737EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
738
6e3e939f
JB
739void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
740 struct sk_buff *skb)
741{
742 int ack;
743
744 if (!sock_flag(sk, SOCK_WIFI_STATUS))
745 return;
746 if (!skb->wifi_acked_valid)
747 return;
748
749 ack = skb->wifi_acked;
750
751 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
752}
753EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
754
11165f14 755static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
756 struct sk_buff *skb)
3b885787
NH
757{
758 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
759 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
760 sizeof(__u32), &skb->dropcount);
761}
762
767dd033 763void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
764 struct sk_buff *skb)
765{
766 sock_recv_timestamp(msg, sk, skb);
767 sock_recv_drops(msg, sk, skb);
768}
767dd033 769EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 770
a2e27255
ACM
771static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
772 struct msghdr *msg, size_t size, int flags)
1da177e4 773{
1da177e4
LT
774 struct sock_iocb *si = kiocb_to_siocb(iocb);
775
776 si->sock = sock;
777 si->scm = NULL;
778 si->msg = msg;
779 si->size = size;
780 si->flags = flags;
781
1da177e4
LT
782 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
783}
784
a2e27255
ACM
785static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
786 struct msghdr *msg, size_t size, int flags)
787{
788 int err = security_socket_recvmsg(sock, msg, size, flags);
789
790 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
791}
792
89bddce5 793int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
794 size_t size, int flags)
795{
796 struct kiocb iocb;
797 struct sock_iocb siocb;
798 int ret;
799
89bddce5 800 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
801 iocb.private = &siocb;
802 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
803 if (-EIOCBQUEUED == ret)
804 ret = wait_on_sync_kiocb(&iocb);
805 return ret;
806}
c6d409cf 807EXPORT_SYMBOL(sock_recvmsg);
1da177e4 808
a2e27255
ACM
809static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
810 size_t size, int flags)
811{
812 struct kiocb iocb;
813 struct sock_iocb siocb;
814 int ret;
815
816 init_sync_kiocb(&iocb, NULL);
817 iocb.private = &siocb;
818 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
819 if (-EIOCBQUEUED == ret)
820 ret = wait_on_sync_kiocb(&iocb);
821 return ret;
822}
823
c1249c0a
ML
824/**
825 * kernel_recvmsg - Receive a message from a socket (kernel space)
826 * @sock: The socket to receive the message from
827 * @msg: Received message
828 * @vec: Input s/g array for message data
829 * @num: Size of input s/g array
830 * @size: Number of bytes to read
831 * @flags: Message flags (MSG_DONTWAIT, etc...)
832 *
833 * On return the msg structure contains the scatter/gather array passed in the
834 * vec argument. The array is modified so that it consists of the unfilled
835 * portion of the original array.
836 *
837 * The returned value is the total number of bytes received, or an error.
838 */
89bddce5
SH
839int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
840 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
841{
842 mm_segment_t oldfs = get_fs();
843 int result;
844
845 set_fs(KERNEL_DS);
846 /*
847 * the following is safe, since for compiler definitions of kvec and
848 * iovec are identical, yielding the same in-core layout and alignment
849 */
89bddce5 850 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
851 result = sock_recvmsg(sock, msg, size, flags);
852 set_fs(oldfs);
853 return result;
854}
c6d409cf 855EXPORT_SYMBOL(kernel_recvmsg);
1da177e4
LT
856
857static void sock_aio_dtor(struct kiocb *iocb)
858{
859 kfree(iocb->private);
860}
861
ce1d4d3e
CH
862static ssize_t sock_sendpage(struct file *file, struct page *page,
863 int offset, size_t size, loff_t *ppos, int more)
1da177e4 864{
1da177e4
LT
865 struct socket *sock;
866 int flags;
867
ce1d4d3e
CH
868 sock = file->private_data;
869
35f9c09f
ED
870 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
871 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
872 flags |= more;
ce1d4d3e 873
e6949583 874 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 875}
1da177e4 876
9c55e01c 877static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 878 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
879 unsigned int flags)
880{
881 struct socket *sock = file->private_data;
882
997b37da
RDC
883 if (unlikely(!sock->ops->splice_read))
884 return -EINVAL;
885
9c55e01c
JA
886 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
887}
888
ce1d4d3e 889static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 890 struct sock_iocb *siocb)
ce1d4d3e
CH
891{
892 if (!is_sync_kiocb(iocb)) {
893 siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
894 if (!siocb)
895 return NULL;
1da177e4
LT
896 iocb->ki_dtor = sock_aio_dtor;
897 }
1da177e4 898
ce1d4d3e 899 siocb->kiocb = iocb;
ce1d4d3e
CH
900 iocb->private = siocb;
901 return siocb;
1da177e4
LT
902}
903
ce1d4d3e 904static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
905 struct file *file, const struct iovec *iov,
906 unsigned long nr_segs)
ce1d4d3e
CH
907{
908 struct socket *sock = file->private_data;
909 size_t size = 0;
910 int i;
1da177e4 911
89bddce5
SH
912 for (i = 0; i < nr_segs; i++)
913 size += iov[i].iov_len;
1da177e4 914
ce1d4d3e
CH
915 msg->msg_name = NULL;
916 msg->msg_namelen = 0;
917 msg->msg_control = NULL;
918 msg->msg_controllen = 0;
89bddce5 919 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
920 msg->msg_iovlen = nr_segs;
921 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
922
923 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
924}
925
027445c3
BP
926static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
927 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
928{
929 struct sock_iocb siocb, *x;
930
1da177e4
LT
931 if (pos != 0)
932 return -ESPIPE;
027445c3
BP
933
934 if (iocb->ki_left == 0) /* Match SYS5 behaviour */
1da177e4
LT
935 return 0;
936
027445c3
BP
937
938 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
939 if (!x)
940 return -ENOMEM;
027445c3 941 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
942}
943
ce1d4d3e 944static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
945 struct file *file, const struct iovec *iov,
946 unsigned long nr_segs)
1da177e4 947{
ce1d4d3e
CH
948 struct socket *sock = file->private_data;
949 size_t size = 0;
950 int i;
1da177e4 951
89bddce5
SH
952 for (i = 0; i < nr_segs; i++)
953 size += iov[i].iov_len;
1da177e4 954
ce1d4d3e
CH
955 msg->msg_name = NULL;
956 msg->msg_namelen = 0;
957 msg->msg_control = NULL;
958 msg->msg_controllen = 0;
89bddce5 959 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
960 msg->msg_iovlen = nr_segs;
961 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
962 if (sock->type == SOCK_SEQPACKET)
963 msg->msg_flags |= MSG_EOR;
1da177e4 964
ce1d4d3e 965 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
966}
967
027445c3
BP
968static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
969 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
970{
971 struct sock_iocb siocb, *x;
1da177e4 972
ce1d4d3e
CH
973 if (pos != 0)
974 return -ESPIPE;
027445c3 975
027445c3 976 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
977 if (!x)
978 return -ENOMEM;
1da177e4 979
027445c3 980 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
981}
982
1da177e4
LT
983/*
984 * Atomic setting of ioctl hooks to avoid race
985 * with module unload.
986 */
987
4a3e2f71 988static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 989static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 990
881d966b 991void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 992{
4a3e2f71 993 mutex_lock(&br_ioctl_mutex);
1da177e4 994 br_ioctl_hook = hook;
4a3e2f71 995 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
996}
997EXPORT_SYMBOL(brioctl_set);
998
4a3e2f71 999static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 1000static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 1001
881d966b 1002void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 1003{
4a3e2f71 1004 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1005 vlan_ioctl_hook = hook;
4a3e2f71 1006 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
1007}
1008EXPORT_SYMBOL(vlan_ioctl_set);
1009
4a3e2f71 1010static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 1011static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 1012
89bddce5 1013void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 1014{
4a3e2f71 1015 mutex_lock(&dlci_ioctl_mutex);
1da177e4 1016 dlci_ioctl_hook = hook;
4a3e2f71 1017 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1018}
1019EXPORT_SYMBOL(dlci_ioctl_set);
1020
6b96018b
AB
1021static long sock_do_ioctl(struct net *net, struct socket *sock,
1022 unsigned int cmd, unsigned long arg)
1023{
1024 int err;
1025 void __user *argp = (void __user *)arg;
1026
1027 err = sock->ops->ioctl(sock, cmd, arg);
1028
1029 /*
1030 * If this ioctl is unknown try to hand it down
1031 * to the NIC driver.
1032 */
1033 if (err == -ENOIOCTLCMD)
1034 err = dev_ioctl(net, cmd, argp);
1035
1036 return err;
1037}
1038
1da177e4
LT
1039/*
1040 * With an ioctl, arg may well be a user mode pointer, but we don't know
1041 * what to do with it - that's up to the protocol still.
1042 */
1043
1044static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1045{
1046 struct socket *sock;
881d966b 1047 struct sock *sk;
1da177e4
LT
1048 void __user *argp = (void __user *)arg;
1049 int pid, err;
881d966b 1050 struct net *net;
1da177e4 1051
b69aee04 1052 sock = file->private_data;
881d966b 1053 sk = sock->sk;
3b1e0a65 1054 net = sock_net(sk);
1da177e4 1055 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 1056 err = dev_ioctl(net, cmd, argp);
1da177e4 1057 } else
3d23e349 1058#ifdef CONFIG_WEXT_CORE
1da177e4 1059 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 1060 err = dev_ioctl(net, cmd, argp);
1da177e4 1061 } else
3d23e349 1062#endif
89bddce5 1063 switch (cmd) {
1da177e4
LT
1064 case FIOSETOWN:
1065 case SIOCSPGRP:
1066 err = -EFAULT;
1067 if (get_user(pid, (int __user *)argp))
1068 break;
1069 err = f_setown(sock->file, pid, 1);
1070 break;
1071 case FIOGETOWN:
1072 case SIOCGPGRP:
609d7fa9 1073 err = put_user(f_getown(sock->file),
89bddce5 1074 (int __user *)argp);
1da177e4
LT
1075 break;
1076 case SIOCGIFBR:
1077 case SIOCSIFBR:
1078 case SIOCBRADDBR:
1079 case SIOCBRDELBR:
1080 err = -ENOPKG;
1081 if (!br_ioctl_hook)
1082 request_module("bridge");
1083
4a3e2f71 1084 mutex_lock(&br_ioctl_mutex);
89bddce5 1085 if (br_ioctl_hook)
881d966b 1086 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1087 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1088 break;
1089 case SIOCGIFVLAN:
1090 case SIOCSIFVLAN:
1091 err = -ENOPKG;
1092 if (!vlan_ioctl_hook)
1093 request_module("8021q");
1094
4a3e2f71 1095 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1096 if (vlan_ioctl_hook)
881d966b 1097 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1098 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1099 break;
1da177e4
LT
1100 case SIOCADDDLCI:
1101 case SIOCDELDLCI:
1102 err = -ENOPKG;
1103 if (!dlci_ioctl_hook)
1104 request_module("dlci");
1105
7512cbf6
PE
1106 mutex_lock(&dlci_ioctl_mutex);
1107 if (dlci_ioctl_hook)
1da177e4 1108 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1109 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1110 break;
1111 default:
6b96018b 1112 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1113 break;
89bddce5 1114 }
1da177e4
LT
1115 return err;
1116}
1117
1118int sock_create_lite(int family, int type, int protocol, struct socket **res)
1119{
1120 int err;
1121 struct socket *sock = NULL;
89bddce5 1122
1da177e4
LT
1123 err = security_socket_create(family, type, protocol, 1);
1124 if (err)
1125 goto out;
1126
1127 sock = sock_alloc();
1128 if (!sock) {
1129 err = -ENOMEM;
1130 goto out;
1131 }
1132
1da177e4 1133 sock->type = type;
7420ed23
VY
1134 err = security_socket_post_create(sock, family, type, protocol, 1);
1135 if (err)
1136 goto out_release;
1137
1da177e4
LT
1138out:
1139 *res = sock;
1140 return err;
7420ed23
VY
1141out_release:
1142 sock_release(sock);
1143 sock = NULL;
1144 goto out;
1da177e4 1145}
c6d409cf 1146EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1147
1148/* No kernel lock held - perfect */
89bddce5 1149static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 1150{
2d48d67f 1151 unsigned int ll_flag = 0;
1da177e4
LT
1152 struct socket *sock;
1153
1154 /*
89bddce5 1155 * We can't return errors to poll, so it's either yes or no.
1da177e4 1156 */
b69aee04 1157 sock = file->private_data;
2d48d67f
ET
1158
1159 if (sk_valid_ll(sock->sk)) {
1160 /* this socket can poll_ll so tell the system call */
1161 ll_flag = POLL_LL;
1162
1163 /* once, only if requested by syscall */
1164 if (wait && (wait->_key & POLL_LL))
1165 sk_poll_ll(sock->sk, 1);
1166 }
1167
1168 return ll_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1169}
1170
89bddce5 1171static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1172{
b69aee04 1173 struct socket *sock = file->private_data;
1da177e4
LT
1174
1175 return sock->ops->mmap(file, sock, vma);
1176}
1177
20380731 1178static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1179{
1da177e4
LT
1180 sock_release(SOCKET_I(inode));
1181 return 0;
1182}
1183
1184/*
1185 * Update the socket async list
1186 *
1187 * Fasync_list locking strategy.
1188 *
1189 * 1. fasync_list is modified only under process context socket lock
1190 * i.e. under semaphore.
1191 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1192 * or under socket lock
1da177e4
LT
1193 */
1194
1195static int sock_fasync(int fd, struct file *filp, int on)
1196{
989a2979
ED
1197 struct socket *sock = filp->private_data;
1198 struct sock *sk = sock->sk;
eaefd110 1199 struct socket_wq *wq;
1da177e4 1200
989a2979 1201 if (sk == NULL)
1da177e4 1202 return -EINVAL;
1da177e4
LT
1203
1204 lock_sock(sk);
eaefd110
ED
1205 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1206 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1207
eaefd110 1208 if (!wq->fasync_list)
989a2979
ED
1209 sock_reset_flag(sk, SOCK_FASYNC);
1210 else
bcdce719 1211 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1212
989a2979 1213 release_sock(sk);
1da177e4
LT
1214 return 0;
1215}
1216
43815482 1217/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1218
1219int sock_wake_async(struct socket *sock, int how, int band)
1220{
43815482
ED
1221 struct socket_wq *wq;
1222
1223 if (!sock)
1224 return -1;
1225 rcu_read_lock();
1226 wq = rcu_dereference(sock->wq);
1227 if (!wq || !wq->fasync_list) {
1228 rcu_read_unlock();
1da177e4 1229 return -1;
43815482 1230 }
89bddce5 1231 switch (how) {
8d8ad9d7 1232 case SOCK_WAKE_WAITD:
1da177e4
LT
1233 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1234 break;
1235 goto call_kill;
8d8ad9d7 1236 case SOCK_WAKE_SPACE:
1da177e4
LT
1237 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1238 break;
1239 /* fall through */
8d8ad9d7 1240 case SOCK_WAKE_IO:
89bddce5 1241call_kill:
43815482 1242 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1243 break;
8d8ad9d7 1244 case SOCK_WAKE_URG:
43815482 1245 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1246 }
43815482 1247 rcu_read_unlock();
1da177e4
LT
1248 return 0;
1249}
c6d409cf 1250EXPORT_SYMBOL(sock_wake_async);
1da177e4 1251
721db93a 1252int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1253 struct socket **res, int kern)
1da177e4
LT
1254{
1255 int err;
1256 struct socket *sock;
55737fda 1257 const struct net_proto_family *pf;
1da177e4
LT
1258
1259 /*
89bddce5 1260 * Check protocol is in range
1da177e4
LT
1261 */
1262 if (family < 0 || family >= NPROTO)
1263 return -EAFNOSUPPORT;
1264 if (type < 0 || type >= SOCK_MAX)
1265 return -EINVAL;
1266
1267 /* Compatibility.
1268
1269 This uglymoron is moved from INET layer to here to avoid
1270 deadlock in module load.
1271 */
1272 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1273 static int warned;
1da177e4
LT
1274 if (!warned) {
1275 warned = 1;
89bddce5
SH
1276 printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1277 current->comm);
1da177e4
LT
1278 }
1279 family = PF_PACKET;
1280 }
1281
1282 err = security_socket_create(family, type, protocol, kern);
1283 if (err)
1284 return err;
89bddce5 1285
55737fda
SH
1286 /*
1287 * Allocate the socket and allow the family to set things up. if
1288 * the protocol is 0, the family is instructed to select an appropriate
1289 * default.
1290 */
1291 sock = sock_alloc();
1292 if (!sock) {
e87cc472 1293 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1294 return -ENFILE; /* Not exactly a match, but its the
1295 closest posix thing */
1296 }
1297
1298 sock->type = type;
1299
95a5afca 1300#ifdef CONFIG_MODULES
89bddce5
SH
1301 /* Attempt to load a protocol module if the find failed.
1302 *
1303 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1304 * requested real, full-featured networking support upon configuration.
1305 * Otherwise module support will break!
1306 */
190683a9 1307 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1308 request_module("net-pf-%d", family);
1da177e4
LT
1309#endif
1310
55737fda
SH
1311 rcu_read_lock();
1312 pf = rcu_dereference(net_families[family]);
1313 err = -EAFNOSUPPORT;
1314 if (!pf)
1315 goto out_release;
1da177e4
LT
1316
1317 /*
1318 * We will call the ->create function, that possibly is in a loadable
1319 * module, so we have to bump that loadable module refcnt first.
1320 */
55737fda 1321 if (!try_module_get(pf->owner))
1da177e4
LT
1322 goto out_release;
1323
55737fda
SH
1324 /* Now protected by module ref count */
1325 rcu_read_unlock();
1326
3f378b68 1327 err = pf->create(net, sock, protocol, kern);
55737fda 1328 if (err < 0)
1da177e4 1329 goto out_module_put;
a79af59e 1330
1da177e4
LT
1331 /*
1332 * Now to bump the refcnt of the [loadable] module that owns this
1333 * socket at sock_release time we decrement its refcnt.
1334 */
55737fda
SH
1335 if (!try_module_get(sock->ops->owner))
1336 goto out_module_busy;
1337
1da177e4
LT
1338 /*
1339 * Now that we're done with the ->create function, the [loadable]
1340 * module can have its refcnt decremented
1341 */
55737fda 1342 module_put(pf->owner);
7420ed23
VY
1343 err = security_socket_post_create(sock, family, type, protocol, kern);
1344 if (err)
3b185525 1345 goto out_sock_release;
55737fda 1346 *res = sock;
1da177e4 1347
55737fda
SH
1348 return 0;
1349
1350out_module_busy:
1351 err = -EAFNOSUPPORT;
1da177e4 1352out_module_put:
55737fda
SH
1353 sock->ops = NULL;
1354 module_put(pf->owner);
1355out_sock_release:
1da177e4 1356 sock_release(sock);
55737fda
SH
1357 return err;
1358
1359out_release:
1360 rcu_read_unlock();
1361 goto out_sock_release;
1da177e4 1362}
721db93a 1363EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1364
1365int sock_create(int family, int type, int protocol, struct socket **res)
1366{
1b8d7ae4 1367 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1368}
c6d409cf 1369EXPORT_SYMBOL(sock_create);
1da177e4
LT
1370
1371int sock_create_kern(int family, int type, int protocol, struct socket **res)
1372{
1b8d7ae4 1373 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1374}
c6d409cf 1375EXPORT_SYMBOL(sock_create_kern);
1da177e4 1376
3e0fa65f 1377SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1378{
1379 int retval;
1380 struct socket *sock;
a677a039
UD
1381 int flags;
1382
e38b36f3
UD
1383 /* Check the SOCK_* constants for consistency. */
1384 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1385 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1386 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1387 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1388
a677a039 1389 flags = type & ~SOCK_TYPE_MASK;
77d27200 1390 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1391 return -EINVAL;
1392 type &= SOCK_TYPE_MASK;
1da177e4 1393
aaca0bdc
UD
1394 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1395 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1396
1da177e4
LT
1397 retval = sock_create(family, type, protocol, &sock);
1398 if (retval < 0)
1399 goto out;
1400
77d27200 1401 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1402 if (retval < 0)
1403 goto out_release;
1404
1405out:
1406 /* It may be already another descriptor 8) Not kernel problem. */
1407 return retval;
1408
1409out_release:
1410 sock_release(sock);
1411 return retval;
1412}
1413
1414/*
1415 * Create a pair of connected sockets.
1416 */
1417
3e0fa65f
HC
1418SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1419 int __user *, usockvec)
1da177e4
LT
1420{
1421 struct socket *sock1, *sock2;
1422 int fd1, fd2, err;
db349509 1423 struct file *newfile1, *newfile2;
a677a039
UD
1424 int flags;
1425
1426 flags = type & ~SOCK_TYPE_MASK;
77d27200 1427 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1428 return -EINVAL;
1429 type &= SOCK_TYPE_MASK;
1da177e4 1430
aaca0bdc
UD
1431 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1432 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1433
1da177e4
LT
1434 /*
1435 * Obtain the first socket and check if the underlying protocol
1436 * supports the socketpair call.
1437 */
1438
1439 err = sock_create(family, type, protocol, &sock1);
1440 if (err < 0)
1441 goto out;
1442
1443 err = sock_create(family, type, protocol, &sock2);
1444 if (err < 0)
1445 goto out_release_1;
1446
1447 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1448 if (err < 0)
1da177e4
LT
1449 goto out_release_both;
1450
28407630 1451 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1452 if (unlikely(fd1 < 0)) {
1453 err = fd1;
db349509 1454 goto out_release_both;
bf3c23d1 1455 }
28407630 1456 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1457 if (unlikely(fd2 < 0)) {
1458 err = fd2;
28407630
AV
1459 put_unused_fd(fd1);
1460 goto out_release_both;
1461 }
1462
aab174f0 1463 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1464 if (unlikely(IS_ERR(newfile1))) {
1465 err = PTR_ERR(newfile1);
1466 put_unused_fd(fd1);
1467 put_unused_fd(fd2);
1468 goto out_release_both;
1469 }
1470
aab174f0 1471 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1472 if (IS_ERR(newfile2)) {
1473 err = PTR_ERR(newfile2);
198de4d7
AV
1474 fput(newfile1);
1475 put_unused_fd(fd1);
28407630 1476 put_unused_fd(fd2);
198de4d7
AV
1477 sock_release(sock2);
1478 goto out;
db349509
AV
1479 }
1480
157cf649 1481 audit_fd_pair(fd1, fd2);
db349509
AV
1482 fd_install(fd1, newfile1);
1483 fd_install(fd2, newfile2);
1da177e4
LT
1484 /* fd1 and fd2 may be already another descriptors.
1485 * Not kernel problem.
1486 */
1487
89bddce5 1488 err = put_user(fd1, &usockvec[0]);
1da177e4
LT
1489 if (!err)
1490 err = put_user(fd2, &usockvec[1]);
1491 if (!err)
1492 return 0;
1493
1494 sys_close(fd2);
1495 sys_close(fd1);
1496 return err;
1497
1da177e4 1498out_release_both:
89bddce5 1499 sock_release(sock2);
1da177e4 1500out_release_1:
89bddce5 1501 sock_release(sock1);
1da177e4
LT
1502out:
1503 return err;
1504}
1505
1da177e4
LT
1506/*
1507 * Bind a name to a socket. Nothing much to do here since it's
1508 * the protocol's responsibility to handle the local address.
1509 *
1510 * We move the socket address to kernel space before we call
1511 * the protocol layer (having also checked the address is ok).
1512 */
1513
20f37034 1514SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1515{
1516 struct socket *sock;
230b1839 1517 struct sockaddr_storage address;
6cb153ca 1518 int err, fput_needed;
1da177e4 1519
89bddce5 1520 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1521 if (sock) {
43db362d 1522 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1523 if (err >= 0) {
1524 err = security_socket_bind(sock,
230b1839 1525 (struct sockaddr *)&address,
89bddce5 1526 addrlen);
6cb153ca
BL
1527 if (!err)
1528 err = sock->ops->bind(sock,
89bddce5 1529 (struct sockaddr *)
230b1839 1530 &address, addrlen);
1da177e4 1531 }
6cb153ca 1532 fput_light(sock->file, fput_needed);
89bddce5 1533 }
1da177e4
LT
1534 return err;
1535}
1536
1da177e4
LT
1537/*
1538 * Perform a listen. Basically, we allow the protocol to do anything
1539 * necessary for a listen, and if that works, we mark the socket as
1540 * ready for listening.
1541 */
1542
3e0fa65f 1543SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1544{
1545 struct socket *sock;
6cb153ca 1546 int err, fput_needed;
b8e1f9b5 1547 int somaxconn;
89bddce5
SH
1548
1549 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1550 if (sock) {
8efa6e93 1551 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1552 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1553 backlog = somaxconn;
1da177e4
LT
1554
1555 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1556 if (!err)
1557 err = sock->ops->listen(sock, backlog);
1da177e4 1558
6cb153ca 1559 fput_light(sock->file, fput_needed);
1da177e4
LT
1560 }
1561 return err;
1562}
1563
1da177e4
LT
1564/*
1565 * For accept, we attempt to create a new socket, set up the link
1566 * with the client, wake up the client, then return the new
1567 * connected fd. We collect the address of the connector in kernel
1568 * space and move it to user at the very end. This is unclean because
1569 * we open the socket then return an error.
1570 *
1571 * 1003.1g adds the ability to recvmsg() to query connection pending
1572 * status to recvmsg. We need to add that support in a way thats
1573 * clean when we restucture accept also.
1574 */
1575
20f37034
HC
1576SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1577 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1578{
1579 struct socket *sock, *newsock;
39d8c1b6 1580 struct file *newfile;
6cb153ca 1581 int err, len, newfd, fput_needed;
230b1839 1582 struct sockaddr_storage address;
1da177e4 1583
77d27200 1584 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1585 return -EINVAL;
1586
1587 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1588 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1589
6cb153ca 1590 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1591 if (!sock)
1592 goto out;
1593
1594 err = -ENFILE;
c6d409cf
ED
1595 newsock = sock_alloc();
1596 if (!newsock)
1da177e4
LT
1597 goto out_put;
1598
1599 newsock->type = sock->type;
1600 newsock->ops = sock->ops;
1601
1da177e4
LT
1602 /*
1603 * We don't need try_module_get here, as the listening socket (sock)
1604 * has the protocol module (sock->ops->owner) held.
1605 */
1606 __module_get(newsock->ops->owner);
1607
28407630 1608 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1609 if (unlikely(newfd < 0)) {
1610 err = newfd;
9a1875e6
DM
1611 sock_release(newsock);
1612 goto out_put;
39d8c1b6 1613 }
aab174f0 1614 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1615 if (unlikely(IS_ERR(newfile))) {
1616 err = PTR_ERR(newfile);
1617 put_unused_fd(newfd);
1618 sock_release(newsock);
1619 goto out_put;
1620 }
39d8c1b6 1621
a79af59e
FF
1622 err = security_socket_accept(sock, newsock);
1623 if (err)
39d8c1b6 1624 goto out_fd;
a79af59e 1625
1da177e4
LT
1626 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1627 if (err < 0)
39d8c1b6 1628 goto out_fd;
1da177e4
LT
1629
1630 if (upeer_sockaddr) {
230b1839 1631 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1632 &len, 2) < 0) {
1da177e4 1633 err = -ECONNABORTED;
39d8c1b6 1634 goto out_fd;
1da177e4 1635 }
43db362d 1636 err = move_addr_to_user(&address,
230b1839 1637 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1638 if (err < 0)
39d8c1b6 1639 goto out_fd;
1da177e4
LT
1640 }
1641
1642 /* File flags are not inherited via accept() unlike another OSes. */
1643
39d8c1b6
DM
1644 fd_install(newfd, newfile);
1645 err = newfd;
1da177e4 1646
1da177e4 1647out_put:
6cb153ca 1648 fput_light(sock->file, fput_needed);
1da177e4
LT
1649out:
1650 return err;
39d8c1b6 1651out_fd:
9606a216 1652 fput(newfile);
39d8c1b6 1653 put_unused_fd(newfd);
1da177e4
LT
1654 goto out_put;
1655}
1656
20f37034
HC
1657SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1658 int __user *, upeer_addrlen)
aaca0bdc 1659{
de11defe 1660 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1661}
1662
1da177e4
LT
1663/*
1664 * Attempt to connect to a socket with the server address. The address
1665 * is in user space so we verify it is OK and move it to kernel space.
1666 *
1667 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1668 * break bindings
1669 *
1670 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1671 * other SEQPACKET protocols that take time to connect() as it doesn't
1672 * include the -EINPROGRESS status for such sockets.
1673 */
1674
20f37034
HC
1675SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1676 int, addrlen)
1da177e4
LT
1677{
1678 struct socket *sock;
230b1839 1679 struct sockaddr_storage address;
6cb153ca 1680 int err, fput_needed;
1da177e4 1681
6cb153ca 1682 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1683 if (!sock)
1684 goto out;
43db362d 1685 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1686 if (err < 0)
1687 goto out_put;
1688
89bddce5 1689 err =
230b1839 1690 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1691 if (err)
1692 goto out_put;
1693
230b1839 1694 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1695 sock->file->f_flags);
1696out_put:
6cb153ca 1697 fput_light(sock->file, fput_needed);
1da177e4
LT
1698out:
1699 return err;
1700}
1701
1702/*
1703 * Get the local address ('name') of a socket object. Move the obtained
1704 * name to user space.
1705 */
1706
20f37034
HC
1707SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1708 int __user *, usockaddr_len)
1da177e4
LT
1709{
1710 struct socket *sock;
230b1839 1711 struct sockaddr_storage address;
6cb153ca 1712 int len, err, fput_needed;
89bddce5 1713
6cb153ca 1714 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1715 if (!sock)
1716 goto out;
1717
1718 err = security_socket_getsockname(sock);
1719 if (err)
1720 goto out_put;
1721
230b1839 1722 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1723 if (err)
1724 goto out_put;
43db362d 1725 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1726
1727out_put:
6cb153ca 1728 fput_light(sock->file, fput_needed);
1da177e4
LT
1729out:
1730 return err;
1731}
1732
1733/*
1734 * Get the remote address ('name') of a socket object. Move the obtained
1735 * name to user space.
1736 */
1737
20f37034
HC
1738SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1739 int __user *, usockaddr_len)
1da177e4
LT
1740{
1741 struct socket *sock;
230b1839 1742 struct sockaddr_storage address;
6cb153ca 1743 int len, err, fput_needed;
1da177e4 1744
89bddce5
SH
1745 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1746 if (sock != NULL) {
1da177e4
LT
1747 err = security_socket_getpeername(sock);
1748 if (err) {
6cb153ca 1749 fput_light(sock->file, fput_needed);
1da177e4
LT
1750 return err;
1751 }
1752
89bddce5 1753 err =
230b1839 1754 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1755 1);
1da177e4 1756 if (!err)
43db362d 1757 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1758 usockaddr_len);
6cb153ca 1759 fput_light(sock->file, fput_needed);
1da177e4
LT
1760 }
1761 return err;
1762}
1763
1764/*
1765 * Send a datagram to a given address. We move the address into kernel
1766 * space and check the user space data area is readable before invoking
1767 * the protocol.
1768 */
1769
3e0fa65f 1770SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1771 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1772 int, addr_len)
1da177e4
LT
1773{
1774 struct socket *sock;
230b1839 1775 struct sockaddr_storage address;
1da177e4
LT
1776 int err;
1777 struct msghdr msg;
1778 struct iovec iov;
6cb153ca 1779 int fput_needed;
6cb153ca 1780
253eacc0
LT
1781 if (len > INT_MAX)
1782 len = INT_MAX;
de0fa95c
PE
1783 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1784 if (!sock)
4387ff75 1785 goto out;
6cb153ca 1786
89bddce5
SH
1787 iov.iov_base = buff;
1788 iov.iov_len = len;
1789 msg.msg_name = NULL;
1790 msg.msg_iov = &iov;
1791 msg.msg_iovlen = 1;
1792 msg.msg_control = NULL;
1793 msg.msg_controllen = 0;
1794 msg.msg_namelen = 0;
6cb153ca 1795 if (addr) {
43db362d 1796 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1797 if (err < 0)
1798 goto out_put;
230b1839 1799 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1800 msg.msg_namelen = addr_len;
1da177e4
LT
1801 }
1802 if (sock->file->f_flags & O_NONBLOCK)
1803 flags |= MSG_DONTWAIT;
1804 msg.msg_flags = flags;
1805 err = sock_sendmsg(sock, &msg, len);
1806
89bddce5 1807out_put:
de0fa95c 1808 fput_light(sock->file, fput_needed);
4387ff75 1809out:
1da177e4
LT
1810 return err;
1811}
1812
1813/*
89bddce5 1814 * Send a datagram down a socket.
1da177e4
LT
1815 */
1816
3e0fa65f 1817SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1818 unsigned int, flags)
1da177e4
LT
1819{
1820 return sys_sendto(fd, buff, len, flags, NULL, 0);
1821}
1822
1823/*
89bddce5 1824 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1825 * sender. We verify the buffers are writable and if needed move the
1826 * sender address from kernel to user space.
1827 */
1828
3e0fa65f 1829SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1830 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1831 int __user *, addr_len)
1da177e4
LT
1832{
1833 struct socket *sock;
1834 struct iovec iov;
1835 struct msghdr msg;
230b1839 1836 struct sockaddr_storage address;
89bddce5 1837 int err, err2;
6cb153ca
BL
1838 int fput_needed;
1839
253eacc0
LT
1840 if (size > INT_MAX)
1841 size = INT_MAX;
de0fa95c 1842 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1843 if (!sock)
de0fa95c 1844 goto out;
1da177e4 1845
89bddce5
SH
1846 msg.msg_control = NULL;
1847 msg.msg_controllen = 0;
1848 msg.msg_iovlen = 1;
1849 msg.msg_iov = &iov;
1850 iov.iov_len = size;
1851 iov.iov_base = ubuf;
230b1839
YH
1852 msg.msg_name = (struct sockaddr *)&address;
1853 msg.msg_namelen = sizeof(address);
1da177e4
LT
1854 if (sock->file->f_flags & O_NONBLOCK)
1855 flags |= MSG_DONTWAIT;
89bddce5 1856 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1857
89bddce5 1858 if (err >= 0 && addr != NULL) {
43db362d 1859 err2 = move_addr_to_user(&address,
230b1839 1860 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1861 if (err2 < 0)
1862 err = err2;
1da177e4 1863 }
de0fa95c
PE
1864
1865 fput_light(sock->file, fput_needed);
4387ff75 1866out:
1da177e4
LT
1867 return err;
1868}
1869
1870/*
89bddce5 1871 * Receive a datagram from a socket.
1da177e4
LT
1872 */
1873
89bddce5 1874asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
95c96174 1875 unsigned int flags)
1da177e4
LT
1876{
1877 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1878}
1879
1880/*
1881 * Set a socket option. Because we don't know the option lengths we have
1882 * to pass the user mode parameter for the protocols to sort out.
1883 */
1884
20f37034
HC
1885SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1886 char __user *, optval, int, optlen)
1da177e4 1887{
6cb153ca 1888 int err, fput_needed;
1da177e4
LT
1889 struct socket *sock;
1890
1891 if (optlen < 0)
1892 return -EINVAL;
89bddce5
SH
1893
1894 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1895 if (sock != NULL) {
1896 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1897 if (err)
1898 goto out_put;
1da177e4
LT
1899
1900 if (level == SOL_SOCKET)
89bddce5
SH
1901 err =
1902 sock_setsockopt(sock, level, optname, optval,
1903 optlen);
1da177e4 1904 else
89bddce5
SH
1905 err =
1906 sock->ops->setsockopt(sock, level, optname, optval,
1907 optlen);
6cb153ca
BL
1908out_put:
1909 fput_light(sock->file, fput_needed);
1da177e4
LT
1910 }
1911 return err;
1912}
1913
1914/*
1915 * Get a socket option. Because we don't know the option lengths we have
1916 * to pass a user mode parameter for the protocols to sort out.
1917 */
1918
20f37034
HC
1919SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1920 char __user *, optval, int __user *, optlen)
1da177e4 1921{
6cb153ca 1922 int err, fput_needed;
1da177e4
LT
1923 struct socket *sock;
1924
89bddce5
SH
1925 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1926 if (sock != NULL) {
6cb153ca
BL
1927 err = security_socket_getsockopt(sock, level, optname);
1928 if (err)
1929 goto out_put;
1da177e4
LT
1930
1931 if (level == SOL_SOCKET)
89bddce5
SH
1932 err =
1933 sock_getsockopt(sock, level, optname, optval,
1934 optlen);
1da177e4 1935 else
89bddce5
SH
1936 err =
1937 sock->ops->getsockopt(sock, level, optname, optval,
1938 optlen);
6cb153ca
BL
1939out_put:
1940 fput_light(sock->file, fput_needed);
1da177e4
LT
1941 }
1942 return err;
1943}
1944
1da177e4
LT
1945/*
1946 * Shutdown a socket.
1947 */
1948
754fe8d2 1949SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1950{
6cb153ca 1951 int err, fput_needed;
1da177e4
LT
1952 struct socket *sock;
1953
89bddce5
SH
1954 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1955 if (sock != NULL) {
1da177e4 1956 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1957 if (!err)
1958 err = sock->ops->shutdown(sock, how);
1959 fput_light(sock->file, fput_needed);
1da177e4
LT
1960 }
1961 return err;
1962}
1963
89bddce5 1964/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1965 * fields which are the same type (int / unsigned) on our platforms.
1966 */
1967#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1968#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1969#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1970
c71d8ebe
TH
1971struct used_address {
1972 struct sockaddr_storage name;
1973 unsigned int name_len;
1974};
1975
a7526eb5 1976static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 1977 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1978 struct used_address *used_address)
1da177e4 1979{
89bddce5
SH
1980 struct compat_msghdr __user *msg_compat =
1981 (struct compat_msghdr __user *)msg;
230b1839 1982 struct sockaddr_storage address;
1da177e4 1983 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1984 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1985 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1986 /* 20 is size of ipv6_pktinfo */
1da177e4 1987 unsigned char *ctl_buf = ctl;
a74e9106 1988 int err, ctl_len, total_len;
89bddce5 1989
1da177e4
LT
1990 err = -EFAULT;
1991 if (MSG_CMSG_COMPAT & flags) {
228e548e 1992 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 1993 return -EFAULT;
228e548e 1994 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
1da177e4
LT
1995 return -EFAULT;
1996
228e548e 1997 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
1998 err = -EMSGSIZE;
1999 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2000 goto out;
2001 err = -ENOMEM;
2002 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2003 GFP_KERNEL);
1da177e4 2004 if (!iov)
228e548e 2005 goto out;
1da177e4
LT
2006 }
2007
2008 /* This will also move the address data into kernel space */
2009 if (MSG_CMSG_COMPAT & flags) {
43db362d 2010 err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
1da177e4 2011 } else
43db362d 2012 err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
89bddce5 2013 if (err < 0)
1da177e4
LT
2014 goto out_freeiov;
2015 total_len = err;
2016
2017 err = -ENOBUFS;
2018
228e548e 2019 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 2020 goto out_freeiov;
228e548e 2021 ctl_len = msg_sys->msg_controllen;
1da177e4 2022 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2023 err =
228e548e 2024 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2025 sizeof(ctl));
1da177e4
LT
2026 if (err)
2027 goto out_freeiov;
228e548e
AB
2028 ctl_buf = msg_sys->msg_control;
2029 ctl_len = msg_sys->msg_controllen;
1da177e4 2030 } else if (ctl_len) {
89bddce5 2031 if (ctl_len > sizeof(ctl)) {
1da177e4 2032 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2033 if (ctl_buf == NULL)
1da177e4
LT
2034 goto out_freeiov;
2035 }
2036 err = -EFAULT;
2037 /*
228e548e 2038 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2039 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2040 * checking falls down on this.
2041 */
fb8621bb 2042 if (copy_from_user(ctl_buf,
228e548e 2043 (void __user __force *)msg_sys->msg_control,
89bddce5 2044 ctl_len))
1da177e4 2045 goto out_freectl;
228e548e 2046 msg_sys->msg_control = ctl_buf;
1da177e4 2047 }
228e548e 2048 msg_sys->msg_flags = flags;
1da177e4
LT
2049
2050 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2051 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2052 /*
2053 * If this is sendmmsg() and current destination address is same as
2054 * previously succeeded address, omit asking LSM's decision.
2055 * used_address->name_len is initialized to UINT_MAX so that the first
2056 * destination address never matches.
2057 */
bc909d9d
MD
2058 if (used_address && msg_sys->msg_name &&
2059 used_address->name_len == msg_sys->msg_namelen &&
2060 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2061 used_address->name_len)) {
2062 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2063 goto out_freectl;
2064 }
2065 err = sock_sendmsg(sock, msg_sys, total_len);
2066 /*
2067 * If this is sendmmsg() and sending to current destination address was
2068 * successful, remember it.
2069 */
2070 if (used_address && err >= 0) {
2071 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2072 if (msg_sys->msg_name)
2073 memcpy(&used_address->name, msg_sys->msg_name,
2074 used_address->name_len);
c71d8ebe 2075 }
1da177e4
LT
2076
2077out_freectl:
89bddce5 2078 if (ctl_buf != ctl)
1da177e4
LT
2079 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2080out_freeiov:
2081 if (iov != iovstack)
a74e9106 2082 kfree(iov);
228e548e
AB
2083out:
2084 return err;
2085}
2086
2087/*
2088 * BSD sendmsg interface
2089 */
2090
a7526eb5 2091long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
228e548e
AB
2092{
2093 int fput_needed, err;
2094 struct msghdr msg_sys;
1be374a0
AL
2095 struct socket *sock;
2096
1be374a0 2097 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2098 if (!sock)
2099 goto out;
2100
a7526eb5 2101 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2102
6cb153ca 2103 fput_light(sock->file, fput_needed);
89bddce5 2104out:
1da177e4
LT
2105 return err;
2106}
2107
a7526eb5
AL
2108SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
2109{
2110 if (flags & MSG_CMSG_COMPAT)
2111 return -EINVAL;
2112 return __sys_sendmsg(fd, msg, flags);
2113}
2114
228e548e
AB
2115/*
2116 * Linux sendmmsg interface
2117 */
2118
2119int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2120 unsigned int flags)
2121{
2122 int fput_needed, err, datagrams;
2123 struct socket *sock;
2124 struct mmsghdr __user *entry;
2125 struct compat_mmsghdr __user *compat_entry;
2126 struct msghdr msg_sys;
c71d8ebe 2127 struct used_address used_address;
228e548e 2128
98382f41
AB
2129 if (vlen > UIO_MAXIOV)
2130 vlen = UIO_MAXIOV;
228e548e
AB
2131
2132 datagrams = 0;
2133
2134 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2135 if (!sock)
2136 return err;
2137
c71d8ebe 2138 used_address.name_len = UINT_MAX;
228e548e
AB
2139 entry = mmsg;
2140 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2141 err = 0;
228e548e
AB
2142
2143 while (datagrams < vlen) {
228e548e 2144 if (MSG_CMSG_COMPAT & flags) {
a7526eb5
AL
2145 err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
2146 &msg_sys, flags, &used_address);
228e548e
AB
2147 if (err < 0)
2148 break;
2149 err = __put_user(err, &compat_entry->msg_len);
2150 ++compat_entry;
2151 } else {
a7526eb5
AL
2152 err = ___sys_sendmsg(sock,
2153 (struct msghdr __user *)entry,
2154 &msg_sys, flags, &used_address);
228e548e
AB
2155 if (err < 0)
2156 break;
2157 err = put_user(err, &entry->msg_len);
2158 ++entry;
2159 }
2160
2161 if (err)
2162 break;
2163 ++datagrams;
2164 }
2165
228e548e
AB
2166 fput_light(sock->file, fput_needed);
2167
728ffb86
AB
2168 /* We only return an error if no datagrams were able to be sent */
2169 if (datagrams != 0)
228e548e
AB
2170 return datagrams;
2171
228e548e
AB
2172 return err;
2173}
2174
2175SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2176 unsigned int, vlen, unsigned int, flags)
2177{
1be374a0
AL
2178 if (flags & MSG_CMSG_COMPAT)
2179 return -EINVAL;
228e548e
AB
2180 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2181}
2182
a7526eb5 2183static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 2184 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2185{
89bddce5
SH
2186 struct compat_msghdr __user *msg_compat =
2187 (struct compat_msghdr __user *)msg;
1da177e4 2188 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2189 struct iovec *iov = iovstack;
1da177e4 2190 unsigned long cmsg_ptr;
a74e9106 2191 int err, total_len, len;
1da177e4
LT
2192
2193 /* kernel mode address */
230b1839 2194 struct sockaddr_storage addr;
1da177e4
LT
2195
2196 /* user mode address pointers */
2197 struct sockaddr __user *uaddr;
2198 int __user *uaddr_len;
89bddce5 2199
1da177e4 2200 if (MSG_CMSG_COMPAT & flags) {
a2e27255 2201 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2202 return -EFAULT;
c6d409cf 2203 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
89bddce5 2204 return -EFAULT;
1da177e4 2205
a2e27255 2206 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
2207 err = -EMSGSIZE;
2208 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2209 goto out;
2210 err = -ENOMEM;
2211 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2212 GFP_KERNEL);
1da177e4 2213 if (!iov)
a2e27255 2214 goto out;
1da177e4
LT
2215 }
2216
2217 /*
89bddce5
SH
2218 * Save the user-mode address (verify_iovec will change the
2219 * kernel msghdr to use the kernel address space)
1da177e4 2220 */
89bddce5 2221
a2e27255 2222 uaddr = (__force void __user *)msg_sys->msg_name;
1da177e4
LT
2223 uaddr_len = COMPAT_NAMELEN(msg);
2224 if (MSG_CMSG_COMPAT & flags) {
43db362d 2225 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4 2226 } else
43db362d 2227 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4
LT
2228 if (err < 0)
2229 goto out_freeiov;
89bddce5 2230 total_len = err;
1da177e4 2231
a2e27255
ACM
2232 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2233 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2234
1da177e4
LT
2235 if (sock->file->f_flags & O_NONBLOCK)
2236 flags |= MSG_DONTWAIT;
a2e27255
ACM
2237 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2238 total_len, flags);
1da177e4
LT
2239 if (err < 0)
2240 goto out_freeiov;
2241 len = err;
2242
2243 if (uaddr != NULL) {
43db362d 2244 err = move_addr_to_user(&addr,
a2e27255 2245 msg_sys->msg_namelen, uaddr,
89bddce5 2246 uaddr_len);
1da177e4
LT
2247 if (err < 0)
2248 goto out_freeiov;
2249 }
a2e27255 2250 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2251 COMPAT_FLAGS(msg));
1da177e4
LT
2252 if (err)
2253 goto out_freeiov;
2254 if (MSG_CMSG_COMPAT & flags)
a2e27255 2255 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2256 &msg_compat->msg_controllen);
2257 else
a2e27255 2258 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2259 &msg->msg_controllen);
2260 if (err)
2261 goto out_freeiov;
2262 err = len;
2263
2264out_freeiov:
2265 if (iov != iovstack)
a74e9106 2266 kfree(iov);
a2e27255
ACM
2267out:
2268 return err;
2269}
2270
2271/*
2272 * BSD recvmsg interface
2273 */
2274
a7526eb5 2275long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
a2e27255
ACM
2276{
2277 int fput_needed, err;
2278 struct msghdr msg_sys;
1be374a0
AL
2279 struct socket *sock;
2280
1be374a0 2281 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2282 if (!sock)
2283 goto out;
2284
a7526eb5 2285 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2286
6cb153ca 2287 fput_light(sock->file, fput_needed);
1da177e4
LT
2288out:
2289 return err;
2290}
2291
a7526eb5
AL
2292SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2293 unsigned int, flags)
2294{
2295 if (flags & MSG_CMSG_COMPAT)
2296 return -EINVAL;
2297 return __sys_recvmsg(fd, msg, flags);
2298}
2299
a2e27255
ACM
2300/*
2301 * Linux recvmmsg interface
2302 */
2303
2304int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2305 unsigned int flags, struct timespec *timeout)
2306{
2307 int fput_needed, err, datagrams;
2308 struct socket *sock;
2309 struct mmsghdr __user *entry;
d7256d0e 2310 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2311 struct msghdr msg_sys;
2312 struct timespec end_time;
2313
2314 if (timeout &&
2315 poll_select_set_timeout(&end_time, timeout->tv_sec,
2316 timeout->tv_nsec))
2317 return -EINVAL;
2318
2319 datagrams = 0;
2320
2321 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2322 if (!sock)
2323 return err;
2324
2325 err = sock_error(sock->sk);
2326 if (err)
2327 goto out_put;
2328
2329 entry = mmsg;
d7256d0e 2330 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2331
2332 while (datagrams < vlen) {
2333 /*
2334 * No need to ask LSM for more than the first datagram.
2335 */
d7256d0e 2336 if (MSG_CMSG_COMPAT & flags) {
a7526eb5
AL
2337 err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
2338 &msg_sys, flags & ~MSG_WAITFORONE,
2339 datagrams);
d7256d0e
JMG
2340 if (err < 0)
2341 break;
2342 err = __put_user(err, &compat_entry->msg_len);
2343 ++compat_entry;
2344 } else {
a7526eb5
AL
2345 err = ___sys_recvmsg(sock,
2346 (struct msghdr __user *)entry,
2347 &msg_sys, flags & ~MSG_WAITFORONE,
2348 datagrams);
d7256d0e
JMG
2349 if (err < 0)
2350 break;
2351 err = put_user(err, &entry->msg_len);
2352 ++entry;
2353 }
2354
a2e27255
ACM
2355 if (err)
2356 break;
a2e27255
ACM
2357 ++datagrams;
2358
71c5c159
BB
2359 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2360 if (flags & MSG_WAITFORONE)
2361 flags |= MSG_DONTWAIT;
2362
a2e27255
ACM
2363 if (timeout) {
2364 ktime_get_ts(timeout);
2365 *timeout = timespec_sub(end_time, *timeout);
2366 if (timeout->tv_sec < 0) {
2367 timeout->tv_sec = timeout->tv_nsec = 0;
2368 break;
2369 }
2370
2371 /* Timeout, return less than vlen datagrams */
2372 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2373 break;
2374 }
2375
2376 /* Out of band data, return right away */
2377 if (msg_sys.msg_flags & MSG_OOB)
2378 break;
2379 }
2380
2381out_put:
2382 fput_light(sock->file, fput_needed);
1da177e4 2383
a2e27255
ACM
2384 if (err == 0)
2385 return datagrams;
2386
2387 if (datagrams != 0) {
2388 /*
2389 * We may return less entries than requested (vlen) if the
2390 * sock is non block and there aren't enough datagrams...
2391 */
2392 if (err != -EAGAIN) {
2393 /*
2394 * ... or if recvmsg returns an error after we
2395 * received some datagrams, where we record the
2396 * error to return on the next call or if the
2397 * app asks about it using getsockopt(SO_ERROR).
2398 */
2399 sock->sk->sk_err = -err;
2400 }
2401
2402 return datagrams;
2403 }
2404
2405 return err;
2406}
2407
2408SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2409 unsigned int, vlen, unsigned int, flags,
2410 struct timespec __user *, timeout)
2411{
2412 int datagrams;
2413 struct timespec timeout_sys;
2414
1be374a0
AL
2415 if (flags & MSG_CMSG_COMPAT)
2416 return -EINVAL;
2417
a2e27255
ACM
2418 if (!timeout)
2419 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2420
2421 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2422 return -EFAULT;
2423
2424 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2425
2426 if (datagrams > 0 &&
2427 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2428 datagrams = -EFAULT;
2429
2430 return datagrams;
2431}
2432
2433#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2434/* Argument list sizes for sys_socketcall */
2435#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2436static const unsigned char nargs[21] = {
c6d409cf
ED
2437 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2438 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2439 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2440 AL(4), AL(5), AL(4)
89bddce5
SH
2441};
2442
1da177e4
LT
2443#undef AL
2444
2445/*
89bddce5 2446 * System call vectors.
1da177e4
LT
2447 *
2448 * Argument checking cleaned up. Saved 20% in size.
2449 * This function doesn't need to set the kernel lock because
89bddce5 2450 * it is set by the callees.
1da177e4
LT
2451 */
2452
3e0fa65f 2453SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2454{
2950fa9d 2455 unsigned long a[AUDITSC_ARGS];
89bddce5 2456 unsigned long a0, a1;
1da177e4 2457 int err;
47379052 2458 unsigned int len;
1da177e4 2459
228e548e 2460 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2461 return -EINVAL;
2462
47379052
AV
2463 len = nargs[call];
2464 if (len > sizeof(a))
2465 return -EINVAL;
2466
1da177e4 2467 /* copy_from_user should be SMP safe. */
47379052 2468 if (copy_from_user(a, args, len))
1da177e4 2469 return -EFAULT;
3ec3b2fb 2470
2950fa9d
CG
2471 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2472 if (err)
2473 return err;
3ec3b2fb 2474
89bddce5
SH
2475 a0 = a[0];
2476 a1 = a[1];
2477
2478 switch (call) {
2479 case SYS_SOCKET:
2480 err = sys_socket(a0, a1, a[2]);
2481 break;
2482 case SYS_BIND:
2483 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2484 break;
2485 case SYS_CONNECT:
2486 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2487 break;
2488 case SYS_LISTEN:
2489 err = sys_listen(a0, a1);
2490 break;
2491 case SYS_ACCEPT:
de11defe
UD
2492 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2493 (int __user *)a[2], 0);
89bddce5
SH
2494 break;
2495 case SYS_GETSOCKNAME:
2496 err =
2497 sys_getsockname(a0, (struct sockaddr __user *)a1,
2498 (int __user *)a[2]);
2499 break;
2500 case SYS_GETPEERNAME:
2501 err =
2502 sys_getpeername(a0, (struct sockaddr __user *)a1,
2503 (int __user *)a[2]);
2504 break;
2505 case SYS_SOCKETPAIR:
2506 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2507 break;
2508 case SYS_SEND:
2509 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2510 break;
2511 case SYS_SENDTO:
2512 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2513 (struct sockaddr __user *)a[4], a[5]);
2514 break;
2515 case SYS_RECV:
2516 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2517 break;
2518 case SYS_RECVFROM:
2519 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2520 (struct sockaddr __user *)a[4],
2521 (int __user *)a[5]);
2522 break;
2523 case SYS_SHUTDOWN:
2524 err = sys_shutdown(a0, a1);
2525 break;
2526 case SYS_SETSOCKOPT:
2527 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2528 break;
2529 case SYS_GETSOCKOPT:
2530 err =
2531 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2532 (int __user *)a[4]);
2533 break;
2534 case SYS_SENDMSG:
2535 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2536 break;
228e548e
AB
2537 case SYS_SENDMMSG:
2538 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2539 break;
89bddce5
SH
2540 case SYS_RECVMSG:
2541 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2542 break;
a2e27255
ACM
2543 case SYS_RECVMMSG:
2544 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2545 (struct timespec __user *)a[4]);
2546 break;
de11defe
UD
2547 case SYS_ACCEPT4:
2548 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2549 (int __user *)a[2], a[3]);
aaca0bdc 2550 break;
89bddce5
SH
2551 default:
2552 err = -EINVAL;
2553 break;
1da177e4
LT
2554 }
2555 return err;
2556}
2557
89bddce5 2558#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2559
55737fda
SH
2560/**
2561 * sock_register - add a socket protocol handler
2562 * @ops: description of protocol
2563 *
1da177e4
LT
2564 * This function is called by a protocol handler that wants to
2565 * advertise its address family, and have it linked into the
55737fda
SH
2566 * socket interface. The value ops->family coresponds to the
2567 * socket system call protocol family.
1da177e4 2568 */
f0fd27d4 2569int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2570{
2571 int err;
2572
2573 if (ops->family >= NPROTO) {
89bddce5
SH
2574 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2575 NPROTO);
1da177e4
LT
2576 return -ENOBUFS;
2577 }
55737fda
SH
2578
2579 spin_lock(&net_family_lock);
190683a9
ED
2580 if (rcu_dereference_protected(net_families[ops->family],
2581 lockdep_is_held(&net_family_lock)))
55737fda
SH
2582 err = -EEXIST;
2583 else {
cf778b00 2584 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2585 err = 0;
2586 }
55737fda
SH
2587 spin_unlock(&net_family_lock);
2588
89bddce5 2589 printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2590 return err;
2591}
c6d409cf 2592EXPORT_SYMBOL(sock_register);
1da177e4 2593
55737fda
SH
2594/**
2595 * sock_unregister - remove a protocol handler
2596 * @family: protocol family to remove
2597 *
1da177e4
LT
2598 * This function is called by a protocol handler that wants to
2599 * remove its address family, and have it unlinked from the
55737fda
SH
2600 * new socket creation.
2601 *
2602 * If protocol handler is a module, then it can use module reference
2603 * counts to protect against new references. If protocol handler is not
2604 * a module then it needs to provide its own protection in
2605 * the ops->create routine.
1da177e4 2606 */
f0fd27d4 2607void sock_unregister(int family)
1da177e4 2608{
f0fd27d4 2609 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2610
55737fda 2611 spin_lock(&net_family_lock);
a9b3cd7f 2612 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2613 spin_unlock(&net_family_lock);
2614
2615 synchronize_rcu();
2616
89bddce5 2617 printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
1da177e4 2618}
c6d409cf 2619EXPORT_SYMBOL(sock_unregister);
1da177e4 2620
77d76ea3 2621static int __init sock_init(void)
1da177e4 2622{
b3e19d92 2623 int err;
2ca794e5
EB
2624 /*
2625 * Initialize the network sysctl infrastructure.
2626 */
2627 err = net_sysctl_init();
2628 if (err)
2629 goto out;
b3e19d92 2630
1da177e4 2631 /*
89bddce5 2632 * Initialize skbuff SLAB cache
1da177e4
LT
2633 */
2634 skb_init();
1da177e4
LT
2635
2636 /*
89bddce5 2637 * Initialize the protocols module.
1da177e4
LT
2638 */
2639
2640 init_inodecache();
b3e19d92
NP
2641
2642 err = register_filesystem(&sock_fs_type);
2643 if (err)
2644 goto out_fs;
1da177e4 2645 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2646 if (IS_ERR(sock_mnt)) {
2647 err = PTR_ERR(sock_mnt);
2648 goto out_mount;
2649 }
77d76ea3
AK
2650
2651 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2652 */
2653
2654#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2655 err = netfilter_init();
2656 if (err)
2657 goto out;
1da177e4 2658#endif
cbeb321a 2659
c1f19b51
RC
2660#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2661 skb_timestamping_init();
2662#endif
2663
b3e19d92
NP
2664out:
2665 return err;
2666
2667out_mount:
2668 unregister_filesystem(&sock_fs_type);
2669out_fs:
2670 goto out;
1da177e4
LT
2671}
2672
77d76ea3
AK
2673core_initcall(sock_init); /* early initcall */
2674
1da177e4
LT
2675#ifdef CONFIG_PROC_FS
2676void socket_seq_show(struct seq_file *seq)
2677{
2678 int cpu;
2679 int counter = 0;
2680
6f912042 2681 for_each_possible_cpu(cpu)
89bddce5 2682 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2683
2684 /* It can be negative, by the way. 8) */
2685 if (counter < 0)
2686 counter = 0;
2687
2688 seq_printf(seq, "sockets: used %d\n", counter);
2689}
89bddce5 2690#endif /* CONFIG_PROC_FS */
1da177e4 2691
89bbfc95 2692#ifdef CONFIG_COMPAT
6b96018b 2693static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2694 unsigned int cmd, void __user *up)
7a229387 2695{
7a229387
AB
2696 mm_segment_t old_fs = get_fs();
2697 struct timeval ktv;
2698 int err;
2699
2700 set_fs(KERNEL_DS);
6b96018b 2701 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2702 set_fs(old_fs);
644595f8 2703 if (!err)
ed6fe9d6 2704 err = compat_put_timeval(&ktv, up);
644595f8 2705
7a229387
AB
2706 return err;
2707}
2708
6b96018b 2709static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2710 unsigned int cmd, void __user *up)
7a229387 2711{
7a229387
AB
2712 mm_segment_t old_fs = get_fs();
2713 struct timespec kts;
2714 int err;
2715
2716 set_fs(KERNEL_DS);
6b96018b 2717 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2718 set_fs(old_fs);
644595f8 2719 if (!err)
ed6fe9d6 2720 err = compat_put_timespec(&kts, up);
644595f8 2721
7a229387
AB
2722 return err;
2723}
2724
6b96018b 2725static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2726{
2727 struct ifreq __user *uifr;
2728 int err;
2729
2730 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2731 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2732 return -EFAULT;
2733
6b96018b 2734 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2735 if (err)
2736 return err;
2737
6b96018b 2738 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2739 return -EFAULT;
2740
2741 return 0;
2742}
2743
6b96018b 2744static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2745{
6b96018b 2746 struct compat_ifconf ifc32;
7a229387
AB
2747 struct ifconf ifc;
2748 struct ifconf __user *uifc;
6b96018b 2749 struct compat_ifreq __user *ifr32;
7a229387
AB
2750 struct ifreq __user *ifr;
2751 unsigned int i, j;
2752 int err;
2753
6b96018b 2754 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2755 return -EFAULT;
2756
43da5f2e 2757 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2758 if (ifc32.ifcbuf == 0) {
2759 ifc32.ifc_len = 0;
2760 ifc.ifc_len = 0;
2761 ifc.ifc_req = NULL;
2762 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2763 } else {
c6d409cf
ED
2764 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2765 sizeof(struct ifreq);
7a229387
AB
2766 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2767 ifc.ifc_len = len;
2768 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2769 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2770 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2771 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2772 return -EFAULT;
2773 ifr++;
2774 ifr32++;
2775 }
2776 }
2777 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2778 return -EFAULT;
2779
6b96018b 2780 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2781 if (err)
2782 return err;
2783
2784 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2785 return -EFAULT;
2786
2787 ifr = ifc.ifc_req;
2788 ifr32 = compat_ptr(ifc32.ifcbuf);
2789 for (i = 0, j = 0;
c6d409cf
ED
2790 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2791 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2792 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2793 return -EFAULT;
2794 ifr32++;
2795 ifr++;
2796 }
2797
2798 if (ifc32.ifcbuf == 0) {
2799 /* Translate from 64-bit structure multiple to
2800 * a 32-bit one.
2801 */
2802 i = ifc.ifc_len;
6b96018b 2803 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2804 ifc32.ifc_len = i;
2805 } else {
2806 ifc32.ifc_len = i;
2807 }
6b96018b 2808 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2809 return -EFAULT;
2810
2811 return 0;
2812}
2813
6b96018b 2814static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2815{
3a7da39d
BH
2816 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2817 bool convert_in = false, convert_out = false;
2818 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2819 struct ethtool_rxnfc __user *rxnfc;
7a229387 2820 struct ifreq __user *ifr;
3a7da39d
BH
2821 u32 rule_cnt = 0, actual_rule_cnt;
2822 u32 ethcmd;
7a229387 2823 u32 data;
3a7da39d 2824 int ret;
7a229387 2825
3a7da39d
BH
2826 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2827 return -EFAULT;
7a229387 2828
3a7da39d
BH
2829 compat_rxnfc = compat_ptr(data);
2830
2831 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2832 return -EFAULT;
2833
3a7da39d
BH
2834 /* Most ethtool structures are defined without padding.
2835 * Unfortunately struct ethtool_rxnfc is an exception.
2836 */
2837 switch (ethcmd) {
2838 default:
2839 break;
2840 case ETHTOOL_GRXCLSRLALL:
2841 /* Buffer size is variable */
2842 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2843 return -EFAULT;
2844 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2845 return -ENOMEM;
2846 buf_size += rule_cnt * sizeof(u32);
2847 /* fall through */
2848 case ETHTOOL_GRXRINGS:
2849 case ETHTOOL_GRXCLSRLCNT:
2850 case ETHTOOL_GRXCLSRULE:
55664f32 2851 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2852 convert_out = true;
2853 /* fall through */
2854 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2855 buf_size += sizeof(struct ethtool_rxnfc);
2856 convert_in = true;
2857 break;
2858 }
2859
2860 ifr = compat_alloc_user_space(buf_size);
954b1244 2861 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2862
2863 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2864 return -EFAULT;
2865
3a7da39d
BH
2866 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2867 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2868 return -EFAULT;
2869
3a7da39d 2870 if (convert_in) {
127fe533 2871 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2872 * fs.ring_cookie and at the end of fs, but nowhere else.
2873 */
127fe533
AD
2874 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2875 sizeof(compat_rxnfc->fs.m_ext) !=
2876 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2877 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2878 BUILD_BUG_ON(
2879 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2880 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2881 offsetof(struct ethtool_rxnfc, fs.location) -
2882 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2883
2884 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2885 (void __user *)(&rxnfc->fs.m_ext + 1) -
2886 (void __user *)rxnfc) ||
3a7da39d
BH
2887 copy_in_user(&rxnfc->fs.ring_cookie,
2888 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2889 (void __user *)(&rxnfc->fs.location + 1) -
2890 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2891 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2892 sizeof(rxnfc->rule_cnt)))
2893 return -EFAULT;
2894 }
2895
2896 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2897 if (ret)
2898 return ret;
2899
2900 if (convert_out) {
2901 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2902 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2903 (const void __user *)rxnfc) ||
3a7da39d
BH
2904 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2905 &rxnfc->fs.ring_cookie,
954b1244
SH
2906 (const void __user *)(&rxnfc->fs.location + 1) -
2907 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2908 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2909 sizeof(rxnfc->rule_cnt)))
2910 return -EFAULT;
2911
2912 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2913 /* As an optimisation, we only copy the actual
2914 * number of rules that the underlying
2915 * function returned. Since Mallory might
2916 * change the rule count in user memory, we
2917 * check that it is less than the rule count
2918 * originally given (as the user buffer size),
2919 * which has been range-checked.
2920 */
2921 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2922 return -EFAULT;
2923 if (actual_rule_cnt < rule_cnt)
2924 rule_cnt = actual_rule_cnt;
2925 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2926 &rxnfc->rule_locs[0],
2927 rule_cnt * sizeof(u32)))
2928 return -EFAULT;
2929 }
2930 }
2931
2932 return 0;
7a229387
AB
2933}
2934
7a50a240
AB
2935static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2936{
2937 void __user *uptr;
2938 compat_uptr_t uptr32;
2939 struct ifreq __user *uifr;
2940
c6d409cf 2941 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2942 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2943 return -EFAULT;
2944
2945 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2946 return -EFAULT;
2947
2948 uptr = compat_ptr(uptr32);
2949
2950 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2951 return -EFAULT;
2952
2953 return dev_ioctl(net, SIOCWANDEV, uifr);
2954}
2955
6b96018b
AB
2956static int bond_ioctl(struct net *net, unsigned int cmd,
2957 struct compat_ifreq __user *ifr32)
7a229387
AB
2958{
2959 struct ifreq kifr;
2960 struct ifreq __user *uifr;
7a229387
AB
2961 mm_segment_t old_fs;
2962 int err;
2963 u32 data;
2964 void __user *datap;
2965
2966 switch (cmd) {
2967 case SIOCBONDENSLAVE:
2968 case SIOCBONDRELEASE:
2969 case SIOCBONDSETHWADDR:
2970 case SIOCBONDCHANGEACTIVE:
6b96018b 2971 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2972 return -EFAULT;
2973
2974 old_fs = get_fs();
c6d409cf 2975 set_fs(KERNEL_DS);
c3f52ae6 2976 err = dev_ioctl(net, cmd,
2977 (struct ifreq __user __force *) &kifr);
c6d409cf 2978 set_fs(old_fs);
7a229387
AB
2979
2980 return err;
2981 case SIOCBONDSLAVEINFOQUERY:
2982 case SIOCBONDINFOQUERY:
2983 uifr = compat_alloc_user_space(sizeof(*uifr));
2984 if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2985 return -EFAULT;
2986
2987 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2988 return -EFAULT;
2989
2990 datap = compat_ptr(data);
2991 if (put_user(datap, &uifr->ifr_ifru.ifru_data))
2992 return -EFAULT;
2993
6b96018b 2994 return dev_ioctl(net, cmd, uifr);
7a229387 2995 default:
07d106d0 2996 return -ENOIOCTLCMD;
ccbd6a5a 2997 }
7a229387
AB
2998}
2999
6b96018b
AB
3000static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
3001 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
3002{
3003 struct ifreq __user *u_ifreq64;
7a229387
AB
3004 char tmp_buf[IFNAMSIZ];
3005 void __user *data64;
3006 u32 data32;
3007
3008 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
3009 IFNAMSIZ))
3010 return -EFAULT;
3011 if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
3012 return -EFAULT;
3013 data64 = compat_ptr(data32);
3014
3015 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
3016
3017 /* Don't check these user accesses, just let that get trapped
3018 * in the ioctl handler instead.
3019 */
3020 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
3021 IFNAMSIZ))
3022 return -EFAULT;
3023 if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
3024 return -EFAULT;
3025
6b96018b 3026 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
3027}
3028
6b96018b
AB
3029static int dev_ifsioc(struct net *net, struct socket *sock,
3030 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 3031{
a2116ed2 3032 struct ifreq __user *uifr;
7a229387
AB
3033 int err;
3034
a2116ed2
AB
3035 uifr = compat_alloc_user_space(sizeof(*uifr));
3036 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3037 return -EFAULT;
3038
3039 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3040
7a229387
AB
3041 if (!err) {
3042 switch (cmd) {
3043 case SIOCGIFFLAGS:
3044 case SIOCGIFMETRIC:
3045 case SIOCGIFMTU:
3046 case SIOCGIFMEM:
3047 case SIOCGIFHWADDR:
3048 case SIOCGIFINDEX:
3049 case SIOCGIFADDR:
3050 case SIOCGIFBRDADDR:
3051 case SIOCGIFDSTADDR:
3052 case SIOCGIFNETMASK:
fab2532b 3053 case SIOCGIFPFLAGS:
7a229387 3054 case SIOCGIFTXQLEN:
fab2532b
AB
3055 case SIOCGMIIPHY:
3056 case SIOCGMIIREG:
a2116ed2 3057 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
3058 err = -EFAULT;
3059 break;
3060 }
3061 }
3062 return err;
3063}
3064
a2116ed2
AB
3065static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3066 struct compat_ifreq __user *uifr32)
3067{
3068 struct ifreq ifr;
3069 struct compat_ifmap __user *uifmap32;
3070 mm_segment_t old_fs;
3071 int err;
3072
3073 uifmap32 = &uifr32->ifr_ifru.ifru_map;
3074 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3075 err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3076 err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3077 err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3078 err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
3079 err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
3080 err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
3081 if (err)
3082 return -EFAULT;
3083
3084 old_fs = get_fs();
c6d409cf 3085 set_fs(KERNEL_DS);
c3f52ae6 3086 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3087 set_fs(old_fs);
a2116ed2
AB
3088
3089 if (cmd == SIOCGIFMAP && !err) {
3090 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3091 err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3092 err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3093 err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3094 err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
3095 err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
3096 err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
3097 if (err)
3098 err = -EFAULT;
3099 }
3100 return err;
3101}
3102
3103static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
3104{
3105 void __user *uptr;
3106 compat_uptr_t uptr32;
3107 struct ifreq __user *uifr;
3108
c6d409cf 3109 uifr = compat_alloc_user_space(sizeof(*uifr));
a2116ed2
AB
3110 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
3111 return -EFAULT;
3112
3113 if (get_user(uptr32, &uifr32->ifr_data))
3114 return -EFAULT;
3115
3116 uptr = compat_ptr(uptr32);
3117
3118 if (put_user(uptr, &uifr->ifr_data))
3119 return -EFAULT;
3120
3121 return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
3122}
3123
7a229387 3124struct rtentry32 {
c6d409cf 3125 u32 rt_pad1;
7a229387
AB
3126 struct sockaddr rt_dst; /* target address */
3127 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3128 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3129 unsigned short rt_flags;
3130 short rt_pad2;
3131 u32 rt_pad3;
3132 unsigned char rt_tos;
3133 unsigned char rt_class;
3134 short rt_pad4;
3135 short rt_metric; /* +1 for binary compatibility! */
7a229387 3136 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3137 u32 rt_mtu; /* per route MTU/Window */
3138 u32 rt_window; /* Window clamping */
7a229387
AB
3139 unsigned short rt_irtt; /* Initial RTT */
3140};
3141
3142struct in6_rtmsg32 {
3143 struct in6_addr rtmsg_dst;
3144 struct in6_addr rtmsg_src;
3145 struct in6_addr rtmsg_gateway;
3146 u32 rtmsg_type;
3147 u16 rtmsg_dst_len;
3148 u16 rtmsg_src_len;
3149 u32 rtmsg_metric;
3150 u32 rtmsg_info;
3151 u32 rtmsg_flags;
3152 s32 rtmsg_ifindex;
3153};
3154
6b96018b
AB
3155static int routing_ioctl(struct net *net, struct socket *sock,
3156 unsigned int cmd, void __user *argp)
7a229387
AB
3157{
3158 int ret;
3159 void *r = NULL;
3160 struct in6_rtmsg r6;
3161 struct rtentry r4;
3162 char devname[16];
3163 u32 rtdev;
3164 mm_segment_t old_fs = get_fs();
3165
6b96018b
AB
3166 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3167 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3168 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3169 3 * sizeof(struct in6_addr));
c6d409cf
ED
3170 ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3171 ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3172 ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3173 ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3174 ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3175 ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3176 ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3177
3178 r = (void *) &r6;
3179 } else { /* ipv4 */
6b96018b 3180 struct rtentry32 __user *ur4 = argp;
c6d409cf 3181 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3182 3 * sizeof(struct sockaddr));
c6d409cf
ED
3183 ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
3184 ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
3185 ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
3186 ret |= __get_user(r4.rt_window, &(ur4->rt_window));
3187 ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
3188 ret |= __get_user(rtdev, &(ur4->rt_dev));
7a229387 3189 if (rtdev) {
c6d409cf 3190 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3191 r4.rt_dev = (char __user __force *)devname;
3192 devname[15] = 0;
7a229387
AB
3193 } else
3194 r4.rt_dev = NULL;
3195
3196 r = (void *) &r4;
3197 }
3198
3199 if (ret) {
3200 ret = -EFAULT;
3201 goto out;
3202 }
3203
c6d409cf 3204 set_fs(KERNEL_DS);
6b96018b 3205 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3206 set_fs(old_fs);
7a229387
AB
3207
3208out:
7a229387
AB
3209 return ret;
3210}
3211
3212/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3213 * for some operations; this forces use of the newer bridge-utils that
25985edc 3214 * use compatible ioctls
7a229387 3215 */
6b96018b 3216static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3217{
6b96018b 3218 compat_ulong_t tmp;
7a229387 3219
6b96018b 3220 if (get_user(tmp, argp))
7a229387
AB
3221 return -EFAULT;
3222 if (tmp == BRCTL_GET_VERSION)
3223 return BRCTL_VERSION + 1;
3224 return -EINVAL;
3225}
3226
6b96018b
AB
3227static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3228 unsigned int cmd, unsigned long arg)
3229{
3230 void __user *argp = compat_ptr(arg);
3231 struct sock *sk = sock->sk;
3232 struct net *net = sock_net(sk);
7a229387 3233
6b96018b
AB
3234 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3235 return siocdevprivate_ioctl(net, cmd, argp);
3236
3237 switch (cmd) {
3238 case SIOCSIFBR:
3239 case SIOCGIFBR:
3240 return old_bridge_ioctl(argp);
3241 case SIOCGIFNAME:
3242 return dev_ifname32(net, argp);
3243 case SIOCGIFCONF:
3244 return dev_ifconf(net, argp);
3245 case SIOCETHTOOL:
3246 return ethtool_ioctl(net, argp);
7a50a240
AB
3247 case SIOCWANDEV:
3248 return compat_siocwandev(net, argp);
a2116ed2
AB
3249 case SIOCGIFMAP:
3250 case SIOCSIFMAP:
3251 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3252 case SIOCBONDENSLAVE:
3253 case SIOCBONDRELEASE:
3254 case SIOCBONDSETHWADDR:
3255 case SIOCBONDSLAVEINFOQUERY:
3256 case SIOCBONDINFOQUERY:
3257 case SIOCBONDCHANGEACTIVE:
3258 return bond_ioctl(net, cmd, argp);
3259 case SIOCADDRT:
3260 case SIOCDELRT:
3261 return routing_ioctl(net, sock, cmd, argp);
3262 case SIOCGSTAMP:
3263 return do_siocgstamp(net, sock, cmd, argp);
3264 case SIOCGSTAMPNS:
3265 return do_siocgstampns(net, sock, cmd, argp);
a2116ed2
AB
3266 case SIOCSHWTSTAMP:
3267 return compat_siocshwtstamp(net, argp);
6b96018b
AB
3268
3269 case FIOSETOWN:
3270 case SIOCSPGRP:
3271 case FIOGETOWN:
3272 case SIOCGPGRP:
3273 case SIOCBRADDBR:
3274 case SIOCBRDELBR:
3275 case SIOCGIFVLAN:
3276 case SIOCSIFVLAN:
3277 case SIOCADDDLCI:
3278 case SIOCDELDLCI:
3279 return sock_ioctl(file, cmd, arg);
3280
3281 case SIOCGIFFLAGS:
3282 case SIOCSIFFLAGS:
3283 case SIOCGIFMETRIC:
3284 case SIOCSIFMETRIC:
3285 case SIOCGIFMTU:
3286 case SIOCSIFMTU:
3287 case SIOCGIFMEM:
3288 case SIOCSIFMEM:
3289 case SIOCGIFHWADDR:
3290 case SIOCSIFHWADDR:
3291 case SIOCADDMULTI:
3292 case SIOCDELMULTI:
3293 case SIOCGIFINDEX:
6b96018b
AB
3294 case SIOCGIFADDR:
3295 case SIOCSIFADDR:
3296 case SIOCSIFHWBROADCAST:
6b96018b 3297 case SIOCDIFADDR:
6b96018b
AB
3298 case SIOCGIFBRDADDR:
3299 case SIOCSIFBRDADDR:
3300 case SIOCGIFDSTADDR:
3301 case SIOCSIFDSTADDR:
3302 case SIOCGIFNETMASK:
3303 case SIOCSIFNETMASK:
3304 case SIOCSIFPFLAGS:
3305 case SIOCGIFPFLAGS:
3306 case SIOCGIFTXQLEN:
3307 case SIOCSIFTXQLEN:
3308 case SIOCBRADDIF:
3309 case SIOCBRDELIF:
9177efd3
AB
3310 case SIOCSIFNAME:
3311 case SIOCGMIIPHY:
3312 case SIOCGMIIREG:
3313 case SIOCSMIIREG:
6b96018b 3314 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3315
6b96018b
AB
3316 case SIOCSARP:
3317 case SIOCGARP:
3318 case SIOCDARP:
6b96018b 3319 case SIOCATMARK:
9177efd3
AB
3320 return sock_do_ioctl(net, sock, cmd, arg);
3321 }
3322
6b96018b
AB
3323 return -ENOIOCTLCMD;
3324}
7a229387 3325
95c96174 3326static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3327 unsigned long arg)
89bbfc95
SP
3328{
3329 struct socket *sock = file->private_data;
3330 int ret = -ENOIOCTLCMD;
87de87d5
DM
3331 struct sock *sk;
3332 struct net *net;
3333
3334 sk = sock->sk;
3335 net = sock_net(sk);
89bbfc95
SP
3336
3337 if (sock->ops->compat_ioctl)
3338 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3339
87de87d5
DM
3340 if (ret == -ENOIOCTLCMD &&
3341 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3342 ret = compat_wext_handle_ioctl(net, cmd, arg);
3343
6b96018b
AB
3344 if (ret == -ENOIOCTLCMD)
3345 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3346
89bbfc95
SP
3347 return ret;
3348}
3349#endif
3350
ac5a488e
SS
3351int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3352{
3353 return sock->ops->bind(sock, addr, addrlen);
3354}
c6d409cf 3355EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3356
3357int kernel_listen(struct socket *sock, int backlog)
3358{
3359 return sock->ops->listen(sock, backlog);
3360}
c6d409cf 3361EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3362
3363int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3364{
3365 struct sock *sk = sock->sk;
3366 int err;
3367
3368 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3369 newsock);
3370 if (err < 0)
3371 goto done;
3372
3373 err = sock->ops->accept(sock, *newsock, flags);
3374 if (err < 0) {
3375 sock_release(*newsock);
fa8705b0 3376 *newsock = NULL;
ac5a488e
SS
3377 goto done;
3378 }
3379
3380 (*newsock)->ops = sock->ops;
1b08534e 3381 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3382
3383done:
3384 return err;
3385}
c6d409cf 3386EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3387
3388int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3389 int flags)
ac5a488e
SS
3390{
3391 return sock->ops->connect(sock, addr, addrlen, flags);
3392}
c6d409cf 3393EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3394
3395int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3396 int *addrlen)
3397{
3398 return sock->ops->getname(sock, addr, addrlen, 0);
3399}
c6d409cf 3400EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3401
3402int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3403 int *addrlen)
3404{
3405 return sock->ops->getname(sock, addr, addrlen, 1);
3406}
c6d409cf 3407EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3408
3409int kernel_getsockopt(struct socket *sock, int level, int optname,
3410 char *optval, int *optlen)
3411{
3412 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3413 char __user *uoptval;
3414 int __user *uoptlen;
ac5a488e
SS
3415 int err;
3416
fb8621bb
NK
3417 uoptval = (char __user __force *) optval;
3418 uoptlen = (int __user __force *) optlen;
3419
ac5a488e
SS
3420 set_fs(KERNEL_DS);
3421 if (level == SOL_SOCKET)
fb8621bb 3422 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3423 else
fb8621bb
NK
3424 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3425 uoptlen);
ac5a488e
SS
3426 set_fs(oldfs);
3427 return err;
3428}
c6d409cf 3429EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3430
3431int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3432 char *optval, unsigned int optlen)
ac5a488e
SS
3433{
3434 mm_segment_t oldfs = get_fs();
fb8621bb 3435 char __user *uoptval;
ac5a488e
SS
3436 int err;
3437
fb8621bb
NK
3438 uoptval = (char __user __force *) optval;
3439
ac5a488e
SS
3440 set_fs(KERNEL_DS);
3441 if (level == SOL_SOCKET)
fb8621bb 3442 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3443 else
fb8621bb 3444 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3445 optlen);
3446 set_fs(oldfs);
3447 return err;
3448}
c6d409cf 3449EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3450
3451int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3452 size_t size, int flags)
3453{
3454 if (sock->ops->sendpage)
3455 return sock->ops->sendpage(sock, page, offset, size, flags);
3456
3457 return sock_no_sendpage(sock, page, offset, size, flags);
3458}
c6d409cf 3459EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3460
3461int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3462{
3463 mm_segment_t oldfs = get_fs();
3464 int err;
3465
3466 set_fs(KERNEL_DS);
3467 err = sock->ops->ioctl(sock, cmd, arg);
3468 set_fs(oldfs);
3469
3470 return err;
3471}
c6d409cf 3472EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3473
91cf45f0
TM
3474int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3475{
3476 return sock->ops->shutdown(sock, how);
3477}
91cf45f0 3478EXPORT_SYMBOL(kernel_sock_shutdown);